torchwood: support ML-DSA-44 log vkeys in ParsePolicy

Author: FiloSottile

policy.go

@@ -1,6 +1,7 @@
 package torchwood
 
 import (
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"strconv"
@@ -152,7 +153,7 @@ func ParsePolicy(p []byte) (Policy, error) {
 			if len(fields) < 2 {
 				return nil, fmt.Errorf("line %d: invalid log definition: %q", i+1, line)
 			}
-			v, err := note.NewVerifier(fields[1])
+			v, err := newLogVerifier(fields[1])
 			if err != nil {
 				return nil, fmt.Errorf("line %d: invalid log vkey %q: %w", i+1, fields[1], err)
 			}
@@ -226,3 +227,22 @@ func ParsePolicy(p []byte) (Policy, error) {
 		return ThresholdPolicy(2, q, logPolicy), nil
 	}
 }
+
+// newLogVerifier parses a log vkey, which may use the Ed25519 signature
+// algorithm or the ML-DSA-44 (sub)tree cosignature algorithm.
+func newLogVerifier(vkey string) (note.Verifier, error) {
+	_, rest, _ := strings.Cut(vkey, "+")
+	_, key64, _ := strings.Cut(rest, "+")
+	key, err := base64.StdEncoding.DecodeString(key64)
+	if err != nil || len(key) == 0 {
+		return nil, errors.New("malformed verifier id")
+	}
+	switch key[0] {
+	case algEd25519:
+		return note.NewVerifier(vkey)
+	case algCosignatureMLDSA:
+		return NewCosignatureVerifier(vkey)
+	default:
+		return nil, errors.New("unknown verifier algorithm for log vkey")
+	}
+}

policy_test.go

@@ -0,0 +1,157 @@
+package torchwood_test
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"testing"
+
+	"filippo.io/mldsa"
+	"filippo.io/torchwood"
+	"golang.org/x/mod/sumdb/note"
+	"golang.org/x/mod/sumdb/tlog"
+)
+
+func TestParsePolicyLogKey(t *testing.T) {
+	origin := "example.com/log"
+	checkpoint := torchwood.Checkpoint{
+		Origin: origin,
+		Tree:   tlog.Tree{N: 123, Hash: tlog.RecordHash([]byte("test data"))},
+	}
+
+	t.Run("Ed25519", func(t *testing.T) {
+		skey, vkey, err := note.GenerateKey(rand.Reader, origin)
+		if err != nil {
+			t.Fatal(err)
+		}
+		signer, err := note.NewSigner(skey)
+		if err != nil {
+			t.Fatal(err)
+		}
+		signed, err := note.Sign(&note.Note{Text: checkpoint.String()}, signer)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		policy, err := torchwood.ParsePolicy([]byte("log " + vkey + "\nquorum none\n"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		c, _, err := torchwood.VerifyCheckpoint(signed, policy)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if c.Origin != origin {
+			t.Errorf("origin = %q; want %q", c.Origin, origin)
+		}
+	})
+
+	t.Run("ML-DSA", func(t *testing.T) {
+		k, err := mldsa.GenerateKey(mldsa.MLDSA44())
+		if err != nil {
+			t.Fatal(err)
+		}
+		signer, err := torchwood.NewCosignatureSigner(origin, k)
+		if err != nil {
+			t.Fatal(err)
+		}
+		signed, err := note.Sign(&note.Note{Text: checkpoint.String()}, signer)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		policy, err := torchwood.ParsePolicy([]byte("log " + signer.Verifier().String() + "\nquorum none\n"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		c, _, err := torchwood.VerifyCheckpoint(signed, policy)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if c.Origin != origin {
+			t.Errorf("origin = %q; want %q", c.Origin, origin)
+		}
+
+		// A checkpoint for a different origin doesn't satisfy the policy, even
+		// if the signature verifies.
+		other := torchwood.Checkpoint{
+			Origin: "example.com/other",
+			Tree:   checkpoint.Tree,
+		}
+		signedOther, err := note.Sign(&note.Note{Text: other.String()}, signer)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := torchwood.VerifyCheckpoint(signedOther, policy); err == nil {
+			t.Error("expected error verifying checkpoint with wrong origin")
+		}
+	})
+
+	t.Run("Ed25519 cosignature key rejected", func(t *testing.T) {
+		_, k, err := ed25519.GenerateKey(rand.Reader)
+		if err != nil {
+			t.Fatal(err)
+		}
+		signer, err := torchwood.NewCosignatureSigner(origin, k)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = torchwood.ParsePolicy([]byte("log " + signer.Verifier().String() + "\nquorum none\n"))
+		if err == nil {
+			t.Error("expected error parsing log line with Ed25519 cosignature vkey")
+		}
+	})
+}
+
+func TestParsePolicyMLDSAWithWitness(t *testing.T) {
+	origin := "example.com/log"
+	checkpoint := torchwood.Checkpoint{
+		Origin: origin,
+		Tree:   tlog.Tree{N: 123, Hash: tlog.RecordHash([]byte("test data"))},
+	}
+
+	logKey, err := mldsa.GenerateKey(mldsa.MLDSA44())
+	if err != nil {
+		t.Fatal(err)
+	}
+	logSigner, err := torchwood.NewCosignatureSigner(origin, logKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	witnessKey, err := mldsa.GenerateKey(mldsa.MLDSA44())
+	if err != nil {
+		t.Fatal(err)
+	}
+	witnessSigner, err := torchwood.NewCosignatureSigner("witness.example/w1", witnessKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	policy, err := torchwood.ParsePolicy([]byte(
+		"log " + logSigner.Verifier().String() + "\n" +
+			"witness W1 " + witnessSigner.Verifier().String() + "\n" +
+			"quorum W1\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	signed, err := note.Sign(&note.Note{Text: checkpoint.String()}, logSigner, witnessSigner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, _, err := torchwood.VerifyCheckpoint(signed, policy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.Origin != origin {
+		t.Errorf("origin = %q; want %q", c.Origin, origin)
+	}
+
+	// Without the witness cosignature, the quorum is not satisfied.
+	signedLogOnly, err := note.Sign(&note.Note{Text: checkpoint.String()}, logSigner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := torchwood.VerifyCheckpoint(signedLogOnly, policy); err == nil {
+		t.Error("expected error verifying checkpoint without witness cosignature")
+	}
+}