Fix resealing API

rust/sdk/crates/libs/sdk-enclave/src/userboundkey/mod.rs

@@ -629,26 +629,27 @@ pub fn load_user_bound_key(
 /// Reseal a user-bound key with current enclave identity
 ///
 /// This function re-seals data that was previously sealed by an older enclave version.
-/// It is used when the sealing key has rotated (detected by `is_stale_key` flag from unsealing).
+/// It is used when the sealing key has rotated (detected by `needs_reseal` flag from `load_user_bound_key`).
 ///
-/// Note: The input `bound_key_bytes` should be the unsealed (decrypted) bound key data,
-/// NOT the sealed blob. If you have sealed data, first unseal it with `unseal_data`
-/// from the crypto module, then pass the unsealed result here.
+/// The function first unseals the input data, then re-seals it with the specified policy.
 ///
 /// # Arguments
-/// * `bound_key_bytes` - Previously unsealed bound key bytes (NOT sealed data)
+/// * `sealed_bound_key_bytes` - The sealed bound key bytes to reseal
 /// * `sealing_policy` - Enclave sealing identity policy for the new seal
 /// * `runtime_policy` - Runtime policy flags
 ///
 /// # Returns
 /// Newly sealed key material that can be stored and used with future loads
 pub fn reseal_user_bound_key(
-    bound_key_bytes: &[u8],
+    sealed_bound_key_bytes: &[u8],
     sealing_policy: EnclaveSealingIdentityPolicy,
     runtime_policy: u32,
 ) -> Result<Vec<u8>, UserBoundKeyError> {
+    // First unseal the data to get the raw bound key bytes
+    let (bound_key_bytes, _unseal_flags) = unseal_data(sealed_bound_key_bytes)?;
+
     // Re-seal with current enclave identity
-    let resealed_data = seal_data(bound_key_bytes, sealing_policy, runtime_policy)?;
+    let resealed_data = seal_data(&bound_key_bytes, sealing_policy, runtime_policy)?;
 
     Ok(resealed_data)
 }

src/VbsEnclaveSDK/src/veil_enclave_lib/userboundkey.vtl1.cpp

@@ -689,17 +689,22 @@ std::vector<uint8_t> load_user_bound_key(
 }
 
 std::vector<uint8_t> reseal_user_bound_key(
-    const std::vector<uint8_t>& boundKeyBytes,
+    const std::vector<uint8_t>& sealedBoundKeyBytes,
     ENCLAVE_SEALING_IDENTITY_POLICY sealingPolicy,
     uint32_t runtimePolicy)
 {
     veil::vtl1::vtl0_functions::internal::debug_print(L"DEBUG: reseal_user_bound_key - Function entered");
-    veil::vtl1::vtl0_functions::internal::debug_print((L"DEBUG: reseal_user_bound_key - boundKeyBytes size: " + std::to_wstring(boundKeyBytes.size())).c_str());
+    veil::vtl1::vtl0_functions::internal::debug_print((L"DEBUG: reseal_user_bound_key - sealedBoundKeyBytes size: " + std::to_wstring(sealedBoundKeyBytes.size())).c_str());
     veil::vtl1::vtl0_functions::internal::debug_print((L"DEBUG: reseal_user_bound_key - sealingPolicy: " + std::to_wstring(static_cast<uint32_t>(sealingPolicy))).c_str());
     veil::vtl1::vtl0_functions::internal::debug_print((L"DEBUG: reseal_user_bound_key - runtimePolicy: 0x" + std::to_wstring(runtimePolicy)).c_str());
 
     try
     {
+        // First unseal the data to get the raw bound key bytes
+        auto [boundKeyBytes, unsealingFlags] = veil::vtl1::crypto::unseal_data(sealedBoundKeyBytes);
+
+        veil::vtl1::vtl0_functions::internal::debug_print((L"DEBUG: reseal_user_bound_key - Unsealed data, size: " + std::to_wstring(boundKeyBytes.size())).c_str());
+
         // Re-seal the bound key bytes with current enclave identity
         auto resealedData = veil::vtl1::crypto::seal_data(
             boundKeyBytes, 

src/VbsEnclaveSDK/src/veil_enclave_lib/userboundkey.vtl1.h

@@ -50,8 +50,17 @@ namespace veil::vtl1::userboundkey
         const std::vector<uint8_t>& sealedBoundKeyBytes,
         _Out_ bool& needsReseal);
 
+    /// <summary>
+    /// Re-seals previously sealed bound key data with the current enclave identity.
+    /// This function first unseals the input data, then re-seals it with the specified policy.
+    /// Used when the sealing key has rotated (detected by needsReseal flag from load_user_bound_key).
+    /// </summary>
+    /// <param name="sealedBoundKeyBytes">The sealed bound key bytes to reseal</param>
+    /// <param name="sealingPolicy">The sealing identity policy for the new seal</param>
+    /// <param name="runtimePolicy">The runtime policy flags</param>
+    /// <returns>Newly sealed key material that can be stored and used with future loads</returns>
     std::vector<uint8_t> reseal_user_bound_key(
-        const std::vector<uint8_t>& boundKeyBytes,
+        const std::vector<uint8_t>& sealedBoundKeyBytes,
         ENCLAVE_SEALING_IDENTITY_POLICY sealingPolicy,
         uint32_t runtimePolicy);
 }