Implement OPAQUE password provisioning on Iota

iota-storage/src/users/mod.rs

@@ -1,5 +1,6 @@
 pub mod contact;
 pub mod invitations;
+pub mod password_credentials;
 pub mod pending_operations;
 pub mod user_manager;
-pub mod user_profile;
+pub mod user_profile;

iota-storage/src/users/password_credentials.rs

@@ -0,0 +1,80 @@
+use rusqlite::{OptionalExtension, params};
+
+use crate::{storage_error::StorageError, util::db};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PasswordCredential {
+    pub user_id: i64,
+    pub protocol_version: i64,
+    pub credential_format_version: i64,
+    pub opaque_record: Vec<u8>,
+    pub encrypted_tu_credential: Vec<u8>,
+    pub account_public_key_sha256: Vec<u8>,
+    pub created_at: i64,
+    pub updated_at: i64,
+}
+
+pub fn get(user_id: i64) -> Result<Option<PasswordCredential>, StorageError> {
+    db::with_db(|conn| {
+        conn.query_row(
+            "SELECT user_id, protocol_version, credential_format_version, opaque_record, encrypted_tu_credential, account_public_key_sha256, created_at, updated_at FROM user_password_credentials WHERE user_id = ?1",
+            params![user_id],
+            |row| Ok(PasswordCredential {
+                user_id: row.get(0)?, protocol_version: row.get(1)?, credential_format_version: row.get(2)?,
+                opaque_record: row.get(3)?, encrypted_tu_credential: row.get(4)?,
+                account_public_key_sha256: row.get(5)?, created_at: row.get(6)?, updated_at: row.get(7)?,
+            }),
+        ).optional().map_err(Into::into)
+    })
+}
+
+pub fn exists(user_id: i64) -> Result<bool, StorageError> {
+    db::with_db(|conn| {
+        conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM user_password_credentials WHERE user_id = ?1)",
+            params![user_id],
+            |row| row.get(0),
+        )
+        .map_err(Into::into)
+    })
+}
+
+pub fn any() -> Result<bool, StorageError> {
+    db::with_db(|conn| {
+        conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM user_password_credentials)",
+            [],
+            |row| row.get(0),
+        )
+        .map_err(Into::into)
+    })
+}
+
+pub fn upsert(credential: &PasswordCredential) -> Result<(), StorageError> {
+    db::with_immediate_transaction(|tx| {
+        tx.execute(
+            "INSERT INTO user_password_credentials (user_id, protocol_version, credential_format_version, opaque_record, encrypted_tu_credential, account_public_key_sha256, created_at, updated_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+             ON CONFLICT(user_id) DO UPDATE SET
+                protocol_version = excluded.protocol_version,
+                credential_format_version = excluded.credential_format_version,
+                opaque_record = excluded.opaque_record,
+                encrypted_tu_credential = excluded.encrypted_tu_credential,
+                account_public_key_sha256 = excluded.account_public_key_sha256,
+                updated_at = excluded.updated_at",
+            params![credential.user_id, credential.protocol_version, credential.credential_format_version,
+                credential.opaque_record, credential.encrypted_tu_credential,
+                credential.account_public_key_sha256, credential.created_at, credential.updated_at],
+        )?;
+        Ok(())
+    })
+}
+
+pub fn delete(user_id: i64) -> Result<bool, StorageError> {
+    db::with_db(|conn| {
+        Ok(conn.execute(
+            "DELETE FROM user_password_credentials WHERE user_id = ?1",
+            params![user_id],
+        )? != 0)
+    })
+}

iota-storage/src/users/user_manager.rs

@@ -91,6 +91,13 @@ fn persist_user_profile(
     tx: &rusqlite::Transaction<'_>,
     user: &UserProfile,
 ) -> Result<(), crate::storage_error::StorageError> {
+    // A password backup for the old account key must never restore a rotated identity.
+    tx.execute(
+        "DELETE FROM user_password_credentials WHERE user_id = ?1 AND EXISTS (
+            SELECT 1 FROM users WHERE user_id = ?1 AND public_key != ?2
+        )",
+        params![user.user_id, user.public_key],
+    )?;
     tx.execute(
         r#"
         INSERT INTO users (user_id, username, public_key, private_key_hash, reset_token, created_at, display_name)
@@ -228,6 +235,10 @@ pub fn revoke_all_tauth_grants(user_id: i64) -> Result<usize, crate::storage_err
 
 pub fn remove_user(user_id: i64) -> Result<(), crate::storage_error::StorageError> {
     db::with_immediate_transaction(|conn| {
+        conn.execute(
+            "DELETE FROM user_password_credentials WHERE user_id = ?1",
+            params![user_id],
+        )?;
         conn.execute(
             "DELETE FROM tauth_codes WHERE local_user_id = ?1",
             params![user_id],
@@ -298,6 +309,12 @@ pub fn finalize_local_release(
             params![user_id],
         )?;
         tx.execute("DELETE FROM users WHERE user_id = ?1", params![user_id])?;
+        // OPAQUE records cannot authenticate against another Iota's ServerSetup.
+        // Reassignment requires enrollment again from an authenticated device.
+        tx.execute(
+            "DELETE FROM user_password_credentials WHERE user_id = ?1",
+            params![user_id],
+        )?;
         tx.execute(
             "UPDATE pending_relays SET delivery_state = 'waiting_client', last_error = 'user_released' WHERE target_kind = 0 AND destination_id = ?1",
             params![user_id],
@@ -576,6 +593,10 @@ pub fn erase_user_locally(user_id: i64) -> Result<(), crate::storage_error::Stor
             params![user_id],
         )?;
         conn.execute("DELETE FROM users WHERE user_id = ?1", params![user_id])?;
+        conn.execute(
+            "DELETE FROM user_password_credentials WHERE user_id = ?1",
+            params![user_id],
+        )?;
         conn.execute(
             "DELETE FROM user_residency WHERE user_id = ?1",
             params![user_id],
@@ -644,7 +665,7 @@ pub fn get_residency_by_id(
 pub fn clear() -> Result<(), crate::storage_error::StorageError> {
     db::with_immediate_transaction(|conn| {
         conn.execute_batch(
-            "DELETE FROM tauth_codes; DELETE FROM tauth_sessions; DELETE FROM tauth_metadata; DELETE FROM tauth_grants; DELETE FROM users; DELETE FROM user_residency;",
+            "DELETE FROM tauth_codes; DELETE FROM tauth_sessions; DELETE FROM tauth_metadata; DELETE FROM tauth_grants; DELETE FROM user_password_credentials; DELETE FROM protected_command_replay; DELETE FROM users; DELETE FROM user_residency;",
         )?;
         Ok(())
     })
@@ -772,8 +793,13 @@ mod tests {
                     credential_origin TEXT NOT NULL,
                     updated_at INTEGER NOT NULL
                 );
+                CREATE TABLE user_password_credentials (
+                    user_id INTEGER PRIMARY KEY,
+                    account_public_key_sha256 BLOB NOT NULL
+                );
                 INSERT INTO users VALUES (1, 'alice', 'old-key', NULL, NULL, 1, NULL);
                 INSERT INTO user_residency VALUES (1, 'alice', 'released', 'empty', 'external', 42);
+                INSERT INTO user_password_credentials VALUES (1, x'00');
                 "#,
             )
             .unwrap();
@@ -789,6 +815,14 @@ mod tests {
         let transaction = connection.transaction().unwrap();
         persist_user_profile(&transaction, &user).unwrap();
         transaction.commit().unwrap();
+        let password_rows: i64 = connection
+            .query_row(
+                "SELECT COUNT(*) FROM user_password_credentials WHERE user_id = 1",
+                [],
+                |row| row.get(0),
+            )
+            .unwrap();
+        assert_eq!(password_rows, 0);
 
         let residency: (String, String, String, String, i64) = connection
             .query_row(