Add crypto-refresh (RFC 9580) content key packet for file uploads

Proton Drive's new file-content format uses a v6 PKESK content key packet and
a v2 SEIPD (AES-256-GCM) data packet. Generate the content session key with an
RFC 9580 + AES-GCM handle (protonDrivePGP) so it carries the v6 flag, and
encrypt the content key packet to the (v6) file node key with the same handle,
producing a v6 PKESK.

Name, passphrase and xattr encryption are left unchanged (they stay non-AEAD).

Author: ncw

crypto_v3_compat.go

@@ -14,10 +14,36 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/ProtonMail/gopenpgp/v3/armor"
 	"github.com/ProtonMail/gopenpgp/v3/crypto"
+	"github.com/ProtonMail/gopenpgp/v3/profile"
 )
 
+// protonDrivePGP returns a gopenpgp handle configured for Proton Drive's
+// crypto-refresh (RFC 9580) file-content format: a v6 key packet (PKESK) and a
+// v2 SEIPD data packet using AES-256-GCM. The RFC9580 profile defaults the AEAD
+// mode to OCB, so we override it to GCM (the mode Proton Drive requires).
+//
+// A session key generated from this handle carries the v6 flag, which selects
+// the v6 PKESK when the session key is encrypted to the (v6) file node key, and
+// the v2 SEIPD when it later encrypts the file blocks.
+func protonDrivePGP() *crypto.PGPHandle {
+	p := profile.RFC9580()
+	p.AeadEncryption = &packet.AEADConfig{DefaultMode: packet.AEADModeGCM}
+	return crypto.PGPWithProfile(p)
+}
+
+// encryptContentKeyPacket wraps a Proton Drive content session key into a v6
+// PKESK key packet for the given recipient (node) keyring.
+func encryptContentKeyPacket(kr *crypto.KeyRing, sk *crypto.SessionKey) ([]byte, error) {
+	eh, err := protonDrivePGP().Encryption().Recipients(kr).New()
+	if err != nil {
+		return nil, err
+	}
+	return eh.EncryptSessionKey(sk)
+}
+
 // serverTimeUnix stores the most recently observed server Unix time, sampled
 // from the Date response header. v2 used a global crypto.UpdateTime for this
 // purpose; v3 has no global clock, so we track it ourselves and pass it into

link_file_types.go

@@ -112,12 +112,15 @@ func (createFileReq *CreateFileReq) SetHash(name string, hashKey []byte) error {
 }
 
 func (createFileReq *CreateFileReq) SetContentKeyPacketAndSignature(kr *crypto.KeyRing) (*crypto.SessionKey, error) {
-	newSessionKey, err := crypto.PGP().GenerateSessionKey()
+	// Generate the content session key with the crypto-refresh handle so it
+	// carries the v6 flag; this is what makes the content key packet a v6
+	// PKESK and the file data blocks v2 SEIPD (see protonDrivePGP).
+	newSessionKey, err := protonDrivePGP().GenerateSessionKey()
 	if err != nil {
 		return nil, err
 	}
 
-	encSessionKey, err := encryptSessionKey(kr, newSessionKey)
+	encSessionKey, err := encryptContentKeyPacket(kr, newSessionKey)
 	if err != nil {
 		return nil, err
 	}