Skip to content

Commit b3f7469

Browse files
emostovemostov
committed
Add Quorum Key Resharding Service
wip wip get to compile Initial reshard provision and unit test code clean up fix n choose k refactor n choose k Finish tests for reshard add test for boot reshard Add generate reshard input wip wip wip wip Get reshard-renencrypt working Get post share working lint wip Build get reshard output Add new secrets for file key get full thing working e2e refactor wip get qos core to compile Get all of qos core working refactor to not use quorumpubkey wrapper wip Get e2e tests working with new input Add logic for checking that e2e share recombination works finish integration test lint stuff Improve human verifiactions clean up
1 parent f929829 commit b3f7469

38 files changed

+2475
-106
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ target/
2020
!src/integration/mock/boot-e2e/all-personal-dir/user2-dir/*
2121
!src/integration/mock/boot-e2e/all-personal-dir/user3-dir/*
2222
!src/integration/mock/boot-e2e/genesis-dir/*
23+
!src/integration/mock/new-share-set-secrets/*
2324
src/integration/mock/pivot-build-fingerprints.txt
2425
src/integration/pivot_ok2_works
2526
src/integration/pivot_ok_works

‎src/Cargo.lock

+2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/integration/Cargo.toml

+1
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,4 @@ aws-nitro-enclaves-nsm-api = { version = "0.3", default-features = false }
2525
rand = "0.8"
2626
ureq = { version = "2.9", features = ["json"], default-features = false }
2727
serde = { version = "1", features = ["derive"] }
28+
serde_json = "1.0"

‎src/integration/mock/keys/new-share-set/quorum_threshold

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3

‎src/integration/mock/keys/new-share-set/reshard-1.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
040ee9045f3718bd1345dccf88693c993626d08448fdeba8ecaf1b867f4d0572d439852ef460963a9e8fab08864a55994c0779216b44a165b4eaced98722ed3778041646e59014eaec046b2636d3943f446282363c26cf995320d5944b8b4d7af0aa588c208c13ded5c86c3e9a31af687c4027d4636173f405503e7b1baeeee7eaa5

‎src/integration/mock/keys/new-share-set/reshard-2.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
04c82672b2f8c4d520c5c7cda207b4a05f433e4db7f0daed9bbde6f54d42814af5aeabec191d2dda32ba4cdc6616aa3fda0a6711affa0d42efbe11144043028622044810d6d24626abfe6c31e884e674c870a2197c9e9cd80786b2fd3a087e2c38cad8376d9b7086901915d261ecb92bde5a757d27bbf1a20904120ff079b8a8ef71

‎src/integration/mock/keys/new-share-set/reshard-3.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
049872acc56bca90eea07e1e1185e3015be3b7295b4ba484299702489bf4858b1374928b335d3405a16221ec240e80817fbfd783c7052446a31bd1821a9a10ff9c0469361a228e22e7cad34774a50f7cd8f97e7d6542f3903bf9d14647302691ef9195ae2c08ec62dcd0e845bc75e94ef8b9fa45925199a2f7d94d00981d6d2e0d85

‎src/integration/mock/keys/new-share-set/reshard-4.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0442993076a3b8345cb58b860477bce9db21bb6caceae8df298860410594ea08d4fc2ffec944fd7623a893b57037e0f20c44ff8eee6eff03110717efb9269181ed04bb495296212027597e2eb93ffbba07f0c41ae3018409b9ad2177e87b53a2729806f52ad6d0f6399ca3d37edddc81a687cd2a0a9f8aab914d76be2930ff8f5bba

‎src/integration/mock/new-share-set-secrets/reshard-1.secret

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
60dd1d44decfa12be68c49abdb47b02c7d03e63de8f6d61ac7d9c4a59e2bf381

‎src/integration/mock/new-share-set-secrets/reshard-2.secret

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1b28ba3a047709e4bac8f5911bd213dbeca7b7023a702ea5333837a80c2ed170

‎src/integration/mock/new-share-set-secrets/reshard-3.secret

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
f37186894abb1f45ce0eb5b24b5184334d7d85278037d28af11423f50043d83b

‎src/integration/mock/new-share-set-secrets/reshard-4.secret

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ccb796f57e4a5f52f2ebd81af50a7c98d7576b5503b5dddc337e67b6217d1fa3

‎src/integration/mock/reshard/user1/qkey1/quorum_key.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
04c9434ba0a681ee7c21e17c7ce4f668360803686b198774c9362dac090f9995eeb68961319370969bd0d657167d9cfce13a7466ec47aba9845fbfc4fe9277866d04043daa777f57c1ebef21ff3eb71e00a681921da56186ac96b5d3b06b645c88c512fe8072d12971ce1f9592ef6bafd98b4982f8cf73cb6e80c8f6424294e54c71

‎src/integration/mock/reshard/user2/qkey1/quorum_key.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
04c9434ba0a681ee7c21e17c7ce4f668360803686b198774c9362dac090f9995eeb68961319370969bd0d657167d9cfce13a7466ec47aba9845fbfc4fe9277866d04043daa777f57c1ebef21ff3eb71e00a681921da56186ac96b5d3b06b645c88c512fe8072d12971ce1f9592ef6bafd98b4982f8cf73cb6e80c8f6424294e54c71

‎src/integration/mock/reshard/user3/qkey1/quorum_key.pub

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
04c9434ba0a681ee7c21e17c7ce4f668360803686b198774c9362dac090f9995eeb68961319370969bd0d657167d9cfce13a7466ec47aba9845fbfc4fe9277866d04043daa777f57c1ebef21ff3eb71e00a681921da56186ac96b5d3b06b645c88c512fe8072d12971ce1f9592ef6bafd98b4982f8cf73cb6e80c8f6424294e54c71

‎src/integration/src/lib.rs

+2
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ pub const LOCAL_HOST: &str = "127.0.0.1";
3434
pub const PCR3: &str = "78fce75db17cd4e0a3fb8dad3ad128ca5e77edbb2b2c7f75329dccd99aa5f6ef4fc1f1a452e315b9e98f9e312e6921e6";
3535
/// QOS dist directory.
3636
pub const QOS_DIST_DIR: &str = "../../dist";
37+
/// Mock pcr3 pre-image.
38+
pub const PCR3_PRE_IMAGE_PATH: &str = "./mock/namespaces/pcr3-preimage.txt";
3739

3840
const MSG: &str = "msg";
3941

‎src/integration/tests/boot.rs

+9-9
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ use std::{
77

88
use borsh::de::BorshDeserialize;
99
use integration::{
10-
LOCAL_HOST, PIVOT_OK2_PATH, PIVOT_OK2_SUCCESS_FILE, QOS_DIST_DIR,
10+
LOCAL_HOST, PCR3_PRE_IMAGE_PATH, PIVOT_OK2_PATH, PIVOT_OK2_SUCCESS_FILE,
11+
QOS_DIST_DIR,
1112
};
1213
use qos_core::protocol::{
1314
services::{
@@ -51,7 +52,6 @@ async fn standard_boot_e2e() {
5152
let namespace = "quit-coding-to-vape";
5253

5354
let personal_dir = |user: &str| format!("{all_personal_dir}/{user}-dir");
54-
5555
let user1 = "user1";
5656
let user2 = "user2";
5757
let user3 = "user3";
@@ -81,7 +81,7 @@ async fn standard_boot_e2e() {
8181
"--qos-release-dir",
8282
QOS_DIST_DIR,
8383
"--pcr3-preimage-path",
84-
"./mock/namespaces/pcr3-preimage.txt",
84+
PCR3_PRE_IMAGE_PATH,
8585
"--manifest-path",
8686
&cli_manifest_path,
8787
"--pivot-args",
@@ -157,7 +157,7 @@ async fn standard_boot_e2e() {
157157
"--manifest-approvals-dir",
158158
&*boot_dir,
159159
"--pcr3-preimage-path",
160-
"./mock/namespaces/pcr3-preimage.txt",
160+
PCR3_PRE_IMAGE_PATH,
161161
"--pivot-hash-path",
162162
PIVOT_HASH_PATH,
163163
"--qos-release-dir",
@@ -306,7 +306,7 @@ async fn standard_boot_e2e() {
306306
"--host-ip",
307307
LOCAL_HOST,
308308
"--pcr3-preimage-path",
309-
"./mock/pcr3-preimage.txt",
309+
PCR3_PRE_IMAGE_PATH,
310310
"--unsafe-skip-attestation",
311311
])
312312
.spawn()
@@ -361,7 +361,7 @@ async fn standard_boot_e2e() {
361361
"--manifest-envelope-path",
362362
&manifest_envelope_path,
363363
"--pcr3-preimage-path",
364-
"./mock/namespaces/pcr3-preimage.txt",
364+
PCR3_PRE_IMAGE_PATH,
365365
"--manifest-set-dir",
366366
"./mock/keys/manifest-set",
367367
"--alias",
@@ -400,9 +400,9 @@ async fn standard_boot_e2e() {
400400
stdin.write_all("yes\n".as_bytes()).expect("Failed to write to stdin");
401401

402402
assert_eq!(
403-
&stdout.next().unwrap().unwrap(),
404-
"Does this AWS IAM role belong to the intended organization: arn:aws:iam::123456789012:role/Webserver? (yes/no)"
405-
);
403+
&stdout.next().unwrap().unwrap(),
404+
"Does this AWS IAM role belong to the intended organization: arn:aws:iam::123456789012:role/Webserver? (yes/no)"
405+
);
406406
stdin.write_all("yes\n".as_bytes()).expect("Failed to write to stdin");
407407

408408
assert_eq!(

‎src/integration/tests/genesis.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ use std::{
66
};
77

88
use borsh::de::BorshDeserialize;
9-
use integration::{LOCAL_HOST, QOS_DIST_DIR};
9+
use integration::{LOCAL_HOST, PCR3_PRE_IMAGE_PATH, QOS_DIST_DIR};
1010
use qos_core::protocol::services::genesis::GenesisOutput;
1111
use qos_crypto::{sha_512, shamir::shares_reconstruct};
1212
use qos_nsm::nitro::unsafe_attestation_doc_from_der;
@@ -153,7 +153,7 @@ async fn genesis_e2e() {
153153
"--qos-release-dir",
154154
QOS_DIST_DIR,
155155
"--pcr3-preimage-path",
156-
"./mock/pcr3-preimage.txt",
156+
PCR3_PRE_IMAGE_PATH,
157157
"--dr-key-path",
158158
DR_KEY_PUBLIC_PATH,
159159
"--unsafe-skip-attestation"
@@ -225,7 +225,7 @@ async fn genesis_e2e() {
225225
"--qos-release-dir",
226226
QOS_DIST_DIR,
227227
"--pcr3-preimage-path",
228-
"./mock/pcr3-preimage.txt",
228+
PCR3_PRE_IMAGE_PATH,
229229
"--unsafe-skip-attestation"
230230
])
231231
.spawn()

‎src/integration/tests/key.rs

+7-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
use std::{fs, process::Command};
22

3-
use integration::{LOCAL_HOST, PIVOT_LOOP_PATH, QOS_DIST_DIR};
3+
use integration::{
4+
LOCAL_HOST, PCR3_PRE_IMAGE_PATH, PIVOT_LOOP_PATH, QOS_DIST_DIR,
5+
};
46
use qos_crypto::sha_256;
57
use qos_p256::{P256Pair, P256Public};
68
use qos_test_primitives::{ChildWrapper, PathWrapper};
@@ -158,7 +160,7 @@ fn generate_manifest_envelope() {
158160
"--restart-policy",
159161
"always",
160162
"--pcr3-preimage-path",
161-
"./mock/namespaces/pcr3-preimage.txt",
163+
PCR3_PRE_IMAGE_PATH,
162164
"--pivot-hash-path",
163165
PIVOT_HASH_PATH,
164166
"--qos-release-dir",
@@ -196,7 +198,7 @@ fn generate_manifest_envelope() {
196198
"--manifest-approvals-dir",
197199
BOOT_DIR,
198200
"--pcr3-preimage-path",
199-
"./mock/namespaces/pcr3-preimage.txt",
201+
PCR3_PRE_IMAGE_PATH,
200202
"--pivot-hash-path",
201203
PIVOT_HASH_PATH,
202204
"--qos-release-dir",
@@ -293,7 +295,7 @@ fn boot_old_enclave(old_host_port: u16) -> (ChildWrapper, ChildWrapper) {
293295
"--host-ip",
294296
LOCAL_HOST,
295297
"--pcr3-preimage-path",
296-
"./mock/namespaces/pcr3-preimage.txt",
298+
PCR3_PRE_IMAGE_PATH,
297299
"--unsafe-skip-attestation",
298300
])
299301
.spawn()
@@ -343,7 +345,7 @@ fn boot_old_enclave(old_host_port: u16) -> (ChildWrapper, ChildWrapper) {
343345
"--manifest-envelope-path",
344346
MANIFEST_ENVELOPE_PATH,
345347
"--pcr3-preimage-path",
346-
"./mock/namespaces/pcr3-preimage.txt",
348+
PCR3_PRE_IMAGE_PATH,
347349
"--manifest-set-dir",
348350
"./mock/keys/manifest-set",
349351
"--alias",

0 commit comments

Comments
 (0)