libstore: use OpenSSL for Ed25519 signatures

Previously two cryptography libraries were linked into Lix: OpenSSL used for
hashing and (in usual configurations) indirectly via curl for TLS, and Sodium
used only for handling the Ed25519 path info signatures. The latter is
functionally redundant since OpenSSL supports the same use case as well.
Reimplement the Ed25519 handling using OpenSSL and drop Sodium.

Fixes: https://git.lix.systems/lix-project/lix/issues/969

Change-Id: I6a6a696456b9d3ad7fdc2bf9b0759836a6247a38

doc/manual/src/installation/prerequisites-source.md

@@ -54,11 +54,6 @@ The most current alternative to this section is to read `package.nix` and see wh
     obtained from the its repository
     <https://github.com/troglobit/editline>.
 
-  - The `libsodium` library for verifying cryptographic signatures
-    of contents fetched from binary caches.
-    It can be obtained from the official web site
-    <https://libsodium.org>.
-
   - Recent versions of Bison and Flex to build the parser. (This is
     because Nix needs GLR support in Bison and reentrancy support in
     Flex.) For Bison, you need version 2.6, which can be obtained from

lix/libstore/binary-cache-store.cc

@@ -30,7 +30,7 @@ namespace nix {
 BinaryCacheStore::BinaryCacheStore(const BinaryCacheStoreConfig & config)
 {
     if (config.secretKeyFile != "")
-        secretKey = std::unique_ptr<SecretKey>(new SecretKey(readFile(config.secretKeyFile)));
+        secretKey = std::make_unique<SecretKey>(SecretKey::parse(readFile(config.secretKeyFile)));
 
     StringSink sink;
     sink << narVersionMagic1;

lix/libstore/crypto.cc

@@ -4,98 +4,216 @@
 #include "lix/libstore/globals.hh"
 #include "lix/libutil/strings.hh"
 
-#include <sodium.h>
+#include <openssl/err.h>
 
 namespace nix {
 
-static std::pair<std::string_view, std::string_view> split(std::string_view s)
+constexpr size_t ED25519_KEY_BYTES = 32;
+constexpr size_t ED25519_SIGNATURE_BYTES = 64;
+constexpr size_t MAX_ERROR_MESSAGE_LENGTH = 256;
+
+using EvpPkeyCtxPtr = std::unique_ptr<EVP_PKEY_CTX, decltype([](auto ctx) { EVP_PKEY_CTX_free(ctx); })>;
+using EvpSignaturePtr = std::unique_ptr<EVP_SIGNATURE, decltype([](auto alg) { EVP_SIGNATURE_free(alg); })>;
+
+static std::pair<std::string_view, std::string> split(std::string_view s)
 {
     size_t colon = s.find(':');
     if (colon == std::string::npos || colon == 0)
         return {"", ""};
-    return {s.substr(0, colon), s.substr(colon + 1)};
+    return {s.substr(0, colon), base64Decode(s.substr(colon + 1))};
 }
 
-Key::Key(std::string_view s)
+std::string openssl_error()
 {
-    auto ss = split(s);
-
-    name = ss.first;
-    key = ss.second;
-
-    if (name == "" || key == "")
-        throw Error("secret key is corrupt");
-
-    key = base64Decode(key);
+    auto error = ERR_get_error();
+    char buf[MAX_ERROR_MESSAGE_LENGTH];
+    ERR_error_string_n(error, buf, MAX_ERROR_MESSAGE_LENGTH);
+    return buf;
 }
 
-std::string Key::to_string() const
-{
-    return name + ":" + base64Encode(key);
-}
+SecretKey::SecretKey(std::string name, EvpPkeyPtr pkey)
+    : name(std::move(name)), pkey(std::move(pkey))
+{}
 
-SecretKey::SecretKey(std::string_view s)
-    : Key(s)
-{
-    if (key.size() != crypto_sign_SECRETKEYBYTES)
-        throw Error("secret key is not valid");
-}
+SecretKey::~SecretKey() = default;
 
 std::string SecretKey::signDetached(std::string_view data) const
 {
-    unsigned char sig[crypto_sign_BYTES];
-    unsigned long long sigLen;
-    crypto_sign_detached(
+    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey.get(), nullptr);
+    if (!ctx)
+        throw Error("signing failed: %s", openssl_error());
+    EvpPkeyCtxPtr pctx(ctx);
+    EVP_SIGNATURE *alg = EVP_SIGNATURE_fetch(nullptr, "ED25519", nullptr);
+    if (!alg)
+        throw Error("signing failed: %s", openssl_error());
+    EvpSignaturePtr palg(alg);
+    if (EVP_PKEY_sign_message_init(pctx.get(), palg.get(), nullptr) != 1)
+        throw Error("signing failed: %s", openssl_error());
+
+    unsigned char sig[ED25519_SIGNATURE_BYTES];
+    size_t sig_bytes = ED25519_SIGNATURE_BYTES;
+    if (EVP_PKEY_sign(
+        pctx.get(),
         sig,
-        &sigLen,
-        // the following is not a string function so no null termination issues are possible here.
+        &sig_bytes,
         // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
         charptr_cast<const unsigned char *>(data.data()),
-        data.size(),
-        charptr_cast<const unsigned char *>(key.data())
-    );
-    return name + ":" + base64Encode(std::string(reinterpret_cast<char *>(sig), sigLen));
+        data.size()
+    ) != 1)
+        throw Error("signing failed: %s", openssl_error());
+    assert(sig_bytes == ED25519_SIGNATURE_BYTES);
+
+    return fmt("%s:%s", name, base64Encode({charptr_cast<char *>(sig), ED25519_SIGNATURE_BYTES}));
 }
 
 PublicKey SecretKey::toPublicKey() const
 {
-    unsigned char pk[crypto_sign_PUBLICKEYBYTES];
-    crypto_sign_ed25519_sk_to_pk(pk, charptr_cast<const unsigned char *>(key.data()));
-    return PublicKey(name, std::string(reinterpret_cast<char *>(pk), crypto_sign_PUBLICKEYBYTES));
+    unsigned char raw[ED25519_KEY_BYTES];
+    size_t key_bytes = ED25519_KEY_BYTES;
+    assert(EVP_PKEY_get_raw_public_key(pkey.get(), raw, &key_bytes) == 1);
+    assert(key_bytes == ED25519_KEY_BYTES);
+    return PublicKey::fromRaw(name, {charptr_cast<char *>(raw), ED25519_KEY_BYTES});
+}
+
+std::string SecretKey::to_string() const
+{
+    // For compatibility reasons, the public key is included, even though it is redundant.
+    unsigned char keys[2 * ED25519_KEY_BYTES];
+    size_t key_bytes = ED25519_KEY_BYTES;
+    assert(EVP_PKEY_get_raw_private_key(pkey.get(), keys, &key_bytes) == 1);
+    assert(key_bytes == ED25519_KEY_BYTES);
+    assert(EVP_PKEY_get_raw_public_key(pkey.get(), keys + ED25519_KEY_BYTES, &key_bytes) == 1);
+    assert(key_bytes == ED25519_KEY_BYTES);
+    return fmt("%s:%s", name, base64Encode({charptr_cast<char *>(keys), 2 * ED25519_KEY_BYTES}));
 }
 
 SecretKey SecretKey::generate(std::string_view name)
 {
-    unsigned char pk[crypto_sign_PUBLICKEYBYTES];
-    unsigned char sk[crypto_sign_SECRETKEYBYTES];
-    if (crypto_sign_keypair(pk, sk) != 0)
-        throw Error("key generation failed");
+    EVP_PKEY *key = EVP_PKEY_Q_keygen(nullptr, nullptr, "ED25519");
+    if (!key)
+        throw Error("key generation failed: %s", openssl_error());
+    EvpPkeyPtr pkey(key);
 
-    return SecretKey(name, std::string(reinterpret_cast<char *>(sk), crypto_sign_SECRETKEYBYTES));
+    return SecretKey(std::string(name), std::move(pkey));
 }
 
-PublicKey::PublicKey(std::string_view s)
-    : Key(s)
+SecretKey SecretKey::parse(std::string_view s)
 {
-    if (key.size() != crypto_sign_PUBLICKEYBYTES)
+    auto [name, raw_key] = split(s);
+
+    // For compatibility reasons, the public key is included, even though it is redundant.
+    if (raw_key.size() != 2 * ED25519_KEY_BYTES)
+        throw Error("secret key is not valid");
+
+    EVP_PKEY *key = EVP_PKEY_new_raw_private_key(
+        EVP_PKEY_ED25519,
+        nullptr,
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+        charptr_cast<const unsigned char *>(raw_key.data()),
+        ED25519_KEY_BYTES
+    );
+    if (!key)
+        throw Error("secret key is not valid: %s", openssl_error());
+    EvpPkeyPtr pkey(key);
+
+    // Verify that the redundant copy of the public key is correct.
+    unsigned char pk[ED25519_KEY_BYTES];
+    size_t key_bytes = ED25519_KEY_BYTES;
+    assert(EVP_PKEY_get_raw_public_key(pkey.get(), pk, &key_bytes) == 1);
+    assert(key_bytes == ED25519_KEY_BYTES);
+    if (memcmp(pk, raw_key.data() + ED25519_KEY_BYTES, ED25519_KEY_BYTES) != 0)
+        throw Error("secret key is not valid");
+
+    return SecretKey(std::string(name), std::move(pkey));
+}
+
+PublicKey::PublicKey(std::string name, EvpPkeyPtr pkey)
+    : name(std::move(name)), pkey(std::move(pkey))
+{}
+
+PublicKey::~PublicKey() = default;
+
+bool PublicKey::verifyDetached(std::string_view data, std::string_view sig) const
+{
+    if (sig.size() != ED25519_SIGNATURE_BYTES)
+        throw Error("signature is not valid");
+
+    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey.get(), nullptr);
+    if (!ctx)
+        throw Error("signature verification failed: %s", openssl_error());
+    EvpPkeyCtxPtr pctx(ctx);
+    EVP_SIGNATURE *alg = EVP_SIGNATURE_fetch(nullptr, "ED25519", nullptr);
+    if (!alg)
+        throw Error("signature verification failed: %s", openssl_error());
+    EvpSignaturePtr palg(alg);
+    if (EVP_PKEY_verify_message_init(pctx.get(), palg.get(), nullptr) != 1)
+        throw Error("signature verification failed: %s", openssl_error());
+
+    int result = EVP_PKEY_verify(
+        pctx.get(),
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+        charptr_cast<const unsigned char *>(sig.data()),
+        ED25519_SIGNATURE_BYTES,
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+        charptr_cast<const unsigned char *>(data.data()),
+        data.size()
+    );
+    switch (result) {
+    case 1:
+        // success
+        return true;
+    case 0:
+        // signature did not verify
+        return false;
+    default:
+        // negative return value indicates more serious error
+        throw Error("signature verification failed: %s", openssl_error());
+    }
+}
+
+std::string PublicKey::to_string() const
+{
+    unsigned char pk[ED25519_KEY_BYTES];
+    size_t key_bytes = ED25519_KEY_BYTES;
+    assert(EVP_PKEY_get_raw_public_key(pkey.get(), pk, &key_bytes) == 1);
+    assert(key_bytes == ED25519_KEY_BYTES);
+    return fmt("%s:%s", name, base64Encode({charptr_cast<char *>(pk), ED25519_KEY_BYTES}));
+}
+
+PublicKey PublicKey::fromRaw(std::string_view name, std::string_view raw)
+{
+    if (raw.size() != ED25519_KEY_BYTES)
         throw Error("public key is not valid");
+
+    EVP_PKEY *key = EVP_PKEY_new_raw_public_key(
+        EVP_PKEY_ED25519,
+        nullptr,
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+        charptr_cast<const unsigned char *>(raw.data()),
+        ED25519_KEY_BYTES
+    );
+    if (!key)
+        throw Error("public key is not valid: %s", openssl_error());
+    EvpPkeyPtr pkey(key);
+
+    return PublicKey(std::string(name), std::move(pkey));
+}
+
+PublicKey PublicKey::parse(std::string_view s)
+{
+    auto [name, raw] = split(s);
+    return PublicKey::fromRaw(name, raw);
 }
 
 bool verifyDetached(const std::string & data, const std::string & sig,
     const PublicKeys & publicKeys)
 {
-    auto ss = split(sig);
+    auto [name, sig2] = split(sig);
 
-    auto key = publicKeys.find(std::string(ss.first));
+    auto key = publicKeys.find(std::string(name));
     if (key == publicKeys.end()) return false;
 
-    auto sig2 = base64Decode(ss.second);
-    if (sig2.size() != crypto_sign_BYTES)
-        throw Error("signature is not valid");
-
-    return crypto_sign_verify_detached(charptr_cast<unsigned char *>(sig2.data()),
-        charptr_cast<const unsigned char *>(data.data()), data.size(),
-        charptr_cast<const unsigned char *>(key->second.key.data())) == 0;
+    return key->second.verifyDetached(data, sig2);
 }
 
 PublicKeys getDefaultPublicKeys()
@@ -105,13 +223,14 @@ PublicKeys getDefaultPublicKeys()
     // FIXME: filter duplicates
 
     for (auto s : settings.trustedPublicKeys.get()) {
-        PublicKey key(s);
-        publicKeys.emplace(key.name, key);
+        auto key = PublicKey::parse(s);
+        auto name = key.name;
+        publicKeys.emplace(name, std::move(key));
     }
 
     for (auto secretKeyFile : settings.secretKeyFiles.get()) {
         try {
-            SecretKey secretKey(readFile(secretKeyFile));
+            auto secretKey = SecretKey::parse(readFile(secretKeyFile));
             publicKeys.emplace(secretKey.name, secretKey.toPublicKey());
         } catch (SysError & e) {
             /* Ignore unreadable key files. That's normal in a

lix/libstore/crypto.hh

@@ -3,33 +3,25 @@
 
 
 #include <map>
+#include <memory>
 #include <string>
 
+#include <openssl/evp.h>
+
 namespace nix {
 
-struct Key
-{
-    std::string name;
-    std::string key;
-
-    /**
-     * Construct Key from a string in the format
-     * ‘<name>:<key-in-base64>’.
-     */
-    Key(std::string_view s);
-
-    std::string to_string() const;
-
-protected:
-    Key(std::string_view name, std::string && key)
-        : name(name), key(std::move(key)) { }
-};
+using EvpPkeyPtr = std::unique_ptr<EVP_PKEY, decltype([](auto key) { EVP_PKEY_free(key); })>;
 
 struct PublicKey;
 
-struct SecretKey : Key
+struct SecretKey
 {
-    SecretKey(std::string_view s);
+    std::string name;
+    EvpPkeyPtr pkey;
+
+    SecretKey(std::string name, EvpPkeyPtr pkey);
+    SecretKey(SecretKey &&) = default;
+    ~SecretKey();
 
     /**
      * Return a detached signature of the given string.
@@ -38,21 +30,39 @@ struct SecretKey : Key
 
     PublicKey toPublicKey() const;
 
+    std::string to_string() const;
+
     static SecretKey generate(std::string_view name);
 
-private:
-    SecretKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key)) { }
+    /**
+     * Parse a secret key in the format `<name>:<key-in-base64>`.
+     * For backwards compatibility, the key must be the concatenation of the secret and public key.
+     */
+    static SecretKey parse(std::string_view s);
 };
 
-struct PublicKey : Key
+struct PublicKey
 {
-    PublicKey(std::string_view data);
+    std::string name;
+    EvpPkeyPtr pkey;
 
-private:
-    PublicKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key)) { }
-    friend struct SecretKey;
+    PublicKey(std::string name, EvpPkeyPtr pkey);
+    PublicKey(PublicKey &&) = default;
+    ~PublicKey();
+
+    /**
+     * Check whether a detached signature is valid.
+     */
+    bool verifyDetached(std::string_view data, std::string_view sig) const;
+
+    std::string to_string() const;
+
+    static PublicKey fromRaw(std::string_view name, std::string_view raw);
+
+    /**
+     * Parse a public key in the format `<name>:<key-in-base64>`.
+     */
+    static PublicKey parse(std::string_view data);
 };
 
 typedef std::map<std::string, PublicKey> PublicKeys;

lix/libstore/globals.cc

@@ -16,8 +16,6 @@
 #include <dlfcn.h>
 #include <sys/utsname.h>
 
-#include <sodium/core.h>
-
 #ifdef __GLIBC__
 #include <gnu/lib-names.h>
 #include <nss.h>
@@ -479,9 +477,6 @@ void assertLibStoreInitialized() {
 
 void initLibStore() {
 
-    if (sodium_init() == -1)
-        throw Error("could not initialise libsodium");
-
     loadConfFile();
 
     preloadNSS();

lix/libstore/lix-store.pc.in

@@ -6,5 +6,5 @@ Name: Lix libstore
 Description: Lix Package Manager (libstore)
 Version: @PACKAGE_VERSION@
 Requires: lix-base lix-util
-Requires.private: @AWS_SDK_IF_FOUND@ capnp-rpc libcurl libarchive libseccomp libsodium sqlite3
+Requires.private: @AWS_SDK_IF_FOUND@ capnp-rpc libcrypto libcurl libarchive libseccomp sqlite3
 Libs: -L${libdir} -llixstore

lix/libstore/local-store.cc

@@ -1685,7 +1685,7 @@ void LocalStore::signPathInfo(ValidPathInfo & info)
     auto secretKeyFiles = settings.secretKeyFiles;
 
     for (auto & secretKeyFile : secretKeyFiles.get()) {
-        SecretKey secretKey(readFile(secretKeyFile));
+        auto secretKey = SecretKey::parse(readFile(secretKeyFile));
         info.sign(*this, secretKey);
     }
 }

lix/libstore/meson.build

@@ -394,8 +394,8 @@ dependencies = [
   kj,
   libarchive,
   nlohmann_json,
+  openssl,
   seccomp,
-  sodium,
   sqlite,
 ]
 

lix/nix/sigs.cc

@@ -116,7 +116,7 @@ struct CmdSign : StorePathsCommand
         if (secretKeyFile.empty())
             throw UsageError("you must specify a secret key file using '-k'");
 
-        SecretKey secretKey(readFile(secretKeyFile));
+        auto secretKey = SecretKey::parse(readFile(secretKeyFile));
 
         size_t added = 0;
 
@@ -198,7 +198,7 @@ struct CmdKeyConvertSecretToPublic : Command
 
     void run() override
     {
-        SecretKey secretKey(drainFD(STDIN_FILENO));
+        auto secretKey = SecretKey::parse(drainFD(STDIN_FILENO));
         writeFull(STDOUT_FILENO, secretKey.toPublicKey().to_string());
     }
 };

meson.build

@@ -339,8 +339,6 @@ configdata += {
 
 sqlite = dependency('sqlite3', 'sqlite', version : '>=3.6.19', required : true, include_type : 'system')
 
-sodium = dependency('libsodium', 'sodium', required : true, include_type : 'system')
-
 curl = dependency('libcurl', 'curl', required : true, include_type : 'system')
 
 editline = dependency('libeditline', 'editline', version : '>=1.14', required : true, include_type : 'system')

package.nix

@@ -29,7 +29,6 @@
   libarchive,
   libcpuid,
   libseccomp,
-  libsodium,
   libsystemtap,
   linuxPackages,
   lix-clang-tidy ? null,
@@ -339,7 +338,6 @@ stdenv.mkDerivation (finalAttrs: {
       libarchive
       boost
       lowdown
-      libsodium
       toml11-lix
       pegtl
       capnproto

perl/default.nix

@@ -10,7 +10,6 @@
   bzip2,
   xz,
   boost,
-  libsodium,
   darwin,
   meson,
   ninja,
@@ -36,21 +35,18 @@ perl.pkgs.toPerlModule (
       ninja
     ];
 
-    buildInputs =
-      [
-        nix
-        curl
-        bzip2
-        xz
-        perl
-        boost
-        perlPackages.DBI
-        perlPackages.DBDSQLite
-        # for kj-async
-        capnproto
-      ]
-      ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-      ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+    buildInputs = [
+      nix
+      curl
+      bzip2
+      xz
+      perl
+      boost
+      perlPackages.DBI
+      perlPackages.DBDSQLite
+      # for kj-async
+      capnproto
+    ] ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
     # Nixpkgs' Meson hook likes to set this to "plain".
     mesonBuildType = "debugoptimized";

perl/lib/Nix/Store.xs

@@ -20,9 +20,6 @@
 #include "lix/libutil/async.hh"
 #include "lix/libutil/json.hh"
 
-#include <sodium.h>
-
-
 using namespace nix;
 
 
@@ -254,7 +251,7 @@ SV * convertHash(char * algo, char * s, int toBase32)
 SV * signString(char * secretKey_, char * msg)
     PPCODE:
         try {
-            auto sig = SecretKey(secretKey_).signDetached(msg);
+            auto sig = SecretKey::parse(secretKey_).signDetached(msg);
             XPUSHs(sv_2mortal(newSVpv(sig.c_str(), sig.size())));
         } catch (Error & e) {
             croak("%s", e.what());
@@ -265,16 +262,12 @@ int checkSignature(SV * publicKey_, SV * sig_, char * msg)
     CODE:
         try {
             STRLEN publicKeyLen;
-            unsigned char * publicKey = (unsigned char *) SvPV(publicKey_, publicKeyLen);
-            if (publicKeyLen != crypto_sign_PUBLICKEYBYTES)
-                throw Error("public key is not valid");
+            char * publicKey = SvPV(publicKey_, publicKeyLen);
+            auto key = PublicKey::fromRaw("", {publicKey, publicKeyLen});
 
             STRLEN sigLen;
-            unsigned char * sig = (unsigned char *) SvPV(sig_, sigLen);
-            if (sigLen != crypto_sign_BYTES)
-                throw Error("signature is not valid");
-
-            RETVAL = crypto_sign_verify_detached(sig, (unsigned char *) msg, strlen(msg), publicKey) == 0;
+            char * sig = SvPV(sig_, sigLen);
+            RETVAL = key.verifyDetached(msg, {sig, sigLen});
         } catch (Error & e) {
             croak("%s", e.what());
         }

perl/lib/Nix/meson.build

@@ -23,7 +23,6 @@ perl_libstore = shared_module(
   dependencies : [
     libstore,
     libutil,
-    sodium,
     perl_include,
     kj,
   ],

perl/meson.build

@@ -60,8 +60,6 @@ perl_include = declare_dependency(
   include_directories : include_directories(perl_incdir, is_system : true),
 )
 
-sodium = dependency('libsodium', 'sodium', required : true)
-
 if cxx.get_linker_id() in ['ld.bfd', 'ld.gold']
   add_project_link_arguments('-Wl,--no-copy-dt-needed-entries', language : 'cpp')
 endif

tests/functional/repl_characterization/meson.build

@@ -10,7 +10,6 @@ repl_characterization_tester = executable(
     libasanoptions,
     liblixutil,
     liblixutil_test_support,
-    sodium,
     editline,
     boost,
     lowdown,

tests/functional/test-libstoreconsumer/meson.build

@@ -5,7 +5,6 @@ libstoreconsumer_tester = executable(
     libasanoptions,
     liblixutil,
     liblixstore,
-    sodium,
     editline,
     boost,
     lowdown,