session tag for ECIESx25519 sessions

libi2pd/ECIESX25519AEADRatchetSession.cpp

@@ -18,20 +18,20 @@ namespace garlic
         uint8_t keydata[64];
         i2p::crypto::HKDF (rootKey, k, 32, "KDFDHRatchetStep", keydata); // keydata = HKDF(rootKey, k, "KDFDHRatchetStep", 64)
         // nextRootKey = keydata[0:31]
-        i2p::crypto::HKDF (keydata + 32, nullptr, 0, "TagAndKeyGenKeys", m_CK); 
-        // ck = [sessTag_ck, symmKey_ck] = HKDF(keydata[32:63], ZEROLEN, "TagAndKeyGenKeys", 64) 
+        i2p::crypto::HKDF (keydata + 32, nullptr, 0, "TagAndKeyGenKeys", m_KeyData.buf); 
+        // [sessTag_ck, symmKey_ck] = HKDF(keydata[32:63], ZEROLEN, "TagAndKeyGenKeys", 64) 
     }
 
     void RatchetTagSet::NextSessionTagRatchet ()
     {
-        i2p::crypto::HKDF (m_CK, nullptr, 0, "STInitialization", m_CK); // [ck, sesstag_constant] = HKDF(sessTag_ck, ZEROLEN, "STInitialization", 64)
-        memcpy (m_SessTagConstant, m_CK + 32, 32);
+        i2p::crypto::HKDF (m_KeyData.GetSessTagCK (), nullptr, 0, "STInitialization", m_KeyData.buf); // [sessTag_ck, sesstag_constant] = HKDF(sessTag_ck, ZEROLEN, "STInitialization", 64)
+        memcpy (m_SessTagConstant, m_KeyData.GetSessTagConstant (), 32);
     }
 
-    const uint8_t * RatchetTagSet::GetNextSessionTag ()
+    uint64_t RatchetTagSet::GetNextSessionTag ()
     {
-         i2p::crypto::HKDF (m_CK, m_SessTagConstant, 32, "SessionTagKeyGen", m_CK); // [ck, tag] = HKDF(sessTag_chainkey, SESSTAG_CONSTANT, "SessionTagKeyGen", 64)
-        return m_CK + 32;
+         i2p::crypto::HKDF (m_KeyData.GetSessTagCK (), m_SessTagConstant, 32, "SessionTagKeyGen", m_KeyData.buf); // [sessTag_ck, tag] = HKDF(sessTag_chainkey, SESSTAG_CONSTANT, "SessionTagKeyGen", 64)
+        return m_KeyData.GetTag ();
     }
 
 
@@ -60,7 +60,7 @@ namespace garlic
 	
     bool ECIESX25519AEADRatchetSession::GenerateEphemeralKeysAndEncode (uint8_t * buf)
     {
-        for (int i = 0; i < 5; i++)
+        for (int i = 0; i < 10; i++)
         {
             m_EphemeralKeys.GenerateKeys ();    
             if (i2p::crypto::GetElligator ()->Encode (m_EphemeralKeys.GetPublicKey (), buf))
@@ -69,6 +69,17 @@ namespace garlic
         return false;
     }
 
+    uint64_t ECIESX25519AEADRatchetSession::CreateNewSessionTag () const
+    {
+        uint8_t tagsetKey[32];    
+        i2p::crypto::HKDF (m_CK, nullptr, 0, "SessionReplyTags", tagsetKey, 32); // tagsetKey = HKDF(chainKey, ZEROLEN, "SessionReplyTags", 32)
+         // Session Tag Ratchet
+        RatchetTagSet tagsetNsr;
+        tagsetNsr.DHInitialize (m_CK, tagsetKey); // tagset_nsr = DH_INITIALIZE(chainKey, tagsetKey)
+        tagsetNsr.NextSessionTagRatchet ();
+        return tagsetNsr.GetNextSessionTag ();   
+    }
+
     bool ECIESX25519AEADRatchetSession::NewIncomingSession (const uint8_t * buf, size_t len,  CloveHandler handleClove)
     {
         if (!GetOwner ()) return false;
@@ -200,23 +211,19 @@ namespace garlic
 		}
 		MixHash (out + offset, 16); // h = SHA256(h || ciphertext)
 
+        if (GetOwner ())
+            GetOwner ()->AddECIESx25519SessionTag (CreateNewSessionTag (), shared_from_this ());   		
+
         return true;
     }
 
     bool ECIESX25519AEADRatchetSession::NewSessionReplyMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen)
     {
         // we are Bob
-        uint8_t tagsetKey[32];    
-        i2p::crypto::HKDF (m_CK, nullptr, 0, "SessionReplyTags", tagsetKey, 32); // tagsetKey = HKDF(chainKey, ZEROLEN, "SessionReplyTags", 32)
-
-        // Session Tag Ratchet
-        RatchetTagSet tagsetNsr;
-        tagsetNsr.DHInitialize (m_CK, tagsetKey); // tagset_nsr = DH_INITIALIZE(chainKey, tagsetKey)
-        tagsetNsr.NextSessionTagRatchet ();
-        auto tag = tagsetNsr.GetNextSessionTag ();   
+        uint64_t tag = CreateNewSessionTag ();   
     
         size_t offset = 0;
-        memcpy (out + offset, tag, 8);
+        memcpy (out + offset, &tag, 8);
         offset += 8;
         if (!GenerateEphemeralKeysAndEncode (out + offset)) // bepk
 		{ 
@@ -225,7 +232,7 @@ namespace garlic
 		}         
         offset += 32;      
         // KDF for  Reply Key Section
-        MixHash (tag, 8); // h = SHA256(h || tag)
+        MixHash ((const uint8_t *)&tag, 8); // h = SHA256(h || tag)
         MixHash (m_EphemeralKeys.GetPublicKey (), 32); // h = SHA256(h || bepk)
         uint8_t sharedSecret[32];      
         m_EphemeralKeys.Agree (m_RemoteStaticKey, sharedSecret); // sharedSecret = x25519(besk, aepk)     
@@ -257,6 +264,12 @@ namespace garlic
         return true;
     }
 
+    bool ECIESX25519AEADRatchetSession::NewOutgoingSessionReply (const uint8_t * buf, size_t len, CloveHandler handleClove)
+    {
+        // TODO    
+        return true;
+    }
+
     std::shared_ptr<I2NPMessage> ECIESX25519AEADRatchetSession::WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg)
     { 
         auto m = NewI2NPMessage ();

libi2pd/ECIESX25519AEADRatchetSession.h

@@ -4,6 +4,7 @@
 #include <string.h>
 #include <inttypes.h>
 #include <functional>
+#include <memory>
 #include <vector>
 #include "Identity.h"
 #include "Crypto.h"
@@ -19,11 +20,21 @@ namespace garlic
             
             void DHInitialize (const uint8_t * rootKey, const uint8_t * k);
             void NextSessionTagRatchet ();
-            const uint8_t * GetNextSessionTag ();
+            uint64_t GetNextSessionTag ();
 
         private:
         
-           uint8_t m_CK[64], m_SessTagConstant[32];   
+           union
+           {
+               uint64_t ll[8]; 
+               uint8_t buf[64];
+
+               const uint8_t * GetSessTagCK () const { return buf; }; // sessTag_chainKey = keydata[0:31]
+               const uint8_t * GetSessTagConstant () const { return buf + 32; }; // SESSTAG_CONSTANT = keydata[32:63] 
+               uint64_t GetTag () const { return ll[4]; }; // tag = keydata[32:39]            
+             
+           } m_KeyData;  
+           uint8_t m_SessTagConstant[32];   
     };       
 
     enum ECIESx25519BlockType
@@ -37,7 +48,7 @@ namespace garlic
 		eECIESx25519BlkPadding = 254	
 	};	
 
-    class ECIESX25519AEADRatchetSession: public GarlicRoutingSession
+    class ECIESX25519AEADRatchetSession: public GarlicRoutingSession, public std::enable_shared_from_this<ECIESX25519AEADRatchetSession>
     {
         enum SessionState
         {
@@ -55,6 +66,7 @@ namespace garlic
             std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg);
 
             bool NewIncomingSession (const uint8_t * buf, size_t len, CloveHandler handleClove);
+            bool NewOutgoingSessionReply (const uint8_t * buf, size_t len, CloveHandler handleClove);
             const uint8_t * GetRemoteStaticKey () const { return m_RemoteStaticKey; }
 			void SetRemoteStaticKey (const uint8_t * key) { memcpy (m_RemoteStaticKey, key, 32); }
 
@@ -62,6 +74,7 @@ namespace garlic
 
             void MixHash (const uint8_t * buf, size_t len);
             bool GenerateEphemeralKeysAndEncode (uint8_t * buf); // buf is 32 bytes
+            uint64_t CreateNewSessionTag () const;
 
             void HandlePayload (const uint8_t * buf, size_t len,  CloveHandler& handleClove);
 

libi2pd/Garlic.cpp

@@ -860,16 +860,34 @@ namespace garlic
 	}
 
 	void GarlicDestination::HandleECIESx25519 (const uint8_t * buf, size_t len)
+	{
+        auto handleClove = std::bind (&GarlicDestination::HandleECIESx25519GarlicClove,
+            this, std::placeholders::_1, std::placeholders::_2);
+        uint64_t tag;
+        memcpy (&tag, buf, 8);
+        auto it = m_ECIESx25519Tags.find (tag);
+		if (it != m_ECIESx25519Tags.end ())
+        {
+            // TODO
+            auto session = it->second;
+            if (!session->NewOutgoingSessionReply (buf, len, handleClove))
+            {
+                LogPrint (eLogError, "Garlic: can't decrypt ECIES-X25519-AEAD-Ratchet new session reply");
+                m_ECIESx25519Tags.erase (tag);
+                m_ECIESx25519Sessions.erase (session->GetRemoteStaticKey ());
+            }
+        }
+        else
         {
             auto session = std::make_shared<ECIESX25519AEADRatchetSession> (this);
-        if (session->NewIncomingSession (buf, len, std::bind (&GarlicDestination::HandleECIESx25519GarlicClove,
-            this, std::placeholders::_1, std::placeholders::_2)))
+            if (session->NewIncomingSession (buf, len, handleClove))
             {
                 m_ECIESx25519Sessions.emplace (session->GetRemoteStaticKey (), session);
             }
             else
                  LogPrint (eLogError, "Garlic: can't decrypt ECIES-X25519-AEAD-Ratchet new session");
         }
+	}
 
     void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len)
     {   
@@ -926,5 +944,10 @@ namespace garlic
 				LogPrint (eLogWarning, "Garlic: unexpected delivery type ", (int)deliveryType);
 		} 
     }
+
+    void GarlicDestination::AddECIESx25519SessionTag (uint64_t tag, ECIESX25519AEADRatchetSessionPtr session)
+    {
+        m_ECIESx25519Tags.emplace (tag, session);
+    }
 }
 }

libi2pd/Garlic.h

@@ -217,6 +217,7 @@ namespace garlic
 			void AddSessionKey (const uint8_t * key, const uint8_t * tag); // one tag
 			virtual bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag); // from different thread
 			void DeliveryStatusSent (ElGamalAESSessionPtr session, uint32_t msgID);
+            void AddECIESx25519SessionTag (uint64_t tag, ECIESX25519AEADRatchetSessionPtr session);
 
 			virtual void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg);
 			virtual void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg);
@@ -252,9 +253,10 @@ namespace garlic
 			int m_NumTags;
 			std::mutex m_SessionsMutex;
 			std::map<i2p::data::IdentHash, ElGamalAESSessionPtr> m_Sessions;
-            std::map<i2p::data::Tag<32>, ECIESX25519AEADRatchetSessionPtr > m_ECIESx25519Sessions; // static key -> session
+            std::map<i2p::data::Tag<32>, ECIESX25519AEADRatchetSessionPtr> m_ECIESx25519Sessions; // static key -> session
 			// incoming
 			std::map<SessionTag, std::shared_ptr<AESDecryption> > m_Tags;
+            std::map<uint64_t, ECIESX25519AEADRatchetSessionPtr> m_ECIESx25519Tags; // session tag -> session
 			// DeliveryStatus
 			std::mutex m_DeliveryStatusSessionsMutex;
 			std::map<uint32_t, ElGamalAESSessionPtr> m_DeliveryStatusSessions; // msgID -> session