TySS-Dev/nearby
1
0
Fork 0
mirror of https://github.com/kidfromjupiter/nearby.git synced 2026-09-14 22:56:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

Extend local and shared credential protos to included duplicated metadata_encryption_key and metadata_encryption_key_tag for all protocol version

Browse Source 
PiperOrigin-RevId: 538612138
This commit is contained in:
Anthony Rueda
2023-06-07 15:43:30 -07:00
committed by Copybara-Service
parent e101795cac
commit 72b249474d
9 changed files with 42 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/proto/credential.proto
+12 -5
View File
@@ -40,7 +40,7 @@ enum CredentialType {
// The shared credential is derived from local credential, and distributed to
// remote devices based on the trust token for identity decryption and
// authentication.
// NEXT_ID=12
// NEXT_ID=14
message SharedCredential {
// The randomly generated unique id of the public credential.
bytes secret_id = 1;
@@ -54,12 +54,12 @@ message SharedCredential {
// The time in millis from epoch when this credential expires.
int64 end_time_millis = 4;
// The encrypted Metadata in bytes. Encrypted either by the v0 or v1
// The encrypted Metadata in bytes. Encrypted by the v0
// metadata_encryption_key.
bytes encrypted_metadata_bytes = 5;
bytes encrypted_metadata_bytes_v0 = 5;
// The tag for verifying metadata_encryption_key.
bytes metadata_encryption_key_tag = 6;
// The tag for verifying metadata_encryption_key for an unsigned adv.
bytes metadata_encryption_key_unsigned_adv_tag = 6;
// The public key is used to create a secure connection with the device.
bytes connection_signature_verification_key = 7;
@@ -83,4 +83,11 @@ message SharedCredential {
// determine whether a device identity credential or account based identity
// credential is used for decryption.
CredentialType type = 11;
// The encrypted Metadata in bytes. Encrypted by the v1
// metadata_encryption_key.
bytes encrypted_metadata_bytes_v1 = 12;
// The tag for verifying metadata_encryption_key for a signed V1 adv.
bytes metadata_encryption_key_signed_adv_tag = 13;
}
internal/proto/local_credential.proto
+5 -2
View File
@@ -52,8 +52,8 @@ message LocalCredential {
// The time in millis from epoch when this credential expires.
int64 end_time_millis = 4;
// The 14 or 16 bytes aes key to encrypt metadata in PublicCredential.
bytes metadata_encryption_key = 5;
// The 14 bytes aes key to encrypt metadata in PublicCredential.
bytes metadata_encryption_key_v0 = 5;
// It is used for signing advertisement.
PrivateKey advertisement_signing_key = 6;
@@ -68,4 +68,7 @@ message LocalCredential {
// The set of 2-byte salts already used to encrypt the metadata key.
map<uint32, bool> consumed_salts = 9;
// The 16 bytes aes key to encrypt metadata in PublicCredential.
bytes metadata_encryption_key_v1 = 10;
}
presence/implementation/advertisement_decoder.cc
+2 -1
View File
@@ -213,7 +213,8 @@ absl::StatusOr<std::string> AdvertisementDecoder::DecryptLdt(
}
for (const auto& credential : credentials) {
absl::StatusOr<LdtEncryptor> encryptor = LdtEncryptor::Create(
credential.key_seed(), credential.metadata_encryption_key_tag());
credential.key_seed(),
credential.metadata_encryption_key_unsigned_adv_tag());
if (encryptor.ok()) {
absl::StatusOr<std::string> result =
encryptor->DecryptAndVerify(data_elements, salt);
presence/implementation/advertisement_decoder_test.cc
+2 -1
View File
@@ -78,7 +78,8 @@ SharedCredential GetPublicCredential() {
163, 203, 100, 235, 53, 65, 202, 97, 75, 180});
SharedCredential public_credential;
public_credential.set_key_seed(seed.AsStringView());
public_credential.set_metadata_encryption_key_tag(known_mac.AsStringView());
public_credential.set_metadata_encryption_key_unsigned_adv_tag(
known_mac.AsStringView());
return public_credential;
}
presence/implementation/advertisement_factory.cc
+3 -3
View File
@@ -198,10 +198,10 @@ AdvertisementFactory::CreateBaseNpAdvertisement(
absl::StatusOr<std::string> AdvertisementFactory::EncryptDataElements(
const LocalCredential& credential, absl::string_view salt,
absl::string_view data_elements) const {
if (credential.metadata_encryption_key().size() != kBaseMetadataSize) {
if (credential.metadata_encryption_key_v0().size() != kBaseMetadataSize) {
return absl::FailedPreconditionError(absl::StrFormat(
"Metadata key size %d, expected %d",
credential.metadata_encryption_key().size(), kBaseMetadataSize));
credential.metadata_encryption_key_v0().size(), kBaseMetadataSize));
}
// HMAC is not used during encryption, so we can pass an empty value.
@@ -211,7 +211,7 @@ absl::StatusOr<std::string> AdvertisementFactory::EncryptDataElements(
return encryptor.status();
}
std::string plaintext =
absl::StrCat(credential.metadata_encryption_key(), data_elements);
absl::StrCat(credential.metadata_encryption_key_v0(), data_elements);
return encryptor->Encrypt(plaintext, salt);
}
presence/implementation/advertisement_factory_test.cc
+2 -1
View File
@@ -52,7 +52,8 @@ LocalCredential CreateLocalCredential(IdentityType identity_type) {
LocalCredential private_credential;
private_credential.set_identity_type(identity_type);
private_credential.set_key_seed(seed.AsStringView());
private_credential.set_metadata_encryption_key(metadata_key.AsStringView());
private_credential.set_metadata_encryption_key_v0(
metadata_key.AsStringView());
return private_credential;
}
presence/implementation/credential_manager_impl.cc
+5 -5
View File
@@ -199,7 +199,7 @@ CredentialManagerImpl::CreateLocalCredential(const Metadata& metadata,
std::string metadata_key(kBaseMetadataSize, 0);
crypto::RandBytes(const_cast<std::string::value_type*>(metadata_key.data()),
metadata_key.size());
private_credential.set_metadata_encryption_key(metadata_key);
private_credential.set_metadata_encryption_key_v0(metadata_key);
// Generate the public credential
std::vector<uint8_t> public_key;
@@ -235,13 +235,13 @@ SharedCredential CredentialManagerImpl::CreatePublicCredential(
std::string(public_key.begin(), public_key.end()));
auto metadata_encryption_key_tag =
Crypto::Sha256(private_credential.metadata_encryption_key());
public_credential.set_metadata_encryption_key_tag(
Crypto::Sha256(private_credential.metadata_encryption_key_v0());
public_credential.set_metadata_encryption_key_unsigned_adv_tag(
std::string(metadata_encryption_key_tag.AsStringView()));
// Encrypt the device metadata
auto encrypted_meta_data = EncryptMetadata(
private_credential.metadata_encryption_key(),
private_credential.metadata_encryption_key_v0(),
private_credential.key_seed(), metadata.SerializeAsString());
if (encrypted_meta_data.empty()) {
@@ -251,7 +251,7 @@ SharedCredential CredentialManagerImpl::CreatePublicCredential(
return public_credential;
}
public_credential.set_encrypted_metadata_bytes(encrypted_meta_data);
public_credential.set_encrypted_metadata_bytes_v0(encrypted_meta_data);
return public_credential;
}
presence/implementation/credential_manager_impl_test.cc
+8 -8
View File
@@ -155,7 +155,7 @@ TEST_F(CredentialManagerImplTest, CreateOneCredentialSuccessfully) {
EXPECT_EQ(private_credential.key_seed().size(),
CredentialManagerImpl::kAuthenticityKeyByteSize);
EXPECT_FALSE(private_credential.connection_signing_key().key().empty());
EXPECT_EQ(private_credential.metadata_encryption_key().size(),
EXPECT_EQ(private_credential.metadata_encryption_key_v0().size(),
kBaseMetadataSize);
SharedCredential public_credential = credentials.second;
@@ -170,19 +170,19 @@ TEST_F(CredentialManagerImplTest, CreateOneCredentialSuccessfully) {
EXPECT_GE(public_credential.end_time_millis(), absl::ToUnixMillis(kEndTime));
EXPECT_LE(public_credential.end_time_millis(),
absl::ToUnixMillis(kEndTime + absl::Hours(3)));
EXPECT_EQ(Crypto::Sha256(private_credential.metadata_encryption_key())
EXPECT_EQ(Crypto::Sha256(private_credential.metadata_encryption_key_v0())
.AsStringView(),
public_credential.metadata_encryption_key_tag());
public_credential.metadata_encryption_key_unsigned_adv_tag());
EXPECT_FALSE(
public_credential.connection_signature_verification_key().empty());
EXPECT_FALSE(public_credential.encrypted_metadata_bytes().empty());
EXPECT_FALSE(public_credential.encrypted_metadata_bytes_v0().empty());
// Decrypt the device metadata
auto decrypted_metadata = credential_manager_.DecryptMetadata(
private_credential.metadata_encryption_key(),
private_credential.metadata_encryption_key_v0(),
public_credential.key_seed(),
public_credential.encrypted_metadata_bytes());
public_credential.encrypted_metadata_bytes_v0());
EXPECT_EQ(metadata.SerializeAsString(), decrypted_metadata);
}
@@ -220,7 +220,7 @@ TEST_F(CredentialManagerImplTest, GenerateCredentialsSuccessfully) {
}
EXPECT_LT(start_time_millis + absl::Hours(24) * kLifeCycleDays,
end_time_millis);
EXPECT_FALSE(public_credential.encrypted_metadata_bytes().empty());
EXPECT_FALSE(public_credential.encrypted_metadata_bytes_v0().empty());
previous_start_time = start_time_millis;
previous_end_time = end_time_millis;
}
@@ -567,7 +567,7 @@ TEST_F(CredentialManagerImplTest, ParseAndroidSharedCredential) {
std::string decrypted_metadata = credential_manager_.DecryptMetadata(
absl::HexStringToBytes(kMetadataEncryptionKeyBase16),
shared_credential.key_seed(),
shared_credential.encrypted_metadata_bytes());
shared_credential.encrypted_metadata_bytes_v0());
Metadata metadata;
ASSERT_TRUE(metadata.ParseFromString(decrypted_metadata));
EXPECT_THAT(metadata, EqualsProto(expected_metadata));
presence/implementation/ldt_test.cc
+3 -3
View File
@@ -87,9 +87,9 @@ TEST(Ldt, DecryptAndroidData) {
SharedCredential shared_credential;
ASSERT_TRUE(shared_credential.ParseFromString(
absl::HexStringToBytes(kSharedCredentialBase16)));
absl::StatusOr<LdtEncryptor> encryptor =
LdtEncryptor::Create(shared_credential.key_seed(),
shared_credential.metadata_encryption_key_tag());
absl::StatusOr<LdtEncryptor> encryptor = LdtEncryptor::Create(
shared_credential.key_seed(),
shared_credential.metadata_encryption_key_unsigned_adv_tag());
ASSERT_OK(encryptor);
absl::StatusOr<std::string> decrypted =