canic-core 0.24.3

Canic — a canister orchestration and management toolkit for the Internet Computer
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

#[cfg(feature = "auth-crypto")]
use crate::cdk::mgmt::{
    EcdsaCurve, EcdsaKeyId, EcdsaPublicKeyArgs, SignWithEcdsaArgs, ecdsa_public_key,
    sign_with_ecdsa,
};
use crate::{InternalError, cdk::types::Principal};
#[cfg(feature = "auth-crypto")]
use k256::ecdsa::{Signature, VerifyingKey, signature::hazmat::PrehashVerifier};
use thiserror::Error as ThisError;

///
/// EcdsaOpsError
///

#[derive(Debug, ThisError)]
pub enum EcdsaOpsError {
    #[error("auth crypto support is not enabled in this canister build")]
    AuthCryptoUnavailable,

    #[error("ecdsa public key call failed: {0}")]
    PublicKeyCall(String),

    #[error("ecdsa sign call failed: {0}")]
    SignCall(String),

    #[error("invalid ecdsa public key: {0}")]
    InvalidPublicKey(String),

    #[error("invalid ecdsa signature: {0}")]
    InvalidSignature(String),
}

impl From<EcdsaOpsError> for InternalError {
    fn from(err: EcdsaOpsError) -> Self {
        crate::ops::ic::IcOpsError::from(err).into()
    }
}

///
/// EcdsaOps
///

pub struct EcdsaOps;

#[cfg(feature = "auth-crypto")]
impl EcdsaOps {
    pub async fn sign_bytes(
        key_name: &str,
        derivation_path: Vec<Vec<u8>>,
        msg_hash: [u8; 32],
    ) -> Result<Vec<u8>, InternalError> {
        let args = SignWithEcdsaArgs {
            message_hash: msg_hash.to_vec(),
            derivation_path,
            key_id: EcdsaKeyId {
                curve: EcdsaCurve::Secp256k1,
                name: key_name.to_string(),
            },
        };

        let response = sign_with_ecdsa(&args)
            .await
            .map_err(|err| EcdsaOpsError::SignCall(err.to_string()))?;

        Ok(response.signature)
    }

    pub async fn public_key_sec1(
        key_name: &str,
        derivation_path: Vec<Vec<u8>>,
        canister_id: Principal,
    ) -> Result<Vec<u8>, InternalError> {
        let args = EcdsaPublicKeyArgs {
            canister_id: Some(canister_id),
            derivation_path,
            key_id: EcdsaKeyId {
                curve: EcdsaCurve::Secp256k1,
                name: key_name.to_string(),
            },
        };

        let response = ecdsa_public_key(&args)
            .await
            .map_err(|err| EcdsaOpsError::PublicKeyCall(err.to_string()))?;

        Ok(response.public_key)
    }

    pub fn verify_signature(
        public_key_sec1: &[u8],
        msg_hash: [u8; 32],
        signature_bytes: &[u8],
    ) -> Result<(), InternalError> {
        let verifying_key = VerifyingKey::from_sec1_bytes(public_key_sec1)
            .map_err(|err| EcdsaOpsError::InvalidPublicKey(err.to_string()))?;
        let signature = Signature::try_from(signature_bytes)
            .map_err(|err| EcdsaOpsError::InvalidSignature(err.to_string()))?;

        verifying_key
            .verify_prehash(&msg_hash, &signature)
            .map_err(|err| EcdsaOpsError::InvalidSignature(err.to_string()))?;

        Ok(())
    }
}

#[cfg(not(feature = "auth-crypto"))]
impl EcdsaOps {
    #[allow(clippy::unused_async)]
    pub async fn sign_bytes(
        _key_name: &str,
        _derivation_path: Vec<Vec<u8>>,
        _msg_hash: [u8; 32],
    ) -> Result<Vec<u8>, InternalError> {
        Err(EcdsaOpsError::AuthCryptoUnavailable.into())
    }

    #[allow(clippy::unused_async)]
    pub async fn public_key_sec1(
        _key_name: &str,
        _derivation_path: Vec<Vec<u8>>,
        _canister_id: Principal,
    ) -> Result<Vec<u8>, InternalError> {
        Err(EcdsaOpsError::AuthCryptoUnavailable.into())
    }

    pub fn verify_signature(
        _public_key_sec1: &[u8],
        _msg_hash: [u8; 32],
        _signature_bytes: &[u8],
    ) -> Result<(), InternalError> {
        Err(EcdsaOpsError::AuthCryptoUnavailable.into())
    }
}