diff --git a/Cargo.lock b/Cargo.lock index 742dcb002e..329d1ec96e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1477,7 +1477,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" [[package]] name = "core-models" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "hax-lib", "pastey 0.2.1", @@ -4455,7 +4455,7 @@ checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc" [[package]] name = "libcrux-aesgcm" version = "0.0.6" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-intrinsics", "libcrux-platform", @@ -4466,7 +4466,7 @@ dependencies = [ [[package]] name = "libcrux-chacha20poly1305" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4478,7 +4478,7 @@ dependencies = [ [[package]] name = "libcrux-curve25519" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4489,7 +4489,7 @@ dependencies = [ [[package]] name = "libcrux-ecdh" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-curve25519", "libcrux-p256", @@ -4500,7 +4500,7 @@ dependencies = [ [[package]] name = "libcrux-ed25519" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4512,7 +4512,7 @@ dependencies = [ [[package]] name = "libcrux-hacl-rs" version = "0.0.4" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-macros", ] @@ -4520,7 +4520,7 @@ dependencies = [ [[package]] name = "libcrux-hkdf" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-hmac", @@ -4530,7 +4530,7 @@ dependencies = [ [[package]] name = "libcrux-hmac" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4540,7 +4540,7 @@ dependencies = [ [[package]] name = "libcrux-intrinsics" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "core-models", "hax-lib", @@ -4549,7 +4549,7 @@ dependencies = [ [[package]] name = "libcrux-kem" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-curve25519", "libcrux-ecdh", @@ -4564,7 +4564,7 @@ dependencies = [ [[package]] name = "libcrux-macros" version = "0.0.3" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "quote", "syn 2.0.114", @@ -4573,7 +4573,7 @@ dependencies = [ [[package]] name = "libcrux-ml-dsa" version = "0.0.6" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "core-models", "hax-lib", @@ -4587,7 +4587,7 @@ dependencies = [ [[package]] name = "libcrux-ml-kem" version = "0.0.6" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "hax-lib", "libcrux-intrinsics", @@ -4602,7 +4602,7 @@ dependencies = [ [[package]] name = "libcrux-p256" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4614,7 +4614,7 @@ dependencies = [ [[package]] name = "libcrux-platform" version = "0.0.3" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libc", ] @@ -4622,7 +4622,7 @@ dependencies = [ [[package]] name = "libcrux-poly1305" version = "0.0.4" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4631,7 +4631,7 @@ dependencies = [ [[package]] name = "libcrux-psq" version = "0.0.6" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "classic-mceliece-rust", "libcrux-aesgcm", @@ -4653,7 +4653,7 @@ dependencies = [ [[package]] name = "libcrux-secrets" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "hax-lib", ] @@ -4661,7 +4661,7 @@ dependencies = [ [[package]] name = "libcrux-sha2" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-hacl-rs", "libcrux-macros", @@ -4671,7 +4671,7 @@ dependencies = [ [[package]] name = "libcrux-sha3" version = "0.0.6" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "hax-lib", "libcrux-intrinsics", @@ -4682,7 +4682,7 @@ dependencies = [ [[package]] name = "libcrux-traits" version = "0.0.5" -source = "git+https://github.com/cryspen/libcrux#9df188bb0dc860039a6c3bcaa8cd9f983886c1d7" +source = "git+https://github.com/jstuczyn/libcrux?branch=jstuczyn%2Fpsq-dkhem-utils#647b8b5fc9ffd3368cc832b5a97f86fcf3360af1" dependencies = [ "libcrux-secrets", "rand 0.9.2", diff --git a/Cargo.toml b/Cargo.toml index b09aa86279..b19dd32166 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -401,6 +401,7 @@ libcrux-sha3 = { git = "https://github.com/cryspen/libcrux" } libcrux-traits = { git = "https://github.com/cryspen/libcrux" } + # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests nym-api-requests = { version = "1.20.1", path = "nym-api/nym-api-requests" } nym-authenticator-requests = { version = "1.20.1", path = "common/authenticator-requests" } @@ -551,6 +552,17 @@ wasm-bindgen-test = "0.3.49" wasmtimer = "0.4.1" web-sys = "0.3.76" +# temporary workaround until relevant changes are merged upstream +[patch."https://github.com/cryspen/libcrux"] +libcrux-kem = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-ecdh = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-chacha20poly1305 = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-psq = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-ml-kem = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-sha3 = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } +libcrux-traits = { git = "https://github.com/jstuczyn/libcrux", branch = "jstuczyn/psq-dkhem-utils" } + + # for local development: #[patch.crates-io] #sphinx-packet = { path = "../sphinx" } diff --git a/common/nym-kkt/src/encryption.rs b/common/nym-kkt/src/encryption.rs index 5b0e6009e6..8e62ba839e 100644 --- a/common/nym-kkt/src/encryption.rs +++ b/common/nym-kkt/src/encryption.rs @@ -48,15 +48,18 @@ impl KKTSessionSecret { } pub fn derive(private_key: &DHPrivateKey, public_key: &DHPublicKey) -> Self { - unimplemented!("unexposed in libcrux") - // let mut shared_secret = private_key.diffie_hellman(public_key); - // - // let mut hasher = Hasher::new(); - // - // hasher.update(&shared_secret); + let mut shared_secret = private_key + .diffie_hellman(public_key) + .expect("TODO: error handling"); + + let mut hasher = Hasher::new(); + + hasher.update(shared_secret.as_ref()); + + // TODO: zeroize // shared_secret.zeroize(); - // - // Self(hasher.finalize().as_bytes().to_owned()) + + Self(hasher.finalize().as_bytes().to_owned()) } pub fn as_bytes(&self) -> &[u8; 32] { &self.0 diff --git a/common/nym-lp/src/peer.rs b/common/nym-lp/src/peer.rs index ba2a252d4c..b7e113bfce 100644 --- a/common/nym-lp/src/peer.rs +++ b/common/nym-lp/src/peer.rs @@ -29,16 +29,6 @@ pub struct LpLocalPeer { pub(crate) mceliece: Option<(Arc, Arc)>, } -pub(crate) trait Placeholder { - fn PLACEHOLDER_UNIMPLEMENTED_private_key(&self) -> &DHPrivateKey; -} - -impl Placeholder for DHKeyPair { - fn PLACEHOLDER_UNIMPLEMENTED_private_key(&self) -> &DHPrivateKey { - unimplemented!("need to ask libcrux to expose it") - } -} - impl LpLocalPeer { pub fn new(ed25519: Arc, x25519: Arc) -> Self { // TODO: make nicer conversion (without cloning) + error handling diff --git a/common/nym-lp/src/session.rs b/common/nym-lp/src/session.rs index b722fad24c..4893784563 100644 --- a/common/nym-lp/src/session.rs +++ b/common/nym-lp/src/session.rs @@ -11,7 +11,7 @@ use crate::message::{EncryptedDataPayload, HandshakeData}; // noiserm use crate::noise_protocol::{NoiseError, NoiseProtocol, ReadResult}; use crate::packet::LpHeader; -use crate::peer::{LpLocalPeer, LpRemotePeer, Placeholder}; +use crate::peer::{LpLocalPeer, LpRemotePeer}; use crate::psk::{ derive_subsession_psk, psq_initiator_create_message, psq_responder_process_message, }; @@ -397,10 +397,7 @@ impl LpSession { let params = pattern_name.parse()?; let builder = Builder::new(params); - let local_key_bytes = local_peer - .x25519 - .PLACEHOLDER_UNIMPLEMENTED_private_key() - .as_ref(); + let local_key_bytes = local_peer.x25519.sk().as_ref(); // noiserm let builder = builder.local_private_key(local_key_bytes); @@ -759,17 +756,14 @@ impl LpSession { let mut kkt_state = self.kkt_state.lock(); - let response_bytes = match decrypt_initial_kkt_frame( - self.local_peer - .x25519() - .PLACEHOLDER_UNIMPLEMENTED_private_key(), - request_bytes, - ) { - Ok((session_secret, request_frame, remote_context)) => { - match responder_ingest_message(&remote_context, None, None, &request_frame) { - Ok((mut context, _)) => { - let local_kem_key: Arc = - match self.local_kem_encapsulation_key(&context.ciphersuite().kem()) { + let response_bytes = + match decrypt_initial_kkt_frame(self.local_peer.x25519().sk(), request_bytes) { + Ok((session_secret, request_frame, remote_context)) => { + match responder_ingest_message(&remote_context, None, None, &request_frame) { + Ok((mut context, _)) => { + let local_kem_key: Arc = match self + .local_kem_encapsulation_key(&context.ciphersuite().kem()) + { Some(key) => key.clone(), None => { return Err(LpError::Internal(format!( @@ -779,49 +773,49 @@ impl LpSession { } }; - match responder_process( - &mut context, - request_frame.session_id(), - self.local_peer.ed25519().private_key(), - &local_kem_key, - ) { - Ok(response_frame) => match encrypt_kkt_frame( - &mut rng, - &session_secret, - &response_frame, - KKT_RESPONSE_AAD, + match responder_process( + &mut context, + request_frame.session_id(), + self.local_peer.ed25519().private_key(), + &local_kem_key, ) { - Ok(response_bytes) => response_bytes, + Ok(response_frame) => match encrypt_kkt_frame( + &mut rng, + &session_secret, + &response_frame, + KKT_RESPONSE_AAD, + ) { + Ok(response_bytes) => response_bytes, + Err(e) => { + return Err(LpError::Internal(format!( + "KKT response encryption failure : {:?}", + e + ))); + } + }, Err(e) => { return Err(LpError::Internal(format!( - "KKT response encryption failure : {:?}", + "KKT response generation failure : {:?}", e ))); } - }, - Err(e) => { - return Err(LpError::Internal(format!( - "KKT response generation failure : {:?}", - e - ))); } } - } - Err(e) => { - return Err(LpError::Internal(format!( - "KKT request handling failure: {:?}", - e - ))); + Err(e) => { + return Err(LpError::Internal(format!( + "KKT request handling failure: {:?}", + e + ))); + } } } - } - Err(e) => { - return Err(LpError::Internal(format!( - "KKT request decryption failure: {:?}", - e - ))); - } - }; + Err(e) => { + return Err(LpError::Internal(format!( + "KKT request decryption failure: {:?}", + e + ))); + } + }; // Mark KKT as processed // Responder doesn't store the kem_pk since they already have their own KEM keypair @@ -870,9 +864,7 @@ impl LpSession { let session_context = self.id.to_le_bytes(); let psq_result = match psq_initiator_create_message( - self.local_peer - .x25519 - .PLACEHOLDER_UNIMPLEMENTED_private_key(), + self.local_peer.x25519.sk(), &self.remote_peer.x25519_public, remote_kem, self.local_peer.ed25519.private_key(), @@ -1018,9 +1010,7 @@ impl LpSession { let session_context = self.id.to_le_bytes(); let psq_result = match psq_responder_process_message( - self.local_peer - .x25519 - .PLACEHOLDER_UNIMPLEMENTED_private_key(), + self.local_peer.x25519.sk(), &self.remote_peer.x25519_public, (&dec_key, &enc_key), &self.remote_peer.ed25519_public, @@ -1279,11 +1269,7 @@ impl LpSession { let pattern_name = "Noise_KKpsk0_25519_ChaChaPoly_SHA256"; let params = pattern_name.parse()?; - let local_key_bytes = self - .local_peer - .x25519 - .PLACEHOLDER_UNIMPLEMENTED_private_key() - .as_ref(); + let local_key_bytes = self.local_peer.x25519.sk().as_ref(); let remote_key_bytes = self.remote_x25519_public().as_ref(); let builder = Builder::new(params)