c8a04e144b
Clean-room reference implementation (Ed25519 certificate chain, AES-256-GCM envelope, three-rung revocation ladder, crypto-erasure) with runnable examples and 36 tests that reproduce each demonstrated claim on stand-in payloads. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
108 lines
4 KiB
Python
108 lines
4 KiB
Python
#!/usr/bin/env python3
|
|
"""Claim 1: certificate-chain authority.
|
|
|
|
Issue a three-tier chain (self-signed root, organisational signer, leaf
|
|
capability certificate) with Ed25519 signatures, verify the chain to the
|
|
trusted root, and show that a tampered, expired, or wrongly-issued
|
|
certificate FAILS verification.
|
|
"""
|
|
|
|
import dataclasses
|
|
import sys
|
|
from datetime import timedelta
|
|
from pathlib import Path
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
|
|
|
|
from capability_licensing import CertificateAuthority, verify_chain
|
|
from capability_licensing.certificates import parse_iso
|
|
|
|
failures = []
|
|
|
|
|
|
def check(label: str, condition: bool, evidence: str) -> None:
|
|
marker = "ok " if condition else "FAIL"
|
|
print(f" [{marker}] {label}")
|
|
print(f" {evidence}")
|
|
if not condition:
|
|
failures.append(label)
|
|
|
|
|
|
def main() -> int:
|
|
print("=== Claim 1: certificate-chain authority (issue and verify) ===\n")
|
|
|
|
authority = CertificateAuthority()
|
|
root = authority.create_root("Reference Root Authority")
|
|
organisation = authority.issue_organisation(root.serial, "Reference Research Organisation")
|
|
capability, _capability_key = authority.issue_capability(
|
|
organisation.serial,
|
|
"structured-document-summarisation",
|
|
claims={
|
|
"capability": "structured-document-summarisation",
|
|
"grant": "research demonstration only",
|
|
},
|
|
)
|
|
|
|
print(f" issued root: {root.serial} (self-signed, Ed25519)")
|
|
print(f" issued organisation: {organisation.serial} (signed by root)")
|
|
print(f" issued capability: {capability.serial} (signed by organisation)")
|
|
print()
|
|
|
|
# 1. The intact chain verifies to the trusted root.
|
|
intact = verify_chain(capability, [organisation], [root])
|
|
check(
|
|
"intact chain verifies to the trusted root",
|
|
intact.valid,
|
|
f"result: {'VALID' if intact.valid else 'INVALID'} - {intact.reason} "
|
|
f"(path: {' -> '.join(intact.path)})",
|
|
)
|
|
|
|
# 2. A tampered certificate fails: edit the grant terms after signing.
|
|
tampered = dataclasses.replace(
|
|
capability,
|
|
claims={**dict(capability.claims), "grant": "unlimited production use"},
|
|
)
|
|
tampered_result = verify_chain(tampered, [organisation], [root])
|
|
check(
|
|
"tampered certificate (grant terms edited after signing) fails",
|
|
not tampered_result.valid and "does not verify" in tampered_result.reason,
|
|
f"result: INVALID - {tampered_result.reason}",
|
|
)
|
|
|
|
# 3. An expired certificate fails: verify one day after its not_after.
|
|
after_expiry = parse_iso(capability.not_after) + timedelta(days=1)
|
|
expired_result = verify_chain(capability, [organisation], [root], at=after_expiry)
|
|
check(
|
|
"expired certificate (checked one day after expiry) fails",
|
|
not expired_result.valid and "expired" in expired_result.reason,
|
|
f"result: INVALID - {expired_result.reason}",
|
|
)
|
|
|
|
# 4. A chain from a different, untrusted authority fails against our
|
|
# trust store, even though it is internally well-formed.
|
|
other_authority = CertificateAuthority()
|
|
other_root = other_authority.create_root("Unaccredited Authority")
|
|
other_org = other_authority.issue_organisation(other_root.serial, "Unaccredited Organisation")
|
|
other_leaf, _ = other_authority.issue_capability(
|
|
other_org.serial, "impersonated-capability", claims={}
|
|
)
|
|
wrong_issuer_result = verify_chain(other_leaf, [other_org, other_root], [root])
|
|
check(
|
|
"certificate chained to an untrusted root fails",
|
|
not wrong_issuer_result.valid and "not in the trust store" in wrong_issuer_result.reason,
|
|
f"result: INVALID - {wrong_issuer_result.reason}",
|
|
)
|
|
|
|
print()
|
|
if failures:
|
|
print(f"RESULT: FAIL - {len(failures)} check(s) did not behave as claimed")
|
|
return 1
|
|
print(
|
|
"RESULT: PASS - the chain verifies offline against the trust store, and "
|
|
"tampering, expiry, and an untrusted issuer each fail verification"
|
|
)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|