2 |
3 | # Git-Ring; Easy SSH Ring Signatures
4 |
5 | Anonymously proving that you belong to a set of Github users is now easy.
6 |
7 | Git(hub/lab) is one of the few places with a large repository of identities tied to associated public keys, namely,
8 | the list of authorized SSH keys for each user which these platforms make public (e.g. [github.com/rot256.keys](https://github.com/rot256.keys)).
9 | Git-ring exploits this feature to allow anonymously proving membership among a set of users/organizations/repositories on these platforms using ring signatures (a cryptographic tool) -- without revealing your identity.
10 |
11 | **Disclaimer:** Although I aim for this software to be usable and not just a demo,
12 | I take no responsibility for the correctness/security/completeness of this software:
13 | the software has not undergone a security audit and should currently be considered in an alpha state.
14 | I also do not guarantee that the CLI remains stable, or that the signature format remains backwards compatible.
15 |
16 | There is a [companion post](https://rot256.dev/post/git-ring) describing how the cryptography in git-ring works.
17 |
18 | ## Applications
19 |
20 | #### Whistleblowing
21 |
22 | The primary motivation for ring signatures (e.g. in the seminal work [How to leak a secret](https://people.csail.mit.edu/rivest/pubs/RST01.pdf)
23 | by Rivest, Shamir and Tauman) is that of whistleblowing: suppose you are a member of an organization (e.g. on Github)
24 | and you want to raise an issue either publically or internally.
25 | You could post your revelations anonymously, but how do people know that the claims are not fabrications by someone with no relation to the organization?
26 | You could also raise your concerns with your name attached, so that people can verify that you belong to the organization, but that might have undesired personal ramifications...
27 |
28 | Ring signatures (e.g. git-ring) offers a solution to this dilemma: you can prove that you belong to the organization without revealing your identity.
29 |
30 | In git-ring, this may look something like this:
31 |
32 | ```console
33 | $ ./git-ring sign --msg "They are doing bad things, I work there." --github EvilCorp
34 | ```
35 |
36 | Which creates a signature showing that someone within the organization "EvilCorp" created the message, but does not reveal who.
37 |
38 | #### Designed Verifier Signatures
39 |
40 | You can also use git-ring to create signatures that can only be verified by a single entity (i.e. not publicly verifiable):
41 | by including the verifying party in the ring, the signature could also be forged by the designed verifier
42 | and hence it is not convincing when passed to a third party. e.g.
43 |
44 | ```console
45 | $ ./git-ring --msg "Do not pass this on" --github 54 | The ring of signers can contain combinations of RSA, Ed25519 and ECDSA keys
55 | (i.e. all the types supported by Github). 56 | - Perfectly deniability:
57 | The real signers identity is hidden even if the adversary get access to private keys or break the cryptography. 58 | - Easily prove membership among Github/Gitlab users. 59 | - Easily prove membership of a Github Organization. 60 | - Supports Github credentials to provide access to hidden organizations / private members. 61 | - Manually include SSH keys in the ring. 62 | - Cross platform. 63 | 64 | ## Example Usage 65 | 66 | Git-ring aims to be dead-easy to use and hard to misuse. e.g. running: 67 | 68 | ```console 69 | $ ./git-ring sign --msg "testing git-ring" --github WireGuard 70 | Loading Keys from Different Entities: 71 | Github: 72 | Organization: WireGuard 73 | mdlayher (1 keys) 74 | msfjarvis (2 keys) 75 | nathanchance (1 keys) 76 | rot256 (3 keys) 77 | smaeul (1 keys) 78 | zx2c4 (1 keys) 79 | 9 Keys in the ring. 80 | Covering: 6 / 6 entities 81 | Signature successfully generated 82 | Saved in: ring.sig (1874 bytes) 83 | ``` 84 | 85 | Produces a signature on the message "test" proving that the signer ("rot256" in this case) belongs to the [WireGuard organization on Github](https://github.com/orgs/WireGuard/people). 86 | The signature can then be verified as follows (the path to the signature is "./ring.sig" by default): 87 | 88 | ```console 89 | $ ./git-ring verify --github WireGuard 90 | Loading Keys from Different Entities: 91 | Github: 92 | Organization: WireGuard 93 | mdlayher (1 keys) 94 | msfjarvis (2 keys) 95 | nathanchance (1 keys) 96 | rot256 (3 keys) 97 | smaeul (1 keys) 98 | zx2c4 (1 keys) 99 | 9 Keys in the ring. 100 | Covering: 6 / 6 entities 101 | Message: 102 | testing git-ring 103 | ``` 104 | 105 | Note git-ring signatures include the message being signed to simplify usage. 106 | 107 | You can also include individual people in the ring, e.g. using: 108 | 109 | ```console 110 | $ ./git-ring sign --github rot256 --github torvalds --github gregkh --msg "testing git-ring" 111 | ``` 112 | 113 | Proves that one of the following people signed the message "testing git-ring": 114 | 115 | - Mathias Hall-Andersen (rot256). 116 | - Linus Torvalds (torvalds). 117 | - Greg Kroah-Hartman (gregkh). 118 | 119 | More examples can be found in [the tests for the command-line utility](/tests.sh). 120 | 121 | ## Installation 122 | 123 | If you have a Go enviroment set up, then simply run: 124 | 125 | ```console 126 | $ go install github.com/rot256/git-ring@latest 127 | ``` 128 | -------------------------------------------------------------------------------- /cmd/color.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "fmt" 5 | "runtime" 6 | ) 7 | 8 | const indent = " " 9 | 10 | var colorReset = "\033[0m" 11 | var colorRed = "\033[31m" 12 | var colorGreen = "\033[32m" 13 | var colorYellow = "\033[33m" 14 | var colorBlue = "\033[34m" 15 | var colorPurple = "\033[35m" 16 | var colorCyan = "\033[36m" 17 | var colorWhite = "\033[37m" //lint:ignore U1000 for completeness 18 | 19 | func init() { 20 | if runtime.GOOS == "windows" { 21 | colorReset = "" 22 | colorRed = "" 23 | colorGreen = "" 24 | colorYellow = "" 25 | colorBlue = "" 26 | colorPurple = "" 27 | colorCyan = "" 28 | colorWhite = "" 29 | } 30 | } 31 | 32 | func colorWarnBool(b bool) { 33 | if b { 34 | fmt.Print(colorGreen) 35 | } else { 36 | fmt.Print(colorYellow) 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /cmd/github.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "bytes" 5 | "encoding/json" 6 | "fmt" 7 | "io" 8 | "net/http" 9 | "os" 10 | 11 | "github.com/rot256/git-ring/ring" 12 | ) 13 | 14 | const githubEnvUsername = "GITHUB_USERNAME" 15 | const githubEnvToken = "GITHUB_TOKEN" 16 | 17 | type githubOrgMember struct { 18 | Login string 19 | Type string 20 | } 21 | 22 | // TODO: allow supplying credentials to fetch private orgs 23 | func githubOrganizationUsers(name string) (bool, []string, error) { 24 | // if token is provided: default to bearer token 25 | token, ok := os.LookupEnv(githubEnvToken) 26 | basicAuth := ok 27 | bearerToken := ok 28 | 29 | // if username is provided: use basic auth 30 | username, ok := os.LookupEnv(githubEnvUsername) 31 | basicAuth = basicAuth && ok 32 | bearerToken = bearerToken && !ok 33 | 34 | membersPerPage := 100 35 | 36 | var names []string 37 | var client http.Client 38 | 39 | for n := 1; ; n += 1 { 40 | req, err := http.NewRequest( 41 | http.MethodGet, 42 | fmt.Sprintf("https://api.github.com/orgs/%s/members?page=%d&per_page=%d", name, n, membersPerPage), 43 | bytes.NewReader([]byte{}), // empty body 44 | ) 45 | if err != nil { 46 | panic(err) 47 | } 48 | 49 | // request JSON 50 | req.Header.Add("content-type", "application/json") 51 | 52 | // use basic auth (if supplied) 53 | if basicAuth { 54 | req.SetBasicAuth(username, token) 55 | } else if bearerToken { 56 | req.Header.Add("Authorization", "Bearer "+token) 57 | } 58 | 59 | // send request 60 | resp, err := client.Do(req) 61 | if err != nil { 62 | return false, nil, err 63 | } 64 | 65 | // stop if org not found 66 | if resp.StatusCode == http.StatusNotFound { 67 | return false, nil, nil 68 | } 69 | 70 | // check for error 71 | if resp.StatusCode != http.StatusOK { 72 | return false, nil, fmt.Errorf("HTTP request failed with: %s", resp.Status) 73 | } 74 | 75 | // read response 76 | body, err := io.ReadAll(resp.Body) 77 | if err != nil { 78 | return false, nil, err 79 | } 80 | 81 | // deserialize json 82 | var members []githubOrgMember 83 | if err := json.Unmarshal(body, &members); err != nil { 84 | return false, nil, err 85 | } 86 | 87 | // add to user names 88 | for _, m := range members { 89 | if m.Type == "User" { 90 | names = append(names, m.Login) 91 | } 92 | } 93 | 94 | if len(members) < membersPerPage { 95 | break 96 | } 97 | } 98 | 99 | return true, names, nil 100 | } 101 | 102 | func loadGithubUser(indent string, name string) []ring.PublicKey { 103 | url := "https://github.com/" + name + ".keys" 104 | keys, err := fetchKeys(url) 105 | if err != nil { 106 | exitError("Failed to fetch keys for Github user", name, "err:", err) 107 | } 108 | 109 | colorWarnBool(len(keys) > 0) 110 | fmt.Printf("%s%s (%d keys)\n", indent, name, len(keys)) 111 | fmt.Print(colorReset) 112 | 113 | return keys 114 | } 115 | -------------------------------------------------------------------------------- /cmd/gitlab.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "fmt" 5 | 6 | "github.com/rot256/git-ring/ring" 7 | ) 8 | 9 | func loadGitlabUser(indent string, name string) []ring.PublicKey { 10 | url := "https://gitlab.com/" + name + ".keys" 11 | keys, err := fetchKeys(url) 12 | if err != nil { 13 | exitError("Failed to fetch keys for Gitlab user", name, "err:", err) 14 | } 15 | 16 | colorWarnBool(len(keys) > 0) 17 | fmt.Printf("%s%s (%d keys)\n", indent, name, len(keys)) 18 | fmt.Print(colorReset) 19 | 20 | return keys 21 | } 22 | -------------------------------------------------------------------------------- /cmd/root.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "fmt" 5 | "os" 6 | 7 | "github.com/spf13/cobra" 8 | ) 9 | 10 | const appName = "git-ring" 11 | const appUrl = "https://github.com/rot256/git-ring" 12 | 13 | const optVerbose = "verbose" 14 | const optMsg = "msg" 15 | const optSig = "sig" 16 | const optGithub = "github" 17 | const optGitlab = "gitlab" 18 | const optSSHKeys = "ssh-key" 19 | const optUrls = "url" 20 | const optAllowEmpty = "allow-empty" 21 | 22 | func description() string { 23 | s := "" 24 | s += "Heterogeneous ring signatures for SSH keys.\n" 25 | s += "An easy and private way to prove membership among a set of git users.\n" 26 | s += "More info: " + appUrl 27 | return s 28 | } 29 | 30 | var rootCmd = &cobra.Command{ 31 | Use: appName, 32 | Short: appName + ": Easy SSH Ring Signatures", 33 | Long: description(), 34 | Run: func(cmd *cobra.Command, args []string) { 35 | cmd.Help() 36 | }, 37 | } 38 | 39 | func init() { 40 | rootCmd.AddCommand(signCmd) 41 | rootCmd.AddCommand(verifyCmd) 42 | 43 | // global flags 44 | rootCmd.PersistentFlags().StringP(optSig, "s", "ring.sig", "Path to signature") 45 | rootCmd.PersistentFlags().BoolP(optVerbose, "v", false, "Verbose output") 46 | rootCmd.PersistentFlags().StringArray(optUrls, []string{}, "URLs with lists of keys to include") 47 | rootCmd.PersistentFlags().StringArray(optSSHKeys, []string{}, "Paths to SSH keys to include in the ring") 48 | rootCmd.PersistentFlags().StringArray(optGitlab, []string{}, "Gitlab usernames/organizations to include in the ring") 49 | rootCmd.PersistentFlags().StringArray(optGithub, []string{}, "Github usernames/organizations to include in the ring") 50 | 51 | // flags specific to signing 52 | signCmd.PersistentFlags().StringP(optMsg, "m", "", "Message to sign") 53 | signCmd.PersistentFlags().Bool(optAllowEmpty, false, "Allow retrieving zero keys from a source") 54 | signCmd.MarkPersistentFlagRequired(optMsg) 55 | signCmd.MarkPersistentFlagRequired(optSig) 56 | 57 | // flags specific to verification 58 | verifyCmd.MarkPersistentFlagRequired(optSig) 59 | } 60 | 61 | func Execute() { //nolint:golint 62 | if err := rootCmd.Execute(); err != nil { 63 | fmt.Fprintln(os.Stderr, err) 64 | os.Exit(1) 65 | } 66 | } 67 | -------------------------------------------------------------------------------- /cmd/sign.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "encoding/asn1" 5 | "fmt" 6 | "os" 7 | "path/filepath" 8 | "runtime" 9 | 10 | "github.com/rot256/git-ring/ring" 11 | "github.com/spf13/cobra" 12 | "golang.org/x/term" 13 | ) 14 | 15 | const sshDirectoryEnv = "SSH_DIRECTORY" 16 | 17 | var signCmd = &cobra.Command{ 18 | Use: "sign", 19 | Short: "Generate ring signatures on messages", 20 | Long: `/`, 21 | Run: func(cmd *cobra.Command, args []string) { 22 | msg, err := cmd.Flags().GetString(optMsg) 23 | if err != nil { 24 | panic(err) 25 | } 26 | 27 | sigPath, err := cmd.Flags().GetString(optSig) 28 | if err != nil { 29 | panic(err) 30 | } 31 | 32 | // open the file (better to fail before touching the network) 33 | sigFile, err := os.Create(sigPath) 34 | if err != nil { 35 | exitError("Failed to create signature file:", err) 36 | } 37 | 38 | // load public keys from different sources 39 | sourcesTotal, sourcesWithKeys, pks := loadPublicKeys(cmd) 40 | 41 | // check if all entities covered 42 | allowEmpty, err := cmd.Flags().GetBool(optAllowEmpty) 43 | 44 | if err != nil { 45 | panic(err) 46 | } 47 | 48 | if sourcesTotal != sourcesWithKeys && !allowEmpty { 49 | printError("Error: Obtained zero keys from one/more sources:") 50 | printError("THEY (SHOWN IN " + colorYellow + "YELLOW" + colorRed + ") WILL NOT BE INCLUDED IN THE RING.") 51 | printError("Aborting to avoid accidentially excluding an entity from the ring.") 52 | printError("If you want to allow exlcuding these entities use --" + optAllowEmpty) 53 | exitError() 54 | } 55 | 56 | // list directory to load ssh keys from 57 | var sshDirs []string 58 | dir, ok := os.LookupEnv(sshDirectoryEnv) 59 | if ok { 60 | // use 61 | sshDirs = append(sshDirs, dir) 62 | } else { 63 | // list files in ./ssh directory 64 | home, err := os.UserHomeDir() 65 | if err != nil { 66 | exitError("Failed to obtain home directory") 67 | } 68 | sshDirs = append(sshDirs, filepath.Join(home, "/.ssh")) 69 | 70 | // on windows there are two options: 71 | // 1. %USERPROFILE%/.ssh/ 72 | // 2. %HOMEDRIVE%%HOMEPATH%/.ssh/ 73 | if runtime.GOOS == "windows" { 74 | homeAlt := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH") 75 | sshDirs = append(sshDirs, filepath.Join(homeAlt, "/.ssh")) 76 | } 77 | } 78 | 79 | // load pairs for all included directories 80 | var pairs []ring.EncKeyPair 81 | for _, dir := range sshDirs { 82 | ps, err := loadEncKeyPairs(dir) 83 | if err != nil { 84 | exitError("Failed to load local SSH keys:", err) 85 | } 86 | pairs = append(pairs, ps...) 87 | } 88 | 89 | // find matches between ring members and local keys 90 | matches := findMatches(pks, pairs) 91 | if len(matches) == 0 { 92 | exitError("Error: No matching keys found:\nDid you remember to include yourself in the ring?") 93 | } 94 | 95 | verbose(cmd, "SSH keys in ring (available keys marked with +):\n") 96 | for i, key := range pks { 97 | match := false 98 | for _, m := range matches { 99 | if m.PK.Equals(key) { 100 | match = true 101 | } 102 | } 103 | if match { 104 | verbose(cmd, colorBlue) 105 | verbose(cmd, fmt.Sprintf(" + [ %03d ] : %s\n", i, key.Name())) 106 | verbose(cmd, colorReset) 107 | } else { 108 | verbose(cmd, fmt.Sprintf(" [ %03d ] : %s\n", i, key.Name())) 109 | } 110 | } 111 | 112 | // attempt to use unecrypted secret key 113 | var selected *ring.KeyPair 114 | for _, pair := range matches { 115 | selected, err = pair.Parse() 116 | if err == nil { 117 | break 118 | } 119 | } 120 | 121 | // if not unencrypted pair was found, ask user to decrypt 122 | if selected == nil { 123 | // enumerate matches for the user 124 | for i, pair := range matches { 125 | fmt.Print(colorBlue) 126 | fmt.Printf(" [ %d ] : %s\n", i, pair.PK.Name()) 127 | } 128 | 129 | // prompt the user to select 130 | var index int 131 | fmt.Print(colorReset) 132 | fmt.Printf("Select key to decrypt (enter number 0-%d): ", len(matches)-1) 133 | _, err := fmt.Scanln(&index) 134 | if err != nil { 135 | exitError("Faild to read index:", err) 136 | } 137 | if index < 0 || index >= len(matches) { 138 | exitError("Invalid index:", index) 139 | } 140 | 141 | // prompt for password 142 | passwd, err := term.ReadPassword(int(os.Stdin.Fd())) 143 | if err != nil { 144 | exitError(err) 145 | } 146 | 147 | // attempt decryption 148 | selected, err = matches[index].Decrypt(passwd) 149 | if err != nil { 150 | exitError(err) 151 | } 152 | } 153 | 154 | // generate ring signature 155 | sig := ring.Sign(*selected, pks, []byte(msg)) 156 | 157 | // serialize signature to file 158 | data, err := asn1.Marshal(sig) 159 | if err != nil { 160 | panic(err) 161 | } 162 | if _, err := sigFile.Write(data); err != nil { 163 | exitError("Failed to write signature to disk:", err) 164 | } 165 | 166 | fmt.Print(colorBlue) 167 | fmt.Println("Signature successfully generated") 168 | fmt.Printf("Saved in: %s (%d bytes)\n", sigPath, len(data)) 169 | fmt.Print(colorReset) 170 | }, 171 | } 172 | -------------------------------------------------------------------------------- /cmd/util.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "bufio" 5 | "fmt" 6 | "io" 7 | "log" 8 | "net/http" 9 | "os" 10 | "path/filepath" 11 | "sort" 12 | "strings" 13 | 14 | "github.com/rot256/git-ring/ring" 15 | "github.com/spf13/cobra" 16 | ) 17 | 18 | func verbose(cmd *cobra.Command, s ...interface{}) { 19 | if enabled, _ := cmd.Flags().GetBool(optVerbose); enabled { 20 | fmt.Print(s...) 21 | } 22 | } 23 | 24 | func printError(s ...interface{}) { 25 | fmt.Fprint(os.Stderr, colorRed) 26 | fmt.Fprintln(os.Stderr, s...) 27 | fmt.Fprint(os.Stderr, colorReset) 28 | } 29 | 30 | func exitError(s ...interface{}) { 31 | if len(s) > 0 { 32 | printError(s...) 33 | } 34 | os.Exit(1) 35 | } 36 | 37 | func loadUrl(indent string, url string) []ring.PublicKey { 38 | keys, err := fetchKeys(url) 39 | if err != nil { 40 | exitError("Failed to fetch keys from url:", url) 41 | } 42 | 43 | colorWarnBool(len(keys) > 0) 44 | fmt.Printf("%s%s (%d keys)%s\n", indent, url, len(keys), colorReset) 45 | 46 | return keys 47 | } 48 | 49 | func loadPath(path string) []ring.PublicKey { 50 | file, err := os.Open(path) 51 | if err != nil { 52 | exitError("Failed to open file:", path) 53 | } 54 | 55 | keyData, err := io.ReadAll(file) 56 | if err != nil { 57 | exitError("Failed to read file", path, ":", err) 58 | } 59 | 60 | pk, err := ring.PublicKeyFromStr(string(keyData)) 61 | if err != nil { 62 | exitError("Failed to read public key from", path, ":", err) 63 | } 64 | 65 | return []ring.PublicKey{pk} 66 | } 67 | 68 | func loadPublicKeys(cmd *cobra.Command) (int, int, []ring.PublicKey) { 69 | // 70 | 71 | var sourcesTotal int 72 | var sourcesWithKeys int 73 | var pks []ring.PublicKey 74 | 75 | fmt.Println("Loading Keys from Different Entities:") 76 | 77 | addKeys := func(keys []ring.PublicKey) { 78 | if len(keys) > 0 { 79 | sourcesWithKeys += 1 80 | } 81 | sourcesTotal += 1 82 | pks = append(pks, keys...) 83 | } 84 | 85 | // load github keys 86 | 87 | githubNames, _ := cmd.Flags().GetStringArray(optGithub) 88 | if len(githubNames) > 0 { 89 | fmt.Print(colorCyan + "Github:" + colorReset + "\n") 90 | for _, name := range githubNames { 91 | isOrg, members, err := githubOrganizationUsers(name) 92 | if err != nil { 93 | printError("Failed check for Github org:") 94 | exitError(err) 95 | } 96 | 97 | if isOrg { 98 | fmt.Print(colorPurple) 99 | fmt.Println(indent+"Organization:", name) 100 | fmt.Print(colorReset) 101 | for _, member := range members { 102 | addKeys(loadGithubUser(indent+indent, member)) 103 | } 104 | } else { 105 | addKeys(loadGithubUser(indent, name)) 106 | } 107 | } 108 | } 109 | 110 | // load gitlab keys 111 | gitlabNames, _ := cmd.Flags().GetStringArray(optGitlab) 112 | if len(gitlabNames) > 0 { 113 | fmt.Print(colorCyan + "Gitlab:" + colorReset + "\n") 114 | for _, name := range gitlabNames { 115 | addKeys(loadGitlabUser(indent, name)) 116 | } 117 | } 118 | 119 | // fetch keys from other urls 120 | urls, _ := cmd.Flags().GetStringArray(optUrls) 121 | if len(urls) > 0 { 122 | fmt.Print(colorCyan + "Urls:" + colorReset + "\n") 123 | for _, url := range urls { 124 | addKeys(loadUrl(indent, url)) 125 | } 126 | } 127 | 128 | // load keys from disk 129 | keyPaths, _ := cmd.Flags().GetStringArray(optSSHKeys) 130 | if len(keyPaths) > 0 { 131 | fmt.Print(colorCyan + "Files:" + colorReset + "\n") 132 | for _, path := range keyPaths { 133 | addKeys(loadPath(path)) 134 | fmt.Print(colorBlue + indent + path + colorReset + "\n") 135 | } 136 | } 137 | 138 | // sort and deuplicate the keys 139 | pks = sortAndDedupKeys(pks) 140 | fmt.Println(len(pks), "Keys in the ring.") 141 | fmt.Println("Covering:", sourcesWithKeys, "/", sourcesTotal, "entities") 142 | return sourcesTotal, sourcesWithKeys, pks 143 | } 144 | 145 | // this is used to avoid leaking the order in which the keys were fetched 146 | func sortAndDedupKeys(pks []ring.PublicKey) []ring.PublicKey { 147 | // deduplicate the keys 148 | set := make(map[string]ring.PublicKey) 149 | for _, pk := range pks { 150 | set[pk.Id()] = pk 151 | } 152 | 153 | // sort id's 154 | sorted := make([]string, 0) 155 | for k := range set { 156 | sorted = append(sorted, k) 157 | } 158 | sort.Strings(sorted) 159 | 160 | // retrieve keys in sorted order 161 | pksNew := make([]ring.PublicKey, 0, len(set)) 162 | for _, k := range sorted { 163 | pksNew = append(pksNew, set[k]) 164 | } 165 | return pksNew 166 | } 167 | 168 | func fetchKeys(url string) ([]ring.PublicKey, error) { 169 | var keys []ring.PublicKey 170 | 171 | resp, err := http.Get(url) 172 | if err != nil { 173 | return keys, err 174 | } 175 | 176 | scanner := bufio.NewScanner(resp.Body) 177 | for scanner.Scan() { 178 | pk, err := ring.PublicKeyFromStr(scanner.Text()) 179 | if err != nil { 180 | log.Println("Found invalid public key") 181 | continue 182 | } 183 | keys = append(keys, pk) 184 | } 185 | 186 | if err := scanner.Err(); err != nil { 187 | return keys, err 188 | } 189 | 190 | return keys, nil 191 | } 192 | 193 | func findMatches(pks []ring.PublicKey, pairs []ring.EncKeyPair) []ring.EncKeyPair { 194 | // create lookup 195 | index := make(map[string]bool) 196 | for _, pk := range pks { 197 | index[pk.Id()] = true 198 | } 199 | 200 | // find all pairs which was present in the list of public key 201 | var matches []ring.EncKeyPair 202 | for _, pair := range pairs { 203 | if index[pair.PK.Id()] { 204 | matches = append(matches, pair) 205 | } 206 | } 207 | 208 | return matches 209 | } 210 | 211 | func loadEncKeyPairs(dir string) ([]ring.EncKeyPair, error) { 212 | var pairs []ring.EncKeyPair 213 | 214 | key_files, err := os.ReadDir(dir) 215 | if err != nil { 216 | return pairs, err 217 | } 218 | 219 | // add all pairs of public/secret keys found in .ssh 220 | for _, entry := range key_files { 221 | // ignore directories 222 | if entry.IsDir() { 223 | continue 224 | } 225 | 226 | // ignores public keys 227 | if strings.HasSuffix(entry.Name(), ".pub") { 228 | continue 229 | } 230 | 231 | // read suspected private key 232 | pathSK := filepath.Join(dir, entry.Name()) 233 | skPEM, err := os.ReadFile(pathSK) 234 | if err != nil { 235 | continue 236 | } 237 | 238 | // read corresponding public key 239 | pathPK := filepath.Join(dir, entry.Name()+".pub") 240 | pk_data, err := os.ReadFile(pathPK) 241 | if err != nil { 242 | continue 243 | } 244 | 245 | // parse public key 246 | pk, err := ring.PublicKeyFromStr(string(pk_data)) 247 | if err != nil { 248 | panic(err) 249 | } 250 | 251 | pairs = append( 252 | pairs, 253 | ring.EncKeyPair{ 254 | SKPEM: string(skPEM), 255 | PK: pk, 256 | }, 257 | ) 258 | } 259 | 260 | return pairs, nil 261 | } 262 | -------------------------------------------------------------------------------- /cmd/verify.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "encoding/asn1" 5 | "fmt" 6 | "io" 7 | "os" 8 | 9 | "github.com/rot256/git-ring/ring" 10 | "github.com/spf13/cobra" 11 | ) 12 | 13 | var verifyCmd = &cobra.Command{ 14 | Use: "verify", 15 | Short: "Verify ring signatures", 16 | Long: `/`, 17 | Run: func(cmd *cobra.Command, args []string) { 18 | 19 | sigPath, err := cmd.Flags().GetString(optSig) 20 | if err != nil { 21 | panic(err) 22 | } 23 | 24 | sigFile, err := os.Open(sigPath) 25 | if err != nil { 26 | exitError("Failed to open signature file:", err) 27 | } 28 | 29 | sigData, err := io.ReadAll(sigFile) 30 | if err != nil { 31 | exitError("Failed to read signature file:", err) 32 | } 33 | 34 | var sig ring.Signature 35 | rest, err := asn1.Unmarshal(sigData, &sig) 36 | if err != nil { 37 | exitError("Failed to deserialize signature:", err) 38 | } 39 | if len(rest) != 0 { 40 | exitError("Signature is followed by junk") 41 | } 42 | 43 | _, _, pks := loadPublicKeys(cmd) 44 | 45 | msg, err := sig.Verify(pks) 46 | if err != nil { 47 | printError("Signature is not valid:") 48 | exitError(err) 49 | } 50 | 51 | fmt.Println("Message:") 52 | fmt.Println(string(msg)) 53 | }, 54 | } 55 | -------------------------------------------------------------------------------- /go.mod: -------------------------------------------------------------------------------- 1 | module github.com/rot256/git-ring 2 | 3 | go 1.20 4 | 5 | require ( 6 | filippo.io/edwards25519 v1.1.0 7 | github.com/spf13/cobra v1.7.0 8 | golang.org/x/crypto v0.25.0 9 | golang.org/x/term v0.22.0 10 | ) 11 | 12 | require ( 13 | github.com/inconshreveable/mousetrap v1.1.0 // indirect 14 | github.com/spf13/pflag v1.0.5 // indirect 15 | golang.org/x/sys v0.22.0 // indirect 16 | ) 17 | -------------------------------------------------------------------------------- /go.sum: -------------------------------------------------------------------------------- 1 | filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA= 2 | filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4= 3 | github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= 4 | github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= 5 | github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= 6 | github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= 7 | github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= 8 | github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= 9 | github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= 10 | github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= 11 | golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30= 12 | golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M= 13 | golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI= 14 | golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 15 | golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk= 16 | golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4= 17 | gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= 18 | gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= 19 | -------------------------------------------------------------------------------- /main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "github.com/rot256/git-ring/cmd" 5 | ) 6 | 7 | func main() { 8 | cmd.Execute() 9 | } 10 | -------------------------------------------------------------------------------- /ring/challenge.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto/rand" 5 | "crypto/sha512" 6 | "math/big" 7 | 8 | "golang.org/x/crypto/hkdf" 9 | ) 10 | 11 | const challengeSize = 32 12 | 13 | type challenge struct { 14 | Bytes []byte 15 | } 16 | 17 | func (c *challenge) Random() { 18 | c.Bytes = make([]byte, challengeSize) 19 | if _, err := rand.Read(c.Bytes[:]); err != nil { 20 | panic(err) 21 | } 22 | } 23 | 24 | func (c *challenge) Int(tag string, mod *big.Int) *big.Int { 25 | bytes := (mod.BitLen() + 7) / 8 26 | random := (&big.Int{}).SetBytes(c.Take(tag, bytes*2)) 27 | return random.Mod(random, mod) 28 | } 29 | 30 | func (c *challenge) Take(tag string, n int) []byte { 31 | if len(c.Bytes) != challengeSize { 32 | panic("invalid challenge size") 33 | } 34 | 35 | // expand challenge using HKDF 36 | out := make([]byte, n) 37 | expand := hkdf.New( 38 | sha512.New, 39 | c.Bytes[:], 40 | []byte(tag), 41 | []byte("challenge-hkdf"), 42 | ) 43 | _, err := expand.Read(out) 44 | if err != nil { 45 | panic(err) 46 | } 47 | return out 48 | } 49 | 50 | func (c *challenge) IsValid() bool { 51 | return len(c.Bytes) == challengeSize 52 | } 53 | 54 | // not constant time: only used in verification 55 | func (c *challenge) IsZero() bool { 56 | if len(c.Bytes) != challengeSize { 57 | panic("invalid challenge size") 58 | } 59 | for i := 0; i < challengeSize; i++ { 60 | if c.Bytes[i] != 0x00 { 61 | return false 62 | } 63 | } 64 | return true 65 | } 66 | 67 | func (c *challenge) Add(c1 challenge) { 68 | if len(c.Bytes) != challengeSize || len(c1.Bytes) != challengeSize { 69 | panic("invalid challenge size") 70 | } 71 | 72 | for i := range c.Bytes { 73 | c.Bytes[i] ^= c1.Bytes[i] 74 | } 75 | } 76 | -------------------------------------------------------------------------------- /ring/ecdsa.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto/ecdsa" 5 | "crypto/rand" 6 | "encoding/asn1" 7 | "errors" 8 | "math/big" 9 | ) 10 | 11 | // almost forgot how much the ECC fucking sucks in Go... 12 | // a frigin arsenal of footguns, shit looks like 90ties crypto code. 13 | // sucks to have a weak type-system I guess... 14 | 15 | type ecdsaProver struct { 16 | sk *ecdsa.PrivateKey 17 | pf ecdsaProof 18 | r *big.Int 19 | } 20 | 21 | type ecdsaProof struct { 22 | Ax *big.Int 23 | Ay *big.Int 24 | Z *big.Int 25 | } 26 | 27 | func (pf ecdsaProof) Marshal() []byte { 28 | b, err := asn1.Marshal(pf) 29 | if err != nil { 30 | panic(err) 31 | } 32 | return b 33 | } 34 | 35 | func (pf *ecdsaProof) Unmarshal(b []byte) error { 36 | rest, err := asn1.Unmarshal(b, pf) 37 | if err != nil { 38 | return err 39 | } 40 | if len(rest) != 0 { 41 | return errors.New("ECDSA proof contains junk") 42 | } 43 | if pf.Ax == nil || pf.Ay == nil { 44 | return errors.New("ECDSA proof missing A point") 45 | } 46 | if pf.Z == nil { 47 | return errors.New("ECDSA proof missing Z scalar") 48 | } 49 | return nil 50 | } 51 | 52 | func ecdsaRandomScalar(pk *ecdsa.PublicKey) *big.Int { 53 | // generate enough random bits to avoid statistical bias (or make it negl.) 54 | n := pk.Curve.Params().N.BitLen() 55 | rBytes := make([]byte, n/8*2) 56 | if _, err := rand.Read(rBytes[:]); err != nil { 57 | panic(err) 58 | } 59 | 60 | // reduce modulo the order of the curve 61 | r := (&big.Int{}).SetBytes(rBytes) 62 | return r.Mod(r, pk.Curve.Params().N) 63 | } 64 | 65 | func ecdsaNewChallenge(pk *ecdsa.PublicKey, chal challenge) *big.Int { 66 | return chal.Int("schorr-nist-challenge", pk.Curve.Params().N) 67 | } 68 | 69 | func (pf ecdsaProof) Commit(tx *transcript) { 70 | tx.Append([]byte("ecdsa proof")) 71 | tx.Append(pf.Ax.Bytes()) 72 | tx.Append(pf.Ay.Bytes()) 73 | } 74 | 75 | func (pf ecdsaProof) Verify(key interface{}, chal challenge) error { 76 | pk := key.(*ecdsa.PublicKey) 77 | 78 | if pf.Ax == nil || pf.Ay == nil || !pk.Curve.IsOnCurve(pf.Ax, pf.Ay) { 79 | return errors.New("invalid A point") 80 | } 81 | 82 | if pf.Z == nil || pk.Curve.Params().N.Cmp(pf.Z) != 1 { 83 | return errors.New("invalid Z scalar") 84 | } 85 | 86 | c := ecdsaNewChallenge(pk, chal) 87 | 88 | zx, zy := pk.Curve.ScalarBaseMult(pf.Z.Bytes()) 89 | rx, ry := pk.Curve.ScalarMult(pk.X, pk.Y, c.Bytes()) 90 | lx, ly := pk.Curve.Add(rx, ry, pf.Ax, pf.Ay) 91 | 92 | if lx.Cmp(zx) != 0 || ly.Cmp(zy) != 0 { 93 | return errors.New("failed final check: [c] * pk + A != [z] * G") 94 | } 95 | 96 | return nil 97 | } 98 | 99 | func ecdsaSim(pk *ecdsa.PublicKey, chal challenge) *ecdsaProof { 100 | if !pk.Curve.IsOnCurve(pk.X, pk.Y) { 101 | panic("the point must be on the curve") 102 | } 103 | 104 | Z := ecdsaRandomScalar(pk) 105 | c := ecdsaNewChallenge(pk, chal) 106 | 107 | lx, ly := pk.Curve.ScalarBaseMult(Z.Bytes()) 108 | rx, ry := pk.Curve.ScalarMult(pk.X, pk.Y, c.Bytes()) 109 | 110 | // invert the point (there is not method to do this, wtf?) 111 | // yea for leaky "abstractions" 112 | ry = ry.Neg(ry) 113 | ry = ry.Mod(ry, pk.Params().P) 114 | 115 | // sanity check 116 | if !pk.Curve.IsOnCurve(rx, ry) { 117 | panic("failed inversion") 118 | } 119 | 120 | Ax, Ay := pk.Curve.Add(lx, ly, rx, ry) 121 | 122 | return &ecdsaProof{ 123 | Ax: Ax, 124 | Ay: Ay, 125 | Z: Z, 126 | } 127 | } 128 | 129 | func (p ecdsaProver) Pf() proof { 130 | return &p.pf 131 | } 132 | 133 | func (p *ecdsaProver) Finish(chal challenge) { 134 | 135 | c := ecdsaNewChallenge(&p.sk.PublicKey, chal) 136 | 137 | p.pf.Z = (&big.Int{}).Mul(c, p.sk.D) 138 | p.pf.Z = (&big.Int{}).Add(p.pf.Z, p.r) 139 | p.pf.Z = (&big.Int{}).Mod(p.pf.Z, p.sk.Curve.Params().N) 140 | 141 | // to protect against mistakes erase the blinding 142 | p.r = nil 143 | } 144 | 145 | // Schorr proof 146 | func ecdsaProve(sk *ecdsa.PrivateKey) *ecdsaProver { 147 | // sample random blinding 148 | var p ecdsaProver 149 | p.r = ecdsaRandomScalar(&sk.PublicKey) 150 | p.sk = sk 151 | 152 | // compute commitment 153 | Ax, Ay := sk.PublicKey.Curve.ScalarBaseMult(p.r.Bytes()) 154 | p.pf.Ax = Ax 155 | p.pf.Ay = Ay 156 | 157 | return &p 158 | } 159 | -------------------------------------------------------------------------------- /ring/ed25519.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto/ed25519" 5 | "crypto/rand" 6 | "crypto/sha512" 7 | "errors" 8 | 9 | "filippo.io/edwards25519" 10 | ) 11 | 12 | type ed25519Prover struct { 13 | r *edwards25519.Scalar 14 | pf ed25519Proof 15 | sk ed25519.PrivateKey 16 | pk ed25519.PublicKey 17 | } 18 | 19 | type ed25519Proof struct { 20 | A *edwards25519.Point 21 | Z *edwards25519.Scalar 22 | } 23 | 24 | // derieve secret from ed25519 secret key 25 | func ed25519SfromSK(sk ed25519.PrivateKey) *edwards25519.Scalar { 26 | if len(sk) != ed25519.PrivateKeySize { 27 | panic("ed25519: bad private key length") 28 | } 29 | 30 | seed := sk[:ed25519.SeedSize] 31 | 32 | h := sha512.Sum512(seed) 33 | s, err := edwards25519.NewScalar().SetBytesWithClamping(h[:32]) 34 | if err != nil { 35 | panic(err) 36 | } 37 | return s 38 | } 39 | 40 | func (pf ed25519Proof) Marshal() []byte { 41 | out := pf.A.Bytes() 42 | out = append(out, pf.Z.Bytes()...) 43 | return out 44 | } 45 | 46 | func (pf *ed25519Proof) Unmarshal(b []byte) error { 47 | if len(b) != 64 { 48 | return errors.New("ed25519 proof should be 64 bytes") 49 | } 50 | 51 | A, err := (&edwards25519.Point{}).SetBytes(b[:32]) 52 | if err != nil { 53 | return err 54 | } 55 | 56 | Z, err := (&edwards25519.Scalar{}).SetCanonicalBytes(b[32:]) 57 | if err != nil { 58 | return err 59 | } 60 | 61 | pf.A = A 62 | pf.Z = Z 63 | return nil 64 | } 65 | 66 | func ed25519RandomScalar() *edwards25519.Scalar { 67 | var rBytes [64]byte 68 | if _, err := rand.Read(rBytes[:]); err != nil { 69 | panic(err) 70 | } 71 | 72 | r, err := (&edwards25519.Scalar{}).SetUniformBytes(rBytes[:]) 73 | if err != nil { 74 | panic(err) 75 | } 76 | return r 77 | } 78 | 79 | func ed25519NewChallenge(chal challenge) *edwards25519.Scalar { 80 | c, err := edwards25519.NewScalar().SetUniformBytes( 81 | chal.Take("schorr-edwards25519-challenge", 64), 82 | ) 83 | if err != nil { 84 | panic(err) 85 | } 86 | return c 87 | } 88 | 89 | func (pf ed25519Proof) Commit(tx *transcript) { 90 | tx.Append([]byte("ed25519 proof")) 91 | tx.Append(pf.A.Bytes()) 92 | } 93 | 94 | func (pf ed25519Proof) Verify(pk interface{}, chal challenge) error { 95 | if pf.A == nil || pf.Z == nil { 96 | return errors.New("incomplete proof") 97 | } 98 | A := pf.computeA(pk.(ed25519.PublicKey), chal) 99 | if A.Equal(pf.A) != 1 { 100 | return errors.New("recompute commitment does not match") 101 | } 102 | return nil 103 | } 104 | 105 | func (pf ed25519Proof) computeA(pk ed25519.PublicKey, chal challenge) *edwards25519.Point { 106 | x, err := (&edwards25519.Point{}).SetBytes(pk) 107 | if err != nil { 108 | panic(err) 109 | } 110 | 111 | c := ed25519NewChallenge(chal) 112 | g := edwards25519.NewGeneratorPoint() 113 | 114 | l := (&edwards25519.Point{}).ScalarMult(pf.Z, g) 115 | r := (&edwards25519.Point{}).ScalarMult(c, x) 116 | r = r.Negate(r) 117 | 118 | return (&edwards25519.Point{}).Add(l, r) 119 | } 120 | 121 | func ed25519Sim(pk ed25519.PublicKey, chal challenge) *ed25519Proof { 122 | // [z] * g = [c] * x + a 123 | // [z] * g - [c] * x = a 124 | 125 | var pf ed25519Proof 126 | pf.Z = ed25519RandomScalar() 127 | pf.A = pf.computeA(pk, chal) 128 | 129 | return &pf 130 | } 131 | 132 | func (p ed25519Prover) Pf() proof { 133 | return &p.pf 134 | } 135 | 136 | func (p *ed25519Prover) Finish(chal challenge) { 137 | 138 | s := ed25519SfromSK(p.sk) 139 | c := ed25519NewChallenge(chal) 140 | 141 | p.pf.Z = (&edwards25519.Scalar{}).MultiplyAdd(c, s, p.r) 142 | p.r = nil 143 | } 144 | 145 | // Schorr proof 146 | func ed25519Prove(sk ed25519.PrivateKey) *ed25519Prover { 147 | 148 | // generate a commitment message 149 | 150 | var pf ed25519Proof 151 | 152 | g := edwards25519.NewGeneratorPoint() 153 | r := ed25519RandomScalar() 154 | 155 | pf.A = (&edwards25519.Point{}).ScalarMult(r, g) 156 | 157 | return &ed25519Prover{ 158 | pk: sk.Public().(ed25519.PublicKey), 159 | pf: pf, 160 | sk: sk, 161 | r: r, 162 | } 163 | } 164 | -------------------------------------------------------------------------------- /ring/keys.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto" 5 | "crypto/ecdsa" 6 | "crypto/ed25519" 7 | "errors" 8 | "reflect" 9 | "strings" 10 | "unsafe" 11 | 12 | "golang.org/x/crypto/ssh" 13 | ) 14 | 15 | type PublicKey struct { 16 | pk ssh.PublicKey 17 | pk_ssh string // this is only used for displaying (the generated signature does not depend on it) 18 | } 19 | 20 | func (p *PublicKey) Id() string { 21 | return p.pk.Type() + "-" + ssh.FingerprintSHA256(p.pk) 22 | } 23 | 24 | type EncKeyPair struct { 25 | PK PublicKey 26 | SKPEM string // PEM serialized private key 27 | } 28 | 29 | type KeyPair struct { 30 | PK PublicKey 31 | SK interface{} 32 | } 33 | 34 | func (pk1 PublicKey) Equals(pk2 PublicKey) bool { 35 | return pk1.Id() == pk2.Id() 36 | } 37 | 38 | func (k *PublicKey) FP() string { 39 | return ssh.FingerprintSHA256(k.pk) 40 | } 41 | 42 | func (k *PublicKey) Name() string { 43 | return k.pk_ssh // k.FP() + " (" + k.pk.Type() + ")" 44 | } 45 | 46 | func (p *EncKeyPair) Parse() (*KeyPair, error) { 47 | sk, err := ssh.ParseRawPrivateKey([]byte(p.SKPEM)) 48 | if err != nil { 49 | return nil, err 50 | } 51 | return &KeyPair{ 52 | SK: sk, 53 | PK: p.PK, 54 | }, nil 55 | } 56 | 57 | func (p *EncKeyPair) Decrypt(passwd []byte) (*KeyPair, error) { 58 | sk, err := ssh.ParseRawPrivateKeyWithPassphrase([]byte(p.SKPEM), passwd) 59 | if err != nil { 60 | return nil, err 61 | } 62 | return &KeyPair{ 63 | SK: sk, 64 | PK: p.PK, 65 | }, nil 66 | } 67 | 68 | func PublicKeyFromStr(s string) (PublicKey, error) { 69 | pk_ssh := strings.TrimSpace(s) 70 | pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pk_ssh)) 71 | if err != nil { 72 | return PublicKey{}, err 73 | } 74 | 75 | return PublicKey{ 76 | pk_ssh: pk_ssh, 77 | pk: pk, 78 | }, nil 79 | } 80 | 81 | func toCryptoPublicKey(pk PublicKey) crypto.PublicKey { 82 | switch pk.pk.Type() { 83 | case ssh.KeyAlgoED25519, ssh.KeyAlgoRSA, ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521: 84 | return pk.pk.(ssh.CryptoPublicKey).CryptoPublicKey() 85 | 86 | case ssh.KeyAlgoSKECDSA256: 87 | // use reflection to access the inner (unexported) ecdsa.PublicKey 88 | rs := reflect.ValueOf(pk.pk) 89 | rs2 := reflect.New(rs.Type()).Elem() 90 | rs2.Set(rs) 91 | 92 | // access the second field 93 | rf := reflect.Indirect(rs2).Field(1) 94 | rf = reflect.NewAt(rf.Type(), unsafe.Pointer(rf.UnsafeAddr())).Elem() 95 | 96 | // copy the inner value into an ecdsa.PublicKey 97 | var inner ecdsa.PublicKey 98 | ri := reflect.ValueOf(&inner).Elem() 99 | ri.Set(rf) 100 | return &inner 101 | 102 | case ssh.KeyAlgoSKED25519: 103 | // use reflection to access the inner (unexported) ed25519.PublicKey 104 | rs := reflect.ValueOf(pk.pk) 105 | rs2 := reflect.New(rs.Type()).Elem() 106 | rs2.Set(rs) 107 | 108 | // access the second field 109 | rf := reflect.Indirect(rs2).Field(1) 110 | rf = reflect.NewAt(rf.Type(), unsafe.Pointer(rf.UnsafeAddr())).Elem() 111 | 112 | // copy the inner value into an ecdsa.PublicKey 113 | var inner ed25519.PublicKey 114 | ri := reflect.ValueOf(&inner).Elem() 115 | ri.Set(rf) 116 | return inner 117 | 118 | default: 119 | panic(errors.New("unknown key type")) 120 | } 121 | } 122 | -------------------------------------------------------------------------------- /ring/ring_test.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "math/rand" 5 | "testing" 6 | 7 | "golang.org/x/crypto/ssh" 8 | ) 9 | 10 | type testKeyPair struct { 11 | pk string 12 | sk string 13 | } 14 | 15 | var testKeys []testKeyPair = []testKeyPair{ 16 | testKeyPair{ 17 | pk: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1Gbv1qD9Lj7kX0SgEnN7OEHphcn0xdziUE76MEGLhs6UbWiGvI6akuFw7kWYu1QAtK/pfoRSoxxNKjJURQDOPkO9HBsbk3qutFrvwJsZBAeif/ywyg357+NT2iv0v/bCOL/n/apKTbojdAFsWCrFGienbaTC4iQpAAK9uvj36WE7kFNEJ41y5VlWWm+u7geurJC3lhxyukHsH0g+aidTaFHyVMIPMJG6yK82F4myYAnaCT0I543RzRIldiiaJzJ1Wv1WHiByRhwLs7esggwvZlu1I9jxjFHSWRxDyfg/8SJk1JE/cuDiBltdWhA0YOrRJIyQsp1JdBl1frGgqUql+1mmOzhqOXcYb+OflxAjB4y2FSMwnBZP+AAzRSkbxWvHXbJKZBvrah3CEb3FL8Pri/Jt+dNXKwdOuRriwHKApelaAGZYtQI3++IPyi3lh7+tSi5QUAVCWUycxmSUo0kl09L/oXxkkA+aLQfWGQva6sl+Yg72q5qTApilIDh0uJtjzTd49FsUoiNn3FqRbiXnRYiKJf4HKyLNRWoyptLwttVu0P5cTyBXsCj0ocRcBscWO/P2x/4pnqK3Vn795Fo3OjKjaswmPJu0wrbIn9agQWW6p++RExAqfH7IwReEXb4FGuN4tJPW4vO4ny+uFBGOjS396EK7uJoQ92iKesNJ0qQ==", 18 | sk: ` 19 | -----BEGIN OPENSSH PRIVATE KEY----- 20 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn 21 | NhAAAAAwEAAQAAAgEAtRm79ag/S4+5F9EoBJzezhB6YXJ9MXc4lBO+jBBi4bOlG1ohryOm 22 | pLhcO5FmLtUALSv6X6EUqMcTSoyVEUAzj5DvRwbG5N6rrRa78CbGQQHon/8sMoN+e/jU9o 23 | r9L/2wji/5/2qSk26I3QBbFgqxRonp22kwuIkKQACvbr49+lhO5BTRCeNcuVZVlpvru4Hr 24 | qyQt5YccrpB7B9IPmonU2hR8lTCDzCRusivNheJsmAJ2gk9COeN0c0SJXYomicydVr9Vh4 25 | gckYcC7O3rIIML2ZbtSPY8YxR0lkcQ8n4P/EiZNSRP3Lg4gZbXVoQNGDq0SSMkLKdSXQZd 26 | X6xoKlKpftZpjs4ajl3GG/jn5cQIweMthUjMJwWT/gAM0UpG8Vrx12ySmQb62odwhG9xS/ 27 | D64vybfnTVysHTrka4sBygKXpWgBmWLUCN/viD8ot5Ye/rUouUFAFQllMnMZklKNJJdPS/ 28 | 6F8ZJAPmi0H1hkL2urJfmIO9quakwKYpSA4dLibY803ePRbFKIjZ9xakW4l50WIiiX+Bys 29 | izUVqMqbS8LbVbtD+XE8gV7Ao9KHEXAbHFjvz9sf+KZ6it1Z+/eRaNzoyo2rMJjybtMK2y 30 | J/WoEFluqfvkRMQKnx+yMEXhF2+BRrjeLST1uLzuJ8vrhQRjo0t/ehCu7iaEPdoinrDSdK 31 | kAAAdIxBfPpsQXz6YAAAAHc3NoLXJzYQAAAgEAtRm79ag/S4+5F9EoBJzezhB6YXJ9MXc4 32 | lBO+jBBi4bOlG1ohryOmpLhcO5FmLtUALSv6X6EUqMcTSoyVEUAzj5DvRwbG5N6rrRa78C 33 | bGQQHon/8sMoN+e/jU9or9L/2wji/5/2qSk26I3QBbFgqxRonp22kwuIkKQACvbr49+lhO 34 | 5BTRCeNcuVZVlpvru4HrqyQt5YccrpB7B9IPmonU2hR8lTCDzCRusivNheJsmAJ2gk9COe 35 | N0c0SJXYomicydVr9Vh4gckYcC7O3rIIML2ZbtSPY8YxR0lkcQ8n4P/EiZNSRP3Lg4gZbX 36 | VoQNGDq0SSMkLKdSXQZdX6xoKlKpftZpjs4ajl3GG/jn5cQIweMthUjMJwWT/gAM0UpG8V 37 | rx12ySmQb62odwhG9xS/D64vybfnTVysHTrka4sBygKXpWgBmWLUCN/viD8ot5Ye/rUouU 38 | FAFQllMnMZklKNJJdPS/6F8ZJAPmi0H1hkL2urJfmIO9quakwKYpSA4dLibY803ePRbFKI 39 | jZ9xakW4l50WIiiX+BysizUVqMqbS8LbVbtD+XE8gV7Ao9KHEXAbHFjvz9sf+KZ6it1Z+/ 40 | eRaNzoyo2rMJjybtMK2yJ/WoEFluqfvkRMQKnx+yMEXhF2+BRrjeLST1uLzuJ8vrhQRjo0 41 | t/ehCu7iaEPdoinrDSdKkAAAADAQABAAACACmUcgJSEc5AfmfIft6oQcOgJukOx02/KL9e 42 | 1SYFcR6PB36DMC6tCcrSBWMr3AEuqG62pTKloj+qDXTVWDhwvCXfSgDNvoa31UTVbmsSC/ 43 | zK+mUZykUCydye4g6FFOKa5ZmPzF9nUaYF/+h193PVGqSub4IP4b7MwAy324+aoFJFSj+1 44 | w9T4Xcaz2szMmdAgYUKW+O61GdG+nHDMOwbpVHSJtZzvWaNaTgwcYIC33uT708fReMwfvB 45 | HnD37phDWpRAqxvWpzxtNm4zYQ3iZF0EeyDmLtHipFfQsv3+U9KmBrLrnzz15G8bpXLrPP 46 | d84zVEdiiSCzfgabun6H8BafigiQ4hxq9YHeKeS1FF0PJZNux13EuMQc9d+gvre4NrM8Uq 47 | FowPOC5C8l8esY+AWZHFSXFIx//ifcJgP8m1GZG6RxbTqEDOlqVrXJsGjKvhJEDb7gFDcm 48 | u8BF6yIS4eOv+Mrwec5B2mU8hhShmCVtIvCUV+1lFnx0+3So6wmFJZ/Pt+NQu+YK7I1fnG 49 | shEEFbgkJNcHc662Xg9et0TxfKeEtjbvXhtlUoRMbS78i19LZ+fqWjWr77aUL04cA+BL9T 50 | bTjJEEn9W3JSlXgd0vElr8qWMYI8RgI1xS3S/l6O3h3B5Cby1YLUqGQmhXKLqPsOLIGpxX 51 | LEAb/5WvJAMpRIoftdAAABAQCr3mQoUpUIQ6SXnvzleNMJCvxLxZNowGz13kfyX0rwJzHr 52 | RnowmZBO+Z5i2bhyjfpWYX8VE6edMW0qWMa1DfbwbRZnV2vdbgr+Otc09wDHhsn/qsJCqD 53 | 2k3yAXg1FFTQFzdUEzEazokgAf88IJqEgpaSbG2NQC1rlcRgfC12h9vyYklA1BqlmphHS8 54 | nLe1Q6Vak+40kVgBQ0bnYZgSFmRNi3G97wQAM0KqhDa48FMkzeR/IA5YJ83F1X2cFkKGR8 55 | JV77160Z9K9yqjGeXmeySHpxQNLFCO8zVRquImAC/fFSpKYjrT7y67JLxP97ETyZriHa7L 56 | aMWAKWcFm8wLQQ2OAAABAQDFKMZBDyk8V3F0L74dWWhBbgUJLVkq3XxbUK1YpkbvLGS3VJ 57 | WVRzmI0sb7GnKRANjhV7mqiJ3+Qrl8fEBZyATpiP6/PuoM4mNWM0DHLKkJ6t9v8ZymSP3r 58 | 62euR5fqMyEiShT5iRjZC+e4o+paGuMSP8z79FXp0x4czX/e40nSiUXIx1UzjJUpvh4WYg 59 | 9Jo/iyVbVVm41ylUkUIcGhAyXBWtqNOfWZ0Jx2h18AomUs68Dha0qhaiAjDzzgNhGL4arX 60 | 6ZDXDfLPsASdc1SoenY8MvpUsF1bM3pxzIKdeZPysj8FBknu4ToUfwcCqMfeGnNAsSeefc 61 | GM/F4YbYjnrovjAAABAQDrJgzgGuFREuGXVKzodv31M7W8rSqMOwNx5KQsuZDMaNCdfEcg 62 | PzSvc66r+I0reYaRufNdFOFST3gwyZNuTQPmGKd9+gEeIRmcdZI4sL5f5vtamXqw6i3are 63 | XAQ8FuWTVdFuVRTkBemnHc6MFeQv/Frlq7SbScl8L1KQpqEqjpsZJ1Q27+YZb+GiaXOp4f 64 | JGZ7LoZsTw/0prXo1bb3h7qQYlk8A+KSnd0iDO9vPYgQu3N146di4rxeBHQa93mbXsawbL 65 | AQh5og5t5TDk3FGzkR/FaO0YZEW23Vcy+ix0nHMVGo6bTLwoK5wrJRDWgl76HSpJieUOMv 66 | b9LovSiDiLsDAAAAC3JvdDI1NkBoZXhhAQIDBAUGBw== 67 | -----END OPENSSH PRIVATE KEY-----`, 68 | }, 69 | testKeyPair{ 70 | pk: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCdDfXDTEmWgEuj/dTs8nSV+Ec2bczZhJNlRDe+3A2SWoGLlxHjSrq/TQULFrll2JrzSrGiCpQ9/E81G9KoHMErUZKS5aYAPkc/XQrJ/WdN3f5JNM7TfDcO2oYce3IiC+4qm9DuYlRr51TjqUDyoxp5XBXMMyZcGbQguDr9enCRXm9t/3KdTdgmc5PjqQO+OKFV9vkO5xD1hD+snXkIMmaIjTbkUR03CjxHPwJQMtMXWhmuHbSkKXlyeTQLdEfN82F09JYSOhcPxxs5bRbPOurYepgmFPRq3dqwhVu2Cc8lrYXAA4yE1ce66VvfRLyLqpuu0z6WTTA4PwcpYfY5prrroLwzFtYHLzzY/J8+frsbuejym4un96u5Ub4Jh4eqO59BsOm0nFf95wG7HLps7XKxCgUqErXDS7aHOZ9LCmtGno/sB/9bnKIDT5MJWcJO30ohBSNTvxtWgfe6srgohsUOnaQJtFmB346G/YpwJMKgRlL3ri4Ln0z7Yujzj6HO9rM=", 71 | sk: ` 72 | -----BEGIN OPENSSH PRIVATE KEY----- 73 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn 74 | NhAAAAAwEAAQAAAYEAnQ31w0xJloBLo/3U7PJ0lfhHNm3M2YSTZUQ3vtwNklqBi5cR40q6 75 | v00FCxa5Zdia80qxogqUPfxPNRvSqBzBK1GSkuWmAD5HP10Kyf1nTd3+STTO03w3DtqGHH 76 | tyIgvuKpvQ7mJUa+dU46lA8qMaeVwVzDMmXBm0ILg6/XpwkV5vbf9ynU3YJnOT46kDvjih 77 | Vfb5DucQ9YQ/rJ15CDJmiI025FEdNwo8Rz8CUDLTF1oZrh20pCl5cnk0C3RHzfNhdPSWEj 78 | oXD8cbOW0Wzzrq2HqYJhT0at3asIVbtgnPJa2FwAOMhNXHuulb30S8i6qbrtM+lk0wOD8H 79 | KWH2Oaa666C8MxbWBy882PyfPn67G7no8puLp/eruVG+CYeHqjufQbDptJxX/ecBuxy6bO 80 | 1ysQoFKhK1w0u2hzmfSwprRp6P7Af/W5yiA0+TCVnCTt9KIQUjU78bVoH3urK4KIbFDp2k 81 | CbRZgd+Ohv2KcCTCoEZS964uC59M+2Lo84+hzvazAAAFgOG8YbPhvGGzAAAAB3NzaC1yc2 82 | EAAAGBAJ0N9cNMSZaAS6P91OzydJX4RzZtzNmEk2VEN77cDZJagYuXEeNKur9NBQsWuWXY 83 | mvNKsaIKlD38TzUb0qgcwStRkpLlpgA+Rz9dCsn9Z03d/kk0ztN8Nw7ahhx7ciIL7iqb0O 84 | 5iVGvnVOOpQPKjGnlcFcwzJlwZtCC4Ov16cJFeb23/cp1N2CZzk+OpA744oVX2+Q7nEPWE 85 | P6ydeQgyZoiNNuRRHTcKPEc/AlAy0xdaGa4dtKQpeXJ5NAt0R83zYXT0lhI6Fw/HGzltFs 86 | 866th6mCYU9Grd2rCFW7YJzyWthcADjITVx7rpW99EvIuqm67TPpZNMDg/Bylh9jmmuuug 87 | vDMW1gcvPNj8nz5+uxu56PKbi6f3q7lRvgmHh6o7n0Gw6bScV/3nAbscumztcrEKBSoStc 88 | NLtoc5n0sKa0aej+wH/1ucogNPkwlZwk7fSiEFI1O/G1aB97qyuCiGxQ6dpAm0WYHfjob9 89 | inAkwqBGUveuLgufTPti6POPoc72swAAAAMBAAEAAAGABRCZr+Iqb12U0uWRM9D/3IREu6 90 | cf15X0cOwZxiBvmZwsmFVXYNacniW8N2bUtMme+aCbiOfBbxxPa52Jlh1TR3Paf71DNLfN 91 | cWgtPGVdKwAxPqgi0WQsnGCEua9rd1ieJiafPsjSAybTMIJZU1naNTa4hzzRDGBR1EpMsL 92 | b9oVqDym7WAeesRFUu3EUrlztZTJ3p20atX9WTfhwX9qE1eErhjcxl3kwItJ1+FBsHfrXL 93 | pTdVB4RE4+GvwXzPAf/KxF1lmiuXGtuXdNGi1q03HvCgO10MhcYWw2WiS6GLG6NfAta1jA 94 | +R1twoeO0qz1Bi8y0AXj2thpuPmUhtolHJbSeGm/JHRgv70VYJExHWyaHONIkqVBlUiIbV 95 | N+BklbyiCkGyM0C9U+dg3qAqd2gBVST8L1jH3aC4HfHrGvW7VaX8nu2fXliEXcWNCpk9ic 96 | YVH9/Y8iM1izERlmBHjcXf86XWsu85uGCkIsCExJe95SlKd14w9eL6lQP6QMXvLPw9AAAA 97 | wCXvM8QypXOYY3b+AvlWdw2pUMQTqjw07aVqnbyN1N71KYtxrVxcGkS5cvO1VFuYtQGMBT 98 | VJF3YAJl6WS1crD4I37WjnnhbftYrk2X5vD7bFP4gdrbkAxmwqgMKdjgCZfE+ZyCezLR1a 99 | JValPFlbjQej4FOP3sRf6au0zTWs4II04tkeUBMc9mCv7pS7vrYfFeWy29IL5lWxyRdfdu 100 | 7P7JKx8jgfcPnUlFoU7lcN/5yi2HHJzI3eJUbTuItayGIiKQAAAMEAyc+mmvGWmVqUdmbT 101 | ak5lcNtB5gtwgezNVSCG/5TVuIDyIcpHEEMPJMY8AGskHNxZx1eCOcrlyMmbKScIRxfbNa 102 | b/HwGzuBBPbG7K1HQy2PYKBunOLAHZSwzDtvC305XSmoXLFMO/f5KLYCbD9moWoKY64TlH 103 | JFRYEUH7pk4mwKkNvgj7a9V3S64TmcEYYsONVBVjSYVqa4vd/gBSX5Gx3RdRngCcdyIW7k 104 | 3Y7qKESv0kNOWIEu5x6HUz6CBK5JhfAAAAwQDHOcXpXFVJlV5RCJssOvmLv6gh9sEpH/vq 105 | o08EmlAR9/1lcw/yC61zjldlhnltRJDPchnXYsQC61ApKuPssWzzc+xCq03BAjypjw1FKz 106 | FqubdFZ2Kbjg+85YAzv8HVKvGrnxpkI2GbIgpudTHOVT4Bse/qIgV+nYY7GITU5xxS7Q7B 107 | vZJDfW+aY5B/IH13oYiZtB4JHc9knm6XtX6riEbKWcQgAegW/ZoR2rDTgow6nZeThojFR7 108 | jbQ42WdwmGki0AAAALcm90MjU2QGhleGE= 109 | -----END OPENSSH PRIVATE KEY-----`, 110 | }, 111 | testKeyPair{ 112 | pk: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMGjtL/v4fT7tGHtNgyw8PphfeqDspm2T4GcnxWt1PVN+VcVtLLl9gULtE+w1t0VWPtTn4hjh9aHk5HySXD2nGfe9og5XXR9qFxwqlJVZTCRTC+tYKdMfm9TqmRn+iFLZIXUlP3gl4b2Cn77bND0UZmWDfldlT+oaGjXyzbjetCBR5O7HKDvN71NbFm1fjzOHlxK55caEZKUdEsge/ndWEl9qfu7gWX9kJwp8PCUPd5Ni8y8wMarA/eUV6Ssw6IhnhNqhFgNY5uKwEDkIAyvL1RssodIq4GLa11L4yvGxzOBiO9NZtaQmRlFvyVECiAYrLE1XN5rM41eg5GrykRnzp", 113 | sk: ` 114 | -----BEGIN OPENSSH PRIVATE KEY----- 115 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn 116 | NhAAAAAwEAAQAAAQEAzBo7S/7+H0+7Rh7TYMsPD6YX3qg7KZtk+BnJ8VrdT1TflXFbSy5f 117 | YFC7RPsNbdFVj7U5+IY4fWh5OR8klw9pxn3vaIOV10fahccKpSVWUwkUwvrWCnTH5vU6pk 118 | Z/ohS2SF1JT94JeG9gp++2zQ9FGZlg35XZU/qGho18s243rQgUeTuxyg7ze9TWxZtX48zh 119 | 5cSueXGhGSlHRLIHv53VhJfan7u4Fl/ZCcKfDwlD3eTYvMvMDGqwP3lFekrMOiIZ4TaoRY 120 | DWObisBA5CAMry9UbLKHSKuBi2tdS+MrxsczgYjvTWbWkJkZRb8lRAogGKyxNVzeazONXo 121 | ORq8pEZ86QAAA8h52fjXedn41wAAAAdzc2gtcnNhAAABAQDMGjtL/v4fT7tGHtNgyw8Pph 122 | feqDspm2T4GcnxWt1PVN+VcVtLLl9gULtE+w1t0VWPtTn4hjh9aHk5HySXD2nGfe9og5XX 123 | R9qFxwqlJVZTCRTC+tYKdMfm9TqmRn+iFLZIXUlP3gl4b2Cn77bND0UZmWDfldlT+oaGjX 124 | yzbjetCBR5O7HKDvN71NbFm1fjzOHlxK55caEZKUdEsge/ndWEl9qfu7gWX9kJwp8PCUPd 125 | 5Ni8y8wMarA/eUV6Ssw6IhnhNqhFgNY5uKwEDkIAyvL1RssodIq4GLa11L4yvGxzOBiO9N 126 | ZtaQmRlFvyVECiAYrLE1XN5rM41eg5GrykRnzpAAAAAwEAAQAAAQAHykmF8faLmzy2kAcj 127 | 4Y7n20BRJo0piPhD3aIe/5zvrKQ4XUJYM9h+lzOVTgVvcgcTbDNJUyrVTeHwm58cfUFdiu 128 | F9f6Y+DbdKFgndOfgEmoBhHSIDIKgfnoUNoyZhzpYS3C1SlSg54VBoYIZ9ka4NbH9YJq1L 129 | 9AWN8wO1393+ppKQuQHF0TAQT6HKEePS2LSjrAQIis8lq2vdvREfbcxWjKhy0aDbU3ztLM 130 | QLIVFsIUGzZFGosyQlu0jOpTJKV2Hl4px0DnV1moy1bxG8kzO+9LP4lgIO7UC/rdbrk7AE 131 | 0H7t+ZveEDTxDpuuwTPR8mE9ka4wNHm0qXMEOPMiCPuNAAAAgQDR36rFbXaMuLkbprWBZZ 132 | kD8V4AcF5uKz1WvMpH0BD0DRGo1FwGOMgXpW7QpStvlDIwhHNrKIw2AR+N+xQjzdVfEfWM 133 | 2zQu5ZCDq4Ez0NWTkTUTA1m4hklsCU9SJzsMUJPhiqTuyHs1AGhZrIe/i0s19S/kVrG4Xy 134 | RVa5R+WzS9rQAAAIEA85mIJZvb6kZkEBoZlVN5dU825zwsZX6Ah8APyprkh8Fu7WlPqLWu 135 | RgsKUtx8pqHXuijcbF6QpL9+8KvOdZyZ4rdgkTLJvOc9LWnApWFleUBg0GeOkSEFU6OvvO 136 | Fl7eUcsh+kK8URS/HPxI8TVUYG1ac69TfCme6Crzszs/FpAH0AAACBANZ9/dBxi2C6dOKS 137 | VFbve+BVFxmpTvyzOQeVqdoYCHJONX1C5mRX4e43WuWRTnqLxBCIhZtKmbaI8sM06aEOiL 138 | pw2iheaic1bvOFirw0uml6UBKwY6lpbvcSqg6AuD8rzCmWQsXULh8CdpLdVXLGz/x4Ft1n 139 | f7rHzl1MD6T5+yXdAAAAC3JvdDI1NkBoZXhhAQIDBAUGBw== 140 | -----END OPENSSH PRIVATE KEY-----`, 141 | }, 142 | testKeyPair{ 143 | pk: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDG1A2g2BDCkfyI1SYh3rJn+5MZg9CQFdVQpwJeUy9bYkj6j9EgzMYg3SGeJeIlvAarPjka9qhZBhZ4xxvfoVPEMm2aAG1Lg3IjHV2ilRqbXDoHbNkB4d9H4fvYta1q/+wIL7daTQSSo/lgas9zfCivMoIQa5NjPno58cs9hJxpGw==", 144 | sk: ` 145 | -----BEGIN OPENSSH PRIVATE KEY----- 146 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAlwAAAAdzc2gtcn 147 | NhAAAAAwEAAQAAAIEAxtQNoNgQwpH8iNUmId6yZ/uTGYPQkBXVUKcCXlMvW2JI+o/RIMzG 148 | IN0hniXiJbwGqz45GvaoWQYWeMcb36FTxDJtmgBtS4NyIx1dopUam1w6B2zZAeHfR+H72L 149 | Wtav/sCC+3Wk0EkqP5YGrPc3worzKCEGuTYz56OfHLPYScaRsAAAII40h81uNIfNYAAAAH 150 | c3NoLXJzYQAAAIEAxtQNoNgQwpH8iNUmId6yZ/uTGYPQkBXVUKcCXlMvW2JI+o/RIMzGIN 151 | 0hniXiJbwGqz45GvaoWQYWeMcb36FTxDJtmgBtS4NyIx1dopUam1w6B2zZAeHfR+H72LWt 152 | av/sCC+3Wk0EkqP5YGrPc3worzKCEGuTYz56OfHLPYScaRsAAAADAQABAAAAgDlCtLIPx7 153 | PhSzM0/4hdlE+x+gktFxGH2CkkD+COYGMXCSFv7bBeiOjKBnZ/PoPThLAoeVW0l4Mb57jc 154 | zsA2u+KQyo5ZW8ngpqbw+LK22C0UCUSsjOk14cWqta/robvtmGlIjlch/V7DEnwRfyIkAP 155 | yokE109HS+oDQpls+oeYIxAAAAQQCHI3TY0O75nwszAZHleplQuPXCLHvvRSkd6l/JERkS 156 | ZPz8LoPIW0oDtcLh9tpKcVWCm4ZuWuoDnlF46ozOU7WOAAAAQQDxk/uCeEsBikavYQe/Z3 157 | S8bdPdHCu7jZZP4gjSBFmlBAkJmg+ZDCQC49ZaH1RwD+f6akQic4iGiN1wVMO8aoBfAAAA 158 | QQDSsrrzHioWa5i5n1h15r97xJic7VfjfcgUbdEQpGF4lDBKVZy7O9VMyGaqE4wxIyixh1 159 | hTn7WRDnw/Vydn/GDFAAAAC3JvdDI1NkBoZXhhAQIDBAUGBw== 160 | -----END OPENSSH PRIVATE KEY-----`, 161 | }, 162 | testKeyPair{ 163 | pk: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYImAgE51Zr2qgtm35nzY/88h9gYehjW9+CNa87mb5P", 164 | sk: ` 165 | -----BEGIN OPENSSH PRIVATE KEY----- 166 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW 167 | QyNTUxOQAAACBmCJgIBOdWa9qoLZt+Z82P/PIfYGHoY1vfgjWvO5m+TwAAAJA42+zRONvs 168 | 0QAAAAtzc2gtZWQyNTUxOQAAACBmCJgIBOdWa9qoLZt+Z82P/PIfYGHoY1vfgjWvO5m+Tw 169 | AAAEC4yVHLE00IjntOw0ZPEvja/kDeiLgWQK4N+NQ4TKm4zGYImAgE51Zr2qgtm35nzY/8 170 | 8h9gYehjW9+CNa87mb5PAAAAC3JvdDI1NkBoZXhhAQI= 171 | -----END OPENSSH PRIVATE KEY-----`, 172 | }, 173 | testKeyPair{ 174 | pk: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOFmtb463zcFyZMdh23djtu2hQU5CUQHQKVwRkVMugOC", 175 | sk: ` 176 | -----BEGIN OPENSSH PRIVATE KEY----- 177 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW 178 | QyNTUxOQAAACDhZrW+Ot83BcmTHYdt3Y7btoUFOQlEB0ClcEZFTLoDggAAAJBrnHABa5xw 179 | AQAAAAtzc2gtZWQyNTUxOQAAACDhZrW+Ot83BcmTHYdt3Y7btoUFOQlEB0ClcEZFTLoDgg 180 | AAAEBYoBOpMvswZxK302oXzsfetRzdXD+BWRRCI9a4Kv6xweFmtb463zcFyZMdh23djtu2 181 | hQU5CUQHQKVwRkVMugOCAAAAC3JvdDI1NkBoZXhhAQI= 182 | -----END OPENSSH PRIVATE KEY-----`, 183 | }, 184 | testKeyPair{ 185 | pk: "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDOQPd+sUiGWMhnMe8umAxVc5GmGM0/OFJkTDIGecGbCAAAABHNzaDo=", 186 | sk: ` 187 | -----BEGIN OPENSSH PRIVATE KEY----- 188 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 189 | gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAzkD3frFIhljIZzHvLpgMVXORphjNPzhSZEwyB 190 | nnBmwgAAAARzc2g6AAAA8BtxfCAbcXwgAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 191 | 9tAAAAIDOQPd+sUiGWMhnMe8umAxVc5GmGM0/OFJkTDIGecGbCAAAABHNzaDoBAAAAgFYp 192 | IoE5Nk1NWUs5lsfr/weMX/RzF0C5I+5KezKhfBjpb4gAdFL0q2F1Kf/ltgXGq1Eg89JVLp 193 | LlgWaGafO+JXzLfzdYzZrfYc73xEZTngk/j5DPcaDH1x6/YnBgU3TIEVzZf3demyZg7RSv 194 | twHAN7bHDxJsv3WXRw/JjeRpgkiFAAAAAAAAAAtyb3QyNTZAaGV4YQECAwQFBg== 195 | -----END OPENSSH PRIVATE KEY-----`, 196 | }, 197 | testKeyPair{ 198 | pk: "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAyoeQnJJ6+OYB+oy8jshG3PM2cHQSqCtcnsEBxf2lqT0QTdw0u07neT09ZVqut3HdtZkSJ1+TfYxB3yX9M5nB0=", 199 | sk: ` 200 | -----BEGIN OPENSSH PRIVATE KEY----- 201 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS 202 | 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQMqHkJySevjmAfqMvI7IRtzzNnB0Eq 203 | grXJ7BAcX9pak9EE3cNLtO53k9PWVarrdx3bWZEidfk32MQd8l/TOZwdAAAAqKcC7SGnAu 204 | 0hAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAyoeQnJJ6+OYB+o 205 | y8jshG3PM2cHQSqCtcnsEBxf2lqT0QTdw0u07neT09ZVqut3HdtZkSJ1+TfYxB3yX9M5nB 206 | 0AAAAgAqqeG68xdER0mnkNJ9QCx1cLQf+28ahmSX5WMO5wRcEAAAALcm90MjU2QGhleGEB 207 | AgMEBQ== 208 | -----END OPENSSH PRIVATE KEY-----`, 209 | }, 210 | testKeyPair{ 211 | pk: "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGpdENH6L6VZFX21t8Rd2mDeQRa5jPhiFAE+EWrc+olJjNj7sjJIWm5AR6Gp+7NxfwEFf6h8rC96tk2Y1ik+UI4AAAAEc3NoOg==", 212 | sk: ` 213 | -----BEGIN OPENSSH PRIVATE KEY----- 214 | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2 215 | RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQRqXRDR+i+l 216 | WRV9tbfEXdpg3kEWuYz4YhQBPhFq3PqJSYzY+7IySFpuQEehqfuzcX8BBX+ofKwverZNmN 217 | YpPlCOAAAABHNzaDoAAADguAETGLgBExgAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv 218 | cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEal0Q0fovpVkVfbW3xF3aYN5BFrmM+GIUAT 219 | 4Ratz6iUmM2PuyMkhabkBHoan7s3F/AQV/qHysL3q2TZjWKT5QjgAAAARzc2g6AQAAAEDz 220 | 0O7gKVwW+fFf/yaf8eL2ukVRzRIUU0Dv2eXr8Ckhg2nT9f/eeWGICsV2Hm9VC0mKVyR3eJ 221 | kPUeA+/gnFtKuWAAAAAAAAAAtyb3QyNTZAaGV4YQE= 222 | -----END OPENSSH PRIVATE KEY-----`, 223 | }, 224 | } 225 | 226 | func TestSignVerify(t *testing.T) { 227 | 228 | for rep := 0; rep < 50; rep++ { 229 | // copy keys 230 | keys := make([]testKeyPair, len(testKeys)) 231 | copy(keys, testKeys) 232 | 233 | // shuffle the keys in the ring 234 | rand.Shuffle(len(keys), func(i, j int) { keys[i], keys[j] = keys[j], keys[i] }) 235 | 236 | // decode keys 237 | sks := make([]KeyPair, 0, len(keys)) 238 | pks := make([]PublicKey, 0, len(keys)) 239 | for i := 0; i < len(testKeys); i++ { 240 | pk, err := PublicKeyFromStr(keys[i].pk) 241 | if err != nil { 242 | t.Error(err) 243 | } 244 | 245 | sk, err := ssh.ParseRawPrivateKey([]byte(keys[i].sk)) 246 | if err != nil { 247 | sk = nil // -sk keys are not supported 248 | } 249 | 250 | pks = append(pks, pk) 251 | sks = append( 252 | sks, 253 | KeyPair{ 254 | PK: pk, 255 | SK: sk, 256 | }, 257 | ) 258 | } 259 | 260 | msg := []byte("test") 261 | 262 | // pick the signing key in the ring 263 | var sk KeyPair 264 | for n := 0; sk.SK == nil; n++ { 265 | sk = sks[n] 266 | } 267 | 268 | t.Log(sk) 269 | t.Log(pks) 270 | 271 | sig := Sign(sk, pks, msg) 272 | 273 | _, err := sig.Verify(pks) 274 | if err != nil { 275 | t.Error(err) 276 | } 277 | 278 | } 279 | 280 | } 281 | -------------------------------------------------------------------------------- /ring/rsa.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | // Assumes StrongRSA 4 | // Note: not technically a PoK (and therefore not a sigma protocol) for the secret key: 5 | // there is no reduction from inverting the RSA permutation to recoving the order of the group 6 | // (equiv. the factorization of the modulus) 7 | // 8 | // Instead it demonstrates that the prover can invert the permutation. 9 | // The proof is however SHVZK. 10 | 11 | import ( 12 | "crypto/rand" 13 | "crypto/rsa" 14 | "encoding/asn1" 15 | "errors" 16 | "math/big" 17 | ) 18 | 19 | type rsaProver struct { 20 | pf rsaProof 21 | sk *rsa.PrivateKey 22 | } 23 | 24 | type rsaProof struct { 25 | A *big.Int // image 26 | Z *big.Int // preimage of (a + c) mod N 27 | } 28 | 29 | func rsaChallenge(pk *rsa.PublicKey, chal challenge) *big.Int { 30 | return chal.Int("rsa-challenge", pk.N) 31 | } 32 | 33 | func randomZnElem(pk *rsa.PublicKey) *big.Int { 34 | // read random bytes 35 | n := pk.N.BitLen() / 8 36 | bs := make([]byte, 2*n) 37 | if _, err := rand.Read(bs); err != nil { 38 | panic(err) 39 | } 40 | 41 | // reduce mod N 42 | r := (&big.Int{}).SetBytes(bs) 43 | return r.Mod(r, pk.N) 44 | } 45 | 46 | func rsaPerm(pk *rsa.PublicKey, input *big.Int) *big.Int { 47 | return (&big.Int{}).Exp( 48 | input, 49 | big.NewInt(int64(pk.E)), 50 | pk.N, 51 | ) 52 | } 53 | 54 | func (pf *rsaProof) Verify(pki interface{}, chal challenge) error { 55 | pk := pki.(*rsa.PublicKey) 56 | 57 | // strict encoding: all numbers in \ZZ_N canonical 58 | if pk.N.Cmp(pf.A) != 1 { 59 | return errors.New("field A is not canonically encoded in ZZ_N") 60 | } 61 | if pk.N.Cmp(pf.Z) != 1 { 62 | return errors.New("field Z is not canonically encoded in ZZ_N") 63 | } 64 | 65 | // compute challenge 66 | c := rsaChallenge(pk, chal) 67 | 68 | // img = a + c (image) 69 | img := (&big.Int{}).Add(pf.A, c) 70 | img = img.Mod(img, pk.N) 71 | 72 | // check that \phi(z) = a + c 73 | if rsaPerm(pk, pf.Z).Cmp(img) != 0 { 74 | return errors.New("challenge is not inverted correctly") 75 | } 76 | 77 | return nil 78 | } 79 | 80 | func rsaSim(pk *rsa.PublicKey, chal challenge) *rsaProof { 81 | var pf rsaProof 82 | 83 | // convert challenge to element in Z_N 84 | c := rsaChallenge(pk, chal) 85 | 86 | // z <- Z_N 87 | pf.Z = randomZnElem(pk) 88 | 89 | // phi(z) = a + c mod N 90 | // a = phi(z) - c mod N 91 | pf.A = rsaPerm(pk, pf.Z) 92 | pf.A = pf.A.Sub(pf.A, c) 93 | pf.A = pf.A.Mod(pf.A, pk.N) 94 | 95 | return &pf 96 | } 97 | 98 | func (pf *rsaProof) Commit(tx *transcript) { 99 | tx.Append([]byte("rsa proof")) 100 | tx.Append(pf.A.Bytes()) 101 | } 102 | 103 | func (pf *rsaProof) Unmarshal(b []byte) error { 104 | rest, err := asn1.Unmarshal(b, pf) 105 | if err != nil { 106 | return err 107 | } 108 | if len(rest) != 0 || pf.A == nil || pf.Z == nil { 109 | return errors.New("rsa proofs contains additional junk") 110 | } 111 | return nil 112 | } 113 | 114 | func (pf *rsaProof) Marshal() []byte { 115 | bytes, err := asn1.Marshal(*pf) 116 | if err != nil { 117 | panic(err) 118 | } 119 | return bytes 120 | } 121 | 122 | func rsaProve(sk *rsa.PrivateKey) *rsaProver { 123 | // sample random Zn elem 124 | // (might not be in the range of \phi with negl. prob) 125 | var pf rsaProof 126 | pf.A = randomZnElem(&sk.PublicKey) 127 | return &rsaProver{pf: pf, sk: sk} 128 | } 129 | 130 | func (p *rsaProver) Finish(chal challenge) { 131 | // sample challeng 132 | c := rsaChallenge(&p.sk.PublicKey, chal) 133 | 134 | // compute challenge image (product of c and A) 135 | img := (&big.Int{}).Add(c, p.pf.A) 136 | img = img.Mod(img, p.sk.PublicKey.N) 137 | 138 | // invert challenge 139 | p.pf.Z = img.Exp(img, p.sk.D, p.sk.N) 140 | } 141 | 142 | func (p *rsaProver) Pf() proof { 143 | return &p.pf 144 | } 145 | -------------------------------------------------------------------------------- /ring/sigma.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | type proof interface { 4 | Marshal() []byte 5 | Unmarshal([]byte) error 6 | Commit(*transcript) 7 | Verify(interface{}, challenge) error 8 | } 9 | 10 | type prover interface { 11 | Finish(challenge) 12 | Pf() proof 13 | } 14 | -------------------------------------------------------------------------------- /ring/sign.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto" 5 | "crypto/ecdsa" 6 | "crypto/ed25519" 7 | "crypto/rsa" 8 | "crypto/sha512" 9 | "encoding/binary" 10 | "fmt" 11 | "log" 12 | 13 | "golang.org/x/crypto/ssh" 14 | ) 15 | 16 | const version = 1 17 | 18 | type Signature struct { 19 | Version int 20 | Proofs [][]byte 21 | Challenges []challenge 22 | Fingerprints []string 23 | Msg []byte 24 | } 25 | 26 | func setupTranscript(pks []PublicKey, msg []byte) *transcript { 27 | tx := NewTranscript() 28 | 29 | // include version in transcript 30 | var versionBytes [4]byte 31 | binary.BigEndian.PutUint32(versionBytes[:], uint32(version)) 32 | tx.Append(versionBytes[:]) 33 | 34 | // add message to transcript 35 | // 36 | // We hash the message first to enable streaming in the future: 37 | // signing a big file without keeping it in memory. 38 | hash := sha512.Sum512(msg) 39 | tx.Append(hash[:]) 40 | 41 | // add public keys 42 | for _, pk := range pks { 43 | tx.Append([]byte(pk.FP())) 44 | } 45 | return tx 46 | } 47 | 48 | func Sign(pair KeyPair, pks []PublicKey, msg []byte) Signature { 49 | // commit to statement (list of public key) 50 | tx := setupTranscript(pks, msg) 51 | 52 | // retrieve the index of the signer 53 | index := len(pks) 54 | for i := range pks { 55 | if pair.PK.Equals(pks[i]) { 56 | index = i 57 | } 58 | } 59 | 60 | // sanity checks 61 | if index == len(pks) { 62 | panic("public keys does not contain pair, this is a bug.") 63 | } 64 | 65 | // generate random challenges for in-active clauses 66 | challenges := make([]challenge, len(pks)) 67 | for i := range challenges { 68 | if i != index { 69 | challenges[i].Random() 70 | } 71 | } 72 | 73 | // construct appropiate prover 74 | var prover prover 75 | skCkey := pair.SK.(crypto.PrivateKey) 76 | 77 | // detect ed25519 key 78 | if sk, ok := skCkey.(*ed25519.PrivateKey); ok { 79 | prover = ed25519Prove(*sk) 80 | } 81 | 82 | // detect RSA key 83 | if sk, ok := skCkey.(*rsa.PrivateKey); ok { 84 | prover = rsaProve(sk) 85 | } 86 | 87 | if sk, ok := skCkey.(*ecdsa.PrivateKey); ok { 88 | prover = ecdsaProve(sk) 89 | } 90 | 91 | if prover == nil { 92 | panic(fmt.Errorf("unrecognized private key-type %T", skCkey)) 93 | } 94 | 95 | // the proof for the active index is generated by the honest prover 96 | pfs := make([]proof, len(pks)) 97 | pfs[index] = prover.Pf() 98 | 99 | // simulate in-active clauses using SHVZK sim. 100 | for i, pk := range pks { 101 | if i == index { 102 | continue 103 | } 104 | 105 | chal := challenges[i] 106 | ckey := toCryptoPublicKey(pk) 107 | 108 | switch pk.pk.Type() { 109 | case ssh.KeyAlgoSKED25519, ssh.KeyAlgoED25519: 110 | pfs[i] = ed25519Sim(ckey.(ed25519.PublicKey), chal) 111 | case ssh.KeyAlgoRSA: 112 | pfs[i] = rsaSim(ckey.(*rsa.PublicKey), chal) 113 | case ssh.KeyAlgoSKECDSA256, ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521: 114 | pfs[i] = ecdsaSim(ckey.(*ecdsa.PublicKey), chal) 115 | default: 116 | log.Fatalln("unsupported key type:", pk.pk.Type()) 117 | } 118 | } 119 | 120 | // commit to first round messages 121 | for _, pf := range pfs { 122 | pf.Commit(tx) 123 | } 124 | 125 | // sample challenge 126 | challenges[index] = tx.Challenge() 127 | 128 | // compute challenge for active clause 129 | // (challenges and tx.Challenge sums to 0) 130 | for i, chal := range challenges { 131 | if i != index { 132 | challenges[index].Add(chal) 133 | } 134 | } 135 | 136 | // finish transcript for active clause 137 | prover.Finish(challenges[index]) 138 | pfs[index] = prover.Pf() 139 | 140 | // compile combined signature 141 | sig := Signature{ 142 | Version: version, 143 | Msg: msg, 144 | Challenges: challenges, 145 | Proofs: make([][]byte, len(pfs)), 146 | Fingerprints: make([]string, len(pks)), 147 | } 148 | 149 | // serialize all the proofs 150 | for i, pf := range pfs { 151 | sig.Proofs[i] = pf.Marshal() 152 | } 153 | 154 | // add fingerprints to signature 155 | // (to enable verifying against a superset of keys) 156 | for i, pk := range pks { 157 | sig.Fingerprints[i] = ssh.FingerprintSHA256(pk.pk) 158 | } 159 | 160 | // check validity of generated signature: sanity check 161 | if _, err := sig.VerifyExact(pks); err != nil { 162 | panic(err) 163 | } 164 | 165 | return sig 166 | } 167 | -------------------------------------------------------------------------------- /ring/transcript.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "crypto/sha512" 5 | "encoding/binary" 6 | "errors" 7 | "hash" 8 | ) 9 | 10 | type transcript struct { 11 | h hash.Hash 12 | } 13 | 14 | func NewTranscript() *transcript { 15 | return &transcript{ 16 | h: sha512.New(), 17 | } 18 | } 19 | 20 | func (tx *transcript) Append(bs []byte) { 21 | err := binary.Write(tx.h, binary.LittleEndian, uint64(len(bs))) 22 | if err != nil { 23 | panic(err) 24 | } 25 | tx.h.Write(bs) 26 | } 27 | 28 | func (tx *transcript) Challenge() challenge { 29 | // compute digest 30 | hsh := tx.h.Sum([]byte{}) 31 | if len(hsh) < challengeSize { 32 | panic(errors.New("challenge is bigger than digest")) 33 | } 34 | 35 | // copy hash prefix into challenge 36 | var chal challenge 37 | chal.Bytes = make([]byte, challengeSize) 38 | copy(chal.Bytes, hsh) 39 | return chal 40 | } 41 | -------------------------------------------------------------------------------- /ring/verify.go: -------------------------------------------------------------------------------- 1 | package ring 2 | 3 | import ( 4 | "errors" 5 | "fmt" 6 | 7 | "golang.org/x/crypto/ssh" 8 | ) 9 | 10 | func (sig *Signature) Verify(pks []PublicKey) ([]byte, error) { 11 | // index by fingerprints 12 | keyMap := make(map[string]PublicKey) 13 | for _, pk := range pks { 14 | keyMap[pk.FP()] = pk 15 | } 16 | 17 | // lookup subset of keys included in the signature 18 | // (the signature might be for a smaller ring, e.g. keys may have been added later) 19 | selectPks := make([]PublicKey, 0, len(sig.Fingerprints)) 20 | for _, fp := range sig.Fingerprints { 21 | if pk, ok := keyMap[fp]; ok { 22 | selectPks = append(selectPks, pk) 23 | } else { 24 | return nil, errors.New("the ring is not a subset of the public keys used to verify") 25 | } 26 | } 27 | 28 | return sig.VerifyExact(selectPks) 29 | } 30 | 31 | func (sig *Signature) VerifyExact(pks []PublicKey) ([]byte, error) { 32 | // basic checks 33 | if len(sig.Proofs) != len(pks) { 34 | return nil, errors.New("incorrect number of proofs") 35 | } 36 | if len(sig.Challenges) != len(pks) { 37 | return nil, errors.New("incorrect number of challenges") 38 | } 39 | if len(sig.Fingerprints) != len(pks) { 40 | return nil, errors.New("incorrect number of fingerprints") 41 | } 42 | if sig.Version != version { 43 | return nil, errors.New("supported signature version") 44 | } 45 | 46 | // commit to statement (list of public key) 47 | tx := setupTranscript(pks, sig.Msg) 48 | 49 | // verify every proof 50 | for i, pk := range pks { 51 | // check fingerprint hint included in signature 52 | if pk.FP() != sig.Fingerprints[i] { 53 | return nil, errors.New("fingerprint does not match public key") 54 | } 55 | 56 | // pick proof type (based on public key) 57 | var pf proof 58 | switch pk.pk.Type() { 59 | case ssh.KeyAlgoED25519, ssh.KeyAlgoSKED25519: 60 | pf = &ed25519Proof{} 61 | case ssh.KeyAlgoRSA: 62 | pf = &rsaProof{} 63 | case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521, ssh.KeyAlgoSKECDSA256: 64 | pf = &ecdsaProof{} 65 | default: 66 | return nil, fmt.Errorf("unsupported key type: %s", pk.pk.Type()) 67 | } 68 | 69 | // unmarshal proof 70 | if err := pf.Unmarshal(sig.Proofs[i]); err != nil { 71 | return nil, err 72 | } 73 | 74 | // check that challenge is right size 75 | chal := sig.Challenges[i] 76 | if !chal.IsValid() { 77 | return nil, errors.New("challenge is invalid (wrong length)") 78 | } 79 | 80 | // verify proof against challenge 81 | ckey := toCryptoPublicKey(pk) 82 | if err := pf.Verify(ckey, chal); err != nil { 83 | return nil, err 84 | } 85 | pf.Commit(tx) 86 | } 87 | 88 | // final check: challenges sum to zero 89 | delta := tx.Challenge() 90 | for _, chal := range sig.Challenges { 91 | delta.Add(chal) 92 | } 93 | 94 | if delta.IsZero() { 95 | return sig.Msg, nil 96 | } else { 97 | return nil, errors.New("challenges does not sum to zero") 98 | } 99 | } 100 | -------------------------------------------------------------------------------- /tests.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -e 4 | 5 | MSG="test msg" 6 | SSH_DIRECTORY=/tmp/ring-ssh 7 | 8 | rm -rf $SSH_DIRECTORY 9 | 10 | mkdir $SSH_DIRECTORY 11 | 12 | echo "$SSH_DIRECTORY/id_ecdsa" | ssh-keygen -t ecdsa 13 | echo "$SSH_DIRECTORY/id_ed25519" | ssh-keygen -t ed25519 14 | echo "$SSH_DIRECTORY/id_rsa" | ssh-keygen -b 3072 -t rsa 15 | 16 | export SSH_DIRECTORY=$SSH_DIRECTORY 17 | 18 | ## ECDSA Test ## 19 | 20 | # generate signature 21 | ./git-ring sign --msg "$MSG" --url https://github.com/torvalds.keys --github rot256 --ssh-key $SSH_DIRECTORY/id_ecdsa.pub 22 | 23 | # check against same ring 24 | ./git-ring verify --url https://github.com/torvalds.keys --github rot256 --ssh-key $SSH_DIRECTORY/id_ecdsa.pub | grep "$MSG" 25 | 26 | # check against superset 27 | ./git-ring verify --github torvalds --github gregkh --github rot256 --ssh-key $SSH_DIRECTORY/id_ecdsa.pub | grep "$MSG" 28 | 29 | ## Ed25519 Test ## 30 | 31 | # generate signature 32 | ./git-ring sign --msg "$MSG" --gitlab dzaporozhets --ssh-key $SSH_DIRECTORY/id_ed25519.pub 33 | 34 | # check against same ring 35 | ./git-ring verify --gitlab dzaporozhets --ssh-key $SSH_DIRECTORY/id_ed25519.pub | grep "$MSG" 36 | 37 | # check against superset 38 | ./git-ring verify --github torvalds --github gregkh --github rot256 --gitlab dzaporozhets --ssh-key $SSH_DIRECTORY/id_ed25519.pub | grep "$MSG" 39 | 40 | ## RSA Test ## 41 | 42 | # generate signature (large ring) 43 | ./git-ring sign --msg "$MSG" --allow-empty --github Cloudflare --ssh-key $SSH_DIRECTORY/id_rsa.pub 44 | 45 | # check against superset (large ring) 46 | ./git-ring verify --github Cloudflare --ssh-key $SSH_DIRECTORY/id_rsa.pub --ssh-key $SSH_DIRECTORY/id_ed25519.pub | grep "$MSG" 47 | --------------------------------------------------------------------------------