use libsodium cryptobox / chacha20poly1305

2 files changed, 63 insertions, 160 deletions

diff --git a/src/util/Makefile.am b/src/util/Makefile.am
index 5f3b3d5..22c7a1c 100644
--- a/src/util/Makefile.am
+++ b/src/util/Makefile.am
@@ -38,6 +38,7 @@ libanastasisutil_la_SOURCES = \
 libanastasisutil_la_LIBADD = \
   -lgnunetutil \
   $(LIBGCRYPT_LIBS) \
+  -lsodium \
   -ljansson \
   -ltalerutil \
   $(XLIB)
@@ -54,15 +55,15 @@ TESTS = \
 test_anastasis_crypto_SOURCES = \
   test_anastasis_crypto.c
 test_anastasis_crypto_LDADD = \
+  $(top_builddir)/src/util/libanastasisutil.la \
   -lgnunetutil \
   -ltalerutil \
-  libanastasisutil.la \
   $(XLIB)
 
 anastasis_crypto_tvg_SOURCES = \
   anastasis-crypto-tvg.c
 anastasis_crypto_tvg_LDADD = \
-  $(top_builddir)/src/util/libanastasisutil.la \
+  libanastasisutil.la \
   -ltalerjson \
   -ltalerutil \
   -lgnunetjson \
diff --git a/src/util/anastasis_crypto.c b/src/util/anastasis_crypto.c
index 067ac92..1025e60 100644
--- a/src/util/anastasis_crypto.c
+++ b/src/util/anastasis_crypto.c
@@ -73,49 +73,38 @@ ANASTASIS_CRYPTO_secure_answer_hash (
 
 
 /**
- * Compute @a key and @a iv.
+ * Compute @a key.
  *
  * @param key_material key for calculation
  * @param key_m_len length of key
  * @param nonce nonce for calculation
  * @param salt salt value for calculation
  * @param[out] key where to write the en-/description key
- * @param[out] iv where to write the IV
  */
 static void
-get_iv_key (const void *key_material,
+derive_key (const void *key_material,
             size_t key_m_len,
             const struct ANASTASIS_CRYPTO_NonceP *nonce,
             const char *salt,
-            const struct ANASTASIS_CRYPTO_SymKeyP *key,
-            struct ANASTASIS_CRYPTO_IvP *iv)
+            struct ANASTASIS_CRYPTO_SymKeyP *key)
 {
-  char res[sizeof (struct ANASTASIS_CRYPTO_SymKeyP)
-           + sizeof (struct ANASTASIS_CRYPTO_IvP)];
 
   if (GNUNET_YES !=
-      GNUNET_CRYPTO_hkdf (res,
-                          sizeof (res),
-                          GCRY_MD_SHA512,
-                          GCRY_MD_SHA256,
-                          key_material,
-                          key_m_len,
-                          nonce,
-                          sizeof (struct ANASTASIS_CRYPTO_NonceP),
-                          salt,
-                          strlen (salt),
-                          NULL,
-                          0))
+      GNUNET_CRYPTO_kdf (key,
+                         sizeof (struct ANASTASIS_CRYPTO_SymKeyP),
+                         nonce,
+                         sizeof (struct ANASTASIS_CRYPTO_NonceP),
+                         key_material,
+                         key_m_len,
+                         salt,
+                         strlen (salt),
+                         NULL,
+                         0))
   {
+    // FIXME: Huh?!  Why would we continue here?
     GNUNET_break (0);
     return;
   }
-  memcpy ((void *) key,
-          res,
-          sizeof (*key));
-  memcpy (iv,
-          &res[sizeof (*key)],
-          sizeof (*iv));
 }
 
 
@@ -141,67 +130,25 @@ anastasis_encrypt (const struct ANASTASIS_CRYPTO_NonceP *nonce,
                    void **res,
                    size_t *res_size)
 {
-  struct ANASTASIS_CRYPTO_NonceP *nonceptr;
-  gcry_cipher_hd_t cipher;
-  struct ANASTASIS_CRYPTO_SymKeyP sym_key;
-  struct ANASTASIS_CRYPTO_IvP iv;
-  int rc;
-  struct ANASTASIS_CRYPTO_AesTagP *tag;
-  char *ciphertext;
-
-  *res_size = data_size
-              + sizeof (struct ANASTASIS_CRYPTO_NonceP)
-              + sizeof (struct ANASTASIS_CRYPTO_AesTagP);
-  if (*res_size <= data_size)
-  {
-    GNUNET_break (0);
-    return;
-  }
-  *res = GNUNET_malloc (*res_size);
-  if (*res_size != data_size
-      + sizeof (struct ANASTASIS_CRYPTO_NonceP)
-      + sizeof (struct ANASTASIS_CRYPTO_AesTagP))
-  {
-    GNUNET_break (0);
-    return;
-  }
-  nonceptr = (struct ANASTASIS_CRYPTO_NonceP *) *res;
-  tag = (struct ANASTASIS_CRYPTO_AesTagP *) &nonceptr[1];
-  ciphertext = (char *) &tag[1];
-  memcpy (nonceptr,
-          nonce,
-          sizeof (*nonce));
-  get_iv_key (key,
+  size_t ciphertext_size;
+  struct ANASTASIS_CRYPTO_SymKeyP skey;
+
+  derive_key (key,
               key_len,
               nonce,
               salt,
-              &sym_key,
-              &iv);
-  GNUNET_assert (0 ==
-                 gcry_cipher_open (&cipher,
-                                   GCRY_CIPHER_AES256,
-                                   GCRY_CIPHER_MODE_GCM,
-                                   0));
-  rc = gcry_cipher_setkey (cipher,
-                           &sym_key,
-                           sizeof (sym_key));
-  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
-  rc = gcry_cipher_setiv (cipher,
-                          &iv,
-                          sizeof (iv));
-  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
-
-  GNUNET_assert (0 ==
-                 gcry_cipher_encrypt (cipher,
-                                      ciphertext,
-                                      data_size,
-                                      data,
-                                      data_size));
+              &skey);
+  ciphertext_size = crypto_secretbox_NONCEBYTES
+                    + crypto_secretbox_MACBYTES + data_size;
+  *res_size = ciphertext_size;
+  *res = GNUNET_malloc (ciphertext_size);
+  memcpy (*res, nonce, crypto_secretbox_NONCEBYTES);
   GNUNET_assert (0 ==
-                 gcry_cipher_gettag (cipher,
-                                     tag,
-                                     sizeof (struct ANASTASIS_CRYPTO_AesTagP)));
-  gcry_cipher_close (cipher);
+                 crypto_secretbox_easy (*res + crypto_secretbox_NONCEBYTES,
+                                        data,
+                                        data_size,
+                                        (void *) nonce,
+                                        (void *) &skey));
 }
 
 
@@ -226,71 +173,30 @@ anastasis_decrypt (const void *key,
                    size_t *res_size)
 {
   const struct ANASTASIS_CRYPTO_NonceP *nonce;
-  gcry_cipher_hd_t cipher;
-  const struct ANASTASIS_CRYPTO_SymKeyP sym_key;
-  struct ANASTASIS_CRYPTO_IvP iv;
-  int rc;
-  const struct ANASTASIS_CRYPTO_AesTagP *tag;
-  const char *ciphertext;
-
-  *res_size = data_size
-              - sizeof (struct ANASTASIS_CRYPTO_NonceP)
-              - sizeof (struct ANASTASIS_CRYPTO_AesTagP);
-  if (*res_size >= data_size)
-  {
-    GNUNET_break (0);
-    *res = NULL;
-    return;
-  }
-  *res = GNUNET_malloc (*res_size);
-  if (*res_size != data_size
-      - sizeof (struct ANASTASIS_CRYPTO_NonceP)
-      - sizeof (struct ANASTASIS_CRYPTO_AesTagP))
-  {
-    GNUNET_break (0);
-    GNUNET_free (*res);
-    return;
-  }
+  struct ANASTASIS_CRYPTO_SymKeyP skey;
+  size_t plaintext_size;
 
-  nonce = (const struct ANASTASIS_CRYPTO_NonceP *) data;
-  tag = (struct ANASTASIS_CRYPTO_AesTagP *) &nonce[1];
-  ciphertext = (const char *) &tag[1];
-  get_iv_key (key,
+  GNUNET_assert (data_size >= crypto_secretbox_NONCEBYTES
+                 + crypto_secretbox_MACBYTES);
+  nonce = data;
+  derive_key (key,
               key_len,
               nonce,
               salt,
-              &sym_key,
-              &iv);
-  GNUNET_assert (0 ==
-                 gcry_cipher_open (&cipher,
-                                   GCRY_CIPHER_AES256,
-                                   GCRY_CIPHER_MODE_GCM,
-                                   0));
-  rc = gcry_cipher_setkey (cipher,
-                           &sym_key,
-                           sizeof (sym_key));
-  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
-
-  rc = gcry_cipher_setiv (cipher,
-                          &iv,
-                          sizeof (iv));
-  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
-
-  GNUNET_assert (0 == gcry_cipher_decrypt (cipher,
-                                           *res,
-                                           *res_size,
-                                           ciphertext,
-                                           *res_size));
-  if (0 !=
-      gcry_cipher_checktag (cipher,
-                            tag,
-                            sizeof (struct ANASTASIS_CRYPTO_AesTagP)))
+              &skey);
+  plaintext_size = data_size - (crypto_secretbox_NONCEBYTES
+                                + crypto_secretbox_MACBYTES);
+  *res = GNUNET_malloc (plaintext_size);
+  *res_size = plaintext_size;
+  if (0 != crypto_secretbox_open_easy (*res,
+                                       data + crypto_secretbox_NONCEBYTES,
+                                       data_size - crypto_secretbox_NONCEBYTES,
+                                       (void *) nonce,
+                                       (void *) &skey))
   {
     GNUNET_break (0);
     GNUNET_free (*res);
-    return;
   }
-  gcry_cipher_close (cipher);
 }
 
 
@@ -322,16 +228,14 @@ ANASTASIS_CRYPTO_account_private_key_derive (
 {
   /* priv_key = ver_secret */
   if (GNUNET_YES !=
-      GNUNET_CRYPTO_hkdf (&priv_key->priv,
-                          sizeof (priv_key->priv),
-                          GCRY_MD_SHA512,
-                          GCRY_MD_SHA256,
-                          id,
-                          sizeof (struct ANASTASIS_CRYPTO_UserIdentifierP),
-                          "ver",
-                          strlen ("ver"),
-                          NULL,
-                          0))
+      GNUNET_CRYPTO_kdf (&priv_key->priv,
+                         sizeof (priv_key->priv),
+                         id,
+                         sizeof (struct ANASTASIS_CRYPTO_UserIdentifierP),
+                         "ver",
+                         strlen ("ver"),
+                         NULL,
+                         0))
   {
     GNUNET_break (0);
     return;
@@ -519,15 +423,13 @@ ANASTASIS_CRYPTO_policy_key_derive (
   const struct ANASTASIS_CRYPTO_MasterSaltP *salt,
   struct ANASTASIS_CRYPTO_PolicyKeyP *policy_key)
 {
-  GNUNET_CRYPTO_hkdf (policy_key,
-                      sizeof (*policy_key),
-                      GCRY_MD_SHA512,
-                      GCRY_MD_SHA256,
-                      key_shares,
-                      keyshare_length * sizeof (*key_shares),
-                      salt,
-                      sizeof (*salt),
-                      NULL, 0);
+  GNUNET_CRYPTO_kdf (policy_key,
+                     sizeof (*policy_key),
+                     key_shares,
+                     keyshare_length * sizeof (*key_shares),
+                     salt,
+                     sizeof (*salt),
+                     NULL, 0);
 }