mirror of
https://github.com/luxfi/kms.git
synced 2026-10-30 16:23:36 +00:00
zooqueen
d07c071275
The share set is filed under an org and the ring refuses a request that does not name one. The call named a key and nothing else, so every attempt died at the door with "vault_id and key_id required" — and the REK, whose whole job is to root the master in a quorum, has been unreachable since it was written. Not unwired: unable. Config carries a Vault now, Validate requires it, and it travels on the wire. The operation is the one the ring serves. It was spelled Decrypt and sent a `scheme` naming TFHE, which no node implements and this path does not use; the ring calls it reveal and answers it with a quorum of openings. Two names for one thing, and the wrong one was the one on this side. Deleted with it: an Encryptor interface promising Encrypt and Decrypt over "threshold FHE (T-Chain)", the two ZAP methods behind it — one at an op with no handler anywhere — the two HTTP methods posting to /v1/fhe/*, which nothing serves, and the encryptor field a Manager held and never called. Nothing called any of it. It is worth naming why it mattered rather than just that it was dead: an interface advertising the operation made the real one look present, so the reason nobody noticed the reveal path had no caller is that it appeared to have one. Two tests hold what broke. One pins the request to the three field names the ring reads, and to sending nothing else, because those names are a contract with another repo that no compiler checks. The other drives Bootstrap and asserts the vault arrives at the far side — config holding it and the call dropping it look identical from here otherwise.
48 lines
1.5 KiB
Go
48 lines
1.5 KiB
Go
package mpc
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
)
|
|
|
|
// The ring reads vault_id, key_id and ciphertext, and refuses a request missing
|
|
// any of them. That refusal is why this call never once succeeded: the client
|
|
// sent key_id, ciphertext and a scheme, so every reveal died at the door with
|
|
// "vault_id and key_id required" and the REK that depends on it stayed unwired.
|
|
//
|
|
// The names are the contract with a service in another repo, so they are held
|
|
// here rather than left to a struct tag nobody reads.
|
|
func TestRevealRequestNamesWhatTheRingReads(t *testing.T) {
|
|
b, err := json.Marshal(revealRequest{"acme", "master", []byte("sealed")})
|
|
if err != nil {
|
|
t.Fatalf("marshal: %v", err)
|
|
}
|
|
var got map[string]any
|
|
if err := json.Unmarshal(b, &got); err != nil {
|
|
t.Fatalf("unmarshal: %v", err)
|
|
}
|
|
|
|
for _, k := range []string{"vault_id", "key_id", "ciphertext"} {
|
|
if _, ok := got[k]; !ok {
|
|
t.Errorf("%s is absent; the ring refuses the request without it", k)
|
|
}
|
|
}
|
|
if got["vault_id"] != "acme" {
|
|
t.Errorf("vault_id = %v, want acme", got["vault_id"])
|
|
}
|
|
if got["key_id"] != "master" {
|
|
t.Errorf("key_id = %v, want master", got["key_id"])
|
|
}
|
|
if len(got) != 3 {
|
|
t.Errorf("sends %d fields, want exactly 3: %v", len(got), got)
|
|
}
|
|
}
|
|
|
|
// 0x0031 is the op the ring answers with a quorum opening. There is no seal op
|
|
// beside it: sealing needs the group's public key alone, so it never travels.
|
|
func TestRevealOpIsWhatTheRingServes(t *testing.T) {
|
|
if OpReveal != 0x0031 {
|
|
t.Fatalf("OpReveal = %#04x, want 0x0031", OpReveal)
|
|
}
|
|
}
|