Bind out ed25519 support (#630)

DmitriyMusatkin · web-flow · commit 9d79415d889c · 2025-03-17T11:35:47.000-07:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -223,6 +223,7 @@ jobs:
     permissions:
       id-token: write # This is required for requesting the JWT
     steps:
+      - uses: ilammy/setup-nasm@v1
       - name: configure AWS credentials (containers)
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -233,7 +234,6 @@ jobs:
           python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
           python builder.pyz build -p ${{ env.PACKAGE_NAME }} --python "C:\\hostedtoolcache\\windows\\Python\\3.8.10\\${{ matrix.arch }}\\python.exe"
 
-
   macos:
     runs-on: macos-14 # latest
     permissions:
diff --git a/README.md b/README.md
@@ -34,7 +34,7 @@ python3 -m pip install .
 
 To use from your Python application, declare `awscrt` as a dependency.
 
-### OpenSSL and LibCrypto (Unix only)
+### OpenSSL and LibCrypto
 
 aws-crt-python does not use OpenSSL for TLS.
 On Apple and Windows devices, the OS's default TLS library is used.
@@ -56,8 +56,19 @@ AWS_CRT_BUILD_USE_SYSTEM_LIBCRYPTO=1 python3 -m pip install --no-binary :all: --
 ```
 ( `--no-binary :all:` ensures you do not use the precompiled wheel from PyPI)
 
-You can ignore all this on Windows and Apple platforms, where aws-crt-python
-uses the OS's default libraries for TLS and cryptography math.
+aws-crt-python also exposes a number of cryptographic primitives. 
+On Unix, those depend on libcrypto as described above.
+On Apple and Windows OS level crypto libraries are used whenever possible.
+One exception to above statement is that for ED25519 keygen on Windows and Apple, 
+libcrypto is used as no viable OS level alternative exists. In that case Unix level notes
+about libcrypto apply to Apple and Windows as well. Libcrypto usage for ED25519 support is 
+enabled on Windows and Apple by default and can be disabled by setting environment variable
+`AWS_CRT_BUILD_DISABLE_LIBCRYPTO_USE_FOR_ED25519_EVERYWHERE` as follows:
+(Note: ED25519 keygen functions will start returning not supported error in this case)
+```sh
+AWS_CRT_BUILD_DISABLE_LIBCRYPTO_USE_FOR_ED25519_EVERYWHERE=1 python3 -m pip install --no-binary :all: --verbose awscrt
+```
+( `--no-binary :all:` ensures you do not use the precompiled wheel from PyPI)
 
 ### AWS_CRT_BUILD_USE_SYSTEM_LIBS ###
 
diff --git a/awscrt/crypto.py b/awscrt/crypto.py
@@ -171,3 +171,42 @@ def verify(self, signature_algorithm: RSASignatureAlgorithm,
         Returns True if signature matches and False if not.
         """
         return _awscrt.rsa_verify(self._binding, signature_algorithm, digest, signature)
+
+
+class ED25519ExportFormat(IntEnum):
+    """ED25519 Export format"""
+
+    RAW = 0
+    """
+    Raw bytes.
+    """
+
+    OPENSSH_B64 = 1
+    """
+    Base64 encoded OpenSSH format as defined in RFC 8709.
+    """
+
+
+class ED25519(NativeResource):
+    def __init__(self, binding):
+        super().__init__()
+        self._binding = binding
+
+    @staticmethod
+    def new_generate() -> 'ED25519':
+        """
+        Generates a new instance of ED25159 key pair.
+        """
+        return ED25519(binding=_awscrt.ed25519_new_generate())
+
+    def export_public_key(self, export_format: ED25519ExportFormat) -> bytes:
+        """
+        Exports public part of the key in specified format.
+        """
+        return _awscrt.ed25519_export_public_key(self._binding, export_format)
+
+    def export_private_key(self, export_format: ED25519ExportFormat) -> bytes:
+        """
+        Exports public part of the key in specified format.
+        """
+        return _awscrt.ed25519_export_private_key(self._binding, export_format)
diff --git a/crt/CMakeLists.txt b/crt/CMakeLists.txt
@@ -26,9 +26,11 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON CACHE BOOL "")
 set(BUILD_TESTING OFF CACHE BOOL "")
 include(CTest)
 
+option(AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE "Set this if you want to use libcrypto to support ed25519 on Window/Apple" ON)
+
 # On Unix we use S2N for TLS and AWS-LC crypto.
 # (On Windows and Apple we use the default OS libraries)
-if(UNIX AND NOT APPLE)
+if ((UNIX AND NOT APPLE) OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE)
     option(USE_OPENSSL "Set this if you want to use your system's OpenSSL compatible libcrypto" OFF)
     include(AwsPrebuildDependency)
 
@@ -41,6 +43,14 @@ if(UNIX AND NOT APPLE)
             -DBUILD_TESTING=OFF
         )
 
+        if (APPLE OR WIN32)
+            # Libcrypto implementations typically have several chunky pregenerated tables that add a lot
+            # to artifact size. We dont really need them for ed25519 case on win/mac, so favor 
+            # smaller binary over perf here.
+            # In future if there is more usage of lc on win/mac consider removing this
+            list(APPEND AWSLC_CMAKE_ARGUMENTS -DOPENSSL_SMALL=1)
+        endif()
+
         if(CMAKE_C_COMPILER_ID MATCHES "GNU" AND CMAKE_C_COMPILER_VERSION VERSION_LESS "5.0")
             # Disable AVX512 on old GCC that not supports it.
             list(APPEND AWSLC_CMAKE_ARGUMENTS -DMY_ASSEMBLER_IS_TOO_OLD_FOR_512AVX=ON)
@@ -54,6 +64,10 @@ if(UNIX AND NOT APPLE)
         )
     endif()
 
+
+endif()
+
+if(UNIX AND NOT APPLE)
     # prebuild s2n-tls.
     aws_prebuild_dependency(
         DEPENDENCY_NAME S2N
diff --git a/crt/aws-c-auth b/crt/aws-c-auth
@@ -1 +1 @@
-Subproject commit 2d85beff96bee7ee4734c21c7fc6b15e9d07b85e
+Subproject commit 01dd06acd2b8865a4a6bc232380ee69a042af47d
diff --git a/crt/aws-c-cal b/crt/aws-c-cal
@@ -1 +1 @@
-Subproject commit 7299c6ab9244595b140d604475cdd6c6921be8ae
+Subproject commit d59c198db17c42a48e3ee105d12357f5a9efecf3
diff --git a/crt/aws-c-common b/crt/aws-c-common
@@ -1 +1 @@
-Subproject commit 6401c830ffcd82ee9c9e26255f2fadf7092c7321
+Subproject commit 7fb0071ab88182bffcc18a4a09bdb4dd2a5751d8
diff --git a/crt/aws-c-event-stream b/crt/aws-c-event-stream
@@ -1 +1 @@
-Subproject commit 4bd476bd0c629e8fab4ec0ace92830efc6a79e6c
+Subproject commit 9312b052583183b98526aaeb91e5c72ec3db9627
diff --git a/crt/aws-c-s3 b/crt/aws-c-s3
@@ -1 +1 @@
-Subproject commit 6eb8be530b100fed5c6d24ca48a57ee2e6098fbf
+Subproject commit 1d0091c73ab4652924b902a3e855f7ae651fa391
diff --git a/crt/aws-lc b/crt/aws-lc
@@ -1 +1 @@
-Subproject commit becf5785c131012bb5a64f3da6cdb117ddc0f431
+Subproject commit d0356099f6b668697cdb381dfb09f9a694a6c9c2
diff --git a/crt/s2n b/crt/s2n
@@ -1 +1 @@
-Subproject commit 21cefc1091b3953ef543c9e72b932b6431fadc6e
+Subproject commit 4ed4f1a658b70559ec4a18e91d1319daa14b0610
diff --git a/setup.py b/setup.py
@@ -154,6 +154,11 @@ def forcing_static_libs():
     return os.getenv('AWS_CRT_BUILD_FORCE_STATIC_LIBS') == '1'
 
 
+def disable_libcrypto_use_for_ed25519_everywhere():
+    """If true, libcrypto is not used on mac/win to support ed25519 and apis instead return not supported."""
+    return os.getenv('AWS_CRT_BUILD_DISABLE_LIBCRYPTO_USE_FOR_ED25519_EVERYWHERE') == '1'
+
+
 class AwsLib:
     def __init__(self, name, extra_cmake_args=[], libname=None):
         self.name = name
@@ -164,10 +169,14 @@ def __init__(self, name, extra_cmake_args=[], libname=None):
 # The extension depends on these libs.
 # They're built along with the extension (unless using_system_libs() is True)
 AWS_LIBS = []
-if sys.platform != 'darwin' and sys.platform != 'win32':
+
+if not disable_libcrypto_use_for_ed25519_everywhere() or (sys.platform != 'darwin' and sys.platform != 'win32'):
     # aws-lc produces libcrypto.a
     AWS_LIBS.append(AwsLib('aws-lc', libname='crypto'))
+
+if sys.platform != 'darwin' and sys.platform != 'win32':
     AWS_LIBS.append(AwsLib('s2n'))
+
 AWS_LIBS.append(AwsLib('aws-c-common'))
 AWS_LIBS.append(AwsLib('aws-c-sdkutils'))
 AWS_LIBS.append(AwsLib('aws-c-cal'))
@@ -217,6 +226,9 @@ def _build_dependencies_impl(self, build_dir, install_path, osx_arch=None):
         if using_system_libcrypto():
             cmake_args.append('-DUSE_OPENSSL=ON')
 
+        if not disable_libcrypto_use_for_ed25519_everywhere():
+            cmake_args.append('-DAWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE=ON')
+
         if sys.platform == 'darwin':
             # build lib with same MACOSX_DEPLOYMENT_TARGET that python will ultimately
             # use to link everything together, otherwise there will be linker warnings.
@@ -348,29 +360,10 @@ def awscrt_ext():
         extra_link_args += ['-framework', 'Security']
 
     else:  # unix
-        if forcing_static_libs():
-            # linker will prefer shared libraries over static if it can find both.
-            # force linker to choose static variant by using
-            # "-l:libaws-c-common.a" syntax instead of just "-laws-c-common".
-            #
-            # This helps AWS developers creating Lambda applications from Brazil.
-            # In Brazil, both shared and static libs are available.
-            # But Lambda requires all shared libs to be explicitly packaged up.
-            # So it's simpler to link them in statically and have less runtime dependencies.
-            #
-            # Don't apply this trick to dependencies that are always on the OS (e.g. librt)
-            libraries = [':lib{}.a'.format(x) for x in libraries]
-
         # OpenBSD doesn't have librt; functions are found in libc instead.
         if not sys.platform.startswith('openbsd'):
             libraries += ['rt']
 
-        # hide the symbols from libcrypto.a
-        # this prevents weird crashes if an application also ends up using
-        # libcrypto.so from the system's OpenSSL installation.
-        # Do this even if using system libcrypto, since it could still be a static lib.
-        extra_link_args += ['-Wl,--exclude-libs,libcrypto.a']
-
         # OpenBSD 7.4+ defaults to linking with --execute-only, which is bad for AWS-LC.
         # See: https://github.com/aws/aws-lc/blob/4b07805bddc55f68e5ce8c42f215da51c7a4e099/CMakeLists.txt#L44-L53
         # (If AWS-LC's CMakeLists.txt removes these lines in the future, we can remove this hack here as well)
@@ -387,6 +380,26 @@ def awscrt_ext():
         # rare cases where that didn't happen, so let's be explicit.
         extra_link_args += ['-pthread']
 
+        # hide the symbols from libcrypto.a
+        # this prevents weird crashes if an application also ends up using
+        # libcrypto.so from the system's OpenSSL installation.
+        # Do this even if using system libcrypto, since it could still be a static lib.
+        extra_link_args += ['-Wl,--exclude-libs,libcrypto.a']
+
+    if not disable_libcrypto_use_for_ed25519_everywhere() or (sys.platform != 'darwin' and sys.platform != 'win32'):
+        if forcing_static_libs():
+            # linker will prefer shared libraries over static if it can find both.
+            # force linker to choose static variant by using
+            # "-l:libaws-c-common.a" syntax instead of just "-laws-c-common".
+            #
+            # This helps AWS developers creating Lambda applications from Brazil.
+            # In Brazil, both shared and static libs are available.
+            # But Lambda requires all shared libs to be explicitly packaged up.
+            # So it's simpler to link them in statically and have less runtime dependencies.
+            #
+            # Don't apply this trick to dependencies that are always on the OS (e.g. librt)
+            libraries = [':lib{}.a'.format(x) for x in libraries]
+
     if sys.platform != 'win32' or distutils.ccompiler.get_default_compiler() != 'msvc':
         extra_compile_args += ['-Wno-strict-aliasing', '-std=gnu99']
 
diff --git a/source/crypto.c b/source/crypto.c
@@ -5,6 +5,7 @@
 
 #include "crypto.h"
 
+#include "aws/cal/ed25519.h"
 #include "aws/cal/hash.h"
 #include "aws/cal/hmac.h"
 #include "aws/cal/rsa.h"
@@ -14,6 +15,7 @@
 const char *s_capsule_name_hash = "aws_hash";
 const char *s_capsule_name_hmac = "aws_hmac";
 const char *s_capsule_name_rsa = "aws_rsa";
+const char *s_capsule_name_ed25519 = "aws_ed25519";
 
 static void s_hash_destructor(PyObject *hash_capsule) {
     assert(PyCapsule_CheckExact(hash_capsule));
@@ -528,3 +530,90 @@ PyObject *aws_py_rsa_verify(PyObject *self, PyObject *args) {
 
     Py_RETURN_TRUE;
 }
+
+static void s_ed25519_destructor(PyObject *ed25519_capsule) {
+    struct aws_ed25519_key_pair *key_pair = PyCapsule_GetPointer(ed25519_capsule, s_capsule_name_ed25519);
+    assert(key_pair);
+
+    aws_ed25519_key_pair_release(key_pair);
+}
+
+PyObject *aws_py_ed25519_new_generate(PyObject *self, PyObject *args) {
+    (void)self;
+    (void)args;
+
+    PyObject *capsule = NULL;
+    struct aws_allocator *allocator = aws_py_get_allocator();
+
+    struct aws_ed25519_key_pair *key_pair = aws_ed25519_key_pair_new_generate(allocator);
+
+    if (key_pair == NULL) {
+        PyErr_AwsLastError();
+        goto on_done;
+    }
+
+    capsule = PyCapsule_New(key_pair, s_capsule_name_ed25519, s_ed25519_destructor);
+
+    if (capsule == NULL) {
+        aws_ed25519_key_pair_release(key_pair);
+    }
+
+on_done:
+    return capsule;
+}
+
+PyObject *aws_py_ed25519_export_public_key(PyObject *self, PyObject *args) {
+    (void)self;
+    PyObject *ed25519_capsule = NULL;
+    int export_format = 0;
+
+    if (!PyArg_ParseTuple(args, "Oi", &ed25519_capsule, &export_format)) {
+        return NULL;
+    }
+
+    struct aws_ed25519_key_pair *ed25519 = PyCapsule_GetPointer(ed25519_capsule, s_capsule_name_ed25519);
+    if (ed25519 == NULL) {
+        return NULL;
+    }
+
+    struct aws_allocator *allocator = aws_py_get_allocator();
+    struct aws_byte_buf result_buf;
+    aws_byte_buf_init(&result_buf, allocator, aws_ed25519_key_pair_get_public_key_size(export_format));
+
+    if (aws_ed25519_key_pair_get_public_key(ed25519, export_format, &result_buf)) {
+        aws_byte_buf_clean_up_secure(&result_buf);
+        return PyErr_AwsLastError();
+    }
+
+    PyObject *ret = PyBytes_FromStringAndSize((const char *)result_buf.buffer, result_buf.len);
+    aws_byte_buf_clean_up_secure(&result_buf);
+    return ret;
+}
+
+PyObject *aws_py_ed25519_export_private_key(PyObject *self, PyObject *args) {
+    (void)self;
+    PyObject *ed25519_capsule = NULL;
+    int export_format = 0;
+
+    if (!PyArg_ParseTuple(args, "Oi", &ed25519_capsule, &export_format)) {
+        return NULL;
+    }
+
+    struct aws_ed25519_key_pair *ed25519 = PyCapsule_GetPointer(ed25519_capsule, s_capsule_name_ed25519);
+    if (ed25519 == NULL) {
+        return NULL;
+    }
+
+    struct aws_allocator *allocator = aws_py_get_allocator();
+    struct aws_byte_buf result_buf;
+    aws_byte_buf_init(&result_buf, allocator, aws_ed25519_key_pair_get_private_key_size(export_format));
+
+    if (aws_ed25519_key_pair_get_private_key(ed25519, export_format, &result_buf)) {
+        aws_byte_buf_clean_up_secure(&result_buf);
+        return PyErr_AwsLastError();
+    }
+
+    PyObject *ret = PyBytes_FromStringAndSize((const char *)result_buf.buffer, result_buf.len);
+    aws_byte_buf_clean_up_secure(&result_buf);
+    return ret;
+}
diff --git a/source/crypto.h b/source/crypto.h
@@ -12,6 +12,8 @@ extern const char *s_capsule_name_hash;
 extern const char *s_capsule_name_hmac;
 /** Name string for rsa capsule. */
 extern const char *s_capsule_name_rsa;
+/** Name string for rsa capsule. */
+extern const char *s_capsule_name_ed25519;
 
 PyObject *aws_py_sha1_new(PyObject *self, PyObject *args);
 PyObject *aws_py_sha256_new(PyObject *self, PyObject *args);
@@ -40,4 +42,8 @@ PyObject *aws_py_rsa_decrypt(PyObject *self, PyObject *args);
 PyObject *aws_py_rsa_sign(PyObject *self, PyObject *args);
 PyObject *aws_py_rsa_verify(PyObject *self, PyObject *args);
 
+PyObject *aws_py_ed25519_new_generate(PyObject *self, PyObject *args);
+PyObject *aws_py_ed25519_export_public_key(PyObject *self, PyObject *args);
+PyObject *aws_py_ed25519_export_private_key(PyObject *self, PyObject *args);
+
 #endif /* AWS_CRT_PYTHON_CRYPTO_H */
diff --git a/source/module.c b/source/module.c
@@ -762,6 +762,11 @@ static PyMethodDef s_module_methods[] = {
     AWS_PY_METHOD_DEF(rsa_sign, METH_VARARGS),
     AWS_PY_METHOD_DEF(rsa_verify, METH_VARARGS),
 
+    /* ED25519 crypto primitives */
+    AWS_PY_METHOD_DEF(ed25519_new_generate, METH_NOARGS),
+    AWS_PY_METHOD_DEF(ed25519_export_public_key, METH_VARARGS),
+    AWS_PY_METHOD_DEF(ed25519_export_private_key, METH_VARARGS),
+
     /* Checksum primitives */
     AWS_PY_METHOD_DEF(checksums_crc32, METH_VARARGS),
     AWS_PY_METHOD_DEF(checksums_crc32c, METH_VARARGS),
diff --git a/test/test_crypto.py b/test/test_crypto.py
