research: Barebones x3dh

script/research/x3dh/.gitignore

@@ -0,0 +1,2 @@
+target/*
+Cargo.lock

script/research/x3dh/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "x3dh"
+version = "0.1.0"
+edition = "2021"
+
+[workspace]
+
+[dependencies]
+anyhow = "1.0.56"
+sha2 = "0.10.6"
+rand = "0.7.3"
+crypto_api_chachapoly = "0.5.0"
+curve25519-dalek = "3.2.1"
+ed25519-dalek = "1.0.1"
+x25519-dalek = "1.2.0"

script/research/x3dh/src/hkdf.rs

@@ -0,0 +1,111 @@
+//! https://tools.ietf.org/html/rfc5869
+use core::fmt;
+use sha2::{
+    digest::{crypto_common::BlockSizeUser, typenum::Unsigned, Output, OutputSizeUser, Update},
+    Digest,
+};
+
+use super::hmac::Hmac;
+
+#[derive(Copy, Clone, Debug)]
+pub struct InvalidPrkLength;
+
+impl fmt::Display for InvalidPrkLength {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.write_str("invalid pseudorandom key length, too short")
+    }
+}
+
+// Structure for InvalidLength, used for output error handling.
+#[derive(Copy, Clone, Debug)]
+pub struct InvalidLength;
+
+impl fmt::Display for InvalidLength {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.write_str("invalid number of blocks, too large output")
+    }
+}
+
+#[derive(Clone)]
+pub struct HkdfExtract<H: Digest + BlockSizeUser + Clone> {
+    hmac: Hmac<H>,
+}
+
+impl<H: Digest + BlockSizeUser + Clone> HkdfExtract<H> {
+    pub fn new(salt: &[u8]) -> Self {
+        Self { hmac: Hmac::<H>::new_from_slice(salt) }
+    }
+
+    pub fn input_ikm(&mut self, ikm: &[u8]) {
+        self.hmac.update(ikm);
+    }
+
+    pub fn finalize(self) -> (Output<H>, Hkdf<H>) {
+        let prk = self.hmac.finalize();
+        let hkdf = Hkdf::from_prk(&prk).expect("PRK size is correct");
+        (prk, hkdf)
+    }
+}
+
+#[derive(Clone)]
+pub struct Hkdf<H: Digest + BlockSizeUser + Clone> {
+    hmac: Hmac<H>,
+}
+
+impl<H: Digest + BlockSizeUser + Clone> Hkdf<H> {
+    pub fn new(salt: &[u8], ikm: &[u8]) -> Self {
+        let (_, hkdf) = Self::extract(salt, ikm);
+        hkdf
+    }
+
+    pub fn extract(salt: &[u8], ikm: &[u8]) -> (Output<H>, Self) {
+        let mut extract_ctx = HkdfExtract::new(salt);
+        extract_ctx.input_ikm(ikm);
+        extract_ctx.finalize()
+    }
+
+    pub fn from_prk(prk: &[u8]) -> Result<Self, InvalidPrkLength> {
+        if prk.len() < <H as OutputSizeUser>::OutputSize::to_usize() {
+            return Err(InvalidPrkLength)
+        }
+
+        Ok(Self { hmac: Hmac::<H>::new_from_slice(prk) })
+    }
+
+    pub fn expand(&self, info: &[u8], okm: &mut [u8]) -> Result<(), InvalidLength> {
+        self.expand_multi_info(&[info], okm)
+    }
+
+    pub fn expand_multi_info(&self, infos: &[&[u8]], okm: &mut [u8]) -> Result<(), InvalidLength> {
+        let mut prev: Option<Output<H>> = None;
+
+        let chunk_len = <H as OutputSizeUser>::OutputSize::USIZE;
+        if okm.len() > chunk_len * 255 {
+            return Err(InvalidLength)
+        }
+
+        for (block_n, block) in okm.chunks_mut(chunk_len).enumerate() {
+            let mut hmac = self.hmac.clone();
+
+            if let Some(ref prev) = prev {
+                hmac.update(prev);
+            }
+
+            // Feed in the info components in sequence. This is equivalent
+            // to feeding in the concatenation of all the info components.
+            for info in infos {
+                hmac.update(info);
+            }
+
+            hmac.update(&[block_n as u8 + 1]);
+
+            let output = hmac.finalize();
+            let block_len = block.len();
+            block.copy_from_slice(&output[..block_len]);
+
+            prev = Some(output);
+        }
+
+        Ok(())
+    }
+}

script/research/x3dh/src/hmac.rs

@@ -0,0 +1,88 @@
+//! HMAC simplementation.
+use sha2::{
+    digest::{
+        core_api::Block, crypto_common::BlockSizeUser, Digest, FixedOutput, Output, OutputSizeUser,
+        Update,
+    },
+    Sha256,
+};
+
+const IPAD: u8 = 0x36;
+const OPAD: u8 = 0x5C;
+
+fn get_der_key<D: Digest + BlockSizeUser + Clone>(key: &[u8]) -> Block<D> {
+    let mut der_key = Block::<D>::default();
+    // The key that HMAC processes must be the same as the block size
+    // of the underlying hash function. If the provided key is smaller
+    // than that, we just pad it with zeroes. If it's larger, we hash
+    // it and then pad it with zeroes.
+    if key.len() <= der_key.len() {
+        der_key[..key.len()].copy_from_slice(key);
+        return der_key
+    }
+
+    let hash = Sha256::digest(key);
+    // All commonly used hash functions have block size bigger than
+    // output hash size, but to be extra rigorous we handle the
+    // potential uncommon cases as well. The condition is calculated
+    // at compile time, so this branch gets removed from final binary.
+    if hash.len() <= der_key.len() {
+        der_key[..hash.len()].copy_from_slice(&hash);
+    } else {
+        let n = der_key.len();
+        der_key.copy_from_slice(&hash[..n]);
+    }
+
+    der_key
+}
+
+#[derive(Clone)]
+pub struct Hmac<D: Digest + BlockSizeUser + Clone> {
+    digest: D,
+    opad_key: Block<D>,
+}
+
+impl<D: Digest + BlockSizeUser + Clone> Hmac<D> {
+    #[inline]
+    pub fn new_from_slice(key: &[u8]) -> Self {
+        let der_key = get_der_key::<D>(key);
+
+        let mut ipad_key = der_key.clone();
+        for b in ipad_key.iter_mut() {
+            *b ^= IPAD;
+        }
+
+        let mut digest = D::new();
+        digest.update(&ipad_key);
+
+        let mut opad_key = der_key;
+        for b in opad_key.iter_mut() {
+            *b ^= OPAD;
+        }
+
+        Self { digest, opad_key }
+    }
+
+    pub fn finalize(self) -> Output<D> {
+        Output::<D>::clone_from_slice(&self.finalize_fixed())
+    }
+}
+
+impl<D: Digest + BlockSizeUser + Clone> FixedOutput for Hmac<D> {
+    fn finalize_into(self, out: &mut Output<Self>) {
+        let mut h = D::new();
+        h.update(&self.opad_key);
+        h.update(&self.digest.finalize());
+        h.finalize_into(out);
+    }
+}
+
+impl<D: Digest + BlockSizeUser + Clone> OutputSizeUser for Hmac<D> {
+    type OutputSize = D::OutputSize;
+}
+
+impl<D: Digest + BlockSizeUser + Clone> Update for Hmac<D> {
+    fn update(&mut self, data: &[u8]) {
+        self.digest.update(data);
+    }
+}

script/research/x3dh/src/main.rs

@@ -0,0 +1,155 @@
+//! https://signal.org/docs/specifications/x3dh/x3dh.pdf
+use anyhow::Result;
+use crypto_api_chachapoly::ChachaPolyIetf;
+use rand::rngs::OsRng;
+use sha2::Sha256;
+use x25519_dalek::{
+    EphemeralSecret, PublicKey as X25519PublicKey, StaticSecret as X25519SecretKey,
+};
+
+mod hkdf;
+use hkdf::Hkdf;
+mod hmac;
+mod xeddsa;
+use xeddsa::{XeddsaSigner, XeddsaVerifier};
+
+// 3.2 Publishing keys
+// Bob only needs to upload his identity key to the server once.
+// However, Bob may upload new one-time prekeys at other times.
+// Bob will also upload a new signed prekey and prekey signature
+// at some interval (e.g. once a week/month).
+// The new signed prekey and prekey signature will replace old values.
+struct Keyset {
+    pub identity_key: X25519PublicKey,
+    pub signed_prekey: X25519PublicKey,
+    pub prekey_signature: [u8; 64],
+    //pub onetime_prekeys: Vec<X25519PublicKey>,
+}
+
+struct InitialMessage {
+    pub identity_key: X25519PublicKey,
+    pub ephemeral_key: X25519PublicKey,
+    pub prekeys_used: Vec<X25519PublicKey>,
+    pub ciphertext: Vec<u8>,
+}
+
+fn main() -> Result<()> {
+    let mut server: Vec<Keyset> = vec![];
+
+    // Alice's identity key
+    let alice_ik_secret = X25519SecretKey::new(&mut OsRng);
+    let alice_ik_public = X25519PublicKey::from(&alice_ik_secret);
+
+    // Bob's identity key
+    let bob_ik_secret = X25519SecretKey::new(&mut OsRng);
+    let bob_ik_public = X25519PublicKey::from(&bob_ik_secret);
+
+    // Bob's signed prekey
+    let bob_spk_secret = X25519SecretKey::new(&mut OsRng);
+    let bob_spk_public = X25519PublicKey::from(&bob_spk_secret);
+
+    // Bob's prekey signature
+    let nonce = [0_u8; 64];
+    let bob_spk_signature = bob_ik_secret.xeddsa_sign(&bob_spk_public.to_bytes(), &nonce);
+
+    // Bob uploads his keyset to the server
+    // TODO: onetime_prekeys
+    let keyset = Keyset {
+        identity_key: bob_ik_public,
+        signed_prekey: bob_spk_public,
+        prekey_signature: bob_spk_signature,
+        //onetime_prekeys: vec![],
+    };
+    server.push(keyset);
+
+    // Alice contacts the server and fetches a "prekey bundle" of Bob's keys:
+    // NOTE: Only one onetime_prekey should be in the bundle.
+    let bundle = &server[0];
+
+    // Alice verifies the prekey signature and aborts if verification fails:
+    // NOTE: Should Alice have Bob's key from somewhere else?
+    // NOTE: Or should there be an additional key that links to the keyset?
+    assert!(bundle
+        .identity_key
+        .xeddsa_verify(&bundle.signed_prekey.to_bytes(), &bundle.prekey_signature));
+
+    // Then Alice creates an ephemeral key pair with the public key EK_A
+    let ek_a_secret = X25519SecretKey::new(&mut OsRng);
+    let ek_a_public = X25519PublicKey::from(&ek_a_secret);
+
+    // If the bundle does not contain a one-time prekey, Alice calculates:
+    // DH1 = DH(IK_A, SPK_B)
+    // DH2 = DH(EK_A, IK_B)
+    // DH3 = DH(EK_A, SPK_B)
+    // SK = KDF(DH1 || DH2 || DH3)
+    // If the bundle _does_ contain a one-time prekey, an additional DH is
+    // calculated:
+    // DH4 = DH(EK_A, OPK_B)
+    // SK = KDF(DH1 || DH2 || DH3 || DH4)
+    let dh1 = alice_ik_secret.diffie_hellman(&bundle.signed_prekey);
+    let dh2 = ek_a_secret.diffie_hellman(&bundle.identity_key);
+    let dh3 = ek_a_secret.diffie_hellman(&bundle.signed_prekey);
+
+    let mut ikm = vec![0xFF; 32];
+    ikm.extend_from_slice(&dh1.to_bytes());
+    ikm.extend_from_slice(&dh2.to_bytes());
+    ikm.extend_from_slice(&dh3.to_bytes());
+
+    let info = b"x3dh_info";
+    let salt = [0_u8; 32];
+    let hkdf = Hkdf::<Sha256>::new(&salt, &ikm);
+    let mut sk = [0u8; 32];
+    hkdf.expand(&info.to_vec(), &mut sk).unwrap();
+
+    // Alice then calculates an "associated data" byte sequence AD
+    // that contains:
+    // AD = Encode(IK_A) || Encode(IK_B)
+    // Alice may optionally append additional information to AD
+    let mut ad = Vec::with_capacity(64);
+    ad.extend_from_slice(&alice_ik_public.to_bytes());
+    ad.extend_from_slice(&bob_ik_public.to_bytes());
+
+    let first_msg = b"hi";
+    const AEAD_TAG_SIZE: usize = 16;
+    let mut ciphertext = vec![0_u8; first_msg.len() + AEAD_TAG_SIZE];
+    assert_eq!(
+        ChachaPolyIetf::aead_cipher()
+            .seal_to(&mut ciphertext, first_msg, &ad, &sk, &[0u8; 12])
+            .unwrap(),
+        first_msg.len() + AEAD_TAG_SIZE
+    );
+
+    // Alice then sends Bob an initial message:
+    let initial_msg = InitialMessage {
+        identity_key: alice_ik_public,
+        ephemeral_key: ek_a_public,
+        prekeys_used: vec![],
+        ciphertext,
+    };
+
+    // Bob receives the initial message and repeats the DH and KDF
+    let dh1 = bob_spk_secret.diffie_hellman(&initial_msg.identity_key);
+    let dh2 = bob_ik_secret.diffie_hellman(&initial_msg.ephemeral_key);
+    let dh3 = bob_spk_secret.diffie_hellman(&initial_msg.ephemeral_key);
+
+    let mut ikm = vec![0xFF; 32];
+    ikm.extend_from_slice(&dh1.to_bytes());
+    ikm.extend_from_slice(&dh2.to_bytes());
+    ikm.extend_from_slice(&dh3.to_bytes());
+
+    let info = b"x3dh_info";
+    let salt = [0_u8; 32];
+    let hkdf = Hkdf::<Sha256>::new(&salt, &ikm);
+    let mut sk2 = [0u8; 32];
+    hkdf.expand(&info.to_vec(), &mut sk2).unwrap();
+    assert_eq!(sk, sk2);
+
+    let mut plaintext = vec![0; initial_msg.ciphertext.len() - AEAD_TAG_SIZE];
+    ChachaPolyIetf::aead_cipher()
+        .open_to(&mut plaintext, &initial_msg.ciphertext, &ad, &sk2, &[0u8; 12])
+        .unwrap();
+
+    assert_eq!(plaintext, first_msg);
+
+    Ok(())
+}

script/research/x3dh/src/xeddsa.rs

@@ -0,0 +1,120 @@
+//! Taken from https://docs.rs/ockam_vault/latest/src/ockam_vault/xeddsa.rs.html
+//! XEdDSA according to <https://signal.org/docs/specifications/xeddsa/#xeddsa>
+use curve25519_dalek::{
+    constants::ED25519_BASEPOINT_POINT, montgomery::MontgomeryPoint, scalar::Scalar,
+};
+use ed25519_dalek::{Digest, PublicKey as Ed25519PublicKey, Sha512, Signature, Verifier};
+use x25519_dalek::{PublicKey as X25519PublicKey, StaticSecret as X25519SecretKey};
+
+pub trait XeddsaSigner {
+    fn xeddsa_sign(&self, msg: &[u8], nonce: &[u8; 64]) -> [u8; 64];
+}
+
+pub trait XeddsaVerifier {
+    fn xeddsa_verify(&self, msg: &[u8], nonce: &[u8; 64]) -> bool;
+}
+
+impl XeddsaSigner for X25519SecretKey {
+    fn xeddsa_sign(&self, msg: &[u8], nonce: &[u8; 64]) -> [u8; 64] {
+        //
+        // PREPARATION OF THE KEY MATERIAL
+        //
+        // This algorithm to sign data using a Curve25519 keypair has to
+        // tackle two issues. The first issue is that the conversion of
+        // a Curve25519 public key to an Ed25519 public key is not unique
+        // when only having access to the u coordinate of the Curve25519
+        // public key, which is the case with the serialization format
+        // commonly used. In fact the conversion is unique by the sign of
+        // the Ed25519 public key x coordinate. This signing algorithm
+        // "solves" the problem by modifying the private key so that the
+        // sign of the resulting Ed25519 public key is always zero.
+
+        // x25519-dalek private keys are already clamped, so just compute
+        // the Ed25519 public key from the Curve25519 private key.
+        let scalar_k = Scalar::from_bits(self.to_bytes());
+        let ep = ED25519_BASEPOINT_POINT * scalar_k;
+        let mut ce = ep.compress();
+        let sign = ce.0[31] >> 7;
+        // Set the sign bit to zero after adjusting the private key
+        ce.0[31] &= 0x7F; // A.s = 0
+
+        // Compute the negative secret key
+
+        // If the sign bit of the calculated Ed25519 public key is zero,
+        // the private key doesn't have to be touched. If the sign bit
+        // is one, the private key has to be inverted prior to using it.
+        let k = if sign == 1 { -scalar_k } else { scalar_k };
+
+        //
+        // SIGNING
+        //
+        // The second problem this algorithm has to tackle is that
+        // Ed25519 signature algorithms don't use the private scalar
+        // directly, but rather use a seed to derive other data from.
+        // To create signatures compatible with Ed25519, a modified
+        // version of the signing algorithm is required that does not
+        // depend on a seed.
+        // r = hash1(a || M || Z) (mod q)
+        let mut hash_padding = [0xff, 32];
+        hash_padding[0] = 0xfe;
+        let mut hasher = Sha512::new();
+        hasher.update(hash_padding);
+        hasher.update(k.as_bytes());
+        hasher.update(msg);
+        hasher.update(nonce.as_ref());
+        let r = Scalar::from_hash(hasher);
+
+        // R = rB
+        let cap_r = (ED25519_BASEPOINT_POINT * r).compress();
+
+        // h = hash(R || A || M) (mod q)
+        hasher = Sha512::new();
+        hasher.update(cap_r.as_bytes());
+        hasher.update(ce.as_bytes());
+        hasher.update(msg);
+        let h = Scalar::from_hash(hasher);
+
+        // s = r + ha (mod q)
+        let s = r + h * k;
+
+        // return R || s
+        let mut sig = [0u8; 64];
+        sig[..32].copy_from_slice(cap_r.as_bytes());
+        sig[32..].copy_from_slice(s.as_bytes());
+        sig
+    }
+}
+
+impl XeddsaVerifier for X25519PublicKey {
+    fn xeddsa_verify(&self, msg: &[u8], sig: &[u8; 64]) -> bool {
+        let pt = MontgomeryPoint(self.to_bytes());
+
+        if let Some(edwards) = pt.to_edwards(0) {
+            if let Ok(pk) = Ed25519PublicKey::from_bytes(&edwards.compress().to_bytes()) {
+                let sig = Signature::from_bytes(sig).unwrap();
+                return pk.verify(msg, &sig).is_ok()
+            }
+        }
+
+        false
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn xeddsa_test() {
+        let nonce = [0u8; 64];
+        let msg = [0u8; 200];
+        let mut privkey = [0u8; 32];
+        privkey[8] = 189;
+
+        let xsecret_key = X25519SecretKey::from(privkey);
+        let xpublic_key = X25519PublicKey::from(&xsecret_key);
+
+        let sig = xsecret_key.xeddsa_sign(&msg, &nonce);
+        assert!(xpublic_key.xeddsa_verify(&msg, &sig));
+    }
+}