@libp2p/noise 1.0.0-049bfa0fa

package/src/protocol.ts

@@ -0,0 +1,313 @@
+import { Uint8ArrayList } from 'uint8arraylist'
+import { fromString as uint8ArrayFromString } from 'uint8arrays'
+import { alloc as uint8ArrayAlloc } from 'uint8arrays/alloc'
+import { InvalidCryptoExchangeError } from './errors.js'
+import { Nonce } from './nonce.js'
+import type { ICipherState, ISymmetricState, IHandshakeState, KeyPair, ICrypto } from './types.js'
+
+// Code in this file is a direct translation of a subset of the noise protocol https://noiseprotocol.org/noise.html,
+// agnostic to libp2p's usage of noise
+
+export const ZEROLEN = uint8ArrayAlloc(0)
+
+interface ICipherStateWithKey extends ICipherState {
+  k: Uint8Array
+}
+
+export class CipherState implements ICipherState {
+  public k?: Uint8Array
+  public n: Nonce
+  private readonly crypto: ICrypto
+
+  constructor (crypto: ICrypto, k: Uint8Array | undefined = undefined, n = 0) {
+    this.crypto = crypto
+    this.k = k
+    this.n = new Nonce(n)
+  }
+
+  public hasKey (): this is ICipherStateWithKey {
+    return Boolean(this.k)
+  }
+
+  public encryptWithAd (ad: Uint8Array, plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    if (!this.hasKey()) {
+      return plaintext
+    }
+
+    this.n.assertValue()
+    const e = this.crypto.encrypt(plaintext, this.n.getBytes(), ad, this.k)
+    this.n.increment()
+
+    return e
+  }
+
+  public decryptWithAd (ad: Uint8Array, ciphertext: Uint8Array | Uint8ArrayList, dst?: Uint8Array): Uint8Array | Uint8ArrayList {
+    if (!this.hasKey()) {
+      return ciphertext
+    }
+
+    this.n.assertValue()
+    const plaintext = this.crypto.decrypt(ciphertext, this.n.getBytes(), ad, this.k, dst)
+    this.n.increment()
+
+    return plaintext
+  }
+}
+
+export class SymmetricState implements ISymmetricState {
+  public cs: CipherState
+  public ck: Uint8Array
+  public h: Uint8Array
+  private readonly crypto: ICrypto
+
+  constructor (crypto: ICrypto, protocolName: string) {
+    this.crypto = crypto
+
+    const protocolNameBytes = uint8ArrayFromString(protocolName, 'utf-8')
+    this.h = hashProtocolName(crypto, protocolNameBytes)
+
+    this.ck = this.h
+    this.cs = new CipherState(crypto)
+  }
+
+  public mixKey (ikm: Uint8Array): void {
+    const [ck, tempK] = this.crypto.hkdf(this.ck, ikm)
+    this.ck = ck
+    this.cs = new CipherState(this.crypto, tempK)
+  }
+
+  public mixHash (data: Uint8Array | Uint8ArrayList): void {
+    this.h = this.crypto.hash(new Uint8ArrayList(this.h, data))
+  }
+
+  public encryptAndHash (plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const ciphertext = this.cs.encryptWithAd(this.h, plaintext)
+    this.mixHash(ciphertext)
+    return ciphertext
+  }
+
+  public decryptAndHash (ciphertext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const plaintext = this.cs.decryptWithAd(this.h, ciphertext)
+    this.mixHash(ciphertext)
+    return plaintext
+  }
+
+  public split (): [CipherState, CipherState] {
+    const [tempK1, tempK2] = this.crypto.hkdf(this.ck, ZEROLEN)
+    return [new CipherState(this.crypto, tempK1), new CipherState(this.crypto, tempK2)]
+  }
+}
+
+// const MESSAGE_PATTERNS = ['e', 's', 'ee', 'es', 'se', 'ss'] as const
+// type MessagePattern = Array<typeof MESSAGE_PATTERNS[number]>
+
+export interface HandshakeStateInit {
+  crypto: ICrypto
+  protocolName: string
+  initiator: boolean
+  prologue: Uint8Array
+  s?: KeyPair
+  e?: KeyPair
+  rs?: Uint8Array | Uint8ArrayList
+  re?: Uint8Array | Uint8ArrayList
+}
+
+export abstract class AbstractHandshakeState implements IHandshakeState {
+  public ss: SymmetricState
+  public s?: KeyPair
+  public e?: KeyPair
+  public rs?: Uint8Array | Uint8ArrayList
+  public re?: Uint8Array | Uint8ArrayList
+  public initiator: boolean
+  protected readonly crypto: ICrypto
+
+  constructor (init: HandshakeStateInit) {
+    const { crypto, protocolName, prologue, initiator, s, e, rs, re } = init
+    this.crypto = crypto
+    this.ss = new SymmetricState(crypto, protocolName)
+    this.ss.mixHash(prologue)
+    this.initiator = initiator
+    this.s = s
+    this.e = e
+    this.rs = rs
+    this.re = re
+  }
+
+  protected writeE (): Uint8Array {
+    if (this.e) {
+      throw new Error('ephemeral keypair is already set')
+    }
+    const e = this.crypto.generateKeypair()
+    this.ss.mixHash(e.publicKey)
+    this.e = e
+    return e.publicKey
+  }
+
+  protected writeS (): Uint8Array | Uint8ArrayList {
+    if (!this.s) {
+      throw new Error('static keypair is not set')
+    }
+    return this.ss.encryptAndHash(this.s.publicKey)
+  }
+
+  protected writeEE (): void {
+    if (!this.e) {
+      throw new Error('ephemeral keypair is not set')
+    }
+    if (!this.re) {
+      throw new Error('remote ephemeral public key is not set')
+    }
+    this.ss.mixKey(this.crypto.dh(this.e, this.re))
+  }
+
+  protected writeES (): void {
+    if (this.initiator) {
+      if (!this.e) {
+        throw new Error('ephemeral keypair is not set')
+      }
+      if (!this.rs) {
+        throw new Error('remote static public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.e, this.rs))
+    } else {
+      if (!this.s) {
+        throw new Error('static keypair is not set')
+      }
+      if (!this.re) {
+        throw new Error('remote ephemeral public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.s, this.re))
+    }
+  }
+
+  protected writeSE (): void {
+    if (this.initiator) {
+      if (!this.s) {
+        throw new Error('static keypair is not set')
+      }
+      if (!this.re) {
+        throw new Error('remote ephemeral public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.s, this.re))
+    } else {
+      if (!this.e) {
+        throw new Error('ephemeral keypair is not set')
+      }
+      if (!this.rs) {
+        throw new Error('remote static public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.e, this.rs))
+    }
+  }
+
+  protected readE (message: Uint8ArrayList, offset = 0): void {
+    if (this.re) {
+      throw new Error('remote ephemeral public key is already set')
+    }
+    if (message.byteLength < offset + 32) {
+      throw new Error('message is not long enough')
+    }
+    this.re = message.sublist(offset, offset + 32)
+    this.ss.mixHash(this.re)
+  }
+
+  protected readS (message: Uint8ArrayList, offset = 0): number {
+    if (this.rs) {
+      throw new Error('remote static public key is already set')
+    }
+    const cipherLength = 32 + (this.ss.cs.hasKey() ? 16 : 0)
+    if (message.byteLength < offset + cipherLength) {
+      throw new Error('message is not long enough')
+    }
+    const temp = message.sublist(offset, offset + cipherLength)
+    this.rs = this.ss.decryptAndHash(temp)
+    return cipherLength
+  }
+
+  protected readEE (): void {
+    this.writeEE()
+  }
+
+  protected readES (): void {
+    this.writeES()
+  }
+
+  protected readSE (): void {
+    this.writeSE()
+  }
+}
+
+/**
+ * A IHandshakeState that's optimized for the XX pattern
+ */
+export class XXHandshakeState extends AbstractHandshakeState {
+  // e
+  writeMessageA (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    return new Uint8ArrayList(this.writeE(), this.ss.encryptAndHash(payload))
+  }
+
+  // e, ee, s, es
+  writeMessageB (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const e = this.writeE()
+    this.writeEE()
+    const encS = this.writeS()
+    this.writeES()
+
+    return new Uint8ArrayList(e, encS, this.ss.encryptAndHash(payload))
+  }
+
+  // s, se
+  writeMessageC (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const encS = this.writeS()
+    this.writeSE()
+
+    return new Uint8ArrayList(encS, this.ss.encryptAndHash(payload))
+  }
+
+  // e
+  readMessageA (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      this.readE(message)
+
+      return this.ss.decryptAndHash(message.sublist(32))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 0 validation fail: ${(e as Error).message}`)
+    }
+  }
+
+  // e, ee, s, es
+  readMessageB (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      this.readE(message)
+      this.readEE()
+      const consumed = this.readS(message, 32)
+      this.readES()
+
+      return this.ss.decryptAndHash(message.sublist(32 + consumed))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 1 validation fail: ${(e as Error).message}`)
+    }
+  }
+
+  // s, se
+  readMessageC (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      const consumed = this.readS(message)
+      this.readSE()
+
+      return this.ss.decryptAndHash(message.sublist(consumed))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 2 validation fail: ${(e as Error).message}`)
+    }
+  }
+}
+
+function hashProtocolName (crypto: ICrypto, protocolName: Uint8Array): Uint8Array {
+  if (protocolName.length <= 32) {
+    const h = uint8ArrayAlloc(32)
+    h.set(protocolName)
+    return h
+  } else {
+    return crypto.hash(protocolName)
+  }
+}

package/src/types.ts

@@ -0,0 +1,105 @@
+import type { Nonce } from './nonce.js'
+import type { NoiseExtensions, NoiseHandshakePayload } from './proto/payload.js'
+import type { ConnectionEncrypter, Logger, PrivateKey, PublicKey } from '@libp2p/interface'
+import type { LengthPrefixedStream } from '@libp2p/utils'
+import type { Uint8ArrayList } from 'uint8arraylist'
+
+/**
+ * Crypto functions defined by the noise protocol, abstracted from the
+ * underlying implementations
+ */
+export interface ICrypto {
+  generateKeypair(): KeyPair
+  dh(keypair: KeyPair, publicKey: Uint8Array | Uint8ArrayList): Uint8Array
+  encrypt(plaintext: Uint8Array | Uint8ArrayList, nonce: Uint8Array, ad: Uint8Array, k: Uint8Array): Uint8ArrayList | Uint8Array
+  decrypt(ciphertext: Uint8Array | Uint8ArrayList, nonce: Uint8Array, ad: Uint8Array, k: Uint8Array, dst?: Uint8Array): Uint8ArrayList | Uint8Array
+  hash(data: Uint8Array | Uint8ArrayList): Uint8Array
+  hkdf(ck: Uint8Array, ikm: Uint8Array): [Uint8Array, Uint8Array, Uint8Array]
+}
+
+export interface HandshakeParams {
+  log: Logger
+  connection: LengthPrefixedStream
+  crypto: ICrypto
+  privateKey: PrivateKey
+  prologue: Uint8Array
+  /** static keypair */
+  s: KeyPair
+  remoteIdentityKey?: PublicKey
+  extensions?: NoiseExtensions
+}
+
+export interface HandshakeResult {
+  payload: NoiseHandshakePayload
+  encrypt (plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList
+  decrypt (ciphertext: Uint8Array | Uint8ArrayList, dst?: Uint8Array): Uint8Array | Uint8ArrayList
+}
+
+/**
+ * A CipherState object contains k and n variables, which it uses to encrypt and
+ * decrypt ciphertext.
+ *
+ * During the handshake phase each party has a single CipherState, but during
+ * the transport phase each party has two CipherState objects: one for sending,
+ * and one for receiving.
+ */
+export interface ICipherState {
+  /**
+   * A cipher key of 32 bytes (which may be empty). Empty is a special value
+   * which indicates k has not yet been initialized.
+   */
+  k?: Uint8Array
+  /**
+   * An 8-byte (64-bit) unsigned integer nonce.
+   *
+   * For performance reasons, the nonce is represented as a Nonce object
+   * The nonce is treated as a uint64, even though the underlying `number` only
+   * has 52 safely-available bits.
+   */
+  n: Nonce
+}
+
+/**
+ * A SymmetricState object contains a CipherState plus ck and h variables. It is
+ * so-named because it encapsulates all the "symmetric crypto" used by Noise.
+ *
+ * During the handshake phase each party has a single SymmetricState, which can
+ * be deleted once the handshake is finished.
+ */
+export interface ISymmetricState {
+  cs: ICipherState
+  /** A chaining key of 32 bytes. */
+  ck: Uint8Array
+  /** A hash output of 32 bytes. */
+  h: Uint8Array
+}
+
+/**
+ * A HandshakeState object contains a SymmetricState plus DH variables (s, e,
+ * rs, re) and a variable representing the handshake pattern.
+ *
+ * During the handshake phase each party has a single HandshakeState, which can
+ * be deleted once the handshake is finished.
+ */
+export interface IHandshakeState {
+  ss: ISymmetricState
+  /** The local static key pair */
+  s?: KeyPair
+  /** The local ephemeral key pair */
+  e?: KeyPair
+  /** The remote party's static public key */
+  rs?: Uint8Array | Uint8ArrayList
+  /** The remote party's ephemeral public key */
+  re?: Uint8Array | Uint8ArrayList
+}
+
+export interface KeyPair {
+  publicKey: Uint8Array
+  privateKey: Uint8Array
+}
+
+export interface INoiseExtensions {
+  webtransportCerthashes: Uint8Array[]
+}
+
+export interface INoiseConnection extends ConnectionEncrypter<INoiseExtensions> { }

package/src/utils.ts

@@ -0,0 +1,221 @@
+import { publicKeyFromProtobuf, publicKeyToProtobuf } from '@libp2p/crypto/keys'
+import { StreamMessageEvent, UnexpectedPeerError } from '@libp2p/interface'
+import { AbstractMessageStream, LengthPrefixedDecoder } from '@libp2p/utils'
+import { Uint8ArrayList } from 'uint8arraylist'
+import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
+import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
+import { CHACHA_TAG_LENGTH, NOISE_MSG_MAX_LENGTH_BYTES, NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG } from './constants.ts'
+import { uint16BEEncode, uint16BEDecode } from './encoder.ts'
+import { NoiseHandshakePayload } from './proto/payload.js'
+import type { MetricsRegistry } from './metrics.ts'
+import type { NoiseExtensions } from './proto/payload.js'
+import type { HandshakeResult } from './types.ts'
+import type { AbortOptions, MessageStream, PrivateKey, PublicKey, StreamCloseEvent } from '@libp2p/interface'
+import type { SendResult } from '@libp2p/utils'
+
+export async function createHandshakePayload (
+  privateKey: PrivateKey,
+  staticPublicKey: Uint8Array | Uint8ArrayList,
+  extensions?: NoiseExtensions
+): Promise<Uint8Array | Uint8ArrayList> {
+  const identitySig = await privateKey.sign(getSignaturePayload(staticPublicKey))
+
+  return NoiseHandshakePayload.encode({
+    identityKey: publicKeyToProtobuf(privateKey.publicKey),
+    identitySig,
+    extensions
+  })
+}
+
+export async function decodeHandshakePayload (
+  payloadBytes: Uint8Array | Uint8ArrayList,
+  remoteStaticKey?: Uint8Array | Uint8ArrayList,
+  remoteIdentityKey?: PublicKey
+): Promise<NoiseHandshakePayload> {
+  try {
+    const payload = NoiseHandshakePayload.decode(payloadBytes)
+    const publicKey = publicKeyFromProtobuf(payload.identityKey)
+
+    if (remoteIdentityKey?.equals(publicKey) === false) {
+      throw new Error(`Payload identity key ${publicKey} does not match expected remote identity key ${remoteIdentityKey}`)
+    }
+
+    if (!remoteStaticKey) {
+      throw new Error('Remote static does not exist')
+    }
+
+    const signaturePayload = getSignaturePayload(remoteStaticKey)
+
+    if (!(await publicKey.verify(signaturePayload, payload.identitySig))) {
+      throw new Error('Invalid payload signature')
+    }
+
+    return payload
+  } catch (e) {
+    throw new UnexpectedPeerError((e as Error).message)
+  }
+}
+
+export function getSignaturePayload (publicKey: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+  const prefix = uint8ArrayFromString('noise-libp2p-static-key:')
+
+  if (publicKey instanceof Uint8Array) {
+    return uint8ArrayConcat([prefix, publicKey], prefix.length + publicKey.length)
+  }
+
+  publicKey.prepend(prefix)
+
+  return publicKey
+}
+
+class EncryptedMessageStream extends AbstractMessageStream {
+  private stream: MessageStream
+  private handshake: HandshakeResult
+  private metrics?: MetricsRegistry
+  private decoder: LengthPrefixedDecoder
+
+  constructor (stream: MessageStream, handshake: HandshakeResult, metrics?: MetricsRegistry) {
+    super({
+      log: stream.log,
+      inactivityTimeout: stream.inactivityTimeout,
+      maxReadBufferLength: stream.maxReadBufferLength,
+      direction: stream.direction
+    })
+
+    this.stream = stream
+    this.handshake = handshake
+    this.metrics = metrics
+    this.decoder = new LengthPrefixedDecoder({
+      lengthDecoder: uint16BEDecode,
+      maxBufferSize: 16 * 1024 * 1024,
+      encodingLength: () => 2
+    })
+
+    const noiseOnMessageDecrypt = (evt: StreamMessageEvent): void => {
+      try {
+        for (const buf of this.decoder.decode(evt.data)) {
+          this.onData(this.decrypt(buf))
+        }
+      } catch (err: any) {
+        this.abort(err)
+      }
+    }
+    this.stream.addEventListener('message', noiseOnMessageDecrypt)
+
+    const noiseOnClose = (evt: StreamCloseEvent): void => {
+      if (evt.error != null) {
+        if (evt.local === true) {
+          this.abort(evt.error)
+        } else {
+          this.onRemoteReset()
+        }
+      } else {
+        this.onTransportClosed()
+      }
+    }
+    this.stream.addEventListener('close', noiseOnClose)
+
+    const noiseOnDrain = (): void => {
+      this.safeDispatchEvent('drain')
+    }
+    this.stream.addEventListener('drain', noiseOnDrain)
+
+    const noiseOnRemoteCloseWrite = (): void => {
+      this.onRemoteCloseWrite()
+    }
+    this.stream.addEventListener('remoteCloseWrite', noiseOnRemoteCloseWrite)
+  }
+
+  encrypt (chunk: Uint8Array | Uint8ArrayList): Uint8ArrayList {
+    const output = new Uint8ArrayList()
+
+    for (let i = 0; i < chunk.byteLength; i += NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG) {
+      let end = i + NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG
+      if (end > chunk.byteLength) {
+        end = chunk.byteLength
+      }
+
+      let data: Uint8Array | Uint8ArrayList
+
+      if (chunk instanceof Uint8Array) {
+        data = this.handshake.encrypt(chunk.subarray(i, end))
+      } else {
+        data = this.handshake.encrypt(chunk.sublist(i, end))
+      }
+
+      this.metrics?.encryptedPackets.increment()
+
+      output.append(uint16BEEncode(data.byteLength))
+      output.append(data)
+    }
+
+    return output
+  }
+
+  decrypt (chunk: Uint8Array | Uint8ArrayList): Uint8ArrayList {
+    const output = new Uint8ArrayList()
+
+    for (let i = 0; i < chunk.byteLength; i += NOISE_MSG_MAX_LENGTH_BYTES) {
+      let end = i + NOISE_MSG_MAX_LENGTH_BYTES
+      if (end > chunk.byteLength) {
+        end = chunk.byteLength
+      }
+
+      if (end - CHACHA_TAG_LENGTH < i) {
+        throw new Error('Invalid chunk')
+      }
+
+      let encrypted: Uint8Array | Uint8ArrayList
+
+      if (chunk instanceof Uint8Array) {
+        encrypted = chunk.subarray(i, end)
+      } else {
+        encrypted = chunk.sublist(i, end)
+      }
+
+      // memory allocation is not cheap so reuse the encrypted Uint8Array
+      // see https://github.com/ChainSafe/js-libp2p-noise/pull/242#issue-1422126164
+      // this is ok because chacha20 reads bytes one by one and don't reread after that
+      // it's also tested in https://github.com/ChainSafe/as-chacha20poly1305/pull/1/files#diff-25252846b58979dcaf4e41d47b3eadd7e4f335e7fb98da6c049b1f9cd011f381R48
+      const dst = chunk.subarray(i, end - CHACHA_TAG_LENGTH)
+      try {
+        const plaintext = this.handshake.decrypt(encrypted, dst)
+        this.metrics?.decryptedPackets.increment()
+
+        output.append(plaintext)
+      } catch (e) {
+        this.metrics?.decryptErrors.increment()
+        throw e
+      }
+    }
+
+    return output
+  }
+
+  close (options?: AbortOptions): Promise<void> {
+    return this.stream.close(options)
+  }
+
+  sendPause (): void {
+    this.stream.pause()
+  }
+
+  sendResume (): void {
+    this.stream.resume()
+  }
+
+  sendReset (err: Error): void {
+    this.stream.abort(err)
+  }
+
+  sendData (data: Uint8ArrayList): SendResult {
+    return {
+      sentBytes: data.byteLength,
+      canSendMore: this.stream.send(this.encrypt(data))
+    }
+  }
+}
+
+export function toMessageStream (connection: MessageStream, handshake: HandshakeResult, metrics?: MetricsRegistry): MessageStream {
+  return new EncryptedMessageStream(connection, handshake, metrics)
+}