2 files changed, 66 insertions, 0 deletions

diff --git a/src/cadet/gnunet-service-cadet_peer.c b/src/cadet/gnunet-service-cadet_peer.c
index 19c6c99bf..1948c1ed9 100644
--- a/src/cadet/gnunet-service-cadet_peer.c
+++ b/src/cadet/gnunet-service-cadet_peer.c
@@ -22,6 +22,8 @@
 #include "platform.h"
 #include "gnunet_util_lib.h"
 
+#include "gnunet_signatures.h"
+
 #include "gnunet_transport_service.h"
 #include "gnunet_core_service.h"
 #include "gnunet_statistics_service.h"
@@ -124,6 +126,11 @@ struct CadetPeer
   GNUNET_PEER_Id id;
 
     /**
+     * Axolotl permanent public key.
+     */
+  struct GNUNET_CRYPTO_EcdhePublicKey ax_key;
+
+    /**
      * Last time we heard from this peer
      */
   struct GNUNET_TIME_Absolute last_contact;
@@ -2366,6 +2373,46 @@ GCP_try_connect (struct CadetPeer *peer)
 
 
 /**
+ * Check if the given ECDH key is correct for the peer.
+ *
+ * This function caches the results if the key has been previoulsy checked,
+ * otherwise checks that the key is signed with the peer's ID (EdDSA key).
+ *
+ * TODO: save the cached public key to permanent storage / peerinfo.
+ *
+ * @param peer Peer whose key to check.
+ * @param key ECDH key to check.
+ * @param purpose Purpose of the signature (followed by the key).
+ * @param sig Signature with the peer's EdDSA key (PeerID).
+ */
+int
+GCP_check_key (struct CadetPeer *peer,
+               const struct GNUNET_CRYPTO_EcdhePublicKey *key,
+               const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+               const struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct GNUNET_CRYPTO_EddsaPublicKey *pub;
+  int verified;
+
+  /* Is it the same as the cached key? */
+  if (0 == memcmp (&peer->ax_key, key, sizeof (*key)))
+    return GNUNET_OK;
+
+  /* New key, verify. */
+  pub = (struct GNUNET_CRYPTO_EddsaPublicKey *) GCP_get_id (peer);
+  verified = GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_CADET_AXKX,
+                                         purpose, sig, pub);
+
+  if (GNUNET_OK != verified)
+    return GNUNET_SYSERR;
+
+  /* Cache key for later. */
+  peer->ax_key = *key;
+  return GNUNET_OK;
+}
+
+
+/**
  * Notify a peer that a link between two other peers is broken. If any path
  * used that link, eliminate it.
  *
diff --git a/src/cadet/gnunet-service-cadet_peer.h b/src/cadet/gnunet-service-cadet_peer.h
index a0211328b..53a26b2e9 100644
--- a/src/cadet/gnunet-service-cadet_peer.h
+++ b/src/cadet/gnunet-service-cadet_peer.h
@@ -390,6 +390,25 @@ void
 GCP_try_connect (struct CadetPeer *peer);
 
 /**
+ * Check if the given ECDH key is correct for the peer.
+ *
+ * This function caches the results if the key has been previoulsy checked,
+ * otherwise checks that the key is signed with the peer's ID (EdDSA key).
+ *
+ * TODO: save the cached public key to permanent storage / peerinfo.
+ *
+ * @param peer Peer whose key to check.
+ * @param key ECDH key to check.
+ * @param purpose Purpose of the signature (followed by the key).
+ * @param sig Signature with the peer's EdDSA key (PeerID).
+ */
+int
+GCP_check_key (struct CadetPeer *peer,
+               const struct GNUNET_CRYPTO_EcdhePublicKey *key,
+               const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+               const struct GNUNET_CRYPTO_EddsaSignature *sig);
+
+/**
  * Notify a peer that a link between two other peers is broken. If any path
  * used that link, eliminate it.
  *