aboutsummaryrefslogtreecommitdiff
path: root/crates/arti-relay/src/tasks/crypto.rs
Commit message (Collapse)AuthorAgeFilesLines
...
* arti-relay: Replace have_rotated bools with KeyChange (fmt)Gabriela Moldovan2026-04-091-8/+14
|
* arti-relay: Replace have_rotated bools with KeyChangeGabriela Moldovan2026-04-091-15/+23
| | | | This will enable us to plug in the ntor key rotation logic.
* arti-relay: Add a struct describing a key change eventGabriela Moldovan2026-04-091-0/+19
| | | | | | This is just a wrapper over `bool` right now. It will helps us distinguish changes to the channel auth material from changes affecting the ntor circuit extension keys.
* arti-relay: s/have_rotated/have_removed for clarityGabriela Moldovan2026-04-091-2/+2
|
* arti-relay: Fix test MockRuntime::advance_by() usageGabriela Moldovan2026-04-091-6/+2
| | | | | | | This was previously advancing time by more than intended (I think the intention here was to use something like `MockRuntime::jump_wallclock()`, but that function has no effect on sleeping futures, so I think we should continue using `advance_by()`).
* arti-relay: Retrieve the signing key cert from the keystoreGabriela Moldovan2026-04-081-8/+16
| | | | | | | The API for retrieving certs exists now, so we don't need to regenerate the cert each time. This addresses a TODO.
* arti-relay: Reuse cert_expiry calculationGabriela Moldovan2026-04-081-2/+3
| | | | For readability.
* arti-relay: Move comment closer to the durations it refers toGabriela Moldovan2026-04-081-2/+2
| | | | | We forgot to move this comment when we replaced the hard-coded durations with top-level constants.
* arti-relay: Use more descriptive names for the key lifetimesGabriela Moldovan2026-04-081-20/+20
|
* arti-relay: Remove no-longer needed implsGabriela Moldovan2026-04-011-5/+5
| | | | | The specifiers are local to the crate, so we don't need the `valid_until` accessors anymore.
* arti-relay: Move all key specifiers to a new keys module (fmt)Gabriela Moldovan2026-04-011-15/+11
|
* arti-relay: Move all key specifiers to a new keys moduleGabriela Moldovan2026-04-011-8/+11
| | | | | | | | | | | This extracts the key specifier types out of `tor-relay-crypto`, which * makes the code layout consistent with the hidden service crates (the key specifiers are defined in a `keys` module in `tor-hsservice`, while the key wrapper types live in `tor-hscrypto::pk`) * helps reduce the API surface: the key specifiers are only used in `arti-relay`, so we can move them there and make them `pub(crate)` instead of `pub`
* proto: Rename RelayIdentities to RelayChannelAuthMaterialDavid Goulet2026-03-301-14/+17
| | | | | | | | | | | | This object contains a melting pot of public keys, private keys and certificates. Rename it to reflect that it is channel authentication material and not "identities. https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3791#note_3374454 Signed-off-by: David Goulet <[email protected]>
* relay: Pass now() instead of the runtime in the crypto taskDavid Goulet2026-03-171-37/+31
| | | | | | | | | This way we get the whole task job to be aligned on one single now value to avoid potential inconsistencies between expiry and key generation. Fixes #2404 Signed-off-by: David Goulet <[email protected]>
* relay: Add crypto tasks unit testDavid Goulet2026-03-171-1/+242
| | | | | | Tests the key rotation code. Signed-off-by: David Goulet <[email protected]>
* relay: Use same wallclock() time when generating keysDavid Goulet2026-03-171-8/+6
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Make the crypto tasks use the runtime wallclockDavid Goulet2026-03-171-24/+41
| | | | | | This way we can unit tests properly. Signed-off-by: David Goulet <[email protected]>
* relay: Rewrite the rotation key logic in the crypto taskDavid Goulet2026-03-171-163/+245
| | | | | | | | | | | | | | | | | | | | | | This is almost a full rewrite of the crypto task which was needed in order to support our relay signing certificate to be put in the keystore which will be needed for the offline key feature. Instead of having rotate_key() do all the things, we now instead do two pass: 1. Remove all expired keys and certs. 2. Generate any missing keys. This still results in using the minimum valid_until of all our keys for the task sleep time. We can know cleanup the local trait used for this gymnastic and trade it for some more KeyMgr gymnastic. Fixes #2404 Signed-off-by: David Goulet <[email protected]>
* relay: Don't log warn if key already exists when generating oneDavid Goulet2026-03-171-4/+1
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Remove leftover comment from previous code iterationDavid Goulet2026-03-171-4/+0
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: The AUTHENTICATE cell requires the SHA256 RSA identity digestDavid Goulet2026-02-261-1/+1
| | | | | | | Before this commit, we would use the RsaIdentity which is a SHA1 digest. We do the same for the peer RSA key. Signed-off-by: David Goulet <[email protected]>
* relay: Sleep rotate key task with earliest valid_untilDavid Goulet2026-02-251-19/+54
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Update ChanMgr on key rotationDavid Goulet2026-02-241-8/+18
| | | | Signed-off-by: David Goulet <[email protected]>
* arti-relay: add more error contextSteven Engler2026-02-231-6/+12
|
* arti-relay: don't warn if key gen was successfulSteven Engler2026-02-231-1/+2
|
* relay: Setup const for hardcoded value in crypto taskDavid Goulet2026-02-231-8/+13
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Log when key generation yields an existing key errorDavid Goulet2026-02-231-1/+4
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Simplify the crypto rotation task rotate_key()David Goulet2026-02-231-17/+11
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Get rid of start_task() for readabilityDavid Goulet2026-02-231-17/+1
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Generate relay identities at initDavid Goulet2026-02-231-3/+5
| | | | Signed-off-by: David Goulet <[email protected]>
* relay: Implement a helper to build RelayIdentitiesDavid Goulet2026-02-231-6/+107
| | | | | | | This required to add a slight helper to our tor-key-forge RSA key d-d macro to access the inner keypair. This avoids a clone. Signed-off-by: David Goulet <[email protected]>
* relay: Move try_generate_keys() into crypto taskDavid Goulet2026-02-231-5/+27
| | | | | | | Move rotating keys into a function so we can use it in try_generate_keys() that is used at startup. Signed-off-by: David Goulet <[email protected]>
* relay: Add a crypto task for key rotationDavid Goulet2026-02-231-0/+175
This task crypto module has a rotate key task that is in charge of rotating keys from our KeyMgr based on the valid until. To do so, we add a RotatableKeySpec trait to help us specify our to rotate a specific key. Allows us to have a generic rotate/generate function for all our keys. Task runs every 60 seconds. Taken from C-tor. Signed-off-by: David Goulet <[email protected]>
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 00:44:23 +0000