1 /* $OpenBSD: wg_noise.c,v 1.4 2020/12/09 05:53:33 tb Exp $ */ 2 /* 3 * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 4 * Copyright (C) 2019-2020 Matt Dunwoodie <ncon@noconroy.net> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/types.h> 20 #include <sys/systm.h> 21 #include <sys/param.h> 22 #include <sys/atomic.h> 23 #include <sys/rwlock.h> 24 25 #include <crypto/blake2s.h> 26 #include <crypto/curve25519.h> 27 #include <crypto/chachapoly.h> 28 29 #include <net/wg_noise.h> 30 31 /* Private functions */ 32 static struct noise_keypair * 33 noise_remote_keypair_allocate(struct noise_remote *); 34 static void 35 noise_remote_keypair_free(struct noise_remote *, 36 struct noise_keypair *); 37 static uint32_t noise_remote_handshake_index_get(struct noise_remote *); 38 static void noise_remote_handshake_index_drop(struct noise_remote *); 39 40 static uint64_t noise_counter_send(struct noise_counter *); 41 static int noise_counter_recv(struct noise_counter *, uint64_t); 42 43 static void noise_kdf(uint8_t *, uint8_t *, uint8_t *, const uint8_t *, 44 size_t, size_t, size_t, size_t, 45 const uint8_t [NOISE_HASH_LEN]); 46 static int noise_mix_dh( 47 uint8_t [NOISE_HASH_LEN], 48 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 49 const uint8_t [NOISE_PUBLIC_KEY_LEN], 50 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 51 static int noise_mix_ss( 52 uint8_t ck[NOISE_HASH_LEN], 53 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 54 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]); 55 static void noise_mix_hash( 56 uint8_t [NOISE_HASH_LEN], 57 const uint8_t *, 58 size_t); 59 static void noise_mix_psk( 60 uint8_t [NOISE_HASH_LEN], 61 uint8_t [NOISE_HASH_LEN], 62 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 63 const uint8_t [NOISE_SYMMETRIC_KEY_LEN]); 64 static void noise_param_init( 65 uint8_t [NOISE_HASH_LEN], 66 uint8_t [NOISE_HASH_LEN], 67 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 68 69 static void noise_msg_encrypt(uint8_t *, const uint8_t *, size_t, 70 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 71 uint8_t [NOISE_HASH_LEN]); 72 static int noise_msg_decrypt(uint8_t *, const uint8_t *, size_t, 73 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 74 uint8_t [NOISE_HASH_LEN]); 75 static void noise_msg_ephemeral( 76 uint8_t [NOISE_HASH_LEN], 77 uint8_t [NOISE_HASH_LEN], 78 const uint8_t src[NOISE_PUBLIC_KEY_LEN]); 79 80 static void noise_tai64n_now(uint8_t [NOISE_TIMESTAMP_LEN]); 81 static int noise_timer_expired(struct timespec *, time_t, long); 82 83 /* Set/Get noise parameters */ 84 void 85 noise_local_init(struct noise_local *l, struct noise_upcall *upcall) 86 { 87 bzero(l, sizeof(*l)); 88 rw_init(&l->l_identity_lock, "noise_local_identity"); 89 l->l_upcall = *upcall; 90 } 91 92 void 93 noise_local_lock_identity(struct noise_local *l) 94 { 95 rw_enter_write(&l->l_identity_lock); 96 } 97 98 void 99 noise_local_unlock_identity(struct noise_local *l) 100 { 101 rw_exit_write(&l->l_identity_lock); 102 } 103 104 int 105 noise_local_set_private(struct noise_local *l, 106 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 107 { 108 rw_assert_wrlock(&l->l_identity_lock); 109 110 memcpy(l->l_private, private, NOISE_PUBLIC_KEY_LEN); 111 curve25519_clamp_secret(l->l_private); 112 l->l_has_identity = curve25519_generate_public(l->l_public, private); 113 114 return l->l_has_identity ? 0 : ENXIO; 115 } 116 117 int 118 noise_local_keys(struct noise_local *l, uint8_t public[NOISE_PUBLIC_KEY_LEN], 119 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 120 { 121 int ret = 0; 122 rw_enter_read(&l->l_identity_lock); 123 if (l->l_has_identity) { 124 if (public != NULL) 125 memcpy(public, l->l_public, NOISE_PUBLIC_KEY_LEN); 126 if (private != NULL) 127 memcpy(private, l->l_private, NOISE_PUBLIC_KEY_LEN); 128 } else { 129 ret = ENXIO; 130 } 131 rw_exit_read(&l->l_identity_lock); 132 return ret; 133 } 134 135 void 136 noise_remote_init(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 137 struct noise_local *l) 138 { 139 bzero(r, sizeof(*r)); 140 memcpy(r->r_public, public, NOISE_PUBLIC_KEY_LEN); 141 rw_init(&r->r_handshake_lock, "noise_handshake"); 142 rw_init(&r->r_keypair_lock, "noise_keypair"); 143 144 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[0], kp_entry); 145 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[1], kp_entry); 146 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[2], kp_entry); 147 148 KASSERT(l != NULL); 149 r->r_local = l; 150 151 rw_enter_write(&l->l_identity_lock); 152 noise_remote_precompute(r); 153 rw_exit_write(&l->l_identity_lock); 154 } 155 156 int 157 noise_remote_set_psk(struct noise_remote *r, 158 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 159 { 160 int same; 161 rw_enter_write(&r->r_handshake_lock); 162 same = !timingsafe_bcmp(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 163 if (!same) { 164 memcpy(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 165 } 166 rw_exit_write(&r->r_handshake_lock); 167 return same ? EEXIST : 0; 168 } 169 170 int 171 noise_remote_keys(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 172 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 173 { 174 static uint8_t null_psk[NOISE_SYMMETRIC_KEY_LEN]; 175 int ret; 176 177 if (public != NULL) 178 memcpy(public, r->r_public, NOISE_PUBLIC_KEY_LEN); 179 180 rw_enter_read(&r->r_handshake_lock); 181 if (psk != NULL) 182 memcpy(psk, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 183 ret = timingsafe_bcmp(r->r_psk, null_psk, NOISE_SYMMETRIC_KEY_LEN); 184 rw_exit_read(&r->r_handshake_lock); 185 186 /* If r_psk != null_psk return 0, else ENOENT (no psk) */ 187 return ret ? 0 : ENOENT; 188 } 189 190 void 191 noise_remote_precompute(struct noise_remote *r) 192 { 193 struct noise_local *l = r->r_local; 194 rw_assert_wrlock(&l->l_identity_lock); 195 if (!l->l_has_identity) 196 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 197 else if (!curve25519(r->r_ss, l->l_private, r->r_public)) 198 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 199 200 rw_enter_write(&r->r_handshake_lock); 201 noise_remote_handshake_index_drop(r); 202 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 203 rw_exit_write(&r->r_handshake_lock); 204 } 205 206 /* Handshake functions */ 207 int 208 noise_create_initiation(struct noise_remote *r, uint32_t *s_idx, 209 uint8_t ue[NOISE_PUBLIC_KEY_LEN], 210 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 211 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 212 { 213 struct noise_handshake *hs = &r->r_handshake; 214 struct noise_local *l = r->r_local; 215 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 216 int ret = EINVAL; 217 218 rw_enter_read(&l->l_identity_lock); 219 rw_enter_write(&r->r_handshake_lock); 220 if (!l->l_has_identity) 221 goto error; 222 noise_param_init(hs->hs_ck, hs->hs_hash, r->r_public); 223 224 /* e */ 225 curve25519_generate_secret(hs->hs_e); 226 if (curve25519_generate_public(ue, hs->hs_e) == 0) 227 goto error; 228 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 229 230 /* es */ 231 if (noise_mix_dh(hs->hs_ck, key, hs->hs_e, r->r_public) != 0) 232 goto error; 233 234 /* s */ 235 noise_msg_encrypt(es, l->l_public, 236 NOISE_PUBLIC_KEY_LEN, key, hs->hs_hash); 237 238 /* ss */ 239 if (noise_mix_ss(hs->hs_ck, key, r->r_ss) != 0) 240 goto error; 241 242 /* {t} */ 243 noise_tai64n_now(ets); 244 noise_msg_encrypt(ets, ets, 245 NOISE_TIMESTAMP_LEN, key, hs->hs_hash); 246 247 noise_remote_handshake_index_drop(r); 248 hs->hs_state = CREATED_INITIATION; 249 hs->hs_local_index = noise_remote_handshake_index_get(r); 250 *s_idx = hs->hs_local_index; 251 ret = 0; 252 error: 253 rw_exit_write(&r->r_handshake_lock); 254 rw_exit_read(&l->l_identity_lock); 255 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 256 return ret; 257 } 258 259 int 260 noise_consume_initiation(struct noise_local *l, struct noise_remote **rp, 261 uint32_t s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], 262 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 263 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 264 { 265 struct noise_remote *r; 266 struct noise_handshake hs; 267 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 268 uint8_t r_public[NOISE_PUBLIC_KEY_LEN]; 269 uint8_t timestamp[NOISE_TIMESTAMP_LEN]; 270 int ret = EINVAL; 271 272 rw_enter_read(&l->l_identity_lock); 273 if (!l->l_has_identity) 274 goto error; 275 noise_param_init(hs.hs_ck, hs.hs_hash, l->l_public); 276 277 /* e */ 278 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 279 280 /* es */ 281 if (noise_mix_dh(hs.hs_ck, key, l->l_private, ue) != 0) 282 goto error; 283 284 /* s */ 285 if (noise_msg_decrypt(r_public, es, 286 NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 287 goto error; 288 289 /* Lookup the remote we received from */ 290 if ((r = l->l_upcall.u_remote_get(l->l_upcall.u_arg, r_public)) == NULL) 291 goto error; 292 293 /* ss */ 294 if (noise_mix_ss(hs.hs_ck, key, r->r_ss) != 0) 295 goto error; 296 297 /* {t} */ 298 if (noise_msg_decrypt(timestamp, ets, 299 NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 300 goto error; 301 302 hs.hs_state = CONSUMED_INITIATION; 303 hs.hs_local_index = 0; 304 hs.hs_remote_index = s_idx; 305 memcpy(hs.hs_e, ue, NOISE_PUBLIC_KEY_LEN); 306 307 /* We have successfully computed the same results, now we ensure that 308 * this is not an initiation replay, or a flood attack */ 309 rw_enter_write(&r->r_handshake_lock); 310 311 /* Replay */ 312 if (memcmp(timestamp, r->r_timestamp, NOISE_TIMESTAMP_LEN) > 0) 313 memcpy(r->r_timestamp, timestamp, NOISE_TIMESTAMP_LEN); 314 else 315 goto error_set; 316 /* Flood attack */ 317 if (noise_timer_expired(&r->r_last_init, 0, REJECT_INTERVAL)) 318 getnanouptime(&r->r_last_init); 319 else 320 goto error_set; 321 322 /* Ok, we're happy to accept this initiation now */ 323 noise_remote_handshake_index_drop(r); 324 r->r_handshake = hs; 325 *rp = r; 326 ret = 0; 327 error_set: 328 rw_exit_write(&r->r_handshake_lock); 329 error: 330 rw_exit_read(&l->l_identity_lock); 331 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 332 explicit_bzero(&hs, sizeof(hs)); 333 return ret; 334 } 335 336 int 337 noise_create_response(struct noise_remote *r, uint32_t *s_idx, uint32_t *r_idx, 338 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 339 { 340 struct noise_handshake *hs = &r->r_handshake; 341 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 342 uint8_t e[NOISE_PUBLIC_KEY_LEN]; 343 int ret = EINVAL; 344 345 rw_enter_read(&r->r_local->l_identity_lock); 346 rw_enter_write(&r->r_handshake_lock); 347 348 if (hs->hs_state != CONSUMED_INITIATION) 349 goto error; 350 351 /* e */ 352 curve25519_generate_secret(e); 353 if (curve25519_generate_public(ue, e) == 0) 354 goto error; 355 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 356 357 /* ee */ 358 if (noise_mix_dh(hs->hs_ck, NULL, e, hs->hs_e) != 0) 359 goto error; 360 361 /* se */ 362 if (noise_mix_dh(hs->hs_ck, NULL, e, r->r_public) != 0) 363 goto error; 364 365 /* psk */ 366 noise_mix_psk(hs->hs_ck, hs->hs_hash, key, r->r_psk); 367 368 /* {} */ 369 noise_msg_encrypt(en, NULL, 0, key, hs->hs_hash); 370 371 hs->hs_state = CREATED_RESPONSE; 372 hs->hs_local_index = noise_remote_handshake_index_get(r); 373 *r_idx = hs->hs_remote_index; 374 *s_idx = hs->hs_local_index; 375 ret = 0; 376 error: 377 rw_exit_write(&r->r_handshake_lock); 378 rw_exit_read(&r->r_local->l_identity_lock); 379 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 380 explicit_bzero(e, NOISE_PUBLIC_KEY_LEN); 381 return ret; 382 } 383 384 int 385 noise_consume_response(struct noise_remote *r, uint32_t s_idx, uint32_t r_idx, 386 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 387 { 388 struct noise_local *l = r->r_local; 389 struct noise_handshake hs; 390 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 391 uint8_t preshared_key[NOISE_PUBLIC_KEY_LEN]; 392 int ret = EINVAL; 393 394 rw_enter_read(&l->l_identity_lock); 395 if (!l->l_has_identity) 396 goto error; 397 398 rw_enter_read(&r->r_handshake_lock); 399 hs = r->r_handshake; 400 memcpy(preshared_key, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 401 rw_exit_read(&r->r_handshake_lock); 402 403 if (hs.hs_state != CREATED_INITIATION || 404 hs.hs_local_index != r_idx) 405 goto error; 406 407 /* e */ 408 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 409 410 /* ee */ 411 if (noise_mix_dh(hs.hs_ck, NULL, hs.hs_e, ue) != 0) 412 goto error; 413 414 /* se */ 415 if (noise_mix_dh(hs.hs_ck, NULL, l->l_private, ue) != 0) 416 goto error; 417 418 /* psk */ 419 noise_mix_psk(hs.hs_ck, hs.hs_hash, key, preshared_key); 420 421 /* {} */ 422 if (noise_msg_decrypt(NULL, en, 423 0 + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 424 goto error; 425 426 hs.hs_remote_index = s_idx; 427 428 rw_enter_write(&r->r_handshake_lock); 429 if (r->r_handshake.hs_state == hs.hs_state && 430 r->r_handshake.hs_local_index == hs.hs_local_index) { 431 r->r_handshake = hs; 432 r->r_handshake.hs_state = CONSUMED_RESPONSE; 433 ret = 0; 434 } 435 rw_exit_write(&r->r_handshake_lock); 436 error: 437 rw_exit_read(&l->l_identity_lock); 438 explicit_bzero(&hs, sizeof(hs)); 439 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 440 return ret; 441 } 442 443 int 444 noise_remote_begin_session(struct noise_remote *r) 445 { 446 struct noise_handshake *hs = &r->r_handshake; 447 struct noise_keypair kp, *next, *current, *previous; 448 449 rw_enter_write(&r->r_handshake_lock); 450 451 /* We now derive the keypair from the handshake */ 452 if (hs->hs_state == CONSUMED_RESPONSE) { 453 kp.kp_is_initiator = 1; 454 noise_kdf(kp.kp_send, kp.kp_recv, NULL, NULL, 455 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 456 hs->hs_ck); 457 } else if (hs->hs_state == CREATED_RESPONSE) { 458 kp.kp_is_initiator = 0; 459 noise_kdf(kp.kp_recv, kp.kp_send, NULL, NULL, 460 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 461 hs->hs_ck); 462 } else { 463 rw_exit_write(&r->r_handshake_lock); 464 return EINVAL; 465 } 466 467 kp.kp_valid = 1; 468 kp.kp_local_index = hs->hs_local_index; 469 kp.kp_remote_index = hs->hs_remote_index; 470 getnanouptime(&kp.kp_birthdate); 471 bzero(&kp.kp_ctr, sizeof(kp.kp_ctr)); 472 rw_init(&kp.kp_ctr.c_lock, "noise_counter"); 473 474 /* Now we need to add_new_keypair */ 475 rw_enter_write(&r->r_keypair_lock); 476 next = r->r_next; 477 current = r->r_current; 478 previous = r->r_previous; 479 480 if (kp.kp_is_initiator) { 481 if (next != NULL) { 482 r->r_next = NULL; 483 r->r_previous = next; 484 noise_remote_keypair_free(r, current); 485 } else { 486 r->r_previous = current; 487 } 488 489 noise_remote_keypair_free(r, previous); 490 491 r->r_current = noise_remote_keypair_allocate(r); 492 *r->r_current = kp; 493 } else { 494 noise_remote_keypair_free(r, next); 495 r->r_previous = NULL; 496 noise_remote_keypair_free(r, previous); 497 498 r->r_next = noise_remote_keypair_allocate(r); 499 *r->r_next = kp; 500 } 501 rw_exit_write(&r->r_keypair_lock); 502 503 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 504 rw_exit_write(&r->r_handshake_lock); 505 506 explicit_bzero(&kp, sizeof(kp)); 507 return 0; 508 } 509 510 void 511 noise_remote_clear(struct noise_remote *r) 512 { 513 rw_enter_write(&r->r_handshake_lock); 514 noise_remote_handshake_index_drop(r); 515 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 516 rw_exit_write(&r->r_handshake_lock); 517 518 rw_enter_write(&r->r_keypair_lock); 519 noise_remote_keypair_free(r, r->r_next); 520 noise_remote_keypair_free(r, r->r_current); 521 noise_remote_keypair_free(r, r->r_previous); 522 r->r_next = NULL; 523 r->r_current = NULL; 524 r->r_previous = NULL; 525 rw_exit_write(&r->r_keypair_lock); 526 } 527 528 void 529 noise_remote_expire_current(struct noise_remote *r) 530 { 531 rw_enter_write(&r->r_keypair_lock); 532 if (r->r_next != NULL) 533 r->r_next->kp_valid = 0; 534 if (r->r_current != NULL) 535 r->r_current->kp_valid = 0; 536 rw_exit_write(&r->r_keypair_lock); 537 } 538 539 int 540 noise_remote_ready(struct noise_remote *r) 541 { 542 struct noise_keypair *kp; 543 int ret; 544 545 rw_enter_read(&r->r_keypair_lock); 546 /* kp_ctr isn't locked here, we're happy to accept a racy read. */ 547 if ((kp = r->r_current) == NULL || 548 !kp->kp_valid || 549 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 550 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 551 kp->kp_ctr.c_send >= REJECT_AFTER_MESSAGES) 552 ret = EINVAL; 553 else 554 ret = 0; 555 rw_exit_read(&r->r_keypair_lock); 556 return ret; 557 } 558 559 int 560 noise_remote_encrypt(struct noise_remote *r, uint32_t *r_idx, uint64_t *nonce, 561 uint8_t *buf, size_t buflen) 562 { 563 struct noise_keypair *kp; 564 int ret = EINVAL; 565 566 rw_enter_read(&r->r_keypair_lock); 567 if ((kp = r->r_current) == NULL) 568 goto error; 569 570 /* We confirm that our values are within our tolerances. We want: 571 * - a valid keypair 572 * - our keypair to be less than REJECT_AFTER_TIME seconds old 573 * - our receive counter to be less than REJECT_AFTER_MESSAGES 574 * - our send counter to be less than REJECT_AFTER_MESSAGES 575 * 576 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 577 if (!kp->kp_valid || 578 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 579 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 580 ((*nonce = noise_counter_send(&kp->kp_ctr)) > REJECT_AFTER_MESSAGES)) 581 goto error; 582 583 /* We encrypt into the same buffer, so the caller must ensure that buf 584 * has NOISE_AUTHTAG_LEN bytes to store the MAC. The nonce and index 585 * are passed back out to the caller through the provided data pointer. */ 586 *r_idx = kp->kp_remote_index; 587 chacha20poly1305_encrypt(buf, buf, buflen, 588 NULL, 0, *nonce, kp->kp_send); 589 590 /* If our values are still within tolerances, but we are approaching 591 * the tolerances, we notify the caller with ESTALE that they should 592 * establish a new keypair. The current keypair can continue to be used 593 * until the tolerances are hit. We notify if: 594 * - our send counter is valid and not less than REKEY_AFTER_MESSAGES 595 * - we're the initiator and our keypair is older than 596 * REKEY_AFTER_TIME seconds */ 597 ret = ESTALE; 598 if ((kp->kp_valid && *nonce >= REKEY_AFTER_MESSAGES) || 599 (kp->kp_is_initiator && 600 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME, 0))) 601 goto error; 602 603 ret = 0; 604 error: 605 rw_exit_read(&r->r_keypair_lock); 606 return ret; 607 } 608 609 int 610 noise_remote_decrypt(struct noise_remote *r, uint32_t r_idx, uint64_t nonce, 611 uint8_t *buf, size_t buflen) 612 { 613 struct noise_keypair *kp; 614 int ret = EINVAL; 615 616 /* We retrieve the keypair corresponding to the provided index. We 617 * attempt the current keypair first as that is most likely. We also 618 * want to make sure that the keypair is valid as it would be 619 * catastrophic to decrypt against a zero'ed keypair. */ 620 rw_enter_read(&r->r_keypair_lock); 621 622 if (r->r_current != NULL && r->r_current->kp_local_index == r_idx) { 623 kp = r->r_current; 624 } else if (r->r_previous != NULL && r->r_previous->kp_local_index == r_idx) { 625 kp = r->r_previous; 626 } else if (r->r_next != NULL && r->r_next->kp_local_index == r_idx) { 627 kp = r->r_next; 628 } else { 629 goto error; 630 } 631 632 /* We confirm that our values are within our tolerances. These values 633 * are the same as the encrypt routine. 634 * 635 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 636 if (noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 637 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES) 638 goto error; 639 640 /* Decrypt, then validate the counter. We don't want to validate the 641 * counter before decrypting as we do not know the message is authentic 642 * prior to decryption. */ 643 if (chacha20poly1305_decrypt(buf, buf, buflen, 644 NULL, 0, nonce, kp->kp_recv) == 0) 645 goto error; 646 647 if (noise_counter_recv(&kp->kp_ctr, nonce) != 0) 648 goto error; 649 650 /* If we've received the handshake confirming data packet then move the 651 * next keypair into current. If we do slide the next keypair in, then 652 * we skip the REKEY_AFTER_TIME_RECV check. This is safe to do as a 653 * data packet can't confirm a session that we are an INITIATOR of. */ 654 if (kp == r->r_next) { 655 rw_exit_read(&r->r_keypair_lock); 656 rw_enter_write(&r->r_keypair_lock); 657 if (kp == r->r_next && kp->kp_local_index == r_idx) { 658 noise_remote_keypair_free(r, r->r_previous); 659 r->r_previous = r->r_current; 660 r->r_current = r->r_next; 661 r->r_next = NULL; 662 663 ret = ECONNRESET; 664 goto error; 665 } 666 rw_enter(&r->r_keypair_lock, RW_DOWNGRADE); 667 } 668 669 /* Similar to when we encrypt, we want to notify the caller when we 670 * are approaching our tolerances. We notify if: 671 * - we're the initiator and the current keypair is older than 672 * REKEY_AFTER_TIME_RECV seconds. */ 673 ret = ESTALE; 674 kp = r->r_current; 675 if (kp != NULL && 676 kp->kp_valid && 677 kp->kp_is_initiator && 678 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME_RECV, 0)) 679 goto error; 680 681 ret = 0; 682 683 error: 684 rw_exit(&r->r_keypair_lock); 685 return ret; 686 } 687 688 /* Private functions - these should not be called outside this file under any 689 * circumstances. */ 690 static struct noise_keypair * 691 noise_remote_keypair_allocate(struct noise_remote *r) 692 { 693 struct noise_keypair *kp; 694 kp = SLIST_FIRST(&r->r_unused_keypairs); 695 SLIST_REMOVE_HEAD(&r->r_unused_keypairs, kp_entry); 696 return kp; 697 } 698 699 static void 700 noise_remote_keypair_free(struct noise_remote *r, struct noise_keypair *kp) 701 { 702 struct noise_upcall *u = &r->r_local->l_upcall; 703 if (kp != NULL) { 704 SLIST_INSERT_HEAD(&r->r_unused_keypairs, kp, kp_entry); 705 u->u_index_drop(u->u_arg, kp->kp_local_index); 706 bzero(kp->kp_send, sizeof(kp->kp_send)); 707 bzero(kp->kp_recv, sizeof(kp->kp_recv)); 708 } 709 } 710 711 static uint32_t 712 noise_remote_handshake_index_get(struct noise_remote *r) 713 { 714 struct noise_upcall *u = &r->r_local->l_upcall; 715 return u->u_index_set(u->u_arg, r); 716 } 717 718 static void 719 noise_remote_handshake_index_drop(struct noise_remote *r) 720 { 721 struct noise_handshake *hs = &r->r_handshake; 722 struct noise_upcall *u = &r->r_local->l_upcall; 723 rw_assert_wrlock(&r->r_handshake_lock); 724 if (hs->hs_state != HS_ZEROED) 725 u->u_index_drop(u->u_arg, hs->hs_local_index); 726 } 727 728 static uint64_t 729 noise_counter_send(struct noise_counter *ctr) 730 { 731 #ifdef __LP64__ 732 return atomic_inc_long_nv((u_long *)&ctr->c_send) - 1; 733 #else 734 uint64_t ret; 735 rw_enter_write(&ctr->c_lock); 736 ret = ctr->c_send++; 737 rw_exit_write(&ctr->c_lock); 738 return ret; 739 #endif 740 } 741 742 static int 743 noise_counter_recv(struct noise_counter *ctr, uint64_t recv) 744 { 745 uint64_t i, top, index_recv, index_ctr; 746 unsigned long bit; 747 int ret = EEXIST; 748 749 rw_enter_write(&ctr->c_lock); 750 751 /* Check that the recv counter is valid */ 752 if (ctr->c_recv >= REJECT_AFTER_MESSAGES || 753 recv >= REJECT_AFTER_MESSAGES) 754 goto error; 755 756 /* If the packet is out of the window, invalid */ 757 if (recv + COUNTER_WINDOW_SIZE < ctr->c_recv) 758 goto error; 759 760 /* If the new counter is ahead of the current counter, we'll need to 761 * zero out the bitmap that has previously been used */ 762 index_recv = recv / COUNTER_BITS; 763 index_ctr = ctr->c_recv / COUNTER_BITS; 764 765 if (recv > ctr->c_recv) { 766 top = MIN(index_recv - index_ctr, COUNTER_NUM); 767 for (i = 1; i <= top; i++) 768 ctr->c_backtrack[ 769 (i + index_ctr) & (COUNTER_NUM - 1)] = 0; 770 ctr->c_recv = recv; 771 } 772 773 index_recv %= COUNTER_NUM; 774 bit = 1ul << (recv % COUNTER_BITS); 775 776 if (ctr->c_backtrack[index_recv] & bit) 777 goto error; 778 779 ctr->c_backtrack[index_recv] |= bit; 780 781 ret = 0; 782 error: 783 rw_exit_write(&ctr->c_lock); 784 return ret; 785 } 786 787 static void 788 noise_kdf(uint8_t *a, uint8_t *b, uint8_t *c, const uint8_t *x, 789 size_t a_len, size_t b_len, size_t c_len, size_t x_len, 790 const uint8_t ck[NOISE_HASH_LEN]) 791 { 792 uint8_t out[BLAKE2S_HASH_SIZE + 1]; 793 uint8_t sec[BLAKE2S_HASH_SIZE]; 794 795 #ifdef DIAGNOSTIC 796 KASSERT(a_len <= BLAKE2S_HASH_SIZE && b_len <= BLAKE2S_HASH_SIZE && 797 c_len <= BLAKE2S_HASH_SIZE); 798 KASSERT(!(b || b_len || c || c_len) || (a && a_len)); 799 KASSERT(!(c || c_len) || (b && b_len)); 800 #endif 801 802 /* Extract entropy from "x" into sec */ 803 blake2s_hmac(sec, x, ck, BLAKE2S_HASH_SIZE, x_len, NOISE_HASH_LEN); 804 805 if (a == NULL || a_len == 0) 806 goto out; 807 808 /* Expand first key: key = sec, data = 0x1 */ 809 out[0] = 1; 810 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, 1, BLAKE2S_HASH_SIZE); 811 memcpy(a, out, a_len); 812 813 if (b == NULL || b_len == 0) 814 goto out; 815 816 /* Expand second key: key = sec, data = "a" || 0x2 */ 817 out[BLAKE2S_HASH_SIZE] = 2; 818 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 819 BLAKE2S_HASH_SIZE); 820 memcpy(b, out, b_len); 821 822 if (c == NULL || c_len == 0) 823 goto out; 824 825 /* Expand third key: key = sec, data = "b" || 0x3 */ 826 out[BLAKE2S_HASH_SIZE] = 3; 827 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 828 BLAKE2S_HASH_SIZE); 829 memcpy(c, out, c_len); 830 831 out: 832 /* Clear sensitive data from stack */ 833 explicit_bzero(sec, BLAKE2S_HASH_SIZE); 834 explicit_bzero(out, BLAKE2S_HASH_SIZE + 1); 835 } 836 837 static int 838 noise_mix_dh(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 839 const uint8_t private[NOISE_PUBLIC_KEY_LEN], 840 const uint8_t public[NOISE_PUBLIC_KEY_LEN]) 841 { 842 uint8_t dh[NOISE_PUBLIC_KEY_LEN]; 843 844 if (!curve25519(dh, private, public)) 845 return EINVAL; 846 noise_kdf(ck, key, NULL, dh, 847 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 848 explicit_bzero(dh, NOISE_PUBLIC_KEY_LEN); 849 return 0; 850 } 851 852 static int 853 noise_mix_ss(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 854 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]) 855 { 856 static uint8_t null_point[NOISE_PUBLIC_KEY_LEN]; 857 if (timingsafe_bcmp(ss, null_point, NOISE_PUBLIC_KEY_LEN) == 0) 858 return ENOENT; 859 noise_kdf(ck, key, NULL, ss, 860 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 861 return 0; 862 } 863 864 static void 865 noise_mix_hash(uint8_t hash[NOISE_HASH_LEN], const uint8_t *src, 866 size_t src_len) 867 { 868 struct blake2s_state blake; 869 870 blake2s_init(&blake, NOISE_HASH_LEN); 871 blake2s_update(&blake, hash, NOISE_HASH_LEN); 872 blake2s_update(&blake, src, src_len); 873 blake2s_final(&blake, hash); 874 } 875 876 static void 877 noise_mix_psk(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 878 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 879 const uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 880 { 881 uint8_t tmp[NOISE_HASH_LEN]; 882 883 noise_kdf(ck, tmp, key, psk, 884 NOISE_HASH_LEN, NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 885 NOISE_SYMMETRIC_KEY_LEN, ck); 886 noise_mix_hash(hash, tmp, NOISE_HASH_LEN); 887 explicit_bzero(tmp, NOISE_HASH_LEN); 888 } 889 890 static void 891 noise_param_init(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 892 const uint8_t s[NOISE_PUBLIC_KEY_LEN]) 893 { 894 struct blake2s_state blake; 895 896 blake2s(ck, (uint8_t *)NOISE_HANDSHAKE_NAME, NULL, 897 NOISE_HASH_LEN, strlen(NOISE_HANDSHAKE_NAME), 0); 898 blake2s_init(&blake, NOISE_HASH_LEN); 899 blake2s_update(&blake, ck, NOISE_HASH_LEN); 900 blake2s_update(&blake, (uint8_t *)NOISE_IDENTIFIER_NAME, 901 strlen(NOISE_IDENTIFIER_NAME)); 902 blake2s_final(&blake, hash); 903 904 noise_mix_hash(hash, s, NOISE_PUBLIC_KEY_LEN); 905 } 906 907 static void 908 noise_msg_encrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 909 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 910 { 911 /* Nonce always zero for Noise_IK */ 912 chacha20poly1305_encrypt(dst, src, src_len, 913 hash, NOISE_HASH_LEN, 0, key); 914 noise_mix_hash(hash, dst, src_len + NOISE_AUTHTAG_LEN); 915 } 916 917 static int 918 noise_msg_decrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 919 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 920 { 921 /* Nonce always zero for Noise_IK */ 922 if (!chacha20poly1305_decrypt(dst, src, src_len, 923 hash, NOISE_HASH_LEN, 0, key)) 924 return EINVAL; 925 noise_mix_hash(hash, src, src_len); 926 return 0; 927 } 928 929 static void 930 noise_msg_ephemeral(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 931 const uint8_t src[NOISE_PUBLIC_KEY_LEN]) 932 { 933 noise_mix_hash(hash, src, NOISE_PUBLIC_KEY_LEN); 934 noise_kdf(ck, NULL, NULL, src, NOISE_HASH_LEN, 0, 0, 935 NOISE_PUBLIC_KEY_LEN, ck); 936 } 937 938 static void 939 noise_tai64n_now(uint8_t output[NOISE_TIMESTAMP_LEN]) 940 { 941 struct timespec time; 942 uint64_t sec; 943 uint32_t nsec; 944 945 getnanotime(&time); 946 947 /* Round down the nsec counter to limit precise timing leak. */ 948 time.tv_nsec &= REJECT_INTERVAL_MASK; 949 950 /* https://cr.yp.to/libtai/tai64.html */ 951 sec = htobe64(0x400000000000000aULL + time.tv_sec); 952 nsec = htobe32(time.tv_nsec); 953 954 /* memcpy to output buffer, assuming output could be unaligned. */ 955 memcpy(output, &sec, sizeof(sec)); 956 memcpy(output + sizeof(sec), &nsec, sizeof(nsec)); 957 } 958 959 static int 960 noise_timer_expired(struct timespec *birthdate, time_t sec, long nsec) 961 { 962 struct timespec uptime; 963 struct timespec expire = { .tv_sec = sec, .tv_nsec = nsec }; 964 965 /* We don't really worry about a zeroed birthdate, to avoid the extra 966 * check on every encrypt/decrypt. This does mean that r_last_init 967 * check may fail if getnanouptime is < REJECT_INTERVAL from 0. */ 968 969 getnanouptime(&uptime); 970 timespecadd(birthdate, &expire, &expire); 971 return timespeccmp(&uptime, &expire, >) ? ETIMEDOUT : 0; 972 } 973 974 #ifdef WGTEST 975 976 #define MESSAGE_LEN 64 977 #define LARGE_MESSAGE_LEN 1420 978 979 #define T_LIM (COUNTER_WINDOW_SIZE + 1) 980 #define T_INIT do { \ 981 bzero(&ctr, sizeof(ctr)); \ 982 rw_init(&ctr.c_lock, "counter"); \ 983 } while (0) 984 #define T(num, v, e) do { \ 985 if (noise_counter_recv(&ctr, v) != e) { \ 986 printf("%s, test %d: failed.\n", __func__, num); \ 987 return; \ 988 } \ 989 } while (0) 990 #define T_FAILED(test) do { \ 991 printf("%s %s: failed\n", __func__, test); \ 992 return; \ 993 } while (0) 994 #define T_PASSED printf("%s: passed.\n", __func__) 995 996 static struct noise_local al, bl; 997 static struct noise_remote ar, br; 998 999 static struct noise_initiation { 1000 uint32_t s_idx; 1001 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 1002 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN]; 1003 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]; 1004 } init; 1005 1006 static struct noise_response { 1007 uint32_t s_idx; 1008 uint32_t r_idx; 1009 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 1010 uint8_t en[0 + NOISE_AUTHTAG_LEN]; 1011 } resp; 1012 1013 static uint64_t nonce; 1014 static uint32_t index; 1015 static uint8_t data[MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1016 static uint8_t largedata[LARGE_MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1017 1018 static struct noise_remote * 1019 upcall_get(void *x0, uint8_t *x1) { return x0; } 1020 static uint32_t 1021 upcall_set(void *x0, struct noise_remote *x1) { return 5; } 1022 static void 1023 upcall_drop(void *x0, uint32_t x1) { } 1024 1025 static void 1026 noise_counter_test() 1027 { 1028 struct noise_counter ctr; 1029 int i; 1030 1031 T_INIT; 1032 /* T(test number, nonce, expected_response) */ 1033 T( 1, 0, 0); 1034 T( 2, 1, 0); 1035 T( 3, 1, EEXIST); 1036 T( 4, 9, 0); 1037 T( 5, 8, 0); 1038 T( 6, 7, 0); 1039 T( 7, 7, EEXIST); 1040 T( 8, T_LIM, 0); 1041 T( 9, T_LIM - 1, 0); 1042 T(10, T_LIM - 1, EEXIST); 1043 T(11, T_LIM - 2, 0); 1044 T(12, 2, 0); 1045 T(13, 2, EEXIST); 1046 T(14, T_LIM + 16, 0); 1047 T(15, 3, EEXIST); 1048 T(16, T_LIM + 16, EEXIST); 1049 T(17, T_LIM * 4, 0); 1050 T(18, T_LIM * 4 - (T_LIM - 1), 0); 1051 T(19, 10, EEXIST); 1052 T(20, T_LIM * 4 - T_LIM, EEXIST); 1053 T(21, T_LIM * 4 - (T_LIM + 1), EEXIST); 1054 T(22, T_LIM * 4 - (T_LIM - 2), 0); 1055 T(23, T_LIM * 4 + 1 - T_LIM, EEXIST); 1056 T(24, 0, EEXIST); 1057 T(25, REJECT_AFTER_MESSAGES, EEXIST); 1058 T(26, REJECT_AFTER_MESSAGES - 1, 0); 1059 T(27, REJECT_AFTER_MESSAGES, EEXIST); 1060 T(28, REJECT_AFTER_MESSAGES - 1, EEXIST); 1061 T(29, REJECT_AFTER_MESSAGES - 2, 0); 1062 T(30, REJECT_AFTER_MESSAGES + 1, EEXIST); 1063 T(31, REJECT_AFTER_MESSAGES + 2, EEXIST); 1064 T(32, REJECT_AFTER_MESSAGES - 2, EEXIST); 1065 T(33, REJECT_AFTER_MESSAGES - 3, 0); 1066 T(34, 0, EEXIST); 1067 1068 T_INIT; 1069 for (i = 1; i <= COUNTER_WINDOW_SIZE; ++i) 1070 T(35, i, 0); 1071 T(36, 0, 0); 1072 T(37, 0, EEXIST); 1073 1074 T_INIT; 1075 for (i = 2; i <= COUNTER_WINDOW_SIZE + 1; ++i) 1076 T(38, i, 0); 1077 T(39, 1, 0); 1078 T(40, 0, EEXIST); 1079 1080 T_INIT; 1081 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 0;) 1082 T(41, i, 0); 1083 1084 T_INIT; 1085 for (i = COUNTER_WINDOW_SIZE + 2; i-- > 1;) 1086 T(42, i, 0); 1087 T(43, 0, EEXIST); 1088 1089 T_INIT; 1090 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1091 T(44, i, 0); 1092 T(45, COUNTER_WINDOW_SIZE + 1, 0); 1093 T(46, 0, EEXIST); 1094 1095 T_INIT; 1096 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1097 T(47, i, 0); 1098 T(48, 0, 0); 1099 T(49, COUNTER_WINDOW_SIZE + 1, 0); 1100 1101 T_PASSED; 1102 } 1103 1104 static void 1105 noise_handshake_init(struct noise_local *al, struct noise_remote *ar, 1106 struct noise_local *bl, struct noise_remote *br) 1107 { 1108 uint8_t apriv[NOISE_PUBLIC_KEY_LEN], bpriv[NOISE_PUBLIC_KEY_LEN]; 1109 uint8_t apub[NOISE_PUBLIC_KEY_LEN], bpub[NOISE_PUBLIC_KEY_LEN]; 1110 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]; 1111 1112 struct noise_upcall upcall = { 1113 .u_arg = NULL, 1114 .u_remote_get = upcall_get, 1115 .u_index_set = upcall_set, 1116 .u_index_drop = upcall_drop, 1117 }; 1118 1119 upcall.u_arg = ar; 1120 noise_local_init(al, &upcall); 1121 upcall.u_arg = br; 1122 noise_local_init(bl, &upcall); 1123 1124 arc4random_buf(apriv, NOISE_PUBLIC_KEY_LEN); 1125 arc4random_buf(bpriv, NOISE_PUBLIC_KEY_LEN); 1126 1127 noise_local_lock_identity(al); 1128 noise_local_set_private(al, apriv); 1129 noise_local_unlock_identity(al); 1130 1131 noise_local_lock_identity(bl); 1132 noise_local_set_private(bl, bpriv); 1133 noise_local_unlock_identity(bl); 1134 1135 noise_local_keys(al, apub, NULL); 1136 noise_local_keys(bl, bpub, NULL); 1137 1138 noise_remote_init(ar, bpub, al); 1139 noise_remote_init(br, apub, bl); 1140 1141 arc4random_buf(psk, NOISE_SYMMETRIC_KEY_LEN); 1142 noise_remote_set_psk(ar, psk); 1143 noise_remote_set_psk(br, psk); 1144 } 1145 1146 static void 1147 noise_handshake_test() 1148 { 1149 struct noise_remote *r; 1150 int i; 1151 1152 noise_handshake_init(&al, &ar, &bl, &br); 1153 1154 /* Create initiation */ 1155 if (noise_create_initiation(&ar, &init.s_idx, 1156 init.ue, init.es, init.ets) != 0) 1157 T_FAILED("create_initiation"); 1158 1159 /* Check encrypted (es) validation */ 1160 for (i = 0; i < sizeof(init.es); i++) { 1161 init.es[i] = ~init.es[i]; 1162 if (noise_consume_initiation(&bl, &r, init.s_idx, 1163 init.ue, init.es, init.ets) != EINVAL) 1164 T_FAILED("consume_initiation_es"); 1165 init.es[i] = ~init.es[i]; 1166 } 1167 1168 /* Check encrypted (ets) validation */ 1169 for (i = 0; i < sizeof(init.ets); i++) { 1170 init.ets[i] = ~init.ets[i]; 1171 if (noise_consume_initiation(&bl, &r, init.s_idx, 1172 init.ue, init.es, init.ets) != EINVAL) 1173 T_FAILED("consume_initiation_ets"); 1174 init.ets[i] = ~init.ets[i]; 1175 } 1176 1177 /* Consume initiation properly */ 1178 if (noise_consume_initiation(&bl, &r, init.s_idx, 1179 init.ue, init.es, init.ets) != 0) 1180 T_FAILED("consume_initiation"); 1181 if (r != &br) 1182 T_FAILED("remote_lookup"); 1183 1184 /* Replay initiation */ 1185 if (noise_consume_initiation(&bl, &r, init.s_idx, 1186 init.ue, init.es, init.ets) != EINVAL) 1187 T_FAILED("consume_initiation_replay"); 1188 if (r != &br) 1189 T_FAILED("remote_lookup_r_unchanged"); 1190 1191 /* Create response */ 1192 if (noise_create_response(&br, &resp.s_idx, 1193 &resp.r_idx, resp.ue, resp.en) != 0) 1194 T_FAILED("create_response"); 1195 1196 /* Check encrypted (en) validation */ 1197 for (i = 0; i < sizeof(resp.en); i++) { 1198 resp.en[i] = ~resp.en[i]; 1199 if (noise_consume_response(&ar, resp.s_idx, 1200 resp.r_idx, resp.ue, resp.en) != EINVAL) 1201 T_FAILED("consume_response_en"); 1202 resp.en[i] = ~resp.en[i]; 1203 } 1204 1205 /* Consume response properly */ 1206 if (noise_consume_response(&ar, resp.s_idx, 1207 resp.r_idx, resp.ue, resp.en) != 0) 1208 T_FAILED("consume_response"); 1209 1210 /* Derive keys on both sides */ 1211 if (noise_remote_begin_session(&ar) != 0) 1212 T_FAILED("promote_ar"); 1213 if (noise_remote_begin_session(&br) != 0) 1214 T_FAILED("promote_br"); 1215 1216 for (i = 0; i < MESSAGE_LEN; i++) 1217 data[i] = i; 1218 1219 /* Since bob is responder, he must not encrypt until confirmed */ 1220 if (noise_remote_encrypt(&br, &index, &nonce, 1221 data, MESSAGE_LEN) != EINVAL) 1222 T_FAILED("encrypt_kci_wait"); 1223 1224 /* Alice now encrypt and gets bob to decrypt */ 1225 if (noise_remote_encrypt(&ar, &index, &nonce, 1226 data, MESSAGE_LEN) != 0) 1227 T_FAILED("encrypt_akp"); 1228 if (noise_remote_decrypt(&br, index, nonce, 1229 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != ECONNRESET) 1230 T_FAILED("decrypt_bkp"); 1231 1232 for (i = 0; i < MESSAGE_LEN; i++) 1233 if (data[i] != i) 1234 T_FAILED("decrypt_message_akp_bkp"); 1235 1236 /* Now bob has received confirmation, he can encrypt */ 1237 if (noise_remote_encrypt(&br, &index, &nonce, 1238 data, MESSAGE_LEN) != 0) 1239 T_FAILED("encrypt_kci_ready"); 1240 if (noise_remote_decrypt(&ar, index, nonce, 1241 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != 0) 1242 T_FAILED("decrypt_akp"); 1243 1244 for (i = 0; i < MESSAGE_LEN; i++) 1245 if (data[i] != i) 1246 T_FAILED("decrypt_message_bkp_akp"); 1247 1248 T_PASSED; 1249 } 1250 1251 static void 1252 noise_speed_test() 1253 { 1254 #define SPEED_ITER (1<<16) 1255 struct timespec start, end; 1256 struct noise_remote *r; 1257 int nsec, i; 1258 1259 #define NSEC 1000000000 1260 #define T_TIME_START(iter, size) do { \ 1261 printf("%s %d %d byte encryptions\n", __func__, iter, size); \ 1262 nanouptime(&start); \ 1263 } while (0) 1264 #define T_TIME_END(iter, size) do { \ 1265 nanouptime(&end); \ 1266 timespecsub(&end, &start, &end); \ 1267 nsec = (end.tv_sec * NSEC + end.tv_nsec) / iter; \ 1268 printf("%s %d nsec/iter, %d iter/sec, %d byte/sec\n", \ 1269 __func__, nsec, NSEC / nsec, NSEC / nsec * size); \ 1270 } while (0) 1271 #define T_TIME_START_SINGLE(name) do { \ 1272 printf("%s %s\n", __func__, name); \ 1273 nanouptime(&start); \ 1274 } while (0) 1275 #define T_TIME_END_SINGLE() do { \ 1276 nanouptime(&end); \ 1277 timespecsub(&end, &start, &end); \ 1278 nsec = (end.tv_sec * NSEC + end.tv_nsec); \ 1279 printf("%s %d nsec/iter, %d iter/sec\n", \ 1280 __func__, nsec, NSEC / nsec); \ 1281 } while (0) 1282 1283 noise_handshake_init(&al, &ar, &bl, &br); 1284 1285 T_TIME_START_SINGLE("create_initiation"); 1286 if (noise_create_initiation(&ar, &init.s_idx, 1287 init.ue, init.es, init.ets) != 0) 1288 T_FAILED("create_initiation"); 1289 T_TIME_END_SINGLE(); 1290 1291 T_TIME_START_SINGLE("consume_initiation"); 1292 if (noise_consume_initiation(&bl, &r, init.s_idx, 1293 init.ue, init.es, init.ets) != 0) 1294 T_FAILED("consume_initiation"); 1295 T_TIME_END_SINGLE(); 1296 1297 T_TIME_START_SINGLE("create_response"); 1298 if (noise_create_response(&br, &resp.s_idx, 1299 &resp.r_idx, resp.ue, resp.en) != 0) 1300 T_FAILED("create_response"); 1301 T_TIME_END_SINGLE(); 1302 1303 T_TIME_START_SINGLE("consume_response"); 1304 if (noise_consume_response(&ar, resp.s_idx, 1305 resp.r_idx, resp.ue, resp.en) != 0) 1306 T_FAILED("consume_response"); 1307 T_TIME_END_SINGLE(); 1308 1309 /* Derive keys on both sides */ 1310 T_TIME_START_SINGLE("derive_keys"); 1311 if (noise_remote_begin_session(&ar) != 0) 1312 T_FAILED("begin_ar"); 1313 T_TIME_END_SINGLE(); 1314 if (noise_remote_begin_session(&br) != 0) 1315 T_FAILED("begin_br"); 1316 1317 /* Small data encryptions */ 1318 T_TIME_START(SPEED_ITER, MESSAGE_LEN); 1319 for (i = 0; i < SPEED_ITER; i++) { 1320 if (noise_remote_encrypt(&ar, &index, &nonce, 1321 data, MESSAGE_LEN) != 0) 1322 T_FAILED("encrypt_akp"); 1323 } 1324 T_TIME_END(SPEED_ITER, MESSAGE_LEN); 1325 1326 1327 /* Large data encryptions */ 1328 T_TIME_START(SPEED_ITER, LARGE_MESSAGE_LEN); 1329 for (i = 0; i < SPEED_ITER; i++) { 1330 if (noise_remote_encrypt(&ar, &index, &nonce, 1331 largedata, LARGE_MESSAGE_LEN) != 0) 1332 T_FAILED("encrypt_akp"); 1333 } 1334 T_TIME_END(SPEED_ITER, LARGE_MESSAGE_LEN); 1335 } 1336 1337 void 1338 noise_test() 1339 { 1340 noise_counter_test(); 1341 noise_handshake_test(); 1342 noise_speed_test(); 1343 } 1344 1345 #endif /* WGTEST */ 1346