crypto: Authenticated backup

Cargo.toml

@@ -36,8 +36,8 @@ futures-executor = "0.3.21"
 futures-util = { version = "0.3.26", default-features = false, features = ["alloc"] }
 http = "0.2.6"
 itertools = "0.11.0"
-ruma = { version = "0.9.0", features = ["client-api-c", "compat-upload-signatures", "compat-user-id", "compat-arbitrary-length-ids"] }
-ruma-common = "0.12.0"
+ruma = { git = "https://github.com/uhoreg/ruma", rev = "a1034ef3774d8d1d7486c5ef57df87cac297ceda", features = ["client-api-c", "compat-upload-signatures", "compat-user-id"] }
+ruma-common = { git = "https://github.com/uhoreg/ruma", rev = "a1034ef3774d8d1d7486c5ef57df87cac297ceda" }
 once_cell = "1.16.0"
 serde = "1.0.151"
 serde_html_form = "0.2.0"

bindings/matrix-sdk-crypto-ffi/src/backup_recovery_key.rs

@@ -22,6 +22,9 @@ pub struct BackupRecoveryKey {
 #[derive(Debug, Error, uniffi::Error)]
 #[uniffi(flat_error)]
 pub enum PkDecryptionError {
+    /// Invalid format
+    #[error("Invalid format")]
+    Format(),
     /// An internal libolm error happened during decryption.
     #[error("Error decryption a PkMessage {0}")]
     Olm(#[from] DecryptionError),
@@ -161,10 +164,16 @@ impl BackupRecoveryKey {
     pub fn decrypt_v1(
         &self,
         ephemeral_key: String,
-        mac: String,
+        macv1: Option<String>,
+        macv2: Option<String>,
         ciphertext: String,
     ) -> Result<String, PkDecryptionError> {
-        self.inner.decrypt_v1(&ephemeral_key, &mac, &ciphertext).map_err(|e| e.into())
+        let mac = match (macv1, macv2) {
+            (_, Some(macv2)) => Ok(Mac::V2(&macv2)),
+            (Some(macv1), _) => Ok(Mac::V1(&macv1)),
+            (None, None) => Err(PkDecryptionError::Format),
+        }?;
+        self.inner.decrypt_v1(&ephemeral_key, mac, &ciphertext).map_err(|e| e.into())
     }
 }
 
@@ -208,7 +217,7 @@ mod tests {
         let mac = key_backup_data.session_data.mac.encode();
 
         let _ = recovery_key
-            .decrypt_v1(ephemeral, mac, ciphertext)
+            .decrypt_v1(ephemeral, Some(mac), None, ciphertext)
             .expect("The backed up key should be decrypted successfully");
     }
 }

crates/matrix-sdk-crypto/src/backups/keys/backup.rs

@@ -17,6 +17,9 @@ use std::{
     sync::{Arc, Mutex},
 };
 
+use hmac::{Hmac, Mac as MacT};
+use sha2::Sha256;
+
 use ruma::{
     api::client::backup::{EncryptedSessionDataInit, KeyBackupData, KeyBackupDataInit},
     serde::Base64,
@@ -28,9 +31,14 @@ use zeroize::Zeroizing;
 use super::{compat::PkEncryption, decryption::DecodeError};
 use crate::olm::InboundGroupSession;
 
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type HmacSha256Key = Zeroizing<[u8; 32]>;
+
 #[derive(Debug)]
 struct InnerBackupKey {
     key: Curve25519PublicKey,
+    mac_key: Option<HmacSha256Key>,
     signatures: BTreeMap<OwnedUserId, BTreeMap<OwnedDeviceKeyId, String>>,
     version: Mutex<Option<String>>,
 }
@@ -52,10 +60,11 @@ impl std::fmt::Debug for MegolmV1BackupKey {
 }
 
 impl MegolmV1BackupKey {
-    pub(super) fn new(key: Curve25519PublicKey, version: Option<String>) -> Self {
+    pub(super) fn new(key: Curve25519PublicKey, mac_key: Option<HmacSha256Key>, version: Option<String>) -> Self {
         Self {
             inner: InnerBackupKey {
                 key,
+                mac_key,
                 signatures: Default::default(),
                 version: Mutex::new(version),
             }
@@ -78,7 +87,7 @@ impl MegolmV1BackupKey {
         let key = Curve25519PublicKey::from_base64(public_key)?;
 
         let inner =
-            InnerBackupKey { key, signatures: Default::default(), version: Mutex::new(None) };
+            InnerBackupKey { key, mac_key: None, signatures: Default::default(), version: Mutex::new(None) };
 
         Ok(MegolmV1BackupKey { inner: inner.into() })
     }
@@ -93,6 +102,11 @@ impl MegolmV1BackupKey {
         self.inner.version.lock().unwrap().clone()
     }
 
+    /// Get the MAC key that is used with the backup key
+    pub fn mac_key(&self) -> &Option<HmacSha256Key> {
+        &self.inner.mac_key
+    }
+
     /// Set the backup version that this `MegolmV1BackupKey` will be used with.
     ///
     /// The key won't be able to encrypt room keys unless a version has been
@@ -118,11 +132,21 @@ impl MegolmV1BackupKey {
             Zeroizing::new(serde_json::to_vec(&key).expect("Can't serialize exported room key"));
 
         let message = pk.encrypt(&key);
+        let mac2 = if let Some(mac_key) = self.mac_key() {
+            let mut hmac = HmacSha256::new_from_slice(mac_key.as_ref())
+                .expect("We should be able to create a Hmac object from a 32 byte key");
+            hmac.update(&message.ciphertext);
+            let mac: Base64 = Base64::new(hmac.finalize().into_bytes().to_vec());
+            Some(mac)
+        } else {
+            None
+        };
 
         let session_data = EncryptedSessionDataInit {
             ephemeral: Base64::new(message.ephemeral_key.to_vec()),
             ciphertext: Base64::new(message.ciphertext),
-            mac: Base64::new(message.mac),
+            mac: Some(Base64::new(message.mac.unwrap())),
+            mac2,
         }
         .into();
 
@@ -139,3 +163,38 @@ impl MegolmV1BackupKey {
         .into()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use matrix_sdk_test::async_test;
+    use ruma::{device_id, room_id, user_id};
+    use crate::{
+        backups::keys::decryption::Mac,
+        store::BackupDecryptionKey,
+        EncryptionSettings,
+        OlmMachine,
+    };
+
+    #[async_test]
+    async fn create_mac2() -> Result<(), ()> {
+        let decryption_key = BackupDecryptionKey::new().expect("Can't create new recovery key");
+
+        let backup_key = decryption_key.megolm_v1_public_key();
+
+        let olm_machine = OlmMachine::new(user_id!("@alice:localhost"), device_id!("ABCDEFG")).await;
+        let settings = EncryptionSettings::default();
+        let (_, inbound) = olm_machine.account().create_group_session_pair(room_id!("!room_id:localhost"), settings)
+            .await
+            .expect("Could not create group session");
+        let key_backup_data = backup_key.encrypt(inbound).await;
+        let ephemeral = key_backup_data.session_data.ephemeral.encode();
+        let ciphertext = key_backup_data.session_data.ciphertext.encode();
+        let mac2 = key_backup_data.session_data.mac2.unwrap().encode();
+
+        let _ = decryption_key
+            .decrypt_v1(&ephemeral, Mac::V2(&mac2), &ciphertext)
+            .expect("The backed up key should be decrypted successfully");
+
+        Ok(())
+    }
+}

crates/matrix-sdk-crypto/src/backups/keys/compat.rs

@@ -109,8 +109,10 @@ impl PkDecryption {
         let cipher = Aes256CbcDec::new(keys.aes_key(), keys.iv());
         let decrypted = cipher.decrypt_padded_vec_mut::<Pkcs7>(&message.ciphertext)?;
 
-        let hmac = keys.hmac();
-        hmac.verify_truncated_left(&message.mac)?;
+        if let Some(mac) = message.mac.as_ref() {
+            let hmac = keys.hmac();
+            hmac.verify_truncated_left(mac)?;
+        }
 
         Ok(decrypted)
     }
@@ -162,7 +164,7 @@ impl PkEncryption {
         let mut mac = hmac.finalize().into_bytes().to_vec();
         mac.truncate(MAC_LENGTH);
 
-        Message { ciphertext, mac, ephemeral_key: Curve25519PublicKey::from(&ephemeral_key) }
+        Message { ciphertext, mac: Some(mac), ephemeral_key: Curve25519PublicKey::from(&ephemeral_key) }
     }
 }
 
@@ -177,19 +179,19 @@ pub enum MessageDecodeError {
 #[derive(Debug)]
 pub struct Message {
     pub ciphertext: Vec<u8>,
-    pub mac: Vec<u8>,
+    pub mac: Option<Vec<u8>>,
     pub ephemeral_key: Curve25519PublicKey,
 }
 
 impl Message {
     pub fn from_base64(
         ciphertext: &str,
-        mac: &str,
+        mac: Option<&str>,
         ephemeral_key: &str,
     ) -> Result<Self, MessageDecodeError> {
         Ok(Self {
             ciphertext: base64_decode(ciphertext)?,
-            mac: base64_decode(mac)?,
+            mac: mac.map(|m| base64_decode(m)).transpose()?,
             ephemeral_key: Curve25519PublicKey::from_base64(ephemeral_key)?,
         })
     }
@@ -220,15 +222,15 @@ mod tests {
         type Error = MessageDecodeError;
 
         fn try_from(value: PkMessage) -> Result<Self, Self::Error> {
-            Self::from_base64(&value.ciphertext, &value.mac, &value.ephemeral_key)
+            Self::from_base64(&value.ciphertext, Some(&value.mac), &value.ephemeral_key)
         }
     }
 
     impl From<Message> for PkMessage {
         fn from(val: Message) -> Self {
             PkMessage {
                 ciphertext: base64_encode(val.ciphertext),
-                mac: base64_encode(val.mac),
+                mac: base64_encode(val.mac.unwrap()),
                 ephemeral_key: val.ephemeral_key.to_base64(),
             }
         }