1/*
2 * Off-the-Record Messaging library
3 * Copyright (C) 2004-2012 Ian Goldberg, Rob Smits, Chris Alexander,
4 * Willy Lew, Lisa Du, Nikita Borisov
5 * <otr@cypherpunks.ca>
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of version 2.1 of the GNU Lesser General
9 * Public License as published by the Free Software Foundation.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21#ifndef __AUTH_H__
22#define __AUTH_H__
23
24#include <gcrypt.h>
25#include <time.h>
26#include "dh.h"
27
28
29typedef enum {
30 OTRL_AUTHSTATE_NONE,
31 OTRL_AUTHSTATE_AWAITING_DHKEY,
32 OTRL_AUTHSTATE_AWAITING_REVEALSIG,
33 OTRL_AUTHSTATE_AWAITING_SIG,
34 OTRL_AUTHSTATE_V1_SETUP
35} OtrlAuthState;
36
37typedef struct {
38 OtrlAuthState authstate; /* Our state */
39
40 struct context *context; /* The context which points to us */
41
42 DH_keypair our_dh; /* Our D-H key */
43 unsigned int our_keyid; /* ...and its keyid */
44
45 unsigned char *encgx; /* The encrypted value of g^x */
46 size_t encgx_len; /* ...and its length */
47 unsigned char r[16]; /* The encryption key */
48
49 unsigned char hashgx[32]; /* SHA256(g^x) */
50
51 gcry_mpi_t their_pub; /* Their D-H public key */
52 unsigned int their_keyid; /* ...and its keyid */
53
54
55 gcry_cipher_hd_t enc_c, enc_cp; /* c and c' encryption keys */
56 gcry_md_hd_t mac_m1, mac_m1p; /* m1 and m1' MAC keys */
57 gcry_md_hd_t mac_m2, mac_m2p; /* m2 and m2' MAC keys */
58
59 unsigned char their_fingerprint[20]; /* The fingerprint of their
60 long-term signing key */
61
62 int initiated; /* Did we initiate this
63 authentication? */
64
65 unsigned int protocol_version; /* The protocol version number
66 used to authenticate. */
67
68 unsigned char secure_session_id[20]; /* The secure session id */
69 size_t secure_session_id_len; /* And its actual length,
70 which may be either 20 (for
71 v1) or 8 (for v2) */
72 OtrlSessionIdHalf session_id_half; /* Which half of the session
73 id gets shown in bold */
74
75 char *lastauthmsg; /* The last auth message
76 (base-64 encoded) we sent,
77 in case we need to
78 retransmit it. */
79
80 time_t commit_sent_time; /* The time we last sent the
81 lastauthmsg, if it was a
82 COMMIT message, and this is
83 a master context. 0
84 otherwise. */
85} OtrlAuthInfo;
86
87#include "privkey-t.h"
88
89/*
90 * Initialize the fields of an OtrlAuthInfo (already allocated).
91 */
92void otrl_auth_new(struct context *context);
93
94/*
95 * Clear the fields of an OtrlAuthInfo (but leave it allocated).
96 */
97void otrl_auth_clear(OtrlAuthInfo *auth);
98
99/*
100 * Start a fresh AKE (version 2 or 3) using the given OtrlAuthInfo. Generate
101 * a fresh DH keypair to use. If no error is returned, the message to
102 * transmit will be contained in auth->lastauthmsg.
103 */
104gcry_error_t otrl_auth_start_v23(OtrlAuthInfo *auth, int version);
105
106/*
107 * Handle an incoming D-H Commit Message. If no error is returned, the
108 * message to send will be left in auth->lastauthmsg. Generate a fresh
109 * keypair to use.
110 */
111gcry_error_t otrl_auth_handle_commit(OtrlAuthInfo *auth,
112 const char *commitmsg, int version);
113
114/*
115 * Handle an incoming D-H Key Message. If no error is returned, and
116 * *havemsgp is 1, the message to sent will be left in auth->lastauthmsg.
117 * Use the given private authentication key to sign messages.
118 */
119gcry_error_t otrl_auth_handle_key(OtrlAuthInfo *auth, const char *keymsg,
120 int *havemsgp, OtrlPrivKey *privkey);
121
122/*
123 * Handle an incoming Reveal Signature Message. If no error is
124 * returned, and *havemsgp is 1, the message to be sent will be left in
125 * auth->lastauthmsg. Use the given private authentication key to sign
126 * messages. Call the auth_succeeded callback if authentication is
127 * successful.
128 */
129gcry_error_t otrl_auth_handle_revealsig(OtrlAuthInfo *auth,
130 const char *revealmsg, int *havemsgp, OtrlPrivKey *privkey,
131 gcry_error_t (*auth_succeeded)(const OtrlAuthInfo *auth, void *asdata),
132 void *asdata);
133
134/*
135 * Handle an incoming Signature Message. If no error is returned, and
136 * *havemsgp is 1, the message to be sent will be left in
137 * auth->lastauthmsg. Call the auth_succeeded callback if
138 * authentication is successful.
139 */
140gcry_error_t otrl_auth_handle_signature(OtrlAuthInfo *auth,
141 const char *sigmsg, int *havemsgp,
142 gcry_error_t (*auth_succeeded)(const OtrlAuthInfo *auth, void *asdata),
143 void *asdata);
144
145/*
146 * Start a fresh AKE (version 1) using the given OtrlAuthInfo. If
147 * our_dh is NULL, generate a fresh DH keypair to use. Otherwise, use a
148 * copy of the one passed (with the given keyid). Use the given private
149 * key to sign the message. If no error is returned, the message to
150 * transmit will be contained in auth->lastauthmsg.
151 */
152gcry_error_t otrl_auth_start_v1(OtrlAuthInfo *auth, DH_keypair *our_dh,
153 unsigned int our_keyid, OtrlPrivKey *privkey);
154
155/*
156 * Handle an incoming v1 Key Exchange Message. If no error is returned,
157 * and *havemsgp is 1, the message to be sent will be left in
158 * auth->lastauthmsg. Use the given private authentication key to sign
159 * messages. Call the auth_secceeded callback if authentication is
160 * successful. If non-NULL, use a copy of the given D-H keypair, with
161 * the given keyid.
162 */
163gcry_error_t otrl_auth_handle_v1_key_exchange(OtrlAuthInfo *auth,
164 const char *keyexchmsg, int *havemsgp, OtrlPrivKey *privkey,
165 DH_keypair *our_dh, unsigned int our_keyid,
166 gcry_error_t (*auth_succeeded)(const OtrlAuthInfo *auth, void *asdata),
167 void *asdata);
168
169/*
170 * Copy relevant information from the master OtrlAuthInfo to an
171 * instance OtrlAuthInfo in response to a D-H Key with a new
172 * instance. The fields copied will depend on the state of the
173 * master auth.
174 */
175void otrl_auth_copy_on_key(OtrlAuthInfo *m_auth, OtrlAuthInfo *auth);
176
177#endif
178