120 lines
4.3 KiB
Python
120 lines
4.3 KiB
Python
"""TREZOR support for Ed25519 signify/minisign signatures."""
|
|
|
|
import argparse
|
|
import binascii
|
|
import hashlib
|
|
import logging
|
|
import sys
|
|
import time
|
|
|
|
from .. import util
|
|
from ..device import interface, ui
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
def _create_identity(user_id):
|
|
result = interface.Identity(identity_str='signify://', curve_name='ed25519')
|
|
result.identity_dict['host'] = user_id
|
|
return result
|
|
|
|
|
|
class Client:
|
|
"""Sign messages and get public keys from a hardware device."""
|
|
|
|
def __init__(self, device):
|
|
"""C-tor."""
|
|
self.device = device
|
|
|
|
def pubkey(self, identity):
|
|
"""Return public key as VerifyingKey object."""
|
|
with self.device:
|
|
return bytes(self.device.pubkey(ecdh=False, identity=identity))
|
|
|
|
def sign_with_pubkey(self, identity, data):
|
|
"""Sign the data and return a signature."""
|
|
log.info('please confirm Signify signature on %s for "%s"...',
|
|
self.device, identity.to_string())
|
|
log.debug('signing data: %s', util.hexlify(data))
|
|
with self.device:
|
|
sig, pubkey = self.device.sign_with_pubkey(blob=data, identity=identity)
|
|
assert len(sig) == 64
|
|
assert len(pubkey) == 33
|
|
assert pubkey[:1] == b"\x00"
|
|
return sig, pubkey[1:]
|
|
|
|
|
|
ALG_SIGNIFY = b'Ed'
|
|
ALG_MINISIGN = b'ED' # prehashes the data before signing
|
|
|
|
|
|
def format_payload(pubkey, data, sig_alg):
|
|
"""See http://www.openbsd.org/papers/bsdcan-signify.html for details."""
|
|
keynum = hashlib.sha256(pubkey).digest()[:8]
|
|
return binascii.b2a_base64(sig_alg + keynum + data).decode("ascii")
|
|
|
|
|
|
def run_pubkey(device_type, args):
|
|
"""Export hardware-based Signify public key."""
|
|
util.setup_logging(verbosity=args.verbose)
|
|
log.warning('This Signify tool is still in EXPERIMENTAL mode, '
|
|
'so please note that the key derivation, API, and features '
|
|
'may change without backwards compatibility!')
|
|
|
|
identity = _create_identity(user_id=args.user_id)
|
|
pubkey = Client(device=device_type()).pubkey(identity=identity)
|
|
comment = f'untrusted comment: identity {identity.to_string()}\n'
|
|
payload = format_payload(pubkey=pubkey, data=pubkey, sig_alg=ALG_SIGNIFY)
|
|
print(comment + payload, end="")
|
|
|
|
|
|
def run_sign(device_type, args):
|
|
"""Prehash & sign an input blob using Ed25519."""
|
|
util.setup_logging(verbosity=args.verbose)
|
|
identity = _create_identity(user_id=args.user_id)
|
|
|
|
data_to_sign = sys.stdin.buffer.read()
|
|
sig_alg = ALG_SIGNIFY
|
|
if args.prehash:
|
|
# See https://github.com/jedisct1/minisign/commit/6e1023d20758b6fdb2a4b697213b0bf608ba4020
|
|
# Released in https://github.com/jedisct1/minisign/releases/tag/0.6
|
|
sig_alg = ALG_MINISIGN
|
|
data_to_sign = hashlib.blake2b(data_to_sign).digest()
|
|
|
|
sig, pubkey = Client(device=device_type()).sign_with_pubkey(identity, data_to_sign)
|
|
pubkey_str = format_payload(pubkey=pubkey, data=pubkey, sig_alg=sig_alg)
|
|
sig_str = format_payload(pubkey=pubkey, data=sig, sig_alg=sig_alg)
|
|
untrusted_comment = f'untrusted comment: pubkey {pubkey_str}'
|
|
print(untrusted_comment + sig_str, end="")
|
|
|
|
comment_to_sign = sig + args.comment.encode()
|
|
sig, _ = Client(device=device_type()).sign_with_pubkey(identity, comment_to_sign)
|
|
sig_str = binascii.b2a_base64(sig).decode("ascii")
|
|
print(f'trusted comment: {args.comment}\n' + sig_str, end="")
|
|
|
|
|
|
def main(device_type):
|
|
"""Parse command-line arguments."""
|
|
parser = argparse.ArgumentParser()
|
|
|
|
subparsers = parser.add_subparsers(title='Action', dest='action')
|
|
subparsers.required = True
|
|
|
|
p = subparsers.add_parser('pubkey')
|
|
p.add_argument('user_id')
|
|
p.add_argument('-v', '--verbose', default=0, action='count')
|
|
p.set_defaults(func=run_pubkey)
|
|
|
|
p = subparsers.add_parser('sign')
|
|
p.add_argument('user_id')
|
|
p.add_argument('-v', '--verbose', default=0, action='count')
|
|
p.add_argument('-c', '--comment', default=time.asctime())
|
|
p.add_argument('-H', '--prehash', default=False, action='store_true')
|
|
p.set_defaults(func=run_sign)
|
|
|
|
args = parser.parse_args()
|
|
device_type.ui = ui.UI(device_type=device_type, config=vars(args))
|
|
device_type.ui.cached_passphrase_ack = util.ExpiringCache(seconds=float(60))
|
|
|
|
return args.func(device_type=device_type, args=args)
|