zapo-js 0.1.2 → 0.3.0

package/dist/crypto/math/mod.js

@@ -1,12 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GROUP_L = exports.FIELD_P = void 0;
 exports.mod = mod;
 exports.modGroup = modGroup;
 exports.modInv = modInv;
 const constants_1 = require("../math/constants");
-Object.defineProperty(exports, "FIELD_P", { enumerable: true, get: function () { return constants_1.FIELD_P; } });
-Object.defineProperty(exports, "GROUP_L", { enumerable: true, get: function () { return constants_1.GROUP_L; } });
+const fe_1 = require("../math/fe");
 function mod(value, modulus = constants_1.FIELD_P) {
     const remainder = value % modulus;
     return remainder >= 0n ? remainder : remainder + modulus;
@@ -18,8 +16,17 @@ function modInv(value, modulus = constants_1.FIELD_P) {
     if (value === 0n) {
         throw new Error('field inversion by zero');
     }
+    if (modulus === constants_1.FIELD_P) {
+        return fieldInv(value);
+    }
     return modPow(value, modulus - 2n, modulus);
 }
+function fieldInv(x) {
+    const a = (0, fe_1.feFromBigInt)(mod(x));
+    const out = (0, fe_1.fe)();
+    (0, fe_1.feInv)(out, a);
+    return (0, fe_1.feToBigInt)(out);
+}
 function modPow(base, exponent, modulus) {
     if (modulus <= 0n) {
         throw new Error('modulus must be positive');

package/dist/esm/appstate/WaAppStateCrypto.js

@@ -4,15 +4,18 @@ import { aesCbcDecrypt, aesCbcEncrypt, hmacSign, importAesCbcKey, importHmacKey,
 import { randomBytesAsync } from '../crypto/core/random.js';
 import { proto } from '../proto.js';
 import { WA_APP_STATE_KDF_INFO } from '../protocol/constants.js';
-import { bytesToBase64 } from '../util/bytes.js';
-import { concatBytes, EMPTY_BYTES, intToBytes, TEXT_DECODER, TEXT_ENCODER, uint8Equal } from '../util/bytes.js';
+import { bytesToBase64, concatBytes, EMPTY_BYTES, intToBytes, TEXT_DECODER, TEXT_ENCODER, uint8TimingSafeEqual } from '../util/bytes.js';
 import { setBoundedMapEntry } from '../util/collections.js';
 import { normalizeNonNegativeInteger } from '../util/primitives.js';
 const DEFAULT_DERIVED_KEYS_CACHE_MAX_SIZE = 256;
 export class WaAppStateCrypto {
-    constructor(derivedKeysCacheMaxSize = DEFAULT_DERIVED_KEYS_CACHE_MAX_SIZE) {
+    constructor(derivedKeysCacheMaxSize = DEFAULT_DERIVED_KEYS_CACHE_MAX_SIZE, skipMacVerification = false) {
         this.derivedKeysCache = new Map();
         this.derivedKeysCacheMaxSize = normalizeNonNegativeInteger(derivedKeysCacheMaxSize, DEFAULT_DERIVED_KEYS_CACHE_MAX_SIZE);
+        this.skipMacVerification = skipMacVerification;
+    }
+    get isMacVerificationSkipped() {
+        return this.skipMacVerification;
     }
     clearCache() {
         this.derivedKeysCache.clear();
@@ -25,19 +28,25 @@ export class WaAppStateCrypto {
             return cached;
         }
         const derived = await hkdf(keyData, null, WA_APP_STATE_KDF_INFO.MUTATION_KEYS, APP_STATE_DERIVED_KEY_LENGTH);
+        const [indexHmacKey, valueEncryptionAesKey, valueMacHmacKey, snapshotMacHmacKey, patchMacHmacKey] = await Promise.all([
+            importHmacKey(derived.subarray(0, APP_STATE_DERIVED_INDEX_KEY_END)),
+            importAesCbcKey(derived.subarray(APP_STATE_DERIVED_INDEX_KEY_END, APP_STATE_DERIVED_VALUE_ENCRYPTION_KEY_END)),
+            importHmacSha512Key(derived.subarray(APP_STATE_DERIVED_VALUE_ENCRYPTION_KEY_END, APP_STATE_DERIVED_VALUE_MAC_KEY_END)),
+            importHmacKey(derived.subarray(APP_STATE_DERIVED_VALUE_MAC_KEY_END, APP_STATE_DERIVED_SNAPSHOT_MAC_KEY_END)),
+            importHmacKey(derived.subarray(APP_STATE_DERIVED_SNAPSHOT_MAC_KEY_END, APP_STATE_DERIVED_PATCH_MAC_KEY_END))
+        ]);
         const keys = {
-            indexKey: derived.subarray(0, APP_STATE_DERIVED_INDEX_KEY_END),
-            valueEncryptionKey: derived.subarray(APP_STATE_DERIVED_INDEX_KEY_END, APP_STATE_DERIVED_VALUE_ENCRYPTION_KEY_END),
-            valueMacKey: derived.subarray(APP_STATE_DERIVED_VALUE_ENCRYPTION_KEY_END, APP_STATE_DERIVED_VALUE_MAC_KEY_END),
-            snapshotMacKey: derived.subarray(APP_STATE_DERIVED_VALUE_MAC_KEY_END, APP_STATE_DERIVED_SNAPSHOT_MAC_KEY_END),
-            patchMacKey: derived.subarray(APP_STATE_DERIVED_SNAPSHOT_MAC_KEY_END, APP_STATE_DERIVED_PATCH_MAC_KEY_END)
+            indexHmacKey,
+            valueEncryptionAesKey,
+            valueMacHmacKey,
+            snapshotMacHmacKey,
+            patchMacHmacKey
         };
         this.touchDerivedKeysCacheEntry(cacheKey, keys);
         return keys;
     }
-    async generateIndexMac(indexKey, indexBytes) {
-        const key = await importHmacKey(indexKey);
-        return hmacSign(key, indexBytes);
+    async generateIndexMac(indexHmacKey, indexBytes) {
+        return hmacSign(indexHmacKey, indexBytes);
     }
     async encryptMutation(args) {
         const derivedKeys = await this.deriveKeys(args.keyData);
@@ -52,13 +61,12 @@ export class WaAppStateCrypto {
         if (iv.byteLength !== APP_STATE_IV_LENGTH) {
             throw new Error(`invalid IV length ${iv.byteLength}`);
         }
-        const indexMacPromise = this.generateIndexMac(derivedKeys.indexKey, indexBytes);
-        const encryptionKey = await importAesCbcKey(derivedKeys.valueEncryptionKey);
-        const cipherText = await aesCbcEncrypt(encryptionKey, iv, encoded);
+        const indexMacPromise = this.generateIndexMac(derivedKeys.indexHmacKey, indexBytes);
+        const cipherText = await aesCbcEncrypt(derivedKeys.valueEncryptionAesKey, iv, encoded);
         const cipherWithIv = concatBytes([iv, cipherText]);
         const associatedData = this.generateAssociatedData(args.operation, args.keyId);
         const [valueMac, indexMac] = await Promise.all([
-            this.generateValueMac(derivedKeys.valueMacKey, associatedData, cipherWithIv),
+            this.generateValueMac(derivedKeys.valueMacHmacKey, associatedData, cipherWithIv),
             indexMacPromise
         ]);
         return {
@@ -76,13 +84,14 @@ export class WaAppStateCrypto {
         const mac = args.valueBlob.subarray(args.valueBlob.byteLength - APP_STATE_VALUE_MAC_LENGTH);
         const cipherText = args.valueBlob.subarray(APP_STATE_IV_LENGTH, args.valueBlob.byteLength - APP_STATE_VALUE_MAC_LENGTH);
         const cipherWithIv = args.valueBlob.subarray(0, args.valueBlob.byteLength - APP_STATE_VALUE_MAC_LENGTH);
-        const associatedData = this.generateAssociatedData(args.operation, args.keyId);
-        const expectedMac = await this.generateValueMac(derivedKeys.valueMacKey, associatedData, cipherWithIv);
-        if (!uint8Equal(mac, expectedMac)) {
-            throw new Error('mutation value MAC mismatch');
+        if (!this.skipMacVerification) {
+            const associatedData = this.generateAssociatedData(args.operation, args.keyId);
+            const expectedMac = await this.generateValueMac(derivedKeys.valueMacHmacKey, associatedData, cipherWithIv);
+            if (!uint8TimingSafeEqual(mac, expectedMac)) {
+                throw new Error('mutation value MAC mismatch');
+            }
         }
-        const decryptionKey = await importAesCbcKey(derivedKeys.valueEncryptionKey);
-        const plaintext = await aesCbcDecrypt(decryptionKey, iv, cipherText);
+        const plaintext = await aesCbcDecrypt(derivedKeys.valueEncryptionAesKey, iv, cipherText);
         const syncActionData = proto.SyncActionData.decode(plaintext);
         if (!syncActionData.index) {
             throw new Error('missing sync action index');
@@ -90,9 +99,11 @@ export class WaAppStateCrypto {
         if (syncActionData.version === null || syncActionData.version === undefined) {
             throw new Error('missing sync action version');
         }
-        const generatedIndexMac = await this.generateIndexMac(derivedKeys.indexKey, syncActionData.index);
-        if (!uint8Equal(generatedIndexMac, args.indexMac)) {
-            throw new Error('mutation index MAC mismatch');
+        if (!this.skipMacVerification) {
+            const generatedIndexMac = await this.generateIndexMac(derivedKeys.indexHmacKey, syncActionData.index);
+            if (!uint8TimingSafeEqual(generatedIndexMac, args.indexMac)) {
+                throw new Error('mutation index MAC mismatch');
+            }
         }
         return {
             index: TEXT_DECODER.decode(syncActionData.index),
@@ -109,8 +120,7 @@ export class WaAppStateCrypto {
             intToBytes(8, version),
             TEXT_ENCODER.encode(collectionName)
         ]);
-        const key = await importHmacKey(derivedKeys.snapshotMacKey);
-        return hmacSign(key, payload);
+        return hmacSign(derivedKeys.snapshotMacHmacKey, payload);
     }
     async generatePatchMac(keyData, snapshotMac, valueMacs, version, collectionName) {
         const derivedKeys = await this.deriveKeys(keyData);
@@ -120,8 +130,7 @@ export class WaAppStateCrypto {
             intToBytes(8, version),
             TEXT_ENCODER.encode(collectionName)
         ]);
-        const key = await importHmacKey(derivedKeys.patchMacKey);
-        return hmacSign(key, payload);
+        return hmacSign(derivedKeys.patchMacHmacKey, payload);
     }
     async ltHashAdd(base, addValues) {
         return this.ltHashApply(base, addValues, (left, right) => left + right);
@@ -175,12 +184,11 @@ export class WaAppStateCrypto {
         out.set(keyId, 1);
         return out;
     }
-    async generateValueMac(valueMacKey, associatedData, cipherWithIv) {
+    async generateValueMac(valueMacHmacKey, associatedData, cipherWithIv) {
         const octetLength = new Uint8Array(APP_STATE_MAC_OCTET_LENGTH);
         octetLength[octetLength.length - 1] = associatedData.byteLength & 0xff;
-        const key = await importHmacSha512Key(valueMacKey);
-        const full = await hmacSign(key, concatBytes([associatedData, cipherWithIv, octetLength]));
-        return full.slice(0, APP_STATE_VALUE_MAC_LENGTH);
+        const full = await hmacSign(valueMacHmacKey, concatBytes([associatedData, cipherWithIv, octetLength]));
+        return full.subarray(0, APP_STATE_VALUE_MAC_LENGTH);
     }
     touchDerivedKeysCacheEntry(cacheKey, keys) {
         if (this.derivedKeysCacheMaxSize <= 0) {