eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

redesign sshsigchain authority protocol

Browse source
This commit is contained in:
Eric Wendland 2026-07-18 21:48:27 +02:00
commit 492a37c020
5 changed files with 1542 additions and 867 deletions
Download patch file Download diff file Expand all files Collapse all files

14
crates/geth-cli/src/lib.rs
View file

@ -4109,20 +4109,22 @@ fn print_response(response: ControlResponse, output: OutputMode) -> Result<()> {
chain_id,
records,
head,
active_admin_keys,
users,
active_keys,
devices,
nodes,
disclosed_profiles,
incomplete_profiles,
anchor_threshold,
note,
} => {
println!("sigchain: {}", input.display());
println!("chain_id: {chain_id}");
println!("records: {records}");
println!("head: {head}");
println!("active_admin_keys: {active_admin_keys}");
println!("users: {users}");
println!("active_keys: {active_keys}");
println!("devices: {devices}");
println!("nodes: {nodes}");
println!("disclosed_profiles: {disclosed_profiles}");
println!("incomplete_profiles: {incomplete_profiles}");
println!("anchor_threshold: {anchor_threshold}");
eprintln!("note: {note}");
}
ControlResponse::KeychainExplained { subject, lines } => {

7
crates/geth-control/src/lib.rs
View file

@ -746,10 +746,11 @@ pub enum ControlResponse {
chain_id: String,
records: usize,
head: String,
active_admin_keys: usize,
users: usize,
active_keys: usize,
devices: usize,
nodes: usize,
disclosed_profiles: usize,
incomplete_profiles: usize,
anchor_threshold: u16,
note: String,
},
KeychainExplained {

19
crates/geth-keychain/src/lib.rs
View file

@ -13,15 +13,16 @@
mod sshsigchain;
pub use sshsigchain::{
ChainId as SshSigchainChainId, Digest as SshSigchainDigest,
KEYCHAIN_SSH_SIGCHAIN_PAYLOAD_VERSION, KEYCHAIN_SSH_SIGCHAIN_PROFILE,
KeychainSshSigchainPolicy, KeychainSshSigchainState, KeychainSshSigchainVerification,
MAX_JSONL_BYTES, MAX_JSONL_LINE_BYTES, MAX_NAMESPACE_BYTES, SSH_SIGCHAIN_NAMESPACE,
SSH_SIGCHAIN_VERIFIER_PRINCIPAL, SSH_SIGCHAIN_VERSION, SshSigchainError, SshSigchainPolicy,
SshSigchainRecord, SshSigchainTrust, SshSigchainVerification, SshSigchainVerifier,
decode_keychain_sshsigchain_payload, decode_sshsigchain_jsonl, encode_sshsigchain_jsonl,
keychain_sshsigchain_payload, keychain_sshsigchain_unsigned_record,
verify_keychain_sshsigchain, verify_sshsigchain,
AnchorBackendPolicy, AnchorPolicy, AnchorReceipt, AnchorReceiptVerifier, AnchoredHistory,
AuthorityDeviceState, AuthorityKey, AuthorityKeyId, AuthorityKeyState, AuthorityState,
AuthorityTransition, ChainId as SshSigchainChainId, Digest as SshSigchainDigest, HeadClaim,
MAX_JSONL_BYTES, MAX_JSONL_LINE_BYTES, MAX_NAMESPACE_BYTES, Permission, ProfileDisclosure,
ProfileExtension, SSH_SIGCHAIN_ANCHOR_NAMESPACE, SSH_SIGCHAIN_KEY_PROOF_NAMESPACE,
SSH_SIGCHAIN_NAMESPACE, SSH_SIGCHAIN_VERIFIER_PRINCIPAL, SSH_SIGCHAIN_VERSION,
SshSigchainError, SshSigchainRecord, SshSigchainTrust, SshSigchainVerification,
SshSigchainVerifier, authority_key_id, decode_sshsigchain_jsonl, encode_sshsigchain_jsonl,
key_proof_signing_bytes, profile_payload_commitment, select_anchored_head,
verify_anchor_receipts, verify_head_claim, verify_sshsigchain,
};
use geth_types::{

2534
crates/geth-keychain/src/sshsigchain.rs
View file

File diff suppressed because it is too large Load diff

69
crates/geth-node/src/lib.rs
View file

@ -6505,7 +6505,6 @@ pub fn handle_request(
let records = read_sshsigchain_jsonl_file(&input)?;
let trust = geth_keychain::SshSigchainTrust::new(
geth_keychain::SshSigchainChainId::from_hex(&chain_id)?,
geth_keychain::KEYCHAIN_SSH_SIGCHAIN_PROFILE,
namespace.unwrap_or_else(|| geth_keychain::SSH_SIGCHAIN_NAMESPACE.to_owned()),
std::fs::read_to_string(root_key_path)?,
)?;
@ -6515,12 +6514,13 @@ pub fn handle_request(
chain_id: trust.chain_id.to_hex(),
records: verified.records,
head: verified.head.to_hex(),
active_admin_keys: verified.view.admin_keys.len(),
users: verified.view.users.len(),
devices: verified.view.devices.len(),
nodes: verified.view.nodes.len(),
active_keys: verified.state.active_key_count(),
devices: verified.state.devices.values().filter(|device| device.active).count(),
disclosed_profiles: verified.state.disclosed_profiles.len(),
incomplete_profiles: verified.state.incomplete_profiles.len(),
anchor_threshold: verified.state.anchor_policy.threshold,
note:
"verified linked SSHSIGCHAIN v1 records against the explicitly pinned root key"
"verified sequence-free SSHSIGCHAIN v1 authority records and disclosed profile commitments against the explicitly pinned root key"
.to_owned(),
})
}
@ -9545,7 +9545,7 @@ fn verify_keychain_sigchain_entries_with_ssh(
fn verify_keychain_sshsigchain_with_ssh(
records: &[geth_keychain::SshSigchainRecord],
trust: &geth_keychain::SshSigchainTrust,
) -> Result<geth_keychain::KeychainSshSigchainVerification, NodeError> {
) -> Result<geth_keychain::SshSigchainVerification, NodeError> {
geth_ssh_identity::ensure_ssh_keygen_available()?;
let verify_dir = tempfile::tempdir()?;
@ -9601,7 +9601,7 @@ fn verify_keychain_sshsigchain_with_ssh(
let verifier = SshSigchainOpenSshVerifier {
verify_dir: verify_dir.path().to_path_buf(),
};
Ok(geth_keychain::verify_keychain_sshsigchain(
Ok(geth_keychain::verify_sshsigchain(
records, trust, &verifier,
)?)
}
@ -11045,14 +11045,13 @@ mod tests {
);
let trust = geth_keychain::SshSigchainTrust::new(
geth_keychain::SshSigchainChainId([0x42; 32]),
geth_keychain::KEYCHAIN_SSH_SIGCHAIN_PROFILE,
geth_keychain::SSH_SIGCHAIN_NAMESPACE,
&root_public_key,
)
.expect("trust tuple");
let sign = |record: geth_keychain::SshSigchainRecord| {
let payload = dir.path().join(format!("record-{}", record.sequence));
let payload = dir.path().join("record");
std::fs::write(&payload, record.signing_bytes().expect("signing bytes"))
.expect("write signing payload");
let output = geth_ssh_identity::sign_command(
@ -11072,50 +11071,32 @@ mod tests {
record.with_signature(signature).expect("signed record")
};
let init_op = KeychainOp {
id: AuthOpId::new("auth-op:sshsigchain-init"),
created_at: UnixMillis(1),
kind: KeychainOpKind::KeychainInit,
};
let init = sign(
geth_keychain::keychain_sshsigchain_unsigned_record(
&trust,
0,
geth_keychain::SshSigchainRecord::unsigned(
trust.chain_id,
None,
&init_op,
&root_public_key,
geth_keychain::AuthorityTransition::Genesis {
device_id: "device:root".to_owned(),
root_key: geth_keychain::AuthorityKey {
public_key: root_public_key.clone(),
permissions: vec![geth_keychain::Permission::All],
delegable_permissions: vec![geth_keychain::Permission::All],
},
anchor_policy: geth_keychain::AnchorPolicy::default(),
},
vec![],
)
.expect("unsigned init"),
);
let root_add_op = KeychainOp {
id: AuthOpId::new("auth-op:sshsigchain-root"),
created_at: UnixMillis(2),
kind: KeychainOpKind::AdminKeyAdd {
key: KeyId::new(geth_keychain::admin_key_fingerprint(&root_public_key)),
public_key: Some(root_public_key.clone()),
principal: Some("root".to_owned()),
valid_after_ms: None,
valid_before_ms: None,
},
};
let root_add = sign(
geth_keychain::keychain_sshsigchain_unsigned_record(
&trust,
1,
Some(init.record_hash().expect("init hash")),
&root_add_op,
&root_public_key,
)
.expect("unsigned root add"),
);
let verified = verify_keychain_sshsigchain_with_ssh(&[init.clone(), root_add], &trust)
let verified = verify_keychain_sshsigchain_with_ssh(&[init.clone()], &trust)
.expect("verify real OpenSSH SSHSIG chain");
assert_eq!(verified.records, 2);
assert_eq!(verified.view.admin_keys.len(), 1);
assert_eq!(verified.records, 1);
assert_eq!(verified.state.active_key_count(), 1);
let mut tampered = init;
tampered.payload.push(0);
tampered.chain_id = geth_keychain::SshSigchainChainId([0x43; 32]);
assert!(verify_keychain_sshsigchain_with_ssh(&[tampered], &trust).is_err());
}