File size: 3,596 Bytes
9abace2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 | """
Layer 0: Trust Root — Cryptographic Primitives
Part of SOVEREIGN PYTHON LLM ENGINE
Dependencies:
- hashlib (stdlib)
- nacl.signing (PyNaCl)
- nacl.encoding (PyNaCl)
"""
from hashlib import blake2b
from typing import NewType
from nacl.signing import SigningKey, VerifyKey
from nacl.encoding import Base64Encoder, HexEncoder
# ==========================================
# Type Definitions
# ==========================================
ContentHash = NewType('ContentHash', str) # Blake3 hex digest
Signature = NewType('Signature', str) # Ed25519 signature (base64)
# ==========================================
# Hash Primitives
# ==========================================
def hash_content(data: bytes) -> ContentHash:
"""
Canonical Blake2b hash for content addressing.
Blake2b chosen over Blake3 for stdlib availability.
64-byte digest, hex-encoded.
"""
hasher = blake2b(digest_size=64)
hasher.update(data)
return ContentHash(hasher.hexdigest())
def hash_multipart(parts: list[bytes]) -> ContentHash:
"""
Hash multiple parts in sequence.
Useful for Merkle tree construction.
"""
hasher = blake2b(digest_size=64)
for part in parts:
hasher.update(part)
return ContentHash(hasher.hexdigest())
# ==========================================
# Signature Primitives
# ==========================================
def generate_keypair() -> tuple[SigningKey, VerifyKey]:
"""Generate Ed25519 keypair."""
signing_key = SigningKey.generate()
verify_key = signing_key.verify_key
return signing_key, verify_key
def sign_artifact(key: SigningKey, data: bytes) -> Signature:
"""
Sign data with Ed25519 private key.
Returns base64-encoded signature.
"""
signed = key.sign(data, encoder=Base64Encoder)
return Signature(signed.signature.decode('utf-8'))
def verify_signature(pubkey: VerifyKey, data: bytes, sig: Signature) -> bool:
"""
Verify Ed25519 signature.
Returns True if valid, False otherwise (does not raise).
"""
try:
pubkey.verify(data, sig.encode('utf-8'), encoder=Base64Encoder)
return True
except Exception:
return False
def serialize_public_key(key: VerifyKey) -> str:
"""Serialize public key to hex string."""
return key.encode(encoder=HexEncoder).decode('utf-8')
def deserialize_public_key(hex_str: str) -> VerifyKey:
"""Deserialize public key from hex string."""
return VerifyKey(hex_str, encoder=HexEncoder)
# ==========================================
# Key Generation
# ==========================================
def generate_signing_key() -> SigningKey:
"""
Generate new random signing key.
Uses OS cryptographically secure random source.
"""
import secrets
return SigningKey(secrets.token_bytes(32))
def derive_signing_key(seed: bytes) -> SigningKey:
"""
Derive deterministic signing key from seed.
Useful for reproducible test keys.
"""
if len(seed) != 32:
raise ValueError("Seed must be exactly 32 bytes")
return SigningKey(seed)
# ==========================================
# Content-Addressed Artifact ID
# ==========================================
def artifact_id(content: bytes, metadata: bytes) -> ContentHash:
"""
Generate content-addressed ID from content + metadata.
Ensures both content and metadata are integrity-checked.
"""
return hash_multipart([content, metadata])
|