opencanarias/taple-core

Reference library that implements all the necessary functionality for developing a client that is compatible with TAPLE's DLT network.

TAPLE Core

TAPLE (pronounced T+🍎 ['tapəl]) stands for Tracking (Autonomous) of Provenance and Lifecycle Events. TAPLE is a permissioned DLT solution for traceability of assets and processes. It is:

• Scalable: Scaling to a sufficient level for traceability use cases.
• Light: Designed to support resource constrained devices.
• Flexible: Have a flexible and adaptable cryptographic scheme mechanism for a multitude of scenarios.
• Energy-efficient: Rust powered, TAPLE is sustainable and efficient from the point of view of energy consumption.

TAPLE Core is the reference library that implements all the necessary functionality for developing a client that is compatible with TAPLE's DLT network. If you need a client, refer to our TAPLE Client.

Discover | Learn | Build | Code

Build

Minimium supported rust versión (MSRV) is 1.67.

A basic usage example can be found at examples directory. You can find more information about TAPLE technology and how to develop for TAPLE on TAPLE Website.

License

This project is licensed under the AGPL license.

taple-core's Issues

fix: protect cryptographic material in memory

This fix proposes changing the BaseKeyPair object so that instead of having an option to the PrivateKey, it has as an option an encryptor object that encrypts the secret key in memory when creating the key pair and decrypts it on demand when signing is needed.
We can use the memsec crate, which implements the same functions as the OpenSSH libsodium library, and enforce our encryptor based on an efficient symmetric algorithm (with chacha20poly1305), or use the memsecurity crate that has already implemented it. I attach a proof of concept with memsecurity.

Example BaseKeyPair:

use memsecurity::EncryptedMem;

/// Base key pair.
///
/// This type contains the public key and some `EncryptedMem` object with the
/// secret key or none.
///
pub struct BaseKeyPair<K> {
    pub public: K,
    pub secret: Option<EncryptedMem>,
}

Example type ed25519:

/// Ed25519 key pair.
pub type Ed25519KeyPair = BaseKeyPair<VerifyingKey>;

Example build from secret bytes:

    fn from_secret(secret: &[u8]) -> Result<Self, Error>
    where
        Self: Sized,
    {
        let mut encrytion = EncryptedMem::new();
        let sk = SigningKey::try_from(secret)
            .map_err(|_| Error::KeyPair("Ed25519".to_owned(), "geting SigningKey".to_owned()))?;
        let public_key = VerifyingKey::from(&sk);
        encrytion
            .encrypt(&sk.to_bytes())
            .map_err(|_| Error::KeyPair("Ed25519".to_owned(), "mem encryption".to_owned()))?;
        Ok(Ed25519KeyPair {
            public: public_key,
            secret: Some(encrytion),
        })
    }

Example sign:

    fn sign(&mut self, message: &[u8]) -> Result<Vec<u8>, Error> {
        let encr = self.secret.as_ref().ok_or(Error::KeyPair(
            "Ed25519".to_owned(),
            "secret not found".to_owned(),
        ))?;
        let sk = encr
            .decrypt()
            .map_err(|_| Error::KeyPair("Ed25519".to_owned(), "mem decryption".to_owned()))?;

        let signing_key = SigningKey::try_from(sk.as_ref()).map_err(|_| {
            Error::KeyPair("Ed25519".to_owned(), "SigningKey from slice".to_owned())
        })?;
        let signature = signing_key.sign(message);
        Ok(signature.to_bytes().to_vec())
    }
}

The verification would remain the same as before.