cmd/age-keyserver: hash age public key to prevent log poisoning

Author: FiloSottile

cmd/age-keylookup/main.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"bytes"
 	"context"
+	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"flag"
@@ -157,8 +159,9 @@ func lookupKey(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email s
 	}
 
 	// Verify spicy signature
-	vrfHashB64 := base64.StdEncoding.EncodeToString(vrfHash)
-	entry := fmt.Appendf(nil, "%s\n%s\n", vrfHashB64, result.Pubkey)
+	h := sha256.New()
+	h.Write([]byte(result.Pubkey))
+	entry := h.Sum(vrfHash) // vrf-r255(email) || SHA-256(pubkey)
 	if err := torchwood.VerifyProof(v.Name(), func(b []byte) (*note.Note, error) {
 		return note.Open(b, note.VerifierList(v))
 	}, tlog.RecordHash(entry), []byte(result.Proof)); err != nil {
@@ -169,7 +172,7 @@ func lookupKey(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email s
 }
 
 func monitorLog(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email string) ([]string, error) {
-	// Request the VRF proof from the monitor endpoint
+	// Request the VRF proof and history from the monitor endpoint
 	monitorURL := serverURL + "/api/monitor?email=" + url.QueryEscape(email)
 	client := &http.Client{
 		Timeout: 10 * time.Second,
@@ -187,8 +190,9 @@ func monitorLog(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email
 		return nil, fmt.Errorf("keyserver error: %s - %s", resp.Status, string(body))
 	}
 	var result struct {
-		Email    string `json:"email"`
-		VRFProof []byte `json:"vrf_proof"`
+		Email    string   `json:"email"`
+		VRFProof []byte   `json:"vrf_proof"`
+		History  []string `json:"history"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, fmt.Errorf("failed to parse response: %w", err)
@@ -197,6 +201,13 @@ func monitorLog(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email
 		return nil, fmt.Errorf("keyserver returned unexpected email: %q", result.Email)
 	}
 
+	// Prepare map of hashes of historical keys
+	historyHashes := make(map[[32]byte]string)
+	for _, pk := range result.History {
+		h := sha256.Sum256([]byte(pk))
+		historyHashes[h] = pk
+	}
+
 	// Compute and verify VRF hash
 	vrfProof, err := vrf.NewProof(result.VRFProof)
 	if err != nil {
@@ -233,17 +244,17 @@ func monitorLog(serverURL string, v note.Verifier, vrfKey *vrf.PublicKey, email
 	// Fetch all entries up to the checkpoint size
 	var pubkeys []string
 	for i, entry := range c.AllEntries(context.Background(), checkpoint.Tree, 0) {
-		e, rest, ok := strings.Cut(string(entry), "\n")
-		if !ok {
-			return nil, fmt.Errorf("malformed log entry %d: %q", i, string(entry))
+		if len(entry) != 64+32 {
+			return nil, fmt.Errorf("invalid entry size at index %d", i)
 		}
-		k, rest, ok := strings.Cut(rest, "\n")
-		if !ok || rest != "" {
-			return nil, fmt.Errorf("malformed log entry %d: %q", i, string(entry))
+		if !bytes.Equal(entry[:64], vrfHash) {
+			continue
 		}
-		if e == base64.StdEncoding.EncodeToString(vrfHash) {
-			pubkeys = append(pubkeys, k)
+		pk, ok := historyHashes[([32]byte)(entry[64:])]
+		if !ok {
+			return nil, fmt.Errorf("found unknown public key hash in log at index %d", i)
 		}
+		pubkeys = append(pubkeys, pk)
 	}
 	if c.Err() != nil {
 		return nil, fmt.Errorf("error fetching log entries: %w", c.Err())

cmd/age-keyserver/main.go

@@ -71,7 +71,13 @@ const (
 		CREATE TABLE IF NOT EXISTS keys (
 			email TEXT PRIMARY KEY,
 			json_data BLOB
-		) STRICT;`
+		) STRICT;
+		CREATE TABLE IF NOT EXISTS history (
+			email TEXT NOT NULL,
+			pubkey TEXT NOT NULL
+		) STRICT;
+		CREATE INDEX IF NOT EXISTS history_email_idx ON history(email);
+	`
 )
 
 func main() {
@@ -131,7 +137,7 @@ func main() {
 	dbpool, err := sqlitex.NewPool(*dbPath, sqlitex.PoolOptions{
 		PoolSize: 10,
 		PrepareConn: func(conn *sqlite.Conn) error {
-			return sqlitex.ExecuteTransient(conn, schema, nil)
+			return sqlitex.ExecScript(conn, schema)
 		},
 	})
 	if err != nil {
@@ -354,10 +360,18 @@ func (s *Server) handleSetKey(w http.ResponseWriter, r *http.Request) {
 
 		// Compute VRF hash and proof
 		vrfProof := s.vrf.Prove([]byte(email))
-		vrfHash := base64.StdEncoding.EncodeToString(vrfProof.Hash())
+
+		// Keep track of the unhashed key
+		if err := s.storeHistory(email, pubkey); err != nil {
+			http.Error(w, "Failed to store key history", http.StatusInternalServerError)
+			log.Printf("database error: %v", err)
+			return
+		}
 
 		// Add to transparency log
-		entry := tessera.NewEntry(fmt.Appendf(nil, "%s\n%s\n", vrfHash, pubkey))
+		h := sha256.New()
+		h.Write([]byte(pubkey))
+		entry := tessera.NewEntry(h.Sum(vrfProof.Hash())) // vrf-r255(email) || SHA-256(pubkey)
 		index, _, err := s.awaiter.Await(r.Context(), s.appender.Add(r.Context(), entry))
 		if err != nil {
 			http.Error(w, "Failed to add to transparency log", http.StatusInternalServerError)
@@ -441,11 +455,19 @@ func (s *Server) handleMonitor(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	history, err := s.getHistory(email)
+	if err != nil {
+		http.Error(w, "Database error", http.StatusInternalServerError)
+		log.Printf("database error: %v", err)
+		return
+	}
+
 	// Return as JSON
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]any{
 		"email":     email,
 		"vrf_proof": s.vrf.Prove([]byte(email)).Bytes(),
+		"history":   history,
 	})
 }
 
@@ -581,6 +603,47 @@ func (s *Server) deleteKey(email string) error {
 	})
 }
 
+func (s *Server) getHistory(email string) ([]string, error) {
+	conn, err := s.dbpool.Take(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	defer s.dbpool.Put(conn)
+
+	var pubkeys []string
+	err = sqlitex.Execute(conn, `
+		SELECT pubkey FROM history
+		WHERE email = ?
+	`, &sqlitex.ExecOptions{
+		Args: []any{email},
+		ResultFunc: func(stmt *sqlite.Stmt) error {
+			pubkey := stmt.ColumnText(0)
+			pubkeys = append(pubkeys, pubkey)
+			return nil
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return pubkeys, nil
+}
+
+func (s *Server) storeHistory(email, pubkey string) error {
+	conn, err := s.dbpool.Take(context.Background())
+	if err != nil {
+		return err
+	}
+	defer s.dbpool.Put(conn)
+
+	return sqlitex.Execute(conn, `
+		INSERT INTO history (email, pubkey)
+		VALUES (?, ?)
+	`, &sqlitex.ExecOptions{
+		Args: []any{email, pubkey},
+	})
+}
+
 func verifyCaptcha(response string) bool {
 	if response == "" {
 		return false