WHCandCursor
dade4072cf
Introduce a user Realm keypair (Monocypher) that signs instance certificates so same-domain peers can later auto-discover and connect. Co-authored-by: Cursor <cursoragent@cursor.com>
60 lines
2.1 KiB
C
60 lines
2.1 KiB
C
#ifndef CST_REALM_H
|
|
#define CST_REALM_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/* User Realm keys (Ed25519). The seed is the durable secret; sk is the
|
|
* Monocypher expanded secret (seed||pk). Same Realm public key ⇒ peers may
|
|
* auto-discover and auto-connect. */
|
|
typedef struct cst_realm_keys {
|
|
uint8_t seed[32];
|
|
uint8_t sk[64];
|
|
uint8_t pk[32];
|
|
} cst_realm_keys_t;
|
|
|
|
/* Instance certificate signed by the Realm private key. */
|
|
typedef struct cst_realm_cert {
|
|
char instance_id[64];
|
|
char label[128];
|
|
uint8_t instance_pk[32];
|
|
int64_t not_after; /* unix seconds; 0 = no expiry */
|
|
uint8_t realm_pk[32];
|
|
uint8_t sig[64];
|
|
} cst_realm_cert_t;
|
|
|
|
/* Directory helpers: <config>/realm/{private.key,public.key,revoked}. */
|
|
int cst_realm_dir(char *out, size_t n);
|
|
int cst_realm_generate(cst_realm_keys_t *out);
|
|
int cst_realm_derive(cst_realm_keys_t *out, const uint8_t seed[32]);
|
|
int cst_realm_save(const char *dir, const cst_realm_keys_t *k);
|
|
int cst_realm_load(const char *dir, cst_realm_keys_t *out);
|
|
/* 32 hex chars (blake2b-128 of pk). */
|
|
int cst_realm_fingerprint(const uint8_t pk[32], char out[33]);
|
|
|
|
int cst_realm_enroll(const cst_realm_keys_t *realm, const char *instance_id,
|
|
const char *label, int64_t not_after, cst_realm_cert_t *cert,
|
|
uint8_t instance_seed[32], uint8_t instance_sk[64]);
|
|
int cst_realm_verify_cert(const uint8_t realm_pk[32], const cst_realm_cert_t *cert,
|
|
int64_t now_unix);
|
|
char *cst_realm_cert_to_json(const cst_realm_cert_t *cert);
|
|
int cst_realm_cert_from_json(const char *json, cst_realm_cert_t *out);
|
|
|
|
int cst_realm_challenge_sign(const uint8_t instance_sk[64], const void *chal,
|
|
size_t n, uint8_t sig[64]);
|
|
int cst_realm_challenge_check(const cst_realm_cert_t *cert, const void *chal,
|
|
size_t n, const uint8_t sig[64]);
|
|
|
|
int cst_realm_revoke_add(const char *dir, const char *instance_id);
|
|
int cst_realm_revoked(const char *dir, const char *instance_id);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|