| 426 | } |
| 427 | |
| 428 | bool NTCP2Establisher::ProcessSessionCreatedMessage (uint16_t& paddingLen) |
| 429 | { |
| 430 | size_t offset = 0; |
| 431 | // decrypt Y |
| 432 | i2p::crypto::CBCDecryption decryption; |
| 433 | decryption.SetKey (m_RemoteIdentHash); |
| 434 | decryption.Decrypt (m_Buffer + offset, 32, m_IV, GetRemotePub ()); |
| 435 | offset = 32; |
| 436 | // decryption key for next block (m_K) |
| 437 | if (!KDF2Alice ()) |
| 438 | { |
| 439 | LogPrint (eLogWarning, "NTCP2: SessionCreated KDF failed"); |
| 440 | return false; |
| 441 | } |
| 442 | #if OPENSSL_PQ |
| 443 | if (m_CryptoType > i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD && m_PQKeys) |
| 444 | { |
| 445 | // decrypt kem_ciphertext frame |
| 446 | size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_CryptoType); |
| 447 | std::vector<uint8_t> kemCiphertext(cipherTextLen); |
| 448 | if (!Decrypt (m_Buffer + offset, kemCiphertext.data (), cipherTextLen)) |
| 449 | { |
| 450 | LogPrint (eLogWarning, "NTCP2: SessionCreated ML-KEM ciphertext section AEAD decryption failed"); |
| 451 | return false; |
| 452 | } |
| 453 | |
| 454 | MixHash (m_Buffer + offset, cipherTextLen + 16); |
| 455 | offset += cipherTextLen + 16; |
| 456 | // decaps |
| 457 | uint8_t sharedSecret[32]; |
| 458 | m_PQKeys->Decaps (kemCiphertext.data (), sharedSecret); |
| 459 | MixKey (sharedSecret); |
| 460 | } |
| 461 | #endif |
| 462 | // decrypt options and verify MAC |
| 463 | uint8_t options[16]; |
| 464 | if (Decrypt (m_Buffer + offset, options, 16)) |
| 465 | { |
| 466 | MixHash (m_Buffer + offset, 32); // encrypted options |
| 467 | // options |
| 468 | paddingLen = bufbe16toh(options + 2); |
| 469 | // actual padding is not known yet, apply MixHash later |
| 470 | // check timestamp |
| 471 | auto ts = i2p::util::GetSecondsSinceEpoch (); |
| 472 | uint32_t tsB = bufbe32toh (options + 8); |
| 473 | if (tsB < ts - NTCP2_CLOCK_SKEW || tsB > ts + NTCP2_CLOCK_SKEW) |
| 474 | { |
| 475 | LogPrint (eLogWarning, "NTCP2: SessionCreated time difference ", (int)(ts - tsB), " exceeds clock skew"); |
| 476 | return false; |
| 477 | } |
| 478 | offset += 32; |
| 479 | } |
| 480 | else |
| 481 | { |
| 482 | LogPrint (eLogWarning, "NTCP2: SessionCreated AEAD verification failed "); |
| 483 | return false; |
| 484 | } |
| 485 | m_BufferLen = offset; |
no test coverage detected