jacobpascual/trezor-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow prehashing for Minisign support

Browse Source 
See https://github.com/jedisct1/minisign
This commit is contained in:
Roman Zeyde
2023-01-27 11:53:06 +02:00
parent acd52cd771
commit 54e7ffb6a5
1 changed files with 31 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
libagent/signify/__init__.py
View File

@@ -1,4 +1,4 @@
"""TREZOR support for Ed25519 signify signatures.""" """TREZOR support for Ed25519 signify/minisign signatures."""
import argparse import argparse
import binascii import binascii
@@ -53,10 +53,14 @@ class Client:
return sig, pubkey[1:] return sig, pubkey[1:]
def format_payload(pubkey, data): ALG_SIGNIFY = b'Ed'
ALG_MINISIGN = b'ED' # prehashes the data before signing
def format_payload(pubkey, data, sig_alg):
"""See http://www.openbsd.org/papers/bsdcan-signify.html for details.""" """See http://www.openbsd.org/papers/bsdcan-signify.html for details."""
keynum = hashlib.sha256(pubkey).digest()[:8] keynum = hashlib.sha256(pubkey).digest()[:8]
return binascii.b2a_base64(b"Ed" + keynum + data).decode("ascii") return binascii.b2a_base64(sig_alg + keynum + data).decode("ascii")
def run_pubkey(device_type, args): def run_pubkey(device_type, args):
@@ -69,20 +73,33 @@ def run_pubkey(device_type, args):
identity = _create_identity(user_id=args.user_id) identity = _create_identity(user_id=args.user_id)
pubkey = Client(device=device_type()).pubkey(identity=identity) pubkey = Client(device=device_type()).pubkey(identity=identity)
comment = f'untrusted comment: identity {identity.to_string()}\n' comment = f'untrusted comment: identity {identity.to_string()}\n'
result = comment + format_payload(pubkey=pubkey, data=pubkey) payload = format_payload(pubkey=pubkey, data=pubkey, sig_alg=ALG_SIGNIFY)
print(result, end="") print(comment + payload, end="")
def run_sign(device_type, args): def run_sign(device_type, args):
"""Sign an input blob using Ed25519.""" """Prehash & sign an input blob using Ed25519."""
util.setup_logging(verbosity=args.verbose) util.setup_logging(verbosity=args.verbose)
identity = _create_identity(user_id=args.user_id) identity = _create_identity(user_id=args.user_id)
data = sys.stdin.buffer.read()
sig, pubkey = Client(device=device_type()).sign_with_pubkey(identity, data) data_to_sign = sys.stdin.buffer.read()
pubkey_str = format_payload(pubkey=pubkey, data=pubkey) sig_alg = ALG_SIGNIFY
comment = f'untrusted comment: pubkey {pubkey_str}' if args.prehash:
result = comment + format_payload(pubkey=pubkey, data=sig) # See https://github.com/jedisct1/minisign/commit/6e1023d20758b6fdb2a4b697213b0bf608ba4020
print(result, end="") # Released in https://github.com/jedisct1/minisign/releases/tag/0.6
sig_alg = ALG_MINISIGN
data_to_sign = hashlib.blake2b(data_to_sign).digest()
sig, pubkey = Client(device=device_type()).sign_with_pubkey(identity, data_to_sign)
pubkey_str = format_payload(pubkey=pubkey, data=pubkey, sig_alg=sig_alg)
sig_str = format_payload(pubkey=pubkey, data=sig, sig_alg=sig_alg)
untrusted_comment = f'untrusted comment: pubkey {pubkey_str}'
print(untrusted_comment + sig_str, end="")
comment_to_sign = sig + args.comment.encode()
sig, _ = Client(device=device_type()).sign_with_pubkey(identity, comment_to_sign)
sig_str = binascii.b2a_base64(sig).decode("ascii")
print(f'trusted comment: {args.comment}\n' + sig_str, end="")
def main(device_type): def main(device_type):
@@ -100,6 +117,8 @@ def main(device_type):
p = subparsers.add_parser('sign') p = subparsers.add_parser('sign')
p.add_argument('user_id') p.add_argument('user_id')
p.add_argument('-v', '--verbose', default=0, action='count') p.add_argument('-v', '--verbose', default=0, action='count')
p.add_argument('-c', '--comment', default=time.asctime())
p.add_argument('-H', '--prehash', default=False, action='store_true')
p.set_defaults(func=run_sign) p.set_defaults(func=run_sign)
args = parser.parse_args() args = parser.parse_args()