[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[GNUnet-SVN] r36785 - gnunet/src/identity-token
|
From: |
gnunet |
|
Subject: |
[GNUnet-SVN] r36785 - gnunet/src/identity-token |
|
Date: |
Mon, 4 Jan 2016 16:11:00 +0100 |
Author: schanzen
Date: 2016-01-04 16:10:59 +0100 (Mon, 04 Jan 2016)
New Revision: 36785
Modified:
gnunet/src/identity-token/plugin_rest_identity_token.c
Log:
- encrypted token
Modified: gnunet/src/identity-token/plugin_rest_identity_token.c
===================================================================
--- gnunet/src/identity-token/plugin_rest_identity_token.c 2016-01-04
13:00:09 UTC (rev 36784)
+++ gnunet/src/identity-token/plugin_rest_identity_token.c 2016-01-04
15:10:59 UTC (rev 36785)
@@ -185,6 +185,11 @@
* Selected ego
*/
struct EgoEntry *ego_entry;
+
+ /**
+ * Ptr to current ego private key
+ */
+ const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
/**
* Handle to the rest connection
@@ -437,7 +442,44 @@
return GNUNET_OK;
}
+
/**
+ * Encrypt string using pubkey and ECDHE
+ * Returns ECDHE pubkey to be used for decryption
+ */
+static int
+encrypt_str_ecdhe (const char *data,
+ const struct GNUNET_CRYPTO_EcdsaPublicKey *pub_key,
+ char **enc_data_str,
+ struct GNUNET_CRYPTO_EcdhePublicKey *ecdh_pubkey)
+{
+ struct GNUNET_CRYPTO_EcdhePrivateKey *ecdh_privkey;
+ struct GNUNET_CRYPTO_SymmetricSessionKey skey;
+ struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+ struct GNUNET_HashCode new_key_hash;
+
+ // ECDH keypair E = eG
+ ecdh_privkey = GNUNET_CRYPTO_ecdhe_key_create();
+ GNUNET_CRYPTO_ecdhe_key_get_public (ecdh_privkey,
+ ecdh_pubkey);
+
+ *enc_data_str = GNUNET_malloc (strlen (data));
+
+ // Derived key K = H(eB)
+ GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecdh_ecdsa (ecdh_privkey,
+ pub_key,
+ &new_key_hash));
+ create_sym_key_from_ecdh(&new_key_hash, &skey, &iv);
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Encrypting string %s\n", data);
+ GNUNET_CRYPTO_symmetric_encrypt (data, strlen (data),
+ &skey, &iv,
+ *enc_data_str);
+ GNUNET_free (ecdh_privkey);
+ return GNUNET_OK;
+}
+
+
+/**
* Create the token code
* The metadata is encrypted with a share ECDH derived secret using B (aud_key)
* and e (ecdh_privkey)
@@ -445,58 +487,78 @@
* metadata and E
*/
static int
-create_token_code (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key,
- const struct GNUNET_CRYPTO_EcdhePrivateKey
*ecdh_privkey,
- const struct GNUNET_CRYPTO_EcdhePublicKey *ecdh_pubkey,
- const char* code_str,
- const struct GNUNET_CRYPTO_EcdsaPublicKey *aud_key,
- char **result,
- size_t *result_len,
- struct GNUNET_CRYPTO_EcdsaSignature *sig)
+create_token_code (const char* nonce_str,
+ const char* identity_pkey_str,
+ const char* lbl_str,
+ const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key,
+ const struct GNUNET_CRYPTO_EcdsaPublicKey *aud_key,
+ char **token_code_str)
{
char *write_ptr;
- struct GNUNET_HashCode new_key_hash;
- struct GNUNET_CRYPTO_SymmetricSessionKey skey;
- struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+ char *code_meta_str;
+ char *token_code_sig_str;
+ char *token_code_payload_str;
+ char *token_code_payload;
+ char *dh_key_str;
+ char *param_str;
+ struct GNUNET_CRYPTO_EcdsaSignature sig;
struct GNUNET_CRYPTO_EccSignaturePurpose *purpose;
+ struct GNUNET_CRYPTO_EcdhePublicKey ecdh_pubkey;
- *result = GNUNET_malloc (strlen (code_str));
- *result_len = strlen (code_str);
+ GNUNET_asprintf (&code_meta_str,
+ "{\"nonce\": \"%u\",\"identity\": \"%s\",\"label\":
\"%s\"}",
+ nonce_str, identity_pkey_str, lbl_str);
- // Derived key K = H(eB)
- GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecdh_ecdsa (ecdh_privkey,
- aud_key,
- &new_key_hash));
- create_sym_key_from_ecdh(&new_key_hash, &skey, &iv);
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Encrypting token code %s\n", code_str);
- GNUNET_CRYPTO_symmetric_encrypt (code_str, strlen (code_str),
- &skey, &iv,
- *result);
+ token_code_payload = NULL;
+ GNUNET_assert (GNUNET_OK == encrypt_str_ecdhe (code_meta_str,
+ aud_key,
+ &token_code_payload,
+ &ecdh_pubkey));
+
purpose =
GNUNET_malloc (sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
sizeof (struct GNUNET_CRYPTO_EcdhePublicKey) + //E
- *result_len); // E_K (code_str)
+ strlen (code_meta_str)); // E_K (code_str)
purpose->size =
htonl (sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
sizeof (struct GNUNET_CRYPTO_EcdhePublicKey) +
- *result_len);
+ strlen (code_meta_str));
purpose->purpose = htonl(GNUNET_SIGNATURE_PURPOSE_GNUID_TOKEN_CODE);
write_ptr = (char*) &purpose[1];
- memcpy (write_ptr, ecdh_pubkey, sizeof (struct
GNUNET_CRYPTO_EcdhePublicKey));
+ memcpy (write_ptr, &ecdh_pubkey, sizeof (struct
GNUNET_CRYPTO_EcdhePublicKey));
write_ptr += sizeof (struct GNUNET_CRYPTO_EcdhePublicKey);
- memcpy (write_ptr, *result, *result_len);
+ memcpy (write_ptr, token_code_payload, strlen (code_meta_str));
if (GNUNET_OK != GNUNET_CRYPTO_ecdsa_sign (priv_key,
purpose,
- sig))
+ &sig))
{
GNUNET_free (purpose);
return GNUNET_SYSERR;
}
+
+ GNUNET_STRINGS_base64_encode (token_code_payload,
+ strlen (code_meta_str),
+ &token_code_payload_str);
+ token_code_sig_str = GNUNET_STRINGS_data_to_string_alloc (&sig,
+ sizeof (struct
GNUNET_CRYPTO_EcdsaSignature));
+ dh_key_str = GNUNET_STRINGS_data_to_string_alloc (&ecdh_pubkey,
+ sizeof (struct
GNUNET_CRYPTO_EcdhePublicKey));
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Using ECDH pubkey %s to encrypt\n",
dh_key_str);
+ GNUNET_asprintf (¶m_str, "{\"meta\": \"%s\", \"ecdh\": \"%s\",
\"signature\": \"%s\"}",
+ token_code_payload_str, dh_key_str, token_code_sig_str);
+ GNUNET_STRINGS_base64_encode (param_str, strlen (param_str), token_code_str);
+ GNUNET_free (dh_key_str);
GNUNET_free (purpose);
+ GNUNET_free (code_meta_str);
+ GNUNET_free (token_code_sig_str);
+ GNUNET_free (param_str);
+ GNUNET_free (token_code_payload);
+ GNUNET_free (token_code_payload_str);
return GNUNET_OK;
}
+
/**
* Build a GNUid token for identity
* @param handle the handle
@@ -511,11 +573,8 @@
const struct GNUNET_SCHEDULER_TaskContext *tc)
{
const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
-
struct GNUNET_CRYPTO_EcdsaSignature token_sig;
- struct GNUNET_CRYPTO_EcdsaSignature token_code_sig;
struct GNUNET_CRYPTO_EcdsaPublicKey aud_pkey;
- struct GNUNET_CRYPTO_EcdhePrivateKey *ecdh_privkey;
struct GNUNET_CRYPTO_EcdhePublicKey ecdh_pubkey;
struct GNUNET_CRYPTO_EccSignaturePurpose *purpose;
struct JsonApiResource *json_resource;
@@ -526,7 +585,6 @@
json_t *token_str;
json_t *name_str;
json_t *token_code_json;
- size_t token_code_payload_len;
char *header_str;
char *payload_str;
char *header_base64;
@@ -535,18 +593,13 @@
char *lbl_str;
char *token;
char *exp_str;
- char *renew_str;
char *token_code_str;
- char *token_code_payload;
- char *code_meta_str;
char *audience;
char *nonce_str;
- char *param_str;
- char *token_code_sig_str;
- char *token_code_payload_str;
+ char *record_data;
char *dh_key_str;
- char *record_data;
- int renew_token = GNUNET_NO;
+ char *enc_token;
+ char *enc_token_str;
uint64_t time;
uint64_t exp_time;
uint64_t rnd_key;
@@ -594,50 +647,21 @@
return;
}
- time = GNUNET_TIME_absolute_get().abs_value_us;
+
rnd_key = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_STRONG,
UINT64_MAX);
GNUNET_STRINGS_base64_encode ((char*)&rnd_key, sizeof (uint64_t), &lbl_str);
- GNUNET_asprintf (&code_meta_str,
- "{\"nonce\": \"%u\",\"identity\": \"%s\",\"label\":
\"%s\"}",
- nonce_str, handle->ego_entry->keystring, lbl_str);
priv_key = GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
-
- // ECDH keypair E = eG
- ecdh_privkey = GNUNET_CRYPTO_ecdhe_key_create();
- token_code_payload_len = 0;
- token_code_payload = NULL;
- GNUNET_CRYPTO_ecdhe_key_get_public (ecdh_privkey,
- &ecdh_pubkey);
- if (GNUNET_OK != create_token_code (priv_key,
- ecdh_privkey,
- &ecdh_pubkey,
- code_meta_str,
+ if (GNUNET_OK != create_token_code (nonce_str,
+ handle->ego_entry->keystring,
+ lbl_str,
+ priv_key,
&aud_pkey,
- &token_code_payload,
- &token_code_payload_len,
- &token_code_sig))
+ &token_code_str))
{
handle->emsg = GNUNET_strdup ("Unable to create ref token!\n");
- GNUNET_free (code_meta_str);
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
}
- GNUNET_free (code_meta_str);
- GNUNET_STRINGS_base64_encode (token_code_payload,
- token_code_payload_len,
- &token_code_payload_str);
- token_code_sig_str = GNUNET_STRINGS_data_to_string_alloc (&token_code_sig,
- sizeof (struct
GNUNET_CRYPTO_EcdsaSignature));
- dh_key_str = GNUNET_STRINGS_data_to_string_alloc (&ecdh_pubkey,
- sizeof (struct
GNUNET_CRYPTO_EcdhePublicKey));
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Using ECDH pubkey %s to encrypt\n",
dh_key_str);
- GNUNET_asprintf (¶m_str, "{\"meta\": \"%s\", \"ecdh\": \"%s\",
\"signature\": \"%s\"}",
- token_code_payload_str, dh_key_str, token_code_sig_str);
- GNUNET_STRINGS_base64_encode (param_str, strlen (param_str),
&token_code_str);
- GNUNET_free (token_code_sig_str);
- GNUNET_free (param_str);
- GNUNET_free (token_code_payload);
- GNUNET_free (token_code_payload_str);
GNUNET_CRYPTO_hash (GNUNET_IDENTITY_TOKEN_EXP_STRING,
strlen (GNUNET_IDENTITY_TOKEN_EXP_STRING),
@@ -664,23 +688,9 @@
GNUNET_SCHEDULER_add_now (&do_error, handle);
return;
}
+ time = GNUNET_TIME_absolute_get().abs_value_us;
exp_time = time + etime_rel.rel_value_us;
- //Get renewal policy for token
- GNUNET_CRYPTO_hash (GNUNET_IDENTITY_TOKEN_RENEW_TOKEN,
- strlen (GNUNET_IDENTITY_TOKEN_RENEW_TOKEN),
- &key);
-
-
- if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains
(handle->conndata_handle->url_param_map,
- &key))
- {
- renew_str = GNUNET_CONTAINER_multihashmap_get
(handle->conndata_handle->url_param_map,
- &key);
- if (0 == strcmp (renew_str, "true"))
- renew_token = GNUNET_YES;
- }
-
//json_object_set_new (handle->payload, "lbl", json_string (lbl_str));
json_object_set_new (handle->payload, "sub", json_string
(handle->ego_entry->identifier));
json_object_set_new (handle->payload, "nbf", json_integer (time));
@@ -688,10 +698,6 @@
json_object_set_new (handle->payload, "exp", json_integer (exp_time));
json_object_set_new (handle->payload, "nonce",
json_string (nonce_str));
- if (GNUNET_YES == renew_token)
- {
- json_object_set_new (handle->payload, "rnl", json_string ("yes"));
- }
header_str = json_dumps (handle->header, JSON_COMPACT);
GNUNET_STRINGS_base64_encode (header_str,
@@ -736,6 +742,16 @@
json_decref (handle->header);
json_decref (handle->payload);
+
+ GNUNET_assert (GNUNET_OK == encrypt_str_ecdhe (token,
+ &aud_pkey,
+ &enc_token,
+ &ecdh_pubkey));
+ GNUNET_STRINGS_base64_encode (enc_token,
+ strlen (token),
+ &enc_token_str);
+ dh_key_str = GNUNET_STRINGS_data_to_string_alloc (&ecdh_pubkey,
+ sizeof (struct
GNUNET_CRYPTO_EcdhePublicKey));
handle->resp_object = GNUNET_REST_jsonapi_object_new ();
json_resource = GNUNET_REST_jsonapi_resource_new
(GNUNET_REST_JSONAPI_IDENTITY_TOKEN,
@@ -748,7 +764,7 @@
- token_str = json_string (token);
+ token_str = json_string (enc_token_str);
GNUNET_REST_jsonapi_resource_add_attr (json_resource,
GNUNET_REST_JSONAPI_IDENTITY_TOKEN,
token_str);
@@ -759,16 +775,12 @@
GNUNET_free (token_code_str);
json_decref (token_code_json);
GNUNET_REST_jsonapi_object_resource_add (handle->resp_object, json_resource);
-
- GNUNET_asprintf (&record_data, "%s,%s", dh_key_str, token);
- GNUNET_free (dh_key_str);
+ GNUNET_asprintf (&record_data, "%s,%s", dh_key_str, enc_token_str);
token_record.data = record_data;
token_record.data_size = strlen (record_data) + 1;
token_record.expiration_time = exp_time;
token_record.record_type = GNUNET_GNSRECORD_TYPE_ID_TOKEN;
token_record.flags = GNUNET_GNSRECORD_RF_NONE;
- if (GNUNET_YES == renew_token)
- token_record.flags |= GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
//Persist token
handle->ns_qe = GNUNET_NAMESTORE_records_store (handle->ns_handle,
priv_key,
@@ -780,7 +792,9 @@
GNUNET_free (record_data);
GNUNET_free (lbl_str);
GNUNET_free (token);
- GNUNET_free (ecdh_privkey);
+ GNUNET_free (dh_key_str);
+ GNUNET_free (enc_token);
+ GNUNET_free (enc_token_str);
json_decref (token_str);
}
@@ -1136,6 +1150,52 @@
}
+/**
+ * Decrypts metainfo part from a token code
+ */
+static int
+decrypt_str_ecdhe (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key,
+ const struct GNUNET_CRYPTO_EcdhePublicKey *ecdh_key,
+ const char *enc_str,
+ size_t enc_str_len,
+ char **result_str)
+{
+ struct GNUNET_HashCode new_key_hash;
+ struct GNUNET_CRYPTO_SymmetricSessionKey enc_key;
+ struct GNUNET_CRYPTO_SymmetricInitializationVector enc_iv;
+
+ char *str_buf = GNUNET_malloc (enc_str_len);
+ size_t str_size;
+
+ //Calculate symmetric key from ecdh parameters
+ GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecdsa_ecdh (priv_key,
+ ecdh_key,
+ &new_key_hash));
+
+ create_sym_key_from_ecdh (&new_key_hash,
+ &enc_key,
+ &enc_iv);
+
+ str_size = GNUNET_CRYPTO_symmetric_decrypt (enc_str,
+ enc_str_len,
+ &enc_key,
+ &enc_iv,
+ str_buf);
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Decrypted bytes: %d Expected bytes:
%d\n", str_size, enc_str_len);
+ if (-1 == str_size)
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "ECDH invalid\n");
+ return GNUNET_SYSERR;
+ }
+ *result_str = GNUNET_malloc (str_size+1);
+ memcpy (*result_str, str_buf, str_size);
+ (*result_str)[str_size] = '\0';
+ GNUNET_free (str_buf);
+ return GNUNET_OK;
+
+}
+
+
static void
process_lookup_result (void *cls, uint32_t rd_count,
const struct GNUNET_GNSRECORD_Data *rd)
@@ -1145,6 +1205,12 @@
struct MHD_Response *resp;
char *result;
char* token_str;
+ char* ecdh_pubkey_str;
+ char* enc_token;
+ char* enc_token_str;
+ char* record_str;
+ size_t enc_token_len;
+ struct GNUNET_CRYPTO_EcdhePublicKey ecdh_pubkey;
handle->lookup_request = NULL;
if (1 != rd_count)
@@ -1158,13 +1224,33 @@
}
root = json_object();
- token_str =
+ record_str =
GNUNET_GNSRECORD_value_to_string (GNUNET_GNSRECORD_TYPE_ID_TOKEN,
rd->data,
rd->data_size);
+
+ ecdh_pubkey_str = strtok (record_str, ",");
+ enc_token_str = strtok (NULL, ",");
+
+ GNUNET_STRINGS_string_to_data (ecdh_pubkey_str,
+ strlen (ecdh_pubkey_str),
+ &ecdh_pubkey,
+ sizeof (struct GNUNET_CRYPTO_EcdhePublicKey));
+ enc_token_len = GNUNET_STRINGS_base64_decode (enc_token_str,
+ strlen (enc_token_str),
+ &enc_token);
+
+ GNUNET_assert (GNUNET_OK == decrypt_str_ecdhe ( handle->priv_key,
+ &ecdh_pubkey,
+ enc_token,
+ enc_token_len,
+ &token_str));
+
json_object_set_new (root, "access_token", json_string (token_str));
json_object_set_new (root, "token_type", json_string ("gnuid"));
+ GNUNET_free (enc_token);
GNUNET_free (token_str);
+ GNUNET_free (record_str);
result = json_dumps (root, JSON_INDENT(1));
GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "%s\n", result);
@@ -1176,53 +1262,7 @@
}
-/**
- * Decrypts metainfo part from a token code
- */
static int
-decrypt_meta_str (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key,
- const struct GNUNET_CRYPTO_EcdhePublicKey *ecdh_key,
- const char *enc_meta,
- size_t enc_meta_len,
- struct GNUNET_CRYPTO_EcdsaSignature *signature,
- char **meta_str)
-{
- struct GNUNET_HashCode new_key_hash;
- struct GNUNET_CRYPTO_SymmetricSessionKey enc_key;
- struct GNUNET_CRYPTO_SymmetricInitializationVector enc_iv;
-
- char *meta_str_buf = GNUNET_malloc (enc_meta_len);
- size_t meta_size;
-
- //Calculate symmetric key from ecdh parameters
- GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecdsa_ecdh (priv_key,
- ecdh_key,
- &new_key_hash));
-
- create_sym_key_from_ecdh (&new_key_hash,
- &enc_key,
- &enc_iv);
-
- meta_size = GNUNET_CRYPTO_symmetric_decrypt (enc_meta,
- enc_meta_len,
- &enc_key,
- &enc_iv,
- meta_str_buf);
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Decrypted bytes: %d Expected bytes:
%d\n", meta_size, enc_meta_len);
- if (-1 == meta_size)
- {
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "ECDH signature invalid in
metadata\n");
- return GNUNET_SYSERR;
- }
- *meta_str = GNUNET_malloc (meta_size+1);
- memcpy (*meta_str, meta_str_buf, meta_size);
- (*meta_str)[meta_size] = '\0';
- GNUNET_free (meta_str_buf);
- return GNUNET_OK;
-
-}
-
-static int
extract_values_from_token_code (const char *token_code,
const struct GNUNET_CRYPTO_EcdsaPrivateKey
*priv_key,
struct GNUNET_CRYPTO_EcdsaSignature *signature,
@@ -1289,12 +1329,13 @@
strlen (enc_meta_str),
&enc_meta);
- if (GNUNET_OK != decrypt_meta_str (priv_key,
- ecdhe_pkey,
- enc_meta,
- enc_meta_len,
- signature,
- &meta_str))
+ //TODO: check signature here
+
+ if (GNUNET_OK != decrypt_str_ecdhe (priv_key,
+ ecdhe_pkey,
+ enc_meta,
+ enc_meta_len,
+ &meta_str))
{
GNUNET_free (enc_meta);
json_decref(root);
@@ -1355,8 +1396,6 @@
void **ctx,
const char *name)
{
- const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_key;
-
struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
struct GNUNET_CRYPTO_EcdsaSignature sig;
struct GNUNET_CRYPTO_EcdhePublicKey echde_pkey;
@@ -1390,12 +1429,12 @@
code = GNUNET_CONTAINER_multihashmap_get
(handle->conndata_handle->url_param_map,
&key);
- priv_key = GNUNET_IDENTITY_ego_get_private_key (ego);
+ handle->priv_key = GNUNET_IDENTITY_ego_get_private_key (ego);
label = NULL;
if (GNUNET_SYSERR == extract_values_from_token_code (code,
- priv_key,
+ handle->priv_key,
&sig,
&echde_pkey,
&label,
| [Prev in Thread] |
Current Thread |
[Next in Thread] |
- [GNUnet-SVN] r36785 - gnunet/src/identity-token,
gnunet <=