feat(keys): VerifyingKeys can be transcoded to/from SPKI DER/PEM

Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.83-slim-bookworm AS builder
+FROM rust:1.86-slim-bookworm AS builder
 
 WORKDIR /usr/src/myapp
 
@@ -30,4 +30,3 @@ RUN apt-get update && apt-get install -y --no-install-recommends libssl3 && apt-
 COPY --from=builder /usr/src/myapp/target/release/prism-cli /usr/local/bin/prism-cli
 
 ENTRYPOINT ["prism-cli"]
-

crates/keys/src/tests.rs

@@ -52,23 +52,59 @@ mod key_tests {
 
     #[test]
     fn test_reparsed_der_verifying_keys_are_equal_to_original() {
-        // Not implemented for ec25519 / eip191 / cosmos_adr36 - skipping that
+        let verifying_key_ed25519 = SigningKey::new_ed25519().verifying_key();
+        let re_parsed_verifying_key =
+            VerifyingKey::from_spki_der(&verifying_key_ed25519.to_spki_der().unwrap()).unwrap();
+        assert_eq!(re_parsed_verifying_key, verifying_key_ed25519);
 
         let verifying_key_secp256r1 = SigningKey::new_secp256r1().verifying_key();
-        let re_parsed_verifying_key = VerifyingKey::from_algorithm_and_der(
-            verifying_key_secp256r1.algorithm(),
-            &verifying_key_secp256r1.to_der().unwrap(),
-        )
-        .unwrap();
+        let re_parsed_verifying_key =
+            VerifyingKey::from_spki_der(&verifying_key_secp256r1.to_spki_der().unwrap()).unwrap();
         assert_eq!(re_parsed_verifying_key, verifying_key_secp256r1);
 
         let verifying_key_secp256k1 = SigningKey::new_secp256k1().verifying_key();
-        let re_parsed_verifying_key = VerifyingKey::from_algorithm_and_der(
-            verifying_key_secp256k1.algorithm(),
-            &verifying_key_secp256k1.to_der().unwrap(),
-        )
-        .unwrap();
+        let re_parsed_verifying_key =
+            VerifyingKey::from_spki_der(&verifying_key_secp256k1.to_spki_der().unwrap()).unwrap();
+        assert_eq!(re_parsed_verifying_key, verifying_key_secp256k1);
+
+        // Not implemented for eip191 / cosmos_adr36 - skipping those
+    }
+
+    #[test]
+    fn test_reparsed_verifying_keys_from_spki_pem_files_are_equal_to_original() {
+        let temp_dir = env::temp_dir();
+
+        // Ed25519
+        let verifying_key_ed25519 = SigningKey::new_ed25519().verifying_key();
+        let spki_path = temp_dir.join("ed25519.pem");
+
+        verifying_key_ed25519.to_spki_pem_file(&spki_path).unwrap();
+        let re_parsed_verifying_key = VerifyingKey::from_spki_pem_file(&spki_path).unwrap();
+
+        assert_eq!(re_parsed_verifying_key, verifying_key_ed25519);
+        remove_file(&spki_path).unwrap();
+
+        // Secp256k1
+        let verifying_key_secp256k1 = SigningKey::new_secp256k1().verifying_key();
+        let spki_path = temp_dir.join("secp256k1.pem");
+
+        verifying_key_secp256k1.to_spki_pem_file(&spki_path).unwrap();
+        let re_parsed_verifying_key = VerifyingKey::from_spki_pem_file(&spki_path).unwrap();
+
         assert_eq!(re_parsed_verifying_key, verifying_key_secp256k1);
+        remove_file(&spki_path).unwrap();
+
+        // Secp256r1
+        let verifying_key_secp256r1 = SigningKey::new_secp256r1().verifying_key();
+        let spki_path = temp_dir.join("secp256r1.pem");
+
+        verifying_key_secp256r1.to_spki_pem_file(&spki_path).unwrap();
+        let re_parsed_verifying_key = VerifyingKey::from_spki_pem_file(&spki_path).unwrap();
+
+        assert_eq!(re_parsed_verifying_key, verifying_key_secp256r1);
+        remove_file(&spki_path).unwrap();
+
+        // EIP-191 and Cosmos ADR-36 are using SECP256K1 keys and are omitted here
     }
 
     #[test]

crates/keys/src/verifying_keys.rs

@@ -1,22 +1,26 @@
 use alloy_primitives::eip191_hash_message;
 use anyhow::{Result, anyhow, bail};
+use ed25519::PublicKeyBytes as Ed25519PublicKeyBytes;
 use ed25519_consensus::VerificationKey as Ed25519VerifyingKey;
+use k256::ecdsa::VerifyingKey as Secp256k1VerifyingKey;
 use p256::{
     ecdsa::{
         VerifyingKey as Secp256r1VerifyingKey,
         signature::{DigestVerifier, hazmat::PrehashVerifier},
     },
-    pkcs8::{DecodePublicKey, EncodePublicKey},
+    pkcs8::EncodePublicKey,
+};
+use pkcs8::{
+    Document, LineEnding, SubjectPublicKeyInfoRef,
+    der::{Decode, pem::PemLabel},
 };
-
-use k256::ecdsa::VerifyingKey as Secp256k1VerifyingKey;
-
 use serde::{Deserialize, Serialize};
 use sha2::Digest as _;
 use std::{
     self,
     borrow::Cow,
     hash::{Hash, Hasher},
+    path::Path,
 };
 use utoipa::{
     PartialSchema, ToSchema,
@@ -84,19 +88,6 @@ impl VerifyingKey {
         }
     }
 
-    pub fn to_der(&self) -> Result<Vec<u8>> {
-        let der = match self {
-            VerifyingKey::Ed25519(_) => bail!("Ed25519 vk to DER format is not implemented"),
-            VerifyingKey::Secp256k1(vk) => vk.to_public_key_der()?.into_vec(),
-            VerifyingKey::Secp256r1(vk) => vk.to_public_key_der()?.into_vec(),
-            VerifyingKey::Eip191(_) => bail!("EIP-191 vk to DER format is not implemented"),
-            VerifyingKey::CosmosAdr36(_) => {
-                bail!("Cosmos ADR-36 vk to DER format is not implemented")
-            }
-        };
-        Ok(der)
-    }
-
     pub fn from_algorithm_and_bytes(algorithm: CryptoAlgorithm, bytes: &[u8]) -> Result<Self> {
         match algorithm {
             CryptoAlgorithm::Ed25519 => Ed25519VerifyingKey::try_from(bytes)
@@ -117,22 +108,6 @@ impl VerifyingKey {
         }
     }
 
-    pub fn from_algorithm_and_der(algorithm: CryptoAlgorithm, bytes: &[u8]) -> Result<Self> {
-        match algorithm {
-            CryptoAlgorithm::Ed25519 => bail!("Ed25519 vk from DER format is not implemented"),
-            CryptoAlgorithm::Secp256k1 => Secp256k1VerifyingKey::from_public_key_der(bytes)
-                .map(VerifyingKey::Secp256k1)
-                .map_err(|e| e.into()),
-            CryptoAlgorithm::Secp256r1 => Secp256r1VerifyingKey::from_public_key_der(bytes)
-                .map(VerifyingKey::Secp256r1)
-                .map_err(|e| e.into()),
-            CryptoAlgorithm::Eip191 => bail!("Eth vk from DER format is not implemented"),
-            CryptoAlgorithm::CosmosAdr36 => {
-                bail!("Cosmos ADR-36 vk from DER format is not implemented")
-            }
-        }
-    }
-
     pub fn algorithm(&self) -> CryptoAlgorithm {
         match self {
             VerifyingKey::Ed25519(_) => CryptoAlgorithm::Ed25519,
@@ -191,6 +166,65 @@ impl VerifyingKey {
             }
         }
     }
+
+    fn to_spki_der_doc(&self) -> Result<Document> {
+        match self {
+            VerifyingKey::Ed25519(vk) => Ed25519PublicKeyBytes(vk.to_bytes()).to_public_key_der(),
+            VerifyingKey::Secp256k1(vk) => vk.to_public_key_der(),
+            VerifyingKey::Secp256r1(vk) => vk.to_public_key_der(),
+            VerifyingKey::Eip191(_) => bail!("EIP-191 vk to DER format is not implemented"),
+            VerifyingKey::CosmosAdr36(_) => {
+                bail!("Cosmos ADR-36 vk to DER format is not implemented")
+            }
+        }
+        .map_err(|_| anyhow!("Creating SPKI DER failed"))
+    }
+
+    pub fn to_spki_der(&self) -> Result<Vec<u8>> {
+        Ok(self.to_spki_der_doc()?.as_bytes().to_vec())
+    }
+
+    pub fn to_spki_pem_file(&self, filename: impl AsRef<Path>) -> Result<()> {
+        self.to_spki_der_doc()?
+            .write_pem_file(filename, SubjectPublicKeyInfoRef::PEM_LABEL, LineEnding::LF)
+            .map_err(|_| anyhow!("Creating PKCS8 PEM file failed"))
+    }
+
+    fn from_spki(spki: SubjectPublicKeyInfoRef) -> Result<Self> {
+        let algorithm = CryptoAlgorithm::try_from(spki.algorithm)?;
+
+        match algorithm {
+            CryptoAlgorithm::Ed25519 => {
+                let ed25519_spki = Ed25519PublicKeyBytes::try_from(spki)?;
+                let ed25519_key = Ed25519VerifyingKey::try_from(ed25519_spki.as_ref() as &[u8])?;
+                Ok(VerifyingKey::Ed25519(ed25519_key))
+            }
+            CryptoAlgorithm::Secp256k1 => {
+                let secp256k1_key = Secp256k1VerifyingKey::try_from(spki)?;
+                Ok(VerifyingKey::Secp256k1(secp256k1_key))
+            }
+            CryptoAlgorithm::Secp256r1 => {
+                let secp256r1_key = Secp256r1VerifyingKey::try_from(spki)?;
+                Ok(VerifyingKey::Secp256r1(secp256r1_key))
+            }
+            CryptoAlgorithm::Eip191 => bail!("Eth vk from DER format is not implemented"),
+            CryptoAlgorithm::CosmosAdr36 => {
+                bail!("Cosmos ADR-36 vk from DER format is not implemented")
+            }
+        }
+    }
+
+    pub fn from_spki_der(bytes: &[u8]) -> Result<Self> {
+        let spki = SubjectPublicKeyInfoRef::from_der(bytes)?;
+        Self::from_spki(spki)
+    }
+
+    pub fn from_spki_pem_file(filename: impl AsRef<Path>) -> Result<Self> {
+        let (label, doc) = Document::read_pem_file(filename)?;
+        SubjectPublicKeyInfoRef::validate_pem_label(&label)
+            .map_err(|_| anyhow!("Incorrect PEM label"))?;
+        Self::from_spki_der(doc.as_bytes())
+    }
 }
 
 impl TryFrom<CryptoPayload> for VerifyingKey {

verification_keys/keys.json

@@ -1 +1 @@
-{"base_vk": "0x00d10bfc805af5f51d38ed75b18d8fba6a6f93f70a90516d3b9469b40516e018", "recursive_vk": "0x00cb3451d21dfe2ed596d52c91b8dc4397725257d499c195c2a3c8cb178a11bf"}
+{"base_vk": "0x00877c18096ae02a71b36540e570b0c765d0f457d4e96fc9cb86e7175333a0ce", "recursive_vk": "0x00efb9ffab32fc3309e5b4de61b3bdb30c1c9864bddedb6c4a897a649c862db2"}