Key Sign/Verify and logging system restructuring

MiniKms/pom.xml

@@ -91,6 +91,12 @@
             <artifactId>mapstruct</artifactId>
             <version>1.6.0</version>
         </dependency>
+        <dependency>
+            <groupId>net.logstash.logback</groupId>
+            <artifactId>logstash-logback-encoder</artifactId>
+            <version>8.1</version>
+        </dependency>
+
     </dependencies>
 
     <build>

MiniKms/src/main/java/ftn/security/minikms/config/SecurityConfig.java

@@ -54,6 +54,8 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                         .requestMatchers("/api/v1/auth/**").permitAll()
                         .requestMatchers("/api/v1/test/**").permitAll()
+                        .requestMatchers("/api/v1/crypto/**").permitAll()
+                        .requestMatchers("/api/v1/signatures/**").permitAll()
                         .requestMatchers(HttpMethod.GET, "/api/v1/keys/**").authenticated() // Allow all roles to GET
                         .requestMatchers("/api/v1/keys/**").hasRole("MANAGER")
                         .anyRequest().authenticated()

MiniKms/src/main/java/ftn/security/minikms/controller/SignatureController.java

@@ -0,0 +1,53 @@
+package ftn.security.minikms.controller;
+
+import ftn.security.minikms.dto.SignRequestDTO;
+import ftn.security.minikms.dto.VerifyRequestDTO;
+import ftn.security.minikms.service.SignatureService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.*;
+
+import java.security.GeneralSecurityException;
+import java.security.Principal;
+import java.util.Base64;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/v1/signatures")
+public class SignatureController {
+
+    @Autowired
+    private SignatureService signatureService;
+
+    @PostMapping("/sign")
+    @Transactional(readOnly = true)
+    public ResponseEntity<String> sign(@RequestParam UUID keyId,
+                                       @RequestBody SignRequestDTO request) {
+        try {
+            byte[] signature = signatureService.sign(keyId, request.getMessage(), request.getVersion());
+            return ResponseEntity.ok(Base64.getEncoder().encodeToString(signature));
+        } catch (GeneralSecurityException | IllegalArgumentException e) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(e.getMessage());
+        }
+    }
+
+    @PostMapping("/verify")
+    @Transactional(readOnly = true)
+    public ResponseEntity<String> verify(@RequestParam UUID keyId,
+                                         @RequestParam(required = false) Integer version,
+                                         @RequestBody VerifyRequestDTO req) {
+        try {
+            boolean valid = signatureService.verify(
+                    keyId,
+                    req.getMessage(),
+                    Base64.getDecoder().decode(req.getSignature()),
+                    version
+            );
+            return ResponseEntity.ok(valid ? "VALID" : "INVALID");
+        } catch (GeneralSecurityException | IllegalArgumentException e) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(e.getMessage());
+        }
+    }
+}

MiniKms/src/main/java/ftn/security/minikms/dto/SignRequestDTO.java

@@ -0,0 +1,9 @@
+package ftn.security.minikms.dto;
+
+import lombok.Data;
+
+@Data
+public class SignRequestDTO {
+    private String message;
+    private Integer version;
+}

MiniKms/src/main/java/ftn/security/minikms/dto/VerifyRequestDTO.java

@@ -0,0 +1,9 @@
+package ftn.security.minikms.dto;
+
+import lombok.Data;
+
+@Data
+public class VerifyRequestDTO {
+    private String message;
+    private String signature;
+}

MiniKms/src/main/java/ftn/security/minikms/logging/EntityLogger.java

@@ -2,37 +2,41 @@
 
 import jakarta.persistence.*;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+
+import java.util.Map;
 
 @Slf4j
 public class EntityLogger {
 
-    @PrePersist
-    public void prePersist(Object entity) {
-        log.info("Creating: {}", entity);
+    @Value("${logging.entity.enabled:true}")
+    private boolean loggingEnabled;
+
+    private void logEntity(String action, String phase, Object entity) {
+        if (!loggingEnabled) return;
+
+        log.info("{}", Map.of(
+                "action", action,
+                "phase", phase,
+                "entity", entity.getClass().getSimpleName()
+        ));
     }
 
+    @PrePersist
+    public void prePersist(Object entity) { logEntity("create", "pre", entity); }
+
     @PostPersist
-    public void postPersist(Object entity) {
-        log.info("Created: {}", entity);
-    }
+    public void postPersist(Object entity) { logEntity("create", "post", entity); }
 
     @PreUpdate
-    public void preUpdate(Object entity) {
-        log.info("Updating: {}", entity);
-    }
+    public void preUpdate(Object entity) { logEntity("update", "pre", entity); }
 
     @PostUpdate
-    public void postUpdate(Object entity) {
-        log.info("Updated: {}", entity);
-    }
+    public void postUpdate(Object entity) { logEntity("update", "post", entity); }
 
     @PreRemove
-    public void preRemove(Object entity) {
-        log.info("Deleting: {}", entity);
-    }
+    public void preRemove(Object entity) { logEntity("delete", "pre", entity); }
 
     @PostRemove
-    public void postRemove(Object entity) {
-        log.info("Deleted: {}", entity);
-    }
+    public void postRemove(Object entity) { logEntity("delete", "post", entity); }
 }

MiniKms/src/main/java/ftn/security/minikms/logging/RequestResponseLoggingFilter.java

@@ -5,57 +5,56 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
-import org.springframework.web.util.ContentCachingRequestWrapper;
-import org.springframework.web.util.ContentCachingResponseWrapper;
 
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
+import java.util.Map;
 import java.util.UUID;
 
 @Slf4j
 @Component
 public class RequestResponseLoggingFilter extends OncePerRequestFilter {
 
+    @Value("${logging.controller.enabled:true}")
+    private boolean loggingEnabled;
+
     @Override
     protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain filterChain) throws ServletException, IOException {
 
-        ContentCachingRequestWrapper requestWrapper = new ContentCachingRequestWrapper(request);
-        ContentCachingResponseWrapper responseWrapper = new ContentCachingResponseWrapper(response);
+        if (!loggingEnabled) {
+            filterChain.doFilter(request, response);
+            return;
+        }
 
         String requestId = request.getHeader("X-Request-ID");
         if (requestId == null || requestId.isBlank()) {
             requestId = UUID.randomUUID().toString();
         }
+        response.setHeader("X-Request-ID", requestId);
 
-        responseWrapper.setHeader("X-Request-ID", requestId);
+        String username = request.getUserPrincipal() != null
+                ? request.getUserPrincipal().getName()
+                : "anonymous";
 
         long start = System.currentTimeMillis();
         try {
-            filterChain.doFilter(requestWrapper, responseWrapper);
+            filterChain.doFilter(request, response);
         } finally {
             long duration = System.currentTimeMillis() - start;
 
-            String requestBody = new String(requestWrapper.getContentAsByteArray(), StandardCharsets.UTF_8);
-            log.info("[{}] REQUEST {} {} | Body={}",
-                    requestId,
-                    request.getMethod(),
-                    request.getRequestURI(),
-                    requestBody);
-
-            String responseBody = new String(responseWrapper.getContentAsByteArray(), StandardCharsets.UTF_8);
-            log.info("[{}] RESPONSE {} {} | Status={} | Duration={}ms | Body={}",
-                    requestId,
-                    request.getMethod(),
-                    request.getRequestURI(),
-                    responseWrapper.getStatus(),
-                    duration,
-                    responseBody);
-
-            responseWrapper.copyBodyToResponse();
+            log.info("{}", Map.of(
+                    "message", "HTTP request completed",
+                    "requestId", requestId,
+                    "username", username,
+                    "method", request.getMethod(),
+                    "uri", request.getRequestURI(),
+                    "status", response.getStatus(),
+                    "durationMs", duration
+            ));
         }
     }
 }

MiniKms/src/main/java/ftn/security/minikms/repository/KeyMetadataRepository.java

@@ -2,6 +2,8 @@
 
 import ftn.security.minikms.entity.KeyMetadata;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
 
 import java.util.UUID;
 

MiniKms/src/main/java/ftn/security/minikms/service/KeyComputeService.java

@@ -3,16 +3,14 @@
 import ftn.security.minikms.entity.KeyMaterial;
 import ftn.security.minikms.repository.KeyMetadataRepository;
 import ftn.security.minikms.repository.WrappedKeyRepository;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import javax.crypto.BadPaddingException;
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.NoSuchPaddingException;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
-import java.security.InvalidParameterException;
-import java.security.NoSuchAlgorithmException;
+import java.security.*;
 import java.security.spec.InvalidKeySpecException;
 import java.util.UUID;
 
@@ -25,6 +23,9 @@ public class KeyComputeService {
     private final RSAService rsaService;
     private final HMACService hmacService;
 
+    @Autowired
+    private RootKeyManager rootKeyManager;
+
     public KeyComputeService(KeyMetadataRepository metadataRepository, WrappedKeyRepository keyRepository) {
         this.metadataRepository = metadataRepository;
         this.keyRepository = keyRepository;
@@ -76,4 +77,32 @@ public KeyMaterial getKey(UUID keyId, Integer version) {
 
         return wrappedKey.getWrappedMaterial();
     }
+
+    public KeyMaterial getKeySig(UUID keyId, Integer version) {
+        var metadata = metadataRepository.findById(keyId)
+                .orElseThrow(() -> new InvalidParameterException("Key with given id does not exist"));
+
+        if (version == null) version = metadata.getPrimaryVersion();
+        var wrappedKey = keyRepository.findByMetadataIdAndVersion(keyId, version)
+                .orElseThrow(() -> new InvalidParameterException("Key with given id and version does not exist"));
+
+        var wrappedMaterial = wrappedKey.getWrappedMaterial();
+
+        try {
+            // Unwrap the private key
+            byte[] unwrappedPrivate = rootKeyManager.unwrap(
+                    wrappedMaterial.getKey(), keyId, version
+            );
+
+            // For asymmetric keys: also store public key
+            KeyMaterial material = new KeyMaterial();
+            material.setKey(unwrappedPrivate);
+            material.setPublicKey(wrappedMaterial.getPublicKey());
+
+            return material;
+        } catch (GeneralSecurityException e) {
+            throw new RuntimeException("Failed to unwrap key material", e);
+        }
+    }
+
 }

MiniKms/src/main/java/ftn/security/minikms/service/SignatureService.java

@@ -0,0 +1,60 @@
+package ftn.security.minikms.service;
+
+import ftn.security.minikms.entity.KeyMaterial;
+import ftn.security.minikms.entity.KeyMetadata;
+import ftn.security.minikms.entity.WrappedKey;
+import ftn.security.minikms.enumeration.KeyType;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.nio.charset.StandardCharsets;
+import java.security.*;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Arrays;
+import java.util.UUID;
+
+@Service
+public class SignatureService {
+
+    @Autowired
+    private KeyComputeService keyComputeService;
+
+    public SignatureService() {
+    }
+
+    public byte[] sign(UUID keyId, String message, Integer version) throws GeneralSecurityException {
+        KeyMaterial keyMaterial = keyComputeService.getKeySig(keyId, version);
+
+        if (keyMaterial.getPublicKey() == null) {
+            throw new IllegalArgumentException("Key is not asymmetric and cannot be used for signing");
+        }
+
+
+        PrivateKey privateKey = KeyFactory.getInstance("RSA")
+                .generatePrivate(new PKCS8EncodedKeySpec(keyMaterial.getKey()));
+
+        Signature signature = Signature.getInstance("SHA256withRSA");
+        signature.initSign(privateKey);
+        signature.update(message.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+
+        return signature.sign();
+    }
+
+    public boolean verify(UUID keyId, String message, byte[] signatureBytes, Integer version) throws GeneralSecurityException {
+        KeyMaterial keyMaterial = keyComputeService.getKeySig(keyId, version);
+
+        if (keyMaterial.getPublicKey() == null) {
+            throw new IllegalArgumentException("Key is not asymmetric and cannot be used for verification");
+        }
+
+        PublicKey publicKey = KeyFactory.getInstance("RSA")
+                .generatePublic(new X509EncodedKeySpec(keyMaterial.getPublicKey()));
+
+        Signature signature = Signature.getInstance("SHA256withRSA");
+        signature.initVerify(publicKey);
+        signature.update(message.getBytes(StandardCharsets.UTF_8));
+
+        return signature.verify(signatureBytes);
+    }
+}

MiniKms/src/main/resources/application.properties

@@ -22,9 +22,13 @@ server.ssl.key-alias=minikms
 
 # Debugging
 #spring.jpa.show-sql=true
-#logging.level.org.springframework.security=DEBUG
-#logging.level.io.jsonwebtoken=DEBUG
+logging.level.org.springframework.security=DEBUG
+logging.level.io.jsonwebtoken=DEBUG
 
 # 1 hour
 jwt.expiration=3600000
-jwt.secret=Dubt4z4Lba9fc82KES/2uRcxOR9LcTTwxh7UuxE4f9Q=
+jwt.secret=Dubt4z4Lba9fc82KES/2uRcxOR9LcTTwxh7UuxE4f9Q=
+
+# Enable/disable logging
+logging.controller.enabled=true
+logging.entity.enabled=true