react-native-ble-mesh 1.0.1

package/src/crypto/noise/session.js

@@ -0,0 +1,253 @@
+'use strict';
+
+/**
+ * Noise Protocol Transport Session
+ * Handles encrypted communication after a successful handshake.
+ * @module crypto/noise/session
+ */
+
+const { encrypt, decrypt } = require('../aead');
+
+/**
+ * Maximum nonce value before requiring rekey (2^64 - 1 as safe integer)
+ * In practice, we use a lower limit to ensure safety
+ * @constant {number}
+ */
+const MAX_NONCE = Number.MAX_SAFE_INTEGER;
+
+/**
+ * Nonce threshold for rekey warning
+ * @constant {number}
+ */
+const REKEY_THRESHOLD = 0xFFFFFFFF; // 2^32 - 1
+
+/**
+ * NoiseSession handles encrypted transport after handshake completion.
+ *
+ * Each direction has its own key and nonce counter:
+ * - sendKey/sendNonce for outgoing messages
+ * - receiveKey/receiveNonce for incoming messages
+ *
+ * @class
+ */
+class NoiseSession {
+  /**
+   * Creates a new NoiseSession.
+   * @param {Uint8Array} sendKey - 32-byte key for sending
+   * @param {Uint8Array} receiveKey - 32-byte key for receiving
+   * @param {boolean} isInitiator - True if this is the initiator's session
+   */
+  constructor(sendKey, receiveKey, isInitiator) {
+    if (!(sendKey instanceof Uint8Array) || sendKey.length !== 32) {
+      throw new Error('Send key must be 32 bytes');
+    }
+    if (!(receiveKey instanceof Uint8Array) || receiveKey.length !== 32) {
+      throw new Error('Receive key must be 32 bytes');
+    }
+
+    /** @type {Uint8Array} */
+    this._sendKey = new Uint8Array(sendKey);
+
+    /** @type {Uint8Array} */
+    this._receiveKey = new Uint8Array(receiveKey);
+
+    /** @type {number} */
+    this._sendNonce = 0;
+
+    /** @type {number} */
+    this._receiveNonce = 0;
+
+    /** @type {boolean} */
+    this._isInitiator = isInitiator;
+
+    /** @type {boolean} */
+    this._established = true;
+  }
+
+  /**
+   * Gets the current send nonce.
+   * @returns {number} Current send nonce value
+   */
+  get sendNonce() {
+    return this._sendNonce;
+  }
+
+  /**
+   * Gets the current receive nonce.
+   * @returns {number} Current receive nonce value
+   */
+  get receiveNonce() {
+    return this._receiveNonce;
+  }
+
+  /**
+   * Encrypts a message for sending.
+   * @param {Uint8Array} plaintext - Message to encrypt
+   * @returns {Uint8Array} Encrypted message with authentication tag
+   * @throws {Error} If nonce overflow or session not established
+   */
+  encrypt(plaintext) {
+    if (!this._established) {
+      throw new Error('Session not established');
+    }
+    if (!(plaintext instanceof Uint8Array)) {
+      throw new Error('Plaintext must be a Uint8Array');
+    }
+    if (this._sendNonce >= MAX_NONCE) {
+      throw new Error('Send nonce overflow - session must be rekeyed');
+    }
+
+    const nonce = this._createNonce(this._sendNonce);
+    this._sendNonce++;
+
+    // Warn if approaching nonce limit
+    if (this._sendNonce === REKEY_THRESHOLD) {
+      console.warn('NoiseSession: Approaching send nonce limit, rekey recommended');
+    }
+
+    return encrypt(this._sendKey, nonce, plaintext);
+  }
+
+  /**
+   * Decrypts a received message.
+   * @param {Uint8Array} ciphertext - Encrypted message with authentication tag
+   * @returns {Uint8Array|null} Decrypted plaintext, or null if authentication fails
+   * @throws {Error} If nonce overflow or session not established
+   */
+  decrypt(ciphertext) {
+    if (!this._established) {
+      throw new Error('Session not established');
+    }
+    if (!(ciphertext instanceof Uint8Array)) {
+      throw new Error('Ciphertext must be a Uint8Array');
+    }
+    if (ciphertext.length < 16) {
+      throw new Error('Ciphertext too short (minimum 16 bytes for tag)');
+    }
+    if (this._receiveNonce >= MAX_NONCE) {
+      throw new Error('Receive nonce overflow - session must be rekeyed');
+    }
+
+    const nonce = this._createNonce(this._receiveNonce);
+    const plaintext = decrypt(this._receiveKey, nonce, ciphertext);
+
+    if (plaintext !== null) {
+      this._receiveNonce++;
+
+      // Warn if approaching nonce limit
+      if (this._receiveNonce === REKEY_THRESHOLD) {
+        console.warn('NoiseSession: Approaching receive nonce limit, rekey recommended');
+      }
+    }
+
+    return plaintext;
+  }
+
+  /**
+   * Checks if the session is established and ready for use.
+   * @returns {boolean} True if session is established
+   */
+  isEstablished() {
+    return this._established;
+  }
+
+  /**
+   * Exports the session state for persistence.
+   * WARNING: Contains sensitive key material, handle with care.
+   * @returns {object} Session state object
+   */
+  exportState() {
+    return {
+      sendKey: Array.from(this._sendKey),
+      receiveKey: Array.from(this._receiveKey),
+      sendNonce: this._sendNonce,
+      receiveNonce: this._receiveNonce,
+      isInitiator: this._isInitiator,
+      established: this._established
+    };
+  }
+
+  /**
+   * Creates a NoiseSession from exported state.
+   * @param {object} state - Previously exported session state
+   * @returns {NoiseSession} Restored session
+   * @throws {Error} If state is invalid
+   */
+  static importState(state) {
+    if (!state || typeof state !== 'object') {
+      throw new Error('Invalid session state');
+    }
+
+    const requiredFields = [
+      'sendKey', 'receiveKey', 'sendNonce', 'receiveNonce', 'isInitiator'
+    ];
+    for (const field of requiredFields) {
+      if (!(field in state)) {
+        throw new Error(`Missing required field: ${field}`);
+      }
+    }
+
+    const sendKey = new Uint8Array(state.sendKey);
+    const receiveKey = new Uint8Array(state.receiveKey);
+
+    if (sendKey.length !== 32 || receiveKey.length !== 32) {
+      throw new Error('Invalid key length in state');
+    }
+
+    const session = new NoiseSession(sendKey, receiveKey, state.isInitiator);
+    session._sendNonce = state.sendNonce;
+    session._receiveNonce = state.receiveNonce;
+    session._established = state.established !== false;
+
+    return session;
+  }
+
+  /**
+   * Destroys the session, zeroing sensitive key material.
+   */
+  destroy() {
+    this._sendKey.fill(0);
+    this._receiveKey.fill(0);
+    this._sendNonce = 0;
+    this._receiveNonce = 0;
+    this._established = false;
+  }
+
+  /**
+   * Creates a 12-byte nonce from a counter value.
+   * Format: 4 zero bytes + 8-byte little-endian counter
+   * @param {number} counter - Nonce counter value
+   * @returns {Uint8Array} 12-byte nonce
+   * @private
+   */
+  _createNonce(counter) {
+    const nonce = new Uint8Array(12);
+    const view = new DataView(nonce.buffer);
+    // First 4 bytes are zero
+    // Next 8 bytes are little-endian counter
+    view.setUint32(4, counter >>> 0, true);
+    view.setUint32(8, Math.floor(counter / 0x100000000) >>> 0, true);
+    return nonce;
+  }
+
+  /**
+   * Gets session statistics.
+   * @returns {object} Session statistics
+   */
+  getStats() {
+    return {
+      messagesSent: this._sendNonce,
+      messagesReceived: this._receiveNonce,
+      isInitiator: this._isInitiator,
+      established: this._established,
+      sendNonceRemaining: MAX_NONCE - this._sendNonce,
+      receiveNonceRemaining: MAX_NONCE - this._receiveNonce
+    };
+  }
+}
+
+module.exports = {
+  NoiseSession,
+  MAX_NONCE,
+  REKEY_THRESHOLD
+};

package/src/crypto/noise/state.js

@@ -0,0 +1,268 @@
+'use strict';
+
+/**
+ * Noise Protocol Symmetric State
+ * Implements the symmetric cryptographic state for Noise Protocol handshakes.
+ * @module crypto/noise/state
+ */
+
+const { hash } = require('../sha256');
+const { encrypt, decrypt } = require('../aead');
+const { concat } = require('../../utils/bytes');
+
+/**
+ * Protocol name for Noise_XX_25519_ChaChaPoly_SHA256
+ * @constant {string}
+ */
+const PROTOCOL_NAME = 'Noise_XX_25519_ChaChaPoly_SHA256';
+
+/**
+ * Maximum nonce value before overflow (2^64 - 1 represented as safe integer)
+ * @constant {number}
+ */
+const MAX_NONCE = Number.MAX_SAFE_INTEGER;
+
+/**
+ * SymmetricState manages the cryptographic state during a Noise handshake.
+ *
+ * Properties:
+ * - h: Handshake hash (32 bytes) - rolling hash of all handshake data
+ * - ck: Chaining key (32 bytes) - for key derivation
+ * - k: Cipher key (32 bytes or null) - for encrypting handshake payloads
+ * - n: Nonce counter - increments with each encryption
+ *
+ * @class
+ */
+class SymmetricState {
+  /**
+   * Creates a new SymmetricState.
+   * @param {string} [protocolName=PROTOCOL_NAME] - The Noise protocol name
+   */
+  constructor(protocolName = PROTOCOL_NAME) {
+    const nameBytes = new TextEncoder().encode(protocolName);
+
+    // If protocol name is <= 32 bytes, pad with zeros
+    // If > 32 bytes, hash it
+    if (nameBytes.length <= 32) {
+      this._h = new Uint8Array(32);
+      this._h.set(nameBytes);
+    } else {
+      this._h = hash(nameBytes);
+    }
+
+    // Initialize chaining key to handshake hash
+    this._ck = new Uint8Array(this._h);
+
+    // Cipher key starts as null (no encryption until first MixKey)
+    this._k = null;
+
+    // Nonce counter
+    this._n = 0;
+  }
+
+  /**
+   * Gets the current handshake hash.
+   * @returns {Uint8Array} Copy of the handshake hash
+   */
+  get h() {
+    return new Uint8Array(this._h);
+  }
+
+  /**
+   * Gets the current chaining key.
+   * @returns {Uint8Array} Copy of the chaining key
+   */
+  get ck() {
+    return new Uint8Array(this._ck);
+  }
+
+  /**
+   * Gets the current cipher key.
+   * @returns {Uint8Array|null} Copy of cipher key or null
+   */
+  get k() {
+    return this._k ? new Uint8Array(this._k) : null;
+  }
+
+  /**
+   * Gets the current nonce.
+   * @returns {number} Current nonce value
+   */
+  get n() {
+    return this._n;
+  }
+
+  /**
+   * MixHash: Updates handshake hash with new data.
+   * h = SHA256(h || data)
+   *
+   * @param {Uint8Array} data - Data to mix into the hash
+   */
+  mixHash(data) {
+    this._h = hash(concat(this._h, data));
+  }
+
+  /**
+   * MixKey: Derives new chaining key and cipher key from input key material.
+   * Uses HKDF with current chaining key as salt.
+   *
+   * (ck, k) = HKDF(ck, inputKeyMaterial)
+   * Resets nonce to 0.
+   *
+   * @param {Uint8Array} inputKeyMaterial - Key material to mix in (e.g., DH result)
+   */
+  mixKey(inputKeyMaterial) {
+    // Use proper HKDF: extract then expand
+    const tempKey = hash(concat(this._ck, inputKeyMaterial));
+    const derived = this._hkdfDeriveKeys(tempKey);
+
+    this._ck = derived.ck;
+    this._k = derived.k;
+    this._n = 0;
+  }
+
+  /**
+   * Internal HKDF key derivation for MixKey.
+   * @param {Uint8Array} tempKey - Temporary key from HKDF-Extract
+   * @returns {{ck: Uint8Array, k: Uint8Array}} Derived keys
+   * @private
+   */
+  _hkdfDeriveKeys(tempKey) {
+    // T1 = HMAC(tempKey, 0x01)
+    const t1Input = new Uint8Array(1);
+    t1Input[0] = 0x01;
+    const { hmacSha256 } = require('../hmac');
+    const ck = hmacSha256(tempKey, t1Input);
+
+    // T2 = HMAC(tempKey, T1 || 0x02)
+    const t2Input = new Uint8Array(33);
+    t2Input.set(ck);
+    t2Input[32] = 0x02;
+    const k = hmacSha256(tempKey, t2Input);
+
+    return { ck, k };
+  }
+
+  /**
+   * EncryptAndHash: Encrypts plaintext and mixes ciphertext into hash.
+   * If no cipher key is set, returns plaintext unchanged.
+   *
+   * @param {Uint8Array} plaintext - Data to encrypt
+   * @returns {Uint8Array} Ciphertext (or plaintext if k is null)
+   * @throws {Error} If nonce overflows
+   */
+  encryptAndHash(plaintext) {
+    if (this._k === null) {
+      // No key yet, just mix plaintext into hash
+      this.mixHash(plaintext);
+      return plaintext;
+    }
+
+    if (this._n >= MAX_NONCE) {
+      throw new Error('Nonce overflow');
+    }
+
+    // Create 12-byte nonce: 4 zero bytes + 8-byte little-endian counter
+    const nonce = this._createNonce(this._n);
+    this._n++;
+
+    // Encrypt with h as AAD
+    const ciphertext = encrypt(this._k, nonce, plaintext, this._h);
+
+    // Mix ciphertext into hash
+    this.mixHash(ciphertext);
+
+    return ciphertext;
+  }
+
+  /**
+   * DecryptAndHash: Decrypts ciphertext and mixes it into hash.
+   * If no cipher key is set, returns ciphertext unchanged.
+   *
+   * @param {Uint8Array} ciphertext - Data to decrypt
+   * @returns {Uint8Array} Plaintext (or ciphertext if k is null)
+   * @throws {Error} If decryption fails or nonce overflows
+   */
+  decryptAndHash(ciphertext) {
+    if (this._k === null) {
+      // No key yet, just mix ciphertext into hash
+      this.mixHash(ciphertext);
+      return ciphertext;
+    }
+
+    if (this._n >= MAX_NONCE) {
+      throw new Error('Nonce overflow');
+    }
+
+    // Create 12-byte nonce
+    const nonce = this._createNonce(this._n);
+    this._n++;
+
+    // Decrypt with h as AAD
+    const plaintext = decrypt(this._k, nonce, ciphertext, this._h);
+
+    if (plaintext === null) {
+      throw new Error('Decryption failed: authentication error');
+    }
+
+    // Mix ciphertext into hash (not plaintext!)
+    this.mixHash(ciphertext);
+
+    return plaintext;
+  }
+
+  /**
+   * Split: Derives final transport keys from the handshake state.
+   * Returns two keys for bidirectional communication.
+   *
+   * @returns {{sendKey: Uint8Array, receiveKey: Uint8Array}} Transport keys
+   */
+  split() {
+    const tempKey = hash(concat(this._ck, new Uint8Array(0)));
+    const { hmacSha256 } = require('../hmac');
+
+    // k1 = HKDF-Expand(ck, 0x01)
+    const t1Input = new Uint8Array(1);
+    t1Input[0] = 0x01;
+    const k1 = hmacSha256(tempKey, t1Input);
+
+    // k2 = HKDF-Expand(ck, k1 || 0x02)
+    const t2Input = new Uint8Array(33);
+    t2Input.set(k1);
+    t2Input[32] = 0x02;
+    const k2 = hmacSha256(tempKey, t2Input);
+
+    return { sendKey: k1, receiveKey: k2 };
+  }
+
+  /**
+   * Gets a copy of the current handshake hash.
+   * @returns {Uint8Array} Copy of handshake hash
+   */
+  getHandshakeHash() {
+    return new Uint8Array(this._h);
+  }
+
+  /**
+   * Creates a 12-byte nonce from a counter value.
+   * Format: 4 zero bytes + 8-byte little-endian counter
+   *
+   * @param {number} counter - Nonce counter value
+   * @returns {Uint8Array} 12-byte nonce
+   * @private
+   */
+  _createNonce(counter) {
+    const nonce = new Uint8Array(12);
+    const view = new DataView(nonce.buffer);
+    // First 4 bytes are zero
+    // Next 8 bytes are little-endian counter
+    view.setUint32(4, counter >>> 0, true);
+    view.setUint32(8, Math.floor(counter / 0x100000000) >>> 0, true);
+    return nonce;
+  }
+}
+
+module.exports = {
+  SymmetricState,
+  PROTOCOL_NAME
+};

package/src/crypto/poly1305.js

@@ -0,0 +1,113 @@
+/**
+ * @fileoverview Poly1305 message authentication code (RFC 8439)
+ * @module crypto/poly1305
+ */
+
+'use strict';
+
+/**
+ * Clamps the r portion of the Poly1305 key per RFC 8439
+ * Clears bits 4,5,6,7 of bytes 3,7,11,15 and bits 0,1 of bytes 4,8,12
+ * @param {Uint8Array} r - 16-byte r value (modified in place)
+ * @returns {Uint8Array} Clamped r value
+ */
+function clamp(r) {
+  r[3] &= 0x0f;
+  r[7] &= 0x0f;
+  r[11] &= 0x0f;
+  r[15] &= 0x0f;
+  r[4] &= 0xfc;
+  r[8] &= 0xfc;
+  r[12] &= 0xfc;
+  return r;
+}
+
+/**
+ * Converts bytes to BigInt (little-endian)
+ * @param {Uint8Array} bytes - Byte array
+ * @returns {bigint} BigInt value
+ */
+function bytesToBigInt(bytes) {
+  let result = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    result = (result << 8n) | BigInt(bytes[i]);
+  }
+  return result;
+}
+
+/**
+ * Converts BigInt to bytes (little-endian)
+ * @param {bigint} num - BigInt value
+ * @param {number} length - Desired byte length
+ * @returns {Uint8Array} Byte array
+ */
+function bigIntToBytes(num, length) {
+  const bytes = new Uint8Array(length);
+  let value = num;
+  for (let i = 0; i < length; i++) {
+    bytes[i] = Number(value & 0xffn);
+    value >>= 8n;
+  }
+  return bytes;
+}
+
+/**
+ * Computes Poly1305 MAC
+ * @param {Uint8Array} key - 32-byte one-time key
+ * @param {Uint8Array} message - Message to authenticate
+ * @returns {Uint8Array} 16-byte authentication tag
+ * @throws {Error} If key is not 32 bytes
+ */
+function poly1305(key, message) {
+  if (!(key instanceof Uint8Array) || key.length !== 32) {
+    throw new Error('Key must be 32 bytes');
+  }
+  if (!(message instanceof Uint8Array)) {
+    throw new Error('Message must be a Uint8Array');
+  }
+
+  // Split key into r and s
+  const r = new Uint8Array(key.subarray(0, 16));
+  const s = key.subarray(16, 32);
+
+  // Clamp r
+  clamp(r);
+
+  // Convert to BigInt
+  const rBig = bytesToBigInt(r);
+  const sBig = bytesToBigInt(s);
+
+  // Prime p = 2^130 - 5
+  const p = (1n << 130n) - 5n;
+
+  // Process message in 16-byte blocks
+  let accumulator = 0n;
+  const numBlocks = Math.ceil(message.length / 16);
+
+  for (let i = 0; i < numBlocks; i++) {
+    const start = i * 16;
+    const end = Math.min(start + 16, message.length);
+    const blockSize = end - start;
+
+    // Create block with appended 0x01 byte
+    const block = new Uint8Array(blockSize + 1);
+    block.set(message.subarray(start, end));
+    block[blockSize] = 0x01;
+
+    // Convert block to number and add to accumulator
+    const n = bytesToBigInt(block);
+    accumulator = (accumulator + n) % p;
+
+    // Multiply by r
+    accumulator = (accumulator * rBig) % p;
+  }
+
+  // Add s (no reduction mod p)
+  const tag = (accumulator + sBig) % (1n << 128n);
+
+  return bigIntToBytes(tag, 16);
+}
+
+module.exports = {
+  poly1305
+};