1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

//! Implementation for the (deprecated) CreateFast handshake.
//!

use super::{RelayHandshakeError, RelayHandshakeResult};
use crate::crypto::ll::kdf::{Kdf, LegacyKdf};
use crate::util::ct::bytes_eq;
use crate::{Error, Result};

use rand::{CryptoRng, RngCore};
use tor_error::into_internal;

/// Number of bytes used for a "CREATE_FAST" handshake by the initiator.
pub(crate) const FAST_C_HANDSHAKE_LEN: usize = 20;
/// Number of bytes used for a "CREATE_FAST" handshake by the responder
pub(crate) const FAST_S_HANDSHAKE_LEN: usize = 20 * 2;

/// State for a CREATE_FAST client handshake.
pub(crate) struct CreateFastClientState([u8; FAST_C_HANDSHAKE_LEN]);

/// Client-handshake for CREATE_FAST.
///
/// See module documentation; you probably don't want to use this.
pub(crate) struct CreateFastClient;

impl super::ClientHandshake for CreateFastClient {
    type KeyType = ();
    type StateType = CreateFastClientState;
    type KeyGen = super::TapKeyGenerator;

    fn client1<R: RngCore + CryptoRng>(
        rng: &mut R,
        _key: &Self::KeyType,
    ) -> Result<(Self::StateType, Vec<u8>)> {
        let mut state = [0_u8; FAST_C_HANDSHAKE_LEN];
        rng.fill_bytes(&mut state);
        Ok((CreateFastClientState(state), state.into()))
    }

    fn client2<T: AsRef<[u8]>>(state: Self::StateType, msg: T) -> Result<Self::KeyGen> {
        let msg = msg.as_ref();
        if msg.len() != FAST_S_HANDSHAKE_LEN {
            return Err(Error::BadCircHandshake);
        }
        let mut inp = Vec::new();
        inp.extend(&state.0[..]);
        inp.extend(&msg[0..20]);

        let kh_expect = LegacyKdf::new(0).derive(&inp[..], 20)?;

        if !bytes_eq(&kh_expect, &msg[20..40]) {
            return Err(Error::BadCircHandshake);
        }

        Ok(super::TapKeyGenerator::new(inp.into()))
    }
}

/// Relay-handshake for CREATE_FAST.
///
/// See module documentation; you probably don't want to use this.
pub(crate) struct CreateFastServer;

impl super::ServerHandshake for CreateFastServer {
    type KeyType = ();
    type KeyGen = super::TapKeyGenerator;

    fn server<R: RngCore + CryptoRng, T: AsRef<[u8]>>(
        rng: &mut R,
        _key: &[Self::KeyType],
        msg: T,
    ) -> RelayHandshakeResult<(Self::KeyGen, Vec<u8>)> {
        let msg = msg.as_ref();
        if msg.len() != FAST_C_HANDSHAKE_LEN {
            return Err(RelayHandshakeError::BadHandshake);
        }
        let mut reply = vec![0_u8; FAST_S_HANDSHAKE_LEN];
        rng.fill_bytes(&mut reply[0..20]);

        let mut inp = Vec::new();
        inp.extend(msg);
        inp.extend(&reply[0..20]);
        let kh = LegacyKdf::new(0)
            .derive(&inp[..], 20)
            .map_err(into_internal!("Can't expand key"))?;
        reply[20..].copy_from_slice(&kh);

        Ok((super::TapKeyGenerator::new(inp.into()), reply))
    }
}

#[cfg(test)]
mod test {
    #![allow(clippy::unwrap_used)]
    use super::*;
    use crate::crypto::handshake::{ClientHandshake, KeyGenerator, ServerHandshake};
    use hex_literal::hex;
    use tor_basic_utils::test_rng::testing_rng;

    #[test]
    fn roundtrip() {
        let mut rng = testing_rng();

        let (state, cmsg) = CreateFastClient::client1(&mut rng, &()).unwrap();
        let (s_kg, smsg) = CreateFastServer::server(&mut rng, &[()], cmsg).unwrap();
        let c_kg = CreateFastClient::client2(state, smsg).unwrap();

        let s_key = s_kg.expand(200).unwrap();
        let c_key = c_kg.expand(200).unwrap();

        assert_eq!(s_key, c_key);
    }

    #[test]
    fn failure() {
        let mut rng = testing_rng();

        // badly formatted client message.
        let cmsg = [6_u8; 19];
        let ans = CreateFastServer::server(&mut rng, &[()], cmsg);
        assert!(ans.is_err());

        // corrupt/ incorrect server reply.
        let (state, cmsg) = CreateFastClient::client1(&mut rng, &()).unwrap();
        let (_, mut smsg) = CreateFastServer::server(&mut rng, &[()], cmsg).unwrap();
        smsg[35] ^= 16;
        let ans = CreateFastClient::client2(state, smsg);
        assert!(ans.is_err());
    }

    fn test_one_handshake(cmsg: [u8; 20], smsg: [u8; 40], keys: [u8; 100]) {
        use crate::crypto::testing::FakePRNG;

        let mut rng = FakePRNG::new(&cmsg);
        let (state, cmsg) = CreateFastClient::client1(&mut rng, &()).unwrap();

        let mut rng = FakePRNG::new(&smsg);
        let (s_kg, smsg) = CreateFastServer::server(&mut rng, &[()], cmsg).unwrap();
        let c_kg = CreateFastClient::client2(state, smsg).unwrap();

        let s_key = s_kg.expand(100).unwrap();
        let c_key = c_kg.expand(100).unwrap();

        assert_eq!(s_key, c_key);
        assert_eq!(&s_key[..], &keys[..]);
    }

    #[test]
    fn testvec() {
        // Generated from Tor.
        test_one_handshake(
            hex!("080E247DF7C252FCD2DC10F459703480C223E3A6"),
            hex!("BA95C0D092335428BF80093BBED0B7A26C49E1E8696FBF9C8D6BE26504219C000D26AFE370FCEF04"),
            hex!("AFA89B4FC8CF882335A582C52478B5FCB1E08DAF707E2C2D23B8C27D30BD461F3DF98A3AF82221CB658AD0AA8680B99067E4F7DBC546970EA9A56B26433C71DA867BDD09C14A1308BC327D6A448D71D2382B3AB6AF0BB4E19649A8DFF607DB9C57A04AC3"));

        test_one_handshake(
            hex!("5F786C724C2F5978474A04FA63772057AD896A03"),
            hex!("6210B037001405742FE78B6F5B34E6DB3C9F2F7E24239498613E0ED872E110A00774A3FCB37A7507"),
            hex!("D41B65D83FB4B34A322B658BE4D706EDCD8B62813757E719118C394E1F22E1C8EA8959BAB30E856A914C3054946F547397094DE031F5BCA384C65C8880BF7AAB9CE7BEE33971F9DE8C22A23366F46BF8B5E5112321E216B0E02C62EEA3ABB72A0E062592"));
    }
}