def derive_secrets(
self, initiator_nonce: bytes, responder_nonce: bytes,
remote_ephemeral_pubkey: datatypes.PublicKey,
auth_init_ciphertext: bytes, auth_ack_ciphertext: bytes
) -> Tuple[bytes, bytes, sha3.keccak_256, sha3.keccak_256]:
"""Derive base secrets from ephemeral key agreement."""
# ecdhe-shared-secret = ecdh.agree(ephemeral-privkey, remote-ephemeral-pubk)
ecdhe_shared_secret = ecies.ecdh_agree(self.ephemeral_privkey,
remote_ephemeral_pubkey)
# shared-secret = keccak(ecdhe-shared-secret || keccak(nonce || initiator-nonce))
shared_secret = keccak(ecdhe_shared_secret +
keccak(responder_nonce + initiator_nonce))
# aes-secret = keccak(ecdhe-shared-secret || shared-secret)
aes_secret = keccak(ecdhe_shared_secret + shared_secret)
# mac-secret = keccak(ecdhe-shared-secret || aes-secret)
mac_secret = keccak(ecdhe_shared_secret + aes_secret)
# setup keccak instances for the MACs
# egress-mac = sha3.keccak_256(mac-secret ^ recipient-nonce || auth-sent-init)
mac1 = sha3.keccak_256(
sxor(mac_secret, responder_nonce) + auth_init_ciphertext)
# ingress-mac = sha3.keccak_256(mac-secret ^ initiator-nonce || auth-recvd-ack)
mac2 = sha3.keccak_256(
sxor(mac_secret, initiator_nonce) + auth_ack_ciphertext)
if self._is_initiator:
egress_mac, ingress_mac = mac1, mac2
else:
egress_mac, ingress_mac = mac2, mac1
return aes_secret, mac_secret, egress_mac, ingress_mac
def _encrypt(self, header: bytes, frame: bytes) -> bytes:
if len(header) != HEADER_LEN:
raise ValueError(f"Unexpected header length: {len(header)}")
header_ciphertext = self._aes_enc.update(header)
mac_secret = self._egress_mac.digest()[:HEADER_LEN]
self._egress_mac.update(sxor(self._mac_enc(mac_secret), header_ciphertext))
header_mac = self._egress_mac.digest()[:HEADER_LEN]
frame_ciphertext = self._aes_enc.update(frame)
self._egress_mac.update(frame_ciphertext)
fmac_seed = self._egress_mac.digest()[:HEADER_LEN]
mac_secret = self._egress_mac.digest()[:HEADER_LEN]
self._egress_mac.update(sxor(self._mac_enc(mac_secret), fmac_seed))
frame_mac = self._egress_mac.digest()[:HEADER_LEN]
return header_ciphertext + header_mac + frame_ciphertext + frame_mac
def create_auth_message(self, nonce: bytes) -> bytes:
ecdh_shared_secret = ecies.ecdh_agree(self.privkey, self.remote.pubkey)
secret_xor_nonce = sxor(ecdh_shared_secret, nonce)
S = self.ephemeral_privkey.sign_msg_hash(secret_xor_nonce).to_bytes()
if self.use_eip8:
data = rlp.encode([S, self.pubkey.to_bytes(), nonce, DEVP2P_V4],
sedes=eip8_auth_sedes)
return _pad_eip8_data(data)
else:
# S || H(ephemeral-pubk) || pubk || nonce || 0x0
return (S + keccak(self.ephemeral_pubkey.to_bytes()) +
self.pubkey.to_bytes() + nonce + b'\x00')
def _decrypt_header(self, data: bytes) -> bytes:
if len(data) != HEADER_LEN + MAC_LEN:
raise ValueError(
f"Unexpected header length: {len(data)}, expected {HEADER_LEN} + {MAC_LEN}"
)
header_ciphertext = data[:HEADER_LEN]
header_mac = data[HEADER_LEN:]
mac_secret = self._ingress_mac.digest()[:HEADER_LEN]
aes = self._mac_enc(mac_secret)[:HEADER_LEN]
self._ingress_mac.update(sxor(aes, header_ciphertext))
expected_header_mac = self._ingress_mac.digest()[:HEADER_LEN]
if not hmac.compare_digest(expected_header_mac, header_mac):
raise DecryptionError(
f'Invalid header mac: expected {expected_header_mac}, got {header_mac}'
)
return self._aes_dec.update(header_ciphertext)
def _decrypt_body(self, data: bytes, body_size: int) -> bytes:
read_size = roundup_16(body_size)
if len(data) < read_size + MAC_LEN:
raise ValueError(
f'Insufficient body length; Got {len(data)}, wanted {read_size} + {MAC_LEN}'
)
frame_ciphertext = data[:read_size]
frame_mac = data[read_size:read_size + MAC_LEN]
self._ingress_mac.update(frame_ciphertext)
fmac_seed = self._ingress_mac.digest()[:MAC_LEN]
self._ingress_mac.update(sxor(self._mac_enc(fmac_seed), fmac_seed))
expected_frame_mac = self._ingress_mac.digest()[:MAC_LEN]
if not hmac.compare_digest(expected_frame_mac, frame_mac):
raise DecryptionError(
f'Invalid frame mac: expected {expected_frame_mac}, got {frame_mac}'
)
return self._aes_dec.update(frame_ciphertext)[:body_size]
def decode_authentication(ciphertext: bytes,
privkey: datatypes.PrivateKey
) -> Tuple[datatypes.PublicKey, bytes, datatypes.PublicKey]:
"""
Decrypts and decodes the ciphertext msg.
Returns the initiator's ephemeral pubkey, nonce, and pubkey.
"""
if len(ciphertext) < ENCRYPTED_AUTH_MSG_LEN:
raise DecryptionError(f"Auth msg too short: {len(ciphertext)}")
elif len(ciphertext) == ENCRYPTED_AUTH_MSG_LEN:
sig, initiator_pubkey, initiator_nonce, _ = decode_auth_plain(
ciphertext, privkey)
else:
sig, initiator_pubkey, initiator_nonce, _ = decode_auth_eip8(
ciphertext, privkey)
# recover initiator ephemeral pubkey from sig
# S(ephemeral-privk, ecdh-shared-secret ^ nonce)
shared_secret = ecies.ecdh_agree(privkey, initiator_pubkey)
ephem_pubkey = sig.recover_public_key_from_msg_hash(
sxor(shared_secret, initiator_nonce))
return ephem_pubkey, initiator_nonce, initiator_pubkey
def recover_source_id_from_tag(tag: Tag, destination_node_id: NodeID) -> NodeID:
"""Recover the node id of the source from the tag in a message packet."""
destination_node_id_hash = hashlib.sha256(destination_node_id).digest()
source_node_id = sxor(tag, destination_node_id_hash)
return NodeID(source_node_id)
def compute_tag(source_node_id: NodeID, destination_node_id: NodeID) -> Tag:
"""Compute the tag used in message packets sent between two nodes."""
destination_node_id_hash = hashlib.sha256(destination_node_id).digest()
tag = sxor(destination_node_id_hash, source_node_id)
return Tag(tag)