tka,types/key: remove dependency for tailcfg & types/ packages on tka

Following the pattern elsewhere, we create a new tka-specific types package for the types
that need to couple between the serialized structure types, and tka.

Signed-off-by: Tom DNetto <tom@tailscale.com>

types/key/nl.go

@@ -9,8 +9,8 @@ import (
 	"crypto/subtle"
 
 	"go4.org/mem"
-	"tailscale.com/tka"
 	"tailscale.com/types/structs"
+	"tailscale.com/types/tkatype"
 )
 
 const (
@@ -68,23 +68,26 @@ func (k NLPrivate) Public() NLPublic {
 }
 
 // KeyID returns an identifier for this key.
-func (k NLPrivate) KeyID() tka.KeyID {
-	pub := k.Public()
-	return tka.Key{
-		Kind:   tka.Key25519,
-		Public: pub.k[:],
-	}.ID()
+func (k NLPrivate) KeyID() tkatype.KeyID {
+	// The correct way to compute this is:
+	// return tka.Key{
+	// 	Kind:   tka.Key25519,
+	// 	Public: pub.k[:],
+	// }.ID()
+	//
+	// However, under the hood the key id for a 25519
+	// key is just the public key, so we avoid the
+	// dependency on tka by just doing this ourselves.
+	pub := k.Public().k
+	return pub[:]
 }
 
 // SignAUM implements tka.UpdateSigner.
-func (k NLPrivate) SignAUM(a *tka.AUM) error {
-	sigHash := a.SigHash()
-
-	a.Signatures = append(a.Signatures, tka.Signature{
+func (k NLPrivate) SignAUM(sigHash tkatype.AUMSigHash) ([]tkatype.Signature, error) {
+	return []tkatype.Signature{{
 		KeyID:     k.KeyID(),
-		Signature: ed25519.Sign(k.k[:], sigHash[:]),
-	})
-	return nil
+		Signature: ed25519.Sign(ed25519.PrivateKey(k.k[:]), sigHash[:]),
+	}}, nil
 }
 
 // NLPublic is the public portion of a a NLPrivate.

types/key/nl_test.go

@@ -6,6 +6,7 @@ package key
 
 import (
 	"bytes"
+	"crypto/ed25519"
 	"testing"
 
 	"tailscale.com/tka"
@@ -55,7 +56,14 @@ func TestNLPrivate(t *testing.T) {
 	if got, want := len(aum.Signatures), 1; got != want {
 		t.Fatalf("len(signatures) = %d, want %d", got, want)
 	}
-	if err := aum.Signatures[0].Verify(aum.SigHash(), k); err != nil {
-		t.Errorf("signature did not verify: %v", err)
+	sigHash := aum.SigHash()
+	if ok := ed25519.Verify(pub.Verifier(), sigHash[:], aum.Signatures[0].Signature); !ok {
+		t.Error("signature did not verify")
+	}
+
+	// We manually compute the keyID, so make sure its consistent with
+	// tka.Key.ID().
+	if !bytes.Equal(k.ID(), p.KeyID()) {
+		t.Errorf("private.KeyID() & tka KeyID differ: %x != %x", k.ID(), p.KeyID())
 	}
 }

types/tkatype/tkatype.go

@@ -0,0 +1,34 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package tkatype defines types for working with the tka package.
+//
+// Do not add extra dependencies to this package unless they are tiny,
+// because this package encodes wire types that should be lightweight to use.
+package tkatype
+
+// KeyID references a verification key stored in the key authority. A keyID
+// uniquely identifies a key. KeyIDs are all 32 bytes.
+//
+// For 25519 keys: We just use the 32-byte public key.
+//
+// Even though this is a 32-byte value, we use a byte slice because
+// CBOR-encoded byte slices have a different prefix to CBOR-encoded arrays.
+// Encoding as a byte slice allows us to change the size in the future if we
+// ever need to.
+type KeyID []byte
+
+// MarshaledSignature represents a marshaled tka.NodeKeySignature.
+type MarshaledSignature []byte
+
+// AUMSigHash represents the BLAKE2s digest of an Authority Update
+// Message (AUM), sans any signatures.
+type AUMSigHash [32]byte
+
+// Signature describes a signature over an AUM, which can be verified
+// using the key referenced by KeyID.
+type Signature struct {
+	KeyID     KeyID  `cbor:"1,keyasint"`
+	Signature []byte `cbor:"2,keyasint"`
+}

types/tkatype/tkatype_test.go

@@ -0,0 +1,17 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tkatype
+
+import (
+	"golang.org/x/crypto/blake2s"
+	"testing"
+)
+
+func TestSigHashSize(t *testing.T) {
+	var sigHash AUMSigHash
+	if len(sigHash) != blake2s.Size {
+		t.Errorf("AUMSigHash is wrong size: got %d, want %d", len(sigHash), blake2s.Size)
+	}
+}