@amritk/nish-x86_64-linux 0.20.0 → 0.21.0

package/std/crypto/hmac.ts

@@ -46,12 +46,17 @@
  * stores nothing of its own and an arena scope around it releases all it
  * allocated (see "Caller-owned scratch" below).
  *
- * Written from RFC 2104, not ported from another implementation.
+ * `pbkdf2HmacSha256` is PBKDF2 with HMAC-SHA-256 (RFC 8018 §5.2), the key
+ * derivation SCRAM-SHA-256 runs over a password: the password goes in as a
+ * `Secret<u8[]>` and the derived key comes out as one, and every U_j and T_i
+ * is wiped before it answers (see "PBKDF2" below).
+ *
+ * Written from RFC 2104 and RFC 8018, not ported from another implementation.
  */
 import { SHA256_BLOCK, SHA256_SIZE, Sha256 } from "nish/crypto/sha256"
 import { SHA384_SIZE, SHA512_BLOCK, SHA512_SIZE, Sha384, Sha512 } from "nish/crypto/sha512"
 import { timingSafeEqual } from "nish/crypto/ct"
-import { Secret, exposeWith, wipe } from "nish:secret"
+import { Secret, exposeWith, secret, wipe } from "nish:secret"
 
 /** RFC 2104 §2's `ipad`, the byte XORed into the key for the inner hash. */
 const HMAC_IPAD: i32 = 0x36
@@ -661,3 +666,134 @@ export class HmacSha384Scratch {
     hmacWipeSha384(this.outer)
   }
 }
+
+// ---- PBKDF2 ----------------------------------------------------------------
+//
+// PBKDF2 with HMAC-SHA-256 as its PRF (RFC 8018 §5.2), the key derivation
+// SCRAM-SHA-256 (RFC 7677, RFC 5802 §3 "Hi") runs over a password. The
+// password keys an inner and an outer hasher once; every U_j after that is
+// two compressions in a working hasher copied from them, so a count of 4096
+// costs 4096 HMACs and never keys one again.
+
+/** What `pbkdf2HmacSha256` passes through `exposeWith`, which carries one argument. */
+interface Pbkdf2Request {
+  /** The salt, public: SCRAM's server sends it. */
+  salt: u8[]
+  /** The iteration count `c`, at least 1. */
+  iterations: i32
+  /** The derived key's length `dkLen` in bytes, at least 1. */
+  length: i32
+}
+
+/** The length of INT(i), the big-endian block index after the salt; typed, as `HMAC_FROM` is. */
+const PBKDF2_INDEX: i32 = 4
+
+/**
+ * Ends the HMAC `work` holds, keyed as `keyedOuter` is on the outer side, and
+ * writes its 32-byte tag into `out`. Both digests `work` answers are wiped
+ * here, so they die with this call and its arena scope.
+ */
+const pbkdf2Finish = (keyedOuter: Sha256, work: Sha256, out: u8[]): void => {
+  const innerDigest: u8[] = work.digest()
+  hmacCopySha256(keyedOuter, work)
+  work.update(innerDigest, HMAC_FROM, SHA256_SIZE)
+  wipe(innerDigest)
+  const tag: u8[] = work.digest()
+  for (let i: i32 = 0; i < SHA256_SIZE && i < toI32(tag.length) && i < toI32(out.length); i += 1) {
+    out[i] = tag[i]
+  }
+  wipe(tag)
+}
+
+/** `pbkdf2HmacSha256` on the exposed password. */
+const pbkdf2HmacSha256Exposed = (password: u8[], request: Pbkdf2Request): u8[] | null => {
+  const salt: u8[] = request.salt
+  const iterations: i32 = request.iterations
+  const length: i32 = request.length
+  // Before any `toI32`, which would saturate under `--number-mode f64`.
+  if (password.length > 2147483647 || salt.length > 2147483647) {
+    return null
+  }
+  if (iterations < 1 || length < 1) {
+    return null
+  }
+  const keyedInner = new Sha256()
+  const keyedOuter = new Sha256()
+  hmacKeySha256(keyedInner, keyedOuter, password)
+  const work = new Sha256()
+  const u: u8[] = new Array<u8>(SHA256_SIZE)
+  const t: u8[] = new Array<u8>(SHA256_SIZE)
+  const index: u8[] = new Array<u8>(PBKDF2_INDEX)
+  const dk: u8[] = new Array<u8>(length)
+  // dkLen is an i32, so it never reaches RFC 8018's (2^32 - 1) * hLen bound,
+  // and the block index below never passes 2^26.
+  let block: i32 = 1
+  let done: i32 = 0
+  while (done < length) {
+    // U_1 = PRF(P, S || INT(i)), INT(i) four bytes, most significant first.
+    index[0] = toU8((block >> 24) & 0xff)
+    index[1] = toU8((block >> 16) & 0xff)
+    index[2] = toU8((block >> 8) & 0xff)
+    index[3] = toU8(block & 0xff)
+    hmacCopySha256(keyedInner, work)
+    work.update(salt, HMAC_FROM, toI32(salt.length))
+    work.update(index, HMAC_FROM, PBKDF2_INDEX)
+    pbkdf2Finish(keyedOuter, work, u)
+    for (let j: i32 = 0; j < SHA256_SIZE && j < toI32(t.length) && j < toI32(u.length); j += 1) {
+      t[j] = u[j]
+    }
+    // U_c = PRF(P, U_{c-1}); T_i = U_1 XOR ... XOR U_c.
+    for (let c: i32 = 1; c < iterations; c += 1) {
+      hmacCopySha256(keyedInner, work)
+      work.update(u, HMAC_FROM, SHA256_SIZE)
+      pbkdf2Finish(keyedOuter, work, u)
+      for (let j: i32 = 0; j < SHA256_SIZE && j < toI32(t.length) && j < toI32(u.length); j += 1) {
+        t[j] = t[j] ^ u[j]
+      }
+    }
+    const take: i32 = length - done < SHA256_SIZE ? length - done : SHA256_SIZE
+    for (let j: i32 = 0; j < take && j < toI32(t.length) && done + j < toI32(dk.length); j += 1) {
+      dk[done + j] = t[j]
+    }
+    done += take
+    block += 1
+  }
+  wipe(u)
+  wipe(t)
+  hmacWipeSha256(work)
+  hmacWipeSha256(keyedInner)
+  hmacWipeSha256(keyedOuter)
+  return dk
+}
+
+/**
+ * PBKDF2-HMAC-SHA256(P, S, c, dkLen) as RFC 8018 §5.2 defines it: the
+ * `dkLen`-byte key derived from the password `password` and the salt `salt`
+ * over `iterations` rounds, as a `Secret`.
+ *
+ *     const salted: Secret<u8[]> | null = pbkdf2HmacSha256(password, salt, 4096, 32);
+ *
+ * Bad input answers `null` and never panics: an iteration count or a length
+ * below 1, or a password or salt longer than 2^31 - 1 bytes. The password is
+ * read only inside `exposeWith`, and every U_j, every T_i, both keyed hashers
+ * and the working one are wiped before the key is answered; the digests on
+ * the way are wiped in the call that made them. The time taken depends on
+ * `iterations`, `dkLen` and the password's length past a block, all of which
+ * RFC 8018 treats as public, and on nothing of the password's bytes. The time
+ * is linear in `iterations` and nothing here bounds it, so a caller that takes
+ * the count from an untrusted peer (a SCRAM server's `i=`) must cap it first:
+ * 2^31 - 1 rounds is about 2^32 compressions.
+ */
+export const pbkdf2HmacSha256 = (
+  password: Secret<u8[]>,
+  salt: u8[],
+  iterations: i32,
+  length: i32
+): Secret<u8[]> | null => {
+  const request: Pbkdf2Request = { salt: salt, iterations: iterations, length: length }
+  const dk: u8[] | null = exposeWith(password, request, pbkdf2HmacSha256Exposed)
+  if (dk === null) {
+    return null
+  }
+  return secret(dk)
+}

package/std/crypto/x509.ts

@@ -72,10 +72,10 @@
  *
  * **Constant time.** A private key is the one secret that passes through here:
  * it is base64-decoded from PEM, lifted out of its DER, and handed to
- * `nish/crypto/p256`. Base64 maps a character to its sextet and back by
- * arithmetic on range masks, as `nish/crypto/base64url` does, and folds a bad
- * character into one word read after the whole text, so neither a branch nor a
- * table index depends on the key's bytes. PEM's framing is found by comparing
+ * `nish/crypto/p256`. Base64 is `nish/crypto/base64url`'s `base64StdPadDecode`,
+ * which maps a character to its sextet by arithmetic on range masks and folds a
+ * bad character into one word read after the whole text, so neither a branch
+ * nor a table index depends on the key's bytes. PEM's framing is found by comparing
  * the start of each line with the fixed `-----BEGIN ` and `-----END `, which no
  * base64 character matches, so those comparisons end on a line's first byte
  * whatever the key is. The DER reader branches on tags and
@@ -96,6 +96,7 @@
  * (`docs/wp26-stdlib.md` §3e).
  */
 import { Secret, secret, wipe } from "nish:secret"
+import { base64StdPadDecode, base64StdPadEncode } from "nish/crypto/base64url"
 import { p256PublicKey, p256SignSha256, p256VerifySha256 } from "nish/crypto/p256"
 import { sha256 } from "nish/crypto/sha256"
 
@@ -704,124 +705,9 @@ const x509Bytes = (text: string): u8[] => {
 }
 
 // ---------------------------------------------------------------------------
-// PEM (RFC 7468) and standard base64 (RFC 4648 §4)
+// PEM (RFC 7468), over `nish/crypto/base64url`'s padded base64
 // ---------------------------------------------------------------------------
 
-/**
- * All ones when `lo <= c <= hi`, else zero, without a branch; `c` is a byte or
- * a sextet. The subtractions are `u32`'s, which wrap by definition, rather
- * than checked `i32` ones, whose check would be a branch on a byte of what may
- * be a private key's PEM; the sign bit `>> 31` reads is the same.
- * `x509Base64CharOf` and `x509Base64SextetOf` sum in `u32` for the same reason.
- */
-const x509RangeMask = (c: i32, lo: i32, hi: i32): i32 =>
-  toI32((toU32(lo) - 1 - toU32(c)) & (toU32(c) - toU32(hi) - 1)) >> 31
-
-/**
- * The base64 character for the sextet `v`: `'A' + v`, stepped by the gap to
- * each later range it has reached — 26 lands on `a`, 52 on `0`, 62 on `+` and
- * 63 on `/`.
- */
-const x509Base64CharOf = (v: i32): i32 =>
-  toI32(
-    65 +
-      toU32(v) +
-      toU32(x509RangeMask(v, 26, 63) & 6) -
-      toU32(x509RangeMask(v, 52, 63) & 75) -
-      toU32(x509RangeMask(v, 62, 63) & 15) +
-      toU32(x509RangeMask(v, 63, 63) & 3)
-  )
-
-/** The sextet the byte `c` stands for in base64, or `-1` when it is not in the alphabet. */
-const x509Base64SextetOf = (c: i32): i32 => {
-  const upper: i32 = x509RangeMask(c, 65, 90)
-  const lower: i32 = x509RangeMask(c, 97, 122)
-  const digit: i32 = x509RangeMask(c, 48, 57)
-  const plus: i32 = x509RangeMask(c, 43, 43)
-  const slash: i32 = x509RangeMask(c, 47, 47)
-  const value: i32 =
-    (upper & toI32(toU32(c) - 65)) |
-    (lower & toI32(toU32(c) - 71)) |
-    (digit & toI32(toU32(c) + 4)) |
-    (plus & 62) |
-    (slash & 63)
-  return value | ~(upper | lower | digit | plus | slash)
-}
-
-/** `data` in padded base64, as one line. */
-const x509Base64Encode = (data: u8[]): string => {
-  const parts: string[] = []
-  let acc: i32 = 0
-  let bits: i32 = 0
-  for (let k: i32 = 0; k < toI32(data.length); k++) {
-    acc = ((acc << 8) | toI32(data[k])) & 0xfff
-    bits = bits + 8
-    while (bits >= 6) {
-      bits = bits - 6
-      parts.push(String.fromCharCode(x509Base64CharOf((acc >> bits) & 63)))
-    }
-  }
-  if (bits > 0) {
-    parts.push(String.fromCharCode(x509Base64CharOf((acc << (6 - bits)) & 63)))
-  }
-  // One `=` for a final group of two bytes, two for one byte.
-  const tail: i32 = toI32(data.length) % 3
-  if (tail > 0) {
-    parts.push(tail === 1 ? "==" : "=")
-  }
-  return parts.join("")
-}
-
-/**
- * The bytes of padded base64 `text`, or `null` unless it is the one canonical
- * spelling of them: a whole number of four-character groups, `=` only as the
- * last one or two characters, every other character in the alphabet, and the
- * bits the padding leaves over all zero (RFC 4648 §3.5). Where the padding is
- * depends on the length alone; the characters themselves are read by masks and
- * judged once, after the last.
- */
-const x509Base64Decode = (text: string): u8[] | null => {
-  const n: i32 = toI32(text.length)
-  if (n === 0 || (n & 3) !== 0) {
-    return null
-  }
-  let pad: i32 = 0
-  if (toI32(text.charCodeAt(n - 1)) === 61) {
-    pad = toI32(text.charCodeAt(n - 2)) === 61 ? 2 : 1
-  }
-  const chars: i32 = n - pad
-  const out: u8[] = new Array<u8>((n >> 2) * 3 - pad)
-  const outLen: i32 = toI32(out.length)
-  let bad: i32 = 0
-  let acc: i32 = 0
-  let bits: i32 = 0
-  let j: i32 = 0
-  for (let k: i32 = 0; k < toI32(text.length); k++) {
-    // The padding is past `chars`, and is not data; which positions those are
-    // is a fact about the length.
-    if (k < chars) {
-      const v: i32 = x509Base64SextetOf(toI32(text.charCodeAt(k)))
-      bad = bad | (v >> 31)
-      acc = ((acc << 6) | (v & 63)) & 0xfff
-      bits = bits + 6
-      if (bits >= 8) {
-        bits = bits - 8
-        // Always true — `out` was sized from the same length — and written so
-        // the store keeps no bounds check.
-        if (j >= 0 && j < outLen) {
-          out[j] = toU8((acc >> bits) & 0xff)
-        }
-        j = j + 1
-      }
-    }
-  }
-  bad = bad | (acc & ((1 << bits) - 1))
-  if (bad !== 0) {
-    return null
-  }
-  return out
-}
-
 /** Whether `text` starts with `prefix`. */
 const x509StartsWith = (text: string, prefix: string): boolean => {
   const n: i32 = toI32(prefix.length)
@@ -841,7 +727,7 @@ const x509EndsWith = (text: string, suffix: string): boolean => {
  * ending in a line feed.
  */
 export const derToPem = (der: u8[], label: string): string => {
-  const body: string = x509Base64Encode(der)
+  const body: string = base64StdPadEncode(der)
   const n: i32 = toI32(body.length)
   const lines: string[] = [`-----BEGIN ${label}-----`]
   for (let at: i32 = 0; at < n; at = at + 64) {
@@ -894,7 +780,10 @@ export const pemToDer = (pem: string, label: string): u8[][] | null => {
       }
       // Every block is decoded, whatever its label: a malformed block beside the
       // one asked for is refused, not skipped (docs/security/crypto-x509.md, X509-1).
-      const der: u8[] | null = x509Base64Decode(body.join(""))
+      // An empty body is refused: a block with no DER is malformed, though
+      // the empty text is base64 for no bytes.
+      const text: string = body.join("")
+      const der: u8[] | null = text.length === 0 ? null : base64StdPadDecode(text)
       if (der === null) {
         return null
       }