crypto/handshake/common.h

Go to the documentation of this file.

#pragma once
 
/* Storage capacities in elements; text buffers include the terminating NUL. */
#define CRYPTO_HANDSHAKE_COMMON_EXPECTED_SERVER_KEY_BUFFER_SIZE 256
 
#include <ascii-chat/crypto/sizes.h>
#include <ascii-chat/common/limits.h>

 
#include <stdint.h>
#include <stdbool.h>
#include <libplatform/socket.h>
#include "../../crypto/crypto.h"
#include "../../crypto/keys.h"
#include "../../network/packet/packet.h"
 
struct acip_transport;


#define AUTH_REQUIRE_PASSWORD 0x01
#define AUTH_REQUIRE_CLIENT_KEY 0x02


typedef enum {
  CRYPTO_HANDSHAKE_DISABLED = 0,   
  CRYPTO_HANDSHAKE_INIT,           
  CRYPTO_HANDSHAKE_KEY_EXCHANGE,   
  CRYPTO_HANDSHAKE_AUTHENTICATING, 
  CRYPTO_HANDSHAKE_READY,          
  CRYPTO_HANDSHAKE_FAILED          
} crypto_handshake_state_t;

typedef struct crypto_handshake_context_t {
  crypto_context_t crypto_ctx;    
  crypto_handshake_state_t state; 
  bool is_server;                 
  uint8_t password_failure;       
  bool defer_password_prompt;     

  public_key_t server_public_key;   
  private_key_t server_private_key; 

  public_key_t client_public_key;   
  private_key_t client_private_key; 
  char
      expected_server_key[CRYPTO_HANDSHAKE_COMMON_EXPECTED_SERVER_KEY_BUFFER_SIZE]; 
  uint8_t expected_server_key_bytes[ED25519_PUBLIC_KEY_SIZE]; 
  bool expected_server_key_bytes_set;                         
  char client_gpg_key_id[GPG_FINGERPRINT_HEX_BUFFER_SIZE];    

  char server_hostname[HOSTNAME_BUFFER_SIZE]; 
  char server_ip[HOSTNAME_BUFFER_SIZE];       
  uint16_t server_port;                       

  bool addressless_transport;          
  bool verify_server_key;              
  bool require_client_auth;            
  bool allow_unlisted_client_identity; 
  bool server_uses_client_auth;        
  char client_keys_path[PLATFORM_MAX_PATH_LENGTH]; 

  public_key_t *client_whitelist;   
  size_t num_whitelisted_clients;   
  public_key_t client_ed25519_key;  
  bool client_ed25519_key_verified; 
  bool client_sent_identity;        

  bool has_password;                   
  char password[PASSWORD_BUFFER_SIZE]; 

  uint8_t client_challenge_nonce[AUTH_CHALLENGE_SIZE]; 
 
} crypto_handshake_context_t;


asciichat_error_t crypto_handshake_init(const char *name, crypto_handshake_context_t *ctx, bool is_server);

asciichat_error_t crypto_handshake_set_parameters(crypto_handshake_context_t *ctx,
                                                  const crypto_parameters_packet_t *params);

asciichat_error_t crypto_handshake_validate_packet_size(const crypto_handshake_context_t *ctx, uint16_t packet_type,
                                                        size_t packet_size);

asciichat_error_t crypto_handshake_init_with_password(const char *name, crypto_handshake_context_t *ctx, bool is_server,
                                                      const char *password);

void crypto_handshake_destroy(crypto_handshake_context_t *ctx);

bool crypto_handshake_is_ready(const crypto_handshake_context_t *ctx);

const crypto_context_t *crypto_handshake_get_context(const crypto_handshake_context_t *ctx);