fud: add a signature to `FudSeeder`

bin/fud/fud/src/dht.rs

@@ -32,7 +32,8 @@ use darkfi::{
     util::time::Timestamp,
     Result,
 };
-use darkfi_serial::{SerialDecodable, SerialEncodable};
+use darkfi_sdk::crypto::schnorr::{SchnorrPublic, Signature};
+use darkfi_serial::{serialize_async, SerialDecodable, SerialEncodable};
 
 use crate::{
     pow::VerifiableNodeData,
@@ -78,6 +79,8 @@ pub struct FudSeeder {
     pub key: blake3::Hash,
     /// Seeder's node data
     pub node: FudNode,
+    /// Seeder's signature of (key || node)
+    pub sig: Signature,
     /// When this [`FudSeeder`] was added to our hash table.
     /// This is not sent to other nodes.
     #[skip_serialize]
@@ -99,6 +102,15 @@ impl From<FudSeeder> for JsonValue {
     }
 }
 
+impl FudSeeder {
+    pub async fn verify_signature(&self) -> bool {
+        self.node.data.public_key.verify(
+            &[self.key.as_bytes().to_vec(), serialize_async(&self.node).await].concat(),
+            &self.sig,
+        )
+    }
+}
+
 /// [`DhtHandler`] implementation for fud
 #[async_trait]
 impl DhtHandler for Fud {

bin/fud/fud/src/lib.rs

@@ -46,7 +46,10 @@ use darkfi::{
     util::{path::expand_path, time::Timestamp},
     Error, Result,
 };
-use darkfi_sdk::crypto::{schnorr::SchnorrPublic, SecretKey};
+use darkfi_sdk::crypto::{
+    schnorr::{SchnorrPublic, SchnorrSecret},
+    SecretKey,
+};
 use darkfi_serial::{deserialize_async, serialize_async};
 
 /// P2P protocols
@@ -394,9 +397,16 @@ impl Fud {
 
     /// Create a new [`dht::FudSeeder`] for own node
     pub async fn new_seeder(&self, key: &blake3::Hash) -> FudSeeder {
+        let node = self.node().await;
+
         FudSeeder {
             key: *key,
-            node: self.node().await,
+            node: node.clone(),
+            sig: self
+                .secret_key
+                .read()
+                .await
+                .sign(&[key.as_bytes().to_vec(), serialize_async(&node).await].concat()),
             timestamp: Timestamp::current_time().inner(),
         }
     }

bin/fud/fud/src/proto.rs

@@ -19,7 +19,7 @@
 use async_trait::async_trait;
 use smol::Executor;
 use std::{path::StripPrefixError, sync::Arc};
-use tracing::{debug, error, info};
+use tracing::{debug, error, info, warn};
 
 use darkfi::{
     dht::{event::DhtEvent, DhtHandler},
@@ -505,6 +505,14 @@ impl ProtocolFud {
                 if seeder.node.addresses.is_empty() {
                     continue
                 }
+                if let Err(e) = self.fud.pow.write().await.verify_node(&seeder.node.data).await {
+                    warn!(target: "fud::ProtocolFud::handle_fud_announce()", "Received seeder with invalid PoW: {e}");
+                    continue
+                }
+                if !seeder.verify_signature().await {
+                    warn!(target: "fud::ProtocolFud::handle_fud_announce()", "Received seeder with invalid signature");
+                    continue
+                }
 
                 // TODO: Limit the number of addresses
                 // TODO: Verify each address