hide-protocol 0.9.0-x86_64-linux → 0.9.1-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a6b2c05a134dc9111368d9ddba43f1885abcf36f0af1bdaa8aff4a0cd21b14f
-  data.tar.gz: bf5206f8326a23a0990f99bdec3d7764ff0ce6f9571d21b591894c8de8db6e72
+  metadata.gz: cfb23dd3235edb7cc1f1de32d7095952956a59e2e6f448c1b70d26ffeb17190a
+  data.tar.gz: eef7d550450fc5e1b36dc9d6492887160b526970dd3b6338c88eca8d0feeb295
 SHA512:
-  metadata.gz: b2ba396bd680b542ab0d0efa96a8ccd0ba352d7a7adfa75002f24f2967a5fb1014410ac7429db059863d0e8114d5637780fda7af55627c4c176c334776237b6a
-  data.tar.gz: ea6f0a232e5e5a57b0ac304d109d47c7878a0188396682f1c8d6d1c0a5c2a91785cd428e332cfe8b6bda58ba26813996f459d0e486730610a2cedb290d1bea77
+  metadata.gz: c334b6c3b5c77e38a807d89df95bfda880b0c2cf5809adfdc345669b46156944ad4baeb9e9e02e51fe511c5476136b812d433785a7ee625bc771b9bae3973918
+  data.tar.gz: 3f309306ac02584dc35aeae585eb7b690cdc3a2b0d5a34ef5d6fa55a0ddbd966d77b8df7bd800629851fed9bee6203538c63394451e8f10b9cc6f3d4a67ce135

data/README.md

@@ -103,12 +103,20 @@ written before signatures existed carries no signing seed and raises
 | `Hide.epoch_public_key(chain, epoch)` | the public key to encrypt to for `epoch` |
 | `Hide.verify_inclusion(leaf, index, size, path, root)` | `nil` |
 | `Hide.verify_consistency(old_size, new_size, path, old_root, new_root)` | `nil` |
+| `Hide.verify_identity_pinned(log, recovery_binding, pinned_root)` | `Integer` — devices trusted, after checking the log against the 32-byte root you pinned |
+| `Hide.verify_epoch_chain_bound(log, recovery_binding, pinned_root, chain, epoch_binding)` | `Integer` — epochs held, after proving the chain belongs to that identity |
+| `Hide.verify_checkpoint(note, origin, log_public)` | `[size, root]` — tree size and 32-byte root of a signed checkpoint note |
 
 A cryptographic verify **raises** on failure (`MalformedError` if the bytes did
 not decode, `AuthenticationError` if they decoded but did not verify) and never
 returns `false`. The one boolean is `identity_trusts_device`: the log is
 verified first, so `false` means "not a member", never "did not verify".
 
+`verify_identity_pinned` is the relying-party check (spec §16): a recovery key
+taken from the same untrusted source as the log cannot catch a Recover appended
+under a stranger's key, but a `recovery_binding` checked against a root you
+trust out of band does.
+
 ## Native library
 
 The core is located in this order:

data/lib/hide_protocol/binding.rb

@@ -122,6 +122,15 @@ module Hide
       ],
       hide_transparency_verify_consistency: [
         [UINT64, UINT64, VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP, SIZE_T], INT32
+      ],
+      hide_identity_verify_pinned: [
+        [VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP], INT32
+      ],
+      hide_epoch_verify_bound: [
+        [VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP, SIZE_T, VOIDP], INT32
+      ],
+      hide_checkpoint_verify: [
+        [VOIDP, SIZE_T, VOIDP, VOIDP, SIZE_T, VOIDP, VOIDP], INT32
       ]
     }.freeze
 
@@ -189,5 +198,17 @@ module Hide
       slot[0, WORD] = "\x00" * WORD
       slot
     end
+
+    # A slot for a uint64_t out-parameter. Always 8 bytes, unlike a size_t
+    # slot, so it is read with "Q" rather than WORD_PACK.
+    def self.uint64_slot
+      slot = Fiddle::Pointer.malloc(8, Fiddle::RUBY_FREE)
+      slot[0, 8] = "\x00" * 8
+      slot
+    end
+
+    def self.read_uint64(slot)
+      slot[0, 8].unpack1("Q")
+    end
   end
 end

data/lib/hide_protocol.rb

@@ -292,6 +292,77 @@ module Hide
       nil
     end
 
+    # Verifies an identity log against the root the caller pinned out of band.
+    #
+    # recovery_binding establishes the recovery key, so a log extended by a
+    # Recover under a stranger's key fails — a bare verify_identity with a
+    # recovery key taken from the same untrusted source does not catch that.
+    # Returns how many devices the log trusts now; raises MalformedError for
+    # bytes that do not decode and AuthenticationError for a log that is not
+    # this identity's.
+    def verify_identity_pinned(log, recovery_binding, pinned_root)
+      bytes = binary(log, "log")
+      binding = binary(recovery_binding, "recovery binding")
+      root = binary(pinned_root, "pinned root")
+      slot = Binding.pointer_slot
+      check(Binding.call(
+              :hide_identity_verify_pinned,
+              buffer_arg(bytes), bytes.bytesize,
+              buffer_arg(binding), binding.bytesize,
+              buffer_arg(root), root.bytesize,
+              slot
+            ))
+      Binding.read_count(slot)
+    end
+
+    # Verifies that an epoch chain belongs to the pinned identity.
+    #
+    # epoch_binding must be signed by a device the log trusts now, over this
+    # exact chain. Returns how many epochs the chain holds.
+    def verify_epoch_chain_bound(log, recovery_binding, pinned_root, chain, epoch_binding)
+      bytes = binary(log, "log")
+      binding = binary(recovery_binding, "recovery binding")
+      root = binary(pinned_root, "pinned root")
+      chain_bytes = binary(chain, "chain")
+      epoch_bytes = binary(epoch_binding, "epoch binding")
+      slot = Binding.pointer_slot
+      check(Binding.call(
+              :hide_epoch_verify_bound,
+              buffer_arg(bytes), bytes.bytesize,
+              buffer_arg(binding), binding.bytesize,
+              buffer_arg(root), root.bytesize,
+              buffer_arg(chain_bytes), chain_bytes.bytesize,
+              buffer_arg(epoch_bytes), epoch_bytes.bytesize,
+              slot
+            ))
+      Binding.read_count(slot)
+    end
+
+    # Verifies a signed checkpoint note from the log named origin, under the
+    # log's 1984-byte public key. Returns [size, root]: the tree size and its
+    # 32-byte root. Raises AuthenticationError when the note was altered,
+    # names another origin, or is not signed under log_public.
+    def verify_checkpoint(note, origin, log_public)
+      bytes = binary(note, "note")
+      key = binary(log_public, "log public key")
+      size = Binding.uint64_slot
+      out = Binding.empty_buffer
+      begin
+        check(Binding.call(
+                :hide_checkpoint_verify,
+                buffer_arg(bytes), bytes.bytesize,
+                cstring(origin.to_s),
+                buffer_arg(key), key.bytesize,
+                size, out
+              ))
+      rescue StandardError
+        # On failure the core leaves out untouched; freeing it releases the scratch space.
+        Binding.take(out)
+        raise
+      end
+      [Binding.read_uint64(size), Binding.take(out)]
+    end
+
     def check(code)
       return if code == Binding::OK
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hide-protocol
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: x86_64-linux
 authors:
 - HIDE contributors