feat: WIP NoiseIK handshake based on libsodium

.gitignore

@@ -77,6 +77,9 @@ build/
 # VScode
 .vscode/
 
+# Tests via Zoff
+.localrun/
+
 # Netbeans
 nbproject
 

toxcore/Messenger.h

@@ -70,6 +70,7 @@ typedef struct Messenger_State_Plugin {
 
 typedef struct Messenger_Options {
     bool ipv6enabled;
+    bool noise_compatibility_enabled;
     bool udp_disabled;
     TCP_Proxy_Info proxy_info;
     uint16_t port_range[2];

toxcore/crypto_core.h

@@ -67,6 +67,11 @@ extern "C" {
  */
 #define CRYPTO_NONCE_SIZE              24
 
+/**
+ * @brief NoiseIK: The number of bytes in a nonce used for encryption/decryption (ChaChaPoly-1305-IETF).
+ */
+#define CRYPTO_NOISEIK_NONCE_SIZE              12
+
 /**
  * @brief The number of bytes in a SHA256 hash.
  */
@@ -109,6 +114,25 @@ typedef struct Random {
     void *obj;
 } Random;
 
+// TODO: struct necessary?
+// TODO: move to crypto_core.h?
+/** @brief Necessary Noise handshake state information/values.
+ */
+typedef struct Noise_Handshake {
+    // TODO: static_private?
+    uint8_t static_private[CRYPTO_SECRET_KEY_SIZE];
+    uint8_t static_public[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t ephemeral_private[CRYPTO_SECRET_KEY_SIZE];
+    uint8_t ephemeral_public[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t remote_static[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t remote_ephemeral[CRYPTO_PUBLIC_KEY_SIZE];
+
+    uint8_t hash[CRYPTO_SHA512_SIZE];
+    uint8_t chaining_key[CRYPTO_SHA512_SIZE];
+
+    bool initiator;
+} Noise_Handshake;
+
 /** @brief System random number generator.
  *
  * Uses libsodium's CSPRNG (on Linux, `/dev/urandom`).
@@ -501,6 +525,222 @@ bool crypto_memunlock(void *data, size_t length);
 non_null()
 void new_hmac_key(const Random *rng, uint8_t key[CRYPTO_HMAC_KEY_SIZE]);
 
+/* Necessary functions for Noise, cf. https://noiseprotocol.org/noise.html (Revision 34) */
+
+/**
+ * @brief Encrypt message with precomputed shared key using ChaCha20-Poly1305-IETF (RFC7539).
+ *
+ * Encrypts plain of plain_length to encrypted of plain_length + @ref CRYPTO_MAC_SIZE
+ * using a shared key @ref CRYPTO_SYMMETRIC_KEY_SIZE big and a @ref CRYPTO_NOISEIK_NONCE_SIZE
+ * byte nonce. The encrypted message, as well as a tag authenticating both the confidential
+ * message m and adlen bytes of non-confidential data ad, are put into encrypted.
+ *
+ * @retval -1 if there was a problem.
+ * @return length of encrypted data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t encrypt_data_symmetric_aead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NOISEIK_NONCE_SIZE], const uint8_t *plain, size_t plain_length,
+                                    uint8_t *encrypted, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Decrypt message with precomputed shared key using ChaCha20-Poly1305-IETF (RFC7539).
+ *
+ * Decrypts encrypted of encrypted_length to plain of length
+ * `length - CRYPTO_MAC_SIZE` using a shared key @ref CRYPTO_SHARED_KEY_SIZE
+ * big and a @ref CRYPTO_NOISEIK_NONCE_SIZE byte nonce.
+ *
+ * @retval -1 if there was a problem (decryption failed).
+ * @return length of plain data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t decrypt_data_symmetric_aead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NOISEIK_NONCE_SIZE], const uint8_t *encrypted, size_t encrypted_length,
+                                    uint8_t *plain, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Encrypt message with precomputed shared key using XChaCha20-Poly1305.
+ *
+ * Encrypts plain of plain_length to encrypted of plain_length + @ref CRYPTO_MAC_SIZE
+ * using a shared key @ref CRYPTO_SYMMETRIC_KEY_SIZE big and a @ref CRYPTO_NONCE_SIZE
+ * byte nonce. The encrypted message, as well as a tag authenticating both the confidential
+ * message m and adlen bytes of non-confidential data ad, are put into encrypted.
+ *
+ * @retval -1 if there was a problem.
+ * @return length of encrypted data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t encrypt_data_symmetric_xaead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NONCE_SIZE], const uint8_t *plain, size_t plain_length,
+                                    uint8_t *encrypted, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Decrypt message with precomputed shared key using XChaCha20-Poly1305.
+ *
+ * Decrypts encrypted of encrypted_length to plain of length
+ * `length - CRYPTO_MAC_SIZE` using a shared key @ref CRYPTO_SHARED_KEY_SIZE
+ * big and a @ref CRYPTO_NONCE_SIZE byte nonce.
+ *
+ * @retval -1 if there was a problem (decryption failed).
+ * @return length of plain data if everything was fine.
+ */
+non_null(1, 2, 3, 5) nullable(6)
+int32_t decrypt_data_symmetric_xaead(const uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE], const uint8_t nonce[CRYPTO_NONCE_SIZE], const uint8_t *encrypted, size_t encrypted_length,
+                                    uint8_t *plain, const uint8_t *ad, size_t ad_length);
+
+/**
+ * @brief Compute an HMAC-SHA512 authenticator (64 bytes).
+ *
+ * cf. Noise sections 4.3 and 5.1
+ * Applies HMAC from RFC2104 (https://tools.ietf.org/html/rfc2104) using the HASH() (=SHA512) function.
+ * This function is only called via `crypto_hkdf()`.
+ * HMAC-SHA-512 instead of HMAC-SHA512-256 as used by `crypto_auth_*()` (libsodium) which is underlying function of
+ * `crypto_hmac*() in crypto_core. Necessary for Noise (cf. section 4.3) to return 64 bytes (SHA512 HASHLEN) instead of
+ * of 32 bytes (SHA512-256 HASHLEN). Cf. https://doc.libsodium.org/advanced/hmac-sha2#hmac-sha-512
+ * key is CRYPTO_SHA512_SIZE bytes because this function is only called via crypto_hkdf() where the key (ck, temp_key)
+ * is always HASHLEN bytes.
+ *
+ * @param auth Resulting authenticator.
+ * @param key Secret key
+ */
+non_null(1, 2) nullable(3)
+void crypto_hmac512(uint8_t auth[CRYPTO_SHA512_SIZE], const uint8_t key[CRYPTO_SHA512_SIZE], const uint8_t *data,
+                    size_t data_length);
+
+/**
+ * @brief Computes the number of provides outputs (=keys) with HKDF-SHA512.
+ *
+ * cf. Noise sections 4.3 and 5.1
+ *
+ * This is Hugo Krawczyk's HKDF:
+ * - https://eprint.iacr.org/2010/264.pdf
+ * - https://tools.ietf.org/html/rfc5869
+ * HKDF(chaining_key, input_key_material, num_outputs): Takes a
+ * chaining_key byte sequence of length HASHLEN, and an input_key_material
+ * byte sequence with length either zero bytes, 32 bytes, or DHLEN bytes.
+ * Returns a pair or triple of byte sequences each of length HASHLEN,
+ * depending on whether num_outputs is two or three:
+ * – Sets temp_key = HMAC-HASH(chaining_key, input_key_material).
+ * – Sets output1 = HMAC-HASH(temp_key, byte(0x01)).
+ * – Sets output2 = HMAC-HASH(temp_key, output1 || byte(0x02)).
+ * – If num_outputs == 2 then returns the pair (output1, output2).
+ * – Sets output3 = HMAC-HASH(temp_key, output2 || byte(0x03)).
+ * – Returns the triple (output1, output2, output3).
+ * Note that temp_key, output1, output2, and output3 are all HASHLEN bytes in
+ * length. Also note that the HKDF() function is simply HKDF with the
+ * chaining_key as HKDF salt, and zero-length HKDF info.
+ *
+ * @param output1 First key to compute
+ * @param first_len Length of output1/key
+ * @param output2 Second key to compute
+ * @param second_len Length of output2/key
+ * @param data HKDF input_key_material byte sequence with length either zero bytes, 32 bytes, or DHLEN bytes
+ * @param data_len length of either zero bytes, 32 bytes, or DHLEN bytes
+ * @param chaining_key Noise 64 byte chaining key as HKDF salt
+ */
+non_null(1, 3, 7) nullable(5)
+void crypto_hkdf(uint8_t *output1, size_t first_len, uint8_t *output2,
+                 size_t second_len, const uint8_t *data,
+                 size_t data_len, const uint8_t chaining_key[CRYPTO_SHA512_SIZE]);
+
+/**
+ * @brief Initializes a Noise Handshake State with provided static X25519 ID key pair, X25519 static ID public key from peer
+ * and sets if initiator or not.
+ *
+ * cf. Noise section 5.3
+ * Calls InitializeSymmetric(protocol_name).
+ * Calls MixHash(prologue).
+ * Sets the initiator, s, e, rs, and re variables to the corresponding arguments.
+ * Calls MixHash() once for each public key listed in the pre-messages.
+ *
+ * //TODO: remove Logger Param
+ * @param noise_handshake handshake struct to save the necessary values to
+ * @param self_secret_key static private ID X25519 key of this Tox instance
+ * @param peer_public_key X25519 static ID public key from peer to connect to
+ * @param initiator specifies if this Tox instance is the initiator of this crypto connection
+ * @param prologue specifies the prologue, used in call to MixHash(prologue) which maybe zero-length
+ * @param prologue_length length of prologue in bytes
+ *
+ * @return -1 on failure
+ * @return 0 on success
+ */
+non_null(2, 3) nullable(1, 4, 6)
+int noise_handshake_init
+(Noise_Handshake *noise_handshake, const uint8_t *self_secret_key, const uint8_t *peer_public_key, bool initiator, const uint8_t *prologue, size_t prologue_length);
+// int noise_handshake_init
+// (const Logger *log, Noise_Handshake *noise_handshake, const uint8_t *self_secret_key, const uint8_t *peer_public_key, bool initiator, const uint8_t *prologue, size_t prologue_length);
+/**
+ * @brief Noise MixKey(input_key_material)
+ *
+ * cf. Noise section 5.2
+ * Executes the following steps:
+ * - Sets ck, temp_k = HKDF(ck, input_key_material, 2).
+ * - If HASHLEN is 64, then truncates temp_k to 32 bytes
+ * - Calls InitializeKey(temp_k).
+ * input_key_material = DH_X25519(private, public)
+ *
+ * @param chaining_key 64 byte Noise ck
+ * @param shared_key 32 byte key to be calculated
+ * @param private_key X25519 private key
+ * @param public_key X25519 public key
+ */
+ non_null()
+int32_t noise_mix_key(uint8_t chaining_key[CRYPTO_SHA512_SIZE], uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                      const uint8_t private_key[CRYPTO_SECRET_KEY_SIZE],
+                      const uint8_t public_key[CRYPTO_PUBLIC_KEY_SIZE]);
+
+/**
+ * @brief Noise MixHash(data): Sets h = HASH(h || data).
+ *
+ * cf. Noise section 5.2
+ *
+ * @param hash Contains current hash, is updated with new hash
+ * @param data to add to hash
+ * @param data_len length of data to hash
+ *
+ */
+non_null()
+void noise_mix_hash(uint8_t hash[CRYPTO_SHA512_SIZE], const uint8_t *data, size_t data_len);
+
+/**
+ * @brief Noise EncryptAndHash(plaintext): Sets ciphertext = EncryptWithAd(h,
+ * plaintext), calls MixHash(ciphertext), and returns ciphertext. Note
+ * that if k is empty, the EncryptWithAd() call will set ciphertext equal
+ * to plaintext.
+ *
+ * cf. Noise section 5.2
+ * "Noise spec: Note that if k is empty, the EncryptWithAd() call will set ciphertext equal to plaintext."
+ * This is not the case in Tox.
+ *
+ * @param ciphertext stores encrypted plaintext
+ * @param plaintext to be encrypted
+ * @param plain_length length of plaintext
+ * @param shared_key used for XAEAD encryption
+ * @param hash stores hash value, used as associated data in XAEAD
+ */
+non_null()
+void noise_encrypt_and_hash(uint8_t *ciphertext, const uint8_t *plaintext,
+                            size_t plain_length, uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                            uint8_t hash[CRYPTO_SHA512_SIZE]);
+
+/**
+ * @brief DecryptAndHash(ciphertext): Sets plaintext = DecryptWithAd(h,
+ * ciphertext), calls MixHash(ciphertext), and returns plaintext. Note
+ * that if k is empty, the DecryptWithAd() call will set plaintext equal to
+ * ciphertext.
+ *
+ * cf. Noise section 5.2
+ * "Note that if k is empty, the DecryptWithAd() call will set plaintext equal to ciphertext."
+ * This is not the case in Tox.
+ *
+ * @param ciphertext contains ciphertext to decrypt
+ * @param plaintext stores decrypted ciphertext
+ * @param encrypted_length length of ciphertext+MAC
+ * @param shared_key used for XAEAD decryption
+ * @param hash stores hash value, used as associated data in XAEAD
+ */
+non_null()
+int noise_decrypt_and_hash(uint8_t *plaintext, const uint8_t *ciphertext, 
+                           size_t encrypted_length, uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE],
+                           uint8_t hash[CRYPTO_SHA512_SIZE]);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif

toxcore/logger.c

@@ -109,7 +109,8 @@ void logger_write(const Logger *log, Logger_Level level, const char *file, int l
 #endif /* WIN32 */
 
     // Format message
-    char msg[1024];
+    // TODO: changed from 1024 to 4096
+    char msg[4096];
     va_list args;
     va_start(args, format);
     vsnprintf(msg, sizeof(msg), format, args);