diff options
Diffstat (limited to 'poc/spike6_gek.py')
| -rw-r--r-- | poc/spike6_gek.py | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/poc/spike6_gek.py b/poc/spike6_gek.py index 89ab06c..e58823b 100644 --- a/poc/spike6_gek.py +++ b/poc/spike6_gek.py @@ -16,18 +16,25 @@ Validates the full GEK lifecycle: The hub stores opaque encrypted blobs — it never sees the GEK in cleartext. """ -import asyncio, httpx, base64, os, json, time +import asyncio +import base64 +import json +import os +import time from pathlib import Path + +import blake3 +import httpx +from cryptography.hazmat.primitives import hashes, serialization from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 from cryptography.hazmat.primitives.kdf.hkdf import HKDF -from cryptography.hazmat.primitives import hashes, serialization -import blake3 HUB_URL = "http://meshbay.org" STATE_FILE = Path("node_state.json") -PASS = "✓"; FAIL = "✗" +PASS = "✓" +FAIL = "✗" # ── Key helpers ──────────────────────────────────────────────────────────────── @@ -194,7 +201,9 @@ async def main(): bundle_alice = wrap_gek(gek_raw, pk_alice_x_raw) print(f" {PASS} Wrapped in {(time.perf_counter()-t0)*1000:.2f}ms") print(f" pk_eph : {bundle_alice['pk_eph_b64'][:24]}...") - print(f" wrapped : {bundle_alice['wrapped_b64'][:24]}... ({len(base64.b64decode(bundle_alice['wrapped_b64']))}B)") + wrapped = bundle_alice["wrapped_b64"] + print(f" wrapped : {wrapped[:24]}... " + f"({len(base64.b64decode(wrapped))}B)") r = await c.post( f"{HUB_URL}/v1/groups/{group_id}/members/{state.get('username','node_cbesson')}/gek", @@ -218,7 +227,7 @@ async def main(): wrap_ms = (time.perf_counter()-t0)*1000 print(f" {PASS} Wrapped in {wrap_ms:.2f}ms") print(f" pk_eph : {bundle_bob['pk_eph_b64'][:24]}...") - print(f" (different from Alice's bundle — ephemeral key is unique)") + print(" (different from Alice's bundle — ephemeral key is unique)") r = await c.post( f"{HUB_URL}/v1/groups/{group_id}/members/bob_member/gek", @@ -301,10 +310,10 @@ async def main(): print(f" {PASS} Wrong private key correctly rejected (AEAD auth failed)") print("\n" + "="*55) - print(f"Spike 6 COMPLETE — GEK distribution validated.") + print("Spike 6 COMPLETE — GEK distribution validated.") print(f" wrap_gek : {wrap_ms:.2f} ms") print(f" unwrap_gek : {unwrap_ms:.2f} ms") - print(f" Hub role : stores opaque bundle, never sees GEK in clear") - print(f" Security : wrong key rejected by AEAD authentication tag") + print(" Hub role : stores opaque bundle, never sees GEK in clear") + print(" Security : wrong key rejected by AEAD authentication tag") asyncio.run(main()) |