feat: Key-Set@Version + Server-Side Decrypt-With-Keyset

Author: Manuthor

CHANGELOG/docs_key-autorotation-spec.md

@@ -8,12 +8,24 @@
 - Introduce `RekeyOperation` trait to unify symmetric, keypair, and certificate rotation logic ([#968](https://github.com/Cosmian/kms/pull/968))
 - Add `offset` field to `ReCertify` struct per KMIP 2.1 §6.1.45 for date-based activation scheduling ([#968](https://github.com/Cosmian/kms/pull/968))
 - Implement KMIP §4.57 transition 6 auto-deactivation: Active keys automatically transition to Deactivated when their DeactivationDate is reached ([#968](https://github.com/Cosmian/kms/pull/968))
+- Implement keyset resolution: `name@latest`, `name@first`, `name@N` syntax to address specific key generations by `rotate_name` ([#968](https://github.com/Cosmian/kms/pull/968))
+- Implement try-each-key decryption: Decrypt, SignatureVerify, and MACVerify operations with a bare keyset name walk the rotation chain (newest→oldest) until one key succeeds ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add `--keyset-decrypt-max-attempts` server config flag (default: 100) to cap rotation chain traversal depth ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add `find_by_rotate_name()` to `ObjectsStore` trait with SQLite, PostgreSQL, and MySQL implementations for keyset lookup ([#968](https://github.com/Cosmian/kms/pull/968))
+- Inherit `rotate_name` from old key to new key during ReKey so keyset resolution works across generations ([#968](https://github.com/Cosmian/kms/pull/968))
+- Implement `ckms sym keys set-rotation-policy` CLI command with `--interval`, `--offset`, `--rotation-name` flags ([#968](https://github.com/Cosmian/kms/pull/968))
+- Implement `ckms sym keys get-rotation-policy` CLI command to display interval, offset, keyset name, generation, and last rotation date ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add Web UI components for Set Rotation Policy, Get Rotation Policy, and Re-Key under Symmetric Keys ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add HSM keyset support: store keyset metadata in `CKA_LABEL` (`name::gen::base_id[::latest]`); `SetAttribute rotate_name` writes `CKA_LABEL`; `SetAttribute rotate_interval` writes `CKA_START_DATE`/`CKA_END_DATE`; `Re-Key` on HSM UIDs generates a new HSM key and updates both CKA_LABELs; keyset resolution via `find_by_rotate_name` enumerates PKCS#11 objects and sorts by generation ([#968](https://github.com/Cosmian/kms/pull/968))
+- Enrich `HsmStore::retrieve()` export path with CKA_LABEL keyset metadata (`rotate_name`, `rotate_generation`, `rotate_latest`) so the non-latest guard works for extractable HSM keys ([#968](https://github.com/Cosmian/kms/pull/968))
 
 ## Security
 
 - Mark `x-rotate-generation` and `x-rotate-date` as server-managed read-only attributes: reject user modifications via AddAttribute, SetAttribute, ModifyAttribute, and DeleteAttribute ([#968](https://github.com/Cosmian/kms/pull/968))
-- Reject `Re-Key` and `Re-Key Key Pair` on HSM-managed keys (`hsm::` UID prefix) with an explicit `Not Supported` error instead of silently failing deep in the pipeline ([#968](https://github.com/Cosmian/kms/pull/968))
+- Guard `Re-Key` / `Re-Key Key Pair` to reject rotation of non-latest keyset members (`x-rotate-latest = false` and `x-rotate-name` set) with a clear error; keys without a keyset name are unaffected ([#968](https://github.com/Cosmian/kms/pull/968))
+- Reject `SetAttribute rotate_offset` on HSM keys with `NotSupported` — HSM rotation scheduling uses `CKA_START_DATE`/`CKA_END_DATE`, not SQL-managed offset windows ([#968](https://github.com/Cosmian/kms/pull/968))
 - Restrict rotation to Active or Deactivated keys: `Re-Key`, `Re-Key Key Pair`, and `ReCertify` now reject PreActive, Compromised, Destroyed, and Destroyed_Compromised objects with an explicit error (KMIP §6.1.46 does not list `Wrong_Key_Lifecycle_State` for Re-Key) ([#968](https://github.com/Cosmian/kms/pull/968))
+- Reject `@` character in `rotate_name` attribute values to prevent keyset versioning syntax injection ([#968](https://github.com/Cosmian/kms/pull/968))
 
 ## Bug Fixes
 
@@ -33,6 +45,9 @@
 - Fix symmetric rekey hardcoding `State::Active` — now uses `setup_object_lifecycle` for date-based state computation ([#968](https://github.com/Cosmian/kms/pull/968))
 - Fix `setup_object_lifecycle` not storing `activation_date` for `PreActive` keys — offset-based activation scheduling now works correctly ([#968](https://github.com/Cosmian/kms/pull/968))
 - Add `ReCertify` request/response deserialization to KMIP 2.1 message handler ([#968](https://github.com/Cosmian/kms/pull/968))
+- Fix `find_by_rotate_name` SQL queries using wrong JSON path (`$.rotate_name` → `$.RotateName`) matching PascalCase serde serialization ([#968](https://github.com/Cosmian/kms/pull/968))
+- Fix `GetAttributes` not returning rotation policy fields (interval, offset, name, generation, date) because they lack `Tag` enum entries ([#968](https://github.com/Cosmian/kms/pull/968))
+- Implement `find_by_rotate_name()` on Redis-Findex backend and index `rotate_name` attribute in Findex keywords ([#968](https://github.com/Cosmian/kms/pull/968))
 - Fix `ReCertify.generate_replacement` passing empty user to `get_subject`/`get_issuer` — use certificate owner instead ([#968](https://github.com/Cosmian/kms/pull/968))
 - Fix `ReCertify` not computing lifecycle state from offset — certificates with future activation_date are now `PreActive` ([#968](https://github.com/Cosmian/kms/pull/968))
 
@@ -71,6 +86,9 @@
 - Add 3 negative ReCertify test vectors (missing UID, non-existent, not a certificate) ([#968](https://github.com/Cosmian/kms/pull/968))
 - Add 2 offset state verification vectors (rekey + rekey-keypair: Offset=0 → Active, Offset=86400 → PreActive) ([#968](https://github.com/Cosmian/kms/pull/968))
 - Add 2 negative state restriction vectors: `rekey_preactive_fails`, `rekey_keypair_preactive_fails` ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add 7 keyset resolution test vectors: `keyset_encrypt_latest`, `keyset_encrypt_bare_name`, `keyset_encrypt_latest_after_rotation`, `keyset_decrypt_try_each`, `keyset_decrypt_double_rotation`, `keyset_decrypt_at_latest`, `keyset_rotate_name_at_rejected` ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add HSM keyset support: `find_due_for_rotation` on HsmStore reads `CKA_START_DATE`/`CKA_END_DATE`; keyset metadata stored in `CKA_LABEL` (`name::gen::key_id[::latest]`); `SetAttribute rotate_name` writes `CKA_LABEL` via `C_SetAttributeValue`; `SetAttribute rotate_interval` writes `CKA_START_DATE`/`CKA_END_DATE`; `Re-Key` on HSM UIDs generates a new HSM key and updates both CKA_LABELs; `walk_keyset_chain` resolves HSM keysets by `CKA_LABEL` without `ReplacedObjectLink` ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add 3 HSM keyset test vectors: `resident_keyset_set_rotate_name`, `resident_keyset_rekey_and_decrypt`, `resident_keyset_double_rotation` + 1 negative: `hsm_rotate_offset_rejected` ([#968](https://github.com/Cosmian/kms/pull/968))
 
 ## Documentation
 
@@ -81,6 +99,7 @@
 - Correct HSM key rotation section: the KMS cannot use KMIP `Re-Key` on
   HSM-managed keys (no SQL attribute storage, non-extractable key material);
   use PKCS#11 vendor tools instead ([#968](https://github.com/Cosmian/kms/pull/968))
+- Add HSM keyset section to `key_auto_rotation.md`: CKA_LABEL convention, UID generation format, supported/unsupported attributes, example workflow, and keyset resolution description ([#968](https://github.com/Cosmian/kms/pull/968))
 - Document `x-rotate-generation` and `x-rotate-date` invariants: monotonically
   increasing counter unique within a key-set, authoritative last-rotation
   timestamp relied on by `is_due_for_rotation` ([#968](https://github.com/Cosmian/kms/pull/968))

Cargo.lock

@@ -1,5 +1,6 @@
 pub(crate) mod create_key;
 pub(crate) mod encrypt_decrypt;
 pub(crate) mod rekey;
+pub(crate) mod rotation_policy;
 
 pub(crate) const SUB_COMMAND: &str = "sym";

crate/clients/ckms/src/tests/symmetric/mod.rs

@@ -0,0 +1,125 @@
+use test_kms_server::start_default_test_kms_server;
+
+use crate::{
+    error::result::CosmianResult,
+    tests::{
+        symmetric::create_key::create_symmetric_key,
+        utils::{owner_config, run_ckms, run_ckms_expect_error},
+    },
+};
+
+/// Set the rotation policy for a symmetric key via the CLI.
+pub(crate) fn set_rotation_policy(
+    cli_conf_path: &str,
+    key_id: &str,
+    interval: i64,
+    offset: Option<i64>,
+    rotate_name: Option<&str>,
+) -> CosmianResult<String> {
+    let mut args = vec!["sym", "keys", "set-rotation-policy", "--key-id", key_id];
+    let interval_str = interval.to_string();
+    args.extend(["--interval", &interval_str]);
+    let offset_str;
+    if let Some(o) = offset {
+        offset_str = o.to_string();
+        args.extend(["--offset", &offset_str]);
+    }
+    if let Some(name) = rotate_name {
+        args.extend(["--rotation-name", name]);
+    }
+    run_ckms(cli_conf_path, &args)
+}
+
+/// Get the rotation policy for a symmetric key via the CLI.
+pub(crate) fn get_rotation_policy(cli_conf_path: &str, key_id: &str) -> CosmianResult<String> {
+    let args = vec!["sym", "keys", "get-rotation-policy", "--key-id", key_id];
+    run_ckms(cli_conf_path, &args)
+}
+
+#[tokio::test]
+pub(crate) async fn test_set_and_get_rotation_policy() -> CosmianResult<()> {
+    let ctx = start_default_test_kms_server().await;
+    let owner_client_conf_path = owner_config(ctx);
+
+    // Create a symmetric key
+    let key_id = create_symmetric_key(&owner_client_conf_path, &["--number-of-bits", "256"])?;
+
+    // Set rotation policy with interval, offset, and name
+    let output = set_rotation_policy(
+        &owner_client_conf_path,
+        &key_id,
+        86400,
+        Some(3600),
+        Some("test-keyset"),
+    )?;
+    assert!(output.contains("Rotation policy set successfully"));
+
+    // Get rotation policy and verify
+    let output = get_rotation_policy(&owner_client_conf_path, &key_id)?;
+    assert!(
+        output.contains("86400"),
+        "expected interval=86400 in: {output}"
+    );
+    assert!(output.contains("3600"), "expected offset=3600 in: {output}");
+    assert!(
+        output.contains("test-keyset"),
+        "expected name=test-keyset in: {output}"
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+pub(crate) async fn test_set_rotation_policy_name_rejects_at() -> CosmianResult<()> {
+    let ctx = start_default_test_kms_server().await;
+    let owner_client_conf_path = owner_config(ctx);
+
+    // Create a symmetric key
+    let key_id = create_symmetric_key(&owner_client_conf_path, &["--number-of-bits", "256"])?;
+
+    // Try to set rotation policy with a name containing '@' — should fail
+    let args = vec![
+        "sym",
+        "keys",
+        "set-rotation-policy",
+        "--key-id",
+        &key_id,
+        "--interval",
+        "86400",
+        "--rotation-name",
+        "bad@name",
+    ];
+    let stderr = run_ckms_expect_error(&owner_client_conf_path, &args)?;
+    assert!(
+        stderr.contains('@'),
+        "expected error mentioning '@' in: {stderr}"
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+pub(crate) async fn test_set_rotation_policy_interval_only() -> CosmianResult<()> {
+    let ctx = start_default_test_kms_server().await;
+    let owner_client_conf_path = owner_config(ctx);
+
+    // Create a symmetric key
+    let key_id = create_symmetric_key(&owner_client_conf_path, &["--number-of-bits", "256"])?;
+
+    // Set rotation policy with interval only (no offset, no name)
+    let output = set_rotation_policy(&owner_client_conf_path, &key_id, 43200, None, None)?;
+    assert!(output.contains("Rotation policy set successfully"));
+
+    // Get rotation policy and verify
+    let output = get_rotation_policy(&owner_client_conf_path, &key_id)?;
+    assert!(
+        output.contains("43200"),
+        "expected interval=43200 in: {output}"
+    );
+    assert!(
+        output.contains("not set") || !output.contains("offset"),
+        "expected no offset set"
+    );
+
+    Ok(())
+}

crate/clients/ckms/src/tests/symmetric/rotation_policy.rs

@@ -1,9 +1,17 @@
 use clap::Parser;
-use cosmian_kms_client::KmsClient;
+use cosmian_kms_client::{
+    KmsClient,
+    kmip_2_1::{kmip_operations::GetAttributes, kmip_types::UniqueIdentifier},
+};
 
-use crate::error::result::KmsCliResult;
+use crate::{
+    actions::console,
+    error::result::{KmsCliResult, KmsCliResultHelper},
+};
 
 /// Get the automatic rotation policy for a symmetric key.
+///
+/// Displays: rotation interval, offset, keyset name, generation, and last rotation date.
 #[derive(Parser, Debug)]
 #[clap(verbatim_doc_comment)]
 pub struct GetRotationPolicyAction {
@@ -13,9 +21,45 @@ pub struct GetRotationPolicyAction {
 }
 
 impl GetRotationPolicyAction {
-    #[allow(clippy::unused_async)]
-    pub async fn run(&self, _kms_rest_client: KmsClient) -> KmsCliResult<()> {
-        // TODO: implement KMIP Get Attributes call to retrieve rotation policy
+    pub async fn run(&self, kms_rest_client: KmsClient) -> KmsCliResult<()> {
+        let uid = UniqueIdentifier::TextString(self.key_id.clone());
+
+        let response = kms_rest_client
+            .get_attributes(GetAttributes {
+                unique_identifier: Some(uid),
+                attribute_reference: None,
+            })
+            .await
+            .with_context(|| "failed retrieving attributes")?;
+
+        let attrs = &response.attributes;
+
+        let interval = attrs
+            .rotate_interval
+            .map_or_else(|| "not set".to_owned(), |v| v.to_string());
+        let offset = attrs
+            .rotate_offset
+            .map_or_else(|| "not set".to_owned(), |v| v.to_string());
+        let name = attrs.rotate_name.as_deref().unwrap_or("not set");
+        let generation = attrs
+            .rotate_generation
+            .map_or_else(|| "not set".to_owned(), |v| v.to_string());
+        let date = attrs
+            .rotate_date
+            .map_or_else(|| "never".to_owned(), |d| d.to_string());
+
+        let output = format!(
+            "Rotation policy for key: {}\n\
+             \x20 Interval (seconds): {interval}\n\
+             \x20 Offset (seconds):   {offset}\n\
+             \x20 Keyset name:        {name}\n\
+             \x20 Generation:         {generation}\n\
+             \x20 Last rotation date: {date}",
+            response.unique_identifier
+        );
+
+        console::Stdout::new(&output).write()?;
+
         Ok(())
     }
 }

crate/clients/clap/src/actions/symmetric/keys/get_rotation_policy.rs

@@ -1,9 +1,22 @@
 use clap::Parser;
-use cosmian_kms_client::KmsClient;
+use cosmian_kms_client::{
+    KmsClient,
+    kmip_2_1::{
+        kmip_attributes::Attribute, kmip_operations::SetAttribute, kmip_types::UniqueIdentifier,
+    },
+};
 
-use crate::error::result::KmsCliResult;
+use crate::{
+    actions::console,
+    error::result::{KmsCliResult, KmsCliResultHelper},
+};
 
 /// Set the automatic rotation policy for a symmetric key.
+///
+/// This configures:
+///  - The rotation interval (how often the key is automatically re-keyed)
+///  - An optional offset (delay before first rotation)
+///  - An optional keyset name (for addressing key generations via name@version syntax)
 #[derive(Parser, Debug)]
 #[clap(verbatim_doc_comment)]
 pub struct SetRotationPolicyAction {
@@ -18,12 +31,52 @@ pub struct SetRotationPolicyAction {
     /// Offset in seconds from the initial date before the first rotation occurs.
     #[clap(long = "offset", short = 'o')]
     offset_secs: Option<i64>,
+
+    /// A keyset name for addressing key generations via name@latest, name@first, name@N syntax.
+    /// Must not contain the '@' character.
+    #[clap(long = "rotation-name", short = 'n')]
+    rotate_name: Option<String>,
 }
 
 impl SetRotationPolicyAction {
-    #[allow(clippy::unused_async)]
-    pub async fn run(&self, _kms_rest_client: KmsClient) -> KmsCliResult<()> {
-        // TODO: implement KMIP Modify Attribute call to set rotation policy
+    pub async fn run(&self, kms_rest_client: KmsClient) -> KmsCliResult<()> {
+        let uid = UniqueIdentifier::TextString(self.key_id.clone());
+
+        // Set the rotation interval
+        kms_rest_client
+            .set_attribute(SetAttribute {
+                unique_identifier: Some(uid.clone()),
+                new_attribute: Attribute::RotateInterval(self.interval_secs),
+            })
+            .await
+            .with_context(|| "failed setting RotateInterval attribute")?;
+
+        // Set the rotation offset if provided
+        if let Some(offset) = self.offset_secs {
+            kms_rest_client
+                .set_attribute(SetAttribute {
+                    unique_identifier: Some(uid.clone()),
+                    new_attribute: Attribute::RotateOffset(offset),
+                })
+                .await
+                .with_context(|| "failed setting RotateOffset attribute")?;
+        }
+
+        // Set the rotation name if provided
+        if let Some(ref name) = self.rotate_name {
+            kms_rest_client
+                .set_attribute(SetAttribute {
+                    unique_identifier: Some(uid.clone()),
+                    new_attribute: Attribute::RotateName(name.clone()),
+                })
+                .await
+                .with_context(|| "failed setting RotateName attribute")?;
+        }
+
+        let mut stdout = console::Stdout::new("Rotation policy set successfully.");
+        stdout.set_unique_identifier(&uid);
+        stdout.write()?;
+
         Ok(())
     }
 }

crate/clients/clap/src/actions/symmetric/keys/set_rotation_policy.rs

@@ -26,5 +26,6 @@ lru = { workspace = true }
 pkcs11-sys = { workspace = true }
 rand = { workspace = true }
 thiserror = { workspace = true }
+time = { workspace = true }
 uuid = { workspace = true, features = ["v4"] }
 zeroize = { workspace = true }

crate/hsm/base_hsm/Cargo.toml

@@ -8,8 +8,9 @@ use pkcs11_sys::{
     CK_C_Finalize, CK_C_FindObjects, CK_C_FindObjectsFinal, CK_C_FindObjectsInit, CK_C_GenerateKey,
     CK_C_GenerateKeyPair, CK_C_GenerateRandom, CK_C_GetAttributeValue, CK_C_GetInfo,
     CK_C_GetMechanismInfo, CK_C_GetMechanismList, CK_C_INITIALIZE_ARGS, CK_C_Initialize,
-    CK_C_Login, CK_C_Logout, CK_C_OpenSession, CK_C_SeedRandom, CK_C_Sign, CK_C_SignInit,
-    CK_C_UnwrapKey, CK_C_WrapKey, CKF_OS_LOCKING_OK, CKR_CRYPTOKI_ALREADY_INITIALIZED, CKR_OK,
+    CK_C_Login, CK_C_Logout, CK_C_OpenSession, CK_C_SeedRandom, CK_C_SetAttributeValue, CK_C_Sign,
+    CK_C_SignInit, CK_C_UnwrapKey, CK_C_WrapKey, CKF_OS_LOCKING_OK,
+    CKR_CRYPTOKI_ALREADY_INITIALIZED, CKR_OK,
 };
 
 use crate::{HResult, hsm_call};
@@ -85,6 +86,7 @@ pub struct HsmLib {
     pub(crate) C_SeedRandom: CK_C_SeedRandom,
 
     pub(crate) C_GetAttributeValue: CK_C_GetAttributeValue,
+    pub(crate) C_SetAttributeValue: CK_C_SetAttributeValue,
 
     pub(crate) C_GetInfo: CK_C_GetInfo,
     pub(crate) C_GetMechanismList: CK_C_GetMechanismList,
@@ -130,6 +132,7 @@ impl HsmLib {
                 C_GenerateRandom: Some(*library.get(b"C_GenerateRandom")?),
                 C_SeedRandom: Some(*library.get(b"C_SeedRandom")?),
                 C_GetAttributeValue: Some(*library.get(b"C_GetAttributeValue")?),
+                C_SetAttributeValue: Some(*library.get(b"C_SetAttributeValue")?),
                 C_GetInfo: Some(*library.get(b"C_GetInfo")?),
                 C_GetMechanismList: Some(*library.get(b"C_GetMechanismList")?),
                 C_GetMechanismInfo: Some(*library.get(b"C_GetMechanismInfo")?),