906 lines
35 KiB
C
906 lines
35 KiB
C
/* Test for Phase 2 ed25519 + x25519 crypto (pq_crypto.c, key_store.c,
|
|
* enforcement.c, dispatcher.c).
|
|
*
|
|
* Verifies:
|
|
* - ed25519 keygen from seed: 32-byte priv/pub
|
|
* - ed25519 sign/verify roundtrip + wrong-message fails
|
|
* - ed25519 determinism: same seed -> same keypair
|
|
* - x25519 keygen from seed: 32-byte priv/pub
|
|
* - x25519 ECDH roundtrip: two sides derive matching shared secret
|
|
* - x25519 determinism: same seed -> same keypair
|
|
* - SLIP-0010 derivation: deterministic seed from mnemonic+path
|
|
* - Integration: derive ed25519 key via crypto_derive_one, sign via
|
|
* dispatcher, verify signature
|
|
* - Enforcement: sign allowed on ssh+ed25519, rejected on nostr+secp256k1
|
|
* - Enforcement: sign allowed on ssh+ed25519
|
|
* - Enforcement: encapsulate/decapsulate rejected on ssh/ed25519
|
|
*/
|
|
/* NSIGNER_HEADERLESS_DECLS_BEGIN */
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
#include <sys/types.h>
|
|
#include <cJSON.h>
|
|
|
|
/* from secure_mem.h */
|
|
|
|
|
|
typedef struct {
|
|
void *data;
|
|
size_t size;
|
|
int locked;
|
|
} secure_buf_t;
|
|
|
|
int secure_buf_alloc(secure_buf_t *buf, size_t size);
|
|
void secure_buf_free(secure_buf_t *buf);
|
|
void secure_memzero(void *ptr, size_t len);
|
|
|
|
|
|
/* from mnemonic.h */
|
|
|
|
|
|
#define MNEMONIC_MAX_LEN 256
|
|
|
|
typedef struct {
|
|
secure_buf_t buf;
|
|
int loaded;
|
|
int word_count;
|
|
} mnemonic_state_t;
|
|
|
|
void mnemonic_init(mnemonic_state_t *state);
|
|
int mnemonic_load(mnemonic_state_t *state, const char *phrase);
|
|
void mnemonic_unload(mnemonic_state_t *state);
|
|
int mnemonic_is_loaded(const mnemonic_state_t *state);
|
|
const char *mnemonic_get_phrase(const mnemonic_state_t *state);
|
|
int mnemonic_generate(int word_count, char *out, size_t out_len);
|
|
|
|
|
|
/* from role_table.h */
|
|
|
|
|
|
#define ROLE_NAME_MAX 64
|
|
#define ROLE_PATH_MAX 128
|
|
#define ROLE_PURPOSE_MAX 32
|
|
#define ROLE_CURVE_MAX 16
|
|
#define ROLE_PUBKEY_HEX_MAX 66
|
|
#define ROLE_TABLE_MAX_ENTRIES 256
|
|
|
|
typedef enum {
|
|
PURPOSE_NOSTR = 0,
|
|
PURPOSE_BITCOIN,
|
|
PURPOSE_SSH,
|
|
PURPOSE_AGE,
|
|
PURPOSE_FIPS,
|
|
PURPOSE_PQ_SIG,
|
|
PURPOSE_PQ_KEM,
|
|
PURPOSE_UNKNOWN
|
|
} role_purpose_t;
|
|
|
|
typedef enum {
|
|
CURVE_SECP256K1 = 0,
|
|
CURVE_ED25519,
|
|
CURVE_X25519,
|
|
CURVE_ML_DSA_65,
|
|
CURVE_SLH_DSA_128S,
|
|
CURVE_ML_KEM_768,
|
|
CURVE_UNKNOWN
|
|
} role_curve_t;
|
|
|
|
typedef enum {
|
|
SELECTOR_NOSTR_INDEX,
|
|
SELECTOR_ROLE_PATH
|
|
} role_selector_type_t;
|
|
|
|
typedef struct {
|
|
char name[ROLE_NAME_MAX];
|
|
char purpose_str[ROLE_PURPOSE_MAX];
|
|
char curve_str[ROLE_CURVE_MAX];
|
|
role_purpose_t purpose;
|
|
role_curve_t curve;
|
|
role_selector_type_t selector_type;
|
|
int nostr_index;
|
|
char role_path[ROLE_PATH_MAX];
|
|
char pubkey_hex[ROLE_PUBKEY_HEX_MAX];
|
|
int derived;
|
|
} role_entry_t;
|
|
|
|
typedef struct {
|
|
role_entry_t entries[ROLE_TABLE_MAX_ENTRIES];
|
|
int count;
|
|
} role_table_t;
|
|
|
|
void role_table_init(role_table_t *table);
|
|
int role_table_add(role_table_t *table, const role_entry_t *entry);
|
|
role_entry_t *role_table_find_by_name(role_table_t *table, const char *name);
|
|
role_entry_t *role_table_find_by_nostr_index(role_table_t *table, int index);
|
|
role_entry_t *role_table_find_by_path(role_table_t *table, const char *path);
|
|
role_entry_t *role_table_get_default(role_table_t *table);
|
|
role_purpose_t role_purpose_from_str(const char *s);
|
|
role_curve_t role_curve_from_str(const char *s);
|
|
const char *role_purpose_to_str(role_purpose_t p);
|
|
const char *role_curve_to_str(role_curve_t c);
|
|
int role_table_register_nostr_index(role_table_t *table, int nostr_index);
|
|
|
|
|
|
/* from selector.h */
|
|
|
|
|
|
#define SELECTOR_OK 0
|
|
#define SELECTOR_ERR_AMBIGUOUS -1
|
|
#define SELECTOR_ERR_NOT_FOUND -2
|
|
#define SELECTOR_ERR_NO_DEFAULT -3
|
|
|
|
typedef struct {
|
|
int has_role;
|
|
char role_name[ROLE_NAME_MAX];
|
|
int has_nostr_index;
|
|
int nostr_index;
|
|
int has_role_path;
|
|
char role_path[ROLE_PATH_MAX];
|
|
} selector_request_t;
|
|
|
|
void selector_request_init(selector_request_t *req);
|
|
int selector_resolve(const selector_request_t *req, role_table_t *table, role_entry_t **out);
|
|
const char *selector_strerror(int err);
|
|
|
|
|
|
/* from enforcement.h */
|
|
|
|
|
|
#define ENFORCE_OK 0
|
|
#define ENFORCE_ERR_PURPOSE -1
|
|
#define ENFORCE_ERR_CURVE -2
|
|
#define ENFORCE_ERR_UNKNOWN_VERB -3
|
|
#define ENFORCE_ERR_ALGORITHM -4
|
|
|
|
#define VERB_GET_PUBLIC_KEY "get_public_key"
|
|
#define VERB_SIGN "sign"
|
|
#define VERB_VERIFY "verify"
|
|
#define VERB_ENCAPSULATE "encapsulate"
|
|
#define VERB_DECAPSULATE "decapsulate"
|
|
#define VERB_DERIVE_SHARED "derive_shared_secret"
|
|
#define VERB_DERIVE "derive"
|
|
#define VERB_NOSTR_GET_PUBLIC_KEY "nostr_get_public_key"
|
|
#define VERB_NOSTR_SIGN_EVENT "nostr_sign_event"
|
|
#define VERB_NOSTR_MINE_EVENT "nostr_mine_event"
|
|
#define VERB_NOSTR_NIP44_ENCRYPT "nostr_nip44_encrypt"
|
|
#define VERB_NOSTR_NIP44_DECRYPT "nostr_nip44_decrypt"
|
|
#define VERB_NOSTR_NIP04_ENCRYPT "nostr_nip04_encrypt"
|
|
#define VERB_NOSTR_NIP04_DECRYPT "nostr_nip04_decrypt"
|
|
|
|
int enforce_verb_role(const char *verb, const role_entry_t *role);
|
|
const char *enforce_strerror(int err);
|
|
|
|
|
|
/* from policy.h */
|
|
|
|
|
|
#define POLICY_MAX_ENTRIES 32
|
|
#define POLICY_MAX_VERBS 16
|
|
#define POLICY_MAX_ROLES 16
|
|
#define POLICY_MAX_PURPOSES 8
|
|
#define POLICY_VERB_MAX_LEN 32
|
|
#define POLICY_CALLER_MAX_LEN 160
|
|
#define POLICY_MAX_ALGS 16
|
|
#define POLICY_MAX_ALGS 16
|
|
|
|
typedef enum {
|
|
PROMPT_NEVER = 0,
|
|
PROMPT_FIRST_PER_BOOT,
|
|
PROMPT_EVERY_REQUEST,
|
|
PROMPT_DENY
|
|
} prompt_mode_t;
|
|
|
|
typedef enum {
|
|
POLICY_SOURCE_DEFAULT = 0,
|
|
POLICY_SOURCE_PREAPPROVE,
|
|
POLICY_SOURCE_SESSION_GRANT
|
|
} policy_source_t;
|
|
|
|
typedef struct {
|
|
char caller[POLICY_CALLER_MAX_LEN];
|
|
char verbs[POLICY_MAX_VERBS][POLICY_VERB_MAX_LEN];
|
|
int verb_count;
|
|
char roles[POLICY_MAX_ROLES][ROLE_NAME_MAX];
|
|
int role_count;
|
|
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
|
|
int purpose_count;
|
|
/* Algorithm-based (new) */
|
|
char algorithms[16][32]; /* algorithm names; POLICY_MAX_ALGS */
|
|
int alg_count;
|
|
int index_min; /* -1 = any */
|
|
int index_max; /* -1 = any */
|
|
/* Common */
|
|
prompt_mode_t prompt;
|
|
policy_source_t source;
|
|
} policy_entry_t;
|
|
|
|
typedef struct {
|
|
policy_entry_t entries[POLICY_MAX_ENTRIES];
|
|
int count;
|
|
} policy_table_t;
|
|
|
|
#define POLICY_ALLOW 0
|
|
#define POLICY_DENY -1
|
|
#define POLICY_PROMPT -2
|
|
#define POLICY_NO_MATCH -3
|
|
|
|
void policy_table_init(policy_table_t *table);
|
|
void policy_init_default(policy_table_t *table, uid_t owner_uid);
|
|
int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
|
|
int policy_check(const policy_table_t *table, const char *caller_id,
|
|
const char *verb, const char *role_name, const char *purpose,
|
|
policy_source_t *out_source);
|
|
|
|
/* Check whether caller_id is allowed to invoke `verb` with the given
|
|
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
|
|
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
|
|
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
|
|
const char *verb, const char *algorithm, int index,
|
|
policy_source_t *out_source);
|
|
|
|
/* Check whether caller_id is allowed to invoke `verb` with the given
|
|
* algorithm and index (algorithm-based policy). Returns POLICY_ALLOW,
|
|
* POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH. */
|
|
int policy_check_algorithm(const policy_table_t *table, const char *caller_id,
|
|
const char *verb, const char *algorithm, int index,
|
|
policy_source_t *out_source);
|
|
prompt_mode_t prompt_mode_from_str(const char *s);
|
|
const char *prompt_mode_to_str(prompt_mode_t m);
|
|
|
|
|
|
/* from pq_crypto.h */
|
|
|
|
|
|
/* Algorithm identifiers */
|
|
typedef enum {
|
|
CRYPTO_ALG_SECP256K1 = 0,
|
|
CRYPTO_ALG_ED25519,
|
|
CRYPTO_ALG_X25519,
|
|
CRYPTO_ALG_ML_DSA_65,
|
|
CRYPTO_ALG_SLH_DSA_128S,
|
|
CRYPTO_ALG_ML_KEM_768,
|
|
CRYPTO_ALG_UNKNOWN
|
|
} crypto_alg_t;
|
|
|
|
/* Key sizes for each algorithm (compile-time constants) */
|
|
typedef struct {
|
|
size_t priv_key_len;
|
|
size_t pub_key_len;
|
|
size_t sig_len;
|
|
size_t ciphertext_len;
|
|
size_t shared_secret_len;
|
|
} crypto_alg_sizes_t;
|
|
|
|
const crypto_alg_sizes_t *crypto_alg_get_sizes(crypto_alg_t alg);
|
|
crypto_alg_t crypto_alg_from_role(role_curve_t curve, role_purpose_t purpose);
|
|
const char *crypto_alg_to_str(crypto_alg_t alg);
|
|
crypto_alg_t crypto_alg_from_str(const char *s);
|
|
/* ed25519: derive keypair from a 32-byte seed.
|
|
* priv_out and pub_out must be at least 32 bytes each.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_ed25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
|
|
unsigned char *priv_out, unsigned char *pub_out);
|
|
|
|
/* ed25519: sign a message. priv is 32-byte private key.
|
|
* sig_out must be at least 64 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_ed25519_sign(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
unsigned char *sig_out, size_t *sig_out_len);
|
|
|
|
/* ed25519: verify a signature. pub is 32-byte public key.
|
|
* Returns 0 on valid, 1 on invalid, -1 on error. */
|
|
int crypto_ed25519_verify(const unsigned char *pub, size_t pub_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
const unsigned char *sig, size_t sig_len);
|
|
|
|
/* x25519: derive keypair from a 32-byte seed.
|
|
* priv_out and pub_out must be at least 32 bytes each.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_x25519_keygen_from_seed(const unsigned char *seed, size_t seed_len,
|
|
unsigned char *priv_out, unsigned char *pub_out);
|
|
|
|
/* x25519: derive shared secret from our private key and peer's public key.
|
|
* shared_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_x25519_ecdh(const unsigned char *our_priv, size_t priv_len,
|
|
const unsigned char *peer_pub, size_t pub_len,
|
|
unsigned char *shared_out, size_t *shared_out_len);
|
|
|
|
/* Derive a 32-byte seed from a mnemonic using a BIP-44 path (SLIP-0010).
|
|
* seed_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_derive_seed_from_mnemonic(const char *mnemonic, const char *path,
|
|
unsigned char *seed_out, size_t seed_out_len);
|
|
/* ML-DSA-65: generate keypair from a 32-byte seed (deterministic).
|
|
* priv_out must be at least 4032 bytes, pub_out at least 1952 bytes.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_ml_dsa_65_keygen_from_seed(const unsigned char *seed, size_t seed_len,
|
|
unsigned char *priv_out, unsigned char *pub_out);
|
|
|
|
/* ML-DSA-65: sign a message. priv is 4032-byte private key.
|
|
* sig_out must be at least 3309 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_ml_dsa_65_sign(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
unsigned char *sig_out, size_t *sig_out_len);
|
|
|
|
/* ML-DSA-65: verify a signature. pub is 1952-byte public key.
|
|
* Returns 0 on valid, 1 on invalid, -1 on error. */
|
|
int crypto_ml_dsa_65_verify(const unsigned char *pub, size_t pub_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
const unsigned char *sig, size_t sig_len);
|
|
|
|
|
|
/* SLH-DSA-128s: generate keypair from a 32-byte seed (deterministic).
|
|
* priv_out must be at least 64 bytes, pub_out at least 32 bytes.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_slh_dsa_128s_keygen_from_seed(const unsigned char *seed, size_t seed_len,
|
|
unsigned char *priv_out, unsigned char *pub_out);
|
|
|
|
/* SLH-DSA-128s: sign a message. priv is 64-byte private key.
|
|
* sig_out must be at least 7856 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_slh_dsa_128s_sign(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
unsigned char *sig_out, size_t *sig_out_len);
|
|
|
|
/* SLH-DSA-128s: verify a signature. pub is 32-byte public key.
|
|
* Returns 0 on valid, 1 on invalid, -1 on error. */
|
|
int crypto_slh_dsa_128s_verify(const unsigned char *pub, size_t pub_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
const unsigned char *sig, size_t sig_len);
|
|
|
|
/* ML-KEM-768: generate keypair from a 32-byte seed (deterministic).
|
|
* priv_out must be at least 2400 bytes, pub_out at least 1184 bytes.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_ml_kem_768_keygen_from_seed(const unsigned char *seed, size_t seed_len,
|
|
unsigned char *priv_out, unsigned char *pub_out);
|
|
|
|
/* ML-KEM-768: encapsulate. pub is 1184-byte public key.
|
|
* ct_out must be at least 1088 bytes, ss_out at least 32 bytes.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_ml_kem_768_encaps(const unsigned char *pub, size_t pub_len,
|
|
unsigned char *ct_out, unsigned char *ss_out);
|
|
|
|
/* ML-KEM-768: decapsulate. priv is 2400-byte secret key, ct is 1088-byte ciphertext.
|
|
* ss_out must be at least 32 bytes. Returns 0 on success, -1 on error. */
|
|
int crypto_ml_kem_768_decaps(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *ct, size_t ct_len,
|
|
unsigned char *ss_out);
|
|
/* Deterministic PRNG for PQ keygen (replaces PQClean randombytes()). */
|
|
void pq_drbg_init(const unsigned char *seed, size_t seed_len);
|
|
int pq_drbg_randombytes(unsigned char *buf, size_t len);
|
|
void pq_drbg_zeroize(void);
|
|
|
|
|
|
|
|
/* from crypto.h */
|
|
|
|
|
|
/* Per-role derived key material (stored in secure memory) */
|
|
typedef struct {
|
|
secure_buf_t private_key; /* mlock'd, variable size per algorithm */
|
|
secure_buf_t public_key; /* mlock'd, variable size per algorithm */
|
|
char pubkey_hex[8192]; /* hex-encoded public key (PQ pubkeys are large) */
|
|
char npub[128]; /* bech32 npub (secp256k1 only, empty for others) */
|
|
crypto_alg_t alg; /* which algorithm this key was derived for */
|
|
int valid;
|
|
} derived_key_t;
|
|
|
|
typedef struct {
|
|
derived_key_t keys[ROLE_TABLE_MAX_ENTRIES];
|
|
int count;
|
|
} key_store_t;
|
|
|
|
int crypto_derive_all(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic);
|
|
int crypto_derive_one(key_store_t *store, role_table_t *table, const mnemonic_state_t *mnemonic, int role_index);
|
|
const unsigned char *crypto_get_private_key(const key_store_t *store, int role_index);
|
|
const char *crypto_get_pubkey_hex(const key_store_t *store, int role_index);
|
|
char *crypto_sign_event(const key_store_t *store, int role_index, const char *event_json);
|
|
void crypto_wipe(key_store_t *store);
|
|
|
|
|
|
|
|
/* from alg_api.h */
|
|
|
|
|
|
/* Check whether a verb is valid for an algorithm (algorithm-based enforcement).
|
|
* Returns ENFORCE_OK, ENFORCE_ERR_ALGORITHM, or ENFORCE_ERR_UNKNOWN_VERB.
|
|
* Does NOT check purpose — purpose is irrelevant for the new verbs. */
|
|
int enforce_verb_algorithm(const char *verb, crypto_alg_t alg);
|
|
|
|
/* secp256k1 Schnorr (BIP-340) sign arbitrary bytes.
|
|
* priv is 32-byte scalar, pub is 32-byte x-only pubkey, sig_out is 64 bytes.
|
|
* Hashes the message with SHA-256 before signing (like Nostr event signing).
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_secp256k1_schnorr_sign(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
unsigned char *sig_out, size_t *sig_out_len);
|
|
|
|
/* secp256k1 Schnorr (BIP-340) verify.
|
|
* pub is 32-byte x-only pubkey, sig is 64 bytes.
|
|
* Returns 0 on valid, 1 on invalid, -1 on error. */
|
|
int crypto_secp256k1_schnorr_verify(const unsigned char *pub, size_t pub_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
const unsigned char *sig, size_t sig_len);
|
|
|
|
/* secp256k1 ECDSA sign arbitrary bytes.
|
|
* priv is 32-byte scalar, sig_out must be at least 64 bytes (compact DER r||s).
|
|
* Hashes the message with SHA-256 before signing.
|
|
* Returns 0 on success, -1 on error. */
|
|
int crypto_secp256k1_ecdsa_sign(const unsigned char *priv, size_t priv_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
unsigned char *sig_out, size_t *sig_out_len);
|
|
|
|
/* secp256k1 ECDSA verify.
|
|
* pub is 32-byte x-only pubkey (converted internally to compressed form).
|
|
* sig is 64-byte compact (r||s). Returns 0 on valid, 1 on invalid, -1 on error. */
|
|
int crypto_secp256k1_ecdsa_verify(const unsigned char *pub, size_t pub_len,
|
|
const unsigned char *msg, size_t msg_len,
|
|
const unsigned char *sig, size_t sig_len);
|
|
|
|
/* ---- Algorithm key cache ----
|
|
* On-demand key derivation by algorithm+index, separate from the role-based
|
|
* key_store. Holds up to ALG_KEY_CACHE_MAX derived keys in secure memory.
|
|
* When full, the oldest entry is evicted (FIFO). */
|
|
|
|
#define ALG_KEY_CACHE_MAX 32
|
|
|
|
typedef struct {
|
|
crypto_alg_t alg;
|
|
int index;
|
|
secure_buf_t private_key;
|
|
secure_buf_t public_key;
|
|
char pubkey_hex[8192];
|
|
char key_id[17];
|
|
int valid;
|
|
} alg_key_entry_t;
|
|
|
|
typedef struct {
|
|
alg_key_entry_t entries[ALG_KEY_CACHE_MAX];
|
|
int count;
|
|
} algorithm_key_cache_t;
|
|
|
|
/* Initialize an empty cache. */
|
|
void alg_key_cache_init(algorithm_key_cache_t *cache);
|
|
|
|
/* Zeroize and free all entries. Idempotent. */
|
|
void alg_key_cache_wipe(algorithm_key_cache_t *cache);
|
|
|
|
/* Look up a cached entry by (alg, index). Returns NULL if not present. */
|
|
const alg_key_entry_t *alg_key_cache_get(algorithm_key_cache_t *cache, crypto_alg_t alg, int index);
|
|
|
|
/* Derive a key on-demand by (alg, index) and store it in the cache.
|
|
* Uses the standard derivation path for the algorithm.
|
|
* Returns 0 on success, -1 on error. */
|
|
int alg_key_cache_derive(algorithm_key_cache_t *cache, const mnemonic_state_t *mnemonic, crypto_alg_t alg, int index);
|
|
|
|
|
|
/* from dispatcher.h */
|
|
|
|
|
|
typedef struct {
|
|
role_table_t *role_table;
|
|
mnemonic_state_t *mnemonic;
|
|
key_store_t *key_store;
|
|
} dispatcher_ctx_t;
|
|
|
|
void dispatcher_init(dispatcher_ctx_t *ctx, role_table_t *table, mnemonic_state_t *mnemonic, key_store_t *key_store, algorithm_key_cache_t *alg_key_cache);
|
|
char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request);
|
|
|
|
|
|
/* NSIGNER_HEADERLESS_DECLS_END */
|
|
|
|
static algorithm_key_cache_t g_alg_key_cache;
|
|
|
|
#include <nostr_core/nostr_common.h>
|
|
#include <nostr_core/utils.h>
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
|
|
static int g_passes = 0;
|
|
static int g_total = 0;
|
|
|
|
static void check_condition(const char *name, int condition) {
|
|
g_total++;
|
|
if (condition) {
|
|
printf("PASS: %s\n", name);
|
|
g_passes++;
|
|
} else {
|
|
printf("FAIL: %s\n", name);
|
|
}
|
|
}
|
|
|
|
static int response_has(const char *response, const char *needle) {
|
|
return (response != NULL && needle != NULL && strstr(response, needle) != NULL);
|
|
}
|
|
|
|
static role_entry_t make_ssh_ed25519_entry(const char *name, int idx) {
|
|
role_entry_t e;
|
|
memset(&e, 0, sizeof(e));
|
|
strncpy(e.name, name, sizeof(e.name) - 1);
|
|
strncpy(e.purpose_str, "ssh", sizeof(e.purpose_str) - 1);
|
|
strncpy(e.curve_str, "ed25519", sizeof(e.curve_str) - 1);
|
|
e.purpose = role_purpose_from_str(e.purpose_str);
|
|
e.curve = role_curve_from_str(e.curve_str);
|
|
e.selector_type = SELECTOR_NOSTR_INDEX;
|
|
e.nostr_index = idx;
|
|
e.derived = 0;
|
|
return e;
|
|
}
|
|
|
|
static role_entry_t make_nostr_secp_entry(const char *name, int idx) {
|
|
role_entry_t e;
|
|
memset(&e, 0, sizeof(e));
|
|
strncpy(e.name, name, sizeof(e.name) - 1);
|
|
strncpy(e.purpose_str, "nostr", sizeof(e.purpose_str) - 1);
|
|
strncpy(e.curve_str, "secp256k1", sizeof(e.curve_str) - 1);
|
|
e.purpose = role_purpose_from_str(e.purpose_str);
|
|
e.curve = role_curve_from_str(e.curve_str);
|
|
e.selector_type = SELECTOR_NOSTR_INDEX;
|
|
e.nostr_index = idx;
|
|
e.derived = 0;
|
|
return e;
|
|
}
|
|
|
|
static role_entry_t make_pq_kem_entry(const char *name, int idx) {
|
|
role_entry_t e;
|
|
memset(&e, 0, sizeof(e));
|
|
strncpy(e.name, name, sizeof(e.name) - 1);
|
|
strncpy(e.purpose_str, "pq-kem", sizeof(e.purpose_str) - 1);
|
|
strncpy(e.curve_str, "ml-kem-768", sizeof(e.curve_str) - 1);
|
|
e.purpose = role_purpose_from_str(e.purpose_str);
|
|
e.curve = role_curve_from_str(e.curve_str);
|
|
e.selector_type = SELECTOR_NOSTR_INDEX;
|
|
e.nostr_index = idx;
|
|
e.derived = 0;
|
|
return e;
|
|
}
|
|
|
|
int main(void) {
|
|
/* Test mnemonic (BIP-39 standard test vector). */
|
|
const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
|
|
unsigned char seed[32];
|
|
unsigned char priv1[32], pub1[32];
|
|
unsigned char priv2[32], pub2[32];
|
|
unsigned char sig[64];
|
|
size_t sig_len;
|
|
size_t shared_len;
|
|
int rc;
|
|
|
|
/* ---- ed25519 keygen from seed ---- */
|
|
memset(seed, 0x42, 32);
|
|
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv1, pub1);
|
|
check_condition("ed25519 keygen from seed succeeds", rc == 0);
|
|
|
|
/* Determinism: same seed -> same keypair */
|
|
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
|
|
check_condition("ed25519 keygen determinism (same seed -> same key)", rc == 0 &&
|
|
memcmp(priv1, priv2, 32) == 0 && memcmp(pub1, pub2, 32) == 0);
|
|
|
|
/* Different seed -> different keypair */
|
|
memset(seed, 0x99, 32);
|
|
rc = crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
|
|
check_condition("ed25519 keygen different seed -> different key", rc == 0 &&
|
|
memcmp(priv1, priv2, 32) != 0);
|
|
|
|
/* ---- ed25519 sign/verify roundtrip ---- */
|
|
memset(seed, 0x42, 32);
|
|
crypto_ed25519_keygen_from_seed(seed, 32, priv1, pub1);
|
|
{
|
|
const char *msg = "hello world";
|
|
sig_len = sizeof(sig);
|
|
rc = crypto_ed25519_sign(priv1, 32, (const unsigned char *)msg, strlen(msg), sig, &sig_len);
|
|
check_condition("ed25519 sign succeeds", rc == 0 && sig_len == 64);
|
|
|
|
rc = crypto_ed25519_verify(pub1, 32, (const unsigned char *)msg, strlen(msg), sig, sig_len);
|
|
check_condition("ed25519 verify valid signature", rc == 0);
|
|
|
|
/* Wrong message should fail */
|
|
const char *wrong_msg = "hello worle";
|
|
rc = crypto_ed25519_verify(pub1, 32, (const unsigned char *)wrong_msg, strlen(wrong_msg), sig, sig_len);
|
|
check_condition("ed25519 verify wrong message -> invalid", rc == 1);
|
|
|
|
/* Wrong key should fail */
|
|
memset(seed, 0xAB, 32);
|
|
crypto_ed25519_keygen_from_seed(seed, 32, priv2, pub2);
|
|
rc = crypto_ed25519_verify(pub2, 32, (const unsigned char *)msg, strlen(msg), sig, sig_len);
|
|
check_condition("ed25519 verify wrong key -> invalid", rc == 1);
|
|
}
|
|
|
|
/* ---- x25519 keygen from seed ---- */
|
|
memset(seed, 0x33, 32);
|
|
rc = crypto_x25519_keygen_from_seed(seed, 32, priv1, pub1);
|
|
check_condition("x25519 keygen from seed succeeds", rc == 0);
|
|
|
|
memset(seed, 0x33, 32);
|
|
rc = crypto_x25519_keygen_from_seed(seed, 32, priv2, pub2);
|
|
check_condition("x25519 keygen determinism (same seed -> same key)", rc == 0 &&
|
|
memcmp(priv1, priv2, 32) == 0 && memcmp(pub1, pub2, 32) == 0);
|
|
|
|
/* ---- x25519 ECDH roundtrip ---- */
|
|
{
|
|
unsigned char alice_priv[32], alice_pub[32];
|
|
unsigned char bob_priv[32], bob_pub[32];
|
|
unsigned char alice_shared[32], bob_shared[32];
|
|
|
|
memset(seed, 0xAA, 32);
|
|
crypto_x25519_keygen_from_seed(seed, 32, alice_priv, alice_pub);
|
|
memset(seed, 0xBB, 32);
|
|
crypto_x25519_keygen_from_seed(seed, 32, bob_priv, bob_pub);
|
|
|
|
shared_len = 32;
|
|
rc = crypto_x25519_ecdh(alice_priv, 32, bob_pub, 32, alice_shared, &shared_len);
|
|
check_condition("x25519 ECDH alice side succeeds", rc == 0 && shared_len == 32);
|
|
|
|
shared_len = 32;
|
|
rc = crypto_x25519_ecdh(bob_priv, 32, alice_pub, 32, bob_shared, &shared_len);
|
|
check_condition("x25519 ECDH bob side succeeds", rc == 0 && shared_len == 32);
|
|
|
|
check_condition("x25519 ECDH shared secrets match",
|
|
memcmp(alice_shared, bob_shared, 32) == 0);
|
|
}
|
|
|
|
/* ---- SLIP-0010 derivation from mnemonic ---- */
|
|
{
|
|
unsigned char seed_a[32], seed_b[32];
|
|
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0'/0'", seed_a, 32);
|
|
check_condition("SLIP-0010 derive seed succeeds", rc == 0);
|
|
|
|
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0'/0'", seed_b, 32);
|
|
check_condition("SLIP-0010 derive seed determinism", rc == 0 &&
|
|
memcmp(seed_a, seed_b, 32) == 0);
|
|
|
|
/* Different path -> different seed */
|
|
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/1'/0'/0'", seed_b, 32);
|
|
check_condition("SLIP-0010 different path -> different seed", rc == 0 &&
|
|
memcmp(seed_a, seed_b, 32) != 0);
|
|
|
|
/* Non-hardened path should fail (SLIP-0010 requirement) */
|
|
rc = crypto_derive_seed_from_mnemonic(mnemonic, "m/44'/102001'/0'/0/0", seed_b, 32);
|
|
check_condition("SLIP-0010 non-hardened path rejected", rc == -1);
|
|
}
|
|
|
|
/* ---- Integration: derive ed25519 key via crypto_derive_one ---- */
|
|
{
|
|
role_table_t table;
|
|
role_entry_t ssh_role;
|
|
mnemonic_state_t mnemonic_state;
|
|
key_store_t key_store;
|
|
int derived;
|
|
|
|
role_table_init(&table);
|
|
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
|
|
role_table_add(&table, &ssh_role);
|
|
|
|
mnemonic_init(&mnemonic_state);
|
|
mnemonic_load(&mnemonic_state, mnemonic);
|
|
|
|
memset(&key_store, 0, sizeof(key_store));
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
derived = crypto_derive_all(&key_store, &table, &mnemonic_state);
|
|
check_condition("crypto_derive_all derives ed25519 key", derived == 1);
|
|
|
|
{
|
|
const char *pub_hex = crypto_get_pubkey_hex(&key_store, 0);
|
|
check_condition("ed25519 derived pubkey hex is 64 chars",
|
|
pub_hex != NULL && strlen(pub_hex) == 64);
|
|
}
|
|
|
|
{
|
|
const unsigned char *priv = crypto_get_private_key(&key_store, 0);
|
|
check_condition("ed25519 derived private key not NULL", priv != NULL);
|
|
}
|
|
|
|
crypto_wipe(&key_store);
|
|
mnemonic_unload(&mnemonic_state);
|
|
}
|
|
|
|
/* ---- Integration: sign via dispatcher ---- */
|
|
{
|
|
role_table_t table;
|
|
role_entry_t ssh_role;
|
|
mnemonic_state_t mnemonic_state;
|
|
key_store_t key_store;
|
|
dispatcher_ctx_t dispatcher;
|
|
char *resp;
|
|
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" in hex */
|
|
char request[512];
|
|
|
|
role_table_init(&table);
|
|
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
|
|
role_table_add(&table, &ssh_role);
|
|
|
|
mnemonic_init(&mnemonic_state);
|
|
mnemonic_load(&mnemonic_state, mnemonic);
|
|
|
|
memset(&key_store, 0, sizeof(key_store));
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
crypto_derive_all(&key_store, &table, &mnemonic_state);
|
|
|
|
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
|
|
|
|
/* sign request */
|
|
snprintf(request, sizeof(request),
|
|
"{\"id\":\"test1\",\"method\":\"sign\",\"params\":[\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
|
|
msg_hex);
|
|
resp = dispatcher_handle_request(&dispatcher, request);
|
|
check_condition("sign via dispatcher returns result",
|
|
resp != NULL && response_has(resp, "\"result\""));
|
|
check_condition("sign result contains signature",
|
|
resp != NULL && response_has(resp, "signature"));
|
|
check_condition("sign result contains algorithm ed25519",
|
|
resp != NULL && response_has(resp, "ed25519"));
|
|
free(resp);
|
|
|
|
/* sign request */
|
|
snprintf(request, sizeof(request),
|
|
"{\"id\":\"test2\",\"method\":\"sign\",\"params\":[\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
|
|
msg_hex);
|
|
resp = dispatcher_handle_request(&dispatcher, request);
|
|
check_condition("sign via dispatcher returns result",
|
|
resp != NULL && response_has(resp, "\"result\""));
|
|
check_condition("sign result contains signature",
|
|
resp != NULL && response_has(resp, "signature"));
|
|
free(resp);
|
|
|
|
crypto_wipe(&key_store);
|
|
mnemonic_unload(&mnemonic_state);
|
|
}
|
|
|
|
/* ---- Enforcement: sign on ssh+ed25519 ---- */
|
|
{
|
|
role_entry_t ssh_ed = make_ssh_ed25519_entry("ssh", 0);
|
|
role_entry_t nostr_secp = make_nostr_secp_entry("nostr", 0);
|
|
role_entry_t pq_kem = make_pq_kem_entry("kem", 0);
|
|
|
|
/* sign/verify are algorithm-based now: checked via enforce_verb_algorithm(). */
|
|
check_condition("enforce sign + ed25519 -> OK",
|
|
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_ED25519) == ENFORCE_OK);
|
|
|
|
check_condition("enforce sign + secp256k1 -> OK",
|
|
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_SECP256K1) == ENFORCE_OK);
|
|
|
|
check_condition("enforce verify + ed25519 -> OK",
|
|
enforce_verb_algorithm(VERB_VERIFY, CRYPTO_ALG_ED25519) == ENFORCE_OK);
|
|
|
|
check_condition("enforce sign + ml-kem-768 -> ALGORITHM err",
|
|
enforce_verb_algorithm(VERB_SIGN, CRYPTO_ALG_ML_KEM_768) == ENFORCE_ERR_ALGORITHM);
|
|
|
|
check_condition("enforce nostr_sign_event + ssh/ed25519 -> PURPOSE err",
|
|
enforce_verb_role(VERB_NOSTR_SIGN_EVENT, &ssh_ed) == ENFORCE_ERR_PURPOSE);
|
|
|
|
check_condition("enforce encapsulate + ml-kem-768 -> OK",
|
|
enforce_verb_algorithm(VERB_ENCAPSULATE, CRYPTO_ALG_ML_KEM_768) == ENFORCE_OK);
|
|
|
|
check_condition("enforce decapsulate + ml-kem-768 -> OK",
|
|
enforce_verb_algorithm(VERB_DECAPSULATE, CRYPTO_ALG_ML_KEM_768) == ENFORCE_OK);
|
|
|
|
check_condition("enforce encapsulate + ed25519 -> ALGORITHM err",
|
|
enforce_verb_algorithm(VERB_ENCAPSULATE, CRYPTO_ALG_ED25519) == ENFORCE_ERR_ALGORITHM);
|
|
}
|
|
|
|
/* ---- Dispatcher: encapsulate with invalid pubkey length ---- */
|
|
{
|
|
role_table_t table;
|
|
role_entry_t kem_role;
|
|
mnemonic_state_t mnemonic_state;
|
|
key_store_t key_store;
|
|
dispatcher_ctx_t dispatcher;
|
|
char *resp;
|
|
const char *request = "{\"id\":\"k1\",\"method\":\"encapsulate\",\"params\":[\"00\",{\"algorithm\":\"ml-kem-768\",\"index\":0}]}";
|
|
|
|
role_table_init(&table);
|
|
kem_role = make_pq_kem_entry("kem_main", 0);
|
|
role_table_add(&table, &kem_role);
|
|
|
|
mnemonic_init(&mnemonic_state);
|
|
mnemonic_load(&mnemonic_state, mnemonic);
|
|
|
|
memset(&key_store, 0, sizeof(key_store));
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
|
|
|
|
/* encapsulate is now implemented (Phase 5). With a too-short
|
|
* pubkey hex ("00" = 1 byte, but ML-KEM-768 needs 1184 bytes),
|
|
* the dispatcher should return an invalid_pubkey_length error. */
|
|
resp = dispatcher_handle_request(&dispatcher, request);
|
|
check_condition("encapsulate with short pubkey returns error",
|
|
resp != NULL && response_has(resp, "\"error\""));
|
|
free(resp);
|
|
|
|
crypto_wipe(&key_store);
|
|
mnemonic_unload(&mnemonic_state);
|
|
}
|
|
|
|
/* ---- Dispatcher: verify roundtrip ---- */
|
|
{
|
|
role_table_t table;
|
|
role_entry_t ssh_role;
|
|
mnemonic_state_t mnemonic_state;
|
|
key_store_t key_store;
|
|
dispatcher_ctx_t dispatcher;
|
|
char *sign_resp, *verify_resp;
|
|
const char *msg_hex = "68656c6c6f20776f726c64"; /* "hello world" */
|
|
char sign_req[512];
|
|
char verify_req[1024];
|
|
cJSON *sign_json, *result_item, *sig_item;
|
|
const char *sig_str = NULL;
|
|
|
|
role_table_init(&table);
|
|
ssh_role = make_ssh_ed25519_entry("ssh_main", 0);
|
|
role_table_add(&table, &ssh_role);
|
|
|
|
mnemonic_init(&mnemonic_state);
|
|
mnemonic_load(&mnemonic_state, mnemonic);
|
|
|
|
memset(&key_store, 0, sizeof(key_store));
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
alg_key_cache_init(&g_alg_key_cache);
|
|
crypto_derive_all(&key_store, &table, &mnemonic_state);
|
|
dispatcher_init(&dispatcher, &table, &mnemonic_state, &key_store, &g_alg_key_cache);
|
|
|
|
/* Sign */
|
|
snprintf(sign_req, sizeof(sign_req),
|
|
"{\"id\":\"s1\",\"method\":\"sign\",\"params\":[\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
|
|
msg_hex);
|
|
sign_resp = dispatcher_handle_request(&dispatcher, sign_req);
|
|
check_condition("verify roundtrip: sign succeeds", sign_resp != NULL);
|
|
|
|
/* Extract signature from result */
|
|
if (sign_resp != NULL) {
|
|
sign_json = cJSON_Parse(sign_resp);
|
|
if (sign_json != NULL) {
|
|
result_item = cJSON_GetObjectItemCaseSensitive(sign_json, "result");
|
|
if (cJSON_IsString(result_item)) {
|
|
cJSON *result_obj = cJSON_Parse(result_item->valuestring);
|
|
if (result_obj != NULL) {
|
|
sig_item = cJSON_GetObjectItemCaseSensitive(result_obj, "signature");
|
|
if (cJSON_IsString(sig_item)) {
|
|
sig_str = strdup(sig_item->valuestring);
|
|
}
|
|
cJSON_Delete(result_obj);
|
|
}
|
|
}
|
|
cJSON_Delete(sign_json);
|
|
}
|
|
}
|
|
check_condition("verify roundtrip: extracted signature hex", sig_str != NULL);
|
|
|
|
/* Verify */
|
|
if (sig_str != NULL) {
|
|
snprintf(verify_req, sizeof(verify_req),
|
|
"{\"id\":\"v1\",\"method\":\"verify\",\"params\":[\"%s\",\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
|
|
msg_hex, sig_str);
|
|
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
|
|
check_condition("verify returns valid:true",
|
|
verify_resp != NULL && response_has(verify_resp, "valid") &&
|
|
response_has(verify_resp, "true"));
|
|
free(verify_resp);
|
|
|
|
/* Verify with wrong message */
|
|
snprintf(verify_req, sizeof(verify_req),
|
|
"{\"id\":\"v2\",\"method\":\"verify\",\"params\":[\"00ff\",\"%s\",{\"algorithm\":\"ed25519\",\"index\":0}]}",
|
|
sig_str);
|
|
verify_resp = dispatcher_handle_request(&dispatcher, verify_req);
|
|
check_condition("verify wrong msg returns valid:false",
|
|
verify_resp != NULL && response_has(verify_resp, "valid") &&
|
|
response_has(verify_resp, "false"));
|
|
free(verify_resp);
|
|
|
|
free((void *)sig_str);
|
|
} else {
|
|
check_condition("verify returns valid:true", 0);
|
|
check_condition("verify wrong msg returns valid:false", 0);
|
|
}
|
|
|
|
free(sign_resp);
|
|
crypto_wipe(&key_store);
|
|
mnemonic_unload(&mnemonic_state);
|
|
}
|
|
|
|
printf("%d/%d tests passed\n", g_passes, g_total);
|
|
return (g_passes == g_total) ? 0 : 1;
|
|
}
|