651396fa13
4 crates, all compile. 16/17 tests pass.
warzone-protocol (core crypto):
- Seed-based identity (Ed25519 + X25519 from 32-byte seed via HKDF)
- BIP39 mnemonic encode/decode (24 words)
- Fingerprint type (SHA-256 truncated, displayed as xxxx:xxxx:xxxx:xxxx)
- ChaCha20-Poly1305 AEAD encrypt/decrypt with random nonce
- HKDF-SHA256 key derivation
- Pre-key bundle generation with Ed25519 signatures
- X3DH key exchange (simplified, needs X25519 identity key in bundle)
- Double Ratchet: full implementation with DH ratchet, chain ratchet,
out-of-order message handling via skipped keys cache
- Message format (WarzoneMessage envelope + RatchetHeader)
- Session type with ratchet state
- Storage trait definitions (PreKeyStore, SessionStore, MessageQueue)
warzone-server (axum):
- sled database (keys, messages, one-time pre-keys)
- Routes: /v1/health, /v1/keys/register, /v1/keys/{fp},
/v1/messages/send, /v1/messages/poll/{fp}, /v1/messages/{id}/ack
warzone-client (CLI):
- `warzone init` — generate seed, show mnemonic, save to ~/.warzone/
- `warzone recover <words>` — restore from mnemonic
- `warzone info` — show fingerprint and keys
- Seed storage at ~/.warzone/identity.seed (600 perms)
- Stubs for send, recv, chat commands
warzone-mule: Phase 4 placeholder
Known issue: X3DH test fails (initiate/respond use different DH ops
due to missing X25519 identity key in bundle). Fix in next step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
41 lines
1.2 KiB
Rust
41 lines
1.2 KiB
Rust
//! Seed storage: encrypts at rest with Argon2 + ChaCha20-Poly1305.
|
|
//! For Phase 1, we store the seed in plaintext. Encryption is TODO.
|
|
|
|
use std::fs;
|
|
use std::path::PathBuf;
|
|
|
|
use warzone_protocol::identity::Seed;
|
|
|
|
fn seed_path() -> PathBuf {
|
|
let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());
|
|
PathBuf::from(home).join(".warzone").join("identity.seed")
|
|
}
|
|
|
|
pub fn save_seed(seed: &Seed) -> anyhow::Result<()> {
|
|
let path = seed_path();
|
|
if let Some(parent) = path.parent() {
|
|
fs::create_dir_all(parent)?;
|
|
}
|
|
// TODO: encrypt with passphrase (Argon2 + ChaCha20-Poly1305)
|
|
fs::write(&path, &seed.0)?;
|
|
// Set permissions to owner-only on Unix
|
|
#[cfg(unix)]
|
|
{
|
|
use std::os::unix::fs::PermissionsExt;
|
|
fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
pub fn load_seed() -> anyhow::Result<Seed> {
|
|
let path = seed_path();
|
|
let bytes = fs::read(&path)
|
|
.map_err(|_| anyhow::anyhow!("No identity found. Run `warzone init` first."))?;
|
|
if bytes.len() != 32 {
|
|
anyhow::bail!("Corrupted seed file");
|
|
}
|
|
let mut seed_bytes = [0u8; 32];
|
|
seed_bytes.copy_from_slice(&bytes);
|
|
Ok(Seed::from_bytes(seed_bytes))
|
|
}
|