provared 0.1.0 → 0.3.0

package/src/timestamp.js

@@ -11,6 +11,7 @@
 
 import { TAG, badStamp, children, contentOf, ecdsaToRaw, expect, hexOf, readElement, timeOf, validateDer, wholeOf } from './der.js';
 import { Refusal, equalBytes, formatTime, sha256, toBase64url } from './encoding.js';
+import { weakEd25519 } from './keys.js';
 
 /** The largest time-stamp, in bytes. */
 export const MAX_STAMP_BYTES = 12288;
@@ -107,21 +108,53 @@ function readStatement(bytes) {
   return { hash, stamped, time, accuracySeconds, critical };
 }
 
-// The size of an RSA key in a certificate: 2,048 to 8,192 bits, with a
-// small public number, so that checking a signature cannot be made slow.
-function checkRsaKey(bytes, keyBits) {
-  const inner = bytes.subarray(keyBits.start + 1, keyBits.end);
-  const key = expect(readElement(inner, 0), TAG.SEQUENCE, 'an RSA key');
-  const [n, e] = children(inner, key, 2);
-  expect(n, TAG.INTEGER, 'an RSA key');
-  expect(e, TAG.INTEGER, 'an RSA key');
+// The public key of a certificate, written exactly as its standard sets
+// out, so that two checkers cannot disagree about whether it can be read:
+// RSA as RFC 3279 section 2.3.1 sets out (the method's parameters empty,
+// the key two positive whole numbers in strict DER, nothing after them);
+// ECDSA as RFC 5480 section 2.2 (an uncompressed point of the named
+// curve); Ed25519 as RFC 8410 section 4 (no parameters, 32 bytes). In each,
+// the string of bits has no unused bits.
+//
+// An RSA key is 2,048 to 8,192 bits, with an odd public number from 3 to
+// 2^32 - 1: a small number, so that checking a signature cannot be made
+// slow, and never 1, under which anyone can make a signature that checks.
+function checkKeyEncoding(bytes, certificate, method, size) {
+  const why = 'the public key of a certificate is not written as its standard sets out.';
+  const bits = certificate.keyBits;
+  if (bits.end - bits.start < 1 || bytes[bits.start] !== 0) throw badStamp(why);
+  const inner = bytes.subarray(bits.start + 1, bits.end);
+  const parameters = certificate.keyParameters;
+  if (method === 'ECDSA') {
+    if (inner.length !== 1 + 2 * size || inner[0] !== 0x04) throw badStamp(why);
+    return;
+  }
+  if (method === 'Ed25519') {
+    if (parameters !== null || inner.length !== 32) throw badStamp(why);
+    if (weakEd25519(inner)) throw invalid('A time-stamp was signed with an Ed25519 key under which anyone can sign, which is not accepted.');
+    return;
+  }
+  if (parameters === null || parameters.tag !== TAG.NULL) throw badStamp(why);
+  let n;
+  let e;
+  try {
+    const key = readElement(inner, 0);
+    if (key.tag !== TAG.SEQUENCE || key.end !== inner.length) throw new Error();
+    validateDer(inner, key);
+    const parts = children(inner, key, 3);
+    [n, e] = parts;
+    if (parts.length !== 2 || n.tag !== TAG.INTEGER || e.tag !== TAG.INTEGER || inner[n.start] & 0x80 || inner[e.start] & 0x80) throw new Error();
+  } catch {
+    throw badStamp(why);
+  }
   let modulus = contentOf(inner, n);
   if (modulus[0] === 0) modulus = modulus.subarray(1);
-  const bits = modulus.length === 0 ? 0 : (modulus.length - 1) * 8 + (32 - Math.clz32(modulus[0]));
+  const length = modulus.length === 0 ? 0 : (modulus.length - 1) * 8 + (32 - Math.clz32(modulus[0]));
   let exponent = contentOf(inner, e);
   if (exponent[0] === 0) exponent = exponent.subarray(1);
-  if (bits < 2048 || bits > 8192 || exponent.length === 0 || exponent.length > 4) {
-    throw invalid('A time-stamp was signed with an RSA key of a size that is not accepted.');
+  const odd = exponent.length > 0 && (exponent[exponent.length - 1] & 1) === 1;
+  if (length < 2048 || length > 8192 || exponent.length === 0 || exponent.length > 4 || !odd || (exponent.length === 1 && exponent[0] < 3)) {
+    throw invalid('A time-stamp was signed with an RSA key whose size or public number is not accepted.');
   }
 }
 
@@ -148,6 +181,7 @@ function readCertificate(bytes, element) {
     notAfter: timeOf(bytes, validity[1]),
     spki: wholeOf(bytes, keyInfo),
     keyOid: keyAlgorithm.oid,
+    keyParameters: keyAlgorithm.parameters ?? null,
     keyBits: expect(keyParts[1], TAG.BIT_STRING, 'the public key of a certificate'),
     curveOid: keyAlgorithm.parameters && keyAlgorithm.parameters.tag === TAG.OID ? hexOf(bytes, keyAlgorithm.parameters) : null,
   };
@@ -169,11 +203,14 @@ function signingCertificateOf(bytes, value, v2) {
   return { hash, value: contentOf(bytes, expect(first[at], TAG.OCTET_STRING, 'the signing certificate attribute')) };
 }
 
+const KIND_NOT_ACCEPTED = 'A time-stamp was signed with a kind of key that is not accepted: RSA, ECDSA on the curves P-256 and P-384, and Ed25519 are.';
+
 // Check the service's signature with the public key of its certificate.
 // Returns "valid", "invalid", or "unavailable" where this device has no
 // built-in support for the method. The fingerprint method is the one the
 // signer names (RFC 5652 section 5.4); a signing method that names another
-// is refused.
+// is refused; a key of a kind that is not accepted is refused in words that
+// say so.
 async function verifyWith(certificate, bytes, signatureOid, digestName, signature, signed, without) {
   const subtle = globalThis.crypto.subtle;
   let importParams;
@@ -182,13 +219,15 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
   let raw = signature;
   if (certificate.keyOid === OID.rsaEncryption) {
     if (signatureOid !== OID.rsaEncryption && RSA_WITH[signatureOid] !== digestName) return 'invalid';
-    checkRsaKey(bytes, certificate.keyBits);
+    checkKeyEncoding(bytes, certificate, 'RSA');
     method = 'RSA';
     importParams = { name: 'RSASSA-PKCS1-v1_5', hash: digestName };
     verifyParams = { name: 'RSASSA-PKCS1-v1_5' };
   } else if (certificate.keyOid === OID.ecPublicKey) {
     const curve = certificate.curveOid === OID.p256 ? ['P-256', 32] : certificate.curveOid === OID.p384 ? ['P-384', 48] : null;
-    if (ECDSA_WITH[signatureOid] !== digestName || !curve) return 'invalid';
+    if (!curve) throw invalid(KIND_NOT_ACCEPTED);
+    if (ECDSA_WITH[signatureOid] !== digestName) return 'invalid';
+    checkKeyEncoding(bytes, certificate, 'ECDSA', curve[1]);
     method = 'ECDSA';
     importParams = { name: 'ECDSA', namedCurve: curve[0] };
     verifyParams = { name: 'ECDSA', hash: digestName };
@@ -197,12 +236,14 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
     } catch {
       return 'invalid';
     }
-  } else if (certificate.keyOid === OID.ed25519 && signatureOid === OID.ed25519) {
+  } else if (certificate.keyOid === OID.ed25519) {
+    if (signatureOid !== OID.ed25519) return 'invalid';
+    checkKeyEncoding(bytes, certificate, 'Ed25519');
     method = 'Ed25519';
     importParams = { name: 'Ed25519' };
     verifyParams = { name: 'Ed25519' };
   } else {
-    return 'invalid';
+    throw invalid(KIND_NOT_ACCEPTED);
   }
   if (without.includes(method)) return 'unavailable';
   let key;
@@ -212,6 +253,8 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
     // A device with no Ed25519 says so when the key is loaded.
     return method === 'Ed25519' && e && e.name === 'NotSupportedError' ? 'unavailable' : 'invalid';
   }
+  // An Ed25519 signature whose first half is a point of small order is refused, as everywhere (format description, section 3.8).
+  if (method === 'Ed25519' && (raw.length !== 64 || weakEd25519(raw.subarray(0, 32)))) return 'invalid';
   try {
     return (await subtle.verify(verifyParams, key, raw, signed)) ? 'valid' : 'invalid';
   } catch {

package/src/tools.js

@@ -18,6 +18,11 @@ import * as f from './fields.js';
 /** How deep the arguments of a call may nest. */
 const MAX_ARGUMENT_DEPTH = 64;
 
+// Calling a generator function does not run its body, so its stub would be
+// written for an action not yet taken.
+const GENERATORS = new Set(['[object GeneratorFunction]', '[object AsyncGeneratorFunction]']);
+const NOT_A_GENERATOR = 'must not be a generator function: calling one does not run its body, so its stub would be written for an action not yet taken.';
+
 /**
  * A call through a recorded tool that was not run: the check before acting
  * did not allow it, or the record so far has a problem. "answer" is what
@@ -108,7 +113,7 @@ const needsOnlyApproval = (answer) => answer.problems.length === 0 && answer.bre
  * @param {object} recorder the stub writer (openRecorder)
  * @param {Record<string, object>} tools by name. For each tool:
  *   - "action": the action name the slip uses for what this tool does;
- *   - "run": the tool itself, a function of the arguments. It must not call the stub writer;
+ *   - "run": the tool itself, a function of the arguments, not a generator function. It must not call the stub writer;
  *   Each function is called by itself, without "this". "amount" and "with" must give their value at once, not a promise.
  *   - "with" (optional): the id of the service the tool deals with, as the slip names it, or a function of the arguments that gives it;
  *   - "amount" (optional): {unit, value}, or a function of the arguments that gives it;
@@ -143,6 +148,7 @@ export function recordTools(recorder, tools, options = {}) {
     // Each member is read once: what is checked is what is fixed.
     const fixed = { action: spec.action, run: spec.run, details: spec.details, countersign: spec.countersign, approve: spec.approve, amount: spec.amount, with: spec.with };
     if (typeof fixed.run !== 'function') throw f.fail(`tools.${name}.run`, 'must be a function.');
+    if (GENERATORS.has(Object.prototype.toString.call(fixed.run))) throw f.fail(`tools.${name}.run`, NOT_A_GENERATOR);
     f.actionName(fixed.action, `tools.${name}.action`);
     for (const member of ['countersign', 'approve']) {
       if (fixed[member] !== undefined && typeof fixed[member] !== 'function') throw f.fail(`tools.${name}.${member}`, 'must be a function.');