device/trezor: HF10 protocol upgrade

src/crypto/CMakeLists.txt

@@ -39,6 +39,7 @@ set(crypto_sources
   hash-extra-jh.c
   hash-extra-skein.c
   hash.c
+  hmac-keccak.c
   jh.c
   keccak.c
   oaes_lib.c
@@ -64,6 +65,7 @@ set(crypto_private_headers
   groestl_tables.h
   hash-ops.h
   hash.h
+  hmac-keccak.h
   initializer.h
   jh.h
   keccak.h

src/crypto/hmac-keccak.c

@@ -0,0 +1,81 @@
+// Copyright (c) 2014-2018, The Monero Project
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without modification, are
+// permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of
+//    conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list
+//    of conditions and the following disclaimer in the documentation and/or other
+//    materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be
+//    used to endorse or promote products derived from this software without specific
+//    prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "hmac-keccak.h"
+#include "memwipe.h"
+
+#define KECCAK_BLOCKLEN 136
+#define HASH_SIZE 32
+
+void hmac_keccak_init(hmac_keccak_state *S, const uint8_t *_key, size_t keylen) {
+  const uint8_t *key = _key;
+  uint8_t keyhash[HASH_SIZE];
+  uint8_t pad[KECCAK_BLOCKLEN];
+  uint64_t i;
+
+  if (keylen > KECCAK_BLOCKLEN) {
+    keccak(key, keylen, keyhash, HASH_SIZE);
+    key = keyhash;
+    keylen = HASH_SIZE;
+  }
+
+  keccak_init(&S->inner);
+  memset(pad, 0x36, KECCAK_BLOCKLEN);
+  for (i = 0; i < keylen; ++i) {
+    pad[i] ^= key[i];
+  }
+  keccak_update(&S->inner, pad, KECCAK_BLOCKLEN);
+
+  keccak_init(&S->outer);
+  memset(pad, 0x5c, KECCAK_BLOCKLEN);
+  for (i = 0; i < keylen; ++i) {
+    pad[i] ^= key[i];
+  }
+  keccak_update(&S->outer, pad, KECCAK_BLOCKLEN);
+
+  memwipe(keyhash, HASH_SIZE);
+}
+
+void hmac_keccak_update(hmac_keccak_state *S, const uint8_t *data, size_t datalen) {
+  keccak_update(&S->inner, data, datalen);
+}
+
+void hmac_keccak_finish(hmac_keccak_state *S, uint8_t *digest) {
+  uint8_t ihash[HASH_SIZE];
+  keccak_finish(&S->inner, ihash);
+  keccak_update(&S->outer, ihash, HASH_SIZE);
+  keccak_finish(&S->outer, digest);
+  memwipe(ihash, HASH_SIZE);
+}
+
+void hmac_keccak_hash(uint8_t *out, const uint8_t *key, size_t keylen, const uint8_t *in, size_t inlen) {
+  hmac_keccak_state S;
+  hmac_keccak_init(&S, key, keylen);
+  hmac_keccak_update(&S, in, inlen);
+  hmac_keccak_finish(&S, out);
+}

src/crypto/hmac-keccak.h

@@ -0,0 +1,59 @@
+// Copyright (c) 2014-2018, The Monero Project
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without modification, are
+// permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this list of
+//    conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list
+//    of conditions and the following disclaimer in the documentation and/or other
+//    materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its contributors may be
+//    used to endorse or promote products derived from this software without specific
+//    prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef HMAC_KECCAK_H
+#define HMAC_KECCAK_H
+
+#include "keccak.h"
+
+// HMAC RFC 2104 with Keccak-256 base hash function
+//
+// B = KECCAK_BLOCKLEN = 136 B
+// L = HASH_SIZE = 32 B
+//
+// Note this is not HMAC-SHA3 as SHA3 and Keccak differs in
+// the padding constant.
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+  KECCAK_CTX inner;
+  KECCAK_CTX outer;
+} hmac_keccak_state;
+
+void hmac_keccak_init(hmac_keccak_state *S, const uint8_t *_key, size_t keylen);
+void hmac_keccak_update(hmac_keccak_state *S, const uint8_t *data, size_t datalen);
+void hmac_keccak_finish(hmac_keccak_state *S, uint8_t *digest);
+void hmac_keccak_hash(uint8_t *out, const uint8_t *key, size_t keylen, const uint8_t *in, size_t inlen);
+
+#ifdef __cplusplus
+}
+#endif
+#endif //HMAC_KECCAK_H

src/cryptonote_basic/cryptonote_format_utils.cpp

@@ -282,6 +282,11 @@ namespace cryptonote
   //---------------------------------------------------------------
   bool generate_key_image_helper_precomp(const account_keys& ack, const crypto::public_key& out_key, const crypto::key_derivation& recv_derivation, size_t real_output_index, const subaddress_index& received_index, keypair& in_ephemeral, crypto::key_image& ki, hw::device &hwdev)
   {
+    if (hwdev.compute_key_image(ack, out_key, recv_derivation, real_output_index, received_index, in_ephemeral, ki))
+    {
+      return true;
+    }
+
     if (ack.m_spend_secret_key == crypto::null_skey)
     {
       // for watch-only wallet, simply copy the known output pubkey

src/device/device.hpp

@@ -70,6 +70,7 @@ namespace cryptonote
     struct account_keys;
     struct subaddress_index;
     struct tx_destination_entry;
+    struct keypair;
 }
 
 namespace hw {
@@ -81,11 +82,18 @@ namespace hw {
            return false;
     }
 
+    class device_progress {
+    public:
+      virtual double progress() const { return 0; }
+      virtual bool indeterminate() const { return false; }
+    };
+
     class i_device_callback {
     public:
-        virtual void on_button_request() {}
-        virtual void on_pin_request(epee::wipeable_string & pin) {}
-        virtual void on_passphrase_request(bool on_device, epee::wipeable_string & passphrase) {}
+        virtual void on_button_request(uint64_t code=0) {}
+        virtual boost::optional<epee::wipeable_string> on_pin_request() { return boost::none; }
+        virtual boost::optional<epee::wipeable_string> on_passphrase_request(bool on_device) { return boost::none; }
+        virtual void on_progress(const device_progress& event) {}
         virtual ~i_device_callback() = default;
     };
 
@@ -141,6 +149,9 @@ namespace hw {
         virtual void set_callback(i_device_callback * callback) {};
         virtual void set_derivation_path(const std::string &derivation_path) {};
 
+        virtual void set_pin(const epee::wipeable_string & pin) {}
+        virtual void set_passphrase(const epee::wipeable_string & passphrase) {}
+
         /* ======================================================================= */
         /*  LOCKER                                                                 */
         /* ======================================================================= */ 
@@ -229,7 +240,9 @@ namespace hw {
 
         virtual bool  has_ki_cold_sync(void) const { return false; }
         virtual bool  has_tx_cold_sign(void) const { return false; }
-
+        virtual bool  has_ki_live_refresh(void) const { return true; }
+        virtual bool  compute_key_image(const cryptonote::account_keys& ack, const crypto::public_key& out_key, const crypto::key_derivation& recv_derivation, size_t real_output_index, const cryptonote::subaddress_index& received_index, cryptonote::keypair& in_ephemeral, crypto::key_image& ki) { return false; }
+        virtual void  computing_key_images(bool started) {};
         virtual void  set_network_type(cryptonote::network_type network_type) { }
 
     protected:

src/device/device_cold.hpp

@@ -31,6 +31,7 @@
 #define MONERO_DEVICE_COLD_H
 
 #include "wallet/wallet2.h"
+#include <boost/optional/optional.hpp>
 #include <boost/function.hpp>
 
 
@@ -44,13 +45,62 @@ namespace hw {
   public:
     std::vector<std::string> tx_device_aux;  // device generated aux data
     std::vector<cryptonote::address_parse_info> tx_recipients;  // as entered by user
+    boost::optional<int> bp_version;  // BP version to use
+    boost::optional<unsigned> client_version;  // Signing client version to use (testing)
   };
 
   class device_cold {
   public:
 
     using exported_key_image = std::vector<std::pair<crypto::key_image, crypto::signature>>;
 
+    class op_progress : public hw::device_progress {
+    public:
+      op_progress():m_progress(0), m_indeterminate(false) {};
+      explicit op_progress(double progress, bool indeterminate=false): m_progress(progress), m_indeterminate(indeterminate){}
+
+      double progress() const override { return m_progress; }
+      bool indeterminate() const override { return m_indeterminate; }
+    protected:
+      double m_progress;
+      bool m_indeterminate;
+    };
+
+    class tx_progress : public op_progress {
+    public:
+      tx_progress():
+        m_cur_tx(0), m_max_tx(1),
+        m_cur_step(0), m_max_step(1),
+        m_cur_substep(0), m_max_substep(1){};
+
+      tx_progress(size_t cur_tx, size_t max_tx, size_t cur_step, size_t max_step, size_t cur_substep, size_t max_substep):
+        m_cur_tx(cur_tx), m_max_tx(max_tx),
+        m_cur_step(cur_tx), m_max_step(max_tx),
+        m_cur_substep(cur_tx), m_max_substep(max_tx){}
+
+      double progress() const override {
+        return std::max(1.0, (double)m_cur_tx / m_max_tx
+          + (double)m_cur_step / (m_max_tx * m_max_step)
+          + (double)m_cur_substep / (m_max_tx * m_max_step * m_max_substep));
+      }
+      bool indeterminate() const override { return false; }
+
+    protected:
+      size_t m_cur_tx;
+      size_t m_max_tx;
+      size_t m_cur_step;
+      size_t m_max_step;
+      size_t m_cur_substep;
+      size_t m_max_substep;
+    };
+
+    typedef struct {
+      std::string salt1;
+      std::string salt2;
+      std::string tx_enc_keys;
+      std::string tx_prefix_hash;
+    } tx_key_data_t;
+
     /**
      * Key image sync with the cold protocol.
      */
@@ -65,6 +115,52 @@ namespace hw {
                  const ::tools::wallet2::unsigned_tx_set & unsigned_tx,
                  ::tools::wallet2::signed_tx_set & signed_tx,
                  tx_aux_data & aux_data) =0;
+
+    /**
+     * Get tx key support check.
+     */
+    virtual bool is_get_tx_key_supported() const { return false; }
+
+    /**
+     * Loads TX aux data required for tx key.
+     */
+    virtual void load_tx_key_data(tx_key_data_t & res, const std::string & tx_aux_data) =0;
+
+    /**
+     * Decrypts TX keys.
+     */
+    virtual void get_tx_key(
+        std::vector<::crypto::secret_key> & tx_keys,
+        const tx_key_data_t & tx_aux_data,
+        const ::crypto::secret_key & view_key_priv) =0;
+
+    /**
+     * Live refresh support check
+     */
+    virtual bool is_live_refresh_supported() const { return false; };
+
+    /**
+     * Starts live refresh process with the device
+     */
+    virtual void live_refresh_start() =0;
+
+    /**
+     * One live refresh step
+     */
+    virtual void live_refresh(
+        const ::crypto::secret_key & view_key_priv,
+        const crypto::public_key& out_key,
+        const crypto::key_derivation& recv_derivation,
+        size_t real_output_index,
+        const cryptonote::subaddress_index& received_index,
+        cryptonote::keypair& in_ephemeral,
+        crypto::key_image& ki
+    ) =0;
+
+    /**
+     * Live refresh process termination
+     */
+    virtual void live_refresh_finish() =0;
   };
 }