mirror of
https://github.com/fromchat-messenger/web.git
synced 2026-09-22 19:15:08 +03:00
Implement standalone FromChat Protocol
This commit is contained in:
@@ -0,0 +1,66 @@
|
||||
import { aesGcmDecrypt, aesGcmEncrypt, importPassword, deriveKEK, randomBytes } from "../crypto/index";
|
||||
|
||||
export interface PrivateKeyBundle {
|
||||
version: 1;
|
||||
privateKey: Uint8Array; // X25519 private key
|
||||
}
|
||||
|
||||
export interface EncryptedBackupBlob {
|
||||
salt: Uint8Array; // for PBKDF2 derivation of KEK
|
||||
iv: Uint8Array; // AES-GCM IV
|
||||
ciphertext: Uint8Array; // encrypted serialized PrivateKeyBundle
|
||||
}
|
||||
|
||||
export function serializeBundle(bundle: PrivateKeyBundle): Uint8Array {
|
||||
const header = new Uint8Array([bundle.version]);
|
||||
const len = new Uint8Array(new Uint32Array([bundle.privateKey.length]).buffer);
|
||||
const out = new Uint8Array(1 + 4 + bundle.privateKey.length);
|
||||
out.set(header, 0);
|
||||
out.set(len, 1);
|
||||
out.set(bundle.privateKey, 5);
|
||||
return out;
|
||||
}
|
||||
|
||||
export function deserializeBundle(data: Uint8Array): PrivateKeyBundle {
|
||||
const version = data[0] as 1;
|
||||
const len = new Uint32Array(data.slice(1, 5).buffer)[0];
|
||||
const pk = data.slice(5, 5 + len);
|
||||
return { version, privateKey: pk };
|
||||
}
|
||||
|
||||
export async function encryptBackupWithPassword(password: string, bundle: PrivateKeyBundle): Promise<EncryptedBackupBlob> {
|
||||
const salt = randomBytes(16);
|
||||
const pw = await importPassword(password);
|
||||
const kek = await deriveKEK(pw, salt);
|
||||
const serialized = serializeBundle(bundle);
|
||||
const { iv, ciphertext } = await aesGcmEncrypt(kek, serialized);
|
||||
return { salt, iv, ciphertext };
|
||||
}
|
||||
|
||||
export async function decryptBackupWithPassword(password: string, blob: EncryptedBackupBlob): Promise<PrivateKeyBundle> {
|
||||
const pw = await importPassword(password);
|
||||
const kek = await deriveKEK(pw, blob.salt);
|
||||
const plaintext = await aesGcmDecrypt(kek, blob.iv, blob.ciphertext);
|
||||
return deserializeBundle(plaintext);
|
||||
}
|
||||
|
||||
export function encodeBlob(blob: EncryptedBackupBlob): string {
|
||||
function b64(a: Uint8Array) { return btoa(String.fromCharCode(...a)); }
|
||||
return JSON.stringify({
|
||||
salt: b64(blob.salt),
|
||||
iv: b64(blob.iv),
|
||||
ciphertext: b64(blob.ciphertext)
|
||||
});
|
||||
}
|
||||
|
||||
export function decodeBlob(json: string): EncryptedBackupBlob {
|
||||
function ub64(s: string) {
|
||||
const bin = atob(s);
|
||||
const arr = new Uint8Array(bin.length);
|
||||
for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);
|
||||
return arr;
|
||||
}
|
||||
const obj = JSON.parse(json);
|
||||
return { salt: ub64(obj.salt), iv: ub64(obj.iv), ciphertext: ub64(obj.ciphertext) };
|
||||
}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
import nacl from "tweetnacl";
|
||||
import { hkdfExtractAndExpand } from "./kdf";
|
||||
|
||||
export interface X25519KeyPair {
|
||||
publicKey: Uint8Array;
|
||||
privateKey: Uint8Array;
|
||||
}
|
||||
|
||||
export function generateX25519KeyPair(): X25519KeyPair {
|
||||
const kp = nacl.box.keyPair();
|
||||
return { publicKey: kp.publicKey, privateKey: kp.secretKey };
|
||||
}
|
||||
|
||||
export function ecdhSharedSecret(myPrivateKey: Uint8Array, theirPublicKey: Uint8Array): Uint8Array {
|
||||
return nacl.box.before(theirPublicKey, myPrivateKey);
|
||||
}
|
||||
|
||||
export async function deriveWrappingKey(sharedSecret: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<Uint8Array> {
|
||||
return hkdfExtractAndExpand(sharedSecret.buffer as ArrayBuffer, salt, info, 32);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
// Re-export all crypto functions for convenience
|
||||
export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./asymmetric";
|
||||
export type { X25519KeyPair } from "./asymmetric";
|
||||
export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./symmetric";
|
||||
export type { AesGcmCiphertext } from "./symmetric";
|
||||
export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./kdf";
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
export async function hkdfExtractAndExpand(inputKeyMaterial: Uint8Array | ArrayBuffer, salt: Uint8Array | ArrayBuffer, info: Uint8Array | ArrayBuffer, length = 32): Promise<Uint8Array> {
|
||||
const inputBuffer = inputKeyMaterial instanceof Uint8Array ? inputKeyMaterial.buffer as ArrayBuffer : inputKeyMaterial;
|
||||
const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
|
||||
const infoBuffer = info instanceof Uint8Array ? info.buffer as ArrayBuffer : info;
|
||||
|
||||
const ikmKey = await crypto.subtle.importKey("raw", inputBuffer, { name: "HKDF" }, false, ["deriveBits"]);
|
||||
const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: saltBuffer, info: infoBuffer }, ikmKey, length * 8);
|
||||
return new Uint8Array(bits);
|
||||
}
|
||||
|
||||
export function randomBytes(length: number): Uint8Array {
|
||||
const out = new Uint8Array(length);
|
||||
crypto.getRandomValues(out);
|
||||
return out;
|
||||
}
|
||||
|
||||
export async function importPassword(password: string): Promise<CryptoKey> {
|
||||
const enc = new TextEncoder();
|
||||
return crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveKey", "deriveBits"]);
|
||||
}
|
||||
|
||||
export async function deriveKEK(passwordKey: CryptoKey, salt: Uint8Array | ArrayBuffer, iterations = 210_000): Promise<CryptoKey> {
|
||||
const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
|
||||
return crypto.subtle.deriveKey(
|
||||
{ name: "PBKDF2", salt: saltBuffer, iterations, hash: "SHA-256" },
|
||||
passwordKey,
|
||||
{ name: "AES-GCM", length: 256 },
|
||||
false,
|
||||
["encrypt", "decrypt"]
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
export interface AesGcmCiphertext {
|
||||
iv: Uint8Array;
|
||||
ciphertext: Uint8Array;
|
||||
}
|
||||
|
||||
export async function aesGcmEncrypt(key: CryptoKey, plaintext: Uint8Array | ArrayBuffer): Promise<AesGcmCiphertext> {
|
||||
const iv = crypto.getRandomValues(new Uint8Array(12));
|
||||
const plaintextBuffer = plaintext instanceof Uint8Array ? plaintext.buffer as ArrayBuffer : plaintext;
|
||||
const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintextBuffer);
|
||||
return { iv, ciphertext: new Uint8Array(ct) };
|
||||
}
|
||||
|
||||
export async function aesGcmDecrypt(key: CryptoKey, iv: Uint8Array | ArrayBuffer, ciphertext: Uint8Array | ArrayBuffer): Promise<Uint8Array> {
|
||||
const ivBuf: ArrayBuffer = iv instanceof Uint8Array
|
||||
? (iv.buffer as ArrayBuffer).slice(iv.byteOffset, iv.byteOffset + iv.byteLength)
|
||||
: (iv as ArrayBuffer);
|
||||
|
||||
const ctBuf: ArrayBuffer = ciphertext instanceof Uint8Array
|
||||
? (ciphertext.buffer as ArrayBuffer).slice(ciphertext.byteOffset, ciphertext.byteOffset + ciphertext.byteLength)
|
||||
: (ciphertext as ArrayBuffer);
|
||||
|
||||
const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: ivBuf }, key, ctBuf);
|
||||
return new Uint8Array(pt as ArrayBuffer);
|
||||
}
|
||||
|
||||
export async function importAesGcmKey(rawKey: Uint8Array | ArrayBuffer): Promise<CryptoKey> {
|
||||
const keyBuffer = rawKey instanceof Uint8Array
|
||||
? (rawKey.buffer as ArrayBuffer).slice(rawKey.byteOffset, rawKey.byteOffset + rawKey.byteLength)
|
||||
: (rawKey as ArrayBuffer);
|
||||
return crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
export { FromChatProtocol } from "./protocol/FromChatProtocol";
|
||||
export type { EncryptedMessage } from "./protocol/types";
|
||||
|
||||
// Export crypto functions
|
||||
export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./crypto/asymmetric";
|
||||
export type { X25519KeyPair } from "./crypto/asymmetric";
|
||||
export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./crypto/symmetric";
|
||||
export type { AesGcmCiphertext } from "./crypto/symmetric";
|
||||
export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./crypto/kdf";
|
||||
|
||||
// Export backup functions
|
||||
export {
|
||||
encryptBackupWithPassword,
|
||||
decryptBackupWithPassword,
|
||||
encodeBlob,
|
||||
decodeBlob,
|
||||
serializeBundle,
|
||||
deserializeBundle
|
||||
} from "./backup/backup";
|
||||
export type { PrivateKeyBundle, EncryptedBackupBlob } from "./backup/backup";
|
||||
@@ -0,0 +1,102 @@
|
||||
import { ecdhSharedSecret, deriveWrappingKey } from "../crypto/asymmetric";
|
||||
import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "../crypto/symmetric";
|
||||
import { randomBytes } from "../crypto/kdf";
|
||||
import type { EncryptedMessage } from "./types";
|
||||
|
||||
/**
|
||||
* FromChat Protocol - Simple ECDH-based encryption
|
||||
*
|
||||
* Protocol:
|
||||
* 1. Generate random message key (mk) - 32 bytes
|
||||
* 2. Generate random salt (wkSalt) - 16 bytes
|
||||
* 3. Derive shared secret from ECDH (X25519)
|
||||
* 4. Derive wrapping key from shared secret using HKDF with salt
|
||||
* 5. Encrypt message with mk using AES-GCM
|
||||
* 6. Encrypt (wrap) mk with wrapping key using AES-GCM
|
||||
* 7. Send: { iv, ciphertext, salt, iv2, wrappedMk }
|
||||
*/
|
||||
export class FromChatProtocol {
|
||||
private privateKey: Uint8Array;
|
||||
|
||||
constructor(privateKey: Uint8Array) {
|
||||
this.privateKey = privateKey;
|
||||
}
|
||||
|
||||
/**
|
||||
* Encrypt a message for a recipient
|
||||
* @param recipientPublicKey - Recipient's X25519 public key
|
||||
* @param plaintext - Message to encrypt
|
||||
* @returns Encrypted message with all necessary fields
|
||||
*/
|
||||
async encryptMessage(recipientPublicKey: Uint8Array, plaintext: string): Promise<EncryptedMessage> {
|
||||
// Generate random message key
|
||||
const mk = randomBytes(32);
|
||||
|
||||
// Generate random salt for wrapping key derivation
|
||||
const wkSalt = randomBytes(16);
|
||||
|
||||
// Derive shared secret from ECDH
|
||||
const shared = ecdhSharedSecret(this.privateKey, recipientPublicKey);
|
||||
|
||||
// Derive wrapping key from shared secret using HKDF
|
||||
const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
|
||||
const wk = await importAesGcmKey(wkRaw);
|
||||
|
||||
// Encrypt the message with message key
|
||||
const plaintextBytes = new TextEncoder().encode(plaintext);
|
||||
const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), plaintextBytes);
|
||||
|
||||
// Encrypt (wrap) the message key with wrapping key
|
||||
const wrap = await aesGcmEncrypt(wk, mk);
|
||||
|
||||
// Convert to base64 for transmission
|
||||
return {
|
||||
iv: btoa(String.fromCharCode(...encMsg.iv)),
|
||||
ciphertext: btoa(String.fromCharCode(...encMsg.ciphertext)),
|
||||
salt: btoa(String.fromCharCode(...wkSalt)),
|
||||
iv2: btoa(String.fromCharCode(...wrap.iv)),
|
||||
wrappedMk: btoa(String.fromCharCode(...wrap.ciphertext))
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Decrypt a message from a sender
|
||||
* @param senderPublicKey - Sender's X25519 public key
|
||||
* @param message - Encrypted message
|
||||
* @returns Decrypted plaintext
|
||||
*/
|
||||
async decryptMessage(senderPublicKey: Uint8Array, message: EncryptedMessage): Promise<string> {
|
||||
// Decode base64 fields
|
||||
const salt = new Uint8Array(
|
||||
atob(message.salt).split("").map(c => c.charCodeAt(0))
|
||||
);
|
||||
const iv2 = new Uint8Array(
|
||||
atob(message.iv2).split("").map(c => c.charCodeAt(0))
|
||||
);
|
||||
const wrappedMk = new Uint8Array(
|
||||
atob(message.wrappedMk).split("").map(c => c.charCodeAt(0))
|
||||
);
|
||||
const iv = new Uint8Array(
|
||||
atob(message.iv).split("").map(c => c.charCodeAt(0))
|
||||
);
|
||||
const ciphertext = new Uint8Array(
|
||||
atob(message.ciphertext).split("").map(c => c.charCodeAt(0))
|
||||
);
|
||||
|
||||
// Derive shared secret from ECDH
|
||||
const shared = ecdhSharedSecret(this.privateKey, senderPublicKey);
|
||||
|
||||
// Derive wrapping key from shared secret using salt from message
|
||||
const wkRaw = await deriveWrappingKey(shared, salt, new Uint8Array([1]));
|
||||
const wk = await importAesGcmKey(wkRaw);
|
||||
|
||||
// Decrypt (unwrap) the message key
|
||||
const mk = await aesGcmDecrypt(wk, iv2, wrappedMk);
|
||||
|
||||
// Decrypt the message with message key
|
||||
const decrypted = await aesGcmDecrypt(await importAesGcmKey(mk), iv, ciphertext);
|
||||
|
||||
return new TextDecoder().decode(decrypted);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
/**
|
||||
* Encrypted message format
|
||||
*/
|
||||
export interface EncryptedMessage {
|
||||
iv: string; // Base64 encoded IV for message encryption
|
||||
ciphertext: string; // Base64 encoded encrypted message
|
||||
salt: string; // Base64 encoded salt for wrapping key derivation
|
||||
iv2: string; // Base64 encoded IV for message key wrapping
|
||||
wrappedMk: string; // Base64 encoded wrapped message key
|
||||
}
|
||||
Reference in New Issue
Block a user