This repository has been archived by the owner on Mar 27, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 162
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Legacy encrypt (current aries RFC 19), compatible with ACA-Py
Closes #139 Signed-off-by: Filip Burlacu <[email protected]>
- Loading branch information
Filip Burlacu
committed
Sep 19, 2019
1 parent
fe806bf
commit 9b358b5
Showing
6 changed files
with
695 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,226 @@ | ||
| /* | ||
| Copyright SecureKey Technologies Inc. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package authcrypt | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "crypto/rand" | ||
| "crypto/sha512" | ||
| "encoding/json" | ||
| "fmt" | ||
|
|
||
| "github.com/agl/ed25519/extra25519" | ||
| "golang.org/x/crypto/blake2b" | ||
| "golang.org/x/crypto/nacl/box" | ||
|
|
||
| "golang.org/x/crypto/ed25519" | ||
|
|
||
| "golang.org/x/crypto/chacha20poly1305" | ||
| errors "golang.org/x/xerrors" | ||
| ) | ||
|
|
||
| type privateEd25519 [ed25519.PrivateKeySize]byte | ||
| type publicEd25519 [ed25519.PublicKeySize]byte | ||
|
|
||
| type keyPairEd25519 struct { | ||
| priv *privateEd25519 | ||
| pub *publicEd25519 | ||
| } | ||
|
|
||
| // CurveKeySize is the size of public and private Curve25519 keys in bytes | ||
| const CurveKeySize int = 32 | ||
|
|
||
| type privateCurve25519 [CurveKeySize]byte | ||
| type publicCurve25519 [CurveKeySize]byte | ||
|
|
||
| type keyPairCurve25519 struct { | ||
| priv *privateCurve25519 | ||
| pub *publicCurve25519 | ||
| } | ||
|
|
||
| // contentEncryption represents a content encryption algorithm. | ||
| type contentEncryption string | ||
|
|
||
| // C20P Chacha20Poly1035 algorithm | ||
| const C20P = contentEncryption("C20P") // Chacha20 encryption + Poly1035 authenticator cipher (96 bits nonce) | ||
|
|
||
| // XC20P XChacha20Poly1035 algorithm | ||
| const XC20P = contentEncryption("XC20P") // XChacha20 encryption + Poly1035 authenticator cipher (192 bits nonce) | ||
|
|
||
| // Crypter represents an Authcrypt Encrypter (Decrypter) that outputs/reads legacy Aries envelopes | ||
| type Crypter struct { | ||
| sender keyPairEd25519 | ||
| recipients []*publicEd25519 | ||
| alg contentEncryption | ||
| nonceSize int | ||
| } | ||
|
|
||
| // New will create a Crypter that encrypts messages using the legacy Aries format | ||
| // Note: legacy crypter does not support XChacha20Poly1035 (XC20P), only Chacha20Poly1035 (C20P) | ||
| func New(sender keyPairEd25519, recipients []*publicEd25519, alg contentEncryption) (*Crypter, error) { | ||
| var nonceSize int | ||
| switch alg { | ||
| case C20P: | ||
| nonceSize = chacha20poly1305.NonceSize | ||
| default: | ||
| return nil, errors.New(fmt.Sprintf("Encryption algorithm '%s' not supported", alg)) | ||
| } | ||
|
|
||
| if len(recipients) == 0 { | ||
| return nil, errors.New("empty recipients keys, must have at least one recipient") | ||
| } | ||
| var recipientsKey []*publicEd25519 | ||
| recipientsKey = append(recipientsKey, recipients...) | ||
|
|
||
| c := &Crypter{ | ||
| sender: sender, | ||
| recipients: recipientsKey, | ||
| alg: alg, | ||
| nonceSize: nonceSize, | ||
| } | ||
|
|
||
| if !isKeyPairValid(sender) { | ||
| return nil, errors.New(fmt.Sprintf( | ||
| "sender keyPair not supported, it must have a %d byte private key and %d byte public key.", | ||
| ed25519.PrivateKeySize, | ||
| ed25519.PublicKeySize)) | ||
| } | ||
|
|
||
| return c, nil | ||
| } | ||
|
|
||
| func isKeyPairValid(kp keyPairEd25519) bool { | ||
| if kp.priv == nil || kp.pub == nil { | ||
| return false | ||
| } | ||
|
|
||
| return true | ||
| } | ||
|
|
||
| // Envelope is the full payload envelope for the JSON message | ||
| type Envelope struct { | ||
| Protected string `json:"protected,omitempty"` | ||
| IV string `json:"iv,omitempty"` | ||
| CipherText string `json:"ciphertext,omitempty"` | ||
| Tag string `json:"tag,omitempty"` | ||
| } | ||
|
|
||
| // Protected is the protected header of the JSON envelope | ||
| type Protected struct { | ||
| Enc string `json:"enc,omitempty"` | ||
| Typ string `json:"typ,omitempty"` | ||
| Alg string `json:"alg,omitempty"` | ||
| Recipients []Recipient `json:"recipients,omitempty"` | ||
| } | ||
|
|
||
| // Recipient holds the data for a recipient in the envelope header | ||
| type Recipient struct { | ||
| EncryptedKey string `json:"encrypted_key,omitempty"` | ||
| Header RecipientHeader `json:"header,omitempty"` | ||
| } | ||
|
|
||
| // RecipientHeader holds the header data for a recipient | ||
| type RecipientHeader struct { | ||
| KID string `json:"kid,omitempty"` | ||
| Sender string `json:"sender,omitempty"` | ||
| IV string `json:"iv,omitempty"` | ||
| } | ||
|
|
||
| // publicEd25519toCurve25519 takes an Ed25519 public key and provides the corresponding Curve25519 public key | ||
| // This function wraps PublicKeyToCurve25519 from Adam Langley's ed25519 repo: github.com/agl/ed25519 | ||
| func publicEd25519toCurve25519(pub *publicEd25519) (*publicCurve25519, error) { | ||
| pkOut := new([32]byte) | ||
| success := extra25519.PublicKeyToCurve25519(pkOut, (*[32]byte)(pub)) | ||
| if !success { | ||
| return nil, errors.New("failed to convert public key") | ||
| } | ||
| return (*publicCurve25519)(pkOut), nil | ||
| } | ||
|
|
||
| // TODO: consider wrapping agl's secret key conversion instead of reimplementing | ||
|
|
||
| // secretEd25519toCurve25519 converts a secret key from Ed25519 to curve25519 format | ||
| // Made with reference to https://github.com/agl/ed25519/blob/master/extra25519/extra25519.go and | ||
| // https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_sign/ed25519/ref10/keypair.c#L70 | ||
| func secretEd25519toCurve25519(priv *privateEd25519) (*privateCurve25519, error) { | ||
| hasher := sha512.New() | ||
| _, err := hasher.Write(priv[:32]) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| hash := hasher.Sum(nil) | ||
|
|
||
| hash[0] &= 248 // clr lower 3 bits | ||
| hash[31] &= 127 // clr upper 1 bit | ||
| hash[31] |= 64 // set 6th bit | ||
|
|
||
| out := new([CurveKeySize]byte) | ||
| copy(out[:], hash) | ||
| return (*privateCurve25519)(out), nil | ||
| } | ||
|
|
||
| func makeNonce(pub1, pub2 []byte) ([]byte, error) { | ||
| var nonce [24]byte | ||
| // generate an equivalent nonce to libsodium's (see link above) | ||
| nonceWriter, err := blake2b.New(24, nil) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| _, err = nonceWriter.Write(pub1) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| _, err = nonceWriter.Write(pub2) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| nonceOut := nonceWriter.Sum(nil) | ||
| copy(nonce[:], nonceOut) | ||
|
|
||
| return nonce[:], nil | ||
| } | ||
|
|
||
| // TODO dupe of jwe/authcrypt encryptOID, refactor out | ||
|
|
||
| // sodiumBoxSeal will encrypt a msg (in the case of this package, it will be | ||
| // an ephemeral key concatenated to the sender's public key) using the | ||
| // recipient's pubKey, this is equivalent to libsodium's C function: crypto_box_seal() | ||
| // https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes#usage | ||
| func sodiumBoxSeal(msg []byte, recPub *publicCurve25519) ([]byte, error) { | ||
| var nonce [24]byte | ||
| // generate ephemeral curve25519 asymmetric keys | ||
| epk, esk, err := box.GenerateKey(rand.Reader) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| // generate an equivalent nonce to libsodium's (see link above) | ||
| nonceSlice, err := makeNonce(epk[:], recPub[:]) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| copy(nonce[:], nonceSlice) | ||
|
|
||
| var out = make([]byte, len(epk)) | ||
| copy(out, epk[:]) | ||
|
|
||
| // now seal the msg with the ephemeral key, nonce and recPub (which is recipient's publicKey) | ||
| ret := box.Seal(out, msg, &nonce, (*[32]byte)(recPub), esk) | ||
|
|
||
| return ret, nil | ||
| } | ||
|
|
||
| func prettyPrint(msg []byte) (string, error) { | ||
| var prettyJSON bytes.Buffer | ||
| err := json.Indent(&prettyJSON, msg, "", "\t") | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return prettyJSON.String(), nil | ||
| } |
Oops, something went wrong.