67 lines
2.8 KiB
C
67 lines
2.8 KiB
C
#ifndef NSIGNER_CRYPTO_H
|
|
#define NSIGNER_CRYPTO_H
|
|
|
|
#include "role_table.h"
|
|
#include "secure_mem.h"
|
|
#include "mnemonic.h"
|
|
#include <cJSON.h>
|
|
|
|
/* Per-role derived key material (stored in secure memory) */
|
|
typedef struct {
|
|
secure_buf_t private_key; /* 32 bytes, mlock'd */
|
|
unsigned char public_key[32];
|
|
char pubkey_hex[65]; /* 64 hex chars + null */
|
|
char npub[128]; /* bech32 npub */
|
|
int valid;
|
|
} derived_key_t;
|
|
|
|
/* Key store — holds derived keys for all roles */
|
|
typedef struct {
|
|
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
|
|
int count;
|
|
} key_store_t;
|
|
|
|
/* Initialize crypto subsystem (calls nostr_init). Returns 0 on success. */
|
|
int crypto_init(void);
|
|
|
|
/* Cleanup crypto subsystem (calls nostr_cleanup). */
|
|
void crypto_cleanup(void);
|
|
|
|
/* Derive keys for all roles in the table using the loaded mnemonic.
|
|
* Populates key_store and sets role->pubkey_hex and role->derived for each role.
|
|
* Only derives for roles with purpose=nostr and curve=secp256k1 (for now).
|
|
* Returns number of keys derived, or -1 on error. */
|
|
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
|
|
|
|
/* Get the derived private key for a role (by table index). Returns NULL if not derived. */
|
|
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
|
|
|
|
/* Get the derived public key hex for a role. Returns NULL if not derived. */
|
|
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
|
|
|
|
/* Sign a Nostr event. event_json is the unsigned event JSON string.
|
|
* Returns a newly-allocated string containing the signed event JSON, or NULL on error.
|
|
* Caller must free() the returned string. */
|
|
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
|
|
|
|
/* NIP-44 encrypt. Returns newly-allocated ciphertext string, or NULL on error. Caller frees. */
|
|
char *crypto_nip44_encrypt(const key_store_t *store, int role_index,
|
|
const char *recipient_pubkey_hex, const char *plaintext);
|
|
|
|
/* NIP-44 decrypt. Returns newly-allocated plaintext string, or NULL on error. Caller frees. */
|
|
char *crypto_nip44_decrypt(const key_store_t *store, int role_index,
|
|
const char *sender_pubkey_hex, const char *ciphertext);
|
|
|
|
/* NIP-04 encrypt. Returns newly-allocated ciphertext string, or NULL on error. Caller frees. */
|
|
char *crypto_nip04_encrypt(const key_store_t *store, int role_index,
|
|
const char *recipient_pubkey_hex, const char *plaintext);
|
|
|
|
/* NIP-04 decrypt. Returns newly-allocated plaintext string, or NULL on error. Caller frees. */
|
|
char *crypto_nip04_decrypt(const key_store_t *store, int role_index,
|
|
const char *sender_pubkey_hex, const char *ciphertext);
|
|
|
|
/* Zeroize all derived keys in the store. */
|
|
void crypto_wipe(key_store_t *store);
|
|
|
|
#endif /* NSIGNER_CRYPTO_H */
|