PeerTube/server/helpers/peertube-crypto.ts

208 lines
6.6 KiB
TypeScript
Raw Normal View History

2021-08-27 14:32:44 +02:00
import { compare, genSalt, hash } from 'bcrypt'
2022-10-10 11:12:23 +02:00
import { createCipheriv, createDecipheriv, createSign, createVerify } from 'crypto'
import { Request } from 'express'
2021-08-27 14:32:44 +02:00
import { cloneDeep } from 'lodash'
2021-12-17 13:58:07 +01:00
import { sha256 } from '@shared/extra-utils'
2022-10-10 11:12:23 +02:00
import { BCRYPT_SALT_SIZE, ENCRYPTION, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers/constants'
2021-08-27 14:32:44 +02:00
import { MActor } from '../types/models'
2022-10-10 11:12:23 +02:00
import { generateRSAKeyPairPromise, promisify1, promisify2, randomBytesPromise, scryptPromise } from './core-utils'
import { jsonld } from './custom-jsonld-signature'
2017-11-23 17:53:38 +01:00
import { logger } from './logger'
2021-08-27 14:32:44 +02:00
const bcryptComparePromise = promisify2<any, string, boolean>(compare)
const bcryptGenSaltPromise = promisify1<number, string>(genSalt)
const bcryptHashPromise = promisify2<any, string | number, string>(hash)
const httpSignature = require('@peertube/http-signature')
2022-07-12 10:54:21 +02:00
function createPrivateAndPublicKeys () {
2017-11-09 17:51:58 +01:00
logger.info('Generating a RSA key...')
2022-07-12 10:54:21 +02:00
return generateRSAKeyPairPromise(PRIVATE_RSA_KEY_SIZE)
}
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
// User password checks
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
function comparePassword (plainPassword: string, hashPassword: string) {
if (!plainPassword) return Promise.resolve(false)
return bcryptComparePromise(plainPassword, hashPassword)
}
async function cryptPassword (password: string) {
const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE)
return bcryptHashPromise(password, salt)
}
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
// HTTP Signature
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean {
if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) {
return buildDigest(rawBody.toString()) === req.headers['digest']
}
return true
}
2019-08-15 11:53:26 +02:00
function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): boolean {
return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true
}
function parseHTTPSignature (req: Request, clockSkew?: number) {
2022-05-06 15:11:54 +02:00
const requiredHeaders = req.method === 'POST'
? [ '(request-target)', 'host', 'digest' ]
: [ '(request-target)', 'host' ]
2022-05-06 15:11:54 +02:00
const parsed = httpSignature.parse(req, { clockSkew, headers: requiredHeaders })
const parsedHeaders = parsed.params.headers
if (!parsedHeaders.includes('date') && !parsedHeaders.includes('(created)')) {
throw new Error(`date or (created) must be included in signature`)
}
return parsed
}
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
// JSONLD
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
function isJsonLDSignatureVerified (fromActor: MActor, signedDocument: any): Promise<boolean> {
if (signedDocument.signature.type === 'RsaSignature2017') {
return isJsonLDRSA2017Verified(fromActor, signedDocument)
}
logger.warn('Unknown JSON LD signature %s.', signedDocument.signature.type, signedDocument)
return Promise.resolve(false)
2016-08-25 17:57:37 +02:00
}
// Backward compatibility with "other" implementations
2019-08-15 11:53:26 +02:00
async function isJsonLDRSA2017Verified (fromActor: MActor, signedDocument: any) {
const [ documentHash, optionsHash ] = await Promise.all([
createDocWithoutSignatureHash(signedDocument),
createSignatureHash(signedDocument.signature)
])
const toVerify = optionsHash + documentHash
const verify = createVerify('RSA-SHA256')
verify.update(toVerify, 'utf8')
return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64')
}
2021-03-08 14:24:11 +01:00
async function signJsonLDObject <T> (byActor: MActor, data: T) {
const signature = {
type: 'RsaSignature2017',
2017-12-18 11:53:04 +01:00
creator: byActor.url,
created: new Date().toISOString()
}
const [ documentHash, optionsHash ] = await Promise.all([
createDocWithoutSignatureHash(data),
createSignatureHash(signature)
])
const toSign = optionsHash + documentHash
const sign = createSign('RSA-SHA256')
sign.update(toSign, 'utf8')
const signatureValue = sign.sign(byActor.privateKey, 'base64')
Object.assign(signature, { signatureValue })
return Object.assign(data, { signature })
2017-11-09 17:51:58 +01:00
}
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
2020-04-23 09:32:53 +02:00
function buildDigest (body: any) {
const rawBody = typeof body === 'string' ? body : JSON.stringify(body)
return 'SHA-256=' + sha256(rawBody, 'base64')
}
2022-10-10 11:12:23 +02:00
// ---------------------------------------------------------------------------
// Encryption
// ---------------------------------------------------------------------------
async function encrypt (str: string, secret: string) {
const iv = await randomBytesPromise(ENCRYPTION.IV)
const key = await scryptPromise(secret, ENCRYPTION.SALT, 32)
const cipher = createCipheriv(ENCRYPTION.ALGORITHM, key, iv)
let encrypted = iv.toString(ENCRYPTION.ENCODING) + ':'
encrypted += cipher.update(str, 'utf8', ENCRYPTION.ENCODING)
encrypted += cipher.final(ENCRYPTION.ENCODING)
return encrypted
}
async function decrypt (encryptedArg: string, secret: string) {
const [ ivStr, encryptedStr ] = encryptedArg.split(':')
const iv = Buffer.from(ivStr, 'hex')
const key = await scryptPromise(secret, ENCRYPTION.SALT, 32)
const decipher = createDecipheriv(ENCRYPTION.ALGORITHM, key, iv)
return decipher.update(encryptedStr, ENCRYPTION.ENCODING, 'utf8') + decipher.final('utf8')
}
// ---------------------------------------------------------------------------
2016-02-05 18:03:20 +01:00
2017-05-15 22:22:03 +02:00
export {
isHTTPSignatureDigestValid,
parseHTTPSignature,
isHTTPSignatureVerified,
2020-04-23 09:32:53 +02:00
buildDigest,
isJsonLDSignatureVerified,
2017-05-15 22:22:03 +02:00
comparePassword,
2017-11-09 17:51:58 +01:00
createPrivateAndPublicKeys,
2017-05-15 22:22:03 +02:00
cryptPassword,
2022-10-10 11:12:23 +02:00
signJsonLDObject,
encrypt,
decrypt
}
// ---------------------------------------------------------------------------
2021-08-27 14:32:44 +02:00
function hashObject (obj: any): Promise<any> {
2022-09-09 11:46:58 +02:00
return jsonld.promises.normalize(obj, {
safe: false,
algorithm: 'URDNA2015',
format: 'application/n-quads'
}).then(res => sha256(res))
}
function createSignatureHash (signature: any) {
const signatureCopy = cloneDeep(signature)
Object.assign(signatureCopy, {
'@context': [
'https://w3id.org/security/v1',
{ RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' }
]
})
delete signatureCopy.type
delete signatureCopy.id
delete signatureCopy.signatureValue
2021-08-27 14:32:44 +02:00
return hashObject(signatureCopy)
}
function createDocWithoutSignatureHash (doc: any) {
const docWithoutSignature = cloneDeep(doc)
delete docWithoutSignature.signature
2021-08-27 14:32:44 +02:00
return hashObject(docWithoutSignature)
}