fix(gossipsub): validate the message key for all peer id types

packages/gossipsub/src/utils/buildRawMessage.ts

@@ -139,8 +139,9 @@ export async function validateToRawMessage (
       let publicKey: PublicKey
       if (msg.key != null) {
         publicKey = publicKeyFromProtobuf(msg.key)
-        // TODO: Should `fromPeerId.pubKey` be optional?
-        if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
+
+        // the message key must derive to the `from` peer id
+        if (!fromPeerId.equals(publicKey.toMultihash().bytes)) {
           return { valid: false, error: ValidateError.InvalidPeerId }
         }
       } else {
@@ -176,7 +177,7 @@ export async function validateToRawMessage (
           sequenceNumber: BigInt(`0x${uint8ArrayToString(msg.seqno, 'base16')}`),
           topic: msg.topic,
           signature: msg.signature,
-          key: msg.key != null ? publicKeyFromProtobuf(msg.key) : publicKey
+          key: publicKey
         }
       }
     }

packages/gossipsub/test/unit/buildRawMessage.spec.ts

@@ -3,8 +3,10 @@ import { peerIdFromPrivateKey } from '@libp2p/peer-id'
 import { expect } from 'aegir/chai'
 import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
 import { StrictSign } from '../../src/index.ts'
-import { buildRawMessage } from '../../src/utils/buildRawMessage.ts'
+import { ValidateError } from '../../src/types.ts'
+import { buildRawMessage, validateToRawMessage } from '../../src/utils/buildRawMessage.ts'
 import { getPublishConfigFromPeerId } from '../../src/utils/publishConfig.ts'
+import type { PrivateKey } from '@libp2p/interface'
 
 describe('buildRawMessage', () => {
   describe('Signing seqno', () => {
@@ -28,4 +30,42 @@ describe('buildRawMessage', () => {
       }
     })
   })
+
+  describe('RSA author key binding', () => {
+    const topic = 'test-topic'
+    const data = uint8ArrayFromString('hello')
+    let victimKey: PrivateKey
+
+    before(async function () {
+      // RSA key generation is slow
+      this.timeout(30_000)
+      victimKey = await generateKeyPair('RSA', 2048)
+    })
+
+    it('accepts a message signed by the genuine RSA author', async () => {
+      const victim = peerIdFromPrivateKey(victimKey)
+      const config = getPublishConfigFromPeerId(StrictSign, victim, victimKey)
+      const { raw } = await buildRawMessage(config, topic, data, data)
+
+      const result = await validateToRawMessage(StrictSign, raw)
+      expect(result.valid).to.equal(true)
+    })
+
+    it('rejects a message whose signing key does not derive to the RSA author', async () => {
+      const victim = peerIdFromPrivateKey(victimKey)
+      const attackerKey = await generateKeyPair('Ed25519')
+
+      // claim the victim RSA peer id as author but sign with the attacker's key.
+      // getPublishConfigFromPeerId does not check that the peer id matches the
+      // private key, so `from` is the victim while the signature and `key` field
+      // are the attacker's
+      const forgedConfig = getPublishConfigFromPeerId(StrictSign, victim, attackerKey)
+      const { raw } = await buildRawMessage(forgedConfig, topic, data, data)
+
+      expect(raw.from).to.deep.equal(victim.toMultihash().bytes)
+
+      const result = await validateToRawMessage(StrictSign, raw)
+      expect(result).to.deep.equal({ valid: false, error: ValidateError.InvalidPeerId })
+    })
+  })
 })