[PM-24051] Init crypto and update kdf with MasterPasswordUnlock

crates/bitwarden-core/src/auth/api/response/identity_success_response.rs

@@ -38,7 +38,7 @@ pub(crate) struct IdentityTokenSuccessResponse {
     key_connector_url: Option<String>,
 
     #[serde(rename = "userDecryptionOptions", alias = "UserDecryptionOptions")]
-    user_decryption_options: Option<UserDecryptionOptionsResponseModel>,
+    pub(crate) user_decryption_options: Option<UserDecryptionOptionsResponseModel>,
 
     /// Stores unknown api response fields
     extra: Option<HashMap<String, Value>>,

crates/bitwarden-core/src/auth/api/response/user_decryption_options_response.rs

@@ -10,6 +10,7 @@ pub(crate) struct UserDecryptionOptionsResponseModel {
     /// None when user have no master password.
     #[serde(
         rename = "masterPasswordUnlock",
+        alias = "MasterPasswordUnlock",
         skip_serializing_if = "Option::is_none"
     )]
     pub(crate) master_password_unlock: Option<MasterPasswordUnlockResponseModel>,

crates/bitwarden-core/src/auth/login/access_token.rs

@@ -85,6 +85,11 @@ pub(crate) async fn login_access_token(
             r.refresh_token.clone(),
             r.expires_in,
         );
+
+        client
+            .internal
+            .initialize_crypto_single_org_key(organization_id, encryption_key);
+
         client
             .internal
             .set_login_method(LoginMethod::ServiceAccount(
@@ -94,10 +99,6 @@ pub(crate) async fn login_access_token(
                     state_file: input.state_file.clone(),
                 },
             ));
-
-        client
-            .internal
-            .initialize_crypto_single_org_key(organization_id, encryption_key);
     }
 
     AccessTokenLoginResponse::process_response(response)

crates/bitwarden-core/src/auth/login/api_key.rs

@@ -1,15 +1,15 @@
-use bitwarden_crypto::{EncString, MasterKey};
+use bitwarden_crypto::EncString;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
 use crate::{
     Client,
     auth::{
-        JwtToken,
         api::{request::ApiTokenRequest, response::IdentityTokenResponse},
         login::{LoginError, PasswordLoginResponse, response::two_factor::TwoFactorProviders},
     },
     client::{LoginMethod, UserLoginMethod, internal::UserKeyState},
+    key_management::UserDecryptionData,
     require,
 };
 
@@ -23,44 +23,44 @@ pub(crate) async fn login_api_key(
     let response = request_api_identity_tokens(client, input).await?;
 
     if let IdentityTokenResponse::Authenticated(r) = &response {
-        let access_token_obj: JwtToken = r.access_token.parse()?;
-
-        // This should always be Some() when logging in with an api key
-        let email = access_token_obj
-            .email
-            .ok_or(LoginError::JwtTokenMissingEmail)?;
-
-        let kdf = client.auth().prelogin(email.clone()).await?;
-
         client.internal.set_tokens(
             r.access_token.clone(),
             r.refresh_token.clone(),
             r.expires_in,
         );
 
-        let master_key = MasterKey::derive(&input.password, &email, &kdf)?;
-
-        client
-            .internal
-            .set_login_method(LoginMethod::User(UserLoginMethod::ApiKey {
-                client_id: input.client_id.to_owned(),
-                client_secret: input.client_secret.to_owned(),
-                email,
-                kdf,
-            }));
-
-        let user_key: EncString = require!(r.key.as_deref()).parse()?;
-        let private_key: EncString = require!(r.private_key.as_deref()).parse()?;
-
-        client.internal.initialize_user_crypto_master_key(
-            master_key,
-            user_key,
-            UserKeyState {
-                private_key,
-                signing_key: None,
-                security_state: None,
-            },
-        )?;
+        let private_key: EncString = require!(&r.private_key).parse()?;
+
+        let user_key_state = UserKeyState {
+            private_key,
+            signing_key: None,
+            security_state: None,
+        };
+
+        let master_password_unlock = r
+            .user_decryption_options
+            .as_ref()
+            .map(UserDecryptionData::try_from)
+            .transpose()?
+            .and_then(|user_decryption| user_decryption.master_password_unlock);
+        if let Some(master_password_unlock) = master_password_unlock {
+            client
+                .internal
+                .initialize_user_crypto_master_password_unlock(
+                    input.password.clone(),
+                    master_password_unlock.clone(),
+                    user_key_state,
+                )?;
+
+            client
+                .internal
+                .set_login_method(LoginMethod::User(UserLoginMethod::ApiKey {
+                    client_id: input.client_id.clone(),
+                    client_secret: input.client_secret.clone(),
+                    email: master_password_unlock.salt,
+                    kdf: master_password_unlock.kdf,
+                }));
+        }
     }
 
     Ok(ApiKeyLoginResponse::process_response(response))

crates/bitwarden-core/src/auth/login/auth_request.rs

@@ -10,8 +10,10 @@ use crate::{
         api::{request::AuthRequestTokenRequest, response::IdentityTokenResponse},
         auth_request::new_auth_request,
     },
-    client::{LoginMethod, UserLoginMethod},
-    key_management::crypto::{AuthRequestMethod, InitUserCryptoMethod, InitUserCryptoRequest},
+    key_management::{
+        UserDecryptionData,
+        crypto::{AuthRequestMethod, InitUserCryptoMethod, InitUserCryptoRequest},
+    },
     require,
 };
 
@@ -88,20 +90,11 @@ pub(crate) async fn complete_auth_request(
     .await?;
 
     if let IdentityTokenResponse::Authenticated(r) = response {
-        let kdf = Kdf::default();
-
         client.internal.set_tokens(
             r.access_token.clone(),
             r.refresh_token.clone(),
             r.expires_in,
         );
-        client
-            .internal
-            .set_login_method(LoginMethod::User(UserLoginMethod::Username {
-                client_id: "web".to_owned(),
-                email: auth_req.email.to_owned(),
-                kdf: kdf.clone(),
-            }));
 
         let method = match res.master_password_hash {
             Some(_) => AuthRequestMethod::MasterKey {
@@ -113,12 +106,27 @@ pub(crate) async fn complete_auth_request(
             },
         };
 
+        let master_password_unlock = r
+            .user_decryption_options
+            .as_ref()
+            .map(UserDecryptionData::try_from)
+            .transpose()?
+            .and_then(|user_decryption| user_decryption.master_password_unlock);
+        let kdf = master_password_unlock
+            .as_ref()
+            .map(|mpu| mpu.kdf.clone())
+            .unwrap_or_else(Kdf::default);
+        let salt = master_password_unlock
+            .as_ref()
+            .map(|mpu| mpu.salt.clone())
+            .unwrap_or_else(|| auth_req.email.clone());
+
         client
             .crypto()
             .initialize_user_crypto(InitUserCryptoRequest {
                 user_id: None,
                 kdf_params: kdf,
-                email: auth_req.email,
+                email: salt,
                 private_key: require!(r.private_key).parse()?,
                 signing_key: None,
                 security_state: None,

crates/bitwarden-core/src/auth/login/mod.rs

@@ -77,4 +77,8 @@ pub enum LoginError {
 
     #[error("Failed to authenticate")]
     AuthenticationFailed,
+
+    #[cfg(feature = "internal")]
+    #[error(transparent)]
+    MasterPassword(#[from] crate::key_management::MasterPasswordError),
 }

crates/bitwarden-core/src/auth/login/password.rs

@@ -1,6 +1,4 @@
 #[cfg(feature = "internal")]
-use bitwarden_crypto::Kdf;
-#[cfg(feature = "internal")]
 use log::info;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -13,14 +11,15 @@ use crate::{
     Client,
     auth::{api::request::PasswordTokenRequest, login::LoginError, login::TwoFactorRequest},
     client::LoginMethod,
+    key_management::{MasterPasswordAuthenticationData, UserDecryptionData},
 };
 
 #[cfg(feature = "internal")]
 pub(crate) async fn login_password(
     client: &Client,
     input: &PasswordLoginRequest,
 ) -> Result<PasswordLoginResponse, LoginError> {
-    use bitwarden_crypto::{EncString, HashPurpose, MasterKey};
+    use bitwarden_crypto::EncString;
 
     use crate::{
         client::{UserLoginMethod, internal::UserKeyState},
@@ -29,38 +28,55 @@ pub(crate) async fn login_password(
 
     info!("password logging in");
 
-    let master_key = MasterKey::derive(&input.password, &input.email, &input.kdf)?;
-    let password_hash = master_key
-        .derive_master_key_hash(input.password.as_bytes(), HashPurpose::ServerAuthorization);
+    let kdf = client.auth().prelogin(input.email.clone()).await?;
+
+    let master_password_authentication =
+        MasterPasswordAuthenticationData::derive(&input.password, &kdf, &input.email)?;
+
+    let password_hash = master_password_authentication
+        .master_password_authentication_hash
+        .to_string();
 
-    let response = request_identity_tokens(client, input, &password_hash.to_string()).await?;
+    let response = request_identity_tokens(client, input, &password_hash).await?;
 
     if let IdentityTokenResponse::Authenticated(r) = &response {
         client.internal.set_tokens(
             r.access_token.clone(),
             r.refresh_token.clone(),
             r.expires_in,
         );
-        client
-            .internal
-            .set_login_method(LoginMethod::User(UserLoginMethod::Username {
-                client_id: "web".to_owned(),
-                email: input.email.to_owned(),
-                kdf: input.kdf.to_owned(),
-            }));
-
-        let user_key: EncString = require!(r.key.as_deref()).parse()?;
-        let private_key: EncString = require!(r.private_key.as_deref()).parse()?;
-
-        client.internal.initialize_user_crypto_master_key(
-            master_key,
-            user_key,
-            UserKeyState {
-                private_key,
-                signing_key: None,
-                security_state: None,
-            },
-        )?;
+
+        let private_key: EncString = require!(&r.private_key).parse()?;
+
+        let user_key_state = UserKeyState {
+            private_key,
+            signing_key: None,
+            security_state: None,
+        };
+
+        let master_password_unlock = r
+            .user_decryption_options
+            .as_ref()
+            .map(UserDecryptionData::try_from)
+            .transpose()?
+            .and_then(|user_decryption| user_decryption.master_password_unlock);
+        if let Some(master_password_unlock) = master_password_unlock {
+            client
+                .internal
+                .initialize_user_crypto_master_password_unlock(
+                    input.password.clone(),
+                    master_password_unlock.clone(),
+                    user_key_state,
+                )?;
+
+            client
+                .internal
+                .set_login_method(LoginMethod::User(UserLoginMethod::Username {
+                    client_id: "web".to_owned(),
+                    email: master_password_unlock.salt,
+                    kdf: master_password_unlock.kdf,
+                }));
+        }
     }
 
     Ok(PasswordLoginResponse::process_response(response))
@@ -97,8 +113,6 @@ pub struct PasswordLoginRequest {
     pub password: String,
     /// Two-factor authentication
     pub two_factor: Option<TwoFactorRequest>,
-    /// Kdf from prelogin
-    pub kdf: Kdf,
 }
 
 #[allow(missing_docs)]

crates/bitwarden-core/src/auth/tde.rs

@@ -32,15 +32,6 @@ pub(super) fn make_register_tde_keys(
         None
     };
 
-    client
-        .internal
-        .set_login_method(crate::client::LoginMethod::User(
-            crate::client::UserLoginMethod::Username {
-                client_id: "".to_owned(),
-                email,
-                kdf: Kdf::default(),
-            },
-        ));
     client.internal.initialize_user_crypto_decrypted_key(
         user_key.0,
         UserKeyState {
@@ -52,6 +43,16 @@ pub(super) fn make_register_tde_keys(
         },
     )?;
 
+    client
+        .internal
+        .set_login_method(crate::client::LoginMethod::User(
+            crate::client::UserLoginMethod::Username {
+                client_id: "".to_owned(),
+                email,
+                kdf: Kdf::default(),
+            },
+        ));
+
     Ok(RegisterTdeKeyResponse {
         private_key: key_pair.private,
         public_key: key_pair.public,