Kaladaran/briar
0
0
Fork 0
mirror of https://code.briarproject.org/briar/briar.git synced 2026-02-20 22:59:54 +01:00
Code Issues Projects Releases Wiki Activity

Include namespaced labels in crypto operations.

Browse Source
This commit is contained in:
akwizgran
2017-11-27 12:02:58 +00:00
parent ddea031cbf
commit 9f7021acd3
17 changed files with 468 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactExchangeTask.java
View File

@@ -12,6 +12,27 @@ import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
@NotNullByDefault @NotNullByDefault
public interface ContactExchangeTask { public interface ContactExchangeTask {
/**
* Label for deriving Alice's header key from the master secret.
*/
String ALICE_KEY_LABEL =
"org.briarproject.bramble.contact/ALICE_HEADER_KEY";
/**
* Label for deriving Bob's header key from the master secret.
*/
String BOB_KEY_LABEL = "org.briarproject.bramble.contact/BOB_HEADER_KEY";
/**
* Label for deriving Alice's key binding nonce from the master secret.
*/
String ALICE_NONCE_LABEL = "org.briarproject.bramble.contact/ALICE_NONCE";
/**
* Label for deriving Bob's key binding nonce from the master secret.
*/
String BOB_NONCE_LABEL = "org.briarproject.bramble.contact/BOB_NONCE";
/** /**
* Exchanges contact information with a remote peer. * Exchanges contact information with a remote peer.
*/ */

120
bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoComponent.java
View File

@@ -27,95 +27,74 @@ public interface CryptoComponent {
KeyParser getMessageKeyParser(); KeyParser getMessageKeyParser();
/** /**
* Derives a stream header key from the given master secret. * Derives another secret key from the given secret key.
* @param alice whether the key is for use by Alice or Bob. *
* @param label a namespaced label indicating the purpose of the derived
* key, to prevent it from being repurposed or colliding with a key derived
* for another purpose
*/ */
SecretKey deriveHeaderKey(SecretKey master, boolean alice); SecretKey deriveKey(String label, SecretKey k, byte[]... inputs);
/** /**
* Derives a message authentication code key from the given master secret. * Derives a nonce from the given secret key that can be used for key
* @param alice whether the key is for use by Alice or Bob. * binding.
*
* @param label a namespaced label indicating the purpose of this nonce,
* to prevent it from being repurposed or colliding with a nonce derived
* for another purpose
*/ */
SecretKey deriveMacKey(SecretKey master, boolean alice); byte[] deriveKeyBindingNonce(String label, SecretKey k);
/**
* Derives a nonce from the given master secret for one of the parties to
* sign.
* @param alice whether the nonce is for use by Alice or Bob.
*/
byte[] deriveSignatureNonce(SecretKey master, boolean alice);
/** /**
* Derives a commitment to the provided public key. * Derives a commitment to the provided public key.
* <p/> * <p/>
* Part of BQP. * Used by the key exchange protocol.
* *
* @param publicKey the public key * @param publicKey the public key
* @return the commitment to the provided public key. * @return the commitment to the provided public key.
*/ */
byte[] deriveKeyCommitment(byte[] publicKey); byte[] deriveKeyCommitment(PublicKey publicKey);
/** /**
* Derives a common shared secret from two public keys and one of the * Derives a common shared secret from two public keys and one of the
* corresponding private keys. * corresponding private keys.
* <p/>
* Part of BQP.
* *
* @param theirPublicKey the ephemeral public key of the remote party * @param label a namespaced label indicating the purpose of this shared
* @param ourKeyPair our ephemeral keypair * secret, to prevent it from being repurposed or colliding with a shared
* @param alice true if ourKeyPair belongs to Alice * secret derived for another purpose
* @param theirPublicKey the public key of the remote party
* @param ourKeyPair the key pair of the local party
* @param alice true if the local party is Alice
* @return the shared secret * @return the shared secret
*/ */
SecretKey deriveSharedSecret(byte[] theirPublicKey, KeyPair ourKeyPair, SecretKey deriveSharedSecret(String label, PublicKey theirPublicKey,
boolean alice) throws GeneralSecurityException; KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException;
/** /**
* Derives the content of a confirmation record. * Derives the content of a confirmation record.
* <p/> * <p/>
* Part of BQP. * Used by the key exchange protocol.
* *
* @param sharedSecret the common shared secret * @param sharedSecret the common shared secret
* @param theirPayload the commit payload from the remote party * @param theirPayload the key exchange payload of the remote party
* @param ourPayload the commit payload we sent * @param ourPayload the key exchange payload of the local party
* @param theirPublicKey the ephemeral public key of the remote party * @param theirPublicKey the ephemeral public key of the remote party
* @param ourKeyPair our ephemeral keypair * @param ourKeyPair our ephemeral key pair of the local party
* @param alice true if ourKeyPair belongs to Alice * @param alice true if the local party is Alice
* @param aliceRecord true if the confirmation record is for use by Alice * @param aliceRecord true if the confirmation record is for use by Alice
* @return the confirmation record * @return the confirmation record
*/ */
byte[] deriveConfirmationRecord(SecretKey sharedSecret, byte[] deriveConfirmationRecord(SecretKey sharedSecret,
byte[] theirPayload, byte[] ourPayload, byte[] theirPayload, byte[] ourPayload,
byte[] theirPublicKey, KeyPair ourKeyPair, PublicKey theirPublicKey, KeyPair ourKeyPair,
boolean alice, boolean aliceRecord); boolean alice, boolean aliceRecord);
/**
* Derives a master secret from the given shared secret.
* <p/>
* Part of BQP.
*
* @param sharedSecret the common shared secret
* @return the master secret
*/
SecretKey deriveMasterSecret(SecretKey sharedSecret);
/**
* Derives a master secret from two public keys and one of the corresponding
* private keys.
* <p/>
* This is a helper method that calls
* deriveMasterSecret(deriveSharedSecret(theirPublicKey, ourKeyPair, alice))
*
* @param theirPublicKey the ephemeral public key of the remote party
* @param ourKeyPair our ephemeral keypair
* @param alice true if ourKeyPair belongs to Alice
* @return the shared secret
*/
SecretKey deriveMasterSecret(byte[] theirPublicKey, KeyPair ourKeyPair,
boolean alice) throws GeneralSecurityException;
/** /**
* Derives initial transport keys for the given transport in the given * Derives initial transport keys for the given transport in the given
* rotation period from the given master secret. * rotation period from the given master secret.
* <p/>
* Used by the transport security protocol.
*
* @param alice whether the keys are for use by Alice or Bob. * @param alice whether the keys are for use by Alice or Bob.
*/ */
TransportKeys deriveTransportKeys(TransportId t, SecretKey master, TransportKeys deriveTransportKeys(TransportId t, SecretKey master,
@@ -124,18 +103,25 @@ public interface CryptoComponent {
/** /**
* Rotates the given transport keys to the given rotation period. If the * Rotates the given transport keys to the given rotation period. If the
* keys are for a future rotation period they are not rotated. * keys are for a future rotation period they are not rotated.
* <p/>
* Used by the transport security protocol.
*/ */
TransportKeys rotateTransportKeys(TransportKeys k, long rotationPeriod); TransportKeys rotateTransportKeys(TransportKeys k, long rotationPeriod);
/** Encodes the pseudo-random tag that is used to recognise a stream. */ /**
* Encodes the pseudo-random tag that is used to recognise a stream.
* <p/>
* Used by the transport security protocol.
*/
void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion, void encodeTag(byte[] tag, SecretKey tagKey, int protocolVersion,
long streamNumber); long streamNumber);
/** /**
* Signs the given byte[] with the given ECDSA private key. * Signs the given byte[] with the given ECDSA private key.
* *
* @param label A label specific to this signature * @param label a namespaced label indicating the purpose of this
* to ensure that the signature cannot be repurposed * signature, to prevent it from being repurposed or colliding with a
* signature created for another purpose
*/ */
byte[] sign(String label, byte[] toSign, byte[] privateKey) byte[] sign(String label, byte[] toSign, byte[] privateKey)
throws GeneralSecurityException; throws GeneralSecurityException;
@@ -153,8 +139,9 @@ public interface CryptoComponent {
* Verifies that the given signature is valid for the signed data * Verifies that the given signature is valid for the signed data
* and the given ECDSA public key. * and the given ECDSA public key.
* *
* @param label A label that was specific to this signature * @param label a namespaced label indicating the purpose of this
* to ensure that the signature cannot be repurposed * signature, to prevent it from being repurposed or colliding with a
* signature created for another purpose
* @return true if the signature was valid, false otherwise. * @return true if the signature was valid, false otherwise.
*/ */
boolean verify(String label, byte[] signedData, byte[] publicKey, boolean verify(String label, byte[] signedData, byte[] publicKey,
@@ -175,23 +162,22 @@ public interface CryptoComponent {
* Returns the hash of the given inputs. The inputs are unambiguously * Returns the hash of the given inputs. The inputs are unambiguously
* combined by prefixing each input with its length. * combined by prefixing each input with its length.
* *
* @param label A label specific to this hash to ensure that hashes * @param label a namespaced label indicating the purpose of this hash, to
* calculated for distinct purposes don't collide. * prevent it from being repurposed or colliding with a hash created for
* another purpose
*/ */
byte[] hash(String label, byte[]... inputs); byte[] hash(String label, byte[]... inputs);
/**
* Returns the length of hashes produced by
* the {@link CryptoComponent#hash(String, byte[]...)} method.
*/
int getHashLength();
/** /**
* Returns a message authentication code with the given key over the * Returns a message authentication code with the given key over the
* given inputs. The inputs are unambiguously combined by prefixing each * given inputs. The inputs are unambiguously combined by prefixing each
* input with its length. * input with its length.
*
* @param label a namespaced label indicating the purpose of this MAC, to
* prevent it from being repurposed or colliding with a MAC created for
* another purpose
*/ */
byte[] mac(SecretKey macKey, byte[]... inputs); byte[] mac(String label, SecretKey macKey, byte[]... inputs);
/** /**
* Encrypts and authenticates the given plaintext so it can be written to * Encrypts and authenticates the given plaintext so it can be written to

2
bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorId.java
View File

@@ -16,7 +16,7 @@ public class AuthorId extends UniqueId {
/** /**
* Label for hashing authors to calculate their identities. * Label for hashing authors to calculate their identities.
*/ */
public static final String LABEL = "org.briarproject.bramble.AUTHOR_ID"; public static final String LABEL = "org.briarproject.bramble/AUTHOR_ID";
public AuthorId(byte[] id) { public AuthorId(byte[] id) {
super(id); super(id);

19
bramble-api/src/main/java/org/briarproject/bramble/api/keyagreement/KeyAgreementConstants.java
View File

@@ -5,7 +5,7 @@ public interface KeyAgreementConstants {
/** /**
* The current version of the BQP protocol. * The current version of the BQP protocol.
*/ */
byte PROTOCOL_VERSION = 2; byte PROTOCOL_VERSION = 3;
/** /**
* The length of the record header in bytes. * The length of the record header in bytes.
@@ -22,7 +22,10 @@ public interface KeyAgreementConstants {
*/ */
int COMMIT_LENGTH = 16; int COMMIT_LENGTH = 16;
long CONNECTION_TIMEOUT = 20 * 1000; // Milliseconds /**
* The connection timeout in milliseconds.
*/
long CONNECTION_TIMEOUT = 20 * 1000;
/** /**
* The transport identifier for Bluetooth. * The transport identifier for Bluetooth.
@@ -33,4 +36,16 @@ public interface KeyAgreementConstants {
* The transport identifier for LAN. * The transport identifier for LAN.
*/ */
int TRANSPORT_ID_LAN = 1; int TRANSPORT_ID_LAN = 1;
/**
* Label for deriving the shared secret.
*/
String SHARED_SECRET_LABEL =
"org.briarproject.bramble.keyagreement/SHARED_SECRET";
/**
* Label for deriving the master secret.
*/
String MASTER_SECRET_LABEL =
"org.briarproject.bramble.keyagreement/MASTER_SECRET";
} }

2
bramble-api/src/main/java/org/briarproject/bramble/api/sync/GroupId.java
View File

@@ -15,7 +15,7 @@ public class GroupId extends UniqueId {
/** /**
* Label for hashing groups to calculate their identifiers. * Label for hashing groups to calculate their identifiers.
*/ */
public static final String LABEL = "org.briarproject.bramble.GROUP_ID"; public static final String LABEL = "org.briarproject.bramble/GROUP_ID";
public GroupId(byte[] id) { public GroupId(byte[] id) {
super(id); super(id);

2
bramble-api/src/main/java/org/briarproject/bramble/api/sync/MessageId.java
View File

@@ -16,7 +16,7 @@ public class MessageId extends UniqueId {
/** /**
* Label for hashing messages to calculate their identifiers. * Label for hashing messages to calculate their identifiers.
*/ */
public static final String LABEL = "org.briarproject.bramble.MESSAGE_ID"; public static final String LABEL = "org.briarproject.bramble/MESSAGE_ID";
public MessageId(byte[] id) { public MessageId(byte[] id) {
super(id); super(id);

14
bramble-core/src/main/java/org/briarproject/bramble/contact/ContactExchangeTaskImpl.java
View File

@@ -141,8 +141,9 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
} }
// Derive the header keys for the transport streams // Derive the header keys for the transport streams
SecretKey aliceHeaderKey = crypto.deriveHeaderKey(masterSecret, true); SecretKey aliceHeaderKey = crypto.deriveKey(ALICE_KEY_LABEL,
SecretKey bobHeaderKey = crypto.deriveHeaderKey(masterSecret, false); masterSecret);
SecretKey bobHeaderKey = crypto.deriveKey(BOB_KEY_LABEL, masterSecret);
// Create the readers // Create the readers
InputStream streamReader = InputStream streamReader =
@@ -156,8 +157,10 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
BdfWriter w = bdfWriterFactory.createWriter(streamWriter); BdfWriter w = bdfWriterFactory.createWriter(streamWriter);
// Derive the nonces to be signed // Derive the nonces to be signed
byte[] aliceNonce = crypto.deriveSignatureNonce(masterSecret, true); byte[] aliceNonce = crypto.deriveKeyBindingNonce(ALICE_NONCE_LABEL,
byte[] bobNonce = crypto.deriveSignatureNonce(masterSecret, false); masterSecret);
byte[] bobNonce = crypto.deriveKeyBindingNonce(BOB_NONCE_LABEL,
masterSecret);
// Exchange pseudonyms, signed nonces, and timestamps // Exchange pseudonyms, signed nonces, and timestamps
long localTimestamp = clock.currentTimeMillis(); long localTimestamp = clock.currentTimeMillis();
@@ -312,8 +315,7 @@ class ContactExchangeTaskImpl extends Thread implements ContactExchangeTask {
return contactId; return contactId;
} }
private void tryToClose(DuplexTransportConnection conn, private void tryToClose(DuplexTransportConnection conn, boolean exception) {
boolean exception) {
try { try {
LOG.info("Closing connection"); LOG.info("Closing connection");
conn.getReader().dispose(exception, true); conn.getReader().dispose(exception, true);

145
bramble-core/src/main/java/org/briarproject/bramble/crypto/CryptoComponentImpl.java
View File

@@ -30,7 +30,6 @@ import org.spongycastle.crypto.params.ECPrivateKeyParameters;
import org.spongycastle.crypto.params.ECPublicKeyParameters; import org.spongycastle.crypto.params.ECPublicKeyParameters;
import org.spongycastle.crypto.params.KeyParameter; import org.spongycastle.crypto.params.KeyParameter;
import java.nio.charset.Charset;
import java.security.GeneralSecurityException; import java.security.GeneralSecurityException;
import java.security.NoSuchAlgorithmException; import java.security.NoSuchAlgorithmException;
import java.security.Provider; import java.security.Provider;
@@ -65,39 +64,25 @@ class CryptoComponentImpl implements CryptoComponent {
private static final int PBKDF_SALT_BYTES = 32; // 256 bits private static final int PBKDF_SALT_BYTES = 32; // 256 bits
private static final int PBKDF_TARGET_MILLIS = 500; private static final int PBKDF_TARGET_MILLIS = 500;
private static final int PBKDF_SAMPLES = 30; private static final int PBKDF_SAMPLES = 30;
private static final int HASH_SIZE = 256 / 8;
private static byte[] ascii(String s) {
return s.getBytes(Charset.forName("US-ASCII"));
}
// KDF labels for contact exchange stream header key derivation
private static final byte[] A_INVITE = ascii("ALICE_INVITATION_KEY");
private static final byte[] B_INVITE = ascii("BOB_INVITATION_KEY");
// KDF labels for contact exchange signature nonce derivation
private static final byte[] A_SIG_NONCE = ascii("ALICE_SIGNATURE_NONCE");
private static final byte[] B_SIG_NONCE = ascii("BOB_SIGNATURE_NONCE");
// Hash label for BQP public key commitment derivation // Hash label for BQP public key commitment derivation
private static final String COMMIT = private static final String COMMIT_LABEL =
"org.briarproject.bramble.COMMIT"; "org.briarproject.bramble.keyagreement/COMMIT";
// Hash label for shared secret derivation
private static final String SHARED_SECRET =
"org.briarproject.bramble.SHARED_SECRET";
// KDF label for BQP confirmation key derivation // KDF label for BQP confirmation key derivation
private static final byte[] CONFIRMATION_KEY = ascii("CONFIRMATION_KEY"); private static final String CONFIRMATION_KEY_LABEL =
// KDF label for master key derivation "org.briarproject.bramble.keyagreement/CONFIRMATION_KEY";
private static final byte[] MASTER_KEY = ascii("MASTER_KEY"); // MAC label for BQP confirmation record
private static final String CONFIRMATION_MAC_LABEL =
"org.briarproject.bramble.keyagreement/CONFIRMATION_MAC";
// KDF labels for tag key derivation // KDF labels for tag key derivation
private static final byte[] A_TAG = ascii("ALICE_TAG_KEY"); private static final String A_TAG = "ALICE_TAG_KEY";
private static final byte[] B_TAG = ascii("BOB_TAG_KEY"); private static final String B_TAG = "BOB_TAG_KEY";
// KDF labels for header key derivation // KDF labels for header key derivation
private static final byte[] A_HEADER = ascii("ALICE_HEADER_KEY"); private static final String A_HEADER = "ALICE_HEADER_KEY";
private static final byte[] B_HEADER = ascii("BOB_HEADER_KEY"); private static final String B_HEADER = "BOB_HEADER_KEY";
// KDF labels for MAC key derivation
private static final byte[] A_MAC = ascii("ALICE_MAC_KEY");
private static final byte[] B_MAC = ascii("BOB_MAC_KEY");
// KDF label for key rotation // KDF label for key rotation
private static final byte[] ROTATE = ascii("ROTATE"); private static final String ROTATE = "ROTATE";
private final SecureRandom secureRandom; private final SecureRandom secureRandom;
private final ECKeyPairGenerator agreementKeyPairGenerator; private final ECKeyPairGenerator agreementKeyPairGenerator;
@@ -263,25 +248,19 @@ class CryptoComponentImpl implements CryptoComponent {
} }
@Override @Override
public SecretKey deriveHeaderKey(SecretKey master, public SecretKey deriveKey(String label, SecretKey k,
boolean alice) { byte[]... inputs) {
return new SecretKey(macKdf(master, alice ? A_INVITE : B_INVITE)); return new SecretKey(macKdf(label, k, inputs));
} }
@Override @Override
public SecretKey deriveMacKey(SecretKey master, boolean alice) { public byte[] deriveKeyBindingNonce(String label, SecretKey k) {
return new SecretKey(macKdf(master, alice ? A_MAC : B_MAC)); return macKdf(label, k);
} }
@Override @Override
public byte[] deriveSignatureNonce(SecretKey master, public byte[] deriveKeyCommitment(PublicKey publicKey) {
boolean alice) { byte[] hash = hash(COMMIT_LABEL, publicKey.getEncoded());
return macKdf(master, alice ? A_SIG_NONCE : B_SIG_NONCE);
}
@Override
public byte[] deriveKeyCommitment(byte[] publicKey) {
byte[] hash = hash(COMMIT, publicKey);
// The output is the first COMMIT_LENGTH bytes of the hash // The output is the first COMMIT_LENGTH bytes of the hash
byte[] commitment = new byte[COMMIT_LENGTH]; byte[] commitment = new byte[COMMIT_LENGTH];
System.arraycopy(hash, 0, commitment, 0, COMMIT_LENGTH); System.arraycopy(hash, 0, commitment, 0, COMMIT_LENGTH);
@@ -289,55 +268,45 @@ class CryptoComponentImpl implements CryptoComponent {
} }
@Override @Override
public SecretKey deriveSharedSecret(byte[] theirPublicKey, public SecretKey deriveSharedSecret(String label, PublicKey theirPublicKey,
KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException { KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException {
PrivateKey ourPriv = ourKeyPair.getPrivate(); PrivateKey ourPriv = ourKeyPair.getPrivate();
PublicKey theirPub = agreementKeyParser.parsePublicKey(theirPublicKey); byte[] raw = performRawKeyAgreement(ourPriv, theirPublicKey);
byte[] raw = performRawKeyAgreement(ourPriv, theirPub);
byte[] alicePub, bobPub; byte[] alicePub, bobPub;
if (alice) { if (alice) {
alicePub = ourKeyPair.getPublic().getEncoded(); alicePub = ourKeyPair.getPublic().getEncoded();
bobPub = theirPublicKey; bobPub = theirPublicKey.getEncoded();
} else { } else {
alicePub = theirPublicKey; alicePub = theirPublicKey.getEncoded();
bobPub = ourKeyPair.getPublic().getEncoded(); bobPub = ourKeyPair.getPublic().getEncoded();
} }
return new SecretKey(hash(SHARED_SECRET, raw, alicePub, bobPub)); return new SecretKey(hash(label, raw, alicePub, bobPub));
} }
@Override @Override
public byte[] deriveConfirmationRecord(SecretKey sharedSecret, public byte[] deriveConfirmationRecord(SecretKey sharedSecret,
byte[] theirPayload, byte[] ourPayload, byte[] theirPublicKey, byte[] theirPayload, byte[] ourPayload, PublicKey theirPublicKey,
KeyPair ourKeyPair, boolean alice, boolean aliceRecord) { KeyPair ourKeyPair, boolean alice, boolean aliceRecord) {
SecretKey ck = new SecretKey(macKdf(sharedSecret, CONFIRMATION_KEY)); SecretKey ck = deriveKey(CONFIRMATION_KEY_LABEL, sharedSecret);
byte[] alicePayload, alicePub, bobPayload, bobPub; byte[] alicePayload, alicePub, bobPayload, bobPub;
if (alice) { if (alice) {
alicePayload = ourPayload; alicePayload = ourPayload;
alicePub = ourKeyPair.getPublic().getEncoded(); alicePub = ourKeyPair.getPublic().getEncoded();
bobPayload = theirPayload; bobPayload = theirPayload;
bobPub = theirPublicKey; bobPub = theirPublicKey.getEncoded();
} else { } else {
alicePayload = theirPayload; alicePayload = theirPayload;
alicePub = theirPublicKey; alicePub = theirPublicKey.getEncoded();
bobPayload = ourPayload; bobPayload = ourPayload;
bobPub = ourKeyPair.getPublic().getEncoded(); bobPub = ourKeyPair.getPublic().getEncoded();
} }
if (aliceRecord) if (aliceRecord) {
return macKdf(ck, alicePayload, alicePub, bobPayload, bobPub); return macKdf(CONFIRMATION_MAC_LABEL, ck, alicePayload, alicePub,
else bobPayload, bobPub);
return macKdf(ck, bobPayload, bobPub, alicePayload, alicePub); } else {
} return macKdf(CONFIRMATION_MAC_LABEL, ck, bobPayload, bobPub,
alicePayload, alicePub);
@Override }
public SecretKey deriveMasterSecret(SecretKey sharedSecret) {
return new SecretKey(macKdf(sharedSecret, MASTER_KEY));
}
@Override
public SecretKey deriveMasterSecret(byte[] theirPublicKey,
KeyPair ourKeyPair, boolean alice) throws GeneralSecurityException {
return deriveMasterSecret(deriveSharedSecret(
theirPublicKey, ourKeyPair, alice));
} }
@Override @Override
@@ -396,19 +365,19 @@ class CryptoComponentImpl implements CryptoComponent {
private SecretKey rotateKey(SecretKey k, long rotationPeriod) { private SecretKey rotateKey(SecretKey k, long rotationPeriod) {
byte[] period = new byte[INT_64_BYTES]; byte[] period = new byte[INT_64_BYTES];
ByteUtils.writeUint64(rotationPeriod, period, 0); ByteUtils.writeUint64(rotationPeriod, period, 0);
return new SecretKey(macKdf(k, ROTATE, period)); return deriveKey(ROTATE, k, period);
} }
private SecretKey deriveTagKey(SecretKey master, TransportId t, private SecretKey deriveTagKey(SecretKey master, TransportId t,
boolean alice) { boolean alice) {
byte[] id = StringUtils.toUtf8(t.getString()); byte[] id = StringUtils.toUtf8(t.getString());
return new SecretKey(macKdf(master, alice ? A_TAG : B_TAG, id)); return deriveKey(alice ? A_TAG : B_TAG, master, id);
} }
private SecretKey deriveHeaderKey(SecretKey master, TransportId t, private SecretKey deriveHeaderKey(SecretKey master, TransportId t,
boolean alice) { boolean alice) {
byte[] id = StringUtils.toUtf8(t.getString()); byte[] id = StringUtils.toUtf8(t.getString());
return new SecretKey(macKdf(master, alice ? A_HEADER : B_HEADER, id)); return deriveKey(alice ? A_HEADER : B_HEADER, master, id);
} }
@Override @Override
@@ -513,14 +482,13 @@ class CryptoComponentImpl implements CryptoComponent {
} }
@Override @Override
public int getHashLength() { public byte[] mac(String label, SecretKey macKey, byte[]... inputs) {
return HASH_SIZE; byte[] labelBytes = StringUtils.toUtf8(label);
}
@Override
public byte[] mac(SecretKey macKey, byte[]... inputs) {
Digest mac = new Blake2sDigest(macKey.getBytes()); Digest mac = new Blake2sDigest(macKey.getBytes());
byte[] length = new byte[INT_32_BYTES]; byte[] length = new byte[INT_32_BYTES];
ByteUtils.writeUint32(labelBytes.length, length, 0);
mac.update(length, 0, length.length);
mac.update(labelBytes, 0, labelBytes.length);
for (byte[] input : inputs) { for (byte[] input : inputs) {
ByteUtils.writeUint32(input.length, length, 0); ByteUtils.writeUint32(input.length, length, 0);
mac.update(length, 0, length.length); mac.update(length, 0, length.length);
@@ -614,26 +582,11 @@ class CryptoComponentImpl implements CryptoComponent {
// Key derivation function based on a pseudo-random function - see // Key derivation function based on a pseudo-random function - see
// NIST SP 800-108, section 5.1 // NIST SP 800-108, section 5.1
private byte[] macKdf(SecretKey key, byte[]... inputs) { private byte[] macKdf(String label, SecretKey k, byte[]... inputs) {
// Initialise the PRF byte[] mac = mac(label, k, inputs);
Digest prf = new Blake2sDigest(key.getBytes()); // The output of the PRF must be usable as a key
// The output of the PRF must be long enough to use as a key if (mac.length != SecretKey.LENGTH) throw new IllegalStateException();
int macLength = prf.getDigestSize(); return mac;
if (macLength < SecretKey.LENGTH) throw new IllegalStateException();
// Calculate the PRF over the concatenated length-prefixed inputs
byte[] length = new byte[INT_32_BYTES];
for (byte[] input : inputs) {
ByteUtils.writeUint32(input.length, length, 0);
prf.update(length, 0, length.length);
prf.update(input, 0, input.length);
}
byte[] mac = new byte[macLength];
prf.doFinal(mac, 0);
// The output is the first SecretKey.LENGTH bytes of the MAC
if (mac.length == SecretKey.LENGTH) return mac;
byte[] truncated = new byte[SecretKey.LENGTH];
System.arraycopy(mac, 0, truncated, 0, truncated.length);
return truncated;
} }
// Password-based key derivation function - see PKCS#5 v2.1, section 5.2 // Password-based key derivation function - see PKCS#5 v2.1, section 5.2

4
bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementConnector.java
View File

@@ -70,8 +70,8 @@ class KeyAgreementConnector {
public Payload listen(KeyPair localKeyPair) { public Payload listen(KeyPair localKeyPair) {
LOG.info("Starting BQP listeners"); LOG.info("Starting BQP listeners");
// Derive commitment // Derive commitment
byte[] commitment = crypto.deriveKeyCommitment( byte[] commitment =
localKeyPair.getPublic().getEncoded()); crypto.deriveKeyCommitment(localKeyPair.getPublic());
// Start all listeners and collect their descriptors // Start all listeners and collect their descriptors
List<TransportDescriptor> descriptors = new ArrayList<>(); List<TransportDescriptor> descriptors = new ArrayList<>();
for (DuplexPlugin plugin : pluginManager.getKeyAgreementPlugins()) { for (DuplexPlugin plugin : pluginManager.getKeyAgreementPlugins()) {

34
bramble-core/src/main/java/org/briarproject/bramble/keyagreement/KeyAgreementProtocol.java
View File

@@ -2,6 +2,8 @@ package org.briarproject.bramble.keyagreement;
import org.briarproject.bramble.api.crypto.CryptoComponent; import org.briarproject.bramble.api.crypto.CryptoComponent;
import org.briarproject.bramble.api.crypto.KeyPair; import org.briarproject.bramble.api.crypto.KeyPair;
import org.briarproject.bramble.api.crypto.KeyParser;
import org.briarproject.bramble.api.crypto.PublicKey;
import org.briarproject.bramble.api.crypto.SecretKey; import org.briarproject.bramble.api.crypto.SecretKey;
import org.briarproject.bramble.api.keyagreement.Payload; import org.briarproject.bramble.api.keyagreement.Payload;
import org.briarproject.bramble.api.keyagreement.PayloadEncoder; import org.briarproject.bramble.api.keyagreement.PayloadEncoder;
@@ -11,6 +13,9 @@ import java.io.IOException;
import java.security.GeneralSecurityException; import java.security.GeneralSecurityException;
import java.util.Arrays; import java.util.Arrays;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.MASTER_SECRET_LABEL;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.SHARED_SECRET_LABEL;
/** /**
* Implementation of the BQP protocol. * Implementation of the BQP protocol.
* <p/> * <p/>
@@ -86,7 +91,7 @@ class KeyAgreementProtocol {
*/ */
SecretKey perform() throws AbortException, IOException { SecretKey perform() throws AbortException, IOException {
try { try {
byte[] theirPublicKey; PublicKey theirPublicKey;
if (alice) { if (alice) {
sendKey(); sendKey();
// Alice waits here until Bob obtains her payload. // Alice waits here until Bob obtains her payload.
@@ -104,7 +109,7 @@ class KeyAgreementProtocol {
receiveConfirm(s, theirPublicKey); receiveConfirm(s, theirPublicKey);
sendConfirm(s, theirPublicKey); sendConfirm(s, theirPublicKey);
} }
return crypto.deriveMasterSecret(s); return crypto.deriveKey(MASTER_SECRET_LABEL, s);
} catch (AbortException e) { } catch (AbortException e) {
sendAbort(e.getCause() != null); sendAbort(e.getCause() != null);
throw e; throw e;
@@ -115,25 +120,32 @@ class KeyAgreementProtocol {
transport.sendKey(ourKeyPair.getPublic().getEncoded()); transport.sendKey(ourKeyPair.getPublic().getEncoded());
} }
private byte[] receiveKey() throws AbortException { private PublicKey receiveKey() throws AbortException {
byte[] publicKey = transport.receiveKey(); byte[] publicKeyBytes = transport.receiveKey();
callbacks.initialRecordReceived(); callbacks.initialRecordReceived();
byte[] expected = crypto.deriveKeyCommitment(publicKey); KeyParser keyParser = crypto.getAgreementKeyParser();
if (!Arrays.equals(expected, theirPayload.getCommitment())) try {
PublicKey publicKey = keyParser.parsePublicKey(publicKeyBytes);
byte[] expected = crypto.deriveKeyCommitment(publicKey);
if (!Arrays.equals(expected, theirPayload.getCommitment()))
throw new AbortException();
return publicKey;
} catch (GeneralSecurityException e) {
throw new AbortException(); throw new AbortException();
return publicKey; }
} }
private SecretKey deriveSharedSecret(byte[] theirPublicKey) private SecretKey deriveSharedSecret(PublicKey theirPublicKey)
throws AbortException { throws AbortException {
try { try {
return crypto.deriveSharedSecret(theirPublicKey, ourKeyPair, alice); return crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
theirPublicKey, ourKeyPair, alice);
} catch (GeneralSecurityException e) { } catch (GeneralSecurityException e) {
throw new AbortException(e); throw new AbortException(e);
} }
} }
private void sendConfirm(SecretKey s, byte[] theirPublicKey) private void sendConfirm(SecretKey s, PublicKey theirPublicKey)
throws IOException { throws IOException {
byte[] confirm = crypto.deriveConfirmationRecord(s, byte[] confirm = crypto.deriveConfirmationRecord(s,
payloadEncoder.encode(theirPayload), payloadEncoder.encode(theirPayload),
@@ -143,7 +155,7 @@ class KeyAgreementProtocol {
transport.sendConfirm(confirm); transport.sendConfirm(confirm);
} }
private void receiveConfirm(SecretKey s, byte[] theirPublicKey) private void receiveConfirm(SecretKey s, PublicKey theirPublicKey)
throws AbortException { throws AbortException {
byte[] confirm = transport.receiveConfirm(); byte[] confirm = transport.receiveConfirm();
byte[] expected = crypto.deriveConfirmationRecord(s, byte[] expected = crypto.deriveConfirmationRecord(s,

29
bramble-core/src/test/java/org/briarproject/bramble/crypto/KeyAgreementTest.java
View File

@@ -3,40 +3,25 @@ package org.briarproject.bramble.crypto;
import org.briarproject.bramble.api.crypto.CryptoComponent; import org.briarproject.bramble.api.crypto.CryptoComponent;
import org.briarproject.bramble.api.crypto.KeyPair; import org.briarproject.bramble.api.crypto.KeyPair;
import org.briarproject.bramble.api.crypto.SecretKey; import org.briarproject.bramble.api.crypto.SecretKey;
import org.briarproject.bramble.api.system.SecureRandomProvider;
import org.briarproject.bramble.test.BrambleTestCase; import org.briarproject.bramble.test.BrambleTestCase;
import org.briarproject.bramble.test.TestSecureRandomProvider; import org.briarproject.bramble.test.TestSecureRandomProvider;
import org.junit.Test; import org.junit.Test;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.SHARED_SECRET_LABEL;
import static org.junit.Assert.assertArrayEquals; import static org.junit.Assert.assertArrayEquals;
public class KeyAgreementTest extends BrambleTestCase { public class KeyAgreementTest extends BrambleTestCase {
@Test
public void testDeriveMasterSecret() throws Exception {
SecureRandomProvider
secureRandomProvider = new TestSecureRandomProvider();
CryptoComponent crypto = new CryptoComponentImpl(secureRandomProvider);
KeyPair aPair = crypto.generateAgreementKeyPair();
byte[] aPub = aPair.getPublic().getEncoded();
KeyPair bPair = crypto.generateAgreementKeyPair();
byte[] bPub = bPair.getPublic().getEncoded();
SecretKey aMaster = crypto.deriveMasterSecret(aPub, bPair, true);
SecretKey bMaster = crypto.deriveMasterSecret(bPub, aPair, false);
assertArrayEquals(aMaster.getBytes(), bMaster.getBytes());
}
@Test @Test
public void testDeriveSharedSecret() throws Exception { public void testDeriveSharedSecret() throws Exception {
SecureRandomProvider CryptoComponent crypto =
secureRandomProvider = new TestSecureRandomProvider(); new CryptoComponentImpl(new TestSecureRandomProvider());
CryptoComponent crypto = new CryptoComponentImpl(secureRandomProvider);
KeyPair aPair = crypto.generateAgreementKeyPair(); KeyPair aPair = crypto.generateAgreementKeyPair();
byte[] aPub = aPair.getPublic().getEncoded();
KeyPair bPair = crypto.generateAgreementKeyPair(); KeyPair bPair = crypto.generateAgreementKeyPair();
byte[] bPub = bPair.getPublic().getEncoded(); SecretKey aShared = crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
SecretKey aShared = crypto.deriveSharedSecret(bPub, aPair, true); bPair.getPublic(), aPair, true);
SecretKey bShared = crypto.deriveSharedSecret(aPub, bPair, false); SecretKey bShared = crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
aPair.getPublic(), bPair, false);
assertArrayEquals(aShared.getBytes(), bShared.getBytes()); assertArrayEquals(aShared.getBytes(), bShared.getBytes());
} }
} }

43
bramble-core/src/test/java/org/briarproject/bramble/crypto/MacTest.java
View File

@@ -4,42 +4,49 @@ import org.briarproject.bramble.api.crypto.CryptoComponent;
import org.briarproject.bramble.api.crypto.SecretKey; import org.briarproject.bramble.api.crypto.SecretKey;
import org.briarproject.bramble.test.BrambleTestCase; import org.briarproject.bramble.test.BrambleTestCase;
import org.briarproject.bramble.test.TestSecureRandomProvider; import org.briarproject.bramble.test.TestSecureRandomProvider;
import org.briarproject.bramble.test.TestUtils;
import org.junit.Test; import org.junit.Test;
import java.util.Arrays; import java.util.Arrays;
import static org.briarproject.bramble.test.TestUtils.getRandomBytes;
import static org.briarproject.bramble.test.TestUtils.getSecretKey;
import static org.briarproject.bramble.util.StringUtils.getRandomString;
import static org.junit.Assert.assertArrayEquals; import static org.junit.Assert.assertArrayEquals;
import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertFalse;
public class MacTest extends BrambleTestCase { public class MacTest extends BrambleTestCase {
private final CryptoComponent crypto; private final CryptoComponent crypto =
new CryptoComponentImpl(new TestSecureRandomProvider());
private final SecretKey k = TestUtils.getSecretKey(); private final SecretKey key1 = getSecretKey(), key2 = getSecretKey();
private final byte[] inputBytes = TestUtils.getRandomBytes(123); private final String label1 = getRandomString(123);
private final byte[] inputBytes1 = TestUtils.getRandomBytes(234); private final String label2 = getRandomString(123);
private final byte[] inputBytes2 = new byte[0]; private final byte[] input1 = getRandomBytes(123);
private final byte[] input2 = getRandomBytes(234);
public MacTest() { private final byte[] input3 = new byte[0];
crypto = new CryptoComponentImpl(new TestSecureRandomProvider());
}
@Test @Test
public void testIdenticalKeysAndInputsProduceIdenticalMacs() { public void testIdenticalKeysAndInputsProduceIdenticalMacs() {
// Calculate the MAC twice - the results should be identical // Calculate the MAC twice - the results should be identical
byte[] mac = crypto.mac(k, inputBytes, inputBytes1, inputBytes2); byte[] mac = crypto.mac(label1, key1, input1, input2, input3);
byte[] mac1 = crypto.mac(k, inputBytes, inputBytes1, inputBytes2); byte[] mac1 = crypto.mac(label1, key1, input1, input2, input3);
assertArrayEquals(mac, mac1); assertArrayEquals(mac, mac1);
} }
@Test
public void testDifferentLabelsProduceDifferentMacs() {
// Calculate the MAC with each label - the results should be different
byte[] mac = crypto.mac(label1, key1, input1, input2, input3);
byte[] mac1 = crypto.mac(label2, key1, input1, input2, input3);
assertFalse(Arrays.equals(mac, mac1));
}
@Test @Test
public void testDifferentKeysProduceDifferentMacs() { public void testDifferentKeysProduceDifferentMacs() {
// Generate second random key
SecretKey k1 = TestUtils.getSecretKey();
// Calculate the MAC with each key - the results should be different // Calculate the MAC with each key - the results should be different
byte[] mac = crypto.mac(k, inputBytes, inputBytes1, inputBytes2); byte[] mac = crypto.mac(label1, key1, input1, input2, input3);
byte[] mac1 = crypto.mac(k1, inputBytes, inputBytes1, inputBytes2); byte[] mac1 = crypto.mac(label1, key2, input1, input2, input3);
assertFalse(Arrays.equals(mac, mac1)); assertFalse(Arrays.equals(mac, mac1));
} }
@@ -47,8 +54,8 @@ public class MacTest extends BrambleTestCase {
public void testDifferentInputsProduceDifferentMacs() { public void testDifferentInputsProduceDifferentMacs() {
// Calculate the MAC with the inputs in different orders - the results // Calculate the MAC with the inputs in different orders - the results
// should be different // should be different
byte[] mac = crypto.mac(k, inputBytes, inputBytes1, inputBytes2); byte[] mac = crypto.mac(label1, key1, input1, input2, input3);
byte[] mac1 = crypto.mac(k, inputBytes2, inputBytes1, inputBytes); byte[] mac1 = crypto.mac(label1, key1, input3, input2, input1);
assertFalse(Arrays.equals(mac, mac1)); assertFalse(Arrays.equals(mac, mac1));
} }

260
bramble-core/src/test/java/org/briarproject/bramble/keyagreement/KeyAgreementProtocolTest.java
View File

@@ -2,12 +2,12 @@ package org.briarproject.bramble.keyagreement;
import org.briarproject.bramble.api.crypto.CryptoComponent; import org.briarproject.bramble.api.crypto.CryptoComponent;
import org.briarproject.bramble.api.crypto.KeyPair; import org.briarproject.bramble.api.crypto.KeyPair;
import org.briarproject.bramble.api.crypto.KeyParser;
import org.briarproject.bramble.api.crypto.PublicKey; import org.briarproject.bramble.api.crypto.PublicKey;
import org.briarproject.bramble.api.crypto.SecretKey; import org.briarproject.bramble.api.crypto.SecretKey;
import org.briarproject.bramble.api.keyagreement.Payload; import org.briarproject.bramble.api.keyagreement.Payload;
import org.briarproject.bramble.api.keyagreement.PayloadEncoder; import org.briarproject.bramble.api.keyagreement.PayloadEncoder;
import org.briarproject.bramble.test.BrambleTestCase; import org.briarproject.bramble.test.BrambleTestCase;
import org.briarproject.bramble.test.TestUtils;
import org.jmock.Expectations; import org.jmock.Expectations;
import org.jmock.auto.Mock; import org.jmock.auto.Mock;
import org.jmock.integration.junit4.JUnitRuleMockery; import org.jmock.integration.junit4.JUnitRuleMockery;
@@ -16,6 +16,10 @@ import org.junit.Rule;
import org.junit.Test; import org.junit.Test;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.COMMIT_LENGTH; import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.COMMIT_LENGTH;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.MASTER_SECRET_LABEL;
import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.SHARED_SECRET_LABEL;
import static org.briarproject.bramble.test.TestUtils.getRandomBytes;
import static org.briarproject.bramble.test.TestUtils.getSecretKey;
import static org.hamcrest.Matchers.equalTo; import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.is;
import static org.junit.Assert.assertThat; import static org.junit.Assert.assertThat;
@@ -28,34 +32,31 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
setImposteriser(ClassImposteriser.INSTANCE); setImposteriser(ClassImposteriser.INSTANCE);
}}; }};
private static final byte[] ALICE_PUBKEY = TestUtils.getRandomBytes(32); private final PublicKey alicePubKey =
private static final byte[] ALICE_COMMIT = context.mock(PublicKey.class, "alice");
TestUtils.getRandomBytes(COMMIT_LENGTH); private final byte[] alicePubKeyBytes = getRandomBytes(32);
private static final byte[] ALICE_PAYLOAD = private final byte[] aliceCommit = getRandomBytes(COMMIT_LENGTH);
TestUtils.getRandomBytes(COMMIT_LENGTH + 8); private final byte[] alicePayload = getRandomBytes(COMMIT_LENGTH + 8);
private final byte[] aliceConfirm = getRandomBytes(SecretKey.LENGTH);
private static final byte[] BOB_PUBKEY = TestUtils.getRandomBytes(32); private final PublicKey bobPubKey = context.mock(PublicKey.class, "bob");
private static final byte[] BOB_COMMIT = private final byte[] bobPubKeyBytes = getRandomBytes(32);
TestUtils.getRandomBytes(COMMIT_LENGTH); private final byte[] bobCommit = getRandomBytes(COMMIT_LENGTH);
private static final byte[] BOB_PAYLOAD = private final byte[] bobPayload = getRandomBytes(COMMIT_LENGTH + 19);
TestUtils.getRandomBytes(COMMIT_LENGTH + 19); private final byte[] bobConfirm = getRandomBytes(SecretKey.LENGTH);
private static final byte[] ALICE_CONFIRM = private final PublicKey badPubKey = context.mock(PublicKey.class, "bad");
TestUtils.getRandomBytes(SecretKey.LENGTH); private final byte[] badPubKeyBytes = getRandomBytes(32);
private static final byte[] BOB_CONFIRM = private final byte[] badCommit = getRandomBytes(COMMIT_LENGTH);
TestUtils.getRandomBytes(SecretKey.LENGTH); private final byte[] badConfirm = getRandomBytes(SecretKey.LENGTH);
private static final byte[] BAD_PUBKEY = TestUtils.getRandomBytes(32);
private static final byte[] BAD_COMMIT =
TestUtils.getRandomBytes(COMMIT_LENGTH);
private static final byte[] BAD_CONFIRM =
TestUtils.getRandomBytes(SecretKey.LENGTH);
@Mock @Mock
KeyAgreementProtocol.Callbacks callbacks; KeyAgreementProtocol.Callbacks callbacks;
@Mock @Mock
CryptoComponent crypto; CryptoComponent crypto;
@Mock @Mock
KeyParser keyParser;
@Mock
PayloadEncoder payloadEncoder; PayloadEncoder payloadEncoder;
@Mock @Mock
KeyAgreementTransport transport; KeyAgreementTransport transport;
@@ -65,11 +66,11 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test @Test
public void testAliceProtocol() throws Exception { public void testAliceProtocol() throws Exception {
// set up // set up
Payload theirPayload = new Payload(BOB_COMMIT, null); Payload theirPayload = new Payload(bobCommit, null);
Payload ourPayload = new Payload(ALICE_COMMIT, null); Payload ourPayload = new Payload(aliceCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
SecretKey sharedSecret = TestUtils.getSecretKey(); SecretKey sharedSecret = getSecretKey();
SecretKey masterSecret = TestUtils.getSecretKey(); SecretKey masterSecret = getSecretKey();
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
new KeyAgreementProtocol(callbacks, crypto, payloadEncoder, new KeyAgreementProtocol(callbacks, crypto, payloadEncoder,
@@ -79,46 +80,51 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(payloadEncoder).encode(ourPayload); allowing(payloadEncoder).encode(ourPayload);
will(returnValue(ALICE_PAYLOAD)); will(returnValue(alicePayload));
allowing(payloadEncoder).encode(theirPayload); allowing(payloadEncoder).encode(theirPayload);
will(returnValue(BOB_PAYLOAD)); will(returnValue(bobPayload));
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(ALICE_PUBKEY)); will(returnValue(alicePubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Alice sends her public key // Alice sends her public key
oneOf(transport).sendKey(ALICE_PUBKEY); oneOf(transport).sendKey(alicePubKeyBytes);
// Alice receives Bob's public key // Alice receives Bob's public key
oneOf(callbacks).connectionWaiting(); oneOf(callbacks).connectionWaiting();
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(BOB_PUBKEY)); will(returnValue(bobPubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(bobPubKeyBytes);
will(returnValue(bobPubKey));
// Alice verifies Bob's public key // Alice verifies Bob's public key
oneOf(crypto).deriveKeyCommitment(BOB_PUBKEY); oneOf(crypto).deriveKeyCommitment(bobPubKey);
will(returnValue(BOB_COMMIT)); will(returnValue(bobCommit));
// Alice computes shared secret // Alice computes shared secret
oneOf(crypto).deriveSharedSecret(BOB_PUBKEY, ourKeyPair, true); oneOf(crypto).deriveSharedSecret(SHARED_SECRET_LABEL, bobPubKey,
ourKeyPair, true);
will(returnValue(sharedSecret)); will(returnValue(sharedSecret));
// Alice sends her confirmation record // Alice sends her confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, BOB_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, bobPayload,
ALICE_PAYLOAD, BOB_PUBKEY, ourKeyPair, true, true); alicePayload, bobPubKey, ourKeyPair, true, true);
will(returnValue(ALICE_CONFIRM)); will(returnValue(aliceConfirm));
oneOf(transport).sendConfirm(ALICE_CONFIRM); oneOf(transport).sendConfirm(aliceConfirm);
// Alice receives Bob's confirmation record // Alice receives Bob's confirmation record
oneOf(transport).receiveConfirm(); oneOf(transport).receiveConfirm();
will(returnValue(BOB_CONFIRM)); will(returnValue(bobConfirm));
// Alice verifies Bob's confirmation record // Alice verifies Bob's confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, BOB_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, bobPayload,
ALICE_PAYLOAD, BOB_PUBKEY, ourKeyPair, true, false); alicePayload, bobPubKey, ourKeyPair, true, false);
will(returnValue(BOB_CONFIRM)); will(returnValue(bobConfirm));
// Alice computes master secret // Alice computes master secret
oneOf(crypto).deriveMasterSecret(sharedSecret); oneOf(crypto).deriveKey(MASTER_SECRET_LABEL, sharedSecret);
will(returnValue(masterSecret)); will(returnValue(masterSecret));
}}); }});
@@ -129,11 +135,11 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test @Test
public void testBobProtocol() throws Exception { public void testBobProtocol() throws Exception {
// set up // set up
Payload theirPayload = new Payload(ALICE_COMMIT, null); Payload theirPayload = new Payload(aliceCommit, null);
Payload ourPayload = new Payload(BOB_COMMIT, null); Payload ourPayload = new Payload(bobCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
SecretKey sharedSecret = TestUtils.getSecretKey(); SecretKey sharedSecret = getSecretKey();
SecretKey masterSecret = TestUtils.getSecretKey(); SecretKey masterSecret = getSecretKey();
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
new KeyAgreementProtocol(callbacks, crypto, payloadEncoder, new KeyAgreementProtocol(callbacks, crypto, payloadEncoder,
@@ -143,45 +149,50 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(payloadEncoder).encode(ourPayload); allowing(payloadEncoder).encode(ourPayload);
will(returnValue(BOB_PAYLOAD)); will(returnValue(bobPayload));
allowing(payloadEncoder).encode(theirPayload); allowing(payloadEncoder).encode(theirPayload);
will(returnValue(ALICE_PAYLOAD)); will(returnValue(alicePayload));
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(BOB_PUBKEY)); will(returnValue(bobPubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Bob receives Alice's public key // Bob receives Alice's public key
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(ALICE_PUBKEY)); will(returnValue(alicePubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(alicePubKeyBytes);
will(returnValue(alicePubKey));
// Bob verifies Alice's public key // Bob verifies Alice's public key
oneOf(crypto).deriveKeyCommitment(ALICE_PUBKEY); oneOf(crypto).deriveKeyCommitment(alicePubKey);
will(returnValue(ALICE_COMMIT)); will(returnValue(aliceCommit));
// Bob sends his public key // Bob sends his public key
oneOf(transport).sendKey(BOB_PUBKEY); oneOf(transport).sendKey(bobPubKeyBytes);
// Bob computes shared secret // Bob computes shared secret
oneOf(crypto).deriveSharedSecret(ALICE_PUBKEY, ourKeyPair, false); oneOf(crypto).deriveSharedSecret(SHARED_SECRET_LABEL, alicePubKey,
ourKeyPair, false);
will(returnValue(sharedSecret)); will(returnValue(sharedSecret));
// Bob receives Alices's confirmation record // Bob receives Alices's confirmation record
oneOf(transport).receiveConfirm(); oneOf(transport).receiveConfirm();
will(returnValue(ALICE_CONFIRM)); will(returnValue(aliceConfirm));
// Bob verifies Alice's confirmation record // Bob verifies Alice's confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, ALICE_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, alicePayload,
BOB_PAYLOAD, ALICE_PUBKEY, ourKeyPair, false, true); bobPayload, alicePubKey, ourKeyPair, false, true);
will(returnValue(ALICE_CONFIRM)); will(returnValue(aliceConfirm));
// Bob sends his confirmation record // Bob sends his confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, ALICE_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, alicePayload,
BOB_PAYLOAD, ALICE_PUBKEY, ourKeyPair, false, false); bobPayload, alicePubKey, ourKeyPair, false, false);
will(returnValue(BOB_CONFIRM)); will(returnValue(bobConfirm));
oneOf(transport).sendConfirm(BOB_CONFIRM); oneOf(transport).sendConfirm(bobConfirm);
// Bob computes master secret // Bob computes master secret
oneOf(crypto).deriveMasterSecret(sharedSecret); oneOf(crypto).deriveKey(MASTER_SECRET_LABEL, sharedSecret);
will(returnValue(masterSecret)); will(returnValue(masterSecret));
}}); }});
@@ -192,8 +203,8 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test(expected = AbortException.class) @Test(expected = AbortException.class)
public void testAliceProtocolAbortOnBadKey() throws Exception { public void testAliceProtocolAbortOnBadKey() throws Exception {
// set up // set up
Payload theirPayload = new Payload(BOB_COMMIT, null); Payload theirPayload = new Payload(bobCommit, null);
Payload ourPayload = new Payload(ALICE_COMMIT, null); Payload ourPayload = new Payload(aliceCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
@@ -204,26 +215,31 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(ALICE_PUBKEY)); will(returnValue(alicePubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Alice sends her public key // Alice sends her public key
oneOf(transport).sendKey(ALICE_PUBKEY); oneOf(transport).sendKey(alicePubKeyBytes);
// Alice receives a bad public key // Alice receives a bad public key
oneOf(callbacks).connectionWaiting(); oneOf(callbacks).connectionWaiting();
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(BAD_PUBKEY)); will(returnValue(badPubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(badPubKeyBytes);
will(returnValue(badPubKey));
// Alice verifies Bob's public key // Alice verifies Bob's public key
oneOf(crypto).deriveKeyCommitment(BAD_PUBKEY); oneOf(crypto).deriveKeyCommitment(badPubKey);
will(returnValue(BAD_COMMIT)); will(returnValue(badCommit));
// Alice aborts // Alice aborts
oneOf(transport).sendAbort(false); oneOf(transport).sendAbort(false);
// Alice never computes shared secret // Alice never computes shared secret
never(crypto).deriveSharedSecret(BAD_PUBKEY, ourKeyPair, true); never(crypto).deriveSharedSecret(SHARED_SECRET_LABEL, badPubKey,
ourKeyPair, true);
}}); }});
// execute // execute
@@ -233,8 +249,8 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test(expected = AbortException.class) @Test(expected = AbortException.class)
public void testBobProtocolAbortOnBadKey() throws Exception { public void testBobProtocolAbortOnBadKey() throws Exception {
// set up // set up
Payload theirPayload = new Payload(ALICE_COMMIT, null); Payload theirPayload = new Payload(aliceCommit, null);
Payload ourPayload = new Payload(BOB_COMMIT, null); Payload ourPayload = new Payload(bobCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
@@ -245,22 +261,26 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(BOB_PUBKEY)); will(returnValue(bobPubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Bob receives a bad public key // Bob receives a bad public key
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(BAD_PUBKEY)); will(returnValue(badPubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(badPubKeyBytes);
will(returnValue(badPubKey));
// Bob verifies Alice's public key // Bob verifies Alice's public key
oneOf(crypto).deriveKeyCommitment(BAD_PUBKEY); oneOf(crypto).deriveKeyCommitment(badPubKey);
will(returnValue(BAD_COMMIT)); will(returnValue(badCommit));
// Bob aborts // Bob aborts
oneOf(transport).sendAbort(false); oneOf(transport).sendAbort(false);
// Bob never sends his public key // Bob never sends his public key
never(transport).sendKey(BOB_PUBKEY); never(transport).sendKey(bobPubKeyBytes);
}}); }});
// execute // execute
@@ -270,10 +290,10 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test(expected = AbortException.class) @Test(expected = AbortException.class)
public void testAliceProtocolAbortOnBadConfirm() throws Exception { public void testAliceProtocolAbortOnBadConfirm() throws Exception {
// set up // set up
Payload theirPayload = new Payload(BOB_COMMIT, null); Payload theirPayload = new Payload(bobCommit, null);
Payload ourPayload = new Payload(ALICE_COMMIT, null); Payload ourPayload = new Payload(aliceCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
SecretKey sharedSecret = TestUtils.getSecretKey(); SecretKey sharedSecret = getSecretKey();
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
new KeyAgreementProtocol(callbacks, crypto, payloadEncoder, new KeyAgreementProtocol(callbacks, crypto, payloadEncoder,
@@ -283,49 +303,54 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(payloadEncoder).encode(ourPayload); allowing(payloadEncoder).encode(ourPayload);
will(returnValue(ALICE_PAYLOAD)); will(returnValue(alicePayload));
allowing(payloadEncoder).encode(theirPayload); allowing(payloadEncoder).encode(theirPayload);
will(returnValue(BOB_PAYLOAD)); will(returnValue(bobPayload));
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(ALICE_PUBKEY)); will(returnValue(alicePubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Alice sends her public key // Alice sends her public key
oneOf(transport).sendKey(ALICE_PUBKEY); oneOf(transport).sendKey(alicePubKeyBytes);
// Alice receives Bob's public key // Alice receives Bob's public key
oneOf(callbacks).connectionWaiting(); oneOf(callbacks).connectionWaiting();
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(BOB_PUBKEY)); will(returnValue(bobPubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(bobPubKeyBytes);
will(returnValue(bobPubKey));
// Alice verifies Bob's public key // Alice verifies Bob's public key
oneOf(crypto).deriveKeyCommitment(BOB_PUBKEY); oneOf(crypto).deriveKeyCommitment(bobPubKey);
will(returnValue(BOB_COMMIT)); will(returnValue(bobCommit));
// Alice computes shared secret // Alice computes shared secret
oneOf(crypto).deriveSharedSecret(BOB_PUBKEY, ourKeyPair, true); oneOf(crypto).deriveSharedSecret(SHARED_SECRET_LABEL, bobPubKey,
ourKeyPair, true);
will(returnValue(sharedSecret)); will(returnValue(sharedSecret));
// Alice sends her confirmation record // Alice sends her confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, BOB_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, bobPayload,
ALICE_PAYLOAD, BOB_PUBKEY, ourKeyPair, true, true); alicePayload, bobPubKey, ourKeyPair, true, true);
will(returnValue(ALICE_CONFIRM)); will(returnValue(aliceConfirm));
oneOf(transport).sendConfirm(ALICE_CONFIRM); oneOf(transport).sendConfirm(aliceConfirm);
// Alice receives a bad confirmation record // Alice receives a bad confirmation record
oneOf(transport).receiveConfirm(); oneOf(transport).receiveConfirm();
will(returnValue(BAD_CONFIRM)); will(returnValue(badConfirm));
// Alice verifies Bob's confirmation record // Alice verifies Bob's confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, BOB_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, bobPayload,
ALICE_PAYLOAD, BOB_PUBKEY, ourKeyPair, true, false); alicePayload, bobPubKey, ourKeyPair, true, false);
will(returnValue(BOB_CONFIRM)); will(returnValue(bobConfirm));
// Alice aborts // Alice aborts
oneOf(transport).sendAbort(false); oneOf(transport).sendAbort(false);
// Alice never computes master secret // Alice never computes master secret
never(crypto).deriveMasterSecret(sharedSecret); never(crypto).deriveKey(MASTER_SECRET_LABEL, sharedSecret);
}}); }});
// execute // execute
@@ -335,10 +360,10 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
@Test(expected = AbortException.class) @Test(expected = AbortException.class)
public void testBobProtocolAbortOnBadConfirm() throws Exception { public void testBobProtocolAbortOnBadConfirm() throws Exception {
// set up // set up
Payload theirPayload = new Payload(ALICE_COMMIT, null); Payload theirPayload = new Payload(aliceCommit, null);
Payload ourPayload = new Payload(BOB_COMMIT, null); Payload ourPayload = new Payload(bobCommit, null);
KeyPair ourKeyPair = new KeyPair(ourPubKey, null); KeyPair ourKeyPair = new KeyPair(ourPubKey, null);
SecretKey sharedSecret = TestUtils.getSecretKey(); SecretKey sharedSecret = getSecretKey();
KeyAgreementProtocol protocol = KeyAgreementProtocol protocol =
new KeyAgreementProtocol(callbacks, crypto, payloadEncoder, new KeyAgreementProtocol(callbacks, crypto, payloadEncoder,
@@ -348,43 +373,48 @@ public class KeyAgreementProtocolTest extends BrambleTestCase {
context.checking(new Expectations() {{ context.checking(new Expectations() {{
// Helpers // Helpers
allowing(payloadEncoder).encode(ourPayload); allowing(payloadEncoder).encode(ourPayload);
will(returnValue(BOB_PAYLOAD)); will(returnValue(bobPayload));
allowing(payloadEncoder).encode(theirPayload); allowing(payloadEncoder).encode(theirPayload);
will(returnValue(ALICE_PAYLOAD)); will(returnValue(alicePayload));
allowing(ourPubKey).getEncoded(); allowing(ourPubKey).getEncoded();
will(returnValue(BOB_PUBKEY)); will(returnValue(bobPubKeyBytes));
allowing(crypto).getAgreementKeyParser();
will(returnValue(keyParser));
// Bob receives Alice's public key // Bob receives Alice's public key
oneOf(transport).receiveKey(); oneOf(transport).receiveKey();
will(returnValue(ALICE_PUBKEY)); will(returnValue(alicePubKeyBytes));
oneOf(callbacks).initialRecordReceived(); oneOf(callbacks).initialRecordReceived();
oneOf(keyParser).parsePublicKey(alicePubKeyBytes);
will(returnValue(alicePubKey));
// Bob verifies Alice's public key // Bob verifies Alice's public key
oneOf(crypto).deriveKeyCommitment(ALICE_PUBKEY); oneOf(crypto).deriveKeyCommitment(alicePubKey);
will(returnValue(ALICE_COMMIT)); will(returnValue(aliceCommit));
// Bob sends his public key // Bob sends his public key
oneOf(transport).sendKey(BOB_PUBKEY); oneOf(transport).sendKey(bobPubKeyBytes);
// Bob computes shared secret // Bob computes shared secret
oneOf(crypto).deriveSharedSecret(ALICE_PUBKEY, ourKeyPair, false); oneOf(crypto).deriveSharedSecret(SHARED_SECRET_LABEL, alicePubKey,
ourKeyPair, false);
will(returnValue(sharedSecret)); will(returnValue(sharedSecret));
// Bob receives a bad confirmation record // Bob receives a bad confirmation record
oneOf(transport).receiveConfirm(); oneOf(transport).receiveConfirm();
will(returnValue(BAD_CONFIRM)); will(returnValue(badConfirm));
// Bob verifies Alice's confirmation record // Bob verifies Alice's confirmation record
oneOf(crypto).deriveConfirmationRecord(sharedSecret, ALICE_PAYLOAD, oneOf(crypto).deriveConfirmationRecord(sharedSecret, alicePayload,
BOB_PAYLOAD, ALICE_PUBKEY, ourKeyPair, false, true); bobPayload, alicePubKey, ourKeyPair, false, true);
will(returnValue(ALICE_CONFIRM)); will(returnValue(aliceConfirm));
// Bob aborts // Bob aborts
oneOf(transport).sendAbort(false); oneOf(transport).sendAbort(false);
// Bob never sends his confirmation record // Bob never sends his confirmation record
never(crypto).deriveConfirmationRecord(sharedSecret, ALICE_PAYLOAD, never(crypto).deriveConfirmationRecord(sharedSecret, alicePayload,
BOB_PAYLOAD, ALICE_PUBKEY, ourKeyPair, false, false); bobPayload, alicePubKey, ourKeyPair, false, false);
}}); }});
// execute // execute

40
briar-api/src/main/java/org/briarproject/briar/api/introduction/IntroductionConstants.java
View File

@@ -86,4 +86,44 @@ public interface IntroductionConstants {
int TASK_ACTIVATE_CONTACT = 1; int TASK_ACTIVATE_CONTACT = 1;
int TASK_ABORT = 2; int TASK_ABORT = 2;
/**
* Label for deriving the shared secret.
*/
String SHARED_SECRET_LABEL =
"org.briarproject.briar.introduction/SHARED_SECRET";
/**
* Label for deriving Alice's key binding nonce from the shared secret.
*/
String ALICE_NONCE_LABEL =
"org.briarproject.briar.introduction/ALICE_NONCE";
/**
* Label for deriving Bob's key binding nonce from the shared secret.
*/
String BOB_NONCE_LABEL =
"org.briarproject.briar.introduction/BOB_NONCE";
/**
* Label for deriving Alice's MAC key from the shared secret.
*/
String ALICE_MAC_KEY_LABEL =
"org.briarproject.briar.introduction/ALICE_MAC_KEY";
/**
* Label for deriving Bob's MAC key from the shared secret.
*/
String BOB_MAC_KEY_LABEL =
"org.briarproject.briar.introduction/BOB_MAC_KEY";
/**
* Label for signing the introduction response.
*/
String SIGNING_LABEL =
"org.briarproject.briar.introduction/RESPONSE_SIGNATURE";
/**
* Label for MACing the introduction response.
*/
String MAC_LABEL = "org.briarproject.briar.introduction/RESPONSE_MAC";
} }

81
briar-core/src/main/java/org/briarproject/briar/introduction/IntroduceeManager.java
View File

@@ -50,7 +50,11 @@ import static org.briarproject.bramble.api.data.BdfDictionary.NULL_VALUE;
import static org.briarproject.briar.api.introduction.IntroduceeProtocolState.AWAIT_REQUEST; import static org.briarproject.briar.api.introduction.IntroduceeProtocolState.AWAIT_REQUEST;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ACCEPT; import static org.briarproject.briar.api.introduction.IntroductionConstants.ACCEPT;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ADDED_CONTACT_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.ADDED_CONTACT_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ALICE_MAC_KEY_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ALICE_NONCE_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ANSWERED; import static org.briarproject.briar.api.introduction.IntroductionConstants.ANSWERED;
import static org.briarproject.briar.api.introduction.IntroductionConstants.BOB_MAC_KEY_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.BOB_NONCE_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.CONTACT; import static org.briarproject.briar.api.introduction.IntroductionConstants.CONTACT;
import static org.briarproject.briar.api.introduction.IntroductionConstants.CONTACT_ID_1; import static org.briarproject.briar.api.introduction.IntroductionConstants.CONTACT_ID_1;
import static org.briarproject.briar.api.introduction.IntroductionConstants.EXISTS; import static org.briarproject.briar.api.introduction.IntroductionConstants.EXISTS;
@@ -60,6 +64,7 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.INTR
import static org.briarproject.briar.api.introduction.IntroductionConstants.LOCAL_AUTHOR_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.LOCAL_AUTHOR_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_TIME; import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_TIME;
import static org.briarproject.briar.api.introduction.IntroductionConstants.NAME; import static org.briarproject.briar.api.introduction.IntroductionConstants.NAME;
@@ -76,7 +81,9 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.REMO
import static org.briarproject.briar.api.introduction.IntroductionConstants.REMOTE_AUTHOR_IS_US; import static org.briarproject.briar.api.introduction.IntroductionConstants.REMOTE_AUTHOR_IS_US;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE; import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE_INTRODUCEE; import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE_INTRODUCEE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SHARED_SECRET_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE; import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNING_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.STATE; import static org.briarproject.briar.api.introduction.IntroductionConstants.STATE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.STORAGE_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.STORAGE_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TASK; import static org.briarproject.briar.api.introduction.IntroductionConstants.TASK;
@@ -89,7 +96,6 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ABORT; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ABORT;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ACK; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ACK;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE;
import static org.briarproject.briar.api.introduction.IntroductionManager.CLIENT_ID;
@Immutable @Immutable
@NotNullByDefault @NotNullByDefault
@@ -98,9 +104,6 @@ class IntroduceeManager {
private static final Logger LOG = private static final Logger LOG =
Logger.getLogger(IntroduceeManager.class.getName()); Logger.getLogger(IntroduceeManager.class.getName());
static final String SIGNING_LABEL_RESPONSE =
CLIENT_ID.getString() + "/RESPONSE";
private final MessageSender messageSender; private final MessageSender messageSender;
private final DatabaseComponent db; private final DatabaseComponent db;
private final ClientHelper clientHelper; private final ClientHelper clientHelper;
@@ -288,8 +291,7 @@ class IntroduceeManager {
@Nullable @Nullable
private BdfDictionary performTasks(Transaction txn, private BdfDictionary performTasks(Transaction txn,
BdfDictionary localState) BdfDictionary localState) throws FormatException, DbException {
throws FormatException, DbException {
if (!localState.containsKey(TASK) || localState.get(TASK) == NULL_VALUE) if (!localState.containsKey(TASK) || localState.get(TASK) == NULL_VALUE)
return null; return null;
@@ -306,22 +308,21 @@ class IntroduceeManager {
} }
// figure out who takes which role by comparing public keys // figure out who takes which role by comparing public keys
byte[] publicKeyBytes = localState.getRaw(OUR_PUBLIC_KEY); byte[] ourPublicKeyBytes = localState.getRaw(OUR_PUBLIC_KEY);
byte[] theirEphemeralKey = localState.getRaw(E_PUBLIC_KEY); byte[] theirPublicKeyBytes = localState.getRaw(E_PUBLIC_KEY);
int comp = Bytes.COMPARATOR.compare(new Bytes(publicKeyBytes), int comp = Bytes.COMPARATOR.compare(new Bytes(ourPublicKeyBytes),
new Bytes(theirEphemeralKey)); new Bytes(theirPublicKeyBytes));
boolean alice = comp < 0; boolean alice = comp < 0;
// get our local author // get our local author
LocalAuthor author = identityManager.getLocalAuthor(txn); LocalAuthor author = identityManager.getLocalAuthor(txn);
SecretKey secretKey; SecretKey secretKey;
byte[] privateKeyBytes = localState.getRaw(OUR_PRIVATE_KEY); byte[] ourPrivateKeyBytes = localState.getRaw(OUR_PRIVATE_KEY);
try { try {
// derive secret master key // derive secret master key
secretKey = secretKey = deriveSecretKey(ourPublicKeyBytes,
deriveSecretKey(publicKeyBytes, privateKeyBytes, alice, ourPrivateKeyBytes, alice, theirPublicKeyBytes);
theirEphemeralKey);
// derive MAC keys and nonces, sign our nonce and calculate MAC // derive MAC keys and nonces, sign our nonce and calculate MAC
deriveMacKeysAndNonces(localState, author, secretKey, alice); deriveMacKeysAndNonces(localState, author, secretKey, alice);
} catch (GeneralSecurityException e) { } catch (GeneralSecurityException e) {
@@ -410,34 +411,36 @@ class IntroduceeManager {
return null; return null;
} }
private SecretKey deriveSecretKey(byte[] publicKeyBytes, private SecretKey deriveSecretKey(byte[] ourPublicKeyBytes,
byte[] privateKeyBytes, boolean alice, byte[] theirPublicKey) byte[] ourPrivateKeyBytes, boolean alice,
throws GeneralSecurityException { byte[] theirPublicKeyBytes) throws GeneralSecurityException {
// parse the local ephemeral key pair // parse the local ephemeral key pair
KeyParser keyParser = cryptoComponent.getAgreementKeyParser(); KeyParser keyParser = cryptoComponent.getAgreementKeyParser();
PublicKey publicKey; PublicKey ourPublicKey;
PrivateKey privateKey; PrivateKey ourPrivateKey;
try { try {
publicKey = keyParser.parsePublicKey(publicKeyBytes); ourPublicKey = keyParser.parsePublicKey(ourPublicKeyBytes);
privateKey = keyParser.parsePrivateKey(privateKeyBytes); ourPrivateKey = keyParser.parsePrivateKey(ourPrivateKeyBytes);
} catch (GeneralSecurityException e) { } catch (GeneralSecurityException e) {
if (LOG.isLoggable(WARNING)) { if (LOG.isLoggable(WARNING)) {
LOG.log(WARNING, e.toString(), e); LOG.log(WARNING, e.toString(), e);
} }
throw new RuntimeException("Our own ephemeral key is invalid"); throw new RuntimeException("Our own ephemeral key is invalid");
} }
KeyPair keyPair = new KeyPair(publicKey, privateKey); KeyPair ourKeyPair = new KeyPair(ourPublicKey, ourPrivateKey);
PublicKey theirPublicKey =
keyParser.parsePublicKey(theirPublicKeyBytes);
// The master secret is derived from the local ephemeral key pair // The shared secret is derived from the local ephemeral key pair
// and the remote ephemeral public key // and the remote ephemeral public key
return cryptoComponent return cryptoComponent.deriveSharedSecret(SHARED_SECRET_LABEL,
.deriveMasterSecret(theirPublicKey, keyPair, alice); theirPublicKey, ourKeyPair, alice);
} }
/** /**
* Derives nonces, signs our nonce and calculates MAC * Derives nonces, signs our nonce and calculates MAC
* <p> * <p>
* Derives two nonces and two mac keys from the secret master key. * Derives two nonces and two MAC keys from the shared secret key.
* The other introducee's nonce and MAC key are added to the localState. * The other introducee's nonce and MAC key are added to the localState.
* <p> * <p>
* Our nonce is signed with the local author's long-term private key. * Our nonce is signed with the local author's long-term private key.
@@ -448,21 +451,23 @@ class IntroduceeManager {
private void deriveMacKeysAndNonces(BdfDictionary localState, private void deriveMacKeysAndNonces(BdfDictionary localState,
LocalAuthor author, SecretKey secretKey, boolean alice) LocalAuthor author, SecretKey secretKey, boolean alice)
throws FormatException, GeneralSecurityException { throws FormatException, GeneralSecurityException {
// Derive two nonces and a MAC key from the secret master key // Derive two nonces and MAC keys from the shared secret key
byte[] ourNonce = byte[] ourNonce = cryptoComponent.deriveKeyBindingNonce(
cryptoComponent.deriveSignatureNonce(secretKey, alice); alice ? ALICE_NONCE_LABEL : BOB_NONCE_LABEL, secretKey);
byte[] theirNonce = byte[] theirNonce = cryptoComponent.deriveKeyBindingNonce(
cryptoComponent.deriveSignatureNonce(secretKey, !alice); alice ? BOB_NONCE_LABEL : ALICE_NONCE_LABEL, secretKey);
SecretKey macKey = cryptoComponent.deriveMacKey(secretKey, alice); SecretKey ourMacKey = cryptoComponent.deriveKey(
SecretKey theirMacKey = cryptoComponent.deriveMacKey(secretKey, !alice); alice ? ALICE_MAC_KEY_LABEL : BOB_MAC_KEY_LABEL, secretKey);
SecretKey theirMacKey = cryptoComponent.deriveKey(
alice ? BOB_MAC_KEY_LABEL : ALICE_MAC_KEY_LABEL, secretKey);
// Save the other nonce and MAC key for the verification // Save the other nonce and MAC key for the verification
localState.put(NONCE, theirNonce); localState.put(NONCE, theirNonce);
localState.put(MAC_KEY, theirMacKey.getBytes()); localState.put(MAC_KEY, theirMacKey.getBytes());
// Sign our nonce with our long-term identity public key // Sign our nonce with our long-term identity public key
byte[] sig = cryptoComponent byte[] sig = cryptoComponent.sign(SIGNING_LABEL, ourNonce,
.sign(SIGNING_LABEL_RESPONSE, ourNonce, author.getPrivateKey()); author.getPrivateKey());
// Calculate a MAC over identity public key, ephemeral public key, // Calculate a MAC over identity public key, ephemeral public key,
// transport properties and timestamp. // transport properties and timestamp.
@@ -472,7 +477,7 @@ class IntroduceeManager {
BdfList toMacList = BdfList.of(author.getPublicKey(), BdfList toMacList = BdfList.of(author.getPublicKey(),
publicKeyBytes, tp, ourTime); publicKeyBytes, tp, ourTime);
byte[] toMac = clientHelper.toByteArray(toMacList); byte[] toMac = clientHelper.toByteArray(toMacList);
byte[] mac = cryptoComponent.mac(macKey, toMac); byte[] mac = cryptoComponent.mac(MAC_LABEL, ourMacKey, toMac);
// Add MAC and signature to localState, so it can be included in ACK // Add MAC and signature to localState, so it can be included in ACK
localState.put(OUR_MAC, mac); localState.put(OUR_MAC, mac);
@@ -486,7 +491,7 @@ class IntroduceeManager {
byte[] key = localState.getRaw(PUBLIC_KEY); byte[] key = localState.getRaw(PUBLIC_KEY);
// Verify the signature // Verify the signature
if (!cryptoComponent.verify(SIGNING_LABEL_RESPONSE, nonce, key, sig)) { if (!cryptoComponent.verify(SIGNING_LABEL, nonce, key, sig)) {
LOG.warning("Invalid nonce signature in ACK"); LOG.warning("Invalid nonce signature in ACK");
throw new GeneralSecurityException(); throw new GeneralSecurityException();
} }
@@ -506,7 +511,7 @@ class IntroduceeManager {
long timestamp = localState.getLong(TIME); long timestamp = localState.getLong(TIME);
BdfList toMacList = BdfList.of(pubKey, ePubKey, tp, timestamp); BdfList toMacList = BdfList.of(pubKey, ePubKey, tp, timestamp);
byte[] toMac = clientHelper.toByteArray(toMacList); byte[] toMac = clientHelper.toByteArray(toMacList);
byte[] calculatedMac = cryptoComponent.mac(macKey, toMac); byte[] calculatedMac = cryptoComponent.mac(MAC_LABEL, macKey, toMac);
if (!Arrays.equals(mac, calculatedMac)) { if (!Arrays.equals(mac, calculatedMac)) {
LOG.warning("Received ACK with invalid MAC"); LOG.warning("Received ACK with invalid MAC");
throw new GeneralSecurityException(); throw new GeneralSecurityException();

15
briar-core/src/test/java/org/briarproject/briar/introduction/IntroduceeManagerTest.java
View File

@@ -53,6 +53,7 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.INTR
import static org.briarproject.briar.api.introduction.IntroductionConstants.LOCAL_AUTHOR_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.LOCAL_AUTHOR_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_LENGTH; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_LENGTH;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_TIME; import static org.briarproject.briar.api.introduction.IntroductionConstants.MESSAGE_TIME;
@@ -66,6 +67,7 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE
import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE_INTRODUCEE; import static org.briarproject.briar.api.introduction.IntroductionConstants.ROLE_INTRODUCEE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SESSION_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.SESSION_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE; import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNING_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.STATE; import static org.briarproject.briar.api.introduction.IntroductionConstants.STATE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.STORAGE_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.STORAGE_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TIME; import static org.briarproject.briar.api.introduction.IntroductionConstants.TIME;
@@ -74,7 +76,6 @@ import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ACK; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_ACK;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_REQUEST; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_REQUEST;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE;
import static org.briarproject.briar.introduction.IntroduceeManager.SIGNING_LABEL_RESPONSE;
import static org.hamcrest.Matchers.array; import static org.hamcrest.Matchers.array;
import static org.hamcrest.Matchers.samePropertyValuesAs; import static org.hamcrest.Matchers.samePropertyValuesAs;
import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertFalse;
@@ -266,7 +267,7 @@ public class IntroduceeManagerTest extends BriarTestCase {
); );
context.checking(new Expectations() {{ context.checking(new Expectations() {{
oneOf(cryptoComponent).verify(SIGNING_LABEL_RESPONSE, nonce, oneOf(cryptoComponent).verify(SIGNING_LABEL, nonce,
introducee2.getAuthor().getPublicKey(), sig); introducee2.getAuthor().getPublicKey(), sig);
will(returnValue(false)); will(returnValue(false));
}}); }});
@@ -296,7 +297,7 @@ public class IntroduceeManagerTest extends BriarTestCase {
state.put(SIGNATURE, sig); state.put(SIGNATURE, sig);
context.checking(new Expectations() {{ context.checking(new Expectations() {{
oneOf(cryptoComponent).verify(SIGNING_LABEL_RESPONSE, nonce, oneOf(cryptoComponent).verify(SIGNING_LABEL, nonce,
publicKeyBytes, sig); publicKeyBytes, sig);
will(returnValue(true)); will(returnValue(true));
}}); }});
@@ -330,7 +331,8 @@ public class IntroduceeManagerTest extends BriarTestCase {
BdfList.of(publicKeyBytes, ePublicKeyBytes, tp, time)); BdfList.of(publicKeyBytes, ePublicKeyBytes, tp, time));
will(returnValue(signBytes)); will(returnValue(signBytes));
//noinspection unchecked //noinspection unchecked
oneOf(cryptoComponent).mac(with(samePropertyValuesAs(macKey)), oneOf(cryptoComponent).mac(with(MAC_LABEL),
with(samePropertyValuesAs(macKey)),
with(array(equal(signBytes)))); with(array(equal(signBytes))));
will(returnValue(mac)); will(returnValue(mac));
}}); }});
@@ -343,14 +345,15 @@ public class IntroduceeManagerTest extends BriarTestCase {
BdfList.of(publicKeyBytes, ePublicKeyBytes, tp, time)); BdfList.of(publicKeyBytes, ePublicKeyBytes, tp, time));
will(returnValue(signBytes)); will(returnValue(signBytes));
//noinspection unchecked //noinspection unchecked
oneOf(cryptoComponent).mac(with(samePropertyValuesAs(macKey)), oneOf(cryptoComponent).mac(with(MAC_LABEL),
with(samePropertyValuesAs(macKey)),
with(array(equal(signBytes)))); with(array(equal(signBytes))));
will(returnValue(TestUtils.getRandomBytes(MAC_LENGTH))); will(returnValue(TestUtils.getRandomBytes(MAC_LENGTH)));
}}); }});
try { try {
introduceeManager.verifyMac(state); introduceeManager.verifyMac(state);
fail(); fail();
} catch(GeneralSecurityException e) { } catch (GeneralSecurityException e) {
// expected // expected
} }
context.assertIsSatisfied(); context.assertIsSatisfied();

43
briar-core/src/test/java/org/briarproject/briar/introduction/IntroductionIntegrationTest.java
View File

@@ -56,21 +56,25 @@ import javax.inject.Inject;
import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH; import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
import static org.briarproject.bramble.test.TestPluginConfigModule.TRANSPORT_ID; import static org.briarproject.bramble.test.TestPluginConfigModule.TRANSPORT_ID;
import static org.briarproject.briar.api.client.MessageQueueManager.QUEUE_STATE_KEY; import static org.briarproject.briar.api.client.MessageQueueManager.QUEUE_STATE_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ALICE_MAC_KEY_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.ALICE_NONCE_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.E_PUBLIC_KEY; import static org.briarproject.briar.api.introduction.IntroductionConstants.E_PUBLIC_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.GROUP_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.GROUP_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY; import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.MAC_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.NAME; import static org.briarproject.briar.api.introduction.IntroductionConstants.NAME;
import static org.briarproject.briar.api.introduction.IntroductionConstants.NONCE; import static org.briarproject.briar.api.introduction.IntroductionConstants.NONCE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.PUBLIC_KEY; import static org.briarproject.briar.api.introduction.IntroductionConstants.PUBLIC_KEY;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SESSION_ID; import static org.briarproject.briar.api.introduction.IntroductionConstants.SESSION_ID;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SHARED_SECRET_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE; import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNATURE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.SIGNING_LABEL;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TIME; import static org.briarproject.briar.api.introduction.IntroductionConstants.TIME;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TRANSPORT; import static org.briarproject.briar.api.introduction.IntroductionConstants.TRANSPORT;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_REQUEST; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_REQUEST;
import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE; import static org.briarproject.briar.api.introduction.IntroductionConstants.TYPE_RESPONSE;
import static org.briarproject.briar.introduction.IntroduceeManager.SIGNING_LABEL_RESPONSE;
import static org.briarproject.briar.test.BriarTestUtils.assertGroupCount; import static org.briarproject.briar.test.BriarTestUtils.assertGroupCount;
import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertFalse;
@@ -635,7 +639,7 @@ public class IntroductionIntegrationTest
// adapt outgoing message queue to removed message // adapt outgoing message queue to removed message
Group g2 = introductionGroupFactory Group g2 = introductionGroupFactory
.createIntroductionGroup(contact2From0); .createIntroductionGroup(contact2From0);
decreaseOutgoingMessageCounter(ch, g2.getId(), 1); decreaseOutgoingMessageCounter(ch, g2.getId());
// allow visitor to modify response // allow visitor to modify response
boolean earlyAbort = visitor.visit(response); boolean earlyAbort = visitor.visit(response);
@@ -746,34 +750,33 @@ public class IntroductionIntegrationTest
// create keys // create keys
KeyPair keyPair1 = crypto.generateSignatureKeyPair(); KeyPair keyPair1 = crypto.generateSignatureKeyPair();
KeyPair eKeyPair1 = crypto.generateAgreementKeyPair(); KeyPair eKeyPair1 = crypto.generateAgreementKeyPair();
byte[] ePublicKeyBytes1 = eKeyPair1.getPublic().getEncoded();
KeyPair eKeyPair2 = crypto.generateAgreementKeyPair(); KeyPair eKeyPair2 = crypto.generateAgreementKeyPair();
byte[] ePublicKeyBytes2 = eKeyPair2.getPublic().getEncoded();
// Nonce 1 // Nonce 1
SecretKey secretKey = SecretKey sharedSecret = crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
crypto.deriveMasterSecret(ePublicKeyBytes2, eKeyPair1, true); eKeyPair2.getPublic(), eKeyPair1, true);
byte[] nonce1 = crypto.deriveSignatureNonce(secretKey, true); byte[] nonce1 = crypto.deriveKeyBindingNonce(ALICE_NONCE_LABEL,
sharedSecret);
// Signature 1 // Signature 1
byte[] sig1 = crypto.sign(SIGNING_LABEL_RESPONSE, nonce1, byte[] sig1 = crypto.sign(SIGNING_LABEL, nonce1,
keyPair1.getPrivate().getEncoded()); keyPair1.getPrivate().getEncoded());
// MAC 1 // MAC 1
SecretKey macKey1 = crypto.deriveMacKey(secretKey, true); SecretKey macKey1 = crypto.deriveKey(ALICE_MAC_KEY_LABEL, sharedSecret);
BdfDictionary tp1 = BdfDictionary.of(new BdfEntry("fake", "fake")); BdfDictionary tp1 = BdfDictionary.of(new BdfEntry("fake", "fake"));
long time1 = clock.currentTimeMillis(); long time1 = clock.currentTimeMillis();
BdfList toMacList = BdfList.of(keyPair1.getPublic().getEncoded(), BdfList toMacList = BdfList.of(keyPair1.getPublic().getEncoded(),
ePublicKeyBytes1, tp1, time1); eKeyPair1.getPublic().getEncoded(), tp1, time1);
byte[] toMac = clientHelper.toByteArray(toMacList); byte[] toMac = clientHelper.toByteArray(toMacList);
byte[] mac1 = crypto.mac(macKey1, toMac); byte[] mac1 = crypto.mac(MAC_LABEL, macKey1, toMac);
// create only relevant part of state for introducee2 // create only relevant part of state for introducee2
BdfDictionary state = new BdfDictionary(); BdfDictionary state = new BdfDictionary();
state.put(PUBLIC_KEY, keyPair1.getPublic().getEncoded()); state.put(PUBLIC_KEY, keyPair1.getPublic().getEncoded());
state.put(TRANSPORT, tp1); state.put(TRANSPORT, tp1);
state.put(TIME, time1); state.put(TIME, time1);
state.put(E_PUBLIC_KEY, ePublicKeyBytes1); state.put(E_PUBLIC_KEY, eKeyPair1.getPublic().getEncoded());
state.put(MAC, mac1); state.put(MAC, mac1);
state.put(MAC_KEY, macKey1.getBytes()); state.put(MAC_KEY, macKey1.getBytes());
state.put(NONCE, nonce1); state.put(NONCE, nonce1);
@@ -786,16 +789,16 @@ public class IntroductionIntegrationTest
// replace ephemeral key pair and recalculate matching keys and nonce // replace ephemeral key pair and recalculate matching keys and nonce
KeyPair eKeyPair1f = crypto.generateAgreementKeyPair(); KeyPair eKeyPair1f = crypto.generateAgreementKeyPair();
byte[] ePublicKeyBytes1f = eKeyPair1f.getPublic().getEncoded(); byte[] ePublicKeyBytes1f = eKeyPair1f.getPublic().getEncoded();
secretKey = sharedSecret = crypto.deriveSharedSecret(SHARED_SECRET_LABEL,
crypto.deriveMasterSecret(ePublicKeyBytes2, eKeyPair1f, true); eKeyPair2.getPublic(), eKeyPair1f, true);
nonce1 = crypto.deriveSignatureNonce(secretKey, true); nonce1 = crypto.deriveKeyBindingNonce(ALICE_NONCE_LABEL, sharedSecret);
// recalculate MAC // recalculate MAC
macKey1 = crypto.deriveMacKey(secretKey, true); macKey1 = crypto.deriveKey(ALICE_MAC_KEY_LABEL, sharedSecret);
toMacList = BdfList.of(keyPair1.getPublic().getEncoded(), toMacList = BdfList.of(keyPair1.getPublic().getEncoded(),
ePublicKeyBytes1f, tp1, time1); ePublicKeyBytes1f, tp1, time1);
toMac = clientHelper.toByteArray(toMacList); toMac = clientHelper.toByteArray(toMacList);
mac1 = crypto.mac(macKey1, toMac); mac1 = crypto.mac(MAC_LABEL, macKey1, toMac);
// update state with faked information // update state with faked information
state.put(E_PUBLIC_KEY, ePublicKeyBytes1f); state.put(E_PUBLIC_KEY, ePublicKeyBytes1f);
@@ -970,12 +973,12 @@ public class IntroductionIntegrationTest
} }
private void decreaseOutgoingMessageCounter(ClientHelper ch, GroupId g, private void decreaseOutgoingMessageCounter(ClientHelper ch, GroupId g)
int num) throws FormatException, DbException { throws FormatException, DbException {
BdfDictionary gD = ch.getGroupMetadataAsDictionary(g); BdfDictionary gD = ch.getGroupMetadataAsDictionary(g);
LOG.warning(gD.toString()); LOG.warning(gD.toString());
BdfDictionary queue = gD.getDictionary(QUEUE_STATE_KEY); BdfDictionary queue = gD.getDictionary(QUEUE_STATE_KEY);
queue.put("nextOut", queue.getLong("nextOut") - num); queue.put("nextOut", queue.getLong("nextOut") - 1);
gD.put(QUEUE_STATE_KEY, queue); gD.put(QUEUE_STATE_KEY, queue);
ch.mergeGroupMetadata(g, gD); ch.mergeGroupMetadata(g, gD);
} }