`crypto-refresh`: add support for new Ed25519/X25519 keys, signatures and messages #1620

larabr · 2023-03-24T18:51:03Z

This addition is backwards compatible. We offer no way to generate v4 keys in the new format, since existing implementations might not support them.

TODO

update kdf to include public key
test with messages (to decrypt and verify) from gopenpgp
~~merge after introducing support for intended recipient (no longer needed after spec's kdf change)~~
enforce using AES (https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/276) (done in x448 PR, so it's only needed if we don't merge that on in v5)
merge lukas changes
~~change base branch (to be merged into v6)~~ we merge to v5 as there are no breaking changes

src/packet/public_key_encrypted_session_key.js

src/type/mont_symkey.js

src/type/ecdh_symkey.js

This addition is backwards compatible. We offer no way to generate v4 keys in the new format.

twiss · 2023-07-13T10:02:00Z

src/message.js

+    await Promise.all(encryptionKeys.map(key => key.getEncryptionKey()
+      .catch(() => null) // ignore key strength requirements
+      .then(maybeKey => {
+        if (maybeKey && (maybeKey.keyPacket.algorithm === enums.publicKey.x25519) && !util.isAES(algo)) {
+          throw new Error('Could not generate a session key compatible with the given `encryptionKeys`: X22519 keys can only be used to encrypt AES session keys; change `config.preferredSymmetricAlgorithm` accordingly.');
+        }
+      })
+    ));


I think it would be safer to just use AES128 in this scenario. After all, we're always allowed to use that, and the config is called preferredSymmetricAlgorithm, it's not a guarantee it will be used (and in this case we can just say that the key doesn't support it - although tbh it would be a bit strange if the key's algorithm preferences claim otherwise).

This is an edge case which requires passing config.preferredSymmetricAlgorithm with a non-AES algo as well as (all) encryptionKeys with that algo appearing in the prefs.
So I think a specific error can make sense in this case, also considering that AES-128 is not the best fallback for x488, so users might want to go with AES-256 at that point? 🤞

Yeah, fair enough 👍

src/enums.js

src/packet/public_key_encrypted_session_key.js

src/type/mont_symkey.js

test/karma.conf.js

src/crypto/public_key/elliptic/ecdh_x.js

twiss · 2023-07-24T18:38:22Z

src/crypto/public_key/elliptic/eddsa_legacy.js

+// OpenPGP.js - An OpenPGP implementation in javascript
+// Copyright (C) 2018 Proton Technologies AG
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 3.0 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+


Suggested change

// OpenPGP.js - An OpenPGP implementation in javascript

// Copyright (C) 2018 Proton Technologies AG

//

// This library is free software; you can redistribute it and/or

// modify it under the terms of the GNU Lesser General Public

// License as published by the Free Software Foundation; either

// version 3.0 of the License, or (at your option) any later version.

//

// This library is distributed in the hope that it will be useful,

// but WITHOUT ANY WARRANTY; without even the implied warranty of

// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

// Lesser General Public License for more details.

//

// You should have received a copy of the GNU Lesser General Public

// License along with this library; if not, write to the Free Software

// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

This was already there, I just renamed the file. Maybe we should review these copyright notes in a separate PR?

src/crypto/hkdf.js

twiss · 2023-07-24T19:08:08Z

src/crypto/hkdf.js

+
+const webCrypto = util.getWebCrypto();
+const nodeCrypto = util.getNodeCrypto();
+const nodeSubtleCrypto = nodeCrypto && nodeCrypto.webcrypto && nodeCrypto.webcrypto.subtle;


(For now this is fine but maybe long-term we can just make getWebCrypto return Node's Web Crypto too? And then the code can decide by the ordering which they prefer between Node Crypto and Node Web Crypto.)

As specified in openpgp-crypto-refresh-09. Instead of encoding the symmetric key algorithm in the PKESK ciphertext (requiring padding), the symmetric key algorithm is left unencrypted. Co-authored-by: Lukas Burkhalter <lukas.burkhalter@proton.ch>

Fail on PKESK parsing as well as session key generation and encryption

Following the addition of the new format for Montgomery curves, which do not rely on OIDs.

SubtleCrypto not available in the latter due to stricter secure context checks

larabr force-pushed the new-25519 branch 5 times, most recently from ed0b0e4 to c7003f9 Compare March 29, 2023 16:32

larabr requested a review from twiss March 29, 2023 17:02

larabr mentioned this pull request Mar 31, 2023

[v6] crypto-refresh: add support for Ed448/X448 #1625

Merged

11 tasks

larabr force-pushed the new-25519 branch 3 times, most recently from dd814b5 to 785b47b Compare April 25, 2023 09:08

larabr commented May 2, 2023

View reviewed changes

src/packet/public_key_encrypted_session_key.js Outdated Show resolved Hide resolved

larabr commented May 2, 2023

View reviewed changes

src/packet/public_key_encrypted_session_key.js Outdated Show resolved Hide resolved

larabr commented May 2, 2023

View reviewed changes

src/packet/public_key_encrypted_session_key.js Outdated Show resolved Hide resolved

larabr force-pushed the new-25519 branch from 785b47b to c5fa7b3 Compare July 12, 2023 20:58

larabr commented Jul 13, 2023

View reviewed changes

src/type/mont_symkey.js Outdated Show resolved Hide resolved

larabr commented Jul 13, 2023

View reviewed changes

src/type/ecdh_symkey.js Outdated Show resolved Hide resolved

larabr force-pushed the new-25519 branch from c5fa7b3 to 5e04097 Compare July 13, 2023 09:22

crypto-refresh: add support for new Ed25519 key and signature format

3f44082

This addition is backwards compatible. We offer no way to generate v4 keys in the new format.

larabr force-pushed the new-25519 branch from 5e04097 to a405399 Compare July 13, 2023 10:01

twiss reviewed Jul 13, 2023

View reviewed changes

larabr force-pushed the new-25519 branch from ec6ab43 to ccb9675 Compare July 13, 2023 11:57

larabr requested a review from twiss July 13, 2023 11:57

larabr force-pushed the new-25519 branch 2 times, most recently from 7dc1b9e to 460a491 Compare July 24, 2023 17:39

twiss reviewed Jul 24, 2023

View reviewed changes

larabr and others added 5 commits July 25, 2023 10:17

Enforce AES with PKESK v3 using x25519 (new format)

ee4ad89

Fail on PKESK parsing as well as session key generation and encryption

Add HKDF fallback for Node 14, where SubtleCrypto is not available

ef953ce

Internal: rename Curves to CurvesWithOID

b164190

Following the addition of the new format for Montgomery curves, which do not rely on OIDs.

CI: test on iOS Safari 14 instead of 15 to have access to SubtleCrypto

5ae2846

SubtleCrypto not available in the latter due to stricter secure context checks

larabr force-pushed the new-25519 branch from 460a491 to 5ae2846 Compare July 25, 2023 08:25

twiss approved these changes Jul 25, 2023

View reviewed changes

larabr merged commit 8d4dd34 into openpgpjs:main Jul 26, 2023
12 checks passed

larabr mentioned this pull request Sep 7, 2023

[v6] crypto-refresh: support generating Curve448 and Curve25519 keys (new format) #1676

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`crypto-refresh`: add support for new Ed25519/X25519 keys, signatures and messages #1620

`crypto-refresh`: add support for new Ed25519/X25519 keys, signatures and messages #1620

larabr commented Mar 24, 2023 •

edited

twiss Jul 13, 2023

larabr Jul 13, 2023 •

edited

twiss Jul 13, 2023

twiss Jul 24, 2023

larabr Jul 25, 2023

twiss Jul 24, 2023

crypto-refresh: add support for new Ed25519/X25519 keys, signatures and messages #1620

crypto-refresh: add support for new Ed25519/X25519 keys, signatures and messages #1620

Conversation

larabr commented Mar 24, 2023 • edited

twiss Jul 13, 2023

Choose a reason for hiding this comment

larabr Jul 13, 2023 • edited

Choose a reason for hiding this comment

twiss Jul 13, 2023

Choose a reason for hiding this comment

twiss Jul 24, 2023

Choose a reason for hiding this comment

larabr Jul 25, 2023

Choose a reason for hiding this comment

twiss Jul 24, 2023

Choose a reason for hiding this comment

`crypto-refresh`: add support for new Ed25519/X25519 keys, signatures and messages #1620

`crypto-refresh`: add support for new Ed25519/X25519 keys, signatures and messages #1620

larabr commented Mar 24, 2023 •

edited

larabr Jul 13, 2023 •

edited