No OneTemporary
Actions

Size

66 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/client/actions/encryption.cpp b/src/client/actions/encryption.cpp
	index 8b525b6..d36f8d9 100644
	--- a/src/client/actions/encryption.cpp
	+++ b/src/client/actions/encryption.cpp
	@@ -1,618 +1,617 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2021-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <zug/transducer/filter.hpp>
	#include <zug/transducer/cat.hpp>

	#include "encryption.hpp"

	#include <immer-utils.hpp>
	#include <debug.hpp>
	#include "cursorutil.hpp"
	#include "status-utils.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	static json convertSignature(const ClientModel &m, std::string signature)
	{
	auto j = json::object();
	j[m.userId] = json::object();
	j[m.userId][ed25519 + ":" + m.deviceId] = signature;

	return j;
	}

	ClientResult updateClient(ClientModel m, UploadIdentityKeysAction)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	auto keys =
	immer::map<std::string, std::string>{}
	.set(ed25519 + ":" + m.deviceId, m.constCrypto().ed25519IdentityKey())
	.set(curve25519 + ":" + m.deviceId, m.constCrypto().curve25519IdentityKey());

	DeviceKeys k {
	m.userId,
	m.deviceId,
	{olmAlgo, megOlmAlgo},
	keys,
	{} // signatures to be added soon
	};

	auto j = json(k);

	auto sig = m.withCrypto([&](auto &crypto) { return crypto.sign(j); });

	k.signatures = convertSignature(m, sig);

	auto job = m.job<UploadKeysJob>()
	.make(k)
	.withData(json{{"is", "identityKeys"}});

	kzo.client.dbg() << "Uploading identity keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, GenerateAndUploadOneTimeKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), simpleFail };
	}

	kzo.client.dbg() << "Generating one-time keys..." << std::endl;

	auto maxNumKeys = m.constCrypto().maxNumberOfOneTimeKeys();
	auto numLocalKeys = m.constCrypto().numUnpublishedOneTimeKeys();
	auto numStoredKeys = m.constCrypto().uploadedOneTimeKeysCount(signedCurve25519) + numLocalKeys;
	auto numKeysToGenerate = a.numToGen;
	auto genKeysLimit = maxNumKeys - numStoredKeys;

	if (numKeysToGenerate > genKeysLimit) {
	numKeysToGenerate = genKeysLimit;
	}

	if (numLocalKeys <= 0 && numKeysToGenerate <= 0) { // we have enough already
	kzo.client.dbg() << "We have enough one-time keys. Ignoring this." << std::endl;
	return { std::move(m), lager::noop };
	}

	if (numKeysToGenerate > 0) {
	m.withCrypto([&](auto &c) { c.genOneTimeKeysWithRandom(a.random, numKeysToGenerate); });
	}
	kzo.client.dbg() << "Generating done." << std::endl;

	auto keys = m.constCrypto().unpublishedOneTimeKeys();

	auto cv25519Keys = keys.at(curve25519);
	json oneTimeKeys = json::object();
	for (auto [id, keyStr] : cv25519Keys.items()) {
	json keyObject = json::object();
	keyObject["key"] = keyStr;
	keyObject["signatures"] = convertSignature(m, m.withCrypto([&](auto &c) { return c.sign(keyObject); }));

	oneTimeKeys[signedCurve25519 + ":" + id] = keyObject;
	}

	auto job = m.job<UploadKeysJob>()
	.make(
	std::nullopt, // deviceKeys
	oneTimeKeys)
	.withData(json{{"is", "oneTimeKeys"}});

	kzo.client.dbg() << "Uploading one time keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };

	};

	ClientResult processResponse(ClientModel m, UploadKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	auto is = r.dataStr("is");

	if (is == "identityKeys") {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading identity keys failed" << std::endl;
	m.addTrigger(UploadIdentityKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading identity keys successful" << std::endl;
	m.addTrigger(UploadIdentityKeysSuccessful{});

	m.identityKeysUploaded = true;
	} else {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading one-time keys failed" << std::endl;
	m.addTrigger(UploadOneTimeKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading one-time keys successful" << std::endl;
	m.addTrigger(UploadOneTimeKeysSuccessful{});

	m.withCrypto([&](auto &c) { c.markOneTimeKeysAsPublished(); });
	}

	m.withCrypto([&](auto &c) { c.setUploadedOneTimeKeysCount(r.oneTimeKeyCounts()); });

	return { std::move(m), lager::noop };
	}

	static JsonWrap cannotDecryptEvent(std::string reason)
	{
	return json{
	{"type", "m.room.message"},
	{"content", {
	{"msgtype","moe.kazv.mxc.cannot.decrypt"},
	{"body", "This message cannot be decrypted due to " + reason + "."}}}};
	}

	static bool verifyEvent(ClientModel &m, Event e, const json &plainJson)
	{
	bool valid = true;

	try {
	std::string senderCurve25519Key = e.originalJson().get()
	.at("content").at("sender_key");

	auto deviceInfoOpt = m.deviceLists.findByCurve25519Key(e.sender(), senderCurve25519Key);

	if (! deviceInfoOpt) {
	kzo.client.dbg() << "Device key " << senderCurve25519Key
	<< " unknown, thus invalid" << std::endl;
	valid = false;
	}

	auto deviceInfo = deviceInfoOpt.value();

	std::string algo = e.originalJson().get().at("content").at("algorithm");
	if (algo == olmAlgo) {
	if (! (plainJson.at("sender") == e.sender())) {
	kzo.client.dbg() << "Sender does not match, thus invalid" << std::endl;
	valid = false;
	}
	if (! (plainJson.at("recipient") == m.userId)) {
	kzo.client.dbg() << "Recipient does not match, thus invalid" << std::endl;
	valid = false;
	}
	if (! (plainJson.at("recipient_keys").at(ed25519) == m.constCrypto().ed25519IdentityKey())) {
	kzo.client.dbg() << "Recipient key does not match, thus invalid" << std::endl;
	valid = false;
	}
	auto thisEd25519Key = plainJson.at("keys").at(ed25519).get<std::string>();
	if (thisEd25519Key != deviceInfo.ed25519Key) {
	kzo.client.dbg() << "Sender ed25519 key does not match, thus invalid" << std::endl;
	valid = false;
	}
	} else if (algo == megOlmAlgo) {
	if (! (plainJson.at("room_id").get<std::string>() ==
	e.originalJson().get().at("room_id").get<std::string>())) {
	kzo.client.dbg() << "Room id does not match, thus invalid" << std::endl;
	valid = false;
	}
	if (e.originalJson().get().at("content").at("device_id").get<std::string>()
	!= deviceInfo.deviceId) {
	kzo.client.dbg() << "Device id does not match, thus invalid" << std::endl;
	valid = false;
	}
	auto actualEd25519Key = m.constCrypto().getInboundGroupSessionEd25519KeyFromEvent(e.originalJson().get());
	if ((! actualEd25519Key)
	\|\| deviceInfo.ed25519Key != actualEd25519Key.value()) {
	kzo.client.dbg() << "sender ed25519 key does not match, thus invalid" << std::endl;
	kzo.client.dbg() << "From group session: "
	<< (actualEd25519Key ? actualEd25519Key.value() : "<none>") << std::endl;
	kzo.client.dbg() << "From device info: " << deviceInfo.ed25519Key << std::endl;
	valid = false;
	}
	} else {
	kzo.client.dbg() << "Unknown algorithm, thus invalid" << std::endl;
	valid = false;
	}
	} catch (const std::exception &) {
	kzo.client.dbg() << "json format is not correct, thus invalid" << std::endl;
	valid = false;
	}

	return valid;
	}

	static Event decryptEvent(ClientModel &m, Event e)
	{
	// no need for decryption
	if (e.decrypted() \|\| (! e.encrypted())) {
	return e;
	}

	kzo.client.dbg() << "About to decrypt event: "
	<< e.id() << std::endl;

	auto maybePlainText = m.withCrypto([&](Crypto &c) {
	return c.decrypt(e.originalJson().get());
	});

	if (! maybePlainText) {
	kzo.client.dbg() << "Cannot decrypt: " << maybePlainText.reason() << std::endl;
	return e.setDecryptedJson(cannotDecryptEvent(maybePlainText.reason()), Event::NotDecrypted);
	} else {
	auto plainJson = json::parse(maybePlainText.value());
	auto valid = verifyEvent(m, e, plainJson);
	if (valid) {
	kzo.client.dbg() << "The decrypted event is valid." << std::endl;
	}
	return valid
	? e.setDecryptedJson(plainJson, Event::Decrypted)
	: e.setDecryptedJson(cannotDecryptEvent("invalid event"), Event::NotDecrypted);
	}
	}

	ClientModel tryDecryptEvents(ClientModel m)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring decryption request" << std::endl;
	return m;
	}

	kzo.client.dbg() << "Trying to decrypt events..." << std::endl;

	auto decryptFunc = [&](auto e) { return decryptEvent(m, e); };

	auto takeOutRoomKeyEvents =
	[&](auto e) {
	if (e.type() != "m.room_key") {
	// Leave it as it is
	return true;
	}

	try {
	auto content = e.content();
	std::string roomId = content.get().at("room_id");
	std::string sessionId = content.get().at("session_id");
	std::string sessionKey = content.get().at("session_key");
	- std::string senderKey = e.originalJson().get().at("content").at("sender_key");

	- auto k = KeyOfGroupSession{roomId, senderKey, sessionId};
	+ auto k = KeyOfGroupSession{roomId, sessionId};

	std::string ed25519Key = e.decryptedJson().get().at("keys").at(ed25519);

	if (m.withCrypto([&](auto &c) { return c.createInboundGroupSession(k, sessionKey, ed25519Key); })) {
	return false; // such that this event is removed
	}
	} catch (...) {
	kzo.client.dbg() << "cannot create group session";
	return false;
	}
	return true;
	};

	m.toDevice = intoImmer(
	EventList{},
	zug::map(decryptFunc)
	\| zug::filter(takeOutRoomKeyEvents),
	std::move(m.toDevice));

	auto decryptEventInRoom =
	[&](auto id, auto room) {
	if (! room.encrypted) {
	return;
	} else {
	auto messages = room.messages;
	room.messages = merge(
	room.messages,
	intoImmer(
	EventList{},
	zug::filter([](auto n) {
	auto e = n.second;
	return e.encrypted();
	})
	\| zug::map([=](auto n) {
	auto event = n.second;
	return decryptFunc(event);
	}),
	std::move(messages)),
	keyOfTimeline);
	m.roomList.rooms = std::move(m.roomList.rooms).set(id, room);
	}
	};

	auto rooms = m.roomList.rooms;
	for (auto [id, room]: rooms) {
	decryptEventInRoom(id, room);
	}

	return m;
	}

	std::optional<BaseJob> clientPerform(ClientModel m, QueryKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return std::nullopt;
	}

	immer::map<std::string, immer::array<std::string>> deviceKeys;
	auto encryptedUsers = m.deviceLists.outdatedUsers();

	if (encryptedUsers.empty()) {
	kzo.client.dbg() << "Keys are up-to-date." << std::endl;
	return std::nullopt;
	}

	kzo.client.dbg() << "We need to query keys for: " << std::endl;
	for (auto userId: encryptedUsers) {
	kzo.client.dbg() << userId << std::endl;
	deviceKeys = std::move(deviceKeys).set(userId, {});
	}
	kzo.client.dbg() << "^" << std::endl;

	auto job = m.job<QueryKeysJob>()
	.make(std::move(deviceKeys),
	std::nullopt, // timeout
	a.isInitialSync ? std::nullopt : m.syncToken
	);
	return job;
	}

	ClientResult updateClient(ClientModel m, QueryKeysAction a)
	{
	auto jobOpt = clientPerform(m, a);
	if (jobOpt) {
	m.addJob(jobOpt.value());
	}

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, QueryKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "query keys failed: " << r.errorCode() << r.errorMessage() << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Received a query key response" << std::endl;

	auto usersMap = r.deviceKeys();

	for (auto [userId, deviceMap] : usersMap) {
	for (auto [deviceId, deviceInfo] : deviceMap) {
	kzo.client.dbg() << "Key for " << userId
	<< "/" << deviceId
	<< ": " << json(deviceInfo).dump()
	<< std::endl;
	m.withCrypto([&](Crypto &c) {
	m.deviceLists.addDevice(userId, deviceId, deviceInfo, c);
	});
	}
	m.deviceLists.markUpToDate(userId);
	}

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, ClaimKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), lager::noop };
	}

	kzo.client.dbg() << "claim keys for: " << json(a.devicesToSend).dump() << std::endl;

	auto keyMap = immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>>{};


	for (auto [userId, devices] : a.devicesToSend) {
	kzo.client.dbg() << "Iterating through user " << userId << std::endl;
	auto deviceToKey = immer::map<std::string, std::string>{};
	for (auto deviceId : devices) {
	kzo.client.dbg() << "Device: " << deviceId << std::endl;
	auto infoOpt = m.deviceLists.get(userId, deviceId);
	if (infoOpt) {
	kzo.client.dbg() << "Got device info, curve25519 key is: " << infoOpt.value().curve25519Key << std::endl;
	deviceToKey = std::move(deviceToKey)
	.set(deviceId, infoOpt.value().curve25519Key);
	} else {
	kzo.client.dbg() << "Did not get device info" << std::endl;
	}
	}
	keyMap = std::move(keyMap).set(userId, deviceToKey);
	}

	auto devicesToClaimKeys = m.withCrypto([&](auto &c) { return c.devicesMissingOutboundSessionKey(keyMap); });

	kzo.client.dbg() << "Really claim keys for: " << json(devicesToClaimKeys).dump() << std::endl;

	auto oneTimeKeys = immer::map<std::string, immer::map<std::string, std::string>>{};
	for (auto [userId, devices] : devicesToClaimKeys) {
	auto devKeys = immer::map<std::string, std::string>{};
	for (auto deviceId: devices) {
	devKeys = std::move(devKeys).set(deviceId, signedCurve25519);
	}
	oneTimeKeys = std::move(oneTimeKeys).set(userId, devKeys);
	}

	auto job = m.job<ClaimKeysJob>()
	.make(std::move(oneTimeKeys))
	.withData(json{
	{"roomId", a.roomId},
	{"sessionId", a.sessionId},
	{"sessionKey", a.sessionKey},
	{"devicesToSend", a.devicesToSend},
	{"random", a.random}
	});
	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, ClaimKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "claim keys failed" << std::endl;
	m.addTrigger(ClaimKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "claim keys successful" << std::endl;

	kzo.client.dbg() << "Json body: " << r.jsonBody().get().dump() << std::endl;

	auto roomId = r.dataStr("roomId");
	auto sessionKey = r.dataStr("sessionKey");
	auto sessionId = r.dataStr("sessionId");
	auto devicesToSend =
	immer::map<std::string, immer::flex_vector<std::string>>(r.dataJson("devicesToSend"));
	auto random = r.dataJson("random").template get<RandomData>();

	// create outbound sessions for those devices
	auto oneTimeKeys = r.oneTimeKeys();

	for (auto [userId, deviceMap] : oneTimeKeys) {
	for (auto [deviceId, keyVar] : deviceMap) {
	auto keys = keyVar.get();
	for (auto [keyId, key] : keys.items()) {
	auto deviceInfoOpt = m.deviceLists.get(userId, deviceId);
	if (deviceInfoOpt) {
	auto deviceInfo = deviceInfoOpt.value();
	kzo.client.dbg() << "Verifying key for " << userId
	<< "/" << deviceId
	<< key.dump()
	<< " with ed25519 key "
	<< deviceInfo.ed25519Key << std::endl;
	auto verified = m.withCrypto([&](auto &c) { return c.verify(key, userId, deviceId, deviceInfo.ed25519Key); });
	kzo.client.dbg() << (verified ? "passed" : "did not pass") << std::endl;
	if (verified && key.contains("key")) {
	auto theirOneTimeKey = key.at("key");
	kzo.client.dbg() << "creating outbound session for it" << std::endl;
	m.withCrypto([&](auto &c) { c.createOutboundSessionWithRandom(random, deviceInfo.curve25519Key, theirOneTimeKey); });
	random.erase(0, Crypto::createOutboundSessionRandomSize());
	kzo.client.dbg() << "done" << std::endl;
	}
	}
	}
	}
	}

	auto eventJson = json{
	{"content", {{"algorithm", megOlmAlgo},
	{"room_id", roomId},
	{"session_id", sessionId},
	{"session_key", sessionKey}}},
	{"type", "m.room_key"}
	};

	auto event = Event(JsonWrap(eventJson));

	return {
	std::move(m),
	[event](auto &&) { return EffectStatus{ /* success = */ true, json{{ "keyEvent", event.originalJson() }} }; }
	};
	}

	ClientResult updateClient(ClientModel m, EncryptMegOlmEventAction a)
	{
	auto [encryptedEvent, maybeKey] = m.megOlmEncrypt(a.e, a.roomId, a.timeMs, a.random);

	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"encrypted", encryptedEvent.originalJson()},
	});
	if (maybeKey.has_value()) {
	retJson["key"] = maybeKey.value();
	}
	return EffectStatus(/* succ = */ true, retJson);
	}
	};
	}

	ClientResult updateClient(ClientModel m, SetDeviceTrustLevelAction a)
	{
	auto maybeOldInfo = m.deviceLists.get(a.userId, a.deviceId);
	if (!maybeOldInfo) {
	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"error", "No such device"},
	{"errorCode", "MOE_KAZV_MXC_KAZV_NO_SUCH_DEVICE"},
	});

	return EffectStatus(/* succ = */ false, retJson);
	}
	};
	}

	m.deviceLists.deviceLists = updateIn(
	std::move(m.deviceLists.deviceLists),
	[a](auto device) {
	device.trustLevel = a.trustLevel;
	return device;
	},
	a.userId,
	a.deviceId
	);

	return { m, lager::noop };
	}

	ClientResult updateClient(ClientModel m, SetTrustLevelNeededToSendKeysAction a)
	{
	m.trustLevelNeededToSendKeys = a.trustLevel;
	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, PrepareForSharingRoomKeyAction a)
	{
	auto messages = m.olmEncryptSplit(a.e, a.devices, a.random);

	auto txnId = getTxnId(Event(), m);

	m.roomList = RoomListModel::update(
	std::move(m.roomList),
	UpdateRoomAction{
	a.roomId,
	AddPendingRoomKeyAction{
	PendingRoomKeyEvent{txnId, messages}
	}
	}
	);

	return { std::move(m), [txnId](auto &&) {
	return EffectStatus(/* succ = */ true, json::object({{"txnId", txnId}}));
	} };
	}
	}
	diff --git a/src/crypto/crypto-util.hpp b/src/crypto/crypto-util.hpp
	index 0ebd4ca..f830b51 100644
	--- a/src/crypto/crypto-util.hpp
	+++ b/src/crypto/crypto-util.hpp
	@@ -1,122 +1,117 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2021 Tusooa Zhu <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#pragma once
	#include <libkazv-config.hpp>

	#include <string>
	#include <random>
	#include <algorithm>
	#include <vector>

	#include <nlohmann/json.hpp>

	#include <boost/container_hash/hash.hpp>

	namespace Kazv
	{
	using ByteArray = std::vector<unsigned char>;

	struct KeyOfGroupSession
	{
	std::string roomId;
	- std::string senderKey;
	std::string sessionId;
	};

	/**
	* The tag to indicate that a constructor should use user-provided random data.
	*/
	struct RandomTag {};

	using RandomData = std::string;

	inline void from_json(const nlohmann::json &j, KeyOfGroupSession &k)
	{
	k.roomId = j.at("roomId");
	- k.senderKey = j.at("senderKey");
	k.sessionId = j.at("sessionId");
	}

	inline void to_json(nlohmann::json &j, const KeyOfGroupSession &k)
	{
	j = nlohmann::json::object({
	{"roomId", k.roomId},
	- {"senderKey", k.senderKey},
	{"sessionId", k.sessionId},
	});
	}

	inline bool operator==(KeyOfGroupSession a, KeyOfGroupSession b)
	{
	return a.roomId == b.roomId
	- && a.senderKey == b.senderKey
	&& a.sessionId == b.sessionId;
	}

	struct KeyOfOutboundSession
	{
	std::string userId;
	std::string deviceId;
	};

	inline bool operator==(KeyOfOutboundSession a, KeyOfOutboundSession b)
	{
	return a.userId == b.userId
	&& a.deviceId == b.deviceId;
	};

	[[nodiscard]] inline ByteArray genRandom(int len)
	{
	auto rd = std::random_device{};
	auto ret = ByteArray(len, '\0');
	std::generate(ret.begin(), ret.end(), [&] { return rd(); });
	return ret;
	}

	[[nodiscard]] inline RandomData genRandomData(int len)
	{
	auto rd = std::random_device{};
	auto ret = RandomData(len, '\0');
	std::generate(ret.begin(), ret.end(), [&] { return rd(); });
	return ret;
	}


	namespace CryptoConstants
	{
	inline const std::string ed25519{"ed25519"};
	inline const std::string curve25519{"curve25519"};
	inline const std::string signedCurve25519{"signed_curve25519"};

	inline const std::string olmAlgo{"m.olm.v1.curve25519-aes-sha2"};
	inline const std::string megOlmAlgo{"m.megolm.v1.aes-sha2"};
	}
	}

	namespace std
	{
	template<> struct hash<Kazv::KeyOfGroupSession>
	{
	std::size_t operator()(const Kazv::KeyOfGroupSession & k) const noexcept {
	std::size_t seed = 0;
	boost::hash_combine(seed, k.roomId);
	- boost::hash_combine(seed, k.senderKey);
	boost::hash_combine(seed, k.sessionId);
	return seed;
	}
	};

	template<> struct hash<Kazv::KeyOfOutboundSession>
	{
	std::size_t operator()(const Kazv::KeyOfOutboundSession & k) const noexcept {
	std::size_t seed = 0;
	boost::hash_combine(seed, k.userId);
	boost::hash_combine(seed, k.deviceId);
	return seed;
	}
	};
	}
	diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
	index 85272dc..66c0825 100644
	--- a/src/crypto/crypto.cpp
	+++ b/src/crypto/crypto.cpp
	@@ -1,650 +1,649 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <vector>

	#include <zug/transducer/filter.hpp>

	#include <olm/olm.h>

	#include <nlohmann/json.hpp>

	#include <debug.hpp>
	#include <event.hpp>
	#include <cursorutil.hpp>
	#include <types.hpp>

	#include "crypto-p.hpp"
	#include "session-p.hpp"

	#include "crypto-util.hpp"
	#include "time-util.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	CryptoPrivate::CryptoPrivate()
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	, valid(false)
	{
	}

	CryptoPrivate::CryptoPrivate(RandomTag, RandomData data)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	auto randLenNeeded = Crypto::constructRandomSize();
	checkError(olm_create_account(account, data.data(), randLenNeeded));
	}


	CryptoPrivate::~CryptoPrivate()
	{
	olm_clear_account(account);
	}

	CryptoPrivate::CryptoPrivate(const CryptoPrivate &that)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, uploadedOneTimeKeysCount(that.uploadedOneTimeKeysCount)
	, numUnpublishedKeys(that.numUnpublishedKeys)
	, knownSessions(that.knownSessions)
	, inboundGroupSessions(that.inboundGroupSessions)
	, outboundGroupSessions(that.outboundGroupSessions)
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	unpickle(that.pickle());
	}

	std::string CryptoPrivate::pickle() const
	{
	auto key = ByteArray(3, 'x');
	auto pickleData = std::string(olm_pickle_account_length(account), '\0');
	checkError(olm_pickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	return pickleData;
	}

	void CryptoPrivate::unpickle(std::string pickleData)
	{
	auto key = ByteArray(3, 'x');
	checkError(olm_unpickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	}

	std::size_t CryptoPrivate::checkError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm error: " << olm_account_last_error(account) << std::endl;
	}
	return code;
	}

	std::size_t CryptoPrivate::checkUtilError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm utility error: " << olm_utility_last_error(utility) << std::endl;
	}
	return code;
	}


	MaybeString CryptoPrivate::decryptOlm(nlohmann::json content)
	{
	auto theirCurve25519IdentityKey = content.at("sender_key").get<std::string>();

	auto ourCurve25519IdentityKey = curve25519IdentityKey();

	if (! content.at("ciphertext").contains(ourCurve25519IdentityKey)) {
	return NotBut("Message not intended for us");
	}

	auto type = content.at("ciphertext").at(ourCurve25519IdentityKey).at("type").get<int>();
	auto body = content.at("ciphertext").at(ourCurve25519IdentityKey).at("body").get<std::string>();

	auto hasKnownSession = knownSessions.find(theirCurve25519IdentityKey) != knownSessions.end();

	if (type == 0) { // pre-key message
	bool shouldCreateNewSession =
	// there is no possible session
	(! hasKnownSession)
	// the possible session does not match this message
	\|\| (! knownSessions.at(theirCurve25519IdentityKey).matches(body));

	if (shouldCreateNewSession) {
	auto created = createInboundSession(theirCurve25519IdentityKey, body);
	if (! created) { // cannot create session, thus cannot decrypt
	return NotBut("Cannot create session");
	}
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);

	return session.decrypt(type, body);
	} else {
	if (! hasKnownSession) {
	return NotBut("No available session");
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);
	return session.decrypt(type, body);
	}
	}

	MaybeString CryptoPrivate::decryptMegOlm(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");

	- auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	- auto k = KeyOfGroupSession{roomId, senderKey, sessionId};
	+ auto k = KeyOfGroupSession{roomId, sessionId};

	if (inboundGroupSessions.find(k) == inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto msg = content.at("ciphertext").get<std::string>();
	auto eventId = eventJson.at("event_id").get<std::string>();
	auto originServerTs = eventJson.at("origin_server_ts").get<Timestamp>();
	auto &session = inboundGroupSessions.at(k);

	return session.decrypt(msg, eventId, originServerTs);
	}
	}

	bool CryptoPrivate::createInboundSession(std::string theirCurve25519IdentityKey,
	std::string message)
	{
	auto s = Session(InboundSessionTag{}, account,
	theirCurve25519IdentityKey, message);

	if (s.valid()) {
	checkError(olm_remove_one_time_keys(account, s.m_d->session));
	knownSessions.insert_or_assign(theirCurve25519IdentityKey, std::move(s));
	return true;
	}

	return false;
	}

	bool CryptoPrivate::reuseOrCreateOutboundGroupSession(
	RandomData random, Timestamp timeMs,
	std::string roomId, std::optional<MegOlmSessionRotateDesc> desc)
	{
	bool valid = true;
	if (! desc.has_value()) { // force rotate
	valid = false;
	} else {
	auto it = outboundGroupSessions.find(roomId);
	if (it == outboundGroupSessions.end()) {
	valid = false;
	} else {
	auto &session = it->second;
	if (timeMs - session.creationTimeMs() >= desc.value().ms) {
	valid = false;
	} else if (session.messageIndex() >= desc.value().messages) {
	valid = false;
	}
	}
	}

	if (! valid) {
	outboundGroupSessions.insert_or_assign(roomId, OutboundGroupSession(RandomTag{}, random, timeMs));
	auto &session = outboundGroupSessions.at(roomId);
	auto sessionId = session.sessionId();
	auto sessionKey = session.sessionKey();
	- auto senderKey = curve25519IdentityKey();

	- auto k = KeyOfGroupSession{roomId, senderKey, sessionId};
	+ auto k = KeyOfGroupSession{roomId, sessionId};

	if (! createInboundGroupSession(k, sessionKey, ed25519IdentityKey())) {
	kzo.client.warn() << "Create inbound group session from outbound group session failed. We may not be able to read our own messages." << std::endl;
	}
	}
	return valid;
	}


	std::size_t Crypto::constructRandomSize()
	{
	static std::size_t s =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_create_account_random_length(account);
	}();
	return s;
	}

	Crypto::Crypto()
	: m_d(new CryptoPrivate{})
	{
	}

	Crypto::Crypto(RandomTag, RandomData data)
	: m_d(new CryptoPrivate(RandomTag{}, std::move(data)))
	{
	}

	Crypto::~Crypto() = default;

	Crypto::Crypto(const Crypto &that)
	: m_d(new CryptoPrivate(*that.m_d))
	{
	}

	Crypto::Crypto(Crypto &&that)
	: m_d(std::move(that.m_d))
	{
	}

	Crypto &Crypto::operator=(const Crypto &that)
	{
	m_d.reset(new CryptoPrivate(*that.m_d));
	return *this;
	}

	Crypto &Crypto::operator=(Crypto &&that)
	{
	m_d = std::move(that.m_d);
	return *this;
	}

	bool Crypto::operator==(const Crypto &that) const
	{
	return this->m_d == that.m_d;
	}

	bool Crypto::valid() const
	{
	return m_d->valid;
	}

	ByteArray CryptoPrivate::identityKeys() const
	{
	auto ret = ByteArray(olm_account_identity_keys_length(account), '\0');
	checkError(olm_account_identity_keys(account, ret.data(), ret.size()));
	return ret;
	}

	std::string CryptoPrivate::ed25519IdentityKey() const
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(ed25519);
	}

	std::string CryptoPrivate::curve25519IdentityKey() const
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(curve25519);
	}

	std::string Crypto::ed25519IdentityKey() const
	{
	return m_d->ed25519IdentityKey();
	}

	std::string Crypto::curve25519IdentityKey() const
	{
	return m_d->curve25519IdentityKey();
	}

	std::string Crypto::sign(nlohmann::json j)
	{
	j.erase("signatures");
	j.erase("unsigned");

	auto str = j.dump();

	auto ret = ByteArray(olm_account_signature_length(m_d->account), '\0');

	kzo.crypto.dbg() << "We are about to sign: " << str << std::endl;

	m_d->checkError(olm_account_sign(m_d->account,
	str.data(), str.size(),
	ret.data(), ret.size()));

	return std::string{ret.begin(), ret.end()};
	}

	void Crypto::setUploadedOneTimeKeysCount(immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount)
	{
	m_d->uploadedOneTimeKeysCount = uploadedOneTimeKeysCount;
	}

	std::size_t Crypto::maxNumberOfOneTimeKeys() const
	{
	return olm_account_max_number_of_one_time_keys(m_d->account);
	}

	std::size_t Crypto::genOneTimeKeysRandomSize(int num)
	{
	static std::size_t oneKeyRandomSize =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_account_generate_one_time_keys_random_length(account, 1);
	}();

	return oneKeyRandomSize * num;
	}

	void Crypto::genOneTimeKeysWithRandom(RandomData random, int num)
	{
	assert(random.size() >= genOneTimeKeysRandomSize(num));

	auto res = m_d->checkError(
	olm_account_generate_one_time_keys(
	m_d->account,
	num,
	random.data(), random.size()));

	if (res != olm_error()) {
	m_d->numUnpublishedKeys += num;
	}
	}


	nlohmann::json Crypto::unpublishedOneTimeKeys() const
	{
	auto keys = ByteArray(olm_account_one_time_keys_length(m_d->account), '\0');
	m_d->checkError(olm_account_one_time_keys(m_d->account, keys.data(), keys.size()));

	return nlohmann::json::parse(std::string(keys.begin(), keys.end()));
	}

	void Crypto::markOneTimeKeysAsPublished()
	{
	auto ret = m_d->checkError(olm_account_mark_keys_as_published(m_d->account));
	if (ret != olm_error()) {
	m_d->numUnpublishedKeys = 0;
	}
	}

	int Crypto::numUnpublishedOneTimeKeys() const
	{
	return m_d->numUnpublishedKeys;
	}

	int Crypto::uploadedOneTimeKeysCount(std::string algorithm) const
	{
	return m_d->uploadedOneTimeKeysCount[algorithm];
	}

	MaybeString Crypto::decrypt(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");
	auto algo = content.contains("algorithm") ? content.at("algorithm").template get<std::string>() : std::string();
	if (algo == olmAlgo) {
	return m_d->decryptOlm(std::move(content));
	} else if (algo == megOlmAlgo) {
	return m_d->decryptMegOlm(eventJson);
	}
	return NotBut("Algorithm " + algo + " not supported");
	}

	bool Crypto::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	return m_d->createInboundGroupSession(std::move(k), std::move(sessionKey), std::move(ed25519Key));
	}

	bool Crypto::hasInboundGroupSession(KeyOfGroupSession k) const
	{
	return m_d->inboundGroupSessions.find(k) != m_d->inboundGroupSessions.end();
	}

	bool CryptoPrivate::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	auto session = InboundGroupSession(sessionKey, ed25519Key);
	if (session.valid()) {
	inboundGroupSessions.insert_or_assign(k, std::move(session));
	return true;
	}
	return false;
	}

	bool Crypto::verify(nlohmann::json object, std::string userId, std::string deviceId, std::string ed25519Key)
	{
	if (! object.contains("signatures")) {
	return false;
	}
	std::string signature;
	try {
	signature = object.at("signatures").at(userId).at(ed25519 + ":" + deviceId);
	} catch(const std::exception &) {
	return false;
	}
	object.erase("signatures");
	object.erase("unsigned");

	auto message = object.dump();

	auto res = m_d->checkUtilError(
	olm_ed25519_verify(m_d->utility,
	ed25519Key.c_str(), ed25519Key.size(),
	message.c_str(), message.size(),
	signature.data(), signature.size()));

	return res != olm_error();
	}

	MaybeString Crypto::getInboundGroupSessionEd25519KeyFromEvent(const nlohmann::json &eventJson) const
	{
	auto content = eventJson.at("content");

	- auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	- auto k = KeyOfGroupSession{roomId, senderKey, sessionId};
	+ auto k = KeyOfGroupSession{roomId, sessionId};

	if (m_d->inboundGroupSessions.find(k) == m_d->inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto &session = m_d->inboundGroupSessions.at(k);
	return session.ed25519Key();
	}
	}

	std::size_t Crypto::encryptOlmRandomSize(std::string /* theirCurve25519IdentityKey */) const
	{
	// HACK: To prevent a possible race condition where we call
	// encryptedOlmRandomSize() -> randomGenerator.generateRange() ~> [encryptOlm()]
	//
	// Here, encryptOlm() must be called in the reducer,
	// as it changes the status of
	// Crypto (so we should not risk any infomation lose in Crypto).
	// Also, for the reducer to be pure, we may not call generateRange() in the reducer,
	// as that is not a pure function. This means it can only be called in an effect,
	// or .then() continuation. This means, the sequence from encryptedOlmRandomSize()
	// to encryptOlm() can never be atomic. That is, there may be other encryptOlm()
	// calls within, and that may increase the random data needed, and as a result,
	// we will not have enough random data.
	//
	// According to the olm headers:
	// https://gitlab.matrix.org/matrix-org/olm/-/blob/master/include/olm/ratchet.hh
	// The maximum random size needed to encrypt is 32. We use this to ensure we
	// will always have enough random data fot the encryption.
	return encryptOlmMaxRandomSize();
	}

	std::size_t Crypto::encryptOlmMaxRandomSize()
	{
	static std::size_t maxRandomSizeNeeded = 32;
	return maxRandomSizeNeeded;
	}

	nlohmann::json Crypto::encryptOlmWithRandom(
	RandomData random, nlohmann::json eventJson, std::string theirCurve25519IdentityKey)
	{
	assert(random.size() >= encryptOlmRandomSize(theirCurve25519IdentityKey));
	try {
	auto &session = m_d->knownSessions.at(theirCurve25519IdentityKey);
	auto [type, body] = session.encryptWithRandom(random, eventJson.dump());
	return nlohmann::json{
	{
	theirCurve25519IdentityKey, {
	{"type", type},
	{"body", body}
	}
	}
	};
	} catch (const std::exception &) {
	return nlohmann::json::object();
	}
	}

	nlohmann::json Crypto::encryptMegOlm(nlohmann::json eventJson)
	{
	auto roomId = eventJson.at("room_id").get<std::string>();
	auto content = eventJson.at("content");
	auto type = eventJson.at("type").get<std::string>();

	auto jsonToEncrypt = nlohmann::json::object();
	jsonToEncrypt["room_id"] = roomId;
	jsonToEncrypt["content"] = std::move(content);
	jsonToEncrypt["type"] = type;

	auto textToEncrypt = std::move(jsonToEncrypt).dump();

	auto &session = m_d->outboundGroupSessions.at(roomId);

	auto ciphertext = session.encrypt(std::move(textToEncrypt));

	return
	json{
	{"algorithm", CryptoConstants::megOlmAlgo},
	+ // NOTE: we might stop sending sender_key in the future
	+ // as per the Matrix spec
	{"sender_key", curve25519IdentityKey()},
	{"ciphertext", ciphertext},
	{"session_id", session.sessionId()},
	};
	}

	std::size_t Crypto::rotateMegOlmSessionRandomSize()
	{
	return OutboundGroupSession::constructRandomSize();
	}

	std::string Crypto::rotateMegOlmSessionWithRandom(RandomData random, Timestamp timeMs, std::string roomId)
	{
	m_d->reuseOrCreateOutboundGroupSession(
	random, timeMs,
	roomId, std::nullopt);
	return outboundGroupSessionCurrentKey(roomId);
	}

	std::optional<std::string> Crypto::rotateMegOlmSessionWithRandomIfNeeded(
	RandomData random, Timestamp timeMs,
	std::string roomId, MegOlmSessionRotateDesc desc)
	{
	auto oldSessionValid = m_d->reuseOrCreateOutboundGroupSession(random, timeMs, roomId, std::move(desc));
	return oldSessionValid ? std::nullopt : std::optional(outboundGroupSessionCurrentKey(roomId));
	}

	std::string Crypto::outboundGroupSessionInitialKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.initialSessionKey();
	}

	std::string Crypto::outboundGroupSessionCurrentKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.sessionKey();
	}

	auto Crypto::devicesMissingOutboundSessionKey(
	immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>> keyMap) const -> UserIdToDeviceIdMap
	{
	auto ret = UserIdToDeviceIdMap{};
	for (auto [userId, devices] : keyMap) {
	auto unknownDevices =
	intoImmer(immer::flex_vector<std::string>{},
	zug::filter([=](auto kv) {
	auto [deviceId, theirCurve25519IdentityKey] = kv;
	return m_d->knownSessions.find(theirCurve25519IdentityKey)
	== m_d->knownSessions.end();
	})
	\| zug::map([=](auto kv) {
	auto [deviceId, key] = kv;
	return deviceId;
	}),
	devices);
	if (! unknownDevices.empty()) {
	ret = std::move(ret).set(userId, std::move(unknownDevices));
	}
	}
	return ret;
	}

	std::size_t Crypto::createOutboundSessionRandomSize()
	{
	return Session::constructOutboundRandomSize();
	}

	void Crypto::createOutboundSessionWithRandom(
	RandomData random,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	{
	assert(random.size() >= createOutboundSessionRandomSize());
	auto session = Session(OutboundSessionTag{},
	RandomTag{},
	random,
	m_d->account,
	theirIdentityKey,
	theirOneTimeKey);

	if (session.valid()) {
	m_d->knownSessions.insert_or_assign(theirIdentityKey,
	std::move(session));
	}
	}

	nlohmann::json Crypto::toJson() const
	{
	std::string pickledData = m_d->valid ? m_d->pickle() : std::string();
	auto j = nlohmann::json::object({
	{"valid", m_d->valid},
	{"account", std::move(pickledData)},
	{"uploadedOneTimeKeysCount", m_d->uploadedOneTimeKeysCount},
	{"numUnpublishedKeys", m_d->numUnpublishedKeys},
	{"knownSessions", nlohmann::json(m_d->knownSessions)},
	{"inboundGroupSessions", nlohmann::json(m_d->inboundGroupSessions)},
	{"outboundGroupSessions", nlohmann::json(m_d->outboundGroupSessions)},
	});

	return j;
	}

	void Crypto::loadJson(const nlohmann::json &j)
	{
	m_d->valid = j.contains("valid") ? j["valid"].template get<bool>() : true;
	const auto &pickledData = j.at("account").template get<std::string>();
	if (m_d->valid) { m_d->unpickle(pickledData); }

	m_d->uploadedOneTimeKeysCount = j.at("uploadedOneTimeKeysCount");
	m_d->numUnpublishedKeys = j.at("numUnpublishedKeys");
	m_d->knownSessions = j.at("knownSessions").template get<decltype(m_d->knownSessions)>();
	m_d->inboundGroupSessions = j.at("inboundGroupSessions").template get<decltype(m_d->inboundGroupSessions)>();
	m_d->outboundGroupSessions = j.at("outboundGroupSessions").template get<decltype(m_d->outboundGroupSessions)>();
	}
	}
	diff --git a/src/tests/crypto-test.cpp b/src/tests/crypto-test.cpp
	index 7951c70..d476c03 100644
	--- a/src/tests/crypto-test.cpp
	+++ b/src/tests/crypto-test.cpp
	@@ -1,509 +1,560 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>


	#include <catch2/catch_all.hpp>

	#include <sstream>

	#include <boost/archive/text_iarchive.hpp>
	#include <boost/archive/text_oarchive.hpp>


	#include <crypto/crypto.hpp>
	#include <aes-256-ctr.hpp>
	#include <base64.hpp>
	#include <sha256.hpp>

	using namespace Kazv;
	using namespace Kazv::CryptoConstants;

	using IAr = boost::archive::text_iarchive;
	using OAr = boost::archive::text_oarchive;

	template<class T>
	static void serializeDup(const T &in, T &out)
	{
	std::stringstream stream;

	{
	auto ar = OAr(stream);
	ar << in;
	}

	{
	auto ar = IAr(stream);
	ar >> out;
	}
	}

	TEST_CASE("Crypto constructors", "[crypto]")
	{
	Crypto crypto;
	REQUIRE(!crypto.valid());

	Crypto crypto2(RandomTag{}, genRandomData(Crypto::constructRandomSize()));
	REQUIRE(crypto2.valid());
	}

	TEST_CASE("Crypto should be copyable", "[crypto]")
	{
	Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	crypto.genOneTimeKeysWithRandom(genRandomData(Crypto::genOneTimeKeysRandomSize(1)), 1);
	auto oneTimeKeys = crypto.unpublishedOneTimeKeys();
	Crypto cryptoClone(crypto);

	REQUIRE(crypto.ed25519IdentityKey() == cryptoClone.ed25519IdentityKey());
	REQUIRE(crypto.curve25519IdentityKey() == cryptoClone.curve25519IdentityKey());

	auto oneTimeKeys2 = cryptoClone.unpublishedOneTimeKeys();

	REQUIRE(oneTimeKeys == oneTimeKeys2);
	REQUIRE(crypto.numUnpublishedOneTimeKeys() == cryptoClone.numUnpublishedOneTimeKeys());
	}

	TEST_CASE("Crypto should be serializable", "[crypto]")
	{
	Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	crypto.genOneTimeKeysWithRandom(genRandomData(Crypto::genOneTimeKeysRandomSize(1)), 1);
	auto oneTimeKeys = crypto.unpublishedOneTimeKeys();

	Crypto cryptoClone;

	serializeDup(crypto, cryptoClone);

	REQUIRE(crypto.ed25519IdentityKey() == cryptoClone.ed25519IdentityKey());
	REQUIRE(crypto.curve25519IdentityKey() == cryptoClone.curve25519IdentityKey());

	auto oneTimeKeys2 = cryptoClone.unpublishedOneTimeKeys();

	REQUIRE(oneTimeKeys == oneTimeKeys2);
	REQUIRE(crypto.numUnpublishedOneTimeKeys() == cryptoClone.numUnpublishedOneTimeKeys());
	}

	TEST_CASE("Invalid Crypto should be serializable", "[crypto]")
	{
	Crypto crypto;
	Crypto cryptoClone;
	serializeDup(crypto, cryptoClone);
	REQUIRE(!cryptoClone.valid());
	}

	TEST_CASE("Serialize Crypto with an OutboundGroupSession", "[crypto]")
	{
	Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	std::string roomId = "!example:example.org";
	auto desc = MegOlmSessionRotateDesc{500000 /* ms /, 100 / messages */};

	crypto.rotateMegOlmSessionWithRandom(genRandomData(Crypto::rotateMegOlmSessionRandomSize()), currentTimeMs(), roomId);

	Crypto cryptoClone;

	serializeDup(crypto, cryptoClone);

	REQUIRE(! cryptoClone.rotateMegOlmSessionWithRandomIfNeeded(
	genRandomData(Crypto::rotateMegOlmSessionRandomSize()), currentTimeMs(),
	roomId, desc).has_value());
	}

	TEST_CASE("Generating and publishing keys should work", "[crypto]")
	{
	Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	crypto.genOneTimeKeysWithRandom(genRandomData(Crypto::genOneTimeKeysRandomSize(1)), 1);

	REQUIRE(crypto.numUnpublishedOneTimeKeys() == 1);

	crypto.genOneTimeKeysWithRandom(genRandomData(Crypto::genOneTimeKeysRandomSize(1)), 1);
	REQUIRE(crypto.numUnpublishedOneTimeKeys() == 2);

	crypto.markOneTimeKeysAsPublished();
	REQUIRE(crypto.numUnpublishedOneTimeKeys() == 0);
	}

	TEST_CASE("Should reuse existing inbound session to encrypt", "[crypto]")
	{
	Crypto a(RandomTag{}, genRandomData(Crypto::constructRandomSize()));
	Crypto b(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	a.genOneTimeKeysWithRandom(genRandomData(Crypto::genOneTimeKeysRandomSize(1)), 1);
	// Get A publish the key and send to B
	auto k = a.unpublishedOneTimeKeys();
	a.markOneTimeKeysAsPublished();

	auto oneTimeKey = std::string{};

	for (auto [id, key] : k[curve25519].items()) {
	oneTimeKey = key;
	}

	auto aIdKey = a.curve25519IdentityKey();
	b.createOutboundSessionWithRandom(genRandomData(Crypto::createOutboundSessionRandomSize()), aIdKey, oneTimeKey);

	auto origJson = json{{"test", "mew"}};
	auto encryptedMsg = b.encryptOlmWithRandom(genRandomData(Crypto::encryptOlmMaxRandomSize()), origJson, aIdKey);
	auto encJson = json{
	{"content",
	{
	{"algorithm", olmAlgo},
	{"ciphertext", encryptedMsg},
	{"sender_key", b.curve25519IdentityKey()}
	}
	}
	};

	auto decryptedOpt = a.decrypt(encJson);

	REQUIRE(decryptedOpt);

	auto decryptedJson = json::parse(decryptedOpt.value());

	REQUIRE(decryptedJson == origJson);

	using StrMap = immer::map<std::string, std::string>;
	auto devMap = immer::map<std::string, StrMap>()
	.set("b", StrMap().set("dev", b.curve25519IdentityKey()));

	Crypto aClone{a};

	auto devices = a.devicesMissingOutboundSessionKey(devMap);
	auto devicesAClone = aClone.devicesMissingOutboundSessionKey(devMap);

	// No device should be missing an olm session, as A has received an
	// inbound olm session before.
	auto expected = immer::map<std::string, immer::flex_vector<std::string>>();

	REQUIRE(devices == expected);
	REQUIRE(devicesAClone == expected);
	}

	TEST_CASE("Encrypt and decrypt AES-256-CTR", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);
	auto desc2 = desc;

	std::string original = "test for aes-256-ctr";

	auto encrypted = desc.processInPlace(original);

	auto decrypted = desc2.processInPlace(encrypted);

	REQUIRE(original == decrypted);
	}

	TEST_CASE("Encrypt and decrypt AES-256-CTR with any sequence type", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);
	auto desc2 = desc;

	std::string oStr = "test for aes-256-ctr";
	std::vector<unsigned char> original(oStr.begin(), oStr.end());

	auto encrypted = desc.processInPlace(original);

	auto decrypted = desc2.processInPlace(encrypted);

	REQUIRE(original == decrypted);
	}

	TEST_CASE("Encrypt and decrypt AES-256-CTR in a non-destructive way", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);

	std::string original = "test for aes-256-ctr";

	auto [next, encrypted] = desc.process(original);

	auto [next2, encrypted2] = desc.process(original);

	REQUIRE(encrypted == encrypted2);

	auto [next3, decrypted] = desc.process(encrypted);

	REQUIRE(original == decrypted);
	}

	TEST_CASE("Encrypt and decrypt AES-256-CTR in batches", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);

	std::string original = "test for aes-256-ctr";

	std::string orig2 = "another test string...";

	auto [next, encrypted] = desc.process(original);
	auto [next2, encrypted2] = next.process(orig2);

	auto [next3, decrypted] = desc.process(encrypted + encrypted2);

	REQUIRE(original + orig2 == decrypted);
	}

	TEST_CASE("AES-256-CTR should be movable", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);

	auto desc2 = std::move(desc);

	REQUIRE(desc2.valid());
	REQUIRE(! desc.valid());

	std::string original = "test for aes-256-ctr";

	std::string encrypted;

	// Can be moved from itself
	desc2 = std::move(desc2);
	REQUIRE(desc2.valid());

	std::tie(desc2, encrypted) = std::move(desc2).process(original);

	REQUIRE(desc2.valid());
	}

	TEST_CASE("AES-256-CTR should be copyable", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);

	auto desc2 = desc;

	REQUIRE(desc2.valid());
	REQUIRE(desc.valid());

	desc = AES256CTRDesc::fromRandom(RandomData{});

	std::string original = "test for aes-256-ctr";

	std::string encrypted;

	REQUIRE(desc2.valid());

	std::tie(desc2, encrypted) = desc2.process(original);

	REQUIRE(desc2.valid());
	}

	TEST_CASE("Construct AES-256-CTR from known key and iv", "[crypto][aes256ctr]")
	{
	auto r = genRandom(AES256CTRDesc::randomSize);

	auto desc = AES256CTRDesc::fromRandom(r);

	auto desc2 = AES256CTRDesc(desc.key(), desc.iv());

	REQUIRE(desc2.valid());
	REQUIRE(desc.key() == desc2.key());
	REQUIRE(desc.iv() == desc2.iv());
	}

	TEST_CASE("AES-256-CTR validity check", "[crypto][aes256ctr]")
	{
	SECTION("Not enough random, should reject") {
	ByteArray random = genRandom(AES256CTRDesc::randomSize - 1);

	auto desc = AES256CTRDesc::fromRandom(random);

	REQUIRE(! desc.valid());
	}

	SECTION("More than enough random, should accept") {
	ByteArray random = genRandom(AES256CTRDesc::randomSize + 1);

	auto desc = AES256CTRDesc::fromRandom(random);

	REQUIRE(desc.valid());
	}

	}


	TEST_CASE("Base64 encoder and decoder", "[crypto][base64]")
	{
	std::string orig = "The Quick Brown Fox Jumps Over the Lazy Dog";
	// no padding
	std::string expected = "VGhlIFF1aWNrIEJyb3duIEZveCBKdW1wcyBPdmVyIHRoZSBMYXp5IERvZw";
	std::string encoded = encodeBase64(orig);
	REQUIRE(encoded == expected);

	std::string decoded = decodeBase64(encoded);
	REQUIRE(decoded == orig);
	}

	TEST_CASE("Urlsafe base64 encoder and decoder", "[crypto][base64]")
	{
	std::string orig = "The Quick Brown Fox Jumps Over the Lazy Dog";
	// no padding
	std::string expected = "VGhlIFF1aWNrIEJyb3duIEZveCBKdW1wcyBPdmVyIHRoZSBMYXp5IERvZw";
	std::string encoded = encodeBase64(orig, Base64Opts::urlSafe);
	REQUIRE(encoded == expected);

	std::string decoded = decodeBase64(encoded, Base64Opts::urlSafe);
	REQUIRE(decoded == orig);
	}

	TEST_CASE("Base64 encoder and decoder, example from Matrix specs", "[crypto][base64]")
	{
	std::string orig = "JGLn/yafz74HB2AbPLYJWIVGnKAtqECOBf11yyXac2Y";

	std::string decoded = decodeBase64(orig);
	std::string encoded = encodeBase64(decoded);
	REQUIRE(encoded == orig);
	}

	TEST_CASE("Urlsafe base64 encoder and decoder, example from Matrix specs", "[crypto][base64]")
	{
	std::string orig = "JGLn_yafz74HB2AbPLYJWIVGnKAtqECOBf11yyXac2Y";

	std::string decoded = decodeBase64(orig, Base64Opts::urlSafe);
	std::string encoded = encodeBase64(decoded, Base64Opts::urlSafe);
	REQUIRE(encoded == orig);
	}

	TEST_CASE("SHA256 hashing support", "[crypto][sha256]")
	{
	auto hash = SHA256Desc{};

	auto message1 = std::string("12345678910");
	hash.processInPlace(message1);

	auto res = hash.get();
	auto expected = std::string("Y2QCZISah8kDVhKdmeoWXjeqX6vB/qRpBt8afKUNtJI");

	REQUIRE(res == expected);
	}

	TEST_CASE("SHA256 hashing streaming", "[crypto][sha256]")
	{
	auto hash = SHA256Desc{};

	auto message1 = std::string("12345678910");
	auto message2 = std::string("abcdefghijklmn");
	hash.processInPlace(message1);
	hash.processInPlace(message2);

	auto res = hash.get();

	auto hash2 = SHA256Desc{};

	hash2.processInPlace(message1 + message2);
	auto expected = hash2.get();

	REQUIRE(res == expected);
	}

	TEST_CASE("SHA256Desc should be copyable", "[crypto][sha256]")
	{
	auto hash = SHA256Desc{};

	auto message1 = std::string("12345678910");
	auto message2 = std::string("abcdefghijklmn");
	hash.processInPlace(message1);

	auto hash2 = hash;

	hash.processInPlace(message2);
	hash2.processInPlace(message2);

	auto res = hash.get();
	auto res2 = hash2.get();

	REQUIRE(res == res2);
	}

	TEST_CASE("SHA256Desc should be self-copyable and -movable", "[crypto][sha256]")
	{
	auto hash = SHA256Desc{};

	auto message1 = std::string("12345678910");
	hash = hash.process(message1);

	auto message2 = std::string("abcdefghijklmn");
	hash = std::move(hash).process(message2);

	auto hash2 = SHA256Desc{};

	hash2.processInPlace(message1 + message2);

	auto res = hash.get();
	auto res2 = hash2.get();

	REQUIRE(res == res2);
	}

	TEST_CASE("SHA256 should accept any range type", "[crypto][sha256]")
	{
	std::string msg = "12345678910";
	std::vector<char> arr(msg.begin(), msg.end());

	auto hash = SHA256Desc{};

	auto res1 = hash.process(arr).get();

	auto res2 = std::move(hash).process(arr).get();

	// after moving, hash is no longer valid, reset it here
	hash = SHA256Desc{};

	hash.processInPlace(arr);
	auto res3 = hash.get();

	hash = SHA256Desc{};
	auto reference = hash.process(msg).get();

	REQUIRE(res1 == res2);
	REQUIRE(res1 == res3);
	REQUIRE(res1 == reference);
	}

	TEST_CASE("Crypto::hasInboundGroupSession", "[crypto][group-session]")
	{
	Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));

	// creating a outbound group session will add it to inbound group sessions
	crypto.rotateMegOlmSessionWithRandom(
	genRandomData(Crypto::rotateMegOlmSessionRandomSize()),
	0,
	"!someroom:example.com"
	);

	// encrypt to get the session id
	- auto ev = crypto.encryptMegOlm(R"({
	+ auto encryptedContent = crypto.encryptMegOlm(R"({
	"content": {},
	"type": "m.room.message",
	"room_id": "!someroom:example.com"
	})"_json);

	- auto sessionId = ev["session_id"].template get<std::string>();
	+ auto sessionId = encryptedContent["session_id"].template get<std::string>();

	REQUIRE(crypto.hasInboundGroupSession(KeyOfGroupSession{
	"!someroom:example.com",
	- crypto.curve25519IdentityKey(),
	sessionId,
	}));

	REQUIRE(!crypto.hasInboundGroupSession(KeyOfGroupSession{
	"!someroom:example.com",
	- crypto.curve25519IdentityKey(),
	sessionId + "something something",
	}));
	}
	+
	+TEST_CASE("Crypto::decrypt(MegOlmEvent)", "[crypto][group-session]")
	+{
	+ Crypto crypto(RandomTag{}, genRandomData(Crypto::constructRandomSize()));
	+
	+ crypto.rotateMegOlmSessionWithRandom(
	+ genRandomData(Crypto::rotateMegOlmSessionRandomSize()),
	+ 0,
	+ "!someroom:example.com"
	+ );
	+
	+ auto plainText = R"({
	+ "content": {"body": "something"},
	+ "type": "m.room.message",
	+ "room_id": "!someroom:example.com"
	+ })"_json;
	+ // encrypt to get the session id
	+ auto encryptedContent = crypto.encryptMegOlm(plainText);
	+
	+ auto encryptedEvent = json{
	+ {"event_id", "$some-event-id"},
	+ {"origin_server_ts", 1719196953000},
	+ {"content", encryptedContent},
	+ {"type", "m.room.encrypted"},
	+ {"room_id", "!someroom:example.com"},
	+ };
	+
	+ auto res = crypto.decrypt(encryptedEvent);
	+ auto decrypted = json::parse(res.value());
	+ REQUIRE(decrypted == plainText);
	+}
	+
	+TEST_CASE("KeyOfGroupSession serialization", "[crypto][group-session]")
	+{
	+ {
	+ auto k = KeyOfGroupSession{"!someroom:example.com", "some-session-id"};
	+ json j = k;
	+ REQUIRE(j == json{
	+ {"roomId", "!someroom:example.com"},
	+ {"sessionId", "some-session-id"},
	+ });
	+ }
	+
	+ {
	+ json j{
	+ {"roomId", "!someroom:example.com"},
	+ {"senderKey", "some-key"}, // legacy version
	+ {"sessionId", "some-session-id"},
	+ };
	+ auto k = j.template get<KeyOfGroupSession>();
	+ REQUIRE(k == KeyOfGroupSession{"!someroom:example.com", "some-session-id"});
	+ }
	+}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 8, 5:13 PM (1 d, 21 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1723753
Default Alt Text: (66 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions