@matter/protocol 0.14.0-alpha.0-20250525-d6ada0d45 → 0.14.0-alpha.0-20250528-ad0054c84

package/src/session/case/CaseServer.ts

@@ -4,9 +4,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { Bytes, Crypto, Logger, PublicKey, UnexpectedDataError } from "#general";
-import { SessionManager } from "#session/SessionManager.js";
-import { NodeId, ProtocolStatusCode, SECURE_CHANNEL_PROTOCOL_ID } from "#types";
+import { Bytes, Crypto, CryptoDecryptError, Logger, PublicKey, UnexpectedDataError } from "#general";
+import { TlvSessionParameters } from "#session/pase/PaseMessages.js";
+import { ResumptionRecord, SessionManager } from "#session/SessionManager.js";
+import { NodeId, ProtocolStatusCode, SECURE_CHANNEL_PROTOCOL_ID, TypeFromSchema } from "#types";
 import { TlvOperationalCertificate } from "../../certificate/CertificateManager.js";
 import { FabricManager, FabricNotFoundError } from "../../fabric/FabricManager.js";
 import { MessageExchange } from "../../protocol/MessageExchange.js";
@@ -21,6 +22,7 @@ import {
     RESUME2_MIC_NONCE,
     TBE_DATA2_NONCE,
     TBE_DATA3_NONCE,
+    TlvCaseSigma1,
     TlvEncryptedDataSigma2,
     TlvEncryptedDataSigma3,
     TlvSignedData,
@@ -44,7 +46,7 @@ export class CaseServer implements ProtocolHandler {
     async onNewExchange(exchange: MessageExchange) {
         const messenger = new CaseServerMessenger(exchange);
         try {
-            await this.handleSigma1(messenger);
+            await this.#handleSigma1(messenger);
         } catch (error) {
             logger.error("An error occurred during the commissioning", error);
 
@@ -61,211 +63,272 @@ export class CaseServer implements ProtocolHandler {
         }
     }
 
-    private async handleSigma1(messenger: CaseServerMessenger) {
+    async #handleSigma1(messenger: CaseServerMessenger) {
         logger.info(`Received pairing request from ${messenger.getChannelName()}`);
-        // Generate pairing info
-        const responderRandom = Crypto.getRandom();
 
-        // Read and process sigma 1
+        // Initialize context with information from peer
         const { sigma1Bytes, sigma1 } = await messenger.readSigma1();
-        const {
-            initiatorSessionId: peerSessionId,
-            resumptionId: peerResumptionId,
-            initiatorResumeMic: peerResumeMic,
-            destinationId,
-            initiatorRandom: peerRandom,
-            initiatorEcdhPublicKey: peerEcdhPublicKey,
-            initiatorSessionParams,
-        } = sigma1;
-
-        // Try to resume a previous session
-        const resumptionId = Crypto.getRandomData(16);
-
         const resumptionRecord =
-            peerResumptionId !== undefined && peerResumeMic !== undefined
-                ? this.#sessions.findResumptionRecordById(peerResumptionId)
+            sigma1.resumptionId !== undefined && sigma1.initiatorResumeMic !== undefined
+                ? this.#sessions.findResumptionRecordById(sigma1.resumptionId)
                 : undefined;
-        // We try to resume the session
-        if (peerResumptionId !== undefined && peerResumeMic !== undefined && resumptionRecord !== undefined) {
-            const { sharedSecret, fabric, peerNodeId, caseAuthenticatedTags } = resumptionRecord;
-            const peerResumeKey = await Crypto.hkdf(
-                sharedSecret,
-                Bytes.concat(peerRandom, peerResumptionId),
-                KDFSR1_KEY_INFO,
-            );
-            Crypto.decrypt(peerResumeKey, peerResumeMic, RESUME1_MIC_NONCE);
-
-            // All good! Create secure session
-            const responderSessionId = await this.#sessions.getNextAvailableSessionId();
-            const secureSessionSalt = Bytes.concat(peerRandom, peerResumptionId);
-            const secureSession = await this.#sessions.createSecureSession({
-                sessionId: responderSessionId,
-                fabric,
-                peerNodeId,
-                peerSessionId,
-                sharedSecret,
-                salt: secureSessionSalt,
-                isInitiator: false,
-                isResumption: true,
-                peerSessionParameters: initiatorSessionParams,
-                caseAuthenticatedTags,
-            });
 
-            // Generate sigma 2 resume
-            const resumeSalt = Bytes.concat(peerRandom, resumptionId);
-            const resumeKey = await Crypto.hkdf(sharedSecret, resumeSalt, KDFSR2_KEY_INFO);
-            const resumeMic = Crypto.encrypt(resumeKey, new Uint8Array(0), RESUME2_MIC_NONCE);
-            try {
-                await messenger.sendSigma2Resume({
-                    resumptionId,
-                    resumeMic,
-                    responderSessionId,
-                    responderSessionParams: this.#sessions.sessionParameters, // responder session parameters
-                });
-            } catch (error) {
-                // If we fail to send the resume, we destroy the session
-                await secureSession.destroy(false);
-                throw error;
-            }
+        const context = new Sigma1Context(messenger, sigma1Bytes, sigma1, resumptionRecord);
 
-            logger.info(
-                `Session ${secureSession.id} resumed with ${messenger.getChannelName()} for Fabric ${NodeId.toHexString(
-                    fabric.nodeId,
-                )} (index ${fabric.fabricIndex}) and PeerNode ${NodeId.toHexString(peerNodeId)}`,
-                "with CATs",
-                caseAuthenticatedTags,
-            );
-            resumptionRecord.resumptionId = resumptionId; /* Update the ID */
-
-            // Wait for success on the peer side
-            await messenger.waitForSuccess("Sigma2Resume-Success");
-
-            await messenger.close();
-            await this.#sessions.saveResumptionRecord(resumptionRecord);
-        } else if (
-            (peerResumptionId === undefined && peerResumeMic === undefined) ||
-            (peerResumptionId !== undefined && peerResumeMic !== undefined && resumptionRecord === undefined)
-        ) {
-            // Generate sigma 2
-            // TODO: Pass through a group id?
-            const fabric = await this.#fabrics.findFabricFromDestinationId(destinationId, peerRandom);
-            const { operationalCert: nodeOpCert, intermediateCACert, operationalIdentityProtectionKey } = fabric;
-            const { publicKey: responderEcdhPublicKey, sharedSecret } =
-                await Crypto.ecdhGeneratePublicKeyAndSecret(peerEcdhPublicKey);
-            const sigma2Salt = Bytes.concat(
-                operationalIdentityProtectionKey,
-                responderRandom,
-                responderEcdhPublicKey,
-                await Crypto.hash(sigma1Bytes),
-            );
-            const sigma2Key = await Crypto.hkdf(sharedSecret, sigma2Salt, KDFSR2_INFO);
-            const signatureData = TlvSignedData.encode({
-                nodeOpCert,
-                intermediateCACert,
-                ecdhPublicKey: responderEcdhPublicKey,
-                peerEcdhPublicKey,
-            });
-            const signature = await fabric.sign(signatureData);
-            const encryptedData = TlvEncryptedDataSigma2.encode({
-                nodeOpCert,
-                intermediateCACert,
-                signature,
-                resumptionId,
-            });
-            const encrypted = Crypto.encrypt(sigma2Key, encryptedData, TBE_DATA2_NONCE);
-            const responderSessionId = await this.#sessions.getNextAvailableSessionId();
-            const sigma2Bytes = await messenger.sendSigma2({
-                responderRandom,
+        // Attempt resumption
+        if (await this.#resume(context)) {
+            return;
+        }
+
+        // Attempt sigma2 negotiation
+        if (await this.#generateSigma2(context)) {
+            return;
+        }
+
+        logger.info(
+            `Invalid resumption ID or resume MIC received from ${messenger.getChannelName()}`,
+            context.peerResumptionId,
+            context.peerResumeMic,
+        );
+
+        throw new UnexpectedDataError("Invalid resumption ID or resume MIC.");
+    }
+
+    async #resume(cx: Sigma1Context) {
+        if (cx.peerResumptionId === undefined || cx.peerResumeMic === undefined || cx.resumptionRecord === undefined) {
+            return false;
+        }
+
+        const { sharedSecret, fabric, peerNodeId, caseAuthenticatedTags } = cx.resumptionRecord;
+        const peerResumeKey = await Crypto.hkdf(
+            sharedSecret,
+            Bytes.concat(cx.peerRandom, cx.peerResumptionId),
+            KDFSR1_KEY_INFO,
+        );
+
+        try {
+            Crypto.decrypt(peerResumeKey, cx.peerResumeMic, RESUME1_MIC_NONCE);
+        } catch (e) {
+            CryptoDecryptError.accept(e);
+
+            // Clear resumption and initiate negotiate new connection
+            cx.peerResumptionId = cx.peerResumeMic = undefined;
+
+            return false;
+        }
+
+        // All good! Create secure session
+        const responderSessionId = await this.#sessions.getNextAvailableSessionId();
+        const secureSessionSalt = Bytes.concat(cx.peerRandom, cx.peerResumptionId);
+        const secureSession = await this.#sessions.createSecureSession({
+            sessionId: responderSessionId,
+            fabric,
+            peerNodeId,
+            peerSessionId: cx.peerSessionId,
+            sharedSecret,
+            salt: secureSessionSalt,
+            isInitiator: false,
+            isResumption: true,
+            peerSessionParameters: cx.peerSessionParams,
+            caseAuthenticatedTags,
+        });
+
+        // Generate sigma 2 resume
+        const resumeSalt = Bytes.concat(cx.peerRandom, cx.localResumptionId);
+        const resumeKey = await Crypto.hkdf(sharedSecret, resumeSalt, KDFSR2_KEY_INFO);
+        const resumeMic = Crypto.encrypt(resumeKey, new Uint8Array(0), RESUME2_MIC_NONCE);
+        try {
+            await cx.messenger.sendSigma2Resume({
+                resumptionId: cx.localResumptionId,
+                resumeMic,
                 responderSessionId,
-                responderEcdhPublicKey,
-                encrypted,
                 responderSessionParams: this.#sessions.sessionParameters, // responder session parameters
             });
+        } catch (error) {
+            // If we fail to send the resume, we destroy the session
+            await secureSession.destroy(false);
+            throw error;
+        }
 
-            // Read and process sigma 3
-            const {
-                sigma3Bytes,
-                sigma3: { encrypted: peerEncrypted },
-            } = await messenger.readSigma3();
-            const sigma3Salt = Bytes.concat(
-                operationalIdentityProtectionKey,
-                await Crypto.hash([sigma1Bytes, sigma2Bytes]),
-            );
-            const sigma3Key = await Crypto.hkdf(sharedSecret, sigma3Salt, KDFSR3_INFO);
-            const peerDecryptedData = Crypto.decrypt(sigma3Key, peerEncrypted, TBE_DATA3_NONCE);
-            const {
-                nodeOpCert: peerNewOpCert,
-                intermediateCACert: peerIntermediateCACert,
-                signature: peerSignature,
-            } = TlvEncryptedDataSigma3.decode(peerDecryptedData);
-
-            await fabric.verifyCredentials(peerNewOpCert, peerIntermediateCACert);
-
-            const peerSignatureData = TlvSignedData.encode({
-                nodeOpCert: peerNewOpCert,
-                intermediateCACert: peerIntermediateCACert,
-                ecdhPublicKey: peerEcdhPublicKey,
-                peerEcdhPublicKey: responderEcdhPublicKey,
-            });
-            const {
-                ellipticCurvePublicKey: peerPublicKey,
-                subject: { fabricId: peerFabricId, nodeId: peerNodeId, caseAuthenticatedTags },
-            } = TlvOperationalCertificate.decode(peerNewOpCert);
+        logger.info(
+            `Session ${secureSession.id} resumed with ${cx.messenger.getChannelName()} for Fabric ${NodeId.toHexString(
+                fabric.nodeId,
+            )} (index ${fabric.fabricIndex}) and PeerNode ${NodeId.toHexString(peerNodeId)}`,
+            "with CATs",
+            caseAuthenticatedTags,
+        );
+        cx.resumptionRecord.resumptionId = cx.localResumptionId; /* Update the ID */
 
-            if (fabric.fabricId !== peerFabricId) {
-                throw new UnexpectedDataError(`Fabric ID mismatch: ${fabric.fabricId} !== ${peerFabricId}`);
-            }
+        // Wait for success on the peer side
+        await cx.messenger.waitForSuccess("Sigma2Resume-Success");
 
-            await Crypto.verify(PublicKey(peerPublicKey), peerSignatureData, peerSignature);
-
-            // All good! Create secure session
-            const secureSessionSalt = Bytes.concat(
-                operationalIdentityProtectionKey,
-                await Crypto.hash([sigma1Bytes, sigma2Bytes, sigma3Bytes]),
-            );
-            const secureSession = await this.#sessions.createSecureSession({
-                sessionId: responderSessionId,
-                fabric,
-                peerNodeId,
-                peerSessionId,
-                sharedSecret,
-                salt: secureSessionSalt,
-                isInitiator: false,
-                isResumption: false,
-                peerSessionParameters: initiatorSessionParams,
-                caseAuthenticatedTags,
-            });
-            logger.info(
-                `Session ${secureSession.id} created with ${messenger.getChannelName()} for Fabric ${NodeId.toHexString(
-                    fabric.nodeId,
-                )} (index ${fabric.fabricIndex}) and PeerNode ${NodeId.toHexString(peerNodeId)}`,
-                "with CATs",
-                caseAuthenticatedTags,
-            );
-            await messenger.sendSuccess();
-
-            const resumptionRecord = {
-                peerNodeId,
-                fabric,
-                sharedSecret,
-                resumptionId,
-                sessionParameters: secureSession.parameters,
-                caseAuthenticatedTags,
-            };
-
-            await messenger.close();
-            await this.#sessions.saveResumptionRecord(resumptionRecord);
-        } else {
-            logger.info(
-                `Invalid resumption ID or resume MIC received from ${messenger.getChannelName()}`,
-                peerResumptionId,
-                peerResumeMic,
-            );
-            throw new UnexpectedDataError("Invalid resumption ID or resume MIC.");
+        await cx.messenger.close();
+        await this.#sessions.saveResumptionRecord(cx.resumptionRecord);
+
+        return true;
+    }
+
+    async #generateSigma2(cx: Sigma1Context) {
+        if (
+            // No resumption attempted is OK
+            !(cx.peerResumptionId === undefined && cx.peerResumeMic === undefined) &&
+            // Resumption attempted with no record on our side is OK
+            !(cx.peerResumptionId !== undefined && cx.peerResumeMic !== undefined && cx.resumptionRecord === undefined)
+        ) {
+            return false;
         }
+
+        // Generate pairing info
+        const responderRandom = Crypto.getRandom();
+
+        // TODO: Pass through a group id?
+        const fabric = await this.#fabrics.findFabricFromDestinationId(cx.destinationId, cx.peerRandom);
+        const { operationalCert: nodeOpCert, intermediateCACert, operationalIdentityProtectionKey } = fabric;
+        const { publicKey: responderEcdhPublicKey, sharedSecret } = await Crypto.ecdhGeneratePublicKeyAndSecret(
+            cx.peerEcdhPublicKey,
+        );
+        const sigma2Salt = Bytes.concat(
+            operationalIdentityProtectionKey,
+            responderRandom,
+            responderEcdhPublicKey,
+            await Crypto.hash(cx.bytes),
+        );
+        const sigma2Key = await Crypto.hkdf(sharedSecret, sigma2Salt, KDFSR2_INFO);
+        const signatureData = TlvSignedData.encode({
+            nodeOpCert,
+            intermediateCACert,
+            ecdhPublicKey: responderEcdhPublicKey,
+            peerEcdhPublicKey: cx.peerEcdhPublicKey,
+        });
+        const signature = await fabric.sign(signatureData);
+        const encryptedData = TlvEncryptedDataSigma2.encode({
+            nodeOpCert,
+            intermediateCACert,
+            signature,
+            resumptionId: cx.localResumptionId,
+        });
+        const encrypted = Crypto.encrypt(sigma2Key, encryptedData, TBE_DATA2_NONCE);
+        const responderSessionId = await this.#sessions.getNextAvailableSessionId();
+        const sigma2Bytes = await cx.messenger.sendSigma2({
+            responderRandom,
+            responderSessionId,
+            responderEcdhPublicKey,
+            encrypted,
+            responderSessionParams: this.#sessions.sessionParameters, // responder session parameters
+        });
+
+        // Read and process sigma 3
+        const {
+            sigma3Bytes,
+            sigma3: { encrypted: peerEncrypted },
+        } = await cx.messenger.readSigma3();
+        const sigma3Salt = Bytes.concat(operationalIdentityProtectionKey, await Crypto.hash([cx.bytes, sigma2Bytes]));
+        const sigma3Key = await Crypto.hkdf(sharedSecret, sigma3Salt, KDFSR3_INFO);
+        const peerDecryptedData = Crypto.decrypt(sigma3Key, peerEncrypted, TBE_DATA3_NONCE);
+        const {
+            nodeOpCert: peerNewOpCert,
+            intermediateCACert: peerIntermediateCACert,
+            signature: peerSignature,
+        } = TlvEncryptedDataSigma3.decode(peerDecryptedData);
+
+        await fabric.verifyCredentials(peerNewOpCert, peerIntermediateCACert);
+
+        const peerSignatureData = TlvSignedData.encode({
+            nodeOpCert: peerNewOpCert,
+            intermediateCACert: peerIntermediateCACert,
+            ecdhPublicKey: cx.peerEcdhPublicKey,
+            peerEcdhPublicKey: responderEcdhPublicKey,
+        });
+        const {
+            ellipticCurvePublicKey: peerPublicKey,
+            subject: { fabricId: peerFabricId, nodeId: peerNodeId, caseAuthenticatedTags },
+        } = TlvOperationalCertificate.decode(peerNewOpCert);
+
+        if (fabric.fabricId !== peerFabricId) {
+            throw new UnexpectedDataError(`Fabric ID mismatch: ${fabric.fabricId} !== ${peerFabricId}`);
+        }
+
+        await Crypto.verify(PublicKey(peerPublicKey), peerSignatureData, peerSignature);
+
+        // All good! Create secure session
+        const secureSessionSalt = Bytes.concat(
+            operationalIdentityProtectionKey,
+            await Crypto.hash([cx.bytes, sigma2Bytes, sigma3Bytes]),
+        );
+        const secureSession = await this.#sessions.createSecureSession({
+            sessionId: responderSessionId,
+            fabric,
+            peerNodeId,
+            peerSessionId: cx.peerSessionId,
+            sharedSecret,
+            salt: secureSessionSalt,
+            isInitiator: false,
+            isResumption: false,
+            peerSessionParameters: cx.peerSessionParams,
+            caseAuthenticatedTags,
+        });
+        logger.info(
+            `Session ${secureSession.id} created with ${cx.messenger.getChannelName()} for Fabric ${NodeId.toHexString(
+                fabric.nodeId,
+            )} (index ${fabric.fabricIndex}) and PeerNode ${NodeId.toHexString(peerNodeId)}`,
+            "with CATs",
+            caseAuthenticatedTags,
+        );
+        await cx.messenger.sendSuccess();
+
+        const resumptionRecord = {
+            peerNodeId,
+            fabric,
+            sharedSecret,
+            resumptionId: cx.localResumptionId,
+            sessionParameters: secureSession.parameters,
+            caseAuthenticatedTags,
+        };
+
+        await cx.messenger.close();
+        await this.#sessions.saveResumptionRecord(resumptionRecord);
+
+        return true;
     }
 
     async close() {
         // Nothing to do
     }
 }
+
+class Sigma1Context {
+    messenger: CaseServerMessenger;
+    bytes: Uint8Array;
+    peerSessionId: number;
+    peerResumptionId?: Uint8Array;
+    peerResumeMic?: Uint8Array;
+    destinationId: Uint8Array;
+    peerRandom: Uint8Array;
+    peerEcdhPublicKey: Uint8Array;
+    peerSessionParams?: TypeFromSchema<typeof TlvSessionParameters>;
+    resumptionRecord?: ResumptionRecord;
+
+    #localResumptionId?: Uint8Array;
+
+    constructor(
+        messenger: CaseServerMessenger,
+        bytes: Uint8Array,
+        sigma1: TypeFromSchema<typeof TlvCaseSigma1>,
+        resumptionRecord?: ResumptionRecord,
+    ) {
+        this.messenger = messenger;
+        this.bytes = bytes;
+        this.peerSessionId = sigma1.initiatorSessionId;
+        this.peerResumptionId = sigma1.resumptionId;
+        this.peerResumeMic = sigma1.initiatorResumeMic;
+        this.destinationId = sigma1.destinationId;
+        this.peerRandom = sigma1.initiatorRandom;
+        this.peerEcdhPublicKey = sigma1.initiatorEcdhPublicKey;
+        this.peerSessionParams = sigma1.initiatorSessionParams;
+        this.resumptionRecord = resumptionRecord;
+    }
+
+    get localResumptionId() {
+        return (this.#localResumptionId ??= Crypto.getRandomData(16));
+    }
+}