identity.rs 87.6%

226 of 258 lines run, 83 of 122 functions · run #36 on main · run missed

//! Spectra's identities and composite signatures (spec §8.0).
//!
//! An identity is a composite key pair, Ed25519 and ML-DSA-65, with a name,
//! the identity it succeeds and the keys it delegates to. Both halves sign
//! the same target and both must verify, so a signature stays sound while
//! either algorithm does. The design follows the lessons of Oxygen's
//! identities; the code, encoding and files are Spectra's own.

use crate::cbor::{self, Value};
use ed25519_dalek::ed25519::signature::Signer as _;
use ed25519_dalek::{Signature as EdSignature, SigningKey as EdSigningKey, VerifyingKey as EdVerifyingKey};
use ml_dsa::{
    EncodedSignature, EncodedVerifyingKey, MlDsa65, Seed, Signature as MlSignature, SigningKey as MlSigningKey,
    VerifyingKey as MlVerifyingKey,
};
use rand::RngCore;

const VERSION: u64 = 1;

/// An identity's name: `BLAKE3("spectra1 identity " || encoding)`.
#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct KeyId(pub [u8; 32]);

impl KeyId {
    pub fn to_hex(&self) -> String {
        hex::encode(self.0)
    }
    pub fn from_hex(s: &str) -> Option<KeyId> {
        hex::decode(s.trim()).ok()?.try_into().ok().map(KeyId)
    }
    /// The first `n` hex digits, for display.
    pub fn short(&self, n: usize) -> String {
        let h = self.to_hex();
        h[..n.min(h.len())].to_string()
    }
}

impl std::fmt::Debug for KeyId {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "KeyId({})", self.short(12))
    }
}

impl std::fmt::Display for KeyId {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.to_hex())
    }
}

/// A key an identity lets act for it, until `expires` if set (ms).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Delegate {
    pub key: KeyId,
    pub expires: Option<u64>,
}

impl Delegate {
    pub fn allows(&self, at_ms: u64) -> bool {
        self.expires.is_none_or(|e| at_ms < e)
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Identity {
    pub ed25519_pk: [u8; 32],
    pub mldsa65_pk: Vec<u8>,
    pub name: String,
    pub contact: String,
    pub created: u64,
    pub expires: Option<u64>,
    pub previous: Option<KeyId>,
    pub delegates: Vec<Delegate>,
}

/// Why an identity, a secret or a signature could not be read or checked.
#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
pub enum Error {
    #[error(transparent)]
    Cbor(#[from] cbor::Error),
    #[error("{0}")]
    Shape(String),
    #[error("the signature is by another key")]
    KeyMismatch,
    #[error("a public key that does not decode")]
    BadKey,
    #[error("the Ed25519 half does not verify")]
    Ed25519,
    #[error("the ML-DSA-65 half does not verify")]
    MlDsa,
}

fn shape(s: &str) -> Error {
    Error::Shape(s.into())
}

fn bytes_of(v: Option<&Value>, what: &str) -> Result<Vec<u8>, Error> {
    v.and_then(Value::as_bytes).map(|b| b.to_vec()).ok_or_else(|| shape(what))
}

fn key_of(v: Option<&Value>, what: &str) -> Result<KeyId, Error> {
    bytes_of(v, what)?.try_into().map(KeyId).map_err(|_| shape(what))
}

fn opt_uint(v: Option<&Value>, what: &str) -> Result<Option<u64>, Error> {
    match v {
        None | Some(Value::Null) => Ok(None),
        Some(Value::Uint(u)) => Ok(Some(*u)),
        _ => Err(shape(what)),
    }
}

fn opt_val<T>(o: Option<T>, f: impl Fn(T) -> Value) -> Value {
    o.map(f).unwrap_or(Value::Null)
}

impl Identity {
    pub fn to_value(&self) -> Value {
        Value::map([
            (0, Value::Uint(VERSION)),
            (1, Value::Bytes(self.ed25519_pk.to_vec())),
            (2, Value::Bytes(self.mldsa65_pk.clone())),
            (3, Value::Text(self.name.clone())),
            (4, Value::Text(self.contact.clone())),
            (5, Value::Uint(self.created)),
            (6, opt_val(self.expires, Value::Uint)),
            (7, opt_val(self.previous, |k| Value::Bytes(k.0.to_vec()))),
            (
                8,
                Value::Array(
                    self.delegates
                        .iter()
                        .map(|d| Value::map([(0, Value::Bytes(d.key.0.to_vec())), (1, opt_val(d.expires, Value::Uint))]))
                        .collect(),
                ),
            ),
        ])
    }

    pub fn encode(&self) -> Vec<u8> {
        cbor::encode(&self.to_value())
    }

    pub fn hash(&self) -> KeyId {
        let mut h = blake3::Hasher::new();
        h.update(b"spectra1 identity ");
        h.update(&self.encode());
        KeyId(*h.finalize().as_bytes())
    }

    pub fn decode(b: &[u8]) -> Result<Identity, Error> {
        let v = cbor::decode(b)?;
        let m = v.as_map().ok_or_else(|| shape("an identity is a map"))?;
        if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {
            return Err(shape("an identity of an unknown version"));
        }
        let text = |k: u64, what: &str| m.get(&k).and_then(Value::as_text).map(String::from).ok_or_else(|| shape(what));
        let delegates = m
            .get(&8)
            .and_then(Value::as_array)
            .ok_or_else(|| shape("delegates"))?
            .iter()
            .map(|d| {
                let dm = d.as_map().ok_or_else(|| shape("a delegate is a map"))?;
                Ok(Delegate { key: key_of(dm.get(&0), "a delegate's key")?, expires: opt_uint(dm.get(&1), "a delegate's expiry")? })
            })
            .collect::<Result<Vec<_>, Error>>()?;
        let id = Identity {
            ed25519_pk: bytes_of(m.get(&1), "the Ed25519 key")?.try_into().map_err(|_| shape("the Ed25519 key"))?,
            mldsa65_pk: bytes_of(m.get(&2), "the ML-DSA-65 key")?,
            name: text(3, "the name")?,
            contact: text(4, "the contact")?,
            created: m.get(&5).and_then(Value::as_uint).ok_or_else(|| shape("the creation time"))?,
            expires: opt_uint(m.get(&6), "the expiry")?,
            previous: match m.get(&7) {
                None | Some(Value::Null) => None,
                v => Some(key_of(v, "the previous identity")?),
            },
            delegates,
        };
        // One identity, one encoding: what was read must be what we write.
        if id.encode() != b {
            return Err(shape("an identity not in Spectra's own encoding"));
        }
        Ok(id)
    }

    pub fn delegate(&self, key: &KeyId) -> Option<&Delegate> {
        self.delegates.iter().find(|d| &d.key == key)
    }

    /// Whether this identity lets `key` act for it at `at_ms`.
    pub fn delegates_to(&self, key: &KeyId, at_ms: u64) -> bool {
        !self.is_expired_at(at_ms) && self.delegate(key).is_some_and(|d| d.allows(at_ms))
    }

    pub fn is_expired_at(&self, at_ms: u64) -> bool {
        self.expires.is_some_and(|e| at_ms >= e)
    }

    /// The next identity: the same key pair with these delegates.
    pub fn successor(&self, delegates: Vec<Delegate>, expires: Option<u64>, created: u64) -> Identity {
        Identity { delegates, expires, created, previous: Some(self.hash()), ..self.clone() }
    }

    fn ed_key(&self) -> Result<EdVerifyingKey, Error> {
        EdVerifyingKey::from_bytes(&self.ed25519_pk).map_err(|_| Error::BadKey)
    }

    fn ml_key(&self) -> Result<MlVerifyingKey<MlDsa65>, Error> {
        let enc = EncodedVerifyingKey::<MlDsa65>::try_from(self.mldsa65_pk.as_slice()).map_err(|_| Error::BadKey)?;
        Ok(MlVerifyingKey::decode(&enc))
    }
}

/// What both halves sign: the signer's KeyId and the message, under
/// Spectra's prefix, so a signature means one thing by one key.
fn target(key: &KeyId, message: &[u8]) -> [u8; 32] {
    let mut h = blake3::Hasher::new();
    h.update(b"spectra1 sign ");
    h.update(&key.0);
    h.update(message);
    *h.finalize().as_bytes()
}

#[derive(Clone, PartialEq, Eq)]
pub struct Signature {
    pub key: KeyId,
    pub ed: [u8; 64],
    pub ml: Vec<u8>,
}

impl std::fmt::Debug for Signature {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "Signature({:?})", self.key)
    }
}

impl Signature {
    pub fn to_value(&self) -> Value {
        Value::map([(0, Value::Bytes(self.key.0.to_vec())), (1, Value::Bytes(self.ed.to_vec())), (2, Value::Bytes(self.ml.clone()))])
    }

    pub fn from_value(v: &Value) -> Result<Signature, Error> {
        let m = v.as_map().ok_or_else(|| shape("a signature is a map"))?;
        Ok(Signature {
            key: key_of(m.get(&0), "the signature's key")?,
            ed: bytes_of(m.get(&1), "the Ed25519 signature")?.try_into().map_err(|_| shape("the Ed25519 signature"))?,
            ml: bytes_of(m.get(&2), "the ML-DSA-65 signature")?,
        })
    }

    pub fn encode(&self) -> Vec<u8> {
        cbor::encode(&self.to_value())
    }

    pub fn decode(b: &[u8]) -> Result<Signature, Error> {
        Signature::from_value(&cbor::decode(b)?)
    }
}

/// Check a signature by `identity` over `message`.
pub fn verify(identity: &Identity, sig: &Signature, message: &[u8]) -> Result<(), Error> {
    let key = identity.hash();
    if sig.key != key {
        return Err(Error::KeyMismatch);
    }
    let t = target(&key, message);
    identity.ed_key()?.verify_strict(&t, &EdSignature::from_bytes(&sig.ed)).map_err(|_| Error::Ed25519)?;
    let enc = EncodedSignature::<MlDsa65>::try_from(sig.ml.as_slice()).map_err(|_| Error::MlDsa)?;
    let ml = MlSignature::<MlDsa65>::decode(&enc).ok_or(Error::MlDsa)?;
    if !identity.ml_key()?.verify_with_context(&t, b"", &ml) {
        return Err(Error::MlDsa);
    }
    Ok(())
}

/// The seeds of a key pair; stored only in its identity home, 0600.
#[derive(Clone)]
pub struct SecretKey {
    ed_seed: [u8; 32],
    ml_seed: [u8; 32],
}

impl std::fmt::Debug for SecretKey {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str("SecretKey(..)")
    }
}

impl SecretKey {
    pub fn generate() -> SecretKey {
        let (mut ed_seed, mut ml_seed) = ([0u8; 32], [0u8; 32]);
        rand::rngs::OsRng.fill_bytes(&mut ed_seed);
        rand::rngs::OsRng.fill_bytes(&mut ml_seed);
        SecretKey { ed_seed, ml_seed }
    }

    fn ed(&self) -> EdSigningKey {
        EdSigningKey::from_bytes(&self.ed_seed)
    }

    fn ml(&self) -> MlSigningKey<MlDsa65> {
        MlSigningKey::from_seed(&Seed::from(self.ml_seed))
    }

    /// The identity of this key pair, delegating to nobody.
    pub fn identity(&self, name: &str, contact: &str, created: u64) -> Identity {
        Identity {
            ed25519_pk: self.ed().verifying_key().to_bytes(),
            mldsa65_pk: self.ml().expanded_key().verifying_key().encode().as_slice().to_vec(),
            name: name.into(),
            contact: contact.into(),
            created,
            expires: None,
            previous: None,
            delegates: vec![],
        }
    }

    /// Sign `message` as the identity named `key` (this key pair's).
    pub fn sign(&self, key: &KeyId, message: &[u8]) -> Signature {
        let t = target(key, message);
        let ed = self.ed().sign(&t).to_bytes();
        let ml = self.ml().expanded_key().sign_deterministic(&t, b"").expect("an empty context is valid").encode().as_slice().to_vec();
        Signature { key: *key, ed, ml }
    }

    /// Whether this is the key pair of `identity`.
    pub fn matches(&self, identity: &Identity) -> bool {
        let mine = self.identity("", "", 0);
        mine.ed25519_pk == identity.ed25519_pk && mine.mldsa65_pk == identity.mldsa65_pk
    }

    pub fn encode(&self, key: &KeyId) -> Vec<u8> {
        cbor::encode(&Value::map([
            (0, Value::Uint(VERSION)),
            (1, Value::Bytes(key.0.to_vec())),
            (2, Value::Bytes(self.ed_seed.to_vec())),
            (3, Value::Bytes(self.ml_seed.to_vec())),
        ]))
    }

    pub fn decode(b: &[u8]) -> Result<(KeyId, SecretKey), Error> {
        let v = cbor::decode(b)?;
        let m = v.as_map().ok_or_else(|| shape("a secret key is a map"))?;
        if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {
            return Err(shape("a secret key of an unknown version"));
        }
        let seed = |k: u64| -> Result<[u8; 32], Error> { bytes_of(m.get(&k), "a seed")?.try_into().map_err(|_| shape("a seed")) };
        Ok((key_of(m.get(&1), "the secret's key")?, SecretKey { ed_seed: seed(2)?, ml_seed: seed(3)? }))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn a_signature_binds_the_key_and_the_message_and_needs_both_halves() {
        let sk = SecretKey::generate();
        let id = sk.identity("Andy", "a@example", 1);
        let key = id.hash();
        let sig = sk.sign(&key, b"spectra1 test hello");
        verify(&id, &sig, b"spectra1 test hello").unwrap();
        assert_eq!(verify(&id, &sig, b"spectra1 test other"), Err(Error::Ed25519));
        let other = SecretKey::generate().identity("B", "", 1);
        assert_eq!(verify(&other, &sig, b"spectra1 test hello"), Err(Error::KeyMismatch));
        let mut half = sig.clone();
        half.ml[0] ^= 1;
        assert!(verify(&id, &half, b"spectra1 test hello").is_err(), "a broken ML-DSA half fails");
        assert_eq!(Signature::decode(&sig.encode()).unwrap(), sig);
    }

    #[test]
    fn identities_round_trip_and_successors_chain() {
        let sk = SecretKey::generate();
        let id = sk.identity("Andy", "", 5);
        assert_eq!(Identity::decode(&id.encode()).unwrap(), id);
        let agent = SecretKey::generate().identity("claude", "", 5).hash();
        let next = id.successor(vec![Delegate { key: agent, expires: Some(100) }], None, 6);
        assert_eq!(next.previous, Some(id.hash()));
        assert_ne!(next.hash(), id.hash());
        assert!(next.delegates_to(&agent, 99));
        assert!(!next.delegates_to(&agent, 100), "expired");
        assert!(!id.delegates_to(&agent, 1));
        assert!(sk.matches(&next));
        let (k, back) = SecretKey::decode(&sk.encode(&next.hash())).unwrap();
        assert_eq!(k, next.hash());
        assert!(back.matches(&id));
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Spectra's identities and composite signatures (spec §8.0).
2		//!
3		//! An identity is a composite key pair, Ed25519 and ML-DSA-65, with a name,
4		//! the identity it succeeds and the keys it delegates to. Both halves sign
5		//! the same target and both must verify, so a signature stays sound while
6		//! either algorithm does. The design follows the lessons of Oxygen's
7		//! identities; the code, encoding and files are Spectra's own.
8
9		use crate::cbor::{self, Value};
10		use ed25519_dalek::ed25519::signature::Signer as _;
11		use ed25519_dalek::{Signature as EdSignature, SigningKey as EdSigningKey, VerifyingKey as EdVerifyingKey};
12		use ml_dsa::{
13		EncodedSignature, EncodedVerifyingKey, MlDsa65, Seed, Signature as MlSignature, SigningKey as MlSigningKey,
14		VerifyingKey as MlVerifyingKey,
15		};
16		use rand::RngCore;
17
18		const VERSION: u64 = 1;
19
20		/// An identity's name: `BLAKE3("spectra1 identity " \|\| encoding)`.
21		#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
22		pub struct KeyId(pub [u8; 32]);
23
24		impl KeyId {
25	2296×	pub fn to_hex(&self) -> String {
26	2296×	hex::encode(self.0)
27	2296×	}
28	381×	pub fn from_hex(s: &str) -> Option<KeyId> {
29	381×	hex::decode(s.trim()).ok()?.try_into().ok().map(KeyId)
30	381×	}
31		/// The first `n` hex digits, for display.
32	91×	pub fn short(&self, n: usize) -> String {
33	91×	let h = self.to_hex();
34	91×	h[..n.min(h.len())].to_string()
35	91×	}
36		}
37
38		impl std::fmt::Debug for KeyId {
39	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
40	0×	write!(f, "KeyId({})", self.short(12))
41	0×	}
42		}
43
44		impl std::fmt::Display for KeyId {
45	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
46	0×	f.write_str(&self.to_hex())
47	0×	}
48		}
49
50		/// A key an identity lets act for it, until `expires` if set (ms).
51		#[derive(Clone, Debug, PartialEq, Eq)]
52		pub struct Delegate {
53		pub key: KeyId,
54		pub expires: Option<u64>,
55		}
56
57		impl Delegate {
58	439×	pub fn allows(&self, at_ms: u64) -> bool {
59	439×	self.expires.is_none_or(\|e\| at_ms < e)
60	439×	}
61		}
62
63		#[derive(Clone, Debug, PartialEq, Eq)]
64		pub struct Identity {
65		pub ed25519_pk: [u8; 32],
66		pub mldsa65_pk: Vec<u8>,
67		pub name: String,
68		pub contact: String,
69		pub created: u64,
70		pub expires: Option<u64>,
71		pub previous: Option<KeyId>,
72		pub delegates: Vec<Delegate>,
73		}
74
75		/// Why an identity, a secret or a signature could not be read or checked.
76		#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
77		pub enum Error {
78		#[error(transparent)]
79		Cbor(#[from] cbor::Error),
80		#[error("{0}")]
81		Shape(String),
82		#[error("the signature is by another key")]
83		KeyMismatch,
84		#[error("a public key that does not decode")]
85		BadKey,
86		#[error("the Ed25519 half does not verify")]
87		Ed25519,
88		#[error("the ML-DSA-65 half does not verify")]
89		MlDsa,
90		}
91
92	0×	fn shape(s: &str) -> Error {
93	0×	Error::Shape(s.into())
94	0×	}
95
96	11346×	fn bytes_of(v: Option<&Value>, what: &str) -> Result<Vec<u8>, Error> {
97	11346×	v.and_then(Value::as_bytes).map(\|b\| b.to_vec()).ok_or_else(\|\| shape(what))
98	11346×	}
99
100	4062×	fn key_of(v: Option<&Value>, what: &str) -> Result<KeyId, Error> {
101	4062×	bytes_of(v, what)?.try_into().map(KeyId).map_err(\|_\| shape(what))
102	4062×	}
103
104	3119×	fn opt_uint(v: Option<&Value>, what: &str) -> Result<Option<u64>, Error> {
105	3119×	match v {
106	3094×	None \| Some(Value::Null) => Ok(None),
107	25×	Some(Value::Uint(u)) => Ok(Some(*u)),
108	0×	_ => Err(shape(what)),
109		}
110	3119×	}
111
112	29656×	fn opt_val<T>(o: Option<T>, f: impl Fn(T) -> Value) -> Value {
113	29656×	o.map(f).unwrap_or(Value::Null)
114	29656×	}
115
116		impl Identity {
117	9951×	pub fn to_value(&self) -> Value {
118	9951×	Value::map([
119	9951×	(0, Value::Uint(VERSION)),
120	9951×	(1, Value::Bytes(self.ed25519_pk.to_vec())),
121	9951×	(2, Value::Bytes(self.mldsa65_pk.clone())),
122	9951×	(3, Value::Text(self.name.clone())),
123	9951×	(4, Value::Text(self.contact.clone())),
124	9951×	(5, Value::Uint(self.created)),
125	9951×	(6, opt_val(self.expires, Value::Uint)),
126	9951×	(7, opt_val(self.previous, \|k\| Value::Bytes(k.0.to_vec()))),
127		(
128		8,
129		Value::Array(
130	9951×	self.delegates
131	9951×	.iter()
132	9951×	.map(\|d\| Value::map([(0, Value::Bytes(d.key.0.to_vec())), (1, opt_val(d.expires, Value::Uint))]))
133	9951×	.collect(),
134		),
135		),
136		])
137	9951×	}
138
139	9951×	pub fn encode(&self) -> Vec<u8> {
140	9951×	cbor::encode(&self.to_value())
141	9951×	}
142
143	7521×	pub fn hash(&self) -> KeyId {
144	7521×	let mut h = blake3::Hasher::new();
145	7521×	h.update(b"spectra1 identity ");
146	7521×	h.update(&self.encode());
147	7521×	KeyId(*h.finalize().as_bytes())
148	7521×	}
149
150	1762×	pub fn decode(b: &[u8]) -> Result<Identity, Error> {
151	1762×	let v = cbor::decode(b)?;
152	1762×	let m = v.as_map().ok_or_else(\|\| shape("an identity is a map"))?;
153	1762×	if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {
154	0×	return Err(shape("an identity of an unknown version"));
155	1762×	}
156	3524×	let text = \|k: u64, what: &str\| m.get(&k).and_then(Value::as_text).map(String::from).ok_or_else(\|\| shape(what));
157	1762×	let delegates = m
158	1762×	.get(&8)
159	1762×	.and_then(Value::as_array)
160	1762×	.ok_or_else(\|\| shape("delegates"))?
161	1762×	.iter()
162	1762×	.map(\|d\| {
163	1357×	let dm = d.as_map().ok_or_else(\|\| shape("a delegate is a map"))?;
164	1357×	Ok(Delegate { key: key_of(dm.get(&0), "a delegate's key")?, expires: opt_uint(dm.get(&1), "a delegate's expiry")? })
165	1357×	})
166	1762×	.collect::<Result<Vec<_>, Error>>()?;
167	1762×	let id = Identity {
168	1762×	ed25519_pk: bytes_of(m.get(&1), "the Ed25519 key")?.try_into().map_err(\|_\| shape("the Ed25519 key"))?,
169	1762×	mldsa65_pk: bytes_of(m.get(&2), "the ML-DSA-65 key")?,
170	1762×	name: text(3, "the name")?,
171	1762×	contact: text(4, "the contact")?,
172	1762×	created: m.get(&5).and_then(Value::as_uint).ok_or_else(\|\| shape("the creation time"))?,
173	1762×	expires: opt_uint(m.get(&6), "the expiry")?,
174	1762×	previous: match m.get(&7) {
175	937×	None \| Some(Value::Null) => None,
176	825×	v => Some(key_of(v, "the previous identity")?),
177		},
178	1762×	delegates,
179		};
180		// One identity, one encoding: what was read must be what we write.
181	1762×	if id.encode() != b {
182	0×	return Err(shape("an identity not in Spectra's own encoding"));
183	1762×	}
184	1762×	Ok(id)
185	1762×	}
186
187	538×	pub fn delegate(&self, key: &KeyId) -> Option<&Delegate> {
188	1117×	self.delegates.iter().find(\|d\| &d.key == key)
189	538×	}
190
191		/// Whether this identity lets `key` act for it at `at_ms`.
192	447×	pub fn delegates_to(&self, key: &KeyId, at_ms: u64) -> bool {
193	447×	!self.is_expired_at(at_ms) && self.delegate(key).is_some_and(\|d\| d.allows(at_ms))
194	447×	}
195
196	447×	pub fn is_expired_at(&self, at_ms: u64) -> bool {
197	447×	self.expires.is_some_and(\|e\| at_ms >= e)
198	447×	}
199
200		/// The next identity: the same key pair with these delegates.
201	79×	pub fn successor(&self, delegates: Vec<Delegate>, expires: Option<u64>, created: u64) -> Identity {
202	79×	Identity { delegates, expires, created, previous: Some(self.hash()), ..self.clone() }
203	79×	}
204
205	1419×	fn ed_key(&self) -> Result<EdVerifyingKey, Error> {
206	1419×	EdVerifyingKey::from_bytes(&self.ed25519_pk).map_err(\|_\| Error::BadKey)
207	1419×	}
208
209	1416×	fn ml_key(&self) -> Result<MlVerifyingKey<MlDsa65>, Error> {
210	1416×	let enc = EncodedVerifyingKey::<MlDsa65>::try_from(self.mldsa65_pk.as_slice()).map_err(\|_\| Error::BadKey)?;
211	1416×	Ok(MlVerifyingKey::decode(&enc))
212	1416×	}
213		}
214
215		/// What both halves sign: the signer's KeyId and the message, under
216		/// Spectra's prefix, so a signature means one thing by one key.
217	2010×	fn target(key: &KeyId, message: &[u8]) -> [u8; 32] {
218	2010×	let mut h = blake3::Hasher::new();
219	2010×	h.update(b"spectra1 sign ");
220	2010×	h.update(&key.0);
221	2010×	h.update(message);
222	2010×	*h.finalize().as_bytes()
223	2010×	}
224
225		#[derive(Clone, PartialEq, Eq)]
226		pub struct Signature {
227		pub key: KeyId,
228		pub ed: [u8; 64],
229		pub ml: Vec<u8>,
230		}
231
232		impl std::fmt::Debug for Signature {
233	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
234	0×	write!(f, "Signature({:?})", self.key)
235	0×	}
236		}
237
238		impl Signature {
239	734×	pub fn to_value(&self) -> Value {
240	734×	Value::map([(0, Value::Bytes(self.key.0.to_vec())), (1, Value::Bytes(self.ed.to_vec())), (2, Value::Bytes(self.ml.clone()))])
241	734×	}
242
243	1413×	pub fn from_value(v: &Value) -> Result<Signature, Error> {
244	1413×	let m = v.as_map().ok_or_else(\|\| shape("a signature is a map"))?;
245		Ok(Signature {
246	1413×	key: key_of(m.get(&0), "the signature's key")?,
247	1413×	ed: bytes_of(m.get(&1), "the Ed25519 signature")?.try_into().map_err(\|_\| shape("the Ed25519 signature"))?,
248	1413×	ml: bytes_of(m.get(&2), "the ML-DSA-65 signature")?,
249		})
250	1413×	}
251
252	1×	pub fn encode(&self) -> Vec<u8> {
253	1×	cbor::encode(&self.to_value())
254	1×	}
255
256	1×	pub fn decode(b: &[u8]) -> Result<Signature, Error> {
257	1×	Signature::from_value(&cbor::decode(b)?)
258	1×	}
259		}
260
261		/// Check a signature by `identity` over `message`.
262	1422×	pub fn verify(identity: &Identity, sig: &Signature, message: &[u8]) -> Result<(), Error> {
263	1422×	let key = identity.hash();
264	1422×	if sig.key != key {
265	3×	return Err(Error::KeyMismatch);
266	1419×	}
267	1419×	let t = target(&key, message);
268	1419×	identity.ed_key()?.verify_strict(&t, &EdSignature::from_bytes(&sig.ed)).map_err(\|_\| Error::Ed25519)?;
269	1416×	let enc = EncodedSignature::<MlDsa65>::try_from(sig.ml.as_slice()).map_err(\|_\| Error::MlDsa)?;
270	1416×	let ml = MlSignature::<MlDsa65>::decode(&enc).ok_or(Error::MlDsa)?;
271	1416×	if !identity.ml_key()?.verify_with_context(&t, b"", &ml) {
272	1×	return Err(Error::MlDsa);
273	1415×	}
274	1415×	Ok(())
275	1422×	}
276
277		/// The seeds of a key pair; stored only in its identity home, 0600.
278		#[derive(Clone)]
279		pub struct SecretKey {
280		ed_seed: [u8; 32],
281		ml_seed: [u8; 32],
282		}
283
284		impl std::fmt::Debug for SecretKey {
285	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
286	0×	f.write_str("SecretKey(..)")
287	0×	}
288		}
289
290		impl SecretKey {
291	154×	pub fn generate() -> SecretKey {
292	154×	let (mut ed_seed, mut ml_seed) = ([0u8; 32], [0u8; 32]);
293	154×	rand::rngs::OsRng.fill_bytes(&mut ed_seed);
294	154×	rand::rngs::OsRng.fill_bytes(&mut ml_seed);
295	154×	SecretKey { ed_seed, ml_seed }
296	154×	}
297
298	1213×	fn ed(&self) -> EdSigningKey {
299	1213×	EdSigningKey::from_bytes(&self.ed_seed)
300	1213×	}
301
302	1213×	fn ml(&self) -> MlSigningKey<MlDsa65> {
303	1213×	MlSigningKey::from_seed(&Seed::from(self.ml_seed))
304	1213×	}
305
306		/// The identity of this key pair, delegating to nobody.
307	622×	pub fn identity(&self, name: &str, contact: &str, created: u64) -> Identity {
308	622×	Identity {
309	622×	ed25519_pk: self.ed().verifying_key().to_bytes(),
310	622×	mldsa65_pk: self.ml().expanded_key().verifying_key().encode().as_slice().to_vec(),
311	622×	name: name.into(),
312	622×	contact: contact.into(),
313	622×	created,
314	622×	expires: None,
315	622×	previous: None,
316	622×	delegates: vec![],
317	622×	}
318	622×	}
319
320		/// Sign `message` as the identity named `key` (this key pair's).
321	591×	pub fn sign(&self, key: &KeyId, message: &[u8]) -> Signature {
322	591×	let t = target(key, message);
323	591×	let ed = self.ed().sign(&t).to_bytes();
324	591×	let ml = self.ml().expanded_key().sign_deterministic(&t, b"").expect("an empty context is valid").encode().as_slice().to_vec();
325	591×	Signature { key: *key, ed, ml }
326	591×	}
327
328		/// Whether this is the key pair of `identity`.
329	468×	pub fn matches(&self, identity: &Identity) -> bool {
330	468×	let mine = self.identity("", "", 0);
331	468×	mine.ed25519_pk == identity.ed25519_pk && mine.mldsa65_pk == identity.mldsa65_pk
332	468×	}
333
334	201×	pub fn encode(&self, key: &KeyId) -> Vec<u8> {
335	201×	cbor::encode(&Value::map([
336	201×	(0, Value::Uint(VERSION)),
337	201×	(1, Value::Bytes(key.0.to_vec())),
338	201×	(2, Value::Bytes(self.ed_seed.to_vec())),
339	201×	(3, Value::Bytes(self.ml_seed.to_vec())),
340	201×	]))
341	201×	}
342
343	467×	pub fn decode(b: &[u8]) -> Result<(KeyId, SecretKey), Error> {
344	467×	let v = cbor::decode(b)?;
345	467×	let m = v.as_map().ok_or_else(\|\| shape("a secret key is a map"))?;
346	467×	if m.get(&0).and_then(Value::as_uint) != Some(VERSION) {
347	0×	return Err(shape("a secret key of an unknown version"));
348	467×	}
349	934×	let seed = \|k: u64\| -> Result<[u8; 32], Error> { bytes_of(m.get(&k), "a seed")?.try_into().map_err(\|_\| shape("a seed")) };
350	467×	Ok((key_of(m.get(&1), "the secret's key")?, SecretKey { ed_seed: seed(2)?, ml_seed: seed(3)? }))
351	467×	}
352		}
353
354		#[cfg(test)]
355		mod tests {
356		use super::*;
357
358		#[test]
359	1×	fn a_signature_binds_the_key_and_the_message_and_needs_both_halves() {
360	1×	let sk = SecretKey::generate();
361	1×	let id = sk.identity("Andy", "a@example", 1);
362	1×	let key = id.hash();
363	1×	let sig = sk.sign(&key, b"spectra1 test hello");
364	1×	verify(&id, &sig, b"spectra1 test hello").unwrap();
365	1×	assert_eq!(verify(&id, &sig, b"spectra1 test other"), Err(Error::Ed25519));
366	1×	let other = SecretKey::generate().identity("B", "", 1);
367	1×	assert_eq!(verify(&other, &sig, b"spectra1 test hello"), Err(Error::KeyMismatch));
368	1×	let mut half = sig.clone();
369	1×	half.ml[0] ^= 1;
370	1×	assert!(verify(&id, &half, b"spectra1 test hello").is_err(), "a broken ML-DSA half fails");
371	1×	assert_eq!(Signature::decode(&sig.encode()).unwrap(), sig);
372	1×	}
373
374		#[test]
375	1×	fn identities_round_trip_and_successors_chain() {
376	1×	let sk = SecretKey::generate();
377	1×	let id = sk.identity("Andy", "", 5);
378	1×	assert_eq!(Identity::decode(&id.encode()).unwrap(), id);
379	1×	let agent = SecretKey::generate().identity("claude", "", 5).hash();
380	1×	let next = id.successor(vec![Delegate { key: agent, expires: Some(100) }], None, 6);
381	1×	assert_eq!(next.previous, Some(id.hash()));
382	1×	assert_ne!(next.hash(), id.hash());
383	1×	assert!(next.delegates_to(&agent, 99));
384	1×	assert!(!next.delegates_to(&agent, 100), "expired");
385	1×	assert!(!id.delegates_to(&agent, 1));
386	1×	assert!(sk.matches(&next));
387	1×	let (k, back) = SecretKey::decode(&sk.encode(&next.hash())).unwrap();
388	1×	assert_eq!(k, next.hash());
389	1×	assert!(back.matches(&id));
390	1×	}
391		}

Coverage / crates/spectra-core/src/identity.rs 87.6%

Keyboard