diff --git a/services/identity/src/main.rs b/services/identity/src/main.rs --- a/services/identity/src/main.rs +++ b/services/identity/src/main.rs @@ -10,6 +10,7 @@ mod interceptor; mod keygen; mod nonce; +mod pake_grpc; mod service; mod token; diff --git a/services/identity/src/pake_grpc.rs b/services/identity/src/pake_grpc.rs new file mode 100644 --- /dev/null +++ b/services/identity/src/pake_grpc.rs @@ -0,0 +1,104 @@ +use comm_opaque::Cipher; +use opaque_ke::CredentialFinalization; +use opaque_ke::CredentialRequest; +use opaque_ke::RegistrationRequest; +use opaque_ke::RegistrationUpload; +use opaque_ke::ServerLogin; +use opaque_ke::ServerLoginFinishResult; +use opaque_ke::ServerLoginStartParameters; +use opaque_ke::ServerLoginStartResult; +use opaque_ke::ServerRegistration; +use opaque_ke::ServerRegistrationStartResult; +use rand::rngs::OsRng; +use tonic::Status; +use tracing::error; + +use crate::config::CONFIG; + +/// This file is meant to expose the opaque_ke actions, but +/// returning tonic::Status as the error type to reduce boilerplate +/// around describing PAKE failures to grpc. + +pub fn server_registration_start( + pake_registration_request: &Vec, +) -> Result, Status> { + let registration_bytes = RegistrationRequest::deserialize( + &pake_registration_request[..], + ) + .map_err(|e| { + error!("Unsuccessfully deserialized registration bytes: {}", e); + Status::invalid_argument("Invalid Registration response") + })?; + ServerRegistration::::start( + &mut OsRng, + registration_bytes, + CONFIG.server_keypair.public(), + ) + .map_err(|e| { + error!("Unsuccessfully started PAKE server response: {}", e); + Status::aborted("server error") + }) +} + +pub fn server_registration_finish( + server_registration: ServerRegistration, + registration_upload_bytes: &Vec, +) -> Result, Status> { + let upload_payload = RegistrationUpload::deserialize( + registration_upload_bytes, + ) + .map_err(|e| { + error!("Failed to deserialize registration upload bytes: {}", e); + Status::invalid_argument("invalid registration") + })?; + server_registration.finish(upload_payload).map_err(|e| { + error!( + "Encountered a PAKE protocol error when finishing registration: {}", + e + ); + Status::aborted("server error") + }) +} + +pub fn server_login_start( + server_registration: ServerRegistration, + pake_credential_request: &[u8], +) -> Result, Status> { + let credential_request = + CredentialRequest::deserialize(pake_credential_request).map_err(|e| { + error!("Failed to deserialize credential request: {}", e); + Status::invalid_argument("invalid message") + })?; + ServerLogin::start( + &mut OsRng, + server_registration, + CONFIG.server_keypair.private(), + credential_request, + ServerLoginStartParameters::default(), + ) + .map_err(|e| { + error!( + "Encountered a PAKE protocol error when starting login: {}", + e + ); + Status::aborted("server error") + }) +} +pub fn server_login_finish( + server_login: ServerLogin, + pake_credential_finalization: &Vec, +) -> Result, Status> { + let finalization_payload = + CredentialFinalization::deserialize(&pake_credential_finalization[..]) + .map_err(|e| { + error!("Failed to deserialize credential finalization bytes: {}", e); + Status::invalid_argument("Could not deserialize login credentials") + })?; + server_login.finish(finalization_payload).map_err(|e| { + error!( + "Encountered a PAKE protocol error when finishing login: {}", + e + ); + Status::aborted("server error") + }) +} diff --git a/services/identity/src/service.rs b/services/identity/src/service.rs --- a/services/identity/src/service.rs +++ b/services/identity/src/service.rs @@ -4,12 +4,7 @@ use comm_opaque::Cipher; use constant_time_eq::constant_time_eq; use futures_core::Stream; -use opaque_ke::{ - CredentialFinalization, CredentialRequest, - RegistrationRequest as PakeRegistrationRequest, ServerLogin, - ServerLoginStartParameters, -}; -use opaque_ke::{RegistrationUpload, ServerRegistration}; +use opaque_ke::{ServerLogin, ServerRegistration}; use rand::rngs::OsRng; use rand::{CryptoRng, Rng}; use siwe::Message; @@ -20,10 +15,10 @@ use tonic::{Request, Response, Status}; use tracing::{error, info, instrument}; -use crate::config::CONFIG; use crate::constants::MPSC_CHANNEL_BUFFER_CAPACITY; use crate::database::{DatabaseClient, Error as DBError}; use crate::nonce::generate_nonce_data; +use crate::pake_grpc; use crate::token::{AccessTokenData, AuthType}; pub use proto::identity_service_server::IdentityServiceServer; @@ -451,37 +446,21 @@ } Err(e) => return Err(handle_db_error(e)), }; - let credential_request = - CredentialRequest::deserialize(pake_credential_request).map_err(|e| { - error!("Failed to deserialize credential request: {}", e); - Status::invalid_argument("invalid message") - })?; - match ServerLogin::start( - &mut OsRng, + let server_login_start_result = pake_grpc::server_login_start( server_registration, - CONFIG.server_keypair.private(), - credential_request, - ServerLoginStartParameters::default(), - ) { - Ok(server_login_start_result) => Ok(LoginResponseAndPakeState { - response: PakeLoginResponseStruct { - data: Some(PakeCredentialResponse( - server_login_start_result.message.serialize().map_err(|e| { - error!("Failed to serialize PAKE message: {}", e); - Status::failed_precondition("internal error") - })?, - )), - }, - pake_state: server_login_start_result.state, - }), - Err(e) => { - error!( - "Encountered a PAKE protocol error when starting login: {}", - e - ); - Err(Status::aborted("server error")) - } - } + pake_credential_request, + )?; + let credential_response = + server_login_start_result.message.serialize().map_err(|e| { + error!("Failed to serialize PAKE message: {}", e); + Status::failed_precondition("internal error") + })?; + Ok(LoginResponseAndPakeState { + response: PakeLoginResponseStruct { + data: Some(PakeCredentialResponse(credential_response)), + }, + pake_state: server_login_start_result.state, + }) } async fn pake_login_finish( @@ -489,7 +468,7 @@ signing_public_key: &str, client: &DatabaseClient, server_login: ServerLogin, - pake_credential_finalization: &[u8], + pake_credential_finalization: &Vec, rng: &mut (impl Rng + CryptoRng), pake_workflow: PakeWorkflow, session_initialization_info: &HashMap, @@ -501,21 +480,8 @@ ); return Err(Status::aborted("user not found")); } - server_login - .finish( - CredentialFinalization::deserialize(pake_credential_finalization) - .map_err(|e| { - error!("Failed to deserialize credential finalization bytes: {}", e); - Status::aborted("login failed") - })?, - ) - .map_err(|e| { - error!( - "Encountered a PAKE protocol error when finishing login: {}", - e - ); - Status::aborted("server error") - })?; + + pake_grpc::server_login_finish(server_login, pake_credential_finalization)?; if matches!(pake_workflow, PakeWorkflow::Login) { client .update_users_table( @@ -542,45 +508,26 @@ }) } -async fn pake_registration_start( - rng: &mut (impl Rng + CryptoRng), - registration_request_bytes: &[u8], +async fn server_register_response( + registration_request_bytes: &Vec, ) -> Result { - match ServerRegistration::::start( - rng, - PakeRegistrationRequest::deserialize(registration_request_bytes).map_err( - |e| { - error!("Failed to deserialize registration request bytes: {}", e); - Status::aborted("registration failed") - }, - )?, - CONFIG.server_keypair.public(), - ) { - Ok(server_registration_start_result) => { - Ok(RegistrationResponseAndPakeState { - response: RegistrationResponse { - data: Some(PakeRegistrationResponse( - server_registration_start_result.message.serialize(), - )), - }, - pake_state: server_registration_start_result.state, - }) - } - Err(e) => { - error!( - "Encountered a PAKE protocol error when starting registration: {}", - e - ); - Err(Status::aborted("server error")) - } - } + let server_registration_start_result = + pake_grpc::server_registration_start(registration_request_bytes)?; + Ok(RegistrationResponseAndPakeState { + response: RegistrationResponse { + data: Some(PakeRegistrationResponse( + server_registration_start_result.message.serialize(), + )), + }, + pake_state: server_registration_start_result.state, + }) } async fn pake_registration_finish( user_id: &str, client: &DatabaseClient, - registration_upload_bytes: &[u8], - server_registration: Option>, + registration_upload_bytes: &Vec, + server_registration: ServerRegistration, username: &str, signing_public_key: &str, session_initialization_info: &HashMap, @@ -589,23 +536,11 @@ error!("Incomplete data: user ID not provided"); return Err(Status::aborted("user not found")); } - let server_registration_finish_result = server_registration - .ok_or_else(|| Status::aborted("registration failed"))? - .finish( - RegistrationUpload::deserialize(registration_upload_bytes).map_err( - |e| { - error!("Failed to deserialize registration upload bytes: {}", e); - Status::aborted("registration failed") - }, - )?, - ) - .map_err(|e| { - error!( - "Encountered a PAKE protocol error when finishing registration: {}", - e - ); - Status::aborted("server error") - })?; + let server_registration_finish_result = + pake_grpc::server_registration_finish( + server_registration, + registration_upload_bytes, + )?; match client .add_user_to_users_table( diff --git a/services/identity/src/service/registration.rs b/services/identity/src/service/registration.rs --- a/services/identity/src/service/registration.rs +++ b/services/identity/src/service/registration.rs @@ -37,8 +37,7 @@ Err(e) => return Err(handle_db_error(e)), _ => {} }; - let response_and_state = pake_registration_start( - &mut OsRng, + let response_and_state = server_register_response( &pake_registration_request_and_user_id.pake_registration_request, ) .await?; @@ -81,7 +80,7 @@ client, &pake_registration_upload_and_credential_request .pake_registration_upload, - Some(pake_state), + pake_state, ®istration_state.username, ®istration_state.signing_public_key, ®istration_state.session_initialization_info,