| 268 | } |
| 269 | |
| 270 | func (device *Device) CreateMessageInitiation(peer *Peer) (*MessageInitiation, error) { |
| 271 | device.staticIdentity.RLock() |
| 272 | defer device.staticIdentity.RUnlock() |
| 273 | |
| 274 | handshake := &peer.handshake |
| 275 | handshake.mutex.Lock() |
| 276 | defer handshake.mutex.Unlock() |
| 277 | |
| 278 | // create ephemeral key |
| 279 | var err error |
| 280 | handshake.hash = InitialHash |
| 281 | handshake.chainKey = InitialChainKey |
| 282 | handshake.localEphemeral, err = newPrivateKey() |
| 283 | if err != nil { |
| 284 | return nil, err |
| 285 | } |
| 286 | |
| 287 | handshake.mixHash(handshake.remoteStatic[:]) |
| 288 | |
| 289 | msg := MessageInitiation{ |
| 290 | Type: MessageInitiationType, |
| 291 | Ephemeral: handshake.localEphemeral.publicKey(), |
| 292 | } |
| 293 | |
| 294 | handshake.mixKey(msg.Ephemeral[:]) |
| 295 | handshake.mixHash(msg.Ephemeral[:]) |
| 296 | |
| 297 | // encrypt static key |
| 298 | ss, err := handshake.localEphemeral.sharedSecret(handshake.remoteStatic) |
| 299 | if err != nil { |
| 300 | return nil, err |
| 301 | } |
| 302 | var key [chacha20poly1305.KeySize]byte |
| 303 | KDF2( |
| 304 | &handshake.chainKey, |
| 305 | &key, |
| 306 | handshake.chainKey[:], |
| 307 | ss[:], |
| 308 | ) |
| 309 | aead, _ := chacha20poly1305.New(key[:]) |
| 310 | aead.Seal(msg.Static[:0], ZeroNonce[:], device.staticIdentity.publicKey[:], handshake.hash[:]) |
| 311 | handshake.mixHash(msg.Static[:]) |
| 312 | |
| 313 | // encrypt timestamp |
| 314 | if isZero(handshake.precomputedStaticStatic[:]) { |
| 315 | return nil, errInvalidPublicKey |
| 316 | } |
| 317 | KDF2( |
| 318 | &handshake.chainKey, |
| 319 | &key, |
| 320 | handshake.chainKey[:], |
| 321 | handshake.precomputedStaticStatic[:], |
| 322 | ) |
| 323 | timestamp := tai64n.Now() |
| 324 | aead, _ = chacha20poly1305.New(key[:]) |
| 325 | aead.Seal(msg.Timestamp[:0], ZeroNonce[:], timestamp[:], handshake.hash[:]) |
| 326 | |
| 327 | // assign index |