crumbl-signer

Easy signer server for the Crumbl™ platform

This application is an easy signer server for the Crumbl™ platform patented by Cyril Dever.

Usage

1. Either you have set your own MongoDB environment compatible with the crumbl-signer's requirements:

   npm i crumbl-signer && npm run compile && npm start

2. Or you start the Docker container:

   git clone https://github.com/cyrildever/crumbl-signer.git && cd crumbl-signer && docker-compose up --build -d

   You might want to use the ./cleanup script (or ./cleanup.bat on Windows) before launching any new Docker session (especially when you've built the NPM project).

Running the application will write a 'crumbl-signer.log' file in the main folder.

Production

Change or adapt the following environment variables every time you launch a new session if need be:

• HTTP_PORT: the listening HTTP port number (default: 4000);
• MONGO_DOMAIN: the MongoDB domain (default: localhost);
• MONGO_PORT: the MongoDB port number (default: 27017);
• MONGO_DB: the name of the MongoDB database (default: crumbl);
• MONGO_USERNAME: the username to access the MongoDB database;
• MONGO_PASSWORD: the user password for the MongoDB database;
• MONGO_COLLECTION: the name of the collection to use (default: signer);
• SESSION_SEED: the hexadecimal string representation of the initial seed.

To generate a new seed for a session, you might want to use the following snippet:

import { generateNewSessionSeedPath } from 'crumbl-signer'

const seedPath = generateNewSessionSeedPath()
const sessionSeed = seedPath.seed
console.log(sessionSeed)

NB: Beware that modifying the seed will reset the path leant to it.

API

The following endpoints are available:

• GET /lastPubKey

This endpoint generates the request ID and the signer's last public key to use for the Crumbl™ encryption, eg. http://localhost:4000/lastPubKey.

It expects three mandatory HTTP headers (as only registered users should ever call for a new pub key):

• X-User-ID: the ID of the requesting user;
• X-User-PubKey: the public key of the user;
• X-User-Secret: the API secret of the user. eg.

   GET /lastPubKey HTTP/1.1
   X-User-ID: 123456abcdef123456abcdef123456abcdef123456abcdef
   X-User-PubKey: yourPublicKey
   X-User-Secret: yourAPISecret
   User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
   Host: crumbl.io
   Accept-Language: fr-FR
   Accept-Encoding: gzip, deflate
   Connection: Keep-Alive

It returns a 412 status code in case these HTTP headers are either missing or wrong. Otherwise, it returns a 200 status code along with a JSON object in the body respecting the following format:

{
  "encryptionAlgorithm": "ecies",
  "publicKey": "<The ECIES decompressed public key in hexadecimal representation>",
  "requestId": "<The requestId to use when recording the crumbl (see below)>"
}

// TODO Add RSA support.

• GET /uncrumbs

This endpoint deciphers the passed crumbled string if the signer had signed one or more of its crumbs. It expects the 4 following mandatory URI-encoded arguments in the query string: (eg. http://localhost:4000/uncrumbs?dataId=123456789abcdef&crumbl=9876543210fedcba[...]&verificationHash=9876543210fedcba[...]&token=12345678-90ab-cdef-1234-567890abcdef1)

• dataId: the data ID related to the crumbled string (in hash format);
• crumbl: the full crumbled string;
• verificationHash: the hash of the original source (not to be confused with the initial hashered source of the crumbled string);
• token: a valid token (in UUID format).

It returns a 200 status code along with the partial uncrumb as a plain text body if deciphered any, 400 if any query argument is missing, or a 404 status code if it's not a signer.

• POST /crumbl

This endpoint records the data ID in the local database to keep track of its relation with the public key used when crumbling the data. Calling it is necessary to make the crumbl decipherable in time. It expects the request body to be a JSON object respecting the following format:

{
  "dataId": "<A custom ID using a hash string>",
  "requestId": "<The requestId generated through the /lastPubKey endpoint (see above)>"
}

It returns a 201 status code if everything went well.

As usual, all endpoints return a 500 status code if an error occurred on the server side.

License

The use of the crumbl-signer server is subject to fees for commercial purpose and to the respect of the BSD2-Clause-Patent license.
Please contact me to get further information.