Add InboundGroupSession.session_key().
This commit is contained in:
parent
23a3e32b8d
commit
ad7ffd4cfa
3 changed files with 123 additions and 25 deletions
|
@ -172,6 +172,29 @@ uint32_t olm_inbound_group_session_first_known_index(
|
||||||
const OlmInboundGroupSession *session
|
const OlmInboundGroupSession *session
|
||||||
);
|
);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get the number of bytes returned by olm_inbound_group_session_key()
|
||||||
|
*/
|
||||||
|
size_t olm_inbound_group_session_key_length(
|
||||||
|
const OlmInboundGroupSession *session
|
||||||
|
);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get the base64-encoded ratchet key for this session, at the given index
|
||||||
|
*
|
||||||
|
* Returns the length of the ratchet key on success or olm_error() on
|
||||||
|
* failure. On failure last_error will be set with an error code. The
|
||||||
|
* last_error will be:
|
||||||
|
* * OUTPUT_BUFFER_TOO_SMALL if the buffer was too small
|
||||||
|
* * OLM_UNKNOWN_MESSAGE_INDEX if we do not have a session key corresponding to the
|
||||||
|
* given index (ie, it was sent before the session key was shared with
|
||||||
|
* us)
|
||||||
|
*/
|
||||||
|
size_t olm_inbound_group_session_key(
|
||||||
|
OlmInboundGroupSession *session,
|
||||||
|
uint8_t * key, size_t key_length, uint32_t message_index
|
||||||
|
);
|
||||||
|
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
} // extern "C"
|
} // extern "C"
|
||||||
|
|
|
@ -111,4 +111,15 @@ InboundGroupSession.prototype['first_known_index'] = restore_stack(function() {
|
||||||
)(this.ptr);
|
)(this.ptr);
|
||||||
});
|
});
|
||||||
|
|
||||||
|
InboundGroupSession.prototype['session_key'] = restore_stack(function(message_index) {
|
||||||
|
var key_length = inbound_group_session_method(
|
||||||
|
Module['_olm_inbound_group_session_key_length']
|
||||||
|
)(this.ptr);
|
||||||
|
var key = stack(key_length + NULL_BYTE_PADDING_LENGTH);
|
||||||
|
outbound_group_session_method(Module['_olm_inbound_group_session_key'])(
|
||||||
|
this.ptr, key, key_length, message_index
|
||||||
|
);
|
||||||
|
return Pointer_stringify(key);
|
||||||
|
});
|
||||||
|
|
||||||
olm_exports['InboundGroupSession'] = InboundGroupSession;
|
olm_exports['InboundGroupSession'] = InboundGroupSession;
|
||||||
|
|
|
@ -31,7 +31,6 @@
|
||||||
#define OLM_PROTOCOL_VERSION 3
|
#define OLM_PROTOCOL_VERSION 3
|
||||||
#define GROUP_SESSION_ID_LENGTH ED25519_PUBLIC_KEY_LENGTH
|
#define GROUP_SESSION_ID_LENGTH ED25519_PUBLIC_KEY_LENGTH
|
||||||
#define PICKLE_VERSION 1
|
#define PICKLE_VERSION 1
|
||||||
#define SESSION_KEY_VERSION 2
|
|
||||||
|
|
||||||
struct OlmInboundGroupSession {
|
struct OlmInboundGroupSession {
|
||||||
/** our earliest known ratchet value */
|
/** our earliest known ratchet value */
|
||||||
|
@ -71,7 +70,7 @@ size_t olm_clear_inbound_group_session(
|
||||||
return sizeof(OlmInboundGroupSession);
|
return sizeof(OlmInboundGroupSession);
|
||||||
}
|
}
|
||||||
|
|
||||||
#define SESSION_KEY_RAW_LENGTH \
|
#define V2_SESSION_KEY_RAW_LENGTH \
|
||||||
(1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH\
|
(1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH\
|
||||||
+ ED25519_SIGNATURE_LENGTH)
|
+ ED25519_SIGNATURE_LENGTH)
|
||||||
|
|
||||||
|
@ -83,7 +82,7 @@ static size_t _init_group_session_keys(
|
||||||
const uint8_t *ptr = key_buf;
|
const uint8_t *ptr = key_buf;
|
||||||
size_t version = *ptr++;
|
size_t version = *ptr++;
|
||||||
|
|
||||||
if (version != SESSION_KEY_VERSION) {
|
if (version != 2) {
|
||||||
session->last_error = OLM_BAD_SESSION_KEY;
|
session->last_error = OLM_BAD_SESSION_KEY;
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
|
@ -116,7 +115,7 @@ size_t olm_init_inbound_group_session(
|
||||||
OlmInboundGroupSession *session,
|
OlmInboundGroupSession *session,
|
||||||
const uint8_t * session_key, size_t session_key_length
|
const uint8_t * session_key, size_t session_key_length
|
||||||
) {
|
) {
|
||||||
uint8_t key_buf[SESSION_KEY_RAW_LENGTH];
|
uint8_t key_buf[V2_SESSION_KEY_RAW_LENGTH];
|
||||||
size_t raw_length = _olm_decode_base64_length(session_key_length);
|
size_t raw_length = _olm_decode_base64_length(session_key_length);
|
||||||
size_t result;
|
size_t result;
|
||||||
|
|
||||||
|
@ -125,14 +124,14 @@ size_t olm_init_inbound_group_session(
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (raw_length != SESSION_KEY_RAW_LENGTH) {
|
if (raw_length != V2_SESSION_KEY_RAW_LENGTH) {
|
||||||
session->last_error = OLM_BAD_SESSION_KEY;
|
session->last_error = OLM_BAD_SESSION_KEY;
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
|
|
||||||
_olm_decode_base64(session_key, session_key_length, key_buf);
|
_olm_decode_base64(session_key, session_key_length, key_buf);
|
||||||
result = _init_group_session_keys(session, key_buf);
|
result = _init_group_session_keys(session, key_buf);
|
||||||
_olm_unset(key_buf, SESSION_KEY_RAW_LENGTH);
|
_olm_unset(key_buf, V2_SESSION_KEY_RAW_LENGTH);
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -257,6 +256,32 @@ size_t olm_group_decrypt_max_plaintext_length(
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* get a copy of the megolm ratchet, advanced
|
||||||
|
* to the relevant index. Returns 0 on success, -1 on error
|
||||||
|
*/
|
||||||
|
static size_t _get_megolm(
|
||||||
|
OlmInboundGroupSession *session, uint32_t message_index, Megolm *result
|
||||||
|
) {
|
||||||
|
/* pick a megolm instance to use. If we're at or beyond the latest ratchet
|
||||||
|
* value, use that */
|
||||||
|
if ((message_index - session->latest_ratchet.counter) < (1U << 31)) {
|
||||||
|
megolm_advance_to(&session->latest_ratchet, message_index);
|
||||||
|
*result = session->latest_ratchet;
|
||||||
|
return 0;
|
||||||
|
} else if ((message_index - session->initial_ratchet.counter) >= (1U << 31)) {
|
||||||
|
/* the counter is before our intial ratchet - we can't decode this. */
|
||||||
|
session->last_error = OLM_UNKNOWN_MESSAGE_INDEX;
|
||||||
|
return (size_t)-1;
|
||||||
|
} else {
|
||||||
|
/* otherwise, start from the initial megolm. Take a copy so that we
|
||||||
|
* don't overwrite the initial megolm */
|
||||||
|
*result = session->initial_ratchet;
|
||||||
|
megolm_advance_to(result, message_index);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* decrypt an un-base64-ed message
|
* decrypt an un-base64-ed message
|
||||||
*/
|
*/
|
||||||
|
@ -268,8 +293,7 @@ static size_t _decrypt(
|
||||||
) {
|
) {
|
||||||
struct _OlmDecodeGroupMessageResults decoded_results;
|
struct _OlmDecodeGroupMessageResults decoded_results;
|
||||||
size_t max_length, r;
|
size_t max_length, r;
|
||||||
Megolm *megolm;
|
Megolm megolm;
|
||||||
Megolm tmp_megolm;
|
|
||||||
|
|
||||||
_olm_decode_group_message(
|
_olm_decode_group_message(
|
||||||
message, message_length,
|
message, message_length,
|
||||||
|
@ -316,33 +340,21 @@ static size_t _decrypt(
|
||||||
return (size_t)-1;
|
return (size_t)-1;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* pick a megolm instance to use. If we're at or beyond the latest ratchet
|
r = _get_megolm(session, decoded_results.message_index, &megolm);
|
||||||
* value, use that */
|
if (r == (size_t)-1) {
|
||||||
if ((decoded_results.message_index - session->latest_ratchet.counter) < (1U << 31)) {
|
return r;
|
||||||
megolm = &session->latest_ratchet;
|
|
||||||
} else if ((decoded_results.message_index - session->initial_ratchet.counter) >= (1U << 31)) {
|
|
||||||
/* the counter is before our intial ratchet - we can't decode this. */
|
|
||||||
session->last_error = OLM_UNKNOWN_MESSAGE_INDEX;
|
|
||||||
return (size_t)-1;
|
|
||||||
} else {
|
|
||||||
/* otherwise, start from the initial megolm. Take a copy so that we
|
|
||||||
* don't overwrite the initial megolm */
|
|
||||||
tmp_megolm = session->initial_ratchet;
|
|
||||||
megolm = &tmp_megolm;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
megolm_advance_to(megolm, decoded_results.message_index);
|
|
||||||
|
|
||||||
/* now try checking the mac, and decrypting */
|
/* now try checking the mac, and decrypting */
|
||||||
r = megolm_cipher->ops->decrypt(
|
r = megolm_cipher->ops->decrypt(
|
||||||
megolm_cipher,
|
megolm_cipher,
|
||||||
megolm_get_data(megolm), MEGOLM_RATCHET_LENGTH,
|
megolm_get_data(&megolm), MEGOLM_RATCHET_LENGTH,
|
||||||
message, message_length,
|
message, message_length,
|
||||||
decoded_results.ciphertext, decoded_results.ciphertext_length,
|
decoded_results.ciphertext, decoded_results.ciphertext_length,
|
||||||
plaintext, max_plaintext_length
|
plaintext, max_plaintext_length
|
||||||
);
|
);
|
||||||
|
|
||||||
_olm_unset(&tmp_megolm, sizeof(tmp_megolm));
|
_olm_unset(&megolm, sizeof(megolm));
|
||||||
if (r == (size_t)-1) {
|
if (r == (size_t)-1) {
|
||||||
session->last_error = OLM_BAD_MESSAGE_MAC;
|
session->last_error = OLM_BAD_MESSAGE_MAC;
|
||||||
return r;
|
return r;
|
||||||
|
@ -397,3 +409,55 @@ uint32_t olm_inbound_group_session_first_known_index(
|
||||||
) {
|
) {
|
||||||
return session->initial_ratchet.counter;
|
return session->initial_ratchet.counter;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// we don't have an Ed25519 signature to share; this is a version 3 message format
|
||||||
|
#define SESSION_KEY_VERSION 3
|
||||||
|
#define V3_SESSION_KEY_RAW_LENGTH \
|
||||||
|
(1 + 4 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH)
|
||||||
|
|
||||||
|
size_t olm_inbound_group_session_key_length(
|
||||||
|
const OlmInboundGroupSession *session
|
||||||
|
) {
|
||||||
|
return _olm_encode_base64_length(V3_SESSION_KEY_RAW_LENGTH);
|
||||||
|
}
|
||||||
|
|
||||||
|
size_t olm_inbound_group_session_key(
|
||||||
|
OlmInboundGroupSession *session,
|
||||||
|
uint8_t * key, size_t key_length, uint32_t message_index
|
||||||
|
) {
|
||||||
|
uint8_t *raw;
|
||||||
|
uint8_t *ptr;
|
||||||
|
Megolm megolm;
|
||||||
|
size_t r;
|
||||||
|
size_t encoded_length = olm_inbound_group_session_key_length(session);
|
||||||
|
|
||||||
|
if (key_length < encoded_length) {
|
||||||
|
session->last_error = OLM_OUTPUT_BUFFER_TOO_SMALL;
|
||||||
|
return (size_t)-1;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = _get_megolm(session, message_index, &megolm);
|
||||||
|
if (r == (size_t)-1) {
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* put the raw data at the end of the output buffer. */
|
||||||
|
raw = ptr = key + encoded_length - V3_SESSION_KEY_RAW_LENGTH;
|
||||||
|
*ptr++ = SESSION_KEY_VERSION;
|
||||||
|
|
||||||
|
// Encode message index as a big endian 32-bit number.
|
||||||
|
for (unsigned i = 0; i < 4; i++) {
|
||||||
|
*ptr++ = 0xFF & (message_index >> 24); message_index <<= 8;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(ptr, megolm_get_data(&megolm), MEGOLM_RATCHET_LENGTH);
|
||||||
|
ptr += MEGOLM_RATCHET_LENGTH;
|
||||||
|
|
||||||
|
memcpy(
|
||||||
|
ptr, session->signing_key.public_key,
|
||||||
|
ED25519_PUBLIC_KEY_LENGTH
|
||||||
|
);
|
||||||
|
ptr += ED25519_PUBLIC_KEY_LENGTH;
|
||||||
|
|
||||||
|
return _olm_encode_base64(raw, V3_SESSION_KEY_RAW_LENGTH, key);
|
||||||
|
}
|
||||||
|
|
Loading…
Reference in a new issue