1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96
97. 97
98. 98
99. 99
100. 100
101. 101
102. 102
103. 103
104. 104

package packet

import (
	"bytes"
	"io"
	"math/big"

	"github.com/keybase/go-crypto/openpgp/ecdh"
	"github.com/keybase/go-crypto/openpgp/errors"
	"github.com/keybase/go-crypto/openpgp/s2k"
)

// ECDHKdfParams generates KDF parameters sequence for given
// PublicKey. See https://tools.ietf.org/html/rfc6637#section-8
func ECDHKdfParams(pub *PublicKey) []byte {
	buf := new(bytes.Buffer)
	oid := pub.ec.oid
	buf.WriteByte(byte(len(oid)))
	buf.Write(oid)
	buf.WriteByte(18) // ECDH TYPE
	pub.ecdh.serialize(buf)
	buf.WriteString("Anonymous Sender    ")
	buf.Write(pub.Fingerprint[:])
	return buf.Bytes()
}

func decryptKeyECDH(priv *PrivateKey, X, Y *big.Int, C []byte) (out []byte, err error) {
	ecdhpriv, ok := priv.PrivateKey.(*ecdh.PrivateKey)
	if !ok {
		return nil, errors.InvalidArgumentError("bad internal ECDH key")
	}

	Sx := ecdhpriv.DecryptShared(X, Y)

	kdfParams := ECDHKdfParams(&priv.PublicKey)
	hash, ok := s2k.HashIdToHash(byte(priv.ecdh.KdfHash))
	if !ok {
		return nil, errors.InvalidArgumentError("invalid hash id in private key")
	}

	key := ecdhpriv.KDF(Sx, kdfParams, hash)
	keySize := CipherFunction(priv.ecdh.KdfAlgo).KeySize()

	decrypted, err := ecdh.AESKeyUnwrap(key[:keySize], C)
	if err != nil {
		return nil, err
	}

	// We have to "read ahead" to discover real length of the
	// encryption key and properly unpad buffer.
	cipherFunc := CipherFunction(decrypted[0])
	// +3 bytes = 1-byte cipher id and checksum 2-byte checksum.
	out = ecdh.UnpadBuffer(decrypted, cipherFunc.KeySize()+3)
	if out == nil {
		return nil, errors.InvalidArgumentError("invalid padding while ECDH")
	}
	return out, nil
}

func serializeEncryptedKeyECDH(w io.Writer, rand io.Reader, header [10]byte, pub *PublicKey, keyBlock []byte) error {
	ecdhpub := pub.PublicKey.(*ecdh.PublicKey)
	kdfParams := ECDHKdfParams(pub)

	hash, ok := s2k.HashIdToHash(byte(pub.ecdh.KdfHash))
	if !ok {
		return errors.InvalidArgumentError("invalid hash id in private key")
	}

	kdfKeySize := CipherFunction(pub.ecdh.KdfAlgo).KeySize()
	Vx, Vy, C, err := ecdhpub.Encrypt(rand, kdfParams, keyBlock, hash, kdfKeySize)
	if err != nil {
		return err
	}

	mpis, mpiBitLen := ecdh.Marshal(ecdhpub.Curve, Vx, Vy)

	packetLen := len(header) /* header length in bytes */
	packetLen += 2 /* mpi length in bits */ + len(mpis)
	packetLen += 1 /* ciphertext size in bytes */ + len(C)

	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
	if err != nil {
		return err
	}

	_, err = w.Write(header[:])
	if err != nil {
		return err
	}

	_, err = w.Write([]byte{byte(mpiBitLen >> 8), byte(mpiBitLen)})
	if err != nil {
		return err
	}

	_, err = w.Write(mpis[:])
	if err != nil {
		return err
	}

	w.Write([]byte{byte(len(C))})
	w.Write(C[:])
	return nil
}