Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add symmetric capabilities to DecryptedThing #214

Closed
wants to merge 5 commits into from
Closed

Add symmetric capabilities to DecryptedThing #214

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e006ae3
Add symmetric capabilities to DecryptedThing
benjaminpreiss Oct 4, 2023
9bc0fac
Implement HashedKeyEnvelope
benjaminpreiss Oct 5, 2023
34179af
Add .create function to Aes256 key
benjaminpreiss Oct 6, 2023
e757cdc
Update packages/utils/crypto/src/encryption.ts
benjaminpreiss Oct 6, 2023
d01c1ec
Update packages/utils/crypto/src/encryption.ts
benjaminpreiss Oct 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
245 changes: 209 additions & 36 deletions packages/utils/crypto/src/encryption.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,10 @@ export abstract class MaybeEncrypted<T> {
}

decrypt(
keyOrKeychain?: Keychain | X25519Keypair
keyOrKeychain?:
| Keychain
| X25519Keypair
| Uint8Array /* Comment: The last is added */
): Promise<DecryptedThing<T>> | DecryptedThing<T> {
throw new Error("Not implemented");
}
Expand All @@ -45,6 +48,24 @@ export abstract class MaybeEncrypted<T> {
abstract get byteLength(): number;
}

type EncryptAsymmetricParameters = {
x25519Keypair: X25519Keypair;
receiverPublicKeys: (X25519PublicKey | Ed25519PublicKey)[];
};

type EncryptSymmetricParameters = { symmetricKey: Uint8Array };

type EncryptReturnValue<Parameters, T> =
Parameters extends EncryptSymmetricParameters
? EncryptedSymmetricThing<T>
: EncryptedThing<T>;

function isEncryptSymmetricParameters(
parameters: EncryptSymmetricParameters | EncryptAsymmetricParameters
): parameters is EncryptSymmetricParameters {
return (parameters as EncryptSymmetricParameters).symmetricKey !== undefined;
}

@variant(0)
export class DecryptedThing<T> extends MaybeEncrypted<T> {
@field({ type: Uint8Array })
Expand All @@ -69,50 +90,67 @@ export class DecryptedThing<T> extends MaybeEncrypted<T> {
return deserialize(this._data, clazz);
}

async encrypt(
x25519Keypair: X25519Keypair,
...receiverPublicKeys: (X25519PublicKey | Ed25519PublicKey)[]
): Promise<EncryptedThing<T>> {
async encrypt<
Parameters extends EncryptAsymmetricParameters | EncryptSymmetricParameters
>(
parameters: EncryptAsymmetricParameters | EncryptSymmetricParameters
/* Comment: instead of
x25519Keypair: X25519Keypair,
...receiverPublicKeys: (X25519PublicKey | Ed25519PublicKey)[] */
): Promise<
EncryptReturnValue<Parameters, T>
> /* Comment: instead of Promise<EncryptedThing<T>> */ {
const bytes = serialize(this);
const epheremalKey = sodium.crypto_secretbox_keygen();
const epheremalKey = isEncryptSymmetricParameters(parameters)
? parameters.symmetricKey
: sodium.crypto_secretbox_keygen();
/* Comment: instead of const epheremalKey = sodium.crypto_secretbox_keygen(); */
const nonce = randomBytes(NONCE_LENGTH); // crypto random is faster than sodim random
const cipher = sodium.crypto_secretbox_easy(bytes, nonce, epheremalKey);

const receiverX25519PublicKeys = await Promise.all(
receiverPublicKeys.map((key) => {
if (key instanceof Ed25519PublicKey) {
return X25519PublicKey.from(key);
}
return key;
})
);
if (!isEncryptSymmetricParameters(parameters)) {
const { receiverPublicKeys, x25519Keypair } = parameters;
const receiverX25519PublicKeys = await Promise.all(
receiverPublicKeys.map((key) => {
if (key instanceof Ed25519PublicKey) {
return X25519PublicKey.from(key);
}
return key;
})
);

const ks = receiverX25519PublicKeys.map((receiverPublicKey) => {
const kNonce = randomBytes(NONCE_LENGTH); // crypto random is faster than sodium random
return new K({
encryptedKey: new CipherWithNonce({
cipher: sodium.crypto_box_easy(
epheremalKey,
kNonce,
receiverPublicKey.publicKey,
x25519Keypair.secretKey.secretKey
),
nonce: kNonce
}),
receiverPublicKey
const ks = receiverX25519PublicKeys.map((receiverPublicKey) => {
const kNonce = randomBytes(NONCE_LENGTH); // crypto random is faster than sodium random
return new K({
encryptedKey: new CipherWithNonce({
cipher: sodium.crypto_box_easy(
epheremalKey,
kNonce,
receiverPublicKey.publicKey,
x25519Keypair.secretKey.secretKey
),
nonce: kNonce
}),
receiverPublicKey
});
});
});

const enc = new EncryptedThing<T>({
const enc = new EncryptedThing<T>({
encrypted: new Uint8Array(cipher),
nonce,
envelope: new Envelope({
senderPublicKey: x25519Keypair.publicKey,
ks
})
});
enc._decrypted = this;
return enc as EncryptReturnValue<Parameters, T>;
}
const enc = new EncryptedSymmetricThing<T>({
encrypted: new Uint8Array(cipher),
nonce,
envelope: new Envelope({
senderPublicKey: x25519Keypair.publicKey,
ks
})
nonce
});
enc._decrypted = this;
return enc;
return enc as EncryptReturnValue<Parameters, T>;
}

get decrypted(): DecryptedThing<T> {
Expand Down Expand Up @@ -374,3 +412,138 @@ export class EncryptedThing<T> extends MaybeEncrypted<T> {
return this._encrypted.byteLength; // ignore other metdata for now in the size calculation
}
}

@variant(2)
export class EncryptedSymmetricThing<T> extends MaybeEncrypted<T> {
@field({ type: Uint8Array })
_encrypted: Uint8Array;

@field({ type: Uint8Array })
_nonce: Uint8Array;

constructor(props?: { encrypted: Uint8Array; nonce: Uint8Array }) {
super();
if (props) {
this._encrypted = props.encrypted;
this._nonce = props.nonce;
}
}

_decrypted?: DecryptedThing<T>;
get decrypted(): DecryptedThing<T> {
if (!this._decrypted) {
throw new Error(
"Entry has not been decrypted, invoke decrypt method before"
);
}
return this._decrypted;
}

async decrypt(
keyResolver?: Uint8Array /* Comment: instead of Keychain | X25519Keypair */
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder whether the Keychain should be improved to also be able to export Ephemeral keys based on their hashes or something

But this is about solving the problem

  • How do I know I have decrypted something correctly?
  • How do I know that I can decrypt it before decrypting it? (Lets say I have 1000 ephemeral keys in the keystore, I can not test all of them)

Copy link
Collaborator Author

@benjaminpreiss benjaminpreiss Oct 4, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting thought... So that means one would also include an Envelope within EncryptedSymmetricThing that includes the hash of the SymmetricKey (salted)?

encryption-providers

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... Well maybe the naming would not be envelope any more as there is no signature.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding your questions:

How do I know I have decrypted something correctly?

I think certainty can be provided by successful deserialization?

How do I know that I can decrypt it before decrypting it? (Lets say I have 1000 ephemeral keys in the keystore, I can not test all of them)

When we include the hash of the ephemeral key used for encryption in the "envelope", we have a linear lookup time for the question "Can I decrypt?".

Copy link
Member

@marcus-pousette marcus-pousette Oct 4, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think certainty can be provided by successful deserialization?

There might be scenarios where the decrypted ciphertext still can deserialize succesfully into your object even though the decryption is invalid. Lets say it is not something you can trust on 100%

But this page is pretty good

https://libsodium.gitbook.io/doc/secret-key_cryptography/secretbox

(which is the function you are using in this PR)

So the solution you have there does the integrity check. I think it bundles some authentication data in the cipher text that depends on the nonce and the secret key used. So that issue would be solved (but one has to test) that this will be sufficient for the verifying it has been decrypted correctly.

When we include the hash of the ephemeral key used for encryption in the "envelope", we have a linear lookup time for the question "Can I decrypt?".

That would be an easy way to go about it. But it is not standard thing to do it seems.. (I am lookig around on the web and ask the chatbot). But it feels very intuitive

An alternative thing would be that this is on the app level. So you would a have a keychain locally which is a KV store, and you would put your symmetric keys in there with well chosen IDs, like it could be the db address of the store you want to encrypt. So basically when you want to decrypt a db you would go into this keychain and look for this key that has an id which is the db address and then if it exist, use it to decrypt entries.

Another alternative would be that you would have a shared keychain which is a document store for ephemeral keys which is encrypted with publickey encryption (the encryption you get default with the document store now). With that you can have each document to have an id which you somehow connect with the id you use for the messages you encrypt in another db (this solution would also help you send your ephemeral keys to the other party)

Copy link
Member

@marcus-pousette marcus-pousette Oct 5, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the recipient for some unknown reason only knows the symm key, he cannot sufficiently answer that question in this scenario.

So what I want to continue to say on this topic is that if you want to receiver to have all necessary data to lookup the secretkey from the keystore you practically need to talk on the sidechannel for every message (?) (given that the salt is unique for every message). If you are to talk about the encryption for about every message you might just want to generate a new symmetric key for every message altogether and use the sidechannel to send that over instead.

Using salts is generally done with a slow hashfunction for passwords which have a low entropy. This prevents someone from bruteforcing passwords given that they know they salt and the password + salt hash. But in this case the "password" is high entropy and there is no possibility that an actor will try to generate all 32 byte symmetric keys to match the hash. The only thing would be that if the symmetric key gets lost, then a middle man could have a easy way of figuring out what messages the middle man can decrypt. Having a salt here would not help anything, or making anything harder if the secret key gets lost. For the same reason as the salt for a password db does not help anything if the password in plain text gets lost

The question remains - what can we do?

i would just keep it simple!

HashedKeyEnvelope

just make it

{ hash: Uint8Array } 

Pros:

  • Will solve a problem where you want to have encryption but share keys on a sidechannel instead of inside the message itself (i.e. use the PublicKeyEnvelope)

  • The hash will help a receiver to figure out if they have a key in the keystore

  • Noone can find out what the symmetric key is given the hash

  • I can loop over all messages efficiently and figure out what messages I can decrypt, if not I can use a sidechannel to ask for the symmetric key by refering to its hash

Cons:

  • Someone from the outside can fiigure out that all messages are encrypted with the same key (make this a less of a con by generating new symmetric keys at a frequent rate)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed! That's how I will implement it.

Copy link
Collaborator Author

@benjaminpreiss benjaminpreiss Oct 5, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you then also just keep one EncryptedThing or split up in EncryptedThing and SymmetricEncryptedThing?

What type would you suggest for the unified EncryptedThing encrypt function?

async decrypt(
	keyResolver?: Keychain | X25519Keypair // | Uint8Array like this?
): Promise<DecryptedThing<T>>

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you then also just keep one EncryptedThing or split up in EncryptedThing and SymmetricEncryptedThing?

What type would you suggest for the unified EncryptedThing encrypt function?

async decrypt(
	keyResolver?: Keychain | X25519Keypair // | Uint8Array like this?
): Promise<DecryptedThing<T>>

One encrypted thing, because later lets say the Keystore can both store Symmetric keys and X25519 Keypairs then you can do

await encryptedThing.decrypt(myKeystore)

without knowing the details of what the Envelope is.

But there is a problem now with the Keystore class is that it depends on the libp2p Keystore object which only can store PeerIds.. and it will also be dropped soon

libp2p/js-libp2p#2084

Copy link
Member

@marcus-pousette marcus-pousette Oct 6, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There might be a sidequest to this to rework the Keychain to have following features

  • Can store all keytypes necessary
  • Can look them up by their IDs or by their PublicKeys or their secret key hashes

): Promise<DecryptedThing<T>> {
if (this._decrypted) {
return this._decrypted;
}

if (!keyResolver) {
throw new AccessError("Expecting key resolver");
}
/*
// We only need to open with one of the keys
let key: { index: number; keypair: X25519Keypair } | undefined;
if (keyResolver instanceof X25519Keypair) {
for (const [i, k] of this._envelope._ks.entries()) {
if (k._receiverPublicKey.equals(keyResolver.publicKey)) {
key = {
index: i,
keypair: keyResolver
};
}
}
} else {
for (const [i, k] of this._envelope._ks.entries()) {
const exported = await keyResolver.exportByKey(k._receiverPublicKey);
if (exported) {
key = {
index: i,
keypair: exported
};
break;
}
}
} */

/* if (key) {
const k = this._envelope._ks[key.index];
let secretKey: X25519SecretKey = undefined as any;
if (key.keypair instanceof X25519Keypair) {
secretKey = key.keypair.secretKey;
} else {
secretKey = await X25519SecretKey.from(key.keypair);
}
let epheremalKey: Uint8Array;
try {
epheremalKey = sodium.crypto_box_open_easy(
k._encryptedKey.cipher,
k._encryptedKey.nonce,
this._envelope._senderPublicKey.publicKey,
secretKey.secretKey
);
} catch (error) {
throw new AccessError('Failed to decrypt');
} */

// TODO: is nested decryption necessary?
/* let der: any = this;
let counter = 0;
while (der instanceof EncryptedThing) {
const decrypted = await sodium.crypto_secretbox_open_easy(this._encrypted, this._nonce, epheremalKey);
der = deserialize(decrypted, DecryptedThing)
counter += 1;
if (counter >= 10) {
throw new Error("Unexpected decryption behaviour, data seems to always be in encrypted state")
}
} */

const der = deserialize(
sodium.crypto_secretbox_open_easy(
this._encrypted,
this._nonce,
keyResolver /* Comment: instead of epheremalKey */
),
DecryptedThing
);
this._decrypted = der as DecryptedThing<T>;
/* } else {
throw new AccessError('Failed to resolve decryption key');
} */
return this._decrypted;
}

equals(other: MaybeEncrypted<T>): boolean {
if (other instanceof EncryptedSymmetricThing) {
if (!equals(this._encrypted, other._encrypted)) {
return false;
}
if (!equals(this._nonce, other._nonce)) {
return false;
}
/*
if (!this._envelope.equals(other._envelope)) {
return false;
} */
return true;
} else {
return false;
}
}

clear() {
this._decrypted = undefined;
}

get byteLength() {
return this._encrypted.byteLength; // ignore other metdata for now in the size calculation
}
}