Reworked key exchange, now using direct C imports from monocypher instead of nimble modules/libraries.
This commit is contained in:
Jakob Friedl
@@ -3,7 +3,6 @@ import winim
|
||||
|
||||
import core/[task, taskresult, heartbeat, http, register]
|
||||
import ../../common/[types, utils, crypto]
|
||||
import sugar
|
||||
|
||||
const ListenerUuid {.strdefine.}: string = ""
|
||||
const Octet1 {.intdefine.}: int = 0
|
||||
@@ -36,7 +35,7 @@ proc main() =
|
||||
# Create agent configuration
|
||||
var config: AgentConfig
|
||||
try:
|
||||
let agentKeyPair = generateKeyPair()
|
||||
var agentKeyPair = generateKeyPair()
|
||||
let serverPublicKey = decode(ServerPublicKey).toKey()
|
||||
|
||||
config = AgentConfig(
|
||||
@@ -49,8 +48,8 @@ proc main() =
|
||||
agentPublicKey: agentKeyPair.publicKey
|
||||
)
|
||||
|
||||
# Clean up agent's private key from memory
|
||||
zeroMem(agentKeyPair.privateKey[0].addr, sizeof(PrivateKey))
|
||||
# Cleanup agent's secret key
|
||||
wipeKey(agentKeyPair.privateKey)
|
||||
|
||||
except CatchableError as err:
|
||||
echo "[-] " & err.msg
|
||||
|
||||
@@ -5,5 +5,5 @@
|
||||
-d:Octet3="0"
|
||||
-d:Octet4="1"
|
||||
-d:ListenerPort=9999
|
||||
-d:SleepDelay=10
|
||||
-d:ServerPublicKey="8OysfB6C8kn8KSu8bYIH/78BMCpFOZsTaAWEG+860HY="
|
||||
-d:SleepDelay=5
|
||||
-d:ServerPublicKey="oxrOv1HwX1BKvMB0iVLTA0Kfc9Iit4NzP5g8NekvNUs="
|
||||
|
||||
@@ -1,8 +1,5 @@
|
||||
import system
|
||||
import nimcrypto
|
||||
import nimcrypto/blake2
|
||||
from ed25519 import keyExchange, createKeyPair, seed
|
||||
# from monocypher import crypto_key_exchange_public_key, crypto_key_exchange, crypto_blake2b, crypto_wipe
|
||||
|
||||
import ./[utils, types]
|
||||
|
||||
@@ -10,14 +7,6 @@ import ./[utils, types]
|
||||
Symmetric AES256 GCM encryption for secure C2 traffic
|
||||
Ensures both confidentiality and integrity of the packet
|
||||
]#
|
||||
proc generateKeyPair*(): KeyPair =
|
||||
let keyPair = createKeyPair(seed())
|
||||
|
||||
return KeyPair(
|
||||
privateKey: keyPair.privateKey,
|
||||
publicKey: keyPair.publicKey
|
||||
)
|
||||
|
||||
proc generateIV*(): Iv =
|
||||
# Generate a random 98-bit (12-byte) initialization vector for AES-256 GCM mode
|
||||
var iv: Iv
|
||||
@@ -56,41 +45,54 @@ proc decrypt*(key: Key, iv: Iv, encData: seq[byte], sequenceNumber: uint64): (se
|
||||
return (data, tag)
|
||||
|
||||
#[
|
||||
ECDHE key exchange using ed25519
|
||||
Key exchange using X25519 and Blake2b
|
||||
Elliptic curve cryptography ensures that the actual session key is never sent over the network
|
||||
Private keys and shared secrets are wiped from agent memory as soon as possible
|
||||
]#
|
||||
proc loadKeys*(privateKeyFile, publicKeyFile: string): KeyPair =
|
||||
let filePrivate = open(privateKeyFile, fmRead)
|
||||
defer: filePrivate.close()
|
||||
{.compile: "monocypher/monocypher.c".}
|
||||
{.passc: "-Imonocypher".}
|
||||
|
||||
var privateKey: PrivateKey
|
||||
var bytesRead = filePrivate.readBytes(privateKey, 0, sizeof(PrivateKey))
|
||||
# C function imports from (monocypher/monocypher.c)
|
||||
proc crypto_x25519*(shared_secret: ptr byte, your_secret_key: ptr byte, their_public_key: ptr byte) {.importc, cdecl.}
|
||||
proc crypto_x25519_public_key*(public_key: ptr byte, secret_key: ptr byte) {.importc, cdecl.}
|
||||
proc crypto_blake2b_keyed*(hash: ptr byte, hash_size: csize_t, key: ptr byte, key_size: csize_t, message: ptr byte, message_size: csize_t) {.importc, cdecl.}
|
||||
proc crypto_wipe*(data: ptr byte, size: csize_t) {.importc, cdecl.}
|
||||
|
||||
if bytesRead != sizeof(PrivateKey):
|
||||
raise newException(ValueError, "Invalid private key length.")
|
||||
# Generate X25519 public key from private key
|
||||
proc getPublicKey*(privateKey: Key): Key =
|
||||
crypto_x25519_public_key(result[0].addr, privateKey[0].addr)
|
||||
|
||||
let filePublic = open(publicKeyFile, fmRead)
|
||||
defer: filePublic.close()
|
||||
# Perform X25519 key exchange
|
||||
proc keyExchange*(privateKey: Key, publicKey: Key): Key =
|
||||
crypto_x25519(result[0].addr, privateKey[0].addr, publicKey[0].addr)
|
||||
|
||||
var publicKey: PublicKey
|
||||
bytesRead = filePublic.readBytes(publicKey, 0, sizeof(PublicKey))
|
||||
# Calculate Blake2b hash
|
||||
func pointerAndLength*(bytes: openArray[byte]): (ptr[byte], uint) =
|
||||
result = (cast[ptr[byte]](unsafeAddr bytes), uint(len(bytes)))
|
||||
|
||||
if bytesRead != sizeof(PublicKey):
|
||||
raise newException(ValueError, "Invalid public key length.")
|
||||
func blake2b*(message: openArray[byte], key: openArray[byte] = []): array[64, byte] =
|
||||
let (messagePtr, messageLen) = pointerAndLength(message)
|
||||
let (keyPtr, keyLen) = pointerAndLength(key)
|
||||
|
||||
crypto_blake2b_keyed(addr result[0], 64, keyPtr, keyLen, messagePtr, messageLen)
|
||||
|
||||
# Secure memory wiping
|
||||
proc wipeKey*(data: var openArray[byte]) =
|
||||
if data.len > 0:
|
||||
crypto_wipe(data[0].addr, data.len.csize_t)
|
||||
|
||||
# Key pair generation
|
||||
proc generateKeyPair*(): KeyPair =
|
||||
var privateKey: Key
|
||||
if randomBytes(privateKey) != sizeof(Key):
|
||||
raise newException(ValueError, "Failed to generate key.")
|
||||
|
||||
return KeyPair(
|
||||
privateKey: privateKey,
|
||||
publicKey: publicKey
|
||||
publicKey: getPublicKey(privateKey)
|
||||
)
|
||||
|
||||
proc writeKey*[T: PublicKey | PrivateKey](keyFile: string, key: T) =
|
||||
let file = open(keyFile, fmWrite)
|
||||
defer: file.close()
|
||||
|
||||
let bytesWritten = file.writeBytes(key, 0, sizeof(T))
|
||||
|
||||
if bytesWritten != sizeof(T):
|
||||
raise newException(ValueError, "Invalid key length.")
|
||||
|
||||
# Key derivation
|
||||
proc combineKeys(publicKey, otherPublicKey: Key): Key =
|
||||
# XOR is a commutative operation, that ensures that the order of the public keys does not matter
|
||||
for i in 0..<32:
|
||||
@@ -100,22 +102,42 @@ proc deriveSessionKey*(keyPair: KeyPair, publicKey: Key): Key =
|
||||
var key: Key
|
||||
|
||||
# Calculate shared secret (https://monocypher.org/manual/x25519)
|
||||
let sharedSecret = keyExchange(publicKey, keyPair.privateKey)
|
||||
var sharedSecret = keyExchange(keyPair.privateKey, publicKey)
|
||||
|
||||
# Add combined public keys to hash
|
||||
let combinedKeys: Key = combineKeys(keyPair.publicKey, publicKey)
|
||||
let hashMessage: seq[byte] = "CONQUEST".toBytes() & @combinedKeys
|
||||
|
||||
# Calculate Blake2b hash to derive session key
|
||||
var ctx: blake2_512
|
||||
ctx.init()
|
||||
ctx.update(sharedSecret)
|
||||
ctx.update("CONQUEST".toBytes() & @combinedKeys)
|
||||
|
||||
let hash = ctx.finish
|
||||
let bytes = hash.data[0..<sizeof(Key)]
|
||||
copyMem(key[0].addr, bytes[0].addr, sizeof(Key))
|
||||
# Calculate Blake2b hash and extract the first 32 bytes for the AES key (https://monocypher.org/manual/blake2b)
|
||||
let hash = blake2b(hashMessage, sharedSecret)
|
||||
copyMem(key[0].addr, hash[0].addr, sizeof(Key))
|
||||
|
||||
# Cleanup
|
||||
zeroMem(sharedSecret[0].addr, sharedSecret.len)
|
||||
wipeKey(sharedSecret)
|
||||
|
||||
return key
|
||||
|
||||
# Key management
|
||||
proc loadKeyPair*(keyFile: string): KeyPair =
|
||||
let file = open(keyFile, fmRead)
|
||||
defer: file.close()
|
||||
|
||||
var privateKey: Key
|
||||
let bytesRead = file.readBytes(privateKey, 0, sizeof(Key))
|
||||
|
||||
if bytesRead != sizeof(Key):
|
||||
raise newException(ValueError, "Invalid key length.")
|
||||
|
||||
return KeyPair(
|
||||
privateKey: privateKey,
|
||||
publicKey: getPublicKey(privateKey)
|
||||
)
|
||||
|
||||
proc writeKeyToDisk*(keyFile: string, key: Key) =
|
||||
let file = open(keyFile, fmWrite)
|
||||
defer: file.close()
|
||||
|
||||
let bytesWritten = file.writeBytes(key, 0, sizeof(Key))
|
||||
|
||||
if bytesWritten != sizeof(Key):
|
||||
raise newException(ValueError, "Invalid key length.")
|
||||
|
||||
2956
src/common/monocypher/monocypher.c
Normal file
2956
src/common/monocypher/monocypher.c
Normal file
File diff suppressed because it is too large
Load Diff
321
src/common/monocypher/monocypher.h
Normal file
321
src/common/monocypher/monocypher.h
Normal file
@@ -0,0 +1,321 @@
|
||||
// Monocypher version __git__
|
||||
//
|
||||
// This file is dual-licensed. Choose whichever licence you want from
|
||||
// the two licences listed below.
|
||||
//
|
||||
// The first licence is a regular 2-clause BSD licence. The second licence
|
||||
// is the CC-0 from Creative Commons. It is intended to release Monocypher
|
||||
// to the public domain. The BSD licence serves as a fallback option.
|
||||
//
|
||||
// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0
|
||||
//
|
||||
// ------------------------------------------------------------------------
|
||||
//
|
||||
// Copyright (c) 2017-2019, Loup Vaillant
|
||||
// All rights reserved.
|
||||
//
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// 1. Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
//
|
||||
// 2. Redistributions in binary form must reproduce the above copyright
|
||||
// notice, this list of conditions and the following disclaimer in the
|
||||
// documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
//
|
||||
// ------------------------------------------------------------------------
|
||||
//
|
||||
// Written in 2017-2019 by Loup Vaillant
|
||||
//
|
||||
// To the extent possible under law, the author(s) have dedicated all copyright
|
||||
// and related neighboring rights to this software to the public domain
|
||||
// worldwide. This software is distributed without any warranty.
|
||||
//
|
||||
// You should have received a copy of the CC0 Public Domain Dedication along
|
||||
// with this software. If not, see
|
||||
// <https://creativecommons.org/publicdomain/zero/1.0/>
|
||||
|
||||
#ifndef MONOCYPHER_H
|
||||
#define MONOCYPHER_H
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef MONOCYPHER_CPP_NAMESPACE
|
||||
namespace MONOCYPHER_CPP_NAMESPACE {
|
||||
#elif defined(__cplusplus)
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
// Constant time comparisons
|
||||
// -------------------------
|
||||
|
||||
// Return 0 if a and b are equal, -1 otherwise
|
||||
int crypto_verify16(const uint8_t a[16], const uint8_t b[16]);
|
||||
int crypto_verify32(const uint8_t a[32], const uint8_t b[32]);
|
||||
int crypto_verify64(const uint8_t a[64], const uint8_t b[64]);
|
||||
|
||||
|
||||
// Erase sensitive data
|
||||
// --------------------
|
||||
void crypto_wipe(void *secret, size_t size);
|
||||
|
||||
|
||||
// Authenticated encryption
|
||||
// ------------------------
|
||||
void crypto_aead_lock(uint8_t *cipher_text,
|
||||
uint8_t mac [16],
|
||||
const uint8_t key [32],
|
||||
const uint8_t nonce[24],
|
||||
const uint8_t *ad, size_t ad_size,
|
||||
const uint8_t *plain_text, size_t text_size);
|
||||
int crypto_aead_unlock(uint8_t *plain_text,
|
||||
const uint8_t mac [16],
|
||||
const uint8_t key [32],
|
||||
const uint8_t nonce[24],
|
||||
const uint8_t *ad, size_t ad_size,
|
||||
const uint8_t *cipher_text, size_t text_size);
|
||||
|
||||
// Authenticated stream
|
||||
// --------------------
|
||||
typedef struct {
|
||||
uint64_t counter;
|
||||
uint8_t key[32];
|
||||
uint8_t nonce[8];
|
||||
} crypto_aead_ctx;
|
||||
|
||||
void crypto_aead_init_x(crypto_aead_ctx *ctx,
|
||||
const uint8_t key[32], const uint8_t nonce[24]);
|
||||
void crypto_aead_init_djb(crypto_aead_ctx *ctx,
|
||||
const uint8_t key[32], const uint8_t nonce[8]);
|
||||
void crypto_aead_init_ietf(crypto_aead_ctx *ctx,
|
||||
const uint8_t key[32], const uint8_t nonce[12]);
|
||||
|
||||
void crypto_aead_write(crypto_aead_ctx *ctx,
|
||||
uint8_t *cipher_text,
|
||||
uint8_t mac[16],
|
||||
const uint8_t *ad , size_t ad_size,
|
||||
const uint8_t *plain_text, size_t text_size);
|
||||
int crypto_aead_read(crypto_aead_ctx *ctx,
|
||||
uint8_t *plain_text,
|
||||
const uint8_t mac[16],
|
||||
const uint8_t *ad , size_t ad_size,
|
||||
const uint8_t *cipher_text, size_t text_size);
|
||||
|
||||
|
||||
// General purpose hash (BLAKE2b)
|
||||
// ------------------------------
|
||||
|
||||
// Direct interface
|
||||
void crypto_blake2b(uint8_t *hash, size_t hash_size,
|
||||
const uint8_t *message, size_t message_size);
|
||||
|
||||
void crypto_blake2b_keyed(uint8_t *hash, size_t hash_size,
|
||||
const uint8_t *key, size_t key_size,
|
||||
const uint8_t *message, size_t message_size);
|
||||
|
||||
// Incremental interface
|
||||
typedef struct {
|
||||
// Do not rely on the size or contents of this type,
|
||||
// for they may change without notice.
|
||||
uint64_t hash[8];
|
||||
uint64_t input_offset[2];
|
||||
uint64_t input[16];
|
||||
size_t input_idx;
|
||||
size_t hash_size;
|
||||
} crypto_blake2b_ctx;
|
||||
|
||||
void crypto_blake2b_init(crypto_blake2b_ctx *ctx, size_t hash_size);
|
||||
void crypto_blake2b_keyed_init(crypto_blake2b_ctx *ctx, size_t hash_size,
|
||||
const uint8_t *key, size_t key_size);
|
||||
void crypto_blake2b_update(crypto_blake2b_ctx *ctx,
|
||||
const uint8_t *message, size_t message_size);
|
||||
void crypto_blake2b_final(crypto_blake2b_ctx *ctx, uint8_t *hash);
|
||||
|
||||
|
||||
// Password key derivation (Argon2)
|
||||
// --------------------------------
|
||||
#define CRYPTO_ARGON2_D 0
|
||||
#define CRYPTO_ARGON2_I 1
|
||||
#define CRYPTO_ARGON2_ID 2
|
||||
|
||||
typedef struct {
|
||||
uint32_t algorithm; // Argon2d, Argon2i, Argon2id
|
||||
uint32_t nb_blocks; // memory hardness, >= 8 * nb_lanes
|
||||
uint32_t nb_passes; // CPU hardness, >= 1 (>= 3 recommended for Argon2i)
|
||||
uint32_t nb_lanes; // parallelism level (single threaded anyway)
|
||||
} crypto_argon2_config;
|
||||
|
||||
typedef struct {
|
||||
const uint8_t *pass;
|
||||
const uint8_t *salt;
|
||||
uint32_t pass_size;
|
||||
uint32_t salt_size; // 16 bytes recommended
|
||||
} crypto_argon2_inputs;
|
||||
|
||||
typedef struct {
|
||||
const uint8_t *key; // may be NULL if no key
|
||||
const uint8_t *ad; // may be NULL if no additional data
|
||||
uint32_t key_size; // 0 if no key (32 bytes recommended otherwise)
|
||||
uint32_t ad_size; // 0 if no additional data
|
||||
} crypto_argon2_extras;
|
||||
|
||||
extern const crypto_argon2_extras crypto_argon2_no_extras;
|
||||
|
||||
void crypto_argon2(uint8_t *hash, uint32_t hash_size, void *work_area,
|
||||
crypto_argon2_config config,
|
||||
crypto_argon2_inputs inputs,
|
||||
crypto_argon2_extras extras);
|
||||
|
||||
|
||||
// Key exchange (X-25519)
|
||||
// ----------------------
|
||||
|
||||
// Shared secrets are not quite random.
|
||||
// Hash them to derive an actual shared key.
|
||||
void crypto_x25519_public_key(uint8_t public_key[32],
|
||||
const uint8_t secret_key[32]);
|
||||
void crypto_x25519(uint8_t raw_shared_secret[32],
|
||||
const uint8_t your_secret_key [32],
|
||||
const uint8_t their_public_key [32]);
|
||||
|
||||
// Conversion to EdDSA
|
||||
void crypto_x25519_to_eddsa(uint8_t eddsa[32], const uint8_t x25519[32]);
|
||||
|
||||
// scalar "division"
|
||||
// Used for OPRF. Be aware that exponential blinding is less secure
|
||||
// than Diffie-Hellman key exchange.
|
||||
void crypto_x25519_inverse(uint8_t blind_salt [32],
|
||||
const uint8_t private_key[32],
|
||||
const uint8_t curve_point[32]);
|
||||
|
||||
// "Dirty" versions of x25519_public_key().
|
||||
// Use with crypto_elligator_rev().
|
||||
// Leaks 3 bits of the private key.
|
||||
void crypto_x25519_dirty_small(uint8_t pk[32], const uint8_t sk[32]);
|
||||
void crypto_x25519_dirty_fast (uint8_t pk[32], const uint8_t sk[32]);
|
||||
|
||||
|
||||
// Signatures
|
||||
// ----------
|
||||
|
||||
// EdDSA with curve25519 + BLAKE2b
|
||||
void crypto_eddsa_key_pair(uint8_t secret_key[64],
|
||||
uint8_t public_key[32],
|
||||
uint8_t seed[32]);
|
||||
void crypto_eddsa_sign(uint8_t signature [64],
|
||||
const uint8_t secret_key[64],
|
||||
const uint8_t *message, size_t message_size);
|
||||
int crypto_eddsa_check(const uint8_t signature [64],
|
||||
const uint8_t public_key[32],
|
||||
const uint8_t *message, size_t message_size);
|
||||
|
||||
// Conversion to X25519
|
||||
void crypto_eddsa_to_x25519(uint8_t x25519[32], const uint8_t eddsa[32]);
|
||||
|
||||
// EdDSA building blocks
|
||||
void crypto_eddsa_trim_scalar(uint8_t out[32], const uint8_t in[32]);
|
||||
void crypto_eddsa_reduce(uint8_t reduced[32], const uint8_t expanded[64]);
|
||||
void crypto_eddsa_mul_add(uint8_t r[32],
|
||||
const uint8_t a[32],
|
||||
const uint8_t b[32],
|
||||
const uint8_t c[32]);
|
||||
void crypto_eddsa_scalarbase(uint8_t point[32], const uint8_t scalar[32]);
|
||||
int crypto_eddsa_check_equation(const uint8_t signature[64],
|
||||
const uint8_t public_key[32],
|
||||
const uint8_t h_ram[32]);
|
||||
|
||||
|
||||
// Chacha20
|
||||
// --------
|
||||
|
||||
// Specialised hash.
|
||||
// Used to hash X25519 shared secrets.
|
||||
void crypto_chacha20_h(uint8_t out[32],
|
||||
const uint8_t key[32],
|
||||
const uint8_t in [16]);
|
||||
|
||||
// Unauthenticated stream cipher.
|
||||
// Don't forget to add authentication.
|
||||
uint64_t crypto_chacha20_djb(uint8_t *cipher_text,
|
||||
const uint8_t *plain_text,
|
||||
size_t text_size,
|
||||
const uint8_t key[32],
|
||||
const uint8_t nonce[8],
|
||||
uint64_t ctr);
|
||||
uint32_t crypto_chacha20_ietf(uint8_t *cipher_text,
|
||||
const uint8_t *plain_text,
|
||||
size_t text_size,
|
||||
const uint8_t key[32],
|
||||
const uint8_t nonce[12],
|
||||
uint32_t ctr);
|
||||
uint64_t crypto_chacha20_x(uint8_t *cipher_text,
|
||||
const uint8_t *plain_text,
|
||||
size_t text_size,
|
||||
const uint8_t key[32],
|
||||
const uint8_t nonce[24],
|
||||
uint64_t ctr);
|
||||
|
||||
|
||||
// Poly 1305
|
||||
// ---------
|
||||
|
||||
// This is a *one time* authenticator.
|
||||
// Disclosing the mac reveals the key.
|
||||
// See crypto_lock() on how to use it properly.
|
||||
|
||||
// Direct interface
|
||||
void crypto_poly1305(uint8_t mac[16],
|
||||
const uint8_t *message, size_t message_size,
|
||||
const uint8_t key[32]);
|
||||
|
||||
// Incremental interface
|
||||
typedef struct {
|
||||
// Do not rely on the size or contents of this type,
|
||||
// for they may change without notice.
|
||||
uint8_t c[16]; // chunk of the message
|
||||
size_t c_idx; // How many bytes are there in the chunk.
|
||||
uint32_t r [4]; // constant multiplier (from the secret key)
|
||||
uint32_t pad[4]; // random number added at the end (from the secret key)
|
||||
uint32_t h [5]; // accumulated hash
|
||||
} crypto_poly1305_ctx;
|
||||
|
||||
void crypto_poly1305_init (crypto_poly1305_ctx *ctx, const uint8_t key[32]);
|
||||
void crypto_poly1305_update(crypto_poly1305_ctx *ctx,
|
||||
const uint8_t *message, size_t message_size);
|
||||
void crypto_poly1305_final (crypto_poly1305_ctx *ctx, uint8_t mac[16]);
|
||||
|
||||
|
||||
// Elligator 2
|
||||
// -----------
|
||||
|
||||
// Elligator mappings proper
|
||||
void crypto_elligator_map(uint8_t curve [32], const uint8_t hidden[32]);
|
||||
int crypto_elligator_rev(uint8_t hidden[32], const uint8_t curve [32],
|
||||
uint8_t tweak);
|
||||
|
||||
// Easy to use key pair generation
|
||||
void crypto_elligator_key_pair(uint8_t hidden[32], uint8_t secret_key[32],
|
||||
uint8_t seed[32]);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // MONOCYPHER_H
|
||||
@@ -52,8 +52,6 @@ type
|
||||
# Encryption
|
||||
type
|
||||
Key* = array[32, byte]
|
||||
PublicKey* = array[32, byte]
|
||||
PrivateKey* = array[64, byte]
|
||||
Iv* = array[12, byte]
|
||||
AuthenticationTag* = array[16, byte]
|
||||
|
||||
@@ -171,7 +169,7 @@ type
|
||||
# Server structure
|
||||
type
|
||||
KeyPair* = object
|
||||
privateKey*: PrivateKey
|
||||
privateKey*: Key
|
||||
publicKey*: Key
|
||||
|
||||
Conquest* = ref object
|
||||
@@ -191,4 +189,4 @@ type
|
||||
port*: int
|
||||
sleep*: int
|
||||
sessionKey*: Key
|
||||
agentPublicKey*: PublicKey
|
||||
agentPublicKey*: Key
|
||||
@@ -136,7 +136,7 @@ proc initConquest*(): Conquest =
|
||||
cq.listeners = initTable[string, Listener]()
|
||||
cq.agents = initTable[string, Agent]()
|
||||
cq.interactAgent = nil
|
||||
cq.keyPair = loadKeys("../data/keys/conquest-server_ed25519_private.key", "../data/keys/conquest-server_ed25519_public.key")
|
||||
cq.keyPair = loadKeyPair("../data/keys/conquest-server_x25519_private.key")
|
||||
|
||||
return cq
|
||||
|
||||
|
||||
Reference in New Issue
Block a user