lys-core 0.3.2

Domain-agnostic cryptographic trust primitives — certificate authority, Merkle transparency log, signed attestations, sealed envelopes, and Ed25519 key management.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

#![cfg(test)]

use super::*;
use tempfile::tempdir;

fn identity() -> Ed25519Identity {
    let dir = tempdir().unwrap();
    Ed25519Identity::load_or_generate(&dir.path().join("id.key")).unwrap()
}

#[test]
fn sign_and_seal_returns_envelope_and_attestation() {
    let sender = identity();
    let recipient = identity();
    let payload = b"authenticated credential bundle";
    let (env, att) = sign_and_seal(payload, &sender, &recipient.x25519_public_key()).unwrap();
    assert_eq!(att.signer_public_key, sender.public_key_bytes());
    assert_eq!(env.ciphertext.len(), payload.len() + 16);
}

#[test]
fn open_and_verify_returns_payload_for_correct_sender() {
    let sender = identity();
    let recipient = identity();
    let payload = b"audit-bound payload";
    let (env, att) = sign_and_seal(payload, &sender, &recipient.x25519_public_key()).unwrap();
    let opened = open_and_verify(
        &env,
        &att,
        &sender.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap();
    assert_eq!(opened.as_slice(), payload);
}

#[test]
fn wrong_sender_public_key_returns_attestation_failed_without_unsealing() {
    let sender = identity();
    let imposter = identity();
    let recipient = identity();
    let (env, att) = sign_and_seal(b"payload", &sender, &recipient.x25519_public_key()).unwrap();
    let err = open_and_verify(
        &env,
        &att,
        &imposter.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap_err();
    assert!(matches!(err, TrustError::AttestationFailed));
}

#[test]
fn tampered_attestation_signature_returns_attestation_failed() {
    let sender = identity();
    let recipient = identity();
    let (env, mut att) =
        sign_and_seal(b"payload", &sender, &recipient.x25519_public_key()).unwrap();
    att.signature[0] ^= 0x01;
    let err = open_and_verify(
        &env,
        &att,
        &sender.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap_err();
    assert!(matches!(err, TrustError::AttestationFailed));
}

#[test]
fn forged_signer_key_in_attestation_returns_attestation_failed() {
    let sender = identity();
    let imposter = identity();
    let recipient = identity();
    let (env, mut att) =
        sign_and_seal(b"payload", &sender, &recipient.x25519_public_key()).unwrap();
    // Adversary swaps in their own public key claiming the signature is
    // theirs. The two-step gate must reject this — first the explicit
    // key comparison would pass (we now ask to verify against the
    // imposter's key), but the signature was produced by `sender` over
    // the original hash, so verification against `imposter` fails.
    att.signer_public_key = imposter.public_key_bytes();
    let err = open_and_verify(
        &env,
        &att,
        &imposter.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap_err();
    assert!(matches!(err, TrustError::AttestationFailed));
}

#[test]
fn tampered_envelope_after_signing_returns_attestation_failed() {
    let sender = identity();
    let recipient = identity();
    let (mut env, att) =
        sign_and_seal(b"payload", &sender, &recipient.x25519_public_key()).unwrap();
    env.ciphertext[0] ^= 0x01;
    let err = open_and_verify(
        &env,
        &att,
        &sender.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap_err();
    // The attestation covers the envelope bytes, so a post-signing
    // tamper is rejected at the attestation gate, not the AES-GCM gate.
    assert!(matches!(err, TrustError::AttestationFailed));
}

#[test]
fn generic_attestation_over_bare_envelope_bytes_is_rejected() {
    // Context binding: an attestation the sender produced with the
    // generic primitive over the envelope's canonical bytes (no context
    // tag) must not be accepted by the authenticated composition.
    let sender = identity();
    let recipient = identity();
    let (env, _att) = sign_and_seal(b"payload", &sender, &recipient.x25519_public_key()).unwrap();
    let generic = crate::attestation::sign::sign_attestation(&env.attestation_bytes(), &sender);
    let err = open_and_verify(
        &env,
        &generic,
        &sender.public_key_bytes(),
        &recipient.x25519_static_secret(),
    )
    .unwrap_err();
    assert!(matches!(err, TrustError::AttestationFailed));
}

#[test]
fn standalone_seal_and_open_still_work() {
    // The composed API is a strict superset; the standalone primitives
    // must remain functional and unrelated — `seal`/`open` are not
    // replaced by the authenticated composition.
    let recipient = identity();
    let env = seal(b"anonymous", &recipient.x25519_public_key()).unwrap();
    let opened = open(&env, &recipient.x25519_static_secret()).unwrap();
    assert_eq!(opened.as_slice(), b"anonymous");
}