Skip to content

Commit e6a1870

Browse files
zjkmxyzjkmxy
authored
security: Add ed25519 signer (#92)
* security: Add ed25519 signer Fix: #91
1 parent be1788d commit e6a1870

File tree

5 files changed

+213
-66
lines changed

5 files changed

+213
-66
lines changed

‎std/security/asym-signer.go

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package security
2+
3+
import (
4+
"time"
5+
6+
enc "github.com/named-data/ndnd/std/encoding"
7+
"github.com/named-data/ndnd/std/ndn"
8+
"github.com/named-data/ndnd/std/utils"
9+
)
10+
11+
// asymSigner is a base class of signer used for asymmetric keys.
12+
type asymSigner struct {
13+
timer ndn.Timer
14+
seq uint64
15+
16+
keyLocatorName enc.Name
17+
forCert bool
18+
forInt bool
19+
certExpireTime time.Duration
20+
}
21+
22+
func (s *asymSigner) genSigInfo(sigType ndn.SigType) (*ndn.SigConfig, error) {
23+
ret := &ndn.SigConfig{
24+
Type: sigType,
25+
KeyName: s.keyLocatorName,
26+
}
27+
if s.forCert {
28+
ret.NotBefore = utils.IdPtr(s.timer.Now())
29+
ret.NotAfter = utils.IdPtr(s.timer.Now().Add(s.certExpireTime))
30+
}
31+
if s.forInt {
32+
s.seq++
33+
ret.Nonce = s.timer.Nonce()
34+
ret.SigTime = utils.IdPtr(s.timer.Now())
35+
ret.SeqNum = utils.IdPtr(s.seq)
36+
}
37+
return ret, nil
38+
}

‎std/security/ecc-signer.go

+14-33
Original file line numberDiff line numberDiff line change
@@ -9,38 +9,17 @@ import (
99
enc "github.com/named-data/ndnd/std/encoding"
1010
basic_engine "github.com/named-data/ndnd/std/engine/basic"
1111
"github.com/named-data/ndnd/std/ndn"
12-
"github.com/named-data/ndnd/std/utils"
1312
)
1413

1514
// eccSigner is a signer that uses ECC key to sign packets.
1615
type eccSigner struct {
17-
timer ndn.Timer
18-
seq uint64
19-
20-
keyLocatorName enc.Name
21-
key *ecdsa.PrivateKey
22-
keyLen uint
23-
forCert bool
24-
forInt bool
25-
certExpireTime time.Duration
16+
asymSigner
17+
keyLen uint
18+
key *ecdsa.PrivateKey
2619
}
2720

2821
func (s *eccSigner) SigInfo() (*ndn.SigConfig, error) {
29-
ret := &ndn.SigConfig{
30-
Type: ndn.SignatureSha256WithEcdsa,
31-
KeyName: s.keyLocatorName,
32-
}
33-
if s.forCert {
34-
ret.NotBefore = utils.IdPtr(s.timer.Now())
35-
ret.NotAfter = utils.IdPtr(s.timer.Now().Add(s.certExpireTime))
36-
}
37-
if s.forInt {
38-
s.seq++
39-
ret.Nonce = s.timer.Nonce()
40-
ret.SigTime = utils.IdPtr(s.timer.Now())
41-
ret.SeqNum = utils.IdPtr(s.seq)
42-
}
43-
return ret, nil
22+
return s.genSigInfo(ndn.SignatureSha256WithEcdsa)
4423
}
4524

4625
func (s *eccSigner) EstimateSize() uint {
@@ -67,13 +46,15 @@ func NewEccSigner(
6746
keyLen := uint(key.Curve.Params().BitSize*2+7) / 8
6847
keyLen += keyLen%2 + 8
6948
return &eccSigner{
70-
timer: basic_engine.Timer{},
71-
seq: 0,
72-
keyLocatorName: keyLocatorName,
73-
key: key,
74-
keyLen: keyLen,
75-
forCert: forCert,
76-
forInt: forInt,
77-
certExpireTime: expireTime,
49+
asymSigner: asymSigner{
50+
timer: basic_engine.Timer{},
51+
seq: 0,
52+
keyLocatorName: keyLocatorName,
53+
forCert: forCert,
54+
forInt: forInt,
55+
certExpireTime: expireTime,
56+
},
57+
keyLen: keyLen,
58+
key: key,
7859
}
7960
}

‎std/security/ed-signer.go

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
package security
2+
3+
import (
4+
"crypto/ed25519"
5+
"time"
6+
7+
enc "github.com/named-data/ndnd/std/encoding"
8+
basic_engine "github.com/named-data/ndnd/std/engine/basic"
9+
"github.com/named-data/ndnd/std/ndn"
10+
)
11+
12+
// edSigner is a signer that uses Ed25519 key to sign packets.
13+
type edSigner struct {
14+
asymSigner
15+
key ed25519.PrivateKey
16+
}
17+
18+
func (s *edSigner) SigInfo() (*ndn.SigConfig, error) {
19+
return s.genSigInfo(ndn.SignatureEd25519)
20+
}
21+
22+
func (s *edSigner) EstimateSize() uint {
23+
return ed25519.SignatureSize
24+
}
25+
26+
func (s *edSigner) ComputeSigValue(covered enc.Wire) ([]byte, error) {
27+
return ed25519.Sign(s.key, covered.Join()), nil
28+
}
29+
30+
// NewEdSigner creates a signer using ed25519 key
31+
func NewEdSigner(
32+
forCert bool, forInt bool, expireTime time.Duration, key ed25519.PrivateKey,
33+
keyLocatorName enc.Name,
34+
) ndn.Signer {
35+
return &edSigner{
36+
asymSigner: asymSigner{
37+
timer: basic_engine.Timer{},
38+
seq: 0,
39+
keyLocatorName: keyLocatorName,
40+
forCert: forCert,
41+
forInt: forInt,
42+
certExpireTime: expireTime,
43+
},
44+
key: key,
45+
}
46+
}
47+
48+
// Ed25519DerivePubKey derives the public key from a private key.
49+
func Ed25519DerivePubKey(privKey ed25519.PrivateKey) ed25519.PublicKey {
50+
return ed25519.PublicKey(privKey[ed25519.PublicKeySize:])
51+
}

‎std/security/rsa-signer.go

+15-33
Original file line numberDiff line numberDiff line change
@@ -9,38 +9,17 @@ import (
99
enc "github.com/named-data/ndnd/std/encoding"
1010
basic_engine "github.com/named-data/ndnd/std/engine/basic"
1111
"github.com/named-data/ndnd/std/ndn"
12-
"github.com/named-data/ndnd/std/utils"
1312
)
1413

1514
// rsaSigner is a signer that uses ECC key to sign packets.
1615
type rsaSigner struct {
17-
timer ndn.Timer
18-
seq uint64
19-
20-
keyLocatorName enc.Name
21-
key *rsa.PrivateKey
22-
keyLen uint
23-
forCert bool
24-
forInt bool
25-
certExpireTime time.Duration
16+
asymSigner
17+
keyLen uint
18+
key *rsa.PrivateKey
2619
}
2720

2821
func (s *rsaSigner) SigInfo() (*ndn.SigConfig, error) {
29-
ret := &ndn.SigConfig{
30-
Type: ndn.SignatureSha256WithEcdsa,
31-
KeyName: s.keyLocatorName,
32-
}
33-
if s.forCert {
34-
ret.NotBefore = utils.IdPtr(s.timer.Now())
35-
ret.NotAfter = utils.IdPtr(s.timer.Now().Add(s.certExpireTime))
36-
}
37-
if s.forInt {
38-
s.seq++
39-
ret.Nonce = s.timer.Nonce()
40-
ret.SigTime = utils.IdPtr(s.timer.Now())
41-
ret.SeqNum = utils.IdPtr(s.seq)
42-
}
43-
return ret, nil
22+
return s.genSigInfo(ndn.SignatureSha256WithRsa)
4423
}
4524

4625
func (s *rsaSigner) EstimateSize() uint {
@@ -66,13 +45,16 @@ func NewRsaSigner(
6645
) ndn.Signer {
6746
keyLen := uint(key.Size())
6847
return &rsaSigner{
69-
timer: basic_engine.Timer{},
70-
seq: 0,
71-
keyLocatorName: keyLocatorName,
72-
key: key,
73-
keyLen: keyLen,
74-
forCert: forCert,
75-
forInt: forInt,
76-
certExpireTime: expireTime,
48+
asymSigner: asymSigner{
49+
timer: basic_engine.Timer{},
50+
seq: 0,
51+
keyLocatorName: keyLocatorName,
52+
53+
forCert: forCert,
54+
forInt: forInt,
55+
certExpireTime: expireTime,
56+
},
57+
key: key,
58+
keyLen: keyLen,
7759
}
7860
}

‎std/security/signers_test.go

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
package security_test
2+
3+
import (
4+
"crypto/ed25519"
5+
"crypto/x509"
6+
"encoding/base64"
7+
"testing"
8+
"time"
9+
10+
enc "github.com/named-data/ndnd/std/encoding"
11+
"github.com/named-data/ndnd/std/ndn"
12+
"github.com/named-data/ndnd/std/ndn/spec_2022"
13+
"github.com/named-data/ndnd/std/security"
14+
"github.com/named-data/ndnd/std/utils"
15+
"github.com/stretchr/testify/require"
16+
)
17+
18+
func TestEddsaSignerBasic(t *testing.T) {
19+
utils.SetTestingT(t)
20+
21+
keyLocatorName := utils.WithoutErr(enc.NameFromStr("/test/KEY/1"))
22+
edkeybits := ed25519.NewKeyFromSeed([]byte("01234567890123456789012345678901"))
23+
signer := security.NewEdSigner(
24+
false, false, 0, edkeybits, keyLocatorName,
25+
)
26+
27+
require.Equal(t, uint(ed25519.SignatureSize), signer.EstimateSize())
28+
signInfo := utils.WithoutErr(signer.SigInfo())
29+
require.Equal(t, 0, signInfo.KeyName.Compare(keyLocatorName))
30+
require.Equal(t, ndn.SignatureEd25519, signInfo.Type)
31+
32+
dataVal := enc.Wire{[]byte(
33+
"\x07\x14\x08\x05local\x08\x03ndn\x08\x06prefix" +
34+
"\x14\x03\x18\x01\x00")}
35+
sigValue := utils.WithoutErr(signer.ComputeSigValue(dataVal))
36+
37+
// For basic test, we use ed25519.Verify to verify the signature.
38+
require.True(t, ed25519.Verify(security.Ed25519DerivePubKey(edkeybits), dataVal.Join(), sigValue))
39+
}
40+
41+
func TestEddsaSignerCertificate(t *testing.T) {
42+
utils.SetTestingT(t)
43+
44+
spec := spec_2022.Spec{}
45+
46+
keyLocatorName := utils.WithoutErr(enc.NameFromStr("/test/KEY/1"))
47+
certName := utils.WithoutErr(enc.NameFromStr("/test/KEY/1/self/1"))
48+
edkeybits := ed25519.NewKeyFromSeed([]byte("01234567890123456789012345678901"))
49+
signer := security.NewEdSigner(
50+
false, false, 3600*time.Second, edkeybits, keyLocatorName,
51+
)
52+
pubKey := security.Ed25519DerivePubKey(edkeybits)
53+
pubKeyBits := utils.WithoutErr(x509.MarshalPKIXPublicKey(pubKey))
54+
55+
cert := utils.WithoutErr(spec.MakeData(certName, &ndn.DataConfig{
56+
ContentType: utils.IdPtr(ndn.ContentTypeKey),
57+
Freshness: utils.IdPtr(3600 * time.Second),
58+
}, enc.Wire{pubKeyBits}, signer))
59+
60+
data, covered, err := spec.ReadData(enc.NewWireReader(cert.Wire))
61+
require.NoError(t, err)
62+
63+
pubKeyParsedBits := data.Content().Join()
64+
pubKeyParsedUntyped := utils.WithoutErr(x509.ParsePKIXPublicKey(pubKeyParsedBits))
65+
if pubKeyParsed := pubKeyParsedUntyped.(ed25519.PublicKey); pubKeyParsed != nil {
66+
require.True(t, security.EddsaValidate(covered, data.Signature(), pubKeyParsed))
67+
} else {
68+
require.Fail(t, "unexpected public key type")
69+
}
70+
}
71+
72+
// TestEddsaSignerCertificate2 tests the validator using a given certificate for interoperability.
73+
func TestEddsaSignerCertificate2(t *testing.T) {
74+
utils.SetTestingT(t)
75+
76+
const TestCert = `
77+
Bv0BCgc1CAxFZDI1NTE5LWRlbW8IA0tFWQgQNWE2MTVkYjdjZjA2MDNiNQgEc2Vs
78+
ZjYIAAABgQD8AY0UCRgBAhkEADbugBUsMCowBQYDK2VwAyEAQxUZBL+3I3D4oDIJ
79+
tJvuCTguHM7AUbhlhA/wu8ZhrkwWVhsBBRwnByUIDEVkMjU1MTktZGVtbwgDS0VZ
80+
CBA1YTYxNWRiN2NmMDYwM2I1/QD9Jv0A/g8xOTcwMDEwMVQwMDAwMDD9AP8PMjAy
81+
MjA1MjZUMTUyODQ0F0DAAWCZzxQSCAV0tluFDry5aT1b+EgoYgT1JKxbKVb/tINx
82+
M43PFy/2hDe8j61PuYD9tCah0TWapPwfXWi3fygA`
83+
spec := spec_2022.Spec{}
84+
85+
certWire := utils.WithoutErr(base64.RawStdEncoding.DecodeString(TestCert))
86+
certData, covered, err := spec.ReadData(enc.NewBufferReader(certWire))
87+
require.NoError(t, err)
88+
89+
pubKeyBits := utils.WithoutErr(x509.ParsePKIXPublicKey(certData.Content().Join()))
90+
pubKey := pubKeyBits.(ed25519.PublicKey)
91+
if pubKey == nil {
92+
require.Fail(t, "unexpected public key type")
93+
}
94+
require.True(t, security.EddsaValidate(covered, certData.Signature(), pubKey))
95+
}

0 commit comments

Comments
 (0)