ic_auth_protocol_types/
proof.rs

1//! Passive application authentication proof contracts.
2//! Adapted from Canic; see docs/design/canic-source-review.md.
3
4use super::{DelegatedRoleGrant, DelegationAudience};
5use candid::{CandidType, Principal};
6use serde::{Deserialize, Serialize};
7
8//
9// RootProof
10//
11
12#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
13pub enum RootProof {
14    IcChainKeyBatchSignatureV1(IcChainKeyBatchSignatureProofV1),
15}
16
17//
18// IssuerProof
19//
20
21#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
22pub enum IssuerProof {
23    IcCanisterSignatureV1(IcCanisterSignatureProofV1),
24}
25
26//
27// IcCanisterSignatureProofV1
28//
29
30#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
31pub struct IcCanisterSignatureProofV1 {
32    pub signature_cbor: Vec<u8>,
33    pub public_key_der: Vec<u8>,
34}
35
36//
37// ChainKeyAlgorithm
38//
39
40#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
41pub enum ChainKeyAlgorithm {
42    EcdsaSecp256k1,
43}
44
45//
46// ChainKeyKeyId
47//
48
49#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
50pub struct ChainKeyKeyId {
51    pub name: String,
52}
53
54//
55// IcChainKeyBatchSignatureProofV1
56//
57
58#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
59pub struct IcChainKeyBatchSignatureProofV1 {
60    pub header: ChainKeyBatchHeaderV1,
61    pub delegation_cert: ChainKeyDelegationCertV1,
62    pub issuer_witness: ChainKeyBatchWitnessV1,
63    pub signature: ChainKeyRootSignatureV1,
64}
65
66//
67// ChainKeyBatchHeaderV1
68//
69
70#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
71pub struct ChainKeyBatchHeaderV1 {
72    pub schema_version: u16,
73    pub root_canister_id: Principal,
74    pub batch_id: [u8; 32],
75    pub proof_epoch: u64,
76    pub registry_epoch: u64,
77    pub registry_hash: [u8; 32],
78    pub tree_root: [u8; 32],
79    pub not_before_ns: u64,
80    pub expires_at_ns: u64,
81    pub algorithm: ChainKeyAlgorithm,
82    pub key_id: ChainKeyKeyId,
83    pub derivation_path_hash: [u8; 32],
84    pub key_version: u64,
85}
86
87//
88// ChainKeyDelegationCertV1
89//
90
91#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
92pub struct ChainKeyDelegationCertV1 {
93    pub root_canister_id: Principal,
94    pub issuer_canister_id: Principal,
95    pub proof_epoch: u64,
96    pub issuer_proof_algorithm: IssuerProofAlgorithm,
97    pub issuer_proof_binding_hash: [u8; 32],
98    pub issuer_proof_binding: IssuerProofBinding,
99    pub max_token_ttl_ns: u64,
100    pub audience: DelegationAudience,
101    pub grants: Vec<DelegatedRoleGrant>,
102    pub not_before_ns: u64,
103    pub expires_at_ns: u64,
104    pub registry_epoch: u64,
105    pub registry_hash: [u8; 32],
106}
107
108//
109// ChainKeyRootSignatureV1
110//
111
112#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
113pub struct ChainKeyRootSignatureV1 {
114    pub algorithm: ChainKeyAlgorithm,
115    pub key_id: ChainKeyKeyId,
116    pub derivation_path: Vec<Vec<u8>>,
117    pub public_key: Vec<u8>,
118    pub signature: Vec<u8>,
119}
120
121//
122// ChainKeyBatchWitnessV1
123//
124
125#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
126pub struct ChainKeyBatchWitnessV1 {
127    pub steps: Vec<ChainKeyBatchWitnessStepV1>,
128}
129
130//
131// ChainKeyBatchWitnessStepV1
132//
133
134#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
135pub enum ChainKeyBatchWitnessStepV1 {
136    LeftSibling([u8; 32]),
137    RightSibling([u8; 32]),
138}
139
140//
141// IssuerProofAlgorithm
142//
143
144#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
145pub enum IssuerProofAlgorithm {
146    IcCanisterSignatureV1,
147}
148
149//
150// IssuerProofBinding
151//
152
153#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
154pub enum IssuerProofBinding {
155    IcCanisterSignatureV1 { seed_hash: [u8; 32] },
156}
157
158//
159// DelegationCert
160//
161
162#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
163pub struct DelegationCert {
164    pub root_pid: Principal,
165    pub issuer_pid: Principal,
166    pub issuer_proof_alg: IssuerProofAlgorithm,
167    pub issuer_proof_binding_hash: [u8; 32],
168    pub issuer_proof_binding: IssuerProofBinding,
169    pub issued_at_ns: u64,
170    pub not_before_ns: u64,
171    pub expires_at_ns: u64,
172    pub max_token_ttl_ns: u64,
173    pub aud: DelegationAudience,
174    pub grants: Vec<DelegatedRoleGrant>,
175}
176
177//
178// DelegationProof
179//
180
181#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
182pub struct DelegationProof {
183    pub cert: DelegationCert,
184    pub root_proof: RootProof,
185}
ic_auth_protocol_types/proof.rs

ic_auth_protocol_types/
proof.rs
