Merge pull request #41 from nats-io/curve2

unify KeyPair and Curve interfaces

errors.go

@@ -15,28 +15,32 @@ package nkeys
 
 // Errors
 const (
-	ErrInvalidPrefixByte = nkeysError("nkeys: invalid prefix byte")
-	ErrInvalidKey        = nkeysError("nkeys: invalid key")
-	ErrInvalidPublicKey  = nkeysError("nkeys: invalid public key")
-	ErrInvalidPrivateKey = nkeysError("nkeys: invalid private key")
-	ErrInvalidSeedLen    = nkeysError("nkeys: invalid seed length")
-	ErrInvalidSeed       = nkeysError("nkeys: invalid seed")
-	ErrInvalidEncoding   = nkeysError("nkeys: invalid encoded key")
-	ErrInvalidSignature  = nkeysError("nkeys: signature verification failed")
-	ErrCannotSign        = nkeysError("nkeys: can not sign, no private key available")
-	ErrPublicKeyOnly     = nkeysError("nkeys: no seed or private key available")
-	ErrIncompatibleKey   = nkeysError("nkeys: incompatible key")
-	ErrInvalidChecksum   = nkeysError("nkeys: invalid checksum")
-	ErrNoSeedFound       = nkeysError("nkeys: no nkey seed found")
-	ErrInvalidNkeySeed   = nkeysError("nkeys: doesn't contain a seed nkey")
-	ErrInvalidUserSeed   = nkeysError("nkeys: doesn't contain an user seed nkey")
-	ErrInvalidRecipient  = nkeysError("nkeys: not a valid recipient public curve key")
-	ErrInvalidSender     = nkeysError("nkeys: not a valid sender public curve key")
-	ErrInvalidCurveKey   = nkeysError("nkeys: not a valid curve key")
-	ErrInvalidCurveSeed  = nkeysError("nkeys: not a valid curve seed")
-	ErrInvalidEncrypted  = nkeysError("nkeys: encrypted input is not valid")
-	ErrInvalidEncVersion = nkeysError("nkeys: encrypted input wrong version")
-	ErrCouldNotDecrypt   = nkeysError("nkeys: could not decrypt input")
+	ErrInvalidPrefixByte        = nkeysError("nkeys: invalid prefix byte")
+	ErrInvalidKey               = nkeysError("nkeys: invalid key")
+	ErrInvalidPublicKey         = nkeysError("nkeys: invalid public key")
+	ErrInvalidPrivateKey        = nkeysError("nkeys: invalid private key")
+	ErrInvalidSeedLen           = nkeysError("nkeys: invalid seed length")
+	ErrInvalidSeed              = nkeysError("nkeys: invalid seed")
+	ErrInvalidEncoding          = nkeysError("nkeys: invalid encoded key")
+	ErrInvalidSignature         = nkeysError("nkeys: signature verification failed")
+	ErrCannotSign               = nkeysError("nkeys: can not sign, no private key available")
+	ErrPublicKeyOnly            = nkeysError("nkeys: no seed or private key available")
+	ErrIncompatibleKey          = nkeysError("nkeys: incompatible key")
+	ErrInvalidChecksum          = nkeysError("nkeys: invalid checksum")
+	ErrNoSeedFound              = nkeysError("nkeys: no nkey seed found")
+	ErrInvalidNkeySeed          = nkeysError("nkeys: doesn't contain a seed nkey")
+	ErrInvalidUserSeed          = nkeysError("nkeys: doesn't contain an user seed nkey")
+	ErrInvalidRecipient         = nkeysError("nkeys: not a valid recipient public curve key")
+	ErrInvalidSender            = nkeysError("nkeys: not a valid sender public curve key")
+	ErrInvalidCurveKey          = nkeysError("nkeys: not a valid curve key")
+	ErrInvalidCurveSeed         = nkeysError("nkeys: not a valid curve seed")
+	ErrInvalidEncrypted         = nkeysError("nkeys: encrypted input is not valid")
+	ErrInvalidEncVersion        = nkeysError("nkeys: encrypted input wrong version")
+	ErrCouldNotDecrypt          = nkeysError("nkeys: could not decrypt input")
+	ErrInvalidCurveKeyOperation = nkeysError("nkeys: curve key is not valid for sign/verify")
+	ErrInvalidNKeyOperation     = nkeysError("nkeys: only curve key can seal/open")
+	ErrCannotOpen               = nkeysError("nkeys: cannot open no private curve key available")
+	ErrCannotSeal               = nkeysError("nkeys: cannot seal no private curve key available")
 )
 
 type nkeysError string

keypair.go

@@ -36,6 +36,9 @@ func CreatePair(prefix PrefixByte) (KeyPair, error) {
 
 // CreatePair will create a KeyPair based on the rand reader and a type/prefix byte. rand can be nil.
 func CreatePairWithRand(prefix PrefixByte, rr io.Reader) (KeyPair, error) {
+	if prefix == PrefixByteCurve {
+		return CreateCurveKeysWithRand(rr)
+	}
 	if rr == nil {
 		rr = rand.Reader
 	}
@@ -126,3 +129,18 @@ func (pair *kp) Verify(input []byte, sig []byte) error {
 	}
 	return nil
 }
+
+// Seal is only supported on CurveKeyPair
+func (pair *kp) Seal(input []byte, recipient string) ([]byte, error) {
+	return nil, ErrInvalidNKeyOperation
+}
+
+// SealWithRand is only supported on CurveKeyPair
+func (pair *kp) SealWithRand(input []byte, recipient string, rr io.Reader) ([]byte, error) {
+	return nil, ErrInvalidNKeyOperation
+}
+
+// Open is only supported on CurveKey
+func (pair *kp) Open(input []byte, sender string) ([]byte, error) {
+	return nil, ErrInvalidNKeyOperation
+}

nkeys.go

@@ -16,6 +16,8 @@
 // It also supports encryption via x25519 keys and is compatible with https://pkg.go.dev/golang.org/x/crypto/nacl/box.
 package nkeys
 
+import "io"
+
 // Version is our current version
 const Version = "0.4.0-beta"
 
@@ -24,9 +26,17 @@ type KeyPair interface {
 	Seed() ([]byte, error)
 	PublicKey() (string, error)
 	PrivateKey() ([]byte, error)
+	// Sign is only supported on Non CurveKeyPairs
 	Sign(input []byte) ([]byte, error)
+	// Verify is only supported on Non CurveKeyPairs
 	Verify(input []byte, sig []byte) error
 	Wipe()
+	// Seal is only supported on CurveKeyPair
+	Seal(input []byte, recipient string) ([]byte, error)
+	// SealWithRand is only supported on CurveKeyPair
+	SealWithRand(input []byte, recipient string, rr io.Reader) ([]byte, error)
+	// Open is only supported on CurveKey
+	Open(input []byte, sender string) ([]byte, error)
 }
 
 // CreateUser will create a User typed KeyPair.
@@ -69,10 +79,13 @@ func FromPublicKey(public string) (KeyPair, error) {
 
 // FromSeed will create a KeyPair capable of signing and verifying signatures.
 func FromSeed(seed []byte) (KeyPair, error) {
-	_, _, err := DecodeSeed(seed)
+	prefix, _, err := DecodeSeed(seed)
 	if err != nil {
 		return nil, err
 	}
+	if prefix == PrefixByteCurve {
+		return FromCurveSeed(seed)
+	}
 	copy := append([]byte{}, seed...)
 	return &kp{copy}, nil
 }

nkeys_test.go

@@ -692,3 +692,40 @@ func TestValidateKeyPairRole(t *testing.T) {
 		}
 	}
 }
+
+func testSealOpen(t *testing.T, prefixByte PrefixByte) {
+	kp, err := CreatePair(prefixByte)
+	if err != nil {
+		t.Fatalf("Failed to create pair for %v", prefixByte)
+	}
+	if kp == nil {
+		t.Fatalf("Failed to create pair for %v - nil keypair", prefixByte)
+	}
+	_, err = kp.Open([]byte("hello"), "ME")
+	if err == nil {
+		t.Fatalf("Expected Open to fail for %v", prefixByte)
+	}
+	if err != ErrInvalidNKeyOperation {
+		t.Fatalf("Expected Open to fail for %v with %v: %v", prefixByte, ErrInvalidNKeyOperation, err)
+	}
+	_, err = kp.Seal([]byte("hello"), "ME")
+	if err == nil {
+		t.Fatalf("Expected Seal to fail for %v", prefixByte)
+	}
+	if err != ErrInvalidNKeyOperation {
+		t.Fatalf("Expected Seal to fail for %v with %v: %v", prefixByte, ErrInvalidNKeyOperation, err)
+	}
+	_, err = kp.SealWithRand([]byte("hello"), "ME", nil)
+	if err == nil {
+		t.Fatalf("Expected SealWithRand to fail for %v", prefixByte)
+	}
+	if err != ErrInvalidNKeyOperation {
+		t.Fatalf("Expected SealWithRand to fail for %v with %v: %v", prefixByte, ErrInvalidNKeyOperation, err)
+	}
+}
+
+func TestSealOpen(t *testing.T) {
+	testSealOpen(t, PrefixByteOperator)
+	testSealOpen(t, PrefixByteAccount)
+	testSealOpen(t, PrefixByteUser)
+}

public.go

@@ -64,3 +64,23 @@ func (p *pub) Wipe() {
 	p.pre = '0'
 	io.ReadFull(rand.Reader, p.pub)
 }
+
+func (p *pub) Seal(input []byte, recipient string) ([]byte, error) {
+	if p.pre == PrefixByteCurve {
+		return nil, ErrCannotSeal
+	}
+	return nil, ErrInvalidNKeyOperation
+}
+func (p *pub) SealWithRand(input []byte, _recipient string, rr io.Reader) ([]byte, error) {
+	if p.pre == PrefixByteCurve {
+		return nil, ErrCannotSeal
+	}
+	return nil, ErrInvalidNKeyOperation
+}
+
+func (p *pub) Open(input []byte, sender string) ([]byte, error) {
+	if p.pre == PrefixByteCurve {
+		return nil, ErrCannotOpen
+	}
+	return nil, ErrInvalidNKeyOperation
+}

xkeys.go

@@ -28,17 +28,6 @@ import (
 // We may add more advanced options in the future for group recipients and better
 // end to end algorithms.
 
-// CurveKeyPair provides the central interface to xkeys used for encryption.
-type CurveKeyPair interface {
-	Seed() ([]byte, error)
-	PublicKey() (string, error)
-	PrivateKey() ([]byte, error)
-	Seal(input []byte, recipient string) ([]byte, error)
-	SealWithRand(input []byte, recipient string, rr io.Reader) ([]byte, error)
-	Open(input []byte, sender string) ([]byte, error)
-	Wipe()
-}
-
 const (
 	curveKeyLen    = 32
 	curveDecodeLen = 35
@@ -50,12 +39,12 @@ type ckp struct {
 }
 
 // CreateUser will create a User typed KeyPair.
-func CreateCurveKeys() (CurveKeyPair, error) {
+func CreateCurveKeys() (KeyPair, error) {
 	return CreateCurveKeysWithRand(rand.Reader)
 }
 
 // CreateUser will create a User typed KeyPair with specified rand source.
-func CreateCurveKeysWithRand(rr io.Reader) (CurveKeyPair, error) {
+func CreateCurveKeysWithRand(rr io.Reader) (KeyPair, error) {
 	var kp ckp
 	_, err := io.ReadFull(rr, kp.seed[:])
 	if err != nil {
@@ -65,7 +54,7 @@ func CreateCurveKeysWithRand(rr io.Reader) (CurveKeyPair, error) {
 }
 
 // Will create a curve key pair from seed.
-func FromCurveSeed(seed []byte) (CurveKeyPair, error) {
+func FromCurveSeed(seed []byte) (KeyPair, error) {
 	pb, raw, err := DecodeSeed(seed)
 	if err != nil {
 		return nil, err
@@ -185,3 +174,11 @@ func (pair *ckp) Open(input []byte, sender string) ([]byte, error) {
 func (pair *ckp) Wipe() {
 	io.ReadFull(rand.Reader, pair.seed[:])
 }
+
+func (pair *ckp) Sign(_ []byte) ([]byte, error) {
+	return nil, ErrInvalidCurveKeyOperation
+}
+
+func (pair *ckp) Verify(_ []byte, _ []byte) error {
+	return ErrInvalidCurveKeyOperation
+}

xkeys_test.go

@@ -19,15 +19,7 @@ import (
 	"testing"
 )
 
-func TestCurve(t *testing.T) {
-	kp, err := CreateCurveKeys()
-	if err != nil {
-		t.Fatalf("Expected non-nil error on CreateCurveKeys, received %v", err)
-	}
-	if kp == nil {
-		t.Fatal("Expected a non-nil curve key pair")
-	}
-
+func testCurve(t *testing.T, kp KeyPair) {
 	// Check seed
 	seed, err := kp.Seed()
 	if err != nil {
@@ -81,6 +73,28 @@ func TestCurve(t *testing.T) {
 	}
 }
 
+func TestCurveFromCreateCurveKeys(t *testing.T) {
+	kp, err := CreateCurveKeys()
+	if err != nil {
+		t.Fatalf("Expected nil error on CreateCurveKeys, received %v", err)
+	}
+	if kp == nil {
+		t.Fatal("Expected a non-nil curve key pair")
+	}
+	testCurve(t, kp)
+}
+
+func TestCurveFromCreatePair(t *testing.T) {
+	kp, err := CreatePair(PrefixByteCurve)
+	if err != nil {
+		t.Fatalf("Expected nil error on CreatePair, received %v", err)
+	}
+	if kp == nil {
+		t.Fatal("Expected a non-nil curve key pair")
+	}
+	testCurve(t, kp)
+}
+
 func TestCurveFromSeed(t *testing.T) {
 	kp, _ := CreateCurveKeys()
 	seed, _ := kp.Seed()
@@ -90,6 +104,53 @@ func TestCurveFromSeed(t *testing.T) {
 		t.Fatalf("Unexpected error deriving curve keypair: %v", err)
 	}
 	if !reflect.DeepEqual(kp.(*ckp), nkp.(*ckp)) {
-		t.Fatalf("Expected the curve pairs to be equal")
+		t.Fatal("Expected the curve pairs to be equal")
+	}
+	testCurve(t, nkp)
+}
+
+func TestCurveFromKeyPair(t *testing.T) {
+	kp, _ := CreatePair(PrefixByteCurve)
+	_, err := kp.Sign([]byte("hello"))
+	if err == nil {
+		t.Fatal("Expected sign to fail as it non supported operation")
+	}
+	if err != ErrInvalidCurveKeyOperation {
+		t.Fatalf("Expected %v but got %v", ErrInvalidCurveKeyOperation, err)
+	}
+	err = kp.Verify([]byte("hello"), []byte("bad"))
+	if err == nil {
+		t.Fatal("Expected verify to fail as it is unsupported operation")
+	}
+	if err != ErrInvalidCurveKeyOperation {
+		t.Fatalf("Expected %v but got %v", ErrInvalidCurveKeyOperation, err)
+	}
+}
+
+func TestCurvePublic(t *testing.T) {
+	kp, _ := CreatePair(PrefixByteCurve)
+	_, err := kp.Sign([]byte("hello"))
+	if err == nil {
+		t.Fatal("Expected sign to fail as it non supported operation")
+	}
+	pk, err := kp.PublicKey()
+	if err != nil {
+		t.Fatalf("Unexpected public key error: %v", err)
+	}
+	pub, err := FromPublicKey(pk)
+	if err != nil {
+		t.Fatalf("Unexpected error when creating public key: %v", err)
+	}
+	_, err = pub.Open([]byte("hello"), "bad")
+	if err != ErrCannotOpen {
+		t.Fatalf("Expected %v but got %v", ErrCannotOpen, err)
+	}
+	_, err = pub.Seal([]byte("hello"), "bad")
+	if err != ErrCannotSeal {
+		t.Fatalf("Expected %v but got %v", ErrCannotSeal, err)
+	}
+	_, err = pub.SealWithRand([]byte("hello"), "bad", nil)
+	if err != ErrCannotSeal {
+		t.Fatalf("Expected %v but got %v", ErrCannotSeal, err)
 	}
 }