DateKeys/scripts/recovery/main_test.go

package main

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"go/parser"
	"go/token"
	"io"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"testing"

	"filippo.io/age"
	bls "github.com/drand/kyber-bls12381"
)

const (
	fixturesDir = "../../testdata/fixtures"
	releasesDir = "../../testdata/releases"
	vectorsDir  = "../../testdata/vectors"
)

type fixtureRecord struct {
	Format  int `json:"format"`
	Release struct {
		Round     uint64 `json:"round"`
		Signature string `json:"signature"`
	} `json:"release"`
	PayloadLength   uint64 `json:"payload_length"`
	PlaintextFile   string `json:"plaintext_file"`
	PlaintextSHA256 string `json:"plaintext_sha256"`
	AccessKeyFile   string `json:"access_key_file"`
	WordsText       string `json:"words_text"`
	Files           []struct {
		Path   string `json:"path"`
		Size   uint64 `json:"size"`
		SHA256 string `json:"sha256"`
	} `json:"files"`
}

func readJSON(t *testing.T, path string, v any) {
	t.Helper()
	b, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(b, v); err != nil {
		t.Fatalf("%s: %v", path, err)
	}
}

func unhex(t *testing.T, s string) []byte {
	t.Helper()
	b, err := hex.DecodeString(s)
	if err != nil {
		t.Fatal(err)
	}
	return b
}

// A tiny deterministic CBOR encoder, enough for a release object.
func cborHead(major byte, n uint64) []byte {
	switch {
	case n < 24:
		return []byte{major<<5 | byte(n)}
	case n < 1<<8:
		return []byte{major<<5 | 24, byte(n)}
	case n < 1<<16:
		return []byte{major<<5 | 25, byte(n >> 8), byte(n)}
	case n < 1<<32:
		return []byte{major<<5 | 26, byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)}
	}
	return []byte{major<<5 | 27, byte(n >> 56), byte(n >> 48), byte(n >> 40), byte(n >> 32),
		byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)}
}

func encodeRelease(chainHash []byte, round uint64, sig []byte) []byte {
	var b []byte
	b = append(b, cborHead(5, 5)...)
	b = append(b, cborHead(0, 0)...)
	b = append(b, cborHead(3, 16)...)
	b = append(b, "datekeys-release"...)
	b = append(b, cborHead(0, 1)...)
	b = append(b, cborHead(0, 1)...)
	b = append(b, cborHead(0, 2)...)
	b = append(b, cborHead(2, uint64(len(chainHash)))...)
	b = append(b, chainHash...)
	b = append(b, cborHead(0, 3)...)
	b = append(b, cborHead(0, round)...)
	b = append(b, cborHead(0, 4)...)
	b = append(b, cborHead(2, uint64(len(sig)))...)
	b = append(b, sig...)
	return b
}

// committedRelease reads testdata/releases/<round>.cbor and checks that it is
// the release object built here from the fixture record.
func committedRelease(t *testing.T, round uint64, sigHex string) []byte {
	t.Helper()
	want := encodeRelease(unhex(t, quicknetChainHash), round, unhex(t, sigHex))
	path := filepath.Join(releasesDir, strconv.FormatUint(round, 10)+".cbor")
	got, err := os.ReadFile(path)
	if err != nil {
		t.Fatalf("the committed release is missing: %v", err)
	}
	if !bytes.Equal(got, want) {
		t.Fatalf("%s:\n got %x\nwant %x", path, got, want)
	}
	return got
}

func loadFixture(t *testing.T, name string) (fixtureRecord, []byte, []byte, []byte) {
	t.Helper()
	var rec fixtureRecord
	readJSON(t, filepath.Join(fixturesDir, name+".json"), &rec)
	dkc, err := os.ReadFile(filepath.Join(fixturesDir, name+".dkc"))
	if err != nil {
		t.Fatal(err)
	}
	var dkk []byte
	if rec.AccessKeyFile != "" {
		if dkk, err = os.ReadFile(filepath.Join(fixturesDir, rec.AccessKeyFile)); err != nil {
			t.Fatal(err)
		}
	}
	return rec, dkc, committedRelease(t, rec.Release.Round, rec.Release.Signature), dkk
}

func TestRecoverFixtures(t *testing.T) {
	for _, name := range []string{
		"format3_single",
		"format3_time_and_key_portable",
		"format3_tree",
		"format3_signed",
		"format3_time_and_key_words", // opened with its words (annex 79.7)
		"format3_full_chunk",         // PAYLOAD_AGE ends in a full chunk (79.5)
		"format2_time_only",          // two STREAM chunks
		"format2_time_and_key_portable",
		"format2_time_and_key_sixteen", // round 2000; no .dkk, so only its release is checked below
		"time_only",
		"time_and_key_portable",
	} {
		t.Run(name, func(t *testing.T) {
			rec, dkc, relObj, dkk := loadFixture(t, name)
			if name == "format2_time_and_key_sixteen" {
				_, err := recoverCapsule(dkc, relObj, credential{}, io.Discard)
				if err == nil || !strings.Contains(err.Error(), "needs its .dkk") {
					t.Fatalf("got %v, want the .dkk to be required", err)
				}
				return
			}
			key := credential{dkk: dkk}
			if rec.WordsText != "" {
				key.words = &rec.WordsText
			}
			res, err := recoverCapsule(dkc, relObj, key, io.Discard)
			if err != nil {
				t.Fatal(err)
			}
			want, err := os.ReadFile(filepath.Join(fixturesDir, rec.PlaintextFile))
			if err != nil {
				t.Fatal(err)
			}
			if !bytes.Equal(res.content, want) {
				t.Fatalf("content differs from %s", rec.PlaintextFile)
			}
			if res.format != rec.Format || uint64(len(res.content)) != rec.PayloadLength {
				t.Fatalf("format %d, L %d; want %d, %d", res.format, len(res.content), rec.Format, rec.PayloadLength)
			}
			if res.format != 3 {
				return
			}
			if len(res.body.files) != len(rec.Files) {
				t.Fatalf("%d files, want %d", len(res.body.files), len(rec.Files))
			}
			dir := t.TempDir()
			if err := writeFiles(dir, res.body, io.Discard); err != nil {
				t.Fatal(err)
			}
			for i, f := range rec.Files {
				if res.body.files[i].path != f.Path {
					t.Fatalf("file %d is %q, want %q", i, res.body.files[i].path, f.Path)
				}
				b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(f.Path)))
				if err != nil {
					t.Fatal(err)
				}
				sum := sha256.Sum256(b)
				if hex.EncodeToString(sum[:]) != f.SHA256 || uint64(len(b)) != f.Size {
					t.Fatalf("%s: written file differs from the record", f.Path)
				}
			}
		})
	}
}

func TestRun(t *testing.T) {
	dir := t.TempDir()
	out, bodyFile := filepath.Join(dir, "out"), filepath.Join(dir, "body")
	args := []string{
		"-dkc", filepath.Join(fixturesDir, "format3_time_and_key_portable.dkc"),
		"-release", filepath.Join(releasesDir, "1000.cbor"),
		"-dkk", filepath.Join(fixturesDir, "format3_time_and_key_portable.dkk"),
		"-out", out, "-body", bodyFile,
	}
	var log bytes.Buffer
	if err := run(args, &log); err != nil {
		t.Fatalf("%v\n%s", err, log.String())
	}
	got, _ := os.ReadFile(bodyFile)
	want, _ := os.ReadFile(filepath.Join(fixturesDir, "format3_time_and_key_portable.plaintext"))
	if !bytes.Equal(got, want) {
		t.Fatal("-body differs from the plaintext fixture")
	}
	if _, err := os.Stat(filepath.Join(out, "secreto.txt")); err != nil {
		t.Fatal(err)
	}
}

func TestBadReleases(t *testing.T) {
	var single, other fixtureRecord
	readJSON(t, filepath.Join(fixturesDir, "format3_single.json"), &single)
	readJSON(t, filepath.Join(fixturesDir, "empty_payload.json"), &other) // round 1001
	dkc, err := os.ReadFile(filepath.Join(fixturesDir, "format3_single.dkc"))
	if err != nil {
		t.Fatal(err)
	}
	chain := unhex(t, quicknetChainHash)
	wrongChain := bytes.Clone(chain)
	wrongChain[0] ^= 1
	sig, otherSig := unhex(t, single.Release.Signature), unhex(t, other.Release.Signature)

	for _, tc := range []struct {
		name, want string
		relObj     []byte
	}{
		{"wrong chain_hash", "not Quicknet's", encodeRelease(wrongChain, 1000, sig)},
		{"release of another round", "needs round 1000", encodeRelease(chain, other.Release.Round, otherSig)},
		{"signature of another round", "does not verify", encodeRelease(chain, 1000, otherSig)},
		{"wrong type tag", "type tag", bytes.Replace(encodeRelease(chain, 1000, sig), []byte("release"), []byte("relaxed"), 1)},
	} {
		t.Run(tc.name, func(t *testing.T) {
			_, err := recoverCapsule(dkc, tc.relObj, credential{}, io.Discard)
			if err == nil || !strings.Contains(err.Error(), tc.want) {
				t.Fatalf("got %v, want an error with %q", err, tc.want)
			}
		})
	}
}

// TestTlockVectors checks steps 10 and 11 value by value against
// testdata/vectors/tlock_steps.json and the GT serialization against
// tlock_ibe.json.
func TestTlockVectors(t *testing.T) {
	var ibe struct {
		Vectors []struct{ G1, G2, GT, H2 string }
	}
	readJSON(t, filepath.Join(vectorsDir, "tlock_ibe.json"), &ibe)
	for _, v := range ibe.Vectors {
		g1, g2 := bls.NullKyberG1(), bls.NullKyberG2()
		if err := decodePoint(g1, unhex(t, v.G1), 48, "g1"); err != nil {
			t.Fatal(err)
		}
		if err := decodePoint(g2, unhex(t, v.G2), 96, "g2"); err != nil {
			t.Fatal(err)
		}
		if !g1.Equal(bls.NullKyberG1().Base()) || !g2.Equal(bls.NullKyberG2().Base()) {
			t.Fatal("vector points are not the generators")
		}
		gt := suite.Pair(g1, g2)
		raw, _ := gt.MarshalBinary()
		if hex.EncodeToString(raw) != v.GT {
			t.Fatal("GT serialization differs")
		}
		if h, _ := h2(gt); hex.EncodeToString(h) != v.H2 {
			t.Fatalf("H2 = %x, want %s", h, v.H2)
		}
	}

	var steps struct {
		ChainHash string `json:"chain_hash"`
		PublicKey string `json:"public_key"`
		DST       string `json:"dst"`
		Vectors   []struct {
			Round                           uint64
			Signature, Message              string
			HashToG1                        string `json:"hash_to_g1"`
			Body, Pairing, H2, Sigma, H4, R string
			FileKey                         string `json:"file_key"`
		}
	}
	readJSON(t, filepath.Join(vectorsDir, "tlock_steps.json"), &steps)
	if steps.ChainHash != quicknetChainHash || steps.PublicKey != quicknetPublicKey || steps.DST != quicknetDST {
		t.Fatal("pinned parameters differ from the vectors")
	}
	for _, v := range steps.Vectors {
		if hex.EncodeToString(roundMessage(v.Round)) != v.Message {
			t.Fatalf("round %d: M differs", v.Round)
		}
		hm, _ := hashToG1(roundMessage(v.Round)).MarshalBinary()
		if hex.EncodeToString(hm) != v.HashToG1 {
			t.Fatalf("round %d: H(M) differs", v.Round)
		}
		sig, err := verifyRelease(release{round: v.Round, signature: unhex(t, v.Signature)})
		if err != nil {
			t.Fatal(err)
		}
		body := unhex(t, v.Body)
		u := bls.NullKyberG2()
		if err := decodePoint(u, body[:96], 96, "U"); err != nil {
			t.Fatal(err)
		}
		gt := suite.Pair(sig, u)
		raw, _ := gt.MarshalBinary()
		mask, _ := h2(gt)
		sigma := xor(body[96:112], mask)
		r, err := h3(sigma, xor(body[112:], h4(sigma)))
		if err != nil {
			t.Fatal(err)
		}
		fk, err := unwrapTlock(body, sig)
		if err != nil {
			t.Fatal(err)
		}
		for _, c := range []struct{ name, got, want string }{
			{"pairing", hex.EncodeToString(raw), v.Pairing},
			{"H2", hex.EncodeToString(mask), v.H2},
			{"sigma", hex.EncodeToString(sigma), v.Sigma},
			{"H4", hex.EncodeToString(h4(sigma)), v.H4},
			{"r", hex.EncodeToString(r.FillBytes(make([]byte, 32))), v.R},
			{"file key", hex.EncodeToString(fk), v.FileKey},
		} {
			if c.got != c.want {
				t.Fatalf("round %d: %s = %s, want %s", v.Round, c.name, c.got, c.want)
			}
		}
	}
}

func TestPinnedRoundTime(t *testing.T) {
	// format3_single.json: round 1000 unlocks at 2023-08-23T15:59:24Z.
	if got := roundTime(1000).Format("2006-01-02T15:04:05Z"); got != "2023-08-23T15:59:24Z" {
		t.Fatal(got)
	}
}

// TestAgeSecretKey checks the Bech32 encoder against age's own.
func TestAgeSecretKey(t *testing.T) {
	var rec struct {
		AccessMaterial string `json:"access_material"`
	}
	readJSON(t, filepath.Join(fixturesDir, "format3_time_and_key_portable.dkk.json"), &rec)
	key := ageSecretKey(unhex(t, rec.AccessMaterial))
	got, err := age.ParseX25519Identity(key)
	if err != nil {
		t.Fatal(err)
	}
	if got.String() != key {
		t.Fatalf("age re-encodes %s as %s", key, got.String())
	}
}

func TestStreamEdges(t *testing.T) {
	if _, err := streamDecrypt(make([]byte, 32), nil); err == nil {
		t.Fatal("an empty STREAM must fail")
	}
}

// TestTampered flips one byte in each part of a capsule: the tlock U, the
// sealed age payload and PAYLOAD_AGE must each make the recovery fail.
func TestTampered(t *testing.T) {
	var rec fixtureRecord
	readJSON(t, filepath.Join(fixturesDir, "format3_single.json"), &rec)
	dkc, err := os.ReadFile(filepath.Join(fixturesDir, "format3_single.dkc"))
	if err != nil {
		t.Fatal(err)
	}
	relObj := encodeRelease(unhex(t, quicknetChainHash), rec.Release.Round, unhex(t, rec.Release.Signature))
	sealedEnd := 16 + 0x79 + 0x1ca // PUBLIC_HEADER_LEN and SEALED_CONTROL_LEN of its prelude
	stanza := bytes.Index(dkc, []byte("-> tlock"))
	body := stanza + bytes.IndexByte(dkc[stanza:], '\n') + 1
	for _, tc := range []struct {
		name string
		at   int
	}{
		{"tlock U", body + 10},
		{"sealed control STREAM", sealedEnd - 1},
		{"PAYLOAD_AGE STREAM", len(dkc) - 1},
	} {
		t.Run(tc.name, func(t *testing.T) {
			bad := bytes.Clone(dkc)
			bad[tc.at] ^= 0x01
			if _, err := recoverCapsule(bad, relObj, credential{}, io.Discard); err == nil {
				t.Fatal("a tampered capsule opened")
			}
		})
	}
}

// TestImports keeps the program independent of DateKeys and of the drand
// tools: only the standard library, age, kyber and x/crypto.
func TestImports(t *testing.T) {
	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, parser.ImportsOnly)
	if err != nil {
		t.Fatal(err)
	}
	var errs []error
	for _, imp := range f.Imports {
		p, _ := strconv.Unquote(imp.Path.Value)
		for _, banned := range []string{"g.activething.com/go/DateKeys", "github.com/drand/tlock", "github.com/drand/drand"} {
			if strings.HasPrefix(p, banned) {
				errs = append(errs, errors.New("forbidden import "+p))
			}
		}
	}
	if err := errors.Join(errs...); err != nil {
		t.Fatal(err)
	}
}