blindplane-access 0.1.0

Signed enterprise access grants, capability policies, revocation and encrypted audit events for Blindplane
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

//! Domain-separated signing helpers.

#[cfg(feature = "client")]
use blindplane_crypto::SigningKey;
use blindplane_crypto::{Sha256, verify_strict};

use crate::AccessError;
use crate::codec::push_bytes;

pub(crate) fn key_id(domain: &[u8], public_key: &[u8; 32]) -> [u8; 32] {
    let mut input = Vec::with_capacity(domain.len() + public_key.len() + 4);
    push_bytes(&mut input, domain);
    input.extend_from_slice(public_key);
    Sha256::digest(&input)
}

#[cfg(feature = "client")]
pub(crate) fn sign(domain: &[u8], signing_key: &SigningKey, unsigned: &[u8]) -> [u8; 64] {
    signing_key.sign(&message(domain, unsigned))
}

pub(crate) fn message(domain: &[u8], unsigned: &[u8]) -> Vec<u8> {
    let mut out = Vec::with_capacity(domain.len() + unsigned.len() + 4);
    push_bytes(&mut out, domain);
    out.extend_from_slice(unsigned);
    out
}

pub(crate) fn verify(
    domain: &[u8],
    public_key: &[u8; 32],
    unsigned: &[u8],
    signature: &[u8; 64],
) -> Result<(), AccessError> {
    verify_strict(public_key, &message(domain, unsigned), signature)
        .map_err(|_| AccessError::InvalidSignature)
}