From 615438e6aace667f6673209476b8eed24a62965b Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Wed, 2 Sep 2026 10:43:50 +0000 Subject: [PATCH 1/6] Introduce identity type map --- CMakeLists.txt | 5 ++ src/node/test/identity_types.cpp | 95 +++++++++++++++++++++++++++++ src/service/tables/identity_types.h | 82 +++++++++++++++++++++++++ 3 files changed, 182 insertions(+) create mode 100644 src/node/test/identity_types.cpp create mode 100644 src/service/tables/identity_types.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 6f600245a758..44146af74d75 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -884,6 +884,11 @@ if(BUILD_TESTS) ${CMAKE_CURRENT_SOURCE_DIR}/src/node/test/node_info_json.cpp ) + add_unit_test( + identity_types_test + ${CMAKE_CURRENT_SOURCE_DIR}/src/node/test/identity_types.cpp + ) + add_unit_test(tls_test ${CMAKE_CURRENT_SOURCE_DIR}/src/tls/test/main.cpp) target_link_libraries(tls_test PRIVATE ${CMAKE_THREAD_LIBS_INIT}) diff --git a/src/node/test/identity_types.cpp b/src/node/test/identity_types.cpp new file mode 100644 index 000000000000..f685738baa8c --- /dev/null +++ b/src/node/test/identity_types.cpp @@ -0,0 +1,95 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the Apache 2.0 License. + +#include "service/tables/identity_types.h" + +#include "ccf/kv/unit.h" + +#define DOCTEST_CONFIG_IMPLEMENT_WITH_MAIN +#include +#include +#include +#include +#include +#include +#include +#include + +using IdentityTypeSerialiser = + ccf::kv::serialisers::BlitSerialiser; + +static constexpr std::array IDENTITY_TYPES = { + ccf::IdentityType::EC384, ccf::IdentityType::MLDSA65}; + +TEST_CASE("EC384 shares the serialised key of a single-Value table") +{ + // ServiceValue is a Map with a single entry, whose key is 8 null bytes. A + // table keyed by IdentityType is therefore serialised identically to a + // ServiceValue for as long as EC384 is its only entry. + REQUIRE( + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::EC384) == + ccf::kv::serialisers::ZeroBlitUnitCreator::get()); + + REQUIRE( + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::MLDSA65) != + ccf::kv::serialisers::ZeroBlitUnitCreator::get()); +} + +TEST_CASE("IdentityType serialisation round-trips") +{ + for (const auto identity_type : IDENTITY_TYPES) + { + const auto serialised = + IdentityTypeSerialiser::to_serialised(identity_type); + REQUIRE(serialised.size() == sizeof(uint64_t)); + REQUIRE( + IdentityTypeSerialiser::from_serialised(serialised) == identity_type); + } +} + +TEST_CASE("Unknown identity types are rejected") +{ + const auto unknown = + ccf::kv::serialisers::BlitSerialiser::to_serialised( + std::numeric_limits::max()); + REQUIRE_THROWS_AS( + IdentityTypeSerialiser::from_serialised(unknown), std::logic_error); +} + +TEST_CASE("IdentityType names are distinct and stable") +{ + // These names will appear in the ledger, so they must not change. + REQUIRE(nlohmann::json(ccf::IdentityType::EC384) == "EC384"); + REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA65) == "MLDSA65"); + + std::set names; + for (const auto identity_type : IDENTITY_TYPES) + { + const nlohmann::json name = identity_type; + REQUIRE(names.insert(name.get()).second); + } + REQUIRE(names.size() == IDENTITY_TYPES.size()); +} + +TEST_CASE("Identity round-trips through JSON") +{ + const ccf::Identity identity{ + ccf::IdentityKind::RawX509Key, std::vector{1, 2, 3, 4}}; + + const nlohmann::json j = identity; + REQUIRE(j["kind"] == "RawX509Key"); + + REQUIRE(j.get() == identity); +} + +TEST_CASE("Identities round-trips through JSON") +{ + const ccf::Identities identities{ + {ccf::IdentityType::EC384, + {ccf::IdentityKind::RawX509Cert, std::vector{1, 2}}}, + {ccf::IdentityType::MLDSA65, + {ccf::IdentityKind::RawX509Key, std::vector{3, 4}}}}; + + const nlohmann::json j = identities; + REQUIRE(j.get() == identities); +} diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h new file mode 100644 index 000000000000..754295bfbcca --- /dev/null +++ b/src/service/tables/identity_types.h @@ -0,0 +1,82 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the Apache 2.0 License. +#pragma once + +#include "ccf/ds/json.h" +#include "ccf/kv/serialisers/blit_serialiser.h" + +#include +#include +#include +#include + +namespace ccf +{ + enum class IdentityType : uint64_t + { + EC384 = 0, + MLDSA65 = 1, + }; + + DECLARE_JSON_ENUM( + IdentityType, + {{IdentityType::EC384, "EC384"}, {IdentityType::MLDSA65, "MLDSA65"}}); + + enum class IdentityKind : uint8_t + { + RawX509Cert = 0, + RawX509Key = 1, + // COSE key and JWK representations may be added here in the future. + }; + + DECLARE_JSON_ENUM( + IdentityKind, + {{IdentityKind::RawX509Cert, "RawX509Cert"}, + {IdentityKind::RawX509Key, "RawX509Key"}}); + + using IdentityValue = std::vector; + + struct Identity + { + IdentityKind kind; + IdentityValue value; + + bool operator==(const Identity&) const = default; + }; + + DECLARE_JSON_TYPE(Identity); + DECLARE_JSON_REQUIRED_FIELDS(Identity, kind, value); + + using Identities = std::map; +} + +namespace ccf::kv::serialisers +{ + // IdentityType is used as a KV key by tables which were previously a single + // Value. EC384 is 0, so it serialises to the same bytes as the unit key of + // those tables, keeping their serialised form unchanged. + template <> + struct BlitSerialiser + { + static SerialisedEntry to_serialised(const ccf::IdentityType& identity_type) + { + return BlitSerialiser::to_serialised( + static_cast(identity_type)); + } + + static ccf::IdentityType from_serialised(const SerialisedEntry& data) + { + const auto value = BlitSerialiser::from_serialised(data); + switch (value) + { + case static_cast(ccf::IdentityType::EC384): + return ccf::IdentityType::EC384; + case static_cast(ccf::IdentityType::MLDSA65): + return ccf::IdentityType::MLDSA65; + default: + throw std::logic_error( + fmt::format("Unknown identity type: {}", value)); + } + } + }; +} From bc6ba09a0d66c89a583bc9b4074c6d08962b70af Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Wed, 2 Sep 2026 13:54:36 +0000 Subject: [PATCH 2/6] Name the EC identity type after its signature algorithm ES384 is the COSE algorithm the identity signs with, matching MLDSA65, which is likewise named after its signature scheme rather than its key. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/node/test/identity_types.cpp | 12 ++++++------ src/service/tables/identity_types.h | 10 +++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/node/test/identity_types.cpp b/src/node/test/identity_types.cpp index f685738baa8c..b87b54d09cca 100644 --- a/src/node/test/identity_types.cpp +++ b/src/node/test/identity_types.cpp @@ -19,15 +19,15 @@ using IdentityTypeSerialiser = ccf::kv::serialisers::BlitSerialiser; static constexpr std::array IDENTITY_TYPES = { - ccf::IdentityType::EC384, ccf::IdentityType::MLDSA65}; + ccf::IdentityType::ES384, ccf::IdentityType::MLDSA65}; -TEST_CASE("EC384 shares the serialised key of a single-Value table") +TEST_CASE("ES384 shares the serialised key of a single-Value table") { // ServiceValue is a Map with a single entry, whose key is 8 null bytes. A // table keyed by IdentityType is therefore serialised identically to a - // ServiceValue for as long as EC384 is its only entry. + // ServiceValue for as long as ES384 is its only entry. REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::EC384) == + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ES384) == ccf::kv::serialisers::ZeroBlitUnitCreator::get()); REQUIRE( @@ -59,7 +59,7 @@ TEST_CASE("Unknown identity types are rejected") TEST_CASE("IdentityType names are distinct and stable") { // These names will appear in the ledger, so they must not change. - REQUIRE(nlohmann::json(ccf::IdentityType::EC384) == "EC384"); + REQUIRE(nlohmann::json(ccf::IdentityType::ES384) == "ES384"); REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA65) == "MLDSA65"); std::set names; @@ -85,7 +85,7 @@ TEST_CASE("Identity round-trips through JSON") TEST_CASE("Identities round-trips through JSON") { const ccf::Identities identities{ - {ccf::IdentityType::EC384, + {ccf::IdentityType::ES384, {ccf::IdentityKind::RawX509Cert, std::vector{1, 2}}}, {ccf::IdentityType::MLDSA65, {ccf::IdentityKind::RawX509Key, std::vector{3, 4}}}}; diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h index 754295bfbcca..b3d8bc5b672a 100644 --- a/src/service/tables/identity_types.h +++ b/src/service/tables/identity_types.h @@ -14,13 +14,13 @@ namespace ccf { enum class IdentityType : uint64_t { - EC384 = 0, + ES384 = 0, MLDSA65 = 1, }; DECLARE_JSON_ENUM( IdentityType, - {{IdentityType::EC384, "EC384"}, {IdentityType::MLDSA65, "MLDSA65"}}); + {{IdentityType::ES384, "ES384"}, {IdentityType::MLDSA65, "MLDSA65"}}); enum class IdentityKind : uint8_t { @@ -53,7 +53,7 @@ namespace ccf namespace ccf::kv::serialisers { // IdentityType is used as a KV key by tables which were previously a single - // Value. EC384 is 0, so it serialises to the same bytes as the unit key of + // Value. ES384 is 0, so it serialises to the same bytes as the unit key of // those tables, keeping their serialised form unchanged. template <> struct BlitSerialiser @@ -69,8 +69,8 @@ namespace ccf::kv::serialisers const auto value = BlitSerialiser::from_serialised(data); switch (value) { - case static_cast(ccf::IdentityType::EC384): - return ccf::IdentityType::EC384; + case static_cast(ccf::IdentityType::ES384): + return ccf::IdentityType::ES384; case static_cast(ccf::IdentityType::MLDSA65): return ccf::IdentityType::MLDSA65; default: From 7596f5fae1a10d7c7fa74d64009bbc11cb37eb85 Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Wed, 2 Sep 2026 14:52:26 +0000 Subject: [PATCH 3/6] Name identity types and kinds after what they are, not what they measure IdentityType drops the parameter from its names: ES384 becomes ES, and MLDSA65 becomes MLDSA. The size cannot be part of the name because it is not a property of the slot. The curve of the service identity comes from node_certificate.curve_id (default Secp384R1, also accepts Secp256R1), which is passed straight to NetworkIdentity when a service is started or recovered. A service configured with Secp256R1 therefore signs with ES256 over SHA-256, and, since the identity is recreated during recovery from the recovering node's configuration, a service can change curve between epochs. An enum value asserting 384 would be wrong in both cases. ES and MLDSA name the signature scheme family, which is fixed for the slot; the parameters follow the key and are already recoverable from it. IdentityKind now names the encoding precisely: RawX509Cert becomes X509_CERT_DER, and RawX509Key becomes X509_SPKI_DER. The latter is not an X.509 certificate but a SubjectPublicKeyInfo, the structure produced by i2d_PUBKEY and carried in a PEM public key, so the old name suggested more than it held. Spelling out DER also makes it explicit that these are the binary encodings, not PEM. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/node/test/identity_types.cpp | 26 +++++++++++++------------- src/service/tables/identity_types.h | 25 ++++++++++++------------- 2 files changed, 25 insertions(+), 26 deletions(-) diff --git a/src/node/test/identity_types.cpp b/src/node/test/identity_types.cpp index b87b54d09cca..38234bdbc628 100644 --- a/src/node/test/identity_types.cpp +++ b/src/node/test/identity_types.cpp @@ -19,19 +19,19 @@ using IdentityTypeSerialiser = ccf::kv::serialisers::BlitSerialiser; static constexpr std::array IDENTITY_TYPES = { - ccf::IdentityType::ES384, ccf::IdentityType::MLDSA65}; + ccf::IdentityType::ES, ccf::IdentityType::MLDSA}; -TEST_CASE("ES384 shares the serialised key of a single-Value table") +TEST_CASE("ES shares the serialised key of a single-Value table") { // ServiceValue is a Map with a single entry, whose key is 8 null bytes. A // table keyed by IdentityType is therefore serialised identically to a - // ServiceValue for as long as ES384 is its only entry. + // ServiceValue for as long as ES is its only entry. REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ES384) == + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ES) == ccf::kv::serialisers::ZeroBlitUnitCreator::get()); REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::MLDSA65) != + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::MLDSA) != ccf::kv::serialisers::ZeroBlitUnitCreator::get()); } @@ -59,8 +59,8 @@ TEST_CASE("Unknown identity types are rejected") TEST_CASE("IdentityType names are distinct and stable") { // These names will appear in the ledger, so they must not change. - REQUIRE(nlohmann::json(ccf::IdentityType::ES384) == "ES384"); - REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA65) == "MLDSA65"); + REQUIRE(nlohmann::json(ccf::IdentityType::ES) == "ES"); + REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA) == "MLDSA"); std::set names; for (const auto identity_type : IDENTITY_TYPES) @@ -74,10 +74,10 @@ TEST_CASE("IdentityType names are distinct and stable") TEST_CASE("Identity round-trips through JSON") { const ccf::Identity identity{ - ccf::IdentityKind::RawX509Key, std::vector{1, 2, 3, 4}}; + ccf::IdentityKind::X509_SPKI_DER, std::vector{1, 2, 3, 4}}; const nlohmann::json j = identity; - REQUIRE(j["kind"] == "RawX509Key"); + REQUIRE(j["kind"] == "X509_SPKI_DER"); REQUIRE(j.get() == identity); } @@ -85,10 +85,10 @@ TEST_CASE("Identity round-trips through JSON") TEST_CASE("Identities round-trips through JSON") { const ccf::Identities identities{ - {ccf::IdentityType::ES384, - {ccf::IdentityKind::RawX509Cert, std::vector{1, 2}}}, - {ccf::IdentityType::MLDSA65, - {ccf::IdentityKind::RawX509Key, std::vector{3, 4}}}}; + {ccf::IdentityType::ES, + {ccf::IdentityKind::X509_CERT_DER, std::vector{1, 2}}}, + {ccf::IdentityType::MLDSA, + {ccf::IdentityKind::X509_SPKI_DER, std::vector{3, 4}}}}; const nlohmann::json j = identities; REQUIRE(j.get() == identities); diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h index b3d8bc5b672a..5ad2719e66cf 100644 --- a/src/service/tables/identity_types.h +++ b/src/service/tables/identity_types.h @@ -14,25 +14,24 @@ namespace ccf { enum class IdentityType : uint64_t { - ES384 = 0, - MLDSA65 = 1, + ES = 0, + MLDSA = 1, }; DECLARE_JSON_ENUM( - IdentityType, - {{IdentityType::ES384, "ES384"}, {IdentityType::MLDSA65, "MLDSA65"}}); + IdentityType, {{IdentityType::ES, "ES"}, {IdentityType::MLDSA, "MLDSA"}}); enum class IdentityKind : uint8_t { - RawX509Cert = 0, - RawX509Key = 1, + X509_CERT_DER = 0, + X509_SPKI_DER = 1, // COSE key and JWK representations may be added here in the future. }; DECLARE_JSON_ENUM( IdentityKind, - {{IdentityKind::RawX509Cert, "RawX509Cert"}, - {IdentityKind::RawX509Key, "RawX509Key"}}); + {{IdentityKind::X509_CERT_DER, "X509_CERT_DER"}, + {IdentityKind::X509_SPKI_DER, "X509_SPKI_DER"}}); using IdentityValue = std::vector; @@ -53,7 +52,7 @@ namespace ccf namespace ccf::kv::serialisers { // IdentityType is used as a KV key by tables which were previously a single - // Value. ES384 is 0, so it serialises to the same bytes as the unit key of + // Value. ES is 0, so it serialises to the same bytes as the unit key of // those tables, keeping their serialised form unchanged. template <> struct BlitSerialiser @@ -69,10 +68,10 @@ namespace ccf::kv::serialisers const auto value = BlitSerialiser::from_serialised(data); switch (value) { - case static_cast(ccf::IdentityType::ES384): - return ccf::IdentityType::ES384; - case static_cast(ccf::IdentityType::MLDSA65): - return ccf::IdentityType::MLDSA65; + case static_cast(ccf::IdentityType::ES): + return ccf::IdentityType::ES; + case static_cast(ccf::IdentityType::MLDSA): + return ccf::IdentityType::MLDSA; default: throw std::logic_error( fmt::format("Unknown identity type: {}", value)); From 46c22206430942cb01035c05ce3bd7afa5d73a12 Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Wed, 2 Sep 2026 14:57:44 +0000 Subject: [PATCH 4/6] Drop speculative comment from IdentityKind The comment named encodings which may never be added, and says nothing about the two values which exist. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/service/tables/identity_types.h | 1 - 1 file changed, 1 deletion(-) diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h index 5ad2719e66cf..9e45f4361aed 100644 --- a/src/service/tables/identity_types.h +++ b/src/service/tables/identity_types.h @@ -25,7 +25,6 @@ namespace ccf { X509_CERT_DER = 0, X509_SPKI_DER = 1, - // COSE key and JWK representations may be added here in the future. }; DECLARE_JSON_ENUM( From 5e23dca7cb13a212b9b32a6cbd63262c01101cdb Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Wed, 2 Sep 2026 15:01:28 +0000 Subject: [PATCH 5/6] Name identity types after the signature scheme, not the JOSE prefix ES is the JOSE and COSE prefix for ECDSA with SHA-2, and is only meaningful with a digest size attached: ES256, ES384, ES512 are registered, ES alone is not. This enum names an identity rather than a signature, so it takes the name of the scheme the identity belongs to. ECDSA pairs symmetrically with MLDSA, and neither implies a curve or parameter set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/node/test/identity_types.cpp | 12 ++++++------ src/service/tables/identity_types.h | 11 ++++++----- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/src/node/test/identity_types.cpp b/src/node/test/identity_types.cpp index 38234bdbc628..901c5d427f48 100644 --- a/src/node/test/identity_types.cpp +++ b/src/node/test/identity_types.cpp @@ -19,15 +19,15 @@ using IdentityTypeSerialiser = ccf::kv::serialisers::BlitSerialiser; static constexpr std::array IDENTITY_TYPES = { - ccf::IdentityType::ES, ccf::IdentityType::MLDSA}; + ccf::IdentityType::ECDSA, ccf::IdentityType::MLDSA}; -TEST_CASE("ES shares the serialised key of a single-Value table") +TEST_CASE("ECDSA shares the serialised key of a single-Value table") { // ServiceValue is a Map with a single entry, whose key is 8 null bytes. A // table keyed by IdentityType is therefore serialised identically to a - // ServiceValue for as long as ES is its only entry. + // ServiceValue for as long as ECDSA is its only entry. REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ES) == + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ECDSA) == ccf::kv::serialisers::ZeroBlitUnitCreator::get()); REQUIRE( @@ -59,7 +59,7 @@ TEST_CASE("Unknown identity types are rejected") TEST_CASE("IdentityType names are distinct and stable") { // These names will appear in the ledger, so they must not change. - REQUIRE(nlohmann::json(ccf::IdentityType::ES) == "ES"); + REQUIRE(nlohmann::json(ccf::IdentityType::ECDSA) == "ECDSA"); REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA) == "MLDSA"); std::set names; @@ -85,7 +85,7 @@ TEST_CASE("Identity round-trips through JSON") TEST_CASE("Identities round-trips through JSON") { const ccf::Identities identities{ - {ccf::IdentityType::ES, + {ccf::IdentityType::ECDSA, {ccf::IdentityKind::X509_CERT_DER, std::vector{1, 2}}}, {ccf::IdentityType::MLDSA, {ccf::IdentityKind::X509_SPKI_DER, std::vector{3, 4}}}}; diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h index 9e45f4361aed..8fede16a8dbd 100644 --- a/src/service/tables/identity_types.h +++ b/src/service/tables/identity_types.h @@ -14,12 +14,13 @@ namespace ccf { enum class IdentityType : uint64_t { - ES = 0, + ECDSA = 0, MLDSA = 1, }; DECLARE_JSON_ENUM( - IdentityType, {{IdentityType::ES, "ES"}, {IdentityType::MLDSA, "MLDSA"}}); + IdentityType, + {{IdentityType::ECDSA, "ECDSA"}, {IdentityType::MLDSA, "MLDSA"}}); enum class IdentityKind : uint8_t { @@ -51,7 +52,7 @@ namespace ccf namespace ccf::kv::serialisers { // IdentityType is used as a KV key by tables which were previously a single - // Value. ES is 0, so it serialises to the same bytes as the unit key of + // Value. ECDSA is 0, so it serialises to the same bytes as the unit key of // those tables, keeping their serialised form unchanged. template <> struct BlitSerialiser @@ -67,8 +68,8 @@ namespace ccf::kv::serialisers const auto value = BlitSerialiser::from_serialised(data); switch (value) { - case static_cast(ccf::IdentityType::ES): - return ccf::IdentityType::ES; + case static_cast(ccf::IdentityType::ECDSA): + return ccf::IdentityType::ECDSA; case static_cast(ccf::IdentityType::MLDSA): return ccf::IdentityType::MLDSA; default: From 52ecb0812272f07085c0d853842d5bd9a1a038d5 Mon Sep 17 00:00:00 2001 From: Max Tropets Date: Thu, 3 Sep 2026 10:29:00 +0000 Subject: [PATCH 6/6] Name identity types by algorithm class, not by algorithm The identity in slot 0 is whatever the service was already signing with before multiple identities existed, and that is not a fixed algorithm. Its curve comes from node_certificate.curve_id, which accepts Secp384R1 and Secp256R1, and the identity is recreated from the recovering node's configuration during recovery, so it can differ between epochs. Naming the slot after an algorithm makes a claim about existing ledgers which cannot be checked and need not hold. CLASSICAL and PQ name the property the slot exists to express: whether the identity is vulnerable to a cryptographically relevant quantum computer. The concrete algorithm, curve and parameter set stay where they are already recorded, in the key itself. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/node/test/identity_types.cpp | 18 +++++++++--------- src/service/tables/identity_types.h | 18 +++++++++--------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/src/node/test/identity_types.cpp b/src/node/test/identity_types.cpp index 901c5d427f48..74f3d96e5b70 100644 --- a/src/node/test/identity_types.cpp +++ b/src/node/test/identity_types.cpp @@ -19,19 +19,19 @@ using IdentityTypeSerialiser = ccf::kv::serialisers::BlitSerialiser; static constexpr std::array IDENTITY_TYPES = { - ccf::IdentityType::ECDSA, ccf::IdentityType::MLDSA}; + ccf::IdentityType::CLASSICAL, ccf::IdentityType::PQ}; -TEST_CASE("ECDSA shares the serialised key of a single-Value table") +TEST_CASE("CLASSICAL shares the serialised key of a single-Value table") { // ServiceValue is a Map with a single entry, whose key is 8 null bytes. A // table keyed by IdentityType is therefore serialised identically to a - // ServiceValue for as long as ECDSA is its only entry. + // ServiceValue for as long as CLASSICAL is its only entry. REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::ECDSA) == + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::CLASSICAL) == ccf::kv::serialisers::ZeroBlitUnitCreator::get()); REQUIRE( - IdentityTypeSerialiser::to_serialised(ccf::IdentityType::MLDSA) != + IdentityTypeSerialiser::to_serialised(ccf::IdentityType::PQ) != ccf::kv::serialisers::ZeroBlitUnitCreator::get()); } @@ -59,8 +59,8 @@ TEST_CASE("Unknown identity types are rejected") TEST_CASE("IdentityType names are distinct and stable") { // These names will appear in the ledger, so they must not change. - REQUIRE(nlohmann::json(ccf::IdentityType::ECDSA) == "ECDSA"); - REQUIRE(nlohmann::json(ccf::IdentityType::MLDSA) == "MLDSA"); + REQUIRE(nlohmann::json(ccf::IdentityType::CLASSICAL) == "CLASSICAL"); + REQUIRE(nlohmann::json(ccf::IdentityType::PQ) == "PQ"); std::set names; for (const auto identity_type : IDENTITY_TYPES) @@ -85,9 +85,9 @@ TEST_CASE("Identity round-trips through JSON") TEST_CASE("Identities round-trips through JSON") { const ccf::Identities identities{ - {ccf::IdentityType::ECDSA, + {ccf::IdentityType::CLASSICAL, {ccf::IdentityKind::X509_CERT_DER, std::vector{1, 2}}}, - {ccf::IdentityType::MLDSA, + {ccf::IdentityType::PQ, {ccf::IdentityKind::X509_SPKI_DER, std::vector{3, 4}}}}; const nlohmann::json j = identities; diff --git a/src/service/tables/identity_types.h b/src/service/tables/identity_types.h index 8fede16a8dbd..5b215c441387 100644 --- a/src/service/tables/identity_types.h +++ b/src/service/tables/identity_types.h @@ -14,13 +14,13 @@ namespace ccf { enum class IdentityType : uint64_t { - ECDSA = 0, - MLDSA = 1, + CLASSICAL = 0, + PQ = 1, }; DECLARE_JSON_ENUM( IdentityType, - {{IdentityType::ECDSA, "ECDSA"}, {IdentityType::MLDSA, "MLDSA"}}); + {{IdentityType::CLASSICAL, "CLASSICAL"}, {IdentityType::PQ, "PQ"}}); enum class IdentityKind : uint8_t { @@ -52,8 +52,8 @@ namespace ccf namespace ccf::kv::serialisers { // IdentityType is used as a KV key by tables which were previously a single - // Value. ECDSA is 0, so it serialises to the same bytes as the unit key of - // those tables, keeping their serialised form unchanged. + // Value. CLASSICAL is 0, so it serialises to the same bytes as the unit key + // of those tables, keeping their serialised form unchanged. template <> struct BlitSerialiser { @@ -68,10 +68,10 @@ namespace ccf::kv::serialisers const auto value = BlitSerialiser::from_serialised(data); switch (value) { - case static_cast(ccf::IdentityType::ECDSA): - return ccf::IdentityType::ECDSA; - case static_cast(ccf::IdentityType::MLDSA): - return ccf::IdentityType::MLDSA; + case static_cast(ccf::IdentityType::CLASSICAL): + return ccf::IdentityType::CLASSICAL; + case static_cast(ccf::IdentityType::PQ): + return ccf::IdentityType::PQ; default: throw std::logic_error( fmt::format("Unknown identity type: {}", value));