mk & mpkb files

example/client/src/auth.rs

@@ -1,52 +1,49 @@
 use std::fs;
 
 use mtp::client::{ClientConfig, MTPClient, MTPConnection};
-use mtp::crypto::{Ed25519Signer, Keyring, MlDsaSigner, PublicKeyBundle};
+use mtp::crypto::{
+    Ed25519Signer, KemPrivateKey, KemPublicKey, Keyring, MlDsaSigner, PublicKeyBundle,
+};
+use mtp::files::{load_keyring, save_keyring};
 
 pub async fn connect_or_register(
     mut config: ClientConfig,
     host_public_key: PublicKeyBundle,
-    client_key_path: &str,
+    key_prefix: &str,
 ) -> Result<(MTPConnection, Keyring), Box<dyn std::error::Error>> {
-    if let Ok(data) = fs::read_to_string(client_key_path) {
-        let json: serde_json::Value = serde_json::from_str(&data)?;
-        let client_id = json["client_id"].as_u64().expect("Invalid client_id");
-        let keyring = Keyring::from_bytes(&hex::decode(
-            json["keyring"].as_str().expect("Missing keyring"),
-        )?)?;
+    let keyring_path = format!("{key_prefix}.mk");
+    let id_path = format!("{key_prefix}.id");
 
-        println!("Loaded client keys (ID: {})", client_id);
+    if let (Ok(keyring), Ok(id)) = (load_keyring(&keyring_path), fs::read_to_string(&id_path)) {
+        let client_id: u64 = id.trim().parse()?;
+        println!("Loaded client keys (ID: {client_id})");
 
         config.client_id = client_id;
         let conn = MTPClient::auth_connect(config, &keyring, &host_public_key).await?;
         println!("Authenticated (version {})", conn.version);
-        Ok((conn, keyring))
-    } else {
-        println!("No existing keys found: registering new client");
-
-        let (_ed_signer, sig_sk, sig_pk) = Ed25519Signer::generate();
-        let (_pq_signer, sig_pq_sk, sig_pq_pk) = MlDsaSigner::generate();
-        let keyring = Keyring::new(
-            mtp::crypto::KemPublicKey::new(vec![]),
-            mtp::crypto::KemPrivateKey::new(vec![]),
-            sig_pq_pk,
-            sig_pq_sk,
-            sig_pk,
-            sig_sk,
-        );
-
-        let keyring_bytes = keyring.to_bytes();
-        let conn = MTPClient::auth_register(config, &keyring, &host_public_key).await?;
-        println!("Registered with ID: {}", conn.client_id);
-
-        let json = serde_json::json!({
-            "client_id": conn.client_id,
-            "keyring": hex::encode(&keyring_bytes),
-        });
-        fs::write(client_key_path, serde_json::to_string_pretty(&json)?)?;
-        println!("Saved client keys -> {client_key_path}");
-
-        let keyring = Keyring::from_bytes(&keyring_bytes)?;
-        Ok((conn, keyring))
+        return Ok((conn, keyring));
     }
+
+    println!("No existing keys found: registering new client");
+
+    /* The client authenticates with signatures only, so the KEM slot is empty. */
+    let (_ed_signer, sig_sk, sig_pk) = Ed25519Signer::generate();
+    let (_pq_signer, sig_pq_sk, sig_pq_pk) = MlDsaSigner::generate();
+    let keyring = Keyring::new(
+        KemPublicKey::new(vec![]),
+        KemPrivateKey::new(vec![]),
+        sig_pq_pk,
+        sig_pq_sk,
+        sig_pk,
+        sig_sk,
+    );
+
+    let conn = MTPClient::auth_register(config, &keyring, &host_public_key).await?;
+    println!("Registered with ID: {}", conn.client_id);
+
+    save_keyring(&keyring, &keyring_path)?;
+    fs::write(&id_path, conn.client_id.to_string())?;
+    println!("Saved client keys -> {keyring_path}");
+
+    Ok((conn, keyring))
 }

example/client/src/main.rs

@@ -5,7 +5,7 @@ use std::fs;
 use std::path::Path;
 
 use mtp::client::ClientConfig;
-use mtp::crypto::{KemPublicKey, PublicKeyBundle, SignaturePqPublicKey, SignaturePublicKey};
+use mtp::files::load_public_key_bundle;
 
 fn dev_cert_path() -> String {
     std::env::var("MTP_DEV_CERT").unwrap_or_else(|_| {
@@ -25,19 +25,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "Missing TLS certificate at {cert_path}: enter the Nix shell first or run the server to generate it: {e}"
         )
     });
-    let host_public_key = PublicKeyBundle::new(
-        KemPublicKey::new(
-            fs::read("host_enc_kem_pk.bin")
-                .expect("Missing host_enc_kem_pk.bin: run server first"),
-        ),
-        SignaturePqPublicKey::new(
-            fs::read("host_sig_pq_pk.bin")
-                .expect("Missing host_sig_pq_pk.bin: run server first"),
-        ),
-        SignaturePublicKey::new(
-            fs::read("host_sig_pk.bin").expect("Missing host_sig_pk.bin: run server first"),
-        ),
-    );
+    let host_public_key = load_public_key_bundle("host.mpkb")
+        .expect("Missing host.mpkb: run the server first to export it");
 
     println!("Connecting to 127.0.0.1:8080 ...");
 
@@ -46,8 +35,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .with_description("MTP example client");
 
     let server_bundle = host_public_key.clone();
-    let (conn, keyring) =
-        auth::connect_or_register(config, host_public_key, "client_keys.json").await?;
+    let (conn, keyring) = auth::connect_or_register(config, host_public_key, "client").await?;
     messages::send_and_receive(&conn, &keyring, &server_bundle).await?;
 
     println!("\nDone");

example/client/src/messages.rs

@@ -10,20 +10,26 @@ pub fn build_demo_message(
 ) -> CommunicationValue {
     // Encrypt to the server's KEM public key; the server decrypts with its keyring.
     let enc_type = EncryptionType::MlKemChaCha20Poly1305;
-    let signer = Ed25519Signer::new(&keyring.sig_cl_secret_key)
-        .expect("Ed25519 signer from keyring");
+    let signer =
+        Ed25519Signer::new(&keyring.sig_cl_secret_key).expect("Ed25519 signer from keyring");
 
     let tm = TypeMap::latest();
 
     let inner_enc = DataValue::Container(vec![
-        (DataType::Version.to_id(&tm), DataValue::Str("secret inner data".into())),
+        (
+            DataType::Version.to_id(&tm),
+            DataValue::Str("secret inner data".into()),
+        ),
         (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(42)),
     ]);
     let mut dv_enc = inner_enc;
     dv_enc.encrypt_container(enc_type, server_bundle, b"demo-aad");
 
     let inner_sig = DataValue::Container(vec![
-        (DataType::Version.to_id(&tm), DataValue::Str("signed by client".into())),
+        (
+            DataType::Version.to_id(&tm),
+            DataValue::Str("signed by client".into()),
+        ),
         (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(99)),
     ]);
     let mut dv_sig = inner_sig;
@@ -37,7 +43,13 @@ pub fn build_demo_message(
         (DataType::Id.to_id(&tm), DataValue::UnsignedNumber(7)),
     ]);
     let mut dv_sec = inner_sec;
-    dv_sec.sign_and_encrypt_container(SigAlgorithm::ED25519, &signer, enc_type, server_bundle, b"demo-aad");
+    dv_sec.sign_and_encrypt_container(
+        SigAlgorithm::ED25519,
+        &signer,
+        enc_type,
+        server_bundle,
+        b"demo-aad",
+    );
 
     let timestamp = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)