keylet 0.4.0__tar.gz → 0.6.0__tar.gz

{keylet-0.4.0 → keylet-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keylet
-Version: 0.4.0
+Version: 0.6.0
 Summary: Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer
 Keywords: ML-DSA,TKey,Tillitis,PQC,sign,signer
 Author: Jussi Kukkonen
@@ -54,7 +54,7 @@ $ keylet verify --pubkey pub.key README.md
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 186bcf6 sign README.md
+$ keylet --passphrase hunter2 --digest 2cd8741 sign README.md
 
 ```
 
@@ -86,7 +86,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See the [API Reference](https://jku.github.io/keylet/api/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.
 
 ## Development
 

{keylet-0.4.0 → keylet-0.6.0}/README.md

@@ -36,7 +36,7 @@ $ keylet verify --pubkey pub.key README.md
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 186bcf6 sign README.md
+$ keylet --passphrase hunter2 --digest 2cd8741 sign README.md
 
 ```
 
@@ -68,7 +68,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See the [API Reference](https://jku.github.io/keylet/api/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.
 
 ## Development
 

{keylet-0.4.0 → keylet-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keylet"
-version = "0.4.0"
+version = "0.6.0"
 description = "Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer"
 readme = "README.md"
 authors = [
@@ -61,6 +61,7 @@ ignore = [
 "tests/**" = [
     "S101",   # assert is ok in tests
     "S105",   # hardcoded password is ok in tests
+    "SLF001", # Private member access is ok in tests
     "ARG002", # Unused method argument (common with mocks)
 ]
 

{keylet-0.4.0 → keylet-0.6.0}/src/keylet/tkey.py

@@ -150,10 +150,7 @@ class TKey:
     * [Framing protocol](https://dev.tillitis.se/protocol/#framing-protocol)
     """
 
-    def __init__(
-        self,
-        device: str | None,
-    ) -> None:
+    def __init__(self, device: str | None) -> None:
         """Initialize serial connection to TKey device.
 
         Args:

{keylet-0.4.0 → keylet-0.6.0}/src/keylet/tkey_sign.py

@@ -15,17 +15,18 @@ from keylet.tkey import Cmd, LenIdx, Rsp, TKey, TKeyError, TKeyUnexpectedAppErro
 logger = logging.getLogger(__name__)
 
 MU_SIZE = (64).to_bytes(4, byteorder="little")
-
+MAX_PAYLOAD_SIZE = 4096
 
 # Static registry of signer binaries (filename, version)
 # First binary in each list is the default binary.
 _EMBEDDED_MLDSA_BINS: list[tuple[str, int]] = [
     ("pqsigner_v3.bin", 3),
 ]
-
 _EMBEDDED_ED25519_BINS: list[tuple[str, int]] = [
     ("ed25519signer_v3.bin", 3),
 ]
+_MLDSA_APP_NAME = ("tk1", "pqsn")
+_ED25519_APP_NAME = ("tk1", "sign")
 
 
 @dataclass
@@ -48,8 +49,8 @@ class SignApp:
 
     @property
     def digest(self) -> str:
-        """Return the BLAKE2s-256 hex digest of the application binary."""
-        return hashlib.blake2s(self.binary, digest_size=32).hexdigest()
+        """Return the SHA-512 hex digest of the application binary."""
+        return hashlib.sha512(self.binary).hexdigest()
 
     @classmethod
     def _find_binary(
@@ -65,7 +66,7 @@ class SignApp:
                 continue
 
             binary = resources_dir.joinpath(filename).read_bytes()
-            file_digest = hashlib.blake2s(binary, digest_size=32).hexdigest()
+            file_digest = hashlib.sha512(binary).hexdigest()
 
             # Filter by digest if requested
             if digest is not None and not file_digest.startswith(digest.lower()):
@@ -105,7 +106,7 @@ class SignApp:
 
         Args:
             version: The version of the signer application to load.
-            digest: A BLAKE2s-256 hex digest (or prefix) of the target binary.
+            digest: A SHA-512 hex digest (or prefix) of the target binary.
 
         Returns:
             An instance of SignApp configured with the loaded binary.
@@ -116,7 +117,7 @@ class SignApp:
         """
 
         binary, version = cls._find_binary(version, digest, _EMBEDDED_MLDSA_BINS)
-        return cls(binary, version, ("tk1", "pqsn"), 2420, 1312)
+        return cls(binary, version, _MLDSA_APP_NAME, 2420, 1312)
 
     @classmethod
     def load_ed25519(
@@ -132,11 +133,11 @@ class SignApp:
         specific key must provide the binary digest.
 
         Warning:
-            When Ed25519 is used, there is a 4096K size limit to signing payloads.
+            When Ed25519 is used, there is a 4096B size limit to signing payloads.
 
         Args:
             version: The version of the signer application to load.
-            digest: A BLAKE2s-256 hex digest (or prefix) of the target binary.
+            digest: A SHA-512 hex digest (or prefix) of the target binary.
 
         Returns:
             An instance of SignApp configured with the loaded binary.
@@ -146,7 +147,7 @@ class SignApp:
                 is ambiguous (matches multiple binaries).
         """
         binary, version = cls._find_binary(version, digest, _EMBEDDED_ED25519_BINS)
-        return cls(binary, version, ("tk1", "sign"), 64, 32)
+        return cls(binary, version, _ED25519_APP_NAME, 64, 32)
 
 
 class SignRsp:
@@ -269,7 +270,7 @@ class TKeySign(TKey):
 
         Args:
             message: The raw bytes of the message/payload to sign. When Ed25519 keys
-                are used, there is a max message size of 4096K. This limitation does
+                are used, there is a max message size of 4096B. This limitation does
                 not apply to ML-DSA as FIPS 204 external mu is used.
             pub_key: The public key bytes (only needed for ML-DSA). If not provided,
                 key is retrieved from device.
@@ -282,8 +283,7 @@ class TKeySign(TKey):
             TKeyIOError: If writing or reading from the serial port fails.
             TKeyProtocolError: If there is a framing or protocol mismatch.
         """
-        # pqsn = ML-DSA signer, pqnt = no-touch ML-DSA test signer
-        if self.name in [("tk1", "pqsn"), ("tk1", "pqnt")]:
+        if self.name == _MLDSA_APP_NAME:
             # Compute FIPS 204 external mu
             if pub_key is None:
                 pub_key = self.get_pubkey()
@@ -293,8 +293,8 @@ class TKeySign(TKey):
             payload = message
 
         # Set size
-        if len(payload) > 4096:
-            raise ValueError(f"Payload too large {len(payload)} > 4096]")
+        if len(payload) > MAX_PAYLOAD_SIZE:
+            raise ValueError(f"Payload too large {len(payload)} > {MAX_PAYLOAD_SIZE}]")
         self.send(SignCmd.SET_SIZE, len(payload).to_bytes(4, byteorder="little"))
 
         # Load data in chunks