def generate_files(self, config: Dict[str, Any], config_dir_path: str) -> None: if "signing_key" in config: return signing_key_path = config.get("signing_key_path") if signing_key_path is None: signing_key_path = os.path.join( config_dir_path, config["server_name"] + ".signing.key") if not self.path_exists(signing_key_path): print("Generating signing key file %s" % (signing_key_path, )) with open(signing_key_path, "w") as signing_key_file: key_id = "a_" + random_string(4) write_signing_keys(signing_key_file, (generate_signing_key(key_id), )) else: signing_keys = self.read_file(signing_key_path, "signing_key") if len(signing_keys.split("\n")[0].split()) == 1: # handle keys in the old format. key_id = "a_" + random_string(4) key = decode_signing_key_base64(NACL_ED25519, key_id, signing_keys.split("\n")[0]) with open(signing_key_path, "w") as signing_key_file: write_signing_keys(signing_key_file, (key, ))
def generate_files(self, config): signing_key_path = config["signing_key_path"] if not self.path_exists(signing_key_path): with open(signing_key_path, "w") as signing_key_file: key_id = "a_" + random_string(4) write_signing_keys(signing_key_file, (generate_signing_key(key_id), )) else: signing_keys = self.read_file(signing_key_path, "signing_key") if len(signing_keys.split("\n")[0].split()) == 1: # handle keys in the old format. key_id = "a_" + random_string(4) key = decode_signing_key_base64(NACL_ED25519, key_id, signing_keys.split("\n")[0]) with open(signing_key_path, "w") as signing_key_file: write_signing_keys(signing_key_file, (key, ))
def generate_files(self, config): signing_key_path = config["signing_key_path"] if not os.path.exists(signing_key_path): with open(signing_key_path, "w") as signing_key_file: key_id = "a_" + random_string(4) write_signing_keys( signing_key_file, (generate_signing_key(key_id),), ) else: signing_keys = self.read_file(signing_key_path, "signing_key") if len(signing_keys.split("\n")[0].split()) == 1: # handle keys in the old format. key_id = "a_" + random_string(4) key = decode_signing_key_base64( NACL_ED25519, key_id, signing_keys.split("\n")[0] ) with open(signing_key_path, "w") as signing_key_file: write_signing_keys( signing_key_file, (key,), )
def test_upload_signatures(self) -> None: """should check signatures that are uploaded""" # set up a user with cross-signing keys and a device. This user will # try uploading signatures local_user = "******" + self.hs.hostname device_id = "xyz" # private key: OMkooTr76ega06xNvXIGPbgvvxAOzmQncN8VObS7aBA device_pubkey = "NnHhnqiMFQkq969szYkooLaBAXW244ZOxgukCvm2ZeY" device_key = { "user_id": local_user, "device_id": device_id, "algorithms": [ "m.olm.curve25519-aes-sha2", RoomEncryptionAlgorithms.MEGOLM_V1_AES_SHA2, ], "keys": { "curve25519:xyz": "curve25519+key", "ed25519:xyz": device_pubkey }, "signatures": { local_user: { "ed25519:xyz": "something" } }, } device_signing_key = key.decode_signing_key_base64( "ed25519", "xyz", "OMkooTr76ega06xNvXIGPbgvvxAOzmQncN8VObS7aBA") self.get_success( self.handler.upload_keys_for_user(local_user, device_id, {"device_keys": device_key})) # private key: 2lonYOM6xYKdEsO+6KrC766xBcHnYnim1x/4LFGF8B0 master_pubkey = "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk" master_key = { "user_id": local_user, "usage": ["master"], "keys": { "ed25519:" + master_pubkey: master_pubkey }, } master_signing_key = key.decode_signing_key_base64( "ed25519", master_pubkey, "2lonYOM6xYKdEsO+6KrC766xBcHnYnim1x/4LFGF8B0") usersigning_pubkey = "Hq6gL+utB4ET+UvD5ci0kgAwsX6qP/zvf8v6OInU5iw" usersigning_key = { # private key: 4TL4AjRYwDVwD3pqQzcor+ez/euOB1/q78aTJ+czDNs "user_id": local_user, "usage": ["user_signing"], "keys": { "ed25519:" + usersigning_pubkey: usersigning_pubkey }, } usersigning_signing_key = key.decode_signing_key_base64( "ed25519", usersigning_pubkey, "4TL4AjRYwDVwD3pqQzcor+ez/euOB1/q78aTJ+czDNs") sign.sign_json(usersigning_key, local_user, master_signing_key) # private key: HvQBbU+hc2Zr+JP1sE0XwBe1pfZZEYtJNPJLZJtS+F8 selfsigning_pubkey = "EmkqvokUn8p+vQAGZitOk4PWjp7Ukp3txV2TbMPEiBQ" selfsigning_key = { "user_id": local_user, "usage": ["self_signing"], "keys": { "ed25519:" + selfsigning_pubkey: selfsigning_pubkey }, } selfsigning_signing_key = key.decode_signing_key_base64( "ed25519", selfsigning_pubkey, "HvQBbU+hc2Zr+JP1sE0XwBe1pfZZEYtJNPJLZJtS+F8") sign.sign_json(selfsigning_key, local_user, master_signing_key) cross_signing_keys = { "master_key": master_key, "user_signing_key": usersigning_key, "self_signing_key": selfsigning_key, } self.get_success( self.handler.upload_signing_keys_for_user(local_user, cross_signing_keys)) # set up another user with a master key. This user will be signed by # the first user other_user = "******" + self.hs.hostname other_master_pubkey = "fHZ3NPiKxoLQm5OoZbKa99SYxprOjNs4TwJUKP+twCM" other_master_key = { # private key: oyw2ZUx0O4GifbfFYM0nQvj9CL0b8B7cyN4FprtK8OI "user_id": other_user, "usage": ["master"], "keys": { "ed25519:" + other_master_pubkey: other_master_pubkey }, } self.get_success( self.handler.upload_signing_keys_for_user( other_user, {"master_key": other_master_key})) # test various signature failures (see below) ret = self.get_success( self.handler.upload_signatures_for_device_keys( local_user, { local_user: { # fails because the signature is invalid # should fail with INVALID_SIGNATURE device_id: { "user_id": local_user, "device_id": device_id, "algorithms": [ "m.olm.curve25519-aes-sha2", RoomEncryptionAlgorithms.MEGOLM_V1_AES_SHA2, ], "keys": { "curve25519:xyz": "curve25519+key", # private key: OMkooTr76ega06xNvXIGPbgvvxAOzmQncN8VObS7aBA "ed25519:xyz": device_pubkey, }, "signatures": { local_user: { "ed25519:" + selfsigning_pubkey: "something" } }, }, # fails because device is unknown # should fail with NOT_FOUND "unknown": { "user_id": local_user, "device_id": "unknown", "signatures": { local_user: { "ed25519:" + selfsigning_pubkey: "something" } }, }, # fails because the signature is invalid # should fail with INVALID_SIGNATURE master_pubkey: { "user_id": local_user, "usage": ["master"], "keys": { "ed25519:" + master_pubkey: master_pubkey }, "signatures": { local_user: { "ed25519:" + device_pubkey: "something" } }, }, }, other_user: { # fails because the device is not the user's master-signing key # should fail with NOT_FOUND "unknown": { "user_id": other_user, "device_id": "unknown", "signatures": { local_user: { "ed25519:" + usersigning_pubkey: "something" } }, }, other_master_pubkey: { # fails because the key doesn't match what the server has # should fail with UNKNOWN "user_id": other_user, "usage": ["master"], "keys": { "ed25519:" + other_master_pubkey: other_master_pubkey }, "something": "random", "signatures": { local_user: { "ed25519:" + usersigning_pubkey: "something" } }, }, }, }, )) user_failures = ret["failures"][local_user] self.assertEqual(user_failures[device_id]["errcode"], Codes.INVALID_SIGNATURE) self.assertEqual(user_failures[master_pubkey]["errcode"], Codes.INVALID_SIGNATURE) self.assertEqual(user_failures["unknown"]["errcode"], Codes.NOT_FOUND) other_user_failures = ret["failures"][other_user] self.assertEqual(other_user_failures["unknown"]["errcode"], Codes.NOT_FOUND) self.assertEqual(other_user_failures[other_master_pubkey]["errcode"], Codes.UNKNOWN) # test successful signatures del device_key["signatures"] sign.sign_json(device_key, local_user, selfsigning_signing_key) sign.sign_json(master_key, local_user, device_signing_key) sign.sign_json(other_master_key, local_user, usersigning_signing_key) ret = self.get_success( self.handler.upload_signatures_for_device_keys( local_user, { local_user: { device_id: device_key, master_pubkey: master_key }, other_user: { other_master_pubkey: other_master_key }, }, )) self.assertEqual(ret["failures"], {}) # fetch the signed keys/devices and make sure that the signatures are there ret = self.get_success( self.handler.query_devices( {"device_keys": { local_user: [], other_user: [] }}, 0, local_user, "device123", )) self.assertEqual( ret["device_keys"][local_user]["xyz"]["signatures"][local_user][ "ed25519:" + selfsigning_pubkey], device_key["signatures"][local_user]["ed25519:" + selfsigning_pubkey], ) self.assertEqual( ret["master_keys"][local_user]["signatures"][local_user][ "ed25519:" + device_id], master_key["signatures"][local_user]["ed25519:" + device_id], ) self.assertEqual( ret["master_keys"][other_user]["signatures"][local_user][ "ed25519:" + usersigning_pubkey], other_master_key["signatures"][local_user]["ed25519:" + usersigning_pubkey], )
def test_reupload_signatures(self) -> None: """re-uploading a signature should not fail""" local_user = "******" + self.hs.hostname keys1 = { "master_key": { # private key: HvQBbU+hc2Zr+JP1sE0XwBe1pfZZEYtJNPJLZJtS+F8 "user_id": local_user, "usage": ["master"], "keys": { "ed25519:EmkqvokUn8p+vQAGZitOk4PWjp7Ukp3txV2TbMPEiBQ": "EmkqvokUn8p+vQAGZitOk4PWjp7Ukp3txV2TbMPEiBQ" }, }, "self_signing_key": { # private key: 2lonYOM6xYKdEsO+6KrC766xBcHnYnim1x/4LFGF8B0 "user_id": local_user, "usage": ["self_signing"], "keys": { "ed25519:nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk": "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk" }, }, } master_signing_key = key.decode_signing_key_base64( "ed25519", "EmkqvokUn8p+vQAGZitOk4PWjp7Ukp3txV2TbMPEiBQ", "HvQBbU+hc2Zr+JP1sE0XwBe1pfZZEYtJNPJLZJtS+F8", ) sign.sign_json(keys1["self_signing_key"], local_user, master_signing_key) signing_key = key.decode_signing_key_base64( "ed25519", "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk", "2lonYOM6xYKdEsO+6KrC766xBcHnYnim1x/4LFGF8B0", ) self.get_success( self.handler.upload_signing_keys_for_user(local_user, keys1)) # upload two device keys, which will be signed later by the self-signing key device_key_1 = { "user_id": local_user, "device_id": "abc", "algorithms": [ "m.olm.curve25519-aes-sha2", RoomEncryptionAlgorithms.MEGOLM_V1_AES_SHA2, ], "keys": { "ed25519:abc": "base64+ed25519+key", "curve25519:abc": "base64+curve25519+key", }, "signatures": { local_user: { "ed25519:abc": "base64+signature" } }, } device_key_2 = { "user_id": local_user, "device_id": "def", "algorithms": [ "m.olm.curve25519-aes-sha2", RoomEncryptionAlgorithms.MEGOLM_V1_AES_SHA2, ], "keys": { "ed25519:def": "base64+ed25519+key", "curve25519:def": "base64+curve25519+key", }, "signatures": { local_user: { "ed25519:def": "base64+signature" } }, } self.get_success( self.handler.upload_keys_for_user(local_user, "abc", {"device_keys": device_key_1})) self.get_success( self.handler.upload_keys_for_user(local_user, "def", {"device_keys": device_key_2})) # sign the first device key and upload it del device_key_1["signatures"] sign.sign_json(device_key_1, local_user, signing_key) self.get_success( self.handler.upload_signatures_for_device_keys( local_user, {local_user: { "abc": device_key_1 }})) # sign the second device key and upload both device keys. The server # should ignore the first device key since it already has a valid # signature for it del device_key_2["signatures"] sign.sign_json(device_key_2, local_user, signing_key) self.get_success( self.handler.upload_signatures_for_device_keys( local_user, {local_user: { "abc": device_key_1, "def": device_key_2 }})) device_key_1["signatures"][local_user][ "ed25519:abc"] = "base64+signature" device_key_2["signatures"][local_user][ "ed25519:def"] = "base64+signature" devices = self.get_success( self.handler.query_devices({"device_keys": { local_user: [] }}, 0, local_user, "device123")) del devices["device_keys"][local_user]["abc"]["unsigned"] del devices["device_keys"][local_user]["def"]["unsigned"] self.assertDictEqual(devices["device_keys"][local_user]["abc"], device_key_1) self.assertDictEqual(devices["device_keys"][local_user]["def"], device_key_2)
def test_decode_invalid_key(self): with self.assertRaises(Exception): decode_signing_key_base64("ed25519", self.version, "")
def test_decode_signing_invalid_algorithm(self): with self.assertRaises(Exception): decode_signing_key_base64("not a valid alg", self.version, "")
def test_decode(self): decoded_key = decode_signing_key_base64("ed25519", self.version, self.key_base64) self.assertEquals(decoded_key.alg, "ed25519") self.assertEquals(decoded_key.version, self.version)
def setUp(self): self.signing_key: SigningKey = decode_signing_key_base64( KEY_ALG, KEY_VER, SIGNING_KEY_SEED)
header = { 'alg': 'ES256' } payload = { 'claim': 'JSON is the raddest.', 'iss': 'brianb' } sig = jws.sign(header, payload, sk256) print(jws.verify(header, payload, sig, vk)) ''' #------ from signedjson.key import generate_signing_key, get_verify_key, encode_signing_key_base64, decode_signing_key_base64 from signedjson.sign import (sign_json, verify_signed_json, SignatureVerifyException) signing_key = generate_signing_key('zxcvb') signed_json = sign_json({'my_key': 'my_data'}, 'CDF', signing_key) print(signed_json) #Going into function verify_key = get_verify_key(signing_key) print("Going into function", verify_key) enc = encode_signing_key_base64(verify_key) print("Base64 encoded:", enc) print("This will go into function") print(decode_signing_key_base64("ed25519", "zxcvb", enc)) try: verify_signed_json(signed_json, 'CDF', verify_key) print('Signature is valid') except SignatureVerifyException: print('Signature is invalid')
def test_decode(self): decoded_key = decode_signing_key_base64( "ed25519", self.version, self.key_base64 ) self.assertEquals(decoded_key.alg, "ed25519") self.assertEquals(decoded_key.version, self.version)