Use token hash to encode private metadata for Trust Token Experiment V1. Bug: 328 Change-Id: Iaf3ff1bbe2f21c622b974081281848c60a01f142 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40764 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/include/openssl/trust_token.h b/include/openssl/trust_token.h index 4945172..a73a868 100644 --- a/include/openssl/trust_token.h +++ b/include/openssl/trust_token.h
@@ -230,15 +230,13 @@ // buffer and must call |OPENSSL_free| when done. It returns one on success or // zero on error. // -// The caller must keep track of all values of |*out_token| and -// |*out_client_data| and seen globally before returning the SRR to the client. -// If either value has been repeated, the caller must discard the SRR and report -// an error to the caller. Returning an SRR with replayed values allows an -// attacker to double-spend tokens and query private metadata bits in SRRs. +// The caller must keep track of all values of |*out_token| seen globally before +// returning the SRR to the client. If the value has been reused, the caller +// must discard the SRR and report an error to the caller. Returning an SRR with +// replayed values allows an attacker to double-spend tokens. // -// TODO(svaldez): The private metadata bit should not be leaked on replay. This -// means callers cannot use eventual consistency to trade off double-spending -// and distributed system performance. See https://crbug.com/boringssl/328. +// The private metadata construction in |TRUST_TOKEN_experiment_v0| does not +// keep the value secret and should not be used when secrecy is required. OPENSSL_EXPORT int TRUST_TOKEN_ISSUER_redeem( const TRUST_TOKEN_ISSUER *ctx, uint8_t **out, size_t *out_len, TRUST_TOKEN **out_token, uint8_t **out_client_data, @@ -247,12 +245,14 @@ // TRUST_TOKEN_decode_private_metadata decodes |encrypted_bit| using the // private metadata key specified by a |key| buffer of length |key_len| and the -// client data specified by a |client_data| buffer of length |client_data_len|. -// |*out_value is set to the decrypted value, either zero or one. It returns one -// on success and zero on error. +// nonce by a |nonce| buffer of length |nonce_len|. The nonce in +// |TRUST_TOKEN_experiment_v0| is the client-data field of the SRR. The nonce in +// |TRUST_TOKEN_experiment_v1| is the token-hash field of the SRR. |*out_value| +// is set to the decrypted value, either zero or one. It returns one on success +// and zero on error. OPENSSL_EXPORT int TRUST_TOKEN_decode_private_metadata( const TRUST_TOKEN_METHOD *method, uint8_t *out_value, const uint8_t *key, - size_t key_len, const uint8_t *client_data, size_t client_data_len, + size_t key_len, const uint8_t *nonce, size_t nonce_len, uint8_t encrypted_bit);