halkyon/packages/halkyon_keys/test/password_keys_test.dart

import 'dart:typed_data';

import 'package:halkyon_keys/halkyon_keys.dart';
import 'package:sodium/sodium_sumo.dart';
import 'package:test/test.dart';

Future<void> main() async {
  final sodium = await SodiumSumoInit.init();
  // Cheap costs for most tests; the production costs are checked once below.
  const cheap = PasswordKdf(opsLimit: 1, memLimit: 8192);
  final salt = Uint8List.fromList(List.generate(16, (i) => i));

  PasswordKeys keysOf(String password, {Uint8List? withSalt}) =>
      derivePasswordKeys(
        sodium,
        password: password,
        salt: withSalt ?? salt,
        kdf: cheap,
      );

  test('the same password and salt make the same keys, on any device', () {
    final first = keysOf('correct horse battery staple');
    final second = keysOf('correct horse battery staple');
    expect(first.srpPrivateValue, second.srpPrivateValue);
    expect(
      first.keyEncryptionKey.extractBytes(),
      second.keyEncryptionKey.extractBytes(),
    );
  });

  test('another password, or another salt, makes other keys', () {
    final keys = keysOf('correct horse battery staple');
    final otherPassword = keysOf('correct horse battery stapler');
    final otherSalt = keysOf(
      'correct horse battery staple',
      withSalt: Uint8List.fromList(List.generate(16, (i) => i + 1)),
    );
    for (final other in [otherPassword, otherSalt]) {
      expect(other.srpPrivateValue, isNot(keys.srpPrivateValue));
      expect(
        other.keyEncryptionKey.extractBytes(),
        isNot(keys.keyEncryptionKey.extractBytes()),
      );
    }
  });

  test("SRP's secret and the key-encryption key are unrelated halves", () {
    final keys = keysOf('a password');
    final srp = keys.srpSecret.extractBytes();
    expect(srp, hasLength(32));
    expect(keys.keyEncryptionKey.extractBytes(), hasLength(32));
    expect(keys.keyEncryptionKey.extractBytes(), isNot(srp));
    expect(keys.srpPrivateValue.bitLength, lessThanOrEqualTo(256));
    expect(keys.srpPrivateValue, greaterThan(BigInt.zero));
  });

  group("the password's proof key (Halkyon Learn's ADR 0020, D19)", () {
    test('is the same for the same password and salt, another for another '
        'password or salt', () {
      final keys = keysOf('correct horse battery staple');
      expect(
        keysOf('correct horse battery staple').proofPublicKey,
        keys.proofPublicKey,
      );
      expect(keys.proofPublicKey, hasLength(sodium.crypto.sign.publicKeyBytes));
      expect(
        keysOf('correct horse battery stapler').proofPublicKey,
        isNot(keys.proofPublicKey),
      );
      expect(
        keysOf(
          'correct horse battery staple',
          withSalt: Uint8List.fromList(List.generate(16, (i) => i + 1)),
        ).proofPublicKey,
        isNot(keys.proofPublicKey),
      );
    });

    test("is unrelated to SRP's secret and the key-encryption key, so "
        'neither the register nor a device holding the unwrapped keys can '
        'make it', () {
      final keys = keysOf('a password');
      final pair = keys.proofKeyPair();
      final seed = sodium.crypto.sign.skToSeed(pair.secretKey).extractBytes();
      expect(seed, hasLength(32));
      expect(seed, isNot(keys.srpSecret.extractBytes()));
      expect(seed, isNot(keys.keyEncryptionKey.extractBytes()));
      expect(
        pair.publicKey,
        isNot(AccountKeys.generate(sodium).signingPublicKey),
      );
      pair.secretKey.dispose();
    });

    test('signs what the register checks against its public half', () {
      final keys = keysOf('a password');
      final pair = keys.proofKeyPair();
      final message = Uint8List.fromList([1, 2, 3]);
      final signature = sodium.crypto.sign.detached(
        message: message,
        secretKey: pair.secretKey,
      );
      pair.secretKey.dispose();
      expect(
        sodium.crypto.sign.verifyDetached(
          message: message,
          signature: signature,
          publicKey: keys.proofPublicKey,
        ),
        isTrue,
      );
      expect(
        sodium.crypto.sign.verifyDetached(
          message: message,
          signature: signature,
          publicKey: keysOf('another password').proofPublicKey,
        ),
        isFalse,
      );
    });
  });

  test(
    'a salt of another length, as an instance might send one, is refused',
    () {
      for (final length in [0, 15, 17]) {
        expect(
          () => derivePasswordKeys(
            sodium,
            password: 'a password',
            salt: Uint8List(length),
            kdf: cheap,
          ),
          throwsA(
            isA<KeyRefused>().having(
              (refused) => refused.reason,
              'reason',
              KeyRefusal.malformed,
            ),
          ),
          reason: '$length',
        );
      }
    },
  );

  test('new salts are 16 random bytes', () {
    final first = newPasswordSalt(sodium);
    expect(first, hasLength(16));
    expect(newPasswordSalt(sodium), isNot(first));
  });

  test('new passwords cost 64 MiB and 3 passes, and that works', () {
    expect(PasswordKdf.current.memLimit, 64 * 1024 * 1024);
    expect(PasswordKdf.current.opsLimit, 3);
    // The floor is apart from what new passwords take, so raising the
    // latter never locks out an account made before.
    expect(PasswordKdf.minimum.memLimit, 64 * 1024 * 1024);
    expect(PasswordKdf.minimum.opsLimit, 3);
    expect(
      PasswordKdf.current.memLimit,
      greaterThanOrEqualTo(PasswordKdf.minimum.memLimit),
    );
    expect(
      PasswordKdf.current.opsLimit,
      greaterThanOrEqualTo(PasswordKdf.minimum.opsLimit),
    );
    final keys = derivePasswordKeys(
      sodium,
      password: 'a password',
      salt: salt,
    );
    expect(keys.srpPrivateValue, greaterThan(BigInt.zero));
    keys.dispose();
  });

  group('the costs kept with an account', () {
    test('the floor itself is read', () {
      final read = PasswordKdf.fromJson(PasswordKdf.minimum.toJson());
      expect(read.opsLimit, PasswordKdf.minimum.opsLimit);
      expect(read.memLimit, PasswordKdf.minimum.memLimit);
    });

    test("the ceiling itself is read: the register's own, 16 passes and "
        '1 GiB', () {
      final read = PasswordKdf.fromJson(PasswordKdf.maximum.toJson());
      expect(read.opsLimit, 16);
      expect(read.memLimit, 1024 * 1024 * 1024);
    });

    test('above the ceiling are refused: a register asking for more would '
        'make the device run out of memory, or time', () {
      for (final json in <Map<String, Object?>>[
        {'algorithm': 'argon2id13', 'opsLimit': 17, 'memLimit': 64 << 20},
        {'algorithm': 'argon2id13', 'opsLimit': 3, 'memLimit': (1 << 30) + 1},
        {'algorithm': 'argon2id13', 'opsLimit': 3, 'memLimit': 100 << 30},
      ]) {
        expect(
          () => PasswordKdf.fromJson(json),
          throwsA(
            isA<KeyRefused>().having(
              (refused) => refused.reason,
              'reason',
              KeyRefusal.excessivePasswordKdf,
            ),
          ),
          reason: '$json',
        );
      }
    });

    test('round-trip', () {
      const raised = PasswordKdf(opsLimit: 4, memLimit: 128 * 1024 * 1024);
      final json = raised.toJson();
      expect(json['algorithm'], 'argon2id13');
      final read = PasswordKdf.fromJson(json);
      expect(read.opsLimit, 4);
      expect(read.memLimit, 128 * 1024 * 1024);
    });

    test('below the floor, or of another algorithm, are refused: a register '
        "can't make guessing cheaper", () {
      for (final json in <Map<String, Object?>>[
        {'algorithm': 'argon2id13', 'opsLimit': 2, 'memLimit': 64 << 20},
        {'algorithm': 'argon2id13', 'opsLimit': 3, 'memLimit': 32 << 20},
        {'algorithm': 'argon2i13', 'opsLimit': 3, 'memLimit': 64 << 20},
        {'algorithm': 'argon2id13', 'opsLimit': '3', 'memLimit': 64 << 20},
        {},
      ]) {
        expect(
          () => PasswordKdf.fromJson(json),
          throwsA(
            isA<KeyRefused>().having(
              (refused) => refused.reason,
              'reason',
              KeyRefusal.weakPasswordKdf,
            ),
          ),
          reason: '$json',
        );
      }
    });
  });
}