Completed noise handshake

src/noise_protocol.go

@@ -9,9 +9,11 @@ import (
 )
 
 const (
-	HandshakeInitialCreated = iota
+	HandshakeReset = iota
+	HandshakeInitialCreated
 	HandshakeInitialConsumed
 	HandshakeResponseCreated
+	HandshakeResponseConsumed
 )
 
 const (
@@ -71,7 +73,6 @@ type Handshake struct {
 }
 
 var (
-	EmptyMessage   []byte
 	ZeroNonce      [chacha20poly1305.NonceSize]byte
 	InitalChainKey [blake2s.Size]byte
 	InitalHash     [blake2s.Size]byte
@@ -82,6 +83,14 @@ func init() {
 	InitalHash = blake2s.Sum256(append(InitalChainKey[:], []byte(WGIdentifier)...))
 }
 
+func addToChainKey(c [blake2s.Size]byte, data []byte) [blake2s.Size]byte {
+	return KDF1(c[:], data)
+}
+
+func addToHash(h [blake2s.Size]byte, data []byte) [blake2s.Size]byte {
+	return blake2s.Sum256(append(h[:], data...))
+}
+
 func (h *Handshake) addToHash(data []byte) {
 	h.hash = addToHash(h.hash, data)
 }
@@ -90,11 +99,6 @@ func (h *Handshake) addToChainKey(data []byte) {
 	h.chainKey = addToChainKey(h.chainKey, data)
 }
 
-func (device *Device) Precompute(peer *Peer) {
-	h := &peer.handshake
-	h.precomputedStaticStatic = device.privateKey.sharedSecret(h.remoteStatic)
-}
-
 func (device *Device) CreateMessageInitial(peer *Peer) (*MessageInital, error) {
 	handshake := &peer.handshake
 	handshake.mutex.Lock()
@@ -116,16 +120,17 @@ func (device *Device) CreateMessageInitial(peer *Peer) (*MessageInital, error) {
 
 	msg.Type = MessageInitalType
 	msg.Ephemeral = handshake.localEphemeral.publicKey()
-	msg.Sender, err = device.indices.NewIndex(handshake)
+	handshake.localIndex, err = device.indices.NewIndex(peer)
 
 	if err != nil {
 		return nil, err
 	}
 
+	msg.Sender = handshake.localIndex
 	handshake.addToChainKey(msg.Ephemeral[:])
 	handshake.addToHash(msg.Ephemeral[:])
 
-	// encrypt long-term "identity key"
+	// encrypt identity key
 
 	func() {
 		var key [chacha20poly1305.KeySize]byte
@@ -221,6 +226,7 @@ func (device *Device) ConsumeMessageInitial(msg *MessageInital) *Peer {
 	handshake.chainKey = chainKey
 	handshake.remoteIndex = msg.Sender
 	handshake.remoteEphemeral = msg.Ephemeral
+	handshake.lastTimestamp = timestamp
 	handshake.state = HandshakeInitialConsumed
 	return peer
 }
@@ -237,14 +243,16 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
 	// assign index
 
 	var err error
-	var msg MessageResponse
-	msg.Type = MessageResponseType
-	msg.Sender, err = device.indices.NewIndex(handshake)
-	msg.Reciever = handshake.remoteIndex
+	handshake.localIndex, err = device.indices.NewIndex(peer)
 	if err != nil {
 		return nil, err
 	}
 
+	var msg MessageResponse
+	msg.Type = MessageResponseType
+	msg.Sender = handshake.localIndex
+	msg.Reciever = handshake.remoteIndex
+
 	// create ephemeral key
 
 	handshake.localEphemeral, err = newPrivateKey()
@@ -252,6 +260,7 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
 		return nil, err
 	}
 	msg.Ephemeral = handshake.localEphemeral.publicKey()
+	handshake.addToHash(msg.Ephemeral[:])
 
 	func() {
 		ss := handshake.localEphemeral.sharedSecret(handshake.remoteEphemeral)
@@ -269,9 +278,97 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
 
 	func() {
 		aead, _ := chacha20poly1305.New(key[:])
-		aead.Seal(msg.Empty[:0], ZeroNonce[:], EmptyMessage, handshake.hash[:])
+		aead.Seal(msg.Empty[:0], ZeroNonce[:], nil, handshake.hash[:])
 		handshake.addToHash(msg.Empty[:])
 	}()
 
+	handshake.state = HandshakeResponseCreated
 	return &msg, nil
 }
+
+func (device *Device) ConsumeMessageResponse(msg *MessageResponse) *Peer {
+	if msg.Type != MessageResponseType {
+		panic(errors.New("bug: invalid message type"))
+	}
+
+	// lookup handshake by reciever
+
+	peer := device.indices.LookupHandshake(msg.Reciever)
+	if peer == nil {
+		return nil
+	}
+	handshake := &peer.handshake
+	handshake.mutex.Lock()
+	defer handshake.mutex.Unlock()
+	if handshake.state != HandshakeInitialCreated {
+		return nil
+	}
+
+	// finish 3-way DH
+
+	hash := addToHash(handshake.hash, msg.Ephemeral[:])
+	chainKey := handshake.chainKey
+
+	func() {
+		ss := handshake.localEphemeral.sharedSecret(msg.Ephemeral)
+		chainKey = addToChainKey(chainKey, ss[:])
+		ss = device.privateKey.sharedSecret(msg.Ephemeral)
+		chainKey = addToChainKey(chainKey, ss[:])
+	}()
+
+	// add preshared key (psk)
+
+	var tau [blake2s.Size]byte
+	var key [chacha20poly1305.KeySize]byte
+	chainKey, tau, key = KDF3(chainKey[:], handshake.presharedKey[:])
+	hash = addToHash(hash, tau[:])
+
+	// authenticate
+
+	aead, _ := chacha20poly1305.New(key[:])
+	_, err := aead.Open(nil, ZeroNonce[:], msg.Empty[:], hash[:])
+	if err != nil {
+		return nil
+	}
+	hash = addToHash(hash, msg.Empty[:])
+
+	// update handshake state
+
+	handshake.hash = hash
+	handshake.chainKey = chainKey
+	handshake.remoteIndex = msg.Sender
+	handshake.state = HandshakeResponseConsumed
+
+	return peer
+}
+
+func (peer *Peer) NewKeyPair() *KeyPair {
+	handshake := &peer.handshake
+	handshake.mutex.Lock()
+	defer handshake.mutex.Unlock()
+
+	// derive keys
+
+	var sendKey [chacha20poly1305.KeySize]byte
+	var recvKey [chacha20poly1305.KeySize]byte
+
+	if handshake.state == HandshakeResponseConsumed {
+		sendKey, recvKey = KDF2(handshake.chainKey[:], nil)
+	} else if handshake.state == HandshakeResponseCreated {
+		recvKey, sendKey = KDF2(handshake.chainKey[:], nil)
+	} else {
+		return nil
+	}
+
+	// create AEAD instances
+
+	var keyPair KeyPair
+	keyPair.send, _ = chacha20poly1305.New(sendKey[:])
+	keyPair.recv, _ = chacha20poly1305.New(recvKey[:])
+	keyPair.sendNonce = 0
+	keyPair.recvNonce = 0
+
+	peer.handshake.state = HandshakeReset
+
+	return &keyPair
+}