Kotlin: X25519, with the small-order check that is not optional here

Raw 32-byte keys on the wire, X.509 SubjectPublicKeyInfo in the JCA -- so every crossing needs the 12-byte DER prefix added or stripped. Written out as a constant rather than parsed: a DER parser here would be more code than the thing it parses, and one more place to get a length wrong. Refuses an all-zero shared secret. X25519 produces all zeros for a small-order peer key, and a peer that sends one forces both sides to a secret it already knows. RFC 7748 says implementations MAY check; when the peer's key arrives over a relay nobody trusts, MAY is not the right reading. All four small-order points from §6.1 are tested. ⚠️ XDH is API 33+ on Android. Older devices throw NoSuchAlgorithmException at the first call, and the app must either bundle a provider or refuse to run -- a decision nobody has made, so it is documented rather than papered over. ⚠️ These run on the JVM against SunEC. Android routes the same calls through Conscrypt. Passing here says the encoding is right and nothing about a device. Kotlin engine: 27 tests -> 33. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-22 11:42:01 -04:00
parent bff7a4bbdd
commit 85f6a29953
2 changed files with 181 additions and 0 deletions
@@ -0,0 +1,83 @@
+package io.flamenet.e2e
+
+import java.security.KeyFactory
+import java.security.KeyPair
+import java.security.KeyPairGenerator
+import java.security.spec.X509EncodedKeySpec
+import javax.crypto.KeyAgreement
+
+/**
+ * X25519 Diffie-Hellman.
+ *
+ * The protocol moves raw 32-byte public keys — that is what the wire carries,
+ * what CryptoKit's `rawRepresentation` gives, and what the JavaScript engine
+ * exports. The JVM and Android both insist on X.509 `SubjectPublicKeyInfo`
+ * instead, so every crossing of that boundary needs the DER wrapper added or
+ * stripped.
+ *
+ * ⚠️ **API 33+ on Android.** `XDH` arrived in the platform with Android 13. On
+ * anything older this throws `NoSuchAlgorithmException` at the first call, and
+ * the app has to either bundle a provider or refuse to run — a decision that
+ * has not been made yet, so it is documented rather than papered over.
+ *
+ * ⚠️ **These tests run on the JVM, where the provider is SunEC. Android routes
+ * the same calls through Conscrypt.** Passing here says the encoding is right;
+ * it says nothing about the device.
+ */
+object X25519 {
+
+    const val KEY_LEN = 32
+
+    /**
+     * The fixed prefix of an X.509-wrapped X25519 public key: SEQUENCE, the
+     * id-X25519 OID (1.3.101.110), then a 32-bit BIT STRING.
+     *
+     * Written out rather than parsed because it is a constant twelve bytes and
+     * a DER parser here would be more code than the thing it parses — and one
+     * more place to get a length wrong.
+     */
+    private val SPKI_PREFIX = byteArrayOf(
+        0x30, 0x2a,                                     // SEQUENCE, 42 bytes
+        0x30, 0x05,                                     // SEQUENCE, 5 bytes
+        0x06, 0x03, 0x2b, 0x65, 0x6e,                   // OID 1.3.101.110
+        0x03, 0x21, 0x00,                               // BIT STRING, 33 bytes, 0 unused
+    )
+
+    fun generate(): KeyPair = KeyPairGenerator.getInstance("XDH").apply { initialize(255) }.generateKeyPair()
+
+    /** Wrap a raw 32-byte public key so the JCA will accept it. */
+    fun publicKeyFromRaw(raw: ByteArray): java.security.PublicKey {
+        require(raw.size == KEY_LEN) { "an X25519 public key is $KEY_LEN bytes, got ${raw.size}" }
+        return KeyFactory.getInstance("XDH")
+            .generatePublic(X509EncodedKeySpec(SPKI_PREFIX + raw))
+    }
+
+    /** The raw 32 bytes the wire carries, from a JCA public key. */
+    fun rawFromPublicKey(key: java.security.PublicKey): ByteArray {
+        val encoded = key.encoded
+        require(encoded.size == SPKI_PREFIX.size + KEY_LEN) {
+            "unexpected X25519 SPKI length ${encoded.size}"
+        }
+        return encoded.copyOfRange(SPKI_PREFIX.size, encoded.size)
+    }
+
+    /**
+     * The shared secret.
+     *
+     * **Rejects an all-zero result.** X25519 produces all zeros for a
+     * small-order public key, and a peer that sends one can force both sides to
+     * a secret it already knows. RFC 7748 says implementations MAY check; for a
+     * key-agreement protocol where the peer's key arrives over an untrusted
+     * relay, it is not optional.
+     */
+    fun agree(privateKey: java.security.PrivateKey, peerRaw: ByteArray): ByteArray {
+        val agreement = KeyAgreement.getInstance("XDH")
+        agreement.init(privateKey)
+        agreement.doPhase(publicKeyFromRaw(peerRaw), true)
+        val secret = agreement.generateSecret()
+        if (secret.all { it.toInt() == 0 }) {
+            throw SecurityException("X25519 produced an all-zero secret: the peer key has small order")
+        }
+        return secret
+    }
+}