ic_auth_protocol_types/
proof.rs

1//! Passive application authentication proof contracts.
2//! Adapted from Canic; see docs/design/canic-source-review.md.
3
4use super::{DelegatedRoleGrant, DelegationAudience};
5use crate::Principal;
6use serde::{Deserialize, Serialize};
7
8//
9// RootProof
10//
11
12#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
13pub enum RootProof {
14    IcChainKeyBatchSignatureV1(IcChainKeyBatchSignatureProofV1),
15}
16
17//
18// IcCanisterSignatureProofV1
19//
20
21#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
22pub struct IcCanisterSignatureProofV1 {
23    pub signature_cbor: Vec<u8>,
24    pub public_key_der: Vec<u8>,
25}
26
27//
28// ChainKeyAlgorithm
29//
30
31#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
32pub enum ChainKeyAlgorithm {
33    EcdsaSecp256k1,
34}
35
36//
37// ChainKeyKeyId
38//
39
40#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
41pub struct ChainKeyKeyId {
42    pub name: String,
43}
44
45//
46// IcChainKeyBatchSignatureProofV1
47//
48
49#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
50pub struct IcChainKeyBatchSignatureProofV1 {
51    pub header: ChainKeyBatchHeaderV1,
52    pub delegation_cert: ChainKeyDelegationCertV1,
53    pub issuer_witness: ChainKeyBatchWitnessV1,
54    pub signature: ChainKeyRootSignatureV1,
55}
56
57//
58// ChainKeyBatchHeaderV1
59//
60
61#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
62pub struct ChainKeyBatchHeaderV1 {
63    pub schema_version: u16,
64    pub root_canister_id: Principal,
65    pub batch_id: [u8; 32],
66    pub proof_epoch: u64,
67    pub registry_epoch: u64,
68    pub registry_hash: [u8; 32],
69    pub tree_root: [u8; 32],
70    pub not_before_ns: u64,
71    pub expires_at_ns: u64,
72    pub algorithm: ChainKeyAlgorithm,
73    pub key_id: ChainKeyKeyId,
74    pub derivation_path_hash: [u8; 32],
75    pub key_version: u64,
76}
77
78//
79// ChainKeyDelegationCertV1
80//
81
82#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
83pub struct ChainKeyDelegationCertV1 {
84    pub root_canister_id: Principal,
85    pub issuer_canister_id: Principal,
86    pub proof_epoch: u64,
87    pub issuer_proof_algorithm: IssuerProofAlgorithm,
88    pub issuer_proof_binding_hash: [u8; 32],
89    pub issuer_proof_binding: IssuerProofBinding,
90    pub max_token_ttl_ns: u64,
91    pub audience: DelegationAudience,
92    pub grants: Vec<DelegatedRoleGrant>,
93    pub not_before_ns: u64,
94    pub expires_at_ns: u64,
95    pub registry_epoch: u64,
96    pub registry_hash: [u8; 32],
97}
98
99//
100// ChainKeyRootSignatureV1
101//
102
103#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
104pub struct ChainKeyRootSignatureV1 {
105    pub algorithm: ChainKeyAlgorithm,
106    pub key_id: ChainKeyKeyId,
107    pub derivation_path: Vec<Vec<u8>>,
108    pub public_key: Vec<u8>,
109    pub signature: Vec<u8>,
110}
111
112//
113// ChainKeyBatchWitnessV1
114//
115
116#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
117pub struct ChainKeyBatchWitnessV1 {
118    pub steps: Vec<ChainKeyBatchWitnessStepV1>,
119}
120
121//
122// ChainKeyBatchWitnessStepV1
123//
124
125#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
126pub enum ChainKeyBatchWitnessStepV1 {
127    LeftSibling([u8; 32]),
128    RightSibling([u8; 32]),
129}
130
131//
132// IssuerProofAlgorithm
133//
134
135#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
136pub enum IssuerProofAlgorithm {
137    IcCanisterSignatureV1,
138}
139
140//
141// IssuerProofBinding
142//
143
144#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
145pub enum IssuerProofBinding {
146    IcCanisterSignatureV1 { seed_hash: [u8; 32] },
147}
148
149//
150// DelegationCert
151//
152
153#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
154pub struct DelegationCert {
155    pub root_pid: Principal,
156    pub issuer_pid: Principal,
157    pub issuer_proof_alg: IssuerProofAlgorithm,
158    pub issuer_proof_binding_hash: [u8; 32],
159    pub issuer_proof_binding: IssuerProofBinding,
160    pub issued_at_ns: u64,
161    pub not_before_ns: u64,
162    pub expires_at_ns: u64,
163    pub max_token_ttl_ns: u64,
164    pub aud: DelegationAudience,
165    pub grants: Vec<DelegatedRoleGrant>,
166}
167
168//
169// DelegationProof
170//
171
172#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
173pub struct DelegationProof {
174    pub cert: DelegationCert,
175    pub root_proof: RootProof,
176}
ic_auth_protocol_types/proof.rs

ic_auth_protocol_types/
proof.rs
