6334893561
* refactoring traits * separate generation session * generalized ClusterSessions * signing session prototype * full_signature_math_session * consensus session prototype * continue signing session * continue signing session * continue signing session * continue signing session * isolated consensus logic * started work on signing test * complete_gen_sign_session works * consensus tests * get rid of duplicated data in SigningSession * TODOs in signing session * fixing tests * fixed last test * signing session in http listener * new key server tests * fix after merge * enabled warnings * fixed possible race * ignore previous jobs responses * include sef node in consensus when confirmed * fixed warning * removed extra clones * consensus_restarts_after_node_timeout * encrypt signature before return * return error text along with HTTP status * fix for odd-of-N (share check fails + not equal to local sign) * fixed t-of-N for odd t * fixed test cases in complete_gen_sign_session * fixed mistimed response reaction * jobs draft * DecryptionJob * consensus session tets * fixed decryption tests * signing job implementation * siginng_session using new consensus_session * added license preambles * same_consensus_group_returned_after_second_selection * database upgrade v0 -> v1 * typo * fixed grumbles
77 lines
4.3 KiB
Rust
77 lines
4.3 KiB
Rust
// Copyright 2015-2017 Parity Technologies (UK) Ltd.
|
|
// This file is part of Parity.
|
|
|
|
// Parity is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
|
|
// Parity is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with Parity. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
use types::all::{Error, Public, ServerKeyId, MessageHash, EncryptedMessageSignature, RequestSignature, EncryptedDocumentKey,
|
|
EncryptedDocumentKeyShadow};
|
|
|
|
/// Server key (SK) generator.
|
|
pub trait ServerKeyGenerator {
|
|
/// Generate new SK.
|
|
/// `key_id` is the caller-provided identifier of generated SK.
|
|
/// `signature` is `key_id`, signed with caller public key.
|
|
/// `threshold + 1` is the minimal number of nodes, required to restore private key.
|
|
/// Result is a public portion of SK.
|
|
fn generate_key(&self, key_id: &ServerKeyId, signature: &RequestSignature, threshold: usize) -> Result<Public, Error>;
|
|
}
|
|
|
|
/// Document key (DK) server.
|
|
pub trait DocumentKeyServer: ServerKeyGenerator {
|
|
/// Store externally generated DK.
|
|
/// `key_id` is identifier of previously generated SK.
|
|
/// `signature` is key_id, signed with caller public key. Caller must be the same as in the `generate_key` call.
|
|
/// `common_point` is a result of `k * T` expression, where `T` is generation point and `k` is random scalar in EC field.
|
|
/// `encrypted_document_key` is a result of `M + k * y` expression, where `M` is unencrypted document key (point on EC),
|
|
/// `k` is the same scalar used in `common_point` calculation and `y` is previously generated public part of SK.
|
|
fn store_document_key(&self, key_id: &ServerKeyId, signature: &RequestSignature, common_point: Public, encrypted_document_key: Public) -> Result<(), Error>;
|
|
/// Generate and store both SK and DK. This is a shortcut for consequent calls of `generate_key` and `store_document_key`.
|
|
/// The only difference is that DK is generated by DocumentKeyServer (which might be considered unsafe).
|
|
/// `key_id` is the caller-provided identifier of generated SK.
|
|
/// `signature` is `key_id`, signed with caller public key.
|
|
/// `threshold + 1` is the minimal number of nodes, required to restore private key.
|
|
/// Result is a DK, encrypted with caller public key.
|
|
fn generate_document_key(&self, key_id: &ServerKeyId, signature: &RequestSignature, threshold: usize) -> Result<EncryptedDocumentKey, Error>;
|
|
/// Restore previously stored DK.
|
|
/// DK is decrypted on the key server (which might be considered unsafe), and then encrypted with caller public key.
|
|
/// `key_id` is identifier of previously generated SK.
|
|
/// `signature` is key_id, signed with caller public key. Caller must be on ACL for this function to succeed.
|
|
/// Result is a DK, encrypted with caller public key.
|
|
fn restore_document_key(&self, key_id: &ServerKeyId, signature: &RequestSignature) -> Result<EncryptedDocumentKey, Error>;
|
|
/// Restore previously stored DK.
|
|
/// To decrypt DK on client:
|
|
/// 1) use requestor secret key to decrypt secret coefficients from result.decrypt_shadows
|
|
/// 2) calculate decrypt_shadows_sum = sum of all secrets from (1)
|
|
/// 3) calculate decrypt_shadow_point: decrypt_shadows_sum * result.common_point
|
|
/// 4) calculate decrypted_secret: result.decrypted_secret + decrypt_shadow_point
|
|
/// Result is a DK shadow.
|
|
fn restore_document_key_shadow(&self, key_id: &ServerKeyId, signature: &RequestSignature) -> Result<EncryptedDocumentKeyShadow, Error>;
|
|
}
|
|
|
|
/// Message signer.
|
|
pub trait MessageSigner: ServerKeyGenerator {
|
|
/// Sign message with previously generated SK.
|
|
/// `key_id` is the caller-provided identifier of generated SK.
|
|
/// `signature` is `key_id`, signed with caller public key.
|
|
/// `message` is the message to be signed.
|
|
/// Result is a signed message, encrypted with caller public key.
|
|
fn sign_message(&self, key_id: &ServerKeyId, signature: &RequestSignature, message: MessageHash) -> Result<EncryptedMessageSignature, Error>;
|
|
}
|
|
|
|
|
|
#[ipc(client_ident="RemoteKeyServer")]
|
|
/// Key server.
|
|
pub trait KeyServer: DocumentKeyServer + MessageSigner + Send + Sync {
|
|
}
|