kcenon::logger::security::secure_key_storage Class Reference

Secure storage and retrieval of encryption keys. More...

#include <secure_key_storage.h>

Collaboration diagram for kcenon::logger::security::secure_key_storage:

Static Public Member Functions
static result< secure_key >	generate_key (size_t size=32)
	Generate a secure random key.
static common::VoidResult	save_key (const secure_key &key, const std::filesystem::path &path, const std::filesystem::path &allowed_base="/var/log/keys")
	Save key to file with secure permissions.
static result< secure_key >	load_key (const std::filesystem::path &path, size_t expected_size=32, const std::filesystem::path &allowed_base="/var/log/keys")
	Load key from file with permission verification.

Static Private Member Functions
static common::VoidResult	validate_key_path (const std::filesystem::path &path, const std::filesystem::path &allowed_base)
	Validate key file path (prevent path traversal)

Detailed Description

Secure storage and retrieval of encryption keys.

Security features:

• File permission verification (0600)
• Path traversal prevention
• Secure random generation
• Memory cleanup after use

Definition at line 141 of file secure_key_storage.h.

Member Function Documentation

generate_key()

static result< secure_key > kcenon::logger::security::secure_key_storage::generate_key ( size_t size = 32 )

inlinestatic

Generate a secure random key.

Parameters

size	Key size in bytes (default: 32 for AES-256)

Returns

Result containing the generated key or error

Definition at line 148 of file secure_key_storage.h.

                                                             {
        secure_key key(size);
 
#ifdef HAS_OPENSSL
        // Use OpenSSL's cryptographically secure random generator
        if (RAND_bytes(key.mutable_data().data(), size) != 1) {
            return result<secure_key>{
                logger_error_code::encryption_failed,
                "Failed to generate secure random key"};
        }
#else
        // Fallback: use std::random_device (less secure on some platforms)
        std::random_device rd;
        for (size_t i = 0; i < size; ++i) {
            key.mutable_data()[i] = static_cast<uint8_t>(rd() & 0xFF);
        }
#endif
 
        return result<secure_key>(std::move(key));
    }

References kcenon::logger::encryption_failed, kcenon::logger::security::secure_key::mutable_data(), and kcenon::logger::size.

Here is the call graph for this function:

load_key()

static result< secure_key > kcenon::logger::security::secure_key_storage::load_key ( const std::filesystem::path & path, size_t expected_size = 32, const std::filesystem::path & allowed_base = "/var/log/keys" )

inlinestatic

Load key from file with permission verification.

Parameters

path	File path
expected_size	Expected key size (default: 32 for AES-256)
allowed_base	Base directory for key storage

Returns

Result containing the loaded key or error

Definition at line 250 of file secure_key_storage.h.

      {
        // 1. Validate path
        auto validation = validate_key_path(path, allowed_base);
        if (validation.is_err()) {
            return result<secure_key>{
                get_logger_error_code(validation),
                get_logger_error_message(validation)};
        }
 
        // 2. Check if file exists
        if (!std::filesystem::exists(path)) {
            return result<secure_key>{
                logger_error_code::file_open_failed,
                "Key file does not exist"};
        }
 
        // 3. Verify file permissions (must not be readable by group/others)
        try {
            auto status = std::filesystem::status(path);
            auto perms = status.permissions();
 
            if ((perms & std::filesystem::perms::group_read) != std::filesystem::perms::none ||
                (perms & std::filesystem::perms::others_read) != std::filesystem::perms::none) {
                return result<secure_key>{
                    logger_error_code::insecure_permissions,
                    "Key file permissions are too permissive (must be 0600 or stricter)"};
            }
        } catch (const std::filesystem::filesystem_error& e) {
            return result<secure_key>{
                logger_error_code::file_permission_denied,
                std::string("Failed to check file permissions: ") + e.what()};
        }
 
        // 4. Verify file size
        size_t file_size = 0;
        try {
            file_size = std::filesystem::file_size(path);
        } catch (const std::filesystem::filesystem_error& e) {
            return result<secure_key>{
                logger_error_code::file_read_failed,
                std::string("Failed to get file size: ") + e.what()};
        }
 
        if (file_size != expected_size) {
            return result<secure_key>{
                logger_error_code::invalid_key_size,
                "Invalid key file size (expected " + std::to_string(expected_size) +
                " bytes, got " + std::to_string(file_size) + ")"};
        }
 
        // 5. Read key from file
        std::ifstream file(path, std::ios::binary);
        if (!file) {
            return result<secure_key>{
                logger_error_code::file_open_failed,
                "Failed to open key file for reading"};
        }
 
        secure_key key(expected_size);
        file.read(
            reinterpret_cast<char*>(key.mutable_data().data()),
            expected_size
        );
 
        if (file.fail()) {
            return result<secure_key>{
                logger_error_code::file_read_failed,
                "Failed to read key data"};
        }
 
        return result<secure_key>(std::move(key));
    }

References kcenon::logger::file_open_failed, kcenon::logger::file_permission_denied, kcenon::logger::file_read_failed, kcenon::logger::get_logger_error_code(), kcenon::logger::get_logger_error_message(), kcenon::logger::insecure_permissions, kcenon::logger::invalid_key_size, kcenon::logger::security::secure_key::mutable_data(), and validate_key_path().

Here is the call graph for this function:

save_key()

static common::VoidResult kcenon::logger::security::secure_key_storage::save_key ( const secure_key & key, const std::filesystem::path & path, const std::filesystem::path & allowed_base = "/var/log/keys" )

inlinestatic

Save key to file with secure permissions.

Parameters

key	The key to save
path	File path (must be in allowed directory)
allowed_base	Base directory for key storage

Returns

Success or error

Definition at line 176 of file secure_key_storage.h.

      {
        // 1. Validate path
        auto validation = validate_key_path(path, allowed_base);
        if (validation.is_err()) {
            return validation;
        }
 
        // 2. Ensure parent directory exists
        try {
            auto parent = path.parent_path();
            if (!parent.empty() && !std::filesystem::exists(parent)) {
                std::filesystem::create_directories(parent);
            }
        } catch (const std::filesystem::filesystem_error& e) {
            return make_logger_void_result(
                logger_error_code::file_write_failed,
                std::string("Failed to create key directory: ") + e.what()
            );
        }
 
        // 3. Write key to file
        std::ofstream file(path, std::ios::binary | std::ios::trunc);
        if (!file) {
            return make_logger_void_result(
                logger_error_code::file_write_failed,
                "Failed to open key file for writing"
            );
        }
 
        file.write(
            reinterpret_cast<const char*>(key.data().data()),
            key.size()
        );
 
        if (file.fail()) {
            return make_logger_void_result(
                logger_error_code::file_write_failed,
                "Failed to write key data"
            );
        }
 
        file.close();
 
        // 4. Set secure file permissions (0600 = owner read/write only)
        try {
            std::filesystem::permissions(
                path,
                std::filesystem::perms::owner_read |
                std::filesystem::perms::owner_write,
                std::filesystem::perm_options::replace
            );
        } catch (const std::filesystem::filesystem_error& e) {
            // Permission setting failed, delete the insecure file
            std::filesystem::remove(path);
            return make_logger_void_result(
                logger_error_code::file_permission_denied,
                std::string("Failed to set secure permissions: ") + e.what()
            );
        }
 
        return common::ok();
    }

References kcenon::logger::security::secure_key::data(), kcenon::logger::file_permission_denied, kcenon::logger::file_write_failed, kcenon::logger::make_logger_void_result(), kcenon::common::ok(), kcenon::logger::security::secure_key::size(), and validate_key_path().

Here is the call graph for this function:

validate_key_path()

static common::VoidResult kcenon::logger::security::secure_key_storage::validate_key_path ( const std::filesystem::path & path, const std::filesystem::path & allowed_base )

inlinestaticprivate

Validate key file path (prevent path traversal)

Parameters

path	Path to validate
allowed_base	Base directory that path must be within

Returns

Success or error

Definition at line 334 of file secure_key_storage.h.

      {
        try {
            // Convert both paths to absolute canonical form
            auto canonical_path = std::filesystem::weakly_canonical(path);
            auto canonical_base = std::filesystem::weakly_canonical(allowed_base);
 
            // Check if path starts with allowed_base
            auto [mismatch_iter, _] = std::mismatch(
                canonical_base.begin(), canonical_base.end(),
                canonical_path.begin(), canonical_path.end()
            );
 
            if (mismatch_iter != canonical_base.end()) {
                return make_logger_void_result(
                    logger_error_code::path_traversal_detected,
                    "Key path must be within allowed directory: " +
                    canonical_base.string()
                );
            }
 
            return common::ok();
        } catch (const std::filesystem::filesystem_error& e) {
            return make_logger_void_result(
                logger_error_code::path_traversal_detected,
                std::string("Path validation failed: ") + e.what()
            );
        }
    }

References kcenon::logger::make_logger_void_result(), kcenon::common::ok(), and kcenon::logger::path_traversal_detected.

Referenced by load_key(), and save_key().

Here is the call graph for this function:

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• include/kcenon/logger/security/secure_key_storage.h