@mtcute/core 0.17.1 → 0.18.0

package/network/authorization.cjs

@@ -0,0 +1,326 @@
+if (typeof globalThis !== "undefined" && !globalThis._MTCUTE_CJS_DEPRECATION_WARNED) {
+  globalThis._MTCUTE_CJS_DEPRECATION_WARNED = true;
+  console.warn("[mtcute-workspace] CommonJS support is deprecated and will be removed in 0.20.0. Please consider switching to ESM, it's " + (/* @__PURE__ */ new Date()).getFullYear() + " already.");
+  console.warn("[mtcute-workspace] Learn more about switching to ESM: https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c");
+}
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const utils = require("@fuman/utils");
+const tl = require("@mtcute/tl");
+const tlRuntime = require("@mtcute/tl-runtime");
+const Long = require("long");
+const keys = require("../utils/crypto/keys.cjs");
+const millerRabin = require("../utils/crypto/miller-rabin.cjs");
+const mtproto = require("../utils/crypto/mtproto.cjs");
+const typeAssertions = require("../utils/type-assertions.cjs");
+const errors = require("../types/errors.cjs");
+const DH_SAFETY_RANGE = 2n ** (2048n - 64n);
+const KNOWN_DH_PRIME = 0xC71CAEB9C6B1C9048E6C522F70F13F73980D40238E3E21C14934D037563D930F48198A0AA7C14058229493D22530F4DBFA336F6E0AC925139543AED44CCE7C3720FD51F69458705AC68CD4FE6B6B13ABDC9746512969328454F18FAF8C595F642477FE96BB2A941D5BCD1D4AC8CC49880708FA9B378E3C4F3A9060BEE67CF9A4A4A695811051907E162753B56B0F6B410DBA74D8A84B2A14B3144E0EF1284754FD17ED950D5965B4B9DD46582DB1178D169C6BC465B0D6FF9CA3928FEF5B9AE4E418FC15E83EBEA0F87FA9FF5EED70050DED2849F47BF959D956850CE929851F0D8115F635B105EE2E4E15D04B2454BF6F4FADF034B10403119CD8E3B92FCC5Bn;
+const TWO_POW_2047 = 2n ** 2047n;
+const TWO_POW_2048 = 2n ** 2048n;
+const checkedPrimesCache = [];
+function checkDhPrime(crypto, log, dhPrime, g) {
+  if (KNOWN_DH_PRIME === dhPrime) {
+    log.debug("server is using known dh prime, skipping validation");
+    return;
+  }
+  let checkedPrime = checkedPrimesCache.find((x) => x.prime === dhPrime);
+  if (!checkedPrime) {
+    if (dhPrime <= TWO_POW_2047 || dhPrime >= TWO_POW_2048) {
+      throw new errors.MtSecurityError("Step 3: dh_prime is not in the 2048-bit range");
+    }
+    if (!millerRabin.millerRabin(crypto, dhPrime)) {
+      throw new errors.MtSecurityError("Step 3: dh_prime is not prime");
+    }
+    if (!millerRabin.millerRabin(crypto, (dhPrime - 1n) / 2n)) {
+      throw new errors.MtSecurityError("Step 3: dh_prime is not a safe prime - (dh_prime-1)/2 is not prime");
+    }
+    log.debug("dh_prime is probably prime");
+    checkedPrime = {
+      prime: dhPrime,
+      generators: []
+    };
+    checkedPrimesCache.push(checkedPrime);
+  } else {
+    log.debug("dh_prime is probably prime (cached)");
+  }
+  const generatorChecked = checkedPrime.generators.includes(g);
+  if (generatorChecked) {
+    log.debug("g = %d is already checked for dh_prime", g);
+    return;
+  }
+  switch (g) {
+    case 2:
+      if (dhPrime % 8n !== 7n) {
+        throw new errors.MtSecurityError("Step 3: ivalid g - dh_prime mod 8 != 7");
+      }
+      break;
+    case 3:
+      if (dhPrime % 3n !== 2n) {
+        throw new errors.MtSecurityError("Step 3: ivalid g - dh_prime mod 3 != 2");
+      }
+      break;
+    case 4:
+      break;
+    case 5: {
+      const mod = dhPrime % 5n;
+      if (mod !== 1n && mod !== 4n) {
+        throw new errors.MtSecurityError("Step 3: ivalid g - dh_prime mod 5 != 1 && dh_prime mod 5 != 4");
+      }
+      break;
+    }
+    case 6: {
+      const mod = dhPrime % 24n;
+      if (mod !== 19n && mod !== 23n) {
+        throw new errors.MtSecurityError("Step 3: ivalid g - dh_prime mod 24 != 19 && dh_prime mod 24 != 23");
+      }
+      break;
+    }
+    case 7: {
+      const mod = dhPrime % 7n;
+      if (mod !== 3n && mod !== 5n && mod !== 6n) {
+        throw new errors.MtSecurityError(
+          "Step 3: ivalid g - dh_prime mod 7 != 3 && dh_prime mod 7 != 5 && dh_prime mod 7 != 6"
+        );
+      }
+      break;
+    }
+    default:
+      throw new errors.MtSecurityError(`Step 3: ivalid g - unknown g = ${g}`);
+  }
+  checkedPrime.generators.push(g);
+  log.debug("g = %d is safe to use with dh_prime", g);
+}
+function rsaPad(data, crypto, key) {
+  const keyModulus = BigInt(`0x${key.modulus}`);
+  const keyExponent = BigInt(`0x${key.exponent}`);
+  if (data.length > 144) {
+    throw new errors.MtArgumentError("Failed to pad: too big data");
+  }
+  const dataPadded = utils.u8.alloc(192);
+  dataPadded.set(data, 0);
+  crypto.randomFill(dataPadded.subarray(data.length));
+  data = dataPadded;
+  for (; ; ) {
+    const aesIv = utils.u8.alloc(32);
+    const aesKey = crypto.randomBytes(32);
+    const dataWithHash = utils.u8.concat2(data, crypto.sha256(utils.u8.concat2(aesKey, data)));
+    dataWithHash.subarray(0, 192).reverse();
+    const aes = crypto.createAesIge(aesKey, aesIv);
+    const encrypted = aes.encrypt(dataWithHash);
+    const encryptedHash = crypto.sha256(encrypted);
+    utils.u8.xorInPlace(aesKey, encryptedHash);
+    const decryptedData = utils.u8.concat2(aesKey, encrypted);
+    const decryptedDataBigint = utils.bigint.fromBytes(decryptedData);
+    if (decryptedDataBigint >= keyModulus) {
+      continue;
+    }
+    const encryptedBigint = utils.bigint.modPowBinary(decryptedDataBigint, keyExponent, keyModulus);
+    return utils.bigint.toBytes(encryptedBigint, 256);
+  }
+}
+function rsaEncrypt(data, crypto, key) {
+  const toEncrypt = utils.u8.concat3(
+    crypto.sha1(data),
+    data,
+    // sha1 is always 20 bytes, so we're left with 255 - 20 - x padding
+    crypto.randomBytes(235 - data.length)
+  );
+  const encryptedBigInt = utils.bigint.modPowBinary(
+    utils.bigint.fromBytes(toEncrypt),
+    BigInt(`0x${key.exponent}`),
+    BigInt(`0x${key.modulus}`)
+  );
+  return utils.bigint.toBytes(encryptedBigInt);
+}
+async function doAuthorization(connection, crypto, expiresIn) {
+  const session = connection["_session"];
+  const readerMap = session._readerMap;
+  const writerMap = session._writerMap;
+  const log = connection.log.create("auth");
+  function sendPlainMessage(message) {
+    const length = tlRuntime.TlSerializationCounter.countNeededBytes(writerMap, message);
+    const writer = tlRuntime.TlBinaryWriter.alloc(writerMap, length + 20);
+    const messageId = session.getMessageId();
+    log.verbose("[PLAIN] >>> %j", message);
+    writer.long(Long.ZERO);
+    writer.long(messageId);
+    writer.uint(length);
+    writer.object(message);
+    return connection.send(writer.result());
+  }
+  async function readNext() {
+    const res = tlRuntime.TlBinaryReader.deserializeObject(
+      readerMap,
+      await connection.waitForUnencryptedMessage(),
+      20
+      // skip mtproto header
+    );
+    log.verbose("[PLAIN] <<< %j", res);
+    return res;
+  }
+  if (expiresIn) log.prefix = "[PFS] ";
+  const nonce = crypto.randomBytes(16);
+  log.debug("starting PQ handshake (temp = %b), nonce = %h", expiresIn, nonce);
+  await sendPlainMessage({ _: "mt_req_pq_multi", nonce });
+  const resPq = await readNext();
+  typeAssertions.mtpAssertTypeIs("auth step 1", resPq, "mt_resPQ");
+  if (!utils.typed.equal(resPq.nonce, nonce)) {
+    throw new errors.MtSecurityError("Step 1: invalid nonce from server");
+  }
+  const serverKeys = resPq.serverPublicKeyFingerprints.map((it) => it.toUnsigned().toString(16));
+  log.debug("received PQ, keys: %j", serverKeys);
+  const publicKey = keys.findKeyByFingerprints(serverKeys);
+  if (!publicKey) {
+    throw new errors.MtSecurityError(
+      `Step 2: Could not find server public key with any of these fingerprints: ${serverKeys.join(", ")}`
+    );
+  }
+  log.debug("found server key, fp = %s, old = %s", publicKey.fingerprint, publicKey.old);
+  if (millerRabin.millerRabin(crypto, utils.bigint.fromBytes(resPq.pq))) {
+    throw new errors.MtSecurityError("Step 2: pq is prime");
+  }
+  const [p, q] = await crypto.factorizePQ(resPq.pq);
+  log.debug("factorized PQ: PQ = %h, P = %h, Q = %h", resPq.pq, p, q);
+  const newNonce = crypto.randomBytes(32);
+  let dcId = connection.params.dc.id;
+  if (connection.params.testMode) dcId += 1e4;
+  if (connection.params.dc.mediaOnly) dcId = -dcId;
+  const _pqInnerData = {
+    _: expiresIn ? "mt_p_q_inner_data_temp_dc" : "mt_p_q_inner_data_dc",
+    pq: resPq.pq,
+    p,
+    q,
+    nonce,
+    newNonce,
+    serverNonce: resPq.serverNonce,
+    dc: dcId,
+    expiresIn
+    // whatever
+  };
+  const pqInnerData = tlRuntime.TlBinaryWriter.serializeObject(writerMap, _pqInnerData);
+  const encryptedData = publicKey.old ? rsaEncrypt(pqInnerData, crypto, publicKey) : rsaPad(pqInnerData, crypto, publicKey);
+  log.debug("requesting DH params");
+  await sendPlainMessage({
+    _: "mt_req_DH_params",
+    nonce,
+    serverNonce: resPq.serverNonce,
+    p,
+    q,
+    publicKeyFingerprint: Long.fromString(publicKey.fingerprint, true, 16),
+    encryptedData
+  });
+  const serverDhParams = await readNext();
+  typeAssertions.mtpAssertTypeIs("auth step 2", serverDhParams, "mt_server_DH_params_ok");
+  if (!utils.typed.equal(serverDhParams.nonce, nonce)) {
+    throw new errors.MtSecurityError("Step 2: invalid nonce from server");
+  }
+  if (!utils.typed.equal(serverDhParams.serverNonce, resPq.serverNonce)) {
+    throw new errors.MtSecurityError("Step 2: invalid server nonce from server");
+  }
+  log.debug("server DH ok");
+  if (serverDhParams.encryptedAnswer.length % 16 !== 0) {
+    throw new errors.MtSecurityError("Step 2: AES block size is invalid");
+  }
+  const [key, iv] = mtproto.generateKeyAndIvFromNonce(crypto, resPq.serverNonce, newNonce);
+  const ige = crypto.createAesIge(key, iv);
+  const plainTextAnswer = ige.decrypt(serverDhParams.encryptedAnswer);
+  const innerDataHash = plainTextAnswer.subarray(0, 20);
+  const serverDhInnerReader = new tlRuntime.TlBinaryReader(readerMap, plainTextAnswer, 20);
+  const serverDhInner = serverDhInnerReader.object();
+  if (!utils.typed.equal(innerDataHash, crypto.sha1(plainTextAnswer.subarray(20, serverDhInnerReader.pos)))) {
+    throw new errors.MtSecurityError("Step 3: invalid inner data hash");
+  }
+  typeAssertions.mtpAssertTypeIs("auth step 3", serverDhInner, "mt_server_DH_inner_data");
+  if (!utils.typed.equal(serverDhInner.nonce, nonce)) {
+    throw new Error("Step 3: invalid nonce from server");
+  }
+  if (!utils.typed.equal(serverDhInner.serverNonce, resPq.serverNonce)) {
+    throw new Error("Step 3: invalid server nonce from server");
+  }
+  const dhPrime = utils.bigint.fromBytes(serverDhInner.dhPrime);
+  const timeOffset = Math.floor(Date.now() / 1e3) - serverDhInner.serverTime;
+  session.updateTimeOffset(timeOffset);
+  const g = BigInt(serverDhInner.g);
+  const gA = utils.bigint.fromBytes(serverDhInner.gA);
+  checkDhPrime(crypto, log, dhPrime, serverDhInner.g);
+  let retryId = Long.ZERO;
+  const serverSalt = utils.u8.xor(newNonce.subarray(0, 8), resPq.serverNonce.subarray(0, 8));
+  for (; ; ) {
+    const b = utils.bigint.fromBytes(crypto.randomBytes(256));
+    const gB = utils.bigint.modPowBinary(g, b, dhPrime);
+    const authKey = utils.bigint.toBytes(utils.bigint.modPowBinary(gA, b, dhPrime));
+    const authKeyAuxHash = crypto.sha1(authKey).subarray(0, 8);
+    if (g <= 1 || g >= dhPrime - 1n) {
+      throw new errors.MtSecurityError("g is not within (1, dh_prime - 1)");
+    }
+    if (gA <= 1 || gA >= dhPrime - 1n) {
+      throw new errors.MtSecurityError("g_a is not within (1, dh_prime - 1)");
+    }
+    if (gB <= 1 || gB >= dhPrime - 1n) {
+      throw new errors.MtSecurityError("g_b is not within (1, dh_prime - 1)");
+    }
+    if (gA <= DH_SAFETY_RANGE || gA >= dhPrime - DH_SAFETY_RANGE) {
+      throw new errors.MtSecurityError("g_a is not within (2^{2048-64}, dh_prime - 2^{2048-64})");
+    }
+    if (gB <= DH_SAFETY_RANGE || gB >= dhPrime - DH_SAFETY_RANGE) {
+      throw new errors.MtSecurityError("g_b is not within (2^{2048-64}, dh_prime - 2^{2048-64})");
+    }
+    const gB_ = utils.bigint.toBytes(gB, 0);
+    const clientDhInner = {
+      _: "mt_client_DH_inner_data",
+      nonce,
+      serverNonce: resPq.serverNonce,
+      retryId,
+      gB: gB_
+    };
+    let innerLength = tlRuntime.TlSerializationCounter.countNeededBytes(writerMap, clientDhInner) + 20;
+    const innerPaddingLength = innerLength % 16;
+    if (innerPaddingLength > 0) innerLength += 16 - innerPaddingLength;
+    const clientDhInnerWriter = tlRuntime.TlBinaryWriter.alloc(writerMap, innerLength);
+    clientDhInnerWriter.pos = 20;
+    clientDhInnerWriter.object(clientDhInner);
+    const clientDhInnerHash = crypto.sha1(clientDhInnerWriter.uint8View.subarray(20, clientDhInnerWriter.pos));
+    clientDhInnerWriter.pos = 0;
+    clientDhInnerWriter.raw(clientDhInnerHash);
+    log.debug("sending client DH (timeOffset = %d)", timeOffset);
+    const clientDhEncrypted = ige.encrypt(clientDhInnerWriter.uint8View);
+    await sendPlainMessage({
+      _: "mt_set_client_DH_params",
+      nonce,
+      serverNonce: resPq.serverNonce,
+      encryptedData: clientDhEncrypted
+    });
+    const dhGen = await readNext();
+    if (!tl.mtp.isAnySet_client_DH_params_answer(dhGen)) {
+      throw new errors.MtTypeAssertionError("auth step 4", "set_client_DH_params_answer", dhGen._);
+    }
+    if (!utils.typed.equal(dhGen.nonce, nonce)) {
+      throw new errors.MtSecurityError("Step 4: invalid nonce from server");
+    }
+    if (!utils.typed.equal(dhGen.serverNonce, resPq.serverNonce)) {
+      throw new errors.MtSecurityError("Step 4: invalid server nonce from server");
+    }
+    log.debug("DH result: %s", dhGen._);
+    if (dhGen._ === "mt_dh_gen_fail") {
+      throw new errors.MtTypeAssertionError("auth step 4", "!mt_dh_gen_fail", dhGen._);
+    }
+    if (dhGen._ === "mt_dh_gen_retry") {
+      const expectedHash2 = crypto.sha1(utils.u8.concat3(newNonce, [2], authKeyAuxHash));
+      if (!utils.typed.equal(expectedHash2.subarray(4, 20), dhGen.newNonceHash2)) {
+        throw new errors.MtSecurityError("Step 4: invalid retry nonce hash from server");
+      }
+      retryId = Long.fromBytesLE(authKeyAuxHash);
+      continue;
+    }
+    if (dhGen._ !== "mt_dh_gen_ok") throw new Error("unreachable");
+    const expectedHash = crypto.sha1(utils.u8.concat3(newNonce, [1], authKeyAuxHash));
+    if (!utils.typed.equal(expectedHash.subarray(4, 20), dhGen.newNonceHash1)) {
+      throw new errors.MtSecurityError("Step 4: invalid nonce hash from server");
+    }
+    log.info("authorization successful");
+    const dv = utils.typed.toDataView(serverSalt);
+    return [authKey, new Long(dv.getInt32(0, true), dv.getInt32(4, true)), timeOffset];
+  }
+}
+exports.doAuthorization = doAuthorization;

package/network/authorization.d.cts

@@ -0,0 +1,9 @@
+import { ICryptoProvider } from '../utils/index.js';
+import { SessionConnection } from './session-connection.js';
+import { default as Long } from 'long';
+/**
+ * Execute authorization flow on `connection` using `crypto`.
+ *
+ * @returns  tuple: [authKey, serverSalt, timeOffset]
+ */
+export declare function doAuthorization(connection: SessionConnection, crypto: ICryptoProvider, expiresIn?: number): Promise<[Uint8Array, Long, number]>;

package/network/authorization.d.ts

@@ -1,6 +1,6 @@
-import { default as Long } from 'long';
 import { ICryptoProvider } from '../utils/index.js';
 import { SessionConnection } from './session-connection.js';
+import { default as Long } from 'long';
 /**
  * Execute authorization flow on `connection` using `crypto`.
  *

package/network/authorization.js

@@ -0,0 +1,321 @@
+import { typed, bigint, u8 } from "@fuman/utils";
+import { mtp } from "@mtcute/tl";
+import { TlSerializationCounter, TlBinaryWriter, TlBinaryReader } from "@mtcute/tl-runtime";
+import Long from "long";
+import { findKeyByFingerprints } from "../utils/crypto/keys.js";
+import { millerRabin } from "../utils/crypto/miller-rabin.js";
+import { generateKeyAndIvFromNonce } from "../utils/crypto/mtproto.js";
+import { mtpAssertTypeIs } from "../utils/type-assertions.js";
+import { MtSecurityError, MtArgumentError, MtTypeAssertionError } from "../types/errors.js";
+const DH_SAFETY_RANGE = 2n ** (2048n - 64n);
+const KNOWN_DH_PRIME = 0xC71CAEB9C6B1C9048E6C522F70F13F73980D40238E3E21C14934D037563D930F48198A0AA7C14058229493D22530F4DBFA336F6E0AC925139543AED44CCE7C3720FD51F69458705AC68CD4FE6B6B13ABDC9746512969328454F18FAF8C595F642477FE96BB2A941D5BCD1D4AC8CC49880708FA9B378E3C4F3A9060BEE67CF9A4A4A695811051907E162753B56B0F6B410DBA74D8A84B2A14B3144E0EF1284754FD17ED950D5965B4B9DD46582DB1178D169C6BC465B0D6FF9CA3928FEF5B9AE4E418FC15E83EBEA0F87FA9FF5EED70050DED2849F47BF959D956850CE929851F0D8115F635B105EE2E4E15D04B2454BF6F4FADF034B10403119CD8E3B92FCC5Bn;
+const TWO_POW_2047 = 2n ** 2047n;
+const TWO_POW_2048 = 2n ** 2048n;
+const checkedPrimesCache = [];
+function checkDhPrime(crypto, log, dhPrime, g) {
+  if (KNOWN_DH_PRIME === dhPrime) {
+    log.debug("server is using known dh prime, skipping validation");
+    return;
+  }
+  let checkedPrime = checkedPrimesCache.find((x) => x.prime === dhPrime);
+  if (!checkedPrime) {
+    if (dhPrime <= TWO_POW_2047 || dhPrime >= TWO_POW_2048) {
+      throw new MtSecurityError("Step 3: dh_prime is not in the 2048-bit range");
+    }
+    if (!millerRabin(crypto, dhPrime)) {
+      throw new MtSecurityError("Step 3: dh_prime is not prime");
+    }
+    if (!millerRabin(crypto, (dhPrime - 1n) / 2n)) {
+      throw new MtSecurityError("Step 3: dh_prime is not a safe prime - (dh_prime-1)/2 is not prime");
+    }
+    log.debug("dh_prime is probably prime");
+    checkedPrime = {
+      prime: dhPrime,
+      generators: []
+    };
+    checkedPrimesCache.push(checkedPrime);
+  } else {
+    log.debug("dh_prime is probably prime (cached)");
+  }
+  const generatorChecked = checkedPrime.generators.includes(g);
+  if (generatorChecked) {
+    log.debug("g = %d is already checked for dh_prime", g);
+    return;
+  }
+  switch (g) {
+    case 2:
+      if (dhPrime % 8n !== 7n) {
+        throw new MtSecurityError("Step 3: ivalid g - dh_prime mod 8 != 7");
+      }
+      break;
+    case 3:
+      if (dhPrime % 3n !== 2n) {
+        throw new MtSecurityError("Step 3: ivalid g - dh_prime mod 3 != 2");
+      }
+      break;
+    case 4:
+      break;
+    case 5: {
+      const mod = dhPrime % 5n;
+      if (mod !== 1n && mod !== 4n) {
+        throw new MtSecurityError("Step 3: ivalid g - dh_prime mod 5 != 1 && dh_prime mod 5 != 4");
+      }
+      break;
+    }
+    case 6: {
+      const mod = dhPrime % 24n;
+      if (mod !== 19n && mod !== 23n) {
+        throw new MtSecurityError("Step 3: ivalid g - dh_prime mod 24 != 19 && dh_prime mod 24 != 23");
+      }
+      break;
+    }
+    case 7: {
+      const mod = dhPrime % 7n;
+      if (mod !== 3n && mod !== 5n && mod !== 6n) {
+        throw new MtSecurityError(
+          "Step 3: ivalid g - dh_prime mod 7 != 3 && dh_prime mod 7 != 5 && dh_prime mod 7 != 6"
+        );
+      }
+      break;
+    }
+    default:
+      throw new MtSecurityError(`Step 3: ivalid g - unknown g = ${g}`);
+  }
+  checkedPrime.generators.push(g);
+  log.debug("g = %d is safe to use with dh_prime", g);
+}
+function rsaPad(data, crypto, key) {
+  const keyModulus = BigInt(`0x${key.modulus}`);
+  const keyExponent = BigInt(`0x${key.exponent}`);
+  if (data.length > 144) {
+    throw new MtArgumentError("Failed to pad: too big data");
+  }
+  const dataPadded = u8.alloc(192);
+  dataPadded.set(data, 0);
+  crypto.randomFill(dataPadded.subarray(data.length));
+  data = dataPadded;
+  for (; ; ) {
+    const aesIv = u8.alloc(32);
+    const aesKey = crypto.randomBytes(32);
+    const dataWithHash = u8.concat2(data, crypto.sha256(u8.concat2(aesKey, data)));
+    dataWithHash.subarray(0, 192).reverse();
+    const aes = crypto.createAesIge(aesKey, aesIv);
+    const encrypted = aes.encrypt(dataWithHash);
+    const encryptedHash = crypto.sha256(encrypted);
+    u8.xorInPlace(aesKey, encryptedHash);
+    const decryptedData = u8.concat2(aesKey, encrypted);
+    const decryptedDataBigint = bigint.fromBytes(decryptedData);
+    if (decryptedDataBigint >= keyModulus) {
+      continue;
+    }
+    const encryptedBigint = bigint.modPowBinary(decryptedDataBigint, keyExponent, keyModulus);
+    return bigint.toBytes(encryptedBigint, 256);
+  }
+}
+function rsaEncrypt(data, crypto, key) {
+  const toEncrypt = u8.concat3(
+    crypto.sha1(data),
+    data,
+    // sha1 is always 20 bytes, so we're left with 255 - 20 - x padding
+    crypto.randomBytes(235 - data.length)
+  );
+  const encryptedBigInt = bigint.modPowBinary(
+    bigint.fromBytes(toEncrypt),
+    BigInt(`0x${key.exponent}`),
+    BigInt(`0x${key.modulus}`)
+  );
+  return bigint.toBytes(encryptedBigInt);
+}
+async function doAuthorization(connection, crypto, expiresIn) {
+  const session = connection["_session"];
+  const readerMap = session._readerMap;
+  const writerMap = session._writerMap;
+  const log = connection.log.create("auth");
+  function sendPlainMessage(message) {
+    const length = TlSerializationCounter.countNeededBytes(writerMap, message);
+    const writer = TlBinaryWriter.alloc(writerMap, length + 20);
+    const messageId = session.getMessageId();
+    log.verbose("[PLAIN] >>> %j", message);
+    writer.long(Long.ZERO);
+    writer.long(messageId);
+    writer.uint(length);
+    writer.object(message);
+    return connection.send(writer.result());
+  }
+  async function readNext() {
+    const res = TlBinaryReader.deserializeObject(
+      readerMap,
+      await connection.waitForUnencryptedMessage(),
+      20
+      // skip mtproto header
+    );
+    log.verbose("[PLAIN] <<< %j", res);
+    return res;
+  }
+  if (expiresIn) log.prefix = "[PFS] ";
+  const nonce = crypto.randomBytes(16);
+  log.debug("starting PQ handshake (temp = %b), nonce = %h", expiresIn, nonce);
+  await sendPlainMessage({ _: "mt_req_pq_multi", nonce });
+  const resPq = await readNext();
+  mtpAssertTypeIs("auth step 1", resPq, "mt_resPQ");
+  if (!typed.equal(resPq.nonce, nonce)) {
+    throw new MtSecurityError("Step 1: invalid nonce from server");
+  }
+  const serverKeys = resPq.serverPublicKeyFingerprints.map((it) => it.toUnsigned().toString(16));
+  log.debug("received PQ, keys: %j", serverKeys);
+  const publicKey = findKeyByFingerprints(serverKeys);
+  if (!publicKey) {
+    throw new MtSecurityError(
+      `Step 2: Could not find server public key with any of these fingerprints: ${serverKeys.join(", ")}`
+    );
+  }
+  log.debug("found server key, fp = %s, old = %s", publicKey.fingerprint, publicKey.old);
+  if (millerRabin(crypto, bigint.fromBytes(resPq.pq))) {
+    throw new MtSecurityError("Step 2: pq is prime");
+  }
+  const [p, q] = await crypto.factorizePQ(resPq.pq);
+  log.debug("factorized PQ: PQ = %h, P = %h, Q = %h", resPq.pq, p, q);
+  const newNonce = crypto.randomBytes(32);
+  let dcId = connection.params.dc.id;
+  if (connection.params.testMode) dcId += 1e4;
+  if (connection.params.dc.mediaOnly) dcId = -dcId;
+  const _pqInnerData = {
+    _: expiresIn ? "mt_p_q_inner_data_temp_dc" : "mt_p_q_inner_data_dc",
+    pq: resPq.pq,
+    p,
+    q,
+    nonce,
+    newNonce,
+    serverNonce: resPq.serverNonce,
+    dc: dcId,
+    expiresIn
+    // whatever
+  };
+  const pqInnerData = TlBinaryWriter.serializeObject(writerMap, _pqInnerData);
+  const encryptedData = publicKey.old ? rsaEncrypt(pqInnerData, crypto, publicKey) : rsaPad(pqInnerData, crypto, publicKey);
+  log.debug("requesting DH params");
+  await sendPlainMessage({
+    _: "mt_req_DH_params",
+    nonce,
+    serverNonce: resPq.serverNonce,
+    p,
+    q,
+    publicKeyFingerprint: Long.fromString(publicKey.fingerprint, true, 16),
+    encryptedData
+  });
+  const serverDhParams = await readNext();
+  mtpAssertTypeIs("auth step 2", serverDhParams, "mt_server_DH_params_ok");
+  if (!typed.equal(serverDhParams.nonce, nonce)) {
+    throw new MtSecurityError("Step 2: invalid nonce from server");
+  }
+  if (!typed.equal(serverDhParams.serverNonce, resPq.serverNonce)) {
+    throw new MtSecurityError("Step 2: invalid server nonce from server");
+  }
+  log.debug("server DH ok");
+  if (serverDhParams.encryptedAnswer.length % 16 !== 0) {
+    throw new MtSecurityError("Step 2: AES block size is invalid");
+  }
+  const [key, iv] = generateKeyAndIvFromNonce(crypto, resPq.serverNonce, newNonce);
+  const ige = crypto.createAesIge(key, iv);
+  const plainTextAnswer = ige.decrypt(serverDhParams.encryptedAnswer);
+  const innerDataHash = plainTextAnswer.subarray(0, 20);
+  const serverDhInnerReader = new TlBinaryReader(readerMap, plainTextAnswer, 20);
+  const serverDhInner = serverDhInnerReader.object();
+  if (!typed.equal(innerDataHash, crypto.sha1(plainTextAnswer.subarray(20, serverDhInnerReader.pos)))) {
+    throw new MtSecurityError("Step 3: invalid inner data hash");
+  }
+  mtpAssertTypeIs("auth step 3", serverDhInner, "mt_server_DH_inner_data");
+  if (!typed.equal(serverDhInner.nonce, nonce)) {
+    throw new Error("Step 3: invalid nonce from server");
+  }
+  if (!typed.equal(serverDhInner.serverNonce, resPq.serverNonce)) {
+    throw new Error("Step 3: invalid server nonce from server");
+  }
+  const dhPrime = bigint.fromBytes(serverDhInner.dhPrime);
+  const timeOffset = Math.floor(Date.now() / 1e3) - serverDhInner.serverTime;
+  session.updateTimeOffset(timeOffset);
+  const g = BigInt(serverDhInner.g);
+  const gA = bigint.fromBytes(serverDhInner.gA);
+  checkDhPrime(crypto, log, dhPrime, serverDhInner.g);
+  let retryId = Long.ZERO;
+  const serverSalt = u8.xor(newNonce.subarray(0, 8), resPq.serverNonce.subarray(0, 8));
+  for (; ; ) {
+    const b = bigint.fromBytes(crypto.randomBytes(256));
+    const gB = bigint.modPowBinary(g, b, dhPrime);
+    const authKey = bigint.toBytes(bigint.modPowBinary(gA, b, dhPrime));
+    const authKeyAuxHash = crypto.sha1(authKey).subarray(0, 8);
+    if (g <= 1 || g >= dhPrime - 1n) {
+      throw new MtSecurityError("g is not within (1, dh_prime - 1)");
+    }
+    if (gA <= 1 || gA >= dhPrime - 1n) {
+      throw new MtSecurityError("g_a is not within (1, dh_prime - 1)");
+    }
+    if (gB <= 1 || gB >= dhPrime - 1n) {
+      throw new MtSecurityError("g_b is not within (1, dh_prime - 1)");
+    }
+    if (gA <= DH_SAFETY_RANGE || gA >= dhPrime - DH_SAFETY_RANGE) {
+      throw new MtSecurityError("g_a is not within (2^{2048-64}, dh_prime - 2^{2048-64})");
+    }
+    if (gB <= DH_SAFETY_RANGE || gB >= dhPrime - DH_SAFETY_RANGE) {
+      throw new MtSecurityError("g_b is not within (2^{2048-64}, dh_prime - 2^{2048-64})");
+    }
+    const gB_ = bigint.toBytes(gB, 0);
+    const clientDhInner = {
+      _: "mt_client_DH_inner_data",
+      nonce,
+      serverNonce: resPq.serverNonce,
+      retryId,
+      gB: gB_
+    };
+    let innerLength = TlSerializationCounter.countNeededBytes(writerMap, clientDhInner) + 20;
+    const innerPaddingLength = innerLength % 16;
+    if (innerPaddingLength > 0) innerLength += 16 - innerPaddingLength;
+    const clientDhInnerWriter = TlBinaryWriter.alloc(writerMap, innerLength);
+    clientDhInnerWriter.pos = 20;
+    clientDhInnerWriter.object(clientDhInner);
+    const clientDhInnerHash = crypto.sha1(clientDhInnerWriter.uint8View.subarray(20, clientDhInnerWriter.pos));
+    clientDhInnerWriter.pos = 0;
+    clientDhInnerWriter.raw(clientDhInnerHash);
+    log.debug("sending client DH (timeOffset = %d)", timeOffset);
+    const clientDhEncrypted = ige.encrypt(clientDhInnerWriter.uint8View);
+    await sendPlainMessage({
+      _: "mt_set_client_DH_params",
+      nonce,
+      serverNonce: resPq.serverNonce,
+      encryptedData: clientDhEncrypted
+    });
+    const dhGen = await readNext();
+    if (!mtp.isAnySet_client_DH_params_answer(dhGen)) {
+      throw new MtTypeAssertionError("auth step 4", "set_client_DH_params_answer", dhGen._);
+    }
+    if (!typed.equal(dhGen.nonce, nonce)) {
+      throw new MtSecurityError("Step 4: invalid nonce from server");
+    }
+    if (!typed.equal(dhGen.serverNonce, resPq.serverNonce)) {
+      throw new MtSecurityError("Step 4: invalid server nonce from server");
+    }
+    log.debug("DH result: %s", dhGen._);
+    if (dhGen._ === "mt_dh_gen_fail") {
+      throw new MtTypeAssertionError("auth step 4", "!mt_dh_gen_fail", dhGen._);
+    }
+    if (dhGen._ === "mt_dh_gen_retry") {
+      const expectedHash2 = crypto.sha1(u8.concat3(newNonce, [2], authKeyAuxHash));
+      if (!typed.equal(expectedHash2.subarray(4, 20), dhGen.newNonceHash2)) {
+        throw new MtSecurityError("Step 4: invalid retry nonce hash from server");
+      }
+      retryId = Long.fromBytesLE(authKeyAuxHash);
+      continue;
+    }
+    if (dhGen._ !== "mt_dh_gen_ok") throw new Error("unreachable");
+    const expectedHash = crypto.sha1(u8.concat3(newNonce, [1], authKeyAuxHash));
+    if (!typed.equal(expectedHash.subarray(4, 20), dhGen.newNonceHash1)) {
+      throw new MtSecurityError("Step 4: invalid nonce hash from server");
+    }
+    log.info("authorization successful");
+    const dv = typed.toDataView(serverSalt);
+    return [authKey, new Long(dv.getInt32(0, true), dv.getInt32(4, true)), timeOffset];
+  }
+}
+export {
+  doAuthorization
+};