PeerTube/server/helpers/peertube-crypto.ts

150 lines
4.4 KiB
TypeScript
Raw Normal View History

import { Request } from 'express'
import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers'
2017-12-14 17:38:41 +01:00
import { ActorModel } from '../models/activitypub/actor'
import { bcryptComparePromise, bcryptGenSaltPromise, bcryptHashPromise, createPrivateKey, getPublicKey, sha256 } from './core-utils'
import { jsig, jsonld } from './custom-jsonld-signature'
2017-11-23 17:53:38 +01:00
import { logger } from './logger'
import { cloneDeep } from 'lodash'
import { createVerify } from 'crypto'
import { buildDigest } from '../lib/job-queue/handlers/utils/activitypub-http-utils'
const httpSignature = require('http-signature')
2017-11-09 17:51:58 +01:00
async function createPrivateAndPublicKeys () {
logger.info('Generating a RSA key...')
2017-11-09 17:51:58 +01:00
const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE)
const { publicKey } = await getPublicKey(key)
2017-11-09 17:51:58 +01:00
return { privateKey: key, publicKey }
}
// User password checks
function comparePassword (plainPassword: string, hashPassword: string) {
return bcryptComparePromise(plainPassword, hashPassword)
}
async function cryptPassword (password: string) {
const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE)
return bcryptHashPromise(password, salt)
}
// HTTP Signature
function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean {
if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) {
return buildDigest(rawBody.toString()) === req.headers['digest']
}
return true
}
function isHTTPSignatureVerified (httpSignatureParsed: any, actor: ActorModel): boolean {
return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true
}
function parseHTTPSignature (req: Request, clockSkew?: number) {
return httpSignature.parse(req, { authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME, clockSkew })
}
// JSONLD
async function isJsonLDSignatureVerified (fromActor: ActorModel, signedDocument: any): Promise<boolean> {
if (signedDocument.signature.type === 'RsaSignature2017') {
// Mastodon algorithm
const res = await isJsonLDRSA2017Verified(fromActor, signedDocument)
// Success? If no, try with our library
if (res === true) return true
}
2017-11-09 17:51:58 +01:00
const publicKeyObject = {
'@context': jsig.SECURITY_CONTEXT_URL,
id: fromActor.url,
type: 'CryptographicKey',
2017-12-14 17:38:41 +01:00
owner: fromActor.url,
publicKeyPem: fromActor.publicKey
}
2017-11-09 17:51:58 +01:00
const publicKeyOwnerObject = {
'@context': jsig.SECURITY_CONTEXT_URL,
id: fromActor.url,
2017-11-09 17:51:58 +01:00
publicKey: [ publicKeyObject ]
}
2017-11-09 17:51:58 +01:00
const options = {
publicKey: publicKeyObject,
publicKeyOwner: publicKeyOwnerObject
}
return jsig.promises
.verify(signedDocument, options)
2018-10-19 12:42:13 +02:00
.then((result: { verified: boolean }) => result.verified)
.catch(err => {
logger.error('Cannot check signature.', { err })
return false
})
2016-08-25 17:57:37 +02:00
}
// Backward compatibility with "other" implementations
async function isJsonLDRSA2017Verified (fromActor: ActorModel, signedDocument: any) {
function hash (obj: any): Promise<any> {
return jsonld.promises
.normalize(obj, {
algorithm: 'URDNA2015',
format: 'application/n-quads'
})
.then(res => sha256(res))
}
const signatureCopy = cloneDeep(signedDocument.signature)
Object.assign(signatureCopy, {
'@context': [
'https://w3id.org/security/v1',
{ RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' }
]
})
delete signatureCopy.type
delete signatureCopy.id
delete signatureCopy.signatureValue
const docWithoutSignature = cloneDeep(signedDocument)
delete docWithoutSignature.signature
const [ documentHash, optionsHash ] = await Promise.all([
hash(docWithoutSignature),
hash(signatureCopy)
])
const toVerify = optionsHash + documentHash
const verify = createVerify('RSA-SHA256')
verify.update(toVerify, 'utf8')
return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64')
}
function signJsonLDObject (byActor: ActorModel, data: any) {
2017-11-09 17:51:58 +01:00
const options = {
2017-12-14 17:38:41 +01:00
privateKeyPem: byActor.privateKey,
2017-12-18 11:53:04 +01:00
creator: byActor.url,
algorithm: 'RsaSignature2017'
}
return jsig.promises.sign(data, options)
2017-11-09 17:51:58 +01:00
}
// ---------------------------------------------------------------------------
2016-02-05 18:03:20 +01:00
2017-05-15 22:22:03 +02:00
export {
isHTTPSignatureDigestValid,
parseHTTPSignature,
isHTTPSignatureVerified,
isJsonLDSignatureVerified,
2017-05-15 22:22:03 +02:00
comparePassword,
2017-11-09 17:51:58 +01:00
createPrivateAndPublicKeys,
2017-05-15 22:22:03 +02:00
cryptPassword,
signJsonLDObject
}