From 30067fc7d7e29d924ea78b226ca67b4dc21f7f93 Mon Sep 17 00:00:00 2001 From: orignal Date: Fri, 24 Apr 2020 21:36:08 -0400 Subject: [PATCH] handle next key forward --- libi2pd/ECIESX25519AEADRatchetSession.cpp | 97 +++++++++++++++++------ libi2pd/ECIESX25519AEADRatchetSession.h | 30 ++++--- libi2pd/Garlic.cpp | 4 +- 3 files changed, 96 insertions(+), 35 deletions(-) diff --git a/libi2pd/ECIESX25519AEADRatchetSession.cpp b/libi2pd/ECIESX25519AEADRatchetSession.cpp index 954df461..bdc31dec 100644 --- a/libi2pd/ECIESX25519AEADRatchetSession.cpp +++ b/libi2pd/ECIESX25519AEADRatchetSession.cpp @@ -20,7 +20,7 @@ namespace garlic // DH_INITIALIZE(rootKey, k) uint8_t keydata[64]; i2p::crypto::HKDF (rootKey, k, 32, "KDFDHRatchetStep", keydata); // keydata = HKDF(rootKey, k, "KDFDHRatchetStep", 64) - // nextRootKey = keydata[0:31] + memcpy (m_NextRootKey, keydata, 32); // nextRootKey = keydata[0:31] i2p::crypto::HKDF (keydata + 32, nullptr, 0, "TagAndKeyGenKeys", m_KeyData.buf); // [sessTag_ck, symmKey_ck] = HKDF(keydata[32:63], ZEROLEN, "TagAndKeyGenKeys", 64) memcpy (m_SymmKeyCK, m_KeyData.buf + 32, 32); @@ -183,12 +183,12 @@ namespace garlic m_State = eSessionStateNewSessionReceived; GetOwner ()->AddECIESx25519Session (m_RemoteStaticKey, shared_from_this ()); - HandlePayload (payload.data (), len - 16); + HandlePayload (payload.data (), len - 16, nullptr, 0); return true; } - void ECIESX25519AEADRatchetSession::HandlePayload (const uint8_t * buf, size_t len, int index) + void ECIESX25519AEADRatchetSession::HandlePayload (const uint8_t * buf, size_t len, const std::shared_ptr& receiveTagset, int index) { size_t offset = 0; while (offset < len) @@ -217,6 +217,10 @@ namespace garlic case eECIESx25519BlkPadding: LogPrint (eLogDebug, "Garlic: padding"); break; + case eECIESx25519BlkNextKey: + LogPrint (eLogDebug, "Garlic: next key"); + HandleNextKey (buf + offset, size, receiveTagset); + break; case eECIESx25519BlkAck: { LogPrint (eLogDebug, "Garlic: ack"); @@ -232,9 +236,9 @@ namespace garlic case eECIESx25519BlkAckRequest: { LogPrint (eLogDebug, "Garlic: ack request"); - m_AckRequests.push_back ({0, index}); // TODO: use actual tagsetid + m_AckRequests.push_back ({receiveTagset->GetTagSetID (), index}); break; - } + } default: LogPrint (eLogWarning, "Garlic: Unknown block type ", (int)blk); } @@ -242,6 +246,37 @@ namespace garlic } } + void ECIESX25519AEADRatchetSession::HandleNextKey (const uint8_t * buf, size_t len, const std::shared_ptr& receiveTagset) + { + uint8_t flag = buf[0]; buf++; // flag + if (flag & ECIESX25519_NEXT_KEY_REVERSE_KEY_FLAG) + { + // TODO: implement + } + else + { + uint16_t keyID = bufbe16toh (buf); buf += 2; // keyID + if (flag & ECIESX25519_NEXT_KEY_KEY_PRESENT_FLAG) + { + i2p::crypto::X25519Keys k; + k.GenerateKeys (); + uint8_t sharedSecret[32], tagsetKey[32]; + k.Agree (buf, sharedSecret); + i2p::crypto::HKDF (sharedSecret, nullptr, 0, "XDHRatchetTagSet", tagsetKey, 32); // tagsetKey = HKDF(sharedSecret, ZEROLEN, "XDHRatchetTagSet", 32) + auto newTagset = std::make_shared(shared_from_this ()); + newTagset->SetTagSetID (1 + keyID + m_ReceiveKeyID); + newTagset->DHInitialize (receiveTagset->GetNextRootKey (), tagsetKey); + newTagset->NextSessionTagRatchet (); + GenerateMoreReceiveTags (newTagset, GetOwner ()->GetNumTags ()); + m_ReverseKeys.push_back ({m_ReceiveKeyID, k.GetPublicKey ()}); + m_ReceiveKeyID++; + LogPrint (eLogDebug, "Garlic: next receive tagset ", newTagset->GetTagSetID (), " created"); + } + else + LogPrint (eLogWarning, "Garlic: Missing next key"); + } + } + bool ECIESX25519AEADRatchetSession::NewOutgoingSessionMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen) { ResetKeys (); @@ -325,13 +360,13 @@ namespace garlic uint8_t keydata[64]; i2p::crypto::HKDF (m_CK, nullptr, 0, "", keydata); // keydata = HKDF(chainKey, ZEROLEN, "", 64) // k_ab = keydata[0:31], k_ba = keydata[32:63] - m_ReceiveTagset = std::make_shared(shared_from_this ()); - m_ReceiveTagset->DHInitialize (m_CK, keydata); // tagset_ab = DH_INITIALIZE(chainKey, k_ab) - m_ReceiveTagset->NextSessionTagRatchet (); + auto receiveTagset = std::make_shared(shared_from_this ()); + receiveTagset->DHInitialize (m_CK, keydata); // tagset_ab = DH_INITIALIZE(chainKey, k_ab) + receiveTagset->NextSessionTagRatchet (); m_SendTagset = std::make_shared(shared_from_this ()); m_SendTagset->DHInitialize (m_CK, keydata + 32); // tagset_ba = DH_INITIALIZE(chainKey, k_ba) m_SendTagset->NextSessionTagRatchet (); - GenerateMoreReceiveTags (GetOwner ()->GetNumTags ()); + GenerateMoreReceiveTags (receiveTagset, GetOwner ()->GetNumTags ()); i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", m_NSRKey, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32) // encrypt payload if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + offset, len + 16, true)) // encrypt @@ -397,10 +432,10 @@ namespace garlic m_SendTagset = std::make_shared(shared_from_this ()); m_SendTagset->DHInitialize (m_CK, keydata); // tagset_ab = DH_INITIALIZE(chainKey, k_ab) m_SendTagset->NextSessionTagRatchet (); - m_ReceiveTagset = std::make_shared(shared_from_this ()); - m_ReceiveTagset->DHInitialize (m_CK, keydata + 32); // tagset_ba = DH_INITIALIZE(chainKey, k_ba) - m_ReceiveTagset->NextSessionTagRatchet (); - GenerateMoreReceiveTags (GetOwner ()->GetNumTags ()); + auto receiveTagset = std::make_shared(shared_from_this ()); + receiveTagset->DHInitialize (m_CK, keydata + 32); // tagset_ba = DH_INITIALIZE(chainKey, k_ba) + receiveTagset->NextSessionTagRatchet (); + GenerateMoreReceiveTags (receiveTagset, GetOwner ()->GetNumTags ()); i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", keydata, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32) // decrypt payload std::vector payload (len - 16); @@ -412,7 +447,7 @@ namespace garlic m_State = eSessionStateEstablished; GetOwner ()->AddECIESx25519Session (m_RemoteStaticKey, shared_from_this ()); - HandlePayload (payload.data (), len - 16); + HandlePayload (payload.data (), len - 16, nullptr, 0); // we have received reply to NS with LeaseSet in it SetLeaseSetUpdateStatus (eLeaseSetUpToDate); @@ -440,26 +475,28 @@ namespace garlic return true; } - bool ECIESX25519AEADRatchetSession::HandleExistingSessionMessage (const uint8_t * buf, size_t len, int index) + bool ECIESX25519AEADRatchetSession::HandleExistingSessionMessage (const uint8_t * buf, size_t len, + std::shared_ptr receiveTagset, int index) { uint8_t nonce[12]; CreateNonce (index, nonce); // tag's index len -= 8; // tag std::vector payload (len - 16); uint8_t key[32]; - m_ReceiveTagset->GetSymmKey (index, key); + receiveTagset->GetSymmKey (index, key); if (!i2p::crypto::AEADChaCha20Poly1305 (buf + 8, len - 16, buf, 8, key, nonce, payload.data (), len - 16, false)) // decrypt { LogPrint (eLogWarning, "Garlic: Payload section AEAD decryption failed"); return false; } - HandlePayload (payload.data (), len - 16, index); - if (m_ReceiveTagset->GetNextIndex () - index <= GetOwner ()->GetNumTags ()*2/3) - GenerateMoreReceiveTags (GetOwner ()->GetNumTags ()); + HandlePayload (payload.data (), len - 16, receiveTagset, index); + if (receiveTagset->GetNextIndex () - index <= GetOwner ()->GetNumTags ()*2/3) + GenerateMoreReceiveTags (receiveTagset, GetOwner ()->GetNumTags ()); return true; } - bool ECIESX25519AEADRatchetSession::HandleNextMessage (const uint8_t * buf, size_t len, int index) + bool ECIESX25519AEADRatchetSession::HandleNextMessage (const uint8_t * buf, size_t len, + std::shared_ptr receiveTagset, int index) { m_LastActivityTimestamp = i2p::util::GetSecondsSinceEpoch (); switch (m_State) @@ -470,7 +507,7 @@ namespace garlic [[fallthrough]]; #endif case eSessionStateEstablished: - return HandleExistingSessionMessage (buf, len, index); + return HandleExistingSessionMessage (buf, len, receiveTagset, index); case eSessionStateNew: return HandleNewIncomingSession (buf, len); case eSessionStateNewSessionSent: @@ -543,6 +580,8 @@ namespace garlic } if (m_AckRequests.size () > 0) payloadLen += m_AckRequests.size ()*4 + 3; + if (m_ReverseKeys.size () > 0) + payloadLen += m_ReverseKeys.size ()*(3 + 35); uint8_t paddingSize; RAND_bytes (&paddingSize, 1); paddingSize &= 0x0F; paddingSize++; // 1 - 16 @@ -583,6 +622,18 @@ namespace garlic } m_AckRequests.clear (); } + // next keys + if (m_ReverseKeys.size () > 0) + { + for (auto& it: m_ReverseKeys) + { + v[offset] = eECIESx25519BlkNextKey; offset++; + htobe16buf (v.data () + offset, 35); offset += 2; + v[offset] = ECIESX25519_NEXT_KEY_KEY_PRESENT_FLAG | ECIESX25519_NEXT_KEY_REVERSE_KEY_FLAG; offset++; // flag + htobe16buf (v.data () + offset, it.first); offset += 2; // keyid + memcpy (v.data () + offset, it.second, 32); offset += 32; // public key + } + } // padding v[offset] = eECIESx25519BlkPadding; offset++; htobe16buf (v.data () + offset, paddingSize); offset += 2; @@ -647,10 +698,10 @@ namespace garlic return cloveSize + 3; } - void ECIESX25519AEADRatchetSession::GenerateMoreReceiveTags (int numTags) + void ECIESX25519AEADRatchetSession::GenerateMoreReceiveTags (std::shared_ptr receiveTagset, int numTags) { for (int i = 0; i < numTags; i++) - GetOwner ()->AddECIESx25519SessionNextTag (m_ReceiveTagset); + GetOwner ()->AddECIESx25519SessionNextTag (receiveTagset); } bool ECIESX25519AEADRatchetSession::CheckExpired (uint64_t ts) diff --git a/libi2pd/ECIESX25519AEADRatchetSession.h b/libi2pd/ECIESX25519AEADRatchetSession.h index 3798d34b..354b8d74 100644 --- a/libi2pd/ECIESX25519AEADRatchetSession.h +++ b/libi2pd/ECIESX25519AEADRatchetSession.h @@ -27,10 +27,13 @@ namespace garlic void DHInitialize (const uint8_t * rootKey, const uint8_t * k); void NextSessionTagRatchet (); uint64_t GetNextSessionTag (); + const uint8_t * GetNextRootKey () const { return m_NextRootKey; }; int GetNextIndex () const { return m_NextIndex; }; void GetSymmKey (int index, uint8_t * key); std::shared_ptr GetSession () { return m_Session.lock (); }; + int GetTagSetID () const { return m_TagSetID; }; + void SetTagSetID (int tagsetID) { m_TagSetID = tagsetID; }; private: @@ -44,10 +47,11 @@ namespace garlic uint64_t GetTag () const { return ll[4]; }; // tag = keydata[32:39] } m_KeyData; - uint8_t m_SessTagConstant[32], m_SymmKeyCK[32], m_CurrentSymmKeyCK[64]; + uint8_t m_SessTagConstant[32], m_SymmKeyCK[32], m_CurrentSymmKeyCK[64], m_NextRootKey[32]; int m_NextIndex, m_NextSymmKeyIndex; std::unordered_map > m_ItermediateSymmKeys; std::weak_ptr m_Session; + int m_TagSetID = 0; }; enum ECIESx25519BlockType @@ -56,14 +60,17 @@ namespace garlic eECIESx25519BlkSessionID = 1, eECIESx25519BlkTermination = 4, eECIESx25519BlkOptions = 5, - eECIESx25519BlkNextSessionKey = 7, + eECIESx25519BlkNextKey = 7, eECIESx25519BlkAck = 8, eECIESx25519BlkAckRequest = 9, eECIESx25519BlkGalicClove = 11, eECIESx25519BlkPadding = 254 }; - + const uint8_t ECIESX25519_NEXT_KEY_KEY_PRESENT_FLAG = 0x01; + const uint8_t ECIESX25519_NEXT_KEY_REVERSE_KEY_FLAG = 0x02; + const uint8_t ECIESX25519_NEXT_KEY_REQUEST_REVERSE_KEY_FLAG = 0x04; + const int ECIESX25519_RESTART_TIMEOUT = 120; // number of second of inactivity we should restart after const int ECIESX25519_EXPIRATION_TIMEOUT = 600; // in seconds @@ -83,7 +90,7 @@ namespace garlic ECIESX25519AEADRatchetSession (GarlicDestination * owner, bool attachLeaseSet); ~ECIESX25519AEADRatchetSession (); - bool HandleNextMessage (const uint8_t * buf, size_t len, int index = 0); + bool HandleNextMessage (const uint8_t * buf, size_t len, std::shared_ptr receiveTagset, int index = 0); std::shared_ptr WrapSingleMessage (std::shared_ptr msg); const uint8_t * GetRemoteStaticKey () const { return m_RemoteStaticKey; } @@ -107,9 +114,10 @@ namespace garlic bool HandleNewIncomingSession (const uint8_t * buf, size_t len); bool HandleNewOutgoingSessionReply (const uint8_t * buf, size_t len); - bool HandleExistingSessionMessage (const uint8_t * buf, size_t len, int index); - void HandlePayload (const uint8_t * buf, size_t len, int index = 0); - + bool HandleExistingSessionMessage (const uint8_t * buf, size_t len, std::shared_ptr receiveTagset, int index); + void HandlePayload (const uint8_t * buf, size_t len, const std::shared_ptr& receiveTagset, int index); + void HandleNextKey (const uint8_t * buf, size_t len, const std::shared_ptr& receiveTagset); + bool NewOutgoingSessionMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen); bool NewSessionReplyMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen); bool NextNewSessionReplyMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen); @@ -119,7 +127,7 @@ namespace garlic size_t CreateGarlicClove (std::shared_ptr msg, uint8_t * buf, size_t len, bool isDestination = false); size_t CreateDeliveryStatusClove (std::shared_ptr msg, uint8_t * buf, size_t len); - void GenerateMoreReceiveTags (int numTags); + void GenerateMoreReceiveTags (std::shared_ptr receiveTagset, int numTags); private: @@ -129,10 +137,12 @@ namespace garlic i2p::crypto::X25519Keys m_EphemeralKeys; SessionState m_State = eSessionStateNew; uint64_t m_LastActivityTimestamp = 0; // incoming - std::shared_ptr m_SendTagset, m_ReceiveTagset; + std::shared_ptr m_SendTagset; + int m_SendKeyID = 0, m_ReceiveKeyID = 0; std::unique_ptr m_Destination;// TODO: might not need it std::list > m_AckRequests; // (tagsetid, index) - }; + std::list > > m_ReverseKeys; // (keyid, public key) + }; std::shared_ptr WrapECIESX25519AEADRatchetMessage (std::shared_ptr msg, const uint8_t * key, uint64_t tag); } diff --git a/libi2pd/Garlic.cpp b/libi2pd/Garlic.cpp index d10c48cb..f0e3c10e 100644 --- a/libi2pd/Garlic.cpp +++ b/libi2pd/Garlic.cpp @@ -499,7 +499,7 @@ namespace garlic { found = true; auto session = it1->second.tagset->GetSession (); - if (!session || !session->HandleNextMessage (buf, length, it1->second.index)) + if (!session || !session->HandleNextMessage (buf, length, it1->second.tagset, it1->second.index)) LogPrint (eLogError, "Garlic: can't handle ECIES-X25519-AEAD-Ratchet message"); m_ECIESx25519Tags.erase (it1); } @@ -524,7 +524,7 @@ namespace garlic { // otherwise ECIESx25519 auto session = std::make_shared (this, false); // incoming - if (!session->HandleNextMessage (buf, length, 0)) + if (!session->HandleNextMessage (buf, length, nullptr, 0)) LogPrint (eLogError, "Garlic: can't handle ECIES-X25519-AEAD-Ratchet message"); } else