v0.0.47 - Added post-quantum cryptography (ML-DSA-65, SLH-DSA-128s, ML-KEM-768) and standard ECC (ed25519, x25519) support with algorithm-based API
This commit is contained in:
Laan Tungir
273
examples/pq_kem_example.c
Normal file
273
examples/pq_kem_example.c
Normal file
@@ -0,0 +1,273 @@
|
||||
/*
|
||||
* pq_kem_example.c — connect to a running n_signer over its abstract UNIX
|
||||
* socket and demonstrate post-quantum key encapsulation with ML-KEM-768.
|
||||
*
|
||||
* The example:
|
||||
* 1. Sends a get_public_key request for an ML-KEM-768 role ("kem_main").
|
||||
* 2. Prints the structured public key (algorithm, public_key, key_id).
|
||||
* 3. Sends a kem_encapsulate request with the public key, obtaining a
|
||||
* ciphertext + shared secret.
|
||||
* 4. Sends a kem_decapsulate request with the ciphertext, recovering the
|
||||
* shared secret on the signer side.
|
||||
* 5. Prints both shared secrets — they should match.
|
||||
*
|
||||
* Prerequisites:
|
||||
* - n_signer must be running with a role configured for purpose=pq-kem,
|
||||
* curve=ml-kem-768, named "kem_main" (or pass the role name as the 2nd arg).
|
||||
* - A mnemonic must be loaded in the signer.
|
||||
*
|
||||
* Usage: ./pq_kem_example [socket_name] [role_name]
|
||||
*
|
||||
* Default socket_name: nsigner
|
||||
* Default role_name: kem_main
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "nostr_common.h"
|
||||
#include "nsigner_transport.h"
|
||||
#include "nsigner_client.h"
|
||||
#include "../cjson/cJSON.h"
|
||||
|
||||
static int get_structured_pubkey(nsigner_client_t *client, const char *role,
|
||||
char **out_pub_hex) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
cJSON *parsed = NULL;
|
||||
int rc = -1;
|
||||
|
||||
*out_pub_hex = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return -1;
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "get_public_key", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
if (cJSON_IsString(result)) {
|
||||
parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *pk_item = cJSON_GetObjectItemCaseSensitive(parsed, "public_key");
|
||||
if (cJSON_IsString(pk_item)) {
|
||||
*out_pub_hex = strdup(pk_item->valuestring);
|
||||
rc = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(parsed);
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return rc;
|
||||
}
|
||||
|
||||
/* kem_encapsulate: returns ciphertext_hex and shared_secret_hex (newly
|
||||
* allocated, caller frees). */
|
||||
static int kem_encapsulate(nsigner_client_t *client, const char *role,
|
||||
const char *pub_hex,
|
||||
char **out_ct_hex, char **out_ss_hex) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
int rc = -1;
|
||||
|
||||
*out_ct_hex = NULL;
|
||||
*out_ss_hex = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return -1;
|
||||
|
||||
cJSON_AddItemToArray(params, cJSON_CreateString(pub_hex));
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "kem_encapsulate", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
if (cJSON_IsString(result)) {
|
||||
cJSON *parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *ct_item = cJSON_GetObjectItemCaseSensitive(parsed, "ciphertext");
|
||||
cJSON *ss_item = cJSON_GetObjectItemCaseSensitive(parsed, "shared_secret");
|
||||
if (cJSON_IsString(ct_item) && cJSON_IsString(ss_item)) {
|
||||
*out_ct_hex = strdup(ct_item->valuestring);
|
||||
*out_ss_hex = strdup(ss_item->valuestring);
|
||||
if (*out_ct_hex != NULL && *out_ss_hex != NULL) {
|
||||
rc = 0;
|
||||
}
|
||||
}
|
||||
cJSON_Delete(parsed);
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return rc;
|
||||
}
|
||||
|
||||
static char *kem_decapsulate(nsigner_client_t *client, const char *role,
|
||||
const char *ct_hex) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
char *ss_hex = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return NULL;
|
||||
|
||||
cJSON_AddItemToArray(params, cJSON_CreateString(ct_hex));
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "kem_decapsulate", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
if (cJSON_IsString(result)) {
|
||||
cJSON *parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *ss_item = cJSON_GetObjectItemCaseSensitive(parsed, "shared_secret");
|
||||
if (cJSON_IsString(ss_item)) {
|
||||
ss_hex = strdup(ss_item->valuestring);
|
||||
}
|
||||
cJSON_Delete(parsed);
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return ss_hex;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
const char *socket_name = "nsigner";
|
||||
const char *role = "kem_main";
|
||||
nsigner_transport_t *transport = NULL;
|
||||
nsigner_client_t *client = NULL;
|
||||
char *pub_hex = NULL;
|
||||
char *ct_hex = NULL;
|
||||
char *encap_ss_hex = NULL;
|
||||
char *decap_ss_hex = NULL;
|
||||
int rc = 1;
|
||||
|
||||
if (argc > 1 && argv[1] != NULL && argv[1][0] != '\0') {
|
||||
socket_name = argv[1];
|
||||
}
|
||||
if (argc > 2 && argv[2] != NULL && argv[2][0] != '\0') {
|
||||
role = argv[2];
|
||||
}
|
||||
|
||||
if (nostr_init() != NOSTR_SUCCESS) {
|
||||
fprintf(stderr, "failed to initialize crypto subsystem\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
transport = nsigner_transport_open_unix(socket_name, 10000);
|
||||
if (transport == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot open unix transport @%s\n", socket_name);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
client = nsigner_client_new(transport);
|
||||
if (client == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot create nsigner client\n");
|
||||
transport->close(transport);
|
||||
goto cleanup;
|
||||
}
|
||||
transport = NULL;
|
||||
|
||||
printf("=== PQ KEM Example (ML-KEM-768) ===\n");
|
||||
printf("socket: %s\n", socket_name);
|
||||
printf("role: %s\n", role);
|
||||
printf("\n");
|
||||
|
||||
/* 1. Get the ML-KEM-768 public key. */
|
||||
if (get_structured_pubkey(client, role, &pub_hex) != 0 || pub_hex == NULL) {
|
||||
fprintf(stderr, "get_public_key failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
printf("Public Key:\n");
|
||||
printf(" pub_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(pub_hex), strlen(pub_hex) / 2);
|
||||
printf(" pub_head: %.64s...\n", pub_hex);
|
||||
printf("\n");
|
||||
|
||||
/* 2. Encapsulate with the public key. */
|
||||
printf("Encapsulating with public key...\n");
|
||||
if (kem_encapsulate(client, role, pub_hex, &ct_hex, &encap_ss_hex) != 0) {
|
||||
fprintf(stderr, "kem_encapsulate failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
printf("Ciphertext:\n");
|
||||
printf(" ct_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(ct_hex), strlen(ct_hex) / 2);
|
||||
printf(" ct_head: %.64s...\n", ct_hex);
|
||||
printf("Encapsulated shared secret:\n");
|
||||
printf(" ss: %s\n", encap_ss_hex);
|
||||
printf("\n");
|
||||
|
||||
/* 3. Decapsulate with the ciphertext (uses the role's private key). */
|
||||
printf("Decapsulating ciphertext on signer side...\n");
|
||||
decap_ss_hex = kem_decapsulate(client, role, ct_hex);
|
||||
if (decap_ss_hex == NULL) {
|
||||
fprintf(stderr, "kem_decapsulate failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
printf("Decapsulated shared secret:\n");
|
||||
printf(" ss: %s\n", decap_ss_hex);
|
||||
printf("\n");
|
||||
|
||||
/* 4. Verify the shared secrets match. */
|
||||
if (strcmp(encap_ss_hex, decap_ss_hex) == 0) {
|
||||
printf("SUCCESS: shared secrets match!\n");
|
||||
rc = 0;
|
||||
} else {
|
||||
printf("FAILURE: shared secrets do NOT match!\n");
|
||||
}
|
||||
|
||||
cleanup:
|
||||
free(pub_hex);
|
||||
free(ct_hex);
|
||||
free(encap_ss_hex);
|
||||
free(decap_ss_hex);
|
||||
nsigner_client_free(client);
|
||||
nostr_cleanup();
|
||||
return rc;
|
||||
}
|
||||
215
examples/pq_sign_example.c
Normal file
215
examples/pq_sign_example.c
Normal file
@@ -0,0 +1,215 @@
|
||||
/*
|
||||
* pq_sign_example.c — connect to a running n_signer over its abstract UNIX
|
||||
* socket and demonstrate post-quantum signing with ML-DSA-65.
|
||||
*
|
||||
* The example:
|
||||
* 1. Sends a get_public_key request for an ML-DSA-65 role ("pq_sig").
|
||||
* 2. Prints the structured public key (algorithm, public_key, key_id).
|
||||
* 3. Sends a sign_data request with a test message.
|
||||
* 4. Prints the signature (hex) and algorithm.
|
||||
*
|
||||
* Prerequisites:
|
||||
* - n_signer must be running with a role configured for purpose=pq-sig,
|
||||
* curve=ml-dsa-65, named "pq_sig" (or pass the role name as the 2nd arg).
|
||||
* - A mnemonic must be loaded in the signer.
|
||||
*
|
||||
* Usage: ./pq_sign_example [socket_name] [role_name]
|
||||
*
|
||||
* Default socket_name: nsigner
|
||||
* Default role_name: pq_sig
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "nostr_common.h"
|
||||
#include "nsigner_transport.h"
|
||||
#include "nsigner_client.h"
|
||||
#include "../cjson/cJSON.h"
|
||||
|
||||
static int get_structured_pubkey(nsigner_client_t *client, const char *role,
|
||||
cJSON **out_obj) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
cJSON *parsed = NULL;
|
||||
int rc = -1;
|
||||
|
||||
*out_obj = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return -1;
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "get_public_key", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
/* result is a cJSON string containing the serialized structured object. */
|
||||
if (cJSON_IsString(result)) {
|
||||
parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL && cJSON_IsObject(parsed)) {
|
||||
*out_obj = parsed;
|
||||
parsed = NULL;
|
||||
rc = 0;
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(parsed);
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return rc;
|
||||
}
|
||||
|
||||
static char *sign_data(nsigner_client_t *client, const char *role,
|
||||
const char *msg_hex) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
char *sig_hex = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return NULL;
|
||||
|
||||
cJSON_AddItemToArray(params, cJSON_CreateString(msg_hex));
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "sign_data", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
/* result is a string containing {"signature":"<hex>","algorithm":"<alg>"} */
|
||||
if (cJSON_IsString(result)) {
|
||||
cJSON *parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *sig_item = cJSON_GetObjectItemCaseSensitive(parsed, "signature");
|
||||
if (cJSON_IsString(sig_item)) {
|
||||
sig_hex = strdup(sig_item->valuestring);
|
||||
}
|
||||
cJSON_Delete(parsed);
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return sig_hex;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
const char *socket_name = "nsigner";
|
||||
const char *role = "pq_sig";
|
||||
/* "hello post-quantum world" in hex */
|
||||
const char *msg_hex = "68656c6c6f20706f73742d7175616e74756d20776f726c64";
|
||||
nsigner_transport_t *transport = NULL;
|
||||
nsigner_client_t *client = NULL;
|
||||
cJSON *pubkey_obj = NULL;
|
||||
char *sig_hex = NULL;
|
||||
int rc = 1;
|
||||
|
||||
if (argc > 1 && argv[1] != NULL && argv[1][0] != '\0') {
|
||||
socket_name = argv[1];
|
||||
}
|
||||
if (argc > 2 && argv[2] != NULL && argv[2][0] != '\0') {
|
||||
role = argv[2];
|
||||
}
|
||||
|
||||
if (nostr_init() != NOSTR_SUCCESS) {
|
||||
fprintf(stderr, "failed to initialize crypto subsystem\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
transport = nsigner_transport_open_unix(socket_name, 10000);
|
||||
if (transport == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot open unix transport @%s\n", socket_name);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
client = nsigner_client_new(transport);
|
||||
if (client == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot create nsigner client\n");
|
||||
transport->close(transport);
|
||||
goto cleanup;
|
||||
}
|
||||
transport = NULL;
|
||||
|
||||
printf("=== PQ Sign Example (ML-DSA-65) ===\n");
|
||||
printf("socket: %s\n", socket_name);
|
||||
printf("role: %s\n", role);
|
||||
printf("\n");
|
||||
|
||||
/* 1. Get the structured public key. */
|
||||
if (get_structured_pubkey(client, role, &pubkey_obj) != 0 || pubkey_obj == NULL) {
|
||||
fprintf(stderr, "get_public_key failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
{
|
||||
cJSON *alg_item = cJSON_GetObjectItemCaseSensitive(pubkey_obj, "algorithm");
|
||||
cJSON *pk_item = cJSON_GetObjectItemCaseSensitive(pubkey_obj, "public_key");
|
||||
cJSON *kid_item = cJSON_GetObjectItemCaseSensitive(pubkey_obj, "key_id");
|
||||
|
||||
printf("Public Key:\n");
|
||||
printf(" algorithm: %s\n",
|
||||
(cJSON_IsString(alg_item)) ? alg_item->valuestring : "?");
|
||||
printf(" key_id: %s\n",
|
||||
(cJSON_IsString(kid_item)) ? kid_item->valuestring : "?");
|
||||
if (cJSON_IsString(pk_item)) {
|
||||
/* ML-DSA-65 public key is 3904 hex chars — print length + prefix. */
|
||||
printf(" pub_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(pk_item->valuestring), strlen(pk_item->valuestring) / 2);
|
||||
printf(" pub_head: %.64s...\n", pk_item->valuestring);
|
||||
} else {
|
||||
printf(" public_key: (missing)\n");
|
||||
}
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
/* 2. Sign a test message. */
|
||||
printf("Signing message (hex): %s\n", msg_hex);
|
||||
sig_hex = sign_data(client, role, msg_hex);
|
||||
if (sig_hex == NULL) {
|
||||
fprintf(stderr, "sign_data failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
printf("Signature:\n");
|
||||
printf(" sig_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(sig_hex), strlen(sig_hex) / 2);
|
||||
printf(" sig_head: %.64s...\n", sig_hex);
|
||||
printf("\n");
|
||||
|
||||
printf("To verify externally, use ML-DSA-65 (FIPS 204) verify with the\n");
|
||||
printf("public key above, the message, and this signature.\n");
|
||||
|
||||
rc = 0;
|
||||
|
||||
cleanup:
|
||||
free(sig_hex);
|
||||
cJSON_Delete(pubkey_obj);
|
||||
nsigner_client_free(client);
|
||||
nostr_cleanup();
|
||||
return rc;
|
||||
}
|
||||
212
examples/ssh_sign_example.c
Normal file
212
examples/ssh_sign_example.c
Normal file
@@ -0,0 +1,212 @@
|
||||
/*
|
||||
* ssh_sign_example.c — connect to a running n_signer over its abstract UNIX
|
||||
* socket and demonstrate SSH signing with ed25519.
|
||||
*
|
||||
* The example:
|
||||
* 1. Sends a get_public_key request for an SSH/ed25519 role ("ssh_main").
|
||||
* 2. Prints the structured public key (algorithm, public_key, key_id).
|
||||
* 3. Sends an ssh_sign request with a test session ID.
|
||||
* 4. Prints the signature (hex) and algorithm.
|
||||
*
|
||||
* Prerequisites:
|
||||
* - n_signer must be running with a role configured for purpose=ssh,
|
||||
* curve=ed25519, named "ssh_main" (or pass the role name as the 2nd arg).
|
||||
* - A mnemonic must be loaded in the signer.
|
||||
*
|
||||
* Usage: ./ssh_sign_example [socket_name] [role_name]
|
||||
*
|
||||
* Default socket_name: nsigner
|
||||
* Default role_name: ssh_main
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "nostr_common.h"
|
||||
#include "nsigner_transport.h"
|
||||
#include "nsigner_client.h"
|
||||
#include "../cjson/cJSON.h"
|
||||
|
||||
static int get_structured_pubkey(nsigner_client_t *client, const char *role,
|
||||
char **out_pub_hex, char **out_key_id) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
cJSON *parsed = NULL;
|
||||
int rc = -1;
|
||||
|
||||
*out_pub_hex = NULL;
|
||||
*out_key_id = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return -1;
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "get_public_key", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return -1;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
if (cJSON_IsString(result)) {
|
||||
parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *pk_item = cJSON_GetObjectItemCaseSensitive(parsed, "public_key");
|
||||
cJSON *kid_item = cJSON_GetObjectItemCaseSensitive(parsed, "key_id");
|
||||
if (cJSON_IsString(pk_item)) {
|
||||
*out_pub_hex = strdup(pk_item->valuestring);
|
||||
}
|
||||
if (cJSON_IsString(kid_item)) {
|
||||
*out_key_id = strdup(kid_item->valuestring);
|
||||
}
|
||||
if (*out_pub_hex != NULL) {
|
||||
rc = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(parsed);
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return rc;
|
||||
}
|
||||
|
||||
static char *ssh_sign(nsigner_client_t *client, const char *role,
|
||||
const char *msg_hex) {
|
||||
cJSON *params = NULL;
|
||||
cJSON *opts = NULL;
|
||||
cJSON *result = NULL;
|
||||
char *sig_hex = NULL;
|
||||
|
||||
params = cJSON_CreateArray();
|
||||
if (params == NULL) return NULL;
|
||||
|
||||
cJSON_AddItemToArray(params, cJSON_CreateString(msg_hex));
|
||||
|
||||
opts = cJSON_CreateObject();
|
||||
if (opts == NULL) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
cJSON_AddStringToObject(opts, "role", role);
|
||||
cJSON_AddItemToArray(params, opts);
|
||||
opts = NULL;
|
||||
|
||||
if (nsigner_client_call(client, "ssh_sign", params, &result) != NOSTR_SUCCESS) {
|
||||
cJSON_Delete(params);
|
||||
return NULL;
|
||||
}
|
||||
params = NULL;
|
||||
|
||||
if (cJSON_IsString(result)) {
|
||||
cJSON *parsed = cJSON_Parse(result->valuestring);
|
||||
if (parsed != NULL) {
|
||||
cJSON *sig_item = cJSON_GetObjectItemCaseSensitive(parsed, "signature");
|
||||
if (cJSON_IsString(sig_item)) {
|
||||
sig_hex = strdup(sig_item->valuestring);
|
||||
}
|
||||
cJSON_Delete(parsed);
|
||||
}
|
||||
}
|
||||
|
||||
cJSON_Delete(result);
|
||||
cJSON_Delete(params);
|
||||
return sig_hex;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
const char *socket_name = "nsigner";
|
||||
const char *role = "ssh_main";
|
||||
/* A fake SSH session ID (32 bytes = 64 hex chars) for demonstration. */
|
||||
const char *session_id_hex =
|
||||
"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
|
||||
nsigner_transport_t *transport = NULL;
|
||||
nsigner_client_t *client = NULL;
|
||||
char *pub_hex = NULL;
|
||||
char *key_id = NULL;
|
||||
char *sig_hex = NULL;
|
||||
int rc = 1;
|
||||
|
||||
if (argc > 1 && argv[1] != NULL && argv[1][0] != '\0') {
|
||||
socket_name = argv[1];
|
||||
}
|
||||
if (argc > 2 && argv[2] != NULL && argv[2][0] != '\0') {
|
||||
role = argv[2];
|
||||
}
|
||||
|
||||
if (nostr_init() != NOSTR_SUCCESS) {
|
||||
fprintf(stderr, "failed to initialize crypto subsystem\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
transport = nsigner_transport_open_unix(socket_name, 10000);
|
||||
if (transport == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot open unix transport @%s\n", socket_name);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
client = nsigner_client_new(transport);
|
||||
if (client == NULL) {
|
||||
fprintf(stderr, "connect failed: cannot create nsigner client\n");
|
||||
transport->close(transport);
|
||||
goto cleanup;
|
||||
}
|
||||
transport = NULL;
|
||||
|
||||
printf("=== SSH Sign Example (ed25519) ===\n");
|
||||
printf("socket: %s\n", socket_name);
|
||||
printf("role: %s\n", role);
|
||||
printf("\n");
|
||||
|
||||
/* 1. Get the ed25519 public key. */
|
||||
if (get_structured_pubkey(client, role, &pub_hex, &key_id) != 0 ||
|
||||
pub_hex == NULL) {
|
||||
fprintf(stderr, "get_public_key failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
printf("Public Key:\n");
|
||||
printf(" algorithm: ed25519\n");
|
||||
printf(" key_id: %s\n", (key_id != NULL) ? key_id : "?");
|
||||
printf(" pub_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(pub_hex), strlen(pub_hex) / 2);
|
||||
printf(" pubkey: %s\n", pub_hex);
|
||||
printf("\n");
|
||||
|
||||
/* 2. Sign a test SSH session ID. */
|
||||
printf("Signing SSH session ID (hex): %s\n", session_id_hex);
|
||||
sig_hex = ssh_sign(client, role, session_id_hex);
|
||||
if (sig_hex == NULL) {
|
||||
fprintf(stderr, "ssh_sign failed: %s\n",
|
||||
nsigner_client_last_error(client));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
printf("Signature:\n");
|
||||
printf(" sig_len: %zu hex chars (%zu bytes)\n",
|
||||
strlen(sig_hex), strlen(sig_hex) / 2);
|
||||
printf(" sig: %s\n", sig_hex);
|
||||
printf("\n");
|
||||
|
||||
printf("This ed25519 signature can be verified with the public key above\n");
|
||||
printf("using standard ed25519 verify (e.g. libsodium, OpenSSL EVP_DigestVerify).\n");
|
||||
|
||||
rc = 0;
|
||||
|
||||
cleanup:
|
||||
free(pub_hex);
|
||||
free(key_id);
|
||||
free(sig_hex);
|
||||
nsigner_client_free(client);
|
||||
nostr_cleanup();
|
||||
return rc;
|
||||
}
|
||||
Reference in New Issue
Block a user