noise-ruby 0.10.0 → 0.11.0

data/lib/noise/pattern.rb

@@ -2,26 +2,125 @@
 
 module Noise
   module Token
-    E = 'e'
-    S = 's'
-    EE = 'ee'
-    ES = 'es'
-    SE = 'se'
-    SS = 'ss'
-    PSK = 'psk'
+    class TokenE
+      def to_s
+        'e'
+      end
+    end
+
+    class TokenS
+      def to_s
+        's'
+      end
+    end
+
+    class TokenDH
+      def mix(symmetric_state, dh_fn, initiator, keypair)
+        private_key, public_key = get_key(keypair, initiator)
+        symmetric_state.mix_key(dh_fn.dh(private_key, public_key))
+      end
+    end
+
+    class TokenEE < TokenDH
+      def get_key(keypair, _initiator)
+        [keypair.e.private_key, keypair.re]
+      end
+
+      def to_s
+        'ee'
+      end
+    end
+
+    class TokenES < TokenDH
+      def get_key(keypair, initiator)
+        initiator ? [keypair.e.private_key, keypair.rs] : [keypair.s.private_key, keypair.re]
+      end
+
+      def to_s
+        'es'
+      end
+    end
+
+    class TokenSE < TokenDH
+      def get_key(keypair, initiator)
+        initiator ? [keypair.s.private_key, keypair.re] : [keypair.e.private_key, keypair.rs]
+      end
+
+      def to_s
+        'se'
+      end
+    end
+
+    class TokenSS < TokenDH
+      def get_key(keypair, _initiator)
+        [keypair.s.private_key, keypair.rs]
+      end
+
+      def to_s
+        'ss'
+      end
+    end
+
+    class TokenPSK
+      def to_s
+        'psk'
+      end
+    end
+
+    E = TokenE.new
+    S = TokenS.new
+    EE = TokenEE.new
+    ES = TokenES.new
+    SE = TokenSE.new
+    SS = TokenSS.new
+    PSK = TokenPSK.new
+  end
+
+  module Modifier
+    class Psk
+      attr_reader :index
+
+      def initialize(index)
+        @index = index
+      end
+    end
+
+    class Fallback
+    end
+
+    PSK_REGEX = /\Apsk(\d+)\z/
+
+    def self.parse(s)
+      matched = PSK_REGEX.match(s)
+      return Modifier::Psk.new(matched[1].to_i) if matched
+      return Modifier::Fallback.new if s == 'fallback'
+
+      raise Noise::Exceptions::UnsupportedModifierError, "Unsupported modifier: #{s}"
+    end
   end
 
   class Pattern
-    attr_reader :tokens, :modifiers, :psk_count, :fallback
+    attr_reader :name, :tokens, :modifiers, :psk_count, :fallback
+
+    NAME_REGEX = /\A([A-Z1]+)([^A-Z]*)\z/
 
     def self.create(name)
-      pattern_set = name.scan(/([A-Z1]+)([^A-Z]*)/)&.first
-      pattern = pattern_set&.first
-      modifiers = pattern_set[1].split('+')
-      class_name = "Noise::Pattern#{pattern}"
-      klass = Object.const_get(class_name)
-      klass.new(modifiers)
+      matched = NAME_REGEX.match(name)
+      raise Noise::Exceptions::ProtocolNameError, "Malformed pattern name: #{name}" unless matched
+
+      modifiers = matched[2].split('+').map { |s| Modifier.parse(s) }
+      pattern_class(matched[1]).new(modifiers)
+    end
+
+    def self.pattern_class(pattern)
+      klass = Object.const_get("Noise::Pattern#{pattern}")
+      raise NameError unless klass.is_a?(Class) && klass < Pattern
+
+      klass
+    rescue NameError
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported pattern: #{pattern}"
     end
+    private_class_method :pattern_class
 
     def initialize(modifiers)
       @pre_messages = [[], []]
@@ -31,11 +130,17 @@ module Noise
       @modifiers = modifiers
     end
 
+    def psk?
+      modifiers.any? { |m| m.is_a? Modifier::Psk }
+    end
+
     def apply_pattern_modifiers
       @modifiers.each do |modifier|
-        if modifier.start_with?('psk')
-          index = modifier.gsub(/psk/, '').to_i
-          raise Noise::Exceptions::PSKValueError if index / 2 > @tokens.size
+        case modifier
+        when Modifier::Psk
+          index = modifier.index
+          # psk0 prepends to the first message, pskN appends to the Nth one.
+          raise Noise::Exceptions::PSKValueError if index > @tokens.size
 
           if index.zero?
             @tokens[0].insert(0, Token::PSK)
@@ -43,10 +148,8 @@ module Noise
             @tokens[index - 1] << Token::PSK
           end
           @psk_count += 1
-        elsif modifier == 'fallback'
+        when Modifier::Fallback
           @fallback = true
-        else
-          raise Noise::Exceptions::UnsupportedModifierError
         end
       end
     end
@@ -58,24 +161,48 @@ module Noise
 
     def required_keypairs_of_initiator
       required = []
-      required << :s if %w[K X I].include?(@name[0])
-      required << :rs if one_way? || @name[1] == 'K'
+      required << :s if initiator_static?
+      required << :rs if responder_static_pre_shared?
       required
     end
 
     def required_keypairs_of_responder
       required = []
-      required << :rs if @name[0] == 'K'
-      required << :s if one_way? || %w[K X].include?(@name[1])
+      required << :rs if initiator_static_pre_shared?
+      required << :s if responder_static?
       required
     end
 
     def initiator_pre_messages
-      @pre_messages[0].dup
+      (@pre_messages[0] || []).dup
     end
 
     def responder_pre_messages
-      @pre_messages[1].dup
+      (@pre_messages[1] || []).dup
+    end
+
+    # A party needs a static keypair when its static public key is either pre-shared with the peer or
+    # transmitted during the handshake. Deriving this from the pattern itself keeps deferred patterns
+    # (whose names carry a '1', e.g. X1K) working, unlike inspecting single characters of the name.
+    def initiator_static?
+      initiator_static_pre_shared? || sends_static?(0)
+    end
+
+    def responder_static?
+      responder_static_pre_shared? || sends_static?(1)
+    end
+
+    def initiator_static_pre_shared?
+      initiator_pre_messages.include?(Token::S)
+    end
+
+    def responder_static_pre_shared?
+      responder_pre_messages.include?(Token::S)
+    end
+
+    # The initiator writes the messages at even indexes, the responder the ones at odd indexes.
+    def sends_static?(offset)
+      offset.step(@tokens.size - 1, 2).any? { |i| @tokens[i].include?(Token::S) }
     end
 
     def one_way?
@@ -84,10 +211,6 @@ module Noise
   end
 
   class OneWayPattern < Pattern
-    def initialize(modifiers)
-      super(modifiers)
-    end
-
     def one_way?
       true
     end

data/lib/noise/protocol.rb

@@ -2,32 +2,35 @@
 
 module Noise
   class Protocol
-    attr_accessor :is_psk_handshake
     attr_accessor :cipher_fn, :hash_fn, :dh_fn, :hkdf_fn
     attr_reader :name, :pattern
 
     CIPHER = {
-      'AESGCM': Noise::Functions::Cipher::AesGcm,
-      'ChaChaPoly': Noise::Functions::Cipher::ChaChaPoly
-    }.stringify_keys.freeze
+      'AESGCM' => Noise::Functions::Cipher::AesGcm,
+      'ChaChaPoly' => Noise::Functions::Cipher::ChaChaPoly
+    }.freeze
 
     DH = {
-      '25519': Noise::Functions::DH::ED25519,
-      '448': Noise::Functions::DH::ED448,
-      'secp256k1': Noise::Functions::DH::Secp256k1
-    }.stringify_keys.freeze
+      '25519' => Noise::Functions::DH::ED25519,
+      '448' => Noise::Functions::DH::ED448,
+      'secp256k1' => Noise::Functions::DH::Secp256k1
+    }.freeze
 
     HASH = {
-      'BLAKE2b': Noise::Functions::Hash::Blake2b,
-      'BLAKE2s': Noise::Functions::Hash::Blake2s,
-      'SHA256': Noise::Functions::Hash::Sha256,
-      'SHA512': Noise::Functions::Hash::Sha512,
-      'BLAKE3': Noise::Functions::Hash::Blake3,
-    }.stringify_keys.freeze
+      'BLAKE2b' => Noise::Functions::Hash::Blake2b,
+      'BLAKE2s' => Noise::Functions::Hash::Blake2s,
+      'SHA256' => Noise::Functions::Hash::Sha256,
+      'SHA512' => Noise::Functions::Hash::Sha512,
+      'BLAKE3' => Noise::Functions::Hash::Blake3
+    }.freeze
 
     def self.create(name)
-      prefix, pattern_name, dh_name, cipher_name, hash_name = name.split('_')
-      raise Noise::Exceptions::ProtocolNameError if prefix != 'Noise'
+      parts = name.split('_')
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" unless parts.size == 5
+
+      prefix, pattern_name, dh_name, cipher_name, hash_name = parts
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" if prefix != 'Noise'
+
       new(name, pattern_name, cipher_name, hash_name, dh_name)
     end
 
@@ -35,8 +38,6 @@ module Noise
       @name = name
       @pattern = Noise::Pattern.create(pattern_name)
       @hkdf_fn = Noise::Functions::Hash.create_hkdf_fn(hash_name)
-      @is_psk_handshake = @pattern.modifiers.any? { |m| m.start_with?('psk') }
-
       @pattern.apply_pattern_modifiers
 
       initialize_fn!(cipher_name, hash_name, dh_name)
@@ -46,11 +47,12 @@ module Noise
       @cipher_fn = CIPHER[cipher_name]&.new
       @hash_fn = HASH[hash_name]&.new
       @dh_fn = DH[dh_name]&.new
-      raise Noise::Exceptions::ProtocolNameError unless @cipher_fn && @hash_fn && @dh_fn
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported function in: #{@name}" unless
+        @cipher_fn && @hash_fn && @dh_fn
     end
 
-    def psk_handshake?
-      @is_psk_handshake
+    def psk?
+      @pattern.psk?
     end
   end
 end

data/lib/noise/state/cipher_state.rb

@@ -10,10 +10,11 @@ module Noise
     #
     class CipherState
       MAX_NONCE = 2**64 - 1
+      TAG_LENGTH = 16
 
       attr_reader :k, :n
 
-      def initialize(cipher: AesGcm.new)
+      def initialize(cipher:)
         @cipher = cipher
       end
 
@@ -36,6 +37,7 @@ module Noise
       def encrypt_with_ad(ad, plaintext)
         return plaintext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+
         ciphertext = @cipher.encrypt(@k, @n, ad, plaintext)
         @n += 1
         ciphertext
@@ -45,6 +47,10 @@ module Noise
       def decrypt_with_ad(ad, ciphertext)
         return ciphertext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+        # Without this the ciphers slice a nil authentication tag out of the truncated input.
+        raise Noise::Exceptions::DecryptError, 'Ciphertext is shorter than the tag.' if
+          ciphertext.bytesize < TAG_LENGTH
+
         plaintext = @cipher.decrypt(@k, @n, ad, ciphertext)
         @n += 1
         plaintext

data/lib/noise/state/handshake_state.rb

@@ -17,48 +17,63 @@ module Noise
     # message_patterns: A sequence of message patterns.
     #     Each message pattern is a sequence of tokens from the set ("e", "s", "ee", "es", "se", "ss").
     class HandshakeState
-      attr_reader :message_patterns, :symmetric_state
-      attr_reader :s, :rs, :e, :re
+      attr_reader :message_patterns, :symmetric_state, :s, :rs, :e, :re
 
-      def initialize(connection, protocol, initiator, prologue, local_keypairs, remote_keys)
+      def initialize(connection, initiator, prologue, local_keypairs, remote_keys)
         @connection = connection
-        @protocol = protocol
-        @symmetric_state = SymmetricState.new
-        @symmetric_state.initialize_symmetric(@protocol, connection)
-        @symmetric_state.mix_hash(prologue)
+        @protocol = connection.protocol
+        @symmetric_state = SymmetricState.initialize_symmetric(@protocol, connection, prologue: prologue)
         @initiator = initiator
         @s = local_keypairs[:s]
         @e = local_keypairs[:e]
         @rs = remote_keys[:rs]
         @re = remote_keys[:re]
 
-        get_local_keypair = ->(token) { instance_variable_get('@' + token).public_key }
-        get_remote_keypair = ->(token) { instance_variable_get('@r' + token) }
+        initiator_keypair_getter, responder_keypair_getter = get_keypair_getter(initiator)
 
+        # Sets message_patterns to the message patterns from handshake_pattern. The inner arrays are
+        # copied too, so consuming them here can never reach back into the shared Pattern.
+        @message_patterns = @protocol.pattern.tokens.map(&:dup)
+
+        process_initiator_pre_messages(initiator_keypair_getter)
+        process_fallback(initiator_keypair_getter)
+        process_responder_pre_messages(responder_keypair_getter)
+      end
+
+      def get_keypair_getter(initiator)
         if initiator
-          initiator_keypair_getter = get_local_keypair
-          responder_keypair_getter = get_remote_keypair
+          [local_keypair_getter, remote_keypair_getter]
         else
-          initiator_keypair_getter = get_remote_keypair
-          responder_keypair_getter = get_local_keypair
+          [remote_keypair_getter, local_keypair_getter]
         end
+      end
+
+      def local_keypair_getter
+        ->(token) { instance_variable_get("@#{token}").public_key }
+      end
 
-        # Sets message_patterns to the message patterns from handshake_pattern
-        @message_patterns = @protocol.pattern.tokens.dup
+      def remote_keypair_getter
+        ->(token) { instance_variable_get("@r#{token}") }
+      end
 
+      def process_initiator_pre_messages(keypair_getter)
         @protocol.pattern.initiator_pre_messages&.map do |token|
-          keypair = initiator_keypair_getter.call(token)
+          keypair = keypair_getter.call(token)
           @symmetric_state.mix_hash(keypair)
         end
+      end
 
-        if @protocol.pattern.fallback
-          message = @message_patterns.delete_at(0).first
-          public_key = initiator_keypair_getter.call(message)
-          @symmetric_state.mix_hash(public_key)
-        end
+      def process_fallback(initiator_keypair_getter)
+        return unless @protocol.pattern.fallback
 
+        message = @message_patterns.delete_at(0).first
+        public_key = initiator_keypair_getter.call(message)
+        @symmetric_state.mix_hash(public_key)
+      end
+
+      def process_responder_pre_messages(keypair_getter)
         @protocol.pattern.responder_pre_messages&.map do |token|
-          keypair = responder_keypair_getter.call(token)
+          keypair = keypair_getter.call(token)
           @symmetric_state.mix_hash(keypair)
         end
       end
@@ -68,13 +83,13 @@ module Noise
         pattern = @message_patterns.first
         len = pattern.inject(0) do |l, token|
           case token
-          when 'e'
+          when Noise::Token::E
             l += @protocol.dh_fn.dhlen
-            has_key = true if @protocol.psk_handshake?
-          when 's'
+            has_key = true if @protocol.psk?
+          when Noise::Token::S
             l += @protocol.dh_fn.dhlen
             l += 16 if has_key
-          when 'ee', 'es', 'se', 'ss', 'psk'
+          else
             has_key = true
           end
           l
@@ -85,71 +100,83 @@ module Noise
       end
 
       # Takes a payload byte sequence which may be zero-length, and a message_buffer to write the output into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def write_message(payload, message_buffer)
         pattern = @message_patterns.shift
-        dh_fn = @protocol.dh_fn
 
         pattern.each do |token|
           case token
-          when 'e'
-            @e = dh_fn.generate_keypair if @e.nil?
+          when Noise::Token::E
+            @e ||= @protocol.dh_fn.generate_keypair
             message_buffer << @e.public_key
-            @symmetric_state.mix_hash(@e.public_key)
-            @symmetric_state.mix_key(@e.public_key) if @protocol.psk_handshake?
-          when 's'
+            mix_e(@e.public_key)
+          when Noise::Token::S
             message_buffer << @symmetric_state.encrypt_and_hash(@s.public_key)
-          when 'ee'
-            @symmetric_state.mix_key(dh_fn.dh(@e.private_key, @re))
-          when 'es'
-            private_key, public_key = @initiator ? [@e.private_key, @rs] : [@s.private_key, @re]
-            @symmetric_state.mix_key(dh_fn.dh(private_key, public_key))
-          when 'se'
-            private_key, public_key = @initiator ? [@s.private_key, @re] : [@e.private_key, @rs]
-            @symmetric_state.mix_key(dh_fn.dh(private_key, public_key))
-          when 'ss'
-            @symmetric_state.mix_key(dh_fn.dh(@s.private_key, @rs))
-          when 'psk'
-            @symmetric_state.mix_key_and_hash(@connection.psks.shift)
+          when Noise::Token::EE, Noise::Token::ES, Noise::Token::SE, Noise::Token::SS
+            token.mix(@symmetric_state, @protocol.dh_fn, @initiator, self)
+          when Noise::Token::PSK
+            mix_psk
           end
         end
         message_buffer << @symmetric_state.encrypt_and_hash(payload)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
       end
 
       # Takes a byte sequence containing a Noise handshake message,
       # and a payload_buffer to write the message's plaintext payload into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def read_message(message, payload_buffer)
         pattern = @message_patterns.shift
-        dh_fn = @protocol.dh_fn
-        len = dh_fn.dhlen
         pattern.each do |token|
           case token
-          when 'e'
-            @re = message[0...len] if @re.nil?
-            message = message[len..-1]
-            @symmetric_state.mix_hash(@re)
-            @symmetric_state.mix_key(@re) if @protocol.psk_handshake?
-          when 's'
-            offset = @connection.cipher_state_handshake.key? ? 16 : 0
-            temp = message[0...len + offset]
-            message = message[(len + offset)..-1]
-            @rs = @symmetric_state.decrypt_and_hash(temp)
-          when 'ee'
-            @symmetric_state.mix_key(dh_fn.dh(@e.private_key, @re))
-          when 'es'
-            private_key, public_key = @initiator ? [@e.private_key, @rs] : [@s.private_key, @re]
-            @symmetric_state.mix_key(dh_fn.dh(private_key, public_key))
-          when 'se'
-            private_key, public_key = @initiator ? [@s.private_key, @re] : [@e.private_key, @rs]
-            @symmetric_state.mix_key(dh_fn.dh(private_key, public_key))
-          when 'ss'
-            @symmetric_state.mix_key(dh_fn.dh(@s.private_key, @rs))
-          when 'psk'
-            @symmetric_state.mix_key_and_hash(@connection.psks.shift)
+          when Noise::Token::E
+            message, @re = extract_key(message, false)
+            mix_e(@re)
+          when Noise::Token::S
+            message, @rs = extract_key(message, true)
+          when Noise::Token::EE, Noise::Token::ES, Noise::Token::SE, Noise::Token::SS
+            token.mix(@symmetric_state, @protocol.dh_fn, @initiator, self)
+          when Noise::Token::PSK
+            mix_psk
           end
         end
         payload_buffer << @symmetric_state.decrypt_and_hash(message)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
+      end
+
+      private
+
+      # Splits into the transport cipher states once every message pattern has been processed.
+      def finish_handshake
+        return false unless @message_patterns.empty?
+
+        @symmetric_state.split
+        true
+      end
+
+      def extract_key(message, is_encrypted)
+        len = @protocol.dh_fn.dhlen
+        offset =
+          if is_encrypted && @connection.cipher_state_handshake.key?
+            16
+          else
+            0
+          end
+        raise Noise::Exceptions::NoiseHandshakeError, 'Message is too short.' if message.bytesize < len + offset
+
+        key = message[0...len + offset]
+        message = message[(len + offset)..]
+        key = @symmetric_state.decrypt_and_hash(key) if is_encrypted
+        [message, key]
+      end
+
+      def mix_e(public_key)
+        @symmetric_state.mix_hash(public_key)
+        @symmetric_state.mix_key(public_key) if @protocol.psk?
+      end
+
+      def mix_psk
+        @symmetric_state.mix_key_and_hash(@connection.psks.shift)
       end
     end
   end

data/lib/noise/state/symmetric_state.rb

@@ -8,10 +8,9 @@ module Noise
     # - h: A hash output of HASHLEN bytes.
     #
     class SymmetricState
-      attr_reader :h, :ck
-      attr_reader :cipher_state
+      attr_reader :h, :ck, :cipher_state
 
-      def initialize_symmetric(protocol, connection)
+      def initialize(protocol, connection)
         @protocol = protocol
         @connection = connection
         @ck = @h = initialize_h(protocol)
@@ -20,6 +19,10 @@ module Noise
         @cipher_state.initialize_key(nil)
       end
 
+      def self.initialize_symmetric(protocol, connection, prologue: nil)
+        new(protocol, connection).tap { |s| s.mix_hash(prologue) if prologue }
+      end
+
       def mix_key(input_key_meterial)
         @ck, temp_k = @protocol.hkdf_fn.call(@ck, input_key_meterial, 2)
         temp_k = truncate(temp_k)

data/lib/noise/utils/string.rb

@@ -1,11 +1,25 @@
 # frozen_string_literal: true
 
-class String
-  def htb
-    [self].pack('H*')
-  end
+module Noise
+  module Utils
+    # Hex conversion helpers. Offered as a refinement so that requiring this gem does not add methods
+    # to String for the whole process.
+    #
+    #   using Noise::Utils::HexString
+    #   '0102'.htb     # => "\x01\x02"
+    #   "\x01\x02".bth # => "0102"
+    module HexString
+      refine ::String do
+        # hex to binary
+        def htb
+          [self].pack('H*')
+        end
 
-  def bth
-    unpack('H*').first
+        # binary to hex
+        def bth
+          unpack1('H*')
+        end
+      end
+    end
   end
 end

data/lib/noise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Noise
-  VERSION = '0.10.0'
+  VERSION = '0.11.0'
 end

data/lib/noise.rb

@@ -3,11 +3,11 @@
 require 'noise/version'
 
 require 'ecdsa'
+require 'logger'
 require 'rbnacl'
 require 'ruby_hmac'
 require 'securerandom'
 
-require 'noise/utils/hash'
 require 'noise/utils/string'
 
 module Noise
@@ -19,4 +19,30 @@ module Noise
   autoload :Exceptions, 'noise/exceptions'
   autoload :Functions, 'noise/functions'
   autoload :State, 'noise/state'
+
+  # Some DH and hash functions are backed by a gem, and often a system library, that is only needed
+  # when the function appears in a protocol name. Loading one is therefore allowed to fail; the
+  # failure is remembered and reported by optional_dependency! when the function is used.
+  @unavailable_dependencies = {}
+
+  class << self
+    def logger
+      @logger ||= Logger.new($stdout)
+    end
+
+    def require_optional(name)
+      require name
+      yield if block_given?
+    rescue LoadError => e
+      @unavailable_dependencies[name] = e.message
+      logger.warn("Optional dependency '#{name}' is unavailable: #{e.message}")
+    end
+
+    def optional_dependency!(name)
+      reason = @unavailable_dependencies[name]
+      return if reason.nil?
+
+      raise Noise::Exceptions::MissingDependencyError, "'#{name}' could not be loaded: #{reason}"
+    end
+  end
 end