diff options
| author |  vnugent <public@vaughnnugent.com> | 2024-05-04 14:06:06 -0400 |
|---|---|---|
| committer | vnugent <public@vaughnnugent.com> | 2024-05-04 14:06:06 -0400 |
| commit | e7375560d465f6da71aae0483c0e7a72535ccc10 (patch) | |
| tree | bbdfcb275ec0b66cfe84b7f8024258eef6c7aa5a /src | |
| parent | 7485aa5a43476c47d54ec51fb96751a14e0ed629 (diff) | |
Squashed commit of the following:
commit 0a40e209d03e8ff9b6f81cd5969d3e845c633bfc
Author: vnugent <public@vaughnnugent.com>
Date: Sat May 4 13:55:19 2024 -0400
ci: Force disable testing for win ci builds
commit 55fae189fffc86f07a3448370f0a746670819712
Author: vnugent <public@vaughnnugent.com>
Date: Thu May 2 21:54:35 2024 -0400
feat: Working and tested openssl impl & defaults
commit 6ff8bb11774c51fd341b7699a3938fd894995fbf
Author: vnugent <public@vaughnnugent.com>
Date: Thu Apr 25 17:45:42 2024 -0400
refactor: Finish support and testing for mbedtls
commit 7cb7a93de4f6f5e741bc5129e3d928e44f050930
Author: vnugent <public@vaughnnugent.com>
Date: Tue Apr 23 18:19:31 2024 -0400
refactor!: MbedTLS on Windows, switch to uint32
commit 30e8dda6cbea86bdee6d5dfe48514385d3b9f81b
Author: vnugent <public@vaughnnugent.com>
Date: Tue Apr 23 14:48:05 2024 -0400
refactor: Crypto dep redesign working on Windows
commit d09c6c1bd5da3e2d79351daeba304ca99976a726
Author: vnugent <public@vaughnnugent.com>
Date: Thu Apr 18 00:28:51 2024 -0400
refactor!: Pushing what I have to dev
commit 54e06ada7d624ed0d28c6a6db04a149708841bf8
Author: vnugent <public@vaughnnugent.com>
Date: Sat Apr 13 01:24:00 2024 -0400
fix: convert constants to hex, inline macro, ParseErrorCode
commit 4215e3100d9a0d23119080d09638fa5b60d0c6d4
Merge: d3328f4 7485aa5
Author: vnugent <public@vaughnnugent.com>
Date: Wed Apr 3 18:26:30 2024 -0400
Merge branch 'master' into develop
commit d3328f4152b22b28f24c43dda62464287f1efff5
Author: vnugent <public@vaughnnugent.com>
Date: Wed Apr 3 18:22:56 2024 -0400
build: Included dependency and versions in client builds
commit b11bc0bac955fd5c6db65f0da48456bf5e748805
Author: vnugent <public@vaughnnugent.com>
Date: Wed Apr 3 18:10:08 2024 -0400
fix: Fix c89 compatabilty comments and struct assignment
commit 9915bd41799a72413e6b400e150aa9f5fa797e25
Merge: 8e3d6ea 5184d7d
Author: vnugent <public@vaughnnugent.com>
Date: Sat Mar 30 09:57:30 2024 -0400
Merge branch 'master' into develop
commit 8e3d6ea5e3c83fe42cb904b6ccc4fe2b73f76aae
Author: vnugent <public@vaughnnugent.com>
Date: Sat Mar 30 09:52:55 2024 -0400
refactor!: Some api (struct) changes and updated tests
commit e88e8420520204e20802516f01d4488bb0b1d6ea
Merge: 490dfee 21f6c0a
Author: vnugent <public@vaughnnugent.com>
Date: Sun Mar 3 15:02:34 2024 -0500
Merge branch 'master' into develop
commit 490dfee4ef22479009627435c6ad728c3cbbab54
Author: vnugent <public@vaughnnugent.com>
Date: Sun Mar 3 14:59:25 2024 -0500
test: #3 tests for encryption/description and Macs
commit efa97490b7ed47f4e2f05bee52e2b33e14e439e6
Merge: 1b84e3c 120022a
Author: vnugent <public@vaughnnugent.com>
Date: Sun Mar 3 14:55:48 2024 -0500
merge master
commit 1b84e3c7c2e55b1ff9ffdd09b66873e11c131441
Author: vnugent <public@vaughnnugent.com>
Date: Sat Mar 2 22:57:36 2024 -0500
fix: #2 constent usage of sizeof() operator on struct types
commit 9de5a214c66adea0ef2d0bac63c59449de202a88
Author: vnugent <public@vaughnnugent.com>
Date: Fri Mar 1 14:30:36 2024 -0500
perf: avoid nc_key struct copy, cast and verify instead
commit b917b761120ed684af28d0707673ffadcf14b8fe
Author: vnugent <public@vaughnnugent.com>
Date: Mon Feb 12 22:06:50 2024 -0500
fix: found the constant time memcompare function
commit 9f85fff3b9f25da7410569ea94f994b88feb3910
Author: vnugent <public@vaughnnugent.com>
Date: Fri Feb 9 22:48:35 2024 -0500
feat: added/update MAC functions to sign or verify nip44 payload
commit aa5113741bb419b02d6ea416bba571fa3d65db46
Author: vnugent <public@vaughnnugent.com>
Date: Wed Feb 7 01:37:53 2024 -0500
add missing hmac-key output buffer
commit 55f47d22cc9ce4d1e22b70814d608c7ef3b1bbc9
Author: vnugent <public@vaughnnugent.com>
Date: Sun Feb 4 21:08:13 2024 -0500
simple bug fixes, and public api argument validation tests
commit 73c5a713fb164ae8b4ac8a891a8020e08eae0a3b
Author: vnugent <public@vaughnnugent.com>
Date: Fri Feb 2 23:05:48 2024 -0500
update api to return secpvalidate return code instead of internal return codes
commit 06c73004e1a39a7ea4ea3a89c22dee0f66adb236
Author: vnugent <public@vaughnnugent.com>
Date: Fri Feb 2 19:25:17 2024 -0500
change to lgpl license
commit 6e79fdb3b6b6739fc7797d47e55a7691306cf736
Author: vnugent <public@vaughnnugent.com>
Date: Wed Jan 31 21:30:49 2024 -0500
move validation macros, and optionally disable them
commit ac1e58837f1ba687939f78b5c03cadd346c10ddd
Author: vnugent <public@vaughnnugent.com>
Date: Tue Jan 30 12:25:05 2024 -0500
couple more tests, renable range checks, set flags for all projects
Diffstat (limited to 'src')
| -rw-r--r-- | src/crypto/hkdf.c | 131 | ||||
| -rw-r--r-- | src/crypto/impl/bcrypt.c | 263 | ||||
| -rw-r--r-- | src/crypto/impl/mbedtls.c | 172 | ||||
| -rw-r--r-- | src/crypto/impl/monocypher.c | 80 | ||||
| -rw-r--r-- | src/crypto/impl/openssl.c | 180 | ||||
| -rw-r--r-- | src/crypto/nc-crypto.c | 283 | ||||
| -rw-r--r-- | src/noscrypt.c | 467 | ||||
| -rw-r--r-- | src/noscrypt.h | 563 |
8 files changed, 1298 insertions, 841 deletions
diff --git a/src/crypto/hkdf.c b/src/crypto/hkdf.c new file mode 100644 index 0000000..0d91d14 --- /dev/null +++ b/src/crypto/hkdf.c @@ -0,0 +1,131 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: hkdf.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + + +#include "hkdf.h" + +/* Include string for memmove */ +#include <string.h> + +#define HKDF_MIN(a, b) (a < b ? a : b) + +STATIC_ASSERT(HKDF_IN_BUF_SIZE > SHA256_DIGEST_SIZE, "HDK Buffer must be at least the size of the underlying hashing alg output") + +static _nc_fn_inline void ncWriteSpanS(span_t* span, uint32_t offset, const uint8_t* data, uint32_t size) +{ + DEBUG_ASSERT2(span != NULL, "Expected span to be non-null") + DEBUG_ASSERT2(data != NULL, "Expected data to be non-null") + DEBUG_ASSERT2(offset + size <= span->size, "Expected offset + size to be less than span size") + + /* Copy data to span */ + memmove(span->data + offset, data, size); +} + +static _nc_fn_inline void debugValidateHandler(const struct nc_hkdf_fn_cb_struct* handler) +{ + DEBUG_ASSERT(handler != NULL) + DEBUG_ASSERT(handler->update != NULL) + DEBUG_ASSERT(handler->finish != NULL) +} + +/* +* The following functions implements the HKDF expand function using an existing +* HMAC function. +* +* This follows the guidence from RFC 5869: https://tools.ietf.org/html/rfc5869 +*/ + +cstatus_t hkdfExpandProcess( + const struct nc_hkdf_fn_cb_struct* handler, + void* ctx, + const cspan_t* info, + span_t* okm +) +{ + cstatus_t result; + + uint8_t counter; + uint32_t tLen, okmOffset; + uint8_t t[HKDF_IN_BUF_SIZE]; + cspan_t tSpan, counterSpan; + + debugValidateHandler(handler); + + ncCryptoSecureZero(t, sizeof(t)); + + tLen = 0; /* T(0) is an empty string(zero length) */ + okmOffset = 0; + counter = 1; /* counter is offset by 1 for init */ + result = CSTATUS_FAIL; /* Start in fail state */ + + /* counter as a span */ + ncSpanInitC(&counterSpan, &counter, sizeof(counter)); + + /* Compute T(N) = HMAC(prk, T(n-1) | info | n) */ + while (okmOffset < okm->size) + { + ncSpanInitC(&tSpan, t, tLen); + + if (handler->update(ctx, &tSpan) != CSTATUS_OK) + { + goto Exit; + } + + if (handler->update(ctx, info) != CSTATUS_OK) + { + goto Exit; + } + + if (handler->update(ctx, &counterSpan) != CSTATUS_OK) + { + goto Exit; + } + + /* + * Write current hash state to t buffer. It is known + * that the t buffer must be at least the size of the + * underlying hash function output. + */ + if (handler->finish(ctx, t) != CSTATUS_OK) + { + goto Exit; + } + + /* tlen becomes the hash size or remaining okm size */ + tLen = HKDF_MIN(okm->size - okmOffset, SHA256_DIGEST_SIZE); + + DEBUG_ASSERT(tLen <= sizeof(t)); + + /* write the T buffer back to okm */ + ncWriteSpanS(okm, okmOffset, t, tLen); + + /* shift base okm pointer by T */ + okmOffset += tLen; + + /* increment counter */ + counter++; + } + + result = CSTATUS_OK; /* HMAC operation completed, so set success */ + +Exit: + + return result; +} diff --git a/src/crypto/impl/bcrypt.c b/src/crypto/impl/bcrypt.c new file mode 100644 index 0000000..9b01cac --- /dev/null +++ b/src/crypto/impl/bcrypt.c @@ -0,0 +1,263 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: impl/bcrypt.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + + +/* +* This file provides as many fallback implementations on Windows plaforms +* as possible using the bcrypt library. This file should be included behind +* other libarry implementations, as it is a fallback. +*/ + +#ifdef _NC_IS_WINDOWS + +#define WIN32_LEAN_AND_MEAN +#include <Windows.h> +#include <bcrypt.h> + +#include "nc-util.h" +#include "hkdf.h" + +#define IF_BC_FAIL(x) if(!BCRYPT_SUCCESS(x)) +#define BC_FAIL(x) if(!BCRYPT_SUCCESS(x)) return CSTATUS_FAIL; + +struct _bcrypt_ctx +{ + BCRYPT_ALG_HANDLE hAlg; + BCRYPT_HASH_HANDLE hHash; +}; + +_IMPLSTB NTSTATUS _bcInitSha256(struct _bcrypt_ctx* ctx, DWORD flags) +{ + NTSTATUS result; + + result = BCryptOpenAlgorithmProvider( + &ctx->hAlg, + BCRYPT_SHA256_ALGORITHM, + NULL, + flags + ); + + /* + * If operation failed, ensure the algorithm handle is null + * to make free code easier to cleanup + */ + if (!BCRYPT_SUCCESS(result)) + { + ctx->hAlg = NULL; + } + + return result; +} + +_IMPLSTB NTSTATUS _bcCreateHmac(struct _bcrypt_ctx* ctx, const cspan_t* key) +{ + /* + * NOTE: + * I am not explicitly managing the update object buffer. By setting + * the update object to NULL, and length to 0, the buffer will be + * managed by the bcrypt library. + * + * See: https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptcreatehash + */ + + return BCryptCreateHash( + ctx->hAlg, + &ctx->hHash, + NULL, + 0, + (uint8_t*)key->data, + key->size, + BCRYPT_HASH_REUSABLE_FLAG /* Enable reusable for expand function */ + ); +} + +_IMPLSTB NTSTATUS _bcCreate(struct _bcrypt_ctx* ctx) +{ + cspan_t key; + + /* Zero out key span for 0 size and NULL data ptr */ + SecureZeroMemory(&key, sizeof(cspan_t)); + + return _bcCreateHmac(ctx, &key); +} + +_IMPLSTB NTSTATUS _bcHashDataRaw(const struct _bcrypt_ctx* ctx, const uint8_t* data, uint32_t len) +{ + return BCryptHashData(ctx->hHash, (uint8_t*)data, len, 0); +} + +_IMPLSTB NTSTATUS _bcHashData(const struct _bcrypt_ctx* ctx, const cspan_t* data) +{ + return _bcHashDataRaw(ctx, data->data, data->size); +} + +_IMPLSTB NTSTATUS _bcFinishHash(const struct _bcrypt_ctx* ctx, sha256_t digestOut32) +{ + return BCryptFinishHash(ctx->hHash, digestOut32, sizeof(sha256_t), 0); +} + +_IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx) +{ + /* Free the update memory if it was allocated */ + if(ctx->hHash) BCryptDestroyHash(ctx->hHash); + + /* Close the algorithm provider */ + if (ctx->hAlg) BCryptCloseAlgorithmProvider(ctx->hAlg, 0); + + ctx->hAlg = NULL; + ctx->hHash = NULL; +} + +#ifndef _IMPL_SECURE_ZERO_MEMSET + /* + * On Windows, we can use SecureZeroMemory + * as platform zeroing function. + * + * NOTE: + * SecureZeroMemory2 uses volitle function argument + * pointers, which is a contested mehtod of compiler + * optimization prevention. GNU seems to oppose this method + * + * https://learn.microsoft.com/en-us/windows/win32/memory/winbase-securezeromemory2 + */ + #define _IMPL_SECURE_ZERO_MEMSET SecureZeroMemory +#endif /* !_IMPL_SECURE_ZERO_MEMSET */ + +/* +* Provide win32 fallback for sha256 digest if needed +*/ + +#ifndef _IMPL_CRYPTO_SHA256_DIGEST + + /* Export function fallack */ + #define _IMPL_CRYPTO_SHA256_DIGEST _bcrypt_sha256_digest + + _IMPLSTB cstatus_t _bcrypt_sha256_digest(const cspan_t* data, sha256_t digestOut32) + { + cstatus_t result; + struct _bcrypt_ctx ctx; + + result = CSTATUS_FAIL; /* Start in fail state */ + + IF_BC_FAIL(_bcInitSha256(&ctx, 0)) goto Exit; + + IF_BC_FAIL(_bcCreate(&ctx)) goto Exit; + + IF_BC_FAIL(_bcHashData(&ctx, data)) goto Exit; + + IF_BC_FAIL(_bcFinishHash(&ctx, digestOut32)) goto Exit; + + result = CSTATUS_OK; /* Hash operation completed, so set success */ + + Exit: + + _bcDestroyCtx(&ctx); + + return result; + } + +#endif /* !_IMPL_CRYPTO_SHA256_DIGEST */ + +#ifndef _IMPL_CRYPTO_SHA256_HMAC + + /* Export function */ + #define _IMPL_CRYPTO_SHA256_HMAC _bcrypt_hmac_sha256 + + _IMPLSTB cstatus_t _bcrypt_hmac_sha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32) + { + cstatus_t result; + struct _bcrypt_ctx ctx; + + result = CSTATUS_FAIL; /* Start in fail state */ + + /* Init context with hmac flag set */ + IF_BC_FAIL(_bcInitSha256(&ctx, BCRYPT_ALG_HANDLE_HMAC_FLAG)) goto Exit; + + IF_BC_FAIL(_bcCreateHmac(&ctx, key)) goto Exit; + + IF_BC_FAIL(_bcHashData(&ctx, data)) goto Exit; + + IF_BC_FAIL(_bcFinishHash(&ctx, hmacOut32)) goto Exit; + + result = CSTATUS_OK; /* HMAC operation completed, so set success */ + + Exit: + + _bcDestroyCtx(&ctx); + + return result; + } + +#endif /* !_IMPL_CRYPTO_SHA256_HMAC */ + +/* +* Provide a fallback HKDF expand function using the +* HMAC function as a base. +*/ + +#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXPAND + + #define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _bcrypt_fallback_hkdf_expand + + cstatus_t _bcrypt_hkdf_update(void* ctx, const cspan_t* data) + { + DEBUG_ASSERT(ctx != NULL) + + BC_FAIL(_bcHashData((struct _bcrypt_ctx*)ctx, data)) + return CSTATUS_OK; + } + + cstatus_t _bcrypt_hkdf_finish(void* ctx, sha256_t hmacOut32) + { + DEBUG_ASSERT(ctx != NULL) + + BC_FAIL(_bcFinishHash((struct _bcrypt_ctx*)ctx, hmacOut32)) + return CSTATUS_OK; + } + + _IMPLSTB cstatus_t _bcrypt_fallback_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm) + { + cstatus_t result; + struct _bcrypt_ctx ctx; + struct nc_hkdf_fn_cb_struct handler; + + handler.update = _bcrypt_hkdf_update; + handler.finish = _bcrypt_hkdf_finish; + + /* Init bcrypt */ + BC_FAIL(_bcInitSha256(&ctx, BCRYPT_ALG_HANDLE_HMAC_FLAG)) + + BC_FAIL(_bcCreateHmac(&ctx, prk)) + + /* + * NOTE! Hmac reusable flag must be set to allow for multiple + * calls to the finish function without losing the context. + */ + + result = hkdfExpandProcess(&handler, &ctx, info, okm); + + _bcDestroyCtx(&ctx); + + return result; + } + +#endif /* !_IMPL_CRYPTO_SHA256_HKDF_EXPAND */ + +#endif /* _NC_IS_WINDOWS */
\ No newline at end of file diff --git a/src/crypto/impl/mbedtls.c b/src/crypto/impl/mbedtls.c new file mode 100644 index 0000000..057e7b4 --- /dev/null +++ b/src/crypto/impl/mbedtls.c @@ -0,0 +1,172 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: mbedtls.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + + +/* +* This file contains implemntation functions for the required +* cryptography primitives of noscrypt. This file stubs functionality +* using the Mbed-TLS library, if the builder desires to link against +* it. +*/ + +#ifdef MBEDTLS_CRYPTO_LIB + +/* Inline errors on linux in header files on linux */ +#ifndef inline + #define inline __inline +#endif + +#include <mbedtls/md.h> +#include <mbedtls/hkdf.h> +#include <mbedtls/hmac_drbg.h> +#include <mbedtls/sha256.h> +#include <mbedtls/chacha20.h> +#include <mbedtls/constant_time.h> + +#ifndef inline + #undef inline +#endif + + +_IMPLSTB const mbedtls_md_info_t* _mbed_sha256_alg(void) +{ + const mbedtls_md_info_t* info; + /* Get sha256 md info for hdkf operations */ + info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256); + DEBUG_ASSERT2(info != NULL, "Expected SHA256 md info pointer to be valid") + return info; +} + +#if SIZE_MAX < UINT64_MAX + #define _ssize_guard_int(x) if(x > SIZE_MAX) return 1; +#else + #define _ssize_guard_int(x) +#endif + +#ifndef _IMPL_CHACHA20_CRYPT + + /* Export chacha20 computation */ + #define _IMPL_CHACHA20_CRYPT _mbed_chacha20_encrypt + + _IMPLSTB cstatus_t _mbed_chacha20_encrypt( + const uint8_t* key, + const uint8_t* nonce, + const uint8_t* input, + uint8_t* output, + uint32_t dataLen + ) + { + _overflow_check(dataLen) + + /* Counter always starts at 0 */ + return mbedtls_chacha20_crypt( + key, + nonce, + 0x00u, /* nip-44 counter version */ + dataLen, + input, + output + ) == 0 ? CSTATUS_OK : CSTATUS_FAIL; + } + +#endif + +/* Export sha256 if not already defined */ +#ifndef _IMPL_CRYPTO_SHA256_DIGEST + + #define _IMPL_CRYPTO_SHA256_DIGEST _mbed_sha256_digest + + _IMPLSTB cstatus_t _mbed_sha256_digest(const cspan_t* data, sha256_t digestOut32) + { + _overflow_check(data->size) + + return mbedtls_sha256( + data->data, + data->size, + digestOut32, + 0 /* Set 0 for sha256 mode */ + ) == 0 ? CSTATUS_OK : CSTATUS_FAIL; + } + +#endif + +/* Export Sha256 hmac if not already defined by other libs */ +#ifndef _IMPL_CRYPTO_SHA256_HMAC + + #define _IMPL_CRYPTO_SHA256_HMAC _mbed_sha256_hmac + + _IMPLSTB cstatus_t _mbed_sha256_hmac(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32) + { + _overflow_check(data->size) + + /* Keys should never be large enough for this to matter, but sanity check. */ + DEBUG_ASSERT2(key->size < SIZE_MAX, "Expected key size to be less than SIZE_MAX") + + return mbedtls_md_hmac( + _mbed_sha256_alg(), + key->data, + key->size, + data->data, + data->size, + hmacOut32 + ) == 0 ? CSTATUS_OK : CSTATUS_FAIL; + } +#endif + +/* Export hkdf expand if not already defined */ +#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXPAND + + #define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _mbed_sha256_hkdf_expand + + _IMPLSTB cstatus_t _mbed_sha256_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm) + { + /* These sizes should never be large enough to overflow on <64bit platforms, but sanity check */ + DEBUG_ASSERT(okm->size < SIZE_MAX) + DEBUG_ASSERT(prk->size < SIZE_MAX) + DEBUG_ASSERT(info->size < SIZE_MAX) + + return mbedtls_hkdf_expand( + _mbed_sha256_alg(), + prk->data, + prk->size, + info->data, + info->size, + okm->data, + okm->size + ) == 0 ? CSTATUS_OK : CSTATUS_FAIL; + } + +#endif + +/* Export fixed-time compare if not already defined */ +#ifndef _IMPL_CRYPTO_FIXED_TIME_COMPARE + + #define _IMPL_CRYPTO_FIXED_TIME_COMPARE _mbed_fixed_time_compare + + /* fixed-time memcmp */ + _IMPLSTB uint32_t _mbed_fixed_time_compare(const uint8_t* a, const uint8_t* b, uint32_t size) + { + _ssize_guard_int(size) + + return (uint32_t)mbedtls_ct_memcmp(a, b, size); + } +#endif + +#endif
\ No newline at end of file diff --git a/src/crypto/impl/monocypher.c b/src/crypto/impl/monocypher.c new file mode 100644 index 0000000..7c9faea --- /dev/null +++ b/src/crypto/impl/monocypher.c @@ -0,0 +1,80 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: impl/monocypher.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + + +/* +* This file handles some fallbacks that may not be available on +* some platforms. More specifically: +* - Secure memset 0 +* - Chacha20 cipher +* +*/ + +#ifdef NC_ENABLE_MONOCYPHER + +#include <monocypher.h> + +#include "nc-util.h" + +/* Export secure memse0 */ +#ifndef _IMPL_SECURE_ZERO_MEMSET + + /* export cytpo wipe function as is */ + #define _IMPL_SECURE_ZERO_MEMSET crypto_wipe +#endif + +/* Export Chacha20 */ +#ifndef _IMPL_CHACHA20_CRYPT + + #define _IMPL_CHACHA20_CRYPT _mc_chacha20_crypt + + _IMPLSTB cstatus_t _mc_chacha20_crypt( + const uint8_t* key, + const uint8_t* nonce, + const uint8_t* input, + uint8_t* output, + uint32_t dataLen + ) + { + _overflow_check(dataLen) + + /* + * Function returns the next counter value which is not + * needed for noscrypt as encryptions are one-shot, and + * require a new nonce for each encryption. + * + * ITEF function uses a 12byte nonce which is required for + * nip-44 compliant encryption. + */ + crypto_chacha20_ietf( + output, + input, + (size_t)dataLen, + key, + nonce, + 0x00 /* Counter always starts at 0 */ + ); + + return CSTATUS_OK; + } + +#endif + +#endif /* !NC_ENABLE_MONOCYPHER */
\ No newline at end of file diff --git a/src/crypto/impl/openssl.c b/src/crypto/impl/openssl.c new file mode 100644 index 0000000..fd3b4e6 --- /dev/null +++ b/src/crypto/impl/openssl.c @@ -0,0 +1,180 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: impl/openssl.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + + +/* Setup openssl */ +#ifdef OPENSSL_CRYPTO_LIB + +#include "nc-util.h" +#include <openssl/crypto.h> + +#define _OSSL_FAIL(x) if(!(x)) return CSTATUS_FAIL; + +#ifndef _IMPL_SECURE_ZERO_MEMSET + + #define _IMPL_SECURE_ZERO_MEMSET _ossl_secure_zero_memset + + _IMPLSTB void _ossl_secure_zero_memset(void* ptr, size_t size) + { + _overflow_check(size) + + OPENSSL_cleanse(ptr, size); + } +#endif + +#ifndef _IMPL_CRYPTO_FIXED_TIME_COMPARE + + #define _IMPL_CRYPTO_FIXED_TIME_COMPARE _ossl_fixed_time_compare + + _IMPLSTB uint32_t _ossl_fixed_time_compare(const uint8_t* a, const uint8_t* b, uint32_t size) + { + int result; + + /* Size checks are required for platforms that have integer sizes under 32bit */ + _overflow_check(size) + + result = CRYPTO_memcmp(a, b, size); + + return (uint32_t)result; + } + +#endif /* _IMPL_CRYPTO_FIXED_TIME_COMPARE */ + + +#ifndef _IMPL_CRYPTO_SHA256_DIGEST + + #include <openssl/sha.h> + + #define _IMPL_CRYPTO_SHA256_DIGEST _ossl_sha256_digest + + _IMPLSTB cstatus_t _ossl_sha256_digest(const cspan_t* data, sha256_t digestOut32) + { + _overflow_check(data->size) + + _OSSL_FAIL(SHA256(data->data, data->size, digestOut32)) + + return CSTATUS_OK; + } + +#endif + +#ifndef _IMPL_CRYPTO_SHA256_HMAC + + #include <openssl/hmac.h> + + /* Export function */ + #define _IMPL_CRYPTO_SHA256_HMAC _ossl_hmac_sha256 + + _IMPLSTB cstatus_t _ossl_hmac_sha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32) + { + unsigned int hmacLen; + + _overflow_check(key->size) + _overflow_check(data->size) + + hmacLen = sizeof(sha256_t); + + _OSSL_FAIL( + HMAC( + EVP_sha256(), + key->data, + key->size, + data->data, + data->size, + hmacOut32, + &hmacLen + ) + ) + + /* digest length should match the actual digest size */ + DEBUG_ASSERT(hmacLen == sizeof(sha256_t)) + + return CSTATUS_OK; + } + +#endif /* !_IMPL_CRYPTO_SHA256_HMAC */ + +#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXPAND + + #include <openssl/hmac.h> + #include "hkdf.h" + + #define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _ossl_sha256_hkdf_expand + + cstatus_t _ossl_hkdf_update(void* ctx, const cspan_t* data) + { + DEBUG_ASSERT(ctx != NULL) + + _overflow_check(data->size) + + _OSSL_FAIL(EVP_DigestUpdate((EVP_MD_CTX*)ctx, data->data, data->size)) + + return CSTATUS_OK; + } + + cstatus_t _ossl_hkdf_finish(void* ctx, sha256_t hmacOut32) + { + unsigned int hmacSize; + + DEBUG_ASSERT(ctx != NULL) + + hmacSize = sizeof(sha256_t); + + _OSSL_FAIL(EVP_DigestFinal_ex((EVP_MD_CTX*)ctx, hmacOut32, &hmacSize)) + + /* When configured for sha256, should always be the same size in/out */ + DEBUG_ASSERT(hmacSize == sizeof(sha256_t)) + + return CSTATUS_OK; + } + + _IMPLSTB cstatus_t _ossl_sha256_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm) + { + EVP_MD_CTX* ctx; + cstatus_t result; + struct nc_hkdf_fn_cb_struct handler; + + /* + * NOTE! Hmac reusable flag must be set to allow for multiple + * calls to the finish function without losing the context. + */ + + if ((ctx = EVP_MD_CTX_create()) == NULL) + { + return CSTATUS_FAIL; + } + + _OSSL_FAIL(EVP_DigestInit_ex2(ctx, EVP_sha256(), NULL)) + + _OSSL_FAIL(EVP_DigestUpdate(ctx, prk->data, prk->size)); + + handler.update = _ossl_hkdf_update; + handler.finish = _ossl_hkdf_finish; + + result = hkdfExpandProcess(&handler, ctx, info, okm); + + EVP_MD_CTX_destroy(ctx); + + return result; + } + +#endif /* !_IMPL_CRYPTO_SHA256_HKDF_EXPAND */ + +#endif /*!OPENSSL_CRYPTO_LIB */
\ No newline at end of file diff --git a/src/crypto/nc-crypto.c b/src/crypto/nc-crypto.c new file mode 100644 index 0000000..587d59d --- /dev/null +++ b/src/crypto/nc-crypto.c @@ -0,0 +1,283 @@ +/* +* Copyright (c) 2024 Vaughn Nugent +* +* Package: noscrypt +* File: nc-crypto.c +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public License +* as published by the Free Software Foundation; either version 2.1 +* of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with noscrypt. If not, see http://www.gnu.org/licenses/. +*/ + +#include "nc-util.h" +#include "nc-crypto.h" + +/* +* Functions are not forced inline, just suggested. +* So unless it becomes a performance issue, I will leave +* most/all impl functions inline and let the compiler +* decide. +*/ + +#define _IMPLSTB static _nc_fn_inline + +/* +* Impl .c files may define the following macros for function implementations: +* +* _IMPL_SECURE_ZERO_MEMSET secure memset 0 function +* _IMPL_CHACHA20_CRYPT chacha20 cipher function +* _IMPL_CRYPTO_FIXED_TIME_COMPARE fixed time compare function +* _IMPL_CRYPTO_SHA256_HMAC sha256 hmac function +* _IMPL_CRYPTO_SHA256_DIGEST standard sha256 digest function +* _IMPL_CRYPTO_SHA256_HKDF_EXPAND hkdf expand function +* _IMPL_CRYPTO_SHA256_HKDF_EXTRACT hkdf extract function +* +* Macros are used to allow the preprocessor to select the correct implementation +* or raise errors if no implementation is defined. +* +* Implementation functions can assume inputs have been checked/sanitized by the +* calling function, and should return CSTATUS_OK on success, CSTATUS_FAIL on failure. +*/ + + +/* +* Prioritize embedded builds with mbedtls +*/ +#include "impl/mbedtls.c" + +/* +* Include openssl as an alternative default +* implementation +*/ +#include "impl/openssl.c" + +/* +* Include win32 platform specific fallback support +* using bcrypt. +*/ +#include "impl/bcrypt.c" + +/* +* Handle default implementations of secure +* memset 0 functions for each platform. +*/ +#ifndef _IMPL_SECURE_ZERO_MEMSET + /* only incude bzero if libc version greater than 2.25 */ + #if defined(__GLIBC__) && defined(__GLIBC_MINOR__) && __GLIBC__ >= 2 && __GLIBC_MINOR__ >= 25 + /* + * When using libc, we can use explicit_bzero + * as secure memset implementation. + * + * https://sourceware.org/glibc/manual/2.39/html_mono/libc.html#Erasing-Sensitive-Data + */ + #include <string.h> + extern void explicit_bzero(void* block, size_t len); + #define _IMPL_SECURE_ZERO_MEMSET explicit_bzero + #endif +#endif + +/* +* Finally fall back to monocipher to handle some +* that are not provided by other libraries. +* +* Platform specific opimizations are considered +* "better" than monocypher options, so this is +* added as a last resort. Momocypher is "correct" +* and portable, but not optimized for any specific +* platform. +*/ +#include "impl/monocypher.c" + + +#ifdef _IMPL_CRYPTO_SHA256_HMAC + + /* + * If a library does not provide a HKDF extract function, + * we can just use the HMAC function as a fallback. + * + * This is a fallback because another library may provide + * a more optimized implementation. + */ + + #ifndef _IMPL_CRYPTO_SHA256_HKDF_EXTRACT + + #define _IMPL_CRYPTO_SHA256_HKDF_EXTRACT _fallbackHkdfExtract + + _IMPLSTB cstatus_t _fallbackHkdfExtract(const cspan_t* salt, const cspan_t* ikm, sha256_t prk) + { + return _IMPL_CRYPTO_SHA256_HMAC(salt, ikm, prk); + } + + #endif /* !_IMPL_CRYPTO_SHA256_HKDF_EXTRACT */ + +#endif /* _IMPL_CRYPTO_SHA256_HMAC */ + +/* Fallback for fixed time comparison for all platforms */ +#ifndef _IMPL_CRYPTO_FIXED_TIME_COMPARE + + #pragma message("Warning: No fixed time compare implementation defined, using fallback. This may not be secure on all platforms") + + #define _IMPL_CRYPTO_FIXED_TIME_COMPARE _fallbackFixedTimeCompare + + /* + * This implemntation is a slightly simplified version of + * MBed TLS constant time memcmp function, knowm to be a 32bit + * integer size + */ + + static uint32_t _fallbackFixedTimeCompare(const uint8_t* a, const uint8_t* b, uint32_t size) + { + size_t i; + uint32_t result; + uint8_t O; + volatile const uint8_t* A, * B; + + result = 0; + O = 0; + A = (volatile const uint8_t*)a; + B = (volatile const uint8_t*)b; + + /* Compare each byte */ + for(i = 0; i < size; i++) + { + /* Handle volatile read */ + O |= (A[i] ^ B[i]); + + result |= O; + } + + return result; + } + +#endif /* !_IMPL_CRYPTO_FIXED_TIME_COMPARE */ + + +/* +* Internal function implementations that perform +* basic checking and call the correct implementation +* for the desired crypto impl. +* +* The following functions MUST be assumed to +* perform basic input validation. Since these apis are +* internal, debug asserts are used to ensure the +* function has been used correctly. +*/ + +void ncCryptoSecureZero(void* ptr, uint32_t size) +{ + DEBUG_ASSERT2(ptr != NULL, "Expected ptr to be non-null") + +#ifndef _IMPL_SECURE_ZERO_MEMSET + #error "No secure memset implementation defined" +#endif /* _IMPL_SECURE_ZERO_MEMSET */ + + _IMPL_SECURE_ZERO_MEMSET(ptr, size); +} + +uint32_t ncCryptoFixedTimeComp(const uint8_t* a, const uint8_t* b, uint32_t size) +{ + DEBUG_ASSERT2(a != NULL, "Expected a to be non-null") + DEBUG_ASSERT2(b != NULL, "Expected b to be non-null") + +#ifndef _IMPL_CRYPTO_FIXED_TIME_COMPARE + #error "No fixed time compare implementation defined" +#endif /* !_IMPL_CRYPTO_FIXED_TIME_COMPARE */ + + return _IMPL_CRYPTO_FIXED_TIME_COMPARE(a, b, size); +} + +cstatus_t ncCryptoDigestSha256(const cspan_t* data, sha256_t digestOut32) +{ + /* Debug arg validate */ + DEBUG_ASSERT2(data != NULL && data->data != NULL, "Expected data to be non-null") + DEBUG_ASSERT2(digestOut32 != NULL, "Expected digestOut32 to be non-null") + +#ifndef _IMPL_CRYPTO_SHA256_DIGEST + #error "No SHA256 implementation defined" +#endif /* !_IMPL_CRYPTO_SHA256_DIGEST */ + + return _IMPL_CRYPTO_SHA256_DIGEST(data, digestOut32); +} + +cstatus_t ncCryptoHmacSha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32) +{ + /* Debug arg validate */ + DEBUG_ASSERT2(key != NULL && key->data != NULL, "Expected key to be non-null") + DEBUG_ASSERT2(data != NULL && data->data != NULL, "Expected data to be non-null") + DEBUG_ASSERT2(hmacOut32 != NULL && data->data != NULL, "Expected hmacOut32 to be non-null") + +#ifndef _IMPL_CRYPTO_SHA256_HMAC + #error "No SHA256 HMAC implementation defined" +#endif /* !_IMPL_CRYPTO_SHA256_HMAC */ + + return _IMPL_CRYPTO_SHA256_HMAC(key, data, hmacOut32); +} + +cstatus_t ncCryptoSha256HkdfExpand(const cspan_t* prk, const cspan_t* info, span_t* okm) +{ + /* Debug arg validate */ + DEBUG_ASSERT2(prk != NULL && prk->data != NULL, "Expected prk to be non-null") + DEBUG_ASSERT2(info != NULL && info->data != NULL, "Expected info to be non-null") + DEBUG_ASSERT2(okm != NULL && okm->data != NULL, "Expected okm to be non-null") + + /* + * RFC 5869: 2.3 + * "length of output keying material in octets (<= 255 * HashLen)" + * + * important as the counter is 1 byte, so it cannot overflow + */ + + if(okm->size > (uint32_t)(0xFFu * SHA256_DIGEST_SIZE)) + { + return CSTATUS_FAIL; + } + +#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXPAND + #error "No SHA256 HKDF expand implementation defined" +#endif /* !_IMPL_CRYPTO_SHA256_HKDF_EXPAND */ + + return _IMPL_CRYPTO_SHA256_HKDF_EXPAND(prk, info, okm); +} + +cstatus_t ncCryptoSha256HkdfExtract(const cspan_t* salt, const cspan_t* ikm, sha256_t prk) +{ + /* Debug arg validate */ + DEBUG_ASSERT2(salt != NULL, "Expected salt to be non-null") + DEBUG_ASSERT2(ikm != NULL, "Expected ikm to be non-null") + DEBUG_ASSERT2(prk != NULL, "Expected prk to be non-null") + +#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXTRACT + #error "No SHA256 HKDF extract implementation defined" +#endif /* !_IMPL_CRYPTO_SHA256_HKDF_EXTRACT */ + + return _IMPL_CRYPTO_SHA256_HKDF_EXTRACT(salt, ikm, prk); +} + +cstatus_t ncCryptoChacha20( + const uint8_t key[CHACHA_KEY_SIZE], + const uint8_t nonce[CHACHA_NONCE_SIZE], + const uint8_t* input, + uint8_t* output, + uint32_t dataSize +) +{ + DEBUG_ASSERT2(key != NULL, "Expected key to be non-null") + DEBUG_ASSERT2(nonce != NULL, "Expected nonce to be non-null") + DEBUG_ASSERT2(input != NULL, "Expected input to be non-null") + DEBUG_ASSERT2(output != NULL, "Expected output to be non-null") + +#ifndef _IMPL_CHACHA20_CRYPT + #error "No chacha20 implementation defined" +#endif /* !_IMPL_CHACHA20_CRYPT */ + + return _IMPL_CHACHA20_CRYPT(key, nonce, input, output, dataSize); +} diff --git a/src/noscrypt.c b/src/noscrypt.c index 8aeeefe..fac3dfb 100644 --- a/src/noscrypt.c +++ b/src/noscrypt.c @@ -15,40 +15,21 @@ * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License -* along with NativeHeapApi. If not, see http://www.gnu.org/licenses/. +* along with noscrypt. If not, see http://www.gnu.org/licenses/. */ #include "noscrypt.h" -#include <secp256k1_ecdh.h> -#include <secp256k1_schnorrsig.h> +#include "nc-util.h" +#include "nc-crypto.h" -/* Setup mbedtls */ -#include <mbedtls/platform_util.h> -#include <mbedtls/md.h> -#include <mbedtls/hkdf.h> -#include <mbedtls/hmac_drbg.h> -#include <mbedtls/chacha20.h> -#include <mbedtls/sha256.h> -#include <mbedtls/constant_time.h> - -/* Non win platforms may need an inline override */ -#if !defined(_NC_IS_WINDOWS) && !defined(inline) - #define inline __inline__ -#endif /* !IS_WINDOWS */ - -/* NULL */ -#ifndef NULL - #define NULL ((void*)0) -#endif /* !NULL */ - -#define CHACHA_NONCE_SIZE 12 /* Size of 12 is set by the cipher spec */ -#define CHACHA_KEY_SIZE 32 /* Size of 32 is set by the cipher spec */ +#include <secp256k1/secp256k1_ecdh.h> +#include <secp256k1/secp256k1_schnorrsig.h> /* * Local macro for secure zero buffer fill */ -#define ZERO_FILL(x, size) mbedtls_platform_zeroize(x, size) +#define ZERO_FILL(x, size) ncCryptoSecureZero(x, size) /* Include string for memmove */ #include <string.h> @@ -62,6 +43,7 @@ #define CHECK_INVALID_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_INVALID_ARG, argPos); #define CHECK_NULL_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_NULL_PTR, argPos); #define CHECK_ARG_RANGE(x, min, max, argPos) if(x < min || x > max) return NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, argPos); + #define CHECK_CONTEXT_STATE(ctx, argPos) CHECK_INVALID_ARG(ctx->secpCtx, argPos) #else /* empty macros */ #define CHECK_INVALID_ARG(x) @@ -69,35 +51,11 @@ #define CHECK_ARG_RANGE(x, min, max, argPos) #endif /* !NC_DISABLE_INPUT_VALIDATION */ - -#ifdef DEBUG - /* Must include assert.h for assertions */ - #include <assert.h> - #define DEBUG_ASSERT(x) assert(x); - #define DEBUG_ASSERT2(x, message) assert(x && message); - - /* - * Compiler enabled static assertion keywords are - * only available in C11 and later. Later versions - * have macros built-in from assert.h so we can use - * the static_assert macro directly. - * - * Static assertions are only used for testing such as - * sanity checks and this library targets the c89 standard - * so static_assret very likely will not be available. - */ - #if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L - #define STATIC_ASSERT(x, m) static_assert(x, m) - #elif !defined(STATIC_ASSERT) - #define STATIC_ASSERT(x, m) - #pragma message("Static assertions are not supported by this language version") - #endif - -#else - #define DEBUG_ASSERT(x) - #define DEBUG_ASSERT2(x, message) - #define STATIC_ASSERT(x, m) -#endif +/* +* The Nip44 constant salt +* https://github.com/nostr-protocol/nips/blob/master/44.md#encryption +*/ +static const uint8_t Nip44ConstantSalt[8] = { 0x6e, 0x69, 0x70, 0x34, 0x34, 0x2d, 0x76, 0x32 }; struct shared_secret { uint8_t value[NC_SHARED_SEC_SIZE]; @@ -122,16 +80,23 @@ struct nc_expand_keys { uint8_t hmac_key[NC_HMAC_KEY_SIZE]; }; + /* Pointer typecast must work between expanded keys * and message key, size must be identical to work */ -STATIC_ASSERT(sizeof(struct nc_expand_keys) == sizeof(struct message_key), "Expected struct nc_expand_keys to be the same size as struct message_key"); +STATIC_ASSERT(sizeof(struct nc_expand_keys) == sizeof(struct message_key), "Expected struct nc_expand_keys to be the same size as struct message_key") + +/* +* Check that the fallback hkdf extract internal buffer is large enough +* for full converstation key buffers +*/ +STATIC_ASSERT(HKDF_IN_BUF_SIZE >= NC_CONV_KEY_SIZE + 8, "HKDF Buffer size is too small for Safe HKDF operations") /* * Internal helper functions to do common structure conversions */ -static inline int _convertToXonly(const NCContext* ctx, const NCPublicKey* compressedPubKey, secp256k1_xonly_pubkey* xonly) +static _nc_fn_inline int _convertToXonly(const NCContext* ctx, const NCPublicKey* compressedPubKey, secp256k1_xonly_pubkey* xonly) { DEBUG_ASSERT2(ctx != NULL, "Expected valid context") DEBUG_ASSERT2(compressedPubKey != NULL, "Expected a valid public 32byte key structure") @@ -157,14 +122,17 @@ static int _convertToPubKey(const NCContext* ctx, const NCPublicKey* compressedP MEMMOV((compressed + 1), compressedPubKey, sizeof(NCPublicKey)); result = secp256k1_ec_pubkey_parse(ctx->secpCtx, pubKey, compressed, sizeof(compressed)); - - /* zero everything */ + ZERO_FILL(compressed, sizeof(compressed)); return result; } -static inline int _convertFromXonly(const NCContext* ctx, const secp256k1_xonly_pubkey* xonly, NCPublicKey* compressedPubKey) +static _nc_fn_inline int _convertFromXonly( + const NCContext* ctx, + const secp256k1_xonly_pubkey* xonly, + NCPublicKey* compressedPubKey +) { DEBUG_ASSERT2(ctx != NULL, "Expected valid context") DEBUG_ASSERT2(xonly != NULL, "Expected valid X-only secp256k1 public key structure.") @@ -239,163 +207,138 @@ static NCResult _computeSharedSecret( &_edhHashFuncInternal, NULL ); - - /* Clean up sensitive data */ + ZERO_FILL(&pubKey, sizeof(pubKey)); /* Result should be 1 on success */ - return result > 0 ? NC_SUCCESS : E_OPERATION_FAILED; + return result == 1 ? NC_SUCCESS : E_OPERATION_FAILED; } -static inline const mbedtls_md_info_t* _getSha256MdInfo(void) -{ - const mbedtls_md_info_t* info; - /* Get sha256 md info for hdkf operations */ - info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256); - DEBUG_ASSERT2(info != NULL, "Expected SHA256 md info struct to be valid") - return info; -} - - -static inline NCResult _computeConversationKey( +static _nc_fn_inline NCResult _computeConversationKey( const NCContext* ctx, - const mbedtls_md_info_t* mdInfo, const struct shared_secret* sharedSecret, struct conversation_key* ck ) { - int opResult; - /* Validate internal args */ + cspan_t saltSpan, ikmSpan; + DEBUG_ASSERT2(ctx != NULL, "Expected valid context") DEBUG_ASSERT2(sharedSecret != NULL, "Expected a valid shared-point") - DEBUG_ASSERT2(mdInfo != NULL, "Expected valid md context") DEBUG_ASSERT2(ck != NULL, "Expected a valid conversation key") - - /* Derive the encryption key */ - opResult = mbedtls_hkdf_extract( - mdInfo, - Nip44ConstantSalt, - sizeof(Nip44ConstantSalt), - (uint8_t*)sharedSecret, /* Shared secret is the input key */ - NC_SHARED_SEC_SIZE, - (uint8_t*)ck /* Output produces a conversation key */ - ); - /* Return success if the hkdf operation was successful */ - return opResult == 0 ? NC_SUCCESS : E_OPERATION_FAILED; + ncSpanInitC(&saltSpan, Nip44ConstantSalt, sizeof(Nip44ConstantSalt)); + ncSpanInitC(&ikmSpan, sharedSecret->value, NC_SHARED_SEC_SIZE); + + return ncCryptoSha256HkdfExtract(&saltSpan, &ikmSpan, ck->value) == CSTATUS_OK ? NC_SUCCESS : E_OPERATION_FAILED; } /* * Explode the hkdf into the chacha key, chacha nonce, and hmac key. */ -static inline const struct nc_expand_keys* _expandKeysFromHkdf(const struct message_key* hkdf) +static _nc_fn_inline const struct nc_expand_keys* _expandKeysFromHkdf(const struct message_key* hkdf) { return (const struct nc_expand_keys*)hkdf; } -static int _chachaEncipher(const struct nc_expand_keys* keys, NCCryptoData* args) +static cstatus_t _chachaEncipher(const struct nc_expand_keys* keys, NCEncryptionArgs* args) { DEBUG_ASSERT2(keys != NULL, "Expected valid keys") DEBUG_ASSERT2(args != NULL, "Expected valid encryption args") - return mbedtls_chacha20_crypt( + return ncCryptoChacha20( keys->chacha_key, keys->chacha_nonce, - 0, /* Counter (always starts at 0) */ - args->dataSize, /* Data size (input and output are assumed to be the same size) */ args->inputData, /* Input data */ - args->outputData /* Output data */ + args->outputData, /* Output data */ + args->dataSize /* Data size (input and output are assumed to be the same size) */ ); } -static inline NCResult _getMessageKey( - const mbedtls_md_info_t* mdInfo, +static _nc_fn_inline cstatus_t _getMessageKey( const struct conversation_key* converstationKey, - const uint8_t* nonce, - size_t nonceSize, + const cspan_t* nonce, struct message_key* messageKey ) { - int result; - DEBUG_ASSERT2(mdInfo != NULL, "Expected valid md context") + cspan_t prkSpan; + span_t okmSpan; + DEBUG_ASSERT2(nonce != NULL, "Expected valid nonce buffer") DEBUG_ASSERT2(converstationKey != NULL, "Expected valid conversation key") DEBUG_ASSERT2(messageKey != NULL, "Expected valid message key buffer") - /* Another HKDF to derive the message key with nonce */ - result = mbedtls_hkdf_expand( - mdInfo, - (uint8_t*)converstationKey, /* Conversation key is the input key */ - NC_CONV_KEY_SIZE, - nonce, - nonceSize, - (uint8_t*)messageKey, /* Output produces a message key (write it directly to struct memory) */ - NC_MESSAGE_KEY_SIZE - ); - - return result == 0 ? NC_SUCCESS : E_OPERATION_FAILED; + ncSpanInitC(&prkSpan, converstationKey->value, sizeof(struct conversation_key)); /* Conversation key is the input key */ + ncSpanInit(&okmSpan, messageKey->value, sizeof(struct message_key)); /* Output produces a message key (write it directly to struct memory) */ + + /* Nonce is the info */ + return ncCryptoSha256HkdfExpand(&prkSpan, nonce, &okmSpan); } -static inline NCResult _encryptEx( +static _nc_fn_inline NCResult _encryptEx( const NCContext* ctx, - const mbedtls_md_info_t* mdINfo, const struct conversation_key* ck, - uint8_t hmacKey[NC_HMAC_KEY_SIZE], - NCCryptoData* args + uint8_t* hmacKey, + NCEncryptionArgs* args ) { NCResult result; + cspan_t nonceSpan; struct message_key messageKey; const struct nc_expand_keys* expandedKeys; - DEBUG_ASSERT2(ctx != NULL, "Expected valid context") - DEBUG_ASSERT2(ck != NULL, "Expected valid conversation key") - DEBUG_ASSERT2(args != NULL, "Expected valid encryption args") - DEBUG_ASSERT2(mdINfo != NULL, "Expected valid md info struct") - DEBUG_ASSERT2(hmacKey != NULL, "Expected valid hmac key buffer") + DEBUG_ASSERT2(ctx != NULL, "Expected valid context") + DEBUG_ASSERT2(ck != NULL, "Expected valid conversation key") + DEBUG_ASSERT2(args != NULL, "Expected valid encryption args") + DEBUG_ASSERT2(hmacKey != NULL, "Expected valid hmac key buffer") - /* Failure, bail out */ - if ((result = _getMessageKey(mdINfo, ck, args->nonce32, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS) + result = NC_SUCCESS; + + ncSpanInitC(&nonceSpan, args->nonce32, NC_ENCRYPTION_NONCE_SIZE); + + /* Message key will be derrived on every encryption call */ + if (_getMessageKey(ck, &nonceSpan, &messageKey) != CSTATUS_OK) { + result = E_OPERATION_FAILED; goto Cleanup; } - /* Expand the keys from the hkdf so we can use them in the cipher */ + /* Split apart the message key into it's expanded form so components can be extracted */ expandedKeys = _expandKeysFromHkdf(&messageKey); /* Copy the hmac key into the args */ MEMMOV(hmacKey, expandedKeys->hmac_key, NC_HMAC_KEY_SIZE); /* CHACHA20 (the result will be 0 on success) */ - result = (NCResult)_chachaEncipher(expandedKeys, args); + if (_chachaEncipher(expandedKeys, args) != CSTATUS_OK) + { + result = E_OPERATION_FAILED; + } Cleanup: - /* Clean up sensitive data */ ZERO_FILL(&messageKey, sizeof(messageKey)); return result; } -static inline NCResult _decryptEx( - const NCContext* ctx, - const mbedtls_md_info_t* mdInfo, - const struct conversation_key* ck, - NCCryptoData* args -) +static _nc_fn_inline NCResult _decryptEx(const NCContext* ctx, const struct conversation_key* ck, NCEncryptionArgs* args) { NCResult result; + cspan_t nonceSpan; struct message_key messageKey; const struct nc_expand_keys* cipherKeys; DEBUG_ASSERT2(ctx != NULL, "Expected valid context") DEBUG_ASSERT2(ck != NULL, "Expected valid conversation key") DEBUG_ASSERT2(args != NULL, "Expected valid encryption args") - DEBUG_ASSERT2(mdInfo != NULL, "Expected valid md info struct") - /* Failure to get message keys, bail out */ - if ((result = _getMessageKey(mdInfo, ck, args->nonce32, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS) + result = NC_SUCCESS; + + ncSpanInitC(&nonceSpan, args->nonce32, NC_ENCRYPTION_NONCE_SIZE); + + if (_getMessageKey(ck, &nonceSpan, &messageKey) != CSTATUS_OK) { + result = E_OPERATION_FAILED; goto Cleanup; } @@ -403,34 +346,28 @@ static inline NCResult _decryptEx( cipherKeys = _expandKeysFromHkdf(&messageKey); /* CHACHA20 (the result will be 0 on success) */ - result = (NCResult) _chachaEncipher(cipherKeys, args); + if (_chachaEncipher(cipherKeys, args) != CSTATUS_OK) + { + result = E_OPERATION_FAILED; + } Cleanup: - /* Clean up sensitive data */ ZERO_FILL(&messageKey, sizeof(messageKey)); return result; } -static inline int _computeHmac( - const uint8_t key[NC_HMAC_KEY_SIZE], - const NCMacVerifyArgs* args, - uint8_t hmacOut[NC_ENCRYPTION_MAC_SIZE] -) +static _nc_fn_inline cstatus_t _computeHmac(const uint8_t key[NC_HMAC_KEY_SIZE], const cspan_t* payload, sha256_t hmacOut) { - DEBUG_ASSERT2(key != NULL, "Expected valid hmac key") - DEBUG_ASSERT2(args != NULL, "Expected valid mac verification args") - DEBUG_ASSERT2(hmacOut != NULL, "Expected valid hmac output buffer") - DEBUG_ASSERT(args->payload != NULL) - - return mbedtls_md_hmac( - _getSha256MdInfo(), - key, - NC_HMAC_KEY_SIZE, - args->payload, - args->payloadSize, - hmacOut - ); + cspan_t keySpan; + + DEBUG_ASSERT2(key != NULL, "Expected valid hmac key") + DEBUG_ASSERT2(payload != NULL, "Expected valid mac verification args") + DEBUG_ASSERT2(hmacOut != NULL, "Expected valid hmac output buffer") + + ncSpanInitC(&keySpan, key, NC_HMAC_KEY_SIZE); + + return ncCryptoHmacSha256(&keySpan, payload, hmacOut); } static NCResult _verifyMacEx( @@ -440,31 +377,25 @@ static NCResult _verifyMacEx( ) { NCResult result; - const mbedtls_md_info_t* sha256Info; + cspan_t payloadSpan, nonceSpan; + sha256_t hmacOut; const struct nc_expand_keys* keys; struct message_key messageKey; - uint8_t hmacOut[NC_ENCRYPTION_MAC_SIZE]; DEBUG_ASSERT2(ctx != NULL, "Expected valid context") DEBUG_ASSERT2(conversationKey != NULL, "Expected valid conversation key") DEBUG_ASSERT2(args != NULL, "Expected valid mac verification args") - sha256Info = _getSha256MdInfo(); + ncSpanInitC(&nonceSpan, args->nonce32, NC_ENCRYPTION_NONCE_SIZE); + ncSpanInitC(&payloadSpan, args->payload, args->payloadSize); /* - * We need to get the message key in order to - * get the required hmac key + * Message key is again required for the hmac verification */ - result = _getMessageKey( - sha256Info, - (struct conversation_key*)conversationKey, - args->nonce32, - NC_ENCRYPTION_NONCE_SIZE, - &messageKey - ); - if (result != NC_SUCCESS) + if (_getMessageKey((struct conversation_key*)conversationKey, &nonceSpan, &messageKey) != CSTATUS_OK) { + result = E_OPERATION_FAILED; goto Cleanup; } @@ -474,24 +405,22 @@ static NCResult _verifyMacEx( /* * Compute the hmac of the data using the computed hmac key */ - if (_computeHmac(keys->hmac_key, args, hmacOut) != 0) + if (_computeHmac(keys->hmac_key, &payloadSpan, hmacOut) != CSTATUS_OK) { result = E_OPERATION_FAILED; goto Cleanup; } /* constant time compare the macs */ - result = mbedtls_ct_memcmp(hmacOut, args->mac32, NC_ENCRYPTION_MAC_SIZE) == 0 ? NC_SUCCESS : E_OPERATION_FAILED; + result = ncCryptoFixedTimeComp(hmacOut, args->mac32, NC_ENCRYPTION_MAC_SIZE) == 0 ? NC_SUCCESS : E_OPERATION_FAILED; Cleanup: - /* Clean up sensitive data */ ZERO_FILL(&messageKey, sizeof(messageKey)); ZERO_FILL(hmacOut, sizeof(hmacOut)); return result; } - /* * EXTERNAL API FUNCTIONS */ @@ -502,7 +431,7 @@ NC_EXPORT uint32_t NC_CC NCGetContextStructSize(void) NC_EXPORT NCResult NC_CC NCInitContext( NCContext* ctx, - const uint8_t entropy[32] + const uint8_t entropy[NC_CONTEXT_ENTROPY_SIZE] ) { CHECK_NULL_ARG(ctx, 0) @@ -510,18 +439,21 @@ NC_EXPORT NCResult NC_CC NCInitContext( ctx->secpCtx = secp256k1_context_create(SECP256K1_CONTEXT_NONE); - /* Randomize once on init */ + /* + * Randomize once on init, users can call reinit to + * randomize again as needed. + */ return secp256k1_context_randomize(ctx->secpCtx, entropy) ? NC_SUCCESS : E_INVALID_ARG; } NC_EXPORT NCResult NC_CC NCReInitContext( NCContext* ctx, - const uint8_t entropy[32] + const uint8_t entropy[NC_CONTEXT_ENTROPY_SIZE] ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) CHECK_NULL_ARG(entropy, 1) + CHECK_CONTEXT_STATE(ctx, 0) /* Only randomize again */ return secp256k1_context_randomize(ctx->secpCtx, entropy) ? NC_SUCCESS : E_INVALID_ARG; @@ -529,8 +461,8 @@ NC_EXPORT NCResult NC_CC NCReInitContext( NC_EXPORT NCResult NC_CC NCDestroyContext(NCContext* ctx) { - CHECK_NULL_ARG(ctx, 0); - CHECK_INVALID_ARG(ctx->secpCtx, 0); + CHECK_NULL_ARG(ctx, 0) + CHECK_CONTEXT_STATE(ctx, 0) /* Destroy secp256k1 context */ secp256k1_context_destroy(ctx->secpCtx); @@ -553,7 +485,7 @@ NC_EXPORT NCResult NC_CC NCGetPublicKey( secp256k1_xonly_pubkey xonly; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(pk, 2) @@ -577,14 +509,11 @@ NC_EXPORT NCResult NC_CC NCGetPublicKey( return NC_SUCCESS; } -NC_EXPORT NCResult NC_CC NCValidateSecretKey( - const NCContext* ctx, - const NCSecretKey* sk -) +NC_EXPORT NCResult NC_CC NCValidateSecretKey(const NCContext* ctx, const NCSecretKey* sk) { CHECK_NULL_ARG(ctx, 0) CHECK_NULL_ARG(sk, 1) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) /* Validate the secret key */ return secp256k1_ec_seckey_verify(ctx->secpCtx, sk->key); @@ -606,13 +535,13 @@ NC_EXPORT NCResult NC_CC NCSignDigest( /* Validate arguments */ CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(random32, 2) CHECK_NULL_ARG(digest32, 3) CHECK_NULL_ARG(sig64, 4) - /* Generate the keypair */ + /* Fill keypair structure from the callers secret key */ if (secp256k1_keypair_create(ctx->secpCtx, &keyPair, sk->key) != 1) { return E_INVALID_ARG; @@ -628,8 +557,7 @@ NC_EXPORT NCResult NC_CC NCSignDigest( /* Verify the signature is valid */ result = secp256k1_schnorrsig_verify(ctx->secpCtx, sig64, digest32, 32, &xonly); - - /* cleanup any sensitive data */ + ZERO_FILL(&keyPair, sizeof(keyPair)); ZERO_FILL(&xonly, sizeof(xonly)); @@ -641,11 +569,12 @@ NC_EXPORT NCResult NC_CC NCSignData( const NCSecretKey* sk, const uint8_t random32[32], const uint8_t* data, - size_t dataSize, + uint32_t dataSize, uint8_t sig64[64] ) { - uint8_t digest[32]; + cspan_t dataSpan; + sha256_t digest; /* Double check is required because arg position differs */ CHECK_NULL_ARG(ctx, 0) @@ -655,8 +584,10 @@ NC_EXPORT NCResult NC_CC NCSignData( CHECK_ARG_RANGE(dataSize, 1, UINT32_MAX, 4) CHECK_NULL_ARG(sig64, 5) + ncSpanInitC(&dataSpan, data, dataSize); + /* Compute sha256 of the data before signing */ - if(mbedtls_sha256(data, dataSize, digest, 0) != 0) + if(ncCryptoDigestSha256(&dataSpan, digest) != CSTATUS_OK) { return E_INVALID_ARG; } @@ -676,7 +607,7 @@ NC_EXPORT NCResult NC_CC NCVerifyDigest( secp256k1_xonly_pubkey xonly; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(pk, 1) CHECK_NULL_ARG(digest32, 2) CHECK_NULL_ARG(sig64, 3) @@ -689,8 +620,7 @@ NC_EXPORT NCResult NC_CC NCVerifyDigest( /* Verify the signature */ result = secp256k1_schnorrsig_verify(ctx->secpCtx, sig64, digest32, 32, &xonly); - - /* cleanup any sensitive data */ + ZERO_FILL(&xonly, sizeof(xonly)); return result == 1 ? NC_SUCCESS : E_INVALID_ARG; @@ -700,11 +630,12 @@ NC_EXPORT NCResult NC_CC NCVerifyData( const NCContext* ctx, const NCPublicKey* pk, const uint8_t* data, - const size_t dataSize, + const uint32_t dataSize, const uint8_t sig64[64] ) { - uint8_t digest[32]; + sha256_t digest; + cspan_t dataSpan; CHECK_NULL_ARG(ctx, 0) CHECK_NULL_ARG(pk, 1) @@ -712,8 +643,10 @@ NC_EXPORT NCResult NC_CC NCVerifyData( CHECK_ARG_RANGE(dataSize, 1, UINT32_MAX, 3) CHECK_NULL_ARG(sig64, 4) + ncSpanInitC(&dataSpan, data, dataSize); + /* Compute sha256 of the data before verifying */ - if (mbedtls_sha256(data, dataSize, digest, 0) != 0) + if (ncCryptoDigestSha256(&dataSpan, digest) != CSTATUS_OK) { return E_INVALID_ARG; } @@ -732,17 +665,12 @@ NC_EXPORT NCResult NC_CC NCGetSharedSecret( ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(otherPk, 2) CHECK_NULL_ARG(sharedPoint, 3) - return _computeSharedSecret( - ctx, - sk, - otherPk, - (struct shared_secret*)sharedPoint - ); + return _computeSharedSecret(ctx, sk, otherPk, (struct shared_secret*)sharedPoint); } NC_EXPORT NCResult NC_CC NCGetConversationKeyEx( @@ -752,14 +680,13 @@ NC_EXPORT NCResult NC_CC NCGetConversationKeyEx( ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sharedPoint, 1) CHECK_NULL_ARG(conversationKey, 2) /* Cast the shared point to the shared secret type */ return _computeConversationKey( - ctx, - _getSha256MdInfo(), + ctx, (struct shared_secret*)sharedPoint, (struct conversation_key*)conversationKey ); @@ -776,7 +703,7 @@ NC_EXPORT NCResult NC_CC NCGetConversationKey( struct shared_secret sharedSecret; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(pk, 2) CHECK_NULL_ARG(conversationKey, 3) @@ -787,12 +714,7 @@ NC_EXPORT NCResult NC_CC NCGetConversationKey( goto Cleanup; } - result = _computeConversationKey( - ctx, - _getSha256MdInfo(), - &sharedSecret, - (struct conversation_key*)conversationKey - ); + result = _computeConversationKey(ctx, &sharedSecret, (struct conversation_key*)conversationKey); Cleanup: /* Clean up sensitive data */ @@ -804,72 +726,72 @@ Cleanup: NC_EXPORT NCResult NC_CC NCEncryptEx( const NCContext* ctx, const uint8_t conversationKey[NC_CONV_KEY_SIZE], - uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE], - NCCryptoData* args + NCEncryptionArgs* args ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(conversationKey, 1) - CHECK_NULL_ARG(hmacKeyOut, 2) - CHECK_NULL_ARG(args, 3) + CHECK_NULL_ARG(args, 2) /* Validte ciphertext/plaintext */ - CHECK_INVALID_ARG(args->inputData, 3) - CHECK_INVALID_ARG(args->outputData, 3) - CHECK_INVALID_ARG(args->nonce32, 3) - CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3) - - return _encryptEx( - ctx, - _getSha256MdInfo(), - (struct conversation_key*)conversationKey, - hmacKeyOut, - args - ); + CHECK_INVALID_ARG(args->inputData, 2) + CHECK_INVALID_ARG(args->outputData, 2) + CHECK_INVALID_ARG(args->nonce32, 2) + CHECK_INVALID_ARG(args->hmacKeyOut32, 2) + CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 2) + + return _encryptEx(ctx, (struct conversation_key*)conversationKey, args->hmacKeyOut32, args); } NC_EXPORT NCResult NC_CC NCEncrypt( const NCContext* ctx, const NCSecretKey* sk, - const NCPublicKey* pk, - uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE], - NCCryptoData* args + const NCPublicKey* pk, + NCEncryptionArgs* args ) { NCResult result; - const mbedtls_md_info_t* mdInfo; struct shared_secret sharedSecret; struct conversation_key conversationKey; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(pk, 2) - CHECK_NULL_ARG(hmacKeyOut, 3) - CHECK_NULL_ARG(args, 4) + CHECK_NULL_ARG(args, 3) /* Validate input/output data */ - CHECK_INVALID_ARG(args->inputData, 4) - CHECK_INVALID_ARG(args->outputData, 4) - CHECK_INVALID_ARG(args->nonce32, 4) - CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 4) + CHECK_INVALID_ARG(args->inputData, 3) + CHECK_INVALID_ARG(args->outputData, 3) + CHECK_INVALID_ARG(args->nonce32, 3) + CHECK_INVALID_ARG(args->hmacKeyOut32, 3) + CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3) - mdInfo = _getSha256MdInfo(); + switch(args->version) + { + case NC_ENC_VERSION_NIP44: + break; /* Allow nip44 */ + /* At the moment nip04 compatability is not supported */ + case NC_ENC_VERSION_NIP04: + default: + return E_VERSION_NOT_SUPPORTED; + } + /* Compute the shared point */ if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS) { goto Cleanup; } - + /* Compute the conversation key from secret and pubkic keys */ - if ((result = _computeConversationKey(ctx, mdInfo, &sharedSecret, &conversationKey)) != NC_SUCCESS) + if ((result = _computeConversationKey(ctx, &sharedSecret, &conversationKey)) != NC_SUCCESS) { goto Cleanup; } - result = _encryptEx(ctx, mdInfo, &conversationKey, hmacKeyOut, args); + result = _encryptEx(ctx, &conversationKey, args->hmacKeyOut32, args); Cleanup: /* Clean up sensitive data */ @@ -882,11 +804,11 @@ Cleanup: NC_EXPORT NCResult NC_CC NCDecryptEx( const NCContext* ctx, const uint8_t conversationKey[NC_CONV_KEY_SIZE], - NCCryptoData* args + NCEncryptionArgs* args ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(conversationKey, 1) CHECK_NULL_ARG(args, 2) @@ -896,28 +818,22 @@ NC_EXPORT NCResult NC_CC NCDecryptEx( CHECK_INVALID_ARG(args->nonce32, 2) CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 2) - return _decryptEx( - ctx, - _getSha256MdInfo(), - (struct conversation_key*)conversationKey, - args - ); + return _decryptEx(ctx, (struct conversation_key*)conversationKey, args); } NC_EXPORT NCResult NC_CC NCDecrypt( const NCContext* ctx, const NCSecretKey* sk, const NCPublicKey* pk, - NCCryptoData* args + NCEncryptionArgs* args ) { NCResult result; struct shared_secret sharedSecret; struct conversation_key conversationKey; - const mbedtls_md_info_t* mdInfo; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(pk, 2) CHECK_NULL_ARG(args, 3) @@ -928,19 +844,17 @@ NC_EXPORT NCResult NC_CC NCDecrypt( CHECK_INVALID_ARG(args->nonce32, 3) CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3) - mdInfo = _getSha256MdInfo(); - if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS) { goto Cleanup; } - if ((result = _computeConversationKey(ctx, mdInfo, &sharedSecret, &conversationKey)) != NC_SUCCESS) + if ((result = _computeConversationKey(ctx, &sharedSecret, &conversationKey)) != NC_SUCCESS) { goto Cleanup; } - result = _decryptEx(ctx, mdInfo, &conversationKey, args); + result = _decryptEx(ctx, &conversationKey, args); Cleanup: /* Clean up sensitive data */ @@ -954,28 +868,25 @@ NC_EXPORT NCResult NCComputeMac( const NCContext* ctx, const uint8_t hmacKey[NC_HMAC_KEY_SIZE], const uint8_t* payload, - size_t payloadSize, + uint32_t payloadSize, uint8_t hmacOut[NC_ENCRYPTION_MAC_SIZE] ) { - NCMacVerifyArgs args; + cspan_t payloadSpan; CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(hmacKey, 1) CHECK_NULL_ARG(payload, 2) CHECK_ARG_RANGE(payloadSize, 1, UINT32_MAX, 3) CHECK_NULL_ARG(hmacOut, 4) - /*Fill args with 0 before use because we are only using some of the properties*/ - ZERO_FILL(&args, sizeof(args)); - args.payload = payload; - args.payloadSize = payloadSize; + ncSpanInitC(&payloadSpan, payload, payloadSize); /* * Compute the hmac of the data using the supplied hmac key */ - return _computeHmac(hmacKey, &args, hmacOut) == 0 ? NC_SUCCESS : E_OPERATION_FAILED; + return _computeHmac(hmacKey, &payloadSpan, hmacOut) == CSTATUS_OK ? NC_SUCCESS : E_OPERATION_FAILED; } @@ -986,7 +897,7 @@ NC_EXPORT NCResult NC_CC NCVerifyMacEx( ) { CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(conversationKey, 1) CHECK_NULL_ARG(args, 2) @@ -1005,8 +916,12 @@ NC_EXPORT NCResult NC_CC NCVerifyMac( NCMacVerifyArgs* args ) { + NCResult result; + struct shared_secret sharedSecret; + struct conversation_key conversationKey; + CHECK_NULL_ARG(ctx, 0) - CHECK_INVALID_ARG(ctx->secpCtx, 0) + CHECK_CONTEXT_STATE(ctx, 0) CHECK_NULL_ARG(sk, 1) CHECK_NULL_ARG(pk, 2) CHECK_NULL_ARG(args, 3) @@ -1016,22 +931,18 @@ NC_EXPORT NCResult NC_CC NCVerifyMac( CHECK_INVALID_ARG(args->nonce32, 3) CHECK_ARG_RANGE(args->payloadSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3) - NCResult result; - struct shared_secret sharedSecret; - struct conversation_key conversationKey; - /* Computed the shared point so we can get the converstation key */ if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS) { goto Cleanup; } - if ((result = _computeConversationKey(ctx, _getSha256MdInfo(), &sharedSecret, &conversationKey)) != NC_SUCCESS) + if ((result = _computeConversationKey(ctx, &sharedSecret, &conversationKey)) != NC_SUCCESS) { goto Cleanup; } - result = _verifyMacEx(ctx, (uint8_t*)&conversationKey, args); + result = _verifyMacEx(ctx, conversationKey.value, args); Cleanup: /* Clean up sensitive data */ diff --git a/src/noscrypt.h b/src/noscrypt.h deleted file mode 100644 index 6a40171..0000000 --- a/src/noscrypt.h +++ /dev/null @@ -1,563 +0,0 @@ -/* -* Copyright (c) 2024 Vaughn Nugent -* -* Package: noscrypt -* File: noscrypt.h -* -* This library is free software; you can redistribute it and/or -* modify it under the terms of the GNU Lesser General Public License -* as published by the Free Software Foundation; either version 2.1 -* of the License, or (at your option) any later version. -* -* This library is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public License -* along with NativeHeapApi. If not, see http://www.gnu.org/licenses/. -*/ - -/* -* noscrypt is a an open-source, strict C89 library that performs the basic -* cryptographic operations found in the Nostr protocol. It is designed to be -* portable and easy to use in any C89 compatible environment. It is also designed -*/ - -#pragma once - -#ifndef NOSCRYPT_H -#define NOSCRYPT_H - -#include <stdint.h> -#include <stddef.h> - -#if defined(_MSC_VER) || defined(WIN32) || defined(_WIN32) - #define _NC_IS_WINDOWS -#endif - -/* Set api export calling convention (allow used to override) */ -#ifndef NC_CC - #ifdef _NC_IS_WINDOWS - /* STD for importing to other languages such as .NET */ - #define NC_CC __stdcall - #else - #define NC_CC - #endif -#endif /* !NC_CC */ - -#ifndef NC_EXPORT /* Allow users to disable the export/impoty macro if using source code directly */ - #ifdef NOSCRYPT_EXPORTING - #ifdef _NC_IS_WINDOWS - #define NC_EXPORT __declspec(dllexport) - #else - #define NC_EXPORT __attribute__((visibility("default"))) - #endif /* _NC_IS_WINDOWS */ - #else - #ifdef _NC_IS_WINDOWS - #define NC_EXPORT __declspec(dllimport) - #else - #define NC_EXPORT - #endif /* _NC_IS_WINDOWS */ - #endif /* !NOSCRYPT_EXPORTING */ -#endif /* !NC_EXPORT */ - -/* -* CONSTANTS -*/ -#define BIP340_PUBKEY_HEADER_BYTE 0x02 -#define NIP44_MESSAGE_KEY_SIZE 76 -#define NC_ENCRYPTION_NONCE_SIZE 32 -#define NC_SEC_KEY_SIZE 32 -#define NC_PUBKEY_SIZE 32 -#define NC_SHARED_SEC_SIZE 32 -#define NC_CONV_KEY_SIZE 32 -#define NC_HMAC_KEY_SIZE 32 -#define NC_ENCRYPTION_MAC_SIZE 32 -#define NC_MESSAGE_KEY_SIZE NIP44_MESSAGE_KEY_SIZE - -/* -* From spec -* https://github.com/nostr-protocol/nips/blob/master/44.md#decryption -*/ -#define NIP44_MIN_ENC_MESSAGE_SIZE 1 -#define NIP44_MAX_ENC_MESSAGE_SIZE 65535 - -/* -* The Nip44 constant salt -* https://github.com/nostr-protocol/nips/blob/master/44.md#encryption -*/ -static const uint8_t Nip44ConstantSalt[8] = { 0x6e, 0x69, 0x70, 0x34, 0x34, 0x2d, 0x76, 0x32 }; - -/* -* ERROR CODES -* -* Error codes are 64bit integers. The lower 8 bits are reserved for -* the error code, and the upper 8 bits are reserved for the argument -* position. -* -* NCResult type is 64bit to also allow for positive return values for -* operations that return a value count. -*/ - -#define NC_ARG_POSITION_OFFSET 8 -#define NC_ERROR_CODE_MASK 0xFF - -#define NC_SUCCESS 0 -#define E_NULL_PTR -1 -#define E_INVALID_ARG -2 -#define E_INVALID_CONTEXT -3 -#define E_ARGUMENT_OUT_OF_RANGE -4 -#define E_OPERATION_FAILED -5 - -/* A compressed resul/return value, negative values -are failure, 0 is success and positive values are -defined by the operation. -*/ -typedef int64_t NCResult; - -/* - An secp256k1 secret key (aka 32byte private key buffer) -*/ -typedef struct secret_key_struct { - - uint8_t key[NC_SEC_KEY_SIZE]; - -}NCSecretKey; - -/* - An x-only secp256k1 public key -*/ -typedef struct xonly_pubkey_struct { - - uint8_t key[NC_PUBKEY_SIZE]; - -}NCPublicKey; - -/* - An opaque full library context object -*/ -typedef struct ctx_struct { - - void* secpCtx; - -}NCContext; - -/* -* The encryption arguments structure. This structure is used to pass -arguments to the encryption and decryption functions. It stores the -data buffers and required nonce used for the stream cipher. -*/ -typedef struct nc_encryption_struct { - - /* The nonce used for the stream cipher. */ - const uint8_t* nonce32; - - /* The input data buffer to encrypt/decrypt */ - const void* inputData; - - /* The output data buffer to write data to */ - void* outputData; - - /* The size of the data buffers. Buffers must - * be the same size or larger than this value - */ - uint32_t dataSize; - -} NCCryptoData; - -/* -* A structure for Nip44 message authentication code verification. This structure -* is used to pass arguments to the NCVerifyMac and NCVerifyMacEx functions. -*/ -typedef struct nc_mac_verify { - - /* The message authentication code certifying the Nip44 payload */ - const uint8_t* mac32; - - /* The nonce used for the original message encryption */ - const uint8_t* nonce32; - - /* The message payload data */ - const uint8_t* payload; - - /* The size of the payload data */ - size_t payloadSize; - -} NCMacVerifyArgs; - - -/* - API FUNCTIONS -*/ - -/* -* A helper function to cast a 32byte buffer to a NCSecretKey struct -* @param key The 32byte buffer to cast -* @return A pointer to the NCSecretKey struct -*/ -static inline NCSecretKey* NCToSecKey(uint8_t key[NC_SEC_KEY_SIZE]) -{ - return (NCSecretKey*)key; -} - -/* -* A helper function to cast a 32byte buffer to a NCPublicKey struct -* @param key The 32byte buffer to cast -* @return A pointer to the NCPublicKey struct -*/ -static inline NCPublicKey* NCToPubKey(uint8_t key[NC_PUBKEY_SIZE]) -{ - return (NCPublicKey*)key; -} - -static inline NCResult NCResultWithArgPosition(NCResult err, uint8_t argPosition) -{ - return -(((NCResult)argPosition << NC_ARG_POSITION_OFFSET) | -err); -} - -/* -* Parses an error code and returns the error code and the argument position -that caused the error. -* @param result The error code to parse -* @param code A pointer to the error code to write to -* @param argPosition A pointer to the argument position to write to -*/ -NC_EXPORT void NC_CC NCParseErrorCode(NCResult result, int* code, uint8_t* argPosition) -{ - /* convert result to a positive value*/ - NCResult asPositive = -result; - - /* Get the error code from the lower 8 bits and the argument position from the upper 8 bits*/ - *code = -(asPositive & NC_ERROR_CODE_MASK); - *argPosition = (asPositive >> NC_ARG_POSITION_OFFSET) & 0xFF; -} - -/*-------------------------------------- -* LIB CONTEXT API -*/ - -/* -* Runtime check for the size of the context struct to allow -for dynamic allocation when context size structure is not known. -* @return The size of the context struct in bytes -*/ -NC_EXPORT uint32_t NC_CC NCGetContextStructSize(void); -/* -* Initializes a context struct with the given entropy -* @param ctx A pointer to the context structure to initialize -* @param entropy The 32byte entropy to initialize the context with -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCInitContext( - NCContext* ctx, - const uint8_t entropy[32] -); -/* -* Reinitializes a context struct with the given -* @param ctx A pointer to the context structure to initialize -* @param entropy The 32byte entropy to initialize the context with -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCReInitContext( - NCContext* ctx, - const uint8_t entropy[32] -); - -/* -* Destroys a context struct -* @param ctx A pointer to the existing context structure to destroy -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCDestroyContext(NCContext* ctx); - - - -/*-------------------------------------- -* HIGH LEVEL SIGNING API -*/ - -/* -* Gets a 32byte x-only compressed public key from the given secret key -* @param ctx A pointer to the existing library context -* @param sk A pointer to the secret key -* @param pk A pointer to the compressed public key buffer to write to -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCGetPublicKey( - const NCContext* ctx, - const NCSecretKey* sk, - NCPublicKey* pk -); -/* -* Validates that a given secret key is valid according to the secp256k1 curve. This -is functionally the same as calling secp256k1_ec_seckey_verify. -* @param ctx A pointer to the existing library context -* @param sk A pointer to the secret key to verify -* @return 1 if the secret key is valid, 0 if it is not, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCValidateSecretKey( - const NCContext* ctx, - const NCSecretKey* sk -); - - -/* -* Signs a raw message after computing the sha256 checksum using the -given secret key and writes the signature to the sig64 buffer. -* @param ctx A pointer to the existing library context -* @param sk A pointer to the secret key to sign with -* @param random32 A pointer to the 32byte random32 buffer to use for signing -* @param data A pointer to the raw data buffer to sign -* @param dataSize The size of the raw data buffer -* @param sig64 A pointer to the 64byte buffer to write the signature to -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCSignData( - const NCContext* ctx, - const NCSecretKey* sk, - const uint8_t random32[32], - const uint8_t* data, - const size_t dataSize, - uint8_t sig64[64] -); - -/* -* Verifies a signature of a raw data buffer matches the output using the given public key. -* @param ctx A pointer to the existing library context -* @param sig64 The 64byte signature to verify -* @param data A pointer to the raw data buffer to verify -* @param dataSize The size of the raw data buffer -* @param pk A pointer to the the x-only compressed public key (x-only serialized public key) -* @return NC_SUCCESS if the signature could be verified, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCVerifyData( - const NCContext* ctx, - const NCPublicKey* pk, - const uint8_t* data, - const size_t dataSize, - const uint8_t sig64[64] -); - -/*-------------------------------------- -* EXTENDED SIGNING API -*/ - -/* -* Signs a message using the given secret key and writes the signature to the sig64 buffer -* @param ctx A pointer to the existing library context -* @param sk A pointer to the secret key to sign with -* @param random32 A pointer to the 32byte random32 buffer to use for signing -* @param digest32 A pointer to 32byte sha256 digest32 to sign -* @param sig64 A pointer to the 64byte buffer to write the signature to -* @return NC_SUCCESS if the operation was successful, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCSignDigest( - const NCContext* ctx, - const NCSecretKey* sk, - const uint8_t random32[32], - const uint8_t digest32[32], - uint8_t sig64[64] -); - -/* -* Verifies a signature of a digest32 matches the output using the given public key. -Equivalent to calling secp256k1_schnorrsig_verify. -* @param ctx A pointer to the existing library context -* @param sig64 The 64byte signature to verify -* @param digest32 The 32byte digest32 to verify -* @param pk A pointer to the the x-only compressed public key (x-only serialized public key) -* @return NC_SUCCESS if the signature could be verified, otherwise an error code -*/ -NC_EXPORT NCResult NC_CC NCVerifyDigest( - const NCContext* ctx, - const NCPublicKey* pk, - const uint8_t digest32[32], - const uint8_t sig64[64] -); - - - -/*-------------------------------------- -* HIGH LEVEL ENCRYPTION API -*/ - -/* -* NOTES -* -* NIP-44 requires that plaintext/ciphertext must be padded in powers of 2. -* Since this library operates on data at the binary level, and does not do -* ANY runtime heap allocation, it is up to the user to ensure that the -* plaintext/ciphertext buffers are padded properly in The NCryptoData struct -* before calling the encryption/decryption functions. -*/ - -/* -* High level api for encrypting nostr messages using a secret key and a public key. Use -the NCEncryptEx functions for extended encryption functionality -* @param ctx The library context -* @param sk The secret key (the local private key) -* @param pk The 32byte compressed public key (x-only serialized public key) the other user's public key -* @param args The encryption arguments -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCEncrypt( - const NCContext* ctx, - const NCSecretKey* sk, - const NCPublicKey* pk, - uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE], - NCCryptoData* args -); - -/* -* High level api for decrypting nostr messages using a secret key and a public key. Use -the NCDecryptEx functions for extended decryption functionality. -* @param ctx The library context -* @param sk The secret key (the local private key) -* @param pk The 32byte compressed public key (x-only serialized public key) the other user's public key -* @param args The decryption arguments -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCDecrypt( - const NCContext* ctx, - const NCSecretKey* sk, - const NCPublicKey* pk, - NCCryptoData* args -); - -/* -* High level api for verifying a Nip44 message authentication code using a secret key -and a public key. Use the NCVerifyMacEx functions for extended verification functionality. -* @param ctx A pointer to an existing library context -* @param sk A pointer to the secret key -* @param pk A pointer to the 32byte compressed public key (x-only serialized public key) -* @param args A pointer to the mac verification arguments -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -* the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCVerifyMac( - const NCContext* ctx, - const NCSecretKey* sk, - const NCPublicKey* pk, - NCMacVerifyArgs* args -); - -/*-------------------------------------- -* EXTENDED ENCRYPTION API -*/ - -/* -* Computes a NIP-44 shared secret from a secret key and a public key and -stores it in the sharedPoint buffer. -* @param ctx A pointer to the existing library context -* @param sk The secret key -* @param pk The 32byte compressed public key (x-only serialized public key) -* @param sharedPoint The 32byte buffer to store write the secret data to -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCGetSharedSecret( - const NCContext* ctx, - const NCSecretKey* sk, - const NCPublicKey* pk, - uint8_t sharedPoint[NC_SHARED_SEC_SIZE] -); - -/* -* Computes a NIP-44 conversation key from the local secret key and the remote -public key, and stores it in the conversationKey buffer. -* @param ctx A pointer to the existing library context -* @param sk A pointer to the 32byte the secret key -* @param pk A pointer to the 32byte compressed public key (x-only serialized public key) -* @param conversationKey The 32byte buffer to store write the conversation key to -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCGetConversationKey( - const NCContext* ctx, - const NCSecretKey* sk, - const NCPublicKey* pk, - uint8_t conversationKey[NC_CONV_KEY_SIZE] -); -/* -* Computes a NIP-44 conversation key a shared secret/point, and stores it in the -conversationKey buffer. -* @param ctx A pointer to the existing library context -* @param sharedPoint A pointer to the 32byte shared secret/point -* @param conversationKey The 32byte buffer to store write the conversation key to -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error -*/ -NC_EXPORT NCResult NC_CC NCGetConversationKeyEx( - const NCContext* ctx, - const uint8_t sharedPoint[NC_SHARED_SEC_SIZE], - uint8_t conversationKey[NC_CONV_KEY_SIZE] -); - -/* -* Encrypts a message using the given conversation key and writes the encrypted message to the -* output buffer. The output buffer must be at least 99 bytes in size. -* @param ctx A pointer to the existing library context -* @param conversationKey A pointer to the 32byte conversation key -* @param args A pointer to the encryption arguments structure -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error. -*/ -NC_EXPORT NCResult NC_CC NCEncryptEx( - const NCContext* ctx, - const uint8_t conversationKey[NC_CONV_KEY_SIZE], - uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE], - NCCryptoData* args -); - -/* -* Decrypts a message using the given conversation key and writes the decrypted message to the -* output buffer. -* @param ctx A pointer to the existing library context -* @param conversationKey A pointer to the 32byte conversation key -* @param args A pointer to the decryption arguments structure -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -the error code and positional argument that caused the error. -*/ -NC_EXPORT NCResult NC_CC NCDecryptEx( - const NCContext* ctx, - const uint8_t conversationKey[NC_CONV_KEY_SIZE], - NCCryptoData* args -); - -/* -* Verifies a Nip44 message authentication code using the given conversation key. -* @param ctx A pointer to the existing library context -* @param conversationKey A pointer to the 32byte conversation key -* @param args A pointer to the mac verification arguments -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -* the error code and positional argument that caused the error. -*/ -NC_EXPORT NCResult NC_CC NCVerifyMacEx( - const NCContext* ctx, - const uint8_t conversationKey[NC_CONV_KEY_SIZE], - NCMacVerifyArgs* args -); - -/* -* Computes a message authentication code for a given payload using the given hmacKey and writes the -* mac to the hmacOut buffer. -* @param ctx A pointer to the existing library context -* @param hmacKey A pointer to the 32byte hmac key -* @param payload A pointer to the payload data buffer -* @param payloadSize The size of the payload data buffer -* @param hmacOut A pointer to the 32byte buffer to write the mac to -* @return NC_SUCCESS if the operation was successful, otherwise an error code. Use NCParseErrorCode to -* the error code and positional argument that caused the error. -*/ -NC_EXPORT NCResult NCComputeMac( - const NCContext* ctx, - const uint8_t hmacKey[NC_HMAC_KEY_SIZE], - const uint8_t* payload, - size_t payloadSize, - uint8_t hmacOut[NC_ENCRYPTION_MAC_SIZE] -); - -#endif /* !NOSCRYPT_H */ |