add token framing, crypto and errors
This commit is contained in:
juancwu
parent
71483982ca
commit
a6aad1a1d6
5 changed files with 448 additions and 0 deletions
56
crypto.go
Normal file
56
crypto.go
Normal file
|
|
@ -0,0 +1,56 @@
|
||||||
|
package ficha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/chacha20poly1305"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
keySize = chacha20poly1305.KeySize
|
||||||
|
nonceSize = chacha20poly1305.NonceSizeX
|
||||||
|
)
|
||||||
|
|
||||||
|
// encrypt seals plaintext under key. aad is authenticated but not encrypted.
|
||||||
|
// A fresh random nonce is generated per call; with a 24-byte nonce, random generation is collision-safe.
|
||||||
|
func encrypt(key, plaintext, aad []byte) (nonce, ciphertext []byte, err error) {
|
||||||
|
if len(key) != keySize {
|
||||||
|
return nil, nil, fmt.Errorf("ficha: key must be %d bytes, got %d", keySize, len(key))
|
||||||
|
}
|
||||||
|
|
||||||
|
aead, err := chacha20poly1305.NewX(key)
|
||||||
|
if err != nil {
|
||||||
|
return nil, nil, fmt.Errorf("ficha: init aead: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
nonce = make([]byte, nonceSize)
|
||||||
|
if _, err := rand.Read(nonce); err != nil {
|
||||||
|
return nil, nil, fmt.Errorf("ficha: read random nonce: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
ciphertext = aead.Seal(nil, nonce, plaintext, aad)
|
||||||
|
return nonce, ciphertext, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// decrypt verifies and opens ciphertext. Any auth failure returns ErrInvalidToken
|
||||||
|
func decrypt(key, nonce, ciphertext, aad []byte) ([]byte, error) {
|
||||||
|
if len(key) != keySize {
|
||||||
|
return nil, fmt.Errorf("ficha: key must be %d bytes, got %d", keySize, len(key))
|
||||||
|
}
|
||||||
|
if len(nonce) != nonceSize {
|
||||||
|
return nil, errors.New("ficha: invalid nonce size")
|
||||||
|
}
|
||||||
|
|
||||||
|
aead, err := chacha20poly1305.NewX(key)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("ficha: init aead: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
plaintext, err := aead.Open(nil, nonce, ciphertext, aad)
|
||||||
|
if err != nil {
|
||||||
|
return nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
return plaintext, nil
|
||||||
|
}
|
||||||
155
crypto_test.go
Normal file
155
crypto_test.go
Normal file
|
|
@ -0,0 +1,155 @@
|
||||||
|
package ficha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"crypto/rand"
|
||||||
|
"errors"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func testKey(t *testing.T) []byte {
|
||||||
|
t.Helper()
|
||||||
|
k := make([]byte, keySize)
|
||||||
|
if _, err := rand.Read(k); err != nil {
|
||||||
|
t.Fatalf("generate key: %v", err)
|
||||||
|
}
|
||||||
|
return k
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestEncryptDecryptRoundtrip(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
plaintext := []byte("hello, ficha")
|
||||||
|
aad := []byte("v1.k1")
|
||||||
|
|
||||||
|
nonce, ciphertext, err := encrypt(key, plaintext, aad)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(nonce) != nonceSize {
|
||||||
|
t.Errorf("nonce size: got %d, want %d", len(nonce), nonceSize)
|
||||||
|
}
|
||||||
|
if len(ciphertext) != len(plaintext)+16 {
|
||||||
|
t.Errorf("ciphertext size: got %d, want %d", len(ciphertext), len(plaintext)+16)
|
||||||
|
}
|
||||||
|
|
||||||
|
got, err := decrypt(key, nonce, ciphertext, aad)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decrypt: %v", err)
|
||||||
|
}
|
||||||
|
if !bytes.Equal(got, plaintext) {
|
||||||
|
t.Errorf("got %q, want %q", got, plaintext)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestEncryptDecryptEmptyPlaintext(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
nonce, ciphertext, err := encrypt(key, []byte{}, []byte("aad"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
got, err := decrypt(key, nonce, ciphertext, []byte("aad"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decrypt: %v", err)
|
||||||
|
}
|
||||||
|
if len(got) != 0 {
|
||||||
|
t.Errorf("expected empty plaintext, got %q", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecryptWrongKey(t *testing.T) {
|
||||||
|
key1 := testKey(t)
|
||||||
|
key2 := testKey(t)
|
||||||
|
|
||||||
|
nonce, ciphertext, err := encrypt(key1, []byte("secret"), []byte("v1.k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := decrypt(key2, nonce, ciphertext, []byte("v1.k1")); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecryptTamperedCiphertext(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
nonce, ciphertext, err := encrypt(key, []byte("don't tamper"), []byte("v1.k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tampered := append([]byte(nil), ciphertext...)
|
||||||
|
tampered[len(tampered)/2] ^= 0x01
|
||||||
|
|
||||||
|
if _, err := decrypt(key, nonce, tampered, []byte("v1.k1")); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecryptTamperedNonce(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
nonce, ciphertext, err := encrypt(key, []byte("nonce matters"), []byte("v1.k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tampered := append([]byte(nil), nonce...)
|
||||||
|
tampered[0] ^= 0x01
|
||||||
|
|
||||||
|
if _, err := decrypt(key, tampered, ciphertext, []byte("v1.k1")); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecryptTamperedAAD(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
nonce, ciphertext, err := encrypt(key, []byte("aad authenticated"), []byte("v1.k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := decrypt(key, nonce, ciphertext, []byte("v1.k2")); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecryptInvalidSizes(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
keyLen int
|
||||||
|
nonceLen int
|
||||||
|
}{
|
||||||
|
{"key too short", 16, nonceSize},
|
||||||
|
{"key too long", 64, nonceSize},
|
||||||
|
{"nonce too short", keySize, 12},
|
||||||
|
{"nonce too long", keySize, 32},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
key := make([]byte, tc.keyLen)
|
||||||
|
nonce := make([]byte, tc.nonceLen)
|
||||||
|
ct := make([]byte, 32)
|
||||||
|
if _, err := decrypt(key, nonce, ct, nil); err == nil {
|
||||||
|
t.Error("expected error, got nil")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestEncryptProducesUniqueNonces(t *testing.T) {
|
||||||
|
key := testKey(t)
|
||||||
|
const N = 1000
|
||||||
|
seen := make(map[string]bool, N)
|
||||||
|
|
||||||
|
for i := 0; i < N; i++ {
|
||||||
|
nonce, _, err := encrypt(key, []byte("same message"), []byte("v1.k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("iter %d: %v", i, err)
|
||||||
|
}
|
||||||
|
if seen[string(nonce)] {
|
||||||
|
t.Fatalf("duplicate nonce after %d iterations", i)
|
||||||
|
}
|
||||||
|
seen[string(nonce)] = true
|
||||||
|
}
|
||||||
|
}
|
||||||
15
errors.go
Normal file
15
errors.go
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
package ficha
|
||||||
|
|
||||||
|
import "errors"
|
||||||
|
|
||||||
|
var (
|
||||||
|
// ErrInvalidToken means the token is malformed, has an unsupported
|
||||||
|
// version, fails descryption, or has been tampered with.
|
||||||
|
ErrInvalidToken = errors.New("ficha: invalid token")
|
||||||
|
// ErrExpiredToken means the token's expiry time has passed.
|
||||||
|
ErrExpiredToken = errors.New("ficha: token expired")
|
||||||
|
// ErrRevokedToken means the token's ID is in the revocation store.
|
||||||
|
ErrRevokedToken = errors.New("ficha: token revoked")
|
||||||
|
// ErrUnknownKey means the token references a key ID not in the keyring.
|
||||||
|
ErrUnknownKey = errors.New("ficha: unknown key id")
|
||||||
|
)
|
||||||
58
framing.go
Normal file
58
framing.go
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
package ficha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/base64"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
const tokenVersion = "v1"
|
||||||
|
|
||||||
|
// encodeToken builds the wire format: v1.<keyID>.<base64url(none||ciphertext)>
|
||||||
|
func encodeToken(keyID string, nonce, ciphertext []byte) string {
|
||||||
|
body := make([]byte, 0, len(nonce)+len(ciphertext))
|
||||||
|
body = append(body, nonce...)
|
||||||
|
body = append(body, ciphertext...)
|
||||||
|
|
||||||
|
var b strings.Builder
|
||||||
|
b.Grow(len(tokenVersion) + 1 + len(keyID) + 1 + base64.RawURLEncoding.EncodedLen(len(body)))
|
||||||
|
b.WriteString(tokenVersion)
|
||||||
|
b.WriteByte('.')
|
||||||
|
b.WriteString(keyID)
|
||||||
|
b.WriteByte('.')
|
||||||
|
b.WriteString(base64.RawURLEncoding.EncodeToString(body))
|
||||||
|
|
||||||
|
return b.String()
|
||||||
|
}
|
||||||
|
|
||||||
|
// decodeToken parses the wire format and splits the body back into nonce and ciphertext.
|
||||||
|
// Returns ErrInvalidToken for any malformed input.
|
||||||
|
func decodeToken(token string) (keyID string, nonce, ciphertext []byte, err error) {
|
||||||
|
parts := strings.SplitN(token, ".", 3)
|
||||||
|
if len(parts) != 3 {
|
||||||
|
return "", nil, nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
if parts[0] != tokenVersion {
|
||||||
|
return "", nil, nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
if parts[1] == "" {
|
||||||
|
return "", nil, nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
|
||||||
|
body, err := base64.RawURLEncoding.DecodeString(parts[2])
|
||||||
|
if err != nil {
|
||||||
|
return "", nil, nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
|
||||||
|
// body must be at least nonce + auth tag (16 bytes)
|
||||||
|
if len(body) < nonceSize+16 {
|
||||||
|
return "", nil, nil, ErrInvalidToken
|
||||||
|
}
|
||||||
|
|
||||||
|
return parts[1], body[:nonceSize], body[nonceSize:], nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// aadFor builds the AAD bytes for a given version+keyID. Both encrypt
|
||||||
|
// and decrypt must use the same construction.
|
||||||
|
func aadFor(keyID string) []byte {
|
||||||
|
return []byte(tokenVersion + "." + keyID)
|
||||||
|
}
|
||||||
164
framing_test.go
Normal file
164
framing_test.go
Normal file
|
|
@ -0,0 +1,164 @@
|
||||||
|
package ficha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"errors"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestEncodeDecodeRoundtrip(t *testing.T) {
|
||||||
|
keyID := "k1"
|
||||||
|
nonce := bytes.Repeat([]byte{0xAB}, nonceSize)
|
||||||
|
ciphertext := []byte("not-real-ciphertext-but-long-enough-for-tag")
|
||||||
|
|
||||||
|
token := encodeToken(keyID, nonce, ciphertext)
|
||||||
|
|
||||||
|
if !strings.HasPrefix(token, "v1.k1.") {
|
||||||
|
t.Errorf("unexpected prefix: %s", token)
|
||||||
|
}
|
||||||
|
if strings.ContainsAny(token, "+/=") {
|
||||||
|
t.Errorf("token should be url-safe with no padding: %s", token)
|
||||||
|
}
|
||||||
|
|
||||||
|
gotKeyID, gotNonce, gotCT, err := decodeToken(token)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decodeToken: %v", err)
|
||||||
|
}
|
||||||
|
if gotKeyID != keyID {
|
||||||
|
t.Errorf("keyID: got %q, want %q", gotKeyID, keyID)
|
||||||
|
}
|
||||||
|
if !bytes.Equal(gotNonce, nonce) {
|
||||||
|
t.Errorf("nonce: got %x, want %x", gotNonce, nonce)
|
||||||
|
}
|
||||||
|
if !bytes.Equal(gotCT, ciphertext) {
|
||||||
|
t.Errorf("ciphertext: got %q, want %q", gotCT, ciphertext)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestDecodeTokenMalformed(t *testing.T) {
|
||||||
|
// Build a baseline valid token to mutate.
|
||||||
|
validNonce := bytes.Repeat([]byte{0x01}, nonceSize)
|
||||||
|
validCT := bytes.Repeat([]byte{0x02}, 32) // > 16 byte tag minimum
|
||||||
|
valid := encodeToken("k1", validNonce, validCT)
|
||||||
|
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
input string
|
||||||
|
}{
|
||||||
|
{"empty", ""},
|
||||||
|
{"only version", "v1"},
|
||||||
|
{"missing body", "v1.k1"},
|
||||||
|
{"too few parts", "v1.k1"},
|
||||||
|
{"unknown version", "v9.k1.YWFhYQ"},
|
||||||
|
{"empty key id", "v1..YWFhYQ"},
|
||||||
|
{"invalid base64", "v1.k1.!!!not_base64!!!"},
|
||||||
|
{"body too short", "v1.k1.YWFhYQ"}, // 4 bytes < nonceSize + 16
|
||||||
|
{"body too short after truncation", valid[:len("v1.k1.")+8]},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
_, _, _, err := decodeToken(tc.input)
|
||||||
|
if !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAadIsDeterministic(t *testing.T) {
|
||||||
|
a := aadFor("k1")
|
||||||
|
b := aadFor("k1")
|
||||||
|
if !bytes.Equal(a, b) {
|
||||||
|
t.Errorf("aadFor not deterministic: %q vs %q", a, b)
|
||||||
|
}
|
||||||
|
|
||||||
|
c := aadFor("k2")
|
||||||
|
if bytes.Equal(a, c) {
|
||||||
|
t.Error("different key IDs produced the same AAD")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFramingEndToEndWithCrypto(t *testing.T) {
|
||||||
|
// This is the first test that exercises crypto + framing together.
|
||||||
|
// It catches mismatches between encrypt's AAD and decrypt's AAD.
|
||||||
|
key := testKey(t)
|
||||||
|
keyID := "k1"
|
||||||
|
plaintext := []byte("framing meets crypto")
|
||||||
|
|
||||||
|
aad := aadFor(keyID)
|
||||||
|
nonce, ct, err := encrypt(key, plaintext, aad)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
token := encodeToken(keyID, nonce, ct)
|
||||||
|
|
||||||
|
gotKeyID, gotNonce, gotCT, err := decodeToken(token)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decodeToken: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
got, err := decrypt(key, gotNonce, gotCT, aadFor(gotKeyID))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decrypt: %v", err)
|
||||||
|
}
|
||||||
|
if !bytes.Equal(got, plaintext) {
|
||||||
|
t.Errorf("got %q, want %q", got, plaintext)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFramingTamperKeyIDFailsAuth(t *testing.T) {
|
||||||
|
// If an attacker swaps the key ID in the wire format, AAD changes,
|
||||||
|
// and decrypt should fail. This is the whole point of putting
|
||||||
|
// keyID into the AAD.
|
||||||
|
key := testKey(t)
|
||||||
|
plaintext := []byte("bind keyID to ciphertext")
|
||||||
|
|
||||||
|
nonce, ct, err := encrypt(key, plaintext, aadFor("k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Build a token claiming to be from k1, then rewrite to k2.
|
||||||
|
original := encodeToken("k1", nonce, ct)
|
||||||
|
tampered := strings.Replace(original, "v1.k1.", "v1.k2.", 1)
|
||||||
|
|
||||||
|
_, gotNonce, gotCT, err := decodeToken(tampered)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("decodeToken: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Try to decrypt under the SAME key but with the tampered AAD.
|
||||||
|
if _, err := decrypt(key, gotNonce, gotCT, aadFor("k2")); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken on key ID swap, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFramingTruncationFailsAuth(t *testing.T) {
|
||||||
|
// A token that's structurally valid but had bytes lopped off
|
||||||
|
// should pass framing and fail authentication.
|
||||||
|
key := testKey(t)
|
||||||
|
plaintext := []byte("hello, ficha")
|
||||||
|
|
||||||
|
nonce, ct, err := encrypt(key, plaintext, aadFor("k1"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("encrypt: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
token := encodeToken("k1", nonce, ct)
|
||||||
|
truncated := token[:len(token)-5]
|
||||||
|
|
||||||
|
// Framing may or may not accept it (depends on how much got chopped),
|
||||||
|
// but if it does, decryption MUST fail.
|
||||||
|
gotKeyID, gotNonce, gotCT, err := decodeToken(truncated)
|
||||||
|
if err != nil {
|
||||||
|
// Truncated past the minimum — framing rejected it. Also fine.
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := decrypt(key, gotNonce, gotCT, aadFor(gotKeyID)); !errors.Is(err, ErrInvalidToken) {
|
||||||
|
t.Errorf("expected ErrInvalidToken on truncated ciphertext, got %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue