Changeset 275656 in webkit

Timestamp:

Apr 8, 2021, 3:53:44 AM (6 years ago)

Author:

youenn@apple.com

Message:

Update SFrame implementation to latest version
​https://bugs.webkit.org/show_bug.cgi?id=224276

Reviewed by Eric Carlson.

Source/WebCore:

Update implementation according to latest draft at ​https://github.com/eomara/sframe/blob/master/draft-omara-sframe.md.
In particular, we derive keys with new algorithm and the generation of the signature by including header and data length as well as nonce.

Test: webrtc/sframe-test-vectors.html

• Modules/mediastream/RTCRtpSFrameTransform.cpp:

(WebCore::RTCRtpSFrameTransform::setCounterForTesting):

• Modules/mediastream/RTCRtpSFrameTransform.h:
• Modules/mediastream/RTCRtpSFrameTransformer.cpp:

(WebCore::computeIV):
(WebCore::RTCRtpSFrameTransformer::updateEncryptionKey):
(WebCore::RTCRtpSFrameTransformer::decryptFrame):
(WebCore::RTCRtpSFrameTransformer::encryptFrame):
(WebCore::RTCRtpSFrameTransformer::computeEncryptedDataSignature):

• Modules/mediastream/RTCRtpSFrameTransformer.h:
• Modules/mediastream/RTCRtpSFrameTransformerCocoa.cpp:

(WebCore::RTCRtpSFrameTransformer::computeSaltKey):
(WebCore::createBaseSFrameKey):
(WebCore::RTCRtpSFrameTransformer::computeAuthenticationKey):
(WebCore::RTCRtpSFrameTransformer::computeEncryptionKey):
(WebCore::encodeBigEndian):
(WebCore::RTCRtpSFrameTransformer::computeEncryptedDataSignature):

• testing/Internals.cpp:

(WebCore::Internals::setSFrameCounter):

• testing/Internals.h:
• testing/Internals.idl:

Tools:

Update tests according new way of deriving keys and generating the signature.

• TestWebKitAPI/Tests/WebCore/RTCRtpSFrameTransformerTests.cpp:

(TestWebKitAPI::TEST):

LayoutTests:

• webrtc/sframe-test-vectors-expected.txt: Added.
• webrtc/sframe-test-vectors.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/webrtc/sframe-test-vectors-expected.txt (added)
• LayoutTests/webrtc/sframe-test-vectors.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.cpp (modified) (1 diff)
• Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.h (modified) (1 diff)
• Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.cpp (modified) (7 diffs)
• Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.h (modified) (1 diff)
• Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformerCocoa.cpp (modified) (2 diffs)
• Source/WebCore/testing/Internals.cpp (modified) (1 diff)
• Source/WebCore/testing/Internals.h (modified) (1 diff)
• Source/WebCore/testing/Internals.idl (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebCore/RTCRtpSFrameTransformerTests.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-08  Youenn Fablet  <youenn@apple.com>
+
+        Update SFrame implementation to latest version
+        https://bugs.webkit.org/show_bug.cgi?id=224276
+
+        Reviewed by Eric Carlson.
+
+        * webrtc/sframe-test-vectors-expected.txt: Added.
+        * webrtc/sframe-test-vectors.html: Added.
+
 2021-04-07  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-08  Youenn Fablet  <youenn@apple.com>
+
+        Update SFrame implementation to latest version
+        https://bugs.webkit.org/show_bug.cgi?id=224276
+
+        Reviewed by Eric Carlson.
+
+        Update implementation according to latest draft at https://github.com/eomara/sframe/blob/master/draft-omara-sframe.md.
+        In particular, we derive keys with new algorithm and the generation of the signature by including header and data length as well as nonce.
+
+        Test: webrtc/sframe-test-vectors.html
+
+        * Modules/mediastream/RTCRtpSFrameTransform.cpp:
+        (WebCore::RTCRtpSFrameTransform::setCounterForTesting):
+        * Modules/mediastream/RTCRtpSFrameTransform.h:
+        * Modules/mediastream/RTCRtpSFrameTransformer.cpp:
+        (WebCore::computeIV):
+        (WebCore::RTCRtpSFrameTransformer::updateEncryptionKey):
+        (WebCore::RTCRtpSFrameTransformer::decryptFrame):
+        (WebCore::RTCRtpSFrameTransformer::encryptFrame):
+        (WebCore::RTCRtpSFrameTransformer::computeEncryptedDataSignature):
+        * Modules/mediastream/RTCRtpSFrameTransformer.h:
+        * Modules/mediastream/RTCRtpSFrameTransformerCocoa.cpp:
+        (WebCore::RTCRtpSFrameTransformer::computeSaltKey):
+        (WebCore::createBaseSFrameKey):
+        (WebCore::RTCRtpSFrameTransformer::computeAuthenticationKey):
+        (WebCore::RTCRtpSFrameTransformer::computeEncryptionKey):
+        (WebCore::encodeBigEndian):
+        (WebCore::RTCRtpSFrameTransformer::computeEncryptedDataSignature):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setSFrameCounter):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
 2021-04-08  Xabier Rodriguez Calvar  <calvaris@igalia.com>
 

trunk/Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.cpp

@@ -76 +76 @@
 }
 
+void RTCRtpSFrameTransform::setCounterForTesting(uint64_t counter)
+{
+    m_transformer->setCounter(counter);
+}
+
 uint64_t RTCRtpSFrameTransform::counterForTesting() const
 {

trunk/Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.h

@@ -64 +64 @@
     void willClearBackend(RTCRtpTransformBackend&);
 
+    WEBCORE_EXPORT void setCounterForTesting(uint64_t);
     WEBCORE_EXPORT uint64_t counterForTesting() const;
     WEBCORE_EXPORT uint64_t keyIdForTesting() const;

trunk/Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.cpp

@@ -33 +33 @@
 namespace WebCore {
 
+static constexpr unsigned AES_CM_128_HMAC_SHA256_NONCE_SIZE = 12;
+
 static inline void writeUInt64(uint8_t* data, uint64_t value, uint8_t valueLength)
 {
@@ -72 +74 @@
 static inline Vector<uint8_t> computeIV(uint64_t counter, const Vector<uint8_t>& saltKey)
 {
+    // The saltKey is 12 bytes (AES_CM_128_HMAC_SHA256_NONCE_SIZE), we XOR with the counter as 12 bytes.
+    // We then extend it to 16 bytes since that is what is expected by the crypto routines.
     Vector<uint8_t> iv(16);
-    for (unsigned i = 0; i < 8; ++i) {
-        auto value = (counter >> ((7 - i) * 8)) & 0xff;
+    for (unsigned i = 0; i < 4; ++i)
+        iv[i] = saltKey[i];
+    for (unsigned i = 11; i >= 4; --i) {
+        auto value = counter & 0xff;
+        counter = counter >> 8;
         iv[i] = value ^ saltKey[i];
     }
-    for (unsigned i = 8; i < 16; ++i)
-        iv[i] = saltKey[i];
+    for (unsigned i = 12; i < 16; ++i)
+        iv[i] = 0;
     return iv;
 }
@@ -162 +169 @@
         return saltKeyResult.releaseException();
 
-    ASSERT(saltKeyResult.returnValue().size() >= 16);
+    ASSERT(saltKeyResult.returnValue().size() >= AES_CM_128_HMAC_SHA256_NONCE_SIZE);
 
     auto authenticationKeyResult = computeAuthenticationKey(rawKey);
@@ -241 +248 @@
         return Exception { DataError, "Chunk is too small for authentication size" };
 
+    auto iv = computeIV(m_counter, m_saltKey);
+
     // Compute signature
     auto* transmittedSignature = frameData + frameSize - m_authenticationSize;
-    auto signature = computeEncryptedDataSignature(frameData, frameSize  - m_authenticationSize, m_authenticationKey);
+    auto signature = computeEncryptedDataSignature(iv, frameData, header->size, frameData + header->size, frameSize  - m_authenticationSize - header->size, m_authenticationKey);
     for (size_t cptr = 0; cptr < m_authenticationSize; ++cptr) {
         if (signature[cptr] != transmittedSignature[cptr]) {
@@ -252 +261 @@
 
     // Decrypt data
-    auto iv = computeIV(m_counter, m_saltKey);
     auto dataSize = frameSize - header->size - m_authenticationSize;
     auto result = decryptData(frameData + header->size, dataSize, iv, m_encryptionKey);
@@ -312 +320 @@
 
     // Fill signature
-    auto signature = computeEncryptedDataSignature(newDataPointer, frameSize + headerSize, m_authenticationKey);
+    auto signature = computeEncryptedDataSignature(iv, newDataPointer, headerSize, newDataPointer + headerSize, frameSize, m_authenticationKey);
     std::memcpy(newDataPointer + frameSize + headerSize, signature.data(), m_authenticationSize);
 
@@ -357 +365 @@
 }
 
-Vector<uint8_t> RTCRtpSFrameTransformer::computeEncryptedDataSignature(const uint8_t*, size_t, const Vector<uint8_t>&)
+Vector<uint8_t> RTCRtpSFrameTransformer::computeEncryptedDataSignature(const Vector<uint8_t>&, const uint8_t*, size_t, const uint8_t*, size_t, const Vector<uint8_t>&)
 {
     return { };

trunk/Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.h

@@ -75 +75 @@
     ExceptionOr<Vector<uint8_t>> encryptData(const uint8_t*, size_t, const Vector<uint8_t>& iv, const Vector<uint8_t>& key);
     ExceptionOr<Vector<uint8_t>> decryptData(const uint8_t*, size_t, const Vector<uint8_t>& iv, const Vector<uint8_t>& key);
-    Vector<uint8_t> computeEncryptedDataSignature(const uint8_t*, size_t, const Vector<uint8_t>& key);
+    Vector<uint8_t> computeEncryptedDataSignature(const Vector<uint8_t>& nonce, const uint8_t* header, size_t headerSize, const uint8_t* data, size_t dataSize, const Vector<uint8_t>& key);
     void updateAuthenticationSize();
 

trunk/Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformerCocoa.cpp

@@ -36 +36 @@
 ExceptionOr<Vector<uint8_t>> RTCRtpSFrameTransformer::computeSaltKey(const Vector<uint8_t>& rawKey)
 {
-    uint8_t usage[] = "SFrameSaltKey";
-    return deriveHDKFSHA256Bits(rawKey.data(), 16, rawKey.data() + 16, rawKey.size() - 16, usage, sizeof(usage) - 1, 128);
+    uint8_t usage[] = "SFrame10";
+    uint8_t info[] = "salt";
+    return deriveHDKFSHA256Bits(rawKey.data(), 16, usage, sizeof(usage) - 1, info, sizeof(info) - 1, 96);
+}
+
+static ExceptionOr<Vector<uint8_t>> createBaseSFrameKey(const Vector<uint8_t>& rawKey)
+{
+    uint8_t usage[] = "SFrame10";
+    uint8_t info[] = "key";
+    return deriveHDKFSHA256Bits(rawKey.data(), 16, usage, sizeof(usage) - 1, info, sizeof(info) - 1, 128);
 }
 
 ExceptionOr<Vector<uint8_t>> RTCRtpSFrameTransformer::computeAuthenticationKey(const Vector<uint8_t>& rawKey)
 {
-    uint8_t usage[] = "SFrameAuthenticationKey";
-    return deriveHDKFSHA256Bits(rawKey.data(), 16, rawKey.data() + 16, rawKey.size() - 16, usage, sizeof(usage) - 1, 256);
+    auto key = createBaseSFrameKey(rawKey);
+    if (key.hasException())
+        return key;
+
+    uint8_t usage[] = "SFrame10 AES CM AEAD";
+    uint8_t info[] = "auth";
+    return deriveHDKFSHA256Bits(key.returnValue().data(), 16, usage, sizeof(usage) - 1, info, sizeof(info) - 1, 256);
 }
 
 ExceptionOr<Vector<uint8_t>> RTCRtpSFrameTransformer::computeEncryptionKey(const Vector<uint8_t>& rawKey)
 {
-    uint8_t usage[] = "SFrameEncryptionKey";
-    return deriveHDKFSHA256Bits(rawKey.data(), 16, rawKey.data() + 16, rawKey.size() - 16, usage, sizeof(usage) - 1, 128);
+    auto key = createBaseSFrameKey(rawKey);
+    if (key.hasException())
+        return key;
+
+    uint8_t usage[] = "SFrame10 AES CM AEAD";
+    uint8_t info[] = "enc";
+    return deriveHDKFSHA256Bits(key.returnValue().data(), 16, usage, sizeof(usage) - 1, info, sizeof(info) - 1, 128);
 }
 
@@ -62 +80 @@
 }
 
-Vector<uint8_t> RTCRtpSFrameTransformer::computeEncryptedDataSignature(const uint8_t* data, size_t size, const Vector<uint8_t>& key)
+static inline Vector<uint8_t, 8> encodeBigEndian(uint64_t value)
 {
-    return calculateSHA256Signature(key, data, size);
+    Vector<uint8_t, 8> result(8);
+    for (int i = 7; i >= 0; --i) {
+        result.data()[i] = value & 0xff;
+        value = value >> 8;
+    }
+    return result;
+}
+
+Vector<uint8_t> RTCRtpSFrameTransformer::computeEncryptedDataSignature(const Vector<uint8_t>& nonce, const uint8_t* header, size_t headerSize, const uint8_t* data, size_t dataSize, const Vector<uint8_t>& key)
+{
+    auto headerLength = encodeBigEndian(headerSize);
+    auto dataLength = encodeBigEndian(dataSize);
+
+    Vector<uint8_t> result(CC_SHA256_DIGEST_LENGTH);
+    CCHmacContext context;
+    CCHmacInit(&context, kCCHmacAlgSHA256, key.data(), key.size());
+    CCHmacUpdate(&context, headerLength.data(), headerLength.size());
+    CCHmacUpdate(&context, dataLength.data(), dataLength.size());
+    CCHmacUpdate(&context, nonce.data(), 12);
+    CCHmacUpdate(&context, header, headerSize);
+    CCHmacUpdate(&context, data, dataSize);
+    CCHmacFinal(&context, result.data());
+
+    return result;
 }
 

trunk/Source/WebCore/testing/Internals.cpp

@@ -1596 +1596 @@
 }
 
+void Internals::setSFrameCounter(RTCRtpSFrameTransform& transform, const String& counter)
+{
+    if (auto value = StringView(counter).toUInt64Strict())
+        transform.setCounterForTesting(*value);
+}
+
 uint64_t Internals::sframeCounter(const RTCRtpSFrameTransform& transform)
 {

trunk/Source/WebCore/testing/Internals.h

@@ -618 +618 @@
     void setWebRTCVP9Support(bool supportVP9Profile0, bool supportVP9Profile2);
     void setWebRTCVP9VTBSupport(bool);
+    void setSFrameCounter(RTCRtpSFrameTransform&, const String&);
     uint64_t sframeCounter(const RTCRtpSFrameTransform&);
     uint64_t sframeKeyId(const RTCRtpSFrameTransform&);

trunk/Source/WebCore/testing/Internals.idl

@@ -826 +826 @@
     [Conditional=WEB_RTC] undefined setWebRTCVP9Support(boolean supportVP9Profile0, boolean supportVP9Profile2);
     [Conditional=WEB_RTC] undefined setWebRTCVP9VTBSupport(boolean allowed);
+    [Conditional=WEB_RTC] undefined setSFrameCounter(RTCRtpSFrameTransform transform, DOMString counter);
     [Conditional=WEB_RTC] unsigned long long sframeCounter(RTCRtpSFrameTransform transform);
     [Conditional=WEB_RTC] unsigned long long sframeKeyId(RTCRtpSFrameTransform transform);

trunk/Tools/ChangeLog

@@ +1 @@
+2021-04-08  Youenn Fablet  <youenn@apple.com>
+
+        Update SFrame implementation to latest version
+        https://bugs.webkit.org/show_bug.cgi?id=224276
+
+        Reviewed by Eric Carlson.
+
+        Update tests according new way of deriving keys and generating the signature.
+
+        * TestWebKitAPI/Tests/WebCore/RTCRtpSFrameTransformerTests.cpp:
+        (TestWebKitAPI::TEST):
+
 2021-04-07  Jonathan Bedard  <jbedard@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WebCore/RTCRtpSFrameTransformerTests.cpp

@@ -117 +117 @@
     auto transformer = createVideoTransformer();
     checkVectorsAreEqual(transformer->authenticationKey(), Vector<uint8_t>::from(
+        4,
+        98,
+        231,
+        89,
+        19,
+        177,
+        253,
+        241,
+        246,
+        85,
+        193,
+        64,
+        19,
+        72,
+        211,
+        48,
+        57,
+        235,
+        63,
+        57,
+        165,
+        252,
+        130,
+        58,
+        142,
+        14,
+        142,
+        223,
+        134,
         92,
-        228,
+        167,
+        253
+    ));
+}
+
+TEST(RTCRtpSFrameTransformer, EncryptionKey)
+{
+    auto transformer = createVideoTransformer();
+    checkVectorsAreEqual(transformer->encryptionKey(), Vector<uint8_t>::from(
+        180,
+        189,
+        66,
+        149,
+        6,
+        101,
+        148,
+        179,
+        158,
+        210,
+        132,
+        83,
+        75,
+        11,
+        43,
+        50
+    ));
+}
+
+TEST(RTCRtpSFrameTransformer, SaltKey)
+{
+    auto transformer = createVideoTransformer();
+    checkVectorsAreEqual(transformer->saltKey(), Vector<uint8_t>::from(
+        184,
+        43,
+        180,
+        28,
+        93,
         139,
-        195,
-        98,
-        16,
-        4,
-        193,
-        221,
-        248,
-        232,
-        178,
-        135,
-        22,
-        141,
-        150,
-        165,
-        242,
-        73,
-        72,
-        10,
-        197,
-        15,
-        87,
-        181,
-        34,
-        120,
-        71,
-        42,
-        174,
-        131,
-        72
-    ));
-}
-
-TEST(RTCRtpSFrameTransformer, EncryptionKey)
-{
-    auto transformer = createVideoTransformer();
-    checkVectorsAreEqual(transformer->encryptionKey(), Vector<uint8_t>::from(
-        207,
-        251,
-        52,
-        21,
-        101,
-        50,
-        232,
-        48,
-        211,
-        115,
-        11,
-        155,
-        101,
-        116,
-        153,
-        71
-    ));
-}
-
-TEST(RTCRtpSFrameTransformer, SaltKey)
-{
-    auto transformer = createVideoTransformer();
-    checkVectorsAreEqual(transformer->saltKey(), Vector<uint8_t>::from(
-        229,
-        19,
-        42,
-        93,
-        164,
-        103,
-        120,
-        53,
-        25,
-        26,
-        237,
-        204,
-        79,
-        138,
-        138,
-        231
+        8,
+        109,
+        65,
+        142,
+        81,
+        22
     ));
 }
@@ -275 +271 @@
         51,
         0,
-        254,
-        171,
-        168,
-        127,
-        158,
-        97,
-        70,
-        4,
-        233,
-        156,
-        134,
-        220,
-        44,
-        50,
-        90,
-        3,
-        68,
-        200,
-        127,
-        223,
-        6
+        176,
+        194,
+        94,
+        42,
+        248,
+        190,
+        103,
+        74,
+        123,
+        208,
+        120,
+        249,
+        75,
+        63,
+        244,
+        81,
+        244,
+        71,
+        64,
+        46,
+        28
     ));
 }
@@ -310 +306 @@
         EXPECT_FALSE(result.hasException());
     }
+
     checkVectorsAreEqual(result.releaseReturnValue(), Vector<uint8_t>::from(
         31,
@@ -322 +319 @@
         1,
         0,
-        124,
-        218,
-        61,
-        23,
-        78,
-        15,
-        190,
-        35,
-        255,
-        253,
-        120,
-        64,
-        28,
-        183,
-        172,
-        154,
-        144,
-        16,
-        229,
-        87,
-        52
+        37,
+        39,
+        205,
+        106,
+        44,
+        155,
+        25,
+        174,
+        2,
+        206,
+        198,
+        89,
+        82,
+        57,
+        224,
+        232,
+        26,
+        29,
+        98,
+        176,
+        57
     ));
 }
@@ -368 +365 @@
         0,
         0,
-        98,
-        212,
-        137,
-        244,
-        209,
-        16,
-        89,
-        234,
-        21,
-        171,
-        15,
-        107,
-        50,
-        145,
-        73,
-        107,
-        165,
-        45,
-        190,
-        25,
-        82
+        117,
+        5,
+        112,
+        126,
+        205,
+        197,
+        116,
+        213,
+        249,
+        178,
+        47,
+        154,
+        151,
+        123,
+        40,
+        58,
+        121,
+        201,
+        159,
+        90,
+        170
     ));
 }