HKDF for a Java userspace implementation?

HKDF for a Java userspace implementation?

[crasm]

Hello,

I've started tinkering with a Java implementation of wireguard. I'm in
the early stages: the current goal is to be able to build the first
message using hardcoded parameters. I'm new to crypto and doing this
mainly for fun, curiosity, and to have wireguard on my phone.

I'm stuck on calculating the HMAC-BLAKE2s. Specifically,

    Hmac(key, input):
        Hmac-Blake2s(key, input), the ordinary BLAKE2s hash function
        used in an HMAC construction, returning 32 bytes of output.

Is there an existing library that does HKDF with BLAKE2s? Am I supposed
to write the HMAC construction myself using RFC5869 and the cited HKDF
paper [1]?

noise-java [2] can do regular BLAKE2s hashes (and I'm using that part),
but it doesn't include HMAC. Is there anything in libsodium [3] that can
help? Can someone with Java crypto experience point me in the right
direction?

Lastly, has someone already done this so I can get started on the
Android app instead? ;)

--
Christian Demsar

[1]: https://eprint.iacr.org/2010/264.pdf
[2]: https://rweather.github.io/noise-java/index.html
[3]: https://download.libsodium.org/doc/key_derivation/

Re: HKDF for a Java userspace implementation?

[Jason A. Donenfeld]

Hey Christian,

If you're already using noise-java, then that library should take care
of all the HMAC/HKDF stuff for you. WireGuard builds upon the NoseIK
handshake, and the aspects that WireGuard adds on top of Noise not
require HKDF or HMAC. You should not be implementing the internal
mechanisms of the Noise handshake yourself, if you're using the
noise-java library. Instead you should be able to specify to it, "I
would like to use NoiseIK", and then you'll get functions for
generating and receiving the first handshake message and the second
handshake message. Specifically, the two WireGuard handshake messages
are:

msg1 = handshake_initiation {
    u8 message_type
    u8 reserved_zero[3]
    u32 sender_index
    u8 unencryped_ephemeral[32]
    u8 encrypted_static[AEAD_LEN(32)]
    u8 encrypted_timestamp[AEAD_LEN(12)]
    u8 mac1[16]
    u8 mac2[16]
}

msg2 = handshake_response {
    u8 message_type
    u8 reserved_zero[3]
    u32 sender_index
    u32 receiver_index
    u8 unencrypted_ephemeral[32]
    u8 encrypted_nothing[AEAD_LEN(0)]
    u8 mac1[16]
    u8 mac2[16]
}

In these you use the noise-java library generate the values
{unencryped_ephemeral, encrypted_static, encrypted_timestamp} and
{unencrypted_ephemeral, encrypted_nothing}, likely as one solid
contiguous byte[] blob, where encrypted_timestamp is that handshake
message's payload containing the TAI64N 12 byte timestamp (you pass
the timestamp to the 'generate' function as the 'payload'), and where
encrypted_nothing is that handshake message's payload containing
nothing (but still with the result containing the noise-java generated
auth tag).

The wireguard.io/protocol/ page and the white paper try to describe
the WireGuard protocol from the fundamentals. In the coming days, I
think I'll add some documentation for building a WireGuard protocol
implementation out of an existing Noise implementation.

Feel free to find me on Freenode -- I'm zx2c4 -- and I'm happy to give
you some pointers or walk you through the implementation.

Looking forward to seeing what you come up with!

Regards,
Jason