feat(noise): add Noise Handshake State Machine and primitives

vendor/nim-eth

@@ -1 +1 @@
-Subproject commit 92cd608a5f47de1aa55861afa6dcc13bea4ae842
+Subproject commit d442d84d221655ea25271b41bd2de546bafe4914

waku/v2/protocol/waku_noise/noise.nim

@@ -7,17 +7,18 @@
 
 {.push raises: [Defect].}
 
-import std/[options, tables]
+import std/[oids, strformat, options, math, tables]
 import chronos
 import chronicles
 import bearssl
 import strutils
-import stew/[results, endians2]
+import stew/[results, endians2, byteutils]
 import nimcrypto/[utils, sha2, hmac]
 
 import libp2p/utility
 import libp2p/errors
-import libp2p/crypto/[crypto, chacha20poly1305, curve25519]
+import libp2p/crypto/[crypto, chacha20poly1305, curve25519, hkdf]
+import libp2p/protocols/secure/secure
 
 
 logScope:
@@ -72,6 +73,63 @@ type
     handshakeMessage: seq[NoisePublicKey]
     transportMessage: seq[byte]
 
+  #Noise Handshakes
+
+  NoiseTokens* = enum
+    T_e = "e"
+    T_s = "s"
+    T_es = "es"
+    T_ee = "ee"
+    T_se = "se"
+    T_ss = "se"
+    T_psk = "psk"
+    T_none = ""
+
+  MessageDirection* = enum
+    D_r = "->"
+    D_l = "<-"
+    D_none = ""
+
+  HandshakePattern* = object
+    name*: string
+    pre_message_patterns*: seq[(MessageDirection, seq[NoiseTokens])]
+    message_patterns*: seq[(MessageDirection, seq[NoiseTokens])]
+
+  #Noise states
+
+  # https://noiseprotocol.org/noise.html#the-cipherstate-object
+  CipherState* = object
+    k: ChaChaPolyKey
+    n: uint64
+
+  # https://noiseprotocol.org/noise.html#the-symmetricstate-object
+  SymmetricState* = object
+    cs: CipherState
+    ck: ChaChaPolyKey
+    h: MDigest[256]
+
+  # https://noiseprotocol.org/noise.html#the-handshakestate-object
+  HandshakeState = object
+    s: KeyPair
+    e: KeyPair
+    rs: Curve25519Key
+    re: Curve25519Key
+    ss: SymmetricState
+    initiator: bool
+    handshake_pattern: HandshakePattern
+    msg_pattern_idx: uint8
+    psk: seq[byte]
+
+  HandshakeResult = object
+    cs1: CipherState
+    cs2: CipherState
+    rs: Curve25519Key
+    h: MDigest[256] #The handshake state for channel binding
+
+  NoiseState* = object
+    hs: HandshakeState
+    hr: HandshakeResult
+
   # Some useful error types
   NoiseError* = object of LPError
   NoiseHandshakeError* = object of NoiseError
@@ -81,6 +139,54 @@ type
   NoisePublicKeyError* = object of NoiseError
   NoiseMalformedHandshake* = object of NoiseError
 
+# Supported Noise Handshake Patterns
+const
+  EmptyMessagePattern = @[(D_none, @[T_none])]
+
+  NoiseHandshakePatterns*  = {
+
+    "K1K1":   HandshakePattern(name: "Noise_K1K1_25519_ChaChaPoly_SHA256",
+                               pre_message_patterns: @[(D_r, @[T_s]),
+                                                       (D_l, @[T_s])],
+                               message_patterns:     @[(D_r, @[T_e]),
+                                                       (D_l, @[T_e, T_ee, T_es]),
+                                                       (D_r, @[T_se])]
+                               ),
+
+    "XK1":    HandshakePattern(name: "Noise_XK1_25519_ChaChaPoly_SHA256",
+                               pre_message_patterns: @[(D_l, @[T_s])], 
+                               message_patterns:     @[(D_r, @[T_e]),
+                                                       (D_l, @[T_e, T_ee, T_es]),
+                                                       (D_r, @[T_s, T_se])]
+                              ),
+
+    "XX":     HandshakePattern(name: "Noise_XX_25519_ChaChaPoly_SHA256",
+                               pre_message_patterns: EmptyMessagePattern, 
+                               message_patterns:     @[(D_r, @[T_e]),
+                                                       (D_l, @[T_e, T_ee, T_s, T_es]),
+                                                       (D_r, @[T_s, T_se])]
+                              ),
+
+    "XXpsk0": HandshakePattern(name: "Noise_XXpsk0_25519_ChaChaPoly_SHA256",
+                               pre_message_patterns: EmptyMessagePattern, 
+                               message_patterns:     @[(D_r, @[T_psk, T_e]),
+                                                       (D_l, @[T_e, T_ee, T_s, T_es]),
+                                                       (D_r, @[T_s, T_se])]
+                              )
+
+    }.toTable()
+
+
+  PayloadV2ProtocolIDs*  = {
+
+    "":                                      0.uint8,
+    "Noise_K1K1_25519_ChaChaPoly_SHA256":   10.uint8,
+    "Noise_XK1_25519_ChaChaPoly_SHA256":    11.uint8,
+    "Noise_XX_25519_ChaChaPoly_SHA256":     12.uint8,
+    "Noise_XXpsk0_25519_ChaChaPoly_SHA256": 13.uint8,
+    "ChaChaPoly":                           30.uint8
+
+    }.toTable()
 
 #################################################################
 
@@ -99,6 +205,172 @@ proc genKeyPair*(rng: var BrHmacDrbgContext): KeyPair =
   keyPair.publicKey = keyPair.privateKey.public()
   return keyPair
 
+#Printing Handshake Patterns
+proc print*(self: HandshakePattern) 
+   {.raises: [IOError].}=
+  try:
+    if self.name != "":
+      echo self.name, ":"
+    #We iterate over pre message patterns, if any
+    if self.pre_message_patterns != EmptyMessagePattern:
+      for pattern in self.pre_message_patterns:
+          stdout.write "  ", pattern[0]
+          var first = true
+          for token in pattern[1]:
+            if first:
+              stdout.write " ", token
+              first = false        
+            else:
+              stdout.write ", ", token
+          stdout.write "\n"          
+          stdout.flushFile()
+      stdout.write "    ...\n"
+      stdout.flushFile()
+    #We iterate over message patterns
+    for pattern in self.message_patterns:
+      stdout.write "  ", pattern[0]
+      var first = true
+      for token in pattern[1]:
+        if first:
+          stdout.write " ", token
+          first = false        
+        else:
+          stdout.write ", ", token
+      stdout.write "\n"
+      stdout.flushFile()
+  except:
+    echo "HandshakePattern malformed"
+
+
+proc hashProtocol(name: string): MDigest[256] =
+  # If protocol_name is less than or equal to HASHLEN bytes in length,
+  # sets h equal to protocol_name with zero bytes appended to make HASHLEN bytes.
+  # Otherwise sets h = HASH(protocol_name).
+
+  if name.len <= 32:
+    result.data[0..name.high] = name.toBytes
+  else:
+    result = sha256.digest(name)
+
+proc dh(priv: Curve25519Key, pub: Curve25519Key): Curve25519Key =
+  result = pub
+  Curve25519.mul(result, priv)
+
+# Cipherstate
+
+proc hasKey(cs: CipherState): bool =
+  cs.k != EmptyKey
+
+proc encrypt(
+    state: var CipherState,
+    data: var openArray[byte],
+    ad: openArray[byte]): ChaChaPolyTag
+    {.noinit, raises: [Defect, NoiseNonceMaxError].} =
+
+  var nonce: ChaChaPolyNonce
+  nonce[4..<12] = toBytesLE(state.n)
+
+  ChaChaPoly.encrypt(state.k, nonce, result, data, ad)
+
+  inc state.n
+  if state.n > NonceMax:
+    raise newException(NoiseNonceMaxError, "Noise max nonce value reached")
+
+proc encryptWithAd(state: var CipherState, ad, data: openArray[byte]): seq[byte]
+  {.raises: [Defect, NoiseNonceMaxError].} =
+  result = newSeqOfCap[byte](data.len + sizeof(ChaChaPolyTag))
+  result.add(data)
+
+  let tag = encrypt(state, result, ad)
+
+  result.add(tag)
+
+  trace "encryptWithAd",
+    tag = byteutils.toHex(tag), data = result.shortLog, nonce = state.n - 1
+
+proc decryptWithAd(state: var CipherState, ad, data: openArray[byte]): seq[byte]
+  {.raises: [Defect, NoiseDecryptTagError, NoiseNonceMaxError].} =
+  var
+    tagIn = data.toOpenArray(data.len - ChaChaPolyTag.len, data.high).intoChaChaPolyTag
+    tagOut: ChaChaPolyTag
+    nonce: ChaChaPolyNonce
+  nonce[4..<12] = toBytesLE(state.n)
+  result = data[0..(data.high - ChaChaPolyTag.len)]
+  ChaChaPoly.decrypt(state.k, nonce, tagOut, result, ad)
+  trace "decryptWithAd", tagIn = tagIn.shortLog, tagOut = tagOut.shortLog, nonce = state.n
+  if tagIn != tagOut:
+    debug "decryptWithAd failed", data = shortLog(data)
+    raise newException(NoiseDecryptTagError, "decryptWithAd failed tag authentication.")
+  inc state.n
+  if state.n > NonceMax:
+    raise newException(NoiseNonceMaxError, "Noise max nonce value reached")
+
+# Symmetricstate
+
+proc init*(_: type[SymmetricState], hs_pattern: HandshakePattern): SymmetricState =
+  result.h = hs_pattern.name.hashProtocol
+  result.ck = result.h.data.intoChaChaPolyKey
+  result.cs = CipherState(k: EmptyKey)
+
+proc mixKey(ss: var SymmetricState, ikm: ChaChaPolyKey) =
+  var
+    temp_keys: array[2, ChaChaPolyKey]
+  sha256.hkdf(ss.ck, ikm, [], temp_keys)
+  ss.ck = temp_keys[0]
+  ss.cs = CipherState(k: temp_keys[1])
+  trace "mixKey", key = ss.cs.k.shortLog
+
+proc mixHash(ss: var SymmetricState, data: openArray[byte]) =
+  var ctx: sha256
+  ctx.init()
+  ctx.update(ss.h.data)
+  ctx.update(data)
+  ss.h = ctx.finish()
+  trace "mixHash", hash = ss.h.data.shortLog
+
+# We might use this for other handshake patterns/tokens
+proc mixKeyAndHash(ss: var SymmetricState, ikm: openArray[byte]) {.used.} =
+  var
+    temp_keys: array[3, ChaChaPolyKey]
+  sha256.hkdf(ss.ck, ikm, [], temp_keys)
+  ss.ck = temp_keys[0]
+  ss.mixHash(temp_keys[1])
+  ss.cs = CipherState(k: temp_keys[2])
+
+proc encryptAndHash(ss: var SymmetricState, data: openArray[byte]): seq[byte]
+  {.raises: [Defect, NoiseNonceMaxError].} =
+  # according to spec if key is empty leave plaintext
+  if ss.cs.hasKey:
+    result = ss.cs.encryptWithAd(ss.h.data, data)
+  else:
+    result = @data
+  ss.mixHash(result)
+
+proc decryptAndHash(ss: var SymmetricState, data: openArray[byte]): seq[byte]
+  {.raises: [Defect, NoiseDecryptTagError, NoiseNonceMaxError].} =
+  # according to spec if key is empty leave plaintext
+  if ss.cs.hasKey and data.len > ChaChaPolyTag.len:
+    result = ss.cs.decryptWithAd(ss.h.data, data)
+  else:
+    result = @data
+  ss.mixHash(data)
+
+proc split(ss: var SymmetricState): tuple[cs1, cs2: CipherState] =
+  var
+    temp_keys: array[2, ChaChaPolyKey]
+  sha256.hkdf(ss.ck, [], [], temp_keys)
+  return (CipherState(k: temp_keys[0]), CipherState(k: temp_keys[1]))
+
+
+# Handshake state
+
+proc init*(_: type[HandshakeState], hs_pattern: HandshakePattern, psk: seq[byte] = @[]): HandshakeState =
+  # set to true only if startHandshake is called over the handshake state
+  result.initiator = false
+  result.handshake_pattern = hs_pattern
+  result.psk = psk
+  result.ss = SymmetricState.init(hs_pattern)
+
 
 #################################################################
 
@@ -256,7 +528,6 @@ proc decryptNoisePublicKey*(cs: ChaChaPolyCipherState, noisePublicKey: NoisePubl
     decryptedNoisePublicKey = noisePublicKey
   return decryptedNoisePublicKey
 
-
 #################################################################
 
 # Payload encoding/decoding procedures