Attestation service pepper verification

dependency-graph.json

@@ -7,8 +7,9 @@
     "location": "packages/attestation-service",
     "dependencies": [
       "@celo/contractkit",
+      "@celo/identity",
       "@celo/keystores",
-      "@celo/utils"
+      "@celo/phone-utils"
     ]
   },
   "celo-azure-build": {
@@ -58,6 +59,7 @@
       "@celo/connect",
       "@celo/contractkit",
       "@celo/identity",
+      "@celo/phone-utils",
       "@celo/utils"
     ]
   },

dockerfiles/attestation-service/Dockerfile

@@ -21,6 +21,9 @@ COPY packages/sdk/contractkit/package.json packages/sdk/contractkit/
 COPY packages/sdk/keystores/package.json packages/sdk/keystores/
 COPY packages/attestation-service/package.json packages/attestation-service/
 COPY packages/flake-tracker/package.json packages/flake-tracker/package.json
+COPY packages/sdk/identity/package.json packages/sdk/identity/
+COPY packages/sdk/phone-utils/package.json packages/sdk/phone-utils/package.json
+COPY packages/phone-number-privacy/common/package.json packages/phone-number-privacy/common/
 
 RUN yarn install --frozen-lockfile --network-timeout 100000 && yarn cache clean
 
@@ -37,6 +40,9 @@ COPY packages/sdk/contractkit packages/sdk/contractkit/
 COPY packages/sdk/keystores packages/sdk/keystores/
 COPY packages/attestation-service packages/attestation-service/
 COPY packages/flake-tracker packages/flake-tracker
+COPY packages/sdk/identity packages/sdk/identity
+COPY packages/sdk/phone-utils packages/sdk/phone-utils/
+COPY packages/phone-number-privacy/common packages/phone-number-privacy/common
 
 ENV NODE_ENV production
 

dockerfiles/celotool/Dockerfile

@@ -33,6 +33,7 @@ COPY packages/sdk/wallets/wallet-local/package.json packages/sdk/wallets/wallet-
 COPY packages/typescript/package.json packages/typescript/
 COPY patches/ patches/
 COPY scripts/ scripts/
+COPY packages/sdk/phone-utils/package.json packages/sdk/phone-utils/package.json
 
 RUN yarn install --network-timeout 100000 --frozen-lockfile && yarn cache clean
 
@@ -54,6 +55,7 @@ COPY packages/sdk/utils packages/sdk/utils/
 COPY packages/sdk/wallets/wallet-base packages/sdk/wallets/wallet-base/
 COPY packages/sdk/wallets/wallet-local packages/sdk/wallets/wallet-local/
 COPY packages/typescript packages/typescript/
+COPY packages/sdk/phone-utils packages/sdk/phone-utils/
 
 RUN yarn build
 

packages/attestation-service/config/.env.development

@@ -89,3 +89,6 @@ APP_SIGNATURE=x
 
 # Phone number (prefixed with "+") for test-send-sms-twilio script
 # TEST_SMS_RECIPIENT=x
+
+# mainnet, alfajores, or alfajoresstaging, default is mainnet
+# NETWORK=x

packages/attestation-service/package.json

@@ -30,8 +30,9 @@
   },
   "dependencies": {
     "@celo/contractkit": "1.5.3-dev",
+    "@celo/identity": "1.5.3-dev",
     "@celo/keystores": "1.5.3-dev",
-    "@celo/utils": "1.5.3-dev",
+    "@celo/phone-utils": "1.5.3-dev",
     "bignumber.js": "^9.0.0",
     "body-parser": "1.19.0",
     "bunyan": "1.8.12",

packages/attestation-service/src/index.ts

@@ -2,7 +2,7 @@ import {
   AttestationRequestType,
   AttestationServiceTestRequestType,
   GetAttestationRequestType,
-} from '@celo/utils/lib/io'
+} from '@celo/phone-utils/lib/io'
 import express from 'express'
 import rateLimit from 'express-rate-limit'
 import requestIdMiddleware from 'express-request-id'

packages/attestation-service/src/metrics.ts

@@ -70,6 +70,10 @@ export const Counters = {
     labelNames: ['country', 'type'],
     help: 'Counter for requests by country and type of phone number',
   }),
+  attestationRequestsDidNotProvideSignature: new Counter({
+    name: 'attestation_requests_did_not_provide_signature',
+    help: 'Counter for the number of requests which did not provide a phone number signature',
+  }),
 }
 
 export const Gauges = {

packages/attestation-service/src/requestHandlers/attestation.ts

@@ -1,13 +1,20 @@
 import { AttestationState } from '@celo/contractkit/lib/wrappers/Attestations'
+import { OdisUtils } from '@celo/identity'
+import { getPepperFromThresholdSignature } from '@celo/identity/lib/odis/phone-number-identifier'
+import { AttestationRequest } from '@celo/phone-utils/lib/io'
 import { AttestationUtils, PhoneNumberUtils } from '@celo/utils'
 import { eqAddress } from '@celo/utils/lib/address'
 import { sleep } from '@celo/utils/lib/async'
-import { AttestationRequest } from '@celo/utils/lib/io'
 import Logger from 'bunyan'
 import { randomBytes } from 'crypto'
 import express from 'express'
 import { findAttestationByKey, makeSequelizeLogger, SequelizeLogger, useKit } from '../db'
-import { getAccountAddress, getAttestationSignerAddress, isDevMode } from '../env'
+import {
+  fetchEnvOrDefault,
+  getAccountAddress,
+  getAttestationSignerAddress,
+  isDevMode,
+} from '../env'
 import { Counters } from '../metrics'
 import { AttestationKey, AttestationModel } from '../models/attestation'
 import { ErrorWithResponse, respondWithAttestation, respondWithError, Response } from '../request'
@@ -16,6 +23,11 @@ import { obfuscateNumber } from '../sms/base'
 
 const ATTESTATION_ERROR = 'Valid attestation could not be provided'
 const NO_INCOMPLETE_ATTESTATION_FOUND_ERROR = 'No incomplete attestation found'
+export const INVALID_SIGNATURE_ERROR = 'Signature is invalid'
+
+const odisPubKey = OdisUtils.Query.getServiceContext(fetchEnvOrDefault('NETWORK', 'mainnet'))
+  .odisPubKey
+const thresholdBls = require('blind-threshold-bls')
 
 function toBase64(str: string) {
   return Buffer.from(str.slice(2), 'hex').toString('base64')
@@ -78,6 +90,8 @@ class AttestationRequestHandler {
       logging: this.sequelizeLogger,
     })
 
+    await this.verifyPepperIfApplicable()
+
     // Re-requests for existing attestations skip the on-chain check.
     if (attestation) {
       Counters.attestationRequestsRerequest.inc()
@@ -221,6 +235,31 @@ class AttestationRequestHandler {
 
     return attestation
   }
+
+  private async verifyPepperIfApplicable(): Promise<void> {
+    if (this.attestationRequest.phoneNumberSignature && this.attestationRequest.salt) {
+      const sigBuf = Buffer.from(this.attestationRequest.phoneNumberSignature, 'base64')
+
+      try {
+        await thresholdBls.verify(
+          Buffer.from(odisPubKey, 'base64'),
+          Buffer.from(this.attestationRequest.phoneNumber, 'base64'),
+          sigBuf
+        )
+
+        const pepper = getPepperFromThresholdSignature(sigBuf)
+        if (pepper !== this.attestationRequest.salt) {
+          this.logger.error('Pepper is invalid')
+          // temporarily only silently fail, so as not to block users
+          // throw new ErrorWithResponse('Pepper is invalid', 422)
+        }
+      } catch (e) {
+        this.logger.error('Cannot get phone number from signature', e)
+        throw new ErrorWithResponse(INVALID_SIGNATURE_ERROR, 422)
+      }
+    }
+    Counters.attestationRequestsDidNotProvideSignature.inc()
+  }
 }
 
 export async function handleAttestationRequest(

packages/attestation-service/test/requestHandlers/attestation.test.ts

@@ -1,22 +1,38 @@
-import { handleAttestationRequest } from '../../src/requestHandlers/attestation'
-import { anyNumber, capture, instance, mock, reset, verify, when } from 'ts-mockito'
-import { Response } from '../../src/request'
-import { Request } from 'express'
 import * as Logger from 'bunyan'
-import { isValidAddress, toChecksumAddress } from 'ethereumjs-util'
+import { Request } from 'express'
+import { anyNumber, capture, instance, mock, reset, verify, when } from 'ts-mockito'
 import { findAttestationByKey } from '../../src/db'
+import { Response } from '../../src/request'
+import {
+  handleAttestationRequest,
+  INVALID_SIGNATURE_ERROR,
+} from '../../src/requestHandlers/attestation'
 import { rerequestAttestation } from '../../src/sms'
 
-jest.mock('ethereumjs-util')
-const isValidAddressMock = isValidAddress as jest.Mock
-const toChecksumAddressMock = toChecksumAddress as jest.Mock
+import ethereumJsUtil = require('ethereumjs-util')
+const isValidAddressMock = jest.spyOn(ethereumJsUtil, 'isValidAddress')
+const toChecksumAddressMock = jest.spyOn(ethereumJsUtil, 'toChecksumAddress')
 
 jest.mock('../../src/db')
 const findAttestationByKeyMock = findAttestationByKey as jest.Mock
 
 jest.mock('../../src/sms')
 const rerequestAttestationMock = rerequestAttestation as jest.Mock
 
+jest.mock('@celo/identity', () => {
+  const OdisUtils = {
+    Query: {
+      getServiceContext: () => {
+        return {
+          odisPubKey:
+            'ru+9GmEsBi+/SHtNc4lBwR+evpvcVLcmVDYhzyveWXVwaN7EdUGF+GgUvOMMqpUAaxQl+4DkgtbTP4CIFFAUyGnZF0nRLqo64PVSv/mrGrTet0ej5cJeS1Fla+n8o5sB',
+        }
+      },
+    },
+  }
+  return { OdisUtils }
+})
+
 describe('Attestation request handler', () => {
   const requestMock = mock<Request>()
   const responseMock = mock<Response>()
@@ -59,6 +75,7 @@ describe('Attestation request handler', () => {
         salt: 'salt',
         securityCodePrefix: 'p',
         smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: undefined,
       })
 
       expect(findAttestationByKeyMock).toBeCalledTimes(1)
@@ -81,6 +98,7 @@ describe('Attestation request handler', () => {
         salt: 'salt',
         securityCodePrefix: '',
         smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: undefined,
       })
 
       expect(findAttestationByKeyMock).toBeCalledTimes(0)
@@ -106,6 +124,7 @@ describe('Attestation request handler', () => {
         salt: 'salt',
         securityCodePrefix: 'p',
         smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: undefined,
       })
 
       expect(findAttestationByKeyMock).toBeCalledTimes(0)
@@ -116,31 +135,60 @@ describe('Attestation request handler', () => {
       expect(body['error']).toEqual(`Mismatching issuer, I am ${address}`)
     })
 
-    // it("Should fail with 422 code when pepper didn't origin in odis", async () => {
-    //   const address = '0x2F015C60E0be116B1f0CD534704Db9c92118FB6A';
-    //   isValidAddressMock.mockReturnValue(true);
-    //   toChecksumAddressMock.mockReturnValue(address);
-    //   findAttestationByKeyMock.mockResolvedValue(null);
-    //   const responseMockInstance = instance(responseMock);
-    //   when(responseMock.status(anyNumber())).thenReturn(responseMockInstance);
-    //
-    //   await handleAttestationRequest(instance(requestMock), responseMockInstance, {
-    //     phoneNumber: '+14155550000',
-    //     language: 'en',
-    //     account: 'account',
-    //     issuer: address,
-    //     salt: 'salt',
-    //     securityCodePrefix: 'p',
-    //     smsRetrieverAppSig: 'sig'
-    //   });
-    //
-    //   expect(findAttestationByKeyMock).toBeCalledTimes(1);
-    //   expect(rerequestAttestationMock).toBeCalledTimes(0);
-    //   verify(responseMock.status(422)).once();
-    //   const [body] = capture(responseMock.json).last();
-    //   expect(body['success']).toBeFalsy();
-    //   expect(body['error']).toEqual(`Mismatching issuer, I am ${address}`);
-    // })
+    it('Should fail with 422 code with wrong signature', async () => {
+      const address = '0x2F015C60E0be116B1f0CD534704Db9c92118FB6A'
+      isValidAddressMock.mockReturnValue(true)
+      toChecksumAddressMock.mockReturnValue(address)
+      findAttestationByKeyMock.mockResolvedValue(null)
+      const responseMockInstance = instance(responseMock)
+      when(responseMock.status(anyNumber())).thenReturn(responseMockInstance)
+
+      await handleAttestationRequest(instance(requestMock), responseMockInstance, {
+        phoneNumber: '+14155550000',
+        language: 'en',
+        account: 'account',
+        issuer: address,
+        salt: 'salt',
+        securityCodePrefix: 'p',
+        smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: 'wrongSignature',
+      })
+
+      expect(findAttestationByKeyMock).toBeCalledTimes(1)
+      expect(rerequestAttestationMock).toBeCalledTimes(0)
+      verify(responseMock.status(422)).once()
+      const [body] = capture(responseMock.json).last()
+      expect(body['success']).toBeFalsy()
+      expect(body['error']).toEqual(INVALID_SIGNATURE_ERROR)
+    })
+
+    it('Should verify correctly blinded signature and return attestation', async () => {
+      const address = '0x2F015C60E0be116B1f0CD534704Db9c92118FB6A'
+      isValidAddressMock.mockReturnValue(true)
+      toChecksumAddressMock.mockReturnValue(address)
+      const sampleAttestation = {
+        message: 'message',
+        failure: () => false,
+      }
+      findAttestationByKeyMock.mockResolvedValue(sampleAttestation)
+      rerequestAttestationMock.mockResolvedValue(sampleAttestation)
+      when(responseMock.status(anyNumber())).thenReturn(responseMock)
+
+      await handleAttestationRequest(instance(requestMock), instance(responseMock), {
+        phoneNumber: '+14155550000',
+        language: 'en',
+        account: 'account',
+        issuer: address,
+        salt: '4EcPvcixnoe/N',
+        securityCodePrefix: 'p',
+        smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: 'xNOQZWEa6JIyuAhGf9H0Evjx60BB8PQ6E9498CTLod2PhYRypKMdwGVDtLNkptAA',
+      })
+
+      expect(findAttestationByKeyMock).toBeCalledTimes(1)
+      expect(rerequestAttestationMock).toBeCalledTimes(1)
+      verify(responseMock.status(200)).once()
+    })
 
     it('Should fail with 500 code when validator address is invalid', async () => {
       const address = '0x2F015C60E0be116B1f0CD534704Db9c92118FB6A'
@@ -157,6 +205,7 @@ describe('Attestation request handler', () => {
         salt: 'salt',
         securityCodePrefix: 'p',
         smsRetrieverAppSig: 'sig',
+        phoneNumberSignature: undefined,
       })
 
       expect(findAttestationByKeyMock).toBeCalledTimes(0)

packages/attestation-service/test/testSetup.ts

@@ -1,6 +1,7 @@
 module.exports = () => {
-  process.env.ODIS_PUBLIC_KEY = 'key'
+  process.env.NETWORK = 'mainnet'
   process.env.ATTESTATION_SIGNER_ADDRESS = 'signerAddress'
-  process.env.CELO_VALIDATOR_ADDRESS = 'address'
+  process.env.CELO_VALIDATOR_ADDRESS = '0x2F015C60E0be116B1f0CD534704Db9c92118FB6A'
   process.env.CELO_PROVIDERS = 'provider'
+  process.env.NODE_ENV = 'dev'
 }

packages/celotool/README.md

@@ -94,5 +94,5 @@ a few useful commands to make running a node really easy.
 
 #### MacOS Setup
 
-- Install Helm 3.X (available on Homebrew)
+- Install Helm 3.4 or higher (available on Homebrew)
   To get past the Unidentified Developer error: open the directory containing helm, then ctrl-click helm and select Open then Open again. Repeat for tiller.

packages/env-tests/package.json

@@ -10,6 +10,7 @@
     "@celo/base": "1.5.3-dev",
     "@celo/connect": "1.5.3-dev",
     "@celo/identity": "1.5.3-dev",
+    "@celo/phone-utils": "1.5.3-dev",
     "bunyan": "1.8.12",
     "bunyan-gke-stackdriver": "0.1.2",
     "bunyan-debug-stream": "2.0.0",

packages/env-tests/src/shared/attestation.ts

@@ -8,9 +8,9 @@ import {
 } from '@celo/contractkit/lib/wrappers/Attestations'
 import { OdisUtils } from '@celo/identity'
 import { AuthSigner } from '@celo/identity/lib/odis/query'
+import { AttestationRequest } from '@celo/phone-utils/lib/io'
 import { AttestationUtils, PhoneNumberUtils } from '@celo/utils'
 import { concurrentMap, sleep } from '@celo/utils/lib/async'
-import { AttestationRequest } from '@celo/utils/lib/io'
 import Logger from 'bunyan'
 import { sample } from 'lodash'
 import moment from 'moment'
@@ -41,6 +41,7 @@ export async function requestAttestationsFromIssuers(
         smsRetrieverAppSig: undefined,
         securityCodePrefix: securityCode ? getSecurityCodePrefix(attestation.issuer) : undefined,
         language: undefined,
+        phoneNumberSignature: undefined,
       }
 
       const response = await attestations.revealPhoneNumberToIssuer(

packages/helm-charts/attestation-service/templates/attestation.statefulset.yaml

@@ -135,6 +135,8 @@ spec:
           value: /root/.celo
         - name: LOG_FORMAT
           value: stackdriver
+        - name: NETWORK
+          value: alfajores
         - name: NEXMO_KEY
           valueFrom:
             secretKeyRef:

packages/sdk/phone-utils/src/io.ts

@@ -51,6 +51,8 @@ export const AttestationRequestType = t.type({
   // if specified, the message sent will be short random number prefixed by this string
   securityCodePrefix: t.union([t.undefined, t.string]),
   language: t.union([t.undefined, t.string]),
+  // unblinded signature
+  phoneNumberSignature: t.union([t.undefined, t.string]),
 })
 
 export type AttestationRequest = t.TypeOf<typeof AttestationRequestType>