dsse.rs 100.0%

101 of 101 lines run, 20 of 20 functions · run #347 on proposal/125 · run missed

//! DSSE envelopes, the signature wrapper in-toto, SLSA and cosign read, and
//! the PEM public key cosign's `--key` takes: how Oxygen's attestations
//! reach tools outside it (spec §14.6, oxygenhub#239). Only the Ed25519 half
//! of a composite key signs here, since DSSE verifiers know Ed25519 and not
//! ML-DSA-65; DSSE's own pre-authentication encoding separates the domain
//! from Oxygen's signatures (which begin `oxy1 sig`).

use crate::identity::{Identity, SecretKey, VerifyError};

/// DSSE's payload type for in-toto statements.
pub const IN_TOTO: &str = "application/vnd.in-toto+json";

/// DSSE's pre-authentication encoding: what the signature covers.
pub fn pae(payload_type: &str, payload: &[u8]) -> Vec<u8> {
    let mut out = format!(
        "DSSEv1 {} {} {} ",
        payload_type.len(),
        payload_type,
        payload.len()
    )
    .into_bytes();
    out.extend_from_slice(payload);
    out
}

/// A DSSE envelope over `payload`, signed by `sk`, as JSON. `keyid` names
/// the key to a reader; DSSE gives it no meaning.
pub fn envelope(payload_type: &str, payload: &[u8], keyid: &str, sk: &SecretKey) -> String {
    let sig = sk.sign_ed25519(&pae(payload_type, payload));
    format!(
        "{{\"payloadType\":{},\"payload\":\"{}\",\"signatures\":[{{\"keyid\":{},\"sig\":\"{}\"}}]}}",
        crate::repo::json_str(payload_type),
        base64(payload),
        crate::repo::json_str(keyid),
        base64(&sig)
    )
}

/// Check one envelope signature, its parts already decoded.
pub fn verify(
    identity: &Identity,
    payload_type: &str,
    payload: &[u8],
    sig: &[u8],
) -> Result<(), VerifyError> {
    identity.verify_ed25519(&pae(payload_type, payload), sig)
}

/// The identity's Ed25519 public key as a PEM SubjectPublicKeyInfo.
pub fn public_pem(identity: &Identity) -> String {
    // SEQUENCE { SEQUENCE { OID 1.3.101.112 }, BIT STRING { key } }
    let mut der = vec![
        0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
    ];
    der.extend_from_slice(&identity.ed25519_pk);
    format!(
        "-----BEGIN PUBLIC KEY-----\n{}\n-----END PUBLIC KEY-----\n",
        base64(&der)
    )
}

const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

/// Standard base64 with padding, as DSSE and PEM use.
pub fn base64(bytes: &[u8]) -> String {
    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
    for chunk in bytes.chunks(3) {
        let n = chunk.iter().fold(0u32, |acc, b| (acc << 8) | *b as u32) << (8 * (3 - chunk.len()));
        for i in 0..4 {
            if i <= chunk.len() {
                out.push(ALPHABET[((n >> (18 - 6 * i)) & 63) as usize] as char);
            } else {
                out.push('=');
            }
        }
    }
    out
}

/// [`base64`] back to bytes; `None` for anything that is not.
pub fn base64_decode(text: &str) -> Option<Vec<u8>> {
    let text = text.trim_end_matches('=');
    let mut out = Vec::with_capacity(text.len() * 3 / 4);
    let (mut acc, mut bits) = (0u32, 0);
    for c in text.bytes() {
        let v = ALPHABET.iter().position(|a| *a == c)? as u32;
        acc = (acc << 6) | v;
        bits += 6;
        if bits >= 8 {
            bits -= 8;
            out.push((acc >> bits) as u8);
            acc &= (1 << bits) - 1;
        }
    }
    Some(out)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn pae_and_base64_are_the_specs() {
        // DSSE's own example: PAE("http://example.com/HelloWorld", "hello world").
        assert_eq!(
            pae("http://example.com/HelloWorld", b"hello world"),
            b"DSSEv1 29 http://example.com/HelloWorld 11 hello world".to_vec()
        );
        for (plain, coded) in [
            ("", ""),
            ("f", "Zg=="),
            ("fo", "Zm8="),
            ("foo", "Zm9v"),
            ("foobar", "Zm9vYmFy"),
        ] {
            assert_eq!(base64(plain.as_bytes()), coded);
            assert_eq!(base64_decode(coded).unwrap(), plain.as_bytes());
        }
        assert!(base64_decode("Zm9v!").is_none());
    }

    #[test]
    fn an_envelope_verifies_with_its_key_and_nothing_else() {
        let sk = SecretKey::generate();
        let id = sk.identity("Ada", "[email protected]", 1);
        let other = SecretKey::generate().identity("Eve", "[email protected]", 1);
        let payload = br#"{"_type":"https://in-toto.io/Statement/v1"}"#;
        let env = envelope(IN_TOTO, payload, "k", &sk);
        let sig_b64 = env
            .rsplit("\"sig\":\"")
            .next()
            .unwrap()
            .trim_end_matches("\"}]}");
        let sig = base64_decode(sig_b64).unwrap();
        assert!(env.contains(&format!("\"payload\":\"{}\"", base64(payload))));
        assert!(verify(&id, IN_TOTO, payload, &sig).is_ok());
        assert!(verify(&other, IN_TOTO, payload, &sig).is_err());
        assert!(verify(&id, IN_TOTO, b"{}", &sig).is_err());
        assert!(verify(&id, "text/plain", payload, &sig).is_err());
    }

    #[test]
    fn the_pem_holds_the_ed25519_key() {
        let id = SecretKey::generate().identity("Ada", "[email protected]", 1);
        let pem = public_pem(&id);
        let body: String = pem.lines().filter(|l| !l.starts_with("-----")).collect();
        let der = base64_decode(&body).unwrap();
        assert_eq!(der.len(), 44);
        assert_eq!(&der[12..], &id.ed25519_pk);
    }
}

1		//! DSSE envelopes, the signature wrapper in-toto, SLSA and cosign read, and
2		//! the PEM public key cosign's `--key` takes: how Oxygen's attestations
3		//! reach tools outside it (spec §14.6, oxygenhub#239). Only the Ed25519 half
4		//! of a composite key signs here, since DSSE verifiers know Ed25519 and not
5		//! ML-DSA-65; DSSE's own pre-authentication encoding separates the domain
6		//! from Oxygen's signatures (which begin `oxy1 sig`).
7
8		use crate::identity::{Identity, SecretKey, VerifyError};
9
10		/// DSSE's payload type for in-toto statements.
11		pub const IN_TOTO: &str = "application/vnd.in-toto+json";
12
13		/// DSSE's pre-authentication encoding: what the signature covers.
14	9×	pub fn pae(payload_type: &str, payload: &[u8]) -> Vec<u8> {
15	9×	let mut out = format!(
16		"DSSEv1 {} {} {} ",
17	9×	payload_type.len(),
18		payload_type,
19	9×	payload.len()
20		)
21	9×	.into_bytes();
22	9×	out.extend_from_slice(payload);
23	9×	out
24	9×	}
25
26		/// A DSSE envelope over `payload`, signed by `sk`, as JSON. `keyid` names
27		/// the key to a reader; DSSE gives it no meaning.
28	2×	pub fn envelope(payload_type: &str, payload: &[u8], keyid: &str, sk: &SecretKey) -> String {
29	2×	let sig = sk.sign_ed25519(&pae(payload_type, payload));
30	2×	format!(
31		"{{\"payloadType\":{},\"payload\":\"{}\",\"signatures\":[{{\"keyid\":{},\"sig\":\"{}\"}}]}}",
32	2×	crate::repo::json_str(payload_type),
33	2×	base64(payload),
34	2×	crate::repo::json_str(keyid),
35	2×	base64(&sig)
36		)
37	2×	}
38
39		/// Check one envelope signature, its parts already decoded.
40	6×	pub fn verify(
41	6×	identity: &Identity,
42	6×	payload_type: &str,
43	6×	payload: &[u8],
44	6×	sig: &[u8],
45	6×	) -> Result<(), VerifyError> {
46	6×	identity.verify_ed25519(&pae(payload_type, payload), sig)
47	6×	}
48
49		/// The identity's Ed25519 public key as a PEM SubjectPublicKeyInfo.
50	3×	pub fn public_pem(identity: &Identity) -> String {
51		// SEQUENCE { SEQUENCE { OID 1.3.101.112 }, BIT STRING { key } }
52	3×	let mut der = vec![
53		0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
54		];
55	3×	der.extend_from_slice(&identity.ed25519_pk);
56	3×	format!(
57		"-----BEGIN PUBLIC KEY-----\n{}\n-----END PUBLIC KEY-----\n",
58	3×	base64(&der)
59		)
60	3×	}
61
62		const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
63
64		/// Standard base64 with padding, as DSSE and PEM use.
65	76×	pub fn base64(bytes: &[u8]) -> String {
66	76×	let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
67	22784×	for chunk in bytes.chunks(3) {
68	68268×	let n = chunk.iter().fold(0u32, \|acc, b\| (acc << 8) \| b as u32) << (8 (3 - chunk.len()));
69	91136×	for i in 0..4 {
70	91136×	if i <= chunk.len() {
71	91052×	out.push(ALPHABET[((n >> (18 - 6 * i)) & 63) as usize] as char);
72	91052×	} else {
73	84×	out.push('=');
74	84×	}
75		}
76		}
77	76×	out
78	76×	}
79
80		/// [`base64`] back to bytes; `None` for anything that is not.
81	77×	pub fn base64_decode(text: &str) -> Option<Vec<u8>> {
82	77×	let text = text.trim_end_matches('=');
83	77×	let mut out = Vec::with_capacity(text.len() * 3 / 4);
84	77×	let (mut acc, mut bits) = (0u32, 0);
85	100109×	for c in text.bytes() {
86	3180104×	let v = ALPHABET.iter().position(\|a\| *a == c)? as u32;
87	100108×	acc = (acc << 6) \| v;
88	100108×	bits += 6;
89	100108×	if bits >= 8 {
90	75061×	bits -= 8;
91	75061×	out.push((acc >> bits) as u8);
92	75061×	acc &= (1 << bits) - 1;
93	75061×	}
94		}
95	76×	Some(out)
96	77×	}
97
98		#[cfg(test)]
99		mod tests {
100		use super::*;
101
102		#[test]
103	1×	fn pae_and_base64_are_the_specs() {
104		// DSSE's own example: PAE("http://example.com/HelloWorld", "hello world").
105	1×	assert_eq!(
106	1×	pae("http://example.com/HelloWorld", b"hello world"),
107	1×	b"DSSEv1 29 http://example.com/HelloWorld 11 hello world".to_vec()
108		);
109	5×	for (plain, coded) in [
110	1×	("", ""),
111	1×	("f", "Zg=="),
112	1×	("fo", "Zm8="),
113	1×	("foo", "Zm9v"),
114	1×	("foobar", "Zm9vYmFy"),
115	1×	] {
116	5×	assert_eq!(base64(plain.as_bytes()), coded);
117	5×	assert_eq!(base64_decode(coded).unwrap(), plain.as_bytes());
118		}
119	1×	assert!(base64_decode("Zm9v!").is_none());
120	1×	}
121
122		#[test]
123	1×	fn an_envelope_verifies_with_its_key_and_nothing_else() {
124	1×	let sk = SecretKey::generate();
125	1×	let id = sk.identity("Ada", "[email protected]", 1);
126	1×	let other = SecretKey::generate().identity("Eve", "[email protected]", 1);
127	1×	let payload = br#"{"_type":"https://in-toto.io/Statement/v1"}"#;
128	1×	let env = envelope(IN_TOTO, payload, "k", &sk);
129	1×	let sig_b64 = env
130	1×	.rsplit("\"sig\":\"")
131	1×	.next()
132	1×	.unwrap()
133	1×	.trim_end_matches("\"}]}");
134	1×	let sig = base64_decode(sig_b64).unwrap();
135	1×	assert!(env.contains(&format!("\"payload\":\"{}\"", base64(payload))));
136	1×	assert!(verify(&id, IN_TOTO, payload, &sig).is_ok());
137	1×	assert!(verify(&other, IN_TOTO, payload, &sig).is_err());
138	1×	assert!(verify(&id, IN_TOTO, b"{}", &sig).is_err());
139	1×	assert!(verify(&id, "text/plain", payload, &sig).is_err());
140	1×	}
141
142		#[test]
143	1×	fn the_pem_holds_the_ed25519_key() {
144	1×	let id = SecretKey::generate().identity("Ada", "[email protected]", 1);
145	1×	let pem = public_pem(&id);
146	3×	let body: String = pem.lines().filter(\|l\| !l.starts_with("-----")).collect();
147	1×	let der = base64_decode(&body).unwrap();
148	1×	assert_eq!(der.len(), 44);
149	1×	assert_eq!(&der[12..], &id.ed25519_pk);
150	1×	}
151		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/oxy-core/src/dsse.rs 100.0%

Keyboard