#include #include #include #include #include #include #include #include "dr.h" #include "dr_crypto.h" #include "dr_proto.h" // HKDF-SHA-256 (RFC 5869). Caller provides salt (use zero-filled 32 bytes if // none), input keying material (IKM), info, and the desired output length. // We produce up to N=ceil(L/32) HMAC outputs; with L<=64 this is at most 2. int hkdf_sha256(unsigned char *output, size_t output_len, const unsigned char *salt, size_t salt_len, const unsigned char *ikm, size_t ikm_len, const unsigned char *info, size_t info_len) { if (output_len > 32 * 255) return -1; // Extract: PRK = HMAC-SHA-256(salt, IKM). If salt is NULL, use 32 zero bytes. unsigned char zero_salt[32] = {0}; const unsigned char *use_salt = salt ? salt : zero_salt; size_t use_salt_len = salt ? salt_len : sizeof(zero_salt); unsigned char prk[crypto_auth_hmacsha256_BYTES]; // 32 crypto_auth_hmacsha256_state st; if (crypto_auth_hmacsha256_init(&st, use_salt, use_salt_len) != 0) return -1; if (crypto_auth_hmacsha256_update(&st, ikm, ikm_len) != 0) return -1; if (crypto_auth_hmacsha256_final(&st, prk) != 0) return -1; // Expand: T(i) = HMAC-SHA-256(PRK, T(i-1) || info || i). unsigned char t_prev[crypto_auth_hmacsha256_BYTES]; unsigned char t_curr[crypto_auth_hmacsha256_BYTES]; size_t produced = 0; unsigned char counter = 1; size_t t_prev_len = 0; while (produced < output_len) { if (crypto_auth_hmacsha256_init(&st, prk, sizeof(prk)) != 0) return -1; if (t_prev_len > 0 && crypto_auth_hmacsha256_update(&st, t_prev, t_prev_len) != 0) return -1; if (info_len > 0 && crypto_auth_hmacsha256_update(&st, info, info_len) != 0) return -1; if (crypto_auth_hmacsha256_update(&st, &counter, 1) != 0) return -1; if (crypto_auth_hmacsha256_final(&st, t_curr) != 0) return -1; size_t take = output_len - produced; if (take > sizeof(t_curr)) take = sizeof(t_curr); memcpy(output + produced, t_curr, take); produced += take; memcpy(t_prev, t_curr, sizeof(t_curr)); t_prev_len = sizeof(t_curr); counter++; } sodium_memzero(prk, sizeof(prk)); sodium_memzero(t_prev, sizeof(t_prev)); sodium_memzero(t_curr, sizeof(t_curr)); return 0; } // ============================================================================ // Signal-spec AEAD primitives: AES-256-CBC + HMAC-SHA-256 (truncated to 8B). // Used by dr_encrypt/dr_decrypt as a single encrypt-then-MAC unit. // ============================================================================ // Expand a 32B message key into the per-message Signal triplet // (cipher_key, mac_key, iv) via HKDF-SHA-256. // salt = 32 zero bytes (Signal convention for per-message KDF) // info = "WhisperMessageKeys" (canonical libsignal info string) // L = 80 (32 cipher_key + 32 mac_key + 16 iv) int dr_derive_message_keys(unsigned char *cipher_key, unsigned char *mac_key, unsigned char *iv, const unsigned char *message_key) { unsigned char salt[32] = {0}; unsigned char out[80]; if (hkdf_sha256(out, sizeof(out), salt, sizeof(salt), message_key, DR_MESSAGE_KEY_SIZE, (const unsigned char *)"WhisperMessageKeys", sizeof("WhisperMessageKeys") - 1) != 0) { return -1; } memcpy(cipher_key, out, 32); memcpy(mac_key, out + 32, 32); memcpy(iv, out + 64, 16); sodium_memzero(out, sizeof(out)); return 0; } // DR-HE header cipher-key derivation. The IV is NOT derived here: the same // header_key is reused across every message in a chain, so a deterministic // IV would reveal that two messages share a leading plaintext block (the // inner header's first 16 bytes are the ratchet_key prefix, invariant within // a chain). The Signal DR-HE spec explicitly requires the header AEAD to // avoid IV reuse under the same hk; we generate a fresh random IV per // encrypt and prepend it to enc_header. See `dr_encrypt_core`. // // salt = 32 zero bytes // info = "WhisperHeader" // L = 32 (cipher_key only) int dr_derive_header_cipher_key(unsigned char *cipher_key, const unsigned char *header_key) { unsigned char salt[32] = {0}; if (hkdf_sha256(cipher_key, 32, salt, sizeof(salt), header_key, DR_HEADER_KEY_SIZE, (const unsigned char *)"WhisperHeader", sizeof("WhisperHeader") - 1) != 0) { return -1; } return 0; } // AES-256-CBC encrypt with PKCS#7 padding via OpenSSL EVP. // out_buf must have capacity >= plaintext_len + 16. *out_len receives the // padded ciphertext length. Returns 0 on success, -1 on any EVP failure. int dr_aes_cbc_encrypt(unsigned char *out_buf, size_t *out_len, const unsigned char *plaintext, size_t plaintext_len, const unsigned char *key, const unsigned char *iv) { EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); if (!ctx) return -1; int ok = 0; int len1 = 0, len2 = 0; if (EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv) != 1) goto done; if (EVP_EncryptUpdate(ctx, out_buf, &len1, plaintext, (int)plaintext_len) != 1) goto done; if (EVP_EncryptFinal_ex(ctx, out_buf + len1, &len2) != 1) goto done; *out_len = (size_t)(len1 + len2); ok = 1; done: EVP_CIPHER_CTX_free(ctx); return ok ? 0 : -1; } // AES-256-CBC decrypt + PKCS#7 unpad. Caller has already verified the MAC, so // padding-oracle exposure is closed: a tampered ciphertext fails the MAC and // never reaches this function. int dr_aes_cbc_decrypt(unsigned char *out_buf, size_t *out_len, const unsigned char *ciphertext, size_t ciphertext_len, const unsigned char *key, const unsigned char *iv) { EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); if (!ctx) return -1; int ok = 0; int len1 = 0, len2 = 0; if (EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv) != 1) goto done; if (EVP_DecryptUpdate(ctx, out_buf, &len1, ciphertext, (int)ciphertext_len) != 1) goto done; if (EVP_DecryptFinal_ex(ctx, out_buf + len1, &len2) != 1) goto done; *out_len = (size_t)(len1 + len2); ok = 1; done: EVP_CIPHER_CTX_free(ctx); return ok ? 0 : -1; } // Trial-decrypt enc_header under a candidate header_key. enc_header on the // wire is `iv(16) || aes_cbc_ciphertext` -- the IV is generated freshly per // encrypt and shipped with the ciphertext so the same header_key can be // reused safely across every message in a chain. // // On a valid PKCS#7 unpad AND a successful inner-header protobuf parse // (3 expected fields, 32B ratchet_key), fills *out and returns 0. Returns // -1 on size mismatch, AES-CBC failure, padding error, or malformed // inner protobuf. // // out_plain must have capacity >= enc_header_len - 16. int dr_try_decrypt_header(unsigned char *out_plain, size_t *out_plain_len, dr_message_t *out_msg, const unsigned char *enc_header, size_t enc_header_len, const unsigned char *header_key) { if (enc_header_len < 16 + 16) return -1; size_t ct_len = enc_header_len - 16; if ((ct_len % 16) != 0) return -1; const unsigned char *iv = enc_header; const unsigned char *ciphertext = enc_header + 16; unsigned char hcipher[32]; if (dr_derive_header_cipher_key(hcipher, header_key) != 0) { sodium_memzero(hcipher, sizeof(hcipher)); return -1; } size_t pt_len = 0; int rc = dr_aes_cbc_decrypt(out_plain, &pt_len, ciphertext, ct_len, hcipher, iv); sodium_memzero(hcipher, sizeof(hcipher)); if (rc != 0) return -1; // Reject false positives: the decrypted bytes must parse as the inner // header protobuf (fields 1-3 only; no payload field) with a 32B // ratchet_key. memset(out_msg, 0, sizeof(*out_msg)); size_t pos = 0; while (pos < pt_len) { uint64_t tag = 0; size_t consumed = 0; if (pb_decode_varint(out_plain + pos, pt_len - pos, &tag, &consumed) != 0) return -1; pos += consumed; uint32_t field_number = (uint32_t)(tag >> 3); uint32_t wire_type = (uint32_t)(tag & 0x07); if (field_number == 1 && wire_type == 2) { if (out_msg->seen_ratchet_key) return -1; uint64_t len = 0; if (pb_decode_varint(out_plain + pos, pt_len - pos, &len, &consumed) != 0) return -1; pos += consumed; if (len > pt_len - pos) return -1; out_msg->ratchet_key = out_plain + pos; out_msg->ratchet_key_len = (size_t)len; pos += (size_t)len; out_msg->seen_ratchet_key = 1; } else if (field_number == 2 && wire_type == 0) { if (out_msg->seen_counter) return -1; uint64_t v = 0; if (pb_decode_varint(out_plain + pos, pt_len - pos, &v, &consumed) != 0) return -1; pos += consumed; if (v > UINT32_MAX) return -1; out_msg->counter = (uint32_t)v; out_msg->seen_counter = 1; } else if (field_number == 3 && wire_type == 0) { if (out_msg->seen_previous_counter) return -1; uint64_t v = 0; if (pb_decode_varint(out_plain + pos, pt_len - pos, &v, &consumed) != 0) return -1; pos += consumed; if (v > UINT32_MAX) return -1; out_msg->previous_counter = (uint32_t)v; out_msg->seen_previous_counter = 1; } else { return -1; } } if (!out_msg->seen_ratchet_key || !out_msg->seen_counter || !out_msg->seen_previous_counter) return -1; if (out_msg->ratchet_key_len != crypto_box_PUBLICKEYBYTES) return -1; *out_plain_len = pt_len; return 0; } // Compute the Signal-spec MAC: HMAC-SHA-256(mac_key, sender_id_pub(32) || // receiver_id_pub(32) || version(1) || serialized_message), truncated to the // first 8 bytes. Uses the OpenSSL 3 EVP_MAC API; the legacy HMAC_* // interface is deprecated. int dr_compute_mac(unsigned char *out_mac, const unsigned char *mac_key, const unsigned char *sender_id_pub, const unsigned char *receiver_id_pub, unsigned char version, const unsigned char *serialized, size_t serialized_len) { unsigned char full_mac[32]; size_t full_mac_len = 0; EVP_MAC *mac_algo = EVP_MAC_fetch(NULL, "HMAC", NULL); if (!mac_algo) return -1; EVP_MAC_CTX *ctx = EVP_MAC_CTX_new(mac_algo); int ok = 0; if (!ctx) goto done; char sha256[] = "SHA256"; // OSSL_PARAM_construct_utf8_string wants char * OSSL_PARAM params[] = { OSSL_PARAM_construct_utf8_string("digest", sha256, 0), OSSL_PARAM_construct_end() }; if (EVP_MAC_init(ctx, mac_key, 32, params) != 1) goto done; if (EVP_MAC_update(ctx, sender_id_pub, 32) != 1) goto done; if (EVP_MAC_update(ctx, receiver_id_pub, 32) != 1) goto done; if (EVP_MAC_update(ctx, &version, 1) != 1) goto done; if (EVP_MAC_update(ctx, serialized, serialized_len) != 1) goto done; if (EVP_MAC_final(ctx, full_mac, &full_mac_len, sizeof(full_mac)) != 1) goto done; if (full_mac_len < DR_MAC_LEN) goto done; memcpy(out_mac, full_mac, DR_MAC_LEN); ok = 1; done: EVP_MAC_CTX_free(ctx); EVP_MAC_free(mac_algo); sodium_memzero(full_mac, sizeof(full_mac)); return ok ? 0 : -1; }