1 // Copyright 2020 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef SECURITY_CRYPTAUTH_LIB_SECUREGCM_D2D_CONNECTION_CONTEXT_V1_H_ 16 #define SECURITY_CRYPTAUTH_LIB_SECUREGCM_D2D_CONNECTION_CONTEXT_V1_H_ 17 18 #include <memory> 19 #include <string> 20 21 #include "securemessage/crypto_ops.h" 22 23 namespace securegcm { 24 25 // The full context of a secure connection. This class has methods to encode and 26 // decode messages that are to be sent to another device. 27 // 28 // This class should be kept compatible with the Java implementation in 29 // java/com/google/security/cryptauth/lib/securegcm/D2DConnectionContextV1.java 30 class D2DConnectionContextV1 { 31 public: 32 D2DConnectionContextV1(const securemessage::CryptoOps::SecretKey& encode_key, 33 const securemessage::CryptoOps::SecretKey& decode_key, 34 uint32_t encode_sequence_number, 35 uint32_t decode_sequence_number); 36 37 // Once the initiator and responder have negotiated a secret key, use this 38 // method to encrypt and sign |payload|. Both initiator and responder devices 39 // can use this message. 40 // 41 // On failure, nullptr is returned. 42 std::unique_ptr<string> EncodeMessageToPeer(const string& payload); 43 44 // Once the initiator and responder have negotiated a secret key, use this 45 // method to decrypt and verify a |message| received from the other device. 46 // Both initiator and responder devices can use this message. 47 // 48 // On failure, nullptr is returned. 49 std::unique_ptr<string> DecodeMessageFromPeer(const string& message); 50 51 // Returns a cryptographic digest (SHA256) of the session keys prepended by 52 // the SHA256 hash of the ASCII string "D2D". 53 // 54 // On failure, nullptr is returned. 55 std::unique_ptr<string> GetSessionUnique(); 56 57 // Creates a saved session that can be later used for resumption. Note, 58 // this must be stored in a secure location. 59 std::unique_ptr<string> SaveSession(); 60 61 // Parse a saved session info and attempt to construct a resumed context. 62 // 63 // The session info passed to this method should be one that was generated 64 // by |SaveSession|. 65 // 66 // On failure, nullptr is returned. 67 static std::unique_ptr<D2DConnectionContextV1> FromSavedSession( 68 const string& savedSessionInfo); 69 70 private: 71 // The key used to encode payloads. 72 const securemessage::CryptoOps::SecretKey encode_key_; 73 74 // The key used to decode received messages. 75 const securemessage::CryptoOps::SecretKey decode_key_; 76 77 // The current sequence number for encoding. 78 uint32_t encode_sequence_number_; 79 80 // The current sequence number for decoding. 81 uint32_t decode_sequence_number_; 82 83 // A friend to access private variables for testing. 84 friend class D2DConnectionContextV1Peer; 85 }; 86 87 } // namespace securegcm 88 89 #endif // SECURITY_CRYPTAUTH_LIB_SECUREGCM_D2D_CONNECTION_CONTEXT_V1_H_ 90