eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: replace private cas envelope

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 23:02:59 +02:00
commit 63ea36bb51
10 changed files with 193 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

205
crates/geth-cas/src/lib.rs
View file

@ -4,7 +4,9 @@ use std::collections::{BTreeMap, BTreeSet};
use std::path::{Path, PathBuf};
pub const CAS_TREE_OBJECT_VERSION: u16 = 1;
pub const ENCRYPTED_BLOB_ENVELOPE_VERSION: u16 = 1;
pub const ENCRYPTED_BLOB_ENVELOPE_VERSION: u16 = 2;
pub const PRIVATE_BLOB_AEAD_ALGORITHM: &str = "geth.aes-256-gcm.v1";
pub const PRIVATE_BLOB_PROTOTYPE_ALGORITHM: &str = "geth.blake3-xor.v0.prototype";
#[derive(Debug, thiserror::Error)]
pub enum CasError {
@ -191,23 +193,50 @@ pub fn encrypt_private_blob(
resource: &str,
secret_id: &str,
epoch: u64,
nonce_hex: &str,
plaintext: &[u8],
) -> Result<Vec<u8>, CasError> {
let nonce: [u8; 12] = rand::random();
encrypt_private_blob_with_nonce(resource, secret_id, epoch, nonce, plaintext)
}
fn encrypt_private_blob_with_nonce(
resource: &str,
secret_id: &str,
epoch: u64,
nonce: [u8; 12],
plaintext: &[u8],
) -> Result<Vec<u8>, CasError> {
use aes_gcm::{
Aes256Gcm, Nonce,
aead::{Aead, KeyInit, Payload},
};
let key = private_blob_key(resource, secret_id, epoch);
let nonce = decode_32_byte_hex(nonce_hex)?;
let ciphertext = xor_keystream(&key, &nonce, plaintext);
let tag_hex = private_blob_tag(&key, &nonce, &ciphertext);
let cipher = Aes256Gcm::new_from_slice(&key)
.map_err(|error| CasError::EncryptedEnvelope(error.to_string()))?;
let plaintext_hash = hash_bytes(plaintext);
let aad = private_blob_aad(resource, epoch, &plaintext_hash);
let ciphertext = cipher
.encrypt(
Nonce::from_slice(&nonce),
Payload {
msg: plaintext,
aad: aad.as_bytes(),
},
)
.map_err(|_| {
CasError::EncryptedEnvelope("private blob AEAD encryption failed".to_owned())
})?;
let envelope = EncryptedBlobEnvelope {
version: ENCRYPTED_BLOB_ENVELOPE_VERSION,
algorithm: "geth.blake3-xor.v0.prototype".to_owned(),
algorithm: PRIVATE_BLOB_AEAD_ALGORITHM.to_owned(),
resource: resource.to_owned(),
epoch,
plaintext_hash: hash_bytes(plaintext),
nonce_hex: nonce_hex.to_owned(),
plaintext_hash,
nonce_hex: hex::encode(nonce),
ciphertext,
tag_hex,
note: "prototype private blob envelope; not an audited AEAD and does not claim forward secrecy or post-compromise security".to_owned(),
tag_hex: "included-in-aes-gcm-ciphertext".to_owned(),
note: "private blob envelope uses AES-256-GCM with a random 96-bit nonce and resource-bound associated data; it does not claim forward secrecy or post-compromise security".to_owned(),
};
geth_codec::encode_canonical(&envelope).map_err(CasError::from)
}
@ -219,26 +248,53 @@ pub fn decrypt_private_blob(
) -> Result<Vec<u8>, CasError> {
let envelope: EncryptedBlobEnvelope = geth_codec::decode_canonical(envelope_bytes)?;
if envelope.version != ENCRYPTED_BLOB_ENVELOPE_VERSION {
if envelope.version == 1 || envelope.algorithm == PRIVATE_BLOB_PROTOTYPE_ALGORITHM {
return Err(CasError::EncryptedEnvelope(
"prototype private blob envelopes are no longer accepted; recreate the private blob with this pre-release".to_owned(),
));
}
return Err(CasError::EncryptedEnvelope(format!(
"unsupported envelope version {}",
envelope.version
)));
}
if envelope.algorithm != PRIVATE_BLOB_AEAD_ALGORITHM {
return Err(CasError::EncryptedEnvelope(format!(
"unsupported encrypted blob algorithm {}",
envelope.algorithm
)));
}
if envelope.resource != resource {
return Err(CasError::EncryptedEnvelope(format!(
"envelope resource {} does not match requested resource {resource}",
envelope.resource
)));
}
let key = private_blob_key(resource, secret_id, envelope.epoch);
let nonce = decode_32_byte_hex(&envelope.nonce_hex)?;
let expected_tag = private_blob_tag(&key, &nonce, &envelope.ciphertext);
if expected_tag != envelope.tag_hex {
if envelope.tag_hex != "included-in-aes-gcm-ciphertext" {
return Err(CasError::EncryptedEnvelope(
"encrypted blob tag verification failed".to_owned(),
"invalid AES-GCM envelope tag marker".to_owned(),
));
}
let plaintext = xor_keystream(&key, &nonce, &envelope.ciphertext);
use aes_gcm::{
Aes256Gcm, Nonce,
aead::{Aead, KeyInit, Payload},
};
let key = private_blob_key(resource, secret_id, envelope.epoch);
let nonce = decode_hex_exact::<12>(&envelope.nonce_hex)?;
let cipher = Aes256Gcm::new_from_slice(&key)
.map_err(|error| CasError::EncryptedEnvelope(error.to_string()))?;
let aad = private_blob_aad(resource, envelope.epoch, &envelope.plaintext_hash);
let plaintext = cipher
.decrypt(
Nonce::from_slice(&nonce),
Payload {
msg: envelope.ciphertext.as_ref(),
aad: aad.as_bytes(),
},
)
.map_err(|_| {
CasError::EncryptedEnvelope("private blob AEAD verification failed".to_owned())
})?;
let plaintext_hash = hash_bytes(&plaintext);
if plaintext_hash != envelope.plaintext_hash {
return Err(CasError::EncryptedEnvelope(
@ -249,42 +305,25 @@ pub fn decrypt_private_blob(
}
fn private_blob_key(resource: &str, secret_id: &str, epoch: u64) -> [u8; 32] {
let material = format!("geth.private-blob.v0\0{resource}\0{secret_id}\0{epoch}");
let material = format!("geth.private-blob.aes-256-gcm.v1\0{resource}\0{secret_id}\0{epoch}");
*blake3::hash(material.as_bytes()).as_bytes()
}
fn xor_keystream(key: &[u8; 32], nonce: &[u8; 32], input: &[u8]) -> Vec<u8> {
let mut out = Vec::with_capacity(input.len());
for (chunk_index, chunk) in input.chunks(32).enumerate() {
let mut block_input = Vec::with_capacity(40);
block_input.extend_from_slice(nonce);
block_input.extend_from_slice(&(chunk_index as u64).to_le_bytes());
let block = blake3::keyed_hash(key, &block_input);
out.extend(
chunk
.iter()
.zip(block.as_bytes().iter())
.map(|(byte, mask)| byte ^ mask),
);
}
out
fn private_blob_aad(resource: &str, epoch: u64, plaintext_hash: &BlobHash) -> String {
format!(
"{}\0{}\0{}\0{}",
PRIVATE_BLOB_AEAD_ALGORITHM, resource, epoch, plaintext_hash
)
}
fn private_blob_tag(key: &[u8; 32], nonce: &[u8; 32], ciphertext: &[u8]) -> String {
let mut input = Vec::with_capacity(nonce.len() + ciphertext.len());
input.extend_from_slice(nonce);
input.extend_from_slice(ciphertext);
blake3::keyed_hash(key, &input).to_hex().to_string()
}
fn decode_32_byte_hex(hex: &str) -> Result<[u8; 32], CasError> {
if hex.len() != 64 {
return Err(CasError::EncryptedEnvelope(
"nonce must be 32 bytes encoded as lowercase hex".to_owned(),
));
fn decode_hex_exact<const N: usize>(hex: &str) -> Result<[u8; N], CasError> {
if hex.len() != N * 2 {
return Err(CasError::EncryptedEnvelope(format!(
"nonce must be {N} bytes encoded as lowercase hex"
)));
}
let mut bytes = [0_u8; 32];
for index in 0..32 {
let mut bytes = [0_u8; N];
for index in 0..N {
bytes[index] = u8::from_str_radix(&hex[index * 2..index * 2 + 2], 16)
.map_err(|error| CasError::EncryptedEnvelope(format!("invalid nonce hex: {error}")))?;
}
@ -769,18 +808,82 @@ mod tests {
}
#[test]
fn private_blob_envelope_roundtrips_and_checks_resource() {
fn private_blob_envelope_uses_aead_and_checks_bound_context() {
let plaintext = b"private geth bytes";
let nonce = "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f";
let envelope =
encrypt_private_blob("resource:cas:private", "secret:test", 1, nonce, plaintext)
.expect("encrypt");
let envelope = encrypt_private_blob_with_nonce(
"resource:cas:private",
"secret:test",
1,
[7; 12],
plaintext,
)
.expect("encrypt");
let decrypted = decrypt_private_blob("resource:cas:private", "secret:test", &envelope)
.expect("decrypt");
assert_eq!(decrypted, plaintext);
assert!(decrypt_private_blob("resource:cas:other", "secret:test", &envelope).is_err());
assert!(decrypt_private_blob("resource:cas:private", "secret:other", &envelope).is_err());
let decoded: EncryptedBlobEnvelope =
geth_codec::decode_canonical(&envelope).expect("decode envelope");
assert_eq!(decoded.version, ENCRYPTED_BLOB_ENVELOPE_VERSION);
assert_eq!(decoded.algorithm, PRIVATE_BLOB_AEAD_ALGORITHM);
assert_eq!(decoded.nonce_hex, "070707070707070707070707");
assert_eq!(decoded.tag_hex, "included-in-aes-gcm-ciphertext");
let mut tampered_ciphertext = decoded.clone();
tampered_ciphertext.ciphertext[0] ^= 0x01;
let tampered_ciphertext =
geth_codec::encode_canonical(&tampered_ciphertext).expect("encode tampered");
assert!(
decrypt_private_blob("resource:cas:private", "secret:test", &tampered_ciphertext)
.is_err()
);
let mut tampered_hash = decoded.clone();
tampered_hash.plaintext_hash = hash_bytes(b"other plaintext");
let tampered_hash = geth_codec::encode_canonical(&tampered_hash).expect("encode tampered");
assert!(
decrypt_private_blob("resource:cas:private", "secret:test", &tampered_hash).is_err()
);
}
#[test]
fn private_blob_envelope_generates_unique_nonces() {
let first = encrypt_private_blob("resource:cas:private", "secret:test", 1, b"same")
.expect("first encrypt");
let second = encrypt_private_blob("resource:cas:private", "secret:test", 1, b"same")
.expect("second encrypt");
let first: EncryptedBlobEnvelope =
geth_codec::decode_canonical(&first).expect("decode first");
let second: EncryptedBlobEnvelope =
geth_codec::decode_canonical(&second).expect("decode second");
assert_ne!(first.nonce_hex, second.nonce_hex);
assert_ne!(first.ciphertext, second.ciphertext);
}
#[test]
fn prototype_private_blob_envelopes_are_rejected() {
let envelope = EncryptedBlobEnvelope {
version: 1,
algorithm: PRIVATE_BLOB_PROTOTYPE_ALGORITHM.to_owned(),
resource: "resource:cas:private".to_owned(),
epoch: 1,
plaintext_hash: hash_bytes(b"private geth bytes"),
nonce_hex: "00".repeat(32),
ciphertext: vec![1, 2, 3],
tag_hex: "prototype-tag".to_owned(),
note: "old prototype".to_owned(),
};
let encoded = geth_codec::encode_canonical(&envelope).expect("encode prototype");
let error = decrypt_private_blob("resource:cas:private", "secret:test", &encoded)
.expect_err("reject prototype");
assert!(
error
.to_string()
.contains("prototype private blob envelopes")
);
}
#[test]