imid: switch from p256 to ed25519 keys

Cargo.toml

@@ -51,12 +51,12 @@ tower = { version = "0.5.2", features = ["util", "timeout", "load-shed", "limit"
 tracing = "0.1.41"
 tracing-subscriber = { version = "0.3.20", features = ["env-filter"] }
 yaml-rust2 = "0.10.3"
-p256 = "0.13.2"
+ed25519-dalek = { version = "2.2.0", features = ["pkcs8", "pem", "rand_core"] }
 pest = "2.7"
 pest_derive = "2.7"
 pkcs8 = "0.10.2"
+rand_core = { version = "0.6", features = ["getrandom"] }
 regex = "1.11.1"
-ring = "0.17"
 rustls = { version = "0.23.31", default-features = false }
 thiserror = "2.0.16"
 x509-cert = { version = "0.2.5", features = ["builder"] }

context/interfaces/src/imid.md

@@ -14,27 +14,24 @@ pub struct Imid {
     pub string: String,
 
     /// Public key used to verify signatures from this identity.
-    pub public_key: PublicKey,
+    pub public_key: VerifyingKey,
 }
 
 /// Private key material used to sign Intermesh messages.
 pub struct ImidKeypair {
     /// Secret signing key.
-    pub private_key: SecretKey,
+    pub private_key: SigningKey,
 }
 
 impl Imid {
-    /// Create an object suitable for signature verification.
-    pub fn to_unparsed_public_key(&self) -> UnparsedPublicKey<Vec<u8>>;
-
     /// Verify that `signature` was produced by this identity for `message`.
     pub fn verify(&self, message: &[u8], signature: &[u8]) -> Result<(), _>;
 
     /// Parse an IMID from its canonical string form.
     pub fn from_string(s: String) -> anyhow::Result<Self>;
 
-    /// Create an IMID from a P-256 public key.
-    pub fn from_public_key(public_key: PublicKey) -> Self;
+    /// Create an IMID from an Ed25519 public key.
+    pub fn from_public_key(public_key: VerifyingKey) -> Self;
 
     /// Convert to `<imid>.imid` DNS-name form.
     pub fn to_dns_name(&self) -> String;
@@ -45,7 +42,7 @@ impl Imid {
     /// Convert to a rustls server name for TLS verification.
     pub fn to_server_name(&self) -> ServerName<'static>;
 
-    /// Parse from compressed SEC1 public key bytes.
+    /// Parse from raw Ed25519 public key bytes.
     pub fn from_bytes(bytes: &[u8]) -> anyhow::Result<Self>;
 
     /// Derive an IMID from a TLS certificate without validating it.
@@ -62,8 +59,8 @@ impl ImidKeypair {
     /// Serialize the private key as PEM bytes.
     pub fn to_pem(&self) -> Vec<u8>;
 
-    /// Serialize the private key as PKCS#8 EC DER bytes.
-    pub fn to_ec_der(&self) -> Vec<u8>;
+    /// Serialize the private key as PKCS#8 DER bytes.
+    pub fn to_pkcs8_der(&self) -> Vec<u8>;
 
     /// Return the public identity for this keypair.
     pub fn to_imid(&self) -> Imid;

proto/intermesh.proto

@@ -126,7 +126,7 @@ message Authz {
 // Endorsement message transmitted over the network
 message Endorsement {
   bytes payload = 1;    // Serialized `EndorsementData` (binary protobuf)
-  bytes signature = 2;  // ECDSA P-256 signature over data field
+  bytes signature = 2;  // Ed25519 signature over data field
 }
 
 message GossipUpdate {
@@ -137,7 +137,7 @@ message GossipUpdate {
 // Signed revocation message
 message Revocation {
   bytes payload = 1;    // Serialized `Endorsement` (binary protobuf)
-  bytes signature = 2;  // ECDSA P-256 signature over payload
+  bytes signature = 2;  // Ed25519 signature over payload
 }
 
 // Admin service for local CLI commands only over the unix socket.  These
@@ -191,4 +191,3 @@ message EndorseRequest {
 
 message EndorseResponse {}
 
-

src/connect.rs

@@ -51,7 +51,7 @@ impl IntermeshClient {
                 .with_custom_certificate_verifier(verifier)
                 .with_client_auth_cert(
                     vec![keypair.gen_cert()],
-                    PrivateKeyDer::try_from(keypair.to_ec_der()).assert(),
+                    PrivateKeyDer::try_from(keypair.to_pkcs8_der()).assert(),
                 )
                 .assert();
 
@@ -188,7 +188,7 @@ pub(crate) fn intermesh_server_stream(
     listener: TcpListener,
 ) -> impl Stream<Item = Result<IntermeshTlsStream, io::Error>> {
     let cert_der = keypair.gen_cert();
-    let private_key_der = keypair.to_ec_der();
+    let private_key_der = keypair.to_pkcs8_der();
 
     // TODO(Issue/64): Evaluate whether RustCrypto is an appropriate default
     let mut server_config =
@@ -589,7 +589,7 @@ mod tests {
             let server_verifier = Arc::new(IntermeshVerifier::new_permissive());
 
             let cert_der = server_keypair.gen_cert();
-            let private_key_der = server_keypair.to_ec_der();
+            let private_key_der = server_keypair.to_pkcs8_der();
 
             let mut server_config =
                 ServerConfig::builder_with_provider(Arc::new(rustls_rustcrypto::provider()))