Remove redundant public key fingerprint

Store only the signing key public DER and enforce uniqueness on that source value instead of carrying a derived hash that can drift.

Author: sl5-guy

README.md

@@ -127,7 +127,7 @@ The authorization registry has three main tables:
 
 | Table | Key Columns | Purpose |
 |---|---|---|
-| `principal_signing_keys` | `key_id`, `algorithm`, `public_key_spki_der`, `pubkey_sha256`, `not_before`, `not_after`, `revoked_at` | Stores trusted P-256 public keys that may sign permissions. |
+| `principal_signing_keys` | `key_id`, `algorithm`, `public_key_spki_der`, `not_before`, `not_after`, `revoked_at` | Stores trusted P-256 public keys that may sign permissions. |
 | `principal_key_permissions` | `signing_key_id`, `subject_identity`, `destination`, `not_before`, `not_after`, `revoked_at` | Defines what each signing key is allowed to delegate. |
 | `permission_registry` | `permission_id`, `signing_key_id`, `subject_identity`, `destination`, `not_before`, `not_after`, `revoked_at`, `signature` | Stores signed permissions that authorize a subject identity to reach a normalized destination. |
 

examples/register-principal-key.sh

@@ -34,46 +34,40 @@ tmpdir="$(mktemp -d)"
 trap 'rm -rf "$tmpdir"' EXIT
 
 public_der="$tmpdir/public.der"
-pubkey_hash="$tmpdir/pubkey.sha256"
 openssl ec -in "$PRIVATE_KEY" -pubout -outform DER -out "$public_der" 2>/dev/null
-openssl dgst -sha256 -binary "$public_der" > "$pubkey_hash"
 
 hex_file() {
   od -An -tx1 -v "$1" | tr -d ' \n'
 }
 
 PUBLIC_KEY_HEX="$(hex_file "$public_der")"
-PUBKEY_SHA256_HEX="$(hex_file "$pubkey_hash")"
 
 psql "$DATABASE_URL" \
   --set=ON_ERROR_STOP=1 \
   --set=key_id="$KEY_ID" \
   --set=public_key_spki_der="$PUBLIC_KEY_HEX" \
-  --set=pubkey_sha256="$PUBKEY_SHA256_HEX" \
   --set=valid_days="$VALID_DAYS" <<'SQL'
 WITH input AS (
   SELECT
     :'key_id'::text AS key_id,
     decode(:'public_key_spki_der', 'hex') AS public_key_spki_der,
-    decode(:'pubkey_sha256', 'hex') AS pubkey_sha256,
     :'valid_days'::int AS valid_days
 )
 INSERT INTO principal_signing_keys (
-  key_id, algorithm, public_key_spki_der, pubkey_sha256,
+  key_id, algorithm, public_key_spki_der,
   not_before, not_after, revoked_at
 )
 SELECT
-  key_id, 'ecdsa_p256_sha256', public_key_spki_der, pubkey_sha256,
+  key_id, 'ecdsa_p256_sha256', public_key_spki_der,
   now(), now() + make_interval(days => valid_days), NULL
 FROM input
 ON CONFLICT (key_id) DO UPDATE SET
   public_key_spki_der = EXCLUDED.public_key_spki_der,
-  pubkey_sha256 = EXCLUDED.pubkey_sha256,
   not_before = now(),
   not_after = EXCLUDED.not_after,
   revoked_at = NULL,
   updated_at = now()
-RETURNING key_id, encode(pubkey_sha256, 'hex') AS pubkey_sha256, not_after;
+RETURNING key_id, not_after;
 SQL
 
 echo "Private key: $PRIVATE_KEY"

migrations/0001_signed_authorization_registry.sql

@@ -8,8 +8,7 @@ INSERT INTO agent_gateway_schema_version (version) VALUES (1);
 CREATE TABLE principal_signing_keys (
     key_id TEXT PRIMARY KEY,
     algorithm TEXT NOT NULL CHECK (algorithm = 'ecdsa_p256_sha256'),
-    public_key_spki_der BYTEA NOT NULL,
-    pubkey_sha256 BYTEA NOT NULL UNIQUE CHECK (length(pubkey_sha256) = 32),
+    public_key_spki_der BYTEA NOT NULL UNIQUE,
     not_before TIMESTAMPTZ NOT NULL,
     not_after TIMESTAMPTZ NOT NULL,
     revoked_at TIMESTAMPTZ,

tests/common/mod.rs

@@ -13,7 +13,6 @@ use rcgen::{
 };
 use rustls::server::WebPkiClientVerifier;
 use rustls_pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
-use sha2::{Digest, Sha256};
 use sqlx::postgres::PgPoolOptions;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpListener;
@@ -368,22 +367,20 @@ impl TestAuthzRegistry {
             .expect("encode verifying key")
             .as_bytes()
             .to_vec();
-        let pubkey_sha256 = Sha256::digest(&public_key_spki_der).to_vec();
         let key_id = unique_id("test-key");
         let (not_before, not_after) = active_window();
 
         sqlx::query(
             r#"
             INSERT INTO principal_signing_keys (
-                key_id, algorithm, public_key_spki_der, pubkey_sha256,
+                key_id, algorithm, public_key_spki_der,
                 not_before, not_after
             )
-            VALUES ($1, 'ecdsa_p256_sha256', $2, $3, $4, $5)
+            VALUES ($1, 'ecdsa_p256_sha256', $2, $3, $4)
             "#,
         )
         .bind(&key_id)
         .bind(&public_key_spki_der)
-        .bind(&pubkey_sha256)
         .bind(not_before)
         .bind(not_after)
         .execute(&pool)