diff --git a/cmd/generate_keys/main.go b/cmd/generate_keys/main.go index 191fe453..c18d3e3e 100644 --- a/cmd/generate_keys/main.go +++ b/cmd/generate_keys/main.go @@ -31,6 +31,7 @@ var ( outPriv = flag.String("out_priv", "", "Output file for private key.") outPub = flag.String("out_pub", "", "Output file for public key.") print = flag.Bool("print", false, "Print private key, then public key, over 2 lines, to stdout.") + mldsa = flag.Bool("mldsa", false, "If set, generates an MLDSA-44 key, ed25519 otherwise.") ) func main() { @@ -47,14 +48,26 @@ func main() { } } - skey, vkey, err := note.GenerateKey(rand.Reader, *origin) - if err != nil { - klog.Exitf("Unable to create key: %q", err) - } + var ( + skey, vkey string + err error + ) + + if *mldsa { + skey, vkey, err = f_note.GenerateMLDSAKey(*origin) + if err != nil { + klog.Exitf("Unable to create MLDSA key: %q", err) + } + } else { + skey, vkey, err = note.GenerateKey(rand.Reader, *origin) + if err != nil { + klog.Exitf("Unable to create ed25519 key: %q", err) + } - vkey, err = f_note.VKeyToCosignatureV1(vkey) - if err != nil { - klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err) + vkey, err = f_note.VKeyToCosignatureV1(vkey) + if err != nil { + klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err) + } } if *print { diff --git a/cmd/generate_keys_gcp/main.go b/cmd/generate_keys_gcp/main.go index bf12a2d7..15904c36 100644 --- a/cmd/generate_keys_gcp/main.go +++ b/cmd/generate_keys_gcp/main.go @@ -34,6 +34,7 @@ var ( origin = flag.String("origin", "", "Witness origin for the key.") resourceSuffix = flag.String("resource_suffix", "", "Suffix to be used when naming Secret Manager resources.") projectID = flag.String("project_id", os.Getenv("GOOGLE_CLOUD_PROJECT"), "GCP Project ID in which to store the generated secret & public keys.") + mldsa = flag.Bool("mldsa", false, "If set, generates an MLDSA-44 key, ed25519 otherwise.") ) func main() { @@ -62,30 +63,40 @@ func main() { } }() + var ( + skey, vkey string + ) + // Generate key pair - sec, pub, err := note.GenerateKey(rand.Reader, *origin) - if err != nil { - klog.Exitf("Unable to create key: %q", err) - } + if *mldsa { + skey, vkey, err = f_note.GenerateMLDSAKey(*origin) + if err != nil { + klog.Exitf("Unable to create MLDSA key: %q", err) + } + } else { + skey, vkey, err = note.GenerateKey(rand.Reader, *origin) + if err != nil { + klog.Exitf("Unable to create ed25519 key: %q", err) + } - // Convert pubk to a cosig/v1 key. - pub, err = f_note.VKeyToCosignatureV1(pub) - if err != nil { - klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err) + vkey, err = f_note.VKeyToCosignatureV1(vkey) + if err != nil { + klog.Exitf("Failed to convert ed25519 vkey to Cosig/V1 vkey: %v", err) + } } // Store keys in Secret Manager. pubKName := fmt.Sprintf("witness-verifier-%s", safeResource(*resourceSuffix)) - if err := createSecret(ctx, *projectID, client, pubKName, pub); err != nil { + if err := createSecret(ctx, *projectID, client, pubKName, vkey); err != nil { exit("Failed to create secret %q: %v", pubKName, err) } secKName := fmt.Sprintf("witness-secret-%s", safeResource(*resourceSuffix)) - if err := createSecret(ctx, *projectID, client, secKName, sec); err != nil { + if err := createSecret(ctx, *projectID, client, secKName, skey); err != nil { exit("Failed to create secret %q: %v", secKName, err) } // All done! - fmt.Printf("Created new witness keypair:\n Secret name: %s\n Public name: %v\n\nPublic Key:\n%s\n", secKName, pubKName, pub) + fmt.Printf("Created new witness keypair:\n Secret name: %s\n Public name: %v\n\nPublic Key:\n%s\n", secKName, pubKName, vkey) } // safeResource attempts to derive a safe GCP resource name from the provided origin string. diff --git a/go.mod b/go.mod index 14b216c1..14f7980a 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/gorilla/mux v1.8.1 github.com/mattn/go-sqlite3 v1.14.42 github.com/prometheus/client_golang v1.23.2 - github.com/transparency-dev/formats v0.1.0 + github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464 github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14 github.com/transparency-dev/serverless-log v0.0.0-20250425165558-64e1d2007a10 github.com/transparency-dev/tessera v1.0.3-0.20260303172654-b64a6fdf82f4 @@ -33,6 +33,7 @@ require ( cloud.google.com/go/iam v1.7.0 // indirect cloud.google.com/go/longrunning v0.9.0 // indirect cloud.google.com/go/monitoring v1.25.0 // indirect + filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e // indirect github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect github.com/beorn7/perks v1.0.1 // indirect diff --git a/go.sum b/go.sum index 1dcdab2b..c9b3f7ad 100644 --- a/go.sum +++ b/go.sum @@ -19,6 +19,8 @@ cloud.google.com/go/secretmanager v1.19.0 h1:dm9BK06xl+hrxp2unT2psjZeypPj5c6uPiA cloud.google.com/go/secretmanager v1.19.0/go.mod h1:9OmSuOeiiUicANglrbdKWSnT3gYkRcXuUQDk7dDW0zU= cloud.google.com/go/spanner v1.90.0 h1:tVUzYI9IZJY1SDvCmCzyuLoaAyotZgiyQq6go+lNH5A= cloud.google.com/go/spanner v1.90.0/go.mod h1:8NB5a7qgwIhGD19Ly+vkpKffPL78vIG9RcrgsuREha0= +filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e h1:VsUbObBMxXlc23Eb9VeeJYE4jvTs87qa5RqSN2U5FJU= +filippo.io/mldsa v0.0.0-20260215214346-43d0283efc3e/go.mod h1:32qQ5yj3R24Eu03iWFWchdC3OB653wPvoepWejkefbY= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0 h1:BzsL0qE7LvtTEtXG7Dt5NS1EP0CQwI21HZfj9aGghhw= github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0/go.mod h1:I7kE2kM3qCr9QPT4cU4cCFYkEpVyVr16YOGUHzy+nR0= @@ -137,8 +139,10 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/transparency-dev/formats v0.1.0 h1:oL0zUFuYUjg8AbtjPMnIRDmjbaHo5jCjEWU5yaNuz0g= -github.com/transparency-dev/formats v0.1.0/go.mod h1:d2FibUOHfCMdCe/+/rbKt1IPLBbPTDfwj46kt541/mU= +github.com/transparency-dev/formats v0.1.1-0.20260505141615-7f7fdcf1625e h1:Narnmxre3uwnDefYUaGlLjFboH8TIFpBDXtfi6EuRRQ= +github.com/transparency-dev/formats v0.1.1-0.20260505141615-7f7fdcf1625e/go.mod h1:WUGHNGM6NfGokBnNSJ14qM4MSDmgEyoobjoM9aDgAM0= +github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464 h1:AEnMKcjHe3UvIPEB+Bm73I+Od8EfFYiCApTIgR4PBCQ= +github.com/transparency-dev/formats v0.1.1-0.20260505144013-1e3a4ad78464/go.mod h1:WUGHNGM6NfGokBnNSJ14qM4MSDmgEyoobjoM9aDgAM0= github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14 h1:K8JqF1HyGDXfTdDHtHe7VsIzeuFEcfLhioOXaupKB+Q= github.com/transparency-dev/merkle v0.0.3-0.20240919113952-3c979d16ee14/go.mod h1:EoKPjljyIALg1rldsJwRQVKOJO7sLd6eUqki19ruI80= github.com/transparency-dev/serverless-log v0.0.0-20250425165558-64e1d2007a10 h1:mQ9ZzYoywyFZ4Cvm7PtbFQHm/cnKgWvUUJHQlHG608I=