libsignal-skyzopedia 1.0.0

package/src/session_cipher.js

@@ -0,0 +1,336 @@
+// vim: ts=4:sw=4:expandtab
+
+const ChainType = require('./chain_type');
+const ProtocolAddress = require('./protocol_address');
+const SessionBuilder = require('./session_builder');
+const SessionRecord = require('./session_record');
+const crypto = require('./crypto');
+const curve = require('./curve');
+const errors = require('./errors');
+const protobufs = require('./protobufs');
+const queueJob = require('./queue_job');
+
+const VERSION = 3;
+
+function assertBuffer(value) {
+    if (!(value instanceof Buffer)) {
+        throw TypeError(`Expected Buffer instead of: ${value.constructor.name}`);
+    }
+    return value;
+}
+
+
+class SessionCipher {
+
+    constructor(storage, protocolAddress) {
+        if (!(protocolAddress instanceof ProtocolAddress)) {
+            throw new TypeError("protocolAddress must be a ProtocolAddress");
+        }
+        this.addr = protocolAddress;
+        this.storage = storage;
+    }
+
+    _encodeTupleByte(number1, number2) {
+        if (number1 > 15 || number2 > 15) {
+            throw TypeError("Numbers must be 4 bits or less");
+        }
+        return (number1 << 4) | number2;
+    }
+
+    _decodeTupleByte(byte) {
+        return [byte >> 4, byte & 0xf];
+    }
+
+    toString() {
+        return `<SessionCipher(${this.addr.toString()})>`;
+    }
+
+    async getRecord() {
+        const record = await this.storage.loadSession(this.addr.toString());
+        if (record && !(record instanceof SessionRecord)) {
+            throw new TypeError('SessionRecord type expected from loadSession'); 
+        }
+        return record;
+    }
+
+    async storeRecord(record) {
+        record.removeOldSessions();
+        await this.storage.storeSession(this.addr.toString(), record);
+    }
+
+    async queueJob(awaitable) {
+        return await queueJob(this.addr.toString(), awaitable);
+    }
+
+    async encrypt(data) {
+        assertBuffer(data);
+        const ourIdentityKey = await this.storage.getOurIdentity();
+        return await this.queueJob(async () => {
+            const record = await this.getRecord();
+            if (!record) {
+                throw new errors.SessionError("No sessions");
+            }
+            const session = record.getOpenSession();
+            if (!session) {
+                throw new errors.SessionError("No open session");
+            }
+            const remoteIdentityKey = session.indexInfo.remoteIdentityKey;
+            if (!await this.storage.isTrustedIdentity(this.addr.id, remoteIdentityKey)) {
+                throw new errors.UntrustedIdentityKeyError(this.addr.id, remoteIdentityKey);
+            }
+            const chain = session.getChain(session.currentRatchet.ephemeralKeyPair.pubKey);
+            if (chain.chainType === ChainType.RECEIVING) {
+                throw new Error("Tried to encrypt on a receiving chain");
+            }
+            this.fillMessageKeys(chain, chain.chainKey.counter + 1);
+            const keys = crypto.deriveSecrets(chain.messageKeys[chain.chainKey.counter],
+                                              Buffer.alloc(32), Buffer.from("WhisperMessageKeys"));
+            delete chain.messageKeys[chain.chainKey.counter];
+            const msg = protobufs.WhisperMessage.create();
+            msg.ephemeralKey = session.currentRatchet.ephemeralKeyPair.pubKey;
+            msg.counter = chain.chainKey.counter;
+            msg.previousCounter = session.currentRatchet.previousCounter;
+            msg.ciphertext = crypto.encrypt(keys[0], data, keys[2].slice(0, 16));
+            const msgBuf = protobufs.WhisperMessage.encode(msg).finish();
+            const macInput = Buffer.alloc(msgBuf.byteLength + (33 * 2) + 1);
+            macInput.set(ourIdentityKey.pubKey);
+            macInput.set(session.indexInfo.remoteIdentityKey, 33);
+            macInput[33 * 2] = this._encodeTupleByte(VERSION, VERSION);
+            macInput.set(msgBuf, (33 * 2) + 1);
+            const mac = crypto.calculateMAC(keys[1], macInput);
+            const result = Buffer.alloc(msgBuf.byteLength + 9);
+            result[0] = this._encodeTupleByte(VERSION, VERSION);
+            result.set(msgBuf, 1);
+            result.set(mac.slice(0, 8), msgBuf.byteLength + 1);
+            await this.storeRecord(record);
+            let type, body;
+            if (session.pendingPreKey) {
+                type = 3;  // prekey bundle
+                const preKeyMsg = protobufs.PreKeyWhisperMessage.create({
+                    identityKey: ourIdentityKey.pubKey,
+                    registrationId: await this.storage.getOurRegistrationId(),
+                    baseKey: session.pendingPreKey.baseKey,
+                    signedPreKeyId: session.pendingPreKey.signedKeyId,
+                    message: result
+                });
+                if (session.pendingPreKey.preKeyId) {
+                    preKeyMsg.preKeyId = session.pendingPreKey.preKeyId;
+                }
+                body = Buffer.concat([
+                    Buffer.from([this._encodeTupleByte(VERSION, VERSION)]),
+                    Buffer.from(
+                        protobufs.PreKeyWhisperMessage.encode(preKeyMsg).finish()
+                    )
+                ]);
+            } else {
+                type = 1;  // normal
+                body = result;
+            }
+            return {
+                type,
+                body,
+                registrationId: session.registrationId
+            };
+        });
+    }
+
+    async decryptWithSessions(data, sessions) {
+        // Iterate through the sessions, attempting to decrypt using each one.
+        // Stop and return the result if we get a valid result.
+        if (!sessions.length) {
+            throw new errors.SessionError("No sessions available");
+        }   
+        const errs = [];
+        for (const session of sessions) {
+            let plaintext; 
+            try {
+                plaintext = await this.doDecryptWhisperMessage(data, session);
+                session.indexInfo.used = Date.now();
+                return {
+                    session,
+                    plaintext
+                };
+            } catch(e) {
+                errs.push(e);
+            }
+        }
+        //console.error("Failed to decrypt message with any known session, wait baron will fix it..");
+        // for (const e of errs) {
+            // console.error("Session error:" + e, e.stack);
+        // }
+        throw new errors.SessionError("No matching sessions found for message");
+    }
+
+    async decryptWhisperMessage(data) {
+        assertBuffer(data);
+        return await this.queueJob(async () => {
+            const record = await this.getRecord();
+            if (!record) {
+                throw new errors.SessionError("No session record");
+            }
+            const result = await this.decryptWithSessions(data, record.getSessions());
+            const remoteIdentityKey = result.session.indexInfo.remoteIdentityKey;
+            if (!await this.storage.isTrustedIdentity(this.addr.id, remoteIdentityKey)) {
+                throw new errors.UntrustedIdentityKeyError(this.addr.id, remoteIdentityKey);
+            }   
+            if (record.isClosed(result.session)) {
+                // It's possible for this to happen when processing a backlog of messages.
+                // The message was, hopefully, just sent back in a time when this session
+                // was the most current.  Simply make a note of it and continue.  If our
+                // actual open session is for reason invalid, that must be handled via
+                // a full SessionError response.
+                //console.warn("Decrypted message with closed session.");
+            }
+            await this.storeRecord(record);
+            return result.plaintext;
+        });
+    }
+
+    async decryptPreKeyWhisperMessage(data) {
+        assertBuffer(data);
+        const versions = this._decodeTupleByte(data[0]);
+        if (versions[1] > 3 || versions[0] < 3) {  // min version > 3 or max version < 3
+            throw new Error("Incompatible version number on PreKeyWhisperMessage");
+        }
+        return await this.queueJob(async () => {
+            let record = await this.getRecord();
+            const preKeyProto = protobufs.PreKeyWhisperMessage.decode(data.slice(1));
+            if (!record) {
+                if (preKeyProto.registrationId == null) {
+                    throw new Error("No registrationId");
+                }
+                record = new SessionRecord();
+            }
+            const builder = new SessionBuilder(this.storage, this.addr);
+            const preKeyId = await builder.initIncoming(record, preKeyProto);
+            const session = record.getSession(preKeyProto.baseKey);
+            const plaintext = await this.doDecryptWhisperMessage(preKeyProto.message, session);
+            await this.storeRecord(record);
+            if (preKeyId) {
+                await this.storage.removePreKey(preKeyId);
+            }
+            return plaintext;
+        });
+    }
+
+    async doDecryptWhisperMessage(messageBuffer, session) {
+        assertBuffer(messageBuffer);
+        if (!session) {
+            throw new TypeError("session required");
+        }
+        const versions = this._decodeTupleByte(messageBuffer[0]);
+        if (versions[1] > 3 || versions[0] < 3) {  // min version > 3 or max version < 3
+            throw new Error("Incompatible version number on WhisperMessage");
+        }
+        const messageProto = messageBuffer.slice(1, -8);
+        const message = protobufs.WhisperMessage.decode(messageProto);
+        this.maybeStepRatchet(session, message.ephemeralKey, message.previousCounter);
+        const chain = session.getChain(message.ephemeralKey);
+        if (chain.chainType === ChainType.SENDING) {
+            throw new Error("Tried to decrypt on a sending chain");
+        }
+        this.fillMessageKeys(chain, message.counter);
+        if (!chain.messageKeys.hasOwnProperty(message.counter)) {
+            // Most likely the message was already decrypted and we are trying to process
+            // twice.  This can happen if the user restarts before the server gets an ACK.
+            throw new errors.MessageCounterError('Key used already or never filled');
+        }
+        const messageKey = chain.messageKeys[message.counter];
+        delete chain.messageKeys[message.counter];
+        const keys = crypto.deriveSecrets(messageKey, Buffer.alloc(32),
+                                          Buffer.from("WhisperMessageKeys"));
+        const ourIdentityKey = await this.storage.getOurIdentity();
+        const macInput = Buffer.alloc(messageProto.byteLength + (33 * 2) + 1);
+        macInput.set(session.indexInfo.remoteIdentityKey);
+        macInput.set(ourIdentityKey.pubKey, 33);
+        macInput[33 * 2] = this._encodeTupleByte(VERSION, VERSION);
+        macInput.set(messageProto, (33 * 2) + 1);
+        // This is where we most likely fail if the session is not a match.
+        // Don't misinterpret this as corruption.
+        crypto.verifyMAC(macInput, keys[1], messageBuffer.slice(-8), 8);
+        const plaintext = crypto.decrypt(keys[0], message.ciphertext, keys[2].slice(0, 16));
+        delete session.pendingPreKey;
+        return plaintext;
+    }
+
+    fillMessageKeys(chain, counter) {
+        if (chain.chainKey.counter >= counter) {
+            return;
+        }
+        if (counter - chain.chainKey.counter > 2000) {
+            throw new errors.SessionError('Over 2000 messages into the future!');
+        }
+        if (chain.chainKey.key === undefined) {
+            throw new errors.SessionError('Chain closed');
+        }
+        const key = chain.chainKey.key;
+        chain.messageKeys[chain.chainKey.counter + 1] = crypto.calculateMAC(key, Buffer.from([1]));
+        chain.chainKey.key = crypto.calculateMAC(key, Buffer.from([2]));
+        chain.chainKey.counter += 1;
+        return this.fillMessageKeys(chain, counter);
+    }
+
+    maybeStepRatchet(session, remoteKey, previousCounter) {
+        if (session.getChain(remoteKey)) {
+            return;
+        }
+        const ratchet = session.currentRatchet;
+        let previousRatchet = session.getChain(ratchet.lastRemoteEphemeralKey);
+        if (previousRatchet) {
+            this.fillMessageKeys(previousRatchet, previousCounter);
+            delete previousRatchet.chainKey.key;  // Close
+        }
+        this.calculateRatchet(session, remoteKey, false);
+        // Now swap the ephemeral key and calculate the new sending chain
+        const prevCounter = session.getChain(ratchet.ephemeralKeyPair.pubKey);
+        if (prevCounter) {
+            ratchet.previousCounter = prevCounter.chainKey.counter;
+            session.deleteChain(ratchet.ephemeralKeyPair.pubKey);
+        }
+        ratchet.ephemeralKeyPair = curve.generateKeyPair();
+        this.calculateRatchet(session, remoteKey, true);
+        ratchet.lastRemoteEphemeralKey = remoteKey;
+    }
+
+    calculateRatchet(session, remoteKey, sending) {
+        let ratchet = session.currentRatchet;
+        const sharedSecret = curve.calculateAgreement(remoteKey, ratchet.ephemeralKeyPair.privKey);
+        const masterKey = crypto.deriveSecrets(sharedSecret, ratchet.rootKey,
+                                               Buffer.from("WhisperRatchet"), /*chunks*/ 2);
+        const chainKey = sending ? ratchet.ephemeralKeyPair.pubKey : remoteKey;
+        session.addChain(chainKey, {
+            messageKeys: {},
+            chainKey: {
+                counter: -1,
+                key: masterKey[1]
+            },
+            chainType: sending ? ChainType.SENDING : ChainType.RECEIVING
+        });
+        ratchet.rootKey = masterKey[0];
+    }
+
+    async hasOpenSession() {
+        return await this.queueJob(async () => {
+            const record = await this.getRecord();
+            if (!record) {
+                return false;
+            }
+            return record.haveOpenSession();
+        });
+    }
+
+    async closeOpenSession() {
+        return await this.queueJob(async () => {
+            const record = await this.getRecord();
+            if (record) {
+                const openSession = record.getOpenSession();
+                if (openSession) {
+                    record.closeSession(openSession);
+                    await this.storeRecord(record);
+                }
+            }
+        });
+    }
+}
+
+module.exports = SessionCipher;

package/src/session_record.js

@@ -0,0 +1,316 @@
+// vim: ts=4:sw=4
+
+const BaseKeyType = require('./base_key_type');
+
+const CLOSED_SESSIONS_MAX = 40;
+const SESSION_RECORD_VERSION = 'v1';
+
+function assertBuffer(value) {
+    if (!Buffer.isBuffer(value)) {
+        throw new TypeError("Buffer required");
+    }
+}
+
+
+class SessionEntry {
+
+    constructor() {
+        this._chains = {};
+    }
+
+    toString() {
+        const baseKey = this.indexInfo && this.indexInfo.baseKey &&
+            this.indexInfo.baseKey.toString('base64');
+        return `<SessionEntry [baseKey=${baseKey}]>`;
+    }
+
+    inspect() {
+        return this.toString();
+    }
+
+    addChain(key, value) {
+        assertBuffer(key);
+        const id = key.toString('base64');
+        if (this._chains.hasOwnProperty(id)) {
+            throw new Error("Overwrite attempt");
+        }
+        this._chains[id] = value;
+    }
+
+    getChain(key) {
+        assertBuffer(key);
+        return this._chains[key.toString('base64')];
+    }
+
+    deleteChain(key) {
+        assertBuffer(key);
+        const id = key.toString('base64');
+        if (!this._chains.hasOwnProperty(id)) {
+            throw new ReferenceError("Not Found");
+        }
+        delete this._chains[id];
+    }
+
+    *chains() {
+        for (const [k, v] of Object.entries(this._chains)) {
+            yield [Buffer.from(k, 'base64'), v];
+        }
+    }
+
+    serialize() {
+        const data = {
+            registrationId: this.registrationId,
+            currentRatchet: {
+                ephemeralKeyPair: {
+                    pubKey: this.currentRatchet.ephemeralKeyPair.pubKey.toString('base64'),
+                    privKey: this.currentRatchet.ephemeralKeyPair.privKey.toString('base64')
+                },
+                lastRemoteEphemeralKey: this.currentRatchet.lastRemoteEphemeralKey.toString('base64'),
+                previousCounter: this.currentRatchet.previousCounter,
+                rootKey: this.currentRatchet.rootKey.toString('base64')
+            },
+            indexInfo: {
+                baseKey: this.indexInfo.baseKey.toString('base64'),
+                baseKeyType: this.indexInfo.baseKeyType,
+                closed: this.indexInfo.closed,
+                used: this.indexInfo.used,
+                created: this.indexInfo.created,
+                remoteIdentityKey: this.indexInfo.remoteIdentityKey.toString('base64')
+            },
+            _chains: this._serialize_chains(this._chains)
+        };
+        if (this.pendingPreKey) {
+            data.pendingPreKey = Object.assign({}, this.pendingPreKey);
+            data.pendingPreKey.baseKey = this.pendingPreKey.baseKey.toString('base64');
+        }
+        return data;
+    }
+
+    static deserialize(data) {
+        const obj = new this();
+        obj.registrationId = data.registrationId;
+        obj.currentRatchet = {
+            ephemeralKeyPair: {
+                pubKey: Buffer.from(data.currentRatchet.ephemeralKeyPair.pubKey, 'base64'),
+                privKey: Buffer.from(data.currentRatchet.ephemeralKeyPair.privKey, 'base64')
+            },
+            lastRemoteEphemeralKey: Buffer.from(data.currentRatchet.lastRemoteEphemeralKey, 'base64'),
+            previousCounter: data.currentRatchet.previousCounter,
+            rootKey: Buffer.from(data.currentRatchet.rootKey, 'base64')
+        };
+        obj.indexInfo = {
+            baseKey: Buffer.from(data.indexInfo.baseKey, 'base64'),
+            baseKeyType: data.indexInfo.baseKeyType,
+            closed: data.indexInfo.closed,
+            used: data.indexInfo.used,
+            created: data.indexInfo.created,
+            remoteIdentityKey: Buffer.from(data.indexInfo.remoteIdentityKey, 'base64')
+        };
+        obj._chains = this._deserialize_chains(data._chains);
+        if (data.pendingPreKey) {
+            obj.pendingPreKey = Object.assign({}, data.pendingPreKey);
+            obj.pendingPreKey.baseKey = Buffer.from(data.pendingPreKey.baseKey, 'base64');
+        }
+        return obj;
+    }
+
+    _serialize_chains(chains) {
+        const r = {};
+        for (const key of Object.keys(chains)) {
+            const c = chains[key];
+            const messageKeys = {};
+            for (const [idx, key] of Object.entries(c.messageKeys)) {
+                messageKeys[idx] = key.toString('base64');
+            }
+            r[key] = {
+                chainKey: {
+                    counter: c.chainKey.counter,
+                    key: c.chainKey.key && c.chainKey.key.toString('base64')
+                },
+                chainType: c.chainType,
+                messageKeys: messageKeys
+            };
+        }
+        return r;
+    }
+
+    static _deserialize_chains(chains_data) {
+        const r = {};
+        for (const key of Object.keys(chains_data)) {
+            const c = chains_data[key];
+            const messageKeys = {};
+            for (const [idx, key] of Object.entries(c.messageKeys)) {
+                messageKeys[idx] = Buffer.from(key, 'base64');
+            }
+            r[key] = {
+                chainKey: {
+                    counter: c.chainKey.counter,
+                    key: c.chainKey.key && Buffer.from(c.chainKey.key, 'base64')
+                },
+                chainType: c.chainType,
+                messageKeys: messageKeys
+            };
+        }
+        return r;
+    }
+
+}
+
+
+const migrations = [{
+    version: 'v1',
+    migrate: function migrateV1(data) {
+        const sessions = data._sessions;
+        if (data.registrationId) {
+            for (const key in sessions) {
+                if (!sessions[key].registrationId) {
+                    sessions[key].registrationId = data.registrationId;
+                }
+            }
+        } else {
+            for (const key in sessions) {
+                if (sessions[key].indexInfo.closed === -1) {
+                    //console.error('V1 session storage migration error: registrationId',
+                                  //data.registrationId, 'for open session version',
+                                  //data.version);
+                }
+            }
+        }
+    }
+}];
+
+
+class SessionRecord {
+
+    static createEntry() {
+        return new SessionEntry();
+    }
+
+    static migrate(data) {
+        let run = (data.version === undefined);
+        for (let i = 0; i < migrations.length; ++i) {
+            if (run) {
+                //console.info("Migrating session to:", migrations[i].version);
+                migrations[i].migrate(data);
+            } else if (migrations[i].version === data.version) {
+                run = true;
+            }
+        }
+        if (!run) {
+            throw new Error("Error migrating SessionRecord");
+        }
+    }
+
+    static deserialize(data) {
+        if (data.version !== SESSION_RECORD_VERSION) {
+            this.migrate(data);
+        }
+        const obj = new this();
+        if (data._sessions) {
+            for (const [key, entry] of Object.entries(data._sessions)) {
+                obj.sessions[key] = SessionEntry.deserialize(entry);
+            }
+        }
+        return obj;
+    }
+
+    constructor() {
+        this.sessions = {};
+        this.version = SESSION_RECORD_VERSION;
+    }
+
+    serialize() {
+        const _sessions = {};
+        for (const [key, entry] of Object.entries(this.sessions)) {
+            _sessions[key] = entry.serialize();
+        }
+        return {
+            _sessions,
+            version: this.version
+        };
+    }
+
+    haveOpenSession() {
+        const openSession = this.getOpenSession();
+        return (!!openSession && typeof openSession.registrationId === 'number');
+    }
+
+    getSession(key) {
+        assertBuffer(key);
+        const session = this.sessions[key.toString('base64')];
+        if (session && session.indexInfo.baseKeyType === BaseKeyType.OURS) {
+            throw new Error("Tried to lookup a session using our basekey");
+        }
+        return session;
+    }
+
+    getOpenSession() {
+        for (const session of Object.values(this.sessions)) {
+            if (!this.isClosed(session)) {
+                return session;
+            }
+        }
+    }
+
+    setSession(session) {
+        this.sessions[session.indexInfo.baseKey.toString('base64')] = session;
+    }
+
+    getSessions() {
+        // Return sessions ordered with most recently used first.
+        return Array.from(Object.values(this.sessions)).sort((a, b) => {
+            const aUsed = a.indexInfo.used || 0;
+            const bUsed = b.indexInfo.used || 0;
+            return aUsed === bUsed ? 0 : aUsed < bUsed ? 1 : -1;
+        });
+    }
+
+    closeSession(session) {
+        if (this.isClosed(session)) {
+            //console.warn("Session already closed", session);
+            return;
+        }
+        //console.info("Closing session:", session);
+        session.indexInfo.closed = Date.now();
+    }
+
+    openSession(session) {
+        if (!this.isClosed(session)) {
+            //console.warn("Session already open");
+        }
+        //console.info("Opening session:", session);
+        session.indexInfo.closed = -1;
+    }
+
+    isClosed(session) {
+        return session.indexInfo.closed !== -1;
+    }
+
+    removeOldSessions() {
+        while (Object.keys(this.sessions).length > CLOSED_SESSIONS_MAX) {
+            let oldestKey;
+            let oldestSession;
+            for (const [key, session] of Object.entries(this.sessions)) {
+                if (session.indexInfo.closed !== -1 &&
+                    (!oldestSession || session.indexInfo.closed < oldestSession.indexInfo.closed)) {
+                    oldestKey = key;
+                    oldestSession = session;
+                }
+            }
+            if (oldestKey) {
+                //console.info("Removing old closed session:", oldestSession);
+                delete this.sessions[oldestKey];
+            } else {
+                throw new Error('Corrupt sessions object');
+            }
+        }
+    }
+
+    deleteAllSessions() {
+        for (const key of Object.keys(this.sessions)) {
+            delete this.sessions[key];
+        }
+    }
+}
+
+module.exports = SessionRecord;