noise-ruby 0.13.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 326691ebec86a68d5b4978756edcd5752c7307e4eba85c615e08262f8133481e
-  data.tar.gz: 0626adc9ec4b0821211b04b3573a950684ca526edcd5e956450107d4d8c69ce0
+  metadata.gz: a6817736b9a72ca54f30ceb3238c9962fbd1f4a09092e9e0f783fec5a1035e9f
+  data.tar.gz: de1d7510423907f0b73fa4f4115916bb2044195dc4dbbf8acb1f83cb484f2e76
 SHA512:
-  metadata.gz: 2246a0d4be698a11efb560f6e9ddd70b50a926255c32877d8fd7346780e99e4d2950ac2e10ed81fb787ce9a61f626027e69136e94d680c9959e79c1702c73c47
-  data.tar.gz: fe3e968bbb464d11bd574750bdd97410b7ef5564328b327946654f76f8476fae4eadb7fbb8acebf4c4036b4f5edaa2d4a5b265c38705cc2ad33e25f310f78255
+  metadata.gz: 3235949265d26680b60447ad79e7c2ef02824233343a948b3b6805cd519c5e3f1ff5b573abb2ab1feec11eb7e51523448e47ce787ed81bc0399e8ab86e2b8368
+  data.tar.gz: 29d18a35a9d052d117e2ce0422f2a165eedf85d8f53af2d4b77263af500a257d194237cfa274b6ee40d432fbb8366490ed30fffafdaffa7713d70593c4104559

data/Dockerfile

@@ -3,11 +3,11 @@
 # architecture and needs no emulation.
 FROM ruby:4.0
 
-# libsodium: dlopen'd by rbnacl, which lib/noise.rb requires unconditionally.
-# cargo: the blake3 gem is a Rust extension and is built at install time.
 # git: noise.gemspec calls `git ls-files` while the gemspec is evaluated.
+# No Rust toolchain: the blake3-rb gem ships a precompiled binary for this platform.
+# No libsodium: every function is computed by OpenSSL or in pure Ruby.
 RUN apt-get update -qq \
- && apt-get install -y --no-install-recommends build-essential git libsodium23 cargo \
+ && apt-get install -y --no-install-recommends build-essential git \
  && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /work

data/README.md

@@ -33,8 +33,14 @@ Supported Features:
 This gem requires Ruby 3.2 or later, and is tested on 3.2, 3.3, 3.4 and 4.0. Ruby 3.0 and 3.1 are
 past end of life and are no longer supported; stay on noise-ruby 0.12.0 or earlier if you need them.
 
-This gem needs libsodium library.
-To install libsodium, see https://github.com/jedisct1/libsodium
+Every function except BLAKE3, which is optional and covered below, is computed either by the
+OpenSSL that Ruby is linked against or in pure Ruby, so no system library has to be installed
+separately. OpenSSL 1.1.1 or later provides everything this gem asks of it, and that is what the
+official Ruby packages and the usual version managers (rbenv, rvm, asdf) are built with. Two kinds
+of build fall short: a Ruby linked against LibreSSL has no BLAKE2b, no ChaCha20-Poly1305 and no
+X448, and an OpenSSL restricted to the FIPS provider has neither BLAKE2b nor ChaCha20-Poly1305 nor
+the secp256k1 curve. On such a build the protocol names that use a missing function raise an error,
+and the remaining ones keep working.
 
 Add this line to your application's Gemfile:
 
@@ -50,13 +56,16 @@ Or install it yourself as:
 
     $ gem install noise-ruby
 
-If you use BLAKE3, you must install [Rust and Cargo](https://www.rust-lang.org/tools/install).
-And add this line to your Gemfile:
+If you use BLAKE3, add this line to your Gemfile:
 
 ```
-gem 'blake3'
+gem 'blake3-rb'
 ```
 
+`blake3-rb` ships precompiled binaries for common Linux, macOS and Windows platforms (x86_64 and
+aarch64), so no Rust or C toolchain is needed to install it there. On any other platform bundler
+falls back to the source gem, which does need a C compiler.
+
 ## Usage
 
 Followings shows handshake protocol with "Noise_NN_25519_ChaChaPoly_BLAKE2b"

data/lib/noise/functions/cipher/cha_cha_poly.rb

@@ -6,17 +6,32 @@ module Noise
       class ChaChaPoly
         MAX_NONCE = 2**64 - 1
 
+        # The name OpenSSL knows the AEAD construction of RFC 8439 by. It takes a 12 byte nonce and
+        # produces a 16 byte authentication tag, which is what the Noise specification requires of
+        # the ChaChaPoly cipher functions.
+        ALGORITHM = 'chacha20-poly1305'
+
+        # Length in bytes of the authentication tag that encrypt appends to the ciphertext.
+        TAGLEN = 16
+
         def encrypt(k, n, ad, plaintext)
-          cipher = RbNaCl::AEAD::ChaCha20Poly1305IETF.new(String.new(k).force_encoding('ASCII-8BIT'))
-          cipher.encrypt(nonce_to_bytes(n), plaintext, ad)
-        rescue ::RbNaCl::CryptoError => e
+          cipher = OpenSSL::Cipher.new(ALGORITHM).encrypt
+          cipher.key = k
+          cipher.iv = nonce_to_bytes(n)
+          cipher.auth_data = ad
+          update(cipher, plaintext) + cipher.final + cipher.auth_tag
+        rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::EncryptError, "Encrypt failed. #{e.message}", e.backtrace
         end
 
         def decrypt(k, n, ad, ciphertext)
-          cipher = RbNaCl::AEAD::ChaCha20Poly1305IETF.new(String.new(k).force_encoding('ASCII-8BIT'))
-          cipher.decrypt(nonce_to_bytes(n), ciphertext, ad)
-        rescue ::RbNaCl::CryptoError => e
+          cipher = OpenSSL::Cipher.new(ALGORITHM).decrypt
+          cipher.key = k
+          cipher.iv = nonce_to_bytes(n)
+          cipher.auth_data = ad
+          cipher.auth_tag = ciphertext[-TAGLEN..]
+          update(cipher, ciphertext[0...-TAGLEN]) + cipher.final
+        rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::DecryptError, "Decrpyt failed. #{e.message}", e.backtrace
         end
 
@@ -34,6 +49,16 @@ module Noise
         def rekey(k)
           encrypt(k, MAX_NONCE, '', "\x00" * 32)[0...32]
         end
+
+        private
+
+        # A zero-length payload is normal in a Noise message, but OpenSSL::Cipher#update raises
+        # ArgumentError('data must not be empty') instead of returning ''.
+        def update(cipher, data)
+          return String.new if data.empty?
+
+          cipher.update(data)
+        end
       end
     end
   end

data/lib/noise/functions/dh/ed25519.rb

@@ -3,29 +3,41 @@
 module Noise
   module Functions
     module DH
+      # The 25519 DH function of the Noise specification, which is X25519 as defined by RFC 7748 and
+      # not the Ed25519 signature scheme the class name suggests. The name is kept because it is
+      # what Protocol::DH maps '25519' to and what callers reference.
+      #
+      # OpenSSL implements X25519 and exposes it through the raw key interface, so this function
+      # needs no gem and no system library beyond the OpenSSL the other functions already use.
       class ED25519
         DHLEN = 32
+
+        # The name OpenSSL knows the curve by. Ed25519 is a different algorithm, and asking for it
+        # here would produce a signing key rather than one that can derive a shared secret.
+        ALGORITHM = 'X25519'
+
         def generate_keypair
-          private_key = 1 + SecureRandom.random_number(RbNaCl::GroupElement::STANDARD_GROUP_ORDER - 1)
-          scalar_as_string = ECDSA::Format::IntegerOctetString.encode(private_key, 32)
-          public_key = RbNaCl::GroupElements::Curve25519.base.mult(scalar_as_string)
-          Noise::Key.new(ECDSA::Format::IntegerOctetString.encode(private_key, 32), public_key.to_bytes)
+          pkey = OpenSSL::PKey.generate_key(ALGORITHM)
+          Noise::Key.new(pkey.raw_private_key, pkey.raw_public_key)
         end
 
         # Computes the X25519 shared secret for the given remote public key.
         #
-        # RbNaCl reports a public key it cannot use in two different ways: a wrong length
-        # raises RbNaCl::LengthError, and an all-zero or low-order point raises
-        # RbNaCl::CryptoError. Both are translated to InvalidPublicKeyError so that a
-        # caller handling a peer-supplied key rescues the same class for every DH function.
-        # The length is checked before the call so that RbNaCl::LengthError raised for a
-        # malformed private key keeps propagating as itself.
+        # OpenSSL reports a public key it cannot use as OpenSSL::PKey::PKeyError, both when the key
+        # is not DHLEN bytes and when the derivation would produce the all-zero output that RFC 7748
+        # requires be rejected. Both are translated to InvalidPublicKeyError so that a caller
+        # handling a peer-supplied key rescues the same class for every DH function. The local key
+        # is built outside the rescue so that a malformed private key keeps propagating as
+        # PKeyError instead of being reported as the peer's fault.
         def dh(private_key, public_key)
           raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
 
-          RbNaCl::GroupElement.new(public_key).mult(private_key).to_bytes
-        rescue RbNaCl::CryptoError
-          raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          local = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          begin
+            local.derive(OpenSSL::PKey.new_raw_public_key(ALGORITHM, public_key))
+          rescue OpenSSL::PKey::PKeyError
+            raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          end
         end
 
         def dhlen
@@ -33,8 +45,8 @@ module Noise
         end
 
         def self.from_private(private_key)
-          public_key = RbNaCl::GroupElements::Curve25519.base.mult(private_key)
-          Noise::Key.new(private_key, public_key.to_bytes)
+          pkey = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          Noise::Key.new(private_key, pkey.raw_public_key)
         end
       end
     end

data/lib/noise/functions/hash/blake2b.rb

@@ -6,8 +6,14 @@ module Noise
       class Blake2b
         HASHLEN = 64
         BLOCKLEN = 128
+
+        # The name OpenSSL knows BLAKE2b with a 64 byte output by. OpenSSL only implements the
+        # fixed 512 bit output length, which is exactly the HASHLEN the Noise specification gives
+        # the BLAKE2b hash function.
+        DIGEST_NAME = 'BLAKE2b512'
+
         def hash(data)
-          RbNaCl::Hash.blake2b(data)
+          OpenSSL::Digest.digest(DIGEST_NAME, data)
         end
 
         def hashlen
@@ -19,9 +25,25 @@ module Noise
         end
       end
 
+      # Builds an OpenSSL BLAKE2b digest with no argument, which is how HMAC::Base creates the
+      # digests it feeds the inner and outer blocks to. OpenSSL defines no OpenSSL::Digest::BLAKE2b512
+      # constant, so the algorithm name is bound here instead of being passed in at every call.
+      class Blake2bDigester < OpenSSL::Digest
+        def initialize
+          super(Blake2b::DIGEST_NAME)
+        end
+
+        # HMAC::Base hashes a key longer than the block size through this class method. The one
+        # inherited from OpenSSL::Digest takes the algorithm name as its first argument, which this
+        # class has already bound, so it is redefined to take the data alone.
+        def self.digest(data)
+          new.digest(data)
+        end
+      end
+
       class Blake2bHMAC < HMAC::Base
         def initialize(key = nil)
-          super(RbNaCl::Hash::Blake2b, 128, 64, key)
+          super(Blake2bDigester, Blake2b::BLOCKLEN, Blake2b::HASHLEN, key)
         end
         public_class_method :new, :digest, :hexdigest
       end

data/lib/noise/functions/hash/blake3.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-Noise.require_optional 'blake3'
+Noise.require_optional 'blake3-rb'
 
 module Noise
   module Functions
@@ -10,11 +10,11 @@ module Noise
         BLOCKLEN = 64
 
         def initialize
-          Noise.optional_dependency!('blake3')
+          Noise.optional_dependency!('blake3-rb')
         end
 
         def hash(data)
-          ::Blake3.digest(data)
+          ::Digest::Blake3.digest(data)
         end
 
         def hashlen
@@ -28,7 +28,7 @@ module Noise
 
       class Blake3HMAC < HMAC::Base
         def initialize(key = nil)
-          super(::Blake3::Hasher, Blake3::BLOCKLEN, Blake3::HASHLEN, key)
+          super(::Digest::Blake3, Blake3::BLOCKLEN, Blake3::HASHLEN, key)
         end
         public_class_method :new, :digest, :hexdigest
       end

data/lib/noise/functions/hash/sha256.rb

@@ -7,7 +7,7 @@ module Noise
         HASHLEN = 32
         BLOCKLEN = 64
         def hash(data)
-          RbNaCl::Hash.sha256(data)
+          OpenSSL::Digest.digest('SHA256', data)
         end
 
         def hashlen

data/lib/noise/functions/hash/sha512.rb

@@ -7,7 +7,7 @@ module Noise
         HASHLEN = 64
         BLOCKLEN = 128
         def hash(data)
-          RbNaCl::Hash.sha512(data)
+          OpenSSL::Digest.digest('SHA512', data)
         end
 
         def hashlen

data/lib/noise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Noise
-  VERSION = '0.13.0'
+  VERSION = '0.14.0'
 end

data/lib/noise.rb

@@ -4,7 +4,6 @@ require 'noise/version'
 
 require 'ecdsa'
 require 'openssl'
-require 'rbnacl'
 require 'ruby_hmac'
 require 'securerandom'
 

data/noise.gemspec

@@ -30,17 +30,15 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'simplecov'
   spec.add_development_dependency 'simplecov-json'
 
-  # Optional backend. BLAKE3 is needed only when it appears in a protocol name, and it needs Rust
-  # to build, so it is not a runtime dependency. Add it to your own Gemfile if you need it; see the
-  # README.
-  spec.add_development_dependency 'blake3'
+  # Optional backend. BLAKE3 is needed only when it appears in a protocol name, so it is not a
+  # runtime dependency. Add it to your own Gemfile if you need it; see the README.
+  spec.add_development_dependency 'blake3-rb'
 
   spec.add_runtime_dependency 'ecdsa'
-  # The 448 DH function needs the raw key API (OpenSSL::PKey.new_raw_private_key and friends),
-  # which arrived in openssl 3.0. Every supported interpreter bundles a newer default gem, but the
-  # floor is stated so an older openssl pinned in an application's Gemfile fails to resolve rather
-  # than failing at runtime.
+  # The 25519 and 448 DH functions need the raw key API (OpenSSL::PKey.new_raw_private_key and
+  # friends), which arrived in openssl 3.0. Every supported interpreter bundles a newer default
+  # gem, but the floor is stated so an older openssl pinned in an application's Gemfile fails to
+  # resolve rather than failing at runtime.
   spec.add_runtime_dependency 'openssl', '>= 3.0'
-  spec.add_runtime_dependency 'rbnacl'
   spec.add_runtime_dependency 'ruby-hmac'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: noise-ruby
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Hajime Yamaguchi
@@ -94,7 +94,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: blake3
+  name: blake3-rb
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -135,20 +135,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: rbnacl
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: ruby-hmac
   requirement: !ruby/object:Gem::Requirement