Introduce sign_with method in keystore

client/authority-discovery/src/error.rs

@@ -46,4 +46,8 @@ pub enum Error {
 	EncodingDecodingScale(codec::Error),
 	/// Failed to parse a libp2p multi address.
 	ParsingMultiaddress(libp2p::core::multiaddr::Error),
+	/// Failed to sign using a specific public key
+	MissingSignature(usize),
+	/// Failed to sign using all public keys
+	SigningFailed,
 }

client/authority-discovery/src/lib.rs

@@ -63,7 +63,7 @@ use sc_client_api::blockchain::HeaderBackend;
 use sc_network::specialization::NetworkSpecialization;
 use sc_network::{DhtEvent, ExHashT, NetworkStateInfo};
 use sp_authority_discovery::{AuthorityDiscoveryApi, AuthorityId, AuthoritySignature, AuthorityPair};
-use sp_core::crypto::{key_types, Pair};
+use sp_core::crypto::{key_types, CryptoTypePublicPair, Pair};
 use sp_core::traits::BareCryptoStorePtr;
 use sp_runtime::{traits::Block as BlockT, generic::BlockId};
 use sp_api::ProvideRuntimeApi;
@@ -211,19 +211,39 @@ where
 			.encode(&mut serialized_addresses)
 			.map_err(Error::EncodingProto)?;
 
-		for key in self.get_priv_keys_within_authority_set()?.into_iter() {
-			let signature = key.sign(&serialized_addresses);
+		let keys: Vec<CryptoTypePublicPair> = self.get_own_public_keys_within_authority_set()?
+			.into_iter()
+			.map(Into::into)
+			.collect();
 
+		let signatures = self.key_store
+			.read()
+			.sign_with_all(
+				key_types::AUTHORITY_DISCOVERY,
+				keys.clone(),
+				serialized_addresses.as_slice(),
+			)
+			.map_err(|_| Error::SigningFailed)?;
+
+		for (index, (sign_result, key)) in signatures.iter().zip(keys).enumerate() {
 			let mut signed_addresses = vec![];
+
+			// sign_with_all returns Option<Signature> where the signature
+			// is None for a public key that is not supported.
+			// Verify that all signatures exist for all provided keys.
+			if sign_result.is_err() {
+				return Err(Error::MissingSignature(index));
+			}
+			let signature = sign_result.as_ref().unwrap();
 			schema::SignedAuthorityAddresses {
 				addresses: serialized_addresses.clone(),
-				signature: signature.encode(),
+				signature: Encode::encode(&signature),
 			}
 			.encode(&mut signed_addresses)
 				.map_err(Error::EncodingProto)?;
 
 			self.network.put_value(
-				hash_authority_id(key.public().as_ref())?,
+				hash_authority_id(key.1.as_ref())?,
 				signed_addresses,
 			);
 		}
@@ -347,21 +367,6 @@ where
 		Ok(())
 	}
 
-	/// Retrieve all local authority discovery private keys that are within the current authority
-	/// set.
-	fn get_priv_keys_within_authority_set(&mut self) -> Result<Vec<AuthorityPair>> {
-		let keys = self.get_own_public_keys_within_authority_set()?
-			.into_iter()
-			.map(std::convert::Into::into)
-			.filter_map(|pub_key| {
-				self.key_store.read().sr25519_key_pair(key_types::AUTHORITY_DISCOVERY, &pub_key)
-			})
-			.map(std::convert::Into::into)
-			.collect();
-
-		Ok(keys)
-	}
-
 	/// Retrieve our public keys within the current authority set.
 	//
 	// A node might have multiple authority discovery keys within its keystore, e.g. an old one and

client/keystore/src/lib.rs

@@ -18,9 +18,10 @@
 
 #![warn(missing_docs)]
 
-use std::{collections::HashMap, path::PathBuf, fs::{self, File}, io::{self, Write}, sync::Arc};
+use std::{collections::{HashMap, HashSet}, path::PathBuf, fs::{self, File}, io::{self, Write}, sync::Arc};
 use sp_core::{
-	crypto::{KeyTypeId, Pair as PairT, Public, IsWrappedBy, Protected}, traits::BareCryptoStore,
+	crypto::{IsWrappedBy, CryptoTypePublicPair, KeyTypeId, Pair as PairT, Protected, Public},
+	traits::{BareCryptoStore, BareCryptoStoreError as TraitError}
 };
 use sp_application_crypto::{AppKey, AppPublic, AppPair, ed25519, sr25519};
 use parking_lot::RwLock;
@@ -44,6 +45,12 @@ pub enum Error {
 	/// Invalid seed
 	#[display(fmt="Invalid seed")]
 	InvalidSeed,
+	/// Public key type is not supported
+	#[display(fmt="Key crypto type is not supported")]
+	KeyNotSupported,
+	/// Pair not found for public key and KeyTypeId
+	#[display(fmt="Pair not found for {} public key", "_0")]
+	PairNotFound(String),
 	/// Keystore unavailable
 	#[display(fmt="Keystore unavailable")]
 	Unavailable,
@@ -52,6 +59,21 @@ pub enum Error {
 /// Keystore Result
 pub type Result<T> = std::result::Result<T, Error>;
 
+impl From<Error> for TraitError {
+	fn from(error: Error) -> Self {
+		match error {
+			Error::KeyNotSupported => TraitError::KeyNotSupported,
+			Error::PairNotFound(e) => TraitError::PairNotFound(e),
+			Error::InvalidSeed | Error::InvalidPhrase | Error::InvalidPassword => {
+				TraitError::ValidationError(error.to_string())
+			},
+			Error::Unavailable => TraitError::Unavailable,
+			Error::Io(e) => TraitError::Other(e.to_string()),
+			Error::Json(e) => TraitError::Other(e.to_string()),
+		}
+	}
+}
+
 impl std::error::Error for Error {
 	fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
 		match self {
@@ -276,8 +298,65 @@ impl Store {
 }
 
 impl BareCryptoStore for Store {
+	fn supported_keys(
+		&self,
+		id: KeyTypeId,
+		keys: Vec<CryptoTypePublicPair>
+	) -> std::result::Result<HashSet<CryptoTypePublicPair>, TraitError> {
+		let keys = keys.into_iter().collect::<HashSet<_>>();
+		let all_keys = self.keys(id)?;
+
+		Ok(keys.intersection(&all_keys).cloned().collect())
+	}
+
+	fn keys(&self, id: KeyTypeId) -> std::result::Result<HashSet<CryptoTypePublicPair>, TraitError> {
+		let ed25519_existing_keys = self
+			.public_keys_by_type::<ed25519::Public>(id)
+			.map_err(|e| TraitError::from(e))?
+			.into_iter()
+			.map(Into::into);
+
+		let sr25519_existing_keys = self
+			.public_keys_by_type::<sr25519::Public>(id)
+			.map_err(|e| TraitError::from(e))?
+			.into_iter()
+			.map(Into::into);
+
+		Ok(ed25519_existing_keys
+			.chain(sr25519_existing_keys)
+			.collect())
+	}
+
+	fn sign_with(
+		&self,
+		id: KeyTypeId,
+		key: &CryptoTypePublicPair,
+		msg: &[u8],
+	) -> std::result::Result<Vec<u8>, TraitError> {
+		match key.0 {
+			ed25519::CRYPTO_ID => {
+				let pub_key = ed25519::Public::from_slice(key.1.as_slice());
+				let key_pair: ed25519::Pair = self
+					.key_pair_by_type::<ed25519::Pair>(&pub_key, id)
+					.map(Into::into)
+					.map_err(|e| TraitError::from(e))?;
+				Ok(<[u8; 64]>::from(key_pair.sign(msg)).to_vec())
+			}
+			sr25519::CRYPTO_ID => {
+				let pub_key = sr25519::Public::from_slice(key.1.as_slice());
+				let key_pair: sr25519::Pair = self
+					.key_pair_by_type::<sr25519::Pair>(&pub_key, id)
+					.map(Into::into)
+					.map_err(|e| TraitError::from(e))?;
+				Ok(<[u8; 64]>::from(key_pair.sign(msg)).to_vec())
+			}
+			_ => Err(TraitError::KeyNotSupported)
+		}
+	}
+
 	fn sr25519_public_keys(&self, key_type: KeyTypeId) -> Vec<sr25519::Public> {
-		self.public_keys_by_type::<sr25519::Public>(key_type).unwrap_or_default()
+		self.public_keys_by_type::<sr25519::Public>(key_type)
+			.unwrap_or_default()
 	}
 
 	fn sr25519_generate_new(
@@ -293,10 +372,6 @@ impl BareCryptoStore for Store {
 		Ok(pair.public())
 	}
 
-	fn sr25519_key_pair(&self, id: KeyTypeId, pub_key: &sr25519::Public) -> Option<sr25519::Pair> {
-		self.key_pair_by_type::<sr25519::Pair>(pub_key, id).ok()
-	}
-
 	fn ed25519_public_keys(&self, key_type: KeyTypeId) -> Vec<ed25519::Public> {
 		self.public_keys_by_type::<ed25519::Public>(key_type).unwrap_or_default()
 	}
@@ -314,10 +389,6 @@ impl BareCryptoStore for Store {
 		Ok(pair.public())
 	}
 
-	fn ed25519_key_pair(&self, id: KeyTypeId, pub_key: &ed25519::Public) -> Option<ed25519::Pair> {
-		self.key_pair_by_type::<ed25519::Pair>(pub_key, id).ok()
-	}
-
 	fn insert_unknown(&mut self, key_type: KeyTypeId, suri: &str, public: &[u8])
 		-> std::result::Result<(), ()>
 	{

client/rpc/src/author/tests.rs

@@ -21,7 +21,7 @@ use assert_matches::assert_matches;
 use codec::Encode;
 use sp_core::{
 	H256, blake2_256, hexdisplay::HexDisplay, testing::{ED25519, SR25519, KeyStore},
-	traits::BareCryptoStorePtr, ed25519, crypto::{Pair, Public},
+	traits::BareCryptoStorePtr, ed25519, sr25519, crypto::{Pair, Public},
 };
 use rpc::futures::Stream as _;
 use substrate_test_runtime_client::{
@@ -215,10 +215,9 @@ fn should_insert_key() {
 		key_pair.public().0.to_vec().into(),
 	).expect("Insert key");
 
-	let store_key_pair = setup.keystore.read()
-		.ed25519_key_pair(ED25519, &key_pair.public()).expect("Key exists in store");
+	let public_keys = setup.keystore.read().keys(ED25519).unwrap();
 
-	assert_eq!(key_pair.public(), store_key_pair.public());
+	assert!(public_keys.contains(&(ed25519::CRYPTO_ID, key_pair.public().to_raw_vec())));
 }
 
 #[test]
@@ -231,18 +230,11 @@ fn should_rotate_keys() {
 	let session_keys = SessionKeys::decode(&mut &new_public_keys[..])
 		.expect("SessionKeys decode successfully");
 
-	let ed25519_key_pair = setup.keystore.read().ed25519_key_pair(
-		ED25519,
-		&session_keys.ed25519.clone().into(),
-	).expect("ed25519 key exists in store");
+	let ed25519_public_keys = setup.keystore.read().keys(ED25519).unwrap();
+	let sr25519_public_keys = setup.keystore.read().keys(SR25519).unwrap();
 
-	let sr25519_key_pair = setup.keystore.read().sr25519_key_pair(
-		SR25519,
-		&session_keys.sr25519.clone().into(),
-	).expect("sr25519 key exists in store");
-
-	assert_eq!(session_keys.ed25519, ed25519_key_pair.public().into());
-	assert_eq!(session_keys.sr25519, sr25519_key_pair.public().into());
+	assert!(ed25519_public_keys.contains(&(ed25519::CRYPTO_ID, session_keys.ed25519.to_raw_vec())));
+	assert!(sr25519_public_keys.contains(&(sr25519::CRYPTO_ID, session_keys.sr25519.to_raw_vec())));
 }
 
 #[test]

primitives/application-crypto/src/ed25519.rs

@@ -19,16 +19,35 @@
 use crate::{RuntimePublic, KeyTypeId};
 
 use sp_std::vec::Vec;
+use sp_core::crypto::CryptoTypeId;
 
 pub use sp_core::ed25519::*;
 
+/// An identifier used to match public keys against ed25519 keys
+pub const CRYPTO_ID: CryptoTypeId = CryptoTypeId(*b"ed25");
+
 mod app {
+    use sp_core::crypto::{CryptoTypePublicPair, Public as TraitPublic};
 	use sp_core::testing::ED25519;
+    use crate::ed25519::CRYPTO_ID;
+
 	crate::app_crypto!(super, ED25519);
 
 	impl crate::traits::BoundToRuntimeAppPublic for Public {
 		type Public = Self;
 	}
+
+    impl From<Public> for CryptoTypePublicPair {
+        fn from(key: Public) -> Self {
+            return key.into()
+        }
+    }
+
+    impl From<&Public> for CryptoTypePublicPair {
+        fn from(key: &Public) -> Self {
+            return (CRYPTO_ID, key.to_raw_vec())
+        }
+    }
 }
 
 pub use app::{Public as AppPublic, Signature as AppSignature};

primitives/application-crypto/src/lib.rs

@@ -21,11 +21,11 @@
 #![cfg_attr(not(feature = "std"), no_std)]
 
 #[doc(hidden)]
-pub use sp_core::{self, crypto::{CryptoType, Public, Derive, IsWrappedBy, Wraps}, RuntimeDebug};
+pub use sp_core::{self, crypto::{CryptoType, CryptoTypePublicPair, Public, Derive, IsWrappedBy, Wraps}, RuntimeDebug};
 #[doc(hidden)]
 #[cfg(feature = "full_crypto")]
 pub use sp_core::crypto::{SecretStringError, DeriveJunction, Ss58Codec, Pair};
-pub use sp_core::{crypto::{KeyTypeId, key_types}};
+pub use sp_core::crypto::{CryptoTypeId, KeyTypeId, key_types};
 
 #[doc(hidden)]
 pub use codec;

primitives/application-crypto/src/sr25519.rs

@@ -19,16 +19,35 @@
 use crate::{RuntimePublic, KeyTypeId};
 
 use sp_std::vec::Vec;
+use sp_core::crypto::CryptoTypeId;
 
 pub use sp_core::sr25519::*;
 
+/// An identifier used to match public keys against sr25519 keys
+pub const CRYPTO_ID: CryptoTypeId = CryptoTypeId(*b"sr25");
+
 mod app {
+    use sp_core::crypto::{CryptoTypePublicPair, Public as TraitPublic};
 	use sp_core::testing::SR25519;
+    use crate::sr25519::CRYPTO_ID;
+
 	crate::app_crypto!(super, SR25519);
 
 	impl crate::traits::BoundToRuntimeAppPublic for Public {
 		type Public = Self;
 	}
+
+    impl From<Public> for CryptoTypePublicPair {
+        fn from(key: Public) -> Self {
+            return key.into()
+        }
+    }
+
+    impl From<&Public> for CryptoTypePublicPair {
+        fn from(key: &Public) -> Self {
+            return (CRYPTO_ID, key.to_raw_vec())
+        }
+    }
 }
 
 pub use app::{Public as AppPublic, Signature as AppSignature};

primitives/application-crypto/test/src/ed25519.rs

@@ -17,7 +17,10 @@
 //! Integration tests for ed25519
 
 use sp_runtime::generic::BlockId;
-use sp_core::{testing::{KeyStore, ED25519}, crypto::Pair};
+use sp_core::{
+	crypto::Pair,
+	testing::{KeyStore, ED25519},
+};
 use substrate_test_runtime_client::{
 	TestClientBuilder, DefaultTestClientBuilderExt, TestClientBuilderExt,
 	runtime::TestAPI,
@@ -33,8 +36,7 @@ fn ed25519_works_in_runtime() {
 		.test_ed25519_crypto(&BlockId::Number(0))
 		.expect("Tests `ed25519` crypto.");
 
-	let key_pair = keystore.read().ed25519_key_pair(ED25519, &public.as_ref())
-		.expect("There should be at a `ed25519` key in the keystore for the given public key.");
-
-	assert!(AppPair::verify(&signature, "ed25519", &AppPublic::from(key_pair.public())));
+	let supported_keys = keystore.read().keys(ED25519).unwrap();
+	assert!(true, supported_keys.contains(&public.into()));
+	assert!(AppPair::verify(&signature, "ed25519", &AppPublic::from(public)));
 }

primitives/application-crypto/test/src/sr25519.rs

@@ -18,7 +18,10 @@
 
 
 use sp_runtime::generic::BlockId;
-use sp_core::{testing::{KeyStore, SR25519}, crypto::Pair};
+use sp_core::{
+	crypto::Pair,
+	testing::{KeyStore, SR25519},
+};
 use substrate_test_runtime_client::{
 	TestClientBuilder, DefaultTestClientBuilderExt, TestClientBuilderExt,
 	runtime::TestAPI,
@@ -34,8 +37,7 @@ fn sr25519_works_in_runtime() {
 		.test_sr25519_crypto(&BlockId::Number(0))
 		.expect("Tests `sr25519` crypto.");
 
-	let key_pair = keystore.read().sr25519_key_pair(SR25519, public.as_ref())
-		.expect("There should be at a `sr25519` key in the keystore for the given public key.");
-
-	assert!(AppPair::verify(&signature, "sr25519", &AppPublic::from(key_pair.public())));
+	let supported_keys = keystore.read().keys(SR25519).unwrap();
+	assert!(true, supported_keys.contains(&public.into()));
+	assert!(AppPair::verify(&signature, "sr25519", &AppPublic::from(public)));
 }