From 0b7c7efcce2f10f618399c9b64bedca4445ac45b Mon Sep 17 00:00:00 2001 From: Thibault Martinez Date: Mon, 22 Aug 2022 10:09:05 +0200 Subject: [PATCH] Use iota-crypto aead helpers (#1194) * Use iota-crypto aead helpers * CHANGELOG entries * Fix encryption/decryption * Use new crypto version --- CHANGELOG.md | 3 ++ Cargo.lock | 15 +++++++-- Cargo.toml | 2 +- src/stronghold/db.rs | 11 +++---- src/stronghold/encryption.rs | 64 ------------------------------------ src/stronghold/mod.rs | 1 - 6 files changed, 21 insertions(+), 75 deletions(-) delete mode 100644 src/stronghold/encryption.rs diff --git a/CHANGELOG.md b/CHANGELOG.md index e07b95432..784697a81 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,10 +35,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Rename `finish_single_thread_pow` to `finish_single_threaded_pow`; - Rename `minimum_storage_deposit` to `minimum_storage_deposit_basic_output`; - Accept `GenerateAddressesOptions` in `consolidate_funds()` instead of `account_index` and `address_range`; +- Use `chacha::{aead_encrypt, aead_decrypt}` from `crypto.rs` in stronghold's `db` module; ### Removed + - Removed `snapshot_loaded` field from StrongholdAdapter; - Removed `outputs()` field from GetAddressBuilder; +- Stronghold's `encryption` module; ### Fixed diff --git a/Cargo.lock b/Cargo.lock index cd43417b3..5529c880e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1145,7 +1145,7 @@ dependencies = [ "futures", "gloo-timers", "instant", - "iota-crypto 0.13.0", + "iota-crypto 0.14.0", "iota-ledger-nano", "iota_stronghold", "log", @@ -1206,9 +1206,20 @@ version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "538b238fbd6fa732f526f6401656fa6a366598b9fe1ca35185e47f3978369707" dependencies = [ - "aead", "bee-ternary", "blake2 0.10.4", + "digest 0.10.3", + "ed25519-zebra", +] + +[[package]] +name = "iota-crypto" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aee0fbdc68c475a78fd19a6509280b25166499f1bfe087a81237813e7b951667" +dependencies = [ + "aead", + "blake2 0.10.4", "chacha20poly1305", "digest 0.10.3", "ed25519-zebra", diff --git a/Cargo.toml b/Cargo.toml index 67dd9501c..0b712c0d0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,7 +18,7 @@ bee-block = { version = "1.0.0-beta.6", default-features = false, features = [ " bee-pow = { version = "1.0.0-alpha.1", default-features = false } derive_builder = { version = "0.11.2", default-features = false, features = [ "std" ]} futures = { version = "0.3.21", default-features = false, features = [ "thread-pool" ] } -iota-crypto = { version = "0.13.0", default-features = false, features = [ "std", "chacha", "blake2b", "ed25519", "random", "slip10", "bip39", "bip39-en" ] } +iota-crypto = { version = "0.14.0", default-features = false, features = [ "std", "chacha", "blake2b", "ed25519", "random", "slip10", "bip39", "bip39-en" ] } log = { version = "0.4.17", default-features = false } num_cpus = { version = "1.13.1", default-features = false } packable = { version = "0.5.0", default-features = false, features = [ "serde", "primitive-types", "std" ] } diff --git a/src/stronghold/db.rs b/src/stronghold/db.rs index 62b2e74a2..8c270ec77 100644 --- a/src/stronghold/db.rs +++ b/src/stronghold/db.rs @@ -6,12 +6,9 @@ use std::ops::Deref; use async_trait::async_trait; +use crypto::ciphers::chacha; -use super::{ - common::PRIVATE_DATA_CLIENT_PATH, - encryption::{decrypt, encrypt}, - StrongholdAdapter, -}; +use super::{common::PRIVATE_DATA_CLIENT_PATH, StrongholdAdapter}; use crate::{db::DatabaseProvider, Error, Result}; #[async_trait] @@ -38,7 +35,7 @@ impl DatabaseProvider for StrongholdAdapter { let buffer = key_provider.try_unlock()?; let buffer_ref = buffer.borrow(); - decrypt(&data, buffer_ref.deref()).map(Some) + Ok(Some(chacha::aead_decrypt(buffer_ref.deref(), &data)?)) } async fn insert(&mut self, k: &[u8], v: &[u8]) -> Result>> { @@ -52,7 +49,7 @@ impl DatabaseProvider for StrongholdAdapter { let buffer = key_provider.try_unlock()?; let buffer_ref = buffer.borrow(); - encrypt(v, buffer_ref.deref())? + chacha::aead_encrypt(buffer_ref.deref(), v)? }; Ok(self diff --git a/src/stronghold/encryption.rs b/src/stronghold/encryption.rs deleted file mode 100644 index dc48a76d5..000000000 --- a/src/stronghold/encryption.rs +++ /dev/null @@ -1,64 +0,0 @@ -// Copyright 2022 IOTA Stiftung -// SPDX-License-Identifier: Apache-2.0 - -//! A symmetric encryption implementation for `StrongholdAdapter`. - -use crypto::ciphers::{chacha::XChaCha20Poly1305, traits::Aead}; - -use crate::Result; - -// Fixed position indexes for referencing the concatenated parts in a ciphertext: -// -// POS_TAG_END v POS_CIPHERTEXT_START -// +-------+-----+------------+ -// 0 | Nonce | Tag | Ciphertext | v.len() -// +-------+-----+------------+ -// POS_NONCE_END ^ POS_TAG_START -// -// This layout is how it's been historically. -const POS_NONCE_END: usize = XChaCha20Poly1305::NONCE_LENGTH; -const POS_TAG_START: usize = POS_NONCE_END; -const POS_TAG_END: usize = XChaCha20Poly1305::NONCE_LENGTH + XChaCha20Poly1305::TAG_LENGTH; -const POS_CIPHERTEXT_START: usize = POS_TAG_END; - -pub(super) fn encrypt(plaintext: &[u8], key: &[u8]) -> Result> { - let mut nonce = [0u8; XChaCha20Poly1305::NONCE_LENGTH]; - let mut tag = vec![0u8; XChaCha20Poly1305::TAG_LENGTH]; - let mut ciphertext = vec![0u8; plaintext.len()]; - - crypto::utils::rand::fill(&mut nonce)?; - - XChaCha20Poly1305::encrypt( - key.try_into().unwrap(), - &nonce.try_into().unwrap(), - &[], - plaintext, - ciphertext.as_mut(), - tag.as_mut_slice().try_into().unwrap(), - )?; - - let mut ret = nonce.to_vec(); - ret.append(&mut tag); - ret.append(&mut ciphertext); - - Ok(ret) -} - -pub(super) fn decrypt(data: &[u8], key: &[u8]) -> Result> { - let nonce = &data[..POS_NONCE_END]; - let tag = &data[POS_TAG_START..POS_TAG_END]; - let ciphertext = &data[POS_CIPHERTEXT_START..]; - - let mut plaintext = vec![0u8; ciphertext.len()]; - - XChaCha20Poly1305::decrypt( - key.try_into().unwrap(), - nonce.try_into().unwrap(), - &[], - &mut plaintext, - ciphertext, - tag.try_into().unwrap(), - )?; - - Ok(plaintext) -} diff --git a/src/stronghold/mod.rs b/src/stronghold/mod.rs index a597842a1..487e350a2 100644 --- a/src/stronghold/mod.rs +++ b/src/stronghold/mod.rs @@ -48,7 +48,6 @@ mod common; mod db; -mod encryption; mod secret; use std::{