(
parent_key: &SigningKey,
app_id: &[u8],
)
| 9 | use ra_tls::kdf; |
| 10 | |
| 11 | pub(crate) fn derive_k256_key( |
| 12 | parent_key: &SigningKey, |
| 13 | app_id: &[u8], |
| 14 | ) -> Result<(SigningKey, Vec<u8>)> { |
| 15 | let context_data = [app_id, b"app-key"]; |
| 16 | let derived_key_bytes: [u8; 32] = kdf::derive_key(&parent_key.to_bytes(), &context_data, 32)? |
| 17 | .try_into() |
| 18 | .ok() |
| 19 | .context("Invalid derived key len")?; |
| 20 | let derived_signing_key = SigningKey::from_bytes(&derived_key_bytes.into())?; |
| 21 | let pubkey = derived_signing_key.verifying_key(); |
| 22 | |
| 23 | let signature = sign_message( |
| 24 | parent_key, |
| 25 | b"dstack-kms-issued", |
| 26 | app_id, |
| 27 | &pubkey.to_sec1_bytes(), |
| 28 | )?; |
| 29 | Ok((derived_signing_key, signature)) |
| 30 | } |
| 31 | |
| 32 | pub(crate) fn sign_message( |
| 33 | key: &SigningKey, |
no test coverage detected