Harden and fix privacypass implementation

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
         run: |
           cmake -B build \
             -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} \
+            -DOPENSSL_ROOT_DIR="$(brew --prefix openssl@3)" \
             -DPRIVACY_PASS_BUILD_TESTS=ON \
             -DPRIVACY_PASS_BUILD_BENCHMARKS=ON \
             -DPRIVACY_PASS_BUILD_MOQ=ON

.gitignore

@@ -1,5 +1,6 @@
 # Build directories
 build/
+build-examples/
 cmake-build-*/
 
 # IDE

CMakeLists.txt

@@ -29,7 +29,7 @@ function(privacy_pass_set_warnings target)
 endfunction()
 
 # Dependencies
-find_package(OpenSSL REQUIRED)
+find_package(OpenSSL 3.0 REQUIRED)
 
 include(FetchContent)
 
@@ -58,6 +58,14 @@ if(PRIVACY_PASS_BUILD_TESTS)
         GIT_TAG v2.4.12
     )
     FetchContent_MakeAvailable(doctest)
+
+    set(JSON_BuildTests OFF CACHE INTERNAL "")
+    FetchContent_Declare(
+        nlohmann_json
+        GIT_REPOSITORY https://github.com/nlohmann/json.git
+        GIT_TAG v3.11.3
+    )
+    FetchContent_MakeAvailable(nlohmann_json)
 endif()
 
 # Fetch Google Benchmark if building benchmarks
@@ -244,6 +252,10 @@ if(PRIVACY_PASS_BUILD_TESTS)
     target_link_libraries(privacy_pass_tests PRIVATE
         privacy_pass
         doctest::doctest
+        nlohmann_json::nlohmann_json
+    )
+    target_compile_definitions(privacy_pass_tests PRIVATE
+        PRIVACY_PASS_TEST_DATA_DIR="${CMAKE_CURRENT_SOURCE_DIR}/tests/test_data"
     )
     if(PRIVACY_PASS_BUILD_MOQ)
         target_link_libraries(privacy_pass_tests PRIVATE privacy_pass_moq)

README.md

@@ -10,13 +10,13 @@
 | macOS | [![macOS](https://github.com/Quicr/privacypass-cpp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Quicr/privacypass-cpp/actions/workflows/ci.yml?query=branch%3Amain) |
 | Windows | [![Windows](https://github.com/Quicr/privacypass-cpp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Quicr/privacypass-cpp/actions/workflows/ci.yml?query=branch%3Amain) |
 
-C++ implementation of the Privacy Pass protocol (RFC 9576-9578) with optional MOQ extension support.
+C++ implementation of the Privacy Pass protocol ([RFC9576](https://datatracker.ietf.org/doc/html/rfc9576), [RFC9577](https://datatracker.ietf.org/doc/html/rfc9577), [RFC9578](https://datatracker.ietf.org/doc/html/rfc9578)) with optional MOQ extension ([draft-ietf-moq-privacy-pass-auth-02](https://datatracker.ietf.org/doc/html/draft-ietf-moq-privacy-pass-auth-02)) support.
 
 ## Features
 
 - Blind RSA (Token Type 0x0002) and VOPRF P-384 (Token Type 0x0001)
 - Token challenges, requests, responses, and redemption
-- Optional MOQ extension (draft-ietf-moq-privacy-pass-auth)
+- Optional MOQ extension ([draft-ietf-moq-privacy-pass-auth-02](https://datatracker.ietf.org/doc/html/draft-ietf-moq-privacy-pass-auth-02))
 - Modern C++23 with `std::expected` error handling
 
 ## Building

examples/moq_client.cpp

@@ -29,7 +29,7 @@ void print_hex(const std::string& label, ByteView data, size_t max_bytes = 16) {
 // Example MOQ Client built on TokenProvider
 class MoqClient {
 public:
-    MoqClient() : provider_(TokenProviderConfig{.max_cached_tokens = 10}) {}
+    MoqClient() : provider_(TokenProviderConfig{.max_cached_tokens = 10, .origin_name = "origin.example.com"}) {}
 
     void add_issuer(const std::string& name, const PublicKey& key) {
         provider_.add_issuer_key(name, key);

include/privacy_pass/core/serialization.hpp

@@ -298,6 +298,7 @@ class ByteWriter {
 namespace base64url {
 
 [[nodiscard]] std::string encode(ByteView data);
+[[nodiscard]] std::string encode_padded(ByteView data);
 [[nodiscard]] Result<Bytes> decode(std::string_view encoded);
 
 }  // namespace base64url

include/privacy_pass/core/token_provider.hpp

@@ -13,6 +13,7 @@
 #include <functional>
 #include <memory>
 #include <optional>
+#include <string>
 
 namespace privacy_pass {
 
@@ -28,6 +29,7 @@ struct TokenProviderConfig {
     size_t max_cached_tokens{100};
     std::chrono::seconds token_prefetch_threshold{60};
     bool allow_token_reuse{false};  // For testing only
+    std::string origin_name;
 };
 
 // Callback for async token fetching

include/privacy_pass/core/token_request.hpp

@@ -14,7 +14,7 @@ namespace privacy_pass {
 struct TokenRequest {
     TokenType token_type;
     uint8_t truncated_token_key_id;  // LSB of full key ID
-    Bytes blinded_msg;               // Nk bytes for RSA, 97 bytes for VOPRF P-384
+    Bytes blinded_msg;               // Nk bytes for RSA, 49 bytes for VOPRF P-384
 
     // Create a token request
     static TokenRequest create(

include/privacy_pass/core/token_response.hpp

@@ -22,7 +22,7 @@ struct BlindRsaTokenResponse {
 
 // VOPRF token response (P-384)
 struct VoprfTokenResponse {
-    Bytes evaluate_msg;   // Ne = 97 bytes (compressed P-384 point)
+    Bytes evaluate_msg;   // Ne = 49 bytes (compressed P-384 point)
     Bytes evaluate_proof; // 2*Ns = 96 bytes (DLEQ proof)
 
     [[nodiscard]] Result<Bytes> serialize() const;

include/privacy_pass/core/types.hpp

@@ -100,7 +100,7 @@ struct TokenTypeInfo {
     static constexpr TokenTypeInfo for_type(TokenType t) noexcept {
         switch (t) {
             case TokenType::VOPRF_P384_SHA384:
-                return {t, 48, 32, 97, false};
+                return {t, 48, 32, 49, false};
             case TokenType::BLIND_RSA:
                 return {t, 256, 32, 256, true};
             case TokenType::VOPRF_RISTRETTO255_SHA512:

include/privacy_pass/crypto/voprf.hpp

@@ -12,7 +12,7 @@ namespace privacy_pass::crypto {
 // Supports P-384 with SHA-384
 
 // P-384 constants
-constexpr size_t P384_ELEMENT_SIZE = 97;   // Uncompressed point (1 + 48 + 48)
+constexpr size_t P384_ELEMENT_SIZE = 49;   // Compressed point (1 + 48)
 constexpr size_t P384_SCALAR_SIZE = 48;
 constexpr size_t P384_OUTPUT_SIZE = 48;
 constexpr size_t P384_PROOF_SIZE = 96;     // 2 * scalar size

include/privacy_pass/http/auth_scheme.hpp

@@ -9,13 +9,14 @@
 
 #include <optional>
 #include <string>
+#include <vector>
 
 namespace privacy_pass::http {
 
 // WWW-Authenticate header parameters
 struct ChallengeHeader {
     std::string challenge;      // Base64url-encoded TokenChallenge
-    std::string token_key;      // Base64url-encoded issuer public key
+    std::optional<std::string> token_key;  // Base64url-encoded issuer public key
     std::optional<uint32_t> max_age;  // Optional max-age in seconds
 
     // Format as WWW-Authenticate header value
@@ -24,6 +25,9 @@ struct ChallengeHeader {
     // Parse from WWW-Authenticate header value
     [[nodiscard]] static Result<ChallengeHeader> parse(std::string_view header);
 
+    // Parse all PrivateToken challenges from a WWW-Authenticate header value
+    [[nodiscard]] static Result<std::vector<ChallengeHeader>> parse_all(std::string_view header);
+
     // Decode the challenge
     [[nodiscard]] Result<TokenChallenge> decode_challenge() const;
 

justfile

@@ -1,7 +1,5 @@
 # Privacy Pass C++ - Build Commands
 
-set shell := ["zsh", "-cu"]
-
 default:
     @just --list
 
@@ -57,7 +55,7 @@ format-check:
 
 # Static analysis
 lint:
-    clang-tidy src/**/*.cpp -- -I include -std=c++20
+    find src -name '*.cpp' -exec clang-tidy {} -- -I include -std=c++23 \;
 
 # Generate compile_commands.json for IDE support
 compile-commands: configure

src/core/origin.cpp

@@ -442,11 +442,8 @@ Result<bool> Origin::verify(
                 "No RSA keys configured"});
 
         case TokenType::VOPRF_P384_SHA384:
-            if (impl_->private_origin) {
-                return impl_->private_origin->validate_structure(token, expected_challenge);
-            }
-            return std::unexpected(Error{ErrorCode::ISSUER_UNKNOWN,
-                "No VOPRF keys configured"});
+            return std::unexpected(Error{ErrorCode::UNSUPPORTED_TOKEN_TYPE,
+                "VOPRF tokens require issuer private-key verification"});
 
         default:
             return std::unexpected(Error{ErrorCode::UNSUPPORTED_TOKEN_TYPE,

src/core/serialization.cpp

@@ -71,14 +71,28 @@ std::string encode(ByteView data) {
     return result;
 }
 
+std::string encode_padded(ByteView data) {
+    std::string result = encode(data);
+    while ((result.size() % 4) != 0) {
+        result.push_back('=');
+    }
+    return result;
+}
+
 Result<Bytes> decode(std::string_view encoded) {
     if (encoded.empty()) {
         return Bytes{};
     }
 
-    // Remove padding if present
+    size_t padding = 0;
     while (!encoded.empty() && encoded.back() == '=') {
         encoded.remove_suffix(1);
+        ++padding;
+    }
+
+    if (padding > 2 || encoded.find('=') != std::string_view::npos || encoded.size() % 4 == 1) {
+        return std::unexpected(Error{ErrorCode::INVALID_BASE64,
+            "Invalid base64url padding"});
     }
 
     if (encoded.empty()) {

src/core/token.cpp

@@ -152,6 +152,10 @@ Result<Token> Token::deserialize(ByteView data) {
     }
     token.authenticator.assign(auth->begin(), auth->end());
 
+    if (!reader.empty()) {
+        return std::unexpected(Error{ErrorCode::MALFORMED_DATA, "Trailing Token data"});
+    }
+
     return token;
 }