dig-capsule 0.5.0

The DIG Network .dig capsule data plane — one crate over the DIGS format, capsule read-crypto, compiler, staging, and the guest/host serve triad.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

use crate::imp::core::codec::{Decode, Encode};
use crate::imp::core::merkle::{MerkleProof, ProofStep};
use crate::imp::core::wire::{
    AttestationChallenge, AttestationResponse, AuthenticationInfo, ContentResponse, ProofPrelude,
};
use crate::imp::core::Bytes32;

fn sample_merkle_proof() -> MerkleProof {
    MerkleProof {
        leaf: Bytes32([1; 32]),
        path: vec![ProofStep {
            hash: Bytes32([2; 32]),
            is_left: true,
        }],
        root: Bytes32([3; 32]),
    }
}

#[test]
fn content_response_roundtrip() {
    let r = ContentResponse {
        ciphertext: vec![10, 20, 30, 40],
        merkle_proof: sample_merkle_proof(),
        roothash: Bytes32([4; 32]),
        chunk_lens: vec![4],
    };
    assert_eq!(ContentResponse::from_bytes(&r.to_bytes()).unwrap(), r);
}

#[test]
fn attestation_challenge_roundtrip() {
    let c = AttestationChallenge {
        nonce: [1; 32],
        store_id: [2; 32],
        timestamp: 999,
    };
    assert_eq!(AttestationChallenge::from_bytes(&c.to_bytes()).unwrap(), c);
}

#[test]
fn attestation_response_roundtrip() {
    let r = AttestationResponse {
        host_public_key: [3; 48],
        host_instance_id: [4; 32],
        signature: [5; 96],
    };
    assert_eq!(AttestationResponse::from_bytes(&r.to_bytes()).unwrap(), r);
}

#[test]
fn authentication_info_roundtrip() {
    let a = AuthenticationInfo {
        requires_session: true,
        requires_jwt: false,
        jwks_url: Some("https://issuer/.well-known/jwks.json".into()),
        accepted_algorithms: vec!["RS256".into(), "ES256".into()],
    };
    assert_eq!(AuthenticationInfo::from_bytes(&a.to_bytes()).unwrap(), a);
}

#[test]
fn proof_prelude_roundtrip() {
    // C3: guest get_proof returns a ProofPrelude (NOT a finished ExecutionProof).
    let p = ProofPrelude {
        roothash: Bytes32([6; 32]),
        output_commitment: Bytes32([7; 32]),
        serving_digest: Bytes32([8; 32]),
    };
    assert_eq!(ProofPrelude::from_bytes(&p.to_bytes()).unwrap(), p);
}