laantungir/n_signer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 40 Wiki Activity

v0.0.47 - Added post-quantum cryptography (ML-DSA-65, SLH-DSA-128s, ML-KEM-768) and standard ECC (ed25519, x25519) support with algorithm-based API

Browse Source
This commit is contained in:
Laan Tungir
2026-07-16 15:14:57 -04:00
parent 6fd7b8ce1f
commit c5f1a70658
66 changed files with 19091 additions and 257 deletions
Download Patch File Download Diff File Expand all files Collapse all files

693
tests/test_algorithm_api.c Normal file
View File

@@ -0,0 +1,693 @@
/* test_algorithm_api.c — Tests for the algorithm-based API.
*
* Tests the new verbs: sign, verify, encapsulate, decapsulate,
* derive_shared_secret, and the algorithm-based get_public_key.
* Also tests old verb aliases and enforcement.
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum { PURPOSE_NOSTR=0, PURPOSE_BITCOIN, PURPOSE_SSH, PURPOSE_AGE, PURPOSE_FIPS, PURPOSE_PQ_SIG, PURPOSE_PQ_KEM, PURPOSE_UNKNOWN } role_purpose_t;
typedef enum { CURVE_SECP256K1=0, CURVE_ED25519, CURVE_X25519, CURVE_ML_DSA_65, CURVE_SLH_DSA_128S, CURVE_ML_KEM_768, CURVE_UNKNOWN } role_curve_t;
typedef enum { SELECTOR_NOSTR_INDEX, SELECTOR_ROLE_PATH } role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct { role_entry_t entries[ROLE_TABLE_MAX_ENTRIES]; int count; } role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define ENFORCE_ERR_ALGORITHM -4
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
typedef enum { PROMPT_NEVER=0, PROMPT_FIRST_PER_BOOT, PROMPT_EVERY_REQUEST, PROMPT_DENY } prompt_mode_t;
typedef enum { POLICY_SOURCE_DEFAULT=0, POLICY_SOURCE_PREAPPROVE, POLICY_SOURCE_SESSION_GRANT } policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
char algorithms[16][32];
int alg_count;
int index_min;
int index_max;
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct { policy_entry_t entries[POLICY_MAX_ENTRIES]; int count; } policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* from pq_crypto.h */
typedef enum { CRYPTO_ALG_SECP256K1=0, CRYPTO_ALG_ED25519, CRYPTO_ALG_X25519, CRYPTO_ALG_ML_DSA_65, CRYPTO_ALG_SLH_DSA_128S, CRYPTO_ALG_ML_KEM_768, CRYPTO_ALG_UNKNOWN } crypto_alg_t;
typedef struct { size_t priv_key_len; size_t pub_key_len; size_t sig_len; size_t ciphertext_len; size_t shared_secret_len; } crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len, const unsigned char *peer_pub, size_t pub_len, unsigned char *shared_out, size_t *shared_out_len);
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path, unsigned char *seed_out, size_t seed_out_len);
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len, unsigned char *ct_out, unsigned char *ss_out);
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len, const unsigned char *ct, size_t ct_len, unsigned char *ss_out);
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from alg_api.h */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct { alg_key_entry_t entries[ALG_KEY_CACHE_MAX]; int count; } algorithm_key_cache_t;
void alg_key_cache_init(algorithm_key_cache_t *cache);
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from crypto.h */
typedef struct {
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char npub[128];
crypto_alg_t alg;
int valid;
} derived_key_t;
typedef struct { derived_key_t keys[ROLE_TABLE_MAX_ENTRIES]; int count; } key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* from main.h */
#define NSIGNER_VERSION "v0.0.2"
/* NSIGNER_HEADERLESS_DECLS_END */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <nostr_core/utils.h>
#include <nostr_core/nostr_common.h>
static int g_passes = 0;
static int g_total = 0;
static void check(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int resp_has(const char *resp, const char *needle) {
return (resp != NULL && needle != NULL && strstr(resp, needle) != NULL);
}
/* Extract a string field from a JSON result object embedded in a response.
* The response format is {"id":"...","result":"{...}"} where the result
* value is a JSON string. This extracts the result string, parses it,
* and returns the value of the given field. Caller must free. */
static char *extract_result_field(const char *response, const char *field) {
cJSON *root, *result_item, *result_obj, *field_item;
char *out = NULL;
if (response == NULL || field == NULL) return NULL;
root = cJSON_Parse(response);
if (root == NULL) return NULL;
result_item = cJSON_GetObjectItemCaseSensitive(root, "result");
if (!cJSON_IsString(result_item) || result_item->valuestring == NULL) {
cJSON_Delete(root);
return NULL;
}
result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj == NULL) {
cJSON_Delete(root);
return NULL;
}
field_item = cJSON_GetObjectItemCaseSensitive(result_obj, field);
if (cJSON_IsString(field_item) && field_item->valuestring != NULL) {
out = strdup(field_item->valuestring);
}
cJSON_Delete(result_obj);
cJSON_Delete(root);
return out;
}
static int extract_result_bool(const char *response, const char *field) {
cJSON *root, *result_item, *result_obj, *field_item;
int val = -1;
if (response == NULL || field == NULL) return -1;
root = cJSON_Parse(response);
if (root == NULL) return -1;
result_item = cJSON_GetObjectItemCaseSensitive(root, "result");
if (!cJSON_IsString(result_item) || result_item->valuestring == NULL) {
cJSON_Delete(root);
return -1;
}
result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj == NULL) {
cJSON_Delete(root);
return -1;
}
field_item = cJSON_GetObjectItemCaseSensitive(result_obj, field);
if (cJSON_IsBool(field_item)) {
val = cJSON_IsTrue(field_item) ? 1 : 0;
}
cJSON_Delete(result_obj);
cJSON_Delete(root);
return val;
}
/* File-level statics to avoid stack overflow (key_store_t is ~2.1MB) */
static key_store_t g_key_store;
static algorithm_key_cache_t g_alg_key_cache;
static mnemonic_state_t g_mnemonic;
static role_table_t g_role_table;
static dispatcher_ctx_t g_dispatcher;
int main(void) {
const char *valid_12 = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
char *resp;
char *sig_hex;
char *pub_hex;
char *ct_hex;
char *ss_hex1;
char *ss_hex2;
char *shared_hex;
char request[32768];
int rc;
/* ---- Setup ---- */
role_table_init(&g_role_table);
{
role_entry_t main_role;
memset(&main_role, 0, sizeof(main_role));
strncpy(main_role.name, "main", sizeof(main_role.name) - 1);
strncpy(main_role.purpose_str, "nostr", sizeof(main_role.purpose_str) - 1);
strncpy(main_role.curve_str, "secp256k1", sizeof(main_role.curve_str) - 1);
main_role.purpose = role_purpose_from_str("nostr");
main_role.curve = role_curve_from_str("secp256k1");
main_role.selector_type = SELECTOR_NOSTR_INDEX;
main_role.nostr_index = 0;
role_table_add(&g_role_table, &main_role);
}
mnemonic_init(&g_mnemonic);
rc = mnemonic_load(&g_mnemonic, valid_12);
check("mnemonic_load succeeds", rc == 0);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
rc = nostr_init();
check("nostr_init succeeds", rc == 0);
crypto_derive_all(&g_key_store, &g_role_table, &g_mnemonic);
dispatcher_init(&g_dispatcher, &g_role_table, &g_mnemonic, &g_key_store, &g_alg_key_cache);
/* ---- Enforcement tests ---- */
check("enforce sign + ed25519 -> OK",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_ED25519) == ENFORCE_OK);
check("enforce sign + secp256k1 -> OK",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_SECP256K1) == ENFORCE_OK);
check("enforce sign + ml-dsa-65 -> OK",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_ML_DSA_65) == ENFORCE_OK);
check("enforce sign + slh-dsa-128s -> OK",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_SLH_DSA_128S) == ENFORCE_OK);
check("enforce sign + x25519 -> ALGORITHM err",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_X25519) == ENFORCE_ERR_ALGORITHM);
check("enforce sign + ml-kem-768 -> ALGORITHM err",
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_ML_KEM_768) == ENFORCE_ERR_ALGORITHM);
check("enforce encapsulate + ml-kem-768 -> OK",
enforce_verb_algorithm(VERB_ENCAPSULATE, CRYPTO_ALG_ML_KEM_768) == ENFORCE_OK);
check("enforce encapsulate + ed25519 -> ALGORITHM err",
enforce_verb_algorithm(VERB_ENCAPSULATE, CRYPTO_ALG_ED25519) == ENFORCE_ERR_ALGORITHM);
check("enforce decapsulate + ml-kem-768 -> OK",
enforce_verb_algorithm(VERB_DECAPSULATE, CRYPTO_ALG_ML_KEM_768) == ENFORCE_OK);
check("enforce derive_shared_secret + x25519 -> OK",
enforce_verb_algorithm(VERB_DERIVE_SHARED, CRYPTO_ALG_X25519) == ENFORCE_OK);
check("enforce derive_shared_secret + ed25519 -> ALGORITHM err",
enforce_verb_algorithm(VERB_DERIVE_SHARED, CRYPTO_ALG_ED25519) == ENFORCE_ERR_ALGORITHM);
check("enforce get_public_key + any alg -> OK",
enforce_verb_algorithm(VERB_GET_PUBLIC_KEY, CRYPTO_ALG_ED25519) == ENFORCE_OK);
check("enforce sign_event + secp256k1 -> OK",
enforce_verb_algorithm(VERB_SIGN_EVENT, CRYPTO_ALG_SECP256K1) == ENFORCE_OK);
check("enforce sign_event + ed25519 -> ALGORITHM err",
enforce_verb_algorithm(VERB_SIGN_EVENT, CRYPTO_ALG_ED25519) == ENFORCE_ERR_ALGORITHM);
/* ---- get_public_key with algorithm parameter ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"gpk1\",\"method\":\"get_public_key\",\"params\":[{\"algorithm\":\"ed25519\",\"index\":0}]}");
check("get_public_key algorithm=ed25519 returns result",
resp_has(resp, "\"result\""));
check("get_public_key algorithm=ed25519 has algorithm field",
resp_has(resp, "ed25519"));
check("get_public_key algorithm=ed25519 has public_key field",
resp_has(resp, "public_key"));
check("get_public_key algorithm=ed25519 has key_id field",
resp_has(resp, "key_id"));
free(resp);
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"gpk2\",\"method\":\"get_public_key\",\"params\":[{\"algorithm\":\"ml-dsa-65\",\"index\":0}]}");
check("get_public_key algorithm=ml-dsa-65 returns result",
resp_has(resp, "\"result\""));
check("get_public_key algorithm=ml-dsa-65 has algorithm field",
resp_has(resp, "ml-dsa-65"));
free(resp);
/* ---- sign + verify roundtrip: ed25519 ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"s1\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"ed25519\",\"index\":0}]}");
check("sign ed25519 returns result",
resp_has(resp, "\"result\""));
check("sign ed25519 has signature field",
resp_has(resp, "signature"));
check("sign ed25519 has algorithm ed25519",
resp_has(resp, "ed25519"));
check("sign ed25519 has key_id",
resp_has(resp, "key_id"));
sig_hex = extract_result_field(resp, "signature");
free(resp);
check("sign ed25519 extracted signature", sig_hex != NULL && strlen(sig_hex) > 0);
if (sig_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"v1\",\"method\":\"verify\",\"params\":[\"68656c6c6f\",\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify ed25519 returns result", resp_has(resp, "\"result\""));
check("verify ed25519 valid:true", extract_result_bool(resp, "valid") == 1);
free(resp);
/* verify with wrong message */
snprintf(request, sizeof(request),
"{\"id\":\"v2\",\"method\":\"verify\",\"params\":[\"776f726c64\",\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify ed25519 wrong msg valid:false", extract_result_bool(resp, "valid") == 0);
free(resp);
free(sig_hex);
}
/* ---- sign + verify roundtrip: ml-dsa-65 ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"s2\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"ml-dsa-65\",\"index\":0}]}");
check("sign ml-dsa-65 returns result", resp_has(resp, "\"result\""));
check("sign ml-dsa-65 has signature", resp_has(resp, "signature"));
sig_hex = extract_result_field(resp, "signature");
free(resp);
check("sign ml-dsa-65 extracted signature", sig_hex != NULL && strlen(sig_hex) > 0);
if (sig_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"v3\",\"method\":\"verify\",\"params\":[\"68656c6c6f\",\"%s\",{\"algorithm\":\"ml-dsa-65\",\"index\":0}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify ml-dsa-65 valid:true", extract_result_bool(resp, "valid") == 1);
free(resp);
free(sig_hex);
}
/* ---- sign + verify roundtrip: slh-dsa-128s ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"s3\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"slh-dsa-128s\",\"index\":0}]}");
check("sign slh-dsa-128s returns result", resp_has(resp, "\"result\""));
sig_hex = extract_result_field(resp, "signature");
free(resp);
check("sign slh-dsa-128s extracted signature", sig_hex != NULL && strlen(sig_hex) > 0);
if (sig_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"v4\",\"method\":\"verify\",\"params\":[\"68656c6c6f\",\"%s\",{\"algorithm\":\"slh-dsa-128s\",\"index\":0}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify slh-dsa-128s valid:true", extract_result_bool(resp, "valid") == 1);
free(resp);
free(sig_hex);
}
/* ---- sign + verify roundtrip: secp256k1 schnorr ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"s4\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"secp256k1\",\"index\":0,\"scheme\":\"schnorr\"}]}");
check("sign secp256k1 schnorr returns result", resp_has(resp, "\"result\""));
sig_hex = extract_result_field(resp, "signature");
free(resp);
check("sign secp256k1 schnorr extracted signature", sig_hex != NULL && strlen(sig_hex) == 128);
if (sig_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"v5\",\"method\":\"verify\",\"params\":[\"68656c6c6f\",\"%s\",{\"algorithm\":\"secp256k1\",\"index\":0,\"scheme\":\"schnorr\"}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify secp256k1 schnorr valid:true", extract_result_bool(resp, "valid") == 1);
free(resp);
free(sig_hex);
}
/* ---- sign + verify roundtrip: secp256k1 ecdsa ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"s5\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"secp256k1\",\"index\":0,\"scheme\":\"ecdsa\"}]}");
check("sign secp256k1 ecdsa returns result", resp_has(resp, "\"result\""));
sig_hex = extract_result_field(resp, "signature");
free(resp);
check("sign secp256k1 ecdsa extracted signature", sig_hex != NULL && strlen(sig_hex) == 128);
if (sig_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"v6\",\"method\":\"verify\",\"params\":[\"68656c6c6f\",\"%s\",{\"algorithm\":\"secp256k1\",\"index\":0,\"scheme\":\"ecdsa\"}]}",
sig_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("verify secp256k1 ecdsa valid:true", extract_result_bool(resp, "valid") == 1);
free(resp);
free(sig_hex);
}
/* ---- encapsulate + decapsulate: ml-kem-768 ---- */
/* First get our ML-KEM public key */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"gpk3\",\"method\":\"get_public_key\",\"params\":[{\"algorithm\":\"ml-kem-768\",\"index\":0}]}");
pub_hex = extract_result_field(resp, "public_key");
check("get_public_key ml-kem-768 returns public_key", pub_hex != NULL && strlen(pub_hex) > 0);
free(resp);
if (pub_hex) {
/* Encapsulate with our own public key (for testing) */
snprintf(request, sizeof(request),
"{\"id\":\"e1\",\"method\":\"encapsulate\",\"params\":[\"%s\",{\"algorithm\":\"ml-kem-768\"}]}",
pub_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("encapsulate ml-kem-768 returns result", resp_has(resp, "\"result\""));
check("encapsulate ml-kem-768 has ciphertext", resp_has(resp, "ciphertext"));
check("encapsulate ml-kem-768 has shared_secret", resp_has(resp, "shared_secret"));
ct_hex = extract_result_field(resp, "ciphertext");
ss_hex1 = extract_result_field(resp, "shared_secret");
free(resp);
check("encapsulate extracted ciphertext", ct_hex != NULL && strlen(ct_hex) > 0);
check("encapsulate extracted shared_secret", ss_hex1 != NULL && strlen(ss_hex1) > 0);
if (ct_hex) {
/* Decapsulate with our private key */
snprintf(request, sizeof(request),
"{\"id\":\"d1\",\"method\":\"decapsulate\",\"params\":[\"%s\",{\"algorithm\":\"ml-kem-768\",\"index\":0}]}",
ct_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("decapsulate ml-kem-768 returns result", resp_has(resp, "\"result\""));
check("decapsulate ml-kem-768 has shared_secret", resp_has(resp, "shared_secret"));
ss_hex2 = extract_result_field(resp, "shared_secret");
free(resp);
check("decapsulate extracted shared_secret", ss_hex2 != NULL);
/* Verify the shared secrets match */
if (ss_hex1 && ss_hex2) {
check("encapsulate/decapsulate shared secrets match",
strcmp(ss_hex1, ss_hex2) == 0);
}
free(ss_hex2);
}
free(ct_hex);
free(ss_hex1);
free(pub_hex);
}
/* ---- derive_shared_secret: x25519 ---- */
/* Get our x25519 public key */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"gpk4\",\"method\":\"get_public_key\",\"params\":[{\"algorithm\":\"x25519\",\"index\":0}]}");
pub_hex = extract_result_field(resp, "public_key");
check("get_public_key x25519 returns public_key", pub_hex != NULL && strlen(pub_hex) > 0);
free(resp);
if (pub_hex) {
/* Derive shared secret with our own public key (for testing) */
snprintf(request, sizeof(request),
"{\"id\":\"dss1\",\"method\":\"derive_shared_secret\",\"params\":[\"%s\",{\"algorithm\":\"x25519\",\"index\":0}]}",
pub_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("derive_shared_secret x25519 returns result", resp_has(resp, "\"result\""));
check("derive_shared_secret x25519 has shared_secret", resp_has(resp, "shared_secret"));
check("derive_shared_secret x25519 has algorithm x25519", resp_has(resp, "x25519"));
shared_hex = extract_result_field(resp, "shared_secret");
free(resp);
check("derive_shared_secret extracted shared_secret", shared_hex != NULL && strlen(shared_hex) == 64);
free(shared_hex);
free(pub_hex);
}
/* ---- Enforcement via dispatcher: sign with x25519 fails ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"err1\",\"method\":\"sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"x25519\",\"index\":0}]}");
check("sign x25519 returns algorithm error",
resp_has(resp, "algorithm_not_supported_for_verb") || resp_has(resp, "\"code\":1010"));
free(resp);
/* ---- Enforcement via dispatcher: encapsulate with ed25519 fails ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"err2\",\"method\":\"encapsulate\",\"params\":[\"abcd\",{\"algorithm\":\"ed25519\"}]}");
check("encapsulate ed25519 returns algorithm error",
resp_has(resp, "algorithm_not_supported_for_verb") || resp_has(resp, "\"code\":1010"));
free(resp);
/* ---- Old verb alias: sign_data with algorithm=ed25519 ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"alias1\",\"method\":\"sign_data\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"ed25519\",\"index\":0}]}");
check("sign_data alias with algorithm=ed25519 returns result",
resp_has(resp, "\"result\""));
check("sign_data alias has signature",
resp_has(resp, "signature"));
free(resp);
/* ---- Old verb alias: ssh_sign with algorithm=ed25519 ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"alias2\",\"method\":\"ssh_sign\",\"params\":[\"68656c6c6f\",{\"algorithm\":\"ed25519\",\"index\":0}]}");
check("ssh_sign alias with algorithm=ed25519 returns result",
resp_has(resp, "\"result\""));
free(resp);
/* ---- Old verb alias: kem_encapsulate with algorithm=ml-kem-768 ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"gpk5\",\"method\":\"get_public_key\",\"params\":[{\"algorithm\":\"ml-kem-768\",\"index\":1}]}");
pub_hex = extract_result_field(resp, "public_key");
free(resp);
if (pub_hex) {
snprintf(request, sizeof(request),
"{\"id\":\"alias3\",\"method\":\"kem_encapsulate\",\"params\":[\"%s\",{\"algorithm\":\"ml-kem-768\"}]}",
pub_hex);
resp = dispatcher_handle_request(&g_dispatcher, request);
check("kem_encapsulate alias with algorithm=ml-kem-768 returns result",
resp_has(resp, "\"result\""));
check("kem_encapsulate alias has ciphertext",
resp_has(resp, "ciphertext"));
free(resp);
free(pub_hex);
}
/* ---- Backward compat: sign_event with role still works ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"bc1\",\"method\":\"sign_event\",\"params\":[\"{\\\"kind\\\":1,\\\"content\\\":\\\"hello\\\",\\\"tags\\\":[]}\",{\"role\":\"main\"}]}");
check("sign_event with role=main (backward compat) returns signed event",
resp_has(resp, "pubkey") && resp_has(resp, "sig"));
free(resp);
/* ---- Backward compat: get_public_key with role still works ---- */
resp = dispatcher_handle_request(&g_dispatcher,
"{\"id\":\"bc2\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"main\"}]}");
check("get_public_key with role=main (backward compat) returns hex",
resp_has(resp, "\"result\""));
free(resp);
/* ---- Policy: algorithm-based preapprove ---- */
{
policy_table_t policy;
policy_entry_t entry;
policy_source_t src;
policy_init_default(&policy, 1000);
/* Add algorithm-based preapprove entry */
memset(&entry, 0, sizeof(entry));
strncpy(entry.caller, "uid:1000", sizeof(entry.caller) - 1);
strncpy(entry.algorithms[0], "ed25519", sizeof(entry.algorithms[0]) - 1);
entry.alg_count = 1;
entry.index_min = 0;
entry.index_max = 4;
strncpy(entry.verbs[0], "sign", sizeof(entry.verbs[0]) - 1);
strncpy(entry.verbs[1], "verify", sizeof(entry.verbs[1]) - 1);
entry.verb_count = 2;
entry.prompt = PROMPT_NEVER;
entry.source = POLICY_SOURCE_PREAPPROVE;
policy_table_add(&policy, &entry);
/* Check: allowed */
rc = policy_check_algorithm(&policy, "uid:1000", "sign", "ed25519", 0, &src);
check("policy_check_algorithm: sign ed25519 idx=0 -> ALLOW", rc == POLICY_ALLOW);
rc = policy_check_algorithm(&policy, "uid:1000", "sign", "ed25519", 3, &src);
check("policy_check_algorithm: sign ed25519 idx=3 -> ALLOW", rc == POLICY_ALLOW);
/* Check: index out of range */
rc = policy_check_algorithm(&policy, "uid:1000", "sign", "ed25519", 5, &src);
check("policy_check_algorithm: sign ed25519 idx=5 -> NO_MATCH", rc == POLICY_NO_MATCH);
/* Check: wrong algorithm */
rc = policy_check_algorithm(&policy, "uid:1000", "sign", "ml-dsa-65", 0, &src);
check("policy_check_algorithm: sign ml-dsa-65 -> NO_MATCH", rc == POLICY_NO_MATCH);
/* Check: wrong verb */
rc = policy_check_algorithm(&policy, "uid:1000", "encapsulate", "ed25519", 0, &src);
check("policy_check_algorithm: encapsulate ed25519 -> NO_MATCH", rc == POLICY_NO_MATCH);
/* Check: wrong caller */
rc = policy_check_algorithm(&policy, "uid:2000", "sign", "ed25519", 0, &src);
check("policy_check_algorithm: wrong caller -> NO_MATCH", rc == POLICY_NO_MATCH);
}
/* ---- Cleanup ---- */
crypto_wipe(&g_key_store);
alg_key_cache_wipe(&g_alg_key_cache);
nostr_cleanup();
mnemonic_unload(&g_mnemonic);
printf("%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

268
tests/test_dispatcher.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -198,6 +203,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -233,6 +256,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -257,6 +282,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -290,6 +321,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -297,15 +342,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -339,6 +516,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -347,10 +600,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.
@@ -517,6 +771,7 @@ int main(void) {
mnemonic_state_t mnemonic;
dispatcher_ctx_t dispatcher;
key_store_t key_store;
static algorithm_key_cache_t alg_key_cache;
const char *valid_12 = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
char *resp;
int derived;
@@ -536,7 +791,8 @@ int main(void) {
mnemonic_load(&mnemonic, valid_12);
memset(&key_store, 0, sizeof(key_store));
dispatcher_init(&dispatcher, &table, &mnemonic, &key_store);
alg_key_cache_init(&alg_key_cache);
dispatcher_init(&dispatcher, &table, &mnemonic, &key_store, &alg_key_cache);
derived = nostr_init();
check_condition("nostr_init succeeds", derived == 0);

901
tests/test_ed25519_x25519.c Normal file
View File

@@ -0,0 +1,901 @@
/* Test for Phase 2 ed25519 + x25519 crypto (pq_crypto.c, key_store.c,
* enforcement.c, dispatcher.c).
*
* Verifies:
* - ed25519 keygen from seed: 32-byte priv/pub
* - ed25519 sign/verify roundtrip + wrong-message fails
* - ed25519 determinism: same seed -> same keypair
* - x25519 keygen from seed: 32-byte priv/pub
* - x25519 ECDH roundtrip: two sides derive matching shared secret
* - x25519 determinism: same seed -> same keypair
* - SLIP-0010 derivation: deterministic seed from mnemonic+path
* - Integration: derive ed25519 key via crypto_derive_one, sign_data via
* dispatcher, verify signature
* - Enforcement: sign_data allowed on ssh+ed25519, rejected on nostr+secp256k1
* - Enforcement: ssh_sign allowed on ssh+ed25519
* - Enforcement: kem_encapsulate/decapsulate rejected on ssh/ed25519
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0,
PURPOSE_BITCOIN,
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG,
PURPOSE_PQ_KEM,
PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
typedef enum {
SELECTOR_NOSTR_INDEX,
SELECTOR_ROLE_PATH
} role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_entry_t *role_table_find_by_nostr_index(role_table_t *table, int index);
role_entry_t *role_table_find_by_path(role_table_t *table, const char *path);
role_entry_t *role_table_get_default(role_table_t *table);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
int role_table_register_nostr_index(role_table_t *table, int nostr_index);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
PROMPT_FIRST_PER_BOOT,
PROMPT_EVERY_REQUEST,
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0,
POLICY_SOURCE_PREAPPROVE,
POLICY_SOURCE_SESSION_GRANT
} policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0,
CRYPTO_ALG_ED25519,
CRYPTO_ALG_X25519,
CRYPTO_ALG_ML_DSA_65,
CRYPTO_ALG_SLH_DSA_128S,
CRYPTO_ALG_ML_KEM_768,
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len;
size_t ciphertext_len;
size_t shared_secret_len;
} crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
static algorithm_key_cache_t g_alg_key_cache;
#include <nostr_core/nostr_common.h>
#include <nostr_core/utils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
static int g_passes = 0;
static int g_total = 0;
static void check_condition(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int response_has(const char *response, const char *needle) {
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
}
static role_entry_t make_ssh_ed25519_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "ssh", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "ed25519", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
static role_entry_t make_nostr_secp_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "nostr", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "secp256k1", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
static role_entry_t make_pq_kem_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "pq-kem", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "ml-kem-768", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
int main(void) {
/* Test mnemonic (BIP-39 standard test vector). */
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
unsigned char seed[32];
unsigned char priv1[32], pub1[32];
unsigned char priv2[32], pub2[32];
unsigned char sig[64];
size_t sig_len;
size_t shared_len;
int rc;
/* ---- ed25519 keygen from seed ---- */
memset(seed, 0x42, 32);
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv1, pub1);
check_condition("ed25519 keygen from seed succeeds", rc == 0);
/* Determinism: same seed -> same keypair */
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ed25519 keygen determinism (same seed -> same key)", rc == 0 &&
memcmp(priv1, priv2, 32) == 0 && memcmp(pub1, pub2, 32) == 0);
/* Different seed -> different keypair */
memset(seed, 0x99, 32);
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ed25519 keygen different seed -> different key", rc == 0 &&
memcmp(priv1, priv2, 32) != 0);
/* ---- ed25519 sign/verify roundtrip ---- */
memset(seed, 0x42, 32);
crypto_ed25519_keygen_from_seed(seed, 32, priv1, pub1);
{
const char *msg = "hello world";
sig_len = sizeof(sig);
rc = crypto_ed25519_sign(priv1, 32, (const unsigned char *)msg, strlen(msg), sig, &sig_len);
check_condition("ed25519 sign succeeds", rc == 0 && sig_len == 64);
rc = crypto_ed25519_verify(pub1, 32, (const unsigned char *)msg, strlen(msg), sig, sig_len);
check_condition("ed25519 verify valid signature", rc == 0);
/* Wrong message should fail */
const char *wrong_msg = "hello worle";
rc = crypto_ed25519_verify(pub1, 32, (const unsigned char *)wrong_msg, strlen(wrong_msg), sig, sig_len);
check_condition("ed25519 verify wrong message -> invalid", rc == 1);
/* Wrong key should fail */
memset(seed, 0xAB, 32);
crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
rc = crypto_ed25519_verify(pub2, 32, (const unsigned char *)msg, strlen(msg), sig, sig_len);
check_condition("ed25519 verify wrong key -> invalid", rc == 1);
}
/* ---- x25519 keygen from seed ---- */
memset(seed, 0x33, 32);
rc = crypto_x25519_keygen_from_seed(seed, 32, priv1, pub1);
check_condition("x25519 keygen from seed succeeds", rc == 0);
memset(seed, 0x33, 32);
rc = crypto_x25519_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("x25519 keygen determinism (same seed -> same key)", rc == 0 &&
memcmp(priv1, priv2, 32) == 0 && memcmp(pub1, pub2, 32) == 0);
/* ---- x25519 ECDH roundtrip ---- */
{
unsigned char alice_priv[32], alice_pub[32];
unsigned char bob_priv[32], bob_pub[32];
unsigned char alice_shared[32], bob_shared[32];
memset(seed, 0xAA, 32);
crypto_x25519_keygen_from_seed(seed, 32, alice_priv, alice_pub);
memset(seed, 0xBB, 32);
crypto_x25519_keygen_from_seed(seed, 32, bob_priv, bob_pub);
shared_len = 32;
rc = crypto_x25519_ecdh(alice_priv, 32, bob_pub, 32, alice_shared, &shared_len);
check_condition("x25519 ECDH alice side succeeds", rc == 0 && shared_len == 32);
shared_len = 32;
rc = crypto_x25519_ecdh(bob_priv, 32, alice_pub, 32, bob_shared, &shared_len);
check_condition("x25519 ECDH bob side succeeds", rc == 0 && shared_len == 32);
check_condition("x25519 ECDH shared secrets match",
memcmp(alice_shared, bob_shared, 32) == 0);
}
/* ---- SLIP-0010 derivation from mnemonic ---- */
{
unsigned char seed_a[32], seed_b[32];
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0'/0'", seed_a, 32);
check_condition("SLIP-0010 derive seed succeeds", rc == 0);
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0'/0'", seed_b, 32);
check_condition("SLIP-0010 derive seed determinism", rc == 0 &&
memcmp(seed_a, seed_b, 32) == 0);
/* Different path -> different seed */
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/1'/0'/0'", seed_b, 32);
check_condition("SLIP-0010 different path -> different seed", rc == 0 &&
memcmp(seed_a, seed_b, 32) != 0);
/* Non-hardened path should fail (SLIP-0010 requirement) */
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0/0", seed_b, 32);
check_condition("SLIP-0010 non-hardened path rejected", rc == -1);
}
/* ---- Integration: derive ed25519 key via crypto_derive_one ---- */
{
role_table_t table;
role_entry_t ssh_role;
mnemonic_state_t mnemonic_state;
key_store_t key_store;
int derived;
role_table_init(&table);
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
role_table_add(&table, &ssh_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&key_store, 0, sizeof(key_store));
alg_key_cache_init(&g_alg_key_cache);
alg_key_cache_init(&g_alg_key_cache);
derived = crypto_derive_all(&key_store, &table, &mnemonic_state);
check_condition("crypto_derive_all derives ed25519 key", derived == 1);
{
const char *pub_hex = crypto_get_pubkey_hex(&key_store, 0);
check_condition("ed25519 derived pubkey hex is 64 chars",
pub_hex != NULL && strlen(pub_hex) == 64);
}
{
const unsigned char *priv = crypto_get_private_key(&key_store, 0);
check_condition("ed25519 derived private key not NULL", priv != NULL);
}
crypto_wipe(&key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: sign_data via dispatcher ---- */
{
role_table_t table;
role_entry_t ssh_role;
mnemonic_state_t mnemonic_state;
key_store_t key_store;
dispatcher_ctx_t dispatcher;
char *resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" in hex */
char request[512];
role_table_init(&table);
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
role_table_add(&table, &ssh_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&key_store, 0, sizeof(key_store));
alg_key_cache_init(&g_alg_key_cache);
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
/* sign_data request */
snprintf(request, sizeof(request),
"{\"id\":\"test1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"ssh_main\"}]}",
msg_hex);
resp = dispatcher_handle_request(&dispatcher, request);
check_condition("sign_data via dispatcher returns result",
resp != NULL && response_has(resp, "\"result\""));
check_condition("sign_data result contains signature",
resp != NULL && response_has(resp, "signature"));
check_condition("sign_data result contains algorithm ed25519",
resp != NULL && response_has(resp, "ed25519"));
free(resp);
/* ssh_sign request */
snprintf(request, sizeof(request),
"{\"id\":\"test2\",\"method\":\"ssh_sign\",\"params\":[\"%s\",{\"role\":\"ssh_main\"}]}",
msg_hex);
resp = dispatcher_handle_request(&dispatcher, request);
check_condition("ssh_sign via dispatcher returns result",
resp != NULL && response_has(resp, "\"result\""));
check_condition("ssh_sign result contains signature",
resp != NULL && response_has(resp, "signature"));
free(resp);
crypto_wipe(&key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Enforcement: sign_data on ssh+ed25519 ---- */
{
role_entry_t ssh_ed = make_ssh_ed25519_entry("ssh", 0);
role_entry_t nostr_secp = make_nostr_secp_entry("nostr", 0);
role_entry_t pq_kem = make_pq_kem_entry("kem", 0);
check_condition("enforce sign_data + ssh/ed25519 -> OK",
enforce_verb_role(VERB_SIGN_DATA, &ssh_ed) == ENFORCE_OK);
check_condition("enforce sign_data + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_SIGN_DATA, &nostr_secp) == ENFORCE_ERR_PURPOSE);
check_condition("enforce ssh_sign + ssh/ed25519 -> OK",
enforce_verb_role(VERB_SSH_SIGN, &ssh_ed) == ENFORCE_OK);
check_condition("enforce ssh_sign + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_SSH_SIGN, &nostr_secp) == ENFORCE_ERR_PURPOSE);
check_condition("enforce sign_event + ssh/ed25519 -> PURPOSE err",
enforce_verb_role(VERB_SIGN_EVENT, &ssh_ed) == ENFORCE_ERR_PURPOSE);
check_condition("enforce kem_encapsulate + pq-kem/ml-kem-768 -> OK",
enforce_verb_role(VERB_KEM_ENCAPS, &pq_kem) == ENFORCE_OK);
check_condition("enforce kem_decapsulate + pq-kem/ml-kem-768 -> OK",
enforce_verb_role(VERB_KEM_DECAPS, &pq_kem) == ENFORCE_OK);
check_condition("enforce kem_encapsulate + ssh/ed25519 -> PURPOSE err",
enforce_verb_role(VERB_KEM_ENCAPS, &ssh_ed) == ENFORCE_ERR_PURPOSE);
}
/* ---- Dispatcher: kem_encapsulate with invalid pubkey length ---- */
{
role_table_t table;
role_entry_t kem_role;
mnemonic_state_t mnemonic_state;
key_store_t key_store;
dispatcher_ctx_t dispatcher;
char *resp;
const char *request = "{\"id\":\"k1\",\"method\":\"kem_encapsulate\",\"params\":[\"00\",{\"role\":\"kem_main\"}]}";
role_table_init(&table);
kem_role = make_pq_kem_entry("kem_main", 0);
role_table_add(&table, &kem_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&key_store, 0, sizeof(key_store));
alg_key_cache_init(&g_alg_key_cache);
alg_key_cache_init(&g_alg_key_cache);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
/* kem_encapsulate is now implemented (Phase 5). With a too-short
* pubkey hex ("00" = 1 byte, but ML-KEM-768 needs 1184 bytes),
* the dispatcher should return an invalid_pubkey_length error. */
resp = dispatcher_handle_request(&dispatcher, request);
check_condition("kem_encapsulate with short pubkey returns error",
resp != NULL && response_has(resp, "\"error\""));
free(resp);
crypto_wipe(&key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Dispatcher: verify_signature roundtrip ---- */
{
role_table_t table;
role_entry_t ssh_role;
mnemonic_state_t mnemonic_state;
key_store_t key_store;
dispatcher_ctx_t dispatcher;
char *sign_resp, *verify_resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" */
char sign_req[512];
char verify_req[1024];
cJSON *sign_json, *result_item, *sig_item;
const char *sig_str = NULL;
role_table_init(&table);
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
role_table_add(&table, &ssh_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&key_store, 0, sizeof(key_store));
alg_key_cache_init(&g_alg_key_cache);
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
/* Sign */
snprintf(sign_req, sizeof(sign_req),
"{\"id\":\"s1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"ssh_main\"}]}",
msg_hex);
sign_resp = dispatcher_handle_request(&dispatcher, sign_req);
check_condition("verify roundtrip: sign_data succeeds", sign_resp != NULL);
/* Extract signature from result */
if (sign_resp != NULL) {
sign_json = cJSON_Parse(sign_resp);
if (sign_json != NULL) {
result_item = cJSON_GetObjectItemCaseSensitive(sign_json, "result");
if (cJSON_IsString(result_item)) {
cJSON *result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj != NULL) {
sig_item = cJSON_GetObjectItemCaseSensitive(result_obj, "signature");
if (cJSON_IsString(sig_item)) {
sig_str = strdup(sig_item->valuestring);
}
cJSON_Delete(result_obj);
}
}
cJSON_Delete(sign_json);
}
}
check_condition("verify roundtrip: extracted signature hex", sig_str != NULL);
/* Verify */
if (sig_str != NULL) {
snprintf(verify_req, sizeof(verify_req),
"{\"id\":\"v1\",\"method\":\"verify_signature\",\"params\":[\"%s\",\"%s\",{\"role\":\"ssh_main\"}]}",
msg_hex, sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature returns valid:true",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "true"));
free(verify_resp);
/* Verify with wrong message */
snprintf(verify_req, sizeof(verify_req),
"{\"id\":\"v2\",\"method\":\"verify_signature\",\"params\":[\"00ff\",\"%s\",{\"role\":\"ssh_main\"}]}",
sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature wrong msg returns valid:false",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "false"));
free(verify_resp);
free((void *)sig_str);
} else {
check_condition("verify_signature returns valid:true", 0);
check_condition("verify_signature wrong msg returns valid:false", 0);
}
free(sign_resp);
crypto_wipe(&key_store);
mnemonic_unload(&mnemonic_state);
}
printf("%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

264
tests/test_enforcement.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -195,6 +200,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -230,6 +253,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -254,6 +279,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -287,6 +318,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -294,15 +339,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -333,6 +510,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -341,10 +594,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

264
tests/test_integration.c
View File

@@ -84,6 +84,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -92,6 +94,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -197,6 +202,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -232,6 +255,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -256,6 +281,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -289,6 +320,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -296,15 +341,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -335,6 +512,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -343,10 +596,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

258
tests/test_mine_event.c
View File

@@ -49,6 +49,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -56,6 +58,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -128,6 +133,11 @@ const char *selector_strerror(int err);
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
@@ -140,6 +150,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
@@ -162,6 +174,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -182,16 +200,164 @@ int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key;
unsigned char public_key[32];
char pubkey_hex[65];
char npub[128];
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -218,6 +384,82 @@ char *crypto_nip04_decrypt(const key_store_t *store, int role_index,
const char *sender_pubkey_hex, const char *ciphertext);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
@@ -226,7 +468,7 @@ typedef struct {
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
@@ -315,7 +557,8 @@ int main(void) {
role_entry_t main_role;
mnemonic_state_t mnemonic;
dispatcher_ctx_t dispatcher;
key_store_t key_store;
static key_store_t key_store;
static algorithm_key_cache_t alg_key_cache;
const char *valid_12 = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
char *resp;
int derived;
@@ -328,7 +571,8 @@ int main(void) {
mnemonic_load(&mnemonic, valid_12);
memset(&key_store, 0, sizeof(key_store));
dispatcher_init(&dispatcher, &table, &mnemonic, &key_store);
alg_key_cache_init(&alg_key_cache);
dispatcher_init(&dispatcher, &table, &mnemonic, &key_store, &alg_key_cache);
derived = nostr_init();
check_condition("nostr_init succeeds", derived == 0);

836
tests/test_ml_dsa_65.c Normal file
View File

@@ -0,0 +1,836 @@
/* Test for Phase 3 ML-DSA-65 (FIPS 204) post-quantum signatures.
*
* Verifies:
* - ML-DSA-65 keygen from seed: 1952-byte pub, 4032-byte priv
* - ML-DSA-65 keygen determinism: same seed -> same keypair
* - ML-DSA-65 sign/verify roundtrip: sign a message, verify passes
* - ML-DSA-65 sign/verify with wrong message: verify fails
* - ML-DSA-65 sign/verify with wrong key: verify fails
* - DRBG determinism: same seed -> same randombytes output
* - Integration: derive ML-DSA-65 key from mnemonic via crypto_derive_one,
* sign data via sign_data verb through dispatcher, verify signature
* - Enforcement: sign_data allowed on pq-sig+ml-dsa-65
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0,
PURPOSE_BITCOIN,
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG,
PURPOSE_PQ_KEM,
PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
typedef enum {
SELECTOR_NOSTR_INDEX,
SELECTOR_ROLE_PATH
} role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
PROMPT_FIRST_PER_BOOT,
PROMPT_EVERY_REQUEST,
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0,
POLICY_SOURCE_PREAPPROVE,
POLICY_SOURCE_SESSION_GRANT
} policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0,
CRYPTO_ALG_ED25519,
CRYPTO_ALG_X25519,
CRYPTO_ALG_ML_DSA_65,
CRYPTO_ALG_SLH_DSA_128S,
CRYPTO_ALG_ML_KEM_768,
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len;
size_t ciphertext_len;
size_t shared_secret_len;
} crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
static key_store_t g_key_store;
static algorithm_key_cache_t g_alg_key_cache;
#include <nostr_core/nostr_common.h>
#include <nostr_core/utils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* ML-DSA-65 key sizes (FIPS 204) */
#define ML_DSA_65_PUBKEY_BYTES 1952
#define ML_DSA_65_PRIVKEY_BYTES 4032
#define ML_DSA_65_SIG_BYTES 3309
static int g_passes = 0;
static int g_total = 0;
static void check_condition(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int response_has(const char *response, const char *needle) {
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
}
static role_entry_t make_pq_sig_ml_dsa_65_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "pq-sig", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "ml-dsa-65", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
static role_entry_t make_nostr_secp_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "nostr", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "secp256k1", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
int main(void) {
/* Test mnemonic (BIP-39 standard test vector). */
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
unsigned char seed[32];
unsigned char *priv1, *pub1, *priv2, *pub2;
unsigned char *sig;
size_t sig_len;
int rc;
/* Allocate key buffers on the heap (they're large) */
priv1 = (unsigned char *)malloc(ML_DSA_65_PRIVKEY_BYTES);
pub1 = (unsigned char *)malloc(ML_DSA_65_PUBKEY_BYTES);
priv2 = (unsigned char *)malloc(ML_DSA_65_PRIVKEY_BYTES);
pub2 = (unsigned char *)malloc(ML_DSA_65_PUBKEY_BYTES);
sig = (unsigned char *)malloc(ML_DSA_65_SIG_BYTES);
if (!priv1 || !pub1 || !priv2 || !pub2 || !sig) {
printf("FAIL: memory allocation\n");
return 1;
}
/* ---- DRBG determinism ---- */
{
unsigned char out1[64], out2[64];
memset(seed, 0x42, 32);
pq_drbg_init(seed, 32);
rc = pq_drbg_randombytes(out1, 64);
check_condition("DRBG randombytes succeeds", rc == 0);
pq_drbg_zeroize();
memset(seed, 0x42, 32);
pq_drbg_init(seed, 32);
rc = pq_drbg_randombytes(out2, 64);
check_condition("DRBG randombytes succeeds (2nd)", rc == 0);
check_condition("DRBG determinism (same seed -> same output)",
memcmp(out1, out2, 64) == 0);
pq_drbg_zeroize();
}
/* ---- ML-DSA-65 keygen from seed ---- */
memset(seed, 0x42, 32);
rc = crypto_ml_dsa_65_keygen_from_seed(seed, 32, priv1, pub1);
check_condition("ML-DSA-65 keygen from seed succeeds", rc == 0);
/* Keygen determinism: same seed -> same keypair */
memset(seed, 0x42, 32);
rc = crypto_ml_dsa_65_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ML-DSA-65 keygen determinism (same seed -> same key)", rc == 0 &&
memcmp(priv1, priv2, ML_DSA_65_PRIVKEY_BYTES) == 0 &&
memcmp(pub1, pub2, ML_DSA_65_PUBKEY_BYTES) == 0);
/* Different seed -> different keypair */
memset(seed, 0x99, 32);
rc = crypto_ml_dsa_65_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ML-DSA-65 keygen different seed -> different key", rc == 0 &&
memcmp(pub1, pub2, ML_DSA_65_PUBKEY_BYTES) != 0);
/* ---- ML-DSA-65 sign/verify roundtrip ---- */
memset(seed, 0x42, 32);
crypto_ml_dsa_65_keygen_from_seed(seed, 32, priv1, pub1);
{
const char *msg = "hello world";
sig_len = ML_DSA_65_SIG_BYTES;
rc = crypto_ml_dsa_65_sign(priv1, ML_DSA_65_PRIVKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, &sig_len);
check_condition("ML-DSA-65 sign succeeds", rc == 0 && sig_len > 0);
rc = crypto_ml_dsa_65_verify(pub1, ML_DSA_65_PUBKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, sig_len);
check_condition("ML-DSA-65 verify valid signature", rc == 0);
/* Wrong message should fail */
{
const char *wrong_msg = "hello worle";
rc = crypto_ml_dsa_65_verify(pub1, ML_DSA_65_PUBKEY_BYTES,
(const unsigned char *)wrong_msg, strlen(wrong_msg),
sig, sig_len);
check_condition("ML-DSA-65 verify wrong message -> invalid", rc == 1);
}
/* Wrong key should fail */
memset(seed, 0xAB, 32);
crypto_ml_dsa_65_keygen_from_seed(seed, 32, priv2, pub2);
rc = crypto_ml_dsa_65_verify(pub2, ML_DSA_65_PUBKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, sig_len);
check_condition("ML-DSA-65 verify wrong key -> invalid", rc == 1);
}
/* ---- Integration: derive ML-DSA-65 key via crypto_derive_one ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
int derived;
role_table_init(&table);
pq_role = make_pq_sig_ml_dsa_65_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
derived = crypto_derive_all(&g_key_store, &table, &mnemonic_state);
check_condition("crypto_derive_all derives ML-DSA-65 key", derived == 1);
{
const char *pub_hex = crypto_get_pubkey_hex(&g_key_store, 0);
/* 1952 bytes hex-encoded = 3904 hex chars + null */
check_condition("ML-DSA-65 derived pubkey hex is 3904 chars",
pub_hex != NULL && strlen(pub_hex) == 3904);
}
{
const unsigned char *priv = crypto_get_private_key(&g_key_store, 0);
check_condition("ML-DSA-65 derived private key not NULL", priv != NULL);
}
/* Determinism: re-derive and check same key */
{
static key_store_t key_store2;
memset(&key_store2, 0, sizeof(key_store2));
crypto_derive_all(&key_store2, &table, &mnemonic_state);
{
const char *pub_hex1 = crypto_get_pubkey_hex(&g_key_store, 0);
const char *pub_hex2 = crypto_get_pubkey_hex(&key_store2, 0);
check_condition("ML-DSA-65 derivation determinism (same mnemonic -> same key)",
pub_hex1 != NULL && pub_hex2 != NULL &&
strcmp(pub_hex1, pub_hex2) == 0);
}
crypto_wipe(&key_store2);
}
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: sign_data via dispatcher ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" in hex */
char request[512];
role_table_init(&table);
pq_role = make_pq_sig_ml_dsa_65_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
/* sign_data request */
snprintf(request, sizeof(request),
"{\"id\":\"test1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex);
resp = dispatcher_handle_request(&dispatcher, request);
check_condition("sign_data via dispatcher returns result",
resp != NULL && response_has(resp, "\"result\""));
check_condition("sign_data result contains signature",
resp != NULL && response_has(resp, "signature"));
check_condition("sign_data result contains algorithm ml-dsa-65",
resp != NULL && response_has(resp, "ml-dsa-65"));
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: verify_signature roundtrip via dispatcher ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *sign_resp, *verify_resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" */
char sign_req[512];
char verify_req[8192];
cJSON *sign_json, *result_item, *sig_item;
const char *sig_str = NULL;
role_table_init(&table);
pq_role = make_pq_sig_ml_dsa_65_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
/* Sign */
snprintf(sign_req, sizeof(sign_req),
"{\"id\":\"s1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex);
sign_resp = dispatcher_handle_request(&dispatcher, sign_req);
check_condition("verify roundtrip: sign_data succeeds", sign_resp != NULL);
/* Extract signature from result */
if (sign_resp != NULL) {
sign_json = cJSON_Parse(sign_resp);
if (sign_json != NULL) {
result_item = cJSON_GetObjectItemCaseSensitive(sign_json, "result");
if (cJSON_IsString(result_item)) {
cJSON *result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj != NULL) {
sig_item = cJSON_GetObjectItemCaseSensitive(result_obj, "signature");
if (cJSON_IsString(sig_item)) {
sig_str = strdup(sig_item->valuestring);
}
cJSON_Delete(result_obj);
}
}
cJSON_Delete(sign_json);
}
}
check_condition("verify roundtrip: extracted signature hex", sig_str != NULL);
/* Verify */
if (sig_str != NULL) {
snprintf(verify_req, sizeof(verify_req),
"{\"id\":\"v1\",\"method\":\"verify_signature\",\"params\":[\"%s\",\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex, sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature returns valid:true",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "true"));
free(verify_resp);
/* Verify with wrong message */
snprintf(verify_req, sizeof(verify_req),
"{\"id\":\"v2\",\"method\":\"verify_signature\",\"params\":[\"00ff\",\"%s\",{\"role\":\"pq_main\"}]}",
sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature wrong msg returns valid:false",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "false"));
free(verify_resp);
free((void *)sig_str);
} else {
check_condition("verify_signature returns valid:true", 0);
check_condition("verify_signature wrong msg returns valid:false", 0);
}
free(sign_resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Enforcement: sign_data on pq-sig+ml-dsa-65 ---- */
{
role_entry_t pq_sig = make_pq_sig_ml_dsa_65_entry("pq", 0);
role_entry_t nostr_secp = make_nostr_secp_entry("nostr", 0);
check_condition("enforce sign_data + pq-sig/ml-dsa-65 -> OK",
enforce_verb_role(VERB_SIGN_DATA, &pq_sig) == ENFORCE_OK);
check_condition("enforce sign_data + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_SIGN_DATA, &nostr_secp) == ENFORCE_ERR_PURPOSE);
check_condition("enforce verify_signature + pq-sig/ml-dsa-65 -> OK",
enforce_verb_role(VERB_VERIFY_SIG, &pq_sig) == ENFORCE_OK);
check_condition("enforce sign_event + pq-sig/ml-dsa-65 -> PURPOSE err",
enforce_verb_role(VERB_SIGN_EVENT, &pq_sig) == ENFORCE_ERR_PURPOSE);
}
/* Cleanup */
free(priv1);
free(pub1);
free(priv2);
free(pub2);
free(sig);
printf("%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

668
tests/test_ml_kem_768.c Normal file
View File

@@ -0,0 +1,668 @@
/* Test for Phase 5 ML-KEM-768 (FIPS 203) post-quantum key encapsulation.
*
* Verifies:
* - ML-KEM-768 keygen from seed: 1184-byte pub, 2400-byte priv
* - ML-KEM-768 keygen determinism: same seed -> same keypair
* - Encaps/decaps roundtrip: shared secrets match
* - Encaps produces different ciphertexts each call (non-deterministic)
* - Decaps with wrong ciphertext: different shared secret (implicit rejection)
* - Integration: derive ML-KEM-768 key from mnemonic, encaps via dispatcher,
* decaps via dispatcher, shared secrets match
* - Enforcement: kem_encapsulate/kem_decapsulate allowed on pq-kem+ml-kem-768
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0, PURPOSE_BITCOIN, PURPOSE_SSH, PURPOSE_AGE,
PURPOSE_FIPS, PURPOSE_PQ_SIG, PURPOSE_PQ_KEM, PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0, CURVE_ED25519, CURVE_X25519,
CURVE_ML_DSA_65, CURVE_SLH_DSA_128S, CURVE_ML_KEM_768, CURVE_UNKNOWN
} role_curve_t;
typedef enum { SELECTOR_NOSTR_INDEX, SELECTOR_ROLE_PATH } role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum { PROMPT_NEVER = 0, PROMPT_FIRST_PER_BOOT, PROMPT_EVERY_REQUEST, PROMPT_DENY } prompt_mode_t;
typedef enum { POLICY_SOURCE_DEFAULT = 0, POLICY_SOURCE_PREAPPROVE, POLICY_SOURCE_SESSION_GRANT } policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id, const char *verb, const char *role_name, const char *purpose, policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, CRYPTO_ALG_ED25519, CRYPTO_ALG_X25519,
CRYPTO_ALG_ML_DSA_65, CRYPTO_ALG_SLH_DSA_128S, CRYPTO_ALG_ML_KEM_768,
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len;
size_t ciphertext_len;
size_t shared_secret_len;
} crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len, const unsigned char *peer_pub, size_t pub_len, unsigned char *shared_out, size_t *shared_out_len);
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path, unsigned char *seed_out, size_t seed_out_len);
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len, const unsigned char *msg, size_t msg_len, unsigned char *sig_out, size_t *sig_out_len);
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len, const unsigned char *msg, size_t msg_len, const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic). */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len, unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len, unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len, const unsigned char *ct, size_t ct_len, unsigned char *ss_out);
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
typedef struct {
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char npub[128];
crypto_alg_t alg;
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
static key_store_t g_key_store;
static algorithm_key_cache_t g_alg_key_cache;
#include <nostr_core/nostr_common.h>
#include <nostr_core/utils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* ML-KEM-768 key sizes (FIPS 203) */
#define ML_KEM_768_PUBKEY_BYTES 1184
#define ML_KEM_768_PRIVKEY_BYTES 2400
#define ML_KEM_768_CT_BYTES 1088
#define ML_KEM_768_SS_BYTES 32
static int g_passes = 0;
static int g_total = 0;
static void check_condition(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int response_has(const char *response, const char *needle) {
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
}
static role_entry_t make_pq_kem_ml_kem_768_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "pq-kem", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "ml-kem-768", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
static role_entry_t make_nostr_secp_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "nostr", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "secp256k1", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
int main(void) {
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
unsigned char seed[32];
unsigned char *priv1, *pub1, *priv2, *pub2;
unsigned char *ct1, *ct2, *ss1, *ss2, *ss3;
int rc;
priv1 = (unsigned char *)malloc(ML_KEM_768_PRIVKEY_BYTES);
pub1 = (unsigned char *)malloc(ML_KEM_768_PUBKEY_BYTES);
priv2 = (unsigned char *)malloc(ML_KEM_768_PRIVKEY_BYTES);
pub2 = (unsigned char *)malloc(ML_KEM_768_PUBKEY_BYTES);
ct1 = (unsigned char *)malloc(ML_KEM_768_CT_BYTES);
ct2 = (unsigned char *)malloc(ML_KEM_768_CT_BYTES);
ss1 = (unsigned char *)malloc(ML_KEM_768_SS_BYTES);
ss2 = (unsigned char *)malloc(ML_KEM_768_SS_BYTES);
ss3 = (unsigned char *)malloc(ML_KEM_768_SS_BYTES);
if (!priv1 || !pub1 || !priv2 || !pub2 || !ct1 || !ct2 || !ss1 || !ss2 || !ss3) {
printf("FAIL: memory allocation\n");
return 1;
}
/* ---- ML-KEM-768 keygen from seed ---- */
memset(seed, 0x42, 32);
rc = crypto_ml_kem_768_keygen_from_seed(seed, 32, priv1, pub1);
check_condition("ML-KEM-768 keygen from seed succeeds", rc == 0);
/* Keygen determinism: same seed -> same keypair */
memset(seed, 0x42, 32);
rc = crypto_ml_kem_768_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ML-KEM-768 keygen determinism (same seed -> same key)", rc == 0 &&
memcmp(priv1, priv2, ML_KEM_768_PRIVKEY_BYTES) == 0 &&
memcmp(pub1, pub2, ML_KEM_768_PUBKEY_BYTES) == 0);
/* Different seed -> different keypair */
memset(seed, 0x99, 32);
rc = crypto_ml_kem_768_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("ML-KEM-768 keygen different seed -> different key", rc == 0 &&
memcmp(pub1, pub2, ML_KEM_768_PUBKEY_BYTES) != 0);
/* ---- Encaps/decaps roundtrip ---- */
memset(seed, 0x42, 32);
crypto_ml_kem_768_keygen_from_seed(seed, 32, priv1, pub1);
rc = crypto_ml_kem_768_encaps(pub1, ML_KEM_768_PUBKEY_BYTES, ct1, ss1);
check_condition("ML-KEM-768 encaps succeeds", rc == 0);
rc = crypto_ml_kem_768_decaps(priv1, ML_KEM_768_PRIVKEY_BYTES, ct1, ML_KEM_768_CT_BYTES, ss2);
check_condition("ML-KEM-768 decaps succeeds", rc == 0);
check_condition("ML-KEM-768 encaps/decaps shared secrets match",
memcmp(ss1, ss2, ML_KEM_768_SS_BYTES) == 0);
/* ---- Encaps produces different ciphertexts each call ---- */
rc = crypto_ml_kem_768_encaps(pub1, ML_KEM_768_PUBKEY_BYTES, ct2, ss3);
check_condition("ML-KEM-768 second encaps succeeds", rc == 0);
check_condition("ML-KEM-768 encaps produces different ciphertexts",
memcmp(ct1, ct2, ML_KEM_768_CT_BYTES) != 0);
/* Decaps with second ciphertext also matches its shared secret */
{
unsigned char ss4[32];
crypto_ml_kem_768_decaps(priv1, ML_KEM_768_PRIVKEY_BYTES, ct2, ML_KEM_768_CT_BYTES, ss4);
check_condition("ML-KEM-768 second encaps/decaps shared secrets match",
memcmp(ss3, ss4, ML_KEM_768_SS_BYTES) == 0);
}
/* ---- Decaps with wrong ciphertext: implicit rejection ---- */
{
ct1[0] ^= 0xFF;
rc = crypto_ml_kem_768_decaps(priv1, ML_KEM_768_PRIVKEY_BYTES, ct1, ML_KEM_768_CT_BYTES, ss3);
ct1[0] ^= 0xFF; /* restore */
check_condition("ML-KEM-768 decaps wrong ct succeeds (no crash)", rc == 0);
/* The shared secret should be different from the original (implicit rejection) */
check_condition("ML-KEM-768 wrong ct gives different shared secret",
memcmp(ss1, ss3, ML_KEM_768_SS_BYTES) != 0);
}
/* ---- Integration: derive ML-KEM-768 key via crypto_derive_all ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
int derived;
role_table_init(&table);
pq_role = make_pq_kem_ml_kem_768_entry("pq_kem", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
derived = crypto_derive_all(&g_key_store, &table, &mnemonic_state);
check_condition("crypto_derive_all derives ML-KEM-768 key", derived == 1);
{
const char *pub_hex = crypto_get_pubkey_hex(&g_key_store, 0);
/* 1184 bytes hex-encoded = 2368 hex chars + null */
check_condition("ML-KEM-768 derived pubkey hex is 2368 chars",
pub_hex != NULL && strlen(pub_hex) == 2368);
}
{
const unsigned char *priv = crypto_get_private_key(&g_key_store, 0);
check_condition("ML-KEM-768 derived private key not NULL", priv != NULL);
}
/* Determinism: re-derive and check same key */
{
static key_store_t key_store2;
memset(&key_store2, 0, sizeof(key_store2));
crypto_derive_all(&key_store2, &table, &mnemonic_state);
{
const char *pub_hex1 = crypto_get_pubkey_hex(&g_key_store, 0);
const char *pub_hex2 = crypto_get_pubkey_hex(&key_store2, 0);
check_condition("ML-KEM-768 derivation determinism",
pub_hex1 != NULL && pub_hex2 != NULL &&
strcmp(pub_hex1, pub_hex2) == 0);
}
crypto_wipe(&key_store2);
}
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: kem_encapsulate / kem_decapsulate via dispatcher ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *encaps_resp, *decaps_resp;
const char *pub_hex;
char encaps_req[6000]; /* pub_hex is 2368 chars + JSON overhead */
char *decaps_req = (char *)malloc(6000);
cJSON *encaps_json, *result_item, *ct_item, *ss_item;
const char *ct_str = NULL, *ss_encaps_str = NULL;
const char *ss_decaps_str = NULL;
role_table_init(&table);
pq_role = make_pq_kem_ml_kem_768_entry("pq_kem", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
/* Get the public key hex for encaps */
pub_hex = crypto_get_pubkey_hex(&g_key_store, 0);
check_condition("dispatcher integration: pubkey available", pub_hex != NULL);
if (pub_hex != NULL && decaps_req != NULL) {
/* kem_encapsulate request */
snprintf(encaps_req, sizeof(encaps_req),
"{\"id\":\"e1\",\"method\":\"kem_encapsulate\",\"params\":[\"%s\",{\"role\":\"pq_kem\"}]}",
pub_hex);
encaps_resp = dispatcher_handle_request(&dispatcher, encaps_req);
check_condition("kem_encapsulate via dispatcher returns result",
encaps_resp != NULL && response_has(encaps_resp, "\"result\""));
check_condition("kem_encapsulate result contains ciphertext",
encaps_resp != NULL && response_has(encaps_resp, "ciphertext"));
check_condition("kem_encapsulate result contains shared_secret",
encaps_resp != NULL && response_has(encaps_resp, "shared_secret"));
check_condition("kem_encapsulate result contains algorithm ml-kem-768",
encaps_resp != NULL && response_has(encaps_resp, "ml-kem-768"));
/* Extract ciphertext and shared_secret from result */
if (encaps_resp != NULL) {
encaps_json = cJSON_Parse(encaps_resp);
if (encaps_json != NULL) {
result_item = cJSON_GetObjectItemCaseSensitive(encaps_json, "result");
if (cJSON_IsString(result_item)) {
cJSON *result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj != NULL) {
ct_item = cJSON_GetObjectItemCaseSensitive(result_obj, "ciphertext");
ss_item = cJSON_GetObjectItemCaseSensitive(result_obj, "shared_secret");
if (cJSON_IsString(ct_item)) ct_str = strdup(ct_item->valuestring);
if (cJSON_IsString(ss_item)) ss_encaps_str = strdup(ss_item->valuestring);
cJSON_Delete(result_obj);
}
}
cJSON_Delete(encaps_json);
}
}
check_condition("kem_encapsulate: extracted ciphertext hex", ct_str != NULL);
check_condition("kem_encapsulate: extracted shared_secret hex", ss_encaps_str != NULL);
/* kem_decapsulate request */
if (ct_str != NULL) {
snprintf(decaps_req, 6000,
"{\"id\":\"d1\",\"method\":\"kem_decapsulate\",\"params\":[\"%s\",{\"role\":\"pq_kem\"}]}",
ct_str);
decaps_resp = dispatcher_handle_request(&dispatcher, decaps_req);
check_condition("kem_decapsulate via dispatcher returns result",
decaps_resp != NULL && response_has(decaps_resp, "\"result\""));
check_condition("kem_decapsulate result contains shared_secret",
decaps_resp != NULL && response_has(decaps_resp, "shared_secret"));
/* Extract shared_secret from decaps result */
if (decaps_resp != NULL) {
cJSON *decaps_json = cJSON_Parse(decaps_resp);
if (decaps_json != NULL) {
cJSON *d_result = cJSON_GetObjectItemCaseSensitive(decaps_json, "result");
if (cJSON_IsString(d_result)) {
cJSON *d_obj = cJSON_Parse(d_result->valuestring);
if (d_obj != NULL) {
cJSON *d_ss = cJSON_GetObjectItemCaseSensitive(d_obj, "shared_secret");
if (cJSON_IsString(d_ss)) ss_decaps_str = strdup(d_ss->valuestring);
cJSON_Delete(d_obj);
}
}
cJSON_Delete(decaps_json);
}
}
/* Check shared secrets match */
if (ss_encaps_str != NULL && ss_decaps_str != NULL) {
check_condition("dispatcher encaps/decaps shared secrets match",
strcmp(ss_encaps_str, ss_decaps_str) == 0);
} else {
check_condition("dispatcher encaps/decaps shared secrets match", 0);
}
free((void *)ss_decaps_str);
free(decaps_resp);
} else {
check_condition("kem_decapsulate via dispatcher returns result", 0);
check_condition("kem_decapsulate result contains shared_secret", 0);
check_condition("dispatcher encaps/decaps shared secrets match", 0);
}
free((void *)ct_str);
free((void *)ss_encaps_str);
}
free(decaps_req);
free(encaps_resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Enforcement: kem_encapsulate/kem_decapsulate on pq-kem+ml-kem-768 ---- */
{
role_entry_t pq_kem = make_pq_kem_ml_kem_768_entry("pqk", 0);
role_entry_t nostr_secp = make_nostr_secp_entry("nostr", 0);
check_condition("enforce kem_encapsulate + pq-kem/ml-kem-768 -> OK",
enforce_verb_role(VERB_KEM_ENCAPS, &pq_kem) == ENFORCE_OK);
check_condition("enforce kem_encapsulate + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_KEM_ENCAPS, &nostr_secp) == ENFORCE_ERR_PURPOSE);
check_condition("enforce kem_decapsulate + pq-kem/ml-kem-768 -> OK",
enforce_verb_role(VERB_KEM_DECAPS, &pq_kem) == ENFORCE_OK);
check_condition("enforce kem_decapsulate + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_KEM_DECAPS, &nostr_secp) == ENFORCE_ERR_PURPOSE);
}
/* ---- Cleanup ---- */
free(priv1); free(pub1); free(priv2); free(pub2);
free(ct1); free(ct2); free(ss1); free(ss2); free(ss3);
printf("\n%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

264
tests/test_mnemonic.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -195,6 +200,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -230,6 +253,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -254,6 +279,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -287,6 +318,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -294,15 +339,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -333,6 +510,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -341,10 +594,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

264
tests/test_policy.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -195,6 +200,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -230,6 +253,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -254,6 +279,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -293,6 +324,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -300,15 +345,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -339,6 +516,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -347,10 +600,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

640
tests/test_pq_crypto.c Normal file
View File

@@ -0,0 +1,640 @@
/* Test for the Phase 1 post-quantum algorithm registry (pq_crypto.c).
*
* Verifies:
* - crypto_alg_from_role returns the correct algorithm for every valid
* (curve, purpose) combination and CRYPTO_ALG_UNKNOWN for invalid ones.
* - crypto_alg_get_sizes returns the FIPS/PQClean size constants for each
* algorithm and NULL for CRYPTO_ALG_UNKNOWN.
* - crypto_alg_to_str / crypto_alg_from_str roundtrip for all algorithms.
* - role_purpose_from_str("pq-sig") == PURPOSE_PQ_SIG
* - role_purpose_from_str("pq-kem") == PURPOSE_PQ_KEM
* - role_curve_from_str("ml-dsa-65") == CURVE_ML_DSA_65
* - role_curve_from_str("slh-dsa-128s") == CURVE_SLH_DSA_128S
* - role_curve_from_str("ml-kem-768") == CURVE_ML_KEM_768
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0,
PURPOSE_BITCOIN,
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
typedef enum {
SELECTOR_NOSTR_INDEX,
SELECTOR_ROLE_PATH
} role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_entry_t *role_table_find_by_nostr_index(role_table_t *table, int index);
role_entry_t *role_table_find_by_path(role_table_t *table, const char *path);
role_entry_t *role_table_get_default(role_table_t *table);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
int role_table_register_nostr_index(role_table_t *table, int nostr_index);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
PROMPT_FIRST_PER_BOOT,
PROMPT_EVERY_REQUEST,
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0,
POLICY_SOURCE_PREAPPROVE,
POLICY_SOURCE_SESSION_GRANT
} policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
#include <stdio.h>
#include <string.h>
static int g_failures = 0;
static void check_condition(const char *name, int condition) {
if (condition) {
printf("PASS: %s\n", name);
} else {
printf("FAIL: %s\n", name);
g_failures++;
}
}
int main(void) {
const crypto_alg_sizes_t *sz;
crypto_alg_t alg;
const char *str;
crypto_alg_t back;
/* ---- crypto_alg_from_role: valid combinations ---- */
check_condition("secp256k1+nostr -> SECP256K1",
crypto_alg_from_role(CURVE_SECP256K1, PURPOSE_NOSTR) == CRYPTO_ALG_SECP256K1);
check_condition("ed25519+ssh -> ED25519",
crypto_alg_from_role(CURVE_ED25519, PURPOSE_SSH) == CRYPTO_ALG_ED25519);
check_condition("x25519+age -> X25519",
crypto_alg_from_role(CURVE_X25519, PURPOSE_AGE) == CRYPTO_ALG_X25519);
check_condition("ml-dsa-65+pq-sig -> ML_DSA_65",
crypto_alg_from_role(CURVE_ML_DSA_65, PURPOSE_PQ_SIG) == CRYPTO_ALG_ML_DSA_65);
check_condition("slh-dsa-128s+pq-sig -> SLH_DSA_128S",
crypto_alg_from_role(CURVE_SLH_DSA_128S, PURPOSE_PQ_SIG) == CRYPTO_ALG_SLH_DSA_128S);
check_condition("ml-kem-768+pq-kem -> ML_KEM_768",
crypto_alg_from_role(CURVE_ML_KEM_768, PURPOSE_PQ_KEM) == CRYPTO_ALG_ML_KEM_768);
/* ---- crypto_alg_from_role: invalid combinations ---- */
check_condition("secp256k1+ssh -> UNKNOWN",
crypto_alg_from_role(CURVE_SECP256K1, PURPOSE_SSH) == CRYPTO_ALG_UNKNOWN);
check_condition("ed25519+nostr -> UNKNOWN",
crypto_alg_from_role(CURVE_ED25519, PURPOSE_NOSTR) == CRYPTO_ALG_UNKNOWN);
check_condition("ml-dsa-65+pq-kem -> UNKNOWN (purpose mismatch)",
crypto_alg_from_role(CURVE_ML_DSA_65, PURPOSE_PQ_KEM) == CRYPTO_ALG_UNKNOWN);
check_condition("ml-kem-768+pq-sig -> UNKNOWN (purpose mismatch)",
crypto_alg_from_role(CURVE_ML_KEM_768, PURPOSE_PQ_SIG) == CRYPTO_ALG_UNKNOWN);
check_condition("unknown curve -> UNKNOWN",
crypto_alg_from_role(CURVE_UNKNOWN, PURPOSE_NOSTR) == CRYPTO_ALG_UNKNOWN);
/* ---- crypto_alg_get_sizes ---- */
sz = crypto_alg_get_sizes(CRYPTO_ALG_SECP256K1);
check_condition("sizes secp256k1 not NULL", sz != NULL);
check_condition("sizes secp256k1 priv=32 pub=32 sig=64",
sz != NULL && sz->priv_key_len == 32 && sz->pub_key_len == 32 && sz->sig_len == 64 &&
sz->ciphertext_len == 0 && sz->shared_secret_len == 0);
sz = crypto_alg_get_sizes(CRYPTO_ALG_ED25519);
check_condition("sizes ed25519 priv=32 pub=32 sig=64",
sz != NULL && sz->priv_key_len == 32 && sz->pub_key_len == 32 && sz->sig_len == 64);
sz = crypto_alg_get_sizes(CRYPTO_ALG_X25519);
check_condition("sizes x25519 priv=32 pub=32 shared=32 sig=0",
sz != NULL && sz->priv_key_len == 32 && sz->pub_key_len == 32 &&
sz->sig_len == 0 && sz->shared_secret_len == 32);
sz = crypto_alg_get_sizes(CRYPTO_ALG_ML_DSA_65);
check_condition("sizes ml-dsa-65 priv=4032 pub=1952 sig=3309",
sz != NULL && sz->priv_key_len == 4032 && sz->pub_key_len == 1952 &&
sz->sig_len == 3309 && sz->ciphertext_len == 0 && sz->shared_secret_len == 0);
sz = crypto_alg_get_sizes(CRYPTO_ALG_SLH_DSA_128S);
check_condition("sizes slh-dsa-128s priv=64 pub=32 sig=7856",
sz != NULL && sz->priv_key_len == 64 && sz->pub_key_len == 32 &&
sz->sig_len == 7856 && sz->ciphertext_len == 0 && sz->shared_secret_len == 0);
sz = crypto_alg_get_sizes(CRYPTO_ALG_ML_KEM_768);
check_condition("sizes ml-kem-768 priv=2400 pub=1184 ct=1088 shared=32",
sz != NULL && sz->priv_key_len == 2400 && sz->pub_key_len == 1184 &&
sz->sig_len == 0 && sz->ciphertext_len == 1088 && sz->shared_secret_len == 32);
sz = crypto_alg_get_sizes(CRYPTO_ALG_UNKNOWN);
check_condition("sizes UNKNOWN -> NULL", sz == NULL);
/* ---- crypto_alg_to_str / crypto_alg_from_str roundtrip ---- */
str = crypto_alg_to_str(CRYPTO_ALG_SECP256K1);
check_condition("to_str secp256k1", str != NULL && strcmp(str, "secp256k1") == 0);
str = crypto_alg_to_str(CRYPTO_ALG_ED25519);
check_condition("to_str ed25519", str != NULL && strcmp(str, "ed25519") == 0);
str = crypto_alg_to_str(CRYPTO_ALG_X25519);
check_condition("to_str x25519", str != NULL && strcmp(str, "x25519") == 0);
str = crypto_alg_to_str(CRYPTO_ALG_ML_DSA_65);
check_condition("to_str ml-dsa-65", str != NULL && strcmp(str, "ml-dsa-65") == 0);
str = crypto_alg_to_str(CRYPTO_ALG_SLH_DSA_128S);
check_condition("to_str slh-dsa-128s", str != NULL && strcmp(str, "slh-dsa-128s") == 0);
str = crypto_alg_to_str(CRYPTO_ALG_ML_KEM_768);
check_condition("to_str ml-kem-768", str != NULL && strcmp(str, "ml-kem-768") == 0);
check_condition("to_str UNKNOWN -> NULL", crypto_alg_to_str(CRYPTO_ALG_UNKNOWN) == NULL);
back = crypto_alg_from_str("secp256k1");
check_condition("from_str secp256k1", back == CRYPTO_ALG_SECP256K1);
back = crypto_alg_from_str("ed25519");
check_condition("from_str ed25519", back == CRYPTO_ALG_ED25519);
back = crypto_alg_from_str("x25519");
check_condition("from_str x25519", back == CRYPTO_ALG_X25519);
back = crypto_alg_from_str("ml-dsa-65");
check_condition("from_str ml-dsa-65", back == CRYPTO_ALG_ML_DSA_65);
back = crypto_alg_from_str("slh-dsa-128s");
check_condition("from_str slh-dsa-128s", back == CRYPTO_ALG_SLH_DSA_128S);
back = crypto_alg_from_str("ml-kem-768");
check_condition("from_str ml-kem-768", back == CRYPTO_ALG_ML_KEM_768);
back = crypto_alg_from_str("not-a-real-alg");
check_condition("from_str bogus -> UNKNOWN", back == CRYPTO_ALG_UNKNOWN);
back = crypto_alg_from_str(NULL);
check_condition("from_str NULL -> UNKNOWN", back == CRYPTO_ALG_UNKNOWN);
/* roundtrip via to_str then from_str for each algorithm */
alg = CRYPTO_ALG_SECP256K1;
check_condition("roundtrip secp256k1",
crypto_alg_from_str(crypto_alg_to_str(alg)) == alg);
alg = CRYPTO_ALG_ML_DSA_65;
check_condition("roundtrip ml-dsa-65",
crypto_alg_from_str(crypto_alg_to_str(alg)) == alg);
alg = CRYPTO_ALG_ML_KEM_768;
check_condition("roundtrip ml-kem-768",
crypto_alg_from_str(crypto_alg_to_str(alg)) == alg);
/* ---- role_purpose_from_str new values ---- */
check_condition("purpose from_str pq-sig -> PQ_SIG",
role_purpose_from_str("pq-sig") == PURPOSE_PQ_SIG);
check_condition("purpose from_str pq-kem -> PQ_KEM",
role_purpose_from_str("pq-kem") == PURPOSE_PQ_KEM);
check_condition("purpose to_str PQ_SIG -> pq-sig",
strcmp(role_purpose_to_str(PURPOSE_PQ_SIG), "pq-sig") == 0);
check_condition("purpose to_str PQ_KEM -> pq-kem",
strcmp(role_purpose_to_str(PURPOSE_PQ_KEM), "pq-kem") == 0);
/* ---- role_curve_from_str new values ---- */
check_condition("curve from_str ml-dsa-65 -> ML_DSA_65",
role_curve_from_str("ml-dsa-65") == CURVE_ML_DSA_65);
check_condition("curve from_str slh-dsa-128s -> SLH_DSA_128S",
role_curve_from_str("slh-dsa-128s") == CURVE_SLH_DSA_128S);
check_condition("curve from_str ml-kem-768 -> ML_KEM_768",
role_curve_from_str("ml-kem-768") == CURVE_ML_KEM_768);
check_condition("curve to_str ML_DSA_65 -> ml-dsa-65",
strcmp(role_curve_to_str(CURVE_ML_DSA_65), "ml-dsa-65") == 0);
check_condition("curve to_str SLH_DSA_128S -> slh-dsa-128s",
strcmp(role_curve_to_str(CURVE_SLH_DSA_128S), "slh-dsa-128s") == 0);
check_condition("curve to_str ML_KEM_768 -> ml-kem-768",
strcmp(role_curve_to_str(CURVE_ML_KEM_768), "ml-kem-768") == 0);
if (g_failures == 0) {
printf("\nALL TESTS PASSED\n");
return 0;
}
printf("\n%d TEST(S) FAILED\n", g_failures);
return 1;
}

814
tests/test_pubkey_format.c Normal file
View File

@@ -0,0 +1,814 @@
/* Test for Phase 6 get_public_key response format (dispatcher.c).
*
* Verifies:
* - secp256k1: get_public_key returns plain hex string (backward compat)
* - secp256k1 with {"format":"structured"}: returns structured JSON
* - ed25519: returns structured JSON with algorithm "ed25519"
* - ML-DSA-65: returns structured JSON with algorithm "ml-dsa-65" and large pubkey
* - ML-KEM-768: returns structured JSON with algorithm "ml-kem-768"
* - Structured result contains algorithm, public_key, and key_id fields
* - key_id is the first 16 hex chars of the public key
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0,
PURPOSE_BITCOIN,
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG,
PURPOSE_PQ_KEM,
PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
typedef enum {
SELECTOR_NOSTR_INDEX,
SELECTOR_ROLE_PATH
} role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_entry_t *role_table_find_by_nostr_index(role_table_t *table, int index);
role_entry_t *role_table_find_by_path(role_table_t *table, const char *path);
role_entry_t *role_table_get_default(role_table_t *table);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
int role_table_register_nostr_index(role_table_t *table, int nostr_index);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
PROMPT_FIRST_PER_BOOT,
PROMPT_EVERY_REQUEST,
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0,
POLICY_SOURCE_PREAPPROVE,
POLICY_SOURCE_SESSION_GRANT
} policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0,
CRYPTO_ALG_ED25519,
CRYPTO_ALG_X25519,
CRYPTO_ALG_ML_DSA_65,
CRYPTO_ALG_SLH_DSA_128S,
CRYPTO_ALG_ML_KEM_768,
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len;
size_t ciphertext_len;
size_t shared_secret_len;
} crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
typedef struct {
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char npub[128];
crypto_alg_t alg;
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
static key_store_t g_key_store;
static algorithm_key_cache_t g_alg_key_cache;
#include <nostr_core/nostr_common.h>
#include <nostr_core/utils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
static int g_passes = 0;
static int g_total = 0;
static void check_condition(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int response_has(const char *response, const char *needle) {
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
}
/* Parse the dispatcher response's "result" field. If result is a JSON string
* (plain hex), returns a newly-allocated copy of the string in *out_str and
* returns 1. If result is a JSON object serialized as a string, parses it into
* *out_obj and returns 2. Returns 0 on failure. Caller frees accordingly. */
static int parse_result(const char *response, char **out_str, cJSON **out_obj) {
cJSON *root = NULL;
cJSON *result_item = NULL;
int ret = 0;
if (out_str != NULL) *out_str = NULL;
if (out_obj != NULL) *out_obj = NULL;
if (response == NULL) return 0;
root = cJSON_Parse(response);
if (root == NULL) return 0;
result_item = cJSON_GetObjectItemCaseSensitive(root, "result");
if (cJSON_IsString(result_item) && result_item->valuestring != NULL) {
/* Could be a plain hex string OR a serialized JSON object string. */
cJSON *maybe_obj = cJSON_Parse(result_item->valuestring);
if (maybe_obj != NULL && cJSON_IsObject(maybe_obj)) {
if (out_obj != NULL) {
*out_obj = maybe_obj;
maybe_obj = NULL;
ret = 2;
} else {
cJSON_Delete(maybe_obj);
ret = 0;
}
} else {
cJSON_Delete(maybe_obj);
if (out_str != NULL) {
*out_str = strdup(result_item->valuestring);
ret = 1;
}
}
}
cJSON_Delete(root);
return ret;
}
static role_entry_t make_entry(const char *name, const char *purpose_str,
const char *curve_str, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, purpose_str, sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, curve_str, sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
int main(void) {
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
if (nostr_init() != 0) {
fprintf(stderr, "nostr_init failed\n");
return 1;
}
/* ---- secp256k1: plain hex (backward compat) ---- */
{
role_table_t table;
role_entry_t nostr_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp = NULL;
char *result_str = NULL;
cJSON *result_obj = NULL;
int pr;
role_table_init(&table);
nostr_role = make_entry("main", "nostr", "secp256k1", 0);
role_table_add(&table, &nostr_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
resp = dispatcher_handle_request(&dispatcher,
"{\"id\":\"1\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"main\"}]}");
check_condition("secp256k1 get_public_key returns a response", resp != NULL);
pr = parse_result(resp, &result_str, &result_obj);
check_condition("secp256k1 get_public_key result is a plain string (not object)",
pr == 1 && result_str != NULL);
check_condition("secp256k1 plain hex result is 64 hex chars",
result_str != NULL && strlen(result_str) == 64);
check_condition("secp256k1 plain hex result has no 'algorithm' field",
!response_has(resp, "algorithm"));
free(result_str);
cJSON_Delete(result_obj);
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- secp256k1 with format:structured ---- */
{
role_table_t table;
role_entry_t nostr_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp = NULL;
char *result_str = NULL;
cJSON *result_obj = NULL;
cJSON *alg_item = NULL;
cJSON *pk_item = NULL;
cJSON *kid_item = NULL;
int pr;
role_table_init(&table);
nostr_role = make_entry("main", "nostr", "secp256k1", 0);
role_table_add(&table, &nostr_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
resp = dispatcher_handle_request(&dispatcher,
"{\"id\":\"2\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"main\",\"format\":\"structured\"}]}");
check_condition("secp256k1 structured get_public_key returns a response", resp != NULL);
pr = parse_result(resp, &result_str, &result_obj);
check_condition("secp256k1 structured result is a JSON object",
pr == 2 && result_obj != NULL);
if (result_obj != NULL) {
alg_item = cJSON_GetObjectItemCaseSensitive(result_obj, "algorithm");
pk_item = cJSON_GetObjectItemCaseSensitive(result_obj, "public_key");
kid_item = cJSON_GetObjectItemCaseSensitive(result_obj, "key_id");
check_condition("secp256k1 structured has algorithm=secp256k1",
cJSON_IsString(alg_item) && strcmp(alg_item->valuestring, "secp256k1") == 0);
check_condition("secp256k1 structured has public_key (64 hex chars)",
cJSON_IsString(pk_item) && strlen(pk_item->valuestring) == 64);
check_condition("secp256k1 structured has key_id (16 hex chars)",
cJSON_IsString(kid_item) && strlen(kid_item->valuestring) == 16);
check_condition("secp256k1 key_id == first 16 chars of public_key",
cJSON_IsString(pk_item) && cJSON_IsString(kid_item) &&
strncmp(pk_item->valuestring, kid_item->valuestring, 16) == 0);
} else {
check_condition("secp256k1 structured has algorithm=secp256k1", 0);
check_condition("secp256k1 structured has public_key (64 hex chars)", 0);
check_condition("secp256k1 structured has key_id (16 hex chars)", 0);
check_condition("secp256k1 key_id == first 16 chars of public_key", 0);
}
free(result_str);
cJSON_Delete(result_obj);
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- ed25519: structured JSON ---- */
{
role_table_t table;
role_entry_t ssh_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp = NULL;
char *result_str = NULL;
cJSON *result_obj = NULL;
cJSON *alg_item = NULL;
cJSON *pk_item = NULL;
cJSON *kid_item = NULL;
int pr;
role_table_init(&table);
ssh_role = make_entry("ssh_main", "ssh", "ed25519", 0);
role_table_add(&table, &ssh_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
resp = dispatcher_handle_request(&dispatcher,
"{\"id\":\"3\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"ssh_main\"}]}");
check_condition("ed25519 get_public_key returns a response", resp != NULL);
pr = parse_result(resp, &result_str, &result_obj);
check_condition("ed25519 get_public_key result is a JSON object",
pr == 2 && result_obj != NULL);
if (result_obj != NULL) {
alg_item = cJSON_GetObjectItemCaseSensitive(result_obj, "algorithm");
pk_item = cJSON_GetObjectItemCaseSensitive(result_obj, "public_key");
kid_item = cJSON_GetObjectItemCaseSensitive(result_obj, "key_id");
check_condition("ed25519 structured has algorithm=ed25519",
cJSON_IsString(alg_item) && strcmp(alg_item->valuestring, "ed25519") == 0);
check_condition("ed25519 structured has public_key (64 hex chars)",
cJSON_IsString(pk_item) && strlen(pk_item->valuestring) == 64);
check_condition("ed25519 structured has key_id (16 hex chars)",
cJSON_IsString(kid_item) && strlen(kid_item->valuestring) == 16);
check_condition("ed25519 key_id == first 16 chars of public_key",
cJSON_IsString(pk_item) && cJSON_IsString(kid_item) &&
strncmp(pk_item->valuestring, kid_item->valuestring, 16) == 0);
} else {
check_condition("ed25519 structured has algorithm=ed25519", 0);
check_condition("ed25519 structured has public_key (64 hex chars)", 0);
check_condition("ed25519 structured has key_id (16 hex chars)", 0);
check_condition("ed25519 key_id == first 16 chars of public_key", 0);
}
free(result_str);
cJSON_Delete(result_obj);
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- ML-DSA-65: structured JSON with large pubkey ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp = NULL;
char *result_str = NULL;
cJSON *result_obj = NULL;
cJSON *alg_item = NULL;
cJSON *pk_item = NULL;
cJSON *kid_item = NULL;
const crypto_alg_sizes_t *sz;
int pr;
role_table_init(&table);
pq_role = make_entry("pq_sig", "pq-sig", "ml-dsa-65", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
sz = crypto_alg_get_sizes(CRYPTO_ALG_ML_DSA_65);
check_condition("ML-DSA-65 sizes available", sz != NULL);
resp = dispatcher_handle_request(&dispatcher,
"{\"id\":\"4\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"pq_sig\"}]}");
check_condition("ML-DSA-65 get_public_key returns a response", resp != NULL);
pr = parse_result(resp, &result_str, &result_obj);
check_condition("ML-DSA-65 get_public_key result is a JSON object",
pr == 2 && result_obj != NULL);
if (result_obj != NULL && sz != NULL) {
alg_item = cJSON_GetObjectItemCaseSensitive(result_obj, "algorithm");
pk_item = cJSON_GetObjectItemCaseSensitive(result_obj, "public_key");
kid_item = cJSON_GetObjectItemCaseSensitive(result_obj, "key_id");
check_condition("ML-DSA-65 structured has algorithm=ml-dsa-65",
cJSON_IsString(alg_item) && strcmp(alg_item->valuestring, "ml-dsa-65") == 0);
check_condition("ML-DSA-65 structured has large public_key (3904 hex chars)",
cJSON_IsString(pk_item) && strlen(pk_item->valuestring) == sz->pub_key_len * 2);
check_condition("ML-DSA-65 structured has key_id (16 hex chars)",
cJSON_IsString(kid_item) && strlen(kid_item->valuestring) == 16);
check_condition("ML-DSA-65 key_id == first 16 chars of public_key",
cJSON_IsString(pk_item) && cJSON_IsString(kid_item) &&
strncmp(pk_item->valuestring, kid_item->valuestring, 16) == 0);
} else {
check_condition("ML-DSA-65 structured has algorithm=ml-dsa-65", 0);
check_condition("ML-DSA-65 structured has large public_key (3904 hex chars)", 0);
check_condition("ML-DSA-65 structured has key_id (16 hex chars)", 0);
check_condition("ML-DSA-65 key_id == first 16 chars of public_key", 0);
}
free(result_str);
cJSON_Delete(result_obj);
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- ML-KEM-768: structured JSON ---- */
{
role_table_t table;
role_entry_t kem_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp = NULL;
char *result_str = NULL;
cJSON *result_obj = NULL;
cJSON *alg_item = NULL;
cJSON *pk_item = NULL;
cJSON *kid_item = NULL;
const crypto_alg_sizes_t *sz;
int pr;
role_table_init(&table);
kem_role = make_entry("kem_main", "pq-kem", "ml-kem-768", 0);
role_table_add(&table, &kem_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
sz = crypto_alg_get_sizes(CRYPTO_ALG_ML_KEM_768);
check_condition("ML-KEM-768 sizes available", sz != NULL);
resp = dispatcher_handle_request(&dispatcher,
"{\"id\":\"5\",\"method\":\"get_public_key\",\"params\":[{\"role\":\"kem_main\"}]}");
check_condition("ML-KEM-768 get_public_key returns a response", resp != NULL);
pr = parse_result(resp, &result_str, &result_obj);
check_condition("ML-KEM-768 get_public_key result is a JSON object",
pr == 2 && result_obj != NULL);
if (result_obj != NULL && sz != NULL) {
alg_item = cJSON_GetObjectItemCaseSensitive(result_obj, "algorithm");
pk_item = cJSON_GetObjectItemCaseSensitive(result_obj, "public_key");
kid_item = cJSON_GetObjectItemCaseSensitive(result_obj, "key_id");
check_condition("ML-KEM-768 structured has algorithm=ml-kem-768",
cJSON_IsString(alg_item) && strcmp(alg_item->valuestring, "ml-kem-768") == 0);
check_condition("ML-KEM-768 structured has public_key (2368 hex chars)",
cJSON_IsString(pk_item) && strlen(pk_item->valuestring) == sz->pub_key_len * 2);
check_condition("ML-KEM-768 structured has key_id (16 hex chars)",
cJSON_IsString(kid_item) && strlen(kid_item->valuestring) == 16);
check_condition("ML-KEM-768 key_id == first 16 chars of public_key",
cJSON_IsString(pk_item) && cJSON_IsString(kid_item) &&
strncmp(pk_item->valuestring, kid_item->valuestring, 16) == 0);
} else {
check_condition("ML-KEM-768 structured has algorithm=ml-kem-768", 0);
check_condition("ML-KEM-768 structured has public_key (2368 hex chars)", 0);
check_condition("ML-KEM-768 structured has key_id (16 hex chars)", 0);
check_condition("ML-KEM-768 key_id == first 16 chars of public_key", 0);
}
free(result_str);
cJSON_Delete(result_obj);
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
printf("%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

264
tests/test_role_table.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -198,6 +203,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -233,6 +256,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -257,6 +282,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -290,6 +321,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -297,15 +342,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -336,6 +513,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -344,10 +597,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

264
tests/test_selector.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -195,6 +200,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -230,6 +253,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -254,6 +279,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -287,6 +318,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -294,15 +339,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -333,6 +510,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -341,10 +594,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.

837
tests/test_slh_dsa_128s.c Normal file
View File

@@ -0,0 +1,837 @@
/* Test for Phase 4 SLH-DSA-128s (FIPS 205) post-quantum hash-based signatures.
*
* Verifies:
* - SLH-DSA-128s keygen from seed: 32-byte pub, 64-byte priv
* - SLH-DSA-128s keygen determinism: same seed -> same keypair
* - SLH-DSA-128s sign/verify roundtrip: sign a message, verify passes
* - SLH-DSA-128s sign/verify with wrong message: verify fails
* - SLH-DSA-128s sign/verify with wrong key: verify fails
* - DRBG determinism: same seed -> same randombytes output
* - Integration: derive SLH-DSA-128s key from mnemonic via crypto_derive_one,
* sign data via sign_data verb through dispatcher, verify signature
* - Enforcement: sign_data allowed on pq-sig+slh-dsa-128s
*/
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
#include <stddef.h>
#include <stdint.h>
#include <sys/types.h>
#include <cJSON.h>
/* from secure_mem.h */
typedef struct {
void *data;
size_t size;
int locked;
} secure_buf_t;
int secure_buf_alloc(secure_buf_t *buf, size_t size);
void secure_buf_free(secure_buf_t *buf);
void secure_memzero(void *ptr, size_t len);
/* from mnemonic.h */
#define MNEMONIC_MAX_LEN 256
typedef struct {
secure_buf_t buf;
int loaded;
int word_count;
} mnemonic_state_t;
void mnemonic_init(mnemonic_state_t *state);
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
void mnemonic_unload(mnemonic_state_t *state);
int mnemonic_is_loaded(const mnemonic_state_t *state);
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
int mnemonic_generate(int word_count, char *out, size_t out_len);
/* from role_table.h */
#define ROLE_NAME_MAX 64
#define ROLE_PATH_MAX 128
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66
#define ROLE_TABLE_MAX_ENTRIES 256
typedef enum {
PURPOSE_NOSTR = 0,
PURPOSE_BITCOIN,
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG,
PURPOSE_PQ_KEM,
PURPOSE_UNKNOWN
} role_purpose_t;
typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
typedef enum {
SELECTOR_NOSTR_INDEX,
SELECTOR_ROLE_PATH
} role_selector_type_t;
typedef struct {
char name[ROLE_NAME_MAX];
char purpose_str[ROLE_PURPOSE_MAX];
char curve_str[ROLE_CURVE_MAX];
role_purpose_t purpose;
role_curve_t curve;
role_selector_type_t selector_type;
int nostr_index;
char role_path[ROLE_PATH_MAX];
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
int derived;
} role_entry_t;
typedef struct {
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
int count;
} role_table_t;
void role_table_init(role_table_t *table);
int role_table_add(role_table_t *table, const role_entry_t *entry);
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
role_purpose_t role_purpose_from_str(const char *s);
role_curve_t role_curve_from_str(const char *s);
const char *role_purpose_to_str(role_purpose_t p);
const char *role_curve_to_str(role_curve_t c);
/* from selector.h */
#define SELECTOR_OK 0
#define SELECTOR_ERR_AMBIGUOUS -1
#define SELECTOR_ERR_NOT_FOUND -2
#define SELECTOR_ERR_NO_DEFAULT -3
typedef struct {
int has_role;
char role_name[ROLE_NAME_MAX];
int has_nostr_index;
int nostr_index;
int has_role_path;
char role_path[ROLE_PATH_MAX];
} selector_request_t;
void selector_request_init(selector_request_t *req);
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
const char *selector_strerror(int err);
/* from enforcement.h */
#define ENFORCE_OK 0
#define ENFORCE_ERR_PURPOSE -1
#define ENFORCE_ERR_CURVE -2
#define ENFORCE_ERR_UNKNOWN_VERB -3
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_MINE_EVENT "mine_event"
#define VERB_SIGN_DATA "sign_data"
#define VERB_VERIFY_SIG "verify_signature"
#define VERB_SSH_SIGN "ssh_sign"
#define VERB_KEM_ENCAPS "kem_encapsulate"
#define VERB_KEM_DECAPS "kem_decapsulate"
int enforce_verb_role(const char *verb, const role_entry_t *role);
const char *enforce_strerror(int err);
/* from policy.h */
#define POLICY_MAX_ENTRIES 32
#define POLICY_MAX_VERBS 16
#define POLICY_MAX_ROLES 16
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
typedef enum {
PROMPT_NEVER = 0,
PROMPT_FIRST_PER_BOOT,
PROMPT_EVERY_REQUEST,
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0,
POLICY_SOURCE_PREAPPROVE,
POLICY_SOURCE_SESSION_GRANT
} policy_source_t;
typedef struct {
char caller[POLICY_CALLER_MAX_LEN];
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
int verb_count;
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
typedef struct {
policy_entry_t entries[POLICY_MAX_ENTRIES];
int count;
} policy_table_t;
#define POLICY_ALLOW 0
#define POLICY_DENY -1
#define POLICY_PROMPT -2
#define POLICY_NO_MATCH -3
void policy_table_init(policy_table_t *table);
void policy_init_default(policy_table_t *table, uid_t owner_uid);
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0,
CRYPTO_ALG_ED25519,
CRYPTO_ALG_X25519,
CRYPTO_ALG_ML_DSA_65,
CRYPTO_ALG_SLH_DSA_128S,
CRYPTO_ALG_ML_KEM_768,
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len;
size_t ciphertext_len;
size_t shared_secret_len;
} crypto_alg_sizes_t;
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
const char *crypto_alg_to_str(crypto_alg_t alg);
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
typedef struct {
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
int count;
} key_store_t;
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
} dispatcher_ctx_t;
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
/* NSIGNER_HEADERLESS_DECLS_END */
static key_store_t g_key_store;
static algorithm_key_cache_t g_alg_key_cache;
#include <nostr_core/nostr_common.h>
#include <nostr_core/utils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* SLH-DSA-128s key sizes (FIPS 205) */
#define SLH_DSA_128S_PUBKEY_BYTES 32
#define SLH_DSA_128S_PRIVKEY_BYTES 64
#define SLH_DSA_128S_SIG_BYTES 7856
static int g_passes = 0;
static int g_total = 0;
static void check_condition(const char *name, int condition) {
g_total++;
if (condition) {
printf("PASS: %s\n", name);
g_passes++;
} else {
printf("FAIL: %s\n", name);
}
}
static int response_has(const char *response, const char *needle) {
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
}
static role_entry_t make_pq_sig_slh_dsa_128s_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "pq-sig", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "slh-dsa-128s", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
static role_entry_t make_nostr_secp_entry(const char *name, int idx) {
role_entry_t e;
memset(&e, 0, sizeof(e));
strncpy(e.name, name, sizeof(e.name) - 1);
strncpy(e.purpose_str, "nostr", sizeof(e.purpose_str) - 1);
strncpy(e.curve_str, "secp256k1", sizeof(e.curve_str) - 1);
e.purpose = role_purpose_from_str(e.purpose_str);
e.curve = role_curve_from_str(e.curve_str);
e.selector_type = SELECTOR_NOSTR_INDEX;
e.nostr_index = idx;
e.derived = 0;
return e;
}
int main(void) {
/* Test mnemonic (BIP-39 standard test vector). */
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
unsigned char seed[32];
unsigned char *priv1, *pub1, *priv2, *pub2;
unsigned char *sig;
size_t sig_len;
int rc;
/* Allocate key buffers on the heap */
priv1 = (unsigned char *)malloc(SLH_DSA_128S_PRIVKEY_BYTES);
pub1 = (unsigned char *)malloc(SLH_DSA_128S_PUBKEY_BYTES);
priv2 = (unsigned char *)malloc(SLH_DSA_128S_PRIVKEY_BYTES);
pub2 = (unsigned char *)malloc(SLH_DSA_128S_PUBKEY_BYTES);
sig = (unsigned char *)malloc(SLH_DSA_128S_SIG_BYTES);
if (!priv1 || !pub1 || !priv2 || !pub2 || !sig) {
printf("FAIL: memory allocation\n");
return 1;
}
/* ---- DRBG determinism ---- */
{
unsigned char out1[64], out2[64];
memset(seed, 0x42, 32);
pq_drbg_init(seed, 32);
rc = pq_drbg_randombytes(out1, 64);
check_condition("DRBG randombytes succeeds", rc == 0);
pq_drbg_zeroize();
memset(seed, 0x42, 32);
pq_drbg_init(seed, 32);
rc = pq_drbg_randombytes(out2, 64);
check_condition("DRBG randombytes succeeds (2nd)", rc == 0);
check_condition("DRBG determinism (same seed -> same output)",
memcmp(out1, out2, 64) == 0);
pq_drbg_zeroize();
}
/* ---- SLH-DSA-128s keygen from seed ---- */
memset(seed, 0x42, 32);
rc = crypto_slh_dsa_128s_keygen_from_seed(seed, 32, priv1, pub1);
check_condition("SLH-DSA-128s keygen from seed succeeds", rc == 0);
/* Keygen determinism: same seed -> same keypair */
memset(seed, 0x42, 32);
rc = crypto_slh_dsa_128s_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("SLH-DSA-128s keygen determinism (same seed -> same key)", rc == 0 &&
memcmp(priv1, priv2, SLH_DSA_128S_PRIVKEY_BYTES) == 0 &&
memcmp(pub1, pub2, SLH_DSA_128S_PUBKEY_BYTES) == 0);
/* Different seed -> different keypair */
memset(seed, 0x99, 32);
rc = crypto_slh_dsa_128s_keygen_from_seed(seed, 32, priv2, pub2);
check_condition("SLH-DSA-128s keygen different seed -> different key", rc == 0 &&
memcmp(pub1, pub2, SLH_DSA_128S_PUBKEY_BYTES) != 0);
/* ---- SLH-DSA-128s sign/verify roundtrip ---- */
memset(seed, 0x42, 32);
crypto_slh_dsa_128s_keygen_from_seed(seed, 32, priv1, pub1);
{
const char *msg = "hello world";
sig_len = SLH_DSA_128S_SIG_BYTES;
rc = crypto_slh_dsa_128s_sign(priv1, SLH_DSA_128S_PRIVKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, &sig_len);
check_condition("SLH-DSA-128s sign succeeds", rc == 0 && sig_len > 0);
check_condition("SLH-DSA-128s signature is 7856 bytes", sig_len == SLH_DSA_128S_SIG_BYTES);
rc = crypto_slh_dsa_128s_verify(pub1, SLH_DSA_128S_PUBKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, sig_len);
check_condition("SLH-DSA-128s verify valid signature", rc == 0);
/* Wrong message should fail */
{
const char *wrong_msg = "hello worle";
rc = crypto_slh_dsa_128s_verify(pub1, SLH_DSA_128S_PUBKEY_BYTES,
(const unsigned char *)wrong_msg, strlen(wrong_msg),
sig, sig_len);
check_condition("SLH-DSA-128s verify wrong message -> invalid", rc == 1);
}
/* Wrong key should fail */
memset(seed, 0xAB, 32);
crypto_slh_dsa_128s_keygen_from_seed(seed, 32, priv2, pub2);
rc = crypto_slh_dsa_128s_verify(pub2, SLH_DSA_128S_PUBKEY_BYTES,
(const unsigned char *)msg, strlen(msg),
sig, sig_len);
check_condition("SLH-DSA-128s verify wrong key -> invalid", rc == 1);
}
/* ---- Integration: derive SLH-DSA-128s key via crypto_derive_all ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
int derived;
role_table_init(&table);
pq_role = make_pq_sig_slh_dsa_128s_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
derived = crypto_derive_all(&g_key_store, &table, &mnemonic_state);
check_condition("crypto_derive_all derives SLH-DSA-128s key", derived == 1);
{
const char *pub_hex = crypto_get_pubkey_hex(&g_key_store, 0);
/* 32 bytes hex-encoded = 64 hex chars + null */
check_condition("SLH-DSA-128s derived pubkey hex is 64 chars",
pub_hex != NULL && strlen(pub_hex) == 64);
}
{
const unsigned char *priv = crypto_get_private_key(&g_key_store, 0);
check_condition("SLH-DSA-128s derived private key not NULL", priv != NULL);
}
/* Determinism: re-derive and check same key */
{
static key_store_t key_store2;
memset(&key_store2, 0, sizeof(key_store2));
crypto_derive_all(&key_store2, &table, &mnemonic_state);
{
const char *pub_hex1 = crypto_get_pubkey_hex(&g_key_store, 0);
const char *pub_hex2 = crypto_get_pubkey_hex(&key_store2, 0);
check_condition("SLH-DSA-128s derivation determinism (same mnemonic -> same key)",
pub_hex1 != NULL && pub_hex2 != NULL &&
strcmp(pub_hex1, pub_hex2) == 0);
}
crypto_wipe(&key_store2);
}
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: sign_data via dispatcher ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" in hex */
char request[512];
role_table_init(&table);
pq_role = make_pq_sig_slh_dsa_128s_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
/* sign_data request */
snprintf(request, sizeof(request),
"{\"id\":\"test1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex);
resp = dispatcher_handle_request(&dispatcher, request);
check_condition("sign_data via dispatcher returns result",
resp != NULL && response_has(resp, "\"result\""));
check_condition("sign_data result contains signature",
resp != NULL && response_has(resp, "signature"));
check_condition("sign_data result contains algorithm slh-dsa-128s",
resp != NULL && response_has(resp, "slh-dsa-128s"));
free(resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Integration: verify_signature roundtrip via dispatcher ---- */
{
role_table_t table;
role_entry_t pq_role;
static mnemonic_state_t mnemonic_state;
dispatcher_ctx_t dispatcher;
char *sign_resp, *verify_resp;
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" */
char sign_req[512];
/* SLH-DSA-128s sig is 7856 bytes = 15712 hex chars. The verify request
* needs: JSON overhead + msg_hex (22) + sig_hex (15712) + options ~50
* = ~16000 bytes. Use 20000 to be safe. */
char *verify_req = (char *)malloc(20000);
cJSON *sign_json, *result_item, *sig_item;
const char *sig_str = NULL;
role_table_init(&table);
pq_role = make_pq_sig_slh_dsa_128s_entry("pq_main", 0);
role_table_add(&table, &pq_role);
mnemonic_init(&mnemonic_state);
mnemonic_load(&mnemonic_state, mnemonic);
memset(&g_key_store, 0, sizeof(g_key_store));
alg_key_cache_init(&g_alg_key_cache);
crypto_derive_all(&g_key_store, &table, &mnemonic_state);
dispatcher_init(&dispatcher, &table, &mnemonic_state, &g_key_store, &g_alg_key_cache);
/* Sign */
snprintf(sign_req, sizeof(sign_req),
"{\"id\":\"s1\",\"method\":\"sign_data\",\"params\":[\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex);
sign_resp = dispatcher_handle_request(&dispatcher, sign_req);
check_condition("verify roundtrip: sign_data succeeds", sign_resp != NULL);
/* Extract signature from result */
if (sign_resp != NULL) {
sign_json = cJSON_Parse(sign_resp);
if (sign_json != NULL) {
result_item = cJSON_GetObjectItemCaseSensitive(sign_json, "result");
if (cJSON_IsString(result_item)) {
cJSON *result_obj = cJSON_Parse(result_item->valuestring);
if (result_obj != NULL) {
sig_item = cJSON_GetObjectItemCaseSensitive(result_obj, "signature");
if (cJSON_IsString(sig_item)) {
sig_str = strdup(sig_item->valuestring);
}
cJSON_Delete(result_obj);
}
}
cJSON_Delete(sign_json);
}
}
check_condition("verify roundtrip: extracted signature hex", sig_str != NULL);
/* Verify */
if (sig_str != NULL && verify_req != NULL) {
snprintf(verify_req, 20000,
"{\"id\":\"v1\",\"method\":\"verify_signature\",\"params\":[\"%s\",\"%s\",{\"role\":\"pq_main\"}]}",
msg_hex, sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature returns valid:true",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "true"));
free(verify_resp);
/* Verify with wrong message */
snprintf(verify_req, 20000,
"{\"id\":\"v2\",\"method\":\"verify_signature\",\"params\":[\"00ff\",\"%s\",{\"role\":\"pq_main\"}]}",
sig_str);
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
check_condition("verify_signature wrong msg returns valid:false",
verify_resp != NULL && response_has(verify_resp, "valid") &&
response_has(verify_resp, "false"));
free(verify_resp);
free((void *)sig_str);
} else {
check_condition("verify_signature returns valid:true", 0);
check_condition("verify_signature wrong msg returns valid:false", 0);
}
free(verify_req);
free(sign_resp);
crypto_wipe(&g_key_store);
mnemonic_unload(&mnemonic_state);
}
/* ---- Enforcement: sign_data on pq-sig+slh-dsa-128s ---- */
{
role_entry_t pq_sig = make_pq_sig_slh_dsa_128s_entry("pq", 0);
role_entry_t nostr_secp = make_nostr_secp_entry("nostr", 0);
check_condition("enforce sign_data + pq-sig/slh-dsa-128s -> OK",
enforce_verb_role(VERB_SIGN_DATA, &pq_sig) == ENFORCE_OK);
check_condition("enforce sign_data + nostr/secp256k1 -> PURPOSE err",
enforce_verb_role(VERB_SIGN_DATA, &nostr_secp) == ENFORCE_ERR_PURPOSE);
check_condition("enforce verify_signature + pq-sig/slh-dsa-128s -> OK",
enforce_verb_role(VERB_VERIFY_SIG, &pq_sig) == ENFORCE_OK);
}
/* ---- Cleanup ---- */
free(priv1);
free(pub1);
free(priv2);
free(pub2);
free(sig);
printf("\n%d/%d tests passed\n", g_passes, g_total);
return (g_passes == g_total) ? 0 : 1;
}

264
tests/test_socket_name.c
View File

@@ -82,6 +82,8 @@ typedef enum {
PURPOSE_SSH,
PURPOSE_AGE,
PURPOSE_FIPS,
PURPOSE_PQ_SIG, /* post-quantum signatures (ML-DSA, SLH-DSA) */
PURPOSE_PQ_KEM, /* post-quantum key encapsulation (ML-KEM) */
PURPOSE_UNKNOWN
} role_purpose_t;
@@ -90,6 +92,9 @@ typedef enum {
CURVE_SECP256K1 = 0,
CURVE_ED25519,
CURVE_X25519,
CURVE_ML_DSA_65,
CURVE_SLH_DSA_128S,
CURVE_ML_KEM_768,
CURVE_UNKNOWN
} role_curve_t;
@@ -195,6 +200,24 @@ const char *selector_strerror(int err);
#define ENFORCE_ERR_PURPOSE -1 /* purpose mismatch */
#define ENFORCE_ERR_CURVE -2 /* curve mismatch */
#define ENFORCE_ERR_UNKNOWN_VERB -3 /* verb not recognized */
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
#define ENFORCE_ERR_ALGORITHM -4 /* algorithm not valid for verb */
/* New algorithm-based verb defines (algorithm is a parameter, not implicit) */
#define VERB_SIGN "sign"
#define VERB_VERIFY "verify"
#define VERB_ENCAPSULATE "encapsulate"
#define VERB_DECAPSULATE "decapsulate"
#define VERB_DERIVE_SHARED "derive_shared_secret"
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
@@ -230,6 +253,8 @@ const char *enforce_strerror(int err);
#define POLICY_MAX_PURPOSES 8
#define POLICY_VERB_MAX_LEN 32
#define POLICY_CALLER_MAX_LEN 160
#define POLICY_MAX_ALGS 16
#define POLICY_MAX_ALGS 16
/* Prompt behavior */
typedef enum {
@@ -254,6 +279,12 @@ typedef struct {
int role_count;
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
/* Algorithm-based (new) */
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
int alg_count;
int index_min; /* -1 = any */
int index_max; /* -1 = any */
/* Common */
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
@@ -287,6 +318,20 @@ int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Check whether caller_id is allowed to invoke `verb` with the given
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
const char *verb, const char *algorithm, int index,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);
@@ -294,15 +339,147 @@ prompt_mode_t prompt_mode_from_str(const char *s);
const char *prompt_mode_to_str(prompt_mode_t m);
/* from pq_crypto.h */
/* Algorithm identifiers */
typedef enum {
CRYPTO_ALG_SECP256K1 = 0, /* existing, Nostr */
CRYPTO_ALG_ED25519, /* new, SSH signatures */
CRYPTO_ALG_X25519, /* new, key agreement */
CRYPTO_ALG_ML_DSA_65, /* new, PQ signatures */
CRYPTO_ALG_SLH_DSA_128S, /* new, PQ signatures */
CRYPTO_ALG_ML_KEM_768, /* new, PQ KEM */
CRYPTO_ALG_UNKNOWN
} crypto_alg_t;
/* Key sizes for each algorithm (compile-time constants) */
typedef struct {
size_t priv_key_len;
size_t pub_key_len;
size_t sig_len; /* 0 for KEM */
size_t ciphertext_len; /* 0 for signatures */
size_t shared_secret_len; /* 0 for signatures */
} crypto_alg_sizes_t;
/* Get size info for an algorithm. Returns NULL for CRYPTO_ALG_UNKNOWN. */
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
/* Map role_curve_t + role_purpose_t to crypto_alg_t.
* Returns CRYPTO_ALG_UNKNOWN for unsupported combinations. */
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
/* Convert crypto_alg_t to string. Returns NULL for unknown. */
const char *crypto_alg_to_str(crypto_alg_t alg);
/* Parse string to crypto_alg_t. Returns CRYPTO_ALG_UNKNOWN for unrecognized. */
crypto_alg_t crypto_alg_from_str(const char *s);
/* ed25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ed25519: sign a message. priv is 32-byte private key.
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ed25519: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* x25519: derive keypair from a 32-byte seed.
* priv_out and pub_out must be at least 32 bytes each.
* Returns 0 on success, -1 on error. */
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* x25519: derive shared secret from our private key and peer's public key.
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
const unsigned char *peer_pub, size_t pub_len,
unsigned char *shared_out, size_t *shared_out_len);
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
unsigned char *seed_out, size_t seed_out_len);
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
unsigned char *priv_out, unsigned char *pub_out);
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
* Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
unsigned char *ct_out, unsigned char *ss_out);
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
const unsigned char *ct, size_t ct_len,
unsigned char *ss_out);
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
int pq_drbg_randombytes(unsigned char *buf, size_t len);
void pq_drbg_zeroize(void);
/* from crypto.h */
/* Per-role derived key material (stored in secure memory) */
typedef struct {
secure_buf_t private_key; /* 32 bytes, mlock'd */
unsigned char public_key[32];
char pubkey_hex[65]; /* 64 hex chars + null */
char npub[128]; /* bech32 npub */
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
crypto_alg_t alg; /* which algorithm this key was derived for */
int valid;
} derived_key_t;
@@ -333,6 +510,82 @@ char *crypto_sign_event(const key_store_t *store, int role_index, const char *ev
void crypto_wipe(key_store_t *store);
/* from alg_api.h */
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
* Hashes the message with SHA-256 before signing (like Nostr event signing).
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 Schnorr (BIP-340) verify.
* pub is 32-byte x-only pubkey, sig is 64 bytes.
* Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* secp256k1 ECDSA sign arbitrary bytes.
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
* Hashes the message with SHA-256 before signing.
* Returns 0 on success, -1 on error. */
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
const unsigned char *msg, size_t msg_len,
unsigned char *sig_out, size_t *sig_out_len);
/* secp256k1 ECDSA verify.
* pub is 32-byte x-only pubkey (converted internally to compressed form).
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
const unsigned char *msg, size_t msg_len,
const unsigned char *sig, size_t sig_len);
/* ---- Algorithm key cache ----
* On-demand key derivation by algorithm+index, separate from the role-based
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
* When full, the oldest entry is evicted (FIFO). */
#define ALG_KEY_CACHE_MAX 32
typedef struct {
crypto_alg_t alg;
int index;
secure_buf_t private_key;
secure_buf_t public_key;
char pubkey_hex[8192];
char key_id[17];
int valid;
} alg_key_entry_t;
typedef struct {
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
int count;
} algorithm_key_cache_t;
/* Initialize an empty cache. */
void alg_key_cache_init(algorithm_key_cache_t *cache);
/* Zeroize and free all entries. Idempotent. */
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
/* Derive a key on-demand by (alg, index) and store it in the cache.
* Uses the standard derivation path for the algorithm.
* Returns 0 on success, -1 on error. */
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
/* from dispatcher.h */
@@ -341,10 +594,11 @@ typedef struct {
role_table_t *role_table;
mnemonic_state_t *mnemonic;
key_store_t *key_store;
algorithm_key_cache_t *alg_key_cache; /* algorithm-based on-demand keys */
} dispatcher_ctx_t;
/* Initialize dispatcher context */
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store);
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
/*
* Process a JSON-RPC request string and produce a JSON-RPC response string.