alice-auth 0.5.0

Ed25519 ZKP auth for ALICE
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

//! protocol.

use crate::errors::*;
use crate::identity::*;
use crate::random::*;
use crate::types::*;
use crate::verify::*;
use core::fmt;

// Protocol
// ============================================================================

/// Client greeting containing the public identity and protocol version.
#[derive(Clone, Copy)]
#[repr(C)]
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
pub struct Hello {
    pub id: AliceId,
    pub v: u8,
}

/// Server-issued 32-byte random challenge nonce.
#[derive(Clone, Copy)]
#[repr(C)]
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
pub struct Challenge {
    pub n: [u8; 32],
}

/// Client response: Ed25519 signature over the challenge nonce.
#[derive(Clone, Copy)]
#[repr(C)]
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
pub struct Response {
    pub s: AliceSig,
}

/// Authentication result: `Ok(session_token)` or `Fail`.
#[derive(Clone, Copy)]
#[repr(C)]
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
pub enum AuthResult {
    Ok([u8; 16]),
    Fail,
}

/// Server-side pending challenge state (identity + nonce).
#[derive(Clone, Copy)]
#[repr(C)]
pub struct Pending {
    pub id: AliceId,
    pub c: [u8; 32],
}

impl fmt::Debug for Hello {
    #[inline(always)]
    fn fmt(&self, _: &mut fmt::Formatter<'_>) -> fmt::Result {
        Ok(())
    }
}
impl fmt::Debug for Challenge {
    #[inline(always)]
    fn fmt(&self, _: &mut fmt::Formatter<'_>) -> fmt::Result {
        Ok(())
    }
}
impl fmt::Debug for Response {
    #[inline(always)]
    fn fmt(&self, _: &mut fmt::Formatter<'_>) -> fmt::Result {
        Ok(())
    }
}
impl fmt::Debug for AuthResult {
    #[inline(always)]
    fn fmt(&self, _: &mut fmt::Formatter<'_>) -> fmt::Result {
        Ok(())
    }
}
impl fmt::Debug for Pending {
    #[inline(always)]
    fn fmt(&self, _: &mut fmt::Formatter<'_>) -> fmt::Result {
        Ok(())
    }
}

/// # Errors
/// Returns `AuthError::E5` if the platform RNG fails.
#[inline(always)]
pub fn make_challenge(id: AliceId) -> Result<Pending> {
    Ok(Pending {
        id,
        c: challenge()?,
    })
}
/// Returns `AuthResult::Fail` if the signature is invalid or RNG fails.
///
/// An all-zeros token would be a trivially
/// guessable secret, so we treat RNG failure as an authentication failure.
#[inline(always)]
#[must_use]
pub fn check(p: &Pending, r: &Response) -> AuthResult {
    verify32(&p.id, &p.c, &r.s).map_or(AuthResult::Fail, |()| {
        rand::<16>().map_or(AuthResult::Fail, AuthResult::Ok)
    })
}
/// Create a `Hello` greeting from an identity.
#[inline(always)]
#[must_use]
pub fn hello(i: &Identity) -> Hello {
    Hello { id: i.id(), v: 1 }
}
/// Sign a challenge nonce, producing a `Response`.
#[inline(always)]
#[must_use]
pub fn respond(i: &Identity, c: &Challenge) -> Response {
    Response { s: i.sign32(&c.n) }
}