ENG-1446: Verify enclave sig in export/import #31
Conversation
export/index.html
Outdated
| /** | ||
| * Function to verify enclave signature on import bundle received from the server. | ||
| */ | ||
| const verifyEnclaveSignature = async (enclaveQuorumPublic, publicSignature, publicKey) => { |
There was a problem hiding this comment.
do you know if it's possible to use JS modules within an iFrame? I'm seeing a lot of duplicate code which will become harder to maintain. It'd be awesome if we could use a module system although it might not be possible
There was a problem hiding this comment.
yep! the HpkeEncrypt and HpkeDecrypt code are actually already JS modules. at some point early on, i tried to DRY up the shared code across the 3 pages but it is a lot of refactoring. as some follow ups, i think we modularize:
- part 1: import/index.html and import/standalone.html
- part 2: import and export
- part 3: import/export and auth
| @@ -12,7 +12,7 @@ jobs: | |||
| runs-on: ubuntu-latest | |||
| strategy: | |||
| matrix: | |||
| directory: ["auth", "export"] | |||
| directory: ["auth", "export", "import"] | |||
…pers and tests to import
oliviathet
force-pushed
the
olivia/verify-enclave-sig
branch
from
be10770 to
86da7fb
Compare
…ns. convert arrow fns to declarative fns to avoid ordering issues.
…ns. convert arrow fns to declarative fns to avoid ordering issues.
|
@r-n-o Updated the padding function, now called |
| @@ -160,4 +161,78 @@ describe("TKHQ", () => { | |||
| // TODO: test logMessage / sendMessageUp | |||
| expect(true).toBe(true); | |||
| }) | |||
|
|
|||
| it("normalizes padding in a byte array", () => { | |||
Based on ToB findings. Pin the signer enclave's quorum public key to import and export sites and verify the signed public keys from the enclave. Once we've deployed a new release that returns the enclave quorum public key in the import and export bundles, we can implement the TODOs I've left for checking that those fields aren't null and can be compared to the pinned quorum public key -- this lets the client know when the pinned quorum public key should be rotated.