Nucypher
/
nucypher
mirror of https://github.com/nucypher/nucypher.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #2804 from fjarri/remove-unused-method 

Remove unused method `Amonia.use_ursula_as_an_involuntary_and_unbeknownst_cdn`
pull/2811/head
KPrasch 2021-09-30 13:29:08 -07:00 committed by GitHub
parent a9b2a8d412 9991de3819
commit 59d653d647
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 1 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
newsfragments/2804.removal.rst Normal file
View File

@ -0,0 +1 @@
Remove an unused method of ``Amonia`` (deprecated since we do not store the treasure map on Ursulas anymore)

47
nucypher/characters/unlawful.py
View File

@ -178,50 +178,3 @@ class Amonia(Alice):
with patch("nucypher.policy.policies.BlockchainPolicy._publish_to_blockchain", with patch("nucypher.policy.policies.BlockchainPolicy._publish_to_blockchain",
publish_wrong_payee_address_to_blockchain): publish_wrong_payee_address_to_blockchain):
return super().grant(handpicked_ursulas=ursulas_to_trick_into_working_for_free, *args, **kwargs) return super().grant(handpicked_ursulas=ursulas_to_trick_into_working_for_free, *args, **kwargs)
def use_ursula_as_an_involuntary_and_unbeknownst_cdn(self, policy, bob, sucker_ursula):
"""
Ursula is a sucker.
After I distract her, by paying for one Policy, maybe she'll store my copy of the Nicholas Cage remake of
The Wicker Man (I have neither the respect nor the inclination to trick her into storing the original 1973
version, which after all is a very decent film).
I'll make this work by fudging the HRAC a bit to create a new map ID which still appears to be connected
to the Policy for which I paid.
"""
# Here's the proper map associated with the policy for which I paid.
the_map = policy.treasure_map
# I'll make a copy of it to modify for use in this attack.
like_a_map_but_awful = EncryptedTreasureMap.from_bytes(bytes(the_map))
# I'll split the film up into segments, because I know Ursula checks that the file size is under 50k.
for i in range(50):
# I'll include a small portion of this awful film in a new message kit. We don't care about the signature for bob.
not_the_bees = b"Not the bees!" + int(i).to_bytes(length=4, byteorder="big")
like_a_map_but_awful._encrypted_tmap = MessageKit.author(
recipient_key=bob.public_keys(DecryptingPower),
plaintext=not_the_bees,
signer=self.stamp,
)
# Now I'll mess with the hrac just a bit.
bad_hrac = HRAC.from_bytes(bytes(the_map.hrac)[:15] + int(i).to_bytes(length=1, byteorder="big"))
# Also note that we only touch the last byte to demonstrate that this attack isn't possible
# I know Ursula checks the public signature because she thinks I'm Alice. So I'll sign my bad hrac.
like_a_map_but_awful._public_signature = self.stamp(bytes(self.stamp) + bytes(bad_hrac))
like_a_map_but_awful.hrac = bad_hrac
# I'll sign it again, so that it appears to match the policy for which I already paid.
transacting_power = self._crypto_power.power_ups(TransactingPower)
like_a_map_but_awful._blockchain_signature = EncryptedTreasureMap._sign(
blockchain_signer=transacting_power.sign_message,
public_signature=like_a_map_but_awful._public_signature,
hrac=like_a_map_but_awful.hrac,
encrypted_tmap=like_a_map_but_awful._encrypted_tmap)
# Sucker.
response = self.network_middleware.put_treasure_map_on_node(sucker_ursula, map_payload=bytes(like_a_map_but_awful))
return response