feat: WIP NoiseIK handshake based on libsodium

.gitignore

@@ -78,6 +78,9 @@ build/
 # VScode
 .vscode/
 
+# Tests via Zoff
+.localrun/
+
 # Netbeans
 nbproject
 

auto_tests/forwarding_test.c

@@ -127,7 +127,7 @@ static Forwarding_Subtox *new_forwarding_subtox(const Memory *mem, bool no_udp,
     subtox->dht = new_dht(subtox->log, mem, rng, ns, subtox->mono_time, subtox->net, true, true);
 
     const TCP_Proxy_Info inf = {{{{0}}}};
-    subtox->c = new_net_crypto(subtox->log, mem, rng, ns, subtox->mono_time, subtox->dht, &inf);
+    subtox->c = new_net_crypto(subtox->log, mem, rng, ns, subtox->mono_time, subtox->dht, &inf, true);
 
     subtox->forwarding = new_forwarding(subtox->log, mem, rng, subtox->mono_time, subtox->dht);
     ck_assert(subtox->forwarding != nullptr);

auto_tests/onion_test.c

@@ -472,7 +472,7 @@ static Onions *new_onions(const Memory *mem, const Random *rng, uint16_t port, u
     }
 
     TCP_Proxy_Info inf = {{{{0}}}};
-    on->onion_c = new_onion_client(on->log, mem, rng, on->mono_time, new_net_crypto(on->log, mem, rng, ns, on->mono_time, dht, &inf));
+    on->onion_c = new_onion_client(on->log, mem, rng, on->mono_time, new_net_crypto(on->log, mem, rng, ns, on->mono_time, dht, &inf, true));
 
     if (!on->onion_c) {
         kill_onion_announce(on->onion_a);

toxcore/Messenger.c

@@ -3531,7 +3531,7 @@ Messenger *new_messenger(Mono_Time *mono_time, const Memory *mem, const Random *
         return nullptr;
     }
 
-    m->net_crypto = new_net_crypto(m->log, m->mem, m->rng, m->ns, m->mono_time, m->dht, &options->proxy_info);
+    m->net_crypto = new_net_crypto(m->log, m->mem, m->rng, m->ns, m->mono_time, m->dht, &options->proxy_info, options->noise_compatibility_enabled);
 
     if (m->net_crypto == nullptr) {
         LOGGER_WARNING(m->log, "net_crypto initialisation failed");

toxcore/Messenger.h

@@ -70,6 +70,7 @@ typedef struct Messenger_State_Plugin {
 
 typedef struct Messenger_Options {
     bool ipv6enabled;
+    bool noise_compatibility_enabled;
     bool udp_disabled;
     TCP_Proxy_Info proxy_info;
     uint16_t port_range[2];

toxcore/crypto_core.h

@@ -68,6 +68,11 @@ extern "C" {
  */
 #define CRYPTO_NONCE_SIZE              24
 
+/**
+ * @brief NoiseIK: The number of bytes in a nonce used for encryption/decryption (ChaChaPoly1305-IETF).
+ */
+#define CRYPTO_NOISE_NONCE_SIZE              12
+
 /**
  * @brief The number of bytes in a SHA256 hash.
  */
@@ -78,6 +83,16 @@ extern "C" {
  */
 #define CRYPTO_SHA512_SIZE             64
 
+/**
+ * @brief The number of bytes in a BLAKE2b-512 hash (as defined for Noise in section 12.8.).
+ */
+#define CRYPTO_NOISE_BLAKE2B_HASH_SIZE             64
+
+/**
+ * @brief The number of bytes in a BLAKE2b block.
+ */
+#define CRYPTO_BLAKE2B_BLOCK_SIZE             128
+
 /** @brief Fill a byte array with random bytes.
  *
  * This is the key generator callback and as such must be a cryptographically
@@ -110,6 +125,25 @@ typedef struct Random {
     void *obj;
 } Random;
 
+// TODO(goldroom): struct necessary?
+/** @brief Necessary NoiseIK handshake state information/values.
+ */
+typedef struct Noise_Handshake {
+    uint8_t static_private[CRYPTO_SECRET_KEY_SIZE];
+    uint8_t static_public[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t ephemeral_private[CRYPTO_SECRET_KEY_SIZE];
+    uint8_t ephemeral_public[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t remote_static[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t remote_ephemeral[CRYPTO_PUBLIC_KEY_SIZE];
+    // TODO(goldroom): precompute static static? cf. WireGuard struct noise_handshake
+    // uint8_t precomputed_static_static[CRYPTO_SHARED_KEY_SIZE];
+
+    uint8_t hash[CRYPTO_SHA512_SIZE];
+    uint8_t chaining_key[CRYPTO_SHA512_SIZE];
+
+    bool initiator;
+} Noise_Handshake;
+
 /** @brief System random number generator.
  *
  * Uses libsodium's CSPRNG (on Linux, `/dev/urandom`).
@@ -506,6 +540,201 @@ bool crypto_memunlock(void *data, size_t length);
 non_null()
 void new_hmac_key(const Random *rng, uint8_t key[CRYPTO_HMAC_KEY_SIZE]);
 
+/* Necessary functions for Noise, cf. https://noiseprotocol.org/noise.html (Revision 34) */
+
+/**
+ * @brief Encrypt message with precomputed shared key using ChaCha20-Poly1305-IETF (RFC7539).
+ *
+ * Encrypts plain of plain_length to encrypted of plain_length + @ref CRYPTO_MAC_SIZE
+ * using a shared key @ref CRYPTO_SYMMETRIC_KEY_SIZE big and a @ref CRYPTO_NOISE_NONCE_SIZE
+ * byte nonce. The encrypted message, as well as a tag authenticating both the confidential
+ * message m and adlen bytes of non-confidential data ad, are put into encrypted.
+ *
+ * @retval -1 if there was a problem.
+ * @return length of encrypted data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t encrypt_data_symmetric_aead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NOISE_NONCE_SIZE], const uint8_t *plain, size_t plain_length,
+                                    uint8_t *encrypted, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Decrypt message with precomputed shared key using ChaCha20-Poly1305-IETF (RFC7539).
+ *
+ * Decrypts encrypted of encrypted_length to plain of length
+ * `length - CRYPTO_MAC_SIZE` using a shared key @ref CRYPTO_SHARED_KEY_SIZE
+ * big and a @ref CRYPTO_NOISE_NONCE_SIZE byte nonce.
+ *
+ * @retval -1 if there was a problem (decryption failed).
+ * @return length of plain data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t decrypt_data_symmetric_aead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NOISE_NONCE_SIZE], const uint8_t *encrypted, size_t encrypted_length,
+                                    uint8_t *plain, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Encrypt message with precomputed shared key using XChaCha20-Poly1305.
+ *
+ * Encrypts plain of plain_length to encrypted of plain_length + @ref CRYPTO_MAC_SIZE
+ * using a shared key @ref CRYPTO_SYMMETRIC_KEY_SIZE big and a @ref CRYPTO_NONCE_SIZE
+ * byte nonce. The encrypted message, as well as a tag authenticating both the confidential
+ * message m and adlen bytes of non-confidential data ad, are put into encrypted.
+ *
+ * @retval -1 if there was a problem.
+ * @return length of encrypted data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t encrypt_data_symmetric_xaead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NONCE_SIZE], const uint8_t *plain, size_t plain_length,
+                                    uint8_t *encrypted, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Decrypt message with precomputed shared key using XChaCha20-Poly1305.
+ *
+ * Decrypts encrypted of encrypted_length to plain of length
+ * `length - CRYPTO_MAC_SIZE` using a shared key @ref CRYPTO_SHARED_KEY_SIZE
+ * big and a @ref CRYPTO_NONCE_SIZE byte nonce.
+ *
+ * @retval -1 if there was a problem (decryption failed).
+ * @return length of plain data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t decrypt_data_symmetric_xaead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NONCE_SIZE], const uint8_t *encrypted, size_t encrypted_length,
+                                    uint8_t *plain, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Computes the number of provides outputs (=keys) with HKDF-SHA512.
+ *
+ * cf. Noise sections 4.3 and 5.1
+ *
+ * This is Hugo Krawczyk's HKDF:
+ * - https://eprint.iacr.org/2010/264.pdf
+ * - https://tools.ietf.org/html/rfc5869
+ * HKDF(chaining_key, input_key_material, num_outputs): Takes a
+ * chaining_key byte sequence of length HASHLEN, and an input_key_material
+ * byte sequence with length either zero bytes, 32 bytes, or DHLEN bytes.
+ * Returns a pair or triple of byte sequences each of length HASHLEN,
+ * depending on whether num_outputs is two or three:
+ * – Sets temp_key = HMAC-HASH(chaining_key, input_key_material).
+ * – Sets output1 = HMAC-HASH(temp_key, byte(0x01)).
+ * – Sets output2 = HMAC-HASH(temp_key, output1 || byte(0x02)).
+ * – If num_outputs == 2 then returns the pair (output1, output2).
+ * – Sets output3 = HMAC-HASH(temp_key, output2 || byte(0x03)).
+ * – Returns the triple (output1, output2, output3).
+ * Note that temp_key, output1, output2, and output3 are all HASHLEN bytes in
+ * length. Also note that the HKDF() function is simply HKDF with the
+ * chaining_key as HKDF salt, and zero-length HKDF info.
+ *
+ * @param output1 First key to compute
+ * @param first_len Length of output1/key
+ * @param output2 Second key to compute
+ * @param second_len Length of output2/key
+ * @param data HKDF input_key_material byte sequence with length either zero bytes, 32 bytes, or DHLEN bytes
+ * @param data_len length of either zero bytes, 32 bytes, or DHLEN bytes
+ * @param chaining_key Noise 64 byte chaining key as HKDF salt
+ */
+non_null(1, 3, 7) nullable(5)
+void crypto_hkdf(uint8_t *output1, size_t first_len, uint8_t *output2,
+                 size_t second_len, const uint8_t *data,
+                 size_t data_len, const uint8_t chaining_key[CRYPTO_SHA512_SIZE]);
+
+/**
+ * @brief Initializes a Noise Handshake State with provided static X25519 ID key pair, X25519 static ID public key from peer
+ * and sets if initiator or not.
+ *
+ * cf. Noise section 5.3
+ * Calls InitializeSymmetric(protocol_name).
+ * Calls MixHash(prologue).
+ * Sets the initiator, s, e, rs, and re variables to the corresponding arguments.
+ * Calls MixHash() once for each public key listed in the pre-messages.
+ *
+ * @param noise_handshake Noise handshake struct to save the necessary values to
+ * @param self_id_secret_key static private ID X25519 key of this Tox instance
+ * @param peer_id_public_key static public ID X25519 key from the peer to connect to
+ * @param initiator specifies if this Tox instance is the initiator of this crypto connection
+ * @param prologue specifies the Noise prologue, used in call to MixHash(prologue) which maybe zero-length
+ * @param prologue_length length of Noise prologue in bytes
+ *
+ * @return -1 on failure
+ * @return 0 on success
+ */
+non_null(1, 2) nullable(3, 5)
+int noise_handshake_init
+(Noise_Handshake *noise_handshake, const uint8_t self_id_secret_key[CRYPTO_SECRET_KEY_SIZE], const uint8_t peer_id_public_key[CRYPTO_PUBLIC_KEY_SIZE], bool initiator, const uint8_t *prologue, size_t prologue_length);
+
+/**
+ * @brief Noise MixKey(input_key_material)
+ *
+ * cf. Noise section 5.2
+ * Executes the following steps:
+ * - Sets ck, temp_k = HKDF(ck, input_key_material, 2).
+ * - If HASHLEN is 64, then truncates temp_k to 32 bytes
+ * - Calls InitializeKey(temp_k).
+ * input_key_material = DH_X25519(private, public)
+ *
+ * @param chaining_key 64 byte Noise ck
+ * @param shared_key 32 byte secret key to be calculated
+ * @param private_key X25519 private key
+ * @param public_key X25519 public key
+ */
+ non_null()
+int32_t noise_mix_key(uint8_t chaining_key[CRYPTO_SHA512_SIZE], uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                      const uint8_t private_key[CRYPTO_SECRET_KEY_SIZE],
+                      const uint8_t public_key[CRYPTO_PUBLIC_KEY_SIZE]);
+
+/**
+ * @brief Noise MixHash(data): Sets h = HASH(h || data).
+ *
+ * cf. Noise section 5.2
+ *
+ * @param hash Contains current hash, is updated with new hash
+ * @param data to add to hash
+ * @param data_len length of data to hash
+ *
+ */
+non_null(1) nullable(2)
+void noise_mix_hash(uint8_t hash[CRYPTO_SHA512_SIZE], const uint8_t *data, size_t data_len);
+
+/**
+ * @brief Noise EncryptAndHash(plaintext): Sets ciphertext = EncryptWithAd(h,
+ * plaintext), calls MixHash(ciphertext), and returns ciphertext. Note
+ * that if k is empty, the EncryptWithAd() call will set ciphertext equal
+ * to plaintext.
+ *
+ * cf. Noise section 5.2
+ * "Noise spec: Note that if k is empty, the EncryptWithAd() call will set ciphertext equal to plaintext."
+ * This is not the case in Tox.
+ *
+ * @param ciphertext stores encrypted plaintext
+ * @param plaintext to be encrypted
+ * @param plain_length length of plaintext
+ * @param shared_key used for XAEAD encryption
+ * @param hash stores hash value, used as associated data in XAEAD
+ */
+non_null()
+void noise_encrypt_and_hash(uint8_t *ciphertext, const uint8_t *plaintext,
+                            size_t plain_length, uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                            uint8_t hash[CRYPTO_SHA512_SIZE]);
+
+/**
+ * @brief DecryptAndHash(ciphertext): Sets plaintext = DecryptWithAd(h,
+ * ciphertext), calls MixHash(ciphertext), and returns plaintext. Note
+ * that if k is empty, the DecryptWithAd() call will set plaintext equal to
+ * ciphertext.
+ *
+ * cf. Noise section 5.2
+ * "Note that if k is empty, the DecryptWithAd() call will set plaintext equal to ciphertext."
+ * This is not the case in Tox.
+ *
+ * @param ciphertext contains ciphertext to decrypt
+ * @param plaintext stores decrypted ciphertext
+ * @param encrypted_length length of ciphertext+MAC
+ * @param shared_key used for XAEAD decryption
+ * @param hash stores hash value, used as associated data in XAEAD
+ */
+non_null()
+int noise_decrypt_and_hash(uint8_t *plaintext, const uint8_t *ciphertext, 
+                           size_t encrypted_length, uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                           uint8_t hash[CRYPTO_SHA512_SIZE]);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif

toxcore/friend_connection.c

@@ -569,7 +569,7 @@ non_null()
 static int handle_new_connections(void *object, const New_Connection *n_c)
 {
     Friend_Connections *const fr_c = (Friend_Connections *)object;
-    const int friendcon_id = getfriend_conn_id_pk(fr_c, n_c->public_key);
+    const int friendcon_id = getfriend_conn_id_pk(fr_c, n_c->peer_id_public_key);
     Friend_Conn *const friend_con = get_conn(fr_c, friendcon_id);
 
     if (friend_con == nullptr) {
@@ -598,8 +598,8 @@ static int handle_new_connections(void *object, const New_Connection *n_c)
         friend_con->dht_ip_port_lastrecv = mono_time_get(fr_c->mono_time);
     }
 
-    if (!pk_equal(friend_con->dht_temp_pk, n_c->dht_public_key)) {
-        change_dht_pk(fr_c, friendcon_id, n_c->dht_public_key);
+    if (!pk_equal(friend_con->dht_temp_pk, n_c->peer_dht_public_key)) {
+        change_dht_pk(fr_c, friendcon_id, n_c->peer_dht_public_key);
     }
 
     nc_dht_pk_callback(fr_c->net_crypto, id, &dht_pk_callback, fr_c, friendcon_id);

toxcore/logger.c

@@ -83,7 +83,8 @@ void logger_write(const Logger *log, Logger_Level level, const char *file, uint3
 #endif /* WIN32 */
 
     // Format message
-    char msg[1024];
+    // TODO(goldroom): changed from 1024 to 4096
+    char msg[4096];
     va_list args;
     va_start(args, format);
     vsnprintf(msg, sizeof(msg), format, args);