quantus/common
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Remove support for encrypt/decrypt on keypair (#1762)

Browse Source 
* Remove support for encrypt/decrupt on keypair

* Update Keypair type

* Remove encrypt/decrypt tests

* Remove ed2curve dependency

* Remove export

* Adjust nobody
This commit is contained in:
Jaco
2023-03-14 09:41:49 +02:00
committed by GitHub
parent 6d1944bef9
commit b22b225252
9 changed files with 8 additions and 228 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/keyring/src/pair/index.spec.ts
-108
View File
@@ -18,10 +18,6 @@ await cryptoWaitReady();
describe('pair', (): void => {
const SIGNATURE = new Uint8Array([80, 191, 198, 147, 225, 207, 75, 88, 126, 39, 129, 109, 191, 38, 72, 181, 75, 254, 81, 143, 244, 79, 237, 38, 236, 141, 28, 252, 134, 26, 169, 234, 79, 33, 153, 158, 151, 34, 175, 188, 235, 20, 35, 135, 83, 120, 139, 211, 233, 130, 1, 208, 201, 215, 73, 80, 56, 98, 185, 196, 11, 8, 193, 14]);
const ENCRYPTED = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 132, 59, 53, 85, 227, 40, 107, 48, 234, 198, 238, 157, 238, 224, 235, 179, 75, 153, 241, 142, 254]);
// the last byte is changed from 254 -> 253
const ENCRYPTED_CHANGED = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 132, 59, 53, 85, 227, 40, 107, 48, 234, 198, 238, 157, 238, 224, 235, 179, 75, 153, 241, 142, 253]);
it('has a publicKey', (): void => {
expect(
@@ -98,93 +94,6 @@ describe('pair', (): void => {
).toBe(false);
});
it('allows encrypting', (): void => {
const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
expect(
keyring.alice.encryptMessage(
message,
keyring.bob.publicKey,
new Uint8Array(24)
)
).toEqual(ENCRYPTED);
});
it('validates a correctly encrypted message', (): void => {
const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
expect(
keyring.bob.decryptMessage(
ENCRYPTED,
keyring.alice.publicKey
)
).toEqual(message);
});
it('fails a correctly encrypted message (message changed)', (): void => {
expect(
keyring.bob.decryptMessage(
ENCRYPTED_CHANGED,
keyring.alice.publicKey
)
).toEqual(null);
});
it('fails a correctly encrypted message (sender changed)', (): void => {
expect(
keyring.bob.decryptMessage(
ENCRYPTED,
keyring.charlie.publicKey
)
).toEqual(null);
});
it('fails a correctly encrypted message (receiver changed)', (): void => {
expect(
keyring.charlie.decryptMessage(
ENCRYPTED,
keyring.alice.publicKey
)
).toEqual(null);
});
it('validates encryption between ed25519 & sr25519 key pairs', (): void => {
const PASS = 'testing';
const encodedA = keyring.alice.encodePkcs8(PASS);
const encodedB = keyring.bob.encodePkcs8(PASS);
const pairA = createPair({ toSS58, type: 'sr25519' }, { publicKey: keyring.alice.publicKey });
const pairB = createPair({ toSS58, type: 'sr25519' }, { publicKey: keyring.bob.publicKey });
pairA.decodePkcs8(PASS, encodedA);
pairB.decodePkcs8(PASS, encodedB);
const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
// alice-sr25519 -> bob-ed25519
const encrypted1 = pairA.encryptMessage(message, keyring.bob.publicKey);
// alice-sr25519 -> bob-sr25519
const encrypted2 = pairA.encryptMessage(message, pairB.publicKey);
// alice-ed25519 -> bob-sr25519
const encrypted3 = keyring.alice.encryptMessage(message, pairB.publicKey);
// decrypt: Bob-ed25519 - use alice-ed25519 pubkey
expect(
keyring.bob.decryptMessage(encrypted3, keyring.alice.publicKey)
).toEqual(message);
// decrypt: Bob-ed25519 - use alice-sr25519 pubkey
expect(
keyring.bob.decryptMessage(encrypted1, pairA.publicKey)
).toEqual(message);
// decrypt: Bob-sr25519 - use alice-sr25519 pubkey
expect(
pairB.decryptMessage(encrypted2, pairA.publicKey)
).toEqual(message);
});
it('allows setting/getting of meta', (): void => {
keyring.bob.setMeta({ foo: 'bar', something: 'else' });
@@ -276,22 +185,5 @@ describe('pair', (): void => {
});
expect(json.address).toEqual(u8aToHex(PUBLICDERIVED));
});
it('denies access to encryptMessage/decryptMessage API', (): void => {
const PASS = 'testing';
const encoded = keyring.alice.encodePkcs8(PASS);
const pair = createPair({ toSS58, type: 'ethereum' }, { publicKey: keyring.alice.publicKey });
pair.decodePkcs8(PASS, encoded);
expect(
() => pair.encryptMessage(
new Uint8Array(4), // null message
keyring.bob.publicKey,
new Uint8Array(24)
)
).toThrow('Secp256k1 not supported yet');
});
});
});
packages/keyring/src/pair/index.ts
+1 -28
View File
@@ -7,7 +7,7 @@ import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta, SignOptions } fro
import type { PairInfo } from './types.js';
import { objectSpread, u8aConcat, u8aEmpty, u8aEq, u8aToHex, u8aToU8a } from '@polkadot/util';
import { blake2AsU8a, convertPublicKeyToCurve25519, convertSecretKeyToCurve25519, ed25519PairFromSeed as ed25519FromSeed, ed25519Sign, ethereumEncode, keccakAsU8a, keyExtractPath, keyFromPath, naclOpen, naclSeal, secp256k1Compress, secp256k1Expand, secp256k1PairFromSeed as secp256k1FromSeed, secp256k1Sign, signatureVerify, sr25519PairFromSeed as sr25519FromSeed, sr25519Sign, sr25519VrfSign, sr25519VrfVerify } from '@polkadot/util-crypto';
import { blake2AsU8a, ed25519PairFromSeed as ed25519FromSeed, ed25519Sign, ethereumEncode, keccakAsU8a, keyExtractPath, keyFromPath, secp256k1Compress, secp256k1Expand, secp256k1PairFromSeed as secp256k1FromSeed, secp256k1Sign, signatureVerify, sr25519PairFromSeed as sr25519FromSeed, sr25519Sign, sr25519VrfSign, sr25519VrfVerify } from '@polkadot/util-crypto';
import { decodePair } from './decode.js';
import { encodePair } from './encode.js';
@@ -144,22 +144,6 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
},
// eslint-disable-next-line sort-keys
decodePkcs8,
decryptMessage: (encryptedMessageWithNonce: HexString | string | Uint8Array, senderPublicKey: HexString | string | Uint8Array): Uint8Array | null => {
if (isLocked(secretKey)) {
throw new Error('Cannot encrypt with a locked key pair');
} else if (['ecdsa', 'ethereum'].includes(type)) {
throw new Error('Secp256k1 not supported yet');
}
const messageU8a = u8aToU8a(encryptedMessageWithNonce);
return naclOpen(
messageU8a.slice(24, messageU8a.length),
messageU8a.slice(0, 24),
convertPublicKeyToCurve25519(u8aToU8a(senderPublicKey)),
convertSecretKeyToCurve25519(secretKey)
);
},
derive: (suri: string, meta?: KeyringPair$Meta): KeyringPair => {
if (type === 'ethereum') {
throw new Error('Unable to derive on this keypair');
@@ -175,17 +159,6 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
encodePkcs8: (passphrase?: string): Uint8Array => {
return recode(passphrase);
},
encryptMessage: (message: HexString | string | Uint8Array, recipientPublicKey: HexString | string | Uint8Array, nonceIn?: Uint8Array): Uint8Array => {
if (isLocked(secretKey)) {
throw new Error('Cannot encrypt with a locked key pair');
} else if (['ecdsa', 'ethereum'].includes(type)) {
throw new Error('Secp256k1 not supported yet');
}
const { nonce, sealed } = naclSeal(u8aToU8a(message), convertSecretKeyToCurve25519(secretKey), convertPublicKeyToCurve25519(u8aToU8a(recipientPublicKey)), nonceIn);
return u8aConcat(nonce, sealed);
},
lock: (): void => {
secretKey = new Uint8Array();
},
packages/keyring/src/pair/nobody.ts
-6
View File
@@ -32,17 +32,11 @@ const pair: KeyringPair = {
decodePkcs8: (passphrase?: string, encoded?: Uint8Array): void =>
undefined,
// eslint-disable-next-line @typescript-eslint/no-unused-vars
decryptMessage: (encryptedMessageWithNonce: string | Uint8Array, senderPublicKey: string | Uint8Array): Uint8Array | null =>
null,
// eslint-disable-next-line @typescript-eslint/no-unused-vars
derive: (suri: string, meta?: KeyringPair$Meta): KeyringPair =>
pair,
// eslint-disable-next-line @typescript-eslint/no-unused-vars
encodePkcs8: (passphrase?: string): Uint8Array =>
new Uint8Array(0),
// eslint-disable-next-line @typescript-eslint/no-unused-vars
encryptMessage: (message: string | Uint8Array, recipientPublicKey: string | Uint8Array, _nonce?: Uint8Array): Uint8Array =>
new Uint8Array(),
isLocked: true,
lock: (): void => {
// no locking, it is always locked
packages/keyring/src/types.ts
-2
View File
@@ -47,8 +47,6 @@ export interface KeyringPair {
sign (message: HexString | string | Uint8Array, options?: SignOptions): Uint8Array;
toJson (passphrase?: string): KeyringPair$Json;
unlock (passphrase?: string): void;
encryptMessage (message: HexString | string | Uint8Array, recipientPublicKey: HexString | string | Uint8Array, nonce?: Uint8Array): Uint8Array;
decryptMessage (encryptedMessageWithNonce: HexString | string | Uint8Array, senderPublicKey: HexString | string | Uint8Array): Uint8Array | null;
verify (message: HexString | string | Uint8Array, signature: Uint8Array, signerPublic: HexString | string | Uint8Array): boolean;
vrfSign (message: HexString | string | Uint8Array, context?: HexString | string | Uint8Array, extra?: HexString | string | Uint8Array): Uint8Array;
vrfVerify (message: HexString | string | Uint8Array, vrfResult: Uint8Array, signerPublic: HexString | Uint8Array | string, context?: HexString | string | Uint8Array, extra?: HexString | string | Uint8Array): boolean;
packages/util-crypto/package.json
-4
View File
@@ -37,13 +37,9 @@
"@polkadot/x-bigint": "11.0.3-1-x",
"@polkadot/x-randomvalues": "11.0.3-1-x",
"@scure/base": "1.1.1",
"ed2curve": "^0.3.0",
"tslib": "^2.5.0",
"tweetnacl": "^1.0.3"
},
"devDependencies": {
"@types/ed2curve": "^0.2.2"
},
"peerDependencies": {
"@polkadot/util": "11.0.3-1-x"
}
packages/util-crypto/src/ed25519/convertKey.spec.ts
-38
View File
@@ -1,38 +0,0 @@
// Copyright 2017-2023 @polkadot/util-crypto authors & contributors
// SPDX-License-Identifier: Apache-2.0
/// <reference types="@polkadot/dev/node/test/node.d.ts" />
import { u8aToHex } from '@polkadot/util';
import { convertPublicKeyToCurve25519, convertSecretKeyToCurve25519 } from './index.js';
describe('convertPublicKeyToCurve25519', (): void => {
it('converts a known key correctly', (): void => {
expect(
u8aToHex(convertPublicKeyToCurve25519(
new Uint8Array([
180, 114, 93, 155, 165, 255, 217, 82,
16, 250, 209, 11, 193, 10, 88, 218,
190, 190, 41, 193, 236, 252, 1, 152,
216, 214, 0, 41, 45, 138, 13, 53
])
))
).toEqual('0x5e05848ceeef4f306d6e285a26faf1a8070cf0c89f8d28ab966002fe4ad17746');
});
});
describe('convertSecretKeyToCurve25519', (): void => {
it('converts a known key correctly', (): void => {
expect(
u8aToHex(convertSecretKeyToCurve25519(
new Uint8Array([
1, 2, 3, 4, 5, 6, 7, 8,
1, 2, 3, 4, 5, 6, 7, 8,
1, 2, 3, 4, 5, 6, 7, 8,
1, 2, 3, 4, 5, 6, 7, 8
])
))
).toEqual('0xd875a82940b9174dabb1c0c895485810cc2870f5808565b59d4ef708bdcf526c');
});
});
packages/util-crypto/src/ed25519/convertKey.ts
-14
View File
@@ -1,14 +0,0 @@
// Copyright 2017-2023 @polkadot/util-crypto authors & contributors
// SPDX-License-Identifier: Apache-2.0
import ed2curve from 'ed2curve';
import { assertReturn } from '@polkadot/util';
export function convertSecretKeyToCurve25519 (secretKey: Uint8Array): Uint8Array {
return ed2curve.convertSecretKey(secretKey);
}
export function convertPublicKeyToCurve25519 (publicKey: Uint8Array): Uint8Array {
return assertReturn(ed2curve.convertPublicKey(publicKey), 'Unable to convert publicKey to ed25519');
}
packages/util-crypto/src/ed25519/index.ts
-1
View File
@@ -4,7 +4,6 @@
/**
* @summary Implements ed25519 operations
*/
export { convertPublicKeyToCurve25519, convertSecretKeyToCurve25519 } from './convertKey.js';
export { ed25519DeriveHard } from './deriveHard.js';
export { ed25519PairFromRandom } from './pair/fromRandom.js';
export { ed25519PairFromSecret } from './pair/fromSecret.js';
yarn.lock
+7 -27
View File
@@ -814,8 +814,6 @@ __metadata:
"@polkadot/x-bigint": 11.0.3-1-x
"@polkadot/x-randomvalues": 11.0.3-1-x
"@scure/base": 1.1.1
"@types/ed2curve": ^0.2.2
ed2curve: ^0.3.0
tslib: ^2.5.0
tweetnacl: ^1.0.3
peerDependencies:
@@ -1200,15 +1198,6 @@ __metadata:
languageName: node
linkType: hard
"@types/ed2curve@npm:^0.2.2":
version: 0.2.2
resolution: "@types/ed2curve@npm:0.2.2"
dependencies:
tweetnacl: ^1.0.0
checksum: f1ab16d46c5eed50d51539effef76c87806bb53ab45ecff78c19a632e63825fd08d604984b08778f8201c79be0bd43120565dad38cc5d45ba65a6c7de5bf4ace
languageName: node
linkType: hard
"@types/eslint-scope@npm:^3.7.3":
version: 3.7.4
resolution: "@types/eslint-scope@npm:3.7.4"
@@ -3627,15 +3616,6 @@ __metadata:
languageName: node
linkType: hard
"ed2curve@npm:^0.3.0":
version: 0.3.0
resolution: "ed2curve@npm:0.3.0"
dependencies:
tweetnacl: 1.x.x
checksum: 6dfbe2310aa5a47372c9dd2fd920be140c8d52aea5793d716a3e3865d2ceaeaf639a7653e5492dfe3b4910eaf65c09a1d5132580afe2fdca18a75ebb428a52f2
languageName: node
linkType: hard
"ee-first@npm:1.1.1":
version: 1.1.1
resolution: "ee-first@npm:1.1.1"
@@ -8936,13 +8916,6 @@ fsevents@~2.3.2:
languageName: node
linkType: hard
"tweetnacl@npm:1.x.x, tweetnacl@npm:^1.0.0, tweetnacl@npm:^1.0.3":
version: 1.0.3
resolution: "tweetnacl@npm:1.0.3"
checksum: e4a57cac188f0c53f24c7a33279e223618a2bfb5fea426231991652a13247bea06b081fd745d71291fcae0f4428d29beba1b984b1f1ce6f66b06a6d1ab90645c
languageName: node
linkType: hard
"tweetnacl@npm:^0.14.3, tweetnacl@npm:~0.14.0":
version: 0.14.5
resolution: "tweetnacl@npm:0.14.5"
@@ -8950,6 +8923,13 @@ fsevents@~2.3.2:
languageName: node
linkType: hard
"tweetnacl@npm:^1.0.3":
version: 1.0.3
resolution: "tweetnacl@npm:1.0.3"
checksum: e4a57cac188f0c53f24c7a33279e223618a2bfb5fea426231991652a13247bea06b081fd745d71291fcae0f4428d29beba1b984b1f1ce6f66b06a6d1ab90645c
languageName: node
linkType: hard
"type-check@npm:^0.4.0, type-check@npm:~0.4.0":
version: 0.4.0
resolution: "type-check@npm:0.4.0"