feature/1121 implement ucan validation (#1176)

- **refactor: remove unused auth components**
- **refactor: improve devbox configuration and deployment process**
- **refactor: improve devnet and testnet setup**
- **fix: update templ version to v0.2.778**
- **refactor: rename pkl/net.matrix to pkl/matrix.net**
- **refactor: migrate webapp components to nebula**
- **refactor: protobuf types**
- **chore: update dependencies for improved security and stability**
- **feat: implement landing page and vault gateway servers**
- **refactor: Migrate data models to new module structure and update
related files**
- **feature/1121-implement-ucan-validation**
- **refactor: Replace hardcoded constants with model types in attns.go**
- **feature/1121-implement-ucan-validation**
- **chore: add origin Host struct and update main function to handle
multiple hosts**
- **build: remove unused static files from dwn module**
- **build: remove unused static files from dwn module**
- **refactor: Move DWN models to common package**
- **refactor: move models to pkg/common**
- **refactor: move vault web app assets to embed module**
- **refactor: update session middleware import path**
- **chore: configure port labels and auto-forwarding behavior**
- **feat: enhance devcontainer configuration**
- **feat: Add UCAN middleware for Echo with flexible token validation**
- **feat: add JWT middleware for UCAN authentication**
- **refactor: update package URI and versioning in PklProject files**
- **fix: correct sonr.pkl import path**
- **refactor: move JWT related code to auth package**
- **feat: introduce vault configuration retrieval and management**
- **refactor: Move vault components to gateway module and update file
paths**
- **refactor: remove Dexie and SQLite database implementations**
- **feat: enhance frontend with PWA features and WASM integration**
- **feat: add Devbox features and streamline Dockerfile**
- **chore: update dependencies to include TigerBeetle**
- **chore(deps): update go version to 1.23**
- **feat: enhance devnet setup with PATH environment variable and
updated PWA manifest**
- **fix: upgrade tigerbeetle-go dependency and remove indirect
dependency**
- **feat: add PostgreSQL support to devnet and testnet deployments**
- **refactor: rename keyshare cookie to token cookie**
- **feat: upgrade Go version to 1.23.3 and update dependencies**
- **refactor: update devnet and testnet configurations**
- **feat: add IPFS configuration for devnet**
- **I'll help you update the ipfs.config.pkl to include all the peers
from the shell script. Here's the updated configuration:**
- **refactor: move mpc package to crypto directory**
- **feat: add BIP32 support for various cryptocurrencies**
- **feat: enhance ATN.pkl with additional capabilities**
- **refactor: simplify smart account and vault attenuation creation**
- **feat: add new capabilities to the Attenuation type**
- **refactor: Rename MPC files for clarity and consistency**
- **feat: add DIDKey support for cryptographic operations**
- **feat: add devnet and testnet deployment configurations**
- **fix: correct key derivation in bip32 package**
- **refactor: rename crypto/bip32 package to crypto/accaddr**
- **fix: remove duplicate indirect dependency**
- **refactor: move vault package to root directory**
- **refactor: update routes for gateway and vault**
- **refactor: remove obsolete web configuration file**
- **refactor: remove unused TigerBeetle imports and update host
configuration**
- **refactor: adjust styles directory path**
- **feat: add broadcastTx and simulateTx functions to gateway**
- **feat: add PinVault handler**

crypto/core/commit.go

@@ -0,0 +1,115 @@
+//
+// Copyright Coinbase, Inc. All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+package core
+
+import (
+	"crypto/hmac"
+	crand "crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"hash"
+)
+
+// Size of random values and hash outputs are determined by our hash function
+const Size = sha256.Size
+
+type (
+	// Commitment to a given message which can be later revealed.
+	// This is sent to and held by a verifier until the corresponding
+	// witness is provided.
+	Commitment []byte
+
+	// Witness is sent to and opened by the verifier. This proves that
+	// committed message hasn't been altered by later information.
+	Witness struct {
+		Msg []byte
+		r   [Size]byte
+	}
+
+	// witnessJSON is used for un/marshaling.
+	witnessJSON struct {
+		Msg []byte
+		R   [Size]byte
+	}
+)
+
+// MarshalJSON encodes Witness in JSON
+func (w Witness) MarshalJSON() ([]byte, error) {
+	return json.Marshal(witnessJSON{w.Msg, w.r})
+}
+
+// UnmarshalJSON decodes JSON into a Witness struct
+func (w *Witness) UnmarshalJSON(data []byte) error {
+	witness := &witnessJSON{}
+	err := json.Unmarshal(data, witness)
+	if err != nil {
+		return err
+	}
+	w.Msg = witness.Msg
+	w.r = witness.R
+	return nil
+}
+
+// Commit to a given message. Uses SHA256 as the hash function.
+func Commit(msg []byte) (Commitment, *Witness, error) {
+	// Initialize our decommitment
+	d := Witness{msg, [Size]byte{}}
+
+	// Generate a random nonce of the required length
+	n, err := crand.Read(d.r[:])
+	// Ensure no errors retrieving nonce
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Ensure we read all the bytes expected
+	if n != Size {
+		return nil, nil, fmt.Errorf("failed to read %v bytes from crypto/rand: received %v bytes", Size, n)
+	}
+	// Compute the commitment: HMAC(Sha2, msg, key)
+	c, err := ComputeHMAC(sha256.New, msg, d.r[:])
+	if err != nil {
+		return nil, nil, err
+	}
+	return c, &d, nil
+}
+
+// Open a commitment and return true if the commitment/decommitment pair are valid.
+// reference: spec.§2.4: Commitment Scheme
+func Open(c Commitment, d Witness) (bool, error) {
+	// Ensure commitment is well-formed.
+	if len(c) != Size {
+		return false, fmt.Errorf("invalid commitment, wrong length. %v != %v", len(c), Size)
+	}
+
+	// Re-compute the commitment: HMAC(Sha2, msg, key)
+	cʹ, err := ComputeHMAC(sha256.New, d.Msg, d.r[:])
+	if err != nil {
+		return false, err
+	}
+	return subtle.ConstantTimeCompare(cʹ, c) == 1, nil
+}
+
+// ComputeHMAC computes HMAC(hash_fn, msg, key)
+// Takes in a hash function to use for HMAC
+func ComputeHMAC(f func() hash.Hash, msg []byte, k []byte) ([]byte, error) {
+	if f == nil {
+		return nil, fmt.Errorf("hash function cannot be nil")
+	}
+
+	mac := hmac.New(f, k)
+	w, err := mac.Write(msg)
+
+	if w != len(msg) {
+		return nil, fmt.Errorf("bytes written to hash doesn't match expected: %v != %v", w, len(msg))
+	} else if err != nil {
+		return nil, err
+	}
+	return mac.Sum(nil), nil
+}