ant_protocol/payment/
verify.rs

1//! Pure verification helpers for payment quotes and merkle candidates.
2//!
3//! These functions inspect signed wire artifacts (`PaymentQuote` and
4//! `MerklePaymentCandidateNode`) and confirm their ML-DSA-65 signatures
5//! are valid. They do no I/O and do not touch on-chain state.
6//!
7//! Both the client (when building proofs) and the node (when validating
8//! incoming PUTs) need identical verification semantics — keeping these
9//! functions in `ant-protocol` ensures the client and node cannot drift.
10
11use crate::chunk::XorName;
12use crate::logging::debug;
13use evmlib::merkle_payments::MerklePaymentCandidateNode;
14use evmlib::PaymentQuote;
15use saorsa_core::MlDsa65;
16use saorsa_pqc::pqc::types::{MlDsaPublicKey, MlDsaSignature};
17use saorsa_pqc::pqc::MlDsaOperations;
18
19/// Verify that a payment quote's content address matches the expected address.
20///
21/// This is a pure field-equality check — the signature is verified
22/// separately via [`verify_quote_signature`].
23///
24/// # Arguments
25///
26/// * `quote` - The quote to check.
27/// * `expected_content` - The address the caller expected.
28///
29/// # Returns
30///
31/// `true` if `quote.content` equals `expected_content`.
32#[must_use]
33pub fn verify_quote_content(quote: &PaymentQuote, expected_content: &XorName) -> bool {
34    if quote.content.0 != *expected_content {
35        if crate::logging::enabled!(crate::logging::Level::DEBUG) {
36            debug!(
37                "Quote content mismatch: expected {}, got {}",
38                hex::encode(expected_content),
39                hex::encode(quote.content.0)
40            );
41        }
42        return false;
43    }
44    true
45}
46
47/// Verify a payment quote's ML-DSA-65 signature.
48///
49/// Autonomi uses ML-DSA-65 post-quantum signatures for quote signing
50/// (not the Ed25519/libp2p signatures that the upstream `ant-evm`
51/// library assumes). The `pub_key` field holds the raw ML-DSA-65 public
52/// key bytes; `signature` is the ML-DSA-65 signature over the quote's
53/// canonical signing payload (`PaymentQuote::bytes_for_sig`).
54///
55/// # Returns
56///
57/// `true` if the signature is valid for `quote.bytes_for_sig()`.
58#[must_use]
59pub fn verify_quote_signature(quote: &PaymentQuote) -> bool {
60    let pub_key = match MlDsaPublicKey::from_bytes(&quote.pub_key) {
61        Ok(pk) => pk,
62        Err(e) => {
63            debug!("Failed to parse ML-DSA-65 public key from quote: {e}");
64            return false;
65        }
66    };
67
68    let signature = match MlDsaSignature::from_bytes(&quote.signature) {
69        Ok(sig) => sig,
70        Err(e) => {
71            debug!("Failed to parse ML-DSA-65 signature from quote: {e}");
72            return false;
73        }
74    };
75
76    let bytes = quote.bytes_for_sig();
77
78    let ml_dsa = MlDsa65::new();
79    match ml_dsa.verify(&pub_key, &bytes, &signature) {
80        Ok(valid) => {
81            if !valid {
82                debug!("ML-DSA-65 quote signature verification failed");
83            }
84            valid
85        }
86        Err(e) => {
87            debug!("ML-DSA-65 verification error: {e}");
88            false
89        }
90    }
91}
92
93/// Verify a `MerklePaymentCandidateNode`'s ML-DSA-65 signature.
94///
95/// Autonomi uses ML-DSA-65 for merkle candidate signing; the upstream
96/// `MerklePaymentCandidateNode::verify_signature()` method expects libp2p
97/// Ed25519 keys and cannot be used.
98///
99/// `pub_key` holds the raw ML-DSA-65 public key bytes; `signature` is
100/// the ML-DSA-65 signature over `MerklePaymentCandidateNode::bytes_to_sign()`.
101#[must_use]
102pub fn verify_merkle_candidate_signature(candidate: &MerklePaymentCandidateNode) -> bool {
103    let pub_key = match MlDsaPublicKey::from_bytes(&candidate.pub_key) {
104        Ok(pk) => pk,
105        Err(e) => {
106            debug!("Failed to parse ML-DSA-65 public key from merkle candidate: {e}");
107            return false;
108        }
109    };
110
111    let signature = match MlDsaSignature::from_bytes(&candidate.signature) {
112        Ok(sig) => sig,
113        Err(e) => {
114            debug!("Failed to parse ML-DSA-65 signature from merkle candidate: {e}");
115            return false;
116        }
117    };
118
119    let msg = MerklePaymentCandidateNode::bytes_to_sign(
120        &candidate.price,
121        &candidate.reward_address,
122        candidate.merkle_payment_timestamp,
123    );
124
125    let ml_dsa = MlDsa65::new();
126    match ml_dsa.verify(&pub_key, &msg, &signature) {
127        Ok(valid) => {
128            if !valid {
129                debug!("ML-DSA-65 merkle candidate signature verification failed");
130            }
131            valid
132        }
133        Err(e) => {
134            debug!("ML-DSA-65 merkle candidate verification error: {e}");
135            false
136        }
137    }
138}
139
140#[cfg(test)]
141#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
142mod tests {
143    use super::*;
144    use evmlib::common::Amount;
145    use evmlib::RewardsAddress;
146    use saorsa_pqc::pqc::types::MlDsaSecretKey;
147    use std::time::SystemTime;
148
149    fn real_ml_dsa_quote() -> (PaymentQuote, [u8; 32]) {
150        let content = [7u8; 32];
151        let ml_dsa = MlDsa65::new();
152        let (pub_key, secret_key) = ml_dsa.generate_keypair().expect("keypair");
153        let pub_key_bytes = pub_key.as_bytes().to_vec();
154
155        // Build a quote with all fields except signature, then sign bytes_for_sig().
156        let mut quote = PaymentQuote {
157            content: xor_name::XorName(content),
158            timestamp: SystemTime::now(),
159            price: Amount::from(42u64),
160            rewards_address: RewardsAddress::new([2u8; 20]),
161            pub_key: pub_key_bytes,
162            signature: vec![],
163        };
164        let msg = quote.bytes_for_sig();
165        let sk = MlDsaSecretKey::from_bytes(secret_key.as_bytes()).expect("sk");
166        let sig = ml_dsa.sign(&sk, &msg).expect("sign").as_bytes().to_vec();
167        quote.signature = sig;
168
169        (quote, content)
170    }
171
172    #[test]
173    fn verify_quote_content_matches() {
174        let (quote, content) = real_ml_dsa_quote();
175        assert!(verify_quote_content(&quote, &content));
176    }
177
178    #[test]
179    fn verify_quote_content_mismatch() {
180        let (quote, _) = real_ml_dsa_quote();
181        let wrong = [0xFFu8; 32];
182        assert!(!verify_quote_content(&quote, &wrong));
183    }
184
185    #[test]
186    fn verify_quote_signature_real_keys_roundtrip() {
187        let (quote, _) = real_ml_dsa_quote();
188        assert!(verify_quote_signature(&quote));
189    }
190
191    #[test]
192    fn verify_quote_signature_tampered_signature_fails() {
193        let (mut quote, _) = real_ml_dsa_quote();
194        if let Some(byte) = quote.signature.first_mut() {
195            *byte ^= 0xFF;
196        }
197        assert!(!verify_quote_signature(&quote));
198    }
199
200    #[test]
201    fn verify_quote_signature_empty_pub_key_fails() {
202        let quote = PaymentQuote {
203            content: xor_name::XorName([0u8; 32]),
204            timestamp: SystemTime::now(),
205            price: Amount::from(1u64),
206            rewards_address: RewardsAddress::new([0u8; 20]),
207            pub_key: vec![],
208            signature: vec![],
209        };
210        assert!(!verify_quote_signature(&quote));
211    }
212
213    #[test]
214    fn verify_quote_signature_empty_signature_fails() {
215        let ml_dsa = MlDsa65::new();
216        let (pub_key, _sk) = ml_dsa.generate_keypair().expect("keypair");
217        let quote = PaymentQuote {
218            content: xor_name::XorName([0u8; 32]),
219            timestamp: SystemTime::now(),
220            price: Amount::from(1u64),
221            rewards_address: RewardsAddress::new([0u8; 20]),
222            pub_key: pub_key.as_bytes().to_vec(),
223            signature: vec![],
224        };
225        assert!(!verify_quote_signature(&quote));
226    }
227
228    fn real_ml_dsa_merkle_candidate() -> MerklePaymentCandidateNode {
229        let ml_dsa = MlDsa65::new();
230        let (pub_key, secret_key) = ml_dsa.generate_keypair().expect("keypair");
231        let price = Amount::from(1024u64);
232        let reward_address = RewardsAddress::new([3u8; 20]);
233        let merkle_payment_timestamp = 1_700_000_000u64;
234        let msg = MerklePaymentCandidateNode::bytes_to_sign(
235            &price,
236            &reward_address,
237            merkle_payment_timestamp,
238        );
239        let sk = MlDsaSecretKey::from_bytes(secret_key.as_bytes()).expect("sk");
240        let signature = ml_dsa.sign(&sk, &msg).expect("sign").as_bytes().to_vec();
241        MerklePaymentCandidateNode {
242            pub_key: pub_key.as_bytes().to_vec(),
243            price,
244            reward_address,
245            merkle_payment_timestamp,
246            signature,
247        }
248    }
249
250    #[test]
251    fn verify_merkle_candidate_real_keys_roundtrip() {
252        let candidate = real_ml_dsa_merkle_candidate();
253        assert!(verify_merkle_candidate_signature(&candidate));
254    }
255
256    #[test]
257    fn verify_merkle_candidate_tampered_fails() {
258        let mut candidate = real_ml_dsa_merkle_candidate();
259        if let Some(byte) = candidate.signature.first_mut() {
260            *byte ^= 0x55;
261        }
262        assert!(!verify_merkle_candidate_signature(&candidate));
263    }
264
265    #[test]
266    fn verify_merkle_candidate_empty_pub_key_fails() {
267        let mut candidate = real_ml_dsa_merkle_candidate();
268        candidate.pub_key = vec![];
269        assert!(!verify_merkle_candidate_signature(&candidate));
270    }
271
272    #[test]
273    fn verify_merkle_candidate_wrong_timestamp_fails() {
274        let mut candidate = real_ml_dsa_merkle_candidate();
275        candidate.merkle_payment_timestamp = candidate.merkle_payment_timestamp.wrapping_add(1);
276        assert!(!verify_merkle_candidate_signature(&candidate));
277    }
278}
ant_protocol/payment/verify.rs

ant_protocol/payment/
verify.rs
