feat: add Marmot Phase 2 — encryption, group state, and lifecycle helpers
Implements encryption/decryption, gift-wrap flows, and utility logic for the Marmot MLS-over-Nostr protocol, building on the Phase 1 event defs. New files: - ChaCha20Poly1305: standard AEAD (12-byte nonce) for MIP-03 outer layer - GroupEventEncryption: encrypt/decrypt GroupEvent content with MLS key - WelcomeGiftWrap: NIP-59 gift-wrap pipeline for Welcome messages - KeyPackageUtils: selection policy, rotation, migration helpers - CommitOrdering: deterministic conflict resolution for MLS commits - MarmotFilters: relay subscription filter builders for all Marmot events - TokenEncryption: ECDH + HKDF + ChaCha20 token encryption for MIP-05 https://claude.ai/code/session_01Ee5wmBAXwN46AJYUGYA9RQ
This commit is contained in:
Claude
@@ -0,0 +1,141 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot
|
||||||
|
|
||||||
|
import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageEvent
|
||||||
|
import com.vitorpamplona.quartz.marmot.mip00KeyPackages.KeyPackageUtils
|
||||||
|
import com.vitorpamplona.quartz.marmot.mip03GroupMessages.GroupEvent
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.core.HexKey
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
|
||||||
|
import com.vitorpamplona.quartz.nip59Giftwrap.wraps.GiftWrapEvent
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Relay subscription filter builders for Marmot protocol events.
|
||||||
|
*
|
||||||
|
* Provides pre-configured [Filter] instances for subscribing to the various
|
||||||
|
* Marmot event types on Nostr relays.
|
||||||
|
*/
|
||||||
|
object MarmotFilters {
|
||||||
|
/**
|
||||||
|
* Filter for KeyPackages by author (kind:30443).
|
||||||
|
* Used to discover a user's available KeyPackages for group invitations.
|
||||||
|
*
|
||||||
|
* {kinds: [30443], authors: [pubkey]}
|
||||||
|
*/
|
||||||
|
fun keyPackagesByAuthor(pubkey: HexKey): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(KeyPackageEvent.KIND),
|
||||||
|
authors = listOf(pubkey),
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for KeyPackages by multiple authors.
|
||||||
|
* Used when inviting multiple users to a group at once.
|
||||||
|
*
|
||||||
|
* {kinds: [30443], authors: [pubkey1, pubkey2, ...]}
|
||||||
|
*/
|
||||||
|
fun keyPackagesByAuthors(pubkeys: List<HexKey>): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(KeyPackageEvent.KIND),
|
||||||
|
authors = pubkeys,
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for a specific KeyPackage by its ref (kind:30443, #i tag).
|
||||||
|
* Used to look up a specific KeyPackage by its KeyPackageRef hash.
|
||||||
|
*
|
||||||
|
* {kinds: [30443], #i: [keyPackageRef]}
|
||||||
|
*/
|
||||||
|
fun keyPackageByRef(keyPackageRef: HexKey): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(KeyPackageEvent.KIND),
|
||||||
|
tags = mapOf("i" to listOf(keyPackageRef)),
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for GroupEvents by group ID (kind:445, #h tag).
|
||||||
|
* Used to subscribe to all messages and commits for a specific group.
|
||||||
|
*
|
||||||
|
* {kinds: [445], #h: [nostrGroupId]}
|
||||||
|
*/
|
||||||
|
fun groupEventsByGroupId(nostrGroupId: HexKey): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(GroupEvent.KIND),
|
||||||
|
tags = mapOf("h" to listOf(nostrGroupId)),
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for GroupEvents by group ID with a time range.
|
||||||
|
* Used to catch up on missed messages since a given timestamp.
|
||||||
|
*
|
||||||
|
* {kinds: [445], #h: [nostrGroupId], since: timestamp}
|
||||||
|
*/
|
||||||
|
fun groupEventsByGroupIdSince(
|
||||||
|
nostrGroupId: HexKey,
|
||||||
|
since: Long,
|
||||||
|
): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(GroupEvent.KIND),
|
||||||
|
tags = mapOf("h" to listOf(nostrGroupId)),
|
||||||
|
since = since,
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for NIP-59 gift wraps addressed to a user (kind:1059).
|
||||||
|
* Welcome messages (kind:444) are delivered inside gift wraps.
|
||||||
|
* This reuses the standard NIP-59 subscription pattern.
|
||||||
|
*
|
||||||
|
* {kinds: [1059], #p: [recipientPubKey]}
|
||||||
|
*/
|
||||||
|
fun giftWrapsForUser(recipientPubKey: HexKey): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(GiftWrapEvent.KIND),
|
||||||
|
tags = mapOf("p" to listOf(recipientPubKey)),
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for NIP-59 gift wraps since a given timestamp.
|
||||||
|
* Used to catch up on missed Welcome messages.
|
||||||
|
*
|
||||||
|
* {kinds: [1059], #p: [recipientPubKey], since: timestamp}
|
||||||
|
*/
|
||||||
|
fun giftWrapsForUserSince(
|
||||||
|
recipientPubKey: HexKey,
|
||||||
|
since: Long,
|
||||||
|
): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = listOf(GiftWrapEvent.KIND),
|
||||||
|
tags = mapOf("p" to listOf(recipientPubKey)),
|
||||||
|
since = since,
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Filter for KeyPackages during migration (both kind:443 and kind:30443).
|
||||||
|
* Used during the transition period from legacy to addressable KeyPackages.
|
||||||
|
*
|
||||||
|
* {kinds: [30443, 443], authors: [pubkey]}
|
||||||
|
*/
|
||||||
|
fun keyPackagesMigration(pubkey: HexKey): Filter =
|
||||||
|
Filter(
|
||||||
|
kinds = KeyPackageUtils.migrationKinds(),
|
||||||
|
authors = listOf(pubkey),
|
||||||
|
)
|
||||||
|
}
|
||||||
+127
@@ -0,0 +1,127 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot.mip00KeyPackages
|
||||||
|
|
||||||
|
import com.vitorpamplona.quartz.marmot.mip00KeyPackages.tags.EncodingTag
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.core.Event
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.core.HexKey
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Utility functions for KeyPackage lifecycle management (MIP-00).
|
||||||
|
*
|
||||||
|
* Covers:
|
||||||
|
* - Selection policy: prefer non-last-resort, highest created_at, validate encoding
|
||||||
|
* - Rotation: publish new kind:30443 under same d-tag after joining a group
|
||||||
|
* - Migration: support both kind:443 (legacy) and kind:30443 (addressable) during transition
|
||||||
|
*/
|
||||||
|
object KeyPackageUtils {
|
||||||
|
/** Legacy non-addressable KeyPackage kind (pre-migration) */
|
||||||
|
const val LEGACY_KIND = 443
|
||||||
|
|
||||||
|
/** Current addressable KeyPackage kind */
|
||||||
|
const val CURRENT_KIND = KeyPackageEvent.KIND // 30443
|
||||||
|
|
||||||
|
/** Default d-tag slot for primary KeyPackage */
|
||||||
|
const val PRIMARY_SLOT = "0"
|
||||||
|
|
||||||
|
/** Maximum number of d-tag slots a user should maintain */
|
||||||
|
const val MAX_SLOTS = 10
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Selects the best KeyPackage from a set of candidates for a given user.
|
||||||
|
*
|
||||||
|
* Selection policy (MIP-00):
|
||||||
|
* 1. Filter out invalid KeyPackages (bad encoding, missing required fields)
|
||||||
|
* 2. Prefer non-last-resort KeyPackages (those with multiple slots available)
|
||||||
|
* 3. Among valid candidates, prefer highest created_at (most recent)
|
||||||
|
*
|
||||||
|
* @param candidates list of KeyPackageEvents to choose from
|
||||||
|
* @param lastResortDTag d-tag of the user's last-resort KeyPackage (if known)
|
||||||
|
* @return the best KeyPackage, or null if no valid candidates
|
||||||
|
*/
|
||||||
|
fun selectBest(
|
||||||
|
candidates: List<KeyPackageEvent>,
|
||||||
|
lastResortDTag: String? = null,
|
||||||
|
): KeyPackageEvent? {
|
||||||
|
val valid = candidates.filter { isValid(it) }
|
||||||
|
if (valid.isEmpty()) return null
|
||||||
|
|
||||||
|
// Prefer non-last-resort KeyPackages
|
||||||
|
val nonLastResort = valid.filter { it.dTag() != lastResortDTag }
|
||||||
|
val pool = nonLastResort.ifEmpty { valid }
|
||||||
|
|
||||||
|
// Select the most recent
|
||||||
|
return pool.maxByOrNull { it.createdAt }
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Validates a KeyPackage event has required fields and proper encoding.
|
||||||
|
*/
|
||||||
|
fun isValid(event: KeyPackageEvent): Boolean =
|
||||||
|
event.encoding() == EncodingTag.BASE64 &&
|
||||||
|
event.content.isNotEmpty() &&
|
||||||
|
!event.keyPackageRef().isNullOrEmpty() &&
|
||||||
|
!event.mlsCiphersuite().isNullOrEmpty()
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Builds a rotated KeyPackage for the same d-tag slot.
|
||||||
|
*
|
||||||
|
* After joining a group (processing a Welcome), a member MUST rotate their
|
||||||
|
* KeyPackage to prevent reuse of the consumed init_key material.
|
||||||
|
*
|
||||||
|
* @param newKeyPackageBase64 the new MLS KeyPackage content
|
||||||
|
* @param dTagSlot the d-tag slot to rotate (reuses the same slot)
|
||||||
|
* @param newKeyPackageRef the KeyPackageRef of the new KeyPackage
|
||||||
|
* @param relays relay URLs where this KeyPackage should be published
|
||||||
|
* @param ciphersuite MLS ciphersuite identifier
|
||||||
|
* @param clientName optional client name
|
||||||
|
* @return a new KeyPackageEvent that replaces the old one at the same d-tag
|
||||||
|
*/
|
||||||
|
fun buildRotation(
|
||||||
|
newKeyPackageBase64: String,
|
||||||
|
dTagSlot: String,
|
||||||
|
newKeyPackageRef: HexKey,
|
||||||
|
relays: List<NormalizedRelayUrl>,
|
||||||
|
ciphersuite: String = "0x0001",
|
||||||
|
clientName: String? = null,
|
||||||
|
): EventTemplate<KeyPackageEvent> =
|
||||||
|
KeyPackageEvent.build(
|
||||||
|
keyPackageBase64 = newKeyPackageBase64,
|
||||||
|
dTagSlot = dTagSlot,
|
||||||
|
keyPackageRef = newKeyPackageRef,
|
||||||
|
relays = relays,
|
||||||
|
ciphersuite = ciphersuite,
|
||||||
|
clientName = clientName,
|
||||||
|
)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Checks whether an event is a KeyPackage (either legacy kind:443 or current kind:30443).
|
||||||
|
* Used during the migration period.
|
||||||
|
*/
|
||||||
|
fun isKeyPackageKind(event: Event): Boolean = event.kind == CURRENT_KIND || event.kind == LEGACY_KIND
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns the list of kinds to query during migration (both legacy and current).
|
||||||
|
*/
|
||||||
|
fun migrationKinds(): List<Int> = listOf(CURRENT_KIND, LEGACY_KIND)
|
||||||
|
}
|
||||||
+87
@@ -0,0 +1,87 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot.mip02Welcome
|
||||||
|
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.core.HexKey
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
|
||||||
|
import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
|
||||||
|
import com.vitorpamplona.quartz.nip59Giftwrap.rumors.Rumor
|
||||||
|
import com.vitorpamplona.quartz.nip59Giftwrap.seals.SealedRumorEvent
|
||||||
|
import com.vitorpamplona.quartz.nip59Giftwrap.wraps.GiftWrapEvent
|
||||||
|
import com.vitorpamplona.quartz.utils.TimeUtils
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Composes the NIP-59 gift wrap pipeline for Marmot Welcome messages (MIP-02).
|
||||||
|
*
|
||||||
|
* The delivery flow:
|
||||||
|
* WelcomeEvent (unsigned rumor, kind:444)
|
||||||
|
* → SealedRumorEvent (kind:13, encrypted with sender's key)
|
||||||
|
* → GiftWrapEvent (kind:1059, encrypted with ephemeral key to recipient)
|
||||||
|
*
|
||||||
|
* CRITICAL: The Commit that adds the new member MUST be confirmed by relays
|
||||||
|
* BEFORE calling [wrapForRecipient], to prevent MLS state forks.
|
||||||
|
*/
|
||||||
|
object WelcomeGiftWrap {
|
||||||
|
/**
|
||||||
|
* Wraps a WelcomeEvent through the full NIP-59 gift wrap pipeline.
|
||||||
|
*
|
||||||
|
* @param welcomeBase64 base64-encoded MLS Welcome message
|
||||||
|
* @param keyPackageEventId event ID of the KeyPackage consumed for this invitation
|
||||||
|
* @param relays relays where the new member should look for GroupEvents
|
||||||
|
* @param recipientPubKey public key of the new member being invited
|
||||||
|
* @param signer the sender's signer (used to seal the rumor)
|
||||||
|
* @param createdAt timestamp for the welcome event (defaults to now)
|
||||||
|
* @return GiftWrapEvent ready to publish to relays
|
||||||
|
*/
|
||||||
|
suspend fun wrapForRecipient(
|
||||||
|
welcomeBase64: String,
|
||||||
|
keyPackageEventId: HexKey,
|
||||||
|
relays: List<NormalizedRelayUrl>,
|
||||||
|
recipientPubKey: HexKey,
|
||||||
|
signer: NostrSigner,
|
||||||
|
createdAt: Long = TimeUtils.now(),
|
||||||
|
): GiftWrapEvent {
|
||||||
|
// Step 1: Build the WelcomeEvent template and sign it
|
||||||
|
val welcomeTemplate =
|
||||||
|
WelcomeEvent.build(
|
||||||
|
welcomeBase64 = welcomeBase64,
|
||||||
|
keyPackageEventId = keyPackageEventId,
|
||||||
|
relays = relays,
|
||||||
|
createdAt = createdAt,
|
||||||
|
)
|
||||||
|
val welcomeEvent: WelcomeEvent = signer.sign(welcomeTemplate)
|
||||||
|
|
||||||
|
// Step 2: Create a Rumor from the signed event and seal it (kind:13)
|
||||||
|
val rumor = Rumor.create(welcomeEvent)
|
||||||
|
val sealedRumor =
|
||||||
|
SealedRumorEvent.create(
|
||||||
|
rumor = rumor,
|
||||||
|
encryptTo = recipientPubKey,
|
||||||
|
signer = signer,
|
||||||
|
)
|
||||||
|
|
||||||
|
// Step 3: Gift wrap (kind:1059) with an ephemeral key to the recipient
|
||||||
|
return GiftWrapEvent.create(
|
||||||
|
event = sealedRumor,
|
||||||
|
recipientPubKey = recipientPubKey,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
+123
@@ -0,0 +1,123 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot.mip03GroupMessages
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Deterministic commit conflict resolution for MLS over Nostr (MIP-03).
|
||||||
|
*
|
||||||
|
* When multiple members submit Commits for the same epoch, exactly one must win:
|
||||||
|
* 1. Lowest created_at timestamp wins
|
||||||
|
* 2. If timestamps are equal, lexicographically smallest event id wins
|
||||||
|
* 3. All other competing Commits for that epoch are discarded
|
||||||
|
*
|
||||||
|
* This ensures all group members converge on the same group state without
|
||||||
|
* requiring a central coordinator.
|
||||||
|
*/
|
||||||
|
object CommitOrdering {
|
||||||
|
/**
|
||||||
|
* Comparator for ordering GroupEvents deterministically.
|
||||||
|
* The "winner" (lowest value) should be applied; all others are discarded.
|
||||||
|
*/
|
||||||
|
val comparator: Comparator<GroupEvent> =
|
||||||
|
compareBy<GroupEvent> { it.createdAt }
|
||||||
|
.thenBy { it.id }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Selects the winning Commit from a set of competing Commits for the same epoch.
|
||||||
|
*
|
||||||
|
* @param commits competing Commits for the same MLS epoch
|
||||||
|
* @return the winning Commit that should be applied, or null if empty
|
||||||
|
*/
|
||||||
|
fun selectWinner(commits: List<GroupEvent>): GroupEvent? {
|
||||||
|
if (commits.isEmpty()) return null
|
||||||
|
return commits.minWithOrNull(comparator)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Determines if a given commit is the winner among competing commits.
|
||||||
|
*
|
||||||
|
* @param candidate the commit to check
|
||||||
|
* @param competitors all competing commits for the same epoch (including candidate)
|
||||||
|
* @return true if candidate is the winning commit
|
||||||
|
*/
|
||||||
|
fun isWinner(
|
||||||
|
candidate: GroupEvent,
|
||||||
|
competitors: List<GroupEvent>,
|
||||||
|
): Boolean {
|
||||||
|
val winner = selectWinner(competitors) ?: return false
|
||||||
|
return winner.id == candidate.id
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Tracks pending commits per epoch and resolves conflicts.
|
||||||
|
*
|
||||||
|
* Accumulate commits as they arrive from relays, then call [resolve]
|
||||||
|
* to determine which commit wins for each epoch.
|
||||||
|
*/
|
||||||
|
class EpochCommitTracker {
|
||||||
|
private val pendingByEpoch = mutableMapOf<Long, MutableList<GroupEvent>>()
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Adds a commit for a given epoch.
|
||||||
|
*
|
||||||
|
* @param epoch the MLS epoch number this commit targets
|
||||||
|
* @param commit the GroupEvent containing the commit
|
||||||
|
*/
|
||||||
|
fun addCommit(
|
||||||
|
epoch: Long,
|
||||||
|
commit: GroupEvent,
|
||||||
|
) {
|
||||||
|
pendingByEpoch.getOrPut(epoch) { mutableListOf() }.add(commit)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns pending commits for a specific epoch.
|
||||||
|
*/
|
||||||
|
fun pendingForEpoch(epoch: Long): List<GroupEvent> = pendingByEpoch[epoch] ?: emptyList()
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Resolves the winning commit for a specific epoch.
|
||||||
|
*
|
||||||
|
* @param epoch the MLS epoch to resolve
|
||||||
|
* @return the winning commit, or null if no commits exist for this epoch
|
||||||
|
*/
|
||||||
|
fun resolve(epoch: Long): GroupEvent? = selectWinner(pendingByEpoch[epoch] ?: emptyList())
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Clears pending commits for an epoch after it has been resolved.
|
||||||
|
*/
|
||||||
|
fun clearEpoch(epoch: Long) {
|
||||||
|
pendingByEpoch.remove(epoch)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Returns all epochs that have pending commits.
|
||||||
|
*/
|
||||||
|
fun pendingEpochs(): Set<Long> = pendingByEpoch.keys.toSet()
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Clears all pending state.
|
||||||
|
*/
|
||||||
|
fun clear() {
|
||||||
|
pendingByEpoch.clear()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
+96
@@ -0,0 +1,96 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot.mip03GroupMessages
|
||||||
|
|
||||||
|
import com.vitorpamplona.quartz.nip44Encryption.crypto.ChaCha20Poly1305
|
||||||
|
import com.vitorpamplona.quartz.utils.RandomInstance
|
||||||
|
import kotlin.io.encoding.Base64
|
||||||
|
import kotlin.io.encoding.ExperimentalEncodingApi
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Handles the outer ChaCha20-Poly1305 encryption layer for Marmot GroupEvents (MIP-03).
|
||||||
|
*
|
||||||
|
* The encryption flow:
|
||||||
|
* Encrypt: content = base64(randomNonce(12) || ChaCha20-Poly1305.encrypt(key, nonce, mlsMessageBytes, aad=""))
|
||||||
|
* Decrypt: decode base64, split nonce (first 12 bytes) from ciphertext+tag, decrypt with empty AAD
|
||||||
|
*
|
||||||
|
* The key is derived from MLS-Exporter("marmot", "group-event", 32) by the MLS engine.
|
||||||
|
* Since the MLS engine is not yet integrated, this helper accepts the 32-byte key as a parameter.
|
||||||
|
*/
|
||||||
|
object GroupEventEncryption {
|
||||||
|
private val EMPTY_AAD = ByteArray(0)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Encrypts an MLS message for a GroupEvent.
|
||||||
|
*
|
||||||
|
* @param mlsMessageBytes the raw MLS message bytes to encrypt
|
||||||
|
* @param groupKey 32-byte key derived from MLS-Exporter("marmot", "group-event", 32)
|
||||||
|
* @return base64-encoded string containing nonce(12) || ciphertext || tag(16)
|
||||||
|
*/
|
||||||
|
@OptIn(ExperimentalEncodingApi::class)
|
||||||
|
fun encrypt(
|
||||||
|
mlsMessageBytes: ByteArray,
|
||||||
|
groupKey: ByteArray,
|
||||||
|
): String {
|
||||||
|
require(groupKey.size == GroupEvent.EXPORTER_KEY_LENGTH) {
|
||||||
|
"Group key must be ${GroupEvent.EXPORTER_KEY_LENGTH} bytes"
|
||||||
|
}
|
||||||
|
|
||||||
|
val nonce = RandomInstance.bytes(GroupEvent.NONCE_LENGTH)
|
||||||
|
val ciphertextWithTag = ChaCha20Poly1305.encrypt(mlsMessageBytes, EMPTY_AAD, nonce, groupKey)
|
||||||
|
|
||||||
|
// Prepend nonce to ciphertext+tag
|
||||||
|
val payload = ByteArray(nonce.size + ciphertextWithTag.size)
|
||||||
|
nonce.copyInto(payload)
|
||||||
|
ciphertextWithTag.copyInto(payload, nonce.size)
|
||||||
|
|
||||||
|
return Base64.encode(payload)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Decrypts a GroupEvent's encrypted content.
|
||||||
|
*
|
||||||
|
* @param encryptedContentBase64 base64-encoded content from the GroupEvent
|
||||||
|
* @param groupKey 32-byte key derived from MLS-Exporter("marmot", "group-event", 32)
|
||||||
|
* @return decrypted MLS message bytes
|
||||||
|
* @throws IllegalStateException if authentication fails
|
||||||
|
* @throws IllegalArgumentException if content is malformed
|
||||||
|
*/
|
||||||
|
@OptIn(ExperimentalEncodingApi::class)
|
||||||
|
fun decrypt(
|
||||||
|
encryptedContentBase64: String,
|
||||||
|
groupKey: ByteArray,
|
||||||
|
): ByteArray {
|
||||||
|
require(groupKey.size == GroupEvent.EXPORTER_KEY_LENGTH) {
|
||||||
|
"Group key must be ${GroupEvent.EXPORTER_KEY_LENGTH} bytes"
|
||||||
|
}
|
||||||
|
|
||||||
|
val payload = Base64.decode(encryptedContentBase64)
|
||||||
|
require(payload.size >= GroupEvent.MIN_CONTENT_LENGTH) {
|
||||||
|
"Payload too short: ${payload.size} bytes, minimum ${GroupEvent.MIN_CONTENT_LENGTH}"
|
||||||
|
}
|
||||||
|
|
||||||
|
val nonce = payload.copyOfRange(0, GroupEvent.NONCE_LENGTH)
|
||||||
|
val ciphertextWithTag = payload.copyOfRange(GroupEvent.NONCE_LENGTH, payload.size)
|
||||||
|
|
||||||
|
return ChaCha20Poly1305.decrypt(ciphertextWithTag, EMPTY_AAD, nonce, groupKey)
|
||||||
|
}
|
||||||
|
}
|
||||||
+198
@@ -0,0 +1,198 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.marmot.mip05PushNotifications
|
||||||
|
|
||||||
|
import com.vitorpamplona.quartz.marmot.mip05PushNotifications.tags.TokenTag
|
||||||
|
import com.vitorpamplona.quartz.nip44Encryption.crypto.ChaCha20Poly1305
|
||||||
|
import com.vitorpamplona.quartz.utils.RandomInstance
|
||||||
|
import com.vitorpamplona.quartz.utils.Secp256k1Instance
|
||||||
|
import com.vitorpamplona.quartz.utils.mac.MacInstance
|
||||||
|
import com.vitorpamplona.quartz.utils.sha256.sha256
|
||||||
|
import kotlin.io.encoding.Base64
|
||||||
|
import kotlin.io.encoding.ExperimentalEncodingApi
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Handles EncryptedToken creation and decryption for Marmot push notifications (MIP-05).
|
||||||
|
*
|
||||||
|
* EncryptedToken format (280 bytes total):
|
||||||
|
* ephemeral_pubkey(32) || nonce(12) || ciphertext(236 = 220 plaintext + 16 tag)
|
||||||
|
*
|
||||||
|
* Token payload (220 bytes, padded):
|
||||||
|
* platform(1) || token_length(2 BE) || device_token(N) || random_padding(220-3-N)
|
||||||
|
*
|
||||||
|
* Key derivation:
|
||||||
|
* 1. ECDH: shared_point = ephemeral_privkey * server_pubkey
|
||||||
|
* 2. shared_x = sha256(shared_point) (x-coordinate as shared secret)
|
||||||
|
* 3. PRK = HKDF-Extract(salt="mip05-v1", IKM=shared_x)
|
||||||
|
* 4. encryption_key = HKDF-Expand(PRK, info="mip05-token-encryption", 32)
|
||||||
|
* 5. Encrypt padded payload with ChaCha20-Poly1305(key, nonce, payload, aad="")
|
||||||
|
*
|
||||||
|
* Platform values: 0x01 = APNs, 0x02 = FCM
|
||||||
|
*/
|
||||||
|
object TokenEncryption {
|
||||||
|
private const val PADDED_PAYLOAD_SIZE = 220
|
||||||
|
private const val NONCE_SIZE = 12
|
||||||
|
private const val PUBKEY_SIZE = 32
|
||||||
|
private const val HEADER_SIZE = 3 // platform(1) + token_length(2)
|
||||||
|
private const val MAX_TOKEN_SIZE = PADDED_PAYLOAD_SIZE - HEADER_SIZE
|
||||||
|
|
||||||
|
private val HKDF_SALT = "mip05-v1".encodeToByteArray()
|
||||||
|
private val HKDF_INFO = "mip05-token-encryption".encodeToByteArray()
|
||||||
|
private val EMPTY_AAD = ByteArray(0)
|
||||||
|
|
||||||
|
const val PLATFORM_APNS: Byte = 0x01
|
||||||
|
const val PLATFORM_FCM: Byte = 0x02
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Encrypts a device token for a notification server.
|
||||||
|
*
|
||||||
|
* @param platform platform identifier (PLATFORM_APNS or PLATFORM_FCM)
|
||||||
|
* @param deviceToken raw device token bytes
|
||||||
|
* @param serverPubKey 32-byte notification server public key
|
||||||
|
* @return base64-encoded EncryptedToken (280 bytes when decoded)
|
||||||
|
*/
|
||||||
|
@OptIn(ExperimentalEncodingApi::class)
|
||||||
|
fun encrypt(
|
||||||
|
platform: Byte,
|
||||||
|
deviceToken: ByteArray,
|
||||||
|
serverPubKey: ByteArray,
|
||||||
|
): String {
|
||||||
|
require(deviceToken.size <= MAX_TOKEN_SIZE) {
|
||||||
|
"Device token too large: ${deviceToken.size} bytes, max $MAX_TOKEN_SIZE"
|
||||||
|
}
|
||||||
|
require(serverPubKey.size == PUBKEY_SIZE) { "Server pubkey must be $PUBKEY_SIZE bytes" }
|
||||||
|
|
||||||
|
// Build padded payload: platform(1) || token_length(2 BE) || token || random_padding
|
||||||
|
val payload = ByteArray(PADDED_PAYLOAD_SIZE)
|
||||||
|
payload[0] = platform
|
||||||
|
payload[1] = (deviceToken.size ushr 8 and 0xFF).toByte()
|
||||||
|
payload[2] = (deviceToken.size and 0xFF).toByte()
|
||||||
|
deviceToken.copyInto(payload, HEADER_SIZE)
|
||||||
|
// Fill remaining bytes with random padding
|
||||||
|
val paddingStart = HEADER_SIZE + deviceToken.size
|
||||||
|
val padding = RandomInstance.bytes(PADDED_PAYLOAD_SIZE - paddingStart)
|
||||||
|
padding.copyInto(payload, paddingStart)
|
||||||
|
|
||||||
|
// Generate ephemeral keypair for ECDH
|
||||||
|
val ephemeralPrivKey = RandomInstance.bytes(32)
|
||||||
|
val ephemeralPubKey = Secp256k1Instance.compressedPubKeyFor(ephemeralPrivKey)
|
||||||
|
|
||||||
|
// ECDH: shared_x = sha256(ephemeral_privkey * server_pubkey)
|
||||||
|
val sharedPoint = Secp256k1Instance.pubKeyTweakMulCompact(serverPubKey, ephemeralPrivKey)
|
||||||
|
val sharedX = sha256(sharedPoint)
|
||||||
|
|
||||||
|
// HKDF-Extract then Expand to get encryption key
|
||||||
|
val encryptionKey = hkdfDeriveKey(sharedX)
|
||||||
|
|
||||||
|
// Encrypt with ChaCha20-Poly1305
|
||||||
|
val nonce = RandomInstance.bytes(NONCE_SIZE)
|
||||||
|
val ciphertextWithTag = ChaCha20Poly1305.encrypt(payload, EMPTY_AAD, nonce, encryptionKey)
|
||||||
|
|
||||||
|
// Assemble: ephemeral_pubkey(32) || nonce(12) || ciphertext+tag(236)
|
||||||
|
val result = ByteArray(TokenTag.ENCRYPTED_TOKEN_SIZE)
|
||||||
|
ephemeralPubKey.copyInto(result, 0)
|
||||||
|
nonce.copyInto(result, PUBKEY_SIZE)
|
||||||
|
ciphertextWithTag.copyInto(result, PUBKEY_SIZE + NONCE_SIZE)
|
||||||
|
|
||||||
|
return Base64.encode(result)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Decrypts an EncryptedToken using the notification server's private key.
|
||||||
|
*
|
||||||
|
* @param encryptedTokenBase64 base64-encoded EncryptedToken
|
||||||
|
* @param serverPrivKey 32-byte notification server private key
|
||||||
|
* @return decoded token info
|
||||||
|
* @throws IllegalStateException if authentication fails
|
||||||
|
*/
|
||||||
|
@OptIn(ExperimentalEncodingApi::class)
|
||||||
|
fun decrypt(
|
||||||
|
encryptedTokenBase64: String,
|
||||||
|
serverPrivKey: ByteArray,
|
||||||
|
): DecryptedToken {
|
||||||
|
val data = Base64.decode(encryptedTokenBase64)
|
||||||
|
require(data.size == TokenTag.ENCRYPTED_TOKEN_SIZE) {
|
||||||
|
"EncryptedToken must be ${TokenTag.ENCRYPTED_TOKEN_SIZE} bytes, got ${data.size}"
|
||||||
|
}
|
||||||
|
|
||||||
|
// Parse components
|
||||||
|
val ephemeralPubKey = data.copyOfRange(0, PUBKEY_SIZE)
|
||||||
|
val nonce = data.copyOfRange(PUBKEY_SIZE, PUBKEY_SIZE + NONCE_SIZE)
|
||||||
|
val ciphertextWithTag = data.copyOfRange(PUBKEY_SIZE + NONCE_SIZE, data.size)
|
||||||
|
|
||||||
|
// ECDH: shared_x = sha256(server_privkey * ephemeral_pubkey)
|
||||||
|
val sharedPoint = Secp256k1Instance.pubKeyTweakMulCompact(ephemeralPubKey, serverPrivKey)
|
||||||
|
val sharedX = sha256(sharedPoint)
|
||||||
|
|
||||||
|
// Derive encryption key
|
||||||
|
val encryptionKey = hkdfDeriveKey(sharedX)
|
||||||
|
|
||||||
|
// Decrypt
|
||||||
|
val payload = ChaCha20Poly1305.decrypt(ciphertextWithTag, EMPTY_AAD, nonce, encryptionKey)
|
||||||
|
|
||||||
|
// Parse payload: platform(1) || token_length(2 BE) || token || padding
|
||||||
|
val platform = payload[0]
|
||||||
|
val tokenLength = ((payload[1].toInt() and 0xFF) shl 8) or (payload[2].toInt() and 0xFF)
|
||||||
|
require(tokenLength in 0..MAX_TOKEN_SIZE) { "Invalid token length: $tokenLength" }
|
||||||
|
|
||||||
|
val deviceToken = payload.copyOfRange(HEADER_SIZE, HEADER_SIZE + tokenLength)
|
||||||
|
|
||||||
|
return DecryptedToken(platform, deviceToken)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* HKDF-Extract(salt="mip05-v1", IKM=sharedX) then HKDF-Expand(PRK, info="mip05-token-encryption", 32).
|
||||||
|
*/
|
||||||
|
private fun hkdfDeriveKey(sharedX: ByteArray): ByteArray {
|
||||||
|
// HKDF-Extract: PRK = HMAC-SHA256(salt, IKM)
|
||||||
|
val extractMac = MacInstance("HmacSHA256", HKDF_SALT)
|
||||||
|
extractMac.update(sharedX)
|
||||||
|
val prk = extractMac.doFinal()
|
||||||
|
|
||||||
|
// HKDF-Expand: T(1) = HMAC-SHA256(PRK, info || 0x01), take first 32 bytes
|
||||||
|
val expandMac = MacInstance("HmacSHA256", prk)
|
||||||
|
expandMac.update(HKDF_INFO)
|
||||||
|
expandMac.update(0x01.toByte())
|
||||||
|
return expandMac.doFinal()
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Result of decrypting an EncryptedToken.
|
||||||
|
*/
|
||||||
|
data class DecryptedToken(
|
||||||
|
/** Platform identifier: [PLATFORM_APNS] or [PLATFORM_FCM] */
|
||||||
|
val platform: Byte,
|
||||||
|
/** Raw device token bytes */
|
||||||
|
val deviceToken: ByteArray,
|
||||||
|
) {
|
||||||
|
override fun equals(other: Any?): Boolean {
|
||||||
|
if (this === other) return true
|
||||||
|
if (other !is DecryptedToken) return false
|
||||||
|
return platform == other.platform && deviceToken.contentEquals(other.deviceToken)
|
||||||
|
}
|
||||||
|
|
||||||
|
override fun hashCode(): Int {
|
||||||
|
var result = platform.toInt()
|
||||||
|
result = 31 * result + deviceToken.contentHashCode()
|
||||||
|
return result
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
+160
@@ -0,0 +1,160 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quartz.nip44Encryption.crypto
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Standard ChaCha20-Poly1305 AEAD (RFC 8439) with 12-byte nonces.
|
||||||
|
*
|
||||||
|
* Used by the Marmot protocol (MIP-03) for outer encryption of GroupEvents.
|
||||||
|
* Unlike [XChaCha20Poly1305] which uses 24-byte nonces via HChaCha20,
|
||||||
|
* this operates directly with the IETF ChaCha20 variant.
|
||||||
|
*
|
||||||
|
* Construction:
|
||||||
|
* 1. Generate Poly1305 OTK from ChaCha20 block 0
|
||||||
|
* 2. Encrypt with ChaCha20 starting at counter 1
|
||||||
|
* 3. Compute Poly1305 tag over: pad16(ad) || pad16(ciphertext) || len(ad) || len(ct)
|
||||||
|
*/
|
||||||
|
object ChaCha20Poly1305 {
|
||||||
|
private const val TAG_SIZE = 16
|
||||||
|
|
||||||
|
/**
|
||||||
|
* AEAD encrypt.
|
||||||
|
*
|
||||||
|
* @param plaintext message to encrypt
|
||||||
|
* @param ad associated data (authenticated but not encrypted)
|
||||||
|
* @param nonce 12-byte nonce
|
||||||
|
* @param key 32-byte key
|
||||||
|
* @return ciphertext || 16-byte tag
|
||||||
|
*/
|
||||||
|
fun encrypt(
|
||||||
|
plaintext: ByteArray,
|
||||||
|
ad: ByteArray,
|
||||||
|
nonce: ByteArray,
|
||||||
|
key: ByteArray,
|
||||||
|
): ByteArray {
|
||||||
|
require(nonce.size == 12) { "Nonce must be 12 bytes" }
|
||||||
|
require(key.size == 32) { "Key must be 32 bytes" }
|
||||||
|
|
||||||
|
// Step 1: Generate Poly1305 one-time key
|
||||||
|
val polyKey = ChaCha20Core.chaCha20PolyKey(key, nonce)
|
||||||
|
|
||||||
|
// Step 2: Encrypt plaintext with counter starting at 1
|
||||||
|
val ciphertext = ChaCha20Core.chaCha20Xor(plaintext, key, nonce, counter = 1)
|
||||||
|
|
||||||
|
// Step 3: Compute tag
|
||||||
|
val tag = computeTag(polyKey, ad, ciphertext)
|
||||||
|
|
||||||
|
// Step 4: Return ciphertext || tag
|
||||||
|
val result = ByteArray(ciphertext.size + TAG_SIZE)
|
||||||
|
ciphertext.copyInto(result)
|
||||||
|
tag.copyInto(result, ciphertext.size)
|
||||||
|
return result
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* AEAD decrypt.
|
||||||
|
*
|
||||||
|
* @param ciphertextWithTag ciphertext || 16-byte tag
|
||||||
|
* @param ad associated data
|
||||||
|
* @param nonce 12-byte nonce
|
||||||
|
* @param key 32-byte key
|
||||||
|
* @return plaintext, or throws on authentication failure
|
||||||
|
*/
|
||||||
|
fun decrypt(
|
||||||
|
ciphertextWithTag: ByteArray,
|
||||||
|
ad: ByteArray,
|
||||||
|
nonce: ByteArray,
|
||||||
|
key: ByteArray,
|
||||||
|
): ByteArray {
|
||||||
|
require(nonce.size == 12) { "Nonce must be 12 bytes" }
|
||||||
|
require(key.size == 32) { "Key must be 32 bytes" }
|
||||||
|
require(ciphertextWithTag.size >= TAG_SIZE) { "Ciphertext too short" }
|
||||||
|
|
||||||
|
val ctLen = ciphertextWithTag.size - TAG_SIZE
|
||||||
|
val ciphertext = ciphertextWithTag.copyOfRange(0, ctLen)
|
||||||
|
val receivedTag = ciphertextWithTag.copyOfRange(ctLen, ciphertextWithTag.size)
|
||||||
|
|
||||||
|
// Step 1: Generate Poly1305 one-time key
|
||||||
|
val polyKey = ChaCha20Core.chaCha20PolyKey(key, nonce)
|
||||||
|
|
||||||
|
// Step 2: Verify tag
|
||||||
|
val expectedTag = computeTag(polyKey, ad, ciphertext)
|
||||||
|
check(constantTimeEquals(receivedTag, expectedTag)) { "Authentication failed" }
|
||||||
|
|
||||||
|
// Step 3: Decrypt
|
||||||
|
return ChaCha20Core.chaCha20Xor(ciphertext, key, nonce, counter = 1)
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Compute Poly1305 tag over the AEAD construction:
|
||||||
|
* pad16(ad) || pad16(ciphertext) || len(ad) as 8-byte LE || len(ct) as 8-byte LE
|
||||||
|
*/
|
||||||
|
private fun computeTag(
|
||||||
|
polyKey: ByteArray,
|
||||||
|
ad: ByteArray,
|
||||||
|
ciphertext: ByteArray,
|
||||||
|
): ByteArray {
|
||||||
|
val adPadLen = if (ad.size % 16 == 0) 0 else 16 - (ad.size % 16)
|
||||||
|
val ctPadLen = if (ciphertext.size % 16 == 0) 0 else 16 - (ciphertext.size % 16)
|
||||||
|
|
||||||
|
val macData = ByteArray(ad.size + adPadLen + ciphertext.size + ctPadLen + 16)
|
||||||
|
var offset = 0
|
||||||
|
|
||||||
|
ad.copyInto(macData, offset)
|
||||||
|
offset += ad.size + adPadLen
|
||||||
|
|
||||||
|
ciphertext.copyInto(macData, offset)
|
||||||
|
offset += ciphertext.size + ctPadLen
|
||||||
|
|
||||||
|
longToLittleEndian(ad.size.toLong(), macData, offset)
|
||||||
|
offset += 8
|
||||||
|
longToLittleEndian(ciphertext.size.toLong(), macData, offset)
|
||||||
|
|
||||||
|
return Poly1305.mac(macData, polyKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
private fun constantTimeEquals(
|
||||||
|
a: ByteArray,
|
||||||
|
b: ByteArray,
|
||||||
|
): Boolean {
|
||||||
|
if (a.size != b.size) return false
|
||||||
|
var result = 0
|
||||||
|
for (i in a.indices) {
|
||||||
|
result = result or (a[i].toInt() xor b[i].toInt())
|
||||||
|
}
|
||||||
|
return result == 0
|
||||||
|
}
|
||||||
|
|
||||||
|
private fun longToLittleEndian(
|
||||||
|
value: Long,
|
||||||
|
output: ByteArray,
|
||||||
|
offset: Int,
|
||||||
|
) {
|
||||||
|
output[offset] = (value and 0xFF).toByte()
|
||||||
|
output[offset + 1] = (value ushr 8 and 0xFF).toByte()
|
||||||
|
output[offset + 2] = (value ushr 16 and 0xFF).toByte()
|
||||||
|
output[offset + 3] = (value ushr 24 and 0xFF).toByte()
|
||||||
|
output[offset + 4] = (value ushr 32 and 0xFF).toByte()
|
||||||
|
output[offset + 5] = (value ushr 40 and 0xFF).toByte()
|
||||||
|
output[offset + 6] = (value ushr 48 and 0xFF).toByte()
|
||||||
|
output[offset + 7] = (value ushr 56 and 0xFF).toByte()
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user