fca-riyad 37.0.0

package/src/api/socket/e2ee/e2ee/ratchet.js

@@ -0,0 +1,219 @@
+"use strict";
+
+/**
+ * Double Ratchet Algorithm (Signal Protocol)
+ * Based on the Signal Protocol specification:
+ * https://signal.org/docs/specifications/doubleratchet/
+ */
+
+const { generateKeyPair, dh, hkdf, hkdfExtract, hkdfExpand, encrypt, decrypt, hmacSha256 } = require("./crypto");
+
+const MAX_SKIP = 1000;
+const INFO_RATCHET = Buffer.from("WhisperRatchet", "utf8");
+const INFO_MSG = Buffer.from("WhisperMessageKeys", "utf8");
+
+function kdfCK(ck) {
+    const ck2 = hmacSha256(ck, Buffer.from([0x02]));
+    const mk = hmacSha256(ck, Buffer.from([0x01]));
+    return { ck: ck2, mk };
+}
+
+function kdfRK(rk, dh_out) {
+    const salt = rk;
+    const out = hkdf(dh_out, 64, salt, INFO_RATCHET);
+    return { rk: out.slice(0, 32), ck: out.slice(32, 64) };
+}
+
+function deriveMessageKeys(mk) {
+    const out = hkdf(mk, 80, Buffer.alloc(32, 0), INFO_MSG);
+    return {
+        encKey: out.slice(0, 32),
+        authKey: out.slice(32, 64),
+        iv: out.slice(64, 80)
+    };
+}
+
+class DoubleRatchetSession {
+    constructor() {
+        this.DHs = null;          // Our DH ratchet key pair
+        this.DHr = null;          // Their DH ratchet public key (raw 32 bytes)
+        this.RK = null;           // Root key (32 bytes)
+        this.CKs = null;          // Sending chain key
+        this.CKr = null;          // Receiving chain key
+        this.Ns = 0;              // Send message number
+        this.Nr = 0;              // Receive message number
+        this.PN = 0;              // Previous sending chain length
+        this.MKSKIPPED = new Map(); // Skipped message keys
+    }
+
+    /**
+     * Initialize as sender (Alice) after X3DH
+     */
+    initAsSender(sk, recipientRatchetPublicKey) {
+        this.DHs = generateKeyPair();
+        this.DHr = Buffer.from(recipientRatchetPublicKey);
+        const dhOut = dh(this.DHs.privateKey, this.DHr);
+        const { rk, ck } = kdfRK(sk, dhOut);
+        this.RK = rk;
+        this.CKs = ck;
+        this.CKr = null;
+        this.Ns = 0; this.Nr = 0; this.PN = 0;
+    }
+
+    /**
+     * Initialize as receiver (Bob) after X3DH
+     */
+    initAsReceiver(sk, ourRatchetKeyPair) {
+        this.DHs = ourRatchetKeyPair;
+        this.DHr = null;
+        this.RK = sk;
+        this.CKs = null;
+        this.CKr = null;
+        this.Ns = 0; this.Nr = 0; this.PN = 0;
+    }
+
+    /**
+     * Encrypt a message
+     * Returns { header, ciphertext }
+     */
+    encrypt(plaintext, aad) {
+        const { ck, mk } = kdfCK(this.CKs);
+        this.CKs = ck;
+        const header = this._buildHeader(this.DHs.publicKeyRaw, this.PN, this.Ns);
+        this.Ns++;
+        const keys = deriveMessageKeys(mk);
+        const aadFull = aad ? Buffer.concat([aad, header]) : header;
+        const ciphertext = encrypt(keys.encKey, Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext, "utf8"), aadFull);
+        return { header, ciphertext };
+    }
+
+    /**
+     * Decrypt a message
+     * @param {Buffer} header - message header
+     * @param {Buffer} ciphertext - encrypted payload
+     * @param {Buffer} [aad] - additional auth data
+     * @returns {Buffer} decrypted plaintext
+     */
+    decrypt(header, ciphertext, aad) {
+        const { dh_pub, pn, n } = this._parseHeader(header);
+        const aadFull = aad ? Buffer.concat([aad, header]) : header;
+
+        // Check skipped keys first
+        const skipKey = `${dh_pub.toString("hex")}:${n}`;
+        if (this.MKSKIPPED.has(skipKey)) {
+            const mk = this.MKSKIPPED.get(skipKey);
+            this.MKSKIPPED.delete(skipKey);
+            const keys = deriveMessageKeys(mk);
+            return decrypt(keys.encKey, ciphertext, aadFull);
+        }
+
+        // Check if we need to ratchet
+        const needsRatchet = !this.DHr || !dh_pub.equals(this.DHr);
+        if (needsRatchet) {
+            this._skipMessageKeys(pn);
+            this._dhRatchetStep(dh_pub);
+        }
+
+        this._skipMessageKeys(n);
+        const { ck, mk } = kdfCK(this.CKr);
+        this.CKr = ck;
+        this.Nr++;
+
+        const keys = deriveMessageKeys(mk);
+        return decrypt(keys.encKey, ciphertext, aadFull);
+    }
+
+    _skipMessageKeys(until) {
+        if (this.Nr + MAX_SKIP < until) throw new Error("Too many skipped messages: " + until);
+        if (this.CKr) {
+            while (this.Nr < until) {
+                const { ck, mk } = kdfCK(this.CKr);
+                this.CKr = ck;
+                const key = `${this.DHr.toString("hex")}:${this.Nr}`;
+                this.MKSKIPPED.set(key, mk);
+                this.Nr++;
+            }
+        }
+    }
+
+    _dhRatchetStep(remoteDhPub) {
+        this.PN = this.Ns;
+        this.Ns = 0;
+        this.Nr = 0;
+        this.DHr = remoteDhPub;
+
+        // Receive ratchet
+        const dhOut1 = dh(this.DHs.privateKey, this.DHr);
+        const { rk: rk1, ck: ckr } = kdfRK(this.RK, dhOut1);
+        this.RK = rk1;
+        this.CKr = ckr;
+
+        // Send ratchet
+        this.DHs = generateKeyPair();
+        const dhOut2 = dh(this.DHs.privateKey, this.DHr);
+        const { rk: rk2, ck: cks } = kdfRK(this.RK, dhOut2);
+        this.RK = rk2;
+        this.CKs = cks;
+    }
+
+    _buildHeader(dhPub, pn, n) {
+        const buf = Buffer.allocUnsafe(32 + 4 + 4);
+        Buffer.from(dhPub).copy(buf, 0);
+        buf.writeUInt32BE(pn, 32);
+        buf.writeUInt32BE(n, 36);
+        return buf;
+    }
+
+    _parseHeader(header) {
+        if (header.length < 40) throw new Error("Invalid ratchet header length");
+        return {
+            dh_pub: header.slice(0, 32),
+            pn: header.readUInt32BE(32),
+            n: header.readUInt32BE(36)
+        };
+    }
+
+    /**
+     * Serialize session state for persistence
+     */
+    serialize() {
+        return JSON.stringify({
+            DHs_priv: this.DHs ? this.DHs.privateKey.toString("base64") : null,
+            DHs_pub: this.DHs ? this.DHs.publicKeyRaw.toString("base64") : null,
+            DHr: this.DHr ? this.DHr.toString("base64") : null,
+            RK: this.RK ? this.RK.toString("base64") : null,
+            CKs: this.CKs ? this.CKs.toString("base64") : null,
+            CKr: this.CKr ? this.CKr.toString("base64") : null,
+            Ns: this.Ns,
+            Nr: this.Nr,
+            PN: this.PN,
+            MKSKIPPED: Array.from(this.MKSKIPPED.entries()).map(([k, v]) => [k, v.toString("base64")])
+        });
+    }
+
+    /**
+     * Restore session state from serialized string
+     */
+    static deserialize(json) {
+        const d = JSON.parse(json);
+        const session = new DoubleRatchetSession();
+        if (d.DHs_priv) {
+            session.DHs = {
+                privateKey: Buffer.from(d.DHs_priv, "base64"),
+                publicKey: null,
+                publicKeyRaw: Buffer.from(d.DHs_pub, "base64")
+            };
+        }
+        session.DHr = d.DHr ? Buffer.from(d.DHr, "base64") : null;
+        session.RK = d.RK ? Buffer.from(d.RK, "base64") : null;
+        session.CKs = d.CKs ? Buffer.from(d.CKs, "base64") : null;
+        session.CKr = d.CKr ? Buffer.from(d.CKr, "base64") : null;
+        session.Ns = d.Ns || 0;
+        session.Nr = d.Nr || 0;
+        session.PN = d.PN || 0;
+        session.MKSKIPPED = new Map((d.MKSKIPPED || []).map(([k, v]) => [k, Buffer.from(v, "base64")]));
+        return session;
+    }
+}
+
+module.exports = { DoubleRatchetSession, kdfCK, kdfRK, deriveMessageKeys };

package/src/api/socket/e2ee/e2ee/store.js

@@ -0,0 +1,182 @@
+"use strict";
+
+/**
+ * E2EE Device/Session Store
+ * Persists key material to a JSON file (encrypted with a device secret).
+ * Each E2EE session (thread) is stored separately.
+ */
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+class E2EEStore {
+    constructor(storePath, userID) {
+        this.storePath = storePath;
+        this.userID = userID;
+        this.data = {
+            identityKey: null,
+            signedPreKey: null,
+            oneTimePreKeys: [],
+            sessions: {},      // threadID -> serialized DoubleRatchetSession
+            deviceSecret: null // 32-byte random secret for local encryption
+        };
+        this._loaded = false;
+    }
+
+    _storeFile() {
+        return path.join(this.storePath, `nexca_e2ee_${this.userID}.json`);
+    }
+
+    _salt() {
+        return Buffer.from(this.userID.padEnd(16, "0").slice(0, 16), "utf8");
+    }
+
+    _localEncrypt(data) {
+        if (!this.data.deviceSecret) return data;
+        const key = Buffer.from(this.data.deviceSecret, "base64");
+        if (key.length !== 32) return data;
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+        const enc = Buffer.concat([cipher.update(Buffer.from(data, "utf8")), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([iv, tag, enc]).toString("base64");
+    }
+
+    _localDecrypt(data) {
+        if (!this.data.deviceSecret) return data;
+        try {
+            const key = Buffer.from(this.data.deviceSecret, "base64");
+            if (key.length !== 32) return data;
+            const buf = Buffer.from(data, "base64");
+            const iv = buf.slice(0, 12);
+            const tag = buf.slice(12, 28);
+            const enc = buf.slice(28);
+            const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+            decipher.setAuthTag(tag);
+            return Buffer.concat([decipher.update(enc), decipher.final()]).toString("utf8");
+        } catch (_) {
+            return data;
+        }
+    }
+
+    load() {
+        const file = this._storeFile();
+        if (!fs.existsSync(file)) return false;
+        try {
+            const raw = fs.readFileSync(file, "utf8");
+            const parsed = JSON.parse(raw);
+            if (parsed.deviceSecret) this.data.deviceSecret = parsed.deviceSecret;
+            const decrypted = this._localDecrypt(parsed.payload || "{}");
+            const payload = JSON.parse(decrypted);
+            this.data.identityKey = payload.identityKey || null;
+            this.data.signedPreKey = payload.signedPreKey || null;
+            this.data.oneTimePreKeys = payload.oneTimePreKeys || [];
+            this.data.sessions = payload.sessions || {};
+            this._loaded = true;
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }
+
+    save() {
+        if (!fs.existsSync(this.storePath)) {
+            fs.mkdirSync(this.storePath, { recursive: true });
+        }
+        if (!this.data.deviceSecret) {
+            this.data.deviceSecret = crypto.randomBytes(32).toString("base64");
+        }
+        const payload = JSON.stringify({
+            identityKey: this.data.identityKey,
+            signedPreKey: this.data.signedPreKey,
+            oneTimePreKeys: this.data.oneTimePreKeys,
+            sessions: this.data.sessions
+        });
+        const encrypted = this._localEncrypt(payload);
+        fs.writeFileSync(this._storeFile(), JSON.stringify({ deviceSecret: this.data.deviceSecret, payload: encrypted }, null, 2), "utf8");
+    }
+
+    hasIdentityKey() { return !!this.data.identityKey; }
+
+    getIdentityKey() {
+        const ik = this.data.identityKey;
+        if (!ik) return null;
+        return {
+            privateKey: Buffer.from(ik.privateKey, "base64"),
+            publicKey: Buffer.from(ik.publicKey, "base64"),
+            publicKeyRaw: Buffer.from(ik.publicKeyRaw, "base64")
+        };
+    }
+
+    setIdentityKey(keyPair) {
+        this.data.identityKey = {
+            privateKey: keyPair.privateKey.toString("base64"),
+            publicKey: keyPair.publicKey.toString("base64"),
+            publicKeyRaw: keyPair.publicKeyRaw.toString("base64")
+        };
+    }
+
+    getSignedPreKey() {
+        const spk = this.data.signedPreKey;
+        if (!spk) return null;
+        return {
+            privateKey: Buffer.from(spk.privateKey, "base64"),
+            publicKey: Buffer.from(spk.publicKey, "base64"),
+            publicKeyRaw: Buffer.from(spk.publicKeyRaw, "base64"),
+            signature: Buffer.from(spk.signature, "base64"),
+            keyId: spk.keyId
+        };
+    }
+
+    setSignedPreKey(keyPair) {
+        this.data.signedPreKey = {
+            privateKey: keyPair.privateKey.toString("base64"),
+            publicKey: keyPair.publicKey.toString("base64"),
+            publicKeyRaw: keyPair.publicKeyRaw.toString("base64"),
+            signature: keyPair.signature ? keyPair.signature.toString("base64") : "",
+            keyId: keyPair.keyId || 1
+        };
+    }
+
+    getOneTimePreKeys() {
+        return (this.data.oneTimePreKeys || []).map(k => ({
+            privateKey: Buffer.from(k.privateKey, "base64"),
+            publicKey: Buffer.from(k.publicKey, "base64"),
+            publicKeyRaw: Buffer.from(k.publicKeyRaw, "base64"),
+            keyId: k.keyId
+        }));
+    }
+
+    addOneTimePreKey(keyPair) {
+        this.data.oneTimePreKeys = this.data.oneTimePreKeys || [];
+        this.data.oneTimePreKeys.push({
+            privateKey: keyPair.privateKey.toString("base64"),
+            publicKey: keyPair.publicKey.toString("base64"),
+            publicKeyRaw: keyPair.publicKeyRaw.toString("base64"),
+            keyId: keyPair.keyId
+        });
+    }
+
+    consumeOneTimePreKey(keyId) {
+        const idx = (this.data.oneTimePreKeys || []).findIndex(k => k.keyId === keyId);
+        if (idx < 0) return null;
+        const k = this.data.oneTimePreKeys.splice(idx, 1)[0];
+        return {
+            privateKey: Buffer.from(k.privateKey, "base64"),
+            publicKey: Buffer.from(k.publicKey, "base64"),
+            publicKeyRaw: Buffer.from(k.publicKeyRaw, "base64"),
+            keyId: k.keyId
+        };
+    }
+
+    hasSession(threadID) { return !!this.data.sessions[threadID]; }
+
+    getSession(threadID) { return this.data.sessions[threadID] || null; }
+
+    setSession(threadID, serializedSession) { this.data.sessions[threadID] = serializedSession; }
+
+    deleteSession(threadID) { delete this.data.sessions[threadID]; }
+}
+
+module.exports = { E2EEStore };