@libp2p/noise 12.0.1 → 16.1.4-8484de8a2

package/src/crypto/streaming.ts

@@ -1,58 +0,0 @@
-import { TAG_LENGTH } from '@stablelib/chacha20poly1305'
-import { NOISE_MSG_MAX_LENGTH_BYTES, NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG } from '../constants.js'
-import { uint16BEEncode } from '../encoder.js'
-import type { IHandshake } from '../@types/handshake-interface.js'
-import type { MetricsRegistry } from '../metrics.js'
-import type { Transform } from 'it-stream-types'
-import type { Uint8ArrayList } from 'uint8arraylist'
-
-// Returns generator that encrypts payload from the user
-export function encryptStream (handshake: IHandshake, metrics?: MetricsRegistry): Transform<AsyncIterable<Uint8Array>> {
-  return async function * (source) {
-    for await (const chunk of source) {
-      for (let i = 0; i < chunk.length; i += NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG) {
-        let end = i + NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG
-        if (end > chunk.length) {
-          end = chunk.length
-        }
-
-        const data = handshake.encrypt(chunk.subarray(i, end), handshake.session)
-        metrics?.encryptedPackets.increment()
-
-        yield uint16BEEncode(data.byteLength)
-        yield data
-      }
-    }
-  }
-}
-
-// Decrypt received payload to the user
-export function decryptStream (handshake: IHandshake, metrics?: MetricsRegistry): Transform<AsyncIterable<Uint8ArrayList>, AsyncIterable<Uint8Array>> {
-  return async function * (source) {
-    for await (const chunk of source) {
-      for (let i = 0; i < chunk.length; i += NOISE_MSG_MAX_LENGTH_BYTES) {
-        let end = i + NOISE_MSG_MAX_LENGTH_BYTES
-        if (end > chunk.length) {
-          end = chunk.length
-        }
-
-        if (end - TAG_LENGTH < i) {
-          throw new Error('Invalid chunk')
-        }
-        const encrypted = chunk.subarray(i, end)
-        // memory allocation is not cheap so reuse the encrypted Uint8Array
-        // see https://github.com/ChainSafe/js-libp2p-noise/pull/242#issue-1422126164
-        // this is ok because chacha20 reads bytes one by one and don't reread after that
-        // it's also tested in https://github.com/ChainSafe/as-chacha20poly1305/pull/1/files#diff-25252846b58979dcaf4e41d47b3eadd7e4f335e7fb98da6c049b1f9cd011f381R48
-        const dst = chunk.subarray(i, end - TAG_LENGTH)
-        const { plaintext: decrypted, valid } = handshake.decrypt(encrypted, handshake.session, dst)
-        if (!valid) {
-          metrics?.decryptErrors.increment()
-          throw new Error('Failed to validate decrypted chunk')
-        }
-        metrics?.decryptedPackets.increment()
-        yield decrypted
-      }
-    }
-  }
-}

package/src/handshake-xx.ts

@@ -1,177 +0,0 @@
-import { InvalidCryptoExchangeError, UnexpectedPeerError } from '@libp2p/interface/errors'
-import { decode0, decode1, decode2, encode0, encode1, encode2 } from './encoder.js'
-import { XX } from './handshakes/xx.js'
-import {
-  logger,
-  logLocalStaticKeys,
-  logLocalEphemeralKeys,
-  logRemoteEphemeralKey,
-  logRemoteStaticKey,
-  logCipherState
-} from './logger.js'
-import {
-  decodePayload,
-  getPeerIdFromPayload,
-  verifySignedPayload
-} from './utils.js'
-import type { bytes, bytes32 } from './@types/basic.js'
-import type { IHandshake } from './@types/handshake-interface.js'
-import type { CipherState, NoiseSession } from './@types/handshake.js'
-import type { KeyPair } from './@types/libp2p.js'
-import type { ICryptoInterface } from './crypto.js'
-import type { NoiseExtensions } from './proto/payload.js'
-import type { PeerId } from '@libp2p/interface/peer-id'
-import type { LengthPrefixedStream } from 'it-length-prefixed-stream'
-
-export class XXHandshake implements IHandshake {
-  public isInitiator: boolean
-  public session: NoiseSession
-  public remotePeer!: PeerId
-  public remoteExtensions: NoiseExtensions = { webtransportCerthashes: [] }
-
-  protected payload: bytes
-  protected connection: LengthPrefixedStream
-  protected xx: XX
-  protected staticKeypair: KeyPair
-
-  private readonly prologue: bytes32
-
-  constructor (
-    isInitiator: boolean,
-    payload: bytes,
-    prologue: bytes32,
-    crypto: ICryptoInterface,
-    staticKeypair: KeyPair,
-    connection: LengthPrefixedStream,
-    remotePeer?: PeerId,
-    handshake?: XX
-  ) {
-    this.isInitiator = isInitiator
-    this.payload = payload
-    this.prologue = prologue
-    this.staticKeypair = staticKeypair
-    this.connection = connection
-    if (remotePeer) {
-      this.remotePeer = remotePeer
-    }
-    this.xx = handshake ?? new XX(crypto)
-    this.session = this.xx.initSession(this.isInitiator, this.prologue, this.staticKeypair)
-  }
-
-  // stage 0
-  public async propose (): Promise<void> {
-    logLocalStaticKeys(this.session.hs.s)
-    if (this.isInitiator) {
-      logger.trace('Stage 0 - Initiator starting to send first message.')
-      const messageBuffer = this.xx.sendMessage(this.session, new Uint8Array(0))
-      await this.connection.write(encode0(messageBuffer))
-      logger.trace('Stage 0 - Initiator finished sending first message.')
-      logLocalEphemeralKeys(this.session.hs.e)
-    } else {
-      logger.trace('Stage 0 - Responder waiting to receive first message...')
-      const receivedMessageBuffer = decode0((await this.connection.read()).subarray())
-      const { valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
-      if (!valid) {
-        throw new InvalidCryptoExchangeError('xx handshake stage 0 validation fail')
-      }
-      logger.trace('Stage 0 - Responder received first message.')
-      logRemoteEphemeralKey(this.session.hs.re)
-    }
-  }
-
-  // stage 1
-  public async exchange (): Promise<void> {
-    if (this.isInitiator) {
-      logger.trace('Stage 1 - Initiator waiting to receive first message from responder...')
-      const receivedMessageBuffer = decode1((await this.connection.read()).subarray())
-      const { plaintext, valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
-      if (!valid) {
-        throw new InvalidCryptoExchangeError('xx handshake stage 1 validation fail')
-      }
-      logger.trace('Stage 1 - Initiator received the message.')
-      logRemoteEphemeralKey(this.session.hs.re)
-      logRemoteStaticKey(this.session.hs.rs)
-
-      logger.trace("Initiator going to check remote's signature...")
-      try {
-        const decodedPayload = decodePayload(plaintext)
-        this.remotePeer = this.remotePeer || await getPeerIdFromPayload(decodedPayload)
-        await verifySignedPayload(this.session.hs.rs, decodedPayload, this.remotePeer)
-        this.setRemoteNoiseExtension(decodedPayload.extensions)
-      } catch (e) {
-        const err = e as Error
-        throw new UnexpectedPeerError(`Error occurred while verifying signed payload: ${err.message}`)
-      }
-      logger.trace('All good with the signature!')
-    } else {
-      logger.trace('Stage 1 - Responder sending out first message with signed payload and static key.')
-      const messageBuffer = this.xx.sendMessage(this.session, this.payload)
-      await this.connection.write(encode1(messageBuffer))
-      logger.trace('Stage 1 - Responder sent the second handshake message with signed payload.')
-      logLocalEphemeralKeys(this.session.hs.e)
-    }
-  }
-
-  // stage 2
-  public async finish (): Promise<void> {
-    if (this.isInitiator) {
-      logger.trace('Stage 2 - Initiator sending third handshake message.')
-      const messageBuffer = this.xx.sendMessage(this.session, this.payload)
-      await this.connection.write(encode2(messageBuffer))
-      logger.trace('Stage 2 - Initiator sent message with signed payload.')
-    } else {
-      logger.trace('Stage 2 - Responder waiting for third handshake message...')
-      const receivedMessageBuffer = decode2((await this.connection.read()).subarray())
-      const { plaintext, valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
-      if (!valid) {
-        throw new InvalidCryptoExchangeError('xx handshake stage 2 validation fail')
-      }
-      logger.trace('Stage 2 - Responder received the message, finished handshake.')
-
-      try {
-        const decodedPayload = decodePayload(plaintext)
-        this.remotePeer = this.remotePeer || await getPeerIdFromPayload(decodedPayload)
-        await verifySignedPayload(this.session.hs.rs, decodedPayload, this.remotePeer)
-        this.setRemoteNoiseExtension(decodedPayload.extensions)
-      } catch (e) {
-        const err = e as Error
-        throw new UnexpectedPeerError(`Error occurred while verifying signed payload: ${err.message}`)
-      }
-    }
-    logCipherState(this.session)
-  }
-
-  public encrypt (plaintext: Uint8Array, session: NoiseSession): bytes {
-    const cs = this.getCS(session)
-
-    return this.xx.encryptWithAd(cs, new Uint8Array(0), plaintext)
-  }
-
-  public decrypt (ciphertext: Uint8Array, session: NoiseSession, dst?: Uint8Array): { plaintext: bytes, valid: boolean } {
-    const cs = this.getCS(session, false)
-
-    return this.xx.decryptWithAd(cs, new Uint8Array(0), ciphertext, dst)
-  }
-
-  public getRemoteStaticKey (): bytes {
-    return this.session.hs.rs
-  }
-
-  private getCS (session: NoiseSession, encryption = true): CipherState {
-    if (!session.cs1 || !session.cs2) {
-      throw new InvalidCryptoExchangeError('Handshake not completed properly, cipher state does not exist.')
-    }
-
-    if (this.isInitiator) {
-      return encryption ? session.cs1 : session.cs2
-    } else {
-      return encryption ? session.cs2 : session.cs1
-    }
-  }
-
-  protected setRemoteNoiseExtension (e: NoiseExtensions | null | undefined): void {
-    if (e) {
-      this.remoteExtensions = e
-    }
-  }
-}

package/src/handshakes/abstract-handshake.ts

@@ -1,180 +0,0 @@
-import { fromString as uint8ArrayFromString } from 'uint8arrays'
-import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
-import { equals as uint8ArrayEquals } from 'uint8arrays/equals'
-import { logger } from '../logger.js'
-import { Nonce } from '../nonce.js'
-import type { bytes, bytes32 } from '../@types/basic.js'
-import type { CipherState, MessageBuffer, SymmetricState } from '../@types/handshake.js'
-import type { ICryptoInterface } from '../crypto.js'
-
-export interface DecryptedResult {
-  plaintext: bytes
-  valid: boolean
-}
-
-export interface SplitState {
-  cs1: CipherState
-  cs2: CipherState
-}
-
-export abstract class AbstractHandshake {
-  public crypto: ICryptoInterface
-
-  constructor (crypto: ICryptoInterface) {
-    this.crypto = crypto
-  }
-
-  public encryptWithAd (cs: CipherState, ad: Uint8Array, plaintext: Uint8Array): bytes {
-    const e = this.encrypt(cs.k, cs.n, ad, plaintext)
-    cs.n.increment()
-
-    return e
-  }
-
-  public decryptWithAd (cs: CipherState, ad: Uint8Array, ciphertext: Uint8Array, dst?: Uint8Array): DecryptedResult {
-    const { plaintext, valid } = this.decrypt(cs.k, cs.n, ad, ciphertext, dst)
-    if (valid) cs.n.increment()
-
-    return { plaintext, valid }
-  }
-
-  // Cipher state related
-  protected hasKey (cs: CipherState): boolean {
-    return !this.isEmptyKey(cs.k)
-  }
-
-  protected createEmptyKey (): bytes32 {
-    return new Uint8Array(32)
-  }
-
-  protected isEmptyKey (k: bytes32): boolean {
-    const emptyKey = this.createEmptyKey()
-    return uint8ArrayEquals(emptyKey, k)
-  }
-
-  protected encrypt (k: bytes32, n: Nonce, ad: Uint8Array, plaintext: Uint8Array): bytes {
-    n.assertValue()
-
-    return this.crypto.chaCha20Poly1305Encrypt(plaintext, n.getBytes(), ad, k)
-  }
-
-  protected encryptAndHash (ss: SymmetricState, plaintext: bytes): bytes {
-    let ciphertext
-    if (this.hasKey(ss.cs)) {
-      ciphertext = this.encryptWithAd(ss.cs, ss.h, plaintext)
-    } else {
-      ciphertext = plaintext
-    }
-
-    this.mixHash(ss, ciphertext)
-    return ciphertext
-  }
-
-  protected decrypt (k: bytes32, n: Nonce, ad: bytes, ciphertext: bytes, dst?: Uint8Array): DecryptedResult {
-    n.assertValue()
-
-    const encryptedMessage = this.crypto.chaCha20Poly1305Decrypt(ciphertext, n.getBytes(), ad, k, dst)
-
-    if (encryptedMessage) {
-      return {
-        plaintext: encryptedMessage,
-        valid: true
-      }
-    } else {
-      return {
-        plaintext: new Uint8Array(0),
-        valid: false
-      }
-    }
-  }
-
-  protected decryptAndHash (ss: SymmetricState, ciphertext: bytes): DecryptedResult {
-    let plaintext: bytes; let valid = true
-    if (this.hasKey(ss.cs)) {
-      ({ plaintext, valid } = this.decryptWithAd(ss.cs, ss.h, ciphertext))
-    } else {
-      plaintext = ciphertext
-    }
-
-    this.mixHash(ss, ciphertext)
-    return { plaintext, valid }
-  }
-
-  protected dh (privateKey: bytes32, publicKey: bytes32): bytes32 {
-    try {
-      const derivedU8 = this.crypto.generateX25519SharedKey(privateKey, publicKey)
-
-      if (derivedU8.length === 32) {
-        return derivedU8
-      }
-
-      return derivedU8.subarray(0, 32)
-    } catch (e) {
-      const err = e as Error
-      logger.error(err)
-      return new Uint8Array(32)
-    }
-  }
-
-  protected mixHash (ss: SymmetricState, data: bytes): void {
-    ss.h = this.getHash(ss.h, data)
-  }
-
-  protected getHash (a: Uint8Array, b: Uint8Array): bytes32 {
-    const u = this.crypto.hashSHA256(uint8ArrayConcat([a, b], a.length + b.length))
-    return u
-  }
-
-  protected mixKey (ss: SymmetricState, ikm: bytes32): void {
-    const [ck, tempK] = this.crypto.getHKDF(ss.ck, ikm)
-    ss.cs = this.initializeKey(tempK)
-    ss.ck = ck
-  }
-
-  protected initializeKey (k: bytes32): CipherState {
-    return { k, n: new Nonce() }
-  }
-
-  // Symmetric state related
-
-  protected initializeSymmetric (protocolName: string): SymmetricState {
-    const protocolNameBytes = uint8ArrayFromString(protocolName, 'utf-8')
-    const h = this.hashProtocolName(protocolNameBytes)
-
-    const ck = h
-    const key = this.createEmptyKey()
-    const cs: CipherState = this.initializeKey(key)
-
-    return { cs, ck, h }
-  }
-
-  protected hashProtocolName (protocolName: Uint8Array): bytes32 {
-    if (protocolName.length <= 32) {
-      const h = new Uint8Array(32)
-      h.set(protocolName)
-      return h
-    } else {
-      return this.getHash(protocolName, new Uint8Array(0))
-    }
-  }
-
-  protected split (ss: SymmetricState): SplitState {
-    const [tempk1, tempk2] = this.crypto.getHKDF(ss.ck, new Uint8Array(0))
-    const cs1 = this.initializeKey(tempk1)
-    const cs2 = this.initializeKey(tempk2)
-
-    return { cs1, cs2 }
-  }
-
-  protected writeMessageRegular (cs: CipherState, payload: bytes): MessageBuffer {
-    const ciphertext = this.encryptWithAd(cs, new Uint8Array(0), payload)
-    const ne = this.createEmptyKey()
-    const ns = new Uint8Array(0)
-
-    return { ne, ns, ciphertext }
-  }
-
-  protected readMessageRegular (cs: CipherState, message: MessageBuffer): DecryptedResult {
-    return this.decryptWithAd(cs, new Uint8Array(0), message.ciphertext)
-  }
-}

package/src/handshakes/xx.ts

@@ -1,184 +0,0 @@
-import { isValidPublicKey } from '../utils.js'
-import { AbstractHandshake, type DecryptedResult } from './abstract-handshake.js'
-import type { bytes32, bytes } from '../@types/basic.js'
-import type { CipherState, HandshakeState, MessageBuffer, NoiseSession } from '../@types/handshake.js'
-import type { KeyPair } from '../@types/libp2p.js'
-
-export class XX extends AbstractHandshake {
-  private initializeInitiator (prologue: bytes32, s: KeyPair, rs: bytes32, psk: bytes32): HandshakeState {
-    const name = 'Noise_XX_25519_ChaChaPoly_SHA256'
-    const ss = this.initializeSymmetric(name)
-    this.mixHash(ss, prologue)
-    const re = new Uint8Array(32)
-
-    return { ss, s, rs, psk, re }
-  }
-
-  private initializeResponder (prologue: bytes32, s: KeyPair, rs: bytes32, psk: bytes32): HandshakeState {
-    const name = 'Noise_XX_25519_ChaChaPoly_SHA256'
-    const ss = this.initializeSymmetric(name)
-    this.mixHash(ss, prologue)
-    const re = new Uint8Array(32)
-
-    return { ss, s, rs, psk, re }
-  }
-
-  private writeMessageA (hs: HandshakeState, payload: bytes, e?: KeyPair): MessageBuffer {
-    const ns = new Uint8Array(0)
-
-    if (e !== undefined) {
-      hs.e = e
-    } else {
-      hs.e = this.crypto.generateX25519KeyPair()
-    }
-
-    const ne = hs.e.publicKey
-
-    this.mixHash(hs.ss, ne)
-    const ciphertext = this.encryptAndHash(hs.ss, payload)
-
-    return { ne, ns, ciphertext }
-  }
-
-  private writeMessageB (hs: HandshakeState, payload: bytes): MessageBuffer {
-    hs.e = this.crypto.generateX25519KeyPair()
-    const ne = hs.e.publicKey
-    this.mixHash(hs.ss, ne)
-
-    this.mixKey(hs.ss, this.dh(hs.e.privateKey, hs.re))
-    const spk = hs.s.publicKey
-    const ns = this.encryptAndHash(hs.ss, spk)
-
-    this.mixKey(hs.ss, this.dh(hs.s.privateKey, hs.re))
-    const ciphertext = this.encryptAndHash(hs.ss, payload)
-
-    return { ne, ns, ciphertext }
-  }
-
-  private writeMessageC (hs: HandshakeState, payload: bytes): { messageBuffer: MessageBuffer, cs1: CipherState, cs2: CipherState, h: bytes } {
-    const spk = hs.s.publicKey
-    const ns = this.encryptAndHash(hs.ss, spk)
-    this.mixKey(hs.ss, this.dh(hs.s.privateKey, hs.re))
-    const ciphertext = this.encryptAndHash(hs.ss, payload)
-    const ne = this.createEmptyKey()
-    const messageBuffer: MessageBuffer = { ne, ns, ciphertext }
-    const { cs1, cs2 } = this.split(hs.ss)
-
-    return { h: hs.ss.h, messageBuffer, cs1, cs2 }
-  }
-
-  private readMessageA (hs: HandshakeState, message: MessageBuffer): DecryptedResult {
-    if (isValidPublicKey(message.ne)) {
-      hs.re = message.ne
-    }
-
-    this.mixHash(hs.ss, hs.re)
-    return this.decryptAndHash(hs.ss, message.ciphertext)
-  }
-
-  private readMessageB (hs: HandshakeState, message: MessageBuffer): DecryptedResult {
-    if (isValidPublicKey(message.ne)) {
-      hs.re = message.ne
-    }
-
-    this.mixHash(hs.ss, hs.re)
-    if (!hs.e) {
-      throw new Error('Handshake state `e` param is missing.')
-    }
-    this.mixKey(hs.ss, this.dh(hs.e.privateKey, hs.re))
-    const { plaintext: ns, valid: valid1 } = this.decryptAndHash(hs.ss, message.ns)
-    if (valid1 && isValidPublicKey(ns)) {
-      hs.rs = ns
-    }
-    this.mixKey(hs.ss, this.dh(hs.e.privateKey, hs.rs))
-    const { plaintext, valid: valid2 } = this.decryptAndHash(hs.ss, message.ciphertext)
-    return { plaintext, valid: (valid1 && valid2) }
-  }
-
-  private readMessageC (hs: HandshakeState, message: MessageBuffer): { h: bytes, plaintext: bytes, valid: boolean, cs1: CipherState, cs2: CipherState } {
-    const { plaintext: ns, valid: valid1 } = this.decryptAndHash(hs.ss, message.ns)
-    if (valid1 && isValidPublicKey(ns)) {
-      hs.rs = ns
-    }
-    if (!hs.e) {
-      throw new Error('Handshake state `e` param is missing.')
-    }
-    this.mixKey(hs.ss, this.dh(hs.e.privateKey, hs.rs))
-
-    const { plaintext, valid: valid2 } = this.decryptAndHash(hs.ss, message.ciphertext)
-    const { cs1, cs2 } = this.split(hs.ss)
-
-    return { h: hs.ss.h, plaintext, valid: (valid1 && valid2), cs1, cs2 }
-  }
-
-  public initSession (initiator: boolean, prologue: bytes32, s: KeyPair): NoiseSession {
-    const psk = this.createEmptyKey()
-    const rs = new Uint8Array(32) // no static key yet
-    let hs
-
-    if (initiator) {
-      hs = this.initializeInitiator(prologue, s, rs, psk)
-    } else {
-      hs = this.initializeResponder(prologue, s, rs, psk)
-    }
-
-    return {
-      hs,
-      i: initiator,
-      mc: 0
-    }
-  }
-
-  public sendMessage (session: NoiseSession, message: bytes, ephemeral?: KeyPair): MessageBuffer {
-    let messageBuffer: MessageBuffer
-    if (session.mc === 0) {
-      messageBuffer = this.writeMessageA(session.hs, message, ephemeral)
-    } else if (session.mc === 1) {
-      messageBuffer = this.writeMessageB(session.hs, message)
-    } else if (session.mc === 2) {
-      const { h, messageBuffer: resultingBuffer, cs1, cs2 } = this.writeMessageC(session.hs, message)
-      messageBuffer = resultingBuffer
-      session.h = h
-      session.cs1 = cs1
-      session.cs2 = cs2
-    } else if (session.mc > 2) {
-      if (session.i) {
-        if (!session.cs1) {
-          throw new Error('CS1 (cipher state) is not defined')
-        }
-
-        messageBuffer = this.writeMessageRegular(session.cs1, message)
-      } else {
-        if (!session.cs2) {
-          throw new Error('CS2 (cipher state) is not defined')
-        }
-
-        messageBuffer = this.writeMessageRegular(session.cs2, message)
-      }
-    } else {
-      throw new Error('Session invalid.')
-    }
-
-    session.mc++
-    return messageBuffer
-  }
-
-  public recvMessage (session: NoiseSession, message: MessageBuffer): DecryptedResult {
-    let plaintext: bytes = new Uint8Array(0)
-    let valid = false
-    if (session.mc === 0) {
-      ({ plaintext, valid } = this.readMessageA(session.hs, message))
-    } else if (session.mc === 1) {
-      ({ plaintext, valid } = this.readMessageB(session.hs, message))
-    } else if (session.mc === 2) {
-      const { h, plaintext: resultingPlaintext, valid: resultingValid, cs1, cs2 } = this.readMessageC(session.hs, message)
-      plaintext = resultingPlaintext
-      valid = resultingValid
-      session.h = h
-      session.cs1 = cs1
-      session.cs2 = cs2
-    }
-    session.mc++
-    return { plaintext, valid }
-  }
-}