update: improve CA key format

- Save with 0400 perms so PTTH won't accidentally serve them
- Save D-Bus machine ID if possible to detect when keys accidentally change machines
- Add random schema version
main
_ 2021-01-19 17:59:49 -06:00
parent d7ed2ed931
commit b0b6c5672c
4 changed files with 32 additions and 1 deletions

View File

@ -1,5 +1,6 @@
#include "signing_key.h" #include "signing_key.h"
#include <filesystem>
#include <fstream> #include <fstream>
#include "json.hpp" #include "json.hpp"
@ -8,12 +9,28 @@
namespace BareMinimumCrypto { namespace BareMinimumCrypto {
using nlohmann::json; using nlohmann::json;
namespace fs = std::filesystem;
string get_machine_id () {
ifstream f;
f.open ("/etc/machine-id", ifstream::binary);
string machine_id;
if (! f.is_open ()) {
return machine_id;
}
f >> machine_id;
return machine_id;
}
vector <uint8_t> SigningKeyFile::to_msgpack () const { vector <uint8_t> SigningKeyFile::to_msgpack () const {
const auto j = json { const auto j = json {
// Breaking changes should generate a new Base32 schema.
{"schema", "3T6XF5DZ"},
{"salt", json::binary (salt)}, {"salt", json::binary (salt)},
{"time_created", time_created.x}, {"time_created", time_created.x},
{"pubkey", json::binary (pubkey)}, {"pubkey", json::binary (pubkey)},
{"machine_id", machine_id},
}; };
return json::to_msgpack (j); return json::to_msgpack (j);
} }
@ -55,10 +72,13 @@ namespace BareMinimumCrypto {
return nullopt; return nullopt;
} }
const auto machine_id = get_machine_id ();
SigningKeyFile key_on_disk { SigningKeyFile key_on_disk {
salt, salt,
Instant::now (), Instant::now (),
key.pk key.pk,
machine_id,
}; };
const auto msg = key_on_disk.to_msgpack (); const auto msg = key_on_disk.to_msgpack ();
@ -67,6 +87,10 @@ namespace BareMinimumCrypto {
if (! f.is_open ()) { if (! f.is_open ()) {
return nullopt; return nullopt;
} }
fs::permissions (file_path,
fs::perms::owner_read,
fs::perm_options::replace
);
f.write ((const char *)msg.data (), msg.size ()); f.write ((const char *)msg.data (), msg.size ());
f.close (); f.close ();

View File

@ -11,10 +11,13 @@
namespace BareMinimumCrypto { namespace BareMinimumCrypto {
using namespace std; using namespace std;
string get_machine_id ();
struct SigningKeyFile { struct SigningKeyFile {
vector <uint8_t> salt; vector <uint8_t> salt;
Instant time_created; Instant time_created;
vector <uint8_t> pubkey; vector <uint8_t> pubkey;
string machine_id;
vector <uint8_t> to_msgpack () const; vector <uint8_t> to_msgpack () const;
static optional <SigningKeyFile> try_from_msgpack (const vector <uint8_t> & msg); static optional <SigningKeyFile> try_from_msgpack (const vector <uint8_t> & msg);

View File

@ -0,0 +1,3 @@
- 3T6XF5DZ
3T6XF5DZ is a secret key protected by a passphrase.

View File

@ -1 +1,2 @@
- Use libsodium's secure memory when handling keys / seeds / passphrases - Use libsodium's secure memory when handling keys / seeds / passphrases
- Test on Windows (machine_id won't work)