End to end encryption

.gitignore

@@ -11,3 +11,4 @@ temp_*/*
 *.egg-info
 __pycache__
 *.pyc
+launch_*

demo/__init__.py

@@ -38,6 +38,10 @@
 DIRECTOR_REPO_PORT = 30401
 DIRECTOR_REPO_NAME = 'director'
 DIRECTOR_REPO_DIR = os.path.join(uptane.WORKING_DIR, DIRECTOR_REPO_NAME)
+DIRECTOR_ENCRYPTED_IMAGES_FOLDER_NAME = 'hosted_folder'
+DIRECTOR_ENCRYPTION = False
+DIRECTOR_ENCRYPTED_REPO_DIR = os.path.join(
+    uptane.WORKING_DIR, DIRECTOR_REPO_NAME, DIRECTOR_ENCRYPTED_IMAGES_FOLDER_NAME)
 
 DIRECTOR_SERVER_HOST = HOSTING
 DIRECTOR_SERVER_PORT = 30501
@@ -66,7 +70,7 @@ def generate_key(keyname):
     Key type: ed25519
     Key location: DEMO_KEYS_DIR
   """
-  rt.generate_and_write_ed25519_keypair(
+  rt.generate_and_write_rsa_keypair(
       os.path.join(DEMO_KEYS_DIR, keyname), password='pw')
 
 
@@ -80,7 +84,7 @@ def import_public_key(keyname):
     Key type: ed25519
     Key location: DEMO_KEYS_DIR
   """
-  return rt.import_ed25519_publickey_from_file(
+  return rt.import_rsa_publickey_from_file(
       os.path.join(DEMO_KEYS_DIR, keyname + '.pub'))
 
 
@@ -93,7 +97,7 @@ def import_private_key(keyname):
     Key type: ed25519
     Key location: DEMO_KEYS_DIR
   """
-  return rt.import_ed25519_privatekey_from_file(
+  return rt.import_rsa_privatekey_from_file(
       os.path.join(DEMO_KEYS_DIR, keyname), password='pw')
 
 

demo/demo_director.py

@@ -38,6 +38,7 @@
 import uptane.services.director as director
 import uptane.services.inventorydb as inventory
 import tuf.formats
+import tuf.hash
 
 import uptane.encoding.asn1_codec as asn1_codec
 
@@ -55,6 +56,8 @@
 
 KNOWN_VINS = ['111', '112', '113', 'democar']
 
+LOG_PREFIX = uptane.TEAL_BG + 'Director:' + ENDCOLORS + ' '
+
 # Dynamic global objects
 #repo = None
 repo_server_process = None
@@ -181,6 +184,9 @@ def write_to_live(vin_to_update=None):
         os.path.join(repo_dir, 'metadata.livetemp'),
         os.path.join(repo_dir, 'metadata'))
 
+    refresh_metadata_for_encrypted_images_folder(vin)
+
+
 
 
 
@@ -581,23 +587,99 @@ def add_target_to_director(target_fname, filepath_in_repo, vin, ecu_serial):
 
   if vin not in director_service_instance.vehicle_repositories:
     raise uptane.UnknownVehicle('The VIN provided, ' + repr(vin) + ' is not '
-        'that of a vehicle known to this Director.')
+      'that of a vehicle known to this Director.')
 
   repo = director_service_instance.vehicle_repositories[vin]
   repo_dir = repo._repository_directory
 
   print('Copying target file into place.')
   destination_filepath = os.path.join(repo_dir, 'targets', filepath_in_repo)
-
   # TODO: This should probably place the file into a common targets directory
   # that is then softlinked to all repositories.
-  shutil.copy(target_fname, destination_filepath)
 
-  print('Adding target ' + repr(target_fname) + ' for ECU ' + repr(ecu_serial))
+  if ecu_serial in inventory.get_registered_ecu_serials():
+    shutil.copy(target_fname, destination_filepath)
+    public_key_for_ecu = \
+        inventory.get_ecu_public_key(ecu_serial)['keyval']['public']
+
+    encrypted_target_data, encrypted_aes_key= \
+        director_service_instance.encrypt_target(
+        target_fname, public_key_for_ecu)
+
+    demo.DIRECTOR_ENCRYPTION = True
+
+    create_new_folder_to_hold_encrypted_files(vin)
+    encrypted_hash, size_encrypted_file = write_encrypted_file_in_folder(
+        vin, encrypted_target_data, filepath_in_repo)
+
+    print(LOG_PREFIX + 'Adding target ' + repr(target_fname) + ' for ECU ' +
+        repr(ecu_serial))
 
   # This calls the appropriate vehicle repository.
-  director_service_instance.add_target_for_ecu(
-      vin, ecu_serial, destination_filepath)
+    director_service_instance.add_target_for_ecu(
+        vin, ecu_serial, destination_filepath, file_hashes = encrypted_hash,
+        encrypted_symmetric_key = encrypted_aes_key,
+        encrypted_file_size= size_encrypted_file)
+
+
+
+
+
+def create_new_folder_to_hold_encrypted_files(vin):
+  """
+  Stores the encrypted images and the corresponding metadata in a special folder
+  that will be hosted by the director for the primary to access.
+  """
+  host_folder_directory = os.path.join(
+      demo.DIRECTOR_REPO_DIR, demo.DIRECTOR_ENCRYPTED_IMAGES_FOLDER_NAME, vin)
+
+  if not os.path.exists(host_folder_directory):
+    os.mkdir(host_folder_directory)
+
+  if not os.path.exists(os.path.join(host_folder_directory, 'targets')):
+    os.mkdir(os.path.join(host_folder_directory, 'targets'))
+
+  refresh_metadata_for_encrypted_images_folder(vin)
+
+
+
+
+
+def refresh_metadata_for_encrypted_images_folder(vin):
+  """
+  Changes the metadata files whenever new metadata has been added by copying 
+  the new files to the folder
+  """
+  host_folder_directory = os.path.join(
+      demo.DIRECTOR_REPO_DIR, demo.DIRECTOR_ENCRYPTED_IMAGES_FOLDER_NAME, vin)
+
+  if os.path.exists(os.path.join(host_folder_directory, 'metadata')):
+    shutil.rmtree(os.path.join(host_folder_directory, 'metadata'))
+
+  shutil.copytree(os.path.join(demo.DIRECTOR_REPO_DIR, vin, 'metadata'),
+      os.path.join(host_folder_directory, 'metadata'))
+
+
+
+def write_encrypted_file_in_folder(vin, encrypted_target_data, filepath_in_repo):
+  """
+  Writes the encrypted file to be saved in the folder hosting encrypted images
+  """
+  host_folder_directory = os.path.join(
+      demo.DIRECTOR_REPO_DIR, demo.DIRECTOR_ENCRYPTED_IMAGES_FOLDER_NAME, vin)
+
+  encrypted_image_copied = os.path.join(host_folder_directory, 'targets', filepath_in_repo)
+
+  with open(encrypted_image_copied, 'w') as f:
+    f.write(encrypted_target_data)
+
+  size_encrypted_file = os.path.getsize(encrypted_image_copied)
+
+  encrypted_hash = director_service_instance.generate_hashes(
+        encrypted_image_copied)
+
+  return encrypted_hash, size_encrypted_file
+
 
 
 
@@ -624,7 +706,7 @@ def host():
 
   # Prepare to host the director repo contents.
 
-  os.chdir(demo.DIRECTOR_REPO_DIR)
+  os.chdir(demo.DIRECTOR_ENCRYPTED_REPO_DIR)
 
   command = []
   if sys.version_info.major < 3: # Python 2 compatibility

demo/demo_secondary.py

@@ -318,7 +318,6 @@ def update_cycle():
   # is and let it expand and validate the metadata.
   secondary_ecu.process_metadata(archive_fname)
 
-
   # As part of the process_metadata call, the secondary will have saved
   # validated target info for targets intended for it in
   # secondary_ecu.validated_targets_for_this_ecu.
@@ -415,7 +414,36 @@ def update_cycle():
 
   # Validate the image against the metadata.
   try:
-    secondary_ecu.validate_image(image_fname)
+    secondary_ecu.validate_encrypted_image(image_fname)
+  except tuf.DownloadLengthMismatchError:
+    print_banner(
+        BANNER_DEFENDED, color=WHITE+DARK_BLUE_BG,
+        text='Image from Primary failed to validate: length mismatch. Image: ' +
+        repr(image_fname), sound=TADA)
+    # TODO: Add length comparison instead, from error.
+    attacks_detected += 'Image from Primary failed to validate: length ' + \
+        'mismatch.\n'
+    generate_signed_ecu_manifest()
+    submit_ecu_manifest_to_primary()
+    return
+  except tuf.BadHashError:
+    print_banner(
+        BANNER_DEFENDED, color=WHITE+DARK_BLUE_BG,
+        text='Image from Primary failed to validate: hash mismatch. Image: ' +
+        repr(image_fname), sound=TADA)
+    # TODO: Add hash comparison instead, from error.
+    attacks_detected += 'Image from Primary failed to validate: hash ' + \
+        'mismatch.\n'
+    generate_signed_ecu_manifest()
+    submit_ecu_manifest_to_primary()
+    return
+
+
+  secondary_ecu.decrypt_images(image_fname)
+
+
+  try:
+  	secondary_ecu.validate_image(image_fname)
   except tuf.DownloadLengthMismatchError:
     print_banner(
         BANNER_DEFENDED, color=WHITE+DARK_BLUE_BG,

demo/demo_timeserver.py

@@ -136,31 +136,6 @@ def test_demo_timeserver():
 
 
 
-  # Fetch a DER-encoded converted-to-ASN.1 signed time attestation, with a
-  # signature over the DER encoding.
-  der_signed_time = timeserver.get_signed_time_der([2, 9, 151])
-
-  # Encapsulate that in a Binary object for XML-RPC.
-  xb_der_signed_time = xmlrpc_client.Binary(der_signed_time)
-  assert der_signed_time == xb_der_signed_time.data, \
-      'Demo Timeserver self-test fail: xmlrpc Binary encapsulation issue'
-
-
-  # Validate that signature.
-  for pydict_again in [
-      asn1_codec.convert_signed_der_to_dersigned_json(der_signed_time),
-      asn1_codec.convert_signed_der_to_dersigned_json(xb_der_signed_time.data)]:
-
-    assert uptane.common.verify_signature_over_metadata(
-        timeserver_key_pub,
-        pydict_again['signatures'][0],
-        pydict_again['signed'],
-        datatype='time_attestation',
-        metadata_format='der'
-        ), 'Demo Timeserver self-test fail: unable to verify signature over DER'
-
-
-
 
 
 if __name__ == '__main__':

demo/keys/director

@@ -1 +1,42 @@
-7f8fcae94b95a04baa1f07aa374937f9@@@@100000@@@@48d5bd2502df5d921e714f0782f42e1df1ae08ffb4d0dbf5df1923557096b005@@@@a724429acda285bfb3e7f2b4db0b0928@@@@f6056beade9cd29b105c8f82186b24f5e9257a11420ddf2e4056a6ce7907ffb334dc130c6f12268f0229a5b34364d6375cd398de2b3aea93f6fd55355a725b8352caea89a625bf020e7a2a165aec5f95794f73265779056f9e3a227469cf89f484ff4067e4fa50241492810c89a5a9e83945af92a41a37096068f7fd01976ec209c3156bfc9308c5e95a1381859bff06a62df2ad2aabb9f417e2588941b9239d6a6d130572de94813cfd089eefbe73fe59e297f047dac67e8dfa437360bbc7ec953a507ca69fc48a21dadb6124643f6bf3e813d603a5609391cf5c1b5b30321a3024f3a8f97f325e96be102d0dceba28bf1f5a4c7614c0e0ffd2b6819758e0d02ad1df6adb16e23282dc502a
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,56337B81936C42C2
+
+B7vg6ydsSaFyJ/C3i1pdMpwg8GSTuBOkZy8dwcc5A/h94Z8vcR5puUmu9N5w3Fxx
+LfpKgmUB9lVXvDmNHXfjhBkppjUmUKvzNsS0z03C7XzBRc27j5iFVvUoVh4+1Br1
+TRIdMYvvBa2EaGhS4/usa+mhIzW/l9xCqoTruXEfImCj6ur1pHnc1xaWOVaE+8X+
+iXsfjFRXBp8RDiLBX73/mDZbZ1ivgrTGHONNDPdV1jpb1woBh6zcuQN8yrDtI4Mn
+uNAgXadI9+g8hXmIiDh1ToAagMQ3j1jaWYF14BGDNv/N9QXN9K00WFBSf97fnMnh
+VgGmeqrIM4FhTl8cWFTW0CiA3V0kotZYaNPYhZjkLyidz3TKK1wVhKTH1ZBvw8kr
+CYA5yL1CQQng4WQbYB2ic9OsjdVd9a68tYOON37tSDrGLKIvuCwAwV3rAF9xf3sp
+omcU4uCcuYZZ27JlO9Nlf84Rj5WZkNitV1sUMUiUJmVftyROCMpHNUkjx7VuGSk2
+Ks6FjUgVeLxtFMVFMGUpPkDn73sE/QS6PKBep5Cs20B0B4PYDmSimv7eum66M79j
+9EncAxMd/1G2XokcruPtK8g0is/5wM8N5xuKqKDGZPOoeQaVoOPUXy64VFBQpfDL
+77Cb8HtVQuXmN4UVxalzuZYjkXjaC2B0JcTXBorkYQjOFVtVEj0wmROMOsbwb4E6
+7fsy2wIeSaLbZ57CQMDFrZ6bOOk6zw8e9COb6qRvaZo5v+0ffAVKm431va9UfC08
+CQ76ht+dmK+RMn7Zo69Nvp6VhUZ+9NqfQTw/90TCBQc9SiEQW+uczaIjb0Z92x1J
+r6ygtkExlPQ25LfwKwUXV26MAIRU0/9BufQ2N6P1I4gcpneqgVmPNcZCMBmfkYJa
+11oHbLQ8X/ml5NRcGrMqtcCxI9JfZqGQy6AW7jYGfl5M4IXnA8MTMrK30kH3Edah
+ypAXickw+vKLhhD3tDcy6ZzyoQAzT+OFEGbmgSumzDLuHxfW5H7TJEsY/IrinOUQ
+npyhr6Axj204ut/eUJcsAig9vI4mZM08FZpluEXtSr7/Cs9kqkJzLXXI2dCXgYSj
+W6Y+y5F1Ys6ZWTd8fegKCeAATCOzgKc7BRNnTXxAul1dzPe0HjdrdpVCLBzm606X
+QryIm9rZxS8/C5fmDBzT8aQkiDdlVelFihknVFfrVos0hEWrRbDVM8rvdhq2RBMD
+h8ib9sHyIAkLS9p1XRQAexqsFQ+EoBFPqJy0oFnpuqcwjFqnRBjYRt8TFJUmSx6B
+X4P8/nqYVWmnVrNIEOruZk891Tmppozai5tBeyF6Gxu8KukkiQFyUNfkaKWxj/UU
+4UDmuAPfGfZzbXLEIHjUAtk2NEPvZfhxg5nFQJ9M3KAJVrSG9h3l5geETcTnVj6g
+CrJGpYMHqBaysmeFyoDfZ3dzS9pKprjDcDdGQ4VABqbgDr+eAbEoKekJ3ss0Igk9
+wmqlfRsaQ5FhokYqN7Ur8lEBu8oWICy4Tx6jDPO1oRoFWdXbdRCKz6cLMM9TK/Dy
+FYQjZEfhBS4SCvssTvOTTYB/zFFyiz/+0vIoD6/z0kPyzZ5xsDysCTpnrvonlUCk
+3yEWhmolOfMogTkgUWu4iLCI9bpytQ9UaYay3Xj/fzOycKpvrziAQVvDUQjpMceY
+cxCDKiiZaCv4AK5g0VrzYlGikd0Jn1hQf/gqgb2A9ILGGs1Z6NTcSenu2+BIFzZb
+WP6O2k8DIq8aFIERIXp7yXsVgKaBXCkYuI3wi0Nyt4NVsow/fxCqbnAPkoirV3jo
+O8CXk7W5itWyMgb6+vnw9lX5oBFTsrO2JdRdxygw2tFLlBxLuhiIBTWTUAjJOI7D
+TQH+uBW+QQiSFFfVgHP9RBLERz29b5rjOxUO58+qed9sm3HolhoJnlbS6w/pAt+4
+S8A6X9+P2YewS2tyBiEXVj0El0vwUHL3dgHnJcM/eU+ay0vRgCdqlZwTm7GrtusL
+XeEYB+lTDRyDmbQXDgUTIt8gXRt0hE2sRKJHXqWPABJ3hBNSfgbGG96mnAGS4CmN
+T1Z00pIKY6Cjm20kkRypeL7KVR9I6OwS9+VybiJJHFScBIaqywN7TD2+mRb5caFj
+JBOjx45f6Gyt2OXQ0tXEhggEZUUdoiNv4r5jgmqUy6Eps6QbRlJqwBgtfCIK951H
+f6mcT5bNeOFiVuzS70q2eWkYU7fiy3seUx9UH2I342s347+K+KuAxchakdBONMed
+L0D0STGl9RDdifHA6xgw/V8jhZJ44NDgyCbKbb9e/eUxR4lHrVmBJr4WATjQ2Pu1
+YQhZoVEFstex0dQn83XLPfW4AOYLTJd1hYR5bDKnC96jCl+0+4T8qQ==
+-----END RSA PRIVATE KEY-----

demo/keys/director.pub

@@ -1 +1,11 @@
-{"keyid_hash_algorithms": ["sha256", "sha512"], "keyval": {"public": "99ef8790687ca252c4677a80a34e401efb7e17ccdf9b0fcb5f1bc3260c432cb9"}, "keytype": "ed25519"}
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvfRckE1nP+UpxoKREfhu
+ycbEeVMHMF0WUntkTO1ns9bt5MczbLYlKfcFbX8mDng/AseEYn4dug5fyyiCy5OW
+dT8cPqINxluuy2eNh4EPRZ/pUMJ74edArXXRe0ZhvEIhMPQiyaQcffx0dWjqGUL1
+qjxrBpdRYLLs08fPgvyEnf2OmUdhMe2fZxvqeaM1xCpwkyDvmfkeKwbue5DJovwx
+CMZurGHfZfQDn1ecyP4f80UsOCkK/HDDaK9E8LgjeN9YzNIQAw1jgXAFN95x9V3G
+/moRcouYMdhL8KEgSK8fGWsRlUBtqm2MVP9I+g9MbVkOXa/7ZXpvvWsOJliHARoi
+2/j+qKrfifPKnbGWUWhS7/0IH1y5noz1mOSNvgyiOdh+9lSTGEkaYniaMZEKLAgK
+5tKiTI/oy+RlI+SfSqNwua/+HmSSqvtxaP9j+zdNmJTayIbwbyel/VzWOGNBmWm9
+Wbu6bWeA28n4JLawBVdqc0BPs88yEZVy+wi4CDy4DIa7AgMBAAE=
+-----END PUBLIC KEY-----

demo/keys/directorroot

@@ -1 +1,42 @@
-faa431f56ab70096016384d60e789ae6@@@@100000@@@@6b6dbf7be483b860309e617516d6b591651720f3ac95bf2ababb0792825876a0@@@@b6aaab78776ae1f55a3771e814ff50ce@@@@5106a3c58d9749aba7c9ef92514809fb92d139e3b5b6b9109354e7c72c15690e267dc7c0b09ee05ecd78750bec1050e290da42a6da516b0fa26bd01bd5f5d5cda5f2534b64e52af4ccff5f164a0cd98532873622fb603549cabaefc76008bdfd72e3886dd11e9ed3f212e82ca86b08901228b01495911d0a3969260e1eec7c5a3e0777190207ce58658e731960c341e98d5bc0cc0de1e7629afb8a7053e729ff7496c561b72e5be3be4183c146ea6a80287730ea7981c2d332082b10eb9ee555c3f39bd482049e64da59d0cf872ac204dfc080192a3cb645ce0d71fb82a70523681744ddba4b9e02dbd1951ab57e1b5c272271c7a28d67a1d0558813996d4de8829309beb00c1b2eec251c21
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,84815D3A8FCAD025
+
+RHuMN9cPrlI0ohQ/3MEkZHiQOV7tQhyP/p7PDK5x6Je/bVqUu7lBFEvkIZwjww5T
+5xkMzevYIf7YIK+4E6CWcT2KsVBdu9tqvTLafhKlDUtNj+GtXP+0DA1prq6QKt8W
+54vHZ8UYOGenr20bjl2VT9QegFl5fUWNfQFxEM83ovIjGmOml2E11piveM/h/OJ3
+JnYOnYru/DquHn80lUn7PTCTTPGaYzb67CSaKPk/64Yuj1+QNFO+Rps9Vl5eEa/6
+mtWsCavgSqqIkAGP7qyVMn2nqCiY8sbXG3wDvUaeE1SsBg41anaHCey/KGsjlEdu
+Nrpes0C4lbUIIQSte6SJcn5gndR289ePNs5zrxSv6s5PI2JcCxnh/1w0tll0db5s
+llCz9ehkJ5FCwh1opUD7aUTtmnJi3VzqfUZ6vZgSAyYpOtbpLEdB/EIoAP/A4lzg
+XLgSq+KSQJWdLXMIJcgNABGuLUXONFrgbagIdAIaXBKk/xekbab3fBC0ZWCLoR7z
+O48ivYS216zC9NIit8uznGIA8A434Dh7eh7JJ2fnjYF69/4BsIYCoxWvNCuebMqN
+hXL0gXQKi3m5BlCRckfVCsw+giseKQyK+81sLb2CZZzgazjHVEpknVFgW/1XPjm+
+3SjHVs5fVkC8Q47QPGWb44KiMsW+eh2xs3uXUHS0EVKaSs/OAKVgxnGCVffIhlS5
+T7Ao70LOAM0VeVIq9NOmWbdSn1gR4e/fXJv4nZmVCaJqUi88Lhj+QObkw7eZwrhq
+9bOxWIGVq3llBwc27+6rP5zlGEymZlXHB7veFq48DV7RBAdnBHWEkkrlInkzO2W1
+/Pphxc/k+TRtLsyFXpaZZZmUUSrWbN7bHINSyK0pv9+LsYgXYhRFlX6U14kdC7lO
+alX32ZCrAV3nbTyZNXxIC7HNG7iFGRkHkrHmg+C9cp481ETnNWzoILMt8h9KDUME
+qbEeePVCUW1Z2+0qWKIjRTDlbVBZI29V2Eopx4qLCTKDrm16z93ClKDGvLimnIm9
+1ldlM7uZW4hbEqtb+fBRdJSiHQLu6JGpz9o6vBo17S3+Wd3NF1E0GZELssRt+p6X
+zuJ++mRRTOndAlsE1KrwAWDbi9SpODUb4wLg7/5WP7tfYhsvHLmAnU+3QWdP/y/h
+Y1hv/bgy4AZn84M2gAa92m/QVuYEmuTXG3TKlXwCgmRlCZE6glHbnpwStX/oiKS/
+SAr8q/IoHLj4yaC1sDRHMvf+r/238HtL3AWiaKekJY5oF1etgRXeEaUBueealCF5
+AxaLkAqMcffOUeNyUx7TlwIrHHyyA3qULYpAT6eWtkNVZIOueLOnKZF9GjfLee0a
+/BXpcHUO7gBH+eTuGT2Gf22FAqUqYEU4xUV38DsoJtBIYXGhtS0u6/5SBOjZChKI
+NakrqEzr26GEU+AFjatKY+JKhEa+0NeCvxO3e6tmxGUPo56//wiSC47Y4E14TdOx
+vNNp258UyCddTY52nmakjPjw9OrEpzLCKRGhDu3FP6IATxjcyZRGnzLfsEtZyQsP
+3fKuvbg6vf2HUyQtdPSoGmJS3gwDHyOggR1eJtZXvvKaVw0TThm9nLpRZqvZq91U
+g4+foKnIltUqycLeIeOr+Of73IAsOFcLyhDfdBfT3CNEUWNvoqWWE0KtJz824Vt4
+vzIhp7uheUNiEZkVGXZF8eMEXhAkYW3w9IiVPUC42qLer08S1pleviUMCsXJWSUZ
+Nc1RcXnpuuXptnYfbJc72rYOhGh5RerD22X3TU7Vu42Ga1+gTdpyHGJMs9zTKD1u
+jV2znR+7o+0RRoWJuU5kK/mTTVe+H8GvgvEdGQtgYZ02jw32ekAgPO2Dm/22+BrN
+hwtsyp6k3nF5uo9EPiDhEHzmJaa5Y8DMurCcTHWj4v1zTQI7ZUoa3C9awLFGjjqX
+YDM5fgo7j0lVxpOZe3325D9yDD+obqGY+2YnG1NEV4TUVdkwq292LPKH8tMv6hq4
+17bvGgHiIYydm3HmhOj1vjjs4d8hxnBOxnfOizIJdJuzFVLYSW5phGJm1nqwrlEA
+wYPESZ8N2ILZihEGkt2eQ9hqP0/rhUTjaVBsbLrCfgmipcc9+ahn/wajBG7MQzav
+9IrugDJ8hrUO4RWIdfPQz4hnBc4dTE61kQDJwv1xHh/KzKdSZ47nZ2oX7Q38pNTg
+Gg94padb9aW46YlsT0dxSEz/QEgW1ueCt3+jRIOq3raD+Cb0r3xW3eRE/w4ZVRAq
+zhMxKas5WbyZynkkOF8xNrpmqc9AFxffEr7XDdCotzyQJ0zAV96xpFzZoRvqQIs9
+G6lVZX5TSlXeVwyUw9rt91dQESq8C+MIELmArI6XXEz0upyFs6BTdw==
+-----END RSA PRIVATE KEY-----

demo/keys/directorroot.pub

@@ -1 +1,11 @@
-{"keyid_hash_algorithms": ["sha256", "sha512"], "keyval": {"public": "f3b4c231520580eca92e17ae1581a708f606f72d43cc200af493afeec22a5e79"}, "keytype": "ed25519"}
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA1v8uTsmjBRcUOVJh/8OI
+toL3OoOuwxPh1Ab4CZ+vMcUiiHd5XXB7WpyAmYJaRqQMKu3zDre3RKROJt/zM07Q
+/l4Kr2f+RMp7As2cH6qGn4k0CyQBNoop77CzxucbVIrNoyExbtVvv1LOZXBihj4L
+paDAheVfUge6VqMcxpzEdaxGmPACd58gr/vqgYJ15jfnoudJ7GP893WkcL+qiFUv
+3RG9veH+c6BU14kD04OEAon83JxBvarnlOBi/gBH35GRH/LFP14i3MW03sfISPkB
+4rXS4fKjrfpV0dcHteBYpLOaskagtQDs3XZHxjrLDxaRFeBrQqXoO08DmyCfm82i
+yDWqyACgixRdp3n3OxLVwvVZY75FN1X08ksD7bRzXI/4GvJY+Qc2bBT60gi18e6C
+bcAT3SbDjtHoETs6tFCma740hk2118l1tY87ZnJhaUZ9CQWjwgHbuEuZwZaOfqPC
+W6rvKMDvQDzw7ota8I0lmYp/ajarqcQU7CUJOL08I8wtAgMBAAE=
+-----END PUBLIC KEY-----