heddle-crypto 0.15.0

An AI-native version control system
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

// SPDX-License-Identifier: Apache-2.0
//! State-signature helpers that depend on crypto implementations.

use objects::object::{ContentHash, StateSignature};

use crate::{Signer, SignerError, state_signature_payload, verify_state_signature};

/// Error type for state signature operations.
#[derive(Debug, thiserror::Error)]
pub enum StateSignatureError {
    #[error("unsupported signature algorithm: {0}")]
    UnsupportedAlgorithm(String),
    #[error("invalid public key: {0}")]
    InvalidPublicKey(String),
    #[error("invalid signature: {0}")]
    InvalidSignature(String),
    #[error("hex decode error: {0}")]
    Hex(#[from] hex::FromHexError),
    #[error("signer error: {0}")]
    Signer(#[from] SignerError),
}

pub fn state_signature_from_signer(
    hash: &ContentHash,
    signer: &dyn Signer,
) -> Result<StateSignature, StateSignatureError> {
    let signature = signer.sign(&state_signature_payload(hash))?;

    Ok(StateSignature {
        algorithm: signer.algorithm().to_string(),
        public_key: hex::encode(signer.public_key()),
        signature: hex::encode(&signature),
    })
}

pub fn verify_state_signature_bytes(
    signature: &StateSignature,
    hash: &ContentHash,
) -> Result<(), StateSignatureError> {
    let public_key = hex::decode(&signature.public_key)?;
    let signature_bytes = hex::decode(&signature.signature)?;

    verify_state_signature(hash, &signature.algorithm, &public_key, &signature_bytes)
        .map_err(StateSignatureError::from)
}

pub fn public_key_bytes(signature: &StateSignature) -> Result<Vec<u8>, StateSignatureError> {
    hex::decode(&signature.public_key).map_err(StateSignatureError::from)
}

pub fn signature_bytes(signature: &StateSignature) -> Result<Vec<u8>, StateSignatureError> {
    hex::decode(&signature.signature).map_err(StateSignatureError::from)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::Ed25519Signer;

    fn make_test_hash() -> ContentHash {
        ContentHash::from_bytes([1u8; 32])
    }

    #[test]
    fn test_sign_verify_ed25519() {
        let signer = Ed25519Signer::generate().expect("generate key");
        let hash = make_test_hash();

        let sig = state_signature_from_signer(&hash, &signer).expect("sign state");
        assert_eq!(sig.algorithm(), "ed25519");

        verify_state_signature_bytes(&sig, &hash).expect("verify should not error");

        let signature = signature_bytes(&sig).expect("decode tagged signature");
        signer
            .verify(&state_signature_payload(&hash), &signature)
            .expect("signature covers the canonical domain-tagged payload");
    }

    #[test]
    fn untagged_signature_is_rejected() {
        let signer = Ed25519Signer::generate().expect("generate key");
        let hash = make_test_hash();
        let signature = signer.sign(hash.as_bytes()).expect("sign bare hash");
        let untagged = StateSignature {
            algorithm: signer.algorithm().to_string(),
            public_key: hex::encode(signer.public_key()),
            signature: hex::encode(signature),
        };

        verify_state_signature_bytes(&untagged, &hash)
            .expect_err("an untagged signature must fail verification");
    }
}