gabriel / muse public
keypair.py python
97 lines 3.7 KB
Raw
sha256:e8214e0062ef8ef0af999937df2731655b6082781fc22bc563f58db2f42b1de9 Merge 'bump/muse-v0.2.1' into 'dev' — proposal: chore: bump… Human 9 days ago
1 """Ed25519 keypair utilities for Muse CLI authentication.
2
3 Keys are derived in memory from the OS keychain mnemonic via SLIP-0010 HD
4 derivation. No private key material is ever written to disk.
5
6 Public key encoding
7 --------------------
8 Public keys are transmitted as URL-safe base64 (no padding) of the raw 32-byte
9 Ed25519 public key material — identical to the format expected by MuseHub's
10 ``/api/auth/challenge`` and ``/api/auth/verify`` endpoints.
11
12 Fingerprint
13 -----------
14 ``sha256:<64-hex>`` of the raw 32 public key bytes — the canonical prefixed
15 format used throughout the Muse ecosystem and stored by MuseHub.
16 """
17
18 import base64
19 import logging
20
21 from cryptography.hazmat.primitives.asymmetric.ed25519 import (
22 Ed25519PrivateKey,
23 Ed25519PublicKey,
24 )
25 from cryptography.hazmat.primitives.serialization import (
26 Encoding,
27 PublicFormat,
28 )
29
30 from muse.core.paths import user_keys_dir as _user_keys_dir
31
32 logger = logging.getLogger(__name__)
33
34 _KEYS_DIR = _user_keys_dir()
35
36 # _KEYS_DIR is exported for use by cleanup-keys and security-check commands.
37
38 # ---------------------------------------------------------------------------
39 # Public key encoding helpers
40 # ---------------------------------------------------------------------------
41
42 def public_key_to_b64url(public_key: Ed25519PublicKey) -> str:
43 """Return the canonically prefixed encoding of the raw public key bytes.
44
45 Returns ``"ed25519:<base64url>"`` — the same self-describing format used
46 for all cryptographic values in the Muse ecosystem.
47 """
48 from muse.core.types import encode_pubkey, DEFAULT_SIGN_ALGO
49 raw: bytes = public_key.public_bytes(Encoding.Raw, PublicFormat.Raw)
50 return encode_pubkey(DEFAULT_SIGN_ALGO, raw)
51
52 def public_key_fingerprint(public_key: Ed25519PublicKey) -> str:
53 """Return the canonical ``sha256:<64-hex>`` fingerprint of the raw public key bytes."""
54 from muse.core.types import public_key_fingerprint as _fp # noqa: PLC0415
55 raw: bytes = public_key.public_bytes(Encoding.Raw, PublicFormat.Raw)
56 return _fp(raw)
57
58 # ---------------------------------------------------------------------------
59 # Public API
60 # ---------------------------------------------------------------------------
61
62 def sign_bytes(private_key: Ed25519PrivateKey, data: bytes) -> str:
63 """Sign *data* with *private_key* and return a canonically prefixed signature.
64
65 Args:
66 private_key: Ed25519 private key.
67 data: Raw bytes to sign (the nonce bytes from the challenge token).
68
69 Returns:
70 ``"ed25519:<base64url>"`` of the 64-byte signature — self-describing,
71 consistent with all other cryptographic values in the Muse ecosystem.
72 """
73 from muse.core.types import encode_sig, DEFAULT_SIGN_ALGO
74 signature: bytes = private_key.sign(data)
75 return encode_sig(DEFAULT_SIGN_ALGO, signature)
76
77 def derive_hd_public_info(seed: bytes, rotation_index: int = 0) -> tuple[str, str]:
78 """Derive the Ed25519 public key info from *seed* without writing any file.
79
80 Returns ``(public_key_b64url, fingerprint)`` derived via SLIP-0010 HD path.
81 The private key never leaves memory — no PEM is written.
82
83 Args:
84 seed: 64-byte BIP39 root seed from :func:`muse.core.bip39.mnemonic_to_seed`.
85 rotation_index: Key rotation counter (0 = primary key).
86 """
87 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey as _Ed25519PrivateKey
88 from muse.core.hdkeys import derive_identity_key
89
90 dk = derive_identity_key(seed, index=rotation_index)
91 try:
92 private_key = _Ed25519PrivateKey.from_private_bytes(dk.private_bytes)
93 finally:
94 dk.zero()
95 public_key = private_key.public_key()
96 return public_key_to_b64url(public_key), public_key_fingerprint(public_key)
97
File History 4 commits
sha256:e8214e0062ef8ef0af999937df2731655b6082781fc22bc563f58db2f42b1de9 Merge 'bump/muse-v0.2.1' into 'dev' — proposal: chore: bump… Human 9 days ago
sha256:8de4334a98c945aace420969d389ad678aa926d4ab4e886b2ac4c4241cb3bf2b revert: keep pyproject.toml in canonical PEP 440 form Sonnet 4.6 patch 67 days ago
sha256:a317886dc0496c4af7b285b3e41c86c4c34ea2e79afc63b8829aadb1ada7903f chore: bump version to 0.2.0rc15 to match musehub#113 fix release Sonnet 4.6 patch 67 days ago
sha256:f3b726b50f0aee3622bba751e0a67aa7ae4cf75a798477dbce581940b6a9cf70 feat: migrate invariants cache to .muse/cache/invariants.ms… Sonnet 4.6 patch 134 days ago