[release/5.x] Cherry pick: Harden disaster recovery: Ignore duplicate sealed secrets (#6999) (#7001)

Author: eddyashton

CHANGELOG.md

@@ -123,6 +123,8 @@ namespace ccf::kv
       auto search = changes.find(ccf::Tables::SIGNATURES);
       if (search != changes.end())
       {
+        bool has_cose = false;
+
         switch (changes.size())
         {
           case 2:
@@ -138,6 +140,7 @@ namespace ccf::kv
                 changes.end() &&
               changes.find(ccf::Tables::COSE_SIGNATURES) != changes.end())
             {
+              has_cose = true;
               break;
             }
           default:
@@ -148,7 +151,7 @@ namespace ccf::kv
 
         if (history)
         {
-          if (!history->verify_root_signatures())
+          if (!history->verify_root_signatures(has_cose))
           {
             LOG_FAIL_FMT("Failed to deserialise");
             LOG_DEBUG_FMT(

src/kv/deserialise.h

@@ -399,11 +399,7 @@ namespace ccf::kv
     };
 
     virtual ~TxHistory() {}
-    virtual Result verify_and_sign(
-      ccf::PrimarySignature& signature,
-      Term* term,
-      ccf::kv::Configuration::Nodes& nodes) = 0;
-    virtual bool verify_root_signatures() = 0;
+    virtual bool verify_root_signatures(bool has_cose) = 0;
     virtual void try_emit_signature() = 0;
     virtual void emit_signature() = 0;
     virtual ccf::crypto::Sha256Hash get_replicated_state_root() = 0;

src/kv/kv_types.h

@@ -146,15 +146,7 @@ namespace ccf
       version++;
     }
 
-    ccf::kv::TxHistory::Result verify_and_sign(
-      PrimarySignature&,
-      ccf::kv::Term*,
-      ccf::kv::Configuration::Nodes&) override
-    {
-      return ccf::kv::TxHistory::Result::OK;
-    }
-
-    bool verify_root_signatures() override
+    bool verify_root_signatures(bool has_cose) override
     {
       return true;
     }
@@ -661,25 +653,7 @@ namespace ccf
         term_of_next_version};
     }
 
-    ccf::kv::TxHistory::Result verify_and_sign(
-      PrimarySignature& sig,
-      ccf::kv::Term* term,
-      ccf::kv::Configuration::Nodes& config) override
-    {
-      if (!verify_root_signatures())
-      {
-        return ccf::kv::TxHistory::Result::FAIL;
-      }
-
-      ccf::kv::TxHistory::Result result = ccf::kv::TxHistory::Result::OK;
-
-      sig.node = id;
-      sig.sig = kp.sign_hash(sig.root.h.data(), sig.root.h.size());
-
-      return result;
-    }
-
-    bool verify_root_signatures() override
+    bool verify_root_signatures(bool has_cose) override
     {
       auto tx = store.create_read_only_tx();
 
@@ -699,6 +673,11 @@ namespace ccf
         return false;
       }
 
+      if (!has_cose)
+      {
+        return true;
+      }
+
       auto cose_signatures =
         tx.template ro<ccf::CoseSignatures>(ccf::Tables::COSE_SIGNATURES);
       auto cose_sig = cose_signatures->get();

src/node/history.h

@@ -507,12 +507,27 @@ namespace ccf
            it != recovery_ledger_secrets.rend();
            it++)
       {
+        LOG_DEBUG_FMT(
+          "Recovering encrypted ledger secret valid at seqno {}",
+          it->previous_ledger_secret->version);
+
         if (!it->previous_ledger_secret.has_value())
         {
           // Very first entry does not encrypt any other ledger secret
           break;
         }
 
+        if (
+          restored_ledger_secrets.find(it->previous_ledger_secret->version) !=
+          restored_ledger_secrets.end())
+        {
+          // Already decrypted this ledger secret
+          LOG_INFO_FMT(
+            "Skipping, already decrypted ledger secret with version {}",
+            it->previous_ledger_secret->version);
+          continue;
+        }
+
         auto decrypted_ls_raw = decrypt_previous_ledger_secret_raw(
           latest_ls, it->previous_ledger_secret->encrypted_data);
 

src/node/share_manager.h

@@ -814,6 +814,10 @@ def run(args):
         args, "sgx_service", expected_recovery_count=3, test_receipt=False
     )
 
+    test_recover_service_from_files(
+        args, "double_sealed_service", expected_recovery_count=2, test_receipt=False
+    )
+
 
 def run_recover_snapshot_alone(args):
     """

tests/recovery.py

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtjCCATygAwIBAgIUCp/pWk6MnuAKOk3hk+IHzRMNJnowCgYIKoZIzj0EAwMw
+EjEQMA4GA1UEAwwHbWVtYmVyMDAeFw0yNTA1MDgxMjMxNTNaFw0yNjA1MDgxMjMx
+NTNaMBIxEDAOBgNVBAMMB21lbWJlcjAwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASN
+dA7cD9L+dx0fw8fJcuZzvhM3D2Nfla5/joZKleT4jwBo/YOKgOg8u5vcOccwxucO
+AiXXHNJ2dr+7FUPd+vg6N0AnIaOXDFHROXK2ylmT4l8oQMMw5kpXp6N2gS6AVBaj
+UzBRMB0GA1UdDgQWBBSV5wIP6S1xoYNM5aFl3BxL7LTSzzAfBgNVHSMEGDAWgBSV
+5wIP6S1xoYNM5aFl3BxL7LTSzzAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMD
+A2gAMGUCMGzigYRi6rNHp2XnHUJ4dz1ah/osEEnoDLOp1btD/UauD14XGugvD0vL
+vCE0myL25AIxAM5Qkii6F7SQ7J62Tg3/NYrcJ7L6XbkSUK3o1Whgv5POVQG/Eymw
++GgkVACatEnxsw==
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/member0_cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQD2qQjwy8D1vEgf
+5dAUJxleME52tzNp2IjuTi96APNMFPlOtBrT4x1MsOUeixDa0phHO+hOt/3kxVXm
+DInWWcbbewF9jlk8R4k3LXJPseDS9LBftaTC9G3JA8enzFjAbHOyVu76vA0BqiSH
+f+SgWd72eai+4mQf0gcMiPYkoDXoFWTst7l6IUc3i8iheaFRC2x/QGzNtI6PgPPQ
+bRMIQOD5wa1I6hw85VpclVylSlw1/Eq8y9DwMKzX5u+QxwWaSszgRLjPKSrSDyTu
+tMPHkCOiFTW9/s9hJ7Afqff0TPn2EdgFwdD5t3EmQxeG6Nu9y00RuLA64iyDxiYT
+hQntCJ7VAgMBAAECggEAeGw2TTlsz4xIuin82JnuLKnw5My0cSyiTZYmX64vGinz
+PZV4s5HiMBr9AVhrtimy5rQ8ypHRhutA8LuWX+wcxfLb22yv7FoQh7vMX1Q8q0GD
+CncoJXYoU0dhJm8BtZA9PAhtTESbJQDoLK8n85Fs5XCoDemBcHedsWT8pw0AxHkY
+GWqYA+RiilJp2pGxg50ce9362fSZ9TmuBZscNtS9FefHzkER/RTHttWpBR/aVyyC
+FnjyB9p4cELSwbZeFHRAX3v4Ba8KUeF8r3wh0qlBJRnM4fw/8kp1wW3dFA0L39zN
+jHuSYCPt7IQn1dR1rNuw34fHU2egRRPMrx7sVEqm0QKBgQD9Htw/gRjrQKKWmEIJ
+B8g/dYmvy4WBzEwqGWyyG7hGvnSxKQ5VaJna0lVDctaV27b5SLdNbyWNHlMrbPMF
+l51SA3HOLTjDzN4Fp2aotTKG558yZMaDe4nyX4B9REf9RmI8ld+/KVy05k0D36Xv
+TlUNPeP/7Y+2i+rUQ29PnllutwKBgQD5d1xovBgFkGT8Sx31gN1GP9AYgiwS/Rq1
+8Sz6RYdzdCIFlNN8VriX7h+2J4gqZ6hcR2kIQBJCK96RP9KX8WB4wKApgdi4LNB7
+SEI4x/a4jZFcUkQXKoBkpwKK1ZM+1M4gsQCUGr7Lm7M3tLuVJmLG7C4+ufO7SIGZ
+KIwNC0KS0wKBgHvW3Ws0fjybIvELDUPdyttBZlvb9zXJ/nmadtOtPDtgczc6Hwkq
+ZBvrTEvzo4kuNhdAvG3mMzkX3Rkh9MSHqTC2/rcg6OTjFr0tacyg2lemevzs0TMC
+/jrW/sZK4e3IwcdijFW6puDazFNY2JZ8fKA9548Pa4Ckc//l/k+16YuBAoGANzxt
+kqcrLng1VAOR450f4YEZo4OXHLE8K9L14YhpoG+zZMb6OMq+3q0UCnIgXTtMdPo+
+0FvXbx1lj4WxLIF+md4U2Hvur4EEvHdYalgkUeLOr8FrYDHB8gdksbbufngCGAz5
+EtIFMvILsabr7e9s6Zy79JmZ1PsN7wqiT/URTY8CgYAn603wR9ZZP5g4Zsauqh9Z
+skIRQZOQgvakpwl6IRDr9aLoekgl0gYy+uQKylDsy7h89dwqPK+Y8Ut/1y+OQl6S
+KD2Gc/8dHKuNSwrzcOI4dx/5RPUVddj8rNexBnafaitKB77nRbXSd8B7HNXYm3U6
+fqB1wFF2nyI3xWHMZMXagg==
+-----END PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member0_enc_privk.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9qkI8MvA9bxIH+XQFCcZ
+XjBOdrczadiI7k4vegDzTBT5TrQa0+MdTLDlHosQ2tKYRzvoTrf95MVV5gyJ1lnG
+23sBfY5ZPEeJNy1yT7Hg0vSwX7WkwvRtyQPHp8xYwGxzslbu+rwNAaokh3/koFne
+9nmovuJkH9IHDIj2JKA16BVk7Le5eiFHN4vIoXmhUQtsf0BszbSOj4Dz0G0TCEDg
++cGtSOocPOVaXJVcpUpcNfxKvMvQ8DCs1+bvkMcFmkrM4ES4zykq0g8k7rTDx5Aj
+ohU1vf7PYSewH6n39Ez59hHYBcHQ+bdxJkMXhujbvctNEbiwOuIsg8YmE4UJ7Qie
+1QIDAQAB
+-----END PUBLIC KEY-----

tests/testdata/double_sealed_service/common/member0_enc_pubk.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEMCNoAj3RDb9ksY2F0Z3rOstsugsQOmgkcrtDwI0Wv9GsgOiwD2xwLR1b
+RxQuM608naAHBgUrgQQAIg==
+-----END EC PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member0_privk.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtjCCATygAwIBAgIUPV1QxLIzT+2iVAqeJslUTaxV+6wwCgYIKoZIzj0EAwMw
+EjEQMA4GA1UEAwwHbWVtYmVyMTAeFw0yNTA1MDgxMjMxNTNaFw0yNjA1MDgxMjMx
+NTNaMBIxEDAOBgNVBAMMB21lbWJlcjEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQJ
+eb19no8nGhNz+WHMqf9SVmdtPlmkeJBNn8uj47PMAwO6Uaf1vElOpxO9QOXhCCfw
+snmJ0HkJb+uRMDCEaCwJzhj6YHpmBHbSK0+1yRAZV5c8/0cDDVEGrGrc5TVEQkGj
+UzBRMB0GA1UdDgQWBBSXC/FJW4X5DggAVQqVy6ydX9KeuTAfBgNVHSMEGDAWgBSX
+C/FJW4X5DggAVQqVy6ydX9KeuTAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMD
+A2gAMGUCMBRNhh9gp7I/WGWm926pOOsHz64XzUaYkblTFngYj2zO+eltynuNyNAr
+jJ0T/hRMpQIxAKQ5XlevUzC8vsFkkqItZBHLA9HyA1NLUDO87mCzZsgHZem3O/d5
+3iJ1RJmUXSQaQQ==
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/member1_cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDBPuYofEfVxayE
+ftIRUliuVeZ1/nTb1M3RYicDiCR6h/IPVnkl/MaSs6hluHP31uXheQK2VfmyCIfk
+e/X9o7e1PhMLWYlv6Xq4bGsSneSaK0BrgGGDgA/BwhihUdka33JncUvYVx1k83oE
+lO+RA7pwnKFDPtFpX/taPKY7MPadcuE748QGwOLMOQ9WD06y2Oxtgg+8Tbye96G8
+Gu9RF/lKRg3e7zEBICvl+PV3crQK5zbyRH7s0556pkNepp9+nOBUX+SKGPOHbIJ/
+1Z+dx4azxlYmQvzT8gxws9F6PXzhdTGaObnb6eGq8+ru7qd/amCJgxDM/22XaLnd
+9NYwSn61AgMBAAECggEAGHoMEwKy4pvYHywlFXaVrvdIapehW5rXuvawtFzRKggA
+G/s6+xnKWRiSctfrMHAyy91U/51iNC+qbsFYxhivkzBanyxnIRq0pZlt8ny3UOO7
+lCI9t7dHx6X7EqvYUPQOfJW4Ip3eJkREp0HqGjcbrVnZfzf8tFko8CQQdhzcj9Kd
+44EaM4S+7EgRJvJKdfKQESZXtAbtz1jtgeIypXc4bAkTE+t0QKlfiGj+riFXjGVI
+swsEyo2w46T7/VvROq8UZJBzI2PYaqOupfISS4vJ2Rbht2Eh7t4S8Ak9PwOax6EH
+KggVYeFdLsnfkwD22LUsntT7Q0uagk5nlf+raHivPQKBgQDi9hJ4+qlQZTLbg+JU
+TYOF81vorM22IawODsCfMK/RzLasB4+ZbkCKT66MTHGQCX5piVnLd3s0HJXzdIW0
+MqJoeftM5o1/6mMHhwQMU7zR/sornF6Q8b/jAl/rUmXYV0GK2JtGubFZ55If2MUo
+8mzEk6i9C21wSzktLIHBOpVPTwKBgQDZ+IC33Hou+XtpHIwbG/8EmdbuFprEsy4h
+JP0pL7z/ZBogVootJHqn+kGuLuuf3ZwV9yhydinFtEOzyyvpJ0UJPgKICfa3yPMc
+3Fy/TyibsySaWu2aHLq50aA/1F0vT6SnfqCoTWd3YfUyGEX+qzZ/jo1hGeYwD/1I
+xZR3+0lwuwKBgH4FsMAoPvd7GcA1/Ohemhc4x+HsgdUN4WF045QBDr9p8kyXbi79
+vyyNjhgtIimee+jR8WA/GdQXw1OJcexa6T8l7FoI8q0CUraNS7wkiwX3ef65NvE4
+qxm76dLaz95OpQAZwi6FUWrgYIz6ao+P/MEyVFGUFNJzkm349pt6kgmVAoGBALOI
+d5z5QLpIS1n8ZXo+yQIlJF7ex4OUgj5SlSLDa0yASvSv0wfzsAODoW2yv+jhQ5rk
+BLCimy14mPsSMYzNB5PhO3yJmGkwXu46ozoAHVaBa3inxGTXnQVIoFFyvX4mf1xm
+dDWr67jtOmSUkbJ9m1ndNJ3yEyMrSFgURYG9vHPZAoGAPzc4rTSuleorG/jEN7Y6
+o0VXdiH0MIlwE5q9fhePCsAJHUl28rrjQRzHg3EHt1rRNbM2oiqzxaAPVpej3O49
+Y7aNcdJ1fjcNPDstWebDrDZwfjZBzr2llodbeUhBaP6JEnHcL/JJlEkWPL0Q9mx0
+f3y2BCHI/hkNKIAcVVMahGQ=
+-----END PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member1_enc_privk.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwT7mKHxH1cWshH7SEVJY
+rlXmdf5029TN0WInA4gkeofyD1Z5JfzGkrOoZbhz99bl4XkCtlX5sgiH5Hv1/aO3
+tT4TC1mJb+l6uGxrEp3kmitAa4Bhg4APwcIYoVHZGt9yZ3FL2FcdZPN6BJTvkQO6
+cJyhQz7RaV/7WjymOzD2nXLhO+PEBsDizDkPVg9OstjsbYIPvE28nvehvBrvURf5
+SkYN3u8xASAr5fj1d3K0Cuc28kR+7NOeeqZDXqaffpzgVF/kihjzh2yCf9WfnceG
+s8ZWJkL80/IMcLPRej184XUxmjm52+nhqvPq7u6nf2pgiYMQzP9tl2i53fTWMEp+
+tQIDAQAB
+-----END PUBLIC KEY-----

tests/testdata/double_sealed_service/common/member1_enc_pubk.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEMBRfG14GlbLmg46/nF627oGCj2O0KoYoHrr8wKcRqT1e/pDhBxIEnd09
+8O0jNt783aAHBgUrgQQAIg==
+-----END EC PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member1_privk.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtzCCATygAwIBAgIUM/FPCWrFs/oE8n4uEjCxga1yAsMwCgYIKoZIzj0EAwMw
+EjEQMA4GA1UEAwwHbWVtYmVyMjAeFw0yNTA1MDgxMjMxNTNaFw0yNjA1MDgxMjMx
+NTNaMBIxEDAOBgNVBAMMB21lbWJlcjIwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAST
+a2TnA193Iq3/NEjKIbPWrsfjy7mY5SburNoM1vcEaeNHquTSd3QMofuZe+3TUyl2
+HI8MZPScilKEF6Ydnv2mvfGmzt4Eb2t3BaNo95IKGHdrHCz1VHd9tqNCmP8Ly/+j
+UzBRMB0GA1UdDgQWBBSb92UhTtql+Qd2vzrpN6r7qMJa4zAfBgNVHSMEGDAWgBSb
+92UhTtql+Qd2vzrpN6r7qMJa4zAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMD
+A2kAMGYCMQDZ9tB8yLGa4vhIHZEfbNSUcD2+PTnI0nfDpRYS1jAgXjQMvEThTJuq
+Egm6hYGS7i0CMQDH9P0tjW5cF++x+MnM3HlAZtgpjnE3ndz4b+fLN8FhiuBGwCEm
+Da+MpzthTHoSE9s=
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/member2_cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCu+TgO7r91EpyV
+rRCHw+W5+6WRyWLrm/d97KYAyGlpLIWPPHQ9zUBd/7B9o6ulZWtAmFBWZ2ECxdnZ
+JkJpzwGsopbrOqJHvpsOO6LgbvNUmLO/mx14cqIzuI1AAWRyQdCCDyKcJO+YfWNW
+xNCpIxs8ej/+FnKJ8kukuBJBghTXJHLipcCnqoAfhCxvNCHpC3gA+kvIdCxVX/KT
+fb2yU1D1X/ZuIiCvLei0lRjDFmzPR73g6qrBX7hunRIm1JPphRyICg3sv7hfa1jR
+dpbxebecaVdQfQN/VHGtCRnPiL9BdmAenPGokJPRR5GQys2vcPm3AlLcuUfVI/Rq
+IuBQW4C1AgMBAAECggEAOkb/iNm0IwYj6SZPTyjMJvnN15S/wcGc2PAtCi22DjWp
+9l8oSD1IpwY2fmI5FUmGQ2l3uI+OHCJRwKWhkSRFZn5wzcAltMejVUY/pYjOuupx
+U+wSEL/9jkR1p0/PaM7K58aqvF8A/kUlBQ1ggjUTKT1+et53H8L3ttEoI3F0B4Oq
+6lEj2cGgBumvYKV82V6AdR+53U65a23OzRxkqjS9goJWmX3swCnMDE3P+uIetKsl
+VyHWeaPCQxUHMSgvxQzbNuNBvmmUv7P+fgIrLK62G8hnGsKVEWYpAH8HkZejpC+K
+UDlkWA/vaR5kSdTeBHFkQGWPX/PVEz+3ligzPgXaMQKBgQDkfH82SHsph8rm8IJo
+1Ztpc+WL4lxPuqS3P4mFgZg3bbOe2Y6kaJKTR9yMZ6fkvF2SmiB1I+iJmmxbFKgb
+Q0tQZJs/o3Vg5a2nwDMHdTgz/+tfRVky37Rm8TeLyg/a0S1IQFBkJ3bxmBpe01g6
+YwHml2+0NvSeaSdxbGG+ClgFwwKBgQDECxfg5BHnQ38GyvaelXxrlRnT9xGLI7lg
+QrMhpFpeu/tsUUw/E+lkpYKAhvER0oeJNwl5pNn7MS27pIwRSYUWo1VfObk0gslM
+1uW44BwjpYREqTbdAjJhQWyZUebLD6frogUxTgJrFtDPwKvDXkR4YsbV8HY2Z2Ey
+7970IfjgJwKBgE+zsfhwji3thXTLnuIM6Tp+yCrkmkjhlYWqr0EX9M4ZAVg/Ecf+
+BmtD3QZJPkLHBmkWRI44KWyepn+bFAz2i3YOsi0fytkzJUFoBSTr2eAhvKwuF7Bs
+YpSqPjMQGDm/T+ltLd3R+mbKJSDA3nz3fnk+iCO4K9p6Wdzx7qKJHy1bAoGADjlL
+0zpY/jGMft6tBBaOf3PC+vkbIcBGy/Aq9Q7qq6Lx/AruAEmejnnfvRmNViCzSsZe
+fp/yXOJVkh6/NuXhrSHOqOkUQfYXSubwpfhEsmVo8l5gp6poI1xO19T0bNlG8ra/
+r7McQ87U+a3eCH/HcgCgspcOzKW1jK+Qup/YYdMCgYEAxDSxPoSILNhStfGEcluf
+X3bh7R0sEX97t2sek7mxvkm/cR0fVTmpMtoUN8dGgtMUCMMa5Qhj0qHRdCJ/sf/n
+FgncKZgU7As21hAT0eGNH3HjXrFA7VqCcBn1Ed6H/mqY0R02/Z027z8xMlJhcw1I
+kVSoP18JzBRFbkaEKr38R+Q=
+-----END PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member2_enc_privk.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArvk4Du6/dRKcla0Qh8Pl
+ufulkcli65v3feymAMhpaSyFjzx0Pc1AXf+wfaOrpWVrQJhQVmdhAsXZ2SZCac8B
+rKKW6zqiR76bDjui4G7zVJizv5sdeHKiM7iNQAFkckHQgg8inCTvmH1jVsTQqSMb
+PHo//hZyifJLpLgSQYIU1yRy4qXAp6qAH4QsbzQh6Qt4APpLyHQsVV/yk329slNQ
+9V/2biIgry3otJUYwxZsz0e94OqqwV+4bp0SJtST6YUciAoN7L+4X2tY0XaW8Xm3
+nGlXUH0Df1RxrQkZz4i/QXZgHpzxqJCT0UeRkMrNr3D5twJS3LlH1SP0aiLgUFuA
+tQIDAQAB
+-----END PUBLIC KEY-----

tests/testdata/double_sealed_service/common/member2_enc_pubk.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEMJyJmH8xgKTMj9v+qll0O2IcZ7D+S7tm2bvfI9TQEJpZ1podbMPiQzCY
+uqSWMSDUjaAHBgUrgQQAIg==
+-----END EC PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member2_privk.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBxjCCAU2gAwIBAgIQM4vej4b43U6R8iE9nxA1AzAKBggqhkjOPQQDAzAbMRkw
+FwYDVQQDDBBDQ0YgVGVzdCBTZXJ2aWNlMB4XDTI1MDUwODEyMzIxMloXDTI1MDUw
+OTEyMzIxMVowGzEZMBcGA1UEAwwQQ0NGIFRlc3QgU2VydmljZTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABJzBarhI7u5LMf3Wac20Yyjm7U+NnrbQJXWXr935DsgLoN7b
+903cU/cPM6GHdBW5WRiSBi3IaQ+kpmZCPY6Cd3jeCeJi80G2gC6//zpgYlJbdQaE
+bVEyRJ4u4+3wEZocDKNWMFQwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQU
+DI30D475EDzG9ty/p38sgTlAm64wHwYDVR0jBBgwFoAUDI30D475EDzG9ty/p38s
+gTlAm64wCgYIKoZIzj0EAwMDZwAwZAIwO2f/9JUSLJIw6KiQx2H+pXnEA+foNLfG
+/wFU+RCSecKtCGI/K4HNvrxNaG7/0ohdAjAraXY5jTVP6jIGb7UOJm2UIH/mYL5a
+NWiUfnYnfhOV45kS+IsxaG9kSty2yO4Xv5g=
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/service_cert.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBsTCCATigAwIBAgIUVa15tVdCSPmZnV3W8nwrKRK9g90wCgYIKoZIzj0EAwMw
+EDEOMAwGA1UEAwwFdXNlcjAwHhcNMjUwNTA4MTIzMTU3WhcNMjYwNTA4MTIzMTU3
+WjAQMQ4wDAYDVQQDDAV1c2VyMDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBle62qW
+4aZf6wyyaoKLoMLtN3rJViRAAKRqY2FGK2t4yFI7OZu7arlTZeF5C1PafCXrgFXo
+sJTep1KSKhr7vmABSQKDqf+bD3HQ7OzNTWGSj0OU+pNmOL+Q2MTdXUC84qNTMFEw
+HQYDVR0OBBYEFFZpyYuMJ0b6kita6nui8BTe8zebMB8GA1UdIwQYMBaAFFZpyYuM
+J0b6kita6nui8BTe8zebMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwMDZwAw
+ZAIwL9m3nxDuYx2c1k3sgo6jfIkHw56hQkAlI1f+RRiwPmEGpyqQ6Hk+BkY8opze
+biX9AjBmG9JenGWsJbsgiIhKUN3V2ODO/c7HdWrDpHY7JmusbDbA1OdOEeI+nGly
+Zy2FLjs=
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/user0_cert.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEMDrzpXF8RolN/u4AuhMVCNDDe5tWjl+Wb28gdbT8rOFywWUDLBW3wI9D
+4V6bRv8EHqAHBgUrgQQAIg==
+-----END EC PRIVATE KEY-----