From 5fbeb3e29b6440a799d9320e871a1d4d509130b8 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Fri, 6 Jan 2017 12:55:05 +0000 Subject: Enable exporting inbound group session keys A pair of functions which allow you to export the megolm keys for an inbound group session, so that an application can save/restore them. --- src/inbound_group_session.c | 108 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 89 insertions(+), 19 deletions(-) (limited to 'src') diff --git a/src/inbound_group_session.c b/src/inbound_group_session.c index a54e55f..122c26c 100644 --- a/src/inbound_group_session.c +++ b/src/inbound_group_session.c @@ -32,6 +32,7 @@ #define GROUP_SESSION_ID_LENGTH ED25519_PUBLIC_KEY_LENGTH #define PICKLE_VERSION 1 #define SESSION_KEY_VERSION 2 +#define SESSION_EXPORT_VERSION 1 struct OlmInboundGroupSession { /** our earliest known ratchet value */ @@ -71,6 +72,9 @@ size_t olm_clear_inbound_group_session( return sizeof(OlmInboundGroupSession); } +#define SESSION_EXPORT_RAW_LENGTH \ + (1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH) + #define SESSION_KEY_RAW_LENGTH \ (1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH\ + ED25519_SIGNATURE_LENGTH) @@ -257,6 +261,32 @@ size_t olm_group_decrypt_max_plaintext_length( ); } +/** + * get a copy of the megolm ratchet, advanced + * to the relevant index. Returns 0 on success, -1 on error + */ +static size_t _get_megolm( + OlmInboundGroupSession *session, uint32_t message_index, Megolm *result +) { + /* pick a megolm instance to use. If we're at or beyond the latest ratchet + * value, use that */ + if ((message_index - session->latest_ratchet.counter) < (1U << 31)) { + megolm_advance_to(&session->latest_ratchet, message_index); + *result = session->latest_ratchet; + return 0; + } else if ((message_index - session->initial_ratchet.counter) >= (1U << 31)) { + /* the counter is before our intial ratchet - we can't decode this. */ + session->last_error = OLM_UNKNOWN_MESSAGE_INDEX; + return (size_t)-1; + } else { + /* otherwise, start from the initial megolm. Take a copy so that we + * don't overwrite the initial megolm */ + *result = session->initial_ratchet; + megolm_advance_to(result, message_index); + return 0; + } +} + /** * decrypt an un-base64-ed message */ @@ -268,8 +298,7 @@ static size_t _decrypt( ) { struct _OlmDecodeGroupMessageResults decoded_results; size_t max_length, r; - Megolm *megolm; - Megolm tmp_megolm; + Megolm megolm; _olm_decode_group_message( message, message_length, @@ -316,33 +345,21 @@ static size_t _decrypt( return (size_t)-1; } - /* pick a megolm instance to use. If we're at or beyond the latest ratchet - * value, use that */ - if ((decoded_results.message_index - session->latest_ratchet.counter) < (1U << 31)) { - megolm = &session->latest_ratchet; - } else if ((decoded_results.message_index - session->initial_ratchet.counter) >= (1U << 31)) { - /* the counter is before our intial ratchet - we can't decode this. */ - session->last_error = OLM_UNKNOWN_MESSAGE_INDEX; - return (size_t)-1; - } else { - /* otherwise, start from the initial megolm. Take a copy so that we - * don't overwrite the initial megolm */ - tmp_megolm = session->initial_ratchet; - megolm = &tmp_megolm; + r = _get_megolm(session, decoded_results.message_index, &megolm); + if (r == (size_t)-1) { + return r; } - megolm_advance_to(megolm, decoded_results.message_index); - /* now try checking the mac, and decrypting */ r = megolm_cipher->ops->decrypt( megolm_cipher, - megolm_get_data(megolm), MEGOLM_RATCHET_LENGTH, + megolm_get_data(&megolm), MEGOLM_RATCHET_LENGTH, message, message_length, decoded_results.ciphertext, decoded_results.ciphertext_length, plaintext, max_plaintext_length ); - _olm_unset(&tmp_megolm, sizeof(tmp_megolm)); + _olm_unset(&megolm, sizeof(megolm)); if (r == (size_t)-1) { session->last_error = OLM_BAD_MESSAGE_MAC; return r; @@ -391,3 +408,56 @@ size_t olm_inbound_group_session_id( session->signing_key.public_key, GROUP_SESSION_ID_LENGTH, id ); } + +uint32_t olm_inbound_group_session_first_known_index( + const OlmInboundGroupSession *session +) { + return session->initial_ratchet.counter; +} + +size_t olm_export_inbound_group_session_length( + const OlmInboundGroupSession *session +) { + return _olm_encode_base64_length(SESSION_EXPORT_RAW_LENGTH); +} + +size_t olm_export_inbound_group_session( + OlmInboundGroupSession *session, + uint8_t * key, size_t key_length, uint32_t message_index +) { + uint8_t *raw; + uint8_t *ptr; + Megolm megolm; + size_t r; + size_t encoded_length = olm_export_inbound_group_session_length(session); + + if (key_length < encoded_length) { + session->last_error = OLM_OUTPUT_BUFFER_TOO_SMALL; + return (size_t)-1; + } + + r = _get_megolm(session, message_index, &megolm); + if (r == (size_t)-1) { + return r; + } + + /* put the raw data at the end of the output buffer. */ + raw = ptr = key + encoded_length - SESSION_EXPORT_RAW_LENGTH; + *ptr++ = SESSION_EXPORT_VERSION; + + // Encode message index as a big endian 32-bit number. + for (unsigned i = 0; i < 4; i++) { + *ptr++ = 0xFF & (message_index >> 24); message_index <<= 8; + } + + memcpy(ptr, megolm_get_data(&megolm), MEGOLM_RATCHET_LENGTH); + ptr += MEGOLM_RATCHET_LENGTH; + + memcpy( + ptr, session->signing_key.public_key, + ED25519_PUBLIC_KEY_LENGTH + ); + ptr += ED25519_PUBLIC_KEY_LENGTH; + + return _olm_encode_base64(raw, SESSION_EXPORT_RAW_LENGTH, key); +} -- cgit v1.2.3 From a2f0c93a93f6914291954b08a7518b4f17561c11 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Fri, 6 Jan 2017 17:40:39 +0000 Subject: Implement importing group session data olm_import_inbound_group_session, which reads the format written by olm_export_inbound_group_session to initialise a group session. --- src/inbound_group_session.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/inbound_group_session.c b/src/inbound_group_session.c index 122c26c..be0984c 100644 --- a/src/inbound_group_session.c +++ b/src/inbound_group_session.c @@ -79,15 +79,17 @@ size_t olm_clear_inbound_group_session( (1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH\ + ED25519_SIGNATURE_LENGTH) -/** init the session keys from the un-base64-ed session keys */ static size_t _init_group_session_keys( OlmInboundGroupSession *session, - const uint8_t *key_buf + const uint8_t *key_buf, + int export_format ) { + const uint8_t expected_version = + (export_format ? SESSION_EXPORT_VERSION : SESSION_KEY_VERSION); const uint8_t *ptr = key_buf; size_t version = *ptr++; - if (version != SESSION_KEY_VERSION) { + if (version != expected_version) { session->last_error = OLM_BAD_SESSION_KEY; return (size_t)-1; } @@ -107,7 +109,7 @@ static size_t _init_group_session_keys( ); ptr += ED25519_PUBLIC_KEY_LENGTH; - if (!_olm_crypto_ed25519_verify( + if (!export_format && !_olm_crypto_ed25519_verify( &session->signing_key, key_buf, ptr - key_buf, ptr )) { session->last_error = OLM_BAD_SIGNATURE; @@ -135,11 +137,35 @@ size_t olm_init_inbound_group_session( } _olm_decode_base64(session_key, session_key_length, key_buf); - result = _init_group_session_keys(session, key_buf); + result = _init_group_session_keys(session, key_buf, 0); _olm_unset(key_buf, SESSION_KEY_RAW_LENGTH); return result; } +size_t olm_import_inbound_group_session( + OlmInboundGroupSession *session, + const uint8_t * session_key, size_t session_key_length +) { + uint8_t key_buf[SESSION_EXPORT_RAW_LENGTH]; + size_t raw_length = _olm_decode_base64_length(session_key_length); + size_t result; + + if (raw_length == (size_t)-1) { + session->last_error = OLM_INVALID_BASE64; + return (size_t)-1; + } + + if (raw_length != SESSION_EXPORT_RAW_LENGTH) { + session->last_error = OLM_BAD_SESSION_KEY; + return (size_t)-1; + } + + _olm_decode_base64(session_key, session_key_length, key_buf); + result = _init_group_session_keys(session, key_buf, 1); + _olm_unset(key_buf, SESSION_EXPORT_RAW_LENGTH); + return result; +} + static size_t raw_pickle_length( const OlmInboundGroupSession *session ) { -- cgit v1.2.3 From fc72c732fdaaea93ea92d53c680dacd7cc8ff2a5 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Tue, 10 Jan 2017 10:57:14 +0000 Subject: Store a flag indicating if the sender key is verified --- src/inbound_group_session.c | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/inbound_group_session.c b/src/inbound_group_session.c index be0984c..845c960 100644 --- a/src/inbound_group_session.c +++ b/src/inbound_group_session.c @@ -30,7 +30,7 @@ #define OLM_PROTOCOL_VERSION 3 #define GROUP_SESSION_ID_LENGTH ED25519_PUBLIC_KEY_LENGTH -#define PICKLE_VERSION 1 +#define PICKLE_VERSION 2 #define SESSION_KEY_VERSION 2 #define SESSION_EXPORT_VERSION 1 @@ -44,6 +44,17 @@ struct OlmInboundGroupSession { /** The ed25519 signing key */ struct _olm_ed25519_public_key signing_key; + /** + * Have we ever seen any evidence that this is a valid session? + * (either because the original session share was signed, or because we + * have subsequently successfully decrypted a message?) + * + * (We don't do anything with this currently, but we may want to bear it in + * mind when we consider handling key-shares for sessions we already know + * about.) + */ + int signing_key_verified; + enum OlmErrorCode last_error; }; @@ -109,11 +120,15 @@ static size_t _init_group_session_keys( ); ptr += ED25519_PUBLIC_KEY_LENGTH; - if (!export_format && !_olm_crypto_ed25519_verify( - &session->signing_key, key_buf, ptr - key_buf, ptr - )) { - session->last_error = OLM_BAD_SIGNATURE; - return (size_t)-1; + if (!export_format) { + if (!_olm_crypto_ed25519_verify(&session->signing_key, key_buf, + ptr - key_buf, ptr)) { + session->last_error = OLM_BAD_SIGNATURE; + return (size_t)-1; + } + + /* signed keyshare */ + session->signing_key_verified = 1; } return 0; } @@ -174,6 +189,7 @@ static size_t raw_pickle_length( length += megolm_pickle_length(&session->initial_ratchet); length += megolm_pickle_length(&session->latest_ratchet); length += _olm_pickle_ed25519_public_key_length(&session->signing_key); + length += _olm_pickle_bool_length(session->signing_key_verified); return length; } @@ -201,6 +217,7 @@ size_t olm_pickle_inbound_group_session( pos = megolm_pickle(&session->initial_ratchet, pos); pos = megolm_pickle(&session->latest_ratchet, pos); pos = _olm_pickle_ed25519_public_key(pos, &session->signing_key); + pos = _olm_pickle_bool(pos, session->signing_key_verified); return _olm_enc_output(key, key_length, pickled, raw_length); } @@ -224,7 +241,7 @@ size_t olm_unpickle_inbound_group_session( pos = pickled; end = pos + raw_length; pos = _olm_unpickle_uint32(pos, end, &pickle_version); - if (pickle_version != PICKLE_VERSION) { + if (pickle_version < 1 || pickle_version > PICKLE_VERSION) { session->last_error = OLM_UNKNOWN_PICKLE_VERSION; return (size_t)-1; } @@ -232,6 +249,14 @@ size_t olm_unpickle_inbound_group_session( pos = megolm_unpickle(&session->latest_ratchet, pos, end); pos = _olm_unpickle_ed25519_public_key(pos, end, &session->signing_key); + if (pickle_version == 1) { + /* pickle v1 had no signing_key_verified field (all keyshares were + * verified at import time) */ + session->signing_key_verified = 1; + } else { + pos = _olm_unpickle_bool(pos, end, &(session->signing_key_verified)); + } + if (end != pos) { /* We had the wrong number of bytes in the input. */ session->last_error = OLM_CORRUPTED_PICKLE; @@ -391,6 +416,10 @@ static size_t _decrypt( return r; } + /* once we have successfully decrypted a message, set a flag to say the + * session appears valid. */ + session->signing_key_verified = 1; + return r; } -- cgit v1.2.3 From c04b770cd3c96aa3a55ff3b6d817ba5b6f6f6922 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Tue, 10 Jan 2017 14:11:42 +0000 Subject: Add some tests for inbound session import/export --- src/inbound_group_session.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/inbound_group_session.c b/src/inbound_group_session.c index 845c960..a78404d 100644 --- a/src/inbound_group_session.c +++ b/src/inbound_group_session.c @@ -47,7 +47,7 @@ struct OlmInboundGroupSession { /** * Have we ever seen any evidence that this is a valid session? * (either because the original session share was signed, or because we - * have subsequently successfully decrypted a message?) + * have subsequently successfully decrypted a message) * * (We don't do anything with this currently, but we may want to bear it in * mind when we consider handling key-shares for sessions we already know @@ -470,6 +470,12 @@ uint32_t olm_inbound_group_session_first_known_index( return session->initial_ratchet.counter; } +int olm_inbound_group_session_is_verified( + const OlmInboundGroupSession *session +) { + return session->signing_key_verified; +} + size_t olm_export_inbound_group_session_length( const OlmInboundGroupSession *session ) { -- cgit v1.2.3