dsutanto/BackOne
1
0 Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity
Files
86c744897be94a5d579ded865a3f6c6bf71da4f3
BackOne/node/Identity.cpp
T
dedysutanto 86c744897b feat(pqc): identity/COM v2, pqcMode config, selftest gates 
Phases 3-6 (SPEC T19-T23): type-1 identity carries ML-KEM-768 + ML-DSA-65 pubs, COM type-2 double-sign, HELLO capability bit, local.conf settings.pqcMode (off/hybrid/pqconly) with classic fallback. selftest KAT + interop matrix + fragment-loss benchmark green.
2026-10-01 15:55:09 +07:00

347 lines
9.7 KiB
C++
Raw Blame History

/*
* Copyright (c)2019 ZeroTier, Inc.
*
* Use of this software is governed by the Business Source License included
* in the LICENSE.TXT file in the project's root directory.
*
* Change Date: 2026-01-01
*
* On the date above, in accordance with the Business Source License, use
* of this software will be governed by version 2.0 of the Apache License.
*/
/****/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include "Constants.hpp"
#include "Identity.hpp"
#include "SHA512.hpp"
#include "Salsa20.hpp"
#include "Utils.hpp"
// These can't be changed without a new identity type. They define the
// parameters of the hashcash hashing/searching algorithm.
#define ZT_IDENTITY_GEN_HASHCASH_FIRST_BYTE_LESS_THAN 17
#define ZT_IDENTITY_GEN_MEMORY 2097152
namespace ZeroTier {
// A memory-hard composition of SHA-512 and Salsa20 for hashcash hashing
static inline void _computeMemoryHardHash(const void *publicKey,unsigned int publicKeyBytes,void *digest,void *genmem)
{
// Digest publicKey[] to obtain initial digest
SHA512(digest,publicKey,publicKeyBytes);
// Initialize genmem[] using Salsa20 in a CBC-like configuration since
// ordinary Salsa20 is randomly seek-able. This is good for a cipher
// but is not what we want for sequential memory-hardness.
memset(genmem,0,ZT_IDENTITY_GEN_MEMORY);
Salsa20 s20(digest,(char *)digest + 32);
s20.crypt20((char *)genmem,(char *)genmem,64);
for(unsigned long i=64;i<ZT_IDENTITY_GEN_MEMORY;i+=64) {
unsigned long k = i - 64;
*((uint64_t *)((char *)genmem + i)) = *((uint64_t *)((char *)genmem + k));
*((uint64_t *)((char *)genmem + i + 8)) = *((uint64_t *)((char *)genmem + k + 8));
*((uint64_t *)((char *)genmem + i + 16)) = *((uint64_t *)((char *)genmem + k + 16));
*((uint64_t *)((char *)genmem + i + 24)) = *((uint64_t *)((char *)genmem + k + 24));
*((uint64_t *)((char *)genmem + i + 32)) = *((uint64_t *)((char *)genmem + k + 32));
*((uint64_t *)((char *)genmem + i + 40)) = *((uint64_t *)((char *)genmem + k + 40));
*((uint64_t *)((char *)genmem + i + 48)) = *((uint64_t *)((char *)genmem + k + 48));
*((uint64_t *)((char *)genmem + i + 56)) = *((uint64_t *)((char *)genmem + k + 56));
s20.crypt20((char *)genmem + i,(char *)genmem + i,64);
}
// Render final digest using genmem as a lookup table
for(unsigned long i=0;i<(ZT_IDENTITY_GEN_MEMORY / sizeof(uint64_t));) {
unsigned long idx1 = (unsigned long)(Utils::ntoh(((uint64_t *)genmem)[i++]) % (64 / sizeof(uint64_t)));
unsigned long idx2 = (unsigned long)(Utils::ntoh(((uint64_t *)genmem)[i++]) % (ZT_IDENTITY_GEN_MEMORY / sizeof(uint64_t)));
uint64_t tmp = ((uint64_t *)genmem)[idx2];
((uint64_t *)genmem)[idx2] = ((uint64_t *)digest)[idx1];
((uint64_t *)digest)[idx1] = tmp;
s20.crypt20(digest,digest,64);
}
}
// Hashcash generation halting condition -- halt when first byte is less than
// threshold value.
struct _Identity_generate_cond
{
_Identity_generate_cond() {}
_Identity_generate_cond(unsigned char *sb,char *gm) : digest(sb),genmem(gm) {}
inline bool operator()(const C25519::Pair &kp) const
{
_computeMemoryHardHash(kp.pub.data,ZT_C25519_PUBLIC_KEY_LEN,digest,genmem);
return (digest[0] < ZT_IDENTITY_GEN_HASHCASH_FIRST_BYTE_LESS_THAN);
}
unsigned char *digest;
char *genmem;
};
void Identity::generate(bool pq, int pqcMode)
{
unsigned char digest[64];
char *genmem = new char[ZT_IDENTITY_GEN_MEMORY];
C25519::Pair kp;
do {
kp = C25519::generateSatisfying(_Identity_generate_cond(digest,genmem));
_address.setTo(digest + 59,ZT_ADDRESS_LENGTH); // last 5 bytes are address
} while (_address.isReserved());
_publicKey = kp.pub;
if (!_privateKey) {
_privateKey = new C25519::Private();
}
*_privateKey = kp.priv;
delete [] genmem;
// V12: mode off never carries v2 material; pqconly always does.
// Hybrid leaves it to the caller (daemon passes a mode-derived flag once
// Node::pqcMode is plumbed) so bare generate() stays classic.
if (pqcMode == ZT_PQC_MODE_CLASSIC) {
pq = false;
}
else if (pqcMode == ZT_PQC_MODE_PQCONLY) {
pq = true;
}
// Identity type 1: ML-KEM-768 key exchange + ML-DSA-65 signature key pairs.
// Address derivation stays over the C25519 material only (V10).
if (pq) {
if (! _pq) {
_pq = new PQKeys();
}
if ((! PQHybrid::generateKeypair(_pq->mlkemPk, _pq->mlkemSk)) || (! PQHybrid::generateSigKeypair(_pq->mldsaPk, _pq->mldsaSk))) {
Utils::burn(_pq, sizeof(PQKeys));
delete _pq;
_pq = (PQKeys*)0;
}
}
}
bool Identity::locallyValidate() const
{
if (_address.isReserved()) {
return false;
}
unsigned char digest[64];
char *genmem = new char[ZT_IDENTITY_GEN_MEMORY];
_computeMemoryHardHash(_publicKey.data,ZT_C25519_PUBLIC_KEY_LEN,digest,genmem);
delete [] genmem;
unsigned char addrb[5];
_address.copyTo(addrb,5);
return (
(digest[0] < ZT_IDENTITY_GEN_HASHCASH_FIRST_BYTE_LESS_THAN)&&
(digest[59] == addrb[0])&&
(digest[60] == addrb[1])&&
(digest[61] == addrb[2])&&
(digest[62] == addrb[3])&&
(digest[63] == addrb[4]));
}
char *Identity::toString(bool includePrivate,char buf[ZT_IDENTITY_STRING_BUFFER_LENGTH]) const
{
char *p = buf;
Utils::hex10(_address.toInt(),p);
p += 10;
*(p++) = ':';
*(p++) = (_pq) ? '1' : '0';
*(p++) = ':';
Utils::hex(_publicKey.data,ZT_C25519_PUBLIC_KEY_LEN,p);
p += ZT_C25519_PUBLIC_KEY_LEN * 2;
if ((_privateKey)&&(includePrivate)) {
*(p++) = ':';
Utils::hex(_privateKey->data,ZT_C25519_PRIVATE_KEY_LEN,p);
p += ZT_C25519_PRIVATE_KEY_LEN * 2;
}
// Type 1 appends the public ML-KEM-768 + ML-DSA-65 keys, and, when the
// private key is included, their private halves after it.
if (_pq) {
if ((_privateKey) && (includePrivate)) {
*(p++) = ':';
Utils::hex(_pq->mlkemPk, PQHybrid::MLKEM768_PK_LEN, p);
p += PQHybrid::MLKEM768_PK_LEN * 2;
*(p++) = ':';
Utils::hex(_pq->mlkemSk, PQHybrid::MLKEM768_SK_LEN, p);
p += PQHybrid::MLKEM768_SK_LEN * 2;
*(p++) = ':';
Utils::hex(_pq->mldsaPk, PQHybrid::MLDSA65_PK_LEN, p);
p += PQHybrid::MLDSA65_PK_LEN * 2;
*(p++) = ':';
Utils::hex(_pq->mldsaSk, PQHybrid::MLDSA65_SK_LEN, p);
p += PQHybrid::MLDSA65_SK_LEN * 2;
}
else {
*(p++) = ':';
Utils::hex(_pq->mlkemPk, PQHybrid::MLKEM768_PK_LEN, p);
p += PQHybrid::MLKEM768_PK_LEN * 2;
*(p++) = ':';
Utils::hex(_pq->mldsaPk, PQHybrid::MLDSA65_PK_LEN, p);
p += PQHybrid::MLDSA65_PK_LEN * 2;
}
}
*p = (char)0;
return buf;
}
bool Identity::fromString(const char *str)
{
if (!str) {
_address.zero();
return false;
}
char tmp[ZT_IDENTITY_STRING_BUFFER_LENGTH];
if (!Utils::scopy(tmp,sizeof(tmp),str)) {
_address.zero();
return false;
}
// Field counts are fixed per identity type, which removes any ambiguity
// about whether field 3 is a private key or PQ material.
int nfields = 1;
for (const char* s = str; *s; ++s) {
if (*s == ':') {
++nfields;
}
}
delete _privateKey;
_privateKey = (C25519::Private *)0;
if (_pq) {
Utils::burn(_pq, sizeof(PQKeys));
delete _pq;
_pq = (PQKeys*)0;
}
int fno = 0;
char *saveptr = (char *)0;
for(char *f=Utils::stok(tmp,":",&saveptr);(f);f=Utils::stok((char *)0,":",&saveptr)) {
switch(fno++) {
case 0:
_address = Address(Utils::hexStrToU64(f));
if (_address.isReserved()) {
_address.zero();
return false;
}
break;
case 1:
if (f[1]) {
_address.zero();
return false;
}
if (f[0] == '0') {
if ((nfields != 3) && (nfields != 4)) {
_address.zero();
return false;
}
}
else if (f[0] == '1') {
// V10: a type 0 parser must reject this cleanly.
if ((nfields != 5) && (nfields != 8)) {
_address.zero();
return false;
}
_pq = new PQKeys();
memset(_pq, 0, sizeof(PQKeys));
}
else {
_address.zero();
return false;
}
break;
case 2:
if (Utils::unhex(f,_publicKey.data,ZT_C25519_PUBLIC_KEY_LEN) != ZT_C25519_PUBLIC_KEY_LEN) {
_address.zero();
return false;
}
break;
case 3:
if ((_pq) && (nfields == 8)) {
_privateKey = new C25519::Private();
if (Utils::unhex(f, _privateKey->data, ZT_C25519_PRIVATE_KEY_LEN) != ZT_C25519_PRIVATE_KEY_LEN) {
_address.zero();
return false;
}
}
else if (_pq) {
if (Utils::unhex(f, _pq->mlkemPk, PQHybrid::MLKEM768_PK_LEN) != PQHybrid::MLKEM768_PK_LEN) {
_address.zero();
return false;
}
}
else {
_privateKey = new C25519::Private();
if (Utils::unhex(f, _privateKey->data, ZT_C25519_PRIVATE_KEY_LEN) != ZT_C25519_PRIVATE_KEY_LEN) {
_address.zero();
return false;
}
}
break;
case 4:
if (! _pq) {
_address.zero();
return false;
}
if (nfields == 5) {
if (Utils::unhex(f, _pq->mldsaPk, PQHybrid::MLDSA65_PK_LEN) != PQHybrid::MLDSA65_PK_LEN) {
_address.zero();
return false;
}
}
else if (Utils::unhex(f, _pq->mlkemPk, PQHybrid::MLKEM768_PK_LEN) != PQHybrid::MLKEM768_PK_LEN) {
_address.zero();
return false;
}
break;
case 5:
if ((! _pq) || (nfields != 8)) {
_address.zero();
return false;
}
if (Utils::unhex(f, _pq->mlkemSk, PQHybrid::MLKEM768_SK_LEN) != PQHybrid::MLKEM768_SK_LEN) {
_address.zero();
return false;
}
break;
case 6:
if ((! _pq) || (nfields != 8)) {
_address.zero();
return false;
}
if (Utils::unhex(f, _pq->mldsaPk, PQHybrid::MLDSA65_PK_LEN) != PQHybrid::MLDSA65_PK_LEN) {
_address.zero();
return false;
}
break;
case 7:
if ((! _pq) || (nfields != 8)) {
_address.zero();
return false;
}
if (Utils::unhex(f, _pq->mldsaSk, PQHybrid::MLDSA65_SK_LEN) != PQHybrid::MLDSA65_SK_LEN) {
_address.zero();
return false;
}
break;
default:
_address.zero();
return false;
}
}
if ((fno < 3) || (fno != nfields)) {
_address.zero();
return false;
}
return true;
}
} // namespace ZeroTier
Reference in new issue View Git Blame Copy Permalink