kdf: rename derive_ecdsa_* functions to more accurate names

The functions were not specific to ECDSA:
- derive_ecdsa_key was a generic HKDF key derivation, now renamed to derive_key
- derive_ecdsa_key_pair was specifically for P-256, now renamed to derive_p256_key_pair
- derive_ecdsa_key_pair_from_bytes similarly renamed to derive_p256_key_pair_from_bytes

This makes the API clearer about what each function actually does.

Author: kvinwang

Cargo.lock

@@ -14,7 +14,7 @@ use ra_rpc::Attestation;
 use ra_tls::{
     attestation::QuoteContentType,
     cert::generate_ra_cert,
-    kdf::{derive_ecdsa_key, derive_ecdsa_key_pair_from_bytes},
+    kdf::{derive_key, derive_p256_key_pair_from_bytes},
     rcgen::KeyPair,
 };
 use std::{
@@ -378,9 +378,9 @@ fn gen_app_keys_from_seed(
     provider: KeyProviderKind,
     mr: Option<Vec<u8>>,
 ) -> Result<AppKeys> {
-    let key = derive_ecdsa_key_pair_from_bytes(seed, &["app-key".as_bytes()])?;
-    let disk_key = derive_ecdsa_key_pair_from_bytes(seed, &["app-disk-key".as_bytes()])?;
-    let k256_key = derive_ecdsa_key(seed, &["app-k256-key".as_bytes()], 32)?;
+    let key = derive_p256_key_pair_from_bytes(seed, &["app-key".as_bytes()])?;
+    let disk_key = derive_p256_key_pair_from_bytes(seed, &["app-disk-key".as_bytes()])?;
+    let k256_key = derive_key(seed, &["app-k256-key".as_bytes()], 32)?;
     let k256_key = SigningKey::from_bytes(&k256_key).context("Failed to parse k256 key")?;
     let key_provider = match provider {
         KeyProviderKind::None => KeyProvider::None {

dstack-util/src/main.rs

@@ -30,7 +30,7 @@ use ra_rpc::{Attestation, CallContext, RpcCall};
 use ra_tls::{
     attestation::{QuoteContentType, VersionedAttestation, DEFAULT_HASH_ALGORITHM},
     cert::CertConfigV2,
-    kdf::{derive_ecdsa_key, derive_ecdsa_key_pair_from_bytes},
+    kdf::{derive_key, derive_p256_key_pair_from_bytes},
 };
 use rcgen::KeyPair;
 use ring::rand::{SecureRandom, SystemRandom};
@@ -235,7 +235,7 @@ impl DstackGuestRpc for InternalRpcHandler {
             .fill(&mut seed)
             .context("Failed to generate secure seed")?;
         let derived_key =
-            derive_ecdsa_key_pair_from_bytes(&seed, &[]).context("Failed to derive key")?;
+            derive_p256_key_pair_from_bytes(&seed, &[]).context("Failed to derive key")?;
         let config = CertConfigV2 {
             org_name: None,
             subject: request.subject,
@@ -270,7 +270,7 @@ impl DstackGuestRpc for InternalRpcHandler {
 
         let (key, pubkey_hex) = match request.algorithm.as_str() {
             "ed25519" => {
-                let derived_key = derive_ecdsa_key(k256_app_key, &[request.path.as_bytes()], 32)
+                let derived_key = derive_key(k256_app_key, &[request.path.as_bytes()], 32)
                     .context("Failed to derive ed25519 key")?;
                 let signing_key = Ed25519SigningKey::from_bytes(
                     &derived_key
@@ -282,7 +282,7 @@ impl DstackGuestRpc for InternalRpcHandler {
                 (derived_key, pubkey_hex)
             }
             "secp256k1" | "secp256k1_prehashed" | "" => {
-                let derived_key = derive_ecdsa_key(k256_app_key, &[request.path.as_bytes()], 32)
+                let derived_key = derive_key(k256_app_key, &[request.path.as_bytes()], 32)
                     .context("Failed to derive k256 key")?;
 
                 let signing_key =
@@ -497,7 +497,7 @@ impl TappdRpc for InternalRpcHandlerV0 {
         } else {
             &self.state.inner.keys.k256_key
         };
-        let derived_key = derive_ecdsa_key_pair_from_bytes(seed, &[request.path.as_bytes()])
+        let derived_key = derive_p256_key_pair_from_bytes(seed, &[request.path.as_bytes()])
             .context("Failed to derive key")?;
         let config = CertConfigV2 {
             org_name: None,

guest-agent/src/rpc_service.rs

@@ -13,11 +13,10 @@ pub(crate) fn derive_k256_key(
     app_id: &[u8],
 ) -> Result<(SigningKey, Vec<u8>)> {
     let context_data = [app_id, b"app-key"];
-    let derived_key_bytes: [u8; 32] =
-        kdf::derive_ecdsa_key(&parent_key.to_bytes(), &context_data, 32)?
-            .try_into()
-            .ok()
-            .context("Invalid derived key len")?;
+    let derived_key_bytes: [u8; 32] = kdf::derive_key(&parent_key.to_bytes(), &context_data, 32)?
+        .try_into()
+        .ok()
+        .context("Invalid derived key len")?;
     let derived_signing_key = SigningKey::from_bytes(&derived_key_bytes.into())?;
     let pubkey = derived_signing_key.verifying_key();
 

kms/src/crypto.rs

@@ -215,7 +215,7 @@ impl RpcHandler {
 
     fn derive_app_ca(&self, app_id: &[u8]) -> Result<CaCert> {
         let context_data = vec![app_id, b"app-ca"];
-        let app_key = kdf::derive_ecdsa_key_pair(&self.state.root_ca.key, &context_data)
+        let app_key = kdf::derive_p256_key_pair(&self.state.root_ca.key, &context_data)
             .context("Failed to derive app disk key")?;
         let req = CertRequest::builder()
             .key(&app_key)

kms/src/main_service.rs

@@ -20,7 +20,7 @@ impl KeyType for AnySizeKey {
 }
 
 /// Derives a key using HKDF-SHA256.
-pub fn derive_ecdsa_key(
+pub fn derive_key(
     input_key_material: &[u8],
     context_data: &[&[u8]],
     key_size: usize,
@@ -34,21 +34,18 @@ pub fn derive_ecdsa_key(
     Ok(result)
 }
 
-/// Derives a key pair from a given key pair.
-pub fn derive_ecdsa_key_pair(from: &KeyPair, context_data: &[&[u8]]) -> Result<KeyPair> {
+/// Derives a P-256 key pair from a given key pair.
+pub fn derive_p256_key_pair(from: &KeyPair, context_data: &[&[u8]]) -> Result<KeyPair> {
     let der_bytes = from.serialized_der();
     let sk = p256::SecretKey::from_pkcs8_der(der_bytes).context("failed to decode secret key")?;
     let sk_bytes = sk.as_scalar_primitive().to_bytes();
-    derive_ecdsa_key_pair_from_bytes(&sk_bytes, context_data)
+    derive_p256_key_pair_from_bytes(&sk_bytes, context_data)
 }
 
-/// Derives a key pair from a given private key bytes.
-pub fn derive_ecdsa_key_pair_from_bytes(
-    sk_bytes: &[u8],
-    context_data: &[&[u8]],
-) -> Result<KeyPair> {
+/// Derives a P-256 key pair from a given private key bytes.
+pub fn derive_p256_key_pair_from_bytes(sk_bytes: &[u8], context_data: &[&[u8]]) -> Result<KeyPair> {
     let derived_sk_bytes =
-        derive_ecdsa_key(sk_bytes, context_data, 32).or(Err(anyhow!("failed to derive key")))?;
+        derive_key(sk_bytes, context_data, 32).or(Err(anyhow!("failed to derive key")))?;
     let derived_sk = p256::SecretKey::from_slice(&derived_sk_bytes)
         .context("failed to decode derived secret key")?;
     let derived_sk_der = derived_sk
@@ -70,7 +67,7 @@ fn sha256(data: &[u8]) -> [u8; 32] {
 
 /// Derives a X25519 secret from a given key pair.
 pub fn derive_dh_secret(from: &KeyPair, context_data: &[&[u8]]) -> Result<[u8; 32]> {
-    let key_pair = derive_ecdsa_key_pair(from, context_data)?;
+    let key_pair = derive_p256_key_pair(from, context_data)?;
     let derived_secret = sha256(key_pair.serialized_der());
     Ok(derived_secret)
 }
@@ -81,21 +78,21 @@ mod tests {
 
     #[test]
     fn test_derive_key32() {
-        let key = derive_ecdsa_key(b"input key material", &[b"context one"], 32).unwrap();
+        let key = derive_key(b"input key material", &[b"context one"], 32).unwrap();
         assert_eq!(key.len(), 32);
         assert!(key.iter().any(|&x| x != 0));
     }
 
     #[test]
     fn test_derive_key256() {
-        let key = derive_ecdsa_key(b"input key material", &[b"context one"], 256).unwrap();
+        let key = derive_key(b"input key material", &[b"context one"], 256).unwrap();
         assert_eq!(key.len(), 256);
         assert!(key.iter().any(|&x| x != 0));
     }
 
     #[test]
     fn test_derive_key_pair() {
         let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap();
-        let _derived_key = derive_ecdsa_key_pair(&key, &[b"context one"]).unwrap();
+        let _derived_key = derive_p256_key_pair(&key, &[b"context one"]).unwrap();
     }
 }