Transit Secret Engine rewrap with a specific key version

Describe the bug Not able to rewrap keys using a specific key version. The rewrap operation always rewraps with the latest key version.

I have 3 versions of a named key. I want to rewrap the some ciphertext using version 2, but in the currently, I’m not able to rewrap it with key version 2, instead it’s rewrapping with the latest key (version 3).

VaultSharp Version 1.6.0.3

Vault Version 1.6.2

Does this work with Vault CLI? Yes

Sample Code Snippet

var rewrapOptions = new RewrapRequestOptions
{
        BatchedRewrapItems = new List<DecryptionItem>
        {
            new RewrapItem { CipherText = keys[0] },
            new RewrapItem { CipherText = keys[1] },
            new RewrapItem { CipherText = keys[2] }
        },
        KeyVersion = 2
};
Secret<EncryptionResponse> rewrapResponse = vaultClient.V1.Secrets.Transit.RewrapAsync(encryptionKeyName, rewrapOptions,mountPoint).GetAwaiter().GetResult();

Exception Details/Stack Trace/Error Message No Error Message or Exception Thrown

Any additional info I believe the issue lies in how the RewrapItem and RewrapRequestOptions are written. According to the api-docs of Vault, the RewrapItem should contain the key_version instead of the RewrapRequestOptions. KeyVersion in RewrapRequestOptions is simply being ignored at the moment.

Please refer: https://www.vaultproject.io/api-docs/secret/transit#rewrap-data

[rajanadar]

@konidev20 Please try the newly published https://www.nuget.org/packages/VaultSharp/1.6.2

[rajanadar]

thanks for the detailed bug description @konidev20 .

I understood my mistake. The root level KeyVersion field is useless. Vault doesn’t care about it, and VaultSharp is not propagating it to the individual RewrapItems.

I will release a fix to this, by removing the root level KeyVersion as the only change. This is because, the individual RewrapItem class already has a KeyVersion field that you can specify PER item.

So please use the following to get unblocked. As a nice to have, I will remove the root level version field and release a cleaner library later with other critical changes.

        var rewrapOptions = new RewrapRequestOptions
        {
            BatchedRewrapItems = new List<DecryptionItem>
            {
                // Add specific KeyVersion at the Item level.
                new RewrapItem { CipherText = keys[0], KeyVersion = 2 },
                new RewrapItem { CipherText = keys[1], KeyVersion = 2 },
                new RewrapItem { CipherText = keys[2], KeyVersion = 2 }
            },

            // KeyVersion = 2  -- Remove this line
        };

Let me know if any issues.