From 594f13e974f46cf5c02cae4fcc13b4bd1adec8dc Mon Sep 17 00:00:00 2001 From: Alex Emmet <111742636+Alex-Emmet@users.noreply.github.com> Date: Fri, 3 Jul 2026 06:28:08 +0200 Subject: [PATCH] Updated Crypto to use MTP-Crypto --- .gitignore | 4 +- Cargo.lock | 444 ++++++++++++++++++++++++++-------- Cargo.toml | 12 +- src/main.rs | 37 +-- src/omega/omega_connection.rs | 27 +-- src/rho/connection.rs | 116 ++++++--- src/rho/iota_connection.rs | 11 +- src/util/crypto_helper.rs | 149 ------------ src/util/crypto_util.rs | 178 -------------- src/util/mod.rs | 2 - 10 files changed, 466 insertions(+), 514 deletions(-) delete mode 100755 src/util/crypto_helper.rs delete mode 100644 src/util/crypto_util.rs diff --git a/.gitignore b/.gitignore index 1baef92..595e4ab 100644 --- a/.gitignore +++ b/.gitignore @@ -15,5 +15,5 @@ target # Added by cargo -/target -/logs +**/target +**/logs diff --git a/Cargo.lock b/Cargo.lock index 6567e4d..eaed133 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -12,31 +12,6 @@ dependencies = [ "generic-array", ] -[[package]] -name = "aes" -version = "0.8.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" -dependencies = [ - "cfg-if", - "cipher", - "cpufeatures 0.2.17", -] - -[[package]] -name = "aes-gcm" -version = "0.10.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" -dependencies = [ - "aead", - "aes", - "cipher", - "ctr", - "ghash", - "subtle", -] - [[package]] name = "aho-corasick" version = "1.1.4" @@ -277,9 +252,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -288,14 +263,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -310,6 +286,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64ct" +version = "1.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06" + [[package]] name = "bit-vec" version = "0.9.1" @@ -413,6 +395,30 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818" +dependencies = [ + "cfg-if", + "cipher", + "cpufeatures 0.2.17", +] + +[[package]] +name = "chacha20poly1305" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35" +dependencies = [ + "aead", + "chacha20", + "cipher", + "poly1305", + "zeroize", +] + [[package]] name = "chrono" version = "0.4.45" @@ -430,6 +436,7 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" dependencies = [ "crypto-common 0.1.7", "inout", + "zeroize", ] [[package]] @@ -466,6 +473,12 @@ dependencies = [ "crossbeam-utils", ] +[[package]] +name = "const-oid" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" + [[package]] name = "const-oid" version = "0.10.2" @@ -553,16 +566,9 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ + "getrandom 0.4.3", "hybrid-array", -] - -[[package]] -name = "ctr" -version = "0.9.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835" -dependencies = [ - "cipher", + "rand_core 0.10.1", ] [[package]] @@ -574,6 +580,33 @@ dependencies = [ "cmov", ] +[[package]] +name = "curve25519-dalek" +version = "4.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" +dependencies = [ + "cfg-if", + "cpufeatures 0.2.17", + "curve25519-dalek-derive", + "digest 0.10.7", + "fiat-crypto", + "rustc_version", + "subtle", + "zeroize", +] + +[[package]] +name = "curve25519-dalek-derive" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "dashmap" version = "6.2.1" @@ -594,6 +627,27 @@ version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8" +[[package]] +name = "der" +version = "0.7.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" +dependencies = [ + "const-oid 0.9.6", + "pem-rfc7468", + "zeroize", +] + +[[package]] +name = "der" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "71fd89660b2dc699704064e59e9dba0147b903e85319429e131620d022be411b" +dependencies = [ + "const-oid 0.10.2", + "zeroize", +] + [[package]] name = "der-parser" version = "10.0.0" @@ -647,7 +701,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer 0.12.1", - "const-oid", + "const-oid 0.10.2", "crypto-common 0.2.2", "ctutils", ] @@ -686,14 +740,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" [[package]] -name = "ed448-goldilocks" -version = "0.7.2" +name = "ed25519" +version = "2.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87b5fa9e9e3dd5fe1369f380acd3dcdfa766dbd0a1cd5b048fb40e38a6a78e79" +checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" dependencies = [ - "fiat-crypto", - "hex", + "pkcs8 0.10.2", + "signature 2.2.0", +] + +[[package]] +name = "ed25519-dalek" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" +dependencies = [ + "curve25519-dalek", + "ed25519", + "serde", + "sha2 0.10.9", "subtle", + "zeroize", ] [[package]] @@ -765,9 +832,9 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6" [[package]] name = "fiat-crypto" -version = "0.1.20" +version = "0.2.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77" +checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" [[package]] name = "find-msvc-tools" @@ -958,16 +1025,7 @@ dependencies = [ "cfg-if", "libc", "r-efi 6.0.0", -] - -[[package]] -name = "ghash" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1" -dependencies = [ - "opaque-debug", - "polyval", + "rand_core 0.10.1", ] [[package]] @@ -1012,12 +1070,6 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" -[[package]] -name = "hex" -version = "0.4.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" - [[package]] name = "hickory-proto" version = "0.25.2" @@ -1142,6 +1194,7 @@ version = "0.4.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c" dependencies = [ + "ctutils", "typenum", ] @@ -1451,10 +1504,29 @@ dependencies = [ "js-sys", "serde", "serde_json", - "signature", + "signature 2.2.0", "zeroize", ] +[[package]] +name = "keccak" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653" +dependencies = [ + "cpufeatures 0.2.17", +] + +[[package]] +name = "keccak" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", +] + [[package]] name = "kv-log-macro" version = "1.0.7" @@ -1512,7 +1584,7 @@ dependencies = [ "serde", "serde_json", "sha2 0.10.9", - "signature", + "signature 2.2.0", "thiserror 2.0.18", "tokio-tungstenite", "url", @@ -1520,9 +1592,9 @@ dependencies = [ [[package]] name = "livekit-protocol" -version = "0.7.9" +version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35609e3b2a077801c198f4f3de70f6cee4f2ba189d02b8876b99b96be43d0284" +checksum = "4d26880e94e2f9bab298445e7d86a3794453d211a12ddbd051bd9991a343f9ff" dependencies = [ "pbjson", "pbjson-types", @@ -1577,6 +1649,59 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "ml-dsa" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "add6b9d92e496f16f4526d68ff29da1483aba4b119baeab8bed3b9e3544a6f3d" +dependencies = [ + "const-oid 0.10.2", + "crypto-common 0.2.2", + "ctutils", + "hybrid-array", + "module-lattice", + "pkcs8 0.11.0", + "shake", + "signature 3.0.0", +] + +[[package]] +name = "mlkem-rs" +version = "0.8.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b0965b8b081668ff0398dc5e9dc3f2ebb9e833393f4ab5b9f725ddce11acef8" +dependencies = [ + "rand_core 0.6.4", + "serde", + "sha3", + "subtle", + "zeroize", +] + +[[package]] +name = "mlkem-tls" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77b205d031298adf904d88efd6a57862d8650a4ab754aade19a9b5e87040bf4e" +dependencies = [ + "mlkem-rs", + "rand_core 0.6.4", + "subtle", + "x25519-dalek", + "zeroize", +] + +[[package]] +name = "module-lattice" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe" +dependencies = [ + "ctutils", + "hybrid-array", + "num-traits", +] + [[package]] name = "moka" version = "0.12.15" @@ -1597,11 +1722,12 @@ dependencies = [ [[package]] name = "mtp" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "mtp-client", "mtp-codec", "mtp-common", + "mtp-crypto", "mtp-host", "mtp-transport", "mtp-type-map", @@ -1610,10 +1736,11 @@ dependencies = [ [[package]] name = "mtp-client" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "mtp-codec", "mtp-common", + "mtp-crypto", "mtp-transport", "rand 0.8.6", "tokio", @@ -1622,11 +1749,12 @@ dependencies = [ [[package]] name = "mtp-codec" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "base64 0.22.1", "byteorder", "mtp-common", + "mtp-crypto", "mtp-type-map", "rand 0.8.6", ] @@ -1634,7 +1762,7 @@ dependencies = [ [[package]] name = "mtp-common" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "quinn", "rustls", @@ -1642,13 +1770,32 @@ dependencies = [ "wtransport", ] +[[package]] +name = "mtp-crypto" +version = "0.1.0" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" +dependencies = [ + "chacha20poly1305", + "ed25519-dalek", + "getrandom 0.4.3", + "hkdf", + "ml-dsa", + "mlkem-tls", + "rand_core 0.6.4", + "serde", + "sha2 0.11.0", + "thiserror 1.0.69", + "zeroize", +] + [[package]] name = "mtp-host" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "mtp-codec", "mtp-common", + "mtp-crypto", "mtp-transport", "rand 0.8.6", "tokio", @@ -1657,7 +1804,7 @@ dependencies = [ [[package]] name = "mtp-transport" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "log", "mtp-codec", @@ -1671,7 +1818,7 @@ dependencies = [ [[package]] name = "mtp-type-map" version = "0.1.0" -source = "git+https://git.methanium.net/Methanium/mtp.git#15cc1d4c5e6a917f197ebf6685c8cea4e3ab668f" +source = "git+https://git.methanium.net/Methanium/mtp.git#56903049b66d67a5a34f8b6fb78820f19771f2f4" dependencies = [ "serde", "serde_yaml", @@ -1934,15 +2081,12 @@ dependencies = [ name = "omikron" version = "0.1.0" dependencies = [ - "aes-gcm", "ansi_term", "base64 0.22.1", "dashmap", "dotenv", "futures", - "hex", "hickory-resolver", - "hkdf", "json", "livekit-api", "livekit-protocol", @@ -1950,17 +2094,14 @@ dependencies = [ "mtp", "once_cell", "rand 0.8.6", - "rand_core 0.6.4", "rustls", "serde", "serde_json", - "sha2 0.11.0", "strum", "strum_macros", "thiserror 2.0.18", "tokio", "uuid", - "x448", ] [[package]] @@ -2114,6 +2255,15 @@ dependencies = [ "serde_core", ] +[[package]] +name = "pem-rfc7468" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412" +dependencies = [ + "base64ct", +] + [[package]] name = "percent-encoding" version = "2.3.2" @@ -2153,6 +2303,26 @@ dependencies = [ "futures-io", ] +[[package]] +name = "pkcs8" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" +dependencies = [ + "der 0.7.10", + "spki 0.7.3", +] + +[[package]] +name = "pkcs8" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7" +dependencies = [ + "der 0.8.0", + "spki 0.8.0", +] + [[package]] name = "pkg-config" version = "0.3.33" @@ -2174,12 +2344,11 @@ dependencies = [ ] [[package]] -name = "polyval" -version = "0.6.2" +name = "poly1305" +version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25" +checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf" dependencies = [ - "cfg-if", "cpufeatures 0.2.17", "opaque-debug", "universal-hash", @@ -2405,12 +2574,6 @@ dependencies = [ "rand_core 0.9.5", ] -[[package]] -name = "rand_core" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19" - [[package]] name = "rand_core" version = "0.6.4" @@ -2429,6 +2592,12 @@ dependencies = [ "getrandom 0.3.4", ] +[[package]] +name = "rand_core" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + [[package]] name = "rcgen" version = "0.14.8" @@ -2542,6 +2711,15 @@ version = "2.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe" +[[package]] +name = "rustc_version" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92" +dependencies = [ + "semver", +] + [[package]] name = "rusticata-macros" version = "4.1.0" @@ -2594,9 +2772,9 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.14.1" +version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9" +checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046" dependencies = [ "web-time", "zeroize", @@ -2673,6 +2851,12 @@ dependencies = [ "libc", ] +[[package]] +name = "semver" +version = "1.0.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" + [[package]] name = "serde" version = "1.0.228" @@ -2774,6 +2958,27 @@ dependencies = [ "digest 0.11.3", ] +[[package]] +name = "sha3" +version = "0.10.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874" +dependencies = [ + "digest 0.10.7", + "keccak 0.1.6", +] + +[[package]] +name = "shake" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a" +dependencies = [ + "digest 0.11.3", + "keccak 0.2.0", + "sponge-cursor", +] + [[package]] name = "shlex" version = "2.0.1" @@ -2799,6 +3004,16 @@ dependencies = [ "rand_core 0.6.4", ] +[[package]] +name = "signature" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5" +dependencies = [ + "digest 0.11.3", + "rand_core 0.10.1", +] + [[package]] name = "slab" version = "0.4.12" @@ -2821,6 +3036,32 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "spki" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" +dependencies = [ + "base64ct", + "der 0.7.10", +] + +[[package]] +name = "spki" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f" +dependencies = [ + "base64ct", + "der 0.8.0", +] + +[[package]] +name = "sponge-cursor" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620" + [[package]] name = "stable_deref_trait" version = "1.2.1" @@ -2943,9 +3184,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.51" +version = "0.3.53" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327" +checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50" dependencies = [ "deranged", "num-conv", @@ -2963,9 +3204,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" [[package]] name = "time-macros" -version = "0.2.30" +version = "0.2.31" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935" +checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f" dependencies = [ "num-conv", "time-core", @@ -3721,14 +3962,15 @@ dependencies = [ ] [[package]] -name = "x448" -version = "0.6.0" +name = "x25519-dalek" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4cd07d4fae29e07089dbcacf7077cd52dce7760125ca9a4dd5a35ca603ffebb" +checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277" dependencies = [ - "ed448-goldilocks", - "hex", - "rand_core 0.5.1", + "curve25519-dalek", + "rand_core 0.6.4", + "serde", + "zeroize", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 665c0a6..d633517 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,30 +4,28 @@ version = "0.1.0" edition = "2024" [dependencies] -mtp = { git = "https://git.methanium.net/Methanium/mtp.git", features = ["host", "client"] } +mtp = { git = "https://git.methanium.net/Methanium/mtp.git", features = [ + "host", + "client", + "crypto", +] } ansi_term = "*" uuid = { version = "*", features = ["v4"] } base64 = "0.22.1" dashmap = "*" futures = "*" -hex = "*" once_cell = "1.21.4" rand = "0.8" -rand_core = { version = "0.6", features = ["getrandom", "std"] } rustls = { version = "0.23.40", default-features = false, features = [ "std", "tls12", "aws-lc-rs", "prefer-post-quantum", ] } -aes-gcm = "0.10.3" -sha2 = "0.11.0" tokio = { version = "*", features = ["full"] } -x448 = { version = "*" } log = "0.4" dotenv = "0.15.0" -hkdf = "0.13" strum = "0.28.0" strum_macros = "0.28.0" livekit-api = { version = "0.5.0", features = ["native-tls"] } diff --git a/src/main.rs b/src/main.rs index c14b222..8476240 100644 --- a/src/main.rs +++ b/src/main.rs @@ -11,28 +11,37 @@ use std::path::PathBuf; use dotenv::dotenv; use once_cell::sync::Lazy; -pub static WORKING_DIR: Lazy = Lazy::new(|| { - std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")) -}); +pub static WORKING_DIR: Lazy = + Lazy::new(|| std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."))); use rustls::crypto::aws_lc_rs::default_provider; +use base64::engine::general_purpose::STANDARD as BASE64_STD; +use base64::Engine as _; +use mtp::crypto::Keyring; + use crate::{ calls::call_util::garbage_collect_calls, omega::omega_connection::get_omega_connection, rho::server::start, - util::{ - crypto_helper::{load_public_key, load_secret_key}, - logger::startup, - }, + util::logger::startup, }; -static PRIVATE_KEY: Lazy = Lazy::new(|| env::var("PRIVATE_KEY").unwrap()); -pub fn get_private_key() -> x448::Secret { - load_secret_key(&*PRIVATE_KEY).unwrap() -} -static PUBLIC_KEY: Lazy = Lazy::new(|| env::var("PUBLIC_KEY").unwrap()); -pub fn get_public_key() -> x448::PublicKey { - load_public_key(&*PUBLIC_KEY).unwrap() +static KEYRING: Lazy = Lazy::new(|| { + if let Ok(encoded) = env::var("KEYRING") { + let bytes = BASE64_STD.decode(&encoded).expect("Invalid KEYRING base64"); + Keyring::from_bytes(&bytes).expect("Invalid KEYRING data") + } else { + let kr = Keyring::generate(); + eprintln!( + "Generated KEYRING (save to env): {}", + BASE64_STD.encode(&kr.to_bytes()) + ); + kr + } +}); + +pub fn get_keyring() -> &'static Keyring { + &KEYRING } #[tokio::main] diff --git a/src/omega/omega_connection.rs b/src/omega/omega_connection.rs index 5c6c66f..2cca4f7 100644 --- a/src/omega/omega_connection.rs +++ b/src/omega/omega_connection.rs @@ -1,9 +1,12 @@ +use base64::engine::general_purpose::STANDARD as BASE64_STD; +use base64::Engine as _; +use mtp::crypto::decrypt_with; + use crate::{ data::user::UserStatus, - get_private_key, log, log_cv_in, log_cv_out, log_err, log_in, + get_keyring, log, log_cv_in, log_cv_out, log_err, log_in, rho::rho_manager::{self, RHO_CONNECTIONS, connection_count}, util::{ - crypto_helper::{decrypt_b64, secret_key_to_base64}, file_util::load_file_vec, logger::PrintType, }, @@ -389,22 +392,18 @@ impl OmegaConnection { } async fn handle_challenge(&self, cv: CommunicationValue) -> Result<(), String> { - let challenge = cv + let challenge_b64 = cv .get_data(DataType::Challenge) .as_str() .ok_or("Challenge not found")?; - let server_pub_key = cv - .get_data(DataType::PublicKey) - .as_str() - .ok_or("Public key not found")?; - - let decrypted_challenge = decrypt_b64( - &secret_key_to_base64(&get_private_key()), - server_pub_key, - challenge, - ) - .map_err(|e| format!("Decryption failed: {:?}", e))?; + let blob = BASE64_STD + .decode(challenge_b64) + .map_err(|e| format!("Base64 decode failed: {}", e))?; + let decrypted = decrypt_with(&blob, get_keyring(), b"challenge") + .map_err(|e| format!("Decryption failed: {:?}", e))?; + let decrypted_challenge = + String::from_utf8(decrypted).map_err(|_| "Decrypted challenge not valid UTF-8")?; let response_msg = CommunicationValue::new(CommunicationType::ChallengeResponse) .with_id(cv.get_id()) diff --git a/src/rho/connection.rs b/src/rho/connection.rs index f6aeeda..7da7cc1 100755 --- a/src/rho/connection.rs +++ b/src/rho/connection.rs @@ -5,20 +5,23 @@ use std::{collections::BTreeMap, collections::HashMap, sync::Arc, time::Duration use tokio::sync::RwLock; use uuid::Uuid; +use base64::engine::general_purpose::STANDARD as BASE64_STD; +use base64::Engine as _; +use mtp::crypto::{ + encrypt_for, EncryptionType, KemPublicKey, PublicKeyBundle, SignaturePqPublicKey, + SignaturePublicKey, +}; + use crate::{ anonymous_clients::anonymous_client_connection::AnonymousClientConnection, calls::call_manager, - get_private_key, get_public_key, log_cv_in, log_cv_out, log_err, log_in, log_out, + get_keyring, log_cv_in, log_cv_out, log_err, log_in, log_out, omega::omega_connection::get_omega_connection, rho::{ app_connection::AppConnection, client_connection::ClientConnection, iota_connection::IotaConnection, rho_connection::RhoConnection, rho_manager, }, - util::{ - crypto_helper::{load_public_key, public_key_to_base64}, - crypto_util::{DataFormat, SecurePayload}, - logger::PrintType, - }, + util::logger::PrintType, }; #[derive(Debug, Clone, Copy, PartialEq, Eq)] @@ -146,11 +149,11 @@ impl GeneralConnection { *self.app_session.write().await = Some(app_session_id); *self.connection_kind.write().await = Some(ConnectionKind::Phi); - let pub_key = match load_public_key(pub_key_str) { - Some(pk) => pk, - None => return, + let kem_bytes = match BASE64_STD.decode(pub_key_str) { + Ok(b) => b, + Err(_) => return, }; - *self.pub_key.write().await = Some(pub_key.as_bytes().to_vec()); + *self.pub_key.write().await = Some(kem_bytes.clone()); let challenge: String = rand::thread_rng() .sample_iter(&Alphanumeric) @@ -161,18 +164,29 @@ impl GeneralConnection { *self.challenge.write().await = challenge.clone(); *self.identified.write().await = true; - let encrypted_challenge = - SecurePayload::new(challenge.as_bytes(), DataFormat::Raw, get_private_key()) - .unwrap() - .encrypt_x448(pub_key) - .unwrap() - .export(DataFormat::Base64); + let peer_bundle = PublicKeyBundle::new( + KemPublicKey::new(kem_bytes), + SignaturePqPublicKey::new(vec![]), + SignaturePublicKey::new(vec![]), + ); + let encrypted_challenge = BASE64_STD.encode( + &encrypt_for( + EncryptionType::MlKemChaCha20Poly1305, + &peer_bundle, + challenge.as_bytes(), + b"challenge", + ) + .unwrap(), + ); + let our_pk = BASE64_STD.encode( + get_keyring().public_key_bundle().kem_public_key.as_bytes(), + ); let response = CommunicationValue::new(CommunicationType::AppChallenge) .with_id(cv.get_id()) .add_typed_default( DataType::PublicKey, - DataValue::Str(public_key_to_base64(&get_public_key())), + DataValue::Str(our_pk), ) .add_typed_default(DataType::Challenge, DataValue::Str(encrypted_challenge)); @@ -214,20 +228,20 @@ impl GeneralConnection { .as_str() .unwrap_or(""); - let pub_key = match load_public_key(base64_pub) { - Some(pk) => pk, - None => { + let kem_bytes = match BASE64_STD.decode(base64_pub) { + Ok(b) => b, + Err(_) => { log_err!( *iota_id as i64, PrintType::Iota, - "Failed to load public key for iota_id={}", + "Failed to decode public key for iota_id={}", iota_id ); return; } }; - *self.pub_key.write().await = Some(pub_key.as_bytes().to_vec()); + *self.pub_key.write().await = Some(kem_bytes.clone()); let challenge: String = rand::thread_rng() .sample_iter(&Alphanumeric) @@ -238,18 +252,29 @@ impl GeneralConnection { *self.challenge.write().await = challenge.clone(); *self.identified.write().await = true; - let encrypted_challenge = - SecurePayload::new(challenge.as_bytes(), DataFormat::Raw, get_private_key()) - .unwrap() - .encrypt_x448(pub_key) - .unwrap() - .export(DataFormat::Base64); + let peer_bundle = PublicKeyBundle::new( + KemPublicKey::new(kem_bytes), + SignaturePqPublicKey::new(vec![]), + SignaturePublicKey::new(vec![]), + ); + let encrypted_challenge = BASE64_STD.encode( + &encrypt_for( + EncryptionType::MlKemChaCha20Poly1305, + &peer_bundle, + challenge.as_bytes(), + b"challenge", + ) + .unwrap(), + ); + let our_pk = BASE64_STD.encode( + get_keyring().public_key_bundle().kem_public_key.as_bytes(), + ); let response = CommunicationValue::new(CommunicationType::Challenge) .with_id(cv.get_id()) .add_typed_default( DataType::PublicKey, - DataValue::Str(public_key_to_base64(&get_public_key())), + DataValue::Str(our_pk), ) .add_typed_default(DataType::Challenge, DataValue::Str(encrypted_challenge)); @@ -306,14 +331,14 @@ impl GeneralConnection { .to_string(); } - let pub_key = match load_public_key(&base64_pub) { - Some(pk) => pk, - None => { + let kem_bytes = match BASE64_STD.decode(&base64_pub) { + Ok(b) => b, + Err(_) => { return; } }; - *self.pub_key.write().await = Some(pub_key.as_bytes().to_vec()); + *self.pub_key.write().await = Some(kem_bytes.clone()); let challenge: String = rand::thread_rng() .sample_iter(&Alphanumeric) @@ -324,12 +349,20 @@ impl GeneralConnection { *self.challenge.write().await = challenge.clone(); *self.identified.write().await = true; - let encrypted_challenge = - SecurePayload::new(challenge.as_bytes(), DataFormat::Raw, get_private_key()) - .unwrap() - .encrypt_x448(pub_key) - .unwrap() - .export(DataFormat::Base64); + let peer_bundle = PublicKeyBundle::new( + KemPublicKey::new(kem_bytes), + SignaturePqPublicKey::new(vec![]), + SignaturePublicKey::new(vec![]), + ); + let encrypted_challenge = BASE64_STD.encode( + &encrypt_for( + EncryptionType::MlKemChaCha20Poly1305, + &peer_bundle, + challenge.as_bytes(), + b"challenge", + ) + .unwrap(), + ); let challenge_type = if cv.is_type(CommunicationType::AppIdentification) { CommunicationType::AppChallenge @@ -337,12 +370,15 @@ impl GeneralConnection { CommunicationType::Challenge }; + let our_pk = BASE64_STD.encode( + get_keyring().public_key_bundle().kem_public_key.as_bytes(), + ); let response = CommunicationValue::new(challenge_type) .with_id(cv.get_id()) .with_receiver(*self.session_id.read().await) .add_typed_default( DataType::PublicKey, - DataValue::Str(public_key_to_base64(&get_public_key())), + DataValue::Str(our_pk), ) .add_typed_default(DataType::Challenge, DataValue::Str(encrypted_challenge)); diff --git a/src/rho/iota_connection.rs b/src/rho/iota_connection.rs index 6839f1f..35c2b2d 100755 --- a/src/rho/iota_connection.rs +++ b/src/rho/iota_connection.rs @@ -20,7 +20,7 @@ use std::collections::BTreeMap; use std::{collections::HashMap, sync::Arc, time::Duration}; use tokio::sync::RwLock; use tokio::sync::mpsc; -use x448::PublicKey; +use mtp::crypto::KemPublicKey; use super::{rho_connection::RhoConnection, rho_manager}; use crate::omega::omega_connection::OmegaConnection; @@ -79,12 +79,9 @@ impl IotaConnection { } #[allow(dead_code)] - pub async fn get_public_key(&self) -> Option { - if let Some(public_key) = self.pub_key.read().await.clone() { - PublicKey::from_bytes(&public_key) - } else { - None - } + pub async fn get_public_key(&self) -> Option { + let guard = self.pub_key.read().await; + guard.as_ref().map(|bytes| KemPublicKey::new(bytes.clone())) } /// Get the user IDs diff --git a/src/util/crypto_helper.rs b/src/util/crypto_helper.rs deleted file mode 100755 index cb3ae6a..0000000 --- a/src/util/crypto_helper.rs +++ /dev/null @@ -1,149 +0,0 @@ -use aes_gcm::{ - Aes256Gcm, Nonce, - aead::{Aead, KeyInit, OsRng}, -}; -use base64::{Engine as _, engine::general_purpose::STANDARD}; -use rand_core::RngCore; -use sha2::{Digest, Sha256}; -use x448::{PublicKey, Secret, SharedSecret}; - -/// Errors for crypto operations -#[allow(dead_code)] -#[derive(Debug)] -pub enum CryptoError { - Base64Decode(base64::DecodeError), - InvalidKey, - AgreementError, - EncryptionError(aes_gcm::Error), - DecryptionError(aes_gcm::Error), -} - -impl From for CryptoError { - fn from(err: base64::DecodeError) -> Self { - CryptoError::Base64Decode(err) - } -} - -#[allow(dead_code)] -pub struct KeyPair { - pub secret: Secret, - pub public: PublicKey, -} - -#[allow(dead_code)] -pub fn generate_keypair() -> KeyPair { - let mut buf = [0u8; 56]; - let mut rng = OsRng; - rng.fill_bytes(&mut buf); - let secret = Secret::from_bytes(&buf).unwrap(); - let public = PublicKey::from(&secret); - KeyPair { secret, public } -} - -pub fn public_key_to_base64(pubkey: &PublicKey) -> String { - STANDARD.encode(pubkey.as_bytes().as_ref()) -} - -pub fn secret_key_to_base64(secret: &Secret) -> String { - STANDARD.encode(secret.as_bytes().as_ref()) -} - -pub fn load_public_key(base64_pub: &str) -> Option { - let bytes = STANDARD.decode(base64_pub).unwrap(); - PublicKey::from_bytes(&bytes) -} - -pub fn load_secret_key(base64_secret: &str) -> Option { - let bytes = STANDARD.decode(base64_secret).unwrap(); - Secret::from_bytes(&bytes) -} - -fn derive_aes_key(shared: &SharedSecret) -> [u8; 32] { - let mut hasher = Sha256::new(); - hasher.update(shared.as_bytes()); - let result = hasher.finalize(); - let mut key = [0u8; 32]; - key.copy_from_slice(&result[..32]); - key -} - -#[allow(dead_code)] -pub fn encrypt_b64( - base64_secret: &str, - base64_peer_pub: &str, - plaintext: &str, -) -> Result { - let secret = load_secret_key(base64_secret).unwrap(); - let peer_pub = load_public_key(base64_peer_pub).unwrap(); - encrypt(secret, peer_pub, plaintext) -} -pub fn encrypt( - secret: Secret, - peer_pub: PublicKey, - plaintext: &str, -) -> Result { - let shared = secret - .to_diffie_hellman(&peer_pub) - .ok_or(CryptoError::AgreementError)?; - let key_bytes = derive_aes_key(&shared); - let cipher = Aes256Gcm::new_from_slice(&key_bytes).expect("Key length should be correct"); - let mut nonce_bytes = [0u8; 12]; - OsRng.fill_bytes(&mut nonce_bytes); - let nonce = Nonce::from_slice(&nonce_bytes); - let ciphertext = cipher - .encrypt(nonce, plaintext.as_bytes()) - .map_err(CryptoError::EncryptionError)?; - // prefix nonce to ciphertext - let mut out = Vec::with_capacity(nonce_bytes.len() + ciphertext.len()); - out.extend_from_slice(&nonce_bytes); - out.extend_from_slice(&ciphertext); - Ok(STANDARD.encode(&out)) -} - -pub fn decrypt_b64( - base64_secret: &str, - base64_peer_pub: &str, - encrypted_base64: &str, -) -> Result { - let secret = load_secret_key(base64_secret).unwrap(); - let peer_pub = load_public_key(base64_peer_pub).unwrap(); - decrypt(secret, peer_pub, encrypted_base64) -} -pub fn decrypt( - secret: Secret, - peer_pub: PublicKey, - encrypted_base64: &str, -) -> Result { - let shared = secret - .to_diffie_hellman(&peer_pub) - .ok_or(CryptoError::AgreementError)?; - let key_bytes = derive_aes_key(&shared); - let cipher = Aes256Gcm::new_from_slice(&key_bytes).expect("Key length should be correct"); - - let encrypted = STANDARD.decode(encrypted_base64)?; - if encrypted.len() < 12 { - return Err(CryptoError::DecryptionError(aes_gcm::Error)); - } - let nonce_bytes = &encrypted[..12]; - let ciphertext = &encrypted[12..]; - let nonce = Nonce::from_slice(nonce_bytes); - let plaintext_bytes = cipher - .decrypt(nonce, ciphertext) - .map_err(CryptoError::DecryptionError)?; - let plaintext = String::from_utf8(plaintext_bytes) - .map_err(|_| CryptoError::DecryptionError(aes_gcm::Error))?; - Ok(plaintext) -} - -#[allow(dead_code)] -pub fn hash_it(input: &str) -> Vec { - let mut hasher = Sha256::new(); - hasher.update(input.as_bytes()); - hasher.finalize().to_vec() -} - -#[allow(dead_code)] -pub fn hex_hash(input: &str) -> String { - let digest = hash_it(input); - digest.iter().map(|b| format!("{:02x}", b)).collect() -} diff --git a/src/util/crypto_util.rs b/src/util/crypto_util.rs deleted file mode 100644 index bb784e8..0000000 --- a/src/util/crypto_util.rs +++ /dev/null @@ -1,178 +0,0 @@ -use aes_gcm::{ - Aes256Gcm, Nonce, - aead::{Aead, KeyInit, Payload}, -}; -use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STD}; -use hkdf::Hkdf; -type HkdfSha256 = sha2::Sha256; -use sha2::{Digest, Sha256 as HashSha256}; -use x448::{PublicKey, Secret}; - -#[derive(Debug)] -#[allow(dead_code)] -pub enum SecurePayloadError { - InvalidBase64, - InvalidHex, - EncryptionError, - DecryptionError, - InvalidKeyLength, -} - -#[derive(Clone, Copy, Debug)] -#[allow(dead_code)] -pub enum DataFormat { - Raw, - Base64, - Hex, -} - -pub struct SecurePayload { - inner_data: Vec, - private_key: Secret, -} - -impl Clone for SecurePayload { - fn clone(&self) -> Self { - Self { - inner_data: self.inner_data.clone(), - private_key: Secret::from_bytes(self.private_key.as_bytes()).unwrap(), - } - } -} - -#[allow(dead_code)] -impl SecurePayload { - pub fn new>( - data: T, - format: DataFormat, - private_key: S, - ) -> Result - where - S: Into, - { - let raw_data = match format { - DataFormat::Raw => data.as_ref().to_vec(), - DataFormat::Base64 => BASE64_STD - .decode(data.as_ref()) - .map_err(|_| SecurePayloadError::InvalidBase64)?, - DataFormat::Hex => { - hex::decode(data.as_ref()).map_err(|_| SecurePayloadError::InvalidHex)? - } - }; - - Ok(Self { - inner_data: raw_data, - private_key: private_key.into(), - }) - } - - pub fn get_public_key(&self) -> [u8; 56] { - *PublicKey::from(&self.private_key).as_bytes() - } - - pub fn export(&self, format: DataFormat) -> String { - match format.into() { - DataFormat::Raw => String::from_utf8_lossy(&self.inner_data).to_string(), - DataFormat::Base64 => BASE64_STD.encode(&self.inner_data), - DataFormat::Hex => hex::encode(&self.inner_data), - } - } - - pub fn get_bytes(&self) -> &[u8] { - &self.inner_data - } - - pub fn get_hash(&self, format: DataFormat) -> String { - let mut hasher = HashSha256::new(); - hasher.update(&self.inner_data); - let result = hasher.finalize(); - - match format { - DataFormat::Raw => String::from_utf8_lossy(&result).to_string(), - DataFormat::Base64 => BASE64_STD.encode(result), - DataFormat::Hex => hex::encode(result), - } - } - - pub fn encrypt_x448(&self, public_key: S) -> Result - where - S: Into, - { - let peer_pub = public_key.into(); - let shared_secret = self.private_key.as_diffie_hellman(&peer_pub).unwrap(); - - let hkdf = Hkdf::::new(None, shared_secret.as_bytes()); - let mut okm = [0u8; 44]; - - hkdf.expand(b"x448-aes-gcm-no-overhead", &mut okm) - .map_err(|_| SecurePayloadError::EncryptionError)?; - - let key = &okm[..32]; - let nonce_bytes = &okm[32..]; - - let cipher = Aes256Gcm::new(key.into()); - let nonce = Nonce::from_slice(nonce_bytes); - - let ciphertext = cipher - .encrypt( - nonce, - Payload { - msg: &self.inner_data, - aad: &[], - }, - ) - .map_err(|_| SecurePayloadError::EncryptionError)?; - - Ok(SecurePayload { - inner_data: ciphertext, - private_key: Secret::from_bytes(self.private_key.as_bytes()).unwrap(), - }) - } - - pub fn decrypt_to_format( - &self, - peer_public_key_bytes: &[u8; 56], - output_format: DataFormat, - ) -> Result { - let decrypted_instance = - self.decrypt_x448(PublicKey::from_bytes(peer_public_key_bytes).unwrap())?; - Ok(decrypted_instance.export(output_format)) - } - - pub fn decrypt_x448( - &self, - peer_public_key_bytes: S, - ) -> Result - where - S: Into, - { - let peer_pub = peer_public_key_bytes.into(); - let shared_secret = self.private_key.as_diffie_hellman(&peer_pub).unwrap(); - - let hkdf = Hkdf::::new(None, shared_secret.as_bytes()); - let mut okm = [0u8; 44]; - hkdf.expand(b"x448-aes-gcm-no-overhead", &mut okm) - .map_err(|_| SecurePayloadError::DecryptionError)?; - - let key = &okm[..32]; - let nonce_bytes = &okm[32..]; - - let cipher = Aes256Gcm::new(key.into()); - let nonce = Nonce::from_slice(nonce_bytes); - - let plaintext = cipher - .decrypt( - nonce, - Payload { - msg: &self.inner_data, - aad: &[], - }, - ) - .map_err(|_| SecurePayloadError::DecryptionError)?; - - Ok(SecurePayload { - inner_data: plaintext, - private_key: Secret::from_bytes(self.private_key.as_bytes()).unwrap(), - }) - } -} diff --git a/src/util/mod.rs b/src/util/mod.rs index 1897223..d0cc1dd 100644 --- a/src/util/mod.rs +++ b/src/util/mod.rs @@ -1,4 +1,2 @@ -pub mod crypto_helper; -pub mod crypto_util; pub mod file_util; pub mod logger;