|
|
|
@ -82,11 +82,11 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!derivedMaterial) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ missing derived service key.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ missing derived service key.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
if (derivedMaterial.length != kAES256_KeyByteLength * 2) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ derived service key has unexpected length.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ derived service key has unexpected length.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -94,7 +94,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
[derivedMaterial subdataWithRange:NSMakeRange(kAES256_KeyByteLength * 0, kAES256_KeyByteLength)];
|
|
|
|
|
OWSAES256Key *_Nullable clientKey = [OWSAES256Key keyWithData:clientKeyData];
|
|
|
|
|
if (!clientKey) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ clientKey has unexpected length.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ clientKey has unexpected length.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -102,7 +102,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
[derivedMaterial subdataWithRange:NSMakeRange(kAES256_KeyByteLength * 1, kAES256_KeyByteLength)];
|
|
|
|
|
OWSAES256Key *_Nullable serverKey = [OWSAES256Key keyWithData:serverKeyData];
|
|
|
|
|
if (!serverKey) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ serverKey has unexpected length.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ serverKey has unexpected length.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -172,7 +172,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
{
|
|
|
|
|
NSString *_Nullable valueString = self[key];
|
|
|
|
|
if (![valueString isKindOfClass:[NSString class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse string for key: %@", self.logTag, key);
|
|
|
|
|
OWSFail(@"%@ couldn't parse string for key: %@", self.logTag, key);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
return valueString;
|
|
|
|
@ -182,12 +182,12 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
{
|
|
|
|
|
NSString *_Nullable valueString = self[key];
|
|
|
|
|
if (![valueString isKindOfClass:[NSString class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse base 64 value for key: %@", self.logTag, key);
|
|
|
|
|
OWSFail(@"%@ couldn't parse base 64 value for key: %@", self.logTag, key);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable valueData = [[NSData alloc] initWithBase64EncodedString:valueString options:0];
|
|
|
|
|
if (!valueData) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't decode base 64 value for key: %@", self.logTag, key);
|
|
|
|
|
OWSFail(@"%@ couldn't decode base 64 value for key: %@", self.logTag, key);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
return valueData;
|
|
|
|
@ -197,11 +197,15 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
{
|
|
|
|
|
NSData *_Nullable valueData = [self base64DataForKey:key];
|
|
|
|
|
if (valueData && valueData.length != expectedLength) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ decoded base 64 value for key: %@, has unexpected length: %zd != %zd",
|
|
|
|
|
DDLogDebug(@"%@ decoded base 64 value for key: %@, has unexpected length: %zd != %zd",
|
|
|
|
|
self.logTag,
|
|
|
|
|
key,
|
|
|
|
|
valueData.length,
|
|
|
|
|
expectedLength);
|
|
|
|
|
OWSFail(@"%@ decoded base 64 value for key has unexpected length: %lu != %lu",
|
|
|
|
|
self.logTag,
|
|
|
|
|
(unsigned long)valueData.length,
|
|
|
|
|
(unsigned long)expectedLength);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
return valueData;
|
|
|
|
@ -292,13 +296,13 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
NSDictionary *responseDict = response;
|
|
|
|
|
NSString *_Nullable password = [responseDict stringForKey:@"password"];
|
|
|
|
|
if (password.length < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ missing or empty password.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ missing or empty password.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
NSString *_Nullable username = [responseDict stringForKey:@"username"];
|
|
|
|
|
if (username.length < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ missing or empty username.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ missing or empty username.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -359,14 +363,14 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
OWSAssert(enclaveId.length > 0);
|
|
|
|
|
|
|
|
|
|
if (![response isKindOfClass:[NSHTTPURLResponse class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ unexpected response type.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ unexpected response type.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
|
|
|
|
|
NSArray<NSHTTPCookie *> *cookies =
|
|
|
|
|
[NSHTTPCookie cookiesWithResponseHeaderFields:httpResponse.allHeaderFields forURL:[NSURL new]];
|
|
|
|
|
if (cookies.count < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse cookie.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse cookie.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -377,52 +381,52 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
NSData *_Nullable serverEphemeralPublic =
|
|
|
|
|
[responseDict base64DataForKey:@"serverEphemeralPublic" expectedLength:32];
|
|
|
|
|
if (!serverEphemeralPublic) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse serverEphemeralPublic.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse serverEphemeralPublic.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable serverStaticPublic = [responseDict base64DataForKey:@"serverStaticPublic" expectedLength:32];
|
|
|
|
|
if (!serverStaticPublic) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse serverStaticPublic.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse serverStaticPublic.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable encryptedRequestId = [responseDict base64DataForKey:@"ciphertext"];
|
|
|
|
|
if (!encryptedRequestId) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse encryptedRequestId.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse encryptedRequestId.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable encryptedRequestIv = [responseDict base64DataForKey:@"iv" expectedLength:12];
|
|
|
|
|
if (!encryptedRequestIv) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse encryptedRequestIv.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse encryptedRequestIv.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable encryptedRequestTag = [responseDict base64DataForKey:@"tag" expectedLength:16];
|
|
|
|
|
if (!encryptedRequestTag) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse encryptedRequestTag.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse encryptedRequestTag.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable quoteData = [responseDict base64DataForKey:@"quote"];
|
|
|
|
|
if (!quoteData) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse quote data.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse quote data.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSString *_Nullable signatureBody = [responseDict stringForKey:@"signatureBody"];
|
|
|
|
|
if (![signatureBody isKindOfClass:[NSString class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse signatureBody.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse signatureBody.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable signature = [responseDict base64DataForKey:@"signature"];
|
|
|
|
|
if (!signature) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse signature.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse signature.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSString *_Nullable encodedCertificates = [responseDict stringForKey:@"certificates"];
|
|
|
|
|
if (![encodedCertificates isKindOfClass:[NSString class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse encodedCertificates.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse encodedCertificates.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSString *_Nullable certificates = [encodedCertificates stringByRemovingPercentEncoding];
|
|
|
|
|
if (!certificates) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse certificates.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse certificates.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -430,13 +434,13 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
serverEphemeralPublic:serverEphemeralPublic
|
|
|
|
|
serverStaticPublic:serverStaticPublic];
|
|
|
|
|
if (!keys) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't derive keys.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't derive keys.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
CDSQuote *_Nullable quote = [CDSQuote parseQuoteFromData:quoteData];
|
|
|
|
|
if (!quote) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't parse quote.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't parse quote.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable requestId = [self decryptRequestId:encryptedRequestId
|
|
|
|
@ -444,12 +448,12 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
encryptedRequestTag:encryptedRequestTag
|
|
|
|
|
keys:keys];
|
|
|
|
|
if (!requestId) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't decrypt request id.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't decrypt request id.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (![self verifyServerQuote:quote keys:keys enclaveId:enclaveId]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't verify quote.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't verify quote.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -457,7 +461,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
signatureBody:signatureBody
|
|
|
|
|
signature:signature
|
|
|
|
|
quoteData:quoteData]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't verify ias signature.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't verify ias signature.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -485,43 +489,42 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
|
|
|
|
|
CDSSigningCertificate *_Nullable certificate = [CDSSigningCertificate parseCertificateFromPem:certificates];
|
|
|
|
|
if (!certificate) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signing certificate.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signing certificate.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
if (![certificate verifySignatureOfBody:signatureBody signature:signature]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not verify signature.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not verify signature.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SignatureBodyEntity *_Nullable signatureBodyEntity = [self parseSignatureBodyEntity:signatureBody];
|
|
|
|
|
if (!signatureBodyEntity) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature body.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signature body.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Compare the first N bytes of the quote data with the signed quote body.
|
|
|
|
|
const NSUInteger kQuoteBodyComparisonLength = 432;
|
|
|
|
|
if (signatureBodyEntity.isvEnclaveQuoteBody.length < kQuoteBodyComparisonLength) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ isvEnclaveQuoteBody has unexpected length.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ isvEnclaveQuoteBody has unexpected length.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
if (quoteData.length < kQuoteBodyComparisonLength) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ quoteData has unexpected length.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ quoteData has unexpected length.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
NSData *isvEnclaveQuoteBodyForComparison =
|
|
|
|
|
[signatureBodyEntity.isvEnclaveQuoteBody subdataWithRange:NSMakeRange(0, kQuoteBodyComparisonLength)];
|
|
|
|
|
NSData *quoteDataForComparison = [quoteData subdataWithRange:NSMakeRange(0, kQuoteBodyComparisonLength)];
|
|
|
|
|
if (![isvEnclaveQuoteBodyForComparison ows_constantTimeIsEqualToData:quoteDataForComparison]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ isvEnclaveQuoteBody and quoteData do not match.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ isvEnclaveQuoteBody and quoteData do not match.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// TODO: Before going to production, remove GROUP_OUT_OF_DATE.
|
|
|
|
|
if (![@"OK" isEqualToString:signatureBodyEntity.isvEnclaveQuoteStatus]
|
|
|
|
|
&& ![@"GROUP_OUT_OF_DATE" isEqualToString:signatureBodyEntity.isvEnclaveQuoteStatus]) {
|
|
|
|
|
OWSProdLogAndFail(
|
|
|
|
|
@"%@ invalid isvEnclaveQuoteStatus: %@.", self.logTag, signatureBodyEntity.isvEnclaveQuoteStatus);
|
|
|
|
|
OWSFail(@"%@ invalid isvEnclaveQuoteStatus: %@.", self.logTag, signatureBodyEntity.isvEnclaveQuoteStatus);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -531,7 +534,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
[dateFormatter setDateFormat:@"yyy-MM-dd'T'HH:mm:ss.SSSSSS"];
|
|
|
|
|
NSDate *timestampDate = [dateFormatter dateFromString:signatureBodyEntity.timestamp];
|
|
|
|
|
if (!timestampDate) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature body timestamp.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signature body timestamp.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -545,7 +548,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
BOOL isExpired = [now isAfterDate:timestampDatePlus1Day];
|
|
|
|
|
|
|
|
|
|
if (isExpired) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ Signature is expired.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ Signature is expired.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -562,22 +565,22 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
options:0
|
|
|
|
|
error:&error];
|
|
|
|
|
if (error || ![jsonDict isKindOfClass:[NSDictionary class]]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature body JSON: %@.", self.logTag, error);
|
|
|
|
|
OWSFail(@"%@ could not parse signature body JSON: %@.", self.logTag, error);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSString *_Nullable timestamp = [jsonDict stringForKey:@"timestamp"];
|
|
|
|
|
if (timestamp.length < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature timestamp.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signature timestamp.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable isvEnclaveQuoteBody = [jsonDict base64DataForKey:@"isvEnclaveQuoteBody"];
|
|
|
|
|
if (isvEnclaveQuoteBody.length < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature isvEnclaveQuoteBody.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signature isvEnclaveQuoteBody.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSString *_Nullable isvEnclaveQuoteStatus = [jsonDict stringForKey:@"isvEnclaveQuoteStatus"];
|
|
|
|
|
if (isvEnclaveQuoteStatus.length < 1) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not parse signature isvEnclaveQuoteStatus.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not parse signature isvEnclaveQuoteStatus.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -595,7 +598,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
OWSAssert(enclaveId.length > 0);
|
|
|
|
|
|
|
|
|
|
if (quote.reportData.length < keys.serverStaticPublic.length) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ reportData has unexpected length: %zd != %zd.",
|
|
|
|
|
OWSFail(@"%@ reportData has unexpected length: %zd != %zd.",
|
|
|
|
|
self.logTag,
|
|
|
|
|
quote.reportData.length,
|
|
|
|
|
keys.serverStaticPublic.length);
|
|
|
|
@ -605,11 +608,11 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
NSData *_Nullable theirServerPublicStatic =
|
|
|
|
|
[quote.reportData subdataWithRange:NSMakeRange(0, keys.serverStaticPublic.length)];
|
|
|
|
|
if (theirServerPublicStatic.length != keys.serverStaticPublic.length) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ could not extract server public static.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ could not extract server public static.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
if (![keys.serverStaticPublic ows_constantTimeIsEqualToData:theirServerPublicStatic]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ server public statics do not match.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ server public statics do not match.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
// It's easier to compare as hex data than parsing hexadecimal.
|
|
|
|
@ -618,12 +621,12 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
[quote.mrenclave.hexadecimalString dataUsingEncoding:NSUTF8StringEncoding];
|
|
|
|
|
if (!ourEnclaveIdHexData || !theirEnclaveIdHexData
|
|
|
|
|
|| ![ourEnclaveIdHexData ows_constantTimeIsEqualToData:theirEnclaveIdHexData]) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ enclave ids do not match.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ enclave ids do not match.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
// TODO: Reverse this condition in production.
|
|
|
|
|
if (!quote.isDebugQuote) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ quote has invalid isDebugQuote value.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ quote has invalid isDebugQuote value.", self.logTag);
|
|
|
|
|
return NO;
|
|
|
|
|
}
|
|
|
|
|
return YES;
|
|
|
|
@ -641,7 +644,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
|
|
|
|
|
OWSAES256Key *_Nullable key = keys.serverKey;
|
|
|
|
|
if (!key) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ invalid server key.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ invalid server key.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
NSData *_Nullable decryptedData = [Cryptography decryptAESGCMWithInitializationVector:encryptedRequestIv
|
|
|
|
@ -650,7 +653,7 @@ NS_ASSUME_NONNULL_BEGIN
|
|
|
|
|
authTag:encryptedRequestTag
|
|
|
|
|
key:key];
|
|
|
|
|
if (!decryptedData) {
|
|
|
|
|
OWSProdLogAndFail(@"%@ couldn't decrypt request id.", self.logTag);
|
|
|
|
|
OWSFail(@"%@ couldn't decrypt request id.", self.logTag);
|
|
|
|
|
return nil;
|
|
|
|
|
}
|
|
|
|
|
return decryptedData;
|
|
|
|
|