key_set.h File Reference

Go to the source code of this file.

Data Structures
struct	acds_create_key_set_t
	The useful part of acds create key set is in request, count: together they describe what is pending, who owns it, and how much data is valid. Keep the object with its parent operation and use the parent cleanup path. request and reserved_string are adjacent to preserve the legacy trailing name. More...

Functions
asciichat_error_t	acds_create_key_set_collect (acds_create_key_set_t *set, const acip_session_create_t *req, bool require_identity, bool *complete)

Function Documentation

acds_create_key_set_collect()

asciichat_error_t acds_create_key_set_collect	(	acds_create_key_set_t *	set,
		const acip_session_create_t *	req,
		bool	require_identity,
		bool *	complete )

Validate order, bounds, deduplication and individual possession proofs. Errors clear the sequence. complete is true only when every key is present.

Definition at line 6 of file key_set.c.

                                                                                     {
  if (!set || !req || !complete)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing create sequence parameters");
  *complete = false;
  size_t total = req->total_keys ? req->total_keys : 1;
  if (total > MAX_SESSION_KEYS || req->key_index >= total || req->key_index != set->count ||
      (!req->total_keys && set->count) ||
      (set->count && (req->total_keys != set->request.total_keys || req->capabilities != set->request.capabilities ||
                      req->max_participants != set->request.max_participants)) ||
      req->reserved_string_len >= ACIP_MAX_SESSION_STRING_LEN ||
      !memchr(req->server_address, '\0', sizeof(req->server_address)) ||
      (req->has_password && !memchr(req->password_hash, '\0', sizeof(req->password_hash)))) {
    memset(set, 0, sizeof(*set));
    return SET_ERRNO(ERROR_INVALID_PARAM, "Malformed or out-of-order create sequence");
  }
  for (size_t i = 0; i < set->count; ++i) {
    if (memcmp(set->keys[i], req->identity_pubkey, sizeof(req->identity_pubkey)) == 0) {
      memset(set, 0, sizeof(*set));
      return SET_ERRNO(ERROR_INVALID_PARAM, "Duplicate Ed25519 identity");
    }
  }
  // Every member of a restricted set proves possession. Optional single-key
  // identity keeps its existing service-wide policy.
  if (require_identity || total > 1) {
    if (!acds_validate_timestamp(req->timestamp, 300) ||
        acds_verify_session_create(req->identity_pubkey, req->timestamp, req->capabilities, req->max_participants,
                                   req->signature) != ASCIICHAT_OK) {
      memset(set, 0, sizeof(*set));
      return SET_ERRNO(ERROR_CRYPTO_VERIFICATION, "Invalid create identity proof");
    }
  }
  if (!set->count) {
    memcpy(&set->request, req, sizeof(*req));
    if (req->reserved_string_len)
      memcpy(set->reserved_string, req + 1, (size_t)req->reserved_string_len);
  }
  memcpy(set->keys[set->count++], req->identity_pubkey, sizeof(req->identity_pubkey));
  *complete = set->count == total;
  return ASCIICHAT_OK;
}

References acds_validate_timestamp(), acds_verify_session_create(), ACIP_MAX_SESSION_STRING_LEN, acip_session_create_t, ASCIICHAT_OK, acds_create_key_set_t::count, ERROR_CRYPTO_VERIFICATION, ERROR_INVALID_PARAM, acds_create_key_set_t::keys, MAX_SESSION_KEYS, acds_create_key_set_t::request, acds_create_key_set_t::reserved_string, and SET_ERRNO.