Merge pull request #1189 from input-output-hk/djo/upgrade_dalek_to_v2

Upgrade ed25519-dalek to v2 to solve security issue
input-output-hk · Sep 1, 2023 · a6caa1c · a6caa1c
2 parents c590faa + be9fdce
commit a6caa1c
Show file tree

Hide file tree

Showing 7 changed files with 192 additions and 102 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/mithril-common/Cargo.toml b/mithril-common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-common"
-version = "0.2.99"
+version = "0.2.100"
 authors = { workspace = true }
 edition = { workspace = true }
 documentation = { workspace = true }
@@ -22,7 +22,7 @@ bech32 = "0.9.1"
 blake2 = "0.10.6"
 chrono = { version = "0.4.26", features = ["serde"] }
 digest = "0.10.7"
-ed25519-dalek = { version = "1.0.1", features = ["serde"] }
+ed25519-dalek = { version = "2.0.0", features = ["rand_core", "serde"] }
 fixed = "1.23.1"
 glob = "0.3.1"
 hex = "0.4.3"
@@ -34,7 +34,6 @@ kes-summed-ed25519 = { version = "0.2.0", features = [
 ] }
 mockall = "0.11.4"
 nom = "7.1.3"
-rand-chacha-dalek-compat = { package = "rand_chacha", version = "0.2" }
 rand_chacha = "0.3.1"
 rand_core = "0.6.4"
 rayon = "1.7.0"

diff --git a/mithril-common/src/crypto_helper/cardano/cold_key.rs b/mithril-common/src/crypto_helper/cardano/cold_key.rs
@@ -1,15 +1,15 @@
-use ed25519_dalek::Keypair as ColdKeypair;
-use rand_chacha_dalek_compat::rand_core::SeedableRng;
-use rand_chacha_dalek_compat::ChaCha20Rng;
+use ed25519_dalek::SigningKey as ColdSecretKey;
+use rand_chacha::ChaCha20Rng;
+use rand_core::SeedableRng;
 
 /// A cold key generator / test only
 #[derive(Debug)]
 pub struct ColdKeyGenerator();
 
 impl ColdKeyGenerator {
-    pub(crate) fn create_deterministic_keypair(seed: [u8; 32]) -> ColdKeypair {
+    pub(crate) fn create_deterministic_keypair(seed: [u8; 32]) -> ColdSecretKey {
         let mut rng = ChaCha20Rng::from_seed(seed);
-        ColdKeypair::generate(&mut rng)
+        ColdSecretKey::generate(&mut rng)
     }
 }
 

diff --git a/mithril-common/src/crypto_helper/cardano/opcert.rs b/mithril-common/src/crypto_helper/cardano/opcert.rs
@@ -6,9 +6,12 @@ use crate::crypto_helper::ProtocolPartyId;
 
 use bech32::{self, ToBase32, Variant};
 use blake2::{digest::consts::U28, Blake2b, Digest};
-use ed25519_dalek::{Keypair as EdKeypair, Signer};
-use ed25519_dalek::{PublicKey as EdPublicKey, Signature as EdSignature, Verifier};
+use ed25519_dalek::{
+    Signature as EdSignature, Signer, SigningKey as EdSecretKey, Verifier,
+    VerifyingKey as EdVerificationKey,
+};
 use kes_summed_ed25519::PublicKey as KesPublicKey;
+use nom::AsBytes;
 use serde::de::Error;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use sha2::Sha256;
@@ -22,7 +25,7 @@ pub enum OpCertError {
     PoolAddressEncoding,
 }
 
-/// Raw Fields of the operational certificates (without incluiding the cold VK)
+/// Raw Fields of the operational certificates (without including the cold VK)
 #[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
 struct RawFields(
     #[serde(with = "serde_bytes")] Vec<u8>,
@@ -33,7 +36,7 @@ struct RawFields(
 
 /// Raw Operational Certificate
 #[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
-struct RawOpCert(RawFields, EdPublicKey);
+struct RawOpCert(RawFields, EdVerificationKey);
 
 /// Parsed Operational Certificate
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -43,7 +46,7 @@ pub struct OpCert {
     /// KES period at which KES key is initalized
     pub start_kes_period: u64,
     pub(crate) cert_sig: EdSignature,
-    pub(crate) cold_vk: EdPublicKey,
+    pub(crate) cold_vk: EdVerificationKey,
 }
 
 impl SerDeShelleyFileFormat for OpCert {
@@ -57,14 +60,15 @@ impl OpCert {
         kes_vk: KesPublicKey,
         issue_number: u64,
         start_kes_period: u64,
-        cold_keypair: EdKeypair,
+        cold_secret_key: EdSecretKey,
     ) -> Self {
-        let cold_vk: EdPublicKey = cold_keypair.public;
-        let cert_sig = cold_keypair.sign(&Self::compute_message_to_sign(
+        let cold_vk: EdVerificationKey = cold_secret_key.verifying_key();
+        let cert_sig = cold_secret_key.sign(&Self::compute_message_to_sign(
             &kes_vk,
             issue_number,
             start_kes_period,
         ));
+
         Self {
             kes_vk,
             issue_number,
@@ -112,7 +116,7 @@ impl OpCert {
         let mut hasher = Blake2b::<U28>::new();
         hasher.update(self.cold_vk.as_bytes());
         let mut pool_id = [0u8; 28];
-        pool_id.copy_from_slice(hasher.finalize().as_slice());
+        pool_id.copy_from_slice(hasher.finalize().as_bytes());
         bech32::encode("pool", pool_id.to_base32(), Variant::Bech32)
             .map_err(|_| OpCertError::PoolAddressEncoding)
     }
@@ -166,7 +170,7 @@ impl<'de> Deserialize<'de> for OpCert {
                 .map_err(|_| Error::custom("KES vk serialisation error"))?,
             issue_number: raw_cert.0 .1,
             start_kes_period: raw_cert.0 .2,
-            cert_sig: EdSignature::from_bytes(&raw_cert.0 .3)
+            cert_sig: EdSignature::from_slice(&raw_cert.0 .3)
                 .map_err(|_| Error::custom("ed25519 signature serialisation error"))?,
             cold_vk: raw_cert.1,
         })