Reject supplied nonces for non-convergent encryption operations

builtin/logical/transit/path_datakey.go

@@ -170,6 +170,10 @@ func (b *backend) pathDatakeyWrite(ctx context.Context, req *logical.Request, d
 		},
 	}
 
+	if !nonceAllowed(p) {
+		return nil, ErrNonceNotAllowed
+	}
+
 	if constants.IsFIPS() && shouldWarnAboutNonceUsage(p, nonce) {
 		resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
 	}

builtin/logical/transit/path_encrypt.go

@@ -471,6 +471,11 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 			continue
 		}
 
+		if !nonceAllowed(p) {
+			batchResponseItems[i].Error = ErrNonceNotAllowed
+			continue
+		}
+
 		if !warnAboutNonceUsage && shouldWarnAboutNonceUsage(p, item.DecodedNonce) {
 			warnAboutNonceUsage = true
 		}
@@ -568,6 +573,23 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 	return batchRequestResponse(d, resp, req, successesInBatch, userErrorInBatch, internalErrorInBatch)
 }
 
+func nonceAllowed(p *keysutil.Policy) bool {
+	var supportedKeyType bool
+	switch p.Type {
+	case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305:
+		supportedKeyType = true
+	default:
+		supportedKeyType = false
+	}
+
+	if supportedKeyType && p.ConvergentEncryption && p.ConvergentVersion == 1 {
+		// We only use the user supplied nonce for v1 convergent encryption keys
+		return true
+	}
+
+	return false
+}
+
 // Depending on the errors in the batch, different status codes should be returned. User errors
 // will return a 400 and precede internal errors which return a 500. The reasoning behind this is
 // that user errors are non-retryable without making changes to the request, and should be surfaced

builtin/logical/transit/path_rewrap.go

@@ -16,6 +16,8 @@
 	"github.com/mitchellh/mapstructure"
 )
 
+var ErrNonceNotAllowed = errors.New("provided nonce not allowed for this key")
+
 func (b *backend) pathRewrap() *framework.Path {
 	return &framework.Path{
 		Pattern: "rewrap/" + framework.GenericNameRegex("name"),
@@ -164,6 +166,11 @@
 			}
 		}
 
+		if !nonceAllowed(p) {
+			batchResponseItems[i].Error = ErrNonceNotAllowed
+			continue
+		}
+
 		if !warnAboutNonceUsage && shouldWarnAboutNonceUsage(p, item.DecodedNonce) {
 			warnAboutNonceUsage = true
 		}

sdk/helper/keysutil/policy.go

@@ -2013,9 +2013,12 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 
 		encBytes := 32
 		hmacBytes := 0
-		if p.convergentVersion(ver) > 2 {
+		convergentVersion := p.convergentVersion(ver)
+		if convergentVersion > 2 {
 			deriveHMAC = true
 			hmacBytes = 32
+		} else if !p.ConvergentEncryption || convergentVersion != 1 {
+			return "", errutil.UserError{Err: "nonce provided when not allowed"}
 		}
 		if p.Type == KeyType_AES128_GCM96 {
 			encBytes = 16