@libp2p/noise 12.0.1 → 16.1.4-6059227cb

package/src/proto/payload.ts

@@ -1,15 +1,11 @@
-/* eslint-disable import/export */
-/* eslint-disable complexity */
-/* eslint-disable @typescript-eslint/no-namespace */
-/* eslint-disable @typescript-eslint/no-unnecessary-boolean-literal-compare */
-/* eslint-disable @typescript-eslint/no-empty-interface */
-
-import { encodeMessage, decodeMessage, message } from 'protons-runtime'
-import type { Codec } from 'protons-runtime'
+import { decodeMessage, encodeMessage, MaxLengthError, message } from 'protons-runtime'
+import { alloc as uint8ArrayAlloc } from 'uint8arrays/alloc'
+import type { Codec, DecodeOptions } from 'protons-runtime'
 import type { Uint8ArrayList } from 'uint8arraylist'
 
 export interface NoiseExtensions {
   webtransportCerthashes: Uint8Array[]
+  streamMuxers: string[]
 }
 
 export namespace NoiseExtensions {
@@ -29,12 +25,20 @@ export namespace NoiseExtensions {
           }
         }
 
+        if (obj.streamMuxers != null) {
+          for (const value of obj.streamMuxers) {
+            w.uint32(18)
+            w.string(value)
+          }
+        }
+
         if (opts.lengthDelimited !== false) {
           w.ldelim()
         }
-      }, (reader, length) => {
+      }, (reader, length, opts = {}) => {
         const obj: any = {
-          webtransportCerthashes: []
+          webtransportCerthashes: [],
+          streamMuxers: []
         }
 
         const end = length == null ? reader.len : reader.pos + length
@@ -43,12 +47,26 @@ export namespace NoiseExtensions {
           const tag = reader.uint32()
 
           switch (tag >>> 3) {
-            case 1:
+            case 1: {
+              if (opts.limits?.webtransportCerthashes != null && obj.webtransportCerthashes.length === opts.limits.webtransportCerthashes) {
+                throw new MaxLengthError('Decode error - map field "webtransportCerthashes" had too many elements')
+              }
+
               obj.webtransportCerthashes.push(reader.bytes())
               break
-            default:
+            }
+            case 2: {
+              if (opts.limits?.streamMuxers != null && obj.streamMuxers.length === opts.limits.streamMuxers) {
+                throw new MaxLengthError('Decode error - map field "streamMuxers" had too many elements')
+              }
+
+              obj.streamMuxers.push(reader.string())
+              break
+            }
+            default: {
               reader.skipType(tag & 7)
               break
+            }
           }
         }
 
@@ -63,8 +81,8 @@ export namespace NoiseExtensions {
     return encodeMessage(obj, NoiseExtensions.codec())
   }
 
-  export const decode = (buf: Uint8Array | Uint8ArrayList): NoiseExtensions => {
-    return decodeMessage(buf, NoiseExtensions.codec())
+  export const decode = (buf: Uint8Array | Uint8ArrayList, opts?: DecodeOptions<NoiseExtensions>): NoiseExtensions => {
+    return decodeMessage(buf, NoiseExtensions.codec(), opts)
   }
 }
 
@@ -84,30 +102,28 @@ export namespace NoiseHandshakePayload {
           w.fork()
         }
 
-        if (opts.writeDefaults === true || (obj.identityKey != null && obj.identityKey.byteLength > 0)) {
+        if ((obj.identityKey != null && obj.identityKey.byteLength > 0)) {
           w.uint32(10)
-          w.bytes(obj.identityKey ?? new Uint8Array(0))
+          w.bytes(obj.identityKey)
         }
 
-        if (opts.writeDefaults === true || (obj.identitySig != null && obj.identitySig.byteLength > 0)) {
+        if ((obj.identitySig != null && obj.identitySig.byteLength > 0)) {
           w.uint32(18)
-          w.bytes(obj.identitySig ?? new Uint8Array(0))
+          w.bytes(obj.identitySig)
         }
 
         if (obj.extensions != null) {
           w.uint32(34)
-          NoiseExtensions.codec().encode(obj.extensions, w, {
-            writeDefaults: false
-          })
+          NoiseExtensions.codec().encode(obj.extensions, w)
         }
 
         if (opts.lengthDelimited !== false) {
           w.ldelim()
         }
-      }, (reader, length) => {
+      }, (reader, length, opts = {}) => {
         const obj: any = {
-          identityKey: new Uint8Array(0),
-          identitySig: new Uint8Array(0)
+          identityKey: uint8ArrayAlloc(0),
+          identitySig: uint8ArrayAlloc(0)
         }
 
         const end = length == null ? reader.len : reader.pos + length
@@ -116,18 +132,24 @@ export namespace NoiseHandshakePayload {
           const tag = reader.uint32()
 
           switch (tag >>> 3) {
-            case 1:
+            case 1: {
               obj.identityKey = reader.bytes()
               break
-            case 2:
+            }
+            case 2: {
               obj.identitySig = reader.bytes()
               break
-            case 4:
-              obj.extensions = NoiseExtensions.codec().decode(reader, reader.uint32())
+            }
+            case 4: {
+              obj.extensions = NoiseExtensions.codec().decode(reader, reader.uint32(), {
+                limits: opts.limits?.extensions
+              })
               break
-            default:
+            }
+            default: {
               reader.skipType(tag & 7)
               break
+            }
           }
         }
 
@@ -142,7 +164,7 @@ export namespace NoiseHandshakePayload {
     return encodeMessage(obj, NoiseHandshakePayload.codec())
   }
 
-  export const decode = (buf: Uint8Array | Uint8ArrayList): NoiseHandshakePayload => {
-    return decodeMessage(buf, NoiseHandshakePayload.codec())
+  export const decode = (buf: Uint8Array | Uint8ArrayList, opts?: DecodeOptions<NoiseHandshakePayload>): NoiseHandshakePayload => {
+    return decodeMessage(buf, NoiseHandshakePayload.codec(), opts)
   }
 }

package/src/protocol.ts

@@ -0,0 +1,313 @@
+import { Uint8ArrayList } from 'uint8arraylist'
+import { fromString as uint8ArrayFromString } from 'uint8arrays'
+import { alloc as uint8ArrayAlloc } from 'uint8arrays/alloc'
+import { InvalidCryptoExchangeError } from './errors.js'
+import { Nonce } from './nonce.js'
+import type { ICipherState, ISymmetricState, IHandshakeState, KeyPair, ICrypto } from './types.js'
+
+// Code in this file is a direct translation of a subset of the noise protocol https://noiseprotocol.org/noise.html,
+// agnostic to libp2p's usage of noise
+
+export const ZEROLEN = uint8ArrayAlloc(0)
+
+interface ICipherStateWithKey extends ICipherState {
+  k: Uint8Array
+}
+
+export class CipherState implements ICipherState {
+  public k?: Uint8Array
+  public n: Nonce
+  private readonly crypto: ICrypto
+
+  constructor (crypto: ICrypto, k: Uint8Array | undefined = undefined, n = 0) {
+    this.crypto = crypto
+    this.k = k
+    this.n = new Nonce(n)
+  }
+
+  public hasKey (): this is ICipherStateWithKey {
+    return Boolean(this.k)
+  }
+
+  public encryptWithAd (ad: Uint8Array, plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    if (!this.hasKey()) {
+      return plaintext
+    }
+
+    this.n.assertValue()
+    const e = this.crypto.encrypt(plaintext, this.n.getBytes(), ad, this.k)
+    this.n.increment()
+
+    return e
+  }
+
+  public decryptWithAd (ad: Uint8Array, ciphertext: Uint8Array | Uint8ArrayList, dst?: Uint8Array): Uint8Array | Uint8ArrayList {
+    if (!this.hasKey()) {
+      return ciphertext
+    }
+
+    this.n.assertValue()
+    const plaintext = this.crypto.decrypt(ciphertext, this.n.getBytes(), ad, this.k, dst)
+    this.n.increment()
+
+    return plaintext
+  }
+}
+
+export class SymmetricState implements ISymmetricState {
+  public cs: CipherState
+  public ck: Uint8Array
+  public h: Uint8Array
+  private readonly crypto: ICrypto
+
+  constructor (crypto: ICrypto, protocolName: string) {
+    this.crypto = crypto
+
+    const protocolNameBytes = uint8ArrayFromString(protocolName, 'utf-8')
+    this.h = hashProtocolName(crypto, protocolNameBytes)
+
+    this.ck = this.h
+    this.cs = new CipherState(crypto)
+  }
+
+  public mixKey (ikm: Uint8Array): void {
+    const [ck, tempK] = this.crypto.hkdf(this.ck, ikm)
+    this.ck = ck
+    this.cs = new CipherState(this.crypto, tempK)
+  }
+
+  public mixHash (data: Uint8Array | Uint8ArrayList): void {
+    this.h = this.crypto.hash(new Uint8ArrayList(this.h, data))
+  }
+
+  public encryptAndHash (plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const ciphertext = this.cs.encryptWithAd(this.h, plaintext)
+    this.mixHash(ciphertext)
+    return ciphertext
+  }
+
+  public decryptAndHash (ciphertext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const plaintext = this.cs.decryptWithAd(this.h, ciphertext)
+    this.mixHash(ciphertext)
+    return plaintext
+  }
+
+  public split (): [CipherState, CipherState] {
+    const [tempK1, tempK2] = this.crypto.hkdf(this.ck, ZEROLEN)
+    return [new CipherState(this.crypto, tempK1), new CipherState(this.crypto, tempK2)]
+  }
+}
+
+// const MESSAGE_PATTERNS = ['e', 's', 'ee', 'es', 'se', 'ss'] as const
+// type MessagePattern = Array<typeof MESSAGE_PATTERNS[number]>
+
+export interface HandshakeStateInit {
+  crypto: ICrypto
+  protocolName: string
+  initiator: boolean
+  prologue: Uint8Array
+  s?: KeyPair
+  e?: KeyPair
+  rs?: Uint8Array | Uint8ArrayList
+  re?: Uint8Array | Uint8ArrayList
+}
+
+export abstract class AbstractHandshakeState implements IHandshakeState {
+  public ss: SymmetricState
+  public s?: KeyPair
+  public e?: KeyPair
+  public rs?: Uint8Array | Uint8ArrayList
+  public re?: Uint8Array | Uint8ArrayList
+  public initiator: boolean
+  protected readonly crypto: ICrypto
+
+  constructor (init: HandshakeStateInit) {
+    const { crypto, protocolName, prologue, initiator, s, e, rs, re } = init
+    this.crypto = crypto
+    this.ss = new SymmetricState(crypto, protocolName)
+    this.ss.mixHash(prologue)
+    this.initiator = initiator
+    this.s = s
+    this.e = e
+    this.rs = rs
+    this.re = re
+  }
+
+  protected writeE (): Uint8Array {
+    if (this.e) {
+      throw new Error('ephemeral keypair is already set')
+    }
+    const e = this.crypto.generateKeypair()
+    this.ss.mixHash(e.publicKey)
+    this.e = e
+    return e.publicKey
+  }
+
+  protected writeS (): Uint8Array | Uint8ArrayList {
+    if (!this.s) {
+      throw new Error('static keypair is not set')
+    }
+    return this.ss.encryptAndHash(this.s.publicKey)
+  }
+
+  protected writeEE (): void {
+    if (!this.e) {
+      throw new Error('ephemeral keypair is not set')
+    }
+    if (!this.re) {
+      throw new Error('remote ephemeral public key is not set')
+    }
+    this.ss.mixKey(this.crypto.dh(this.e, this.re))
+  }
+
+  protected writeES (): void {
+    if (this.initiator) {
+      if (!this.e) {
+        throw new Error('ephemeral keypair is not set')
+      }
+      if (!this.rs) {
+        throw new Error('remote static public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.e, this.rs))
+    } else {
+      if (!this.s) {
+        throw new Error('static keypair is not set')
+      }
+      if (!this.re) {
+        throw new Error('remote ephemeral public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.s, this.re))
+    }
+  }
+
+  protected writeSE (): void {
+    if (this.initiator) {
+      if (!this.s) {
+        throw new Error('static keypair is not set')
+      }
+      if (!this.re) {
+        throw new Error('remote ephemeral public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.s, this.re))
+    } else {
+      if (!this.e) {
+        throw new Error('ephemeral keypair is not set')
+      }
+      if (!this.rs) {
+        throw new Error('remote static public key is not set')
+      }
+      this.ss.mixKey(this.crypto.dh(this.e, this.rs))
+    }
+  }
+
+  protected readE (message: Uint8ArrayList, offset = 0): void {
+    if (this.re) {
+      throw new Error('remote ephemeral public key is already set')
+    }
+    if (message.byteLength < offset + 32) {
+      throw new Error('message is not long enough')
+    }
+    this.re = message.sublist(offset, offset + 32)
+    this.ss.mixHash(this.re)
+  }
+
+  protected readS (message: Uint8ArrayList, offset = 0): number {
+    if (this.rs) {
+      throw new Error('remote static public key is already set')
+    }
+    const cipherLength = 32 + (this.ss.cs.hasKey() ? 16 : 0)
+    if (message.byteLength < offset + cipherLength) {
+      throw new Error('message is not long enough')
+    }
+    const temp = message.sublist(offset, offset + cipherLength)
+    this.rs = this.ss.decryptAndHash(temp)
+    return cipherLength
+  }
+
+  protected readEE (): void {
+    this.writeEE()
+  }
+
+  protected readES (): void {
+    this.writeES()
+  }
+
+  protected readSE (): void {
+    this.writeSE()
+  }
+}
+
+/**
+ * A IHandshakeState that's optimized for the XX pattern
+ */
+export class XXHandshakeState extends AbstractHandshakeState {
+  // e
+  writeMessageA (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    return new Uint8ArrayList(this.writeE(), this.ss.encryptAndHash(payload))
+  }
+
+  // e, ee, s, es
+  writeMessageB (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const e = this.writeE()
+    this.writeEE()
+    const encS = this.writeS()
+    this.writeES()
+
+    return new Uint8ArrayList(e, encS, this.ss.encryptAndHash(payload))
+  }
+
+  // s, se
+  writeMessageC (payload: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    const encS = this.writeS()
+    this.writeSE()
+
+    return new Uint8ArrayList(encS, this.ss.encryptAndHash(payload))
+  }
+
+  // e
+  readMessageA (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      this.readE(message)
+
+      return this.ss.decryptAndHash(message.sublist(32))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 0 validation fail: ${(e as Error).message}`)
+    }
+  }
+
+  // e, ee, s, es
+  readMessageB (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      this.readE(message)
+      this.readEE()
+      const consumed = this.readS(message, 32)
+      this.readES()
+
+      return this.ss.decryptAndHash(message.sublist(32 + consumed))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 1 validation fail: ${(e as Error).message}`)
+    }
+  }
+
+  // s, se
+  readMessageC (message: Uint8ArrayList): Uint8Array | Uint8ArrayList {
+    try {
+      const consumed = this.readS(message)
+      this.readSE()
+
+      return this.ss.decryptAndHash(message.sublist(consumed))
+    } catch (e) {
+      throw new InvalidCryptoExchangeError(`handshake stage 2 validation fail: ${(e as Error).message}`)
+    }
+  }
+}
+
+function hashProtocolName (crypto: ICrypto, protocolName: Uint8Array): Uint8Array {
+  if (protocolName.length <= 32) {
+    const h = uint8ArrayAlloc(32)
+    h.set(protocolName)
+    return h
+  } else {
+    return crypto.hash(protocolName)
+  }
+}

package/src/types.ts

@@ -0,0 +1,105 @@
+import type { Nonce } from './nonce.js'
+import type { NoiseExtensions, NoiseHandshakePayload } from './proto/payload.js'
+import type { ConnectionEncrypter, Logger, PrivateKey, PublicKey } from '@libp2p/interface'
+import type { LengthPrefixedStream } from '@libp2p/utils'
+import type { Uint8ArrayList } from 'uint8arraylist'
+
+/**
+ * Crypto functions defined by the noise protocol, abstracted from the
+ * underlying implementations
+ */
+export interface ICrypto {
+  generateKeypair(): KeyPair
+  dh(keypair: KeyPair, publicKey: Uint8Array | Uint8ArrayList): Uint8Array
+  encrypt(plaintext: Uint8Array | Uint8ArrayList, nonce: Uint8Array, ad: Uint8Array, k: Uint8Array): Uint8ArrayList | Uint8Array
+  decrypt(ciphertext: Uint8Array | Uint8ArrayList, nonce: Uint8Array, ad: Uint8Array, k: Uint8Array, dst?: Uint8Array): Uint8ArrayList | Uint8Array
+  hash(data: Uint8Array | Uint8ArrayList): Uint8Array
+  hkdf(ck: Uint8Array, ikm: Uint8Array): [Uint8Array, Uint8Array, Uint8Array]
+}
+
+export interface HandshakeParams {
+  log: Logger
+  connection: LengthPrefixedStream
+  crypto: ICrypto
+  privateKey: PrivateKey
+  prologue: Uint8Array
+  /** static keypair */
+  s: KeyPair
+  remoteIdentityKey?: PublicKey
+  extensions?: NoiseExtensions
+}
+
+export interface HandshakeResult {
+  payload: NoiseHandshakePayload
+  encrypt (plaintext: Uint8Array | Uint8ArrayList): Uint8Array | Uint8ArrayList
+  decrypt (ciphertext: Uint8Array | Uint8ArrayList, dst?: Uint8Array): Uint8Array | Uint8ArrayList
+}
+
+/**
+ * A CipherState object contains k and n variables, which it uses to encrypt and
+ * decrypt ciphertext.
+ *
+ * During the handshake phase each party has a single CipherState, but during
+ * the transport phase each party has two CipherState objects: one for sending,
+ * and one for receiving.
+ */
+export interface ICipherState {
+  /**
+   * A cipher key of 32 bytes (which may be empty). Empty is a special value
+   * which indicates k has not yet been initialized.
+   */
+  k?: Uint8Array
+  /**
+   * An 8-byte (64-bit) unsigned integer nonce.
+   *
+   * For performance reasons, the nonce is represented as a Nonce object
+   * The nonce is treated as a uint64, even though the underlying `number` only
+   * has 52 safely-available bits.
+   */
+  n: Nonce
+}
+
+/**
+ * A SymmetricState object contains a CipherState plus ck and h variables. It is
+ * so-named because it encapsulates all the "symmetric crypto" used by Noise.
+ *
+ * During the handshake phase each party has a single SymmetricState, which can
+ * be deleted once the handshake is finished.
+ */
+export interface ISymmetricState {
+  cs: ICipherState
+  /** A chaining key of 32 bytes. */
+  ck: Uint8Array
+  /** A hash output of 32 bytes. */
+  h: Uint8Array
+}
+
+/**
+ * A HandshakeState object contains a SymmetricState plus DH variables (s, e,
+ * rs, re) and a variable representing the handshake pattern.
+ *
+ * During the handshake phase each party has a single HandshakeState, which can
+ * be deleted once the handshake is finished.
+ */
+export interface IHandshakeState {
+  ss: ISymmetricState
+  /** The local static key pair */
+  s?: KeyPair
+  /** The local ephemeral key pair */
+  e?: KeyPair
+  /** The remote party's static public key */
+  rs?: Uint8Array | Uint8ArrayList
+  /** The remote party's ephemeral public key */
+  re?: Uint8Array | Uint8ArrayList
+}
+
+export interface KeyPair {
+  publicKey: Uint8Array
+  privateKey: Uint8Array
+}
+
+export interface INoiseExtensions {
+  webtransportCerthashes: Uint8Array[]
+}
+
+export interface INoiseConnection extends ConnectionEncrypter<INoiseExtensions> { }