christian/schattenpost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SPS3: Poly1305-Einmal-MAC + Public-Ready README/LICENSE

Browse Source 
Authentifizierung für CLI und Web:
- Poly1305 (RFC 8439) pur in Python (bigint) und JS (BigInt), keine neue Dependency
- MAC-Schluessel pro Nachricht frisch aus dem Pad (len+32), encrypt-then-MAC
  ueber Header + Ciphertext; reveal lehnt manipulierte/desynchrone Bilder hart ab
- Stego-Format SPS2 -> SPS3 (16-B-Tag im Header); alte SPS2-Bilder werden noch
  gelesen, aber als unauthentifiziert markiert
- Service-Worker-Cache auf v3 gebumpt
- Interop-Runner (web/_interop_run.sh): RFC-Vektor cross-impl, beide Richtungen,
  Tamper-Erkennung

README fuer Public ueberarbeitet (ehrliches Bedrohungsmodell, Voraussetzungen,
Projektstruktur, Tests) + MIT-LICENSE.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Claude Code
2026-07-15 10:46:04 +00:00
parent dac9550b46
commit 7569cd3fab
8 changed files with 406 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

108
web/index.html
View File

@@ -140,11 +140,18 @@ const SP = (function () {
const enc = (s) => new TextEncoder().encode(s);
const KEY_MAGIC = enc('SPK1'), KEY_VERSION = 1, KEY_HEADER_LEN = 24;
const ROLE_RECV = 0, ROLE_SEND = 1;
const STEGO_MAGIC = enc('SPS2'), STEGO_VERSION = 2, STEGO_HEADER_LEN = 25;
// v3 authentifiziert mit Poly1305-Einmal-MAC (Tag im Header).
const STEGO_MAGIC = enc('SPS3'), STEGO_VERSION = 3;
const STEGO_PRE_LEN = 25, STEGO_TAG_LEN = 16;
const STEGO_HEADER_LEN = STEGO_PRE_LEN + STEGO_TAG_LEN; // 41
const MAC_KEY_LEN = 32;
const STEGO_MAGIC_V2 = enc('SPS2'), STEGO_VERSION_V2 = 2; // Alt, nur Aufdecken
const eq4 = (a, b, off) => a[0]===b[off]&&a[1]===b[off+1]&&a[2]===b[off+2]&&a[3]===b[off+3];
const sameStream = (a, b) => { if (a.length!==b.length) return false;
for (let i=0;i<a.length;i++) if (a[i]!==b[i]) return false; return true; };
const concat = (a, b) => { const o = new Uint8Array(a.length + b.length);
o.set(a, 0); o.set(b, a.length); return o; };
function otpXor(data, material, offset) {
if (offset + data.length > material.length) {
@@ -156,6 +163,26 @@ const SP = (function () {
return out;
}
// --- Poly1305 (RFC 8439), Einmal-MAC aus frischem Pad-Material ---
const _leToBig = (b) => { let x = 0n; for (let i = b.length - 1; i >= 0; i--) x = (x << 8n) | BigInt(b[i]); return x; };
const _bigToLe = (x, n) => { const o = new Uint8Array(n); for (let i = 0; i < n; i++) { o[i] = Number(x & 0xffn); x >>= 8n; } return o; };
const _P1305_P = (1n << 130n) - 5n;
const _P1305_CLAMP = 0x0ffffffc0ffffffc0ffffffc0fffffffn;
function poly1305(msg, key) {
if (key.length !== 32) throw new Error('Poly1305-Schlüssel muss 32 Byte sein.');
const r = _leToBig(key.subarray(0, 16)) & _P1305_CLAMP;
const s = _leToBig(key.subarray(16, 32));
let acc = 0n;
for (let i = 0; i < msg.length; i += 16) {
const block = msg.subarray(i, Math.min(i + 16, msg.length));
const n = _leToBig(block) | (1n << BigInt(8 * block.length));
acc = (acc + n) * r % _P1305_P;
}
return _bigToLe((acc + s) % (1n << 128n), 16);
}
function ctEqual(a, b) { if (a.length !== b.length) return false;
let d = 0; for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i]; return d === 0; }
function parseKey(bytes) {
if (bytes.length < KEY_HEADER_LEN) throw new Error('Keine gültige Schlüsseldatei (zu kurz).');
if (!eq4(KEY_MAGIC, bytes, 0)) throw new Error('Keine schattenpost-Schlüsseldatei.');
@@ -179,14 +206,19 @@ const SP = (function () {
return out;
}
function buildStego(streamId, offset, ciphertext) {
const out = new Uint8Array(STEGO_HEADER_LEN + ciphertext.length);
out.set(STEGO_MAGIC, 0);
out[4] = STEGO_VERSION;
out.set(streamId, 5);
const dv = new DataView(out.buffer);
// macKey: 32 Byte frisches Pad-Material (r|s). Tag deckt Vor-Header+Ciphertext ab.
function buildStego(streamId, offset, ciphertext, macKey) {
const pre = new Uint8Array(STEGO_PRE_LEN);
pre.set(STEGO_MAGIC, 0);
pre[4] = STEGO_VERSION;
pre.set(streamId, 5);
const dv = new DataView(pre.buffer);
dv.setBigUint64(13, BigInt(offset), false);
dv.setUint32(21, ciphertext.length, false);
const tag = poly1305(concat(pre, ciphertext), macKey);
const out = new Uint8Array(STEGO_HEADER_LEN + ciphertext.length);
out.set(pre, 0);
out.set(tag, STEGO_PRE_LEN);
out.set(ciphertext, STEGO_HEADER_LEN);
return out;
}
@@ -210,21 +242,32 @@ const SP = (function () {
}
function extract(rgb) {
if (rgb.length < STEGO_HEADER_LEN * 8) throw new Error('Bild zu klein für einen Header.');
const h = readBytesAt(rgb, STEGO_HEADER_LEN);
if (!eq4(STEGO_MAGIC, h, 0)) throw new Error(
'Kein schattenpost-Container gefunden. Wurde das Bild als Foto komprimiert?');
if (h[4] !== STEGO_VERSION) throw new Error('Unbekannte Container-Version ' + h[4] + '.');
const dv = new DataView(h.buffer);
const streamId = h.slice(5, 13);
if (rgb.length < STEGO_PRE_LEN * 8) throw new Error('Bild zu klein für einen Header.');
const pre = readBytesAt(rgb, STEGO_PRE_LEN);
const ver = pre[4];
const dv = new DataView(pre.buffer);
const streamId = pre.slice(5, 13);
const offset = Number(dv.getBigUint64(13, false));
const length = dv.getUint32(21, false);
const full = readBytesAt(rgb, STEGO_HEADER_LEN + length);
return { streamId, offset, ciphertext: full.slice(STEGO_HEADER_LEN) };
if (eq4(STEGO_MAGIC, pre, 0) && ver === STEGO_VERSION) {
const full = readBytesAt(rgb, STEGO_HEADER_LEN + length);
return { version: ver, streamId, offset, length,
tag: full.slice(STEGO_PRE_LEN, STEGO_HEADER_LEN),
macInputHeader: full.slice(0, STEGO_PRE_LEN),
ciphertext: full.slice(STEGO_HEADER_LEN, STEGO_HEADER_LEN + length) };
}
if (eq4(STEGO_MAGIC_V2, pre, 0) && ver === STEGO_VERSION_V2) {
const full = readBytesAt(rgb, STEGO_PRE_LEN + length);
return { version: ver, streamId, offset, length, tag: null,
ciphertext: full.slice(STEGO_PRE_LEN, STEGO_PRE_LEN + length) };
}
throw new Error('Kein schattenpost-Container gefunden. Wurde das Bild als Foto komprimiert?');
}
return { ROLE_RECV, ROLE_SEND, KEY_HEADER_LEN, STEGO_HEADER_LEN,
otpXor, parseKey, buildKey, buildStego, embed, extract, sameStream };
return { ROLE_RECV, ROLE_SEND, KEY_HEADER_LEN, STEGO_HEADER_LEN, STEGO_PRE_LEN,
STEGO_VERSION, STEGO_VERSION_V2, MAC_KEY_LEN,
otpXor, poly1305, ctEqual, concat, parseKey, buildKey, buildStego,
embed, extract, sameStream };
})();
if (typeof module !== 'undefined' && module.exports) module.exports = SP;
if (typeof globalThis !== 'undefined') globalThis.SP = SP;
@@ -288,8 +331,14 @@ if (typeof document !== 'undefined') (function () {
const key = SP.parseKey(await readFile($('s-key').files[0]));
if (key.role !== SP.ROLE_SEND) throw new Error('Das ist ein Empfangsschlüssel. Zum Senden brauchst du deinen send.key.');
const plain = encTxt.encode(text);
// Keystream (len) + MAC-Schlüssel (32) frisch aus dem Pad.
const need = plain.length + SP.MAC_KEY_LEN;
if (key.sendOffset + need > key.material.length)
throw new Error(`Sendeschlüssel erschöpft: ab Offset ${key.sendOffset} `
+ `brauche ich ${need} B (Nachricht+MAC), habe nur ${key.material.length - key.sendOffset}.`);
const ct = SP.otpXor(plain, key.material, key.sendOffset);
const payload = SP.buildStego(key.streamId, key.sendOffset, ct);
const macKey = key.material.slice(key.sendOffset + plain.length, key.sendOffset + need);
const payload = SP.buildStego(key.streamId, key.sendOffset, ct, macKey);
const img = await loadImage($('s-carrier').files[0]);
const { cv, cx, idata, rgb } = imageToRgb(img);
@@ -301,12 +350,12 @@ if (typeof document !== 'undefined') (function () {
const url = URL.createObjectURL(blob);
$('s-preview').src = url; $('s-preview').style.display = 'block';
const dl = $('s-dlimg'); dl.href = url; dl.download = carrierName(); dl.style.display = 'block';
// Aktualisierter Sendeschlüssel (Offset fortgeschrieben)
const nextOff = key.sendOffset + plain.length;
// Aktualisierter Sendeschlüssel (Offset um Nachricht+MAC fortgeschrieben)
const nextOff = key.sendOffset + need;
const newKey = SP.buildKey(SP.ROLE_SEND, key.streamId, nextOff, key.material);
const dk = $('s-dlkey'); dk.href = blobUrl(newKey); dk.style.display = 'block';
$('s-note').style.display = 'block';
show(st, 'ok', `Versteckt. ${plain.length} B ab Offset ${key.sendOffset}. Neuer Offset: ${nextOff}.`);
show(st, 'ok', `Versteckt + authentifiziert. ${plain.length} B ab Offset ${key.sendOffset}. Neuer Offset: ${nextOff}.`);
}, 'image/png');
} catch (err) { show(st, 'err', '✗ ' + err.message); }
};
@@ -325,10 +374,23 @@ if (typeof document !== 'undefined') (function () {
const info = SP.extract(rgb);
if (!SP.sameStream(info.streamId, key.streamId))
throw new Error('Falscher Schlüssel: dieses Bild gehört zu einem anderen Kontakt.');
let warn = '';
if (info.version === SP.STEGO_VERSION) {
const need = info.ciphertext.length + SP.MAC_KEY_LEN;
if (info.offset + need > key.material.length)
throw new Error('Schlüssel passt nicht: zu kurz für Nachricht+MAC.');
const macKey = key.material.slice(info.offset + info.ciphertext.length, info.offset + need);
const expected = SP.poly1305(SP.concat(info.macInputHeader, info.ciphertext), macKey);
if (!SP.ctEqual(expected, info.tag))
throw new Error('Authentifizierung fehlgeschlagen: Bild verändert oder '
+ 'Schlüssel nicht synchron (Offset-Drift). Nachricht nicht vertrauen.');
} else {
warn = ' ⚠︎ altes SPS2-Bild — unauthentifiziert.';
}
const plain = SP.otpXor(info.ciphertext, key.material, info.offset);
let text; try { text = decTxt.decode(plain); } catch { text = '[Binärdaten]'; }
out.textContent = text; out.style.display = 'block';
show(st, 'ok', `Entschlüsselt (${plain.length} B, Offset ${info.offset}).`);
show(st, 'ok', `Entschlüsselt (${plain.length} B, Offset ${info.offset}).` + warn);
} catch (err) { show(st, 'err', '✗ ' + err.message); }
};