Change SID/MID feedback signature

.github/workflows/build.yml

@@ -118,6 +118,20 @@ jobs:
       with:
         name: ${{ matrix.target }}
         path: ${{ env.DEST }}
+  sanitizers:
+    name: Run unit tests with ASan+UBSan
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+    - name: Install dependencies
+      run: sudo apt update -qq && sudo apt install --no-install-recommends -y ninja-build libboost-test-dev ${UBUNTU_DEPS}
+    - name: Configure
+      run: cmake --preset sanitize
+    - name: Build
+      run: cmake --build --preset sanitize --target unittests
+    - name: Test
+      run: ctest --test-dir build/sanitize --output-on-failure
   windows:
     name: Build on Windows
     runs-on: ${{ matrix.image }}

CMakePresets.json

@@ -25,7 +25,7 @@
         "rhs": "Darwin"
       },
       "cacheVariables": {
-        "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64",
+        "CMAKE_OSX_ARCHITECTURES": "arm64",
         "CMAKE_OSX_DEPLOYMENT_TARGET": "14.0",
         "CMAKE_FIND_ROOT_PATH": "$env{DEST};/opt/homebrew",
         "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
@@ -124,10 +124,29 @@
         "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
         "VCPKG_TARGET_TRIPLET": "$env{PLATFORM}-windows-static-md"
       }
+    },
+    {
+      "name": "sanitize",
+      "displayName": "Sanitizers (ASan+UBSan)",
+      "description": "Debug build with AddressSanitizer and UndefinedBehaviorSanitizer for running the unit tests (system dependencies, no vcpkg; requires boost-test, openssl, libxml2, zlib and flatbuffers development packages)",
+      "generator": "Ninja",
+      "binaryDir": "${sourceDir}/build/${presetName}",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Debug",
+        "CMAKE_CXX_FLAGS": "-fsanitize=address,undefined -fno-omit-frame-pointer",
+        "CMAKE_EXE_LINKER_FLAGS": "-fsanitize=address,undefined",
+        "CMAKE_SHARED_LINKER_FLAGS": "-fsanitize=address,undefined",
+        "CMAKE_DISABLE_FIND_PACKAGE_SWIG": "YES",
+        "CMAKE_DISABLE_FIND_PACKAGE_Doxygen": "YES"
+      }
     }
   ],
   "buildPresets":
   [
+    {
+      "name": "sanitize",
+      "configurePreset": "sanitize"
+    },
     {
       "name": "macos",
       "configurePreset": "macos"

cdoc/CDoc1Reader.cpp

@@ -164,22 +164,21 @@ CDoc1Reader::getFMK(std::vector<uint8_t>& fmk, unsigned int lock_idx)
         // The downstream AES decrypt at the body level is what tells
         // success from failure.
     } else {
-        std::vector<uint8_t> key;
-        int result = crypto->deriveConcatKDF(key,
+        SecureTarget key;
+        int result = crypto->deriveConcatKDF(key.getTarget(),
             lock.getBytes(Lock::Params::KEY_MATERIAL),
             lock.getString(Lock::Params::CONCAT_DIGEST),
             lock.getBytes(Lock::Params::ALGORITHM_ID),
             lock.getBytes(Lock::Params::PARTY_UINFO),
             lock.getBytes(Lock::Params::PARTY_VINFO),
             lock_idx);
         if (result < 0) {
-            libcdoc::cleanse(key);
             setLastError(FAIL_MSG);
             LOG_ERROR("{}", last_error);
             return libcdoc::CRYPTO_ERROR;
         }
         fmk = libcdoc::Crypto::AESWrap(key, lock.encrypted_fmk, false);
-        libcdoc::cleanse(key);
+        key.cleanse();
         // AESWrap returns {} on failure. Pad the candidate to expected
         // length so the failure shape matches the RSA path; the bytes
         // are arbitrary because the body decrypt is going to reject

cdoc/CDoc2Reader.cpp

@@ -147,17 +147,15 @@
     // exceptions). All early returns below previously had to remember to
     // call libcdoc::cleanse(kek) - which several of them did not. With the
     // guard the wipe is unconditional.
-    std::vector<uint8_t> kek;
-    libcdoc::Cleanser kek_guard(kek);
+    SecureTarget kek;
 
     if (lock.type == Lock::Type::PASSWORD) {
         // Password
         LOG_DBG("password");
         std::string info_str = libcdoc::CDoc2::getSaltForExpand(lock.label);
         LOG_DBG("info: {}", toHex(info_str));
-        std::vector<uint8_t> kek_pm;
-        libcdoc::Cleanser kek_pm_guard(kek_pm);
-        if (auto rv = crypto->extractHKDF(kek_pm, lock.getBytes(Lock::SALT), lock.getBytes(Lock::PW_SALT), lock.getInt(Lock::KDF_ITER), lock_idx); rv != libcdoc::OK) {
+        SecureTarget kek_pm;
+        if (auto rv = crypto->extractHKDF(kek_pm.getTarget(), lock.getBytes(Lock::SALT), lock.getBytes(Lock::PW_SALT), lock.getInt(Lock::KDF_ITER), lock_idx); rv != libcdoc::OK) {
             setLastError(crypto->getLastErrorStr(rv));
             LOG_ERROR("{}", last_error);
             return rv;
@@ -170,9 +168,8 @@
         LOG_DBG("symmetric");
         std::string info_str = libcdoc::CDoc2::getSaltForExpand(lock.label);
         LOG_DBG("info: {}", toHex(info_str));
-        std::vector<uint8_t> kek_pm;
-        libcdoc::Cleanser kek_pm_guard(kek_pm);
-        if (auto rv = crypto->extractHKDF(kek_pm, lock.getBytes(Lock::SALT), {}, 0, lock_idx); rv != libcdoc::OK) {
+        SecureTarget kek_pm;
+        if (auto rv = crypto->extractHKDF(kek_pm.getTarget(), lock.getBytes(Lock::SALT), {}, 0, lock_idx); rv != libcdoc::OK) {
             setLastError(crypto->getLastErrorStr(rv));
             LOG_ERROR("{}", last_error);
             return rv;
@@ -182,11 +179,10 @@
         kek = libcdoc::Crypto::expand(kek_pm, info_str, 32);
     } else if ((lock.type == Lock::Type::PUBLIC_KEY) || (lock.type == Lock::Type::SERVER)) {
         // Public/private key
-        std::vector<uint8_t> key_material;
+        SecureTarget key_material;
         // SERVER path fetches key_material over the network; PUBLIC_KEY
         // takes it from the lock. Either way it gets fed into ECDH or RSA
         // and is sensitive enough to wipe in-scope.
-        libcdoc::Cleanser key_material_guard(key_material);
         if(lock.type == Lock::Type::SERVER) {
             if(!conf) {
                 setLastError("Configuration is missing");
@@ -206,7 +202,7 @@
                 return libcdoc::CONFIGURATION_ERROR;
             }
             std::string transaction_id = lock.getString(Lock::Params::TRANSACTION_ID);
-            int result = network->fetchKey(key_material, fetch_url, transaction_id);
+            int result = network->fetchKey(key_material.getTarget(), fetch_url, transaction_id);
             if (result < 0) {
                 setLastError(network->getLastErrorStr(result));
                 return result;
@@ -219,16 +215,15 @@
         LOG_TRACE_KEY("Key material: {}", key_material);
 
         if (lock.isRSA()) {
-            int result = crypto->decryptRSA(kek, key_material, true, lock_idx);
+            int result = crypto->decryptRSA(kek.getTarget(), key_material, true, lock_idx);
             if (result < 0) {
                 setLastError(crypto->getLastErrorStr(result));
                 LOG_ERROR("{}", last_error);
                 return result;
             }
         } else {
-            std::vector<uint8_t> kek_pm;
-            libcdoc::Cleanser kek_pm_guard(kek_pm);
-            int result = crypto->deriveHMACExtract(kek_pm, key_material, toUint8Vector(libcdoc::CDoc2::KEKPREMASTER), lock_idx);
+            SecureTarget kek_pm;
+            int result = crypto->deriveHMACExtract(kek_pm.getTarget(), key_material, toUint8Vector(libcdoc::CDoc2::KEKPREMASTER), lock_idx);
             if (result < 0) {
                 setLastError(crypto->getLastErrorStr(result));
                 LOG_ERROR("{}", last_error);
@@ -248,85 +243,156 @@
         /* SHARE_URLS */
         /* url,share_id;url,share_id... */
         std::string all = lock.getString(Lock::SHARE_URLS);
-        std::vector<std::string> strs = split(all, ';');
-        if (strs.empty()){
+        std::vector<std::string> servers = split(all, ';');
+        if (servers.empty()){
             setLastError("Lock does not contain server info");
             LOG_ERROR("{}", last_error);
             return libcdoc::DATA_FORMAT_ERROR;
         }
         std::vector<ShareData> shares;
-        for (auto& str : strs) {
-            std::vector<std::string> parts = split(str, ',');
+        for (auto& server : servers) {
+            std::vector<std::string> parts = split(server, ',');
             if (parts.size() != 2) {
                 setLastError("Invalid server info in lock");
                 LOG_ERROR("{}", last_error);
                 return libcdoc::DATA_FORMAT_ERROR;
             }
-            std::string url = parts[0];
-            std::string id = parts[1];
-            LOG_DBG("Share {} url {}", id, url);
+            LOG_DBG("Share {} url {}", parts[1], parts[0]);
+            shares.emplace_back(parts[0], parts[1]);
+        }
+
+        // Get authentication token
+        std::string auth_url = conf->getValue({}, Configuration::AUTH_SERVER);
+        if (auth_url.empty()) {
+            setLastError(FORMAT("No AUTH_SERVER found"));
+            LOG_ERROR("{}", last_error);
+            return libcdoc::CONFIGURATION_ERROR;
+        }
+        // auth_url = "https://cdoc2-auth.dev.riaint.ee";
+        // fixme:
+        std::string signer = conf->getValue(Configuration::SHARE_SIGNER);
+        LOG_DBG("Signer: {}", signer);
+        bool mid = false;
+        if (signer == Configuration::SHARE_SIGNER_SID) {
+            //
+        } else if (signer == Configuration::SHARE_SIGNER_MID) {
+            mid = true;
+        } else {
+            setLastError(t_("Unknown or missing signer type"));
+            LOG_ERROR("Unknown or missing signer type");
+            return libcdoc::CONFIGURATION_ERROR;
+        }
+        std::string phone;
+        if (mid) {
+            phone = conf->getValue({}, Configuration::PHONE_NUMBER);
+            if (phone.empty()) {
+                setLastError(t_("Missing phone number"));
+                LOG_ERROR("Missing phone number");
+                return libcdoc::CONFIGURATION_ERROR;
+            }
+        }
+
+        SessionData session;
+        if (auto rv = network->authenticateForShares(auth_url, rcpt_id, phone, session.token, session.cert); rv != OK) {
+            setLastError(network->getLastErrorStr(rv));
+            LOG_ERROR("{}", last_error);
+            return rv;
+        }
+
+        // S1: only contact share servers that the authentication server has
+        // authorized for this session. The session token carries one
+        // disclosure per authorized server; a container pointing to any other
+        // server would otherwise receive the session token and the user's
+        // credentials (SSRF / credential exfiltration). N-of-N reconstruction
+        // needs every share, so an unauthorized server rejects the container.
+        {
+            SessionToken stoken(session.token);
+            for (const auto& share : shares) {
+                if (!stoken.hasDisclosureForUrl(share.base_url)) {
+                    setLastError(FORMAT("Share server {} is not authorized by the authentication session", share.base_url));
+                    LOG_ERROR("{}", last_error);
+                    return libcdoc::DATA_FORMAT_ERROR;
+                }
+            }
+        }
+
+        // S8: validate the authentication session client-side - the session
+        // certificate must belong to the lock recipient and the session token
+        // must not be expired. Also learns the schemeName/rpName claims needed
+        // to verify the signed ticket later.
+        std::string scheme_name, rp_name, v_err;
+        if (auto rv = validateSessionData(crypto, rcpt_id, mid, session.token, session.cert, scheme_name, rp_name, v_err); rv != OK) {
+            setLastError(v_err);
+            LOG_ERROR("{}", last_error);
+            return rv;
+        }
 
+        // Get nonces
+        for (auto& share : shares) {
             std::vector<uint8_t> nonce;
-            result_t result = network->fetchNonce(nonce, url, id);
+            result_t result = network->fetchNonce(nonce, share.base_url, share.share_id, session.token, session.cert);
             if (result != libcdoc::OK) {
                 setLastError(network->getLastErrorStr(result));
-                LOG_ERROR("Cannot fetch nonce from server {}", url);
+                LOG_ERROR("Cannot fetch nonce {} from server {}", share.share_id, share.base_url);
                 return result;
             }
             LOG_DBG("Nonce: {}", std::string(nonce.cbegin(), nonce.cend()));
-            ShareData acc(url, id, std::string(nonce.cbegin(), nonce.cend()));
-            shares.push_back(std::move(acc));
+            share.nonce = std::string(nonce.cbegin(), nonce.cend());
         }
+
+        std::string rp_url = conf->getValue({}, Configuration::RP_SERVER);
+        if (rp_url.empty()) {
+            setLastError(FORMAT("No RP_SERVER found"));
+            LOG_ERROR("{}", last_error);
+            return libcdoc::CONFIGURATION_ERROR;
+        }
+        // rp_url = "https://cdoc2-rp.dev.riaint.ee/"
         /* Create tickets from shares */
-        std::vector<std::string> tickets;
-        std::vector<uint8_t> cert;
+        std::vector<std::string> auth_tokens;
+        AuthenticationData auth;
         result_t result = NOT_IMPLEMENTED;
-        std::string signer = conf->getValue(Configuration::SHARE_SIGNER);
-        LOG_DBG("Signer: {}", signer);
-        if (signer == "SMART_ID") {
-            // "https://sid.demo.sk.ee/smart-id-rp/v2"
-            std::string url = conf->getValue(Configuration::SID_DOMAIN, Configuration::BASE_URL);
-            // "00000000-0000-0000-0000-000000000000"
-            std::string relyingPartyUUID = conf->getValue(Configuration::SID_DOMAIN, Configuration::RP_UUID);
-            // "DEMO"
-            std::string relyingPartyName = conf->getValue(Configuration::SID_DOMAIN, Configuration::RP_NAME);
-            SIDSigner signer(url, relyingPartyUUID, relyingPartyName, rcpt_id, network);
-            result = signer.generateTickets(tickets, shares);
+
+        if (!mid) {
+            SIDSigner signer(rp_url, session, rcpt_id, network);
+            result = signer.generateTickets(auth_tokens, shares);
             if (result != OK) {
                 setLastError(signer.error);
             } else {
-                cert = std::move(signer.cert);
+                auth.cert = std::move(signer.cert);
+                auth.params = std::move(signer.params);
             }
-        } else if (signer == "MOBILE_ID") {
-            // "https://sid.demo.sk.ee/smart-id-rp/v2"
-            std::string url = conf->getValue(Configuration::MID_DOMAIN, Configuration::BASE_URL);
-            // "00000000-0000-0000-0000-000000000000"
-            std::string relyingPartyUUID = conf->getValue(Configuration::MID_DOMAIN, Configuration::RP_UUID);
-            // "DEMO"
-            std::string relyingPartyName = conf->getValue(Configuration::MID_DOMAIN, Configuration::RP_NAME);
-            // "37200000566"
-            std::string phone = conf->getValue(Configuration::MID_DOMAIN, Configuration::PHONE_NUMBER);
-            MIDSigner signer(url, relyingPartyUUID, relyingPartyName, phone, rcpt_id, network);
-            result = signer.generateTickets(tickets, shares);
+        } else {
+            MIDSigner signer(rp_url, phone, session, rcpt_id, network);
+            result = signer.generateTickets(auth_tokens, shares);
             if (result != OK) {
                 setLastError(signer.error);
             } else {
-                cert = std::move(signer.cert);
+                auth.cert = std::move(signer.cert);
+                auth.params = std::move(signer.params);
             }
-        } else {
-            setLastError(t_("Unknown or missing signer type"));
-            LOG_ERROR("Unknown or missing signer type");
-            return result;
         }
         if (result != libcdoc::OK) {
             LOG_ERROR("Cannot generate share tickets");
             return result;
         }
-        kek.resize(32);
-        std::fill(kek.begin(), kek.end(), 0);
-        for (unsigned int i = 0; i < tickets.size(); i++) {
+        // S8: verify the signed auth ticket client-side before spending it -
+        // the signing certificate must belong to rcpt_id and the ACSP_V2
+        // signature must verify (binds identity, the consent text shown to
+        // the user, and freshness). All tickets share the same signed JWT,
+        // so validating the first one covers them all.
+        if (!auth_tokens.empty() && !mid) {
+            std::vector params = fromBase64URL(auth.params[network->X_CDOC2_SID_RPV3_SIGNATURE_PARAMETERS]);
+            if (auto rv = validateAuthTicket(crypto, rcpt_id, auth_tokens[0], auth.cert, std::string(params.cbegin(), params.cend()), scheme_name, rp_name, v_err); rv != OK) {
+                setLastError(v_err);
+                LOG_ERROR("{}", last_error);
+                return rv;
+            }
+        }
+        std::vector<uint8_t>& kek_build = kek.getTarget(32);
+        std::fill(kek_build.begin(), kek_build.end(), 0);
+        for (unsigned int i = 0; i < auth_tokens.size(); i++) {
             NetworkBackend::ShareInfo share;
-            result = network->fetchShare(share, shares[i].base_url, shares[i].share_id, tickets[i], cert);
+            result = network->fetchShare(share, shares[i].base_url, shares[i].share_id, session.token, session.cert, auth_tokens[i], auth.cert, auth.params);
             if (result != libcdoc::OK) {
                 setLastError(network->getLastErrorStr(result));
                 LOG_ERROR("Cannot fetch share {}", i);
@@ -336,7 +402,7 @@
             // remaining shares it reconstructs the KEK. Wipe it after
             // XOR-ing it into kek so it does not linger on the heap.
             libcdoc::Cleanser share_guard(share.share);
-            if (auto err = libcdoc::Crypto::xor_data(kek, kek, share.share); err != libcdoc::OK) {
+            if (auto err = libcdoc::Crypto::xor_data(kek_build, kek_build, share.share); err != libcdoc::OK) {
                 setLastError("Failed to derive kek");
                 LOG_ERROR("Failed to derive kek");
                 return err;
@@ -365,8 +431,7 @@
         fmk.clear();
         return err;
     }
-    std::vector<uint8_t> hhk = libcdoc::Crypto::expand(fmk, libcdoc::CDoc2::HMAC);
-    libcdoc::Cleanser hhk_guard(hhk);
+    SecureTarget hhk = libcdoc::Crypto::expand(fmk, libcdoc::CDoc2::HMAC);
 
     LOG_TRACE_KEY("xor: {}", lock.encrypted_fmk);
     LOG_TRACE_KEY("fmk: {}", fmk);