glm-5.1
04e969982e
Create the alknet-secret crate with BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption, and SecretProtocol irpc service definition. This is Phase 3.1 from the integration plan. Architecture changes: - Promote secret-service.md to reviewed status with full spec format (crate structure, public API, security model, phase progression, ADR/OQ cross-references, wire format compatibility section) - Add ADR-038 (seed lifecycle and memory security): zeroize for v1, mlock deferred to Phase B - Add OQ-SEC-01 (mlock/VirtualLock for seed RAM) to open-questions.md - Update README.md with ADR-038 and secret-service status Crate structure: - src/mnemonic.rs: BIP39 phrase generation, validation, seed derivation - src/derivation.rs: SLIP-0010 HD key derivation, path constants (74') - src/encryption.rs: AES-256-GCM encrypt/decrypt, EncryptedData type - src/protocol.rs: SecretProtocol irpc enum, DerivedKey, KeyType - src/service.rs: SecretServiceHandle with Unlock/Lock lifecycle - 40 passing tests (unit + integration + doc)
62 lines
1.9 KiB
Rust
62 lines
1.9 KiB
Rust
//! Integration tests for key derivation.
|
|
//!
|
|
//! These tests verify that SLIP-0010 derivation produces correct results
|
|
//! against known test vectors and that path constants produce expected key types.
|
|
|
|
use alknet_secret::derivation::PATHS;
|
|
use alknet_secret::service::SecretServiceHandle;
|
|
|
|
#[test]
|
|
fn test_identity_key_derivation() {
|
|
let service = SecretServiceHandle::new();
|
|
let _phrase = service.unlock_new(24).unwrap();
|
|
|
|
let key = service.derive_ed25519(PATHS::IDENTITY).unwrap();
|
|
assert_eq!(key.key_type, alknet_secret::protocol::KeyType::Ed25519);
|
|
assert!(!key.private_key.is_empty());
|
|
assert!(!key.public_key.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn test_encryption_key_derivation() {
|
|
let service = SecretServiceHandle::new();
|
|
service.unlock_new(24).unwrap();
|
|
|
|
let key = service
|
|
.derive_encryption_key(PATHS::ENCRYPTION)
|
|
.unwrap();
|
|
assert_eq!(
|
|
key.key_type,
|
|
alknet_secret::protocol::KeyType::Aes256Gcm
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_deterministic_derivation() {
|
|
// Same seed + same path = same key
|
|
let service = SecretServiceHandle::new();
|
|
let phrase = service.unlock_new(24).unwrap();
|
|
|
|
let key1 = service.derive_ed25519(PATHS::IDENTITY).unwrap();
|
|
|
|
// Unlock with the same phrase again
|
|
service.lock();
|
|
service.unlock(&phrase, None).unwrap();
|
|
|
|
let key2 = service.derive_ed25519(PATHS::IDENTITY).unwrap();
|
|
|
|
assert_eq!(key1.private_key, key2.private_key);
|
|
assert_eq!(key1.public_key, key2.public_key);
|
|
}
|
|
|
|
#[test]
|
|
fn test_different_paths_different_keys() {
|
|
let service = SecretServiceHandle::new();
|
|
service.unlock_new(24).unwrap();
|
|
|
|
let identity_key = service.derive_ed25519(PATHS::IDENTITY).unwrap();
|
|
let ssh_key = service.derive_ed25519(PATHS::SSH_HOST).unwrap();
|
|
|
|
assert_ne!(identity_key.private_key, ssh_key.private_key);
|
|
assert_ne!(identity_key.public_key, ssh_key.public_key);
|
|
} |