Compare commits
1 Commits
d7fe3a6377
...
push-zvwxt
| Author | SHA1 | Date | |
|---|---|---|---|
|
6730534187 |
109
AGENTS.md
109
AGENTS.md
@@ -1,16 +1,13 @@
|
||||
# AGENTS.md
|
||||
|
||||
Guidance for coding agents (Claude Code, Codex, …) working in this repository.
|
||||
This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
|
||||
|
||||
## Project Overview
|
||||
|
||||
Arbiter is a **permissioned signing service** for cryptocurrency wallets:
|
||||
|
||||
Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
|
||||
- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
|
||||
- **`useragent/`** — Flutter app (desktop + mobile + web targets) with a Rust core via `flutter_rust_bridge`
|
||||
- **`protobufs/`** — Protocol Buffer definitions shared between server and clients
|
||||
- **`docs/`** — `ARCHITECTURE.md` (peer types, flows, threat model) and `IMPLEMENTATION.md`; treat them as the design source of truth and update them when behaviour changes
|
||||
- **`scripts/`** — helper scripts, e.g. `gen_erc20_registry.py`
|
||||
- **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
|
||||
- **`protobufs/`** — Protocol Buffer definitions shared between server and client
|
||||
|
||||
The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
|
||||
|
||||
@@ -21,7 +18,7 @@ Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
|
||||
mise install
|
||||
```
|
||||
|
||||
Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.41.7-stable, protoc 29.6, diesel_cli 2.3.7 with `sqlite-bundled`, Python 3.14). Also provided there: `cargo-nextest`, `cargo-audit`, `cargo-vet`, `cargo-shear`, `cargo-mutants`, `cargo-features-manager`, `cargo-edit`, `ast-grep`, `flutter_rust_bridge_codegen`.
|
||||
Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
|
||||
|
||||
## Server (Rust workspace at `server/`)
|
||||
|
||||
@@ -29,14 +26,10 @@ Key versions live in `mise.toml` (currently Rust 1.95.0 with clippy, Flutter 3.4
|
||||
|
||||
| Crate | Purpose |
|
||||
|---|---|
|
||||
| `arbiter-proto` | Generated gRPC stubs + protobuf types (`tonic-prost-build`); also `ArbiterUrl`, `home_path()`, `BOOTSTRAP_PATH` |
|
||||
| `arbiter-crypto` | Shared crypto primitives: `authn` (ML-DSA), `safecell` (hardened memory), `hashing::Hashable`, re-exported `x-wing` |
|
||||
| `arbiter-macros` | `#[derive(Hashable)]` — canonical hashing of structs for the DB integrity layer |
|
||||
| `arbiter-server` | Main daemon — actors, peers, DB, EVM policy engine, gRPC service implementation |
|
||||
| `arbiter-client` | Rust client library for SDK clients (`ArbiterClient`, EVM wallet, key storage) |
|
||||
| `arbiter-tokens-registry` | Generated ERC-20 token registry used by token-transfer policies |
|
||||
|
||||
Workspace lints (`server/Cargo.toml`) are strict: most of clippy `pedantic`/`nursery` plus a large restriction set. `as` casts, indexing/slicing, `dbg!`, float arithmetic and undocumented `unsafe` are denied or warned — expect to add an `#[expect(..., reason = "...")]` rather than to silence a lint globally.
|
||||
| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
|
||||
| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
|
||||
| `arbiter-operator` | Rust client library for the operator side of the gRPC protocol |
|
||||
| `arbiter-client` | Rust client library for SDK clients |
|
||||
|
||||
### Common Commands
|
||||
|
||||
@@ -49,78 +42,54 @@ cargo build
|
||||
# Run the server daemon
|
||||
cargo run -p arbiter-server
|
||||
|
||||
# Run all tests (preferred over cargo test; CI uses --all-features)
|
||||
# Run all tests (preferred over cargo test)
|
||||
cargo nextest run
|
||||
|
||||
# Run a single test
|
||||
cargo nextest run <test_name>
|
||||
|
||||
# Lint (CI runs it with -D warnings)
|
||||
cargo clippy --all -- -D warnings
|
||||
# Lint
|
||||
cargo clippy
|
||||
|
||||
# Security audit
|
||||
cargo audit
|
||||
|
||||
# Supply-chain review (config in server/supply-chain/)
|
||||
cargo vet
|
||||
|
||||
# Check unused dependencies
|
||||
cargo shear
|
||||
|
||||
# Mutation testing
|
||||
cargo mutants
|
||||
# Run snapshot tests and update snapshots
|
||||
cargo insta review
|
||||
```
|
||||
|
||||
### CI
|
||||
|
||||
Woodpecker pipelines in `.woodpecker/` run on `server/**` changes: `server-lint` (clippy), `server-test` (nextest, `--all-features`), `server-audit`, `server-vet`, plus `useragent-analyze` for the Flutter app.
|
||||
|
||||
### Architecture
|
||||
|
||||
The server is actor-based using the **kameo** crate. Long-lived state lives in `GlobalActors` (`src/actors/mod.rs`):
|
||||
The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
|
||||
|
||||
- **`Bootstrapper`** — one-time bootstrap token, written to `~/.arbiter/bootstrap_token` on first run
|
||||
- **`Vault`** — encrypted root key and the Sealed/Unsealed state machine; on unseal decrypts the root key into a `memsafe`-backed `SafeCell`
|
||||
- **`FlowCoordinator`** — cross-connection flow between operators and SDK clients
|
||||
- **`OperatorRegistry`** — tracks currently connected operators
|
||||
- **`EvmActor`** — EVM transaction policy enforcement and signing
|
||||
- **`events`** — a `kameo_actors::MessageBus` (`DeliveryStrategy::Guaranteed`) for cross-actor notifications
|
||||
- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
|
||||
- **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
|
||||
- **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients.
|
||||
- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
|
||||
|
||||
Per-connection state lives under **`src/peers/`**, not `actors/`: `peers/client/` and `peers/operator/`, each with `auth` (challenge-response) and `session` (post-auth) sub-modules; the operator side additionally has `vault_gate/` for the unseal handshake.
|
||||
Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
|
||||
|
||||
The gRPC surface lives in **`src/grpc/`**, split per peer (`client/`, `operator/`, `common/`) and per direction (`inbound.rs` — requests to the daemon, `outbound.rs` — server-initiated streams), with `request_tracker.rs` correlating the two.
|
||||
|
||||
EVM logic is in `src/evm/`: `policies/ether_transfer/`, `policies/token_transfers/`, `abi.rs`, `safe_signer.rs`.
|
||||
|
||||
**Database:** SQLite via `diesel-async` + `bb8`. Schema in `src/db/schema.rs`, models in `src/db/models.rs`, embedded migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`; tests use a temp-file DB via `db::create_test_pool()`.
|
||||
|
||||
Entity ids are newtypes generated by the `declare_id!` macro in `db::models` (`OperatorId`, `ChainId`, …), each a `#[repr(transparent)]` wrapper over `i32` with `to_raw`/`from_raw`. Pass these around instead of bare `i32`.
|
||||
|
||||
**Row integrity:** sensitive rows are covered by an HMAC-SHA256 envelope (`src/crypto/integrity/`, table `integrity_envelope`), keyed from the vault root key. A struct becomes coverable by deriving `arbiter_macros::Hashable` and implementing `Integrable` (`KIND` + `VERSION`). When adding or changing a covered entity, keep the derive and the payload version in sync — a mismatch surfaces as `PayloadVersionMismatch` or `MacMismatch` at runtime.
|
||||
**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
|
||||
|
||||
**Cryptography:**
|
||||
- Authentication: **ML-DSA-87** (post-quantum, `arbiter-crypto::authn::v1`), challenge-response with per-peer nonce tracking
|
||||
- Encryption at rest: XChaCha20-Poly1305, versioned modules (`crypto/encryption/v1.rs`) with a `schema_version` column for transparent migration on unseal
|
||||
- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
|
||||
- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
|
||||
- Password KDF: Argon2
|
||||
- Unseal transport: X25519 ephemeral key exchange (`peers/operator/vault_gate/`); `x-wing` (hybrid PQ KEM) is available via `arbiter-crypto`
|
||||
- TLS: self-signed certificate (rustls + aws-lc-rs, `prefer-post-quantum`), fingerprint distributed via `ArbiterUrl`
|
||||
- Unseal transport: X25519 ephemeral key exchange
|
||||
- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
|
||||
|
||||
Crypto modules are versioned by convention: `mod.rs` re-exports the current `vN`. Add a `v(N+1)` rather than editing an existing version in place.
|
||||
|
||||
**Protocol:** gRPC with Protocol Buffers. `ArbiterUrl` encodes host, port, CA cert and bootstrap token into a single shareable string (printed to console on first run).
|
||||
**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
|
||||
|
||||
### Proto Regeneration
|
||||
|
||||
`arbiter-proto/build.rs` compiles `arbiter.proto`, `operator.proto`, `client.proto` and `evm.proto` (with their `shared/`, `operator/`, `client/` includes) on build:
|
||||
When `.proto` files in `protobufs/` change, rebuild to regenerate:
|
||||
```sh
|
||||
cd server && cargo build -p arbiter-proto
|
||||
```
|
||||
|
||||
Dart protobuf stubs are generated separately, from the repo root:
|
||||
```sh
|
||||
mise run codegen # protoc --dart_out=grpc:useragent/lib/proto
|
||||
```
|
||||
|
||||
### Database Migrations
|
||||
|
||||
```sh
|
||||
@@ -131,8 +100,6 @@ diesel migration generate <name> --migration-dir crates/arbiter-server/migration
|
||||
diesel migration run --migration-dir crates/arbiter-server/migrations
|
||||
```
|
||||
|
||||
Pre-release policy: there is a single `init` migration and no deployed databases yet, so schema changes are made by editing that migration directly instead of stacking new ones. Regenerate `src/db/schema.rs` after changing it.
|
||||
|
||||
### Code Conventions
|
||||
|
||||
**`#[must_use]` Attribute:**
|
||||
@@ -154,23 +121,29 @@ pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool
|
||||
|
||||
This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.
|
||||
|
||||
## User Agent (Flutter + flutter_rust_bridge at `useragent/`)
|
||||
## Operator (Flutter + Rinf at `operator/`)
|
||||
|
||||
The Flutter app calls Rust through [flutter_rust_bridge](https://cjycode.com/flutter_rust_bridge/) 2.12.0. The Rust side is the `rust_lib_arbiter` crate at `useragent/rust/`; everything exposed to Dart is declared in `useragent/rust/src/api/` and lands in `useragent/lib/src/rust/` (see `useragent/flutter_rust_bridge.yaml`). Dart UI code is organised as `lib/features/`, `lib/screens/`, `lib/widgets/`, `lib/providers/`, `lib/theme/`, with routing in `lib/router.dart` (`router.gr.dart` is generated).
|
||||
The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client.
|
||||
|
||||
Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
|
||||
|
||||
```sh
|
||||
cd operator && rinf gen
|
||||
```
|
||||
|
||||
### Common Commands
|
||||
|
||||
```sh
|
||||
cd useragent
|
||||
cd operator
|
||||
|
||||
# Run the app
|
||||
# Run the app (macOS or Windows)
|
||||
flutter run
|
||||
|
||||
# Regenerate Rust↔Dart bindings after editing rust/src/api/
|
||||
mise run codegen # flutter_rust_bridge_codegen generate
|
||||
# Regenerate Rust↔Dart signal bindings
|
||||
rinf gen
|
||||
|
||||
# Analyze Dart code (also run in CI)
|
||||
# Analyze Dart code
|
||||
flutter analyze
|
||||
```
|
||||
|
||||
Note: `app/` contains only stale generated Flutter artifacts and is not the application source.
|
||||
The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals.
|
||||
|
||||
2046
server/Cargo.lock
generated
2046
server/Cargo.lock
generated
File diff suppressed because it is too large
Load Diff
@@ -6,34 +6,34 @@ resolver = "3"
|
||||
|
||||
|
||||
[workspace.dependencies]
|
||||
alloy = "2.0.4"
|
||||
async-trait = "0.1.89"
|
||||
base64 = "0.22.1"
|
||||
chrono = { version = "0.4.44", features = ["serde"] }
|
||||
futures = "0.3.32"
|
||||
alloy = "2.4.1"
|
||||
async-trait = "0.1.92"
|
||||
base64 = "0.23.1"
|
||||
chrono = { version = "0.4.45", features = ["serde"] }
|
||||
futures = "0.3.34"
|
||||
k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
|
||||
kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
|
||||
kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
|
||||
hmac = "0.13.0"
|
||||
miette = { version = "7.6.0", features = ["fancy", "serde"] }
|
||||
ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
|
||||
ml-dsa = { version = "0.1.1", features = ["zeroize"] }
|
||||
mutants = "0.0.4"
|
||||
prost = "0.14.3"
|
||||
prost-types = { version = "0.14.3", features = ["chrono"] }
|
||||
rand = "0.10.1"
|
||||
prost = "0.14.4"
|
||||
prost-types = { version = "0.14.4", features = ["chrono"] }
|
||||
rand = "0.10.2"
|
||||
rand_core = "0.10.1"
|
||||
rcgen = { version = "0.14.7", features = [ "aws_lc_rs", "pem", "x509-parser", "zeroize" ], default-features = false }
|
||||
rcgen = { version = "0.14.9", features = [ "aws_lc_rs", "pem", "x509-parser", "zeroize" ], default-features = false }
|
||||
rstest = "0.26.1"
|
||||
rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
|
||||
rustls-pki-types = "1.14.1"
|
||||
rustls = { version = "0.23.43", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
|
||||
rustls-pki-types = "1.15.1"
|
||||
sha2 = "0.11"
|
||||
smlang = "0.8.0"
|
||||
thiserror = "2.0.18"
|
||||
tokio = { version = "1.52.1", features = ["full"] }
|
||||
tokio-stream = { version = "0.1.18", features = ["full"] }
|
||||
tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
|
||||
thiserror = "2.0.20"
|
||||
tokio = { version = "1.53.1", features = ["full"] }
|
||||
tokio-stream = { version = "0.1.19", features = ["full"] }
|
||||
tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
|
||||
tracing = "0.1.44"
|
||||
x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
|
||||
x25519-dalek = { version = "3.0.0", features = ["getrandom"] }
|
||||
|
||||
[workspace.lints.rust]
|
||||
missing_unsafe_on_extern = "deny"
|
||||
|
||||
@@ -20,8 +20,8 @@ tonic.features = ["tls-aws-lc"]
|
||||
tokio.workspace = true
|
||||
tokio-stream.workspace = true
|
||||
thiserror.workspace = true
|
||||
http = "1.4.0"
|
||||
rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
|
||||
http = "1.5.0"
|
||||
rustls-webpki = { version = "0.103.15", features = ["aws-lc-rs"] }
|
||||
async-trait.workspace = true
|
||||
chrono.workspace = true
|
||||
|
||||
|
||||
@@ -6,10 +6,10 @@ edition = "2024"
|
||||
[dependencies]
|
||||
ml-dsa = {workspace = true, optional = true }
|
||||
rand = {workspace = true, optional = true}
|
||||
memsafe = {version = "0.4.0", optional = true}
|
||||
memsafe = {version = "1.0.2", optional = true}
|
||||
hmac.workspace = true
|
||||
alloy.workspace = true
|
||||
x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
|
||||
x-wing = { version = "0.1.0", features = ["zeroize"] }
|
||||
chrono.workspace = true
|
||||
thiserror.workspace = true
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
use chrono::{DateTime, Utc};
|
||||
use hmac::digest::Digest;
|
||||
use ml_dsa::{
|
||||
EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
|
||||
SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
|
||||
EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
|
||||
Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
|
||||
};
|
||||
use rand::RngExt;
|
||||
|
||||
@@ -77,7 +77,10 @@ impl crate::hashing::Hashable for PublicKey {
|
||||
pub struct Signature(Box<MlDsaSignature<KeyParams>>);
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
|
||||
pub struct SigningKey {
|
||||
key: Box<ExpandedSigningKey<KeyParams>>,
|
||||
seed: Seed,
|
||||
}
|
||||
|
||||
impl PublicKey {
|
||||
pub fn to_bytes(&self) -> Vec<u8> {
|
||||
@@ -100,24 +103,31 @@ impl Signature {
|
||||
|
||||
impl SigningKey {
|
||||
pub fn generate() -> Self {
|
||||
Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
|
||||
let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
|
||||
Self {
|
||||
key: Box::new(ExpandedSigningKey::from_seed(&seed)),
|
||||
seed,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn from_seed(seed: [u8; 32]) -> Self {
|
||||
Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
|
||||
let seed = Seed::from(seed);
|
||||
Self {
|
||||
key: Box::new(ExpandedSigningKey::from_seed(&seed)),
|
||||
seed,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn to_seed(&self) -> [u8; 32] {
|
||||
self.0.to_seed().into()
|
||||
self.seed.into()
|
||||
}
|
||||
|
||||
pub fn public_key(&self) -> PublicKey {
|
||||
self.0.verifying_key().into()
|
||||
self.key.verifying_key().into()
|
||||
}
|
||||
|
||||
pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
|
||||
self.0
|
||||
.signing_key()
|
||||
self.key
|
||||
.sign_deterministic(message, context)
|
||||
.map(Into::into)
|
||||
}
|
||||
@@ -145,12 +155,6 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
|
||||
}
|
||||
}
|
||||
|
||||
impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
|
||||
fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
|
||||
Self(Box::new(value))
|
||||
}
|
||||
}
|
||||
|
||||
impl TryFrom<Vec<u8>> for PublicKey {
|
||||
type Error = ();
|
||||
|
||||
@@ -188,15 +192,15 @@ impl TryFrom<&'_ [u8]> for Signature {
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
|
||||
use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};
|
||||
|
||||
use crate::authn::AuthChallenge;
|
||||
|
||||
use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
|
||||
use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};
|
||||
|
||||
#[test]
|
||||
fn public_key_round_trip_decodes() {
|
||||
let key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let key = RealSigningKey::<MlDsa87>::generate();
|
||||
let encoded = PublicKey::from(key.verifying_key()).to_bytes();
|
||||
|
||||
let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");
|
||||
|
||||
@@ -10,7 +10,7 @@ doctest = false
|
||||
[dependencies]
|
||||
proc-macro2 = "1.0"
|
||||
quote = "1.0"
|
||||
syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
|
||||
syn = { version = "3.0", features = ["derive", "fold", "full", "visit-mut"] }
|
||||
|
||||
[dev-dependencies]
|
||||
arbiter-crypto = { path = "../arbiter-crypto" }
|
||||
|
||||
@@ -9,7 +9,7 @@ license = "Apache-2.0"
|
||||
tonic.workspace = true
|
||||
tokio.workspace = true
|
||||
futures.workspace = true
|
||||
tonic-prost = "0.14.5"
|
||||
tonic-prost = "0.14.6"
|
||||
prost.workspace = true
|
||||
kameo.workspace = true
|
||||
url = "2.5.8"
|
||||
@@ -22,7 +22,7 @@ async-trait.workspace = true
|
||||
tokio-stream.workspace = true
|
||||
|
||||
[build-dependencies]
|
||||
tonic-prost-build = "0.14.5"
|
||||
tonic-prost-build = "0.14.6"
|
||||
|
||||
[dev-dependencies]
|
||||
rstest.workspace = true
|
||||
|
||||
@@ -9,8 +9,14 @@ license = "Apache-2.0"
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
|
||||
diesel-async = { version = "0.9.0", features = [
|
||||
diesel = { version = "2.3.12", features = [
|
||||
"chrono",
|
||||
"returning_clauses_for_sqlite_3_35",
|
||||
"serde_json",
|
||||
"time",
|
||||
"uuid",
|
||||
] }
|
||||
diesel-async = { version = "0.9.2", features = [
|
||||
"bb8",
|
||||
"migrations",
|
||||
"sqlite",
|
||||
@@ -35,17 +41,17 @@ rand_core.workspace = true
|
||||
rcgen.workspace = true
|
||||
chrono.workspace = true
|
||||
kameo.workspace = true
|
||||
chacha20poly1305 = { version = "0.10.1", features = ["std"] }
|
||||
argon2 = { version = "0.5.3", features = ["zeroize"] }
|
||||
chacha20poly1305 = { version = "0.11.0" }
|
||||
argon2 = { version = "0.6.0", features = ["zeroize"] }
|
||||
restructed = "0.2.2"
|
||||
strum = { version = "0.28.0", features = ["derive"] }
|
||||
pem = "3.0.6"
|
||||
pem = "4.0.0"
|
||||
sha2.workspace = true
|
||||
hmac.workspace = true
|
||||
alloy.workspace = true
|
||||
prost-types.workspace = true
|
||||
arbiter-tokens-registry.path = "../arbiter-tokens-registry"
|
||||
anyhow = "1.0.102"
|
||||
anyhow = "1.0.104"
|
||||
mutants.workspace = true
|
||||
subtle = "2.6.1"
|
||||
x25519-dalek.workspace = true
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
use argon2::password_hash::Salt as ArgonSalt;
|
||||
use rand::{
|
||||
Rng as _, SeedableRng,
|
||||
rngs::{StdRng, SysRng},
|
||||
@@ -42,7 +41,7 @@ impl<'a> TryFrom<&'a [u8]> for Nonce {
|
||||
}
|
||||
}
|
||||
|
||||
pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
|
||||
pub type Salt = [u8; argon2::RECOMMENDED_SALT_LEN];
|
||||
|
||||
pub fn generate_salt() -> Salt {
|
||||
let mut salt = Salt::default();
|
||||
|
||||
@@ -3,8 +3,8 @@ use encryption::v1::{Nonce, Salt};
|
||||
|
||||
use argon2::{Algorithm, Argon2};
|
||||
use chacha20poly1305::{
|
||||
AeadInPlace, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
|
||||
aead::{AeadMut, Error, Payload},
|
||||
AeadInOut, Key, KeyInit as _, XChaCha20Poly1305, XNonce,
|
||||
aead::{Aead, Error, Payload},
|
||||
};
|
||||
use rand::{
|
||||
Rng as _, SeedableRng as _,
|
||||
@@ -54,9 +54,9 @@ impl KeyCell {
|
||||
) -> Result<(), Error> {
|
||||
let key_reader = self.0.read();
|
||||
let cipher = XChaCha20Poly1305::new(&key_reader);
|
||||
let nonce = XNonce::from_slice(nonce.0.as_ref());
|
||||
let nonce = XNonce::from(nonce.0);
|
||||
let buffer = buffer.as_mut();
|
||||
cipher.encrypt_in_place(nonce, associated_data, buffer)
|
||||
cipher.encrypt_in_place(&nonce, associated_data, buffer)
|
||||
}
|
||||
pub fn decrypt_in_place(
|
||||
&mut self,
|
||||
@@ -66,10 +66,10 @@ impl KeyCell {
|
||||
) -> Result<(), Error> {
|
||||
let key_reader = self.0.read();
|
||||
let cipher = XChaCha20Poly1305::new(&key_reader);
|
||||
let nonce = XNonce::from_slice(nonce.0.as_ref());
|
||||
let nonce = XNonce::from(nonce.0);
|
||||
let mut buffer = buffer.write();
|
||||
let buffer: &mut Vec<u8> = buffer.as_mut();
|
||||
cipher.decrypt_in_place(nonce, associated_data, buffer)
|
||||
cipher.decrypt_in_place(&nonce, associated_data, buffer)
|
||||
}
|
||||
|
||||
pub fn encrypt(
|
||||
@@ -79,11 +79,11 @@ impl KeyCell {
|
||||
plaintext: impl AsRef<[u8]>,
|
||||
) -> Result<Vec<u8>, Error> {
|
||||
let key_reader = self.0.read();
|
||||
let mut cipher = XChaCha20Poly1305::new(&key_reader);
|
||||
let nonce = XNonce::from_slice(nonce.0.as_ref());
|
||||
let cipher = XChaCha20Poly1305::new(&key_reader);
|
||||
let nonce = XNonce::from(nonce.0);
|
||||
|
||||
let ciphertext = cipher.encrypt(
|
||||
nonce,
|
||||
&nonce,
|
||||
Payload {
|
||||
msg: plaintext.as_ref(),
|
||||
aad: associated_data,
|
||||
|
||||
@@ -10,7 +10,7 @@ use crate::{
|
||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||
use state::State;
|
||||
|
||||
use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
|
||||
use chacha20poly1305::{AeadInOut, KeyInit as _, XChaCha20Poly1305, XNonce};
|
||||
use kameo::{Actor, error::SendError, messages, prelude::Message};
|
||||
use kameo_actors::message_bus::Register;
|
||||
use tokio::sync::oneshot;
|
||||
@@ -101,14 +101,17 @@ impl VaultGate {
|
||||
ciphertext: &[u8],
|
||||
associated_data: &[u8],
|
||||
) -> Result<SafeCell<Vec<u8>>, ()> {
|
||||
let nonce = XNonce::from_slice(nonce);
|
||||
let Ok(nonce) = XNonce::try_from(nonce) else {
|
||||
error!("Encrypted key material carries a nonce of the wrong length");
|
||||
return Err(());
|
||||
};
|
||||
|
||||
let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
|
||||
|
||||
let mut key_buffer = SafeCell::new(ciphertext.to_vec());
|
||||
|
||||
let decryption_result = key_buffer.write_inline(|write_handle| {
|
||||
cipher.decrypt_in_place(nonce, associated_data, write_handle)
|
||||
cipher.decrypt_in_place(&nonce, associated_data, write_handle)
|
||||
});
|
||||
|
||||
match decryption_result {
|
||||
|
||||
@@ -16,7 +16,7 @@ use arbiter_server::{
|
||||
|
||||
use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
|
||||
use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
|
||||
|
||||
fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
|
||||
ClientMetadata {
|
||||
@@ -73,7 +73,7 @@ async fn insert_registered_client(
|
||||
|
||||
fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
|
||||
let challenge = challenge.format();
|
||||
key.signing_key()
|
||||
key.expanded_key()
|
||||
.sign_deterministic(&challenge, CLIENT_CONTEXT)
|
||||
.unwrap()
|
||||
.into()
|
||||
@@ -81,7 +81,7 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -
|
||||
|
||||
async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
|
||||
let mut conn = db.get().await.unwrap();
|
||||
let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
|
||||
let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
|
||||
.encode()
|
||||
.0
|
||||
.to_vec();
|
||||
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
|
||||
connect_client(props, &mut server_transport).await;
|
||||
});
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
|
||||
test_transport
|
||||
.send(auth::Inbound::AuthChallengeRequest {
|
||||
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
|
||||
let db = db::create_test_pool().await;
|
||||
let actors = spawn_test_actors(&db).await;
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
|
||||
Box::pin(insert_registered_client(
|
||||
&db,
|
||||
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
|
||||
pub async fn metadata_unchanged_does_not_append_history() {
|
||||
let db = db::create_test_pool().await;
|
||||
let actors = spawn_test_actors(&db).await;
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
let requested = metadata("client", Some("desc"), Some("1.0.0"));
|
||||
|
||||
Box::pin(insert_registered_client(
|
||||
@@ -269,7 +269,7 @@ pub async fn metadata_unchanged_does_not_append_history() {
|
||||
pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
|
||||
let db = db::create_test_pool().await;
|
||||
let actors = spawn_test_actors(&db).await;
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
|
||||
Box::pin(insert_registered_client(
|
||||
&db,
|
||||
@@ -360,7 +360,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
|
||||
let db = db::create_test_pool().await;
|
||||
let actors = spawn_test_actors(&db).await;
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
let requested = metadata("client", Some("desc"), Some("1.0.0"));
|
||||
|
||||
{
|
||||
|
||||
@@ -14,7 +14,7 @@ use arbiter_server::{
|
||||
use async_trait::async_trait;
|
||||
use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
|
||||
use diesel_async::RunQueryDsl;
|
||||
use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
|
||||
use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
|
||||
use tokio::sync::mpsc;
|
||||
|
||||
fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
|
||||
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
|
||||
challenge: &AuthChallenge,
|
||||
) -> authn::Signature {
|
||||
let challenge = challenge.format();
|
||||
key.signing_key()
|
||||
key.expanded_key()
|
||||
.sign_deterministic(&challenge, OPERATOR_CONTEXT)
|
||||
.unwrap()
|
||||
.into()
|
||||
@@ -170,7 +170,7 @@ pub async fn bootstrap_token_auth() {
|
||||
auth::authenticate(&mut props, &mut server_transport).await
|
||||
});
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
test_transport
|
||||
.send(auth::Inbound::AuthChallengeRequest {
|
||||
pubkey: verifying_key(&new_key).into(),
|
||||
@@ -227,7 +227,7 @@ pub async fn bootstrap_invalid_token_auth() {
|
||||
auth::authenticate(&mut props, &mut server_transport).await
|
||||
});
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
test_transport
|
||||
.send(auth::Inbound::AuthChallengeRequest {
|
||||
pubkey: verifying_key(&new_key).into(),
|
||||
@@ -280,7 +280,7 @@ pub async fn challenge_auth() {
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
|
||||
|
||||
{
|
||||
@@ -366,7 +366,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
|
||||
|
||||
{
|
||||
@@ -439,7 +439,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let new_key = MlDsa87::key_gen(&mut rand::rng());
|
||||
let new_key = SigningKey::<MlDsa87>::generate();
|
||||
let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();
|
||||
|
||||
{
|
||||
|
||||
@@ -16,7 +16,7 @@ use arbiter_server::{
|
||||
},
|
||||
};
|
||||
|
||||
use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
|
||||
use chacha20poly1305::{AeadInOut, XChaCha20Poly1305, XNonce, aead::KeyInit};
|
||||
use kameo::actor::Spawn as _;
|
||||
use tokio::sync::oneshot;
|
||||
use x25519_dalek::{EphemeralSecret, PublicKey};
|
||||
|
||||
Reference in New Issue
Block a user