refactor: take the blinded signing from libsession rather than porting it

session_util is libsession-util's Python binding. It covers the blinded key
pair, the blinded signature and the X25519 to Ed25519 map, which removes the
hand-rolled Ed25519 nonce construction and the field arithmetic behind it.

It ships as a deb rather than a wheel, so pip cannot reach it and a virtualenv
needs --system-site-packages. ban.py is run by hand from a checkout, so this
reaches no deployed job.

pynacl stays for the blinding factor, the two candidate blinded ids, and the
curve check. xed25519.pubkey maps any 32 bytes to a point-shaped result without
judging it, so that check is what rejects a Session ID mistyped out of a ticket
and it now has its own tests.

The blinded signature is no longer checked against a fixed vector: it is not
deterministic across implementations, because the nonce derivation is not part
of what a verifier checks. It is verified under the blinded pubkey instead,
which is what pysogs does with it.

Author: Bilb

README.md

@@ -622,13 +622,34 @@ yet. Deleting messages is the step that needs the blinded form — see
 ### Tests
 
 ```sh
+sudo apt install python3-session-util      # see "Dependencies" below
 pip install -r sogs_moderation/requirements.txt
 python -m unittest discover -s sogs_moderation -v
 ```
 
-The signing tests check our request signatures against the vectors pysogs publishes in
-its own `contrib/auth-example.py`, so a broken port of that construction fails here
-rather than at the server.
+The blinded signature is checked by verifying it under the blinded pubkey rather than
+against a fixed vector. A blinded signature is not deterministic across implementations,
+because the nonce derivation is not part of what a verifier checks, and pysogs accepts it
+as a plain Ed25519 signature under that pubkey. The unblinded signature is deterministic
+and is still checked against pysogs' published vector.
+
+### Dependencies
+
+The blinded request signatures come from `session_util`, libsession-util's Python
+binding. It is published as a deb rather than a wheel, so `pip` cannot reach it:
+
+```sh
+# https://deb.oxen.io has the repository setup
+sudo apt install python3-session-util
+```
+
+It is a compiled extension built per Python minor version, so a Python upgrade needs a
+matching package, and a virtualenv needs `--system-site-packages` to see it. This is why
+`ban.py` is run from a checkout by hand rather than deployed anywhere.
+
+pynacl stays for the blinding factor and the two candidate blinded ids, which the binding
+does not expose. [session-foundation/libsession-python#2](https://github.com/session-foundation/libsession-python/pull/2)
+adds `blind15_id`; until a release carries it, that derivation is ours.
 
 ## Workflow Failure Notificaiton
 

sogs_moderation/ban.py

@@ -61,6 +61,14 @@
 Which of the two blinded ids an account is stored under is not derivable (the sign is
 lost in blinding), so the deletion tries each in turn and the first non-404 answers.
 
+## Dependencies
+
+The blinded request signatures come from session_util, libsession-util's Python binding,
+which ships as a deb rather than a wheel: `apt install python3-session-util` from
+https://deb.oxen.io. It is compiled per Python minor version, so a virtualenv needs
+--system-site-packages. pynacl stays for the blinding factor and the two candidate
+blinded ids, which the binding does not expose.
+
 ## Configuration
 
 The server is SOGS_URL/SOGS_PUBKEY below, fixed in the script. This bans people from
@@ -98,21 +106,29 @@
 import sys
 import time
 from base64 import b64encode
-from hashlib import blake2b, sha512
+from hashlib import blake2b
 
 import nacl.bindings as sodium
 import requests
 from nacl.signing import SigningKey
 
+try:
+    from session_util import blinding, xed25519
+except ImportError as e:  # pragma: no cover - environment, not logic
+    raise SystemExit(
+        "session_util is missing. It is libsession-util's Python binding, and it is not on "
+        "PyPI — install it from the Session apt repository:\n"
+        "    https://deb.oxen.io\n"
+        "    sudo apt install python3-session-util\n"
+        "A virtualenv needs --system-site-packages to see it."
+    ) from e
+
 SESSION_ID_RE = re.compile(r'\A05[0-9a-fA-F]{64}\Z')
 
 # The server we moderate. Not configurable on purpose — see "Configuration" above.
 SOGS_URL = 'https://open.getsession.org'
 SOGS_PUBKEY = 'a03c383cf63c3c4efe67acc52112a6dd734b3a946b9545f488aaa93da7991238'
 
-# Curve25519 field order, for the u -> y birational map in ed25519_pubkey().
-FIELD_P = 2**255 - 19
-
 HTTP_TIMEOUT = 30
 
 
@@ -137,42 +153,13 @@ def __init__(self, sid, outcome, total_steps):
                          f"({label} -> {code}: {str(body)[:200]})")
 
 
-def sha512_parts(*parts):
-    hasher = sha512()
-    for part in parts:
-        if isinstance(part, (list, tuple)):
-            for p in part:
-                hasher.update(p)
-        else:
-            hasher.update(part)
-    return hasher.digest()
-
-
 def blinding_factor(server_pubkey: bytes) -> bytes:
     return sodium.crypto_core_ed25519_scalar_reduce(blake2b(server_pubkey, digest_size=64).digest())
 
 
-def blinded_keys(server_pubkey: bytes, signing_key: SigningKey):
-    """Returns (ka, kA): our blinded private scalar and blinded pubkey for this server."""
-    k = blinding_factor(server_pubkey)
-    # to_curve25519_private_key() is the sodium-supported way to get 'a', the Ed25519
-    # private scalar: the converted X25519 key is that same scalar.
-    a = signing_key.to_curve25519_private_key().encode()
-    ka = sodium.crypto_core_ed25519_scalar_mul(k, a)
-    return ka, sodium.crypto_scalarmult_ed25519_base_noclamp(ka)
-
-
-def blinded_signature(message_parts, signing_key: SigningKey, ka: bytes, kA: bytes) -> bytes:
-    """
-    Ed25519 signature under the blinded key, with kA mixed into the hash that yields r
-    so that different blinded pubkeys are domain separated. Verification is unaffected.
-    """
-    h_rh = sha512(signing_key.encode()).digest()[32:]
-    r = sodium.crypto_core_ed25519_scalar_reduce(sha512_parts(h_rh, kA, message_parts))
-    sig_r = sodium.crypto_scalarmult_ed25519_base_noclamp(r)
-    hram = sodium.crypto_core_ed25519_scalar_reduce(sha512_parts(sig_r, kA, message_parts))
-    sig_s = sodium.crypto_core_ed25519_scalar_add(r, sodium.crypto_core_ed25519_scalar_mul(hram, ka))
-    return sig_r + sig_s
+def blinded_pubkey(server_pubkey: bytes, signing_key: SigningKey) -> bytes:
+    """Our blinded (15) pubkey for this server: the id the server knows us by."""
+    return blinding.blind15_key_pair(signing_key.encode(), server_pubkey).pubkey
 
 
 def auth_headers(signing_key, server_pubkey, method, path, timestamp, nonce, body, blinded):
@@ -188,9 +175,8 @@ def auth_headers(signing_key, server_pubkey, method, path, timestamp, nonce, bod
         to_sign.append(blake2b(body, digest_size=64).digest())
 
     if blinded:
-        ka, kA = blinded_keys(server_pubkey, signing_key)
-        pubkey = '15' + kA.hex()
-        sig = blinded_signature(to_sign, signing_key, ka, kA)
+        pubkey = '15' + blinded_pubkey(server_pubkey, signing_key).hex()
+        sig = blinding.blind15_sign(signing_key.encode(), server_pubkey, b''.join(to_sign))
     else:
         pubkey = '00' + signing_key.verify_key.encode().hex()
         sig = signing_key.sign(b''.join(to_sign)).signature
@@ -215,8 +201,7 @@ def ed25519_pubkey(session_id: str) -> bytes:
     in blinded_ids() fails on a point that is not on the curve, and a Session ID
     mistyped out of a ticket is exactly how that happens.
     """
-    u = int.from_bytes(bytes.fromhex(session_id[2:]), 'little')
-    y = ((u - 1) * pow(u + 1, FIELD_P - 2, FIELD_P) % FIELD_P).to_bytes(32, 'little')
+    y = xed25519.pubkey(bytes.fromhex(session_id[2:]))
     if not sodium.crypto_core_ed25519_is_valid_point(y):
         raise SogsError(f"{session_id} is not a usable Session ID: not a valid public key")
     return y

sogs_moderation/requirements.txt

@@ -1,6 +1,14 @@
-# What ban.py needs. The suite is stdlib unittest and imports nothing else.
+# What ban.py needs from PyPI. The suite is stdlib unittest and imports nothing else.
 requests==2.32.3
 
-# Ed25519 signing and the scalar arithmetic the blinded request signatures are built
-# from (nacl.bindings). pysogs verifies those signatures with the same primitives.
+# The blinding factor and the two candidate blinded ids are still derived here: the
+# scalar arithmetic for those is not exposed by session_util yet.
 pynacl==1.6.2
+
+# NOT INSTALLABLE FROM HERE. The blinded request signatures come from session_util,
+# libsession-util's Python binding, which is published as a deb rather than a wheel:
+#
+#     https://deb.oxen.io   ->   sudo apt install python3-session-util
+#
+# It is a compiled extension built per Python minor version, so a virtualenv needs
+# --system-site-packages to see it.

sogs_moderation/test_ban.py

@@ -9,9 +9,12 @@
 import contextlib
 import io
 import unittest
+from base64 import b64decode
+from hashlib import blake2b
 from unittest import mock
 
-from nacl.signing import SigningKey
+from nacl.exceptions import BadSignatureError
+from nacl.signing import SigningKey, VerifyKey
 
 import ban
 
@@ -26,6 +29,15 @@
 BLINDED_NEG = '1598932d4bccbe595a8789d7eb1629cefc483a0eaddc7e20e8fe5c771efafd9af5'
 
 
+def signed_bytes(body=None):
+    """The exact bytes auth_headers signs, so a signature can be verified here."""
+    parts = [bytes.fromhex(SERVER_PUBKEY), bytes.fromhex(NONCE),
+             str(TIMESTAMP).encode(), b'GET', PATH.encode()]
+    if body:
+        parts.append(blake2b(body, digest_size=64).digest())
+    return b''.join(parts)
+
+
 def headers(blinded, body=None):
     return ban.auth_headers(
         SigningKey(bytes.fromhex(SEED)),
@@ -51,13 +63,24 @@ def test_unblinded(self):
         )
 
     def test_blinded(self):
+        """Checked by verification rather than against a fixed vector: a blinded signature
+        is not deterministic across implementations, because the nonce derivation is not
+        part of what a verifier checks. pysogs verifies it as a plain Ed25519 signature
+        under the blinded pubkey, so that is the property worth asserting."""
         h = headers(blinded=True)
         self.assertEqual(h['X-SOGS-Pubkey'], BLINDED_NEG)
-        self.assertEqual(
-            h['X-SOGS-Signature'],
-            'gYqpWZX6fnF4Gb2xQM3xaXs0WIYEI49+B8q4mUUEg8Rw0ObaHUWfoWjMHMArAtP9QlORfiydsKWz1o6zdPVeCQ==',
+        VerifyKey(bytes.fromhex(BLINDED_NEG[2:])).verify(
+            signed_bytes(), b64decode(h['X-SOGS-Signature'])
         )
 
+    def test_blinded_signature_is_rejected_under_the_wrong_key(self):
+        """Guards the check above: verify() must be capable of failing here."""
+        h = headers(blinded=True)
+        with self.assertRaises(BadSignatureError):
+            VerifyKey(bytes.fromhex(BLINDED_ABS[2:])).verify(
+                signed_bytes(), b64decode(h['X-SOGS-Signature'])
+            )
+
     def test_body_changes_the_signature(self):
         self.assertNotEqual(
             headers(blinded=True)['X-SOGS-Signature'],
@@ -74,9 +97,23 @@ def test_both_blinded_variants(self):
             ban.blinded_ids(SESSION_ID, bytes.fromhex(SERVER_PUBKEY)), (BLINDED_ABS, BLINDED_NEG)
         )
 
+    def test_hex_that_is_not_a_key_is_refused(self):
+        """xed25519.pubkey maps any 32 bytes to a point-shaped result without judging it,
+        so the curve check is the whole defence against a Session ID mistyped out of a
+        ticket. Both of these are the right shape and neither is a key."""
+        for bad in ('ff' * 32, '00' * 32):
+            with self.assertRaises(ban.SogsError):
+                ban.ed25519_pubkey('05' + bad)
+
+    def test_a_real_session_id_survives_that_check(self):
+        """Guards the test above: the check must not simply reject everything."""
+        self.assertEqual(len(ban.ed25519_pubkey(SESSION_ID)), 32)
+
     def test_the_signing_key_blinds_to_one_of_them(self):
-        """The key's own blinded pubkey must be one of the two we would look it up under."""
-        _, kA = ban.blinded_keys(bytes.fromhex(SERVER_PUBKEY), SigningKey(bytes.fromhex(SEED)))
+        """Ties the two together: libsession derives our own blinded pubkey, blinded_ids
+        derives the candidates for an account whose key we do not hold, and the first must
+        be one of the second or the two disagree about what this server calls us."""
+        kA = ban.blinded_pubkey(bytes.fromhex(SERVER_PUBKEY), SigningKey(bytes.fromhex(SEED)))
         self.assertIn('15' + kA.hex(), ban.blinded_ids(SESSION_ID, bytes.fromhex(SERVER_PUBKEY)))