lib: Separate rekey replay from epoch conflict

keyrot_rekey() treated any re-key attempt against a live epoch
(current or previous) the same way, whether the offered root key
matched the live one (a replay) or was genuinely different (a
conflict). Compare the offered key against the live batch's root
and return -EREPLAY for a match, keeping -1/-ECRYPT for an actual
conflict, so callers can handle replayed re-keys distinctly from
real ones.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 17 insertions, 6 deletions

diff --git a/src/lib/tests/keyrot_test.c b/src/lib/tests/keyrot_test.c
index 10baee5c..efdc718e 100644
--- a/src/lib/tests/keyrot_test.c
+++ b/src/lib/tests/keyrot_test.c
@@ -28,6 +28,7 @@
 
 #ifdef HAVE_OPENSSL
 #include <ouroboros/crypt.h>
+#include <ouroboros/errno.h>
 #include <ouroboros/pthread.h>
 
 #include "crypt/keyrot.h"
@@ -112,8 +113,8 @@ static int test_rekey_dup_epoch(void)
         if (a == NULL)
                 goto fail;
 
-        if (keyrot_rekey(a, SEED_B, 0) == 0) {
-                printf("Re-key to the current epoch accepted.\n");
+        if (keyrot_rekey(a, SEED_B, 0) != -1) {
+                printf("New key to the current epoch not a conflict.\n");
                 goto fail_a;
         }
 
@@ -122,13 +123,23 @@ static int test_rekey_dup_epoch(void)
                 goto fail_a;
         }
 
-        if (keyrot_rekey(a, SEED_A, 1) == 0) {
-                printf("Re-key to the current epoch accepted.\n");
+        if (keyrot_rekey(a, SEED_B, 1) != -EREPLAY) {
+                printf("Same key to the current epoch not a replay.\n");
                 goto fail_a;
         }
 
-        if (keyrot_rekey(a, SEED_A, 0) == 0) {
-                printf("Re-key to the previous epoch accepted.\n");
+        if (keyrot_rekey(a, SEED_A, 1) != -1) {
+                printf("New key to the current epoch not a conflict.\n");
+                goto fail_a;
+        }
+
+        if (keyrot_rekey(a, SEED_A, 0) != -EREPLAY) {
+                printf("Same key to the previous epoch not a replay.\n");
+                goto fail_a;
+        }
+
+        if (keyrot_rekey(a, SEED_B, 0) != -1) {
+                printf("New key to the previous epoch not a conflict.\n");
                 goto fail_a;
         }