Skip to content

Commit 52f07f1

Browse files
FiloSottileFiloSottile
committed
cmd/age-keyserver: use VRFs to hide emails in the log
1 parent d031d34 commit 52f07f1

8 files changed

Lines changed: 139 additions & 13 deletions

File tree

‎cmd/age-keylookup/main.go‎

Lines changed: 78 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package main
22

33
import (
44
"context"
5+
"encoding/base64"
56
"encoding/json"
67
"flag"
78
"fmt"
@@ -12,6 +13,7 @@ import (
1213
"strings"
1314
"time"
1415

16+
"filippo.io/mostly-harmless/vrf-r255"
1517
"filippo.io/torchwood"
1618
"golang.org/x/mod/sumdb/note"
1719
"golang.org/x/mod/sumdb/tlog"
@@ -20,6 +22,7 @@ import (
2022
const (
2123
defaultKeyserverURL = "https://keyserver.geomys.org"
2224
defaultKeyserverPubkey = "keyserver.geomys.org+16b31509+ARLJ+pmTj78HzTeBj04V+LVfB+GFAQyrg54CRIju7Nn8"
25+
defaultKeyserverVRFKey = "mKPsDHDcVB95iPXW4Yc7+HPfi3xOw/bHFvfWw6CAMBs="
2326
)
2427

2528
func main() {
@@ -40,6 +43,7 @@ func main() {
4043
fmt.Fprintf(os.Stderr, "Environment:\n")
4144
fmt.Fprintf(os.Stderr, " AGE_KEYSERVER_URL Default keyserver URL\n")
4245
fmt.Fprintf(os.Stderr, " AGE_KEYSERVER_PUBKEY Default keyserver transparency log vkey\n")
46+
fmt.Fprintf(os.Stderr, " AGE_KEYSERVER_VRFKEY Default keyserver transparency log VRF public key\n")
4347
os.Exit(2)
4448
}
4549

@@ -62,11 +66,26 @@ func main() {
6266
}
6367
policy := torchwood.ThresholdPolicy(2, torchwood.OriginPolicy(v.Name()), torchwood.SingleVerifierPolicy(v))
6468

69+
vrfKeyB64 := os.Getenv("AGE_KEYSERVER_VRFKEY")
70+
if vrfKeyB64 == "" {
71+
vrfKeyB64 = defaultKeyserverVRFKey
72+
}
73+
vrfKeyBytes, err := base64.StdEncoding.DecodeString(vrfKeyB64)
74+
if err != nil {
75+
fmt.Fprintf(os.Stderr, "Error: invalid base64 keyserver VRF public key: %v\n", err)
76+
os.Exit(1)
77+
}
78+
vrfKey, err := vrf.NewPublicKey(vrfKeyBytes)
79+
if err != nil {
80+
fmt.Fprintf(os.Stderr, "Error: invalid keyserver VRF public key: %v\n", err)
81+
os.Exit(1)
82+
}
83+
6584
// Normalize email
6685
email = strings.TrimSpace(strings.ToLower(email))
6786

6887
if *allFlag {
69-
pubkeys, err := monitorLog(server, policy, email)
88+
pubkeys, err := monitorLog(server, policy, vrfKey, email)
7089
if err != nil {
7190
fmt.Fprintf(os.Stderr, "Error: %v\n", err)
7291
os.Exit(1)
@@ -77,7 +96,7 @@ func main() {
7796
return
7897
}
7998

80-
pubkey, err := lookupKey(server, policy, email)
99+
pubkey, err := lookupKey(server, policy, vrfKey, email)
81100
if err != nil {
82101
fmt.Fprintf(os.Stderr, "Error: %v\n", err)
83102
os.Exit(1)
@@ -86,7 +105,7 @@ func main() {
86105
fmt.Println(pubkey)
87106
}
88107

89-
func lookupKey(serverURL string, policy torchwood.Policy, email string) (string, error) {
108+
func lookupKey(serverURL string, policy torchwood.Policy, vrfKey *vrf.PublicKey, email string) (string, error) {
90109
// Build the lookup URL
91110
lookupURL := serverURL + "/api/lookup?email=" + url.QueryEscape(email)
92111

@@ -130,16 +149,69 @@ func lookupKey(serverURL string, policy torchwood.Policy, email string) (string,
130149
return "", fmt.Errorf("empty public key returned")
131150
}
132151

152+
// Compute and verify VRF hash
153+
vrfProofBytes, err := torchwood.ProofExtraData([]byte(result.Proof))
154+
if err != nil {
155+
return "", fmt.Errorf("failed to extract VRF proof: %w", err)
156+
}
157+
vrfProof, err := vrf.NewProof(vrfProofBytes)
158+
if err != nil {
159+
return "", fmt.Errorf("failed to parse VRF proof: %w", err)
160+
}
161+
vrfHash, err := vrfKey.Verify(vrfProof, []byte(email))
162+
if err != nil {
163+
return "", fmt.Errorf("failed to verify VRF proof: %w", err)
164+
}
165+
133166
// Verify spicy signature
134-
entry := fmt.Appendf(nil, "%s\n%s\n", result.Email, result.Pubkey)
167+
vrfHashB64 := base64.StdEncoding.EncodeToString(vrfHash)
168+
entry := fmt.Appendf(nil, "%s\n%s\n", vrfHashB64, result.Pubkey)
135169
if err := torchwood.VerifyProof(policy, tlog.RecordHash(entry), []byte(result.Proof)); err != nil {
136170
return "", fmt.Errorf("failed to verify key proof: %w", err)
137171
}
138172

139173
return result.Pubkey, nil
140174
}
141175

142-
func monitorLog(serverURL string, policy torchwood.Policy, email string) ([]string, error) {
176+
func monitorLog(serverURL string, policy torchwood.Policy, vrfKey *vrf.PublicKey, email string) ([]string, error) {
177+
// Request the VRF proof from the monitor endpoint
178+
monitorURL := serverURL + "/api/monitor?email=" + url.QueryEscape(email)
179+
client := &http.Client{
180+
Timeout: 10 * time.Second,
181+
}
182+
resp, err := client.Get(monitorURL)
183+
if err != nil {
184+
return nil, fmt.Errorf("failed to connect to keyserver: %w", err)
185+
}
186+
defer resp.Body.Close()
187+
if resp.StatusCode == http.StatusNotFound {
188+
return nil, fmt.Errorf("no key found for %s", email)
189+
}
190+
if resp.StatusCode != http.StatusOK {
191+
body, _ := io.ReadAll(resp.Body)
192+
return nil, fmt.Errorf("keyserver error: %s - %s", resp.Status, string(body))
193+
}
194+
var result struct {
195+
Email string `json:"email"`
196+
VRFProof []byte `json:"vrf_proof"`
197+
}
198+
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
199+
return nil, fmt.Errorf("failed to parse response: %w", err)
200+
}
201+
if result.Email != email {
202+
return nil, fmt.Errorf("keyserver returned unexpected email: %q", result.Email)
203+
}
204+
205+
// Compute and verify VRF hash
206+
vrfProof, err := vrf.NewProof(result.VRFProof)
207+
if err != nil {
208+
return nil, fmt.Errorf("failed to parse VRF proof: %w", err)
209+
}
210+
vrfHash, err := vrfKey.Verify(vrfProof, []byte(email))
211+
if err != nil {
212+
return nil, fmt.Errorf("failed to verify VRF proof: %w", err)
213+
}
214+
143215
f, err := torchwood.NewTileFetcher(serverURL+"/tlog", torchwood.WithUserAgent("age-keylookup/1.0"))
144216
if err != nil {
145217
return nil, fmt.Errorf("failed to create tile fetcher: %w", err)
@@ -170,7 +242,7 @@ func monitorLog(serverURL string, policy torchwood.Policy, email string) ([]stri
170242
if !ok || rest != "" {
171243
return nil, fmt.Errorf("malformed log entry %d: %q", i, string(entry))
172244
}
173-
if e == email {
245+
if e == base64.StdEncoding.EncodeToString(vrfHash) {
174246
pubkeys = append(pubkeys, k)
175247
}
176248
}

‎cmd/age-keyserver-keygen/keygen.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,11 @@ package main
22

33
import (
44
"crypto/rand"
5+
"encoding/base64"
56
"fmt"
67
"os"
78

9+
"filippo.io/mostly-harmless/vrf-r255"
810
"golang.org/x/mod/sumdb/note"
911
)
1012

@@ -21,6 +23,10 @@ func main() {
2123
os.Exit(1)
2224
}
2325

26+
vrfKey := vrf.GenerateKey()
27+
2428
fmt.Printf("Private key (for LOG_KEY in age-keyserver): %s\n", skey)
29+
fmt.Printf("Private VRF key (for VRF_KEY in age-keyserver): %s\n", base64.StdEncoding.EncodeToString(vrfKey.Bytes()))
2530
fmt.Printf("Public key (for AGE_KEYSERVER_PUBKEY in age-keylookup): %s\n", vkey)
31+
fmt.Printf("Public VRF key (for AGE_KEYSERVER_VRFKEY in age-keylookup): %s\n", base64.StdEncoding.EncodeToString(vrfKey.PublicKey().Bytes()))
2632
}

‎cmd/age-keyserver/main.go‎

Lines changed: 41 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"time"
2626

2727
"filippo.io/age"
28+
"filippo.io/mostly-harmless/vrf-r255"
2829
"filippo.io/torchwood"
2930
"filippo.io/torchwood/tesserax"
3031
"github.com/transparency-dev/tessera"
@@ -50,6 +51,7 @@ type Server struct {
5051
dbpool *sqlitex.Pool
5152
templates *template.Template
5253
hmacKey []byte
54+
vrf *vrf.PrivateKey
5355
baseURL string
5456
reader tessera.LogReader
5557
appender *tessera.Appender
@@ -61,6 +63,7 @@ type KeyData struct {
6163
Pubkey string `json:"pubkey"`
6264
UpdatedAt int64 `json:"updated_at"`
6365
LogIndex int64 `json:"log_index"`
66+
VRFProof []byte `json:"vrf_proof"`
6467
}
6568

6669
const (
@@ -87,6 +90,15 @@ func main() {
8790
policy := torchwood.ThresholdPolicy(2, torchwood.OriginPolicy(v.Name()),
8891
torchwood.SingleVerifierPolicy(v))
8992

93+
vrfKey, err := base64.StdEncoding.DecodeString(os.Getenv("VRF_KEY"))
94+
if err != nil {
95+
log.Fatalln("failed to decode VRF key:", err)
96+
}
97+
vrf, err := vrf.NewPrivateKey(vrfKey)
98+
if err != nil {
99+
log.Fatalln("failed to create VRF from key:", err)
100+
}
101+
90102
driver, err := posix.New(ctx, posix.Config{
91103
Path: *logPath,
92104
})
@@ -164,6 +176,7 @@ func main() {
164176
dbpool: dbpool,
165177
templates: templates,
166178
hmacKey: hmacKey,
179+
vrf: vrf,
167180
baseURL: baseURL,
168181
reader: logReader,
169182
appender: appender,
@@ -178,6 +191,7 @@ func main() {
178191
mux.HandleFunc("GET /manage", srv.handleManage)
179192
mux.HandleFunc("POST /setkey", srv.handleSetKey)
180193
mux.HandleFunc("GET /api/lookup", srv.handleLookup)
194+
mux.HandleFunc("GET /api/monitor", srv.handleMonitor)
181195
mux.HandleFunc("POST /api/verify-token", srv.handleVerifyToken)
182196

183197
// Serve static files
@@ -360,8 +374,12 @@ func (s *Server) handleSetKey(w http.ResponseWriter, r *http.Request) {
360374
return
361375
}
362376

377+
// Compute VRF hash and proof
378+
vrfProof := s.vrf.Prove([]byte(email))
379+
vrfHash := base64.StdEncoding.EncodeToString(vrfProof.Hash())
380+
363381
// Add to transparency log
364-
entry := tessera.NewEntry(fmt.Appendf(nil, "%s\n%s\n", email, pubkey))
382+
entry := tessera.NewEntry(fmt.Appendf(nil, "%s\n%s\n", vrfHash, pubkey))
365383
index, _, err := s.awaiter.Await(r.Context(), s.appender.Add(r.Context(), entry))
366384
if err != nil {
367385
http.Error(w, "Failed to add to transparency log", http.StatusInternalServerError)
@@ -370,14 +388,14 @@ func (s *Server) handleSetKey(w http.ResponseWriter, r *http.Request) {
370388
}
371389

372390
// Store in database
373-
if err := s.storeKey(email, pubkey, int64(index.Index)); err != nil {
391+
if err := s.storeKey(email, pubkey, int64(index.Index), vrfProof.Bytes()); err != nil {
374392
http.Error(w, "Failed to store key", http.StatusInternalServerError)
375393
log.Printf("database error: %v", err)
376394
return
377395
}
378396

379397
// Generate proof for success page
380-
proofBytes, err := s.makeSpicySignature(r.Context(), int64(index.Index))
398+
proofBytes, err := s.makeSpicySignature(r.Context(), int64(index.Index), vrfProof.Bytes())
381399
if err != nil {
382400
http.Error(w, "Failed to create proof", http.StatusInternalServerError)
383401
log.Printf("proof error: %v", err)
@@ -422,7 +440,7 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
422440
return
423441
}
424442

425-
proof, err := s.makeSpicySignature(r.Context(), data.LogIndex)
443+
proof, err := s.makeSpicySignature(r.Context(), data.LogIndex, data.VRFProof)
426444
if err != nil {
427445
http.Error(w, "Failed to create proof", http.StatusInternalServerError)
428446
log.Printf("proof error: %v", err)
@@ -438,7 +456,22 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
438456
})
439457
}
440458

441-
func (s *Server) makeSpicySignature(ctx context.Context, index int64) ([]byte, error) {
459+
func (s *Server) handleMonitor(w http.ResponseWriter, r *http.Request) {
460+
email := r.URL.Query().Get("email")
461+
if email == "" {
462+
http.Error(w, "Email parameter required", http.StatusBadRequest)
463+
return
464+
}
465+
466+
// Return as JSON
467+
w.Header().Set("Content-Type", "application/json")
468+
json.NewEncoder(w).Encode(map[string]any{
469+
"email": email,
470+
"vrf_proof": s.vrf.Prove([]byte(email)).Bytes(),
471+
})
472+
}
473+
474+
func (s *Server) makeSpicySignature(ctx context.Context, index int64, vrfProof []byte) ([]byte, error) {
442475
checkpoint, err := s.reader.ReadCheckpoint(ctx)
443476
if err != nil {
444477
return nil, fmt.Errorf("failed to read checkpoint: %v", err)
@@ -452,7 +485,7 @@ func (s *Server) makeSpicySignature(ctx context.Context, index int64) ([]byte, e
452485
if err != nil {
453486
return nil, fmt.Errorf("failed to create proof: %v", err)
454487
}
455-
return torchwood.FormatProof(index, p, checkpoint), nil
488+
return torchwood.FormatProofWithExtraData(index, vrfProof, p, checkpoint), nil
456489
}
457490

458491
func (s *Server) generateHMAC(email string, ts int64) string {
@@ -525,11 +558,12 @@ func (s *Server) getKeyData(email string) (*KeyData, error) {
525558
return &data, nil
526559
}
527560

528-
func (s *Server) storeKey(email, pubkey string, index int64) error {
561+
func (s *Server) storeKey(email, pubkey string, index int64, vrfProof []byte) error {
529562
data := KeyData{
530563
Pubkey: pubkey,
531564
UpdatedAt: time.Now().Unix(),
532565
LogIndex: index,
566+
VRFProof: vrfProof,
533567
}
534568

535569
jsonData, err := json.Marshal(data)

‎cmd/age-keyserver/testdata/age-keylookup.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ env HCAPTCHA_SECRET=0x0000000000000000000000000000000000000000
55
env AGE_KEYSERVER_URL=http://localhost:13893
66
env AGE_KEYSERVER_HMAC_FILE=$WORK/hmac.txt
77
env LOG_KEY=PRIVATE+KEY+example.com+5800330c+AaAoObvamoDOmN6c30Xh9pH1e/xqKcsU+fNmthQ8qmvM
8+
env VRF_KEY=vni5C6++aVMFR5tg3bwvLamWlhJEmVrtNT7uNeyo6gQ=
89
env AGE_KEYSERVER_PUBKEY=example.com+5800330c+ARPRGiaIwfx6xka5nXhdD/rqojPMjrjhm7OCuy+03Ymz
10+
env AGE_KEYSERVER_VRFKEY=cmJCh5QTwp9VqN+QVV+BRxKLKmCFRuVAx+dahotxqw0=
911
exec age-keyserver -db=$WORK/test.sqlite3 -listen=localhost:13893 &srv&
1012
waitfor http://localhost:13893/
1113

‎cmd/age-keyserver/testdata/age-keyserver.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# start age-keyserver with test hCaptcha secret
22
env HCAPTCHA_SECRET=0x0000000000000000000000000000000000000000
33
env LOG_KEY=PRIVATE+KEY+example.com+5800330c+AaAoObvamoDOmN6c30Xh9pH1e/xqKcsU+fNmthQ8qmvM
4+
env VRF_KEY=vni5C6++aVMFR5tg3bwvLamWlhJEmVrtNT7uNeyo6gQ=
45
exec age-keyserver -db=$WORK/test.sqlite3 -listen=localhost:13892 &srv&
56
waitfor http://localhost:13892/
67

‎cmd/age-keyserver/testdata/monitor.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ env HCAPTCHA_SECRET=0x0000000000000000000000000000000000000000
55
env AGE_KEYSERVER_URL=http://localhost:13894
66
env AGE_KEYSERVER_HMAC_FILE=$WORK/hmac.txt
77
env LOG_KEY=PRIVATE+KEY+example.com+5800330c+AaAoObvamoDOmN6c30Xh9pH1e/xqKcsU+fNmthQ8qmvM
8+
env VRF_KEY=vni5C6++aVMFR5tg3bwvLamWlhJEmVrtNT7uNeyo6gQ=
89
env AGE_KEYSERVER_PUBKEY=example.com+5800330c+ARPRGiaIwfx6xka5nXhdD/rqojPMjrjhm7OCuy+03Ymz
10+
env AGE_KEYSERVER_VRFKEY=cmJCh5QTwp9VqN+QVV+BRxKLKmCFRuVAx+dahotxqw0=
911
exec age-keyserver -db=$WORK/test.sqlite3 -listen=localhost:13894 &srv&
1012
waitfor http://localhost:13894/
1113

‎go.mod‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ go 1.24.0
44

55
require (
66
filippo.io/age v1.2.1
7+
filippo.io/mostly-harmless/vrf-r255 v0.0.0-20251110151915-f587ba8b0f82
78
github.com/cheggaaa/pb/v3 v3.1.5
89
github.com/rogpeppe/go-internal v1.14.1
910
github.com/transparency-dev/tessera v1.0.1
@@ -17,6 +18,7 @@ require (
1718
)
1819

1920
require (
21+
filippo.io/edwards25519 v1.1.0 // indirect
2022
github.com/VividCortex/ewma v1.2.0 // indirect
2123
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
2224
github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -25,6 +27,7 @@ require (
2527
github.com/go-logr/logr v1.4.3 // indirect
2628
github.com/go-logr/stdr v1.2.2 // indirect
2729
github.com/google/uuid v1.6.0 // indirect
30+
github.com/gtank/ristretto255 v0.2.0 // indirect
2831
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
2932
github.com/klauspost/cpuid/v2 v2.0.9 // indirect
3033
github.com/mattn/go-colorable v0.1.13 // indirect

‎go.sum‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3I
22
c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
33
filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
44
filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
5+
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
6+
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
7+
filippo.io/mostly-harmless/vrf-r255 v0.0.0-20251110151915-f587ba8b0f82 h1:ZYps1vXve+JFo/XxLG8bCg2zIL5pn5nys5e+GnbD7nc=
8+
filippo.io/mostly-harmless/vrf-r255 v0.0.0-20251110151915-f587ba8b0f82/go.mod h1:ac5Gah0LmA0/YD4SHdO2M+WUjScWsc99zrAfJK4QViY=
59
github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
610
github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
711
github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
@@ -25,6 +29,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
2529
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
2630
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
2731
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
32+
github.com/gtank/ristretto255 v0.2.0 h1:LeOuWr6giplWkkMizx2emfG03SRPJqKt1nfIHLVHQ/0=
33+
github.com/gtank/ristretto255 v0.2.0/go.mod h1:OJ1ox/dWcp7sJ5grYDcZ+kkHYuj5nelW5aaL7ESVXBw=
2834
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
2935
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
3036
github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

0 commit comments

Comments
 (0)