Function key_rotation

nodedb/src/control/security/encryption.rs:342–372

()

    #[test]
    fn key_rotation() {
        let dir = tempfile::tempdir().unwrap();
        let key1_path = dir.path().join("key1");
        let key2_path = dir.path().join("key2");
        let mut k1 = [0u8; 32];
        let mut k2 = [0u8; 32];
        getrandom::fill(&mut k1).unwrap();
        getrandom::fill(&mut k2).unwrap();
        std::fs::write(&key1_path, k1).unwrap();
        std::fs::write(&key2_path, k2).unwrap();
        use std::os::unix::fs::PermissionsExt as _;
        std::fs::set_permissions(&key1_path, std::fs::Permissions::from_mode(0o600)).unwrap();
        std::fs::set_permissions(&key2_path, std::fs::Permissions::from_mode(0o600)).unwrap();

        let mut enc = VolumeEncryption::new(VolumeEncryptionConfig {
            master_key_path: Some(key1_path),
            enabled: true,
            ..Default::default()
        });
        enc.load_master_key().unwrap();

        // Generate DEK with key1.
        let (dek1, _) = enc.generate_dek().unwrap();

        // Rotate to key2.
        enc.rotate_master_key(&key2_path).unwrap();

        // Generate DEK with key2 — should be different.
        let (dek2, _) = enc.generate_dek().unwrap();
        assert_ne!(dek1, dek2); // Different DEKs (random).
    }

    #[test]
    fn not_active_without_key() {