openmls 0.8.1

A Rust implementation of the Messaging Layer Security (MLS) protocol, as defined in RFC 9420.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175

use std::ops::{Deref, DerefMut};

use openmls_basic_credential::SignatureKeyPair;
use openmls_test::openmls_test;
use openmls_traits::{signatures::Signer, types::Ciphersuite, OpenMlsProvider};
use tls_codec::*;

use super::{extensions::FrankenExtension, leaf_node::FrankenLeafNode};
use crate::{
    ciphersuite::{
        signable::{Signable, SignedStruct},
        signature::{OpenMlsSignaturePublicKey, Signature},
    },
    credentials::{BasicCredential, CredentialWithKey},
    key_packages::{KeyPackage, KeyPackageIn},
    prelude::KeyPackageBundle,
    test_utils::OpenMlsRustCrypto,
    versions::ProtocolVersion,
};

#[derive(
    Debug, Clone, PartialEq, Eq, TlsSerialize, TlsDeserialize, TlsDeserializeBytes, TlsSize,
)]
pub struct FrankenKeyPackage {
    pub payload: FrankenKeyPackageTbs,
    pub signature: VLBytes,
}

impl FrankenKeyPackage {
    // Re-sign both the KeyPackage and the enclosed LeafNode
    pub fn resign(&mut self, signer: &impl Signer) {
        self.payload.leaf_node.resign(None, signer);
        let new_self = self.payload.clone().sign(signer).unwrap();
        let _ = std::mem::replace(self, new_self);
    }

    // Only re-sign the KeyPackage
    pub fn resign_only_key_package(&mut self, signer: &impl Signer) {
        let new_self = self.payload.clone().sign(signer).unwrap();
        let _ = std::mem::replace(self, new_self);
    }
}

impl Deref for FrankenKeyPackage {
    type Target = FrankenKeyPackageTbs;

    fn deref(&self) -> &Self::Target {
        &self.payload
    }
}

impl DerefMut for FrankenKeyPackage {
    fn deref_mut(&mut self) -> &mut Self::Target {
        &mut self.payload
    }
}

impl SignedStruct<FrankenKeyPackageTbs> for FrankenKeyPackage {
    fn from_payload(
        payload: FrankenKeyPackageTbs,
        signature: Signature,
        _serialized_payload: Vec<u8>,
    ) -> Self {
        Self {
            payload,
            signature: signature.as_slice().to_owned().into(),
        }
    }
}

const SIGNATURE_KEY_PACKAGE_LABEL: &str = "KeyPackageTBS";

impl Signable for FrankenKeyPackageTbs {
    type SignedOutput = FrankenKeyPackage;

    fn unsigned_payload(&self) -> Result<Vec<u8>, tls_codec::Error> {
        self.tls_serialize_detached()
    }

    fn label(&self) -> &str {
        SIGNATURE_KEY_PACKAGE_LABEL
    }
}

impl From<KeyPackage> for FrankenKeyPackage {
    fn from(kp: KeyPackage) -> Self {
        FrankenKeyPackage::tls_deserialize(&mut kp.tls_serialize_detached().unwrap().as_slice())
            .unwrap()
    }
}

impl From<KeyPackageBundle> for FrankenKeyPackage {
    fn from(kp: KeyPackageBundle) -> Self {
        FrankenKeyPackage::tls_deserialize(
            &mut kp
                .key_package()
                .tls_serialize_detached()
                .unwrap()
                .as_slice(),
        )
        .unwrap()
    }
}

impl From<FrankenKeyPackage> for KeyPackage {
    fn from(fkp: FrankenKeyPackage) -> Self {
        KeyPackageIn::tls_deserialize(&mut fkp.tls_serialize_detached().unwrap().as_slice())
            .unwrap()
            .into()
    }
}

impl From<FrankenKeyPackage> for KeyPackageIn {
    fn from(fkp: FrankenKeyPackage) -> Self {
        KeyPackageIn::tls_deserialize(&mut fkp.tls_serialize_detached().unwrap().as_slice())
            .unwrap()
    }
}

#[derive(
    Debug, Clone, PartialEq, Eq, TlsSerialize, TlsDeserialize, TlsDeserializeBytes, TlsSize,
)]
pub struct FrankenKeyPackageTbs {
    pub protocol_version: u16,
    pub ciphersuite: u16,
    pub init_key: VLBytes,
    pub leaf_node: FrankenLeafNode,
    pub extensions: Vec<FrankenExtension>,
}

#[derive(
    Debug, Clone, PartialEq, Eq, TlsSerialize, TlsDeserialize, TlsDeserializeBytes, TlsSize,
)]
pub struct FrankenLifetime {
    pub not_before: u64,
    pub not_after: u64,
}

#[openmls_test]
fn test_franken_key_package() {
    let provider = &Provider::default();

    let config = ciphersuite;

    let (credential, signer) = {
        let credential = BasicCredential::new(b"test identity".to_vec());
        let signature_keys = SignatureKeyPair::new(ciphersuite.signature_algorithm()).unwrap();
        signature_keys.store(provider.storage()).unwrap();

        (credential, signature_keys)
    };
    let signature_key = OpenMlsSignaturePublicKey::new(
        signer.to_public_vec().into(),
        ciphersuite.signature_algorithm(),
    )
    .unwrap();

    let credential_with_key = CredentialWithKey {
        credential: credential.into(),
        signature_key: signature_key.into(),
    };

    let kp = KeyPackage::builder()
        .build(config, provider, &signer, credential_with_key)
        .unwrap();

    let ser = kp.key_package().tls_serialize_detached().unwrap();
    let fkp = FrankenKeyPackage::tls_deserialize(&mut ser.as_slice()).unwrap();

    let ser2 = fkp.tls_serialize_detached().unwrap();
    assert_eq!(ser, ser2);

    let kp2 = KeyPackage::from(fkp.clone());
    assert_eq!(kp.key_package(), &kp2);
}