guillm/reticulum-zero
guillm/reticulum-zero
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactored the missing X25519 functions to use keypairs, consume seed buffers once they have been used (fill with zeroes), fixed the remaining compilation issues with identity.zig

Browse source
This commit is contained in:
Gu://em_ 2026-07-29 18:47:40 +02:00
parent 69bad53a03
commit d7139c6ce8
3 changed files with 16 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/crypto/ed25519.zig
View file

@ -25,7 +25,7 @@ pub const Implementation = struct {
pub fn generateKeys (destination: *KeyPair, rng: rngProvider) !void {
var seed_buffer: [KeyPair.seed_length]u8 = undefined;
defer secureZero(@TypeOf(seed_buffer), seed_buffer);
defer secureZero(u8, &seed_buffer);
rng.generate(&seed_buffer);
destination.* = KeyPair.generateDeterministic(seed_buffer) catch return CryptoError.FailedKeyGeneration;
}

14
src/crypto/x25519.zig
View file

@ -3,6 +3,7 @@ const CryptoError = @import("../crypto.zig").CryptoError;
// Constants and default implementation
const X25519 = @import("std").crypto.dh.X25519;
const Ed25519 = @import("std").crypto.sign.Ed25519;
const secureZero = @import("std").crypto.secureZero;
// Random number generation
const rngProvider = @import("random.zig").Implementation;
@ -15,21 +16,16 @@ pub const seed_length: comptime_int = X25519.seed_length;
pub const Implementation = struct {
generateKeys: *const fn (pubkey_buffer: ?*[public_key_length]u8, privkey_buffer: *[secret_key_length]u8, rng: rngProvider) CryptoError!void,
generateKeys: *const fn (destination: *KeyPair, rng: rngProvider) CryptoError!void,
fromEd25519: *const fn (ed25519_keypair: *Ed25519.KeyPair, x25519_keypair: *KeyPair) CryptoError!void,
// TODO
// Switch to a Keypair system based on the stdlib implementation
// generateKeys: *const fn (keypair: *X25519.KeyPair, rng: rngProvider) CryptoError!void,
};
fn generateKeys (pubkey_buffer: ?*[public_key_length]u8, privkey_buffer: *[secret_key_length]u8, rng: rngProvider) !void {
fn generateKeys (destination: *KeyPair, rng: rngProvider) !void {
var seed_buffer: [seed_length]u8 = undefined;
defer secureZero(u8, &seed_buffer);
rng.generate(&seed_buffer);
const keypair: X25519.KeyPair = X25519.KeyPair.generateDeterministic(seed_buffer) catch return CryptoError.FailedKeyGeneration;
if (pubkey_buffer != null) @memcpy(pubkey_buffer.?[0..public_key_length], &keypair.public_key);
@memcpy(privkey_buffer[0..secret_key_length], &keypair.secret_key);
destination.* = X25519.KeyPair.generateDeterministic(seed_buffer) catch return CryptoError.FailedKeyGeneration;
}
fn fromEd25519 (ed25519_keypair: *Ed25519.KeyPair, x25519_keypair: *KeyPair) CryptoError!void {

17
src/identity.zig
View file

@ -36,15 +36,15 @@ pub fn resolveIdentity(comptime crypto_engine: Crypto.Engine) type {
}
pub fn generate(self: *Self) !void {
crypto_engine.ed25519.generateKeys(self.keys, crypto_engine.random);
crypto_engine.x25519.fromEd25519(self.keys, self.signatureKeys, crypto_engine.random);
try crypto_engine.ed25519.generateKeys(&self.keys, crypto_engine.random);
try crypto_engine.x25519.fromEd25519(&self.keys, &self.signatureKeys);
self.update_hash();
}
pub fn update_hash(self: *Self) void {
//WARNING PUBLIC KEY SHOULD BE TRUNCATED
// We should define the truncated hash length somewhere
crypto_engine.sha256.hash(self.keys.public_key, self.hash);
crypto_engine.sha256.hash(&self.keys.public_key.bytes, &self.hash);
}
};
}
@ -88,17 +88,20 @@ test "Basic identity generation" {
.sign = undefined,
.verify = undefined,
};
const crypto_engine = Crypto.resolveEngine(.{
const crypto_engine = comptime Crypto.resolveEngine(.{
.random = fake_rng,
.ed25519 = fake_ed25519,
});
const Identity = resolveIdentity(crypto_engine);
const new_id: Identity = undefined;
var new_id: Identity = undefined;
try new_id.generate();
try expect(memeql(u8, new_id.privKey, testPattern));
try expect(memeql(u8, new_id.signatureKey, testPattern));
const expected_secret_key = [_]u8{testPattern} ** new_id.keys.secret_key.bytes.len;
// const expected_signature_key = [_]u8{testPattern} ** new_id.signatureKeys.secret_key.len;
try expect(memeql(u8, &new_id.keys.secret_key.bytes, &expected_secret_key));
// try expect(memeql(u8, &new_id.signatureKeys.secret_key, &expected_signature_key));
// try expect(memeql(u8, new_id.hash, testPattern));
}