// FillKeyExchange sets elements of kx with key exchange information from the
// ratchet.
func (r *Ratchet) FillKeyExchange(kx *pond.KeyExchange) error {
if r.kxPrivate0 == nil || r.kxPrivate1 == nil {
return errors.New("ratchet: handshake already complete")
}
var public0, public1 [32]byte
curve25519.ScalarBaseMult(&public0, r.kxPrivate0)
curve25519.ScalarBaseMult(&public1, r.kxPrivate1)
kx.Dh = public0[:]
kx.Dh1 = public1[:]
return nil
}
func (contact *Contact) processKeyExchange(kxsBytes []byte, testing, simulateOldClient, disableV2Ratchet bool) error {
var kxs pond.SignedKeyExchange
if err := proto.Unmarshal(kxsBytes, &kxs); err != nil {
return err
}
var sig [64]byte
if len(kxs.Signature) != len(sig) {
return errors.New("invalid signature length")
}
copy(sig[:], kxs.Signature)
var kx pond.KeyExchange
if err := proto.Unmarshal(kxs.Signed, &kx); err != nil {
return err
}
if len(kx.PublicKey) != len(contact.theirPub) {
return errors.New("invalid public key")
}
copy(contact.theirPub[:], kx.PublicKey)
if !ed25519.Verify(&contact.theirPub, kxs.Signed, &sig) {
return errors.New("invalid signature")
}
contact.theirServer = *kx.Server
if _, _, err := parseServer(contact.theirServer, testing); err != nil {
return err
}
group, ok := new(bbssig.Group).Unmarshal(kx.Group)
if !ok {
return errors.New("invalid group")
}
if contact.myGroupKey, ok = new(bbssig.MemberKey).Unmarshal(group, kx.GroupKey); !ok {
return errors.New("invalid group key")
}
if len(kx.IdentityPublic) != len(contact.theirIdentityPublic) {
return errors.New("invalid public identity")
}
copy(contact.theirIdentityPublic[:], kx.IdentityPublic)
if simulateOldClient {
kx.Dh1 = nil
}
if len(kx.Dh1) == 0 {
// They are using an old-style ratchet. We have to extract the
// private value from the Ratchet in order to use it with the
// old code.
contact.lastDHPrivate = contact.ratchet.GetKXPrivateForTransition()
if len(kx.Dh) != len(contact.theirCurrentDHPublic) {
return errors.New("invalid public DH value")
}
copy(contact.theirCurrentDHPublic[:], kx.Dh)
contact.ratchet = nil
} else {
// If the identity and ed25519 public keys are the same (modulo
// isomorphism) then the contact is using the v2 ratchet.
var ed25519Public, curve25519Public [32]byte
copy(ed25519Public[:], kx.PublicKey)
extra25519.PublicKeyToCurve25519(&curve25519Public, &ed25519Public)
v2 := !disableV2Ratchet && bytes.Equal(curve25519Public[:], kx.IdentityPublic[:])
if err := contact.ratchet.CompleteKeyExchange(&kx, v2); err != nil {
return err
}
}
contact.generation = *kx.Generation
return nil
}