ai-remote 0.1.0

package/src/protocols/rdp/crypto.ts

@@ -0,0 +1,416 @@
+// ---------------------------------------------------------------------------
+// Crypto primitives for the RDP Standard Security layer (MS-RDPBCGR 5.3).
+//
+// RDP's own encryption layer predates anything WebCrypto exposes: it needs
+// synchronous MD5 and SHA-1 for a per-PDU MAC, RC4 stream state that persists
+// across PDUs, and textbook RSA against the key the server hands out in its
+// certificate. All of it is small, so it lives here rather than as a
+// dependency, and every function is deliberately synchronous -- the packet path
+// runs inside WebSocket message handlers.
+// ---------------------------------------------------------------------------
+
+// --- MD5 -------------------------------------------------------------------
+
+const MD5_SHIFTS = [
+  7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
+  5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+  4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
+  6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+
+// K[i] = floor(abs(sin(i + 1)) * 2^32) -- generated so the table cannot be mistyped.
+const MD5_K = new Uint32Array(
+  Array.from({ length: 64 }, (_, i) => Math.floor(Math.abs(Math.sin(i + 1)) * 4294967296))
+);
+
+function rotl32(value: Uint8Array, count: number) {
+  return (value << count) | (value >>> (32 - count));
+}
+
+export function md5(message: Uint8Array) {
+  const bitLength = message.length * 8;
+  const blockCount = Math.floor((message.length + 8) / 64) + 1;
+  const padded = new Uint8Array(blockCount * 64);
+  padded.set(message);
+  padded[message.length] = 0x80;
+
+  // Length is appended as a 64-bit little-endian bit count.
+  const tail = new DataView(padded.buffer, padded.byteLength - 8, 8);
+  tail.setUint32(0, bitLength >>> 0, true);
+  tail.setUint32(4, Math.floor(bitLength / 4294967296), true);
+
+  let a0 = 0x67452301, b0 = 0xefcdab89, c0 = 0x98badcfe, d0 = 0x10325476;
+  const words = new Uint32Array(16);
+  const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength);
+
+  for (let block = 0; block < blockCount; block++) {
+    for (let i = 0; i < 16; i++) words[i] = view.getUint32(block * 64 + i * 4, true);
+
+    let a = a0, b = b0, c = c0, d = d0;
+    for (let i = 0; i < 64; i++) {
+      let f;
+      let g;
+      if (i < 16) {
+        f = (b & c) | (~b & d);
+        g = i;
+      } else if (i < 32) {
+        f = (d & b) | (~d & c);
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        f = b ^ c ^ d;
+        g = (3 * i + 5) % 16;
+      } else {
+        f = c ^ (b | ~d);
+        g = (7 * i) % 16;
+      }
+
+      const temp = d;
+      d = c;
+      c = b;
+      const sum = (a + f + MD5_K[i] + words[g]) | 0;
+      b = (b + rotl32(sum, MD5_SHIFTS[i])) | 0;
+      a = temp;
+    }
+
+    a0 = (a0 + a) | 0;
+    b0 = (b0 + b) | 0;
+    c0 = (c0 + c) | 0;
+    d0 = (d0 + d) | 0;
+  }
+
+  const digest = new Uint8Array(16);
+  const out = new DataView(digest.buffer);
+  out.setUint32(0, a0 >>> 0, true);
+  out.setUint32(4, b0 >>> 0, true);
+  out.setUint32(8, c0 >>> 0, true);
+  out.setUint32(12, d0 >>> 0, true);
+  return digest;
+}
+
+// --- SHA-1 -----------------------------------------------------------------
+
+export function sha1(message: Uint8Array) {
+  const bitLength = message.length * 8;
+  const blockCount = Math.floor((message.length + 8) / 64) + 1;
+  const padded = new Uint8Array(blockCount * 64);
+  padded.set(message);
+  padded[message.length] = 0x80;
+
+  const tail = new DataView(padded.buffer, padded.byteLength - 8, 8);
+  tail.setUint32(0, Math.floor(bitLength / 4294967296));
+  tail.setUint32(4, bitLength >>> 0);
+
+  let h0 = 0x67452301, h1 = 0xefcdab89, h2 = 0x98badcfe, h3 = 0x10325476, h4 = 0xc3d2e1f0;
+  const words = new Uint32Array(80);
+  const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength);
+
+  for (let block = 0; block < blockCount; block++) {
+    for (let i = 0; i < 16; i++) words[i] = view.getUint32(block * 64 + i * 4);
+    for (let i = 16; i < 80; i++) {
+      words[i] = rotl32(words[i - 3] ^ words[i - 8] ^ words[i - 14] ^ words[i - 16], 1);
+    }
+
+    let a = h0, b = h1, c = h2, d = h3, e = h4;
+    for (let i = 0; i < 80; i++) {
+      let f;
+      let k;
+      if (i < 20) {
+        f = (b & c) | (~b & d);
+        k = 0x5a827999;
+      } else if (i < 40) {
+        f = b ^ c ^ d;
+        k = 0x6ed9eba1;
+      } else if (i < 60) {
+        f = (b & c) | (b & d) | (c & d);
+        k = 0x8f1bbcdc;
+      } else {
+        f = b ^ c ^ d;
+        k = 0xca62c1d6;
+      }
+
+      const temp = (rotl32(a, 5) + f + e + k + words[i]) | 0;
+      e = d;
+      d = c;
+      c = rotl32(b, 30);
+      b = a;
+      a = temp;
+    }
+
+    h0 = (h0 + a) | 0;
+    h1 = (h1 + b) | 0;
+    h2 = (h2 + c) | 0;
+    h3 = (h3 + d) | 0;
+    h4 = (h4 + e) | 0;
+  }
+
+  const digest = new Uint8Array(20);
+  const out = new DataView(digest.buffer);
+  [h0, h1, h2, h3, h4].forEach((word, i) => out.setUint32(i * 4, word >>> 0));
+  return digest;
+}
+
+// --- RC4 -------------------------------------------------------------------
+
+/** RC4 keystream position. RDP re-keys every 4096 PDUs, so this is mutable. */
+export interface Rc4State {
+  s: Uint8Array;
+  i: number;
+  j: number;
+}
+
+/** The five values MS-RDPBCGR 5.3.5 derives from the two randoms. */
+export interface SessionKeys {
+  macKey: Uint8Array;
+  keyLength: number;
+  is40Bit: boolean;
+  initialDecryptKey: Uint8Array;
+  initialEncryptKey: Uint8Array;
+  decryptKey: Uint8Array;
+  encryptKey: Uint8Array;
+}
+
+export function rc4Init(key: Uint8Array): Rc4State {
+  const s = new Uint8Array(256);
+  for (let i = 0; i < 256; i++) s[i] = i;
+
+  let j = 0;
+  for (let i = 0; i < 256; i++) {
+    j = (j + (s[i] ?? 0) + (key[i % key.length] ?? 0)) & 0xff;
+    const t = s[i] ?? 0;
+    s[i] = s[j] ?? 0;
+    s[j] = t;
+  }
+  return { s, i: 0, j: 0 };
+}
+
+/** RC4 is symmetric, so this both encrypts and decrypts. State advances. */
+export function rc4Crypt(state, data: Uint8Array) {
+  const out = new Uint8Array(data.length);
+  const { s } = state;
+  let { i, j } = state;
+
+  for (let n = 0; n < data.length; n++) {
+    i = (i + 1) & 0xff;
+    j = (j + s[i]) & 0xff;
+    const t = s[i];
+    s[i] = s[j];
+    s[j] = t;
+    out[n] = data[n] ^ s[(s[i] + s[j]) & 0xff];
+  }
+
+  state.i = i;
+  state.j = j;
+  return out;
+}
+
+// --- RSA -------------------------------------------------------------------
+
+function bigIntFromLe(bytes: Uint8Array) {
+  let value = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) value = (value << 8n) | BigInt(bytes[i]);
+  return value;
+}
+
+function bigIntToLe(value: Uint8Array, length: number) {
+  const out = new Uint8Array(length);
+  let remaining = value;
+  for (let i = 0; i < length; i++) {
+    out[i] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+  return out;
+}
+
+function modPow(base: bigint, exponent: bigint, modulus: bigint) {
+  let result = 1n;
+  let b = base % modulus;
+  let e = exponent;
+  while (e > 0n) {
+    if (e & 1n) result = (result * b) % modulus;
+    b = (b * b) % modulus;
+    e >>= 1n;
+  }
+  return result;
+}
+
+/**
+ * Textbook RSA over little-endian buffers, which is what RDP's Security
+ * Exchange PDU carries: the client random is raised to the server's public
+ * exponent with no padding scheme (MS-RDPBCGR 5.3.4.1).
+ */
+export function rsaEncrypt(dataLe: Uint8Array, modulusLe: Uint8Array, exponentLe: Uint8Array) {
+  const modulus = bigIntFromLe(modulusLe);
+  const exponent = bigIntFromLe(exponentLe);
+  const value = bigIntFromLe(dataLe);
+  if (value >= modulus) throw new Error('RDP: client random is larger than the server RSA modulus');
+  return bigIntToLe(modPow(value, exponent, modulus), modulusLe.length);
+}
+
+/**
+ * RSAES-PKCS1-v1_5 encryption over big-endian buffers, which is what TLS uses
+ * for an RSA key exchange. WebCrypto only offers OAEP, so the padding is built
+ * here and the modular exponentiation reuses the same BigInt path as RDP.
+ */
+export function rsaEncryptPkcs1(message: Uint8Array, modulusBe: Uint8Array, exponentBe: Uint8Array) {
+  const bigIntFromBe = (bytes: Uint8Array) => {
+    let value = 0n;
+    for (const byte of bytes) value = (value << 8n) | BigInt(byte);
+    return value;
+  };
+
+  const modulus = bigIntFromBe(modulusBe);
+  const exponent = bigIntFromBe(exponentBe);
+  const keyLength = modulusBe.length;
+  if (message.length > keyLength - 11) {
+    throw new Error('TLS: RSA message is too long for this key');
+  }
+
+  // EM = 0x00 || 0x02 || non-zero padding || 0x00 || message
+  const block = new Uint8Array(keyLength);
+  block[0] = 0x00;
+  block[1] = 0x02;
+  const paddingLength = keyLength - message.length - 3;
+  const padding = new Uint8Array(paddingLength);
+  crypto.getRandomValues(padding);
+  for (let i = 0; i < paddingLength; i++) {
+    // A padding byte of zero would be read as the separator.
+    while (padding[i] === 0) padding[i] = Math.max(1, crypto.getRandomValues(new Uint8Array(1))[0]);
+    block[2 + i] = padding[i];
+  }
+  block[2 + paddingLength] = 0x00;
+  block.set(message, 3 + paddingLength);
+
+  const cipher = modPow(bigIntFromBe(block), exponent, modulus);
+  const out = new Uint8Array(keyLength);
+  let remaining = cipher;
+  for (let i = keyLength - 1; i >= 0; i--) {
+    out[i] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+  return out;
+}
+
+// --- RDP key derivation (MS-RDPBCGR 5.3.5) ---------------------------------
+
+const PAD1 = new Uint8Array(40).fill(0x36);
+const PAD2 = new Uint8Array(48).fill(0x5c);
+
+export const ENCRYPTION_METHOD = {
+  NONE: 0x00000000,
+  BIT_40: 0x00000001,
+  BIT_128: 0x00000002,
+  BIT_56: 0x00000008,
+  FIPS: 0x00000010,
+};
+
+function concat(...parts) {
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+
+/** SaltedHash(S, I) = MD5(S + SHA1(I + S + clientRandom + serverRandom)) */
+function saltedHash(secret: Uint8Array, salt: Uint8Array, clientRandom: Uint8Array, serverRandom: Uint8Array) {
+  return md5(concat(secret, sha1(concat(salt, secret, clientRandom, serverRandom))));
+}
+
+/** FinalHash(K) = MD5(K + clientRandom + serverRandom) */
+function finalHash(key: Uint8Array, clientRandom: Uint8Array, serverRandom: Uint8Array) {
+  return md5(concat(key, clientRandom, serverRandom));
+}
+
+const SALT_A = new Uint8Array([0x41]);
+const SALT_BB = new Uint8Array([0x42, 0x42]);
+const SALT_CCC = new Uint8Array([0x43, 0x43, 0x43]);
+const SALT_X = new Uint8Array([0x58]);
+const SALT_YY = new Uint8Array([0x59, 0x59]);
+const SALT_ZZZ = new Uint8Array([0x5a, 0x5a, 0x5a]);
+
+/**
+ * A 40-bit or 56-bit session key is a 64-bit key with known leading bytes;
+ * only the remaining entropy is secret (MS-RDPBCGR 5.3.5.1).
+ */
+function reduceKey(key: Uint8Array, keyLength, is40Bit) {
+  if (keyLength !== 8) return key.slice(0, keyLength);
+
+  const reduced = key.slice(0, 8);
+  reduced[0] = 0xd1;
+  if (is40Bit) {
+    reduced[1] = 0x26;
+    reduced[2] = 0x9e;
+  }
+  return reduced;
+}
+
+export function keyLengthForMethod(encryptionMethod: number) {
+  if (encryptionMethod === ENCRYPTION_METHOD.BIT_40) return 8;
+  if (encryptionMethod === ENCRYPTION_METHOD.BIT_56) return 8;
+  return 16;
+}
+
+/**
+ * Derive the MAC key and both directional RC4 keys from the two random values
+ * exchanged during connection.
+ */
+export function deriveSessionKeys(clientRandom: Uint8Array, serverRandom: Uint8Array, encryptionMethod: number) {
+  const preMasterSecret = concat(clientRandom.subarray(0, 24), serverRandom.subarray(0, 24));
+
+  const masterSecret = concat(
+    saltedHash(preMasterSecret, SALT_A, clientRandom, serverRandom),
+    saltedHash(preMasterSecret, SALT_BB, clientRandom, serverRandom),
+    saltedHash(preMasterSecret, SALT_CCC, clientRandom, serverRandom)
+  );
+
+  const sessionKeyBlob = concat(
+    saltedHash(masterSecret, SALT_X, clientRandom, serverRandom),
+    saltedHash(masterSecret, SALT_YY, clientRandom, serverRandom),
+    saltedHash(masterSecret, SALT_ZZZ, clientRandom, serverRandom)
+  );
+
+  const keyLength = keyLengthForMethod(encryptionMethod);
+  const is40Bit = encryptionMethod === ENCRYPTION_METHOD.BIT_40;
+
+  const applyReduction = (key: Uint8Array) => reduceKey(key, keyLength, is40Bit);
+
+  const macKey = applyReduction(sessionKeyBlob.subarray(0, 16));
+  const decryptKey = applyReduction(finalHash(sessionKeyBlob.subarray(16, 32), clientRandom, serverRandom));
+  const encryptKey = applyReduction(finalHash(sessionKeyBlob.subarray(32, 48), clientRandom, serverRandom));
+
+  return {
+    macKey,
+    keyLength,
+    is40Bit,
+    // Session-key updates always restart from these initial values.
+    initialDecryptKey: decryptKey.slice(),
+    initialEncryptKey: encryptKey.slice(),
+    decryptKey,
+    encryptKey,
+  };
+}
+
+/**
+ * MACSignature = First64Bits(MD5(macKey + Pad2 + SHA1(macKey + Pad1 + len + data)))
+ */
+export function macSignature(macKey, data: Uint8Array) {
+  const lengthField = new Uint8Array(4);
+  new DataView(lengthField.buffer).setUint32(0, data.length, true);
+  const inner = sha1(concat(macKey, PAD1, lengthField, data));
+  return md5(concat(macKey, PAD2, inner)).subarray(0, 8);
+}
+
+/**
+ * Every 4096 PDUs the RC4 key is refreshed from the initial key
+ * (MS-RDPBCGR 5.3.7.1). The refreshed key is salted with itself.
+ */
+export function updateSessionKey(initialKey, currentKey, keyLength, is40Bit) {
+  const inner = sha1(concat(initialKey, PAD1, currentKey));
+  const nextKey = md5(concat(initialKey, PAD2, inner)).slice(0, keyLength);
+
+  const salted = rc4Crypt(rc4Init(nextKey), nextKey);
+  return reduceKey(salted, keyLength, is40Bit);
+}