54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
package config
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"io"
|
|
"log"
|
|
|
|
"golang.org/x/crypto/hkdf"
|
|
)
|
|
|
|
type Identity struct {
|
|
PublicKey ed25519.PublicKey
|
|
PrivateKey ed25519.PrivateKey
|
|
Fingerprint string // hex SHA256 of public key
|
|
}
|
|
|
|
func DeriveIdentity() Identity {
|
|
//garble:controlflow block_splits=10 junk_jumps=10 flatten_passes=2
|
|
hwid := deriveHWID()
|
|
machineID := platformMachineID()
|
|
if machineID == "" {
|
|
log.Printf("[identity] WARNING: no OS-specific machine ID available, using HWID-only derivation")
|
|
machineID = hwid
|
|
}
|
|
|
|
hkdfReader := hkdf.New(sha256.New, []byte(machineID), []byte(hwid), []byte("overlord-identity"))
|
|
seed := make([]byte, ed25519.SeedSize)
|
|
if _, err := io.ReadFull(hkdfReader, seed); err != nil {
|
|
log.Fatalf("[identity] HKDF derivation failed: %v", err)
|
|
}
|
|
|
|
privateKey := ed25519.NewKeyFromSeed(seed)
|
|
publicKey := privateKey.Public().(ed25519.PublicKey)
|
|
|
|
fp := sha256.Sum256(publicKey)
|
|
|
|
return Identity{
|
|
PublicKey: publicKey,
|
|
PrivateKey: privateKey,
|
|
Fingerprint: hex.EncodeToString(fp[:]),
|
|
}
|
|
}
|
|
|
|
func (id *Identity) Sign(data []byte) []byte {
|
|
return ed25519.Sign(id.PrivateKey, data)
|
|
}
|
|
|
|
func (id *Identity) PublicKeyBase64() string {
|
|
return base64.StdEncoding.EncodeToString(id.PublicKey)
|
|
}
|