@libp2p/noise 12.0.1

package/src/crypto/js.ts

@@ -0,0 +1,58 @@
+import { hkdf } from '@noble/hashes/hkdf'
+import { sha256 } from '@noble/hashes/sha256'
+import { ChaCha20Poly1305 } from '@stablelib/chacha20poly1305'
+import * as x25519 from '@stablelib/x25519'
+import type { bytes, bytes32 } from '../@types/basic.js'
+import type { Hkdf } from '../@types/handshake.js'
+import type { KeyPair } from '../@types/libp2p.js'
+import type { ICryptoInterface } from '../crypto.js'
+
+export const pureJsCrypto: ICryptoInterface = {
+  hashSHA256 (data: Uint8Array): Uint8Array {
+    return sha256(data)
+  },
+
+  getHKDF (ck: bytes32, ikm: Uint8Array): Hkdf {
+    const okm = hkdf(sha256, ikm, ck, undefined, 96)
+
+    const k1 = okm.subarray(0, 32)
+    const k2 = okm.subarray(32, 64)
+    const k3 = okm.subarray(64, 96)
+
+    return [k1, k2, k3]
+  },
+
+  generateX25519KeyPair (): KeyPair {
+    const keypair = x25519.generateKeyPair()
+
+    return {
+      publicKey: keypair.publicKey,
+      privateKey: keypair.secretKey
+    }
+  },
+
+  generateX25519KeyPairFromSeed (seed: Uint8Array): KeyPair {
+    const keypair = x25519.generateKeyPairFromSeed(seed)
+
+    return {
+      publicKey: keypair.publicKey,
+      privateKey: keypair.secretKey
+    }
+  },
+
+  generateX25519SharedKey (privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array {
+    return x25519.sharedKey(privateKey, publicKey)
+  },
+
+  chaCha20Poly1305Encrypt (plaintext: Uint8Array, nonce: Uint8Array, ad: Uint8Array, k: bytes32): bytes {
+    const ctx = new ChaCha20Poly1305(k)
+
+    return ctx.seal(nonce, plaintext, ad)
+  },
+
+  chaCha20Poly1305Decrypt (ciphertext: Uint8Array, nonce: Uint8Array, ad: Uint8Array, k: bytes32, dst?: Uint8Array): bytes | null {
+    const ctx = new ChaCha20Poly1305(k)
+
+    return ctx.open(nonce, ciphertext, ad, dst)
+  }
+}

package/src/crypto/streaming.ts

@@ -0,0 +1,58 @@
+import { TAG_LENGTH } from '@stablelib/chacha20poly1305'
+import { NOISE_MSG_MAX_LENGTH_BYTES, NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG } from '../constants.js'
+import { uint16BEEncode } from '../encoder.js'
+import type { IHandshake } from '../@types/handshake-interface.js'
+import type { MetricsRegistry } from '../metrics.js'
+import type { Transform } from 'it-stream-types'
+import type { Uint8ArrayList } from 'uint8arraylist'
+
+// Returns generator that encrypts payload from the user
+export function encryptStream (handshake: IHandshake, metrics?: MetricsRegistry): Transform<AsyncIterable<Uint8Array>> {
+  return async function * (source) {
+    for await (const chunk of source) {
+      for (let i = 0; i < chunk.length; i += NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG) {
+        let end = i + NOISE_MSG_MAX_LENGTH_BYTES_WITHOUT_TAG
+        if (end > chunk.length) {
+          end = chunk.length
+        }
+
+        const data = handshake.encrypt(chunk.subarray(i, end), handshake.session)
+        metrics?.encryptedPackets.increment()
+
+        yield uint16BEEncode(data.byteLength)
+        yield data
+      }
+    }
+  }
+}
+
+// Decrypt received payload to the user
+export function decryptStream (handshake: IHandshake, metrics?: MetricsRegistry): Transform<AsyncIterable<Uint8ArrayList>, AsyncIterable<Uint8Array>> {
+  return async function * (source) {
+    for await (const chunk of source) {
+      for (let i = 0; i < chunk.length; i += NOISE_MSG_MAX_LENGTH_BYTES) {
+        let end = i + NOISE_MSG_MAX_LENGTH_BYTES
+        if (end > chunk.length) {
+          end = chunk.length
+        }
+
+        if (end - TAG_LENGTH < i) {
+          throw new Error('Invalid chunk')
+        }
+        const encrypted = chunk.subarray(i, end)
+        // memory allocation is not cheap so reuse the encrypted Uint8Array
+        // see https://github.com/ChainSafe/js-libp2p-noise/pull/242#issue-1422126164
+        // this is ok because chacha20 reads bytes one by one and don't reread after that
+        // it's also tested in https://github.com/ChainSafe/as-chacha20poly1305/pull/1/files#diff-25252846b58979dcaf4e41d47b3eadd7e4f335e7fb98da6c049b1f9cd011f381R48
+        const dst = chunk.subarray(i, end - TAG_LENGTH)
+        const { plaintext: decrypted, valid } = handshake.decrypt(encrypted, handshake.session, dst)
+        if (!valid) {
+          metrics?.decryptErrors.increment()
+          throw new Error('Failed to validate decrypted chunk')
+        }
+        metrics?.decryptedPackets.increment()
+        yield decrypted
+      }
+    }
+  }
+}

package/src/crypto.ts

@@ -0,0 +1,16 @@
+import type { bytes32, bytes } from './@types/basic.js'
+import type { Hkdf } from './@types/handshake.js'
+import type { KeyPair } from './@types/libp2p.js'
+
+export interface ICryptoInterface {
+  hashSHA256: (data: Uint8Array) => Uint8Array
+
+  getHKDF: (ck: bytes32, ikm: Uint8Array) => Hkdf
+
+  generateX25519KeyPair: () => KeyPair
+  generateX25519KeyPairFromSeed: (seed: Uint8Array) => KeyPair
+  generateX25519SharedKey: (privateKey: Uint8Array, publicKey: Uint8Array) => Uint8Array
+
+  chaCha20Poly1305Encrypt: (plaintext: Uint8Array, nonce: Uint8Array, ad: Uint8Array, k: bytes32) => bytes
+  chaCha20Poly1305Decrypt: (ciphertext: Uint8Array, nonce: Uint8Array, ad: Uint8Array, k: bytes32, dst?: Uint8Array) => bytes | null
+}

package/src/encoder.ts

@@ -0,0 +1,81 @@
+import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
+import type { bytes } from './@types/basic.js'
+import type { MessageBuffer } from './@types/handshake.js'
+import type { LengthDecoderFunction } from 'it-length-prefixed'
+import type { Uint8ArrayList } from 'uint8arraylist'
+
+const allocUnsafe = (len: number): Uint8Array => {
+  if (globalThis.Buffer) {
+    return globalThis.Buffer.allocUnsafe(len)
+  }
+
+  return new Uint8Array(len)
+}
+
+export const uint16BEEncode = (value: number): Uint8Array => {
+  const target = allocUnsafe(2)
+  new DataView(target.buffer, target.byteOffset, target.byteLength).setUint16(0, value, false)
+  return target
+}
+uint16BEEncode.bytes = 2
+
+export const uint16BEDecode: LengthDecoderFunction = (data: Uint8Array | Uint8ArrayList): number => {
+  if (data.length < 2) throw RangeError('Could not decode int16BE')
+
+  if (data instanceof Uint8Array) {
+    return new DataView(data.buffer, data.byteOffset, data.byteLength).getUint16(0, false)
+  }
+
+  return data.getUint16(0)
+}
+uint16BEDecode.bytes = 2
+
+// Note: IK and XX encoder usage is opposite (XX uses in stages encode0 where IK uses encode1)
+
+export function encode0 (message: MessageBuffer): bytes {
+  return uint8ArrayConcat([message.ne, message.ciphertext], message.ne.length + message.ciphertext.length)
+}
+
+export function encode1 (message: MessageBuffer): bytes {
+  return uint8ArrayConcat([message.ne, message.ns, message.ciphertext], message.ne.length + message.ns.length + message.ciphertext.length)
+}
+
+export function encode2 (message: MessageBuffer): bytes {
+  return uint8ArrayConcat([message.ns, message.ciphertext], message.ns.length + message.ciphertext.length)
+}
+
+export function decode0 (input: bytes): MessageBuffer {
+  if (input.length < 32) {
+    throw new Error('Cannot decode stage 0 MessageBuffer: length less than 32 bytes.')
+  }
+
+  return {
+    ne: input.subarray(0, 32),
+    ciphertext: input.subarray(32, input.length),
+    ns: new Uint8Array(0)
+  }
+}
+
+export function decode1 (input: bytes): MessageBuffer {
+  if (input.length < 80) {
+    throw new Error('Cannot decode stage 1 MessageBuffer: length less than 80 bytes.')
+  }
+
+  return {
+    ne: input.subarray(0, 32),
+    ns: input.subarray(32, 80),
+    ciphertext: input.subarray(80, input.length)
+  }
+}
+
+export function decode2 (input: bytes): MessageBuffer {
+  if (input.length < 48) {
+    throw new Error('Cannot decode stage 2 MessageBuffer: length less than 48 bytes.')
+  }
+
+  return {
+    ne: new Uint8Array(0),
+    ns: input.subarray(0, 48),
+    ciphertext: input.subarray(48, input.length)
+  }
+}

package/src/handshake-xx.ts

@@ -0,0 +1,177 @@
+import { InvalidCryptoExchangeError, UnexpectedPeerError } from '@libp2p/interface/errors'
+import { decode0, decode1, decode2, encode0, encode1, encode2 } from './encoder.js'
+import { XX } from './handshakes/xx.js'
+import {
+  logger,
+  logLocalStaticKeys,
+  logLocalEphemeralKeys,
+  logRemoteEphemeralKey,
+  logRemoteStaticKey,
+  logCipherState
+} from './logger.js'
+import {
+  decodePayload,
+  getPeerIdFromPayload,
+  verifySignedPayload
+} from './utils.js'
+import type { bytes, bytes32 } from './@types/basic.js'
+import type { IHandshake } from './@types/handshake-interface.js'
+import type { CipherState, NoiseSession } from './@types/handshake.js'
+import type { KeyPair } from './@types/libp2p.js'
+import type { ICryptoInterface } from './crypto.js'
+import type { NoiseExtensions } from './proto/payload.js'
+import type { PeerId } from '@libp2p/interface/peer-id'
+import type { LengthPrefixedStream } from 'it-length-prefixed-stream'
+
+export class XXHandshake implements IHandshake {
+  public isInitiator: boolean
+  public session: NoiseSession
+  public remotePeer!: PeerId
+  public remoteExtensions: NoiseExtensions = { webtransportCerthashes: [] }
+
+  protected payload: bytes
+  protected connection: LengthPrefixedStream
+  protected xx: XX
+  protected staticKeypair: KeyPair
+
+  private readonly prologue: bytes32
+
+  constructor (
+    isInitiator: boolean,
+    payload: bytes,
+    prologue: bytes32,
+    crypto: ICryptoInterface,
+    staticKeypair: KeyPair,
+    connection: LengthPrefixedStream,
+    remotePeer?: PeerId,
+    handshake?: XX
+  ) {
+    this.isInitiator = isInitiator
+    this.payload = payload
+    this.prologue = prologue
+    this.staticKeypair = staticKeypair
+    this.connection = connection
+    if (remotePeer) {
+      this.remotePeer = remotePeer
+    }
+    this.xx = handshake ?? new XX(crypto)
+    this.session = this.xx.initSession(this.isInitiator, this.prologue, this.staticKeypair)
+  }
+
+  // stage 0
+  public async propose (): Promise<void> {
+    logLocalStaticKeys(this.session.hs.s)
+    if (this.isInitiator) {
+      logger.trace('Stage 0 - Initiator starting to send first message.')
+      const messageBuffer = this.xx.sendMessage(this.session, new Uint8Array(0))
+      await this.connection.write(encode0(messageBuffer))
+      logger.trace('Stage 0 - Initiator finished sending first message.')
+      logLocalEphemeralKeys(this.session.hs.e)
+    } else {
+      logger.trace('Stage 0 - Responder waiting to receive first message...')
+      const receivedMessageBuffer = decode0((await this.connection.read()).subarray())
+      const { valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
+      if (!valid) {
+        throw new InvalidCryptoExchangeError('xx handshake stage 0 validation fail')
+      }
+      logger.trace('Stage 0 - Responder received first message.')
+      logRemoteEphemeralKey(this.session.hs.re)
+    }
+  }
+
+  // stage 1
+  public async exchange (): Promise<void> {
+    if (this.isInitiator) {
+      logger.trace('Stage 1 - Initiator waiting to receive first message from responder...')
+      const receivedMessageBuffer = decode1((await this.connection.read()).subarray())
+      const { plaintext, valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
+      if (!valid) {
+        throw new InvalidCryptoExchangeError('xx handshake stage 1 validation fail')
+      }
+      logger.trace('Stage 1 - Initiator received the message.')
+      logRemoteEphemeralKey(this.session.hs.re)
+      logRemoteStaticKey(this.session.hs.rs)
+
+      logger.trace("Initiator going to check remote's signature...")
+      try {
+        const decodedPayload = decodePayload(plaintext)
+        this.remotePeer = this.remotePeer || await getPeerIdFromPayload(decodedPayload)
+        await verifySignedPayload(this.session.hs.rs, decodedPayload, this.remotePeer)
+        this.setRemoteNoiseExtension(decodedPayload.extensions)
+      } catch (e) {
+        const err = e as Error
+        throw new UnexpectedPeerError(`Error occurred while verifying signed payload: ${err.message}`)
+      }
+      logger.trace('All good with the signature!')
+    } else {
+      logger.trace('Stage 1 - Responder sending out first message with signed payload and static key.')
+      const messageBuffer = this.xx.sendMessage(this.session, this.payload)
+      await this.connection.write(encode1(messageBuffer))
+      logger.trace('Stage 1 - Responder sent the second handshake message with signed payload.')
+      logLocalEphemeralKeys(this.session.hs.e)
+    }
+  }
+
+  // stage 2
+  public async finish (): Promise<void> {
+    if (this.isInitiator) {
+      logger.trace('Stage 2 - Initiator sending third handshake message.')
+      const messageBuffer = this.xx.sendMessage(this.session, this.payload)
+      await this.connection.write(encode2(messageBuffer))
+      logger.trace('Stage 2 - Initiator sent message with signed payload.')
+    } else {
+      logger.trace('Stage 2 - Responder waiting for third handshake message...')
+      const receivedMessageBuffer = decode2((await this.connection.read()).subarray())
+      const { plaintext, valid } = this.xx.recvMessage(this.session, receivedMessageBuffer)
+      if (!valid) {
+        throw new InvalidCryptoExchangeError('xx handshake stage 2 validation fail')
+      }
+      logger.trace('Stage 2 - Responder received the message, finished handshake.')
+
+      try {
+        const decodedPayload = decodePayload(plaintext)
+        this.remotePeer = this.remotePeer || await getPeerIdFromPayload(decodedPayload)
+        await verifySignedPayload(this.session.hs.rs, decodedPayload, this.remotePeer)
+        this.setRemoteNoiseExtension(decodedPayload.extensions)
+      } catch (e) {
+        const err = e as Error
+        throw new UnexpectedPeerError(`Error occurred while verifying signed payload: ${err.message}`)
+      }
+    }
+    logCipherState(this.session)
+  }
+
+  public encrypt (plaintext: Uint8Array, session: NoiseSession): bytes {
+    const cs = this.getCS(session)
+
+    return this.xx.encryptWithAd(cs, new Uint8Array(0), plaintext)
+  }
+
+  public decrypt (ciphertext: Uint8Array, session: NoiseSession, dst?: Uint8Array): { plaintext: bytes, valid: boolean } {
+    const cs = this.getCS(session, false)
+
+    return this.xx.decryptWithAd(cs, new Uint8Array(0), ciphertext, dst)
+  }
+
+  public getRemoteStaticKey (): bytes {
+    return this.session.hs.rs
+  }
+
+  private getCS (session: NoiseSession, encryption = true): CipherState {
+    if (!session.cs1 || !session.cs2) {
+      throw new InvalidCryptoExchangeError('Handshake not completed properly, cipher state does not exist.')
+    }
+
+    if (this.isInitiator) {
+      return encryption ? session.cs1 : session.cs2
+    } else {
+      return encryption ? session.cs2 : session.cs1
+    }
+  }
+
+  protected setRemoteNoiseExtension (e: NoiseExtensions | null | undefined): void {
+    if (e) {
+      this.remoteExtensions = e
+    }
+  }
+}

package/src/handshakes/abstract-handshake.ts

@@ -0,0 +1,180 @@
+import { fromString as uint8ArrayFromString } from 'uint8arrays'
+import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
+import { equals as uint8ArrayEquals } from 'uint8arrays/equals'
+import { logger } from '../logger.js'
+import { Nonce } from '../nonce.js'
+import type { bytes, bytes32 } from '../@types/basic.js'
+import type { CipherState, MessageBuffer, SymmetricState } from '../@types/handshake.js'
+import type { ICryptoInterface } from '../crypto.js'
+
+export interface DecryptedResult {
+  plaintext: bytes
+  valid: boolean
+}
+
+export interface SplitState {
+  cs1: CipherState
+  cs2: CipherState
+}
+
+export abstract class AbstractHandshake {
+  public crypto: ICryptoInterface
+
+  constructor (crypto: ICryptoInterface) {
+    this.crypto = crypto
+  }
+
+  public encryptWithAd (cs: CipherState, ad: Uint8Array, plaintext: Uint8Array): bytes {
+    const e = this.encrypt(cs.k, cs.n, ad, plaintext)
+    cs.n.increment()
+
+    return e
+  }
+
+  public decryptWithAd (cs: CipherState, ad: Uint8Array, ciphertext: Uint8Array, dst?: Uint8Array): DecryptedResult {
+    const { plaintext, valid } = this.decrypt(cs.k, cs.n, ad, ciphertext, dst)
+    if (valid) cs.n.increment()
+
+    return { plaintext, valid }
+  }
+
+  // Cipher state related
+  protected hasKey (cs: CipherState): boolean {
+    return !this.isEmptyKey(cs.k)
+  }
+
+  protected createEmptyKey (): bytes32 {
+    return new Uint8Array(32)
+  }
+
+  protected isEmptyKey (k: bytes32): boolean {
+    const emptyKey = this.createEmptyKey()
+    return uint8ArrayEquals(emptyKey, k)
+  }
+
+  protected encrypt (k: bytes32, n: Nonce, ad: Uint8Array, plaintext: Uint8Array): bytes {
+    n.assertValue()
+
+    return this.crypto.chaCha20Poly1305Encrypt(plaintext, n.getBytes(), ad, k)
+  }
+
+  protected encryptAndHash (ss: SymmetricState, plaintext: bytes): bytes {
+    let ciphertext
+    if (this.hasKey(ss.cs)) {
+      ciphertext = this.encryptWithAd(ss.cs, ss.h, plaintext)
+    } else {
+      ciphertext = plaintext
+    }
+
+    this.mixHash(ss, ciphertext)
+    return ciphertext
+  }
+
+  protected decrypt (k: bytes32, n: Nonce, ad: bytes, ciphertext: bytes, dst?: Uint8Array): DecryptedResult {
+    n.assertValue()
+
+    const encryptedMessage = this.crypto.chaCha20Poly1305Decrypt(ciphertext, n.getBytes(), ad, k, dst)
+
+    if (encryptedMessage) {
+      return {
+        plaintext: encryptedMessage,
+        valid: true
+      }
+    } else {
+      return {
+        plaintext: new Uint8Array(0),
+        valid: false
+      }
+    }
+  }
+
+  protected decryptAndHash (ss: SymmetricState, ciphertext: bytes): DecryptedResult {
+    let plaintext: bytes; let valid = true
+    if (this.hasKey(ss.cs)) {
+      ({ plaintext, valid } = this.decryptWithAd(ss.cs, ss.h, ciphertext))
+    } else {
+      plaintext = ciphertext
+    }
+
+    this.mixHash(ss, ciphertext)
+    return { plaintext, valid }
+  }
+
+  protected dh (privateKey: bytes32, publicKey: bytes32): bytes32 {
+    try {
+      const derivedU8 = this.crypto.generateX25519SharedKey(privateKey, publicKey)
+
+      if (derivedU8.length === 32) {
+        return derivedU8
+      }
+
+      return derivedU8.subarray(0, 32)
+    } catch (e) {
+      const err = e as Error
+      logger.error(err)
+      return new Uint8Array(32)
+    }
+  }
+
+  protected mixHash (ss: SymmetricState, data: bytes): void {
+    ss.h = this.getHash(ss.h, data)
+  }
+
+  protected getHash (a: Uint8Array, b: Uint8Array): bytes32 {
+    const u = this.crypto.hashSHA256(uint8ArrayConcat([a, b], a.length + b.length))
+    return u
+  }
+
+  protected mixKey (ss: SymmetricState, ikm: bytes32): void {
+    const [ck, tempK] = this.crypto.getHKDF(ss.ck, ikm)
+    ss.cs = this.initializeKey(tempK)
+    ss.ck = ck
+  }
+
+  protected initializeKey (k: bytes32): CipherState {
+    return { k, n: new Nonce() }
+  }
+
+  // Symmetric state related
+
+  protected initializeSymmetric (protocolName: string): SymmetricState {
+    const protocolNameBytes = uint8ArrayFromString(protocolName, 'utf-8')
+    const h = this.hashProtocolName(protocolNameBytes)
+
+    const ck = h
+    const key = this.createEmptyKey()
+    const cs: CipherState = this.initializeKey(key)
+
+    return { cs, ck, h }
+  }
+
+  protected hashProtocolName (protocolName: Uint8Array): bytes32 {
+    if (protocolName.length <= 32) {
+      const h = new Uint8Array(32)
+      h.set(protocolName)
+      return h
+    } else {
+      return this.getHash(protocolName, new Uint8Array(0))
+    }
+  }
+
+  protected split (ss: SymmetricState): SplitState {
+    const [tempk1, tempk2] = this.crypto.getHKDF(ss.ck, new Uint8Array(0))
+    const cs1 = this.initializeKey(tempk1)
+    const cs2 = this.initializeKey(tempk2)
+
+    return { cs1, cs2 }
+  }
+
+  protected writeMessageRegular (cs: CipherState, payload: bytes): MessageBuffer {
+    const ciphertext = this.encryptWithAd(cs, new Uint8Array(0), payload)
+    const ne = this.createEmptyKey()
+    const ns = new Uint8Array(0)
+
+    return { ne, ns, ciphertext }
+  }
+
+  protected readMessageRegular (cs: CipherState, message: MessageBuffer): DecryptedResult {
+    return this.decryptWithAd(cs, new Uint8Array(0), message.ciphertext)
+  }
+}