Migration services: Difference between revisions

Line 849:

Data specific to each message follows.

Messages are encrypted with AES-128-GCM (excluding the [[#KeyExchange|KeyExchange]] messages). The key is derived during the messsage-handling for KeyExchange. The 0xC-byte nonce is the 0x8-bytes derived by [[#KeyExchange|KeyExchange]], followed by a big-endian u32 counter (starting at 0x0). This counter is incremented each time a message is encrypted/decrypted.

Messages are encrypted with AES-128-GCM (excluding the [[#KeyExchange|KeyExchange]] messages). The key is derived during the messsage-handling for KeyExchange. The 0xC-byte nonce is the 0x8-bytes derived by [[#KeyExchange|KeyExchange]], followed by a big-endian u32 counter (starting at 0x0). This counter is incremented each time a message is encrypted/decrypted. The GCM AAD is not used.

The message size must match the expected fixed-size for the MessageId.

Offsets in the below sections are relative to header+0.

Offsets in the below sections are relative to header+0 (for encrypted messages, this is the plaintext payload instead).

Message requests are sent by the client to the server, then (unless noted otherwise) a response with the same MessageId is sent to the client from the server. The first sent request is [[#KeyExchange|KeyExchange]].

For GCM encrypted messages, the encrypted data starts at +0x8, with the 0x10-byte AES-128-GCM MAC tag immediately afterwards. The first 0xC-bytes of plaintext is the nonce (which must match the expected one during decryption), followed by the payload (can be empty).

{| class="wikitable" border="1"

Line 862:

Line 864:

|-

| 0x0 || [[#KeyExchange|KeyExchange]]

|-

| 0x1 || [[#Initialize|Initialize]]

|}

Line 905:

Line 909:

PBKDF2-HMAC-SHA256 is used with the first 0x28-bytes of the above plaintext as the passphrase, a 0x20-byte salt from fixed global data, iterations=1000, and i=1. The first 0x10-bytes of the output HMAC then used as the AES-128-GCM key for later messages. The following 0x8-bytes is used as the first 0x8-bytes of the nonce.

=== Initialize ===

This request is sent after [[#KeyExchange|KeyExchange]].

Plaintext request payload:

{...}

The plaintext response payload is empty.

= Notes =

@@ Line 849: / Line 849: @@
 Data specific to each message follows.
-Messages are encrypted with AES-128-GCM (excluding the [[#KeyExchange|KeyExchange]] messages). The key is derived during the messsage-handling for KeyExchange. The 0xC-byte nonce is the 0x8-bytes derived by [[#KeyExchange|KeyExchange]], followed by a big-endian u32 counter (starting at 0x0). This counter is incremented each time a message is encrypted/decrypted.
+Messages are encrypted with AES-128-GCM (excluding the [[#KeyExchange|KeyExchange]] messages). The key is derived during the messsage-handling for KeyExchange. The 0xC-byte nonce is the 0x8-bytes derived by [[#KeyExchange|KeyExchange]], followed by a big-endian u32 counter (starting at 0x0). This counter is incremented each time a message is encrypted/decrypted. The GCM AAD is not used.
 The message size must match the expected fixed-size for the MessageId.
-Offsets in the below sections are relative to header+0.
+Offsets in the below sections are relative to header+0 (for encrypted messages, this is the plaintext payload instead).
 Message requests are sent by the client to the server, then (unless noted otherwise) a response with the same MessageId is sent to the client from the server. The first sent request is [[#KeyExchange|KeyExchange]].
+For GCM encrypted messages, the encrypted data starts at +0x8, with the 0x10-byte AES-128-GCM MAC tag immediately afterwards. The first 0xC-bytes of plaintext is the nonce (which must match the expected one during decryption), followed by the payload (can be empty).
 {| class="wikitable" border="1"
@@ Line 862: / Line 864: @@
 |-
 | 0x0 || [[#KeyExchange|KeyExchange]]
+|-
+| 0x1 || [[#Initialize|Initialize]]
 |}
@@ Line 905: / Line 909: @@
 PBKDF2-HMAC-SHA256 is used with the first 0x28-bytes of the above plaintext as the passphrase, a 0x20-byte salt from fixed global data, iterations=1000, and i=1. The first 0x10-bytes of the output HMAC then used as the AES-128-GCM key for later messages. The following 0x8-bytes is used as the first 0x8-bytes of the nonce.
+=== Initialize ===
+This request is sent after [[#KeyExchange|KeyExchange]].
+Plaintext request payload:
+{...}
+The plaintext response payload is empty.
 = Notes =