diff --git a/build/CMakeLists.txt b/build/CMakeLists.txt index a9cf3a83..2577fb1b 100644 --- a/build/CMakeLists.txt +++ b/build/CMakeLists.txt @@ -83,6 +83,7 @@ set (LIBI2PD_SRC "${LIBI2PD_SRC_DIR}/NTCP2.cpp" "${LIBI2PD_SRC_DIR}/Blinding.cpp" "${LIBI2PD_SRC_DIR}/Elligator.cpp" + "${LIBI2PD_SRC_DIR}/ECIESX25519AEADRatchetSession.cpp" ) if (WITH_WEBSOCKETS) diff --git a/libi2pd/ECIESX25519AEADRatchetSession.cpp b/libi2pd/ECIESX25519AEADRatchetSession.cpp new file mode 100644 index 00000000..a258e8f7 --- /dev/null +++ b/libi2pd/ECIESX25519AEADRatchetSession.cpp @@ -0,0 +1,160 @@ +#include +#include +#include "Log.h" +#include "Crypto.h" +#include "Elligator.h" +#include "Tag.h" +#include "I2PEndian.h" +#include "Garlic.h" +#include "ECIESX25519AEADRatchetSession.h" + +namespace i2p +{ +namespace garlic +{ + + ECIESX25519AEADRatchetSession::ECIESX25519AEADRatchetSession () + { + // TODO : use precalculated hashes + static const char protocolName[41] = "Noise_IKelg2+hs2_25519_ChaChaPoly_SHA256"; // 40 bytes + SHA256 ((const uint8_t *)protocolName, 40, m_H); + memcpy (m_CK, m_H, 32); + SHA256 (m_H, 32, m_H); + } + + ECIESX25519AEADRatchetSession::~ECIESX25519AEADRatchetSession () + { + } + + void ECIESX25519AEADRatchetSession::MixHash (const uint8_t * buf, size_t len) + { + SHA256_CTX ctx; + SHA256_Init (&ctx); + SHA256_Update (&ctx, m_H, 32); + SHA256_Update (&ctx, buf, len); + SHA256_Final (m_H, &ctx); + } + + bool ECIESX25519AEADRatchetSession::NewIncomingSession (const i2p::data::LocalDestination& dest, + const uint8_t * buf, size_t len, CloveI2NPMsgHandler handleCloveI2NPMsg) + { + // we are Bob + // KDF1 + MixHash (dest.GetEncryptionPublicKey (), 32); // h = SHA256(h || bpk) + + uint8_t aepk[32]; // Alice's ephemeral key + if (!i2p::crypto::GetElligator ()->Decode (buf, aepk)) + { + LogPrint (eLogError, "Garlic: Can't decode elligator"); + return false; + } + buf += 32; len -= 32; + MixHash (aepk, 32); // h = SHA256(h || aepk) + + uint8_t sharedSecret[32], keyData[64]; + dest.Decrypt (aepk, sharedSecret, nullptr); // x25519(bsk, aepk) + i2p::crypto::HKDF (m_CK, sharedSecret, 32, "", keyData); // keydata = HKDF(chainKey, sharedSecret, "", 64) + memcpy (m_CK, keyData, 32); // chainKey = keydata[0:31] + + // decrypt flags/static + uint8_t nonce[12], fs[32]; + memset (nonce, 0, 12); // n = 0 + if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 32, m_H, 32, keyData + 32, nonce, fs, 32, false)) // decrypt + { + LogPrint (eLogWarning, "Garlic: Flags/static section AEAD verification failed "); + return false; + } + MixHash (buf, 48); // h = SHA256(h || ciphertext) + buf += 48; len -= 48; // 32 data + 16 poly + + // decrypt payload + std::vector payload (len - 16); + // KDF2 for payload + bool isStatic = !i2p::data::Tag<32> (fs).IsZero (); + if (isStatic) + { + // static key, fs is apk + dest.Decrypt (fs, sharedSecret, nullptr); // x25519(bsk, apk) + i2p::crypto::HKDF (m_CK, sharedSecret, 32, "", keyData); // keydata = HKDF(chainKey, sharedSecret, "", 64) + memcpy (m_CK, keyData, 32); // chainKey = keydata[0:31] + } + else // all zeros flags + htole64buf (nonce + 4, 1); // n = 1 + if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, m_H, 32, keyData + 32, nonce, payload.data (), len - 16, false)) // decrypt + { + LogPrint (eLogWarning, "Garlic: Payload section AEAD verification failed"); + return false; + } + if (isStatic) MixHash (buf, len); // h = SHA256(h || ciphertext) + + HandlePayload (payload.data (), len - 16, handleCloveI2NPMsg); + + return true; + } + + void ECIESX25519AEADRatchetSession::HandlePayload (const uint8_t * buf, size_t len, CloveI2NPMsgHandler& handleCloveI2NPMsg) + { + size_t offset = 0; + while (offset < len) + { + uint8_t blk = buf[offset]; + offset++; + auto size = bufbe16toh (buf + offset); + offset += 2; + LogPrint (eLogDebug, "Garlic: Block type ", (int)blk, " of size ", size); + if (size > len) + { + LogPrint (eLogError, "Garlic: Unexpected block length ", size); + break; + } + switch (blk) + { + case eECIESx25519BlkGalicClove: + HandleClove (buf + offset, size, handleCloveI2NPMsg); + break; + case eECIESx25519BlkDateTime: + LogPrint (eLogDebug, "Garlic: datetime"); + break; + case eECIESx25519BlkOptions: + LogPrint (eLogDebug, "Garlic: options"); + break; + case eECIESx25519BlkPadding: + LogPrint (eLogDebug, "NTCP2: padding"); + break; + default: + LogPrint (eLogWarning, "Garlic: Unknown block type ", (int)blk); + } + offset += size; + } + } + + void ECIESX25519AEADRatchetSession::HandleClove (const uint8_t * buf, size_t len, CloveI2NPMsgHandler& handleCloveI2NPMsg) + { + const uint8_t * buf1 = buf; + uint8_t flag = buf[0]; buf++; // flag + GarlicDeliveryType deliveryType = (GarlicDeliveryType)((flag >> 5) & 0x03); + switch (deliveryType) + { + case eGarlicDeliveryTypeDestination: + buf += 32; // TODO: check destination + // no break here + case eGarlicDeliveryTypeLocal: + { + uint8_t typeID = buf[0]; buf++; // typeid + buf += (4 + 4); // msgID + expiration + ptrdiff_t offset = buf - buf1; + if (offset <= (int)len) + handleCloveI2NPMsg (typeID, buf, len - offset); + else + LogPrint (eLogError, "Garlic: clove is too long"); + break; + } + // TODO: tunnel + default: + LogPrint (eLogWarning, "Garlic: unexpected delivery type ", (int)deliveryType); + } + } +} +} + + diff --git a/libi2pd/ECIESX25519AEADRatchetSession.h b/libi2pd/ECIESX25519AEADRatchetSession.h new file mode 100644 index 00000000..dd28c669 --- /dev/null +++ b/libi2pd/ECIESX25519AEADRatchetSession.h @@ -0,0 +1,49 @@ +#ifndef ECIES_X25519_AEAD_RATCHET_SESSION_H__ +#define ECIES_X25519_AEAD_RATCHET_SESSION_H__ + +#include +#include +#include "Identity.h" + +namespace i2p +{ +namespace garlic +{ + enum ECIESx25519BlockType + { + eECIESx25519BlkDateTime = 0, + eECIESx25519BlkSessionID = 1, + eECIESx25519BlkTermination = 4, + eECIESx25519BlkOptions = 5, + eECIESx25519BlkNextSessionKey = 7, + eECIESx25519BlkGalicClove = 11, + eECIESx25519BlkPadding = 254 + }; + + class ECIESX25519AEADRatchetSession + { + public: + + typedef std::function CloveI2NPMsgHandler; + + ECIESX25519AEADRatchetSession (); + ~ECIESX25519AEADRatchetSession (); + + bool NewIncomingSession (const i2p::data::LocalDestination& dest, const uint8_t * buf, size_t len, + CloveI2NPMsgHandler handleCloveI2NPMsg); + + private: + + void MixHash (const uint8_t * buf, size_t len); + + void HandlePayload (const uint8_t * buf, size_t len, CloveI2NPMsgHandler& handleCloveI2NPMsg); + void HandleClove (const uint8_t * buf, size_t len, CloveI2NPMsgHandler& handleCloveI2NPMsg); + + private: + + uint8_t m_H[32], m_CK[32]; + }; +} +} + +#endif diff --git a/libi2pd/Garlic.cpp b/libi2pd/Garlic.cpp index 740b213b..de8d6944 100644 --- a/libi2pd/Garlic.cpp +++ b/libi2pd/Garlic.cpp @@ -1,10 +1,8 @@ #include -#include #include "I2PEndian.h" #include #include #include "Crypto.h" -#include "Elligator.h" #include "RouterContext.h" #include "I2NPProtocol.h" #include "Tunnel.h" @@ -13,6 +11,7 @@ #include "Timestamp.h" #include "Log.h" #include "FS.h" +#include "ECIESX25519AEADRatchetSession.h" #include "Garlic.h" namespace i2p @@ -833,129 +832,12 @@ namespace garlic void GarlicDestination::HandleECIESx25519 (const uint8_t * buf, size_t len) { - // KDF1 - // TODO : use precalculated hashes - static const char protocolName[41] = "Noise_IKelg2+hs2_25519_ChaChaPoly_SHA256"; // 40 bytes - uint8_t h[80], ck[32]; - SHA256 ((const uint8_t *)protocolName, 40, h); - memcpy (ck, h, 32); - SHA256 (h, 32, h); - // we are Bob - memcpy (h + 32, GetEncryptionPublicKey (), 32); - SHA256 (h, 64, h); // h = SHA256(h || bpk) - - uint8_t aepk[32]; - if (!i2p::crypto::GetElligator ()->Decode (buf, aepk)) - { - LogPrint (eLogError, "Garlic: Can't decode elligator"); - return; - } - buf += 32; len -= 32; - memcpy (h + 32, aepk, 32); - SHA256 (h, 64, h); // h = SHA256(h || aepk) - - uint8_t sharedSecret[32], keyData[64]; - Decrypt (aepk, sharedSecret, m_Ctx); // x25519(bsk, aepk) - i2p::crypto::HKDF (ck, sharedSecret, 32, "", keyData); // keydata = HKDF(chainKey, sharedSecret, "", 64) - memcpy (ck, keyData, 32); // chainKey = keydata[0:31] - - // decrypt flags/static - uint8_t nonce[12], fs[32]; - memset (nonce, 0, 12); // n = 0 - if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 32, h, 32, keyData + 32, nonce, fs, 32, false)) // decrypt - { - LogPrint (eLogWarning, "Garlic: Flags/static section AEAD verification failed "); - return; - } - memcpy (h + 32, buf, 48); - SHA256 (h, 80, h); // h = SHA256(h || ciphertext) - buf += 48; len -= 48; // 32 data + 16 poly - // decrypt payload - std::vector payload (len + 32); uint8_t h1[32]; - // KDF2 for payload - bool isStatic = !i2p::data::Tag<32> (fs).IsZero (); - if (isStatic) - { - // static key, fs is apk - Decrypt (fs, sharedSecret, m_Ctx); // x25519(bsk, apk) - i2p::crypto::HKDF (ck, sharedSecret, 32, "", keyData); // keydata = HKDF(chainKey, sharedSecret, "", 64) - memcpy (ck, keyData, 32); // chainKey = keydata[0:31] - memcpy (payload.data (), h, 32); - memcpy (payload.data () + 32, buf, len); // h || ciphertext - SHA256 (payload.data (), len + 32, h1); - } - else // all zeros flags - htole64buf (nonce + 4, 1); // n = 1 - if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, h, 32, keyData + 32, nonce, payload.data () + 32, len - 16, false)) // decrypt - { - LogPrint (eLogWarning, "Garlic: Payload section AEAD verification failed"); - return; - } - if (isStatic) memcpy (h, h1, 32); // h = SHA256(h || ciphertext) - HandleECIESx25519Payload (payload.data () + 32, len - 16); - } - - void GarlicDestination::HandleECIESx25519Payload (const uint8_t * buf, size_t len) - { - size_t offset = 0; - while (offset < len) - { - uint8_t blk = buf[offset]; - offset++; - auto size = bufbe16toh (buf + offset); - offset += 2; - LogPrint (eLogDebug, "Garlic: Block type ", (int)blk, " of size ", size); - if (size > len) - { - LogPrint (eLogError, "Garlic: Unexpected block length ", size); - break; - } - switch (blk) - { - case eECIESx25519BlkGalicClove: - HandleECIESx25519GarlicClove (buf + offset, size); - break; - case eECIESx25519BlkDateTime: - LogPrint (eLogDebug, "Garlic: datetime"); - break; - case eECIESx25519BlkOptions: - LogPrint (eLogDebug, "Garlic: options"); - break; - case eECIESx25519BlkPadding: - LogPrint (eLogDebug, "NTCP2: padding"); - break; - default: - LogPrint (eLogWarning, "Garlic: Unknown block type ", (int)blk); - } - offset += size; - } - } - - void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len) - { - const uint8_t * buf1 = buf; - uint8_t flag = buf[0]; buf++; // flag - GarlicDeliveryType deliveryType = (GarlicDeliveryType)((flag >> 5) & 0x03); - switch (deliveryType) - { - case eGarlicDeliveryTypeDestination: - buf += 32; // TODO: check destination - // no break here - case eGarlicDeliveryTypeLocal: - { - uint8_t typeID = buf[0]; buf++; // typeid - buf += (4 + 4); // msgID + expiration - ptrdiff_t offset = buf - buf1; - if (offset <= (int)len) - HandleCloveI2NPMessage (typeID, buf, len - offset); - else - LogPrint (eLogError, "Garlic: clove is too long"); - break; - } - // TODO: tunnel - default: - LogPrint (eLogWarning, "Garlic: unexpected delivery type ", (int)deliveryType); - } + ECIESX25519AEADRatchetSession session; + session.NewIncomingSession (*this, buf, len, + [this](uint8_t typeID, const uint8_t * payload, size_t len) + { + HandleCloveI2NPMessage (typeID, payload,len); + }); } } } diff --git a/libi2pd/Garlic.h b/libi2pd/Garlic.h index 6acfce95..44ab2e82 100644 --- a/libi2pd/Garlic.h +++ b/libi2pd/Garlic.h @@ -165,17 +165,6 @@ namespace garlic //using GarlicRoutingSessionPtr = std::shared_ptr; typedef std::shared_ptr GarlicRoutingSessionPtr; // TODO: replace to using after switch to 4.8 - enum ECIESx25519BlockType - { - eECIESx25519BlkDateTime = 0, - eECIESx25519BlkSessionID = 1, - eECIESx25519BlkTermination = 4, - eECIESx25519BlkOptions = 5, - eECIESx25519BlkNextSessionKey = 7, - eECIESx25519BlkGalicClove = 11, - eECIESx25519BlkPadding = 254 - }; - class GarlicDestination: public i2p::data::LocalDestination { public: @@ -220,8 +209,6 @@ namespace garlic // ECIES-X25519-AEAD-Ratchet void HandleECIESx25519 (const uint8_t * buf, size_t len); - void HandleECIESx25519Payload (const uint8_t * buf, size_t len); - void HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len); private: