1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
"""Tests for password-based key derivation."""
import pytest
from meshbay_common.crypto import pk_to_b64
from meshbay_common.keyderive import (
decrypt_keypair_bundle,
derive_keys_from_password,
encrypt_keypair_bundle,
)
def test_deterministic():
"""Same credentials → same keys."""
sk_ed1, sk_x1 = derive_keys_from_password("alice", "correct-horse")
sk_ed2, sk_x2 = derive_keys_from_password("alice", "correct-horse")
assert pk_to_b64(sk_ed1.public_key()) == pk_to_b64(sk_ed2.public_key())
assert pk_to_b64(sk_x1.public_key()) == pk_to_b64(sk_x2.public_key())
def test_different_users_different_keys():
sk_ed_a, _ = derive_keys_from_password("alice", "samepassword")
sk_ed_b, _ = derive_keys_from_password("bob", "samepassword")
assert pk_to_b64(sk_ed_a.public_key()) != pk_to_b64(sk_ed_b.public_key())
def test_different_passwords_different_keys():
sk_ed1, _ = derive_keys_from_password("alice", "password1")
sk_ed2, _ = derive_keys_from_password("alice", "password2")
assert pk_to_b64(sk_ed1.public_key()) != pk_to_b64(sk_ed2.public_key())
def test_ed_and_x_keys_independent():
sk_ed, sk_x = derive_keys_from_password("user", "pass12345")
from meshbay_common.crypto import sk_to_raw
assert sk_to_raw(sk_ed) != sk_to_raw(sk_x)
def test_bundle_encrypt_decrypt():
sk_ed, sk_x = derive_keys_from_password("alice", "strongpass!")
bundle = encrypt_keypair_bundle(sk_ed, sk_x, "password123", "alice")
sk_ed2, sk_x2 = decrypt_keypair_bundle(bundle, "password123", "alice")
assert pk_to_b64(sk_ed.public_key()) == pk_to_b64(sk_ed2.public_key())
assert pk_to_b64(sk_x.public_key()) == pk_to_b64(sk_x2.public_key())
def test_bundle_wrong_password_rejected():
sk_ed, sk_x = derive_keys_from_password("alice", "correctpass")
bundle = encrypt_keypair_bundle(sk_ed, sk_x, "correctpass", "alice")
with pytest.raises(Exception):
decrypt_keypair_bundle(bundle, "wrongpass", "alice")
def test_bundle_wrong_username_rejected():
sk_ed, sk_x = derive_keys_from_password("alice", "pass12345")
bundle = encrypt_keypair_bundle(sk_ed, sk_x, "pass12345", "alice")
with pytest.raises(Exception):
decrypt_keypair_bundle(bundle, "pass12345", "bob") # wrong username salt
|