feat: node signature verification for queries #784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

krpeacock merged 36 commits into main from kyle/SDK-1216-node-signature-verification

Nov 7, 2023

Contributor

krpeacock commented Oct 20, 2023 •

edited

Loading

Description

In order to defend against malicious boundary nodes, subnet nodes will sign query responses. An Agent should follow the Internet Computer specification to validate these signatures

Fixes SDK-1216

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.

Checklist:

My changes follow the guidelines in CONTRIBUTING.md.
The title of this PR complies with Conventional Commits.
I have edited the CHANGELOG accordingly.
I have made corresponding changes to the documentation.

krpeacock added 9 commits

October 3, 2023 10:46


          feat: adds node signatures to query response types

58aba0a


          verification wip

c6b21bf


          refactor using node keys and domain separator - still not working

55f3f88


          uncommenting status, more useful test case

72dd661


          trimming der prefix from pubkey

53a2658


          hash of map for reply

ecf5ef4


          reject status flow

2a10ed9


          moving fetchNodeKeys to canisterStatus

fa18735


          updating e2e tests

06f5845

krpeacock changed the title ~~Kyle/sdk 1216 node signature verification~~ feat: node signature verification for queries

Contributor

github-actions bot commented Oct 20, 2023 •

edited

Loading

size-limit report 📦

Path	Size
@dfinity/agent	98.18 KB (+10.97% 🔺)
@dfinity/candid	13.41 KB (-1.37% 🔽)
@dfinity/principal	5.01 KB (-3.68% 🔽)
@dfinity/auth-client	90.53 KB (-2.34% 🔽)
@dfinity/assets	91.07 KB (+0.27% 🔺)
@dfinity/identity	88.01 KB (-2.19% 🔽)
@dfinity/identity-secp256k1	249.41 KB (+6.68% 🔺)

krpeacock added 10 commits

October 20, 2023 16:44


          type safety

3d110e5


          mitm wip

cadc406


          e2e tests using vitest

95f8ad2


          fixing browser tests

5da9f94


          more test changes

831d951


          size limit

0379d81


          mitmdump

80bef81


          replaces tweetnacl with @noble/curves

f34e122


          more ed25519 tests and compatibility with previous stored JSON

a0f2ebd


          updating browser tests to use direct host

2e81ce2

Contributor Author

krpeacock commented Oct 24, 2023

oh thank god


          changelog

6969bbc

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Outdated Show resolved Hide resolved

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Show resolved Hide resolved

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Outdated Show resolved Hide resolved

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/canisterStatus/index.ts Outdated Show resolved Hide resolved

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/certificate.ts Show resolved Hide resolved

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Show resolved Hide resolved


          Merge branch 'main' into kyle/SDK-1216-node-signature-verification

bbc7f28

krpeacock added 2 commits

November 1, 2023 16:50


          moving public key into agent

65204ef


          simplifying @dfinity/identity with agent exports

5cf8707

roelstorms reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Outdated Show resolved Hide resolved

krpeacock added 4 commits

November 2, 2023 10:42


          Update packages/agent/src/agent/http/index.ts

a29dd77


          finalizing der transfer from @dfinity/identity

a493bf8


          subnetStatus mapping node id to publc key

fba09bf


          lookup_path now returns tree by default

c22c4e7

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/agent/http/index.ts Outdated Show resolved Hide resolved

krpeacock added 5 commits

November 3, 2023 13:29


          fix: hashOfMap should recursively handle passed objects

f22c502

cleaning up tests


          bumping size limit

aac5d6f


          query correctly fails when subnetStatus fails

a899a3c


          fix: canister ranges checked for root subnet

c0ff8dc

fixes FOLLOW-1301


          Merge branch 'main' into kyle/SDK-1216-node-signature-verification

8916a98

krpeacock marked this pull request as ready for review

November 6, 2023 20:19

krpeacock requested a review from a team as a code owner

November 6, 2023 20:19


          fix: sets maxAge for delegation certificates to

7cf9f9f

Infinity, bypassing check
resolves FOLLOW-1302

krpeacock requested review from ShuoWangNSL and roelstorms

November 6, 2023 20:39

ShuoWangNSL reviewed

View reviewed changes

packages/agent/src/canisterStatus/index.ts Show resolved Hide resolved

krpeacock requested a review from ShuoWangNSL

November 7, 2023 18:43

krpeacock enabled auto-merge (squash)

November 7, 2023 18:45


          changelog update

cc92ea5

ghost approved these changes

View reviewed changes

krpeacock merged commit c115480 into main

krpeacock deleted the kyle/SDK-1216-node-signature-verification branch

November 7, 2023 19:16

krpeacock mentioned this pull request

feat: import everything from tweetnacl? #697

Closed

This was referenced Sep 6, 2024

[Snyk] Upgrade @dfinity/principal from 0.15.7 to 0.21.4 Accelar-labs/frax-smart-contracts#1

Open

[Snyk] Upgrade @dfinity/agent from 0.15.7 to 0.21.4 Accelar-labs/frax-smart-contracts#2

Open

[Snyk] Upgrade @dfinity/candid from 0.15.7 to 0.21.4 Accelar-labs/frax-smart-contracts#3

Open

[Snyk] Upgrade: , , Accelar-labs/frax-smart-contracts#4

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet