webtransport: use deterministic TLS certificates #1833

MarcoPolo · 2022-10-17T18:46:14Z

p2p/transport/webtransport/crypto.go

marten-seemann · 2022-10-18T09:32:34Z

p2p/transport/webtransport/crypto_test.go

+	runs := 1000
+	for i := 0; i < runs; i++ {
+		t.Run(fmt.Sprintf("Run=%d", i), func(t *testing.T) {
+			zeroSeed := [32]byte{}


Should this be a random value? Otherwise, what's the point of running 1000 runs?

shouldn't matter. The test is to check if the signing process itself is non-deterministic. This seed is fed into the hkdf so the signing process is oblivious to this.

Imagine the signing process changes in the future and it randomly reads a byte from /dev/urandom to mix in 10% of the time. Then a single run would succeed 81% of the time. Doing more runs decreases the chance of success iteratively (0.81*0.81*...). The 1000 runs is to detect if there's any chance on non-determinism.

marten-seemann · 2022-10-18T09:32:55Z

p2p/transport/webtransport/crypto_test.go

+	runs := 1000
+	for i := 0; i < runs; i++ {
+		t.Run(fmt.Sprintf("Run=%d", i), func(t *testing.T) {
+			zeroSeed := [32]byte{}


p2p/transport/webtransport/cert_manager.go

marten-seemann · 2022-10-18T11:41:27Z

p2p/transport/webtransport/cert_manager_test.go

@@ -77,7 +86,7 @@ func TestCertRenewal(t *testing.T) {
 		}
 		return false
 	}, 100*time.Millisecond, 10*time.Millisecond)
-	cl.Add(2 * time.Second)
+	cl.Add(clockSkewAllowance + 2*time.Second)


Which change in the logic made this necessary?

It's very subtle! It's here: https://github.com/libp2p/go-libp2p/pull/1833/files#diff-6396cfe3758a5a20ba975f8cc2876388c171949cb5bac4419f31ebfa26a2c3a0R93

Do we still need the skew here?

Kind of. In this test we have this setup

v-- start here-ish |---------| |---------|

with cl.Set(m.currentConfig.End().Add(-(2*clockSkewAllowance + time.Second))), we advance the clock:

v-- clock is here now (minus one second) |---------| |---------|

Remember the transition point is one clock skew before the end.

v-- clock is here now (minus one second) |---------| | <- transition point |---------|

So we need to move one clock skew forward and a couple seconds

v-- clock is here now (plus one second) |---------| | <- transition point |---------|

Maybe this makes more sense if I change it to only advance the clock to one clock skew before the end?
with cl.Set(m.currentConfig.End().Add(-(clockSkewAllowance + time.Second))), we advance the clock:

p2p/transport/webtransport/cert_manager_test.go

MarcoPolo · 2022-10-22T01:26:32Z

p2p/transport/webtransport/cert_manager_test.go

+	for i := 0; i < runs; i++ {
+		t.Run(fmt.Sprintf("Run=%d", i), func(t *testing.T) {
+			cl := clock.NewMock()
+			priv, _, err := test.RandTestKeyPair(crypto.Ed25519, 256)


This should use a zero byte seed. Otherwise we can randomly get to an edge case around the hour (with random offset)

Not sure I understand. Isn’t there the chance we hit the offset for any key?

This test makes sure that if we reboot one hour in the future then we get the same key assuming we aren't near the boundary. The problem with the random key is that it means we have a random offset (offset is defined by the key). So by setting the key to a predetermined one we can uphold the assumption. The zero seed is just one such key, but any key that doesn't put us near the bounds is fine.

p2p/transport/webtransport/cert_manager.go

marten-seemann · 2022-10-22T07:34:24Z

p2p/transport/webtransport/cert_manager.go

+	// We want to add a random offset to each start time so that not all certs
+	// rotate at the same time across the network. The offset represents moving
+	// the bucket start time some `offset` earlier.
+	offset := (time.Duration(binary.LittleEndian.Uint16(pubkeyBytes)) * time.Minute) % (certValidity - clockSkewAllowance)


Why is this module certValidity minus a single clockSkewAllowance?

I was including the clockSkew allowance into the offset, but that was wrong (and also tricky). I've done the simpler thing of subtracting the start I pass to getCurrentBucketStartTime by clockSkewAllowance. This works because getCurrentBucketStartTime will never give a time later than start + certValidity - 2*clockSkew.

p2p/transport/webtransport/cert_manager_test.go

marten-seemann · 2022-10-22T07:37:51Z

p2p/transport/webtransport/cert_manager_test.go

@@ -77,7 +86,7 @@ func TestCertRenewal(t *testing.T) {
 		}
 		return false
 	}, 100*time.Millisecond, 10*time.Millisecond)
-	cl.Add(2 * time.Second)
+	cl.Add(clockSkewAllowance + 2*time.Second)


Do we still need the skew here?

marten-seemann · 2022-10-22T07:38:27Z

p2p/transport/webtransport/cert_manager_test.go

@@ -100,3 +110,66 @@ func TestCertRenewal(t *testing.T) {
 	// check that the 2nd certificate from the beginning was rolled over to be the 1st certificate
 	require.Equal(t, second[1].Value(), third[0].Value())
 }
+
+func TestDeterministicCertsAcrossReboots(t *testing.T) {


Do we need to skip on OSX?

The MacOS issue was around listening, this should be okay (after using a deterministic seed, since otherwise we have random offsets and adding an hour might get us over the border).

marten-seemann · 2022-10-22T07:39:34Z

p2p/transport/webtransport/cert_manager_test.go

+	for i := 0; i < runs; i++ {
+		t.Run(fmt.Sprintf("Run=%d", i), func(t *testing.T) {
+			cl := clock.NewMock()
+			priv, _, err := test.RandTestKeyPair(crypto.Ed25519, 256)


Not sure I understand. Isn’t there the chance we hit the offset for any key?

p2p/transport/webtransport/transport_test.go

marten-seemann · 2022-10-22T07:43:11Z

p2p/transport/webtransport/transport_test.go

+func TestServerSendsBackValidCert(t *testing.T) {
+	var maxTimeoutErrors = 10
+
+	require.NoError(t, quick.Check(func(timeSinceUnixEpoch time.Duration, keySeed int64, randomClientSkew time.Duration) bool {


Do we need to repeat this test 100 time or so?

That's the default: https://pkg.go.dev/testing/quick?utm_source=gopls#Config

marten-seemann · 2022-10-23T12:02:20Z

Looks like one of these tests is failing:

 === RUN   TestServerSendsBackValidCert
  2022/10/22 14:53:07 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details.
  Error: CRYPTO_ERROR (0x12a): Times are not valid: server_now=2062-11-24 13:43:26.165 +0000 UTC client_now=2062-11-24 13:25:30.7370715 +0000 UTC certstart=2062-11-24 13:30:00 +0000 UTC certend=2062-12-08 13:30:00 +0000 UTC
      transport_test.go:598: 
          	Error Trace:	/home/runner/work/go-libp2p/go-libp2p/p2p/transport/webtransport/transport_test.go:598
          	Error:      	Received unexpected error:
          	            	#54: failed on input -6053665406165266670, -6699227244707765831, -642676675427928500
          	Test:       	TestServerSendsBackValidCert
  --- FAIL: TestServerSendsBackValidCert (0.76s)

Fixes the logic that a cert has been valid for a clockSkew by subtracting the clockSkew from the start time rather than incorporating it into the offset. The offset should be used to shift the buckets.

…ew calculation

MarcoPolo requested a review from marten-seemann October 17, 2022 18:46

MarcoPolo marked this pull request as draft October 17, 2022 19:05

MarcoPolo marked this pull request as ready for review October 17, 2022 19:47

marten-seemann reviewed Oct 18, 2022

View reviewed changes

marten-seemann changed the title ~~Use deterministic TLS certificates for webtransport~~ webtransport: use deterministic TLS certificates Oct 19, 2022

MarcoPolo force-pushed the marco/deterministic-certhashes branch from c387a22 to 92bcb04 Compare October 20, 2022 19:04

MarcoPolo marked this pull request as draft October 20, 2022 23:23

MarcoPolo marked this pull request as ready for review October 21, 2022 12:06

mxinden mentioned this pull request Oct 21, 2022

transports: Deterministic certificate generation libp2p/rust-libp2p#3049

Open

MarcoPolo commented Oct 22, 2022

View reviewed changes

marten-seemann reviewed Oct 22, 2022

View reviewed changes

marten-seemann mentioned this pull request Oct 31, 2022

go-libp2p v0.24 #1766

Closed

34 tasks

MarcoPolo force-pushed the marco/deterministic-certhashes branch from e7455e4 to e913a1b Compare October 31, 2022 22:21

MarcoPolo added 16 commits October 31, 2022 23:10

Use deterministic TLS certificates for webtransport

2cabe0d

Update test to work with buckets

b039a0f

Make sure to overlap and use a random offset

b9e79ba

Fixup mistaken change in other test

64f3ce3

Add QuickCheck tests for cert behavior

13b204a

Lint fix

f5cca71

Add more tests

7c6dce5

Add webtransport integration test

fce5ca5

Use same key

949cd48

Actually offset by at least clockSkew

461f0d1

Use seeded key for certs after reboot test

1d4ba6d

PR comments

ff2525e

Remove debug code

c4d856e

Fix calculation for cert having been valid

5e1c1df

Fixes the logic that a cert has been valid for a clockSkew by subtracting the clockSkew from the start time rather than incorporating it into the offset. The offset should be used to shift the buckets.

Update comment

afb9c97

Lint fix

ec9820a

MarcoPolo added 2 commits October 31, 2022 23:10

Update TestGetCurrentBucketStartTimeIsWithinBounds to include clockSk…

f40bb20

…ew calculation

Rebase fixes

3387eb7

MarcoPolo force-pushed the marco/deterministic-certhashes branch from e913a1b to 3387eb7 Compare October 31, 2022 23:14

MarcoPolo requested a review from marten-seemann November 1, 2022 12:55

marten-seemann approved these changes Nov 8, 2022

View reviewed changes

MarcoPolo merged commit a0432e7 into master Nov 14, 2022

mxinden mentioned this pull request Nov 22, 2023

feat: add WebTransport protocol libp2p/rust-libp2p#4874

Draft

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

webtransport: use deterministic TLS certificates #1833

webtransport: use deterministic TLS certificates #1833

MarcoPolo commented Oct 17, 2022 •

edited

marten-seemann Oct 18, 2022

MarcoPolo Oct 18, 2022 •

edited

marten-seemann Oct 18, 2022

marten-seemann Oct 18, 2022

MarcoPolo Oct 18, 2022

MarcoPolo Oct 21, 2022

marten-seemann Oct 22, 2022

MarcoPolo Oct 22, 2022

MarcoPolo Oct 22, 2022

marten-seemann Oct 22, 2022

MarcoPolo Oct 22, 2022

marten-seemann Oct 22, 2022

MarcoPolo Oct 31, 2022

marten-seemann Oct 22, 2022

marten-seemann Oct 22, 2022

MarcoPolo Oct 22, 2022

marten-seemann Oct 22, 2022

marten-seemann Oct 22, 2022

MarcoPolo Oct 22, 2022

marten-seemann commented Oct 23, 2022

webtransport: use deterministic TLS certificates #1833

webtransport: use deterministic TLS certificates #1833

Conversation

MarcoPolo commented Oct 17, 2022 • edited

Choose a reason for hiding this comment

MarcoPolo Oct 18, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marten-seemann commented Oct 23, 2022

MarcoPolo commented Oct 17, 2022 •

edited

MarcoPolo Oct 18, 2022 •

edited