noise-ruby 0.13.0 → 0.15.0

data/lib/noise/exceptions/handshake_not_finished_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a transport operation is called while the handshake is still running.
+    class HandshakeNotFinishedError < NoiseHandshakeError
+    end
+  end
+end

data/lib/noise/exceptions/handshake_not_started_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when an operation needs a handshake that Connection#start_handshake has not begun yet.
+    class HandshakeNotStartedError < NoiseHandshakeError
+    end
+  end
+end

data/lib/noise/exceptions/handshake_turn_error.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a handshake message is written where one has to be read, or read where one has to
+    # be written. A Noise handshake alternates between the two parties, so only one of the two is
+    # legal at any point.
+    class HandshakeTurnError < NoiseHandshakeError
+    end
+  end
+end

data/lib/noise/exceptions/read_timeout_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a transport layer gave up waiting for the rest of a message to arrive.
+    class ReadTimeoutError < RuntimeError
+    end
+  end
+end

data/lib/noise/exceptions/truncated_message_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a stream ends part way through a message that a transport layer was reading.
+    class TruncatedMessageError < RuntimeError
+    end
+  end
+end

data/lib/noise/exceptions.rb

@@ -4,16 +4,22 @@ module Noise
   module Exceptions
     autoload :DecryptError, 'noise/exceptions/decrypt_error'
     autoload :EncryptError, 'noise/exceptions/encrypt_error'
+    autoload :HandshakeAlreadyFinishedError, 'noise/exceptions/handshake_already_finished_error'
+    autoload :HandshakeNotFinishedError, 'noise/exceptions/handshake_not_finished_error'
+    autoload :HandshakeNotStartedError, 'noise/exceptions/handshake_not_started_error'
+    autoload :HandshakeTurnError, 'noise/exceptions/handshake_turn_error'
     autoload :InvalidNonceError, 'noise/exceptions/invalid_nonce_error'
     autoload :InvalidPublicKeyError, 'noise/exceptions/invalid_public_key_error'
     autoload :MaxNonceError, 'noise/exceptions/max_nonce_error'
     autoload :MessageTooLongError, 'noise/exceptions/message_too_long_error'
     autoload :MissingDependencyError, 'noise/exceptions/missing_dependency_error'
     autoload :ProtocolNameError, 'noise/exceptions/protocol_name_error'
+    autoload :ReadTimeoutError, 'noise/exceptions/read_timeout_error'
     autoload :NoiseHandshakeError, 'noise/exceptions/noise_handshake_error'
     autoload :NoiseValidationError, 'noise/exceptions/noise_validation_error'
     autoload :NoisePSKError, 'noise/exceptions/noise_psk_error'
     autoload :PSKValueError, 'noise/exceptions/psk_value_error'
+    autoload :TruncatedMessageError, 'noise/exceptions/truncated_message_error'
     autoload :UnsupportedModifierError, 'noise/exceptions/unsupported_modifier_error'
   end
 end

data/lib/noise/functions/cipher/cha_cha_poly.rb

@@ -6,17 +6,32 @@ module Noise
       class ChaChaPoly
         MAX_NONCE = 2**64 - 1
 
+        # The name OpenSSL knows the AEAD construction of RFC 8439 by. It takes a 12 byte nonce and
+        # produces a 16 byte authentication tag, which is what the Noise specification requires of
+        # the ChaChaPoly cipher functions.
+        ALGORITHM = 'chacha20-poly1305'
+
+        # Length in bytes of the authentication tag that encrypt appends to the ciphertext.
+        TAGLEN = 16
+
         def encrypt(k, n, ad, plaintext)
-          cipher = RbNaCl::AEAD::ChaCha20Poly1305IETF.new(String.new(k).force_encoding('ASCII-8BIT'))
-          cipher.encrypt(nonce_to_bytes(n), plaintext, ad)
-        rescue ::RbNaCl::CryptoError => e
+          cipher = OpenSSL::Cipher.new(ALGORITHM).encrypt
+          cipher.key = k
+          cipher.iv = nonce_to_bytes(n)
+          cipher.auth_data = ad
+          update(cipher, plaintext) + cipher.final + cipher.auth_tag
+        rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::EncryptError, "Encrypt failed. #{e.message}", e.backtrace
         end
 
         def decrypt(k, n, ad, ciphertext)
-          cipher = RbNaCl::AEAD::ChaCha20Poly1305IETF.new(String.new(k).force_encoding('ASCII-8BIT'))
-          cipher.decrypt(nonce_to_bytes(n), ciphertext, ad)
-        rescue ::RbNaCl::CryptoError => e
+          cipher = OpenSSL::Cipher.new(ALGORITHM).decrypt
+          cipher.key = k
+          cipher.iv = nonce_to_bytes(n)
+          cipher.auth_data = ad
+          cipher.auth_tag = ciphertext[-TAGLEN..]
+          update(cipher, ciphertext[0...-TAGLEN]) + cipher.final
+        rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::DecryptError, "Decrpyt failed. #{e.message}", e.backtrace
         end
 
@@ -34,6 +49,16 @@ module Noise
         def rekey(k)
           encrypt(k, MAX_NONCE, '', "\x00" * 32)[0...32]
         end
+
+        private
+
+        # A zero-length payload is normal in a Noise message, but OpenSSL::Cipher#update raises
+        # ArgumentError('data must not be empty') instead of returning ''.
+        def update(cipher, data)
+          return String.new if data.empty?
+
+          cipher.update(data)
+        end
       end
     end
   end

data/lib/noise/functions/dh/ed25519.rb

@@ -3,29 +3,41 @@
 module Noise
   module Functions
     module DH
+      # The 25519 DH function of the Noise specification, which is X25519 as defined by RFC 7748 and
+      # not the Ed25519 signature scheme the class name suggests. The name is kept because it is
+      # what Protocol::DH maps '25519' to and what callers reference.
+      #
+      # OpenSSL implements X25519 and exposes it through the raw key interface, so this function
+      # needs no gem and no system library beyond the OpenSSL the other functions already use.
       class ED25519
         DHLEN = 32
+
+        # The name OpenSSL knows the curve by. Ed25519 is a different algorithm, and asking for it
+        # here would produce a signing key rather than one that can derive a shared secret.
+        ALGORITHM = 'X25519'
+
         def generate_keypair
-          private_key = 1 + SecureRandom.random_number(RbNaCl::GroupElement::STANDARD_GROUP_ORDER - 1)
-          scalar_as_string = ECDSA::Format::IntegerOctetString.encode(private_key, 32)
-          public_key = RbNaCl::GroupElements::Curve25519.base.mult(scalar_as_string)
-          Noise::Key.new(ECDSA::Format::IntegerOctetString.encode(private_key, 32), public_key.to_bytes)
+          pkey = OpenSSL::PKey.generate_key(ALGORITHM)
+          Noise::Key.new(pkey.raw_private_key, pkey.raw_public_key)
         end
 
         # Computes the X25519 shared secret for the given remote public key.
         #
-        # RbNaCl reports a public key it cannot use in two different ways: a wrong length
-        # raises RbNaCl::LengthError, and an all-zero or low-order point raises
-        # RbNaCl::CryptoError. Both are translated to InvalidPublicKeyError so that a
-        # caller handling a peer-supplied key rescues the same class for every DH function.
-        # The length is checked before the call so that RbNaCl::LengthError raised for a
-        # malformed private key keeps propagating as itself.
+        # OpenSSL reports a public key it cannot use as OpenSSL::PKey::PKeyError, both when the key
+        # is not DHLEN bytes and when the derivation would produce the all-zero output that RFC 7748
+        # requires be rejected. Both are translated to InvalidPublicKeyError so that a caller
+        # handling a peer-supplied key rescues the same class for every DH function. The local key
+        # is built outside the rescue so that a malformed private key keeps propagating as
+        # PKeyError instead of being reported as the peer's fault.
         def dh(private_key, public_key)
           raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
 
-          RbNaCl::GroupElement.new(public_key).mult(private_key).to_bytes
-        rescue RbNaCl::CryptoError
-          raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          local = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          begin
+            local.derive(OpenSSL::PKey.new_raw_public_key(ALGORITHM, public_key))
+          rescue OpenSSL::PKey::PKeyError
+            raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          end
         end
 
         def dhlen
@@ -33,8 +45,8 @@ module Noise
         end
 
         def self.from_private(private_key)
-          public_key = RbNaCl::GroupElements::Curve25519.base.mult(private_key)
-          Noise::Key.new(private_key, public_key.to_bytes)
+          pkey = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          Noise::Key.new(private_key, pkey.raw_public_key)
         end
       end
     end

data/lib/noise/functions/hash/blake2b.rb

@@ -6,8 +6,14 @@ module Noise
       class Blake2b
         HASHLEN = 64
         BLOCKLEN = 128
+
+        # The name OpenSSL knows BLAKE2b with a 64 byte output by. OpenSSL only implements the
+        # fixed 512 bit output length, which is exactly the HASHLEN the Noise specification gives
+        # the BLAKE2b hash function.
+        DIGEST_NAME = 'BLAKE2b512'
+
         def hash(data)
-          RbNaCl::Hash.blake2b(data)
+          OpenSSL::Digest.digest(DIGEST_NAME, data)
         end
 
         def hashlen
@@ -19,9 +25,25 @@ module Noise
         end
       end
 
+      # Builds an OpenSSL BLAKE2b digest with no argument, which is how HMAC::Base creates the
+      # digests it feeds the inner and outer blocks to. OpenSSL defines no OpenSSL::Digest::BLAKE2b512
+      # constant, so the algorithm name is bound here instead of being passed in at every call.
+      class Blake2bDigester < OpenSSL::Digest
+        def initialize
+          super(Blake2b::DIGEST_NAME)
+        end
+
+        # HMAC::Base hashes a key longer than the block size through this class method. The one
+        # inherited from OpenSSL::Digest takes the algorithm name as its first argument, which this
+        # class has already bound, so it is redefined to take the data alone.
+        def self.digest(data)
+          new.digest(data)
+        end
+      end
+
       class Blake2bHMAC < HMAC::Base
         def initialize(key = nil)
-          super(RbNaCl::Hash::Blake2b, 128, 64, key)
+          super(Blake2bDigester, Blake2b::BLOCKLEN, Blake2b::HASHLEN, key)
         end
         public_class_method :new, :digest, :hexdigest
       end

data/lib/noise/functions/hash/blake3.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-Noise.require_optional 'blake3'
+Noise.require_optional 'blake3-rb'
 
 module Noise
   module Functions
@@ -10,11 +10,11 @@ module Noise
         BLOCKLEN = 64
 
         def initialize
-          Noise.optional_dependency!('blake3')
+          Noise.optional_dependency!('blake3-rb')
         end
 
         def hash(data)
-          ::Blake3.digest(data)
+          ::Digest::Blake3.digest(data)
         end
 
         def hashlen
@@ -28,7 +28,7 @@ module Noise
 
       class Blake3HMAC < HMAC::Base
         def initialize(key = nil)
-          super(::Blake3::Hasher, Blake3::BLOCKLEN, Blake3::HASHLEN, key)
+          super(::Digest::Blake3, Blake3::BLOCKLEN, Blake3::HASHLEN, key)
         end
         public_class_method :new, :digest, :hexdigest
       end

data/lib/noise/functions/hash/sha256.rb

@@ -7,7 +7,7 @@ module Noise
         HASHLEN = 32
         BLOCKLEN = 64
         def hash(data)
-          RbNaCl::Hash.sha256(data)
+          OpenSSL::Digest.digest('SHA256', data)
         end
 
         def hashlen

data/lib/noise/functions/hash/sha512.rb

@@ -7,7 +7,7 @@ module Noise
         HASHLEN = 64
         BLOCKLEN = 128
         def hash(data)
-          RbNaCl::Hash.sha512(data)
+          OpenSSL::Digest.digest('SHA512', data)
         end
 
         def hashlen

data/lib/noise/pattern.rb

@@ -102,14 +102,16 @@ module Noise
   class Pattern
     attr_reader :name, :tokens, :modifiers, :psk_count, :fallback
 
-    NAME_REGEX = /\A([A-Z1]+)([^A-Z]*)\z/
-
-    def self.create(name)
-      matched = NAME_REGEX.match(name)
-      raise Noise::Exceptions::ProtocolNameError, "Malformed pattern name: #{name}" unless matched
-
-      modifiers = matched[2].split('+').map { |s| Modifier.parse(s) }
-      pattern_class(matched[1]).new(modifiers)
+    # Noise::ProtocolName tells a pattern name from the modifiers written after it, so both
+    # arrive here already separated.
+    #
+    # @param [String] name the handshake pattern name on its own, for example 'XX'.
+    # @param [Array<Noise::Modifier::Psk, Noise::Modifier::Fallback>] modifiers the modifiers to
+    #   apply to it. Call #apply_pattern_modifiers to have them rewrite the token list.
+    # @raise [Noise::Exceptions::ProtocolNameError] if no pattern goes by that name.
+    # @return [Noise::Pattern]
+    def self.create(name, modifiers = [])
+      pattern_class(name).new(modifiers)
     end
 
     def self.pattern_class(pattern)

data/lib/noise/protocol.rb

@@ -3,7 +3,7 @@
 module Noise
   class Protocol
     attr_accessor :cipher_fn, :hash_fn, :dh_fn, :hkdf_fn
-    attr_reader :name, :pattern
+    attr_reader :name, :pattern, :protocol_name
 
     CIPHER = {
       'AESGCM' => Noise::Functions::Cipher::AesGcm,
@@ -24,35 +24,59 @@ module Noise
       'BLAKE3' => Noise::Functions::Hash::Blake3
     }.freeze
 
+    # @param [String] name the protocol name, for example 'Noise_XX_25519_ChaChaPoly_SHA256'.
+    # @raise [Noise::Exceptions::ProtocolNameError] if the name is malformed, or names a pattern
+    #   or a function this gem does not implement.
+    # @raise [Noise::Exceptions::UnsupportedModifierError] if it names a modifier this gem does
+    #   not implement.
+    # @return [Noise::Protocol]
     def self.create(name)
-      parts = name.split('_')
-      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" unless parts.size == 5
-
-      prefix, pattern_name, dh_name, cipher_name, hash_name = parts
-      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" if prefix != 'Noise'
-
-      new(name, pattern_name, cipher_name, hash_name, dh_name)
+      new(Noise::ProtocolName.parse(name))
     end
 
-    def initialize(name, pattern_name, cipher_name, hash_name, dh_name)
-      @name = name
-      @pattern = Noise::Pattern.create(pattern_name)
-      @hkdf_fn = Noise::Functions::Hash.create_hkdf_fn(hash_name)
+    # @param [Noise::ProtocolName] protocol_name the parsed name this protocol runs.
+    def initialize(protocol_name)
+      @protocol_name = protocol_name
+      @name = protocol_name.name
+      @pattern = Noise::Pattern.create(protocol_name.pattern_name, protocol_name.modifiers)
+      @hkdf_fn = Noise::Functions::Hash.create_hkdf_fn(protocol_name.hash_name)
       @pattern.apply_pattern_modifiers
 
-      initialize_fn!(cipher_name, hash_name, dh_name)
+      initialize_fn!
+    end
+
+    def psk?
+      @pattern.psk?
     end
 
-    def initialize_fn!(cipher_name, hash_name, dh_name)
-      @cipher_fn = CIPHER[cipher_name]&.new
-      @hash_fn = HASH[hash_name]&.new
-      @dh_fn = DH[dh_name]&.new
+    private
+
+    # Looks the three functions up by the names the protocol name gives them.
+    #
+    # @raise [Noise::Exceptions::ProtocolNameError] if any of the three is one this gem does not
+    #   implement.
+    def initialize_fn!
+      @cipher_fn = CIPHER[@protocol_name.cipher_name]&.new
+      @hash_fn = HASH[@protocol_name.hash_name]&.new
+      @dh_fn = create_dh_fn(@protocol_name.dh_names)
       raise Noise::Exceptions::ProtocolNameError, "Unsupported function in: #{@name}" unless
         @cipher_fn && @hash_fn && @dh_fn
     end
 
-    def psk?
-      @pattern.psk?
+    # A name may list more than one DH function, joined with '+', which is how a hybrid handshake
+    # is written. This gem runs a single DH function, so any name that lists more than one, or
+    # that leaves a member of the list empty, resolves to nothing and is reported as unsupported.
+    #
+    # The hybrid names the Noise extensions define also carry a modifier, hfs, which
+    # Noise::ProtocolName rejects first, so what reaches here today is a name that lists several
+    # DH functions and nothing else.
+    #
+    # @param [Array<String>] names the DH function names the protocol name lists.
+    # @return [Object, nil] the DH function, or nil if the name asks for one this gem lacks.
+    def create_dh_fn(names)
+      return nil unless names.size == 1
+
+      DH[names.first]&.new
     end
   end
 end

data/lib/noise/protocol_name.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Noise
+  # A Noise protocol name, split into the parts that name a handshake pattern and the three
+  # functions the protocol runs on.
+  #
+  # A name has five parts joined with '_': the prefix 'Noise', the handshake pattern with its
+  # modifiers, the DH function, the cipher function and the hash function, for example
+  # 'Noise_NNpsk0_25519_ChaChaPoly_BLAKE2s'.
+  #
+  # Two of those parts hold a list of their own. The pattern part is a pattern name followed by
+  # the modifiers applied to it, and the DH part is a list joined with '+', because a hybrid
+  # handshake names two DH functions at once ('Noise_NNhfs_25519+448_ChaChaPoly_BLAKE2s'). Both
+  # are split here, so that every rule about the shape of a name lives in this class alone.
+  #
+  # Which functions exist is Noise::Protocol's question, not this one's: a name that asks for a
+  # cipher, hash or DH function this gem does not implement still parses. Modifiers are the one
+  # exception, because a modifier has to be understood before it can be held as a value, so an
+  # unknown one is rejected here.
+  #
+  # The members are the names as written, not the functions themselves. Noise::Protocol resolves
+  # them, and calls its resolved functions cipher_fn, hash_fn and dh_fn.
+  ProtocolName = Data.define(:name, :pattern_name, :modifiers, :dh_names, :cipher_name,
+                             :hash_name) do
+    # Parses a protocol name.
+    #
+    # @param [String] name for example 'Noise_XX_25519_ChaChaPoly_SHA256'.
+    # @raise [Noise::Exceptions::ProtocolNameError] if the name is not five parts with the 'Noise'
+    #   prefix and a pattern part whose modifiers can be told from the pattern name.
+    # @raise [Noise::Exceptions::UnsupportedModifierError] if a modifier is written correctly but
+    #   is not one this gem implements.
+    # @return [Noise::ProtocolName]
+    def self.parse(name)
+      # 'Noise', the pattern with its modifiers, the DH functions, the cipher and the hash.
+      parts = name.split('_')
+      malformed!(name) unless parts.size == 5
+
+      prefix, pattern_part, dh_part, cipher_name, hash_name = parts
+      malformed!(name) unless prefix == 'Noise'
+
+      # A pattern name is capitals, plus the digit 1 that deferred patterns use (X1K1). Whatever
+      # follows it is the modifiers.
+      matched = /\A([A-Z1]+)([^A-Z]*)\z/.match(pattern_part)
+      malformed!(name) unless matched
+
+      new(name: name, pattern_name: matched[1], modifiers: parse_modifiers(matched[2]),
+          dh_names: split_dh(dh_part), cipher_name: cipher_name, hash_name: hash_name)
+    end
+
+    # @param [String] part the modifiers as written, which is '' when there are none.
+    # @return [Array] the modifiers, in the order the name writes them.
+    def self.parse_modifiers(part)
+      part.split('+').map { |modifier| Modifier.parse(modifier) }.freeze
+    end
+    private_class_method :parse_modifiers
+
+    # Keeps the empty members a stray '+' leaves behind, so that '25519+' reads as two DH
+    # functions, the second of which has no name, rather than as the single function '25519'.
+    # Nothing resolves an empty name, so such a name is reported as unsupported.
+    #
+    # @param [String] part the DH functions as written.
+    # @return [Array<String>] one name per member.
+    def self.split_dh(part)
+      part.split('+', -1).freeze
+    end
+    private_class_method :split_dh
+
+    def self.malformed!(name)
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}"
+    end
+    private_class_method :malformed!
+
+    # @return [String] the name this was parsed from.
+    def to_s
+      name
+    end
+  end
+end