mid-signer: the DeviceSigner seam as a no_std leaf - #3
Open
Ttimmahlax wants to merge 2 commits into
Open
Conversation
`DeviceSigner` (a stable device id and a low-s ECDSA P-256 signature over a 32-byte prehash) and `InMemoryDeviceSigner` move out of `kms-client` into `mid-signer`, `no_std` + `alloc` without the `std` feature, so a hardware implementation (secure element, eFuse key, an ESP32's DS peripheral) depends on the trait and `p256` alone and no consumer has to pull an HTTP client to name it. `canonical_bytes` is the shared low-s rule, public so a part that returns raw (r, s) applies the same one. `kms-client` depends on the leaf and re-exports both names at their old paths; `mata-sign` and `mid-issuer` compile unchanged. A blanket impl for `&T` lets `&dyn DeviceSigner` and `impl DeviceSigner` callers coexist. Gates: mid-signer 4 tests (every signature low-s, deterministic and verifying; the canonical rule on a flipped twin; the reference impl; the SEC1 pubkey), kms-client 3 + 5 end-to-end + doctests, riscv32imac no_std check of mid-signer, workspace check. `kms-verifier` fails clippy on its own `len_without_is_empty`, untouched here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`InMemoryDeviceSigner` moves behind an `alloc` feature (implied by `std`, on by default); without it the crate is `DeviceSigner` and `canonical_bytes` over `core` and `p256` alone, which is what a microcontroller with its key in hardware links. riscv32imac checks with and without `alloc`; kms-client and the workspace unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1 (
no-std-types), the other half of the same seam.What
mid-signer(new):DeviceSigner—device_id(&self) -> &str,sign_prehash(&self, &[u8; 32]) -> [u8; 64](low-s) — andInMemoryDeviceSigner, moved verbatim out ofkms-client, pluscanonical_bytes(Signature) -> [u8; 64](the low-s rule, public so a hardware part that returns raw(r, s)applies the same one) and a blanketimpl DeviceSigner for &T.no_std+allocwithout the defaultstdfeature;stdadds p256's std types and thegeneratehelper's OS randomness.kms-clientdepends on the leaf and re-exportsDeviceSigner/InMemoryDeviceSignerat the old paths, somata-sign,mid-issuerand every downstream keep compiling. Its ownrand_coredependency goes with the helper.Why
Every signer implementation and every consumer of the trait currently has to depend on
kms-client, which bringsreqwestand a runtime. The Janus ESP32 family carries a copy of the trait for that reason (rusty_esp_mid-core::signer, byte-for-byte this one, with a comment saying "whenmidextracts it into a leaf crate, this module becomes a re-export"). This is that leaf.Gates
cargo test -p mid-signer -p kms-clientcargo check -p mid-signer --no-default-features --target riscv32imac-unknown-none-elfcargo check --workspacecargo clippy -p mid-signer --all-targets -- -D warningskms-verifierhas a pre-existinglen_without_is_empty, untouched)🤖 Generated with Claude Code