cbwaw 0.5.50

Auth for Ordinary
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

use chacha20poly1305::{
    XChaCha20Poly1305, XNonce,
    aead::{Aead, AeadCore, KeyInit, OsRng},
};

use uuid::Uuid;

use std::error::Error;

pub enum KeyAlg {
    Ed25519Pair,
    Blake2SMac256,
}

impl KeyAlg {
    #[must_use]
    pub fn as_byte(&self) -> u8 {
        match self {
            Self::Ed25519Pair => 0,
            Self::Blake2SMac256 => 1,
        }
    }
}

#[allow(clippy::type_complexity)]
pub fn generate_ed25519_pair(
    cipher: &XChaCha20Poly1305,
    rng: &mut OsRng,
) -> Result<(Vec<u8>, [u8; 32], [u8; 32], Uuid), Box<dyn Error>> {
    let signing_key = ed25519_dalek::SigningKey::generate(rng);

    let verifying_key = signing_key.verifying_key().to_bytes();
    let signing_key = signing_key.to_bytes();

    let kid = Uuid::now_v7();
    let mut kid_key = kid.as_bytes().to_vec();

    let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
    let encrypted_signing_key = match cipher.encrypt(&nonce, &signing_key[..]) {
        Ok(v) => v,
        Err(err) => return Err(err.to_string().into()),
    };

    kid_key.extend_from_slice(&verifying_key[..]);
    kid_key.extend_from_slice(&nonce[..]);
    kid_key.extend_from_slice(&encrypted_signing_key[..]);

    Ok((kid_key, signing_key, verifying_key, kid))
}

#[allow(clippy::type_complexity)]
pub fn decrypt_ed25519_pair(
    cipher: &XChaCha20Poly1305,
    payload: &[u8],
) -> Result<(Uuid, [u8; 32], [u8; 32]), Box<dyn Error>> {
    let kid: [u8; 16] = payload[0..16].try_into()?;
    let verifying_key: [u8; 32] = payload[16..48].try_into()?;

    let nonce = XNonce::from_slice(&payload[48..72]);

    let signing_key = match cipher.decrypt(nonce, &payload[72..]) {
        Ok(v) => v,
        Err(err) => return Err(err.to_string().into()),
    };

    let signing_key_fixed: [u8; 32] = signing_key[0..32].try_into()?;

    let kid = Uuid::from_bytes(kid);

    Ok((kid, signing_key_fixed, verifying_key))
}

#[allow(clippy::type_complexity)]
pub fn generate_256_bit_key(
    cipher: &XChaCha20Poly1305,
    rng: &mut OsRng,
) -> Result<(Vec<u8>, [u8; 32], Uuid), Box<dyn Error>> {
    let hmac_key: [u8; 32] = XChaCha20Poly1305::generate_key(rng).into();

    let kid = Uuid::now_v7();
    let mut kid_key = kid.as_bytes().to_vec();

    let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
    let encrypted_hmac_key = match cipher.encrypt(&nonce, &hmac_key[..]) {
        Ok(v) => v,
        Err(err) => return Err(err.to_string().into()),
    };

    kid_key.extend_from_slice(&nonce[..]);
    kid_key.extend_from_slice(&encrypted_hmac_key[..]);

    Ok((kid_key, hmac_key, kid))
}

pub fn decrypt_256_bit_key(
    cipher: &XChaCha20Poly1305,
    payload: &[u8],
) -> Result<(Uuid, [u8; 32]), Box<dyn Error>> {
    let kid: [u8; 16] = payload[0..16].try_into()?;

    let nonce = XNonce::from_slice(&payload[16..40]);

    let key = match cipher.decrypt(nonce, &payload[40..]) {
        Ok(v) => v,
        Err(err) => return Err(err.to_string().into()),
    };

    let key_fixed: [u8; 32] = key[0..32].try_into()?;

    let kid = Uuid::from_bytes(kid);

    Ok((kid, key_fixed))
}

#[cfg(test)]
mod test {
    use super::*;

    const ENCRYPTION_KEY: [u8; 32] = [0u8; 32];

    #[test]
    fn ed25519() -> Result<(), Box<dyn Error>> {
        let mut rng = OsRng;
        let cipher = XChaCha20Poly1305::new(&ENCRYPTION_KEY.into());

        let (encrypted, signing_key, verifying_key, generated_kid) =
            generate_ed25519_pair(&cipher, &mut rng)?;

        let (kid, decrypted_signing, verifying) = decrypt_ed25519_pair(&cipher, &encrypted)?;

        assert_eq!(kid, generated_kid);
        assert_eq!(signing_key, decrypted_signing);
        assert_eq!(verifying_key, verifying);

        Ok(())
    }

    #[test]
    fn a_256_bit() -> Result<(), Box<dyn Error>> {
        let mut rng = OsRng;
        let cipher = XChaCha20Poly1305::new(&ENCRYPTION_KEY.into());

        let (encrypted, key, generated_kid) = generate_256_bit_key(&cipher, &mut rng)?;

        let (kid, decrypted) = decrypt_256_bit_key(&cipher, &encrypted)?;

        assert_eq!(kid, generated_kid);
        assert_eq!(key, decrypted);

        Ok(())
    }
}