feat: [NET-1446] Quantum resistant identities and signatures by hpihkala · Pull Request #3074 · streamr-dev/network

hpihkala · 2025-04-17T15:29:08Z

Summary

The goal of this PR is to add support for quantum secure cryptographic identities and signatures, as well as to make it easier to add more identity/signature types in the future. The PR includes some refactoring to create a new Identity abstraction which replaces the old Authentication interface.

Most of the line changes are due to renaming things + docs changes. The actual code changes in this PR are actually not that massive.

Changes

More significant changes:

Refactor old Authentication interface replaced by new Identity framework
Added support for ML-DSA-87 identity and signing
As an alternative to configuring keys, allow an Identity instance to be passed to StreamrClient as auth.identity
Add requireQuantumResistantSignatures and requireQuantumResistantEncryption config options as well as related checks
Add --public-key and --key-type options to CLI tool
Breaking change: In CLI tool, rename streamr wallet to streamr keys (the only command there was streamr wallet whoami, which is now streamr keys whoami. Add a new command streamr keys generate.
Breaking change: Removed StreamrClient.generateEthereumAccount(), the new way is EthereumKeyPairIdentity.generate() (can be done with other key/identity types as well).
Breaking change: The string values in Message.signatureType now correspond with the KeyType values. This means the previously output value SECP256K1 is now ECDSA_SECP256K1_EVM.
Large-ish docs changes

Additional minor changes:

Removed some technical debt from StreamMessageTranslator by removing oldContentType vs. newContentType, oldEncryptionType vs. newEncryptionType. The network-level enums are used directly now.
Give more accurate names to SignatureTypes, paving the road for more types to be added later.
Namespace the exports in signingUtils.ts by algorithm type, eg. ECDSA_SECP256K1_EVM and ML_DSA_87
Remove address as an acceptable parameter to key config
Add a central place identityConfig.ts for wiring together identities, SignatureTypes, and verification methods
Remove repetition / enumeration of SignatureTypes from Message.ts and SignatureValidator.ts
bugfix: Fix regex used for validating hex strings given to config

Limitations and future improvements

The client config key auth was kept as-is for backwards compatibility, although renaming it to identity would probably make sense at some point.
I didn't attempt to solve all overlap or inaccuracies in the docs (there are some). I mainly focused on the Identity article, the articles under the Security section, and any references to them.

Checklist before requesting a review

Is this a breaking change? If it is, be clear in summary. (no major breaking changes, but some exported supporting classes have changed)
Read through code myself one more time.
Make sure any and all TODO comments left behind are meant to be left in.
Has reasonable passing test coverage?
Updated changelog if applicable.
Updated documentation if applicable.

linear · 2025-04-17T15:29:11Z

NET-1446 Support a quantum resistant signature algorithm

…antum-resistant-signature-algorithm

teogeb

Second round of comments (utils, cli-tools, changelog)

teogeb

Third round of comments (most of the sdk)

teogeb

Rest of the comments about sdk.

Great improvements in this PR, with excellent readability 👍

…antum-resistant-signature-algorithm

…ption setting

teogeb

Some more comments

…antum-resistant-signature-algorithm

teogeb

👍

## Changes - Add support for ECDSA on `secp256r1` curve. Uses webcrypto (SubtleCrypto) for speed, as that's natively implemented in browsers. - Had to refactor `createSignature` and `verifySignature` in `SigningUtil` interface to be `async`, because webcrypto (SubtleCrypto) only offers async methods. - Offer an `assertValidKeyPair` utility function in all `SigningUtil`s - The previous PR #3074 left some type safety holes in `signingUtils.ts`, they are fixed here. - Unify `EthereumKeyPairIdentity` constructor with other `KeyPairIdentity` constructors. There's now a utility function `EthereumKeyPairIdentity.fromPrivateKey(string)` for creating it from a private key string. - Moved `crossPlatformCrypto.ts` (utility to get `subtle`) from `sdk` package to `utils` package, as it was needed there too. ## Checklist before requesting a review - [x] Is this a breaking change? If it is, be clear in summary. **-> NO** - [x] Read through code myself one more time. - [x] Make sure any and all `TODO` comments left behind are meant to be left in. - [x] Has reasonable passing test coverage? - [x] Updated changelog if applicable. - [x] Updated documentation if applicable.

## Summary The goal of this PR is to add support for quantum secure cryptographic identities and signatures, as well as to make it easier to add more identity/signature types in the future. The PR includes some refactoring to create a new `Identity` abstraction which replaces the old `Authentication` interface. Most of the line changes are due to renaming things + docs changes. The actual code changes in this PR are actually not that massive. ## Changes **More significant changes:** - Refactor old `Authentication` interface replaced by new `Identity` framework - Added support for ML-DSA-87 identity and signing - As an alternative to configuring keys, allow an `Identity` instance to be passed to `StreamrClient` as `auth.identity` - Add `requireQuantumResistantSignatures` and `requireQuantumResistantEncryption` config options as well as related checks - Add `--public-key` and `--key-type` options to CLI tool - **Breaking change**: In CLI tool, rename `streamr wallet` to `streamr keys` (the only command there was `streamr wallet whoami`, which is now `streamr keys whoami`. Add a new command `streamr keys generate`. - **Breaking change**: Removed `StreamrClient.generateEthereumAccount()`, the new way is `EthereumKeyPairIdentity.generate()` (can be done with other key/identity types as well). - **Breaking change**: The string values in `Message.signatureType` now correspond with the `KeyType` values. This means the previously output value `SECP256K1` is now `ECDSA_SECP256K1_EVM`. - Large-ish docs changes **Additional minor changes:** - Removed some technical debt from `StreamMessageTranslator` by removing `oldContentType` vs. `newContentType`, `oldEncryptionType` vs. `newEncryptionType`. The network-level enums are used directly now. - Give more accurate names to `SignatureType`s, paving the road for more types to be added later. - Namespace the exports in `signingUtils.ts` by algorithm type, eg. `ECDSA_SECP256K1_EVM` and `ML_DSA_87` - Remove `address` as an acceptable parameter to key config - Add a central place `identityConfig.ts` for wiring together identities, `SignatureType`s, and verification methods - Remove repetition / enumeration of SignatureTypes from `Message.ts` and `SignatureValidator.ts` - bugfix: Fix regex used for validating hex strings given to config ## Limitations and future improvements - The client config key `auth` was kept as-is for backwards compatibility, although renaming it to `identity` would probably make sense at some point. - I didn't attempt to solve all overlap or inaccuracies in the docs (there are some). I mainly focused on the Identity article, the articles under the Security section, and any references to them. ## Checklist before requesting a review - [x] Is this a breaking change? If it is, be clear in summary. **(no major breaking changes, but some exported supporting classes have changed)** - [x] Read through code myself one more time. - [x] Make sure any and all `TODO` comments left behind are meant to be left in. - [x] Has reasonable passing test coverage? - [x] Updated changelog if applicable. - [x] Updated documentation if applicable.

## Changes - Add support for ECDSA on `secp256r1` curve. Uses webcrypto (SubtleCrypto) for speed, as that's natively implemented in browsers. - Had to refactor `createSignature` and `verifySignature` in `SigningUtil` interface to be `async`, because webcrypto (SubtleCrypto) only offers async methods. - Offer an `assertValidKeyPair` utility function in all `SigningUtil`s - The previous PR #3074 left some type safety holes in `signingUtils.ts`, they are fixed here. - Unify `EthereumKeyPairIdentity` constructor with other `KeyPairIdentity` constructors. There's now a utility function `EthereumKeyPairIdentity.fromPrivateKey(string)` for creating it from a private key string. - Moved `crossPlatformCrypto.ts` (utility to get `subtle`) from `sdk` package to `utils` package, as it was needed there too. ## Checklist before requesting a review - [x] Is this a breaking change? If it is, be clear in summary. **-> NO** - [x] Read through code myself one more time. - [x] Make sure any and all `TODO` comments left behind are meant to be left in. - [x] Has reasonable passing test coverage? - [x] Updated changelog if applicable. - [x] Updated documentation if applicable.

hpihkala added 17 commits April 14, 2025 15:16

add ML-DSA-87, signingUtils test passing

019c213

identity refactor

fdad8da

fix build, support new signature type

80b9afe

fix tests

b85aba8

cleanup

8b139de

make key pairs configurable

0f51cdd

validate key lengths

37bcd9c

fix build

69dcd4a

sdk tests passing

069677e

make it harder to forget to add a new SignatureType to Message class

889596e

cleanup

e974f49

minor cleanup

69626cd

support publicKey and keyType in cli tool

ea11249

- Add and config options as well as related checks

04fb998

add generate() methods to KeyPairIdentities

b284478

cli tool for generating key pairs

48741ea

add tests, fix tests

d809528

github-actions Bot added network Related to Network Package cli-tools Related to CLI Tools Package dht Related to DHT package utils sdk node labels Apr 17, 2025

hpihkala changed the title ~~feat: [NET-1446] Quantum resistant identities and signatures~~ feat: [NET-1446] WIP Quantum resistant identities and signatures Apr 17, 2025

hpihkala added 5 commits April 17, 2025 17:43

Merge remote-tracking branch 'origin/main' into NET-1446/support-a-qu…

c9f93d3

…antum-resistant-signature-algorithm

EthereumKeyPairIdentity accepts private keys with and without 0x

97af48e

add key pair validation and tests

3c25893

remove StreamrClient.generateEthereumAccount

cffaab1

cli tools polish

6b6c83e

teogeb mentioned this pull request Apr 24, 2025

chore(sdk)!: Rename Message#groupKeyId field #3084

Merged

teogeb reviewed Apr 25, 2025

View reviewed changes

Comment thread CHANGELOG.md Outdated

Comment thread packages/utils/src/signingUtils.ts

Comment thread packages/utils/src/signingUtils.ts Outdated

Comment thread packages/cli-tools/bin/streamr.ts Outdated

teogeb reviewed Apr 25, 2025

View reviewed changes

teogeb suggested changes Apr 25, 2025

View reviewed changes

hpihkala mentioned this pull request Apr 25, 2025

feat: [NET-1453] Support ECDSA with the secp256r1 curve #3088

Merged

6 tasks

hpihkala added 13 commits April 28, 2025 14:57

Merge remote-tracking branch 'origin/main' into NET-1446/support-a-qu…

e29d3e8

…antum-resistant-signature-algorithm

PR fixes: first round of comments

5c96252

PR fixes for second round of comments

dabab65

fix ethereum provider comment

7ac3625

allow subscribing to public data despite requireQuantumResistantEncry…

9611f56

…ption setting

rename getUserIdString to getUserId

e585c77

rename getUserIdBytes to getUserIdRaw

6b253b4

rename identityConfig to IdentityMapping

a47cd00

IdentityMapping is internal

5c3c2b4

minor polish based on the rest of the PR feedback

c420d1a

fix eslint

71ecaed

fix cli tool test

89e3cb2

bump @noble/post-quantum to pass version check

a4c6a0c

teogeb suggested changes Apr 29, 2025

View reviewed changes

Comment thread packages/cli-tools/bin/streamr-identity-generate.ts Outdated

Comment thread packages/sdk/src/publish/MessageFactory.ts Outdated

Comment thread packages/sdk/src/utils/encryptionCompliance.ts Outdated

hpihkala added 3 commits April 29, 2025 11:37

remove unnecessary validation

bf0b96d

address latest round of PR comments

48b503f

Merge remote-tracking branch 'origin/main' into NET-1446/support-a-qu…

a7d2569

…antum-resistant-signature-algorithm

teogeb self-requested a review April 29, 2025 09:52

teogeb approved these changes Apr 29, 2025

View reviewed changes

hpihkala merged commit d275b53 into main Apr 29, 2025

hpihkala deleted the NET-1446/support-a-quantum-resistant-signature-algorithm branch April 29, 2025 13:40

hpihkala mentioned this pull request Apr 29, 2025

feat: [NET-1453] support ecdsa with the secp256r1 curve #3095

Closed

6 tasks

Uh oh!

Conversation

hpihkala commented Apr 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Limitations and future improvements

Checklist before requesting a review

Uh oh!

linear Bot commented Apr 17, 2025

Uh oh!

teogeb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

teogeb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

teogeb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

teogeb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

teogeb left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hpihkala commented Apr 17, 2025 •

edited

Loading