noise-ruby 0.10.1 → 0.12.0

data/lib/noise/functions/dh/secp256k1.rb

@@ -1,11 +1,19 @@
 # frozen_string_literal: true
 
-require_force 'secp256k1'
+Noise.require_optional 'secp256k1'
 
 module Noise
   module Functions
     module DH
       class Secp256k1
+        # Length of a compressed secp256k1 point. libsecp256k1 also accepts the 65-byte
+        # uncompressed form, but Noise exchanges only the compressed one.
+        DHLEN = 33
+
+        def initialize
+          Noise.optional_dependency!('secp256k1')
+        end
+
         def generate_keypair
           group = ECDSA::Group::Secp256k1
           private_key = 1 + SecureRandom.random_number(group.order - 1)
@@ -16,15 +24,24 @@ module Noise
           )
         end
 
+        # Computes the ECDH shared secret for the given remote public key.
+        #
+        # A point that is not on the curve makes libsecp256k1 raise Secp256k1::AssertError,
+        # while a public key of any other length raises ArgumentError before the point is
+        # even parsed. Both are translated to InvalidPublicKeyError, matching the other DH
+        # functions. The length is checked here rather than left to the gem so that
+        # ArgumentError raised for a malformed private key keeps propagating as itself.
         def dh(private_key, public_key)
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
+
           key = ::Secp256k1::PublicKey.new(pubkey: public_key, raw: true)
           key.ecdh(private_key)
-        rescue ::Secp256k1::AssertError => _
+        rescue ::Secp256k1::AssertError
           raise Noise::Exceptions::InvalidPublicKeyError, public_key
         end
 
         def dhlen
-          33
+          DHLEN
         end
 
         def self.from_private(private_key)

data/lib/noise/functions/hash/blake2s.rb

@@ -60,6 +60,7 @@ module Noise
         # @return context
         def init(out_len, key)
           raise ArgumentError if out_len.zero? || out_len > 32
+
           h = IV.dup
           h[0] ^= 0x01010000 ^ (key.size << 8) ^ out_len
           t = 0
@@ -168,6 +169,7 @@ module Noise
 
         class Context
           attr_accessor :b, :h, :t, :c, :out_len
+
           def initialize(b, h, t, c, out_len)
             @b = b
             @h = h

data/lib/noise/functions/hash/blake3.rb

@@ -1,13 +1,18 @@
 # frozen_string_literal: true
 
-require_force 'blake3'
+Noise.require_optional 'blake3'
 
 module Noise
   module Functions
     module Hash
       class Blake3
-        HASHLEN = 64
-        BLOCKLEN = 128
+        HASHLEN = 32
+        BLOCKLEN = 64
+
+        def initialize
+          Noise.optional_dependency!('blake3')
+        end
+
         def hash(data)
           ::Blake3.digest(data)
         end

data/lib/noise/functions/hash.rb

@@ -10,14 +10,17 @@ module Noise
       autoload :Blake3, 'noise/functions/hash/blake3'
 
       def self.hmac_hash(key, data, digest)
-        if digest.include?('SHA')
+        case digest
+        when /SHA/
           OpenSSL::HMAC.digest(OpenSSL::Digest.new(digest), key, data)
-        elsif digest.include?('BLAKE2b')
+        when /BLAKE2b/
           Noise::Functions::Hash::Blake2bHMAC.new(key).update(data).digest
-        elsif digest.include?('BLAKE2s')
+        when /BLAKE2s/
           Noise::Functions::Hash::Blake2sHMAC.new(key).update(data).digest
-        elsif digest.include?('BLAKE3')
+        when /BLAKE3/
           Noise::Functions::Hash::Blake3HMAC.new(key).update(data).digest
+        else
+          raise Noise::Exceptions::ProtocolNameError, "Unsupported hash function: #{digest}"
         end
       end
 
@@ -30,9 +33,10 @@ module Noise
       def self.hkdf(chaining_key, input_key_material, num_outputs, digest)
         temp_key = hmac_hash(chaining_key, input_key_material, digest)
         output1 = hmac_hash(temp_key, "\x01", digest)
-        output2 = hmac_hash(temp_key, output1 + "\x02", digest)
+        output2 = hmac_hash(temp_key, "#{output1}\u0002", digest)
         return [output1, output2] if num_outputs == 2
-        output3 = hmac_hash(temp_key, output2 + "\x03", digest)
+
+        output3 = hmac_hash(temp_key, "#{output2}\u0003", digest)
         [output1, output2, output3]
       end
     end

data/lib/noise/pattern.rb

@@ -50,6 +50,7 @@ module Noise
         'se'
       end
     end
+
     class TokenSS < TokenDH
       def get_key(keypair, _initiator)
         [keypair.s.private_key, keypair.rs]
@@ -59,6 +60,7 @@ module Noise
         'ss'
       end
     end
+
     class TokenPSK
       def to_s
         'psk'
@@ -77,6 +79,7 @@ module Noise
   module Modifier
     class Psk
       attr_reader :index
+
       def initialize(index)
         @index = index
       end
@@ -85,29 +88,39 @@ module Noise
     class Fallback
     end
 
+    PSK_REGEX = /\Apsk(\d+)\z/
+
     def self.parse(s)
-      if s.start_with?('psk')
-        index = s.gsub(/psk/, '').to_i
-        Modifier::Psk.new(index)
-      elsif s == 'fallback'
-        Modifier::Fallback.new
-      else
-        raise Noise::Exceptions::UnsupportedModifierError
-      end
+      matched = PSK_REGEX.match(s)
+      return Modifier::Psk.new(matched[1].to_i) if matched
+      return Modifier::Fallback.new if s == 'fallback'
+
+      raise Noise::Exceptions::UnsupportedModifierError, "Unsupported modifier: #{s}"
     end
   end
 
   class Pattern
-    attr_reader :tokens, :modifiers, :psk_count, :fallback
+    attr_reader :name, :tokens, :modifiers, :psk_count, :fallback
+
+    NAME_REGEX = /\A([A-Z1]+)([^A-Z]*)\z/
 
     def self.create(name)
-      pattern_set = name.scan(/([A-Z1]+)([^A-Z]*)/)&.first
-      pattern = pattern_set&.first
-      modifiers = pattern_set[1].split('+').map { |s| Modifier.parse(s) }
-      class_name = "Noise::Pattern#{pattern}"
-      klass = Object.const_get(class_name)
-      klass.new(modifiers)
+      matched = NAME_REGEX.match(name)
+      raise Noise::Exceptions::ProtocolNameError, "Malformed pattern name: #{name}" unless matched
+
+      modifiers = matched[2].split('+').map { |s| Modifier.parse(s) }
+      pattern_class(matched[1]).new(modifiers)
+    end
+
+    def self.pattern_class(pattern)
+      klass = Object.const_get("Noise::Pattern#{pattern}")
+      raise NameError unless klass.is_a?(Class) && klass < Pattern
+
+      klass
+    rescue NameError
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported pattern: #{pattern}"
     end
+    private_class_method :pattern_class
 
     def initialize(modifiers)
       @pre_messages = [[], []]
@@ -126,7 +139,8 @@ module Noise
         case modifier
         when Modifier::Psk
           index = modifier.index
-          raise Noise::Exceptions::PSKValueError if index / 2 > @tokens.size
+          # psk0 prepends to the first message, pskN appends to the Nth one.
+          raise Noise::Exceptions::PSKValueError if index > @tokens.size
 
           if index.zero?
             @tokens[0].insert(0, Token::PSK)
@@ -147,24 +161,48 @@ module Noise
 
     def required_keypairs_of_initiator
       required = []
-      required << :s if %w[K X I].include?(@name[0])
-      required << :rs if one_way? || @name[1] == 'K'
+      required << :s if initiator_static?
+      required << :rs if responder_static_pre_shared?
       required
     end
 
     def required_keypairs_of_responder
       required = []
-      required << :rs if @name[0] == 'K'
-      required << :s if one_way? || %w[K X].include?(@name[1])
+      required << :rs if initiator_static_pre_shared?
+      required << :s if responder_static?
       required
     end
 
     def initiator_pre_messages
-      @pre_messages[0].dup
+      (@pre_messages[0] || []).dup
     end
 
     def responder_pre_messages
-      @pre_messages[1].dup
+      (@pre_messages[1] || []).dup
+    end
+
+    # A party needs a static keypair when its static public key is either pre-shared with the peer or
+    # transmitted during the handshake. Deriving this from the pattern itself keeps deferred patterns
+    # (whose names carry a '1', e.g. X1K) working, unlike inspecting single characters of the name.
+    def initiator_static?
+      initiator_static_pre_shared? || sends_static?(0)
+    end
+
+    def responder_static?
+      responder_static_pre_shared? || sends_static?(1)
+    end
+
+    def initiator_static_pre_shared?
+      initiator_pre_messages.include?(Token::S)
+    end
+
+    def responder_static_pre_shared?
+      responder_pre_messages.include?(Token::S)
+    end
+
+    # The initiator writes the messages at even indexes, the responder the ones at odd indexes.
+    def sends_static?(offset)
+      offset.step(@tokens.size - 1, 2).any? { |i| @tokens[i].include?(Token::S) }
     end
 
     def one_way?
@@ -173,10 +211,6 @@ module Noise
   end
 
   class OneWayPattern < Pattern
-    def initialize(modifiers)
-      super(modifiers)
-    end
-
     def one_way?
       true
     end

data/lib/noise/protocol.rb

@@ -6,27 +6,31 @@ module Noise
     attr_reader :name, :pattern
 
     CIPHER = {
-      'AESGCM': Noise::Functions::Cipher::AesGcm,
-      'ChaChaPoly': Noise::Functions::Cipher::ChaChaPoly
-    }.stringify_keys.freeze
+      'AESGCM' => Noise::Functions::Cipher::AesGcm,
+      'ChaChaPoly' => Noise::Functions::Cipher::ChaChaPoly
+    }.freeze
 
     DH = {
-      '25519': Noise::Functions::DH::ED25519,
-      '448': Noise::Functions::DH::ED448,
-      'secp256k1': Noise::Functions::DH::Secp256k1
-    }.stringify_keys.freeze
+      '25519' => Noise::Functions::DH::ED25519,
+      '448' => Noise::Functions::DH::ED448,
+      'secp256k1' => Noise::Functions::DH::Secp256k1
+    }.freeze
 
     HASH = {
-      'BLAKE2b': Noise::Functions::Hash::Blake2b,
-      'BLAKE2s': Noise::Functions::Hash::Blake2s,
-      'SHA256': Noise::Functions::Hash::Sha256,
-      'SHA512': Noise::Functions::Hash::Sha512,
-      'BLAKE3': Noise::Functions::Hash::Blake3
-    }.stringify_keys.freeze
+      'BLAKE2b' => Noise::Functions::Hash::Blake2b,
+      'BLAKE2s' => Noise::Functions::Hash::Blake2s,
+      'SHA256' => Noise::Functions::Hash::Sha256,
+      'SHA512' => Noise::Functions::Hash::Sha512,
+      'BLAKE3' => Noise::Functions::Hash::Blake3
+    }.freeze
 
     def self.create(name)
-      prefix, pattern_name, dh_name, cipher_name, hash_name = name.split('_')
-      raise Noise::Exceptions::ProtocolNameError if prefix != 'Noise'
+      parts = name.split('_')
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" unless parts.size == 5
+
+      prefix, pattern_name, dh_name, cipher_name, hash_name = parts
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" if prefix != 'Noise'
+
       new(name, pattern_name, cipher_name, hash_name, dh_name)
     end
 
@@ -43,7 +47,8 @@ module Noise
       @cipher_fn = CIPHER[cipher_name]&.new
       @hash_fn = HASH[hash_name]&.new
       @dh_fn = DH[dh_name]&.new
-      raise Noise::Exceptions::ProtocolNameError unless @cipher_fn && @hash_fn && @dh_fn
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported function in: #{@name}" unless
+        @cipher_fn && @hash_fn && @dh_fn
     end
 
     def psk?

data/lib/noise/state/cipher_state.rb

@@ -10,10 +10,11 @@ module Noise
     #
     class CipherState
       MAX_NONCE = 2**64 - 1
+      TAG_LENGTH = 16
 
       attr_reader :k, :n
 
-      def initialize(cipher: AesGcm.new)
+      def initialize(cipher:)
         @cipher = cipher
       end
 
@@ -28,7 +29,17 @@ module Noise
         !@k.nil?
       end
 
+      # Sets n, the nonce the next encrypt_with_ad or decrypt_with_ad call uses. This is SetNonce()
+      # of the Noise spec, needed to decrypt transport messages that arrive out of order.
+      #
+      # The value is checked here because the ciphers pack n into 8 bytes: a value outside the
+      # unsigned 64-bit range silently produces a wrong nonce instead of an error.
+      #
+      # @param [Integer] nonce a value between 0 and MAX_NONCE.
+      # @raise [Noise::Exceptions::InvalidNonceError] if nonce is out of that range.
       def nonce=(nonce)
+        raise Noise::Exceptions::InvalidNonceError unless nonce.is_a?(Integer) && nonce.between?(0, MAX_NONCE)
+
         @n = nonce
       end
 
@@ -36,6 +47,7 @@ module Noise
       def encrypt_with_ad(ad, plaintext)
         return plaintext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+
         ciphertext = @cipher.encrypt(@k, @n, ad, plaintext)
         @n += 1
         ciphertext
@@ -45,11 +57,18 @@ module Noise
       def decrypt_with_ad(ad, ciphertext)
         return ciphertext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+        # Without this the ciphers slice a nil authentication tag out of the truncated input.
+        raise Noise::Exceptions::DecryptError, 'Ciphertext is shorter than the tag.' if
+          ciphertext.bytesize < TAG_LENGTH
+
         plaintext = @cipher.decrypt(@k, @n, ad, ciphertext)
         @n += 1
         plaintext
       end
 
+      # Replaces k with REKEY(k). n is left as it is, as the Noise spec requires.
+      #
+      # @return [String] the new 32 bytes key.
       def rekey
         @k = @cipher.rekey(@k)
       end

data/lib/noise/state/handshake_state.rb

@@ -17,8 +17,7 @@ module Noise
     # message_patterns: A sequence of message patterns.
     #     Each message pattern is a sequence of tokens from the set ("e", "s", "ee", "es", "se", "ss").
     class HandshakeState
-      attr_reader :message_patterns, :symmetric_state
-      attr_reader :s, :rs, :e, :re
+      attr_reader :message_patterns, :symmetric_state, :s, :rs, :e, :re
 
       def initialize(connection, initiator, prologue, local_keypairs, remote_keys)
         @connection = connection
@@ -32,8 +31,9 @@ module Noise
 
         initiator_keypair_getter, responder_keypair_getter = get_keypair_getter(initiator)
 
-        # Sets message_patterns to the message patterns from handshake_pattern
-        @message_patterns = @protocol.pattern.tokens.dup
+        # Sets message_patterns to the message patterns from handshake_pattern. The inner arrays are
+        # copied too, so consuming them here can never reach back into the shared Pattern.
+        @message_patterns = @protocol.pattern.tokens.map(&:dup)
 
         process_initiator_pre_messages(initiator_keypair_getter)
         process_fallback(initiator_keypair_getter)
@@ -49,11 +49,11 @@ module Noise
       end
 
       def local_keypair_getter
-        ->(token) { instance_variable_get('@' + token.to_s).public_key }
+        ->(token) { instance_variable_get("@#{token}").public_key }
       end
 
       def remote_keypair_getter
-        ->(token) { instance_variable_get('@r' + token.to_s) }
+        ->(token) { instance_variable_get("@r#{token}") }
       end
 
       def process_initiator_pre_messages(keypair_getter)
@@ -100,6 +100,7 @@ module Noise
       end
 
       # Takes a payload byte sequence which may be zero-length, and a message_buffer to write the output into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def write_message(payload, message_buffer)
         pattern = @message_patterns.shift
 
@@ -118,18 +119,18 @@ module Noise
           end
         end
         message_buffer << @symmetric_state.encrypt_and_hash(payload)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
       end
 
       # Takes a byte sequence containing a Noise handshake message,
       # and a payload_buffer to write the message's plaintext payload into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def read_message(message, payload_buffer)
         pattern = @message_patterns.shift
         pattern.each do |token|
           case token
           when Noise::Token::E
-            message, re = extract_key(message, false)
-            @re ||= re
+            message, @re = extract_key(message, false)
             mix_e(@re)
           when Noise::Token::S
             message, @rs = extract_key(message, true)
@@ -140,11 +141,19 @@ module Noise
           end
         end
         payload_buffer << @symmetric_state.decrypt_and_hash(message)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
       end
 
       private
 
+      # Splits into the transport cipher states once every message pattern has been processed.
+      def finish_handshake
+        return false unless @message_patterns.empty?
+
+        @symmetric_state.split
+        true
+      end
+
       def extract_key(message, is_encrypted)
         len = @protocol.dh_fn.dhlen
         offset =
@@ -153,8 +162,10 @@ module Noise
           else
             0
           end
+        raise Noise::Exceptions::NoiseHandshakeError, 'Message is too short.' if message.bytesize < len + offset
+
         key = message[0...len + offset]
-        message = message[(len + offset)..-1]
+        message = message[(len + offset)..]
         key = @symmetric_state.decrypt_and_hash(key) if is_encrypted
         [message, key]
       end

data/lib/noise/state/symmetric_state.rb

@@ -8,8 +8,7 @@ module Noise
     # - h: A hash output of HASHLEN bytes.
     #
     class SymmetricState
-      attr_reader :h, :ck
-      attr_reader :cipher_state
+      attr_reader :h, :ck, :cipher_state
 
       def initialize(protocol, connection)
         @protocol = protocol

data/lib/noise/utils/string.rb

@@ -1,11 +1,25 @@
 # frozen_string_literal: true
 
-class String
-  def htb
-    [self].pack('H*')
-  end
+module Noise
+  module Utils
+    # Hex conversion helpers. Offered as a refinement so that requiring this gem does not add methods
+    # to String for the whole process.
+    #
+    #   using Noise::Utils::HexString
+    #   '0102'.htb     # => "\x01\x02"
+    #   "\x01\x02".bth # => "0102"
+    module HexString
+      refine ::String do
+        # hex to binary
+        def htb
+          [self].pack('H*')
+        end
 
-  def bth
-    unpack('H*').first
+        # binary to hex
+        def bth
+          unpack1('H*')
+        end
+      end
+    end
   end
 end

data/lib/noise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Noise
-  VERSION = '0.10.1'
+  VERSION = '0.12.0'
 end

data/lib/noise.rb

@@ -4,11 +4,11 @@ require 'noise/version'
 
 require 'ecdsa'
 require 'logger'
+require 'openssl'
 require 'rbnacl'
 require 'ruby_hmac'
 require 'securerandom'
 
-require 'noise/utils/hash'
 require 'noise/utils/string'
 
 module Noise
@@ -21,14 +21,29 @@ module Noise
   autoload :Functions, 'noise/functions'
   autoload :State, 'noise/state'
 
-  def self.logger
-    @logger ||= Logger.new(STDOUT)
-  end
-end
+  # Some DH and hash functions are backed by a gem, and often a system library, that is only needed
+  # when the function appears in a protocol name. Loading one is therefore allowed to fail; the
+  # failure is remembered and reported by optional_dependency! when the function is used.
+  @unavailable_dependencies = {}
+
+  class << self
+    def logger
+      @logger ||= Logger.new($stdout)
+    end
 
-def require_force(name)
-  require name
-  yield if block_given?
-rescue LoadError => e
-  Noise.logger.warn(e.message)
+    def require_optional(name)
+      require name
+      yield if block_given?
+    rescue LoadError => e
+      @unavailable_dependencies[name] = e.message
+      logger.warn("Optional dependency '#{name}' is unavailable: #{e.message}")
+    end
+
+    def optional_dependency!(name)
+      reason = @unavailable_dependencies[name]
+      return if reason.nil?
+
+      raise Noise::Exceptions::MissingDependencyError, "'#{name}' could not be loaded: #{reason}"
+    end
+  end
 end

data/noise.gemspec

@@ -5,7 +5,8 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'noise/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = 'noise-ruby'
+  spec.name = 'noise-ruby'
+  spec.required_ruby_version = '~> 3.0'
   spec.version       = Noise::VERSION
   spec.authors       = ['Hajime Yamaguchi']
   spec.email         = ['gen.yamaguchi0@gmail.com']
@@ -21,14 +22,26 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'blake3'
   spec.add_development_dependency 'bundler', '~> 2.0'
   spec.add_development_dependency 'rake', '>= 12.3.3'
   spec.add_development_dependency 'rspec', '~> 3.0'
+
+  spec.add_development_dependency 'rubocop'
+  spec.add_development_dependency 'rubocop-rspec'
+  spec.add_development_dependency 'simplecov'
+  spec.add_development_dependency 'simplecov-json'
+
+  # Optional backends. Each one is needed only when its function appears in a protocol name, and
+  # each also needs a system library that cannot be installed as a gem, so none of them is a runtime
+  # dependency. Add the one you need to your own Gemfile; see the README for the system libraries.
+  spec.add_development_dependency 'blake3'
   spec.add_development_dependency 'secp256k1-ruby'
 
   spec.add_runtime_dependency 'ecdsa'
-  spec.add_runtime_dependency 'ed448'
+  # The 448 DH function needs the raw key API (OpenSSL::PKey.new_raw_private_key and friends),
+  # which arrived in openssl 3.0. Ruby 3.0 still ships 2.2 as its default gem, so the version has
+  # to be requested explicitly rather than left to whatever the interpreter bundles.
+  spec.add_runtime_dependency 'openssl', '>= 3.0'
   spec.add_runtime_dependency 'rbnacl'
   spec.add_runtime_dependency 'ruby-hmac'
 end