1b70b558c6
Some checks failed
Checks on the Python tests / Call Ledger Python linters (push) Has been cancelled
Build and run functional tests using ragger through reusable workflow / Build application using the reusable workflow (push) Has been cancelled
Run coding style check / Check linting using the reusable workflow (push) Has been cancelled
Ensure compliance with Ledger guidelines / Call Ledger guidelines_enforcer (push) Has been cancelled
Misspellings checks / Check misspellings (push) Has been cancelled
Build and run functional tests using ragger through reusable workflow / Run standalone ragger tests using the reusable workflow (push) Has been cancelled
Hardware-wallet app for Handshake (HNS). Derives Handshake addresses and signs
Handshake transactions, including name-auction covenants, on Ledger Stax, Flex,
Nano S+, Nano X and Apex+.
The design premise is that the host computer is untrusted: every APDU byte is
attacker-controlled, and the device's job is to be correct when the host lies.
Two failures outrank all others, and the code is shaped around them.
Signing something other than what the user approved. Any field the signature
commits to and the host can vary has to appear on the review screen, and
anything the screen cannot represent honestly is refused rather than shown under
a label that does not describe it. So the device signs SIGHASH_ALL only,
checked per input rather than once for the session; it displays a TRANSFER
covenant's destination, which decides who ends up owning the name and appears
nowhere else in the output; it shows a covenant's name hash when the plaintext
name cannot be verified against it; and it refuses covenant kinds it cannot
name, outputs whose values exceed their inputs, and declared input totals that
would overflow the fee arithmetic.
Misusing key material. Derivation paths are constrained to
m/44'/{5353..5356}'/account'[/change/index] in the app itself, not only by the
install manifest, because BOLOS terminates the app on an out-of-whitelist path
instead of returning an error. One coin type per signing session, since the
review renders every address under a single HRP.
Panics count too: set_panic!(exiting_panic) means a panic kills the app and
strands the session, so nothing unwraps on host-derived data and the session
ceilings are sized to the configured heap.
Consensus follows shd, the Swift Handshake node, which is the reference for the
sighash preimage, covenant item layouts and address encoding.
SIGN_TX is a PSBT-style state machine driven by P1 (BEGIN / ADD_INPUT /
ADD_OUTPUT / REVIEW / SIGN_INPUT): the host streams the transaction as
structured records, the device accumulates its own view of the values, shows one
review, then signs each input on demand.
Tests run under speculos in a container (./scripts/test), 66 of them, green on
all five devices. test_sign_tx_policy.py covers each refusal above and needs no
golden snapshots because every case is rejected before anything is drawn; the
snapshots that do exist are the record of what the user sees before approving.
tests/application_client/handshake_sighash.py is a deliberately independent
reimplementation of the sighash, used to verify real signatures.
Status: v0.1, pre-audit. Not for mainnet keys. Signing has not yet been
exercised on physical hardware.
Forked from LedgerHQ/app-boilerplate-rust (Apache-2.0).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
68 lines
2.7 KiB
Python
68 lines
2.7 KiB
Python
"""SIGN_MESSAGE, which had no functional coverage at all before."""
|
|
|
|
import pytest
|
|
from ecdsa import SECP256k1, VerifyingKey
|
|
from ecdsa.util import sigdecode_string
|
|
from ragger.error import ExceptionRAPDU
|
|
|
|
from application_client.handshake_command_sender import Errors, HandshakeCommandSender
|
|
from application_client.handshake_response_unpacker import (
|
|
unpack_get_public_key_response, unpack_sign_message_response,
|
|
)
|
|
from application_client.handshake_sighash import blake2b_256
|
|
from .review_nav import approve_review
|
|
|
|
PATH = "m/44'/5353'/0'/0/0"
|
|
|
|
#: The device prepends this before hashing, matching shd's `verifymessage`.
|
|
MESSAGE_PREFIX = b"handshake signed message:\n"
|
|
|
|
|
|
def test_sign_message_accepted(backend, device, navigator, default_screenshot_path, test_name):
|
|
client = HandshakeCommandSender(backend)
|
|
pubkey, _, _ = unpack_get_public_key_response(client.get_public_key(path=PATH).data)
|
|
message = b"hello handshake"
|
|
|
|
with client.sign_message(path=PATH, message=message):
|
|
approve_review(device, navigator, default_screenshot_path, test_name)
|
|
|
|
_, signature, returned_pubkey = unpack_sign_message_response(
|
|
client.get_async_response().data)
|
|
assert returned_pubkey == pubkey
|
|
|
|
digest = blake2b_256(MESSAGE_PREFIX + message)
|
|
vk = VerifyingKey.from_string(pubkey, curve=SECP256k1)
|
|
assert vk.verify_digest(signature, digest, sigdecode=sigdecode_string)
|
|
|
|
|
|
def test_sign_message_refused(backend, scenario_navigator):
|
|
client = HandshakeCommandSender(backend)
|
|
with pytest.raises(ExceptionRAPDU) as e:
|
|
with client.sign_message(path=PATH, message=b"hello handshake"):
|
|
scenario_navigator.review_reject()
|
|
assert e.value.status == Errors.SW_DENY
|
|
|
|
|
|
def test_sign_message_rejects_out_of_policy_path(backend):
|
|
client = HandshakeCommandSender(backend)
|
|
with pytest.raises(ExceptionRAPDU) as e:
|
|
with client.sign_message(path="m/44'/1'/0'/0/0", message=b"hi"):
|
|
pass
|
|
assert e.value.status == Errors.SW_BAD_DERIVATION_PATH
|
|
|
|
|
|
def test_sign_message_rejects_truncated_payload(backend):
|
|
"""A declared message length longer than the bytes that follow.
|
|
|
|
`MAX_MESSAGE_LEN` is 512, but a single APDU carries at most 255 data bytes,
|
|
so the length cap is unreachable and the bounds check in the reader is what
|
|
actually protects here.
|
|
"""
|
|
from application_client.handshake_command_sender import CLA, InsType
|
|
from ragger.bip import pack_derivation_path
|
|
|
|
payload = pack_derivation_path(PATH) + (200).to_bytes(2, "little") + b"A" * 10
|
|
with pytest.raises(ExceptionRAPDU) as e:
|
|
backend.exchange(cla=CLA, ins=InsType.SIGN_MESSAGE, p1=0, p2=0, data=payload)
|
|
assert e.value.status == Errors.SW_TX_WRONG_LENGTH
|