pakstr 0.20.0 → 0.21.1

package/android-template/app/src/main/java/com/pakstr/app/crypto/Nip44Crypto.kt

@@ -0,0 +1,513 @@
+package com.pakstr.app.crypto
+
+import org.bouncycastle.crypto.engines.ChaCha7539Engine
+import org.bouncycastle.crypto.params.KeyParameter
+import org.bouncycastle.crypto.params.ParametersWithIV
+import java.math.BigInteger
+import java.nio.ByteBuffer
+import java.nio.charset.CodingErrorAction
+import java.security.MessageDigest
+import java.security.SecureRandom
+import java.util.Arrays
+import java.util.Base64
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+object Nip44Crypto : NostrEncryption {
+    private const val VERSION = 2
+    private const val MIN_PLAINTEXT_SIZE = 1L
+    private const val MAX_PLAINTEXT_SIZE = 16L * 1024L * 1024L
+    private const val MIN_ENCODED_PAYLOAD_SIZE = 132
+    private const val HKDF_OUTPUT_SIZE = 76
+    private val SECURE_RANDOM = SecureRandom()
+    private val HKDF_SALT = "nip44-v2".toByteArray(Charsets.UTF_8)
+
+    override fun encrypt(
+        plaintext: String,
+        privateKey: ByteArray,
+        publicKey: ByteArray
+    ): String {
+        val conversationKey =
+            deriveConversationKey(
+                privateKey,
+                publicKey
+            )
+        val nonce = ByteArray(32)
+        SECURE_RANDOM.nextBytes(nonce)
+
+        return try {
+            encryptWithNonce(
+                plaintext,
+                conversationKey,
+                nonce
+            )
+        } finally {
+            Arrays.fill(conversationKey, 0)
+            Arrays.fill(nonce, 0)
+        }
+    }
+
+    override fun decrypt(
+        payload: String,
+        privateKey: ByteArray,
+        publicKey: ByteArray
+    ): String {
+        val conversationKey =
+            deriveConversationKey(
+                privateKey,
+                publicKey
+            )
+
+        return try {
+            decryptWithConversationKey(
+                payload,
+                conversationKey
+            )
+        } finally {
+            Arrays.fill(conversationKey, 0)
+        }
+    }
+
+    internal fun deriveConversationKey(
+        privateKey: ByteArray,
+        publicKey: ByteArray
+    ): ByteArray {
+        val scalar = Secp256k1.privateScalar(privateKey)
+        val peer = Secp256k1.liftX(publicKey)
+        val sharedPoint = peer.multiply(scalar).normalize()
+        require(!sharedPoint.isInfinity && sharedPoint.isValid) {
+            "Invalid shared secret"
+        }
+
+        val sharedX =
+            Secp256k1.fixedSizeBytes(
+                sharedPoint.affineXCoord.toBigInteger()
+            )
+
+        return try {
+            hmacSha256(
+                HKDF_SALT,
+                sharedX
+            )
+        } finally {
+            Arrays.fill(sharedX, 0)
+        }
+    }
+
+    internal fun deriveMessageKeys(
+        conversationKey: ByteArray,
+        nonce: ByteArray
+    ): MessageKeys {
+        require(conversationKey.size == 32) {
+            "Conversation key must be 32 bytes"
+        }
+        require(nonce.size == 32) {
+            "Nonce must be 32 bytes"
+        }
+
+        val output = ByteArray(HKDF_OUTPUT_SIZE)
+        var previous = ByteArray(0)
+        var offset = 0
+        var counter = 1
+
+        try {
+            while (offset < output.size) {
+                val mac = newHmac(conversationKey)
+                mac.update(previous)
+                mac.update(nonce)
+                mac.update(counter.toByte())
+                val block = mac.doFinal()
+                Arrays.fill(previous, 0)
+                previous = block
+
+                val count = minOf(block.size, output.size - offset)
+                block.copyInto(
+                    output,
+                    destinationOffset = offset,
+                    endIndex = count
+                )
+                offset += count
+                counter++
+            }
+
+            return MessageKeys(
+                chachaKey = output.copyOfRange(0, 32),
+                chachaNonce = output.copyOfRange(32, 44),
+                hmacKey = output.copyOfRange(44, 76)
+            )
+        } finally {
+            Arrays.fill(previous, 0)
+            Arrays.fill(output, 0)
+        }
+    }
+
+    internal fun calculatePaddedLength(
+        plaintextLength: Long
+    ): Long {
+        require(
+            plaintextLength in
+                    MIN_PLAINTEXT_SIZE..0xffffffffL
+        ) {
+            "Invalid plaintext size"
+        }
+
+        if (plaintextLength <= 32L) {
+            return 32L
+        }
+
+        val nextPower =
+            java.lang.Long.highestOneBit(
+                plaintextLength - 1L
+            ) shl 1
+        val chunk =
+            if (nextPower <= 256L) 32L
+            else nextPower / 8L
+
+        return chunk *
+                ((plaintextLength - 1L) / chunk + 1L)
+    }
+
+    internal fun encryptWithNonce(
+        plaintext: String,
+        conversationKey: ByteArray,
+        nonce: ByteArray
+    ): String {
+        val plaintextBytes =
+            plaintext.toByteArray(Charsets.UTF_8)
+        require(
+            plaintextBytes.size.toLong() <=
+                    MAX_PLAINTEXT_SIZE
+        ) {
+            "Plaintext exceeds implementation limit"
+        }
+
+        val padded = pad(plaintextBytes)
+        val keys =
+            deriveMessageKeys(
+                conversationKey,
+                nonce
+            )
+
+        return try {
+            val ciphertext =
+                chacha20(
+                    keys.chachaKey,
+                    keys.chachaNonce,
+                    padded
+                )
+            val mac =
+                hmacSha256(
+                    keys.hmacKey,
+                    nonce,
+                    ciphertext
+                )
+            val payload =
+                ByteArray(
+                    1 + nonce.size +
+                            ciphertext.size + mac.size
+                )
+
+            try {
+                payload[0] = VERSION.toByte()
+                nonce.copyInto(payload, destinationOffset = 1)
+                ciphertext.copyInto(
+                    payload,
+                    destinationOffset = 33
+                )
+                mac.copyInto(
+                    payload,
+                    destinationOffset =
+                        33 + ciphertext.size
+                )
+
+                Base64.getEncoder().encodeToString(payload)
+            } finally {
+                Arrays.fill(ciphertext, 0)
+                Arrays.fill(mac, 0)
+                Arrays.fill(payload, 0)
+            }
+        } finally {
+            keys.close()
+            Arrays.fill(plaintextBytes, 0)
+            Arrays.fill(padded, 0)
+        }
+    }
+
+    internal fun decryptWithConversationKey(
+        payload: String,
+        conversationKey: ByteArray
+    ): String {
+        require(!payload.startsWith("#")) {
+            "Unsupported encryption version"
+        }
+        require(payload.length >= MIN_ENCODED_PAYLOAD_SIZE) {
+            "Invalid encrypted payload"
+        }
+        require(payload.length <= maximumEncodedPayloadSize()) {
+            "Encrypted payload exceeds implementation limit"
+        }
+
+        require(payload.length % 4 == 0) {
+            "Invalid encrypted payload"
+        }
+
+        val decoded =
+            try {
+                Base64.getDecoder().decode(payload)
+            } catch (_: IllegalArgumentException) {
+                throw IllegalArgumentException(
+                    "Invalid encrypted payload"
+                )
+            }
+
+        try {
+            require(
+                Base64.getEncoder()
+                    .encodeToString(decoded) == payload
+            ) {
+                "Invalid encrypted payload"
+            }
+            require(decoded.size >= 99) {
+                "Invalid encrypted payload"
+            }
+            require(decoded[0].toInt() == VERSION) {
+                "Unsupported encryption version"
+            }
+
+            val nonce = decoded.copyOfRange(1, 33)
+            val ciphertext =
+                decoded.copyOfRange(
+                    33,
+                    decoded.size - 32
+                )
+            val receivedMac =
+                decoded.copyOfRange(
+                    decoded.size - 32,
+                    decoded.size
+                )
+            val keys =
+                deriveMessageKeys(
+                    conversationKey,
+                    nonce
+                )
+
+            try {
+                val calculatedMac =
+                    hmacSha256(
+                        keys.hmacKey,
+                        nonce,
+                        ciphertext
+                    )
+
+                try {
+                    require(
+                        MessageDigest.isEqual(
+                            calculatedMac,
+                            receivedMac
+                        )
+                    ) {
+                        "Invalid encrypted payload"
+                    }
+                } finally {
+                    Arrays.fill(calculatedMac, 0)
+                }
+
+                val padded =
+                    chacha20(
+                        keys.chachaKey,
+                        keys.chachaNonce,
+                        ciphertext
+                    )
+
+                val plaintext = unpad(padded)
+
+                return try {
+                    decodeUtf8(plaintext)
+                } finally {
+                    Arrays.fill(plaintext, 0)
+                    Arrays.fill(padded, 0)
+                }
+            } finally {
+                keys.close()
+                Arrays.fill(nonce, 0)
+                Arrays.fill(ciphertext, 0)
+                Arrays.fill(receivedMac, 0)
+            }
+        } finally {
+            Arrays.fill(decoded, 0)
+        }
+    }
+
+    private fun pad(plaintext: ByteArray): ByteArray {
+        val length = plaintext.size.toLong()
+        require(length >= MIN_PLAINTEXT_SIZE) {
+            "Plaintext must not be empty"
+        }
+
+        val paddedLength = calculatePaddedLength(length)
+        val prefixLength = if (length < 65536L) 2 else 6
+        require(
+            paddedLength + prefixLength <= Int.MAX_VALUE
+        ) {
+            "Plaintext exceeds implementation limit"
+        }
+
+        return ByteArray(
+            prefixLength + paddedLength.toInt()
+        ).also { output ->
+            if (prefixLength == 2) {
+                output[0] = (length ushr 8).toByte()
+                output[1] = length.toByte()
+            } else {
+                output[2] = (length ushr 24).toByte()
+                output[3] = (length ushr 16).toByte()
+                output[4] = (length ushr 8).toByte()
+                output[5] = length.toByte()
+            }
+
+            plaintext.copyInto(
+                output,
+                destinationOffset = prefixLength
+            )
+        }
+    }
+
+    private fun unpad(padded: ByteArray): ByteArray {
+        require(padded.size >= 34) {
+            "Invalid padding"
+        }
+
+        val shortLength =
+            ((padded[0].toInt() and 0xff) shl 8) or
+                    (padded[1].toInt() and 0xff)
+        val prefixLength: Int
+        val plaintextLength: Long
+
+        if (shortLength == 0) {
+            require(padded.size >= 38) {
+                "Invalid padding"
+            }
+            prefixLength = 6
+            plaintextLength =
+                ((padded[2].toLong() and 0xff) shl 24) or
+                        ((padded[3].toLong() and 0xff) shl 16) or
+                        ((padded[4].toLong() and 0xff) shl 8) or
+                        (padded[5].toLong() and 0xff)
+            require(plaintextLength >= 65536L) {
+                "Invalid padding"
+            }
+        } else {
+            prefixLength = 2
+            plaintextLength = shortLength.toLong()
+        }
+
+        require(
+            plaintextLength <= MAX_PLAINTEXT_SIZE
+        ) {
+            "Plaintext exceeds implementation limit"
+        }
+        val paddedLength =
+            calculatePaddedLength(plaintextLength)
+        require(
+            padded.size.toLong() ==
+                    prefixLength + paddedLength
+        ) {
+            "Invalid padding"
+        }
+
+        val plaintextEnd =
+            prefixLength + plaintextLength.toInt()
+        require(
+            (plaintextEnd until padded.size)
+                .all { index ->
+                    padded[index] == 0.toByte()
+                }
+        ) {
+            "Invalid padding"
+        }
+
+        return padded.copyOfRange(
+            prefixLength,
+            plaintextEnd
+        )
+    }
+
+    private fun decodeUtf8(value: ByteArray): String {
+        return Charsets.UTF_8
+            .newDecoder()
+            .onMalformedInput(CodingErrorAction.REPORT)
+            .onUnmappableCharacter(CodingErrorAction.REPORT)
+            .decode(ByteBuffer.wrap(value))
+            .toString()
+    }
+
+    private fun chacha20(
+        key: ByteArray,
+        nonce: ByteArray,
+        input: ByteArray
+    ): ByteArray {
+        val engine = ChaCha7539Engine()
+        engine.init(
+            true,
+            ParametersWithIV(
+                KeyParameter(key),
+                nonce
+            )
+        )
+
+        return ByteArray(input.size).also { output ->
+            engine.processBytes(
+                input,
+                0,
+                input.size,
+                output,
+                0
+            )
+        }
+    }
+
+    private fun hmacSha256(
+        key: ByteArray,
+        vararg parts: ByteArray
+    ): ByteArray {
+        val mac = newHmac(key)
+        parts.forEach(mac::update)
+        return mac.doFinal()
+    }
+
+    private fun newHmac(key: ByteArray): Mac {
+        return Mac.getInstance("HmacSHA256")
+            .apply {
+                init(
+                    SecretKeySpec(
+                        key,
+                        "HmacSHA256"
+                    )
+                )
+            }
+    }
+
+    private fun maximumEncodedPayloadSize(): Int {
+        val paddedLength =
+            calculatePaddedLength(MAX_PLAINTEXT_SIZE)
+        val decodedLength =
+            1L + 32L + 6L +
+                    paddedLength + 32L
+
+        return (
+                (decodedLength + 2L) / 3L * 4L
+                ).toInt()
+    }
+
+    internal class MessageKeys(
+        val chachaKey: ByteArray,
+        val chachaNonce: ByteArray,
+        val hmacKey: ByteArray
+    ) : AutoCloseable {
+        override fun close() {
+            Arrays.fill(chachaKey, 0)
+            Arrays.fill(chachaNonce, 0)
+            Arrays.fill(hmacKey, 0)
+        }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/Nip46ClientKey.kt

@@ -0,0 +1,140 @@
+package com.pakstr.app.crypto
+
+import java.math.BigInteger
+import java.security.SecureRandom
+import java.util.Arrays
+
+class Nip46ClientKey private constructor(
+    private var privateKey: ByteArray?
+) : AutoCloseable {
+    private val publicKeyBytes =
+        Secp256k1.xOnlyPublicKey(
+            requireNotNull(privateKey)
+        )
+
+    val publicKey: ByteArray
+        get() = publicKeyBytes.copyOf()
+
+    val publicKeyHex: String
+        get() = Bip340Hash.bytesToHex(publicKeyBytes)
+
+    fun sign(message: ByteArray): ByteArray {
+        val key = requireOpenKey()
+        val auxiliaryRandom = ByteArray(32)
+        SECURE_RANDOM.nextBytes(auxiliaryRandom)
+
+        return try {
+            Bip340Signer.sign(
+                key,
+                message,
+                auxiliaryRandom
+            )
+        } finally {
+            Arrays.fill(auxiliaryRandom, 0)
+        }
+    }
+
+    internal fun encryptNip44(
+        plaintext: String,
+        peerPublicKeyHex: String
+    ): String {
+        val key = requireOpenKey()
+        val peerPublicKey = decodePeerPublicKey(peerPublicKeyHex)
+
+        return try {
+            Nip44Crypto.encrypt(
+                plaintext,
+                key,
+                peerPublicKey
+            )
+        } finally {
+            Arrays.fill(peerPublicKey, 0)
+        }
+    }
+
+    internal fun decryptNip44(
+        payload: String,
+        peerPublicKeyHex: String
+    ): String {
+        val key = requireOpenKey()
+        val peerPublicKey = decodePeerPublicKey(peerPublicKeyHex)
+
+        return try {
+            Nip44Crypto.decrypt(
+                payload,
+                key,
+                peerPublicKey
+            )
+        } finally {
+            Arrays.fill(peerPublicKey, 0)
+        }
+    }
+
+    internal fun <T> withPrivateKey(
+        block: (ByteArray) -> T
+    ): T {
+        val copy = requireOpenKey().copyOf()
+        return try {
+            block(copy)
+        } finally {
+            Arrays.fill(copy, 0)
+        }
+    }
+
+    override fun close() {
+        privateKey?.let { key ->
+            Arrays.fill(key, 0)
+        }
+        privateKey = null
+    }
+
+    private fun requireOpenKey(): ByteArray {
+        return privateKey
+            ?: throw IllegalStateException(
+                "Client key is closed"
+            )
+    }
+
+    private fun decodePeerPublicKey(
+        value: String
+    ): ByteArray {
+        require(
+            value.matches(Regex("[0-9a-f]{64}")) &&
+                    Bip340Verifier.isValidXOnlyPubkey(value)
+        ) {
+            "Invalid peer public key"
+        }
+
+        return Bip340Hash.hexToBytes(value)
+    }
+
+    companion object {
+        private val SECURE_RANDOM = SecureRandom()
+
+        fun generate(): Nip46ClientKey {
+            while (true) {
+                val candidate = ByteArray(32)
+                SECURE_RANDOM.nextBytes(candidate)
+                val scalar = BigInteger(1, candidate)
+
+                if (
+                    scalar.signum() > 0 &&
+                    scalar < Secp256k1.N
+                ) {
+                    return Nip46ClientKey(candidate)
+                }
+
+                Arrays.fill(candidate, 0)
+            }
+        }
+
+        internal fun fromPrivateKey(
+            privateKey: ByteArray
+        ): Nip46ClientKey {
+            Secp256k1.privateScalar(privateKey)
+            return Nip46ClientKey(
+                privateKey.copyOf()
+            )
+        }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/NostrEventHasher.kt

@@ -1,6 +1,5 @@
 package com.pakstr.app.crypto
 
-import org.json.JSONArray
 import org.json.JSONObject
 import java.security.MessageDigest
 
@@ -38,39 +37,15 @@ object NostrEventHasher {
             event.optString("pubkey")
 
         require(pubkey.isNotBlank()) {
-            "Missing pubkey in nostr event: $event"
+            "Missing pubkey in nostr event"
         }
 
         val serialized =
-            JSONArray()
-                .apply {
-
-                    put(0)
-
-                    put(pubkey)
-
-                    put(
-                        event.getLong("created_at")
-                    )
-
-                    put(
-                        event.getInt("kind")
-                    )
-
-                    put(
-                        event.getJSONArray("tags")
-                    )
-
-                    put(
-                        event.getString("content")
-                    )
-
-                }
-                .toString()
+            NostrEventSerializer.serialize(event)
 
 
         return sha256Hex(
-            serialized.toByteArray()
+            serialized.toByteArray(Charsets.UTF_8)
         )
     }