olm/src/ratchet.cpp

/* Copyright 2015 OpenMarket Ltd
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "axolotl/ratchet.hh"
#include "axolotl/message.hh"
#include "axolotl/memory.hh"

#include <cstring>

namespace {

std::uint8_t PROTOCOL_VERSION = 3;
std::size_t MAC_LENGTH = 8;
std::size_t KEY_LENGTH = axolotl::Curve25519PublicKey::LENGTH;
std::uint8_t MESSAGE_KEY_SEED[1] = {0x01};
std::uint8_t CHAIN_KEY_SEED[1] = {0x02};
std::size_t MAX_MESSAGE_GAP = 2000;

void create_chain_key(
    axolotl::SharedKey const & root_key,
    axolotl::Curve25519KeyPair const & our_key,
    axolotl::Curve25519PublicKey const & their_key,
    axolotl::KdfInfo const & info,
    axolotl::SharedKey & new_root_key,
    axolotl::ChainKey & new_chain_key
) {
    axolotl::SharedKey secret;
    axolotl::curve25519_shared_secret(our_key, their_key, secret);
    std::uint8_t derived_secrets[64];
    axolotl::hkdf_sha256(
        secret, sizeof(secret),
        root_key, sizeof(root_key),
        info.ratchet_info, info.ratchet_info_length,
        derived_secrets, sizeof(derived_secrets)
    );
    std::memcpy(new_root_key, derived_secrets, 32);
    std::memcpy(new_chain_key.key, derived_secrets + 32, 32);
    new_chain_key.index = 0;
    axolotl::unset(derived_secrets);
    axolotl::unset(secret);
}


void advance_chain_key(
    axolotl::ChainKey const & chain_key,
    axolotl::ChainKey & new_chain_key
) {
    axolotl::hmac_sha256(
        chain_key.key, sizeof(chain_key.key),
        CHAIN_KEY_SEED, sizeof(CHAIN_KEY_SEED),
        new_chain_key.key
    );
    new_chain_key.index = chain_key.index + 1;
}


void create_message_keys(
    axolotl::ChainKey const & chain_key,
    axolotl::KdfInfo const & info,
    axolotl::MessageKey & message_key
) {
    axolotl::SharedKey secret;
    axolotl::hmac_sha256(
        chain_key.key, sizeof(chain_key.key),
        MESSAGE_KEY_SEED, sizeof(MESSAGE_KEY_SEED),
        secret
    );
    std::uint8_t derived_secrets[80];
    axolotl::hkdf_sha256(
        secret, sizeof(secret),
        NULL, 0,
        info.message_info, info.message_info_length,
        derived_secrets, sizeof(derived_secrets)
    );
    std::memcpy(message_key.cipher_key.key, derived_secrets, 32);
    std::memcpy(message_key.mac_key, derived_secrets + 32, 32);
    std::memcpy(message_key.iv.iv, derived_secrets + 64, 16);
    message_key.index = chain_key.index;
    axolotl::unset(derived_secrets);
    axolotl::unset(secret);
}


bool verify_mac(
    axolotl::MessageKey const & message_key,
    std::uint8_t const * input,
    axolotl::MessageReader const & reader
) {
    std::uint8_t mac[axolotl::HMAC_SHA256_OUTPUT_LENGTH];
    axolotl::hmac_sha256(
        message_key.mac_key, sizeof(message_key.mac_key),
        input, reader.body_length,
        mac
    );

    bool result = axolotl::is_equal(mac, reader.mac, MAC_LENGTH);
    axolotl::unset(mac);
    return result;
}


bool verify_mac_for_existing_chain(
    axolotl::Session const & session,
    axolotl::ChainKey const & chain,
    std::uint8_t const * input,
    axolotl::MessageReader const & reader
) {
    if (reader.counter < chain.index) {
        return false;
    }

    /* Limit the number of hashes we're prepared to compute */
    if (reader.counter - chain.index > MAX_MESSAGE_GAP) {
        return false;
    }

    axolotl::ChainKey new_chain = chain;

    while (new_chain.index < reader.counter) {
        advance_chain_key(new_chain, new_chain);
    }

    axolotl::MessageKey message_key;
    create_message_keys(new_chain, session.kdf_info, message_key);

    bool result = verify_mac(message_key, input, reader);
    axolotl::unset(new_chain);
    return result;
}


bool verify_mac_for_new_chain(
    axolotl::Session const & session,
    std::uint8_t const * input,
    axolotl::MessageReader const & reader
) {
    axolotl::SharedKey new_root_key;
    axolotl::ReceiverChain new_chain;

    /* They shouldn't move to a new chain until we've sent them a message
     * acknowledging the last one */
    if (session.sender_chain.empty()) {
        return false;
    }

    /* Limit the number of hashes we're prepared to compute */
    if (reader.counter > MAX_MESSAGE_GAP) {
        return false;
    }
    std::memcpy(
        new_chain.ratchet_key.public_key, reader.ratchet_key, KEY_LENGTH
    );

    create_chain_key(
        session.root_key, session.sender_chain[0].ratchet_key,
        new_chain.ratchet_key, session.kdf_info,
        new_root_key, new_chain.chain_key
    );

    bool result = verify_mac_for_existing_chain(
        session, new_chain.chain_key, input, reader
    );
    axolotl::unset(new_root_key);
    axolotl::unset(new_chain);
    return result;
}

} // namespace


axolotl::Session::Session(
    axolotl::KdfInfo const & kdf_info
) : kdf_info(kdf_info), last_error(axolotl::ErrorCode::SUCCESS) {
}


void axolotl::Session::initialise_as_bob(
    std::uint8_t const * shared_secret, std::size_t shared_secret_length,
    axolotl::Curve25519PublicKey const & their_ratchet_key
) {
    std::uint8_t derived_secrets[64];
    axolotl::hkdf_sha256(
        shared_secret, shared_secret_length,
        NULL, 0,
        kdf_info.root_info, kdf_info.root_info_length,
        derived_secrets, sizeof(derived_secrets)
    );
    receiver_chains.insert();
    std::memcpy(root_key, derived_secrets, 32);
    std::memcpy(receiver_chains[0].chain_key.key, derived_secrets + 32, 32);
    receiver_chains[0].ratchet_key = their_ratchet_key;
    axolotl::unset(derived_secrets);
}


void axolotl::Session::initialise_as_alice(
    std::uint8_t const * shared_secret, std::size_t shared_secret_length,
    axolotl::Curve25519KeyPair const & our_ratchet_key
) {
    std::uint8_t derived_secrets[64];
    axolotl::hkdf_sha256(
        shared_secret, shared_secret_length,
        NULL, 0,
        kdf_info.root_info, kdf_info.root_info_length,
        derived_secrets, sizeof(derived_secrets)
    );
    sender_chain.insert();
    std::memcpy(root_key, derived_secrets, 32);
    std::memcpy(sender_chain[0].chain_key.key, derived_secrets + 32, 32);
    sender_chain[0].ratchet_key = our_ratchet_key;
    axolotl::unset(derived_secrets);
}


std::size_t axolotl::Session::pickle_max_output_length() {
    std::size_t counter_length = 4;
    std::size_t send_chain_length = counter_length + 64 + 32;
    std::size_t recv_chain_length = counter_length + 32 + 32;
    std::size_t skip_key_length = counter_length + 32 + 32 + 32 + 16;
    std::size_t pickle_length = 3 * counter_length + 32;
    pickle_length += sender_chain.size() * send_chain_length;
    pickle_length += receiver_chains.size() * recv_chain_length;
    pickle_length += skipped_message_keys.size() * skip_key_length;
    return axolotl::aes_encrypt_cbc_length(pickle_length) + MAC_LENGTH;
}

namespace {

std::uint8_t * pickle_counter(
    std::uint8_t * output, std::uint32_t value
) {
    unsigned i = 4;
    output += 4;
    while (i--) { *(--output) = value; value >>= 8; }
    return output + 4;
}

std::uint8_t * unpickle_counter(
    std::uint8_t *input, std::uint32_t &value
) {
    unsigned i = 4;
    value = 0;
    while (i--) { value <<= 8; value |= *(input++); }
    return input;
}

std::uint8_t * pickle_bytes(
    std::uint8_t * output, std::size_t count, std::uint8_t const * bytes
) {
    std::memcpy(output, bytes, count);
    return output + count;
}

std::uint8_t * unpickle_bytes(
    std::uint8_t * input, std::size_t count, std::uint8_t * bytes
) {
    std::memcpy(bytes, input, count);
    return input + count;
}

} // namespace


std::size_t axolotl::Session::pickle(
    std::uint8_t const * key, std::size_t key_length,
    std::uint8_t * output, std::size_t max_output_length
) {
    std::uint8_t * pos = output;
    if (max_output_length < pickle_max_output_length()) {
        last_error = axolotl::ErrorCode::OUTPUT_BUFFER_TOO_SMALL;
        return std::size_t(-1);
    }

    pos = pickle_counter(pos, sender_chain.size());
    pos = pickle_counter(pos, receiver_chains.size());
    pos = pickle_counter(pos, skipped_message_keys.size());
    pos = pickle_bytes(pos, 32, root_key);
    for (const axolotl::SenderChain &chain : sender_chain) {
        pos = pickle_counter(pos, chain.chain_key.index);
        pos = pickle_bytes(pos, 32, chain.chain_key.key);
        pos = pickle_bytes(pos, 32, chain.ratchet_key.public_key);
        pos = pickle_bytes(pos, 32, chain.ratchet_key.private_key);
    }
    for (const axolotl::ReceiverChain &chain : receiver_chains) {
        pos = pickle_counter(pos, chain.chain_key.index);
        pos = pickle_bytes(pos, 32, chain.chain_key.key);
        pos = pickle_bytes(pos, 32, chain.ratchet_key.public_key);
    }
    for (const axolotl::SkippedMessageKey &key : skipped_message_keys) {
        pos = pickle_counter(pos, key.message_key.index);
        pos = pickle_bytes(pos, 32, key.message_key.cipher_key.key);
        pos = pickle_bytes(pos, 32, key.message_key.mac_key);
        pos = pickle_bytes(pos, 16, key.message_key.iv.iv);
        pos = pickle_bytes(pos, 32, key.ratchet_key.public_key);
    }
}

std::size_t axolotl::Session::unpickle(
    std::uint8_t const * key, std::size_t key_length,
    std::uint8_t * input, std::size_t input_length
) {

    std::uint8_t * pos = input;
    std::uint8_t * end = input + input_length;
    std::uint32_t send_chain_num, recv_chain_num, skipped_num;

    if (end - pos < 4 * 3 + 32) {} // input too small.

    pos = unpickle_counter(pos, send_chain_num);
    pos = unpickle_counter(pos, recv_chain_num);
    pos = unpickle_counter(pos, skipped_num);
    pos = unpickle_bytes(pos, 32, root_key);

    if (end - pos < send_chain_num * (32 * 3 + 4)) {} // input too small.

    while (send_chain_num--) {
        axolotl::SenderChain & chain = *sender_chain.insert(
            sender_chain.end()
        );
        pos = unpickle_counter(pos, chain.chain_key.index);
        pos = unpickle_bytes(pos, 32, chain.chain_key.key);
        pos = unpickle_bytes(pos, 32, chain.ratchet_key.public_key);
        pos = unpickle_bytes(pos, 32, chain.ratchet_key.private_key);
    }

    if (end - pos < recv_chain_num * (32 * 2 + 4)) {} // input too small.

    while (recv_chain_num--) {
        axolotl::ReceiverChain & chain = *receiver_chains.insert(
            receiver_chains.end()
        );
        pos = unpickle_counter(pos, chain.chain_key.index);
        pos = unpickle_bytes(pos, 32, chain.chain_key.key);
        pos = unpickle_bytes(pos, 32, chain.ratchet_key.public_key);
    }

    if (end - pos < skipped_num * (32 * 3 + 16 + 4)) {} // input too small.

    while (skipped_num--) {
        axolotl::SkippedMessageKey &key = *skipped_message_keys.insert(
            skipped_message_keys.end()
        );
        pos = unpickle_counter(pos, key.message_key.index);
        pos = unpickle_bytes(pos, 32, key.message_key.cipher_key.key);
        pos = unpickle_bytes(pos, 32, key.message_key.mac_key);
        pos = unpickle_bytes(pos, 16, key.message_key.iv.iv);
        pos = unpickle_bytes(pos, 32, key.ratchet_key.public_key);
    }
}


std::size_t axolotl::Session::encrypt_max_output_length(
    std::size_t plaintext_length
) {
    std::size_t counter = 0;
    if (!sender_chain.empty()) {
        counter = sender_chain[0].chain_key.index;
    }
    std::size_t padded = axolotl::aes_encrypt_cbc_length(plaintext_length);
    return axolotl::encode_message_length(
        counter, KEY_LENGTH, padded, MAC_LENGTH
    );
}


std::size_t axolotl::Session::encrypt_random_length() {
    return sender_chain.empty() ? KEY_LENGTH : 0;
}


std::size_t axolotl::Session::encrypt(
    std::uint8_t const * plaintext, std::size_t plaintext_length,
    std::uint8_t const * random, std::size_t random_length,
    std::uint8_t * output, std::size_t max_output_length
) {
    if (random_length < encrypt_random_length()) {
        last_error = axolotl::ErrorCode::NOT_ENOUGH_RANDOM;
        return std::size_t(-1);
    }
    if (max_output_length < encrypt_max_output_length(plaintext_length)) {
        last_error = axolotl::ErrorCode::OUTPUT_BUFFER_TOO_SMALL;
        return std::size_t(-1);
    }

    if (sender_chain.empty()) {
        sender_chain.insert();
        axolotl::generate_key(random, sender_chain[0].ratchet_key);
        create_chain_key(
            root_key,
            sender_chain[0].ratchet_key,
            receiver_chains[0].ratchet_key,
            kdf_info,
            root_key, sender_chain[0].chain_key
        );
    }

    MessageKey keys;
    create_message_keys(sender_chain[0].chain_key, kdf_info, keys);
    advance_chain_key(sender_chain[0].chain_key, sender_chain[0].chain_key);

    std::size_t padded = axolotl::aes_encrypt_cbc_length(plaintext_length);
    std::uint32_t counter = keys.index;
    Curve25519PublicKey const & ratchet_key = sender_chain[0].ratchet_key;

    axolotl::MessageWriter writer(axolotl::encode_message(
        PROTOCOL_VERSION, counter, KEY_LENGTH, padded, output
    ));

    std::memcpy(writer.ratchet_key, ratchet_key.public_key, KEY_LENGTH);

    axolotl::aes_encrypt_cbc(
        keys.cipher_key, keys.iv,
        plaintext, plaintext_length,
        writer.ciphertext
    );

    std::uint8_t mac[axolotl::HMAC_SHA256_OUTPUT_LENGTH];
    axolotl::hmac_sha256(
        keys.mac_key, sizeof(keys.mac_key),
        output, writer.body_length,
        mac
    );
    std::memcpy(writer.mac, mac, MAC_LENGTH);

    axolotl::unset(keys);
    return writer.body_length + MAC_LENGTH;
}


std::size_t axolotl::Session::decrypt_max_plaintext_length(
    std::size_t input_length
) {
    return input_length;
}


std::size_t axolotl::Session::decrypt(
    std::uint8_t const * input, std::size_t input_length,
    std::uint8_t * plaintext, std::size_t max_plaintext_length
) {
    if (max_plaintext_length < decrypt_max_plaintext_length(input_length)) {
        last_error = axolotl::ErrorCode::OUTPUT_BUFFER_TOO_SMALL;
        return std::size_t(-1);
    }

    axolotl::MessageReader reader(axolotl::decode_message(
        input, input_length, MAC_LENGTH
    ));

    if (reader.version != PROTOCOL_VERSION) {
        last_error = axolotl::ErrorCode::BAD_MESSAGE_VERSION;
        return std::size_t(-1);
    }

    if (reader.body_length == 0 || reader.ratchet_key_length != KEY_LENGTH) {
        last_error = axolotl::ErrorCode::BAD_MESSAGE_FORMAT;
        return std::size_t(-1);
    }

    ReceiverChain * chain = NULL;
    for (axolotl::ReceiverChain & receiver_chain : receiver_chains) {
        if (0 == std::memcmp(
                receiver_chain.ratchet_key.public_key, reader.ratchet_key,
                KEY_LENGTH
        )) {
            chain = &receiver_chain;
            break;
        }
    }

    if (!chain) {
        if (!verify_mac_for_new_chain(*this, input, reader)) {
            last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
            return std::size_t(-1);
        }
    } else {
        if (chain->chain_key.index > reader.counter) {
            /* Chain already advanced beyond the key for this message
             * Check if the message keys are in the skipped key list. */
            for (axolotl::SkippedMessageKey & skipped : skipped_message_keys) {
                if (reader.counter == skipped.message_key.index
                        && 0 == std::memcmp(
                            skipped.ratchet_key.public_key, reader.ratchet_key,
                            KEY_LENGTH
                        )
                ) {
                    /* Found the key for this message. Check the MAC. */
                    if (!verify_mac(skipped.message_key, input, reader)) {
                        last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
                        return std::size_t(-1);
                    }

                    std::size_t result = axolotl::aes_decrypt_cbc(
                        skipped.message_key.cipher_key,
                        skipped.message_key.iv,
                        reader.ciphertext, reader.ciphertext_length,
                        plaintext
                    );

                    if (result == std::size_t(-1)) {
                        last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
                        return result;
                    }

                    /* Remove the key from the skipped keys now that we've
                     * decoded the message it corresponds to. */
                    axolotl::unset(skipped);
                    skipped_message_keys.erase(&skipped);
                    return result;
                }
            }
            /* No matching keys for the message, fail with bad mac */
            last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
            return std::size_t(-1);
        } else if (!verify_mac_for_existing_chain(
               *this, chain->chain_key, input, reader
        )) {
            last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
            return std::size_t(-1);
        }
    }

    if (!chain) {
        /* They have started using a new empheral ratchet key.
         * We need to derive a new set of chain keys.
         * We can discard our previous empheral ratchet key.
         * We will generate a new key when we send the next message. */
        chain = receiver_chains.insert();
        std::memcpy(
            chain->ratchet_key.public_key, reader.ratchet_key, KEY_LENGTH
        );
        create_chain_key(
            root_key, sender_chain[0].ratchet_key, chain->ratchet_key,
            kdf_info, root_key, chain->chain_key
        );
        axolotl::unset(sender_chain[0]);
        sender_chain.erase(sender_chain.begin());
    }

    while (chain->chain_key.index < reader.counter) {
        axolotl::SkippedMessageKey & key = *skipped_message_keys.insert();
        create_message_keys(chain->chain_key, kdf_info, key.message_key);
        key.ratchet_key = chain->ratchet_key;
        advance_chain_key(chain->chain_key, chain->chain_key);
    }

    axolotl::MessageKey message_key;
    create_message_keys(chain->chain_key, kdf_info, message_key);
    std::size_t result = axolotl::aes_decrypt_cbc(
        message_key.cipher_key,
        message_key.iv,
        reader.ciphertext, reader.ciphertext_length,
        plaintext
    );
    axolotl::unset(message_key);

    advance_chain_key(chain->chain_key, chain->chain_key);

    if (result == std::size_t(-1)) {
        last_error = axolotl::ErrorCode::BAD_MESSAGE_MAC;
        return std::size_t(-1);
    } else {
        return result;
    }
}