Compare commits
3 Commits
666cf52755
...
cleverwild
| Author | SHA1 | Date | |
|---|---|---|---|
|
3db7ece6c0 | ||
|
|
d49c39130a | ||
|
|
c722712166 |
282
server/Cargo.lock
generated
282
server/Cargo.lock
generated
@@ -504,7 +504,7 @@ dependencies = [
|
||||
"async-trait",
|
||||
"auto_impl",
|
||||
"either",
|
||||
"elliptic-curve",
|
||||
"elliptic-curve 0.13.8",
|
||||
"k256",
|
||||
"thiserror",
|
||||
]
|
||||
@@ -772,7 +772,6 @@ dependencies = [
|
||||
"prost-types",
|
||||
"rand 0.10.1",
|
||||
"rand_core 0.10.1",
|
||||
"rand_core 0.6.4",
|
||||
"rcgen",
|
||||
"restructed",
|
||||
"rstest",
|
||||
@@ -823,7 +822,7 @@ dependencies = [
|
||||
"ark-serialize 0.3.0",
|
||||
"ark-std 0.3.0",
|
||||
"derivative",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"paste",
|
||||
"rustc_version 0.3.3",
|
||||
@@ -843,7 +842,7 @@ dependencies = [
|
||||
"derivative",
|
||||
"digest 0.10.7",
|
||||
"itertools 0.10.5",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"paste",
|
||||
"rustc_version 0.4.1",
|
||||
@@ -864,7 +863,7 @@ dependencies = [
|
||||
"digest 0.10.7",
|
||||
"educe",
|
||||
"itertools 0.13.0",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"paste",
|
||||
"zeroize",
|
||||
@@ -906,7 +905,7 @@ version = "0.3.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "db2fd794a08ccb318058009eefdf15bcaaaaf6f8161eb3345f907222bac38b20"
|
||||
dependencies = [
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"quote",
|
||||
"syn 1.0.109",
|
||||
@@ -918,7 +917,7 @@ version = "0.4.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7abe79b0e4288889c4574159ab790824d0033b9fdcb2a112a3182fac2e514565"
|
||||
dependencies = [
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
@@ -931,7 +930,7 @@ version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09be120733ee33f7693ceaa202ca41accd5653b779563608f1234f78ae07c4b3"
|
||||
dependencies = [
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
@@ -956,7 +955,7 @@ checksum = "adb7b85a02b83d2f22f89bd5cac66c9c89474240cb6207cb1efc16d098e822a5"
|
||||
dependencies = [
|
||||
"ark-std 0.4.0",
|
||||
"digest 0.10.7",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -968,7 +967,7 @@ dependencies = [
|
||||
"ark-std 0.5.0",
|
||||
"arrayvec",
|
||||
"digest 0.10.7",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1198,6 +1197,12 @@ version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
|
||||
|
||||
[[package]]
|
||||
name = "base16ct"
|
||||
version = "1.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
|
||||
|
||||
[[package]]
|
||||
name = "base64"
|
||||
version = "0.22.1"
|
||||
@@ -1555,6 +1560,12 @@ version = "0.8.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
|
||||
|
||||
[[package]]
|
||||
name = "cpubits"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.2.17"
|
||||
@@ -1617,20 +1628,22 @@ checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
|
||||
dependencies = [
|
||||
"generic-array 0.14.7",
|
||||
"rand_core 0.6.4",
|
||||
"serdect 0.2.0",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "crypto-bigint"
|
||||
version = "0.6.1"
|
||||
version = "0.7.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "96272c2ff28b807e09250b180ad1fb7889a3258f7455759b5c3c58b719467130"
|
||||
checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
|
||||
dependencies = [
|
||||
"cpubits",
|
||||
"ctutils",
|
||||
"hybrid-array",
|
||||
"num-traits",
|
||||
"rand_core 0.6.4",
|
||||
"serdect 0.3.0",
|
||||
"rand_core 0.10.1",
|
||||
"serdect 0.4.3",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
@@ -1663,6 +1676,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
|
||||
dependencies = [
|
||||
"cmov",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1825,7 +1839,7 @@ dependencies = [
|
||||
"asn1-rs",
|
||||
"displaydoc",
|
||||
"nom",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-traits",
|
||||
"rusticata-macros",
|
||||
]
|
||||
@@ -2022,7 +2036,7 @@ checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
|
||||
dependencies = [
|
||||
"der 0.7.10",
|
||||
"digest 0.10.7",
|
||||
"elliptic-curve",
|
||||
"elliptic-curve 0.13.8",
|
||||
"rfc6979",
|
||||
"serdect 0.2.0",
|
||||
"signature 2.2.0",
|
||||
@@ -2056,34 +2070,50 @@ version = "0.13.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
|
||||
dependencies = [
|
||||
"base16ct",
|
||||
"base16ct 0.2.0",
|
||||
"crypto-bigint 0.5.5",
|
||||
"digest 0.10.7",
|
||||
"ff",
|
||||
"ff 0.13.1",
|
||||
"generic-array 0.14.7",
|
||||
"group",
|
||||
"hkdf",
|
||||
"group 0.13.0",
|
||||
"pkcs8 0.10.2",
|
||||
"rand_core 0.6.4",
|
||||
"sec1",
|
||||
"sec1 0.7.3",
|
||||
"serdect 0.2.0",
|
||||
"subtle",
|
||||
"tap",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "elliptic-curve"
|
||||
version = "0.14.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
|
||||
dependencies = [
|
||||
"base16ct 1.0.0",
|
||||
"crypto-bigint 0.7.5",
|
||||
"crypto-common 0.2.1",
|
||||
"ff 0.14.0",
|
||||
"group 0.14.0",
|
||||
"hybrid-array",
|
||||
"pkcs8 0.11.0",
|
||||
"rand_core 0.10.1",
|
||||
"sec1 0.8.1",
|
||||
"serdect 0.4.3",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "elliptic-curve-tools"
|
||||
version = "0.2.0"
|
||||
version = "0.3.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1de2b6fae800f08032a6ea32995b52925b1d451bff9d445c8ab2932323277faf"
|
||||
checksum = "7a0d5e534f103b079a71ef1d66c6e62c89413f1b62709ca11f744429b4afe5b4"
|
||||
dependencies = [
|
||||
"elliptic-curve",
|
||||
"elliptic-curve 0.14.1",
|
||||
"heapless",
|
||||
"hex",
|
||||
"multiexp",
|
||||
"serde",
|
||||
"zeroize",
|
||||
"serdect 0.4.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -2156,11 +2186,20 @@ version = "0.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
|
||||
dependencies = [
|
||||
"bitvec",
|
||||
"rand_core 0.6.4",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ff"
|
||||
version = "0.14.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
|
||||
dependencies = [
|
||||
"rand_core 0.10.1",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fiat-crypto"
|
||||
version = "0.2.9"
|
||||
@@ -2427,11 +2466,22 @@ version = "0.13.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
|
||||
dependencies = [
|
||||
"ff",
|
||||
"ff 0.13.1",
|
||||
"rand_core 0.6.4",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "group"
|
||||
version = "0.14.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
|
||||
dependencies = [
|
||||
"ff 0.14.0",
|
||||
"rand_core 0.10.1",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "h2"
|
||||
version = "0.4.13"
|
||||
@@ -2502,9 +2552,9 @@ checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
|
||||
|
||||
[[package]]
|
||||
name = "heapless"
|
||||
version = "0.8.0"
|
||||
version = "0.9.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
|
||||
checksum = "25ba4bd83f9415b58b4ed8dc5714c76e626a105be4646c02630ad730ad3b5aa4"
|
||||
dependencies = [
|
||||
"hash32",
|
||||
"stable_deref_trait",
|
||||
@@ -2537,15 +2587,6 @@ dependencies = [
|
||||
"arrayvec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hkdf"
|
||||
version = "0.12.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
|
||||
dependencies = [
|
||||
"hmac 0.12.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hmac"
|
||||
version = "0.12.1"
|
||||
@@ -2611,12 +2652,13 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
|
||||
|
||||
[[package]]
|
||||
name = "hybrid-array"
|
||||
version = "0.4.11"
|
||||
version = "0.4.15"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
|
||||
checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
|
||||
dependencies = [
|
||||
"ctutils",
|
||||
"serde",
|
||||
"subtle",
|
||||
"typenum",
|
||||
"zeroize",
|
||||
]
|
||||
@@ -3019,7 +3061,7 @@ checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"ecdsa",
|
||||
"elliptic-curve",
|
||||
"elliptic-curve 0.13.8",
|
||||
"once_cell",
|
||||
"serdect 0.2.0",
|
||||
"sha2 0.10.9",
|
||||
@@ -3363,20 +3405,6 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "multiexp"
|
||||
version = "0.4.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7ec2ce93a6f06ac6cae04c1da3f2a6a24fcfc1f0eb0b4e0f3d302f0df45326cb"
|
||||
dependencies = [
|
||||
"ff",
|
||||
"group",
|
||||
"rand_core 0.6.4",
|
||||
"rustversion",
|
||||
"std-shims",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "multimap"
|
||||
version = "0.10.1"
|
||||
@@ -3408,20 +3436,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
|
||||
dependencies = [
|
||||
"num-bigint",
|
||||
"num-complex",
|
||||
"num-integer",
|
||||
"num-iter",
|
||||
"num-rational",
|
||||
"num-traits",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-bigint"
|
||||
version = "0.4.6"
|
||||
@@ -3430,18 +3444,16 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
|
||||
dependencies = [
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
"rand 0.8.6",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-complex"
|
||||
version = "0.4.6"
|
||||
name = "num-bigint"
|
||||
version = "0.5.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
|
||||
checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
|
||||
dependencies = [
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
"rand 0.8.6",
|
||||
"serde",
|
||||
]
|
||||
|
||||
@@ -3460,28 +3472,6 @@ dependencies = [
|
||||
"num-traits",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-iter"
|
||||
version = "0.1.46"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
|
||||
dependencies = [
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-rational"
|
||||
version = "0.4.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
|
||||
dependencies = [
|
||||
"num-bigint",
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-traits"
|
||||
version = "0.2.19"
|
||||
@@ -4361,7 +4351,7 @@ dependencies = [
|
||||
"bytes",
|
||||
"fastrlp 0.3.1",
|
||||
"fastrlp 0.4.0",
|
||||
"num-bigint",
|
||||
"num-bigint 0.4.6",
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
"parity-scale-codec",
|
||||
@@ -4588,7 +4578,7 @@ version = "0.7.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
|
||||
dependencies = [
|
||||
"base16ct",
|
||||
"base16ct 0.2.0",
|
||||
"der 0.7.10",
|
||||
"generic-array 0.14.7",
|
||||
"pkcs8 0.10.2",
|
||||
@@ -4597,6 +4587,21 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sec1"
|
||||
version = "0.8.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
|
||||
dependencies = [
|
||||
"base16ct 1.0.0",
|
||||
"ctutils",
|
||||
"der 0.8.0",
|
||||
"hybrid-array",
|
||||
"serdect 0.4.3",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "secp256k1"
|
||||
version = "0.30.0"
|
||||
@@ -4754,17 +4759,17 @@ version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
|
||||
dependencies = [
|
||||
"base16ct",
|
||||
"base16ct 0.2.0",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serdect"
|
||||
version = "0.3.0"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
|
||||
checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
|
||||
dependencies = [
|
||||
"base16ct",
|
||||
"base16ct 1.0.0",
|
||||
"serde",
|
||||
]
|
||||
|
||||
@@ -4810,6 +4815,17 @@ dependencies = [
|
||||
"keccak 0.2.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha3"
|
||||
version = "0.12.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
|
||||
dependencies = [
|
||||
"digest 0.11.2",
|
||||
"keccak 0.2.0",
|
||||
"sponge-cursor",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha3-asm"
|
||||
version = "0.1.6"
|
||||
@@ -4820,6 +4836,17 @@ dependencies = [
|
||||
"cfg-if",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "shake"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
|
||||
dependencies = [
|
||||
"digest 0.11.2",
|
||||
"keccak 0.2.0",
|
||||
"sponge-cursor",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sharded-slab"
|
||||
version = "0.1.7"
|
||||
@@ -4933,12 +4960,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "spin"
|
||||
version = "0.10.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
|
||||
|
||||
[[package]]
|
||||
name = "spki"
|
||||
version = "0.7.3"
|
||||
@@ -4959,6 +4980,12 @@ dependencies = [
|
||||
"der 0.8.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sponge-cursor"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
|
||||
|
||||
[[package]]
|
||||
name = "sqlite-wasm-rs"
|
||||
version = "0.5.3"
|
||||
@@ -4983,17 +5010,6 @@ version = "1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
|
||||
|
||||
[[package]]
|
||||
name = "std-shims"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "227c4f8561598188d0df96dbe749824576174bba278b5b6bb2eacff1066067d0"
|
||||
dependencies = [
|
||||
"hashbrown 0.16.1",
|
||||
"rustversion",
|
||||
"spin",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "string_morph"
|
||||
version = "0.1.0"
|
||||
@@ -5750,21 +5766,23 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
||||
|
||||
[[package]]
|
||||
name = "vsss-rs"
|
||||
version = "5.4.0"
|
||||
version = "6.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ec751bdcc8bda099e269b24cc6b4ad14f9ce8b0490c1599174070e792ecd70c"
|
||||
checksum = "d6bfc736cfd88115aedb95ba84bc2d428fe351e92a56f69fce090af301402d91"
|
||||
dependencies = [
|
||||
"crypto-bigint 0.5.5",
|
||||
"crypto-bigint 0.6.1",
|
||||
"elliptic-curve",
|
||||
"crypto-bigint 0.7.5",
|
||||
"elliptic-curve 0.14.1",
|
||||
"elliptic-curve-tools",
|
||||
"ff 0.14.0",
|
||||
"generic-array 1.4.2",
|
||||
"hex",
|
||||
"hybrid-array",
|
||||
"num",
|
||||
"rand_core 0.6.4",
|
||||
"num-bigint 0.5.1",
|
||||
"num-traits",
|
||||
"rand_core 0.10.1",
|
||||
"serde",
|
||||
"sha3 0.10.9",
|
||||
"sha3 0.12.0",
|
||||
"shake",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
@@ -78,7 +78,7 @@ pub_underscore_fields = "allow"
|
||||
redundant_pub_crate = "allow"
|
||||
uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
|
||||
too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
|
||||
unused_async_trait_impl = "allow" # to pedantic
|
||||
unused_async_trait_impl = "allow" # too pedantic
|
||||
|
||||
# restriction lints
|
||||
alloc_instead_of_core = "warn"
|
||||
|
||||
@@ -51,8 +51,7 @@ subtle = "2.6.1"
|
||||
x25519-dalek.workspace = true
|
||||
k256.workspace = true
|
||||
kameo_actors.workspace = true
|
||||
vsss-rs = "5.4.0"
|
||||
rand_core_06 = { package = "rand_core", version = "0.6" }
|
||||
vsss-rs = "6.0.1"
|
||||
|
||||
[dev-dependencies]
|
||||
proptest = "1.11.0"
|
||||
|
||||
@@ -76,6 +76,9 @@ pub enum Error {
|
||||
/// declared, so the token stays valid across several registrations and is
|
||||
/// retired by the `Bootstrapped` event rather than by first use, whichever
|
||||
/// bootstrap path fired it.
|
||||
///
|
||||
/// Every daemon start mints a fresh token and overwrites the file: a token
|
||||
/// handed out by an earlier run is dead.
|
||||
pub struct Bootstrapper {
|
||||
token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
|
||||
token_path: Option<PathBuf>,
|
||||
@@ -116,41 +119,13 @@ impl Bootstrapper {
|
||||
});
|
||||
}
|
||||
|
||||
let registered = diesel::select(diesel::dsl::exists(
|
||||
schema::operator_identity::table.select(schema::operator_identity::id),
|
||||
))
|
||||
.get_result::<bool>(&mut conn)
|
||||
.await?;
|
||||
|
||||
let token = if registered {
|
||||
match tokio::fs::read_to_string(&path).await {
|
||||
Ok(existing)
|
||||
if existing.len() == TOKEN_LENGTH
|
||||
&& existing.chars().all(|c| c.is_ascii_alphanumeric()) =>
|
||||
{
|
||||
let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
|
||||
cell.write().copy_from_slice(existing.as_bytes());
|
||||
cell
|
||||
}
|
||||
Ok(_) | Err(_) => generate_token(&path).await?,
|
||||
}
|
||||
} else {
|
||||
generate_token(&path).await?
|
||||
};
|
||||
|
||||
Ok(Self {
|
||||
token: Some(token),
|
||||
token: Some(generate_token(&path).await?),
|
||||
token_path: Some(path),
|
||||
events,
|
||||
})
|
||||
}
|
||||
|
||||
fn is_correct_token(&mut self, token: &[u8]) -> bool {
|
||||
self.token.as_mut().is_some_and(|expected| {
|
||||
expected.read_inline(|bytes| bool::from(bytes.as_ref().ct_eq(token)))
|
||||
})
|
||||
}
|
||||
|
||||
async fn forget(&mut self) {
|
||||
self.token = None;
|
||||
if let Some(path) = self.token_path.take() {
|
||||
@@ -175,7 +150,9 @@ impl Message<events::Bootstrapped> for Bootstrapper {
|
||||
impl Bootstrapper {
|
||||
#[message]
|
||||
pub fn verify_token(&mut self, token: Vec<u8>) -> bool {
|
||||
self.is_correct_token(&token)
|
||||
self.token.as_mut().is_some_and(|expected| {
|
||||
expected.read_inline(|bytes| bool::from(bytes.as_ref().ct_eq(token.as_slice())))
|
||||
})
|
||||
}
|
||||
|
||||
#[message]
|
||||
|
||||
@@ -3,14 +3,9 @@ use crate::{
|
||||
bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
|
||||
operator_registry::OperatorRegistry, vault::Vault, vault_coordinator::VaultCoordinator,
|
||||
},
|
||||
db::{
|
||||
self,
|
||||
custody::{CustodyStore, DieselCustodyStore},
|
||||
},
|
||||
db,
|
||||
};
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use kameo::actor::{ActorRef, Spawn};
|
||||
use kameo_actors::{DeliveryStrategy, message_bus::MessageBus};
|
||||
use thiserror::Error;
|
||||
@@ -50,12 +45,10 @@ impl GlobalActors {
|
||||
|
||||
pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
|
||||
let events = Self::spawn_message_bus();
|
||||
let custody: Arc<dyn CustodyStore> = Arc::new(DieselCustodyStore);
|
||||
let vault =
|
||||
Vault::spawn(Vault::new(db.clone(), events.clone(), Arc::clone(&custody)).await?);
|
||||
let vault = Vault::spawn(Vault::new(db.clone(), events.clone()).await?);
|
||||
let bootstrapper = Bootstrapper::spawn(Bootstrapper::new(&db, events.clone()).await?);
|
||||
let vault_coordinator =
|
||||
VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault.clone(), custody));
|
||||
VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault.clone()));
|
||||
let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
|
||||
Ok(Self {
|
||||
bootstrapper,
|
||||
|
||||
@@ -6,14 +6,13 @@ use crate::{
|
||||
},
|
||||
db::{
|
||||
self,
|
||||
custody::{CustodyRecord, CustodyStore},
|
||||
custody::CustodyRecord,
|
||||
models::{self, RootKeyHistory, RootKeyHistoryId},
|
||||
schema::{self},
|
||||
},
|
||||
};
|
||||
|
||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use std::sync::Arc;
|
||||
|
||||
use chrono::Utc;
|
||||
use diesel::{
|
||||
@@ -101,17 +100,12 @@ pub struct Vault {
|
||||
db: db::DatabasePool,
|
||||
state: State,
|
||||
events: ActorRef<MessageBus>,
|
||||
custody: Arc<dyn CustodyStore>,
|
||||
unseal_failures: u32,
|
||||
}
|
||||
|
||||
#[messages]
|
||||
impl Vault {
|
||||
pub async fn new(
|
||||
db: db::DatabasePool,
|
||||
events: ActorRef<MessageBus>,
|
||||
custody: Arc<dyn CustodyStore>,
|
||||
) -> Result<Self, Error> {
|
||||
pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
|
||||
let state = {
|
||||
let mut conn = db.get().await?;
|
||||
|
||||
@@ -133,7 +127,6 @@ impl Vault {
|
||||
db,
|
||||
state,
|
||||
events,
|
||||
custody,
|
||||
unseal_failures: 0,
|
||||
})
|
||||
}
|
||||
@@ -213,7 +206,6 @@ impl Vault {
|
||||
let mut conn = self.db.get().await?;
|
||||
|
||||
let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
|
||||
let custody_store = Arc::clone(&self.custody);
|
||||
let root_key_history_id = conn
|
||||
.transaction(async |conn| {
|
||||
let root_key_history_id = insert_into(schema::root_key_history::table)
|
||||
@@ -235,7 +227,7 @@ impl Vault {
|
||||
.await?;
|
||||
|
||||
if let Some(record) = custody.as_ref() {
|
||||
custody_store.write_record(&mut *conn, record).await?;
|
||||
db::custody::write_record(&mut *conn, record).await?;
|
||||
}
|
||||
|
||||
Result::<_, Error>::Ok(RootKeyHistoryId::from_raw(root_key_history_id))
|
||||
@@ -457,16 +449,12 @@ impl Vault {
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::{actors::GlobalActors, db::custody::DieselCustodyStore};
|
||||
use crate::actors::GlobalActors;
|
||||
|
||||
use super::*;
|
||||
|
||||
async fn bootstrapped_actor(db: &db::DatabasePool) -> Vault {
|
||||
let mut actor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
let seal_key = KeyCell::from([0u8; 32]);
|
||||
|
||||
@@ -2,21 +2,20 @@
|
||||
//!
|
||||
//! The coordinator collects one passphrase per committee member, then hands the
|
||||
//! assembled material to [`Vault`] in a single message. It owns no Diesel code:
|
||||
//! everything it reads or writes goes through [`CustodyStore`].
|
||||
|
||||
use std::sync::Arc;
|
||||
//! everything it reads or writes goes through the [`db::custody`] functions.
|
||||
|
||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use argon2::RECOMMENDED_SALT_LEN;
|
||||
use kameo::{Actor, actor::ActorRef, error::SendError, messages};
|
||||
use rand_core_06::{OsRng, RngCore as _};
|
||||
use rand::rngs::SysRng;
|
||||
use rand_core::{Rng as _, UnwrapErr};
|
||||
|
||||
use crate::{
|
||||
actors::vault::{self, Bootstrap, TryUnseal, Vault},
|
||||
crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir},
|
||||
db::{
|
||||
self,
|
||||
custody::{CustodyRecord, CustodyStore, EncryptedShare},
|
||||
custody::{CustodyRecord, EncryptedShare},
|
||||
models::OperatorId,
|
||||
},
|
||||
};
|
||||
@@ -110,20 +109,14 @@ enum CoordinatorState {
|
||||
pub struct VaultCoordinator {
|
||||
db: db::DatabasePool,
|
||||
vault: ActorRef<Vault>,
|
||||
custody: Arc<dyn CustodyStore>,
|
||||
state: CoordinatorState,
|
||||
}
|
||||
|
||||
impl VaultCoordinator {
|
||||
pub fn new(
|
||||
db: db::DatabasePool,
|
||||
vault: ActorRef<Vault>,
|
||||
custody: Arc<dyn CustodyStore>,
|
||||
) -> Self {
|
||||
pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
|
||||
Self {
|
||||
db,
|
||||
vault,
|
||||
custody,
|
||||
state: CoordinatorState::Idle,
|
||||
}
|
||||
}
|
||||
@@ -143,7 +136,7 @@ fn encrypt_share(
|
||||
share: &[u8],
|
||||
) -> Result<EncryptedShare, Error> {
|
||||
let mut salt = [0u8; RECOMMENDED_SALT_LEN];
|
||||
OsRng.fill_bytes(&mut salt);
|
||||
UnwrapErr(SysRng).fill_bytes(&mut salt);
|
||||
|
||||
let nonce = Nonce::default();
|
||||
let ciphertext = derive_key(passphrase, &salt)
|
||||
@@ -188,15 +181,17 @@ async fn finalize_bootstrap(
|
||||
let threshold = shamir::shamir_threshold(total).ok_or_else(|| committee_error(total))?;
|
||||
|
||||
let mut seal_key = KeyCell::new_secure_random();
|
||||
let mut shares = shamir::split_key(threshold, total, &mut seal_key, OsRng)
|
||||
let mut shares = shamir::split_key(threshold, total, &mut seal_key, UnwrapErr(SysRng))
|
||||
.map_err(|error| Error::Shamir(error.to_string()))?;
|
||||
|
||||
if shares.len() < total {
|
||||
return Err(Error::Shamir("missing share for operator".to_owned()));
|
||||
}
|
||||
|
||||
let mut encrypted = Vec::with_capacity(total);
|
||||
for (index, (operator_id, passphrase)) in contributions.0.iter_mut().enumerate() {
|
||||
let share = shares
|
||||
.read_inline(|shares| shares.get(index).cloned())
|
||||
.ok_or_else(|| Error::Shamir("missing share for operator".to_owned()))?;
|
||||
encrypted.push((*operator_id, encrypt_share(passphrase, &share)?));
|
||||
for ((operator_id, passphrase), share) in contributions.0.iter_mut().zip(shares.iter_mut()) {
|
||||
let share = share.read_inline(|share| encrypt_share(passphrase, share))?;
|
||||
encrypted.push((*operator_id, share));
|
||||
}
|
||||
|
||||
vault
|
||||
@@ -214,24 +209,18 @@ async fn finalize_bootstrap(
|
||||
/// Reconstruct the seal key from the contributed passphrases and unseal.
|
||||
async fn finalize_unseal(
|
||||
db: &db::DatabasePool,
|
||||
custody: &Arc<dyn CustodyStore>,
|
||||
vault: &ActorRef<Vault>,
|
||||
threshold: usize,
|
||||
contributions: &mut Contributions,
|
||||
) -> Result<(), Error> {
|
||||
let stored = {
|
||||
let mut conn = db.get().await?;
|
||||
custody
|
||||
.shares(&mut conn, &contributions.operators())
|
||||
.await?
|
||||
db::custody::shares(&mut conn, &contributions.operators()).await?
|
||||
};
|
||||
|
||||
let mut plaintext = SafeCell::new(Vec::with_capacity(stored.len()));
|
||||
let mut plaintext = Vec::with_capacity(stored.len());
|
||||
for ((_, passphrase), share) in contributions.0.iter_mut().zip(stored) {
|
||||
let mut decrypted = decrypt_share(passphrase, share)?;
|
||||
decrypted.read_inline(|share| {
|
||||
plaintext.write_inline(|shares| shares.push(share.clone()));
|
||||
});
|
||||
plaintext.push(decrypt_share(passphrase, share)?);
|
||||
}
|
||||
|
||||
let seal_key = shamir::combine_shares(threshold, &mut plaintext)
|
||||
@@ -336,7 +325,7 @@ impl VaultCoordinator {
|
||||
if matches!(self.state, CoordinatorState::Idle) {
|
||||
let threshold = {
|
||||
let mut conn = self.db.get().await?;
|
||||
self.custody.threshold(&mut conn).await?
|
||||
db::custody::threshold(&mut conn).await?
|
||||
};
|
||||
self.state = CoordinatorState::Unsealing {
|
||||
threshold,
|
||||
@@ -374,15 +363,7 @@ impl VaultCoordinator {
|
||||
unreachable!("state was matched as Unsealing above")
|
||||
};
|
||||
|
||||
match finalize_unseal(
|
||||
&self.db,
|
||||
&self.custody,
|
||||
&self.vault,
|
||||
threshold,
|
||||
&mut contributions,
|
||||
)
|
||||
.await
|
||||
{
|
||||
match finalize_unseal(&self.db, &self.vault, threshold, &mut contributions).await {
|
||||
Ok(()) => Ok(true),
|
||||
Err(error) => {
|
||||
self.state = CoordinatorState::Unsealing {
|
||||
|
||||
@@ -206,9 +206,6 @@ pub async fn is_signing_available(vault: &ActorRef<Vault>) -> Result<bool, Error
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::db::custody::DieselCustodyStore;
|
||||
use diesel::{ExpressionMethods as _, QueryDsl};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use kameo::{actor::ActorRef, prelude::Spawn};
|
||||
@@ -234,11 +231,7 @@ mod tests {
|
||||
|
||||
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
|
||||
let actor = Vault::spawn(
|
||||
Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap(),
|
||||
);
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use rand_core::CryptoRng;
|
||||
use vsss_rs::Gf256;
|
||||
|
||||
use crate::crypto::KeyCell;
|
||||
@@ -15,10 +16,13 @@ pub enum ShamirError {
|
||||
Combine(String),
|
||||
}
|
||||
|
||||
/// Return the required majority threshold for an ordinary operator committee.
|
||||
/// Return the required threshold for a Shamir share pool of `committee_size`.
|
||||
///
|
||||
/// Committees of two are rejected: a majority of two is two, which gives each
|
||||
/// member a veto over every unseal without giving either one recovery.
|
||||
/// A pool of two is rejected: a majority of two is two, which gives each holder
|
||||
/// a veto over every unseal without giving either one recovery. That rejects no
|
||||
/// supported committee, because a two-operator vault must carry at least one
|
||||
/// recovery share and so never splits into a pool of two -- see
|
||||
/// `docs/ARCHITECTURE.md` 3.9.
|
||||
#[expect(
|
||||
clippy::integer_division,
|
||||
reason = "majority thresholds use integer arithmetic"
|
||||
@@ -38,8 +42,8 @@ pub fn split_key(
|
||||
threshold: usize,
|
||||
total: usize,
|
||||
key: &mut KeyCell,
|
||||
mut rng: impl rand_core_06::RngCore + rand_core_06::CryptoRng,
|
||||
) -> Result<SafeCell<Vec<Vec<u8>>>, ShamirError> {
|
||||
rng: impl CryptoRng,
|
||||
) -> Result<Vec<SafeCell<Vec<u8>>>, ShamirError> {
|
||||
if total == 0 || threshold == 0 || threshold > total || total == 2 || total > MAX_COMMITTEE_SIZE
|
||||
{
|
||||
return Err(ShamirError::Split(
|
||||
@@ -47,20 +51,23 @@ pub fn split_key(
|
||||
));
|
||||
}
|
||||
|
||||
// Nothing to interpolate when one share suffices.
|
||||
if threshold == 1 {
|
||||
return Ok(key.0.read_inline(|key| {
|
||||
std::iter::repeat_with(|| SafeCell::new(key.as_slice().to_vec()))
|
||||
.take(total)
|
||||
.collect()
|
||||
}));
|
||||
}
|
||||
|
||||
key.0.read_inline(|key| {
|
||||
let key: &[u8; 32] = key
|
||||
.as_slice()
|
||||
.try_into()
|
||||
.map_err(|_| ShamirError::Split("unexpected seal key length".to_owned()))?;
|
||||
|
||||
if threshold == 1 {
|
||||
return Ok(SafeCell::new(
|
||||
std::iter::repeat_n(key.to_vec(), total).collect(),
|
||||
));
|
||||
}
|
||||
|
||||
Gf256::split_array(threshold, total, key, &mut rng)
|
||||
.map(SafeCell::new)
|
||||
Gf256::split_array(threshold, total, key, rng)
|
||||
.map(|shares| shares.into_iter().map(SafeCell::new).collect())
|
||||
.map_err(|error| ShamirError::Split(format!("{error:?}")))
|
||||
})
|
||||
}
|
||||
@@ -73,30 +80,43 @@ pub fn split_key(
|
||||
/// sized.
|
||||
pub fn combine_shares(
|
||||
threshold: usize,
|
||||
shares: &mut SafeCell<Vec<Vec<u8>>>,
|
||||
shares: &mut [SafeCell<Vec<u8>>],
|
||||
) -> Result<KeyCell, ShamirError> {
|
||||
if threshold == 0 {
|
||||
return Err(ShamirError::Combine("threshold is zero".to_owned()));
|
||||
}
|
||||
if shares.read().len() < threshold {
|
||||
if shares.len() < threshold {
|
||||
return Err(ShamirError::Combine(
|
||||
"not enough shares supplied".to_owned(),
|
||||
));
|
||||
}
|
||||
|
||||
let combined = shares.read_inline(|shares| {
|
||||
// Mirror of the one-of-one case in [`split_key`]: the share is the key.
|
||||
if threshold == 1 {
|
||||
let share = shares
|
||||
.first()
|
||||
.first_mut()
|
||||
.ok_or_else(|| ShamirError::Combine("no shares supplied".to_owned()))?;
|
||||
return Ok(SafeCell::new(share.clone()));
|
||||
return reconstructed_key(share.read_inline(|share| SafeCell::new(share.clone())));
|
||||
}
|
||||
Gf256::combine_array(shares)
|
||||
|
||||
let mut gathered = SafeCell::new(Vec::with_capacity(shares.len()));
|
||||
for share in shares.iter_mut() {
|
||||
share.read_inline(|share| {
|
||||
gathered.write_inline(|gathered| gathered.push(share.clone()));
|
||||
});
|
||||
}
|
||||
|
||||
let combined = gathered.read_inline(|gathered| {
|
||||
Gf256::combine_array(gathered.as_slice())
|
||||
.map(SafeCell::new)
|
||||
.map_err(|error| ShamirError::Combine(format!("{error:?}")))
|
||||
})?;
|
||||
|
||||
KeyCell::try_from(combined)
|
||||
reconstructed_key(combined)
|
||||
}
|
||||
|
||||
fn reconstructed_key(bytes: SafeCell<Vec<u8>>) -> Result<KeyCell, ShamirError> {
|
||||
KeyCell::try_from(bytes)
|
||||
.map_err(|()| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
|
||||
}
|
||||
|
||||
@@ -105,6 +125,9 @@ mod tests {
|
||||
use super::{MAX_COMMITTEE_SIZE, combine_shares, shamir_threshold, split_key};
|
||||
use crate::crypto::KeyCell;
|
||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use rand::rngs::SysRng;
|
||||
use rand_core::UnwrapErr;
|
||||
use rstest::rstest;
|
||||
|
||||
fn key_bytes(mut key: KeyCell) -> [u8; 32] {
|
||||
key.0.read_inline(|key| {
|
||||
@@ -114,35 +137,36 @@ mod tests {
|
||||
})
|
||||
}
|
||||
|
||||
fn select(shares: &mut SafeCell<Vec<Vec<u8>>>, indexes: &[usize]) -> SafeCell<Vec<Vec<u8>>> {
|
||||
shares.read_inline(|shares| {
|
||||
SafeCell::new(
|
||||
fn select(shares: &mut [SafeCell<Vec<u8>>], indexes: &[usize]) -> Vec<SafeCell<Vec<u8>>> {
|
||||
indexes
|
||||
.iter()
|
||||
.filter_map(|index| shares.get(*index).cloned())
|
||||
.collect(),
|
||||
)
|
||||
.filter_map(|index| {
|
||||
shares
|
||||
.get_mut(*index)
|
||||
.map(|share| share.read_inline(|share| SafeCell::new(share.clone())))
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn threshold_shares_reconstruct_fixed_key() {
|
||||
#[rstest]
|
||||
#[case(&[0, 1])]
|
||||
#[case(&[0, 2])]
|
||||
#[case(&[1, 2])]
|
||||
fn threshold_shares_reconstruct_fixed_key(#[case] indexes: &[usize]) {
|
||||
let expected = [9_u8; 32];
|
||||
let mut key = KeyCell::from(expected);
|
||||
let rng = rand_core_06::OsRng;
|
||||
let rng = UnwrapErr(SysRng);
|
||||
let mut shares = split_key(2, 3, &mut key, rng).expect("split should succeed");
|
||||
for indexes in [[0_usize, 1_usize], [0, 2], [1, 2]] {
|
||||
let mut selected = select(&mut shares, &indexes);
|
||||
let mut selected = select(&mut shares, indexes);
|
||||
let combined = combine_shares(2, &mut selected).expect("combine should succeed");
|
||||
assert_eq!(key_bytes(combined), expected);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn one_of_one_round_trips_a_fixed_size_key() {
|
||||
let expected = [7_u8; 32];
|
||||
let mut key = KeyCell::from(expected);
|
||||
let rng = rand_core_06::OsRng;
|
||||
let rng = UnwrapErr(SysRng);
|
||||
let mut shares = split_key(1, 1, &mut key, rng).expect("split should succeed");
|
||||
let combined = combine_shares(1, &mut shares).expect("combine should succeed");
|
||||
assert_eq!(key_bytes(combined), expected);
|
||||
@@ -151,7 +175,7 @@ mod tests {
|
||||
#[test]
|
||||
fn fewer_shares_than_threshold_is_rejected() {
|
||||
let mut key = KeyCell::from([3_u8; 32]);
|
||||
let rng = rand_core_06::OsRng;
|
||||
let rng = UnwrapErr(SysRng);
|
||||
let mut shares = split_key(3, 5, &mut key, rng).expect("split should succeed");
|
||||
let mut selected = select(&mut shares, &[0, 1]);
|
||||
assert!(
|
||||
@@ -160,24 +184,25 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn empty_committee_has_no_threshold() {
|
||||
assert_eq!(shamir_threshold(0), None);
|
||||
#[rstest]
|
||||
#[case(0, None)]
|
||||
#[case(1, Some(1))]
|
||||
#[case(2, None)]
|
||||
#[case(3, Some(2))]
|
||||
#[case(4, Some(3))]
|
||||
#[case(MAX_COMMITTEE_SIZE, Some(128))]
|
||||
#[case(MAX_COMMITTEE_SIZE + 1, None)]
|
||||
fn committee_threshold_is_a_majority(
|
||||
#[case] committee_size: usize,
|
||||
#[case] expected: Option<usize>,
|
||||
) {
|
||||
assert_eq!(shamir_threshold(committee_size), expected);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn committee_threshold_is_majority_for_three_or_more() {
|
||||
assert_eq!(shamir_threshold(1), Some(1));
|
||||
assert_eq!(shamir_threshold(3), Some(2));
|
||||
assert_eq!(shamir_threshold(4), Some(3));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn oversized_committee_has_no_threshold() {
|
||||
assert_eq!(shamir_threshold(MAX_COMMITTEE_SIZE), Some(128));
|
||||
assert_eq!(shamir_threshold(MAX_COMMITTEE_SIZE + 1), None);
|
||||
fn oversized_committee_is_rejected_by_split() {
|
||||
let mut key = KeyCell::from([1_u8; 32]);
|
||||
let rng = rand_core_06::OsRng;
|
||||
let rng = UnwrapErr(SysRng);
|
||||
assert!(
|
||||
split_key(129, MAX_COMMITTEE_SIZE + 1, &mut key, rng).is_err(),
|
||||
"committees above the GF(256) share limit must be rejected"
|
||||
@@ -186,9 +211,8 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn two_operator_committee_is_explicitly_unsupported() {
|
||||
assert_eq!(shamir_threshold(2), None);
|
||||
let mut key = KeyCell::from([7_u8; 32]);
|
||||
let rng = rand_core_06::OsRng;
|
||||
let rng = UnwrapErr(SysRng);
|
||||
assert!(
|
||||
split_key(2, 2, &mut key, rng).is_err(),
|
||||
"two-operator committees must be rejected"
|
||||
|
||||
@@ -1,20 +1,17 @@
|
||||
//! Storage for Shamir custody material: the reconstruction threshold and the
|
||||
//! per-operator encrypted shares of the vault seal key.
|
||||
//!
|
||||
//! Every query lives behind [`CustodyStore`] so that the actors above it hold
|
||||
//! no Diesel code of their own. [`CustodyStore::write_record`] borrows the
|
||||
//! caller's connection instead of taking one from the pool, which lets the
|
||||
//! vault write custody material inside the same transaction that stores the
|
||||
//! root key.
|
||||
//! Every query lives here so that the actors above hold no Diesel code of their
|
||||
//! own. The functions borrow the caller's connection instead of taking one from
|
||||
//! the pool, which lets the vault write custody material inside the same
|
||||
//! transaction that stores the root key.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use async_trait::async_trait;
|
||||
use diesel::{ExpressionMethods as _, QueryDsl};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use diesel::{ExpressionMethods as _, QueryDsl, sqlite::Sqlite};
|
||||
use diesel_async::{AsyncConnection, RunQueryDsl};
|
||||
|
||||
use crate::db::{
|
||||
self,
|
||||
models::{OperatorId, SqliteTimestamp},
|
||||
schema,
|
||||
};
|
||||
@@ -46,42 +43,14 @@ pub enum Error {
|
||||
MissingShare(OperatorId),
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
pub trait CustodyStore: std::fmt::Debug + Send + Sync {
|
||||
/// Persist threshold and shares on the caller's connection, joining any
|
||||
/// transaction the caller has already opened.
|
||||
async fn write_record(
|
||||
&self,
|
||||
conn: &mut db::DatabaseConnection,
|
||||
/// Persist threshold and shares on the caller's connection, joining any
|
||||
/// transaction the caller has already opened.
|
||||
pub async fn write_record(
|
||||
conn: &mut impl AsyncConnection<Backend = Sqlite>,
|
||||
record: &CustodyRecord,
|
||||
) -> Result<(), Error>;
|
||||
|
||||
/// Number of shares required to reconstruct the seal key.
|
||||
async fn threshold(&self, conn: &mut db::DatabaseConnection) -> Result<usize, Error>;
|
||||
|
||||
/// Load the shares of `operators` in one query, in the order requested.
|
||||
async fn shares(
|
||||
&self,
|
||||
conn: &mut db::DatabaseConnection,
|
||||
operators: &[OperatorId],
|
||||
) -> Result<Vec<EncryptedShare>, Error>;
|
||||
}
|
||||
|
||||
/// The production [`CustodyStore`], backed by the `SQLite` schema.
|
||||
#[derive(Debug, Clone, Copy, Default)]
|
||||
pub struct DieselCustodyStore;
|
||||
|
||||
#[async_trait]
|
||||
impl CustodyStore for DieselCustodyStore {
|
||||
async fn write_record(
|
||||
&self,
|
||||
conn: &mut db::DatabaseConnection,
|
||||
record: &CustodyRecord,
|
||||
) -> Result<(), Error> {
|
||||
) -> Result<(), Error> {
|
||||
let threshold = i32::try_from(record.threshold).map_err(|_| Error::BrokenThreshold)?;
|
||||
|
||||
// SQLite has no batch form for REPLACE INTO in diesel, so the rows go
|
||||
// in one at a time. The caller's transaction still makes them atomic.
|
||||
let now = SqliteTimestamp::now();
|
||||
for (operator_id, share) in &record.shares {
|
||||
diesel::replace_into(schema::operator::table)
|
||||
@@ -106,9 +75,10 @@ impl CustodyStore for DieselCustodyStore {
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
async fn threshold(&self, conn: &mut db::DatabaseConnection) -> Result<usize, Error> {
|
||||
/// Number of shares required to reconstruct the seal key.
|
||||
pub async fn threshold(conn: &mut impl AsyncConnection<Backend = Sqlite>) -> Result<usize, Error> {
|
||||
let stored: Option<i32> = schema::arbiter_settings::table
|
||||
.select(schema::arbiter_settings::shamir_threshold)
|
||||
.first(conn)
|
||||
@@ -118,16 +88,19 @@ impl CustodyStore for DieselCustodyStore {
|
||||
.and_then(|value| usize::try_from(value).ok())
|
||||
.filter(|threshold| *threshold > 0)
|
||||
.ok_or(Error::BrokenThreshold)
|
||||
}
|
||||
}
|
||||
|
||||
async fn shares(
|
||||
&self,
|
||||
conn: &mut db::DatabaseConnection,
|
||||
/// One row of the share query: operator id, ciphertext, nonce, salt.
|
||||
type ShareRow = (Option<OperatorId>, Vec<u8>, Vec<u8>, Vec<u8>);
|
||||
|
||||
/// Load the shares of `operators` in one query, in the order requested.
|
||||
pub async fn shares(
|
||||
conn: &mut impl AsyncConnection<Backend = Sqlite>,
|
||||
operators: &[OperatorId],
|
||||
) -> Result<Vec<EncryptedShare>, Error> {
|
||||
) -> Result<Vec<EncryptedShare>, Error> {
|
||||
let wanted: Vec<Option<OperatorId>> = operators.iter().copied().map(Some).collect();
|
||||
|
||||
let rows: Vec<(Option<OperatorId>, Vec<u8>, Vec<u8>, Vec<u8>)> = schema::operator::table
|
||||
let rows: Vec<ShareRow> = schema::operator::table
|
||||
.filter(schema::operator::id.eq_any(wanted))
|
||||
.select((
|
||||
schema::operator::id,
|
||||
@@ -158,5 +131,4 @@ impl CustodyStore for DieselCustodyStore {
|
||||
.iter()
|
||||
.map(|id| found.remove(id).ok_or(Error::MissingShare(*id)))
|
||||
.collect()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -501,9 +501,6 @@ impl Engine {
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::db::custody::DieselCustodyStore;
|
||||
use alloy::primitives::{Address, Bytes, U256, address};
|
||||
use chrono::{Duration, Utc};
|
||||
use diesel::{SelectableHelper, insert_into};
|
||||
@@ -769,11 +766,7 @@ mod tests {
|
||||
|
||||
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
|
||||
let actor = Vault::spawn(
|
||||
Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap(),
|
||||
);
|
||||
|
||||
@@ -7,21 +7,16 @@ use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
|
||||
use arbiter_server::{
|
||||
actors::{GlobalActors, vault::Vault},
|
||||
crypto::KeyCell,
|
||||
db::{self, custody::DieselCustodyStore, schema},
|
||||
db::{self, schema},
|
||||
};
|
||||
|
||||
use async_trait::async_trait;
|
||||
use diesel::QueryDsl;
|
||||
use diesel_async::RunQueryDsl;
|
||||
use std::sync::Arc;
|
||||
use tokio::sync::mpsc;
|
||||
|
||||
pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
|
||||
let mut actor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
actor
|
||||
|
||||
@@ -6,16 +6,13 @@ use arbiter_server::{
|
||||
vault::{CreateNew, Error, Vault},
|
||||
},
|
||||
crypto::KeyCell,
|
||||
db::{self, custody::DieselCustodyStore, models, schema},
|
||||
db::{self, models, schema},
|
||||
};
|
||||
|
||||
use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::sql_query};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use kameo::actor::{ActorRef, Spawn as _};
|
||||
use std::{
|
||||
collections::{HashMap, HashSet},
|
||||
sync::Arc,
|
||||
};
|
||||
use std::collections::{HashMap, HashSet};
|
||||
use tokio::task::JoinSet;
|
||||
|
||||
const TEST_AAD: &[u8] = b"test-aad";
|
||||
@@ -169,11 +166,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
|
||||
let writes = write_concurrently(actor, "roundtrip", 40).await;
|
||||
let expected: HashMap<i32, Vec<u8>> = writes.into_iter().collect();
|
||||
|
||||
let mut decryptor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut decryptor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
decryptor
|
||||
|
||||
@@ -4,11 +4,16 @@ use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use arbiter_server::{
|
||||
actors::{
|
||||
GlobalActors,
|
||||
vault::{Bootstrap, GetState, Seal, VaultState},
|
||||
vault::{Bootstrap, Error as VaultError, GetState, Seal, Vault, VaultState},
|
||||
vault_coordinator::{ContributeBootstrap, ContributeUnseal, StartBootstrap},
|
||||
},
|
||||
crypto::{KeyCell, shamir},
|
||||
db::{self, models::OperatorId, schema},
|
||||
db::{
|
||||
self,
|
||||
custody::{CustodyRecord, EncryptedShare},
|
||||
models::OperatorId,
|
||||
schema,
|
||||
},
|
||||
};
|
||||
|
||||
use diesel::{ExpressionMethods as _, QueryDsl};
|
||||
@@ -175,6 +180,71 @@ async fn refused_bootstrap_stores_no_shares() {
|
||||
);
|
||||
}
|
||||
|
||||
/// A failing custody write must take the whole bootstrap down with it: a vault
|
||||
/// that kept its root key but lost the shares could never be unsealed again.
|
||||
#[tokio::test]
|
||||
#[test_log::test]
|
||||
async fn custody_write_failure_rolls_back_bootstrap() {
|
||||
let db = db::create_test_pool().await;
|
||||
let operators = register_operators(&db, 1).await;
|
||||
let record = CustodyRecord {
|
||||
threshold: 1,
|
||||
shares: operators
|
||||
.into_iter()
|
||||
.map(|operator_id| {
|
||||
(
|
||||
operator_id,
|
||||
EncryptedShare {
|
||||
ciphertext: vec![1; 32],
|
||||
nonce: vec![2; 24],
|
||||
salt: vec![3; 16],
|
||||
},
|
||||
)
|
||||
})
|
||||
.collect(),
|
||||
};
|
||||
let mut vault = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
// The threshold update is the last statement of the custody write, so the
|
||||
// trigger fails the transaction once the share row is already in place.
|
||||
let mut conn = db.get().await.unwrap();
|
||||
diesel::sql_query(
|
||||
"CREATE TRIGGER fail_custody_threshold BEFORE UPDATE OF shamir_threshold ON arbiter_settings BEGIN SELECT RAISE(ABORT, 'forced custody failure'); END;",
|
||||
)
|
||||
.execute(&mut conn)
|
||||
.await
|
||||
.unwrap();
|
||||
drop(conn);
|
||||
|
||||
let error = vault
|
||||
.bootstrap(KeyCell::from([4u8; 32]), Some(record))
|
||||
.await
|
||||
.expect_err("a failing custody write must fail the bootstrap");
|
||||
assert!(
|
||||
matches!(error, VaultError::Custody(_)),
|
||||
"expected a custody error, got {error:?}"
|
||||
);
|
||||
assert_eq!(vault.get_state(), VaultState::Unbootstrapped);
|
||||
assert_eq!(stored_share_count(&db).await, 0);
|
||||
assert_eq!(stored_threshold(&db).await, None);
|
||||
|
||||
let mut conn = db.get().await.unwrap();
|
||||
let root_count: i64 = schema::root_key_history::table
|
||||
.count()
|
||||
.get_result(&mut conn)
|
||||
.await
|
||||
.unwrap();
|
||||
let root_key_id: Option<i32> = schema::arbiter_settings::table
|
||||
.select(schema::arbiter_settings::root_key_id)
|
||||
.first(&mut conn)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(root_count, 0, "the root key write must roll back as well");
|
||||
assert_eq!(root_key_id, None);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[test_log::test]
|
||||
async fn oversized_and_degenerate_committees_are_rejected() {
|
||||
|
||||
@@ -9,12 +9,11 @@ use arbiter_server::{
|
||||
KeyCell,
|
||||
encryption::v1::{Nonce, ROOT_KEY_TAG},
|
||||
},
|
||||
db::{self, custody::DieselCustodyStore, models, schema},
|
||||
db::{self, models, schema},
|
||||
};
|
||||
|
||||
use diesel::{QueryDsl, SelectableHelper};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use std::sync::Arc;
|
||||
|
||||
const TEST_AAD: &[u8] = b"test-aad";
|
||||
|
||||
@@ -22,11 +21,7 @@ const TEST_AAD: &[u8] = b"test-aad";
|
||||
#[test_log::test]
|
||||
async fn bootstrap() {
|
||||
let db = db::create_test_pool().await;
|
||||
let mut actor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
@@ -62,11 +57,7 @@ async fn bootstrap_rejects_double() {
|
||||
#[test_log::test]
|
||||
async fn create_new_before_bootstrap_fails() {
|
||||
let db = db::create_test_pool().await;
|
||||
let mut actor = Vault::new(
|
||||
db,
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
@@ -81,11 +72,7 @@ async fn create_new_before_bootstrap_fails() {
|
||||
#[test_log::test]
|
||||
async fn decrypt_before_bootstrap_fails() {
|
||||
let db = db::create_test_pool().await;
|
||||
let mut actor = Vault::new(
|
||||
db,
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
@@ -100,11 +87,7 @@ async fn new_restores_sealed_state() {
|
||||
let actor = common::bootstrapped_vault(&db).await;
|
||||
drop(actor);
|
||||
|
||||
let mut actor2 = Vault::new(
|
||||
db,
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
|
||||
@@ -124,11 +107,7 @@ async fn unseal_correct_password() {
|
||||
.unwrap();
|
||||
drop(actor);
|
||||
|
||||
let mut actor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
let seal_key = KeyCell::from([0u8; 32]);
|
||||
@@ -151,11 +130,7 @@ async fn unseal_wrong_then_correct_password() {
|
||||
.unwrap();
|
||||
drop(actor);
|
||||
|
||||
let mut actor = Vault::new(
|
||||
db.clone(),
|
||||
GlobalActors::spawn_message_bus(),
|
||||
Arc::new(DieselCustodyStore),
|
||||
)
|
||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
|
||||
Reference in New Issue
Block a user