@ledgerhq/hw-ledger-key-ring-protocol 0.2.1-fix-build-number-pre.0

package/src/__tests__/seedId.ts

@@ -0,0 +1,120 @@
+import { crypto } from "../Crypto";
+import { Challenge, PubKeyCredential } from "../SeedId";
+
+describe("PubKeyCredential regular cases", () => {
+  const rpPubKeyCredential = new PubKeyCredential({
+    version: 0,
+    curveId: 0x21,
+    signAlgorithm: 0x01,
+    publicKey: crypto.from_hex(
+      "02b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5",
+    ),
+  });
+
+  test("assertValidity", () => {
+    expect(() => rpPubKeyCredential.assertValidity()).not.toThrow();
+  });
+
+  test("toJSON", () => {
+    expect(rpPubKeyCredential.toJSON()).toEqual({
+      version: 0,
+      curveId: 33,
+      signAlgorithm: 1,
+      publicKey: "02b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5",
+    });
+  });
+
+  test("toBytes", () => {
+    expect(crypto.to_hex(rpPubKeyCredential.toBytes())).toEqual(
+      "0021012102b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5",
+    );
+  });
+
+  test("fromBytes", () => {
+    expect(
+      PubKeyCredential.fromBytes(
+        crypto.from_hex(
+          "0021012102b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5",
+        ),
+      ),
+    ).toEqual([rpPubKeyCredential, 37]);
+  });
+
+  test("toBytes into fromBytes", () => {
+    const bytes = rpPubKeyCredential.toBytes();
+    const [pubKeyCredential, _] = PubKeyCredential.fromBytes(bytes);
+    expect(pubKeyCredential).toEqual(rpPubKeyCredential);
+  });
+});
+
+describe("Challenge regular cases", () => {
+  const rpPubKeyCredential = new PubKeyCredential({
+    version: 0,
+    curveId: 0x21,
+    signAlgorithm: 0x01,
+    publicKey: crypto.from_hex(
+      "02b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5",
+    ),
+  });
+
+  const challengeData = crypto.from_hex("53cafde60e5395b164eb867213bc05f6");
+  const rpSignature = crypto.from_hex(
+    "3045022025d130d7ae5c48a6cf09781d04a08e9a2d07ce1bd17e84637f6ede4a043c5dcc022100a846ececf20eb53ffc2dc502ce8074ba40b241bfd13edaf1e8575559a9b2b4ea",
+  );
+
+  const challenge = new Challenge({
+    payloadType: 0x07,
+    version: 0,
+    protocolVersion: {
+      major: 1,
+      minor: 0,
+      patch: 0,
+    },
+    challengeData: challengeData,
+    challengeExpiry: new Date(1708678950000),
+    host: "localhost",
+    rpCredential: rpPubKeyCredential,
+    rpSignature: rpSignature,
+  });
+
+  test("parse one example from backend", () => {
+    const hex =
+      "01010702010012102d4492d50ef878a450d9bd6e8862690014010115483046022100beb271fa9752c377251005e125cc115737e427d5259a2dbbc9a38f7a36430c3f0221008826b3d3c1b491b41908d7cc89d71b92e9428c52a927e95341d555252f687b0f16046654aea120096c6f63616c686f7374320121332103cb7628e7248ddf9c07da54b979f16bf081fb3d173aac0992ad2a44ef6a388ae2600401000000";
+    const bytes = crypto.from_hex(hex);
+    const [challengeFromBytes, l] = Challenge.fromBytes(bytes);
+    expect(l).toEqual(bytes.length);
+
+    expect(challengeFromBytes.toJSON()).toEqual({
+      payloadType: 7,
+      version: 0,
+      challenge: { data: "2d4492d50ef878a450d9bd6e88626900", expiry: "2024-05-27T16:02:41.000Z" },
+      host: "localhost",
+      rp: [
+        {
+          credential: {
+            version: 0,
+            curveId: 33,
+            signAlgorithm: 1,
+            publicKey: "03cb7628e7248ddf9c07da54b979f16bf081fb3d173aac0992ad2a44ef6a388ae2",
+          },
+          signature:
+            "3046022100beb271fa9752c377251005e125cc115737e427d5259a2dbbc9a38f7a36430c3f0221008826b3d3c1b491b41908d7cc89d71b92e9428c52a927e95341d555252f687b0f",
+        },
+      ],
+      protocolVersion: { major: 1, minor: 0, patch: 0 },
+    });
+  });
+
+  test("toBytes", () => {
+    expect(crypto.to_hex(challenge.toBytes())).toEqual(
+      "010107020100121053cafde60e5395b164eb867213bc05f614010115473045022025d130d7ae5c48a6cf09781d04a08e9a2d07ce1bd17e84637f6ede4a043c5dcc022100a846ececf20eb53ffc2dc502ce8074ba40b241bfd13edaf1e8575559a9b2b4ea160465d85f2620096c6f63616c686f7374320121332102b2c29ab36022219967cc21a306599ecaf51ce9f2998da6982388d52c8c69a6a5600401000000",
+    );
+  });
+
+  test("toBytes <> fromBytes", () => {
+    const bytes = challenge.toBytes();
+    const [challengeFromBytes, _] = Challenge.fromBytes(bytes);
+    expect(challengeFromBytes).toEqual(challenge);
+    expect(challengeFromBytes.toBytes()).toEqual(bytes);
+  });
+});

package/src/__tests__/shared_object.ts

@@ -0,0 +1,118 @@
+/*
+    This test suite simulates an application generating data (using a fixed shchema) and sharing part of the
+    data to specific users. The data is encrypted using a StreamTree.
+*/
+
+import { StreamTree } from "../StreamTree";
+import { Device, device } from "..";
+import { Permissions } from "../CommandBlock";
+import { StreamTreeCipher } from "../StreamTreeCipher";
+import { DerivationPath, crypto } from "../Crypto";
+
+interface SharedObject {
+  name: string;
+  age: number;
+  email: string;
+}
+
+interface EncryptedSharedObject {
+  name: string;
+  age: string;
+  email: string;
+}
+
+const APPLICATION_ID = 12;
+
+async function encryptSharedObject(
+  device: Device,
+  tree: StreamTree,
+  sharedObject: SharedObject,
+  mapping: Map<string, string> = new Map(),
+): Promise<EncryptedSharedObject> {
+  const cipher = StreamTreeCipher.create(device);
+  const encrypt = async (key: keyof typeof sharedObject, defaultPath: string): Promise<string> => {
+    return crypto.to_hex(
+      await cipher.encrypt(
+        tree,
+        DerivationPath.toIndexArray(mapping.get(key) || defaultPath),
+        new TextEncoder().encode((sharedObject[key] as string | number).toString()),
+      ),
+    );
+  };
+  const encryptedSharedObject = {
+    name: await encrypt("name", `0h/${APPLICATION_ID}h/0h/0h/0h`),
+    age: await encrypt("age", `0h/${APPLICATION_ID}h/0h/1h/0h`),
+    email: await encrypt("email", `0h/${APPLICATION_ID}h/0h/2h/0h`),
+  };
+  return encryptedSharedObject;
+}
+
+async function decryptSharedObject(
+  device: Device,
+  tree: StreamTree,
+  encryptedSharedObject: EncryptedSharedObject,
+  mapping: Map<string, string> = new Map(),
+): Promise<SharedObject> {
+  const cipher = StreamTreeCipher.create(device);
+  const decrypt = async (key: string, defaultPath: string): Promise<string> => {
+    const path = DerivationPath.toIndexArray(mapping.get(key) || defaultPath);
+    const bytes = await cipher.decrypt(
+      tree,
+      path,
+      crypto.from_hex(encryptedSharedObject[key as keyof typeof encryptedSharedObject] as string),
+    );
+    return new TextDecoder().decode(bytes);
+  };
+  const sharedObject = {
+    name: await decrypt("name", `0h/${APPLICATION_ID}h/0h/0h/0h`),
+    age: parseInt(await decrypt("age", `0h/${APPLICATION_ID}h/0h/1h/0h`)),
+    email: await decrypt("email", `0h/${APPLICATION_ID}h/0h/2h/0h`),
+  };
+  return sharedObject;
+}
+
+describe("Shared object scenario using StreamTree", () => {
+  it("should create a tree with 3 members, one member encrypt a shared object and another one decrypts it", async () => {
+    const alice = await device.software();
+    const bob = await device.software();
+    const carol = await device.software();
+
+    // Create a new tree owned by alice
+    let tree = await StreamTree.createNewTree(alice);
+
+    // Share the application node with bob
+    tree = await tree.share(
+      tree.getApplicationRootPath(APPLICATION_ID),
+      alice,
+      (await bob.getPublicKey()).publicKey,
+      "Bob",
+      Permissions.OWNER,
+    );
+
+    // Bob creates a shared object and encrypt it (1 value -> 1 encryption key)
+    const sharedObject = {
+      name: "Bob",
+      age: 42,
+      email: "bob@box.com",
+    };
+    //console.dir(sharedObject, { depth: null });
+    const encryptedObject = await encryptSharedObject(bob, tree, sharedObject);
+
+    // Share the application node with carol
+    tree = await tree.share(
+      tree.getApplicationRootPath(APPLICATION_ID),
+      alice,
+      (await carol.getPublicKey()).publicKey,
+      "Carol",
+      Permissions.OWNER,
+    );
+
+    // Decrypt with Carol
+    const decryptedObject = await decryptSharedObject(carol, tree, encryptedObject);
+
+    //console.dir(encryptedObject, { depth: null });
+    //console.dir(decryptedObject, { depth: null });
+
+    expect(decryptedObject).toEqual(sharedObject);
+  });
+});

package/src/index.ts

@@ -0,0 +1,43 @@
+import { createDevice, SoftwareDevice } from "./Device";
+import * as CS from "./CommandStream";
+import { createApduDevice } from "./ApduDevice";
+import Jsonifier from "./CommandStreamJsonifier";
+
+export type { Device } from "./Device";
+export type { StreamTreeCipherMode } from "./StreamTreeCipher";
+export { StreamTreeCipher } from "./StreamTreeCipher";
+export { crypto, DerivationPath } from "./Crypto";
+export { PublicKey } from "./PublicKey";
+export type { CommandType, Command, CommandBlock } from "./CommandBlock";
+export {
+  AddMember,
+  CloseStream,
+  Derive,
+  EditMember,
+  PublishKey,
+  Seed,
+  Permissions,
+} from "./CommandBlock";
+export { APDU, TRUSTCHAIN_APP_NAME } from "./ApduDevice";
+export { CommandStreamEncoder } from "./CommandStreamEncoder";
+export { CommandStreamDecoder } from "./CommandStreamDecoder";
+export { Challenge, PubKeyCredential } from "./SeedId";
+export { StreamTree } from "./StreamTree";
+export { SoftwareDevice };
+
+/**
+ *
+ */
+export class CommandStream extends CS.default {}
+/**
+ *
+ */
+export class CommandStreamJsonifier extends Jsonifier {}
+
+/**
+ *
+ */
+export const device = {
+  software: createDevice,
+  apdu: createApduDevice,
+};

package/src/tlv.ts

@@ -0,0 +1,210 @@
+import BigEndian from "./BigEndian";
+
+export enum TLVTypes {
+  Null = 0,
+  VarInt = 1,
+  Hash = 2,
+  Signature = 3,
+  String = 4,
+  Bytes = 5,
+  PublicKey = 6,
+}
+
+export interface TLVField {
+  type: number;
+  value: Uint8Array;
+}
+
+export type TLVReaderParams = { tlv: TLVField; offset: number };
+
+function pushTLV(a: Uint8Array, t: number, l: number, v: Uint8Array): Uint8Array {
+  const c = new Uint8Array(a.length + 2 + l);
+  c.set(a);
+  c.set(new Uint8Array([t, l]), a.length);
+  c.set(v, a.length + 2);
+  return c;
+}
+
+function push(a: Uint8Array, b: Uint8Array): Uint8Array {
+  const c = new Uint8Array(a.length + b.length);
+  c.set(a);
+  c.set(b, a.length);
+  return c;
+}
+
+// Generic part of the TLV encoding/decoding
+export const TLV = {
+  readTLV: function (buffer: Uint8Array, offset: number): { tlv: TLVField; offset: number } {
+    const type = buffer[offset];
+    offset += 1;
+    const length = buffer[offset];
+    offset += 1;
+    const value = buffer.slice(offset, offset + length);
+    offset += length;
+    return { tlv: { type, value }, offset };
+  },
+
+  readAllTLV: function (buffer: Uint8Array, offset: number): TLVField[] {
+    const result: TLVField[] = [];
+
+    while (offset < buffer.length) {
+      const tlv = TLV.readTLV(buffer, offset);
+      offset = tlv.offset;
+      result.push(tlv.tlv);
+    }
+    return result;
+  },
+
+  readVarInt: function (read: { tlv: TLVField; offset: number }): {
+    value: number;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.VarInt) {
+      throw new Error(
+        `Invalid type for var int (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const fill = 4 - read.tlv.value.length;
+    const normalized = TLV.push(new Uint8Array([0, 0, 0, 0].slice(0, fill)), read.tlv.value);
+    const value = BigEndian.arrayToNumber(normalized);
+    return { value, offset: read.offset };
+  },
+
+  readBytes: function (read: { tlv: TLVField; offset: number }): {
+    value: Uint8Array;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.Bytes) {
+      throw new Error(
+        `Invalid type for bytes (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const value = read.tlv.value;
+    return { value, offset: read.offset };
+  },
+
+  readDerivationPath: function (read: { tlv: TLVField; offset: number }): {
+    value: number[];
+    offset: number;
+  } {
+    const bytes = TLV.readBytes(read);
+    const view = new DataView(bytes.value.buffer);
+    const value: number[] = [];
+    for (let offset = 0; offset < bytes.value.length; offset += 4) {
+      value.push(view.getUint32(offset, false));
+    }
+    return { value, offset: bytes.offset };
+  },
+
+  readString: function (read: { tlv: TLVField; offset: number }): {
+    value: string;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.String) {
+      throw new Error(
+        `Invalid type for string (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const value = new TextDecoder().decode(read.tlv.value);
+    return { value, offset: read.offset };
+  },
+
+  readHash: function (read: { tlv: TLVField; offset: number }): {
+    value: Uint8Array;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.Hash) {
+      throw new Error(
+        `Invalid type for hash (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const value = read.tlv.value;
+    return { value, offset: read.offset };
+  },
+
+  readSignature: function (read: { tlv: TLVField; offset: number }): {
+    value: Uint8Array;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.Signature) {
+      throw new Error(
+        `Invalid type for signature (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const value = read.tlv.value;
+    return { value, offset: read.offset };
+  },
+
+  readPublicKey: function (read: { tlv: TLVField; offset: number }): {
+    value: Uint8Array;
+    offset: number;
+  } {
+    if (read.tlv.type != TLVTypes.PublicKey) {
+      throw new Error(
+        `Invalid type for public key (at offset ${read.offset - 2 - read.tlv.value.length}))`,
+      );
+    }
+    const value = read.tlv.value;
+    return { value, offset: read.offset };
+  },
+
+  readNullOr: function <Type>(
+    read: { tlv: TLVField; offset: number },
+    func: (read: TLVReaderParams) => { value: Type; offset: number },
+  ): { value: Type | null; offset: number } {
+    if (read.tlv.type == TLVTypes.Null) {
+      return { value: null, offset: read.offset };
+    }
+    return func(read);
+  },
+
+  push,
+  pushTLV,
+
+  pushString: function (a: Uint8Array, b: string): Uint8Array {
+    const encoded = new TextEncoder().encode(b);
+    return pushTLV(a, 0x04, encoded.length, encoded);
+  },
+
+  pushByte: function (a: Uint8Array, b: number): Uint8Array {
+    return pushTLV(a, 0x01, 1, new Uint8Array([b]));
+  },
+
+  pushInt16: function (a: Uint8Array, b: number): Uint8Array {
+    const bytes = BigEndian.shortToArray(b);
+    return pushTLV(a, 0x01, 2, bytes);
+  },
+
+  pushInt32: function (a: Uint8Array, b: number): Uint8Array {
+    const bytes = BigEndian.numberToArray(b);
+    return pushTLV(a, 0x01, 4, bytes);
+  },
+
+  pushHash: function (a: Uint8Array, b: Uint8Array): Uint8Array {
+    return pushTLV(a, 0x02, b.length, b);
+  },
+
+  pushSignature: function (a: Uint8Array, b: Uint8Array): Uint8Array {
+    return pushTLV(a, 0x03, b.length, b);
+  },
+
+  pushBytes: function (a: Uint8Array, b: Uint8Array): Uint8Array {
+    return pushTLV(a, 0x05, b.length, b);
+  },
+
+  pushNull: function (a: Uint8Array): Uint8Array {
+    return pushTLV(a, 0x00, 0, new Uint8Array(0));
+  },
+
+  pushPublicKey: function (a: Uint8Array, b: Uint8Array): Uint8Array {
+    return pushTLV(a, 0x06, b.length, b);
+  },
+
+  pushDerivationPath: function (a: Uint8Array, b: number[]): Uint8Array {
+    let bytes = new Uint8Array();
+    for (let i = 0; i < b.length; i++) {
+      bytes = push(bytes, BigEndian.numberToArray(b[i]));
+    }
+    return TLV.pushBytes(a, bytes);
+  },
+};

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "extends": "../../tsconfig.base",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "noImplicitAny": false,
+    "noImplicitThis": false,
+    "downlevelIteration": true,
+    "module": "commonjs",
+    "lib": ["es2020", "dom"],
+    "outDir": "lib"
+  },
+  "include": ["src/**/*"]
+}