fix(e2ee): verify HMAC in decryptByKeyMaterial (tampered media was silently accepted) (#224)

Co-authored-by: nezumi0627 <nezumi0627@users.noreply.github.com>

Author: nezumi0627

packages/linejs/base/e2ee/keymaterial_hmac.test.ts

@@ -0,0 +1,78 @@
+import { assert, assertEquals, assertRejects } from "@std/assert";
+import { Buffer } from "node:buffer";
+import { E2EE } from "./mod.ts";
+import { InternalError } from "../core/utils/error.ts";
+
+// `encryptByKeyMaterial` appends an HMAC-SHA256 of the ciphertext, but
+// `decryptByKeyMaterial` silently discarded those 32 bytes without ever
+// comparing them — tampered/corrupted media decrypted to garbage without
+// error.
+function makeE2EE() {
+	return new E2EE({
+		profile: { mid: "u-self" },
+		storage: {
+			get() {
+				return Promise.resolve(null);
+			},
+			set() {
+				return Promise.resolve();
+			},
+		},
+		getToType() {
+			return 0;
+		},
+		log() {},
+	} as never);
+}
+
+Deno.test("decryptByKeyMaterial round-trips and verifies the HMAC", async () => {
+	const e2ee = makeE2EE();
+	const raw = Buffer.from("secret media payload");
+
+	const { keyMaterial, encryptedData } = await e2ee.encryptByKeyMaterial(raw);
+	assertEquals(encryptedData.length, raw.length + 32);
+
+	const decrypted = await e2ee.decryptByKeyMaterial(
+		encryptedData,
+		keyMaterial,
+	);
+	assertEquals(decrypted.toString(), "secret media payload");
+});
+
+Deno.test("decryptByKeyMaterial rejects a tampered ciphertext", async () => {
+	const e2ee = makeE2EE();
+	const { keyMaterial, encryptedData } = await e2ee.encryptByKeyMaterial(
+		Buffer.from("secret media payload"),
+	);
+
+	const tampered = Buffer.from(encryptedData);
+	tampered[0] ^= 0x01;
+	await assertRejects(
+		() => e2ee.decryptByKeyMaterial(tampered, keyMaterial),
+		InternalError as never,
+		"HMAC verification failed",
+	);
+});
+
+Deno.test("decryptByKeyMaterial rejects a wrong keyMaterial", async () => {
+	const e2ee = makeE2EE();
+	const { encryptedData } = await e2ee.encryptByKeyMaterial(
+		Buffer.from("secret media payload"),
+	);
+
+	await assertRejects(
+		() => e2ee.decryptByKeyMaterial(encryptedData, Buffer.alloc(32, 7)),
+		InternalError as never,
+		"HMAC verification failed",
+	);
+});
+
+Deno.test("decryptByKeyMaterial rejects truncated input", async () => {
+	const e2ee = makeE2EE();
+	await assertRejects(
+		() => e2ee.decryptByKeyMaterial(Buffer.alloc(10), Buffer.alloc(32)),
+		InternalError as never,
+		"too short",
+	);
+	assert(true);
+});

packages/linejs/base/e2ee/mod.ts

@@ -1346,11 +1346,24 @@ export class E2EE {
 			keyMaterial = Buffer.from(keyMaterial, "base64");
 		}
 		const keys = await this.deriveKeyMaterial(keyMaterial);
-		return (await this.___decryptAESCTR(keys.encKey, keys.nonce, rawData))
-			.slice(
-				0,
-				-32,
+		if (rawData.length < 32) {
+			throw new InternalError(
+				"E2EEMediaError",
+				`encrypted data too short (${rawData.length} bytes) to contain HMAC`,
 			);
+		}
+		const encData = rawData.subarray(0, -32);
+		const sign = rawData.subarray(-32);
+		const expected = this.signData(encData, keys.macKey);
+		if (
+			!crypto.timingSafeEqual(sign, expected)
+		) {
+			throw new InternalError(
+				"E2EEMediaError",
+				"HMAC verification failed: ciphertext was tampered with or keyMaterial is wrong",
+			);
+		}
+		return await this.___decryptAESCTR(keys.encKey, keys.nonce, encData);
 	}
 
 	/**