aboutsummaryrefslogtreecommitdiffstats
path: root/src/handshake/noise.rs
diff options
context:
space:
mode:
Diffstat (limited to 'src/handshake/noise.rs')
-rw-r--r--src/handshake/noise.rs393
1 files changed, 204 insertions, 189 deletions
diff --git a/src/handshake/noise.rs b/src/handshake/noise.rs
index 8efe4aa..db1a244 100644
--- a/src/handshake/noise.rs
+++ b/src/handshake/noise.rs
@@ -15,6 +15,8 @@ use rand::{CryptoRng, RngCore};
use generic_array::typenum::*;
use generic_array::*;
+use clear_on_drop::clear_stack_on_return;
+
use super::device::Device;
use super::messages::{NoiseInitiation, NoiseResponse};
use super::messages::{TYPE_INITIATION, TYPE_RESPONSE};
@@ -39,6 +41,9 @@ const SIZE_HS: usize = 32;
const SIZE_NONCE: usize = 8;
const SIZE_TAG: usize = 16;
+// number of pages to clear after sensitive call
+const CLEAR_PAGES: usize = 1;
+
// C := Hash(Construction)
const INITIAL_CK: [u8; SIZE_CK] = [
0x60, 0xe2, 0x6d, 0xae, 0xf3, 0x27, 0xef, 0xc0, 0x2e, 0xc3, 0x35, 0xe2, 0xa0, 0x25, 0xd2, 0xd0,
@@ -103,21 +108,21 @@ macro_rules! KDF3 {
}
macro_rules! SEAL {
- ($key:expr, $ad:expr, $pt:expr, $ct:expr) => {{
- let ct = ChaCha20Poly1305::new(*GenericArray::from_slice($key))
+ ($key:expr, $ad:expr, $pt:expr, $ct:expr) => {
+ ChaCha20Poly1305::new(*GenericArray::from_slice($key))
.encrypt(&ZERO_NONCE.into(), Payload { msg: $pt, aad: $ad })
- .unwrap();
- $ct.copy_from_slice(&ct);
- }};
+ .map(|ct| $ct.copy_from_slice(&ct))
+ .unwrap()
+ };
}
macro_rules! OPEN {
- ($key:expr, $ad:expr, $pt:expr, $ct:expr) => {{
+ ($key:expr, $ad:expr, $pt:expr, $ct:expr) => {
ChaCha20Poly1305::new(*GenericArray::from_slice($key))
.decrypt(&ZERO_NONCE.into(), Payload { msg: $ct, aad: $ad })
.map_err(|_| HandshakeError::DecryptionFailure)
.map(|pt| $pt.copy_from_slice(&pt))
- }};
+ };
}
#[cfg(test)]
@@ -211,144 +216,151 @@ pub fn create_initiation<T: Copy, R: RngCore + CryptoRng>(
sender: u32,
msg: &mut NoiseInitiation,
) -> Result<(), HandshakeError> {
- // initialize state
+ clear_stack_on_return(CLEAR_PAGES, || {
+ // initialize state
- let ck = INITIAL_CK;
- let hs = INITIAL_HS;
- let hs = HASH!(&hs, peer.pk.as_bytes());
+ let ck = INITIAL_CK;
+ let hs = INITIAL_HS;
+ let hs = HASH!(&hs, peer.pk.as_bytes());
- msg.f_type.set(TYPE_INITIATION as u32);
- msg.f_sender.set(sender);
+ msg.f_type.set(TYPE_INITIATION as u32);
+ msg.f_sender.set(sender);
- // (E_priv, E_pub) := DH-Generate()
+ // (E_priv, E_pub) := DH-Generate()
- let eph_sk = StaticSecret::new(rng);
- let eph_pk = PublicKey::from(&eph_sk);
+ let eph_sk = StaticSecret::new(rng);
+ let eph_pk = PublicKey::from(&eph_sk);
- // C := Kdf(C, E_pub)
+ // C := Kdf(C, E_pub)
- let ck = KDF1!(&ck, eph_pk.as_bytes());
+ let ck = KDF1!(&ck, eph_pk.as_bytes());
- // msg.ephemeral := E_pub
+ // msg.ephemeral := E_pub
- msg.f_ephemeral = *eph_pk.as_bytes();
+ msg.f_ephemeral = *eph_pk.as_bytes();
- // H := HASH(H, msg.ephemeral)
+ // H := HASH(H, msg.ephemeral)
- let hs = HASH!(&hs, msg.f_ephemeral);
+ let hs = HASH!(&hs, msg.f_ephemeral);
- // (C, k) := Kdf2(C, DH(E_priv, S_pub))
+ // (C, k) := Kdf2(C, DH(E_priv, S_pub))
- let (ck, key) = KDF2!(&ck, eph_sk.diffie_hellman(&peer.pk).as_bytes());
+ let (ck, key) = KDF2!(&ck, eph_sk.diffie_hellman(&peer.pk).as_bytes());
- // msg.static := Aead(k, 0, S_pub, H)
+ // msg.static := Aead(k, 0, S_pub, H)
- SEAL!(
- &key,
- &hs, // ad
- device.pk.as_bytes(), // pt
- &mut msg.f_static // ct || tag
- );
+ SEAL!(
+ &key,
+ &hs, // ad
+ device.pk.as_bytes(), // pt
+ &mut msg.f_static // ct || tag
+ );
- // H := Hash(H || msg.static)
+ // H := Hash(H || msg.static)
- let hs = HASH!(&hs, &msg.f_static[..]);
+ let hs = HASH!(&hs, &msg.f_static[..]);
- // (C, k) := Kdf2(C, DH(S_priv, S_pub))
+ // (C, k) := Kdf2(C, DH(S_priv, S_pub))
- let (ck, key) = KDF2!(&ck, peer.ss.as_bytes());
+ let (ck, key) = KDF2!(&ck, peer.ss.as_bytes());
- // msg.timestamp := Aead(k, 0, Timestamp(), H)
+ // msg.timestamp := Aead(k, 0, Timestamp(), H)
- SEAL!(
- &key,
- &hs, // ad
- &timestamp::now(), // pt
- &mut msg.f_timestamp // ct || tag
- );
+ SEAL!(
+ &key,
+ &hs, // ad
+ &timestamp::now(), // pt
+ &mut msg.f_timestamp // ct || tag
+ );
- // H := Hash(H || msg.timestamp)
+ // H := Hash(H || msg.timestamp)
- let hs = HASH!(&hs, &msg.f_timestamp);
+ let hs = HASH!(&hs, &msg.f_timestamp);
- // update state of peer
+ // update state of peer
- peer.set_state(State::InitiationSent {
- hs,
- ck,
- eph_sk,
- sender,
- });
+ peer.set_state(State::InitiationSent {
+ hs,
+ ck,
+ eph_sk,
+ sender,
+ });
- Ok(())
+ Ok(())
+ })
}
pub fn consume_initiation<'a, T: Copy>(
device: &'a Device<T>,
msg: &NoiseInitiation,
) -> Result<(&'a Peer<T>, TemporaryState), HandshakeError> {
- // initialize state
+ clear_stack_on_return(CLEAR_PAGES, || {
+ // initialize state
+
+ let ck = INITIAL_CK;
+ let hs = INITIAL_HS;
+ let hs = HASH!(&hs, device.pk.as_bytes());
- let ck = INITIAL_CK;
- let hs = INITIAL_HS;
- let hs = HASH!(&hs, device.pk.as_bytes());
+ // C := Kdf(C, E_pub)
- // C := Kdf(C, E_pub)
+ let ck = KDF1!(&ck, &msg.f_ephemeral);
- let ck = KDF1!(&ck, &msg.f_ephemeral);
+ // H := HASH(H, msg.ephemeral)
- // H := HASH(H, msg.ephemeral)
+ let hs = HASH!(&hs, &msg.f_ephemeral);
- let hs = HASH!(&hs, &msg.f_ephemeral);
+ // (C, k) := Kdf2(C, DH(E_priv, S_pub))
- // (C, k) := Kdf2(C, DH(E_priv, S_pub))
+ let eph_r_pk = PublicKey::from(msg.f_ephemeral);
+ let (ck, key) = KDF2!(&ck, device.sk.diffie_hellman(&eph_r_pk).as_bytes());
- let eph_r_pk = PublicKey::from(msg.f_ephemeral);
- let (ck, key) = KDF2!(&ck, device.sk.diffie_hellman(&eph_r_pk).as_bytes());
+ // msg.static := Aead(k, 0, S_pub, H)
- // msg.static := Aead(k, 0, S_pub, H)
+ let mut pk = [0u8; 32];
- let mut pk = [0u8; 32];
+ OPEN!(
+ &key,
+ &hs, // ad
+ &mut pk, // pt
+ &msg.f_static // ct || tag
+ )?;
- OPEN!(
- &key,
- &hs, // ad
- &mut pk, // pt
- &msg.f_static // ct || tag
- )?;
+ let peer = device.lookup_pk(&PublicKey::from(pk))?;
- let peer = device.lookup_pk(&PublicKey::from(pk))?;
+ // H := Hash(H || msg.static)
- // H := Hash(H || msg.static)
+ let hs = HASH!(&hs, &msg.f_static[..]);
- let hs = HASH!(&hs, &msg.f_static[..]);
+ // (C, k) := Kdf2(C, DH(S_priv, S_pub))
- // (C, k) := Kdf2(C, DH(S_priv, S_pub))
+ let (ck, key) = KDF2!(&ck, peer.ss.as_bytes());
- let (ck, key) = KDF2!(&ck, peer.ss.as_bytes());
+ // msg.timestamp := Aead(k, 0, Timestamp(), H)
- // msg.timestamp := Aead(k, 0, Timestamp(), H)
+ let mut ts = timestamp::ZERO;
- let mut ts = timestamp::ZERO;
+ OPEN!(
+ &key,
+ &hs, // ad
+ &mut ts, // pt
+ &msg.f_timestamp // ct || tag
+ )?;
- OPEN!(
- &key,
- &hs, // ad
- &mut ts, // pt
- &msg.f_timestamp // ct || tag
- )?;
+ // check and update timestamp
- // check and update timestamp
+ peer.check_replay_flood(device, &ts)?;
- peer.check_replay_flood(device, &ts)?;
+ // H := Hash(H || msg.timestamp)
- // H := Hash(H || msg.timestamp)
+ let hs = HASH!(&hs, &msg.f_timestamp);
- let hs = HASH!(&hs, &msg.f_timestamp);
+ // clear initiation state
+ *peer.state.lock() = State::Reset;
- // return state (to create response)
+ // return state (to create response)
- Ok((peer, (msg.f_sender.get(), eph_r_pk, hs, ck)))
+ Ok((peer, (msg.f_sender.get(), eph_r_pk, hs, ck)))
+ })
}
pub fn create_response<T: Copy, R: RngCore + CryptoRng>(
@@ -358,79 +370,77 @@ pub fn create_response<T: Copy, R: RngCore + CryptoRng>(
state: TemporaryState, // state from "consume_initiation"
msg: &mut NoiseResponse, // resulting response
) -> Result<KeyPair, HandshakeError> {
- // unpack state
+ clear_stack_on_return(CLEAR_PAGES, || {
+ // unpack state
- let (receiver, eph_r_pk, hs, ck) = state;
+ let (receiver, eph_r_pk, hs, ck) = state;
- msg.f_type.set(TYPE_RESPONSE as u32);
- msg.f_sender.set(sender);
- msg.f_receiver.set(receiver);
+ msg.f_type.set(TYPE_RESPONSE as u32);
+ msg.f_sender.set(sender);
+ msg.f_receiver.set(receiver);
- // (E_priv, E_pub) := DH-Generate()
+ // (E_priv, E_pub) := DH-Generate()
- let eph_sk = StaticSecret::new(rng);
- let eph_pk = PublicKey::from(&eph_sk);
+ let eph_sk = StaticSecret::new(rng);
+ let eph_pk = PublicKey::from(&eph_sk);
- // C := Kdf1(C, E_pub)
+ // C := Kdf1(C, E_pub)
- let ck = KDF1!(&ck, eph_pk.as_bytes());
+ let ck = KDF1!(&ck, eph_pk.as_bytes());
- // msg.ephemeral := E_pub
+ // msg.ephemeral := E_pub
- msg.f_ephemeral = *eph_pk.as_bytes();
+ msg.f_ephemeral = *eph_pk.as_bytes();
- // H := Hash(H || msg.ephemeral)
+ // H := Hash(H || msg.ephemeral)
- let hs = HASH!(&hs, &msg.f_ephemeral);
+ let hs = HASH!(&hs, &msg.f_ephemeral);
- // C := Kdf1(C, DH(E_priv, E_pub))
+ // C := Kdf1(C, DH(E_priv, E_pub))
- let ck = KDF1!(&ck, eph_sk.diffie_hellman(&eph_r_pk).as_bytes());
+ let ck = KDF1!(&ck, eph_sk.diffie_hellman(&eph_r_pk).as_bytes());
- // C := Kdf1(C, DH(E_priv, S_pub))
+ // C := Kdf1(C, DH(E_priv, S_pub))
- let ck = KDF1!(&ck, eph_sk.diffie_hellman(&peer.pk).as_bytes());
+ let ck = KDF1!(&ck, eph_sk.diffie_hellman(&peer.pk).as_bytes());
- // (C, tau, k) := Kdf3(C, Q)
+ // (C, tau, k) := Kdf3(C, Q)
- let (ck, tau, key) = KDF3!(&ck, &peer.psk);
+ let (ck, tau, key) = KDF3!(&ck, &peer.psk);
- // H := Hash(H || tau)
+ // H := Hash(H || tau)
- let hs = HASH!(&hs, tau);
+ let hs = HASH!(&hs, tau);
- // msg.empty := Aead(k, 0, [], H)
+ // msg.empty := Aead(k, 0, [], H)
- SEAL!(
- &key,
- &hs, // ad
- &[], // pt
- &mut msg.f_empty // \epsilon || tag
- );
-
- /* not strictly needed
- * // H := Hash(H || msg.empty)
- * let hs = HASH!(&hs, &msg.f_empty_tag);
- */
+ SEAL!(
+ &key,
+ &hs, // ad
+ &[], // pt
+ &mut msg.f_empty // \epsilon || tag
+ );
- // derive key-pair
- // (verbose code, due to GenericArray -> [u8; 32] conversion)
+ // Not strictly needed
+ // let hs = HASH!(&hs, &msg.f_empty_tag);
- let (key_recv, key_send) = KDF2!(&ck, &[]);
+ // derive key-pair
+ let (key_recv, key_send) = KDF2!(&ck, &[]);
- // return unconfirmed key-pair
+ // return unconfirmed key-pair
- Ok(KeyPair {
- birth: Instant::now(),
- initiator: false,
- send: Key {
- id: sender,
- key: key_send.into(),
- },
- recv: Key {
- id: receiver,
- key: key_recv.into(),
- },
+ Ok(KeyPair {
+ birth: Instant::now(),
+ initiator: false,
+ send: Key {
+ id: sender,
+ key: key_send.into(),
+ },
+ recv: Key {
+ id: receiver,
+ key: key_recv.into(),
+ },
+ })
})
}
@@ -438,73 +448,78 @@ pub fn consume_response<T: Copy>(
device: &Device<T>,
msg: &NoiseResponse,
) -> Result<Output<T>, HandshakeError> {
- // retrieve peer and associated state
+ clear_stack_on_return(CLEAR_PAGES, || {
+ // retrieve peer and copy associated state
+ let peer = device.lookup_id(msg.f_receiver.get())?;
+ let (hs, ck, sender, eph_sk) = match *peer.state.lock() {
+ State::InitiationSent {
+ hs,
+ ck,
+ sender,
+ ref eph_sk,
+ } => Ok((hs, ck, sender, StaticSecret::from(eph_sk.to_bytes()))),
+ _ => Err(HandshakeError::InvalidState),
+ }?;
- let peer = device.lookup_id(msg.f_receiver.get())?;
- let (hs, ck, sender, eph_sk) = match peer.get_state() {
- State::Reset => Err(HandshakeError::InvalidState),
- State::InitiationSent {
- hs,
- ck,
- sender,
- eph_sk,
- } => Ok((hs, ck, sender, eph_sk)),
- }?;
+ // C := Kdf1(C, E_pub)
- // C := Kdf1(C, E_pub)
+ let ck = KDF1!(&ck, &msg.f_ephemeral);
- let ck = KDF1!(&ck, &msg.f_ephemeral);
+ // H := Hash(H || msg.ephemeral)
- // H := Hash(H || msg.ephemeral)
+ let hs = HASH!(&hs, &msg.f_ephemeral);
- let hs = HASH!(&hs, &msg.f_ephemeral);
+ // C := Kdf1(C, DH(E_priv, E_pub))
- // C := Kdf1(C, DH(E_priv, E_pub))
+ let eph_r_pk = PublicKey::from(msg.f_ephemeral);
+ let ck = KDF1!(&ck, eph_sk.diffie_hellman(&eph_r_pk).as_bytes());
- let eph_r_pk = PublicKey::from(msg.f_ephemeral);
- let ck = KDF1!(&ck, eph_sk.diffie_hellman(&eph_r_pk).as_bytes());
+ // C := Kdf1(C, DH(E_priv, S_pub))
- // C := Kdf1(C, DH(E_priv, S_pub))
+ let ck = KDF1!(&ck, device.sk.diffie_hellman(&eph_r_pk).as_bytes());
- let ck = KDF1!(&ck, device.sk.diffie_hellman(&eph_r_pk).as_bytes());
+ // (C, tau, k) := Kdf3(C, Q)
- // (C, tau, k) := Kdf3(C, Q)
+ let (ck, tau, key) = KDF3!(&ck, &peer.psk);
- let (ck, tau, key) = KDF3!(&ck, &peer.psk);
+ // H := Hash(H || tau)
- // H := Hash(H || tau)
+ let hs = HASH!(&hs, tau);
- let hs = HASH!(&hs, tau);
+ // msg.empty := Aead(k, 0, [], H)
- // msg.empty := Aead(k, 0, [], H)
+ OPEN!(
+ &key,
+ &hs, // ad
+ &mut [], // pt
+ &msg.f_empty // \epsilon || tag
+ )?;
- OPEN!(
- &key,
- &hs, // ad
- &mut [], // pt
- &msg.f_empty // \epsilon || tag
- )?;
+ // derive key-pair
- // derive key-pair
+ let (key_send, key_recv) = KDF2!(&ck, &[]);
- let (key_send, key_recv) = KDF2!(&ck, &[]);
+ // null the state
- // return confirmed key-pair
+ *peer.state.lock() = State::Reset;
- Ok((
- Some(peer.identifier), // proves overship of the public key (e.g. for updating the endpoint)
- None, // no response message
- Some(KeyPair {
- birth: Instant::now(),
- initiator: true,
- send: Key {
- id: sender,
- key: key_send.into(),
- },
- recv: Key {
- id: msg.f_sender.get(),
- key: key_recv.into(),
- },
- }),
- ))
+ // return confirmed key-pair
+
+ Ok((
+ Some(peer.identifier), // proves ownership of the public key (e.g. for updating the endpoint)
+ None, // no response message
+ Some(KeyPair {
+ birth: Instant::now(),
+ initiator: true,
+ send: Key {
+ id: sender,
+ key: key_send.into(),
+ },
+ recv: Key {
+ id: msg.f_sender.get(),
+ key: key_recv.into(),
+ },
+ }),
+ ))
+ })
}