zapo-js 0.1.0

package/dist/esm/signal/session/SignalRatchet.js

@@ -0,0 +1,260 @@
+import { aesCbcDecrypt, aesCbcEncrypt, hkdf, importAesCbcKey, importHmacKey, hmacSign, prependVersion, toSerializedPubKey } from '../../crypto/index.js';
+import { proto } from '../../proto.js';
+import { CHAIN_KEY_LABEL, FUTURE_MESSAGES_MAX, MAX_UNUSED_KEYS, MESSAGE_KEY_LABEL, SIGNAL_MAC_SIZE, SIGNAL_VERSION } from '../constants.js';
+import { detachSession, calculateRatchet, generateSerializedKeyPair, snapshotToRecord } from '../session/SignalSession.js';
+import { concatBytes, removeAt, uint8Equal } from '../../util/bytes.js';
+import { toError } from '../../util/primitives.js';
+const MAX_TRACKED_RECV_CHAINS = 4;
+export function splitMsgKey(index, bytes) {
+    if (bytes.length < 80) {
+        throw new Error('invalid message key length');
+    }
+    return {
+        index,
+        cipherKey: bytes.subarray(0, 32),
+        macKey: bytes.subarray(32, 64),
+        iv: bytes.subarray(64, 80)
+    };
+}
+export async function deriveMsgKey(index, chainKey) {
+    const state = await createDerivedChainState(chainKey);
+    const derived = await deriveMsgKeyFromState(index, state);
+    return {
+        nextChainKey: derived.nextState.chainKey,
+        messageKey: derived.messageKey
+    };
+}
+export async function selectMessageKey(chain, targetCounter) {
+    const delta = targetCounter - chain.nextMsgIndex;
+    if (delta > FUTURE_MESSAGES_MAX) {
+        throw new Error('message too far in future');
+    }
+    const unused = chain.unusedMsgKeys;
+    if (delta < 0) {
+        const idx = unused.findIndex((entry) => entry.index === targetCounter);
+        if (idx === -1) {
+            throw new Error('duplicate message');
+        }
+        const messageKey = unused[idx];
+        const nextUnused = removeAt(unused, idx);
+        return {
+            messageKey,
+            updatedChain: {
+                ratchetPubKey: chain.ratchetPubKey,
+                nextMsgIndex: chain.nextMsgIndex,
+                chainKey: chain.chainKey,
+                unusedMsgKeys: nextUnused
+            }
+        };
+    }
+    let chainState = await createDerivedChainState(chain.chainKey);
+    const first = await deriveMsgKeyFromState(chain.nextMsgIndex, chainState);
+    let currentMessageKey = first.messageKey;
+    chainState = first.nextState;
+    let nextUnused = unused.slice();
+    if (delta > 0) {
+        let overflow = delta + unused.length - MAX_UNUSED_KEYS;
+        if (overflow > 0) {
+            nextUnused = nextUnused.slice(overflow);
+            overflow -= unused.length;
+        }
+        for (let counter = chain.nextMsgIndex + 1; counter <= targetCounter; counter += 1) {
+            if (overflow > 0) {
+                overflow -= 1;
+            }
+            else {
+                nextUnused.push(currentMessageKey);
+            }
+            const derived = await deriveMsgKeyFromState(counter, chainState);
+            currentMessageKey = derived.messageKey;
+            chainState = derived.nextState;
+        }
+    }
+    return {
+        messageKey: currentMessageKey,
+        updatedChain: {
+            ratchetPubKey: chain.ratchetPubKey,
+            nextMsgIndex: targetCounter + 1,
+            chainKey: chainState.chainKey,
+            unusedMsgKeys: nextUnused
+        }
+    };
+}
+async function createDerivedChainState(chainKey) {
+    return {
+        chainKey,
+        hmacKey: await importHmacKey(chainKey)
+    };
+}
+async function deriveMsgKeyFromState(index, state) {
+    const nextChainRawPromise = hmacSign(state.hmacKey, CHAIN_KEY_LABEL);
+    const messageInputKeyPromise = hmacSign(state.hmacKey, MESSAGE_KEY_LABEL);
+    const [nextChainRaw, messageInputKey] = await Promise.all([
+        nextChainRawPromise,
+        messageInputKeyPromise
+    ]);
+    const nextChainKey = nextChainRaw.subarray(0, 32);
+    const [nextHmacKey, expanded] = await Promise.all([
+        importHmacKey(nextChainKey),
+        hkdf(messageInputKey, null, 'WhisperMessageKeys', 80)
+    ]);
+    return {
+        nextState: {
+            chainKey: nextChainKey,
+            hmacKey: nextHmacKey
+        },
+        messageKey: splitMsgKey(index, expanded)
+    };
+}
+export async function encryptMsg(session, plaintext) {
+    const { nextChainKey, messageKey } = await deriveMsgKey(session.sendChain.nextMsgIndex, session.sendChain.chainKey);
+    const [cipherKey, macKey] = await Promise.all([
+        importAesCbcKey(messageKey.cipherKey),
+        importHmacKey(messageKey.macKey)
+    ]);
+    const ciphertext = await aesCbcEncrypt(cipherKey, messageKey.iv, plaintext);
+    const signalPayload = proto.SignalMessage.encode({
+        ratchetKey: session.sendChain.ratchetKey.pubKey,
+        counter: messageKey.index,
+        previousCounter: session.prevSendChainHighestIndex,
+        ciphertext
+    }).finish();
+    const versionedSignalPayload = prependVersion(signalPayload, SIGNAL_VERSION);
+    const macInput = concatBytes([
+        session.local.pubKey,
+        session.remote.pubKey,
+        versionedSignalPayload
+    ]);
+    const mac = await hmacSign(macKey, macInput);
+    const signalMessage = concatBytes([versionedSignalPayload, mac.subarray(0, SIGNAL_MAC_SIZE)]);
+    let type = 'msg';
+    let output = signalMessage;
+    if (session.initialExchangeInfo) {
+        const preKeyPayload = proto.PreKeySignalMessage.encode({
+            registrationId: session.local.regId,
+            preKeyId: session.initialExchangeInfo.remoteOneTimeId ?? undefined,
+            signedPreKeyId: session.initialExchangeInfo.remoteSignedId,
+            baseKey: session.initialExchangeInfo.localOneTimePubKey,
+            identityKey: session.local.pubKey,
+            message: signalMessage
+        }).finish();
+        type = 'pkmsg';
+        output = prependVersion(preKeyPayload, SIGNAL_VERSION);
+    }
+    const updated = {
+        ...session,
+        sendChain: {
+            ratchetKey: session.sendChain.ratchetKey,
+            nextMsgIndex: messageKey.index + 1,
+            chainKey: nextChainKey
+        }
+    };
+    return [updated, { type, ciphertext: output }];
+}
+export async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
+    if (!session) {
+        throw new Error('signal session not found');
+    }
+    try {
+        const [updatedSession, plaintext] = await decryptMsgFromSession(session, parsed);
+        return {
+            updatedSession,
+            plaintext,
+            newSessionInfo: null
+        };
+    }
+    catch (error) {
+        for (let i = 0; i < session.prevSessions.length; i += 1) {
+            const prevSession = snapshotToRecord(session.prevSessions[i]);
+            try {
+                const [updatedPrev, plaintext] = await decryptMsgFromSession(prevSession, parsed);
+                const updatedSession = {
+                    ...updatedPrev,
+                    prevSessions: [
+                        detachSession(session),
+                        ...session.prevSessions.slice(0, i),
+                        ...session.prevSessions.slice(i + 1)
+                    ]
+                };
+                return {
+                    updatedSession,
+                    plaintext,
+                    newSessionInfo: {
+                        newIdentity: uint8Equal(updatedSession.remote.pubKey, session.remote.pubKey)
+                            ? null
+                            : updatedSession.remote.pubKey,
+                        baseSession: prevSession,
+                        usedPreKey: null
+                    }
+                };
+            }
+            catch (prevError) {
+                onPrevSessionDecryptError?.(toError(prevError), i);
+                continue;
+            }
+        }
+        throw error;
+    }
+}
+export async function decryptMsgFromSession(session, message) {
+    const ratchetPubKey = toSerializedPubKey(message.ratchetPubKey);
+    const recvChainIndex = session.recvChains.findIndex((entry) => uint8Equal(entry.ratchetPubKey, ratchetPubKey));
+    let selectedMessageKey;
+    let updatedSession;
+    if (recvChainIndex === -1) {
+        const recvRatchet = await calculateRatchet(session.rootKey, session.sendChain.ratchetKey, ratchetPubKey);
+        const freshRecvChain = {
+            ratchetPubKey,
+            nextMsgIndex: 0,
+            chainKey: recvRatchet.chainKey,
+            unusedMsgKeys: []
+        };
+        const [selected, newSendRatchet] = await Promise.all([
+            selectMessageKey(freshRecvChain, message.counter),
+            generateSerializedKeyPair()
+        ]);
+        selectedMessageKey = selected.messageKey;
+        const sendRatchet = await calculateRatchet(recvRatchet.rootKey, newSendRatchet, ratchetPubKey);
+        const nextRecvChains = session.recvChains.slice(-MAX_TRACKED_RECV_CHAINS);
+        nextRecvChains.push(selected.updatedChain);
+        updatedSession = {
+            ...session,
+            rootKey: sendRatchet.rootKey,
+            recvChains: nextRecvChains,
+            sendChain: {
+                ratchetKey: newSendRatchet,
+                nextMsgIndex: 0,
+                chainKey: sendRatchet.chainKey
+            },
+            initialExchangeInfo: null,
+            prevSendChainHighestIndex: Math.max(session.sendChain.nextMsgIndex - 1, 0)
+        };
+    }
+    else {
+        const selected = await selectMessageKey(session.recvChains[recvChainIndex], message.counter);
+        selectedMessageKey = selected.messageKey;
+        const nextRecvChains = session.recvChains.slice();
+        nextRecvChains[recvChainIndex] = selected.updatedChain;
+        updatedSession = {
+            ...session,
+            recvChains: nextRecvChains
+        };
+    }
+    const [cipherKey, macKey] = await Promise.all([
+        importAesCbcKey(selectedMessageKey.cipherKey),
+        importHmacKey(selectedMessageKey.macKey)
+    ]);
+    const payloadWithoutMac = message.versionContentMac.subarray(0, message.versionContentMac.length - SIGNAL_MAC_SIZE);
+    const expectedMacInput = concatBytes([
+        session.remote.pubKey,
+        session.local.pubKey,
+        payloadWithoutMac
+    ]);
+    const expectedMac = await hmacSign(macKey, expectedMacInput);
+    const receivedMac = message.versionContentMac.subarray(message.versionContentMac.length - SIGNAL_MAC_SIZE);
+    if (!uint8Equal(expectedMac.subarray(0, SIGNAL_MAC_SIZE), receivedMac)) {
+        throw new Error('invalid message mac');
+    }
+    const plaintext = await aesCbcDecrypt(cipherKey, selectedMessageKey.iv, message.ciphertext);
+    return [updatedSession, plaintext];
+}

package/dist/esm/signal/session/SignalSerializer.js

@@ -0,0 +1,63 @@
+import { readVersionedContent, toSerializedPubKey } from '../../crypto/index.js';
+import { proto } from '../../proto.js';
+import { SIGNAL_MAC_SIZE, SIGNAL_VERSION } from '../constants.js';
+import { toBytesView } from '../../util/bytes.js';
+export function deserializeMsg(versionContentMac) {
+    const content = readVersionedContent(versionContentMac, SIGNAL_VERSION, SIGNAL_MAC_SIZE);
+    const parsed = proto.SignalMessage.decode(content);
+    if (parsed.ratchetKey === null ||
+        parsed.ratchetKey === undefined ||
+        parsed.counter === null ||
+        parsed.counter === undefined ||
+        parsed.ciphertext === null ||
+        parsed.ciphertext === undefined) {
+        throw new Error('invalid signal message');
+    }
+    return {
+        ratchetPubKey: toSerializedPubKey(toBytesView(parsed.ratchetKey)),
+        counter: parsed.counter,
+        ciphertext: toBytesView(parsed.ciphertext),
+        versionContentMac
+    };
+}
+export function deserializePkMsg(versionContent) {
+    const content = readVersionedContent(versionContent, SIGNAL_VERSION, 0);
+    const parsed = proto.PreKeySignalMessage.decode(content);
+    if (parsed.registrationId === null ||
+        parsed.registrationId === undefined ||
+        parsed.signedPreKeyId === null ||
+        parsed.signedPreKeyId === undefined ||
+        parsed.baseKey === null ||
+        parsed.baseKey === undefined ||
+        parsed.identityKey === null ||
+        parsed.identityKey === undefined ||
+        parsed.message === null ||
+        parsed.message === undefined) {
+        throw new Error('invalid prekey signal message');
+    }
+    const signal = deserializeMsg(toBytesView(parsed.message));
+    return {
+        ...signal,
+        remote: {
+            regId: parsed.registrationId,
+            pubKey: toSerializedPubKey(toBytesView(parsed.identityKey))
+        },
+        sessionBaseKey: toSerializedPubKey(toBytesView(parsed.baseKey)),
+        localSignedPreKeyId: parsed.signedPreKeyId,
+        localOneTimeKeyId: parsed.preKeyId ?? null
+    };
+}
+export async function requireSignedPreKey(store, id) {
+    const signedPreKey = await store.getSignedPreKeyById(id);
+    if (!signedPreKey) {
+        throw new Error(`signed prekey ${id} not found`);
+    }
+    return signedPreKey;
+}
+export async function requirePreKey(store, id) {
+    const preKey = await store.getPreKeyById(id);
+    if (!preKey) {
+        throw new Error(`prekey ${id} not found`);
+    }
+    return preKey;
+}

package/dist/esm/signal/session/SignalSession.js

@@ -0,0 +1,153 @@
+import { hkdfSplit, toRawPubKey, toSerializedPubKey, X25519 } from '../../crypto/index.js';
+import { SIGNAL_PREFIX } from '../constants.js';
+import { concatBytes, uint8Equal } from '../../util/bytes.js';
+export function snapshotToRecord(snapshot) {
+    return {
+        ...snapshot,
+        prevSessions: []
+    };
+}
+export function detachSession(session) {
+    const { prevSessions, ...snapshot } = session;
+    void prevSessions;
+    return snapshot;
+}
+export function findMatchingSession(session, sessionBaseKey) {
+    if (!session) {
+        return null;
+    }
+    const serializedBaseKey = toSerializedPubKey(sessionBaseKey);
+    if (session.aliceBaseKey && uint8Equal(session.aliceBaseKey, serializedBaseKey)) {
+        return session;
+    }
+    const previousSessionIndex = session.prevSessions.findIndex((prev) => !!prev.aliceBaseKey && uint8Equal(prev.aliceBaseKey, serializedBaseKey));
+    if (previousSessionIndex !== -1) {
+        const promoted = snapshotToRecord(session.prevSessions[previousSessionIndex]);
+        return {
+            ...promoted,
+            prevSessions: [
+                detachSession(session),
+                ...session.prevSessions.slice(0, previousSessionIndex),
+                ...session.prevSessions.slice(previousSessionIndex + 1)
+            ]
+        };
+    }
+    return null;
+}
+export async function requireLocalIdentity(store) {
+    const registration = await store.getRegistrationInfo();
+    if (!registration) {
+        throw new Error('registration info not found');
+    }
+    return {
+        regId: registration.registrationId,
+        staticKeyPair: toSerializedKeyPair(registration.identityKeyPair)
+    };
+}
+export async function initiateSessionOutgoing(local, remoteBundle, localOneTimeBase) {
+    const remoteIdentity = toSerializedPubKey(remoteBundle.identity);
+    const remoteSignedKey = toSerializedPubKey(remoteBundle.signedKey.publicKey);
+    const remoteOneTimeKey = remoteBundle.oneTimeKey
+        ? toSerializedPubKey(remoteBundle.oneTimeKey.publicKey)
+        : null;
+    const remoteRatchetKey = toSerializedPubKey(remoteBundle.ratchetKey ?? remoteBundle.signedKey.publicKey);
+    const [signedDh, identityDh, baseDh, oneTimeDh] = await Promise.all([
+        ecdh(local.staticKeyPair.privKey, remoteSignedKey),
+        ecdh(localOneTimeBase.privKey, remoteIdentity),
+        ecdh(localOneTimeBase.privKey, remoteSignedKey),
+        remoteOneTimeKey
+            ? ecdh(localOneTimeBase.privKey, remoteOneTimeKey)
+            : Promise.resolve(null)
+    ]);
+    const secret = concatBytes([
+        SIGNAL_PREFIX,
+        signedDh,
+        identityDh,
+        baseDh,
+        ...(oneTimeDh ? [oneTimeDh] : [])
+    ]);
+    const [rootKey, chainKey] = await hkdfSplit(secret, null, 'WhisperText');
+    const recvChain = {
+        ratchetPubKey: remoteRatchetKey,
+        nextMsgIndex: 0,
+        chainKey,
+        unusedMsgKeys: []
+    };
+    const sendRatchet = await generateSerializedKeyPair();
+    const sendRatchetResult = await calculateRatchet(rootKey, sendRatchet, remoteRatchetKey);
+    return {
+        local: { regId: local.regId, pubKey: local.staticKeyPair.pubKey },
+        remote: { regId: remoteBundle.regId, pubKey: remoteIdentity },
+        rootKey: sendRatchetResult.rootKey,
+        recvChains: [recvChain],
+        sendChain: {
+            ratchetKey: sendRatchet,
+            nextMsgIndex: 0,
+            chainKey: sendRatchetResult.chainKey
+        },
+        initialExchangeInfo: {
+            remoteOneTimeId: remoteBundle.oneTimeKey?.id ?? null,
+            remoteSignedId: remoteBundle.signedKey.id,
+            localOneTimePubKey: localOneTimeBase.pubKey
+        },
+        prevSendChainHighestIndex: 0,
+        prevSessions: [],
+        aliceBaseKey: localOneTimeBase.pubKey
+    };
+}
+export async function initiateSessionIncoming(local, remote, sessionBaseKey, localKeys) {
+    const baseKey = toSerializedPubKey(sessionBaseKey);
+    const remotePub = toSerializedPubKey(remote.pubKey);
+    const [identityDh, staticDh, signedDh, oneTimeDh] = await Promise.all([
+        ecdh(localKeys.signed.privKey, remotePub),
+        ecdh(local.staticKeyPair.privKey, baseKey),
+        ecdh(localKeys.signed.privKey, baseKey),
+        localKeys.oneTime
+            ? ecdh(localKeys.oneTime.privKey, baseKey)
+            : Promise.resolve(null)
+    ]);
+    const secret = concatBytes([
+        SIGNAL_PREFIX,
+        identityDh,
+        staticDh,
+        signedDh,
+        ...(oneTimeDh ? [oneTimeDh] : [])
+    ]);
+    const [rootKey, chainKey] = await hkdfSplit(secret, null, 'WhisperText');
+    return {
+        local: { regId: local.regId, pubKey: local.staticKeyPair.pubKey },
+        remote: { regId: remote.regId, pubKey: remotePub },
+        rootKey,
+        recvChains: [],
+        sendChain: {
+            ratchetKey: localKeys.ratchet,
+            nextMsgIndex: 0,
+            chainKey
+        },
+        initialExchangeInfo: null,
+        prevSendChainHighestIndex: 0,
+        prevSessions: [],
+        aliceBaseKey: baseKey
+    };
+}
+export async function calculateRatchet(rootKey, localRatchet, remoteRatchetPubKey) {
+    const sharedSecret = await ecdh(localRatchet.privKey, remoteRatchetPubKey);
+    const [nextRootKey, chainKey] = await hkdfSplit(sharedSecret, rootKey, 'WhisperRatchet');
+    return {
+        rootKey: nextRootKey,
+        chainKey
+    };
+}
+export async function generateSerializedKeyPair() {
+    const pair = await X25519.generateKeyPair();
+    return toSerializedKeyPair(pair);
+}
+export function toSerializedKeyPair(pair) {
+    return {
+        pubKey: toSerializedPubKey(pair.pubKey),
+        privKey: pair.privKey
+    };
+}
+export async function ecdh(privateKey, publicKey) {
+    return X25519.scalarMult(privateKey, toRawPubKey(publicKey));
+}