1/* $OpenBSD: wg_noise.h,v 1.3 2024/03/05 17:48:01 mvs Exp $ */
2/*
3 * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 * Copyright (C) 2019-2020 Matt Dunwoodie <ncon@noconroy.net>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#ifndef __NOISE_H__
20#define __NOISE_H__
21
22#include <sys/types.h>
23#include <sys/time.h>
24#include <sys/mutex.h>
25#include <sys/rwlock.h>
26
27#include <crypto/blake2s.h>
28#include <crypto/chachapoly.h>
29#include <crypto/curve25519.h>
30
31#define NOISE_PUBLIC_KEY_LEN CURVE25519_KEY_SIZE
32#define NOISE_SYMMETRIC_KEY_LEN CHACHA20POLY1305_KEY_SIZE
33#define NOISE_TIMESTAMP_LEN (sizeof(uint64_t) + sizeof(uint32_t))
34#define NOISE_AUTHTAG_LEN CHACHA20POLY1305_AUTHTAG_SIZE
35#define NOISE_HASH_LEN BLAKE2S_HASH_SIZE
36
37/* Protocol string constants */
38#define NOISE_HANDSHAKE_NAME "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s"
39#define NOISE_IDENTIFIER_NAME "WireGuard v1 zx2c4 Jason@zx2c4.com"
40
41/* Constants for the counter */
42#define COUNTER_BITS_TOTAL 8192
43#define COUNTER_BITS (sizeof(unsigned long) * 8)
44#define COUNTER_NUM (COUNTER_BITS_TOTAL / COUNTER_BITS)
45#define COUNTER_WINDOW_SIZE (COUNTER_BITS_TOTAL - COUNTER_BITS)
46
47/* Constants for the keypair */
48#define REKEY_AFTER_MESSAGES (1ull << 60)
49#define REJECT_AFTER_MESSAGES (UINT64_MAX - COUNTER_WINDOW_SIZE - 1)
50#define REKEY_AFTER_TIME 120
51#define REKEY_AFTER_TIME_RECV 165
52#define REJECT_AFTER_TIME 180
53#define REJECT_INTERVAL (1000000000 / 50) /* fifty times per sec */
54/* 24 = floor(log2(REJECT_INTERVAL)) */
55#define REJECT_INTERVAL_MASK (~((1ull<<24)-1))
56
57enum noise_state_hs {
58 HS_ZEROED = 0,
59 CREATED_INITIATION,
60 CONSUMED_INITIATION,
61 CREATED_RESPONSE,
62 CONSUMED_RESPONSE,
63};
64
65struct noise_handshake {
66 enum noise_state_hs hs_state;
67 uint32_t hs_local_index;
68 uint32_t hs_remote_index;
69 uint8_t hs_e[NOISE_PUBLIC_KEY_LEN];
70 uint8_t hs_hash[NOISE_HASH_LEN];
71 uint8_t hs_ck[NOISE_HASH_LEN];
72};
73
74struct noise_counter {
75 struct mutex c_mtx;
76 uint64_t c_send;
77 uint64_t c_recv;
78 unsigned long c_backtrack[COUNTER_NUM];
79};
80
81struct noise_keypair {
82 SLIST_ENTRY(noise_keypair) kp_entry;
83 int kp_valid;
84 int kp_is_initiator;
85 uint32_t kp_local_index;
86 uint32_t kp_remote_index;
87 uint8_t kp_send[NOISE_SYMMETRIC_KEY_LEN];
88 uint8_t kp_recv[NOISE_SYMMETRIC_KEY_LEN];
89 struct timespec kp_birthdate; /* nanouptime */
90 struct noise_counter kp_ctr;
91};
92
93struct noise_remote {
94 uint8_t r_public[NOISE_PUBLIC_KEY_LEN];
95 struct noise_local *r_local;
96 uint8_t r_ss[NOISE_PUBLIC_KEY_LEN];
97
98 struct rwlock r_handshake_lock;
99 struct noise_handshake r_handshake;
100 uint8_t r_psk[NOISE_SYMMETRIC_KEY_LEN];
101 uint8_t r_timestamp[NOISE_TIMESTAMP_LEN];
102 struct timespec r_last_init; /* nanouptime */
103
104 struct mutex r_keypair_mtx;
105 SLIST_HEAD(,noise_keypair) r_unused_keypairs;
106 struct noise_keypair *r_next, *r_current, *r_previous;
107 struct noise_keypair r_keypair[3]; /* 3: next, current, previous. */
108
109};
110
111struct noise_local {
112 struct rwlock l_identity_lock;
113 int l_has_identity;
114 uint8_t l_public[NOISE_PUBLIC_KEY_LEN];
115 uint8_t l_private[NOISE_PUBLIC_KEY_LEN];
116
117 struct noise_upcall {
118 void *u_arg;
119 struct noise_remote *
120 (*u_remote_get)(void *, uint8_t[NOISE_PUBLIC_KEY_LEN]);
121 uint32_t
122 (*u_index_set)(void *, struct noise_remote *);
123 void (*u_index_drop)(void *, uint32_t);
124 } l_upcall;
125};
126
127/* Set/Get noise parameters */
128void noise_local_init(struct noise_local *, struct noise_upcall *);
129void noise_local_lock_identity(struct noise_local *);
130void noise_local_unlock_identity(struct noise_local *);
131int noise_local_set_private(struct noise_local *, uint8_t[NOISE_PUBLIC_KEY_LEN]);
132int noise_local_keys(struct noise_local *, uint8_t[NOISE_PUBLIC_KEY_LEN],
133 uint8_t[NOISE_PUBLIC_KEY_LEN]);
134
135void noise_remote_init(struct noise_remote *, uint8_t[NOISE_PUBLIC_KEY_LEN],
136 struct noise_local *);
137int noise_remote_set_psk(struct noise_remote *, uint8_t[NOISE_SYMMETRIC_KEY_LEN]);
138int noise_remote_keys(struct noise_remote *, uint8_t[NOISE_PUBLIC_KEY_LEN],
139 uint8_t[NOISE_SYMMETRIC_KEY_LEN]);
140
141/* Should be called anytime noise_local_set_private is called */
142void noise_remote_precompute(struct noise_remote *);
143
144/* Cryptographic functions */
145int noise_create_initiation(
146 struct noise_remote *,
147 uint32_t *s_idx,
148 uint8_t ue[NOISE_PUBLIC_KEY_LEN],
149 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN],
150 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]);
151
152int noise_consume_initiation(
153 struct noise_local *,
154 struct noise_remote **,
155 uint32_t s_idx,
156 uint8_t ue[NOISE_PUBLIC_KEY_LEN],
157 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN],
158 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]);
159
160int noise_create_response(
161 struct noise_remote *,
162 uint32_t *s_idx,
163 uint32_t *r_idx,
164 uint8_t ue[NOISE_PUBLIC_KEY_LEN],
165 uint8_t en[0 + NOISE_AUTHTAG_LEN]);
166
167int noise_consume_response(
168 struct noise_remote *,
169 uint32_t s_idx,
170 uint32_t r_idx,
171 uint8_t ue[NOISE_PUBLIC_KEY_LEN],
172 uint8_t en[0 + NOISE_AUTHTAG_LEN]);
173
174int noise_remote_begin_session(struct noise_remote *);
175void noise_remote_clear(struct noise_remote *);
176void noise_remote_expire_current(struct noise_remote *);
177
178int noise_remote_ready(struct noise_remote *);
179
180int noise_remote_encrypt(
181 struct noise_remote *,
182 uint32_t *r_idx,
183 uint64_t *nonce,
184 uint8_t *buf,
185 size_t buflen);
186int noise_remote_decrypt(
187 struct noise_remote *,
188 uint32_t r_idx,
189 uint64_t nonce,
190 uint8_t *buf,
191 size_t buflen);
192
193#ifdef WGTEST
194void noise_test();
195#endif /* WGTEST */
196
197#endif /* __NOISE_H__ */