[Innovation-Sprint/PM-19065] Add opaque authentication / unlock

crates/bitwarden-core/src/mobile/crypto_client.rs

@@ -1,6 +1,6 @@
-use bitwarden_crypto::CryptoError;
 #[cfg(feature = "internal")]
 use bitwarden_crypto::{AsymmetricEncString, EncString};
+use bitwarden_crypto::{CryptoError, SymmetricCryptoKey};
 
 use super::crypto::{
     derive_key_connector, make_key_pair, verify_asymmetric_keys, DeriveKeyConnectorError,
@@ -81,6 +81,56 @@ impl CryptoClient<'_> {
     ) -> Result<VerifyAsymmetricKeysResponse, CryptoError> {
         verify_asymmetric_keys(request)
     }
+
+    pub fn opaque_register_start(
+        &self,
+        password: &[u8],
+    ) -> Result<bitwarden_crypto::opaque_ke::RegistrationStartResult, bitwarden_crypto::OpaqueError>
+    {
+        bitwarden_crypto::opaque_ke::register_start(&password)
+    }
+
+    pub fn opaque_register_finish(
+        &self,
+        registration_start_state: &[u8],
+        registration_start_response: &[u8],
+        password: &[u8],
+        config: &bitwarden_crypto::opaque_ke::CipherConfiguration,
+        userkey: SymmetricCryptoKey,
+    ) -> Result<bitwarden_crypto::opaque_ke::RegistrationFinishResult, bitwarden_crypto::OpaqueError>
+    {
+        bitwarden_crypto::opaque_ke::register_finish(
+            registration_start_state,
+            registration_start_response,
+            password,
+            config,
+            userkey,
+        )
+    }
+
+    pub fn opaque_login_start(
+        &self,
+        password: &[u8],
+    ) -> Result<bitwarden_crypto::opaque_ke::LoginStartResult, bitwarden_crypto::OpaqueError> {
+        bitwarden_crypto::opaque_ke::login_start(password)
+    }
+
+    pub fn opaque_login_finish(
+        &self,
+        login_start_state: &[u8],
+        login_start_response: &[u8],
+        password: &[u8],
+        config: &bitwarden_crypto::opaque_ke::CipherConfiguration,
+        keyset: bitwarden_crypto::rotateable_keyset::RotateableKeyset,
+    ) -> Result<bitwarden_crypto::opaque_ke::LoginFinishResult, bitwarden_crypto::OpaqueError> {
+        bitwarden_crypto::opaque_ke::login_finish(
+            login_start_state,
+            login_start_response,
+            password,
+            config,
+            keyset,
+        )
+    }
 }
 
 impl<'a> Client {

crates/bitwarden-crypto/Cargo.toml

@@ -34,12 +34,14 @@ hkdf = ">=0.12.3, <0.13"
 hmac = ">=0.12.1, <0.13"
 num-bigint = ">=0.4, <0.5"
 num-traits = ">=0.2.15, <0.3"
+opaque-ke = "3.0.0"
 pbkdf2 = { version = ">=0.12.1, <0.13", default-features = false }
 rand = ">=0.8.5, <0.9"
 rayon = ">=1.8.1, <2.0"
 rsa = ">=0.9.2, <0.10"
 schemars = { workspace = true }
 serde = { workspace = true }
+serde_bytes = "0.11.17"
 sha1 = ">=0.10.5, <0.11"
 sha2 = ">=0.10.6, <0.11"
 subtle = ">=2.5.0, <3.0"

crates/bitwarden-crypto/src/error.rs

@@ -1,7 +1,10 @@
 use std::fmt::Debug;
 
 use bitwarden_error::bitwarden_error;
+use serde::{Deserialize, Serialize};
 use thiserror::Error;
+#[cfg(feature = "wasm")]
+use tsify_next::Tsify;
 use uuid::Uuid;
 
 use crate::fingerprint::FingerprintError;
@@ -87,3 +90,12 @@ pub enum RsaError {
 
 /// Alias for `Result<T, CryptoError>`.
 pub(crate) type Result<T, E = CryptoError> = std::result::Result<T, E>;
+
+#[derive(Debug, Error, Deserialize, Serialize)]
+#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
+pub enum OpaqueError {
+    #[error("Error creating message {0}")]
+    Message(String),
+    #[error("Error deserializing message")]
+    Deserialize,
+}

crates/bitwarden-crypto/src/keys/mod.rs

@@ -24,3 +24,4 @@ pub use kdf::{
     default_pbkdf2_iterations, Kdf,
 };
 mod utils;
+pub(crate) use utils::stretch_key;

crates/bitwarden-crypto/src/keys/utils.rs

@@ -8,7 +8,7 @@ use crate::{util::hkdf_expand, Result};
 /// Stretch the given key using HKDF.
 /// This can be either a kdf-derived key (PIN/Master password) or
 /// a random key from key connector
-pub(super) fn stretch_key(key: &Pin<Box<GenericArray<u8, U32>>>) -> Result<Aes256CbcHmacKey> {
+pub(crate) fn stretch_key(key: &Pin<Box<GenericArray<u8, U32>>>) -> Result<Aes256CbcHmacKey> {
     Ok(Aes256CbcHmacKey {
         enc_key: hkdf_expand(key, Some("enc"))?,
         mac_key: hkdf_expand(key, Some("mac"))?,

crates/bitwarden-crypto/src/lib.rs

@@ -76,8 +76,8 @@ mod aes;
 mod enc_string;
 pub use enc_string::{AsymmetricEncString, EncString};
 mod error;
-pub use error::CryptoError;
 pub(crate) use error::Result;
+pub use error::{CryptoError, OpaqueError};
 mod fingerprint;
 pub use fingerprint::fingerprint;
 mod keys;
@@ -93,6 +93,8 @@ pub use store::{KeyStore, KeyStoreContext};
 mod traits;
 pub use traits::{Decryptable, Encryptable, IdentifyKey, KeyId, KeyIds};
 pub use zeroizing_alloc::ZeroAlloc as ZeroizingAllocator;
+pub mod opaque_ke;
+pub mod rotateable_keyset;
 
 #[cfg(feature = "uniffi")]
 uniffi::setup_scaffolding!();