feat(keys): halkyon_keys, an account's keys on the device
ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook compiles the libsodium 1.0.22 it ships: a C compiler and make wherever it builds): - Argon2id (64 MiB, 3 passes, kept with the account and never below that) makes a master key, which libsodium's KDF splits into SRP's secret (x) and the key-encryption key. - The account's X25519 and Ed25519 key pairs, their private halves wrapped with XChaCha20-Poly1305 under the KEK and under the recovery key, bound to their public keys. - A 24-word BIP-39 recovery phrase (the English list, MIT) and the recovery key derived from it. - Data keys sealed to the account with crypto_box_seal, bound to their IDs; content in ADR 0002's envelope, encrypted with a data key and signed with Ed25519 (detached), bound to a context the caller names. - Secrets in libsodium's guarded memory where its API takes them. - Tests: libsodium's Argon2id known answers, BIP-39's English vectors, round trips and every refusal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
470a0b633c
commit
3bc0bae6e3
GPG key ID:
07F6FCF405488B64
1 changed files with 4495 additions and 0 deletions
198
packages/halkyon_keys/test/account_keys_test.dart
Normal file
198
packages/halkyon_keys/test/account_keys_test.dart
Normal file
|
|
@ -0,0 +1,198 @@
|
|||
import 'dart:typed_data';
|
||||
|
||||
import 'package:halkyon_keys/halkyon_keys.dart';
|
||||
import 'package:sodium/sodium_sumo.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
||||
Future<void> main() async {
|
||||
final sodium = await SodiumSumoInit.init();
|
||||
const cheap = PasswordKdf(opsLimit: 1, memLimit: 8192);
|
||||
final salt = Uint8List.fromList(List.generate(16, (i) => i));
|
||||
|
||||
Matcher refusedFor(KeyRefusal reason) => throwsA(
|
||||
isA<KeyRefused>().having((refused) => refused.reason, 'reason', reason),
|
||||
);
|
||||
|
||||
test('key pairs: X25519 to encrypt to, Ed25519 to sign with', () {
|
||||
final keys = AccountKeys.generate(sodium);
|
||||
expect(keys.encryptionPublicKey, hasLength(32));
|
||||
expect(keys.signingPublicKey, hasLength(32));
|
||||
expect(
|
||||
AccountKeys.generate(sodium).encryptionPublicKey,
|
||||
isNot(keys.encryptionPublicKey),
|
||||
);
|
||||
});
|
||||
|
||||
group('wrapped under the password', () {
|
||||
final keys = AccountKeys.generate(sodium);
|
||||
final password = derivePasswordKeys(
|
||||
sodium,
|
||||
password: 'a password',
|
||||
salt: salt,
|
||||
kdf: cheap,
|
||||
);
|
||||
final wrapped = wrapAccountKeys(sodium, keys, password.keyEncryptionKey);
|
||||
|
||||
AccountKeys unwrap(
|
||||
WrappedAccountKeys what,
|
||||
SecureKey key, {
|
||||
Uint8List? encryptionPublicKey,
|
||||
Uint8List? signingPublicKey,
|
||||
}) => unwrapAccountKeys(
|
||||
sodium,
|
||||
what,
|
||||
key,
|
||||
encryptionPublicKey: encryptionPublicKey ?? keys.encryptionPublicKey,
|
||||
signingPublicKey: signingPublicKey ?? keys.signingPublicKey,
|
||||
);
|
||||
|
||||
test('the same password opens them on another device, the same keys', () {
|
||||
final again = derivePasswordKeys(
|
||||
sodium,
|
||||
password: 'a password',
|
||||
salt: salt,
|
||||
kdf: cheap,
|
||||
);
|
||||
final opened = unwrap(
|
||||
WrappedAccountKeys.fromJson(wrapped.toJson()),
|
||||
again.keyEncryptionKey,
|
||||
);
|
||||
expect(
|
||||
opened.encryption.secretKey.extractBytes(),
|
||||
keys.encryption.secretKey.extractBytes(),
|
||||
);
|
||||
expect(
|
||||
opened.signing.secretKey.extractBytes(),
|
||||
keys.signing.secretKey.extractBytes(),
|
||||
);
|
||||
// They work: a signature made with the opened key checks.
|
||||
final message = Uint8List.fromList([1, 2, 3]);
|
||||
expect(
|
||||
sodium.crypto.sign.verifyDetached(
|
||||
message: message,
|
||||
signature: sodium.crypto.sign.detached(
|
||||
message: message,
|
||||
secretKey: opened.signing.secretKey,
|
||||
),
|
||||
publicKey: keys.signingPublicKey,
|
||||
),
|
||||
isTrue,
|
||||
);
|
||||
});
|
||||
|
||||
test('nothing secret is in what the register keeps', () {
|
||||
final json = wrapped.toJson();
|
||||
expect(json.keys, unorderedEquals(['nonce', 'cipherText']));
|
||||
expect(wrapped.nonce, hasLength(24));
|
||||
// 32 + 64 bytes of keys and Poly1305's 16-byte tag.
|
||||
expect(wrapped.cipherText, hasLength(112));
|
||||
});
|
||||
|
||||
test('a wrong password is refused', () {
|
||||
final wrong = derivePasswordKeys(
|
||||
sodium,
|
||||
password: 'a passwort',
|
||||
salt: salt,
|
||||
kdf: cheap,
|
||||
);
|
||||
expect(
|
||||
() => unwrap(wrapped, wrong.keyEncryptionKey),
|
||||
refusedFor(KeyRefusal.wrongKeyOrTampered),
|
||||
);
|
||||
});
|
||||
|
||||
test('a ciphertext or nonce changed is refused', () {
|
||||
final cipherText = Uint8List.fromList(wrapped.cipherText)..[5] ^= 1;
|
||||
final nonce = Uint8List.fromList(wrapped.nonce)..[0] ^= 1;
|
||||
for (final tampered in [
|
||||
WrappedAccountKeys(nonce: wrapped.nonce, cipherText: cipherText),
|
||||
WrappedAccountKeys(nonce: nonce, cipherText: wrapped.cipherText),
|
||||
WrappedAccountKeys(
|
||||
nonce: wrapped.nonce,
|
||||
cipherText: wrapped.cipherText.sublist(1),
|
||||
),
|
||||
]) {
|
||||
expect(
|
||||
() => unwrap(tampered, password.keyEncryptionKey),
|
||||
refusedFor(KeyRefusal.wrongKeyOrTampered),
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test("another account's public keys don't open them: they are bound to "
|
||||
'their own', () {
|
||||
final other = AccountKeys.generate(sodium);
|
||||
expect(
|
||||
() => unwrap(
|
||||
wrapped,
|
||||
password.keyEncryptionKey,
|
||||
encryptionPublicKey: other.encryptionPublicKey,
|
||||
),
|
||||
refusedFor(KeyRefusal.wrongKeyOrTampered),
|
||||
);
|
||||
expect(
|
||||
() => unwrap(
|
||||
wrapped,
|
||||
password.keyEncryptionKey,
|
||||
signingPublicKey: other.signingPublicKey,
|
||||
),
|
||||
refusedFor(KeyRefusal.wrongKeyOrTampered),
|
||||
);
|
||||
expect(
|
||||
() => unwrap(
|
||||
wrapped,
|
||||
password.keyEncryptionKey,
|
||||
signingPublicKey: Uint8List(31),
|
||||
),
|
||||
refusedFor(KeyRefusal.notTheAccountsKeys),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
test('wrapped again under the recovery key, the phrase opens them', () {
|
||||
final keys = AccountKeys.generate(sodium);
|
||||
final phrase = newRecoveryPhrase(sodium);
|
||||
final wrapped = wrapAccountKeys(
|
||||
sodium,
|
||||
keys,
|
||||
recoveryKeyOf(sodium, phrase),
|
||||
);
|
||||
final opened = unwrapAccountKeys(
|
||||
sodium,
|
||||
wrapped,
|
||||
recoveryKeyOf(sodium, phrase),
|
||||
encryptionPublicKey: keys.encryptionPublicKey,
|
||||
signingPublicKey: keys.signingPublicKey,
|
||||
);
|
||||
expect(
|
||||
opened.encryption.secretKey.extractBytes(),
|
||||
keys.encryption.secretKey.extractBytes(),
|
||||
);
|
||||
expect(
|
||||
() => unwrapAccountKeys(
|
||||
sodium,
|
||||
wrapped,
|
||||
recoveryKeyOf(sodium, newRecoveryPhrase(sodium)),
|
||||
encryptionPublicKey: keys.encryptionPublicKey,
|
||||
signingPublicKey: keys.signingPublicKey,
|
||||
),
|
||||
refusedFor(KeyRefusal.wrongKeyOrTampered),
|
||||
);
|
||||
});
|
||||
|
||||
test('every wrapping takes a new nonce', () {
|
||||
final keys = AccountKeys.generate(sodium);
|
||||
final key = sodium.crypto.aeadXChaCha20Poly1305IETF.keygen();
|
||||
final first = wrapAccountKeys(sodium, keys, key);
|
||||
final second = wrapAccountKeys(sodium, keys, key);
|
||||
expect(first.nonce, isNot(second.nonce));
|
||||
expect(first.cipherText, isNot(second.cipherText));
|
||||
});
|
||||
|
||||
test("what isn't wrapped account keys can't be read as such", () {
|
||||
expect(
|
||||
() => WrappedAccountKeys.fromJson({'nonce': 'AAAA'}),
|
||||
throwsFormatException,
|
||||
);
|
||||
});
|
||||
}
|
||||
Loading…
Reference in a new issue