Browse Source
Merge remote-tracking branch 'remotes/origin/develop' into bucky/sig-name
# Conflicts: # Gopkg.lock # keys/keybase_test.go # signature_test.gopull/1782/head
Liamsi
7 years ago
23 changed files with 694 additions and 217 deletions
Split View
Diff Options
-
+34 -0CHANGELOG.md
-
+25 -8Gopkg.lock
-
+4 -1Gopkg.toml
-
+2 -0amino.go
-
+4 -2encode_test.go
-
+125 -43keys/keybase.go
-
+90 -73keys/keybase_test.go
-
+5 -5keys/keys.go
-
+103 -21keys/types.go
-
+4 -0keys/wire.go
-
+19 -0ledger_common.go
-
+146 -0ledger_secp256k1.go
-
+65 -0ledger_test.go
-
+5 -8merkle/simple_map.go
-
+6 -6merkle/simple_map_test.go
-
+11 -3merkle/simple_proof.go
-
+13 -34priv_key.go
-
+5 -1priv_key_test.go
-
+8 -5pub_key.go
-
+4 -2pub_key_test.go
-
+6 -0signature.go
-
+9 -4signature_test.go
-
+1 -1version.go
+ 34
- 0
CHANGELOG.md
View File
+ 25
- 8
Gopkg.lock
View File
+ 4
- 1
Gopkg.toml
View File
+ 2
- 0
amino.go
View File
+ 4
- 2
encode_test.go
View File
+ 125
- 43
keys/keybase.go
View File
+ 90
- 73
keys/keybase_test.go
View File
+ 5
- 5
keys/keys.go
View File
+ 103
- 21
keys/types.go
View File
+ 4
- 0
keys/wire.go
View File
+ 19
- 0
ledger_common.go
View File
| @ -0,0 +1,19 @@ | |||
| package crypto | |||
| import ( | |||
| ledger "github.com/zondax/ledger-goclient" | |||
| ) | |||
| var device *ledger.Ledger | |||
| // Ledger derivation path | |||
| type DerivationPath = []uint32 | |||
| // getLedger gets a copy of the device, and caches it | |||
| func getLedger() (*ledger.Ledger, error) { | |||
| var err error | |||
| if device == nil { | |||
| device, err = ledger.FindLedger() | |||
| } | |||
| return device, err | |||
| } | |||
+ 146
- 0
ledger_secp256k1.go
View File
| @ -0,0 +1,146 @@ | |||
| package crypto | |||
| import ( | |||
| "fmt" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| ledger "github.com/zondax/ledger-goclient" | |||
| ) | |||
| func pubkeyLedgerSecp256k1(device *ledger.Ledger, path DerivationPath) (pub PubKey, err error) { | |||
| key, err := device.GetPublicKeySECP256K1(path) | |||
| if err != nil { | |||
| return nil, fmt.Errorf("error fetching public key: %v", err) | |||
| } | |||
| var p PubKeySecp256k1 | |||
| // Reserialize in the 33-byte compressed format | |||
| cmp, err := secp256k1.ParsePubKey(key[:], secp256k1.S256()) | |||
| copy(p[:], cmp.SerializeCompressed()) | |||
| pub = p | |||
| return | |||
| } | |||
| func signLedgerSecp256k1(device *ledger.Ledger, path DerivationPath, msg []byte) (sig Signature, err error) { | |||
| bsig, err := device.SignSECP256K1(path, msg) | |||
| if err != nil { | |||
| return sig, err | |||
| } | |||
| sig = SignatureSecp256k1FromBytes(bsig) | |||
| return | |||
| } | |||
| // PrivKeyLedgerSecp256k1 implements PrivKey, calling the ledger nano | |||
| // we cache the PubKey from the first call to use it later | |||
| type PrivKeyLedgerSecp256k1 struct { | |||
| // PubKey should be private, but we want to encode it via go-amino | |||
| // so we can view the address later, even without having the ledger | |||
| // attached | |||
| CachedPubKey PubKey | |||
| Path DerivationPath | |||
| } | |||
| // NewPrivKeyLedgerSecp256k1 will generate a new key and store the | |||
| // public key for later use. | |||
| func NewPrivKeyLedgerSecp256k1(path DerivationPath) (PrivKey, error) { | |||
| var pk PrivKeyLedgerSecp256k1 | |||
| pk.Path = path | |||
| // getPubKey will cache the pubkey for later use, | |||
| // this allows us to return an error early if the ledger | |||
| // is not plugged in | |||
| _, err := pk.getPubKey() | |||
| return &pk, err | |||
| } | |||
| // ValidateKey allows us to verify the sanity of a key | |||
| // after loading it from disk | |||
| func (pk PrivKeyLedgerSecp256k1) ValidateKey() error { | |||
| // getPubKey will return an error if the ledger is not | |||
| // properly set up... | |||
| pub, err := pk.forceGetPubKey() | |||
| if err != nil { | |||
| return err | |||
| } | |||
| // verify this matches cached address | |||
| if !pub.Equals(pk.CachedPubKey) { | |||
| return fmt.Errorf("cached key does not match retrieved key") | |||
| } | |||
| return nil | |||
| } | |||
| // AssertIsPrivKeyInner fulfils PrivKey Interface | |||
| func (pk *PrivKeyLedgerSecp256k1) AssertIsPrivKeyInner() {} | |||
| // Bytes fulfils PrivKey Interface - but it stores the cached pubkey so we can verify | |||
| // the same key when we reconnect to a ledger | |||
| func (pk PrivKeyLedgerSecp256k1) Bytes() []byte { | |||
| return cdc.MustMarshalBinaryBare(pk) | |||
| } | |||
| // Sign calls the ledger and stores the PubKey for future use | |||
| // | |||
| // Communication is checked on NewPrivKeyLedger and PrivKeyFromBytes, | |||
| // returning an error, so this should only trigger if the privkey is held | |||
| // in memory for a while before use. | |||
| func (pk PrivKeyLedgerSecp256k1) Sign(msg []byte) (Signature, error) { | |||
| dev, err := getLedger() | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| sig, err := signLedgerSecp256k1(dev, pk.Path, msg) | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| pub, err := pubkeyLedgerSecp256k1(dev, pk.Path) | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| // if we have no pubkey yet, store it for future queries | |||
| if pk.CachedPubKey == nil { | |||
| pk.CachedPubKey = pub | |||
| } else if !pk.CachedPubKey.Equals(pub) { | |||
| return nil, fmt.Errorf("stored key does not match signing key") | |||
| } | |||
| return sig, nil | |||
| } | |||
| // PubKey returns the stored PubKey | |||
| func (pk PrivKeyLedgerSecp256k1) PubKey() (PubKey, error) { | |||
| return pk.getPubKey() | |||
| } | |||
| // getPubKey reads the pubkey from cache or from the ledger itself | |||
| // since this involves IO, it may return an error, which is not exposed | |||
| // in the PubKey interface, so this function allows better error handling | |||
| func (pk PrivKeyLedgerSecp256k1) getPubKey() (key PubKey, err error) { | |||
| // if we have no pubkey, set it | |||
| if pk.CachedPubKey == nil { | |||
| pk.CachedPubKey, err = pk.forceGetPubKey() | |||
| } | |||
| return pk.CachedPubKey, err | |||
| } | |||
| // forceGetPubKey is like getPubKey but ignores any cached key | |||
| // and ensures we get it from the ledger itself. | |||
| func (pk PrivKeyLedgerSecp256k1) forceGetPubKey() (key PubKey, err error) { | |||
| dev, err := getLedger() | |||
| if err != nil { | |||
| return key, fmt.Errorf("cannot connect to Ledger device - error: %v", err) | |||
| } | |||
| key, err = pubkeyLedgerSecp256k1(dev, pk.Path) | |||
| if err != nil { | |||
| return key, fmt.Errorf("please open Cosmos app on the Ledger device - error: %v", err) | |||
| } | |||
| return key, err | |||
| } | |||
| // Equals fulfils PrivKey Interface - makes sure both keys refer to the | |||
| // same | |||
| func (pk PrivKeyLedgerSecp256k1) Equals(other PrivKey) bool { | |||
| if ledger, ok := other.(*PrivKeyLedgerSecp256k1); ok { | |||
| return pk.CachedPubKey.Equals(ledger.CachedPubKey) | |||
| } | |||
| return false | |||
| } | |||
+ 65
- 0
ledger_test.go
View File
| @ -0,0 +1,65 @@ | |||
| package crypto | |||
| import ( | |||
| "os" | |||
| "testing" | |||
| "github.com/stretchr/testify/assert" | |||
| "github.com/stretchr/testify/require" | |||
| ) | |||
| func TestRealLedgerSecp256k1(t *testing.T) { | |||
| if os.Getenv("WITH_LEDGER") == "" { | |||
| t.Skip("Set WITH_LEDGER to run code on real ledger") | |||
| } | |||
| msg := []byte("kuhehfeohg") | |||
| path := DerivationPath{44, 60, 0, 0, 0} | |||
| priv, err := NewPrivKeyLedgerSecp256k1(path) | |||
| require.Nil(t, err, "%+v", err) | |||
| pub, err := priv.PubKey() | |||
| require.Nil(t, err) | |||
| sig, err := priv.Sign(msg) | |||
| require.Nil(t, err) | |||
| valid := pub.VerifyBytes(msg, sig) | |||
| assert.True(t, valid) | |||
| // now, let's serialize the key and make sure it still works | |||
| bs := priv.Bytes() | |||
| priv2, err := PrivKeyFromBytes(bs) | |||
| require.Nil(t, err, "%+v", err) | |||
| // make sure we get the same pubkey when we load from disk | |||
| pub2, err := priv2.PubKey() | |||
| require.Nil(t, err) | |||
| require.Equal(t, pub, pub2) | |||
| // signing with the loaded key should match the original pubkey | |||
| sig, err = priv2.Sign(msg) | |||
| require.Nil(t, err) | |||
| valid = pub.VerifyBytes(msg, sig) | |||
| assert.True(t, valid) | |||
| // make sure pubkeys serialize properly as well | |||
| bs = pub.Bytes() | |||
| bpub, err := PubKeyFromBytes(bs) | |||
| require.NoError(t, err) | |||
| assert.Equal(t, pub, bpub) | |||
| } | |||
| // TestRealLedgerErrorHandling calls. These tests assume | |||
| // the ledger is not plugged in.... | |||
| func TestRealLedgerErrorHandling(t *testing.T) { | |||
| if os.Getenv("WITH_LEDGER") != "" { | |||
| t.Skip("Skipping on WITH_LEDGER as it tests unplugged cases") | |||
| } | |||
| // first, try to generate a key, must return an error | |||
| // (no panic) | |||
| path := DerivationPath{44, 60, 0, 0, 0} | |||
| _, err := NewPrivKeyLedgerSecp256k1(path) | |||
| require.Error(t, err) | |||
| } | |||
+ 5
- 8
merkle/simple_map.go
View File
+ 6
- 6
merkle/simple_map_test.go
View File
+ 11
- 3
merkle/simple_proof.go
View File
+ 13
- 34
priv_key.go
View File
+ 5
- 1
priv_key_test.go
View File
+ 8
- 5
pub_key.go
View File
+ 4
- 2
pub_key_test.go
View File
+ 6
- 0
signature.go
View File
+ 9
- 4
signature_test.go
View File
+ 1
- 1
version.go
View File
| @ -1,3 +1,3 @@ | |||
| package crypto | |||
| const Version = "0.6.2" | |||
| const Version = "0.8.0-dev" | |||