Skip to content
This repository has been archived by the owner on Oct 11, 2024. It is now read-only.

Encapsulate Client Verifier State in test vectors #1316

Merged
merged 8 commits into from
Jul 15, 2019
Merged

Encapsulate Client Verifier State in test vectors #1316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
67309a4
LogRootRequest proto
gdbelvin Jul 8, 2019
03017f6
last_verified_log_root documentation
gdbelvin Jul 11, 2019
f40ba2e
Save LastVerifiedLogRoot
gdbelvin Jul 11, 2019
98ae6b7
Use LastVerified in tests
gdbelvin Jul 11, 2019
fb90383
Regenerate test vectors
gdbelvin Jul 11, 2019
a145c8c
nits
gdbelvin Jul 15, 2019
08a5cf5
Merge branch 'master' into logstate
gdbelvin Jul 15, 2019
8c6b98d
Better comment for root_hash
gdbelvin Jul 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions core/api/v1/keytransparency.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,14 @@ message MapRoot {
repeated bytes log_inclusion = 2;
}

// LogRootRequest contains the information needed to request and verify LogRoot.
message LogRootRequest {
// root_hash is the root hash of the last log root the client verified.
bytes root_hash = 1;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why does the log root request contain the log root hash? Isn't it supposed to be returned as a result of the request?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The LogRootRequest is intended to encode the client's verifier state, as is being done in this PR; but it has a second purpose, which is to make request, response pairs statelessly verifiable. At the moment, an observer of the system, or a server interceptor can't tell if a response is valid because the first hash of the consistency proof is not included in either the request or the response.

// tree_size is the tree size of the last log root the client verified.
int64 tree_size = 2;
}

// LogRoot contains the latest log root and its consistency proof.
message LogRoot {
// log_root is the latest globally consistent log root.
Expand Down
299 changes: 176 additions & 123 deletions core/api/v1/keytransparency_go_proto/keytransparency.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 6 additions & 6 deletions core/client/verifier/verifier_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,17 +47,17 @@ func RunTranscriptTest(t *testing.T, transcript *tpb.Transcript) {
t.Fatal(err)
}

trusted := &types.LogRootV1{}
for _, rpc := range transcript.Actions {
t.Run(rpc.Desc, func(t *testing.T) {
trusted := types.LogRootV1{
TreeSize: uint64(rpc.LastVerifiedLogRoot.GetTreeSize()),
RootHash: rpc.LastVerifiedLogRoot.GetRootHash(),
}
switch pair := rpc.ReqRespPair.(type) {
case *tpb.Action_GetUser:
slr, smr, err := v.VerifyRevision(pair.GetUser.Response.Revision, *trusted)
_, smr, err := v.VerifyRevision(pair.GetUser.Response.Revision, trusted)
if err != nil {
t.Errorf("VerifyRevision(): %v", err)
}
if err == nil && rpc.TrustNewLog {
trusted = slr
t.Fatalf("VerifyRevision(): %v", err)
}
if err := v.VerifyMapLeaf(
transcript.Directory.DirectoryId,
Expand Down
21 changes: 17 additions & 4 deletions core/integration/client_tests.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,6 +260,7 @@ func TestEmptyGetAndUpdate(ctx context.Context, env *Env, t *testing.T) []*tpb.A
} {
t.Run(tc.desc, func(t *testing.T) {
// Check profile.
reqSLR := *slr
e, newslr, err := CheckProfile(ctx, env, tc.userID, tc.wantProfile, slr)
if err != nil {
t.Fatalf("%v", err)
Expand All @@ -272,10 +273,17 @@ func TestEmptyGetAndUpdate(ctx context.Context, env *Env, t *testing.T) []*tpb.A
slr = newslr
}
transcript = append(transcript, &tpb.Action{
Desc: tc.desc,
TrustNewLog: trust,
Desc: tc.desc,
LastVerifiedLogRoot: &pb.LogRootRequest{
TreeSize: int64(reqSLR.TreeSize),
RootHash: reqSLR.RootHash,
},
ReqRespPair: &tpb.Action_GetUser{GetUser: &tpb.GetUser{
Request: &pb.GetUserRequest{UserId: tc.userID},
Request: &pb.GetUserRequest{
DirectoryId: env.Directory.DirectoryId,
UserId: tc.userID,
LastVerifiedTreeSize: int64(reqSLR.TreeSize),
},
Response: e,
}},
})
Expand Down Expand Up @@ -399,7 +407,8 @@ func TestBatchGetUser(ctx context.Context, env *Env, t *testing.T) []*tpb.Action
if err != nil {
t.Fatalf("BatchGetUser(): %v", err)
}
_, smr, err := env.Client.VerifyRevision(resp.Revision, types.LogRootV1{})
slr := types.LogRootV1{}
_, smr, err := env.Client.VerifyRevision(resp.Revision, slr)
if err != nil {
t.Fatalf("VerifyRevision(): %v", nil)
}
Expand All @@ -413,6 +422,10 @@ func TestBatchGetUser(ctx context.Context, env *Env, t *testing.T) []*tpb.Action
}
transcript = append(transcript, &tpb.Action{
Desc: tc.desc,
LastVerifiedLogRoot: &pb.LogRootRequest{
TreeSize: int64(slr.TreeSize),
RootHash: slr.RootHash,
},
ReqRespPair: &tpb.Action_BatchGetUser{
BatchGetUser: &tpb.BatchGetUser{
Request: &pb.BatchGetUserRequest{UserIds: userIDs},
Expand Down
4 changes: 2 additions & 2 deletions core/testdata/TestBatchCreate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"directory": {
"directoryId": "integration",
"log": {
"treeId": "6351326452095781645",
"treeId": "8172687717364565544",
"treeType": "PREORDERED_LOG",
"hashStrategy": "RFC6962_SHA256",
"hashAlgorithm": "SHA256",
Expand All @@ -13,7 +13,7 @@
}
},
"map": {
"treeId": "8005363257432365208",
"treeId": "8476932576446208687",
"treeType": "MAP",
"hashStrategy": "CONIKS_SHA256",
"hashAlgorithm": "SHA256",
Expand Down
Loading