cmd/age-keyserver: add transparency log of stored keys

Author: FiloSottile

cmd/age-keylookup/main.go

@@ -1,30 +1,40 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"os"
+	"strings"
 	"time"
+
+	"filippo.io/torchwood"
+	"golang.org/x/mod/sumdb/note"
+	"golang.org/x/mod/sumdb/tlog"
 )
 
 func main() {
+	allFlag := flag.Bool("all", false, "list all public keys in the transparency log")
 	flag.Parse()
 
 	if flag.NArg() != 1 {
-		fmt.Fprintf(os.Stderr, "Usage: age-keylookup <email>\n")
+		fmt.Fprintf(os.Stderr, "Usage: age-keylookup [-all] <email>\n")
 		fmt.Fprintf(os.Stderr, "\n")
 		fmt.Fprintf(os.Stderr, "Look up an age public key by email address.\n")
 		fmt.Fprintf(os.Stderr, "\n")
+		fmt.Fprintf(os.Stderr, "With -all, it enumerates all public keys in the transparency log.\n")
+		fmt.Fprintf(os.Stderr, "\n")
 		fmt.Fprintf(os.Stderr, "Example:\n")
 		fmt.Fprintf(os.Stderr, "  age-keylookup filippo@example.com\n")
 		fmt.Fprintf(os.Stderr, "  age -r $(age-keylookup filippo@example.com) -o secret.txt.age secret.txt\n")
 		fmt.Fprintf(os.Stderr, "\n")
 		fmt.Fprintf(os.Stderr, "Environment:\n")
 		fmt.Fprintf(os.Stderr, "  AGE_KEYSERVER_URL     Default keyserver URL\n")
+		fmt.Fprintf(os.Stderr, "  AGE_KEYSERVER_PUBKEY  Default keyserver transparency log vkey\n")
 		os.Exit(2)
 	}
 
@@ -36,7 +46,32 @@ func main() {
 		server = "https://keyserver.geomys.org"
 	}
 
-	pubkey, err := lookupKey(server, email)
+	vkey := os.Getenv("AGE_KEYSERVER_PUBKEY")
+	if vkey == "" {
+		vkey = "keyserver.geomys.org+be45b77c+Ae58So8awYbwaF+V98htpY0xXlRcjhNuL5Ucrq9en2yp"
+	}
+	v, err := note.NewVerifier(vkey)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: invalid keyserver public key: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Normalize email
+	email = strings.TrimSpace(strings.ToLower(email))
+
+	if *allFlag {
+		pubkeys, err := monitorLog(server, v, email)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+			os.Exit(1)
+		}
+		for _, pk := range pubkeys {
+			fmt.Println(pk)
+		}
+		return
+	}
+
+	pubkey, err := lookupKey(server, v, email)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
@@ -45,7 +80,7 @@ func main() {
 	fmt.Println(pubkey)
 }
 
-func lookupKey(serverURL, email string) (string, error) {
+func lookupKey(serverURL string, v note.Verifier, email string) (string, error) {
 	// Build the lookup URL
 	lookupURL := serverURL + "/api/lookup?email=" + url.QueryEscape(email)
 
@@ -75,6 +110,7 @@ func lookupKey(serverURL, email string) (string, error) {
 	var result struct {
 		Email  string `json:"email"`
 		Pubkey string `json:"pubkey"`
+		Proof  string `json:"proof"`
 	}
 
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
@@ -88,5 +124,59 @@ func lookupKey(serverURL, email string) (string, error) {
 		return "", fmt.Errorf("empty public key returned")
 	}
 
+	// Verify spicy signature
+	entry := fmt.Appendf(nil, "%s\n%s\n", result.Email, result.Pubkey)
+	if err := torchwood.VerifyProof(v.Name(), func(b []byte) (*note.Note, error) {
+		return note.Open(b, note.VerifierList(v))
+	}, tlog.RecordHash(entry), []byte(result.Proof)); err != nil {
+		return "", fmt.Errorf("failed to verify key proof: %w", err)
+	}
+
 	return result.Pubkey, nil
 }
+
+func monitorLog(serverURL string, v note.Verifier, email string) ([]string, error) {
+	f, err := torchwood.NewTileFetcher(serverURL+"/tlog", torchwood.WithUserAgent("age-keylookup/1.0"))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create tile fetcher: %w", err)
+	}
+	c, err := torchwood.NewClient(f)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create torchwood client: %w", err)
+	}
+
+	// Fetch and verify checkpoint
+	signedCheckpoint, err := f.ReadEndpoint(context.Background(), "checkpoint")
+	if err != nil {
+		return nil, fmt.Errorf("failed to read checkpoint: %w", err)
+	}
+	n, err := note.Open(signedCheckpoint, note.VerifierList(v))
+	if err != nil {
+		return nil, fmt.Errorf("failed to verify checkpoint: %w", err)
+	}
+	checkpoint, err := torchwood.ParseCheckpoint(n.Text)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse checkpoint: %w", err)
+	}
+
+	// Fetch all entries up to the checkpoint size
+	var pubkeys []string
+	for i, entry := range c.AllEntries(context.Background(), checkpoint.Tree, 0) {
+		e, rest, ok := strings.Cut(string(entry), "\n")
+		if !ok {
+			return nil, fmt.Errorf("malformed log entry %d: %q", i, string(entry))
+		}
+		k, rest, ok := strings.Cut(rest, "\n")
+		if !ok || rest != "" {
+			return nil, fmt.Errorf("malformed log entry %d: %q", i, string(entry))
+		}
+		if e == email {
+			pubkeys = append(pubkeys, k)
+		}
+	}
+	if c.Err() != nil {
+		return nil, fmt.Errorf("error fetching log entries: %w", c.Err())
+	}
+
+	return pubkeys, nil
+}

cmd/age-keyserver-keygen/keygen.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"crypto/rand"
+	"fmt"
+	"os"
+
+	"golang.org/x/mod/sumdb/note"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintf(os.Stderr, "Usage: %s <origin>\n", os.Args[0])
+		os.Exit(1)
+	}
+	origin := os.Args[1]
+
+	skey, vkey, err := note.GenerateKey(rand.Reader, origin)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error generating keys: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("Private key (for LOG_KEY in age-keyserver): %s\n", skey)
+	fmt.Printf("Public key (for AGE_KEYSERVER_PUBKEY in age-keylookup): %s\n", vkey)
+}

cmd/age-keyserver/main.go

@@ -24,6 +24,12 @@ import (
 	"time"
 
 	"filippo.io/age"
+	"filippo.io/torchwood"
+	"filippo.io/torchwood/tesserax"
+	"github.com/transparency-dev/tessera"
+	"github.com/transparency-dev/tessera/storage/posix"
+	"golang.org/x/mod/sumdb/note"
+	"golang.org/x/mod/sumdb/tlog"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 	"zombiezen.com/go/sqlite"
@@ -35,6 +41,7 @@ var (
 	embeddedFS embed.FS
 
 	dbPath     = flag.String("db", "keyserver.sqlite3", "path to SQLite database")
+	logPath    = flag.String("logdir", "keyserver-tlog", "directory for transparency log")
 	listenAddr = flag.String("listen", "localhost:13889", "address to listen on")
 )
 
@@ -43,11 +50,16 @@ type Server struct {
 	templates *template.Template
 	hmacKey   []byte
 	baseURL   string
+	reader    tessera.LogReader
+	appender  *tessera.Appender
+	awaiter   *tessera.PublicationAwaiter
+	verifier  note.Verifier
 }
 
 type KeyData struct {
 	Pubkey    string `json:"pubkey"`
 	UpdatedAt int64  `json:"updated_at"`
+	LogIndex  int64  `json:"log_index"`
 }
 
 const (
@@ -61,6 +73,33 @@ const (
 
 func main() {
 	flag.Parse()
+	ctx := context.Background()
+
+	s, err := note.NewSigner(os.Getenv("LOG_KEY"))
+	if err != nil {
+		log.Fatalln("failed to create checkpoint signer:", err)
+	}
+	verifier, err := torchwood.NewVerifierFromSigner(os.Getenv("LOG_KEY"))
+	if err != nil {
+		log.Fatalln("failed to create checkpoint verifier:", err)
+	}
+
+	driver, err := posix.New(ctx, posix.Config{
+		Path: *logPath,
+	})
+	if err != nil {
+		log.Fatalln("failed to create log storage driver:", err)
+	}
+
+	appender, shutdown, logReader, err := tessera.NewAppender(ctx, driver, tessera.NewAppendOptions().
+		WithCheckpointSigner(s).
+		WithBatching(256, 250*time.Millisecond).
+		WithCheckpointInterval(1*time.Second))
+	if err != nil {
+		log.Fatalln("failed to create log appender:", err)
+	}
+	defer shutdown(context.Background())
+	awaiter := tessera.NewPublicationAwaiter(ctx, logReader.ReadCheckpoint, 250*time.Millisecond)
 
 	// Check for development vs production mode
 	postmarkToken := os.Getenv("POSTMARK_TOKEN")
@@ -111,6 +150,10 @@ func main() {
 		templates: templates,
 		hmacKey:   hmacKey,
 		baseURL:   baseURL,
+		reader:    logReader,
+		appender:  appender,
+		awaiter:   awaiter,
+		verifier:  verifier,
 	}
 
 	// Set up routes
@@ -129,6 +172,10 @@ func main() {
 	}
 	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))
 
+	// Serve tlog-tiles log
+	fs := http.StripPrefix("/tlog/", http.FileServer(http.Dir(*logPath)))
+	mux.Handle("GET /tlog/", fs)
+
 	// Start server with h2c support
 	log.Println("")
 	log.Printf("Starting age Keyserver on %s", *listenAddr)
@@ -183,6 +230,14 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Email is required", http.StatusBadRequest)
 		return
 	}
+	// Emails are technically case sensitive, but users are unlikely to monitor
+	// all case variations, so we normalize to lowercase. We do ti before
+	// sending the logic link, so normalization can't lead to impersonation.
+	email = strings.ToLower(email)
+	if strings.ContainsAny(email, "\n") {
+		http.Error(w, "Invalid email format", http.StatusBadRequest)
+		return
+	}
 
 	// Verify captcha
 	if !verifyCaptcha(captchaResponse) {
@@ -276,18 +331,37 @@ func (s *Server) handleSetKey(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Validate age public key
+	var proof string
 	if pubkey != "" {
 		if _, err := age.ParseX25519Recipient(pubkey); err != nil {
 			http.Error(w, "Invalid age public key format", http.StatusBadRequest)
 			return
 		}
 
+		// Add to transparency log
+		entry := tessera.NewEntry(fmt.Appendf(nil, "%s\n%s\n", email, pubkey))
+		index, _, err := s.awaiter.Await(r.Context(), s.appender.Add(r.Context(), entry))
+		if err != nil {
+			http.Error(w, "Failed to add to transparency log", http.StatusInternalServerError)
+			log.Printf("transparency log error: %v", err)
+			return
+		}
+
 		// Store in database
-		if err := s.storeKey(email, pubkey); err != nil {
+		if err := s.storeKey(email, pubkey, int64(index.Index)); err != nil {
 			http.Error(w, "Failed to store key", http.StatusInternalServerError)
 			log.Printf("database error: %v", err)
 			return
 		}
+
+		// Generate proof for success page
+		proofBytes, err := s.makeSpicySignature(r.Context(), int64(index.Index))
+		if err != nil {
+			http.Error(w, "Failed to create proof", http.StatusInternalServerError)
+			log.Printf("proof error: %v", err)
+			return
+		}
+		proof = string(proofBytes)
 	} else {
 		// Delete key
 		if err := s.deleteKey(email); err != nil {
@@ -301,6 +375,7 @@ func (s *Server) handleSetKey(w http.ResponseWriter, r *http.Request) {
 	if err := s.templates.ExecuteTemplate(w, "success.html", map[string]string{
 		"Email":  email,
 		"Pubkey": pubkey,
+		"Proof":  proof,
 	}); err != nil {
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		log.Printf("template error: %v", err)
@@ -325,14 +400,43 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	proof, err := s.makeSpicySignature(r.Context(), data.LogIndex)
+	if err != nil {
+		http.Error(w, "Failed to create proof", http.StatusInternalServerError)
+		log.Printf("proof error: %v", err)
+		return
+	}
+
 	// Return as JSON
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{
 		"email":  email,
 		"pubkey": data.Pubkey,
+		"proof":  string(proof),
 	})
 }
 
+func (s *Server) makeSpicySignature(ctx context.Context, index int64) ([]byte, error) {
+	checkpoint, err := s.reader.ReadCheckpoint(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read checkpoint: %v", err)
+	}
+	n, err := note.Open(checkpoint, note.VerifierList(s.verifier))
+	if err != nil {
+		return nil, fmt.Errorf("failed to open checkpoint note: %v", err)
+	}
+	c, err := torchwood.ParseCheckpoint(n.Text)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse checkpoint: %v", err)
+	}
+	p, err := tlog.ProveRecord(c.N, index, torchwood.TileHashReaderWithContext(
+		ctx, c.Tree, tesserax.NewTileReader(s.reader)))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create proof: %v", err)
+	}
+	return torchwood.FormatProof(index, p, checkpoint), nil
+}
+
 func (s *Server) generateHMAC(email string, ts int64) string {
 	msg := fmt.Sprintf("%s:%d", email, ts)
 	h := hmac.New(sha256.New, s.hmacKey)
@@ -403,10 +507,11 @@ func (s *Server) getKeyData(email string) (*KeyData, error) {
 	return &data, nil
 }
 
-func (s *Server) storeKey(email, pubkey string) error {
+func (s *Server) storeKey(email, pubkey string, index int64) error {
 	data := KeyData{
 		Pubkey:    pubkey,
 		UpdatedAt: time.Now().Unix(),
+		LogIndex:  index,
 	}
 
 	jsonData, err := json.Marshal(data)