mirror of
https://github.com/luxfi/mpc.git
synced 2026-10-30 14:45:41 +00:00
zeekay
82bd565201
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
143 lines
3.8 KiB
Go
143 lines
3.8 KiB
Go
package approval
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/pem"
|
|
"errors"
|
|
"fmt"
|
|
"sync"
|
|
"time"
|
|
|
|
luxhsm "github.com/luxfi/hsm"
|
|
)
|
|
|
|
// ZymbitProvider produces ECDSA-P256 approval signatures via Zymbit SCM
|
|
// (HSM6 / ZYMKEY) over the local REST API. Useful for on-prem, air-gapped,
|
|
// or edge approval ceremonies where the executive is co-located with the
|
|
// Zymbit device.
|
|
//
|
|
// Configuration:
|
|
//
|
|
// api_addr — Zymbit REST API URL (default "http://localhost:6789").
|
|
//
|
|
// Approver enrollment maps approverID -> Zymbit slot ID + cached SPKI public
|
|
// key. Slots must be provisioned out-of-band on the Zymbit device.
|
|
type ZymbitProvider struct {
|
|
signer luxhsm.Signer
|
|
|
|
mu sync.RWMutex
|
|
identity map[string]zymbitEntry
|
|
}
|
|
|
|
type zymbitEntry struct {
|
|
SlotID string // Zymbit slot ("0", "1", ...)
|
|
PubKey *ecdsa.PublicKey
|
|
PubKeyDER []byte
|
|
}
|
|
|
|
func NewZymbit(config map[string]string) (ApprovalProvider, error) {
|
|
apiAddr := ""
|
|
if config != nil {
|
|
apiAddr = config["api_addr"]
|
|
}
|
|
signer, err := luxhsm.NewSigner("zymbit", map[string]string{"api_addr": apiAddr})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("approval/zymbit: %w", err)
|
|
}
|
|
return &ZymbitProvider{
|
|
signer: signer,
|
|
identity: make(map[string]zymbitEntry),
|
|
}, nil
|
|
}
|
|
|
|
func (p *ZymbitProvider) Provider() string { return "zymbit" }
|
|
|
|
func (p *ZymbitProvider) Enroll(approverID, slotID string, pubKeyDER []byte) error {
|
|
pub, err := x509.ParsePKIXPublicKey(pubKeyDER)
|
|
if err != nil {
|
|
return fmt.Errorf("approval/zymbit: parse public key: %w", err)
|
|
}
|
|
ecPub, ok := pub.(*ecdsa.PublicKey)
|
|
if !ok {
|
|
return errors.New("approval/zymbit: enrolled key is not ECDSA")
|
|
}
|
|
if ecPub.Curve != elliptic.P256() {
|
|
return fmt.Errorf("approval/zymbit: unsupported curve %s (want P-256)", ecPub.Curve.Params().Name)
|
|
}
|
|
p.mu.Lock()
|
|
defer p.mu.Unlock()
|
|
p.identity[approverID] = zymbitEntry{
|
|
SlotID: slotID,
|
|
PubKey: ecPub,
|
|
PubKeyDER: pubKeyDER,
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (p *ZymbitProvider) EnrollPEM(approverID, slotID string, pemBytes []byte) error {
|
|
block, _ := pem.Decode(pemBytes)
|
|
if block == nil {
|
|
return errors.New("approval/zymbit: invalid PEM")
|
|
}
|
|
return p.Enroll(approverID, slotID, block.Bytes)
|
|
}
|
|
|
|
func (p *ZymbitProvider) GetPublicIdentity(_ context.Context, approverID string) (PublicIdentity, error) {
|
|
p.mu.RLock()
|
|
defer p.mu.RUnlock()
|
|
entry, ok := p.identity[approverID]
|
|
if !ok {
|
|
return PublicIdentity{}, fmt.Errorf("approval/zymbit: approver %q not enrolled", approverID)
|
|
}
|
|
return PublicIdentity{
|
|
ApproverID: approverID,
|
|
Provider: p.Provider(),
|
|
PublicKey: entry.PubKeyDER,
|
|
Algorithm: AlgorithmECDSAP256,
|
|
}, nil
|
|
}
|
|
|
|
func (p *ZymbitProvider) ApproveIntent(ctx context.Context, approverID string, intent CanonicalIntent) (ApprovalSignature, error) {
|
|
p.mu.RLock()
|
|
entry, ok := p.identity[approverID]
|
|
p.mu.RUnlock()
|
|
if !ok {
|
|
return ApprovalSignature{}, fmt.Errorf("approval/zymbit: approver %q not enrolled", approverID)
|
|
}
|
|
digest := intent.Digest()
|
|
sig, err := p.signer.Sign(ctx, entry.SlotID, intent.Bytes())
|
|
if err != nil {
|
|
return ApprovalSignature{}, fmt.Errorf("approval/zymbit: sign: %w", err)
|
|
}
|
|
return ApprovalSignature{
|
|
ApproverID: approverID,
|
|
Provider: p.Provider(),
|
|
IntentDigest: digest,
|
|
Signature: sig,
|
|
Timestamp: time.Now().UTC(),
|
|
Algorithm: AlgorithmECDSAP256,
|
|
}, nil
|
|
}
|
|
|
|
func (p *ZymbitProvider) VerifyApproval(_ context.Context, intent CanonicalIntent, sig ApprovalSignature) (bool, error) {
|
|
if sig.Provider != p.Provider() || sig.Algorithm != AlgorithmECDSAP256 {
|
|
return false, nil
|
|
}
|
|
digest := intent.Digest()
|
|
if digest != sig.IntentDigest {
|
|
return false, nil
|
|
}
|
|
p.mu.RLock()
|
|
entry, ok := p.identity[sig.ApproverID]
|
|
p.mu.RUnlock()
|
|
if !ok {
|
|
return false, nil
|
|
}
|
|
h := sha256.Sum256(intent.Bytes())
|
|
return ecdsa.VerifyASN1(entry.PubKey, h[:], sig.Signature), nil
|
|
}
|