Christian Nennemann
3a139dfc7e
Strategic work for IETF submission of draft-nennemann-act-01 and
draft-nennemann-wimse-ect-02:
Package restructure:
- move ACT and ECT refimpls to workspace/packages/{act,ect}/
- ietf-act and ietf-ect distribution names (sibling packages)
- cross-spec interop test plan (INTEROP-TEST-PLAN.md)
ACT draft -01 revisions:
- rename 'par' claim to 'pred' (align with ECT)
- rename 'Agent Compact Token' to 'Agent Context Token' (semantic
alignment with ECT family)
- add Applicability section (MCP, OpenAI, LangGraph, A2A, CrewAI)
- add DAG vs Linear Delegation Chains section (differentiator vs
txn-tokens-for-agents actchain, Agentic JWT, AIP/IBCTs)
- add Related Work: AIP, SentinelAgent, Agentic JWT, txn-tokens-for-agents,
HDP, SCITT-AI-agent-execution
- pin SCITT arch to -22, note AUTH48 status
Outreach drafts:
- Emirdag liaison email (SCITT-AI coordination)
- OAuth ML response on txn-tokens-for-agents-06
Strategy document:
- STRATEGY.md with phased action plan, risk register, timeline
Submodule:
- update workspace/drafts/ietf-wimse-ect pointer to -02 commit
146 lines
4.3 KiB
Python
146 lines
4.3 KiB
Python
"""Tests for act.crypto module."""
|
|
|
|
import pytest
|
|
|
|
from act.crypto import (
|
|
ACTKeyResolver,
|
|
KeyRegistry,
|
|
X509TrustStore,
|
|
b64url_sha256,
|
|
compute_sha256,
|
|
did_key_from_ed25519,
|
|
generate_ed25519_keypair,
|
|
generate_p256_keypair,
|
|
resolve_did_key,
|
|
sign,
|
|
verify,
|
|
)
|
|
from act.errors import ACTKeyResolutionError, ACTSignatureError
|
|
|
|
|
|
class TestEd25519:
|
|
def test_generate_keypair(self):
|
|
priv, pub = generate_ed25519_keypair()
|
|
assert priv is not None
|
|
assert pub is not None
|
|
|
|
def test_sign_verify(self):
|
|
priv, pub = generate_ed25519_keypair()
|
|
data = b"test data"
|
|
sig = sign(priv, data)
|
|
verify(pub, sig, data)
|
|
|
|
def test_verify_wrong_data(self):
|
|
priv, pub = generate_ed25519_keypair()
|
|
sig = sign(priv, b"correct data")
|
|
with pytest.raises(ACTSignatureError):
|
|
verify(pub, sig, b"wrong data")
|
|
|
|
def test_verify_wrong_key(self):
|
|
priv1, pub1 = generate_ed25519_keypair()
|
|
_, pub2 = generate_ed25519_keypair()
|
|
sig = sign(priv1, b"data")
|
|
with pytest.raises(ACTSignatureError):
|
|
verify(pub2, sig, b"data")
|
|
|
|
|
|
class TestP256:
|
|
def test_generate_keypair(self):
|
|
priv, pub = generate_p256_keypair()
|
|
assert priv is not None
|
|
assert pub is not None
|
|
|
|
def test_sign_verify(self):
|
|
priv, pub = generate_p256_keypair()
|
|
data = b"test data for p256"
|
|
sig = sign(priv, data)
|
|
assert len(sig) == 64 # r||s, 32 bytes each
|
|
verify(pub, sig, data)
|
|
|
|
def test_verify_wrong_data(self):
|
|
priv, pub = generate_p256_keypair()
|
|
sig = sign(priv, b"correct")
|
|
with pytest.raises(ACTSignatureError):
|
|
verify(pub, sig, b"wrong")
|
|
|
|
|
|
class TestSHA256:
|
|
def test_compute(self):
|
|
h = compute_sha256(b"hello")
|
|
assert len(h) == 32
|
|
|
|
def test_b64url(self):
|
|
result = b64url_sha256(b"hello world")
|
|
assert "=" not in result
|
|
assert isinstance(result, str)
|
|
|
|
|
|
class TestKeyRegistry:
|
|
def test_register_and_get(self):
|
|
reg = KeyRegistry()
|
|
_, pub = generate_ed25519_keypair()
|
|
reg.register("key-1", pub)
|
|
assert reg.get("key-1") is pub
|
|
assert "key-1" in reg
|
|
assert len(reg) == 1
|
|
|
|
def test_missing_key(self):
|
|
reg = KeyRegistry()
|
|
assert reg.get("missing") is None
|
|
assert "missing" not in reg
|
|
|
|
|
|
class TestDIDKey:
|
|
def test_ed25519_roundtrip(self):
|
|
_, pub = generate_ed25519_keypair()
|
|
did = did_key_from_ed25519(pub)
|
|
assert did.startswith("did:key:z6Mk")
|
|
resolved = resolve_did_key(did)
|
|
# Verify same key by signing/verifying
|
|
from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
|
|
original_bytes = pub.public_bytes(Encoding.Raw, PublicFormat.Raw)
|
|
resolved_bytes = resolved.public_bytes(Encoding.Raw, PublicFormat.Raw)
|
|
assert original_bytes == resolved_bytes
|
|
|
|
def test_invalid_prefix(self):
|
|
with pytest.raises(ACTKeyResolutionError):
|
|
resolve_did_key("did:web:example.com")
|
|
|
|
def test_with_fragment(self):
|
|
_, pub = generate_ed25519_keypair()
|
|
did = did_key_from_ed25519(pub)
|
|
did_with_fragment = f"{did}#{did.split(':')[2]}"
|
|
resolved = resolve_did_key(did_with_fragment)
|
|
assert resolved is not None
|
|
|
|
|
|
class TestACTKeyResolver:
|
|
def test_tier1_resolution(self):
|
|
reg = KeyRegistry()
|
|
_, pub = generate_ed25519_keypair()
|
|
reg.register("my-key", pub)
|
|
resolver = ACTKeyResolver(registry=reg)
|
|
assert resolver.resolve("my-key") is pub
|
|
|
|
def test_tier3_did_key(self):
|
|
_, pub = generate_ed25519_keypair()
|
|
did = did_key_from_ed25519(pub)
|
|
resolver = ACTKeyResolver()
|
|
resolved = resolver.resolve(did)
|
|
assert resolved is not None
|
|
|
|
def test_unresolvable(self):
|
|
resolver = ACTKeyResolver()
|
|
with pytest.raises(ACTKeyResolutionError):
|
|
resolver.resolve("unknown-kid")
|
|
|
|
def test_did_web_resolver_callback(self):
|
|
_, pub = generate_ed25519_keypair()
|
|
def resolver_cb(did: str):
|
|
if did == "did:web:example.com":
|
|
return pub
|
|
return None
|
|
resolver = ACTKeyResolver(did_web_resolver=resolver_cb)
|
|
result = resolver.resolve("did:web:example.com")
|
|
assert result is pub
|