fix: rotate of HSM wrapping key id

Author: Manuthor

crate/hsm/base_hsm/src/session/session_impl.rs

@@ -1892,9 +1892,10 @@ impl Session {
         // Format: "rotate_name::generation::key_id[@latest]"
         //
         // `rotate_name` may itself contain "::" — for HSM-resident keys the convention is
-        // rotate_name = "hsm::<slot>::<key_id>" (the full base UID), which is unique across
-        // slots.  Split from the RIGHT so the variable-length rotate_name is always the
-        // residual left segment, regardless of how many "::" it contains.
+        // rotate_name = "hsm::<model>::<slot>::<key_id>" (the full base UID, including the
+        // model segment), which is unique across slots.  Split from the RIGHT so the
+        // variable-length rotate_name is always the residual left segment, regardless of
+        // how many "::" it contains.
         //
         // rsplitn(3, "::") yields (from right to left):
         //   index 0 → key_id[@latest]

crate/server/src/core/operations/attributes/get.rs

@@ -510,9 +510,11 @@ pub(crate) async fn get_attributes(
                     res.state = attributes.state;
                 }
                 Tag::UniqueIdentifier => {
-                    attributes
-                        .unique_identifier
-                        .clone_into(&mut res.unique_identifier);
+                    // Always authoritative: use the stored object UID from the database row
+                    // rather than the embedded attribute value. The embedded value may be a
+                    // stale random UUID for re-keyed objects created before the `finalize`
+                    // fix stamped the correct new UID into the key material attributes.
+                    res.unique_identifier = Some(UniqueIdentifier::TextString(owm.id().to_owned()));
                 }
                 Tag::ShortUniqueIdentifier => {
                     // Ensure presence: if absent, return an empty string

crate/server/src/core/operations/rekey/common.rs

@@ -240,7 +240,7 @@ impl KMS {
     }
 
     /// Re-wrap all keys that were wrapped by the old wrapping key.
-    async fn rewrap_dependants(
+    pub(crate) async fn rewrap_dependants(
         &self,
         owner: &str,
         old_uid: &str,
@@ -408,6 +408,15 @@ impl ReplacementObject {
             old_uid,
             paired_key,
         )?;
+        // Stamp the embedded attributes with the correct UID.
+        // `create_symmetric_key_kmip_object` always assigns a random UUID to
+        // `attributes.unique_identifier`; replace it with `new_uid` so that
+        // GetAttributes always returns a `unique_identifier` that matches the
+        // object's actual stored UID.
+        if let Ok(embedded_attrs) = self.object.attributes_mut() {
+            embedded_attrs.unique_identifier =
+                Some(UniqueIdentifier::TextString(self.new_uid.clone()));
+        }
         let attrs = self.object.attributes().cloned().unwrap_or_default();
         self.tags = attrs.get_tags(vendor_id);
         self.attributes = attrs;

crate/server/src/core/operations/rekey/symmetric/hsm.rs

@@ -5,8 +5,11 @@
 //! on the same HSM slot (via `C_GenerateKey`), assigns a generation-suffixed UID, and
 //! updates `CKA_LABEL` / `CKA_START_DATE` / `CKA_END_DATE` on both old and new keys.
 
-use cosmian_kms_server_database::reexport::cosmian_kmip::kmip_2_1::{
-    kmip_objects::ObjectType, kmip_operations::ReKeyResponse, kmip_types::UniqueIdentifier,
+use cosmian_kms_server_database::reexport::{
+    cosmian_kmip::kmip_2_1::{
+        kmip_objects::ObjectType, kmip_operations::ReKeyResponse, kmip_types::UniqueIdentifier,
+    },
+    cosmian_kms_interfaces::AtomicOperation,
 };
 use cosmian_logger::trace;
 use time::OffsetDateTime;
@@ -263,6 +266,18 @@ impl KMS {
 
         trace!("HSM ReKey: old={uid} → new={new_uid} (slot={slot_id}, gen={new_gen}), user={user}");
 
+        // Re-wrap any DB keys that were wrapped by the old HSM key, so that
+        // they remain accessible under the new generation without requiring
+        // the caller to keep the old HSM key alive.
+        let mut operations: Vec<AtomicOperation> = Vec::new();
+        Box::pin(self.rewrap_dependants(user, uid, &new_uid, &mut operations)).await?;
+        if !operations.is_empty() {
+            self.database
+                .atomic(user, &operations)
+                .await
+                .map_err(KmsError::Database)?;
+        }
+
         Ok(ReKeyResponse {
             unique_identifier: UniqueIdentifier::TextString(new_uid),
         })

crate/server/src/core/operations/rekey/symmetric/mod.rs

@@ -52,7 +52,7 @@ pub(crate) async fn rekey(kms: &KMS, request: ReKey, owner: &str) -> KResult<ReK
     // The general RekeyOperation pipeline is designed for SQL-backed keys and
     // is not applicable to non-extractable HSM key material.
     if has_prefix(&uid).is_some() {
-        return kms.rekey_hsm_symmetric(&uid, owner).await;
+        return Box::pin(kms.rekey_hsm_symmetric(&uid, owner)).await;
     }
 
     let request = ReKey {