feat(android): container crypto unit plus a known-answer test vector
PBKDF2 is implemented in Pascal rather than through javax.crypto SecretKeyFactory: PBEKeySpec takes a char[] and the provider decides how those chars become bytes, so a non-ASCII sync password would derive a different key than the browser and fail as 'wrong password'. AES-GCM does go through JNI - one call, hardware-backed, and WebCrypto's tag-appended layout is exactly what Cipher expects. The vector is generated with WebCrypto itself and uses a non-ASCII password on purpose; an ASCII-only vector would have hidden that bug. It records the derived key separately from the plaintext so a failure points at one stage instead of the whole chain.
This commit is contained in:
r-zakarya
@@ -0,0 +1,271 @@
|
||||
unit PMA.Crypto;
|
||||
{
|
||||
Opens a pm-encrypted-export-v1 container (the vault snapshot) on Android.
|
||||
|
||||
Format, produced by js/app.import.js encryptExportPayload():
|
||||
kdf 'pbkdf2-sha256'
|
||||
kdf_iterations 600000
|
||||
kdf_salt base64, 32 bytes
|
||||
iv base64, 12 bytes
|
||||
ciphertext base64, AES-GCM output = ciphertext || 16-byte tag
|
||||
(payload) UTF-8 JSON
|
||||
|
||||
TWO DIFFERENT ROUTES, on purpose:
|
||||
|
||||
- AES-GCM goes through JNI to javax.crypto. One call, no loop, and the
|
||||
platform implementation is hardware-accelerated. Java's Cipher expects the
|
||||
tag appended to the ciphertext, which is exactly what WebCrypto produces —
|
||||
the buffers are byte-identical, nothing to reshape.
|
||||
|
||||
- PBKDF2 is implemented HERE rather than via SecretKeyFactory, because
|
||||
javax.crypto.spec.PBEKeySpec takes a char[] and the provider decides how
|
||||
those chars become bytes: UTF-8 on some, low-byte on others. For a
|
||||
non-ASCII sync password the derived key would differ from the browser's,
|
||||
and the failure is silent — "wrong password" on a correct password. Doing
|
||||
it here fixes the encoding at UTF-8 and makes the match exact by
|
||||
construction. The cost is 600k HMAC-SHA256 rounds in Pascal; measure it on
|
||||
a real device (see DeriveKeyPBKDF2's note) before considering the JNI
|
||||
route again.
|
||||
}
|
||||
|
||||
interface
|
||||
|
||||
uses
|
||||
System.SysUtils, System.Classes, System.JSON, System.NetEncoding, System.Hash;
|
||||
|
||||
type
|
||||
EPMACrypto = class(Exception);
|
||||
|
||||
/// Derive a key the same way WebCrypto's deriveExportKey does: PBKDF2-SHA256
|
||||
/// over the UTF-8 bytes of the password. AKeyLenBytes = 32 for AES-256.
|
||||
function DeriveKeyPBKDF2(const APassword: string; const ASalt: TBytes;
|
||||
AIterations, AKeyLenBytes: Integer): TBytes;
|
||||
|
||||
/// AES-256-GCM decrypt. ACipherText carries the 16-byte tag at the end, as
|
||||
/// produced by WebCrypto. Raises EPMACrypto when the tag does not verify —
|
||||
/// which is what a wrong password looks like.
|
||||
function AesGcmDecrypt(const AKey, AIv, ACipherText: TBytes): TBytes;
|
||||
|
||||
/// Full container → plaintext JSON payload. Validates the format marker so a
|
||||
/// truncated download or an HTML error page fails with a clear message rather
|
||||
/// than as "wrong password".
|
||||
function DecryptContainer(const AContainerJson, APassword: string): string;
|
||||
|
||||
implementation
|
||||
|
||||
{$IF DEFINED(ANDROID)}
|
||||
uses
|
||||
Androidapi.JNIBridge, Androidapi.JNI.JavaTypes, Androidapi.Helpers;
|
||||
{$ENDIF}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// PBKDF2-SHA256
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function XorBytes(const A, B: TBytes): TBytes;
|
||||
var
|
||||
I: Integer;
|
||||
begin
|
||||
SetLength(Result, Length(A));
|
||||
for I := 0 to High(A) do
|
||||
Result[I] := A[I] xor B[I];
|
||||
end;
|
||||
|
||||
function DeriveKeyPBKDF2(const APassword: string; const ASalt: TBytes;
|
||||
AIterations, AKeyLenBytes: Integer): TBytes;
|
||||
// Straight RFC 2898. One block is enough for a 32-byte key with SHA-256
|
||||
// (hLen = 32), so there is no block loop to get wrong.
|
||||
//
|
||||
// PERFORMANCE: 600k HMAC rounds. Budget a few seconds on a mid-range phone and
|
||||
// run it OFF the UI thread. If it proves unacceptable, the answer is to cache
|
||||
// the derived key in the Android Keystore behind biometrics — NOT to lower the
|
||||
// iteration count, which is shared with the desktop and defines the format.
|
||||
var
|
||||
LPwd, LBlock, LU, LT: TBytes;
|
||||
I: Integer;
|
||||
begin
|
||||
if AKeyLenBytes > 32 then
|
||||
raise EPMACrypto.Create('KeyLen > one SHA-256 block is not implemented');
|
||||
|
||||
LPwd := TEncoding.UTF8.GetBytes(APassword);
|
||||
|
||||
// U1 = HMAC(pwd, salt || INT32BE(1))
|
||||
SetLength(LBlock, Length(ASalt) + 4);
|
||||
if Length(ASalt) > 0 then
|
||||
Move(ASalt[0], LBlock[0], Length(ASalt));
|
||||
LBlock[Length(ASalt)] := 0;
|
||||
LBlock[Length(ASalt) + 1] := 0;
|
||||
LBlock[Length(ASalt) + 2] := 0;
|
||||
LBlock[Length(ASalt) + 3] := 1;
|
||||
|
||||
LU := THashSHA2.GetHMACAsBytes(LBlock, LPwd, THashSHA2.TSHA2Version.SHA256);
|
||||
LT := Copy(LU, 0, Length(LU));
|
||||
for I := 2 to AIterations do
|
||||
begin
|
||||
LU := THashSHA2.GetHMACAsBytes(LU, LPwd, THashSHA2.TSHA2Version.SHA256);
|
||||
LT := XorBytes(LT, LU);
|
||||
end;
|
||||
|
||||
Result := Copy(LT, 0, AKeyLenBytes);
|
||||
end;
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// AES-GCM through javax.crypto
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
{$IF DEFINED(ANDROID)}
|
||||
type
|
||||
// Minimal JNI imports. Delphi ships no headers for javax.crypto, and the
|
||||
// bridge builds its method signatures from these declarations — hence the
|
||||
// real Java types (Key, AlgorithmParameterSpec) rather than JObject, which
|
||||
// would generate a signature no method matches.
|
||||
JKey = interface;
|
||||
JAlgorithmParameterSpec = interface;
|
||||
JSecretKeySpec = interface;
|
||||
JGCMParameterSpec = interface;
|
||||
JCipher = interface;
|
||||
|
||||
JKeyClass = interface(IJavaClass)
|
||||
['{6E0F5B9A-1C2D-4E3F-8A7B-9C0D1E2F3A4B}']
|
||||
end;
|
||||
[JavaSignature('java/security/Key')]
|
||||
JKey = interface(IJavaInstance)
|
||||
['{7F1A6CAB-2D3E-4F50-9B8C-AD1E2F3A4B5C}']
|
||||
end;
|
||||
TJKey = class(TJavaGenericImport<JKeyClass, JKey>) end;
|
||||
|
||||
JAlgorithmParameterSpecClass = interface(IJavaClass)
|
||||
['{8A2B7DBC-3E4F-5061-AC9D-BE2F3A4B5C6D}']
|
||||
end;
|
||||
[JavaSignature('java/security/spec/AlgorithmParameterSpec')]
|
||||
JAlgorithmParameterSpec = interface(IJavaInstance)
|
||||
['{9B3C8ECD-4F50-6172-BDAE-CF3A4B5C6D7E}']
|
||||
end;
|
||||
TJAlgorithmParameterSpec = class(TJavaGenericImport<JAlgorithmParameterSpecClass, JAlgorithmParameterSpec>) end;
|
||||
|
||||
JSecretKeySpecClass = interface(JKeyClass)
|
||||
['{AC4D9FDE-5061-7283-CEBF-DA4B5C6D7E8F}']
|
||||
function init(key: TJavaArray<Byte>; algorithm: JString): JSecretKeySpec; cdecl;
|
||||
end;
|
||||
[JavaSignature('javax/crypto/spec/SecretKeySpec')]
|
||||
JSecretKeySpec = interface(JKey)
|
||||
['{BD5EA0EF-6172-8394-DFCA-EB5C6D7E8F90}']
|
||||
end;
|
||||
TJSecretKeySpec = class(TJavaGenericImport<JSecretKeySpecClass, JSecretKeySpec>) end;
|
||||
|
||||
JGCMParameterSpecClass = interface(JAlgorithmParameterSpecClass)
|
||||
['{CE6FB1F0-7283-94A5-E0DB-FC6D7E8F9001}']
|
||||
function init(tLen: Integer; src: TJavaArray<Byte>): JGCMParameterSpec; cdecl;
|
||||
end;
|
||||
[JavaSignature('javax/crypto/spec/GCMParameterSpec')]
|
||||
JGCMParameterSpec = interface(JAlgorithmParameterSpec)
|
||||
['{DF70C201-8394-A5B6-F1EC-0D7E8F900112}']
|
||||
end;
|
||||
TJGCMParameterSpec = class(TJavaGenericImport<JGCMParameterSpecClass, JGCMParameterSpec>) end;
|
||||
|
||||
JCipherClass = interface(JObjectClass)
|
||||
['{E081D312-94A5-B6C7-02FD-1E8F90011223}']
|
||||
function _GetDECRYPT_MODE: Integer; cdecl;
|
||||
function getInstance(transformation: JString): JCipher; cdecl;
|
||||
property DECRYPT_MODE: Integer read _GetDECRYPT_MODE;
|
||||
end;
|
||||
[JavaSignature('javax/crypto/Cipher')]
|
||||
JCipher = interface(JObject)
|
||||
['{F192E423-A5B6-C7D8-130E-2F9001122334}']
|
||||
procedure init(opmode: Integer; key: JKey; params: JAlgorithmParameterSpec); cdecl;
|
||||
function doFinal(input: TJavaArray<Byte>): TJavaArray<Byte>; cdecl;
|
||||
end;
|
||||
TJCipher = class(TJavaGenericImport<JCipherClass, JCipher>) end;
|
||||
|
||||
function ToJavaBytes(const B: TBytes): TJavaArray<Byte>;
|
||||
var
|
||||
I: Integer;
|
||||
begin
|
||||
Result := TJavaArray<Byte>.Create(Length(B));
|
||||
for I := 0 to High(B) do
|
||||
Result.Items[I] := B[I];
|
||||
end;
|
||||
|
||||
function FromJavaBytes(const A: TJavaArray<Byte>): TBytes;
|
||||
var
|
||||
I: Integer;
|
||||
begin
|
||||
SetLength(Result, A.Length);
|
||||
for I := 0 to A.Length - 1 do
|
||||
Result[I] := A.Items[I];
|
||||
end;
|
||||
{$ENDIF}
|
||||
|
||||
function AesGcmDecrypt(const AKey, AIv, ACipherText: TBytes): TBytes;
|
||||
{$IF DEFINED(ANDROID)}
|
||||
var
|
||||
LCipher: JCipher;
|
||||
LKeySpec: JSecretKeySpec;
|
||||
LGcm: JGCMParameterSpec;
|
||||
begin
|
||||
try
|
||||
LKeySpec := TJSecretKeySpec.JavaClass.init(ToJavaBytes(AKey),
|
||||
StringToJString('AES'));
|
||||
// 128 = tag length in BITS. WebCrypto's default is the same 16 bytes; a
|
||||
// mismatch here fails authentication on otherwise valid data.
|
||||
LGcm := TJGCMParameterSpec.JavaClass.init(128, ToJavaBytes(AIv));
|
||||
LCipher := TJCipher.JavaClass.getInstance(StringToJString('AES/GCM/NoPadding'));
|
||||
LCipher.init(TJCipher.JavaClass.DECRYPT_MODE, LKeySpec, LGcm);
|
||||
Result := FromJavaBytes(LCipher.doFinal(ToJavaBytes(ACipherText)));
|
||||
except
|
||||
// AEADBadTagException surfaces here: wrong password, or altered bytes.
|
||||
// Both are indistinguishable by design — that is what authentication means.
|
||||
on E: Exception do
|
||||
raise EPMACrypto.Create('Decryption failed — wrong password or corrupt file');
|
||||
end;
|
||||
end;
|
||||
{$ELSE}
|
||||
begin
|
||||
// Windows/macOS build of the same units: no platform AES-GCM available here.
|
||||
// The desktop app already has its own crypto; this unit targets Android.
|
||||
raise EPMACrypto.Create('AES-GCM is only wired for Android in this unit');
|
||||
end;
|
||||
{$ENDIF}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Container
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function DecryptContainer(const AContainerJson, APassword: string): string;
|
||||
var
|
||||
LObj: TJSONObject;
|
||||
LFormat, LKdf: string;
|
||||
LIterations: Integer;
|
||||
LSalt, LIv, LCt, LKey, LPlain: TBytes;
|
||||
begin
|
||||
LObj := TJSONObject.ParseJSONValue(AContainerJson) as TJSONObject;
|
||||
if LObj = nil then
|
||||
raise EPMACrypto.Create('Not a JSON container (truncated download?)');
|
||||
try
|
||||
// Checked before anything else: an HTML error page or a half-written file
|
||||
// would otherwise reach the cipher and be reported as a wrong password.
|
||||
LFormat := LObj.GetValue<string>('format', '');
|
||||
if LFormat <> 'pm-encrypted-export-v1' then
|
||||
raise EPMACrypto.CreateFmt('Unknown container format: "%s"', [LFormat]);
|
||||
|
||||
LKdf := LObj.GetValue<string>('kdf', '');
|
||||
if LKdf <> 'pbkdf2-sha256' then
|
||||
raise EPMACrypto.CreateFmt('Unsupported KDF: "%s"', [LKdf]);
|
||||
|
||||
LIterations := LObj.GetValue<Integer>('kdf_iterations', 600000);
|
||||
LSalt := TNetEncoding.Base64.DecodeStringToBytes(LObj.GetValue<string>('kdf_salt', ''));
|
||||
LIv := TNetEncoding.Base64.DecodeStringToBytes(LObj.GetValue<string>('iv', ''));
|
||||
LCt := TNetEncoding.Base64.DecodeStringToBytes(LObj.GetValue<string>('ciphertext', ''));
|
||||
|
||||
if (Length(LSalt) = 0) or (Length(LIv) = 0) or (Length(LCt) = 0) then
|
||||
raise EPMACrypto.Create('Container is missing salt, iv or ciphertext');
|
||||
|
||||
LKey := DeriveKeyPBKDF2(APassword, LSalt, LIterations, 32);
|
||||
LPlain := AesGcmDecrypt(LKey, LIv, LCt);
|
||||
Result := TEncoding.UTF8.GetString(LPlain);
|
||||
finally
|
||||
LObj.Free;
|
||||
end;
|
||||
end;
|
||||
|
||||
end.
|
||||
Reference in New Issue
Block a user