Privatebin plugin by rfc2119 · Pull Request #153 · bbriggs/bitbot

rfc2119 · 2020-04-01T13:52:51Z

This is still a WIP. The following is a "draft" for me of what I have found and should be doing in the plugin. This implements #135

usage and scenario

create a new paste
/msg bitbot !paste <content>
delete a paste
/msg bitbot !paste --delete <delete_token>

see sample for sample server-side configuration file for privatebin (and for more ideas, like url-shortner)

the following sequence diagram represents the creation of a new paste:

encryption format

from here; the following request was sent with key 7MqznSyqHVx9VwNWfHRi6PLsr322eBY4Fnkx45tFV1gR

{
  "adata": [                                // auth data
    [
      "Yu5ECsseuJ07M2QBfdf3bA==",           // base64(cipher_iv); getRandomBytes(16) default
      "kvDZJC6IahU=",                       // base64(kdf_salt); getRandomBytes(8) default
      100000,                               // pbkdf_iterations; default
      256,                                  // pbkdf_keysize; default
      128,                                  // cipher_tag_size (wtf ?); default
      "aes",                                // cipher_algo; default
      "gcm",                                // cipher_mode; default
      "zlib"                                // compression_type; default
    ],
    "plaintext",                            // format of the paste - "plaintext" or "syntaxhighlighting" or "markdown"

    0,                                      // open-discussion flag
    0                                       // burn-after-reading flag (0 or 1)
  ],
  "meta": {
    "expire": "1week"
  },
  "v": 2,                                               // schema version
  "ct": "aVKpZWtKmTJKis5S6nYEL1rdxyPbHYFclHV3E6Kq99Tb"  // cipher text
}

A prompt for password shows up on wrong encryption keys. Also, for ducks sake, It took me a while to figure out that the key is encoded in base58. Here's the relevant code:

me.getPasteKey = function()
        {
            if (symmetricKey === null) {
                let newKey = window.location.hash.substring(1);
                if (newKey === '') {
                    throw 'no encryption key given';
                }

                // Some web 2.0 services and redirectors add data AFTER the anchor
                // (such as &utm_source=...). We will strip any additional data.
                let ampersandPos = newKey.indexOf('&');
                if (ampersandPos > -1)
                {
                    newKey = newKey.substring(0, ampersandPos);
                }

                // version 2 uses base58, version 1 uses base64 without decoding
                try {
                    // base58 encode strips NULL bytes at the beginning of the
                    // string, so we re-add them if necessary
                    symmetricKey = CryptTool.base58decode(newKey).padStart(32, '\u0000');
                } catch(e) {
                    symmetricKey = newKey;
                }
            }

            return symmetricKey;
        };

Key derivation (PBKDF2)

Since passwords and keys are usually too short to be usable for encryption, it is common practice to use salted key derivation to turn such low entropy input into the actual key to use during en/decryption.

kdf_salt = random(8) # 8 bytes
kdf_iterations = 100000 # was 10000 before PrivateBin version 1.3
kdf_keysize = 256 # bits of resulting kdf_key

kdf_key = PBKDF2_HMAC_SHA256(kdf_keysize, kdf_salt, paste_password)

where `paste_password i
The encrypted text is then:

cipher_algo = "aes"
cipher_mode = "gcm" # was "ccm" before PrivateBin version 1.0
cipher_iv = random(16) # 128 bit
cipher_tag_size = 128

cipher_text = cipher(AES(kdf_key), GCM(iv, paste_meta), paste_blob)

generating `paste_password`

If paste_password is an empty string:

paste_passphrase = random(32) # 32 bytes

if a paste_password has been specified:

paste_passphrase = random(32) + paste_password

Processing of the paste_data, if compression is enabled (the default):

paste_blob = zlib.compress(paste_data)

repsonse

{
  "status": 0,
  "id": "8d18870b7b9ae766",
  "url": "/?8d18870b7b9ae766",
  "deletetoken": "61927f5710f04c399533fedcad07f5b5e13fc79e6e8df4065bc71217d1f7edad"
}

todo

switch to a db instead of "file-less" configuration
enable ability to delete
enable paste cloning
see more at this comment

…ture/pastebin

bbriggs · 2020-04-01T14:01:48Z

I love this. Let's fast track it.

changed some types in earlier commit to suit json; still unclear about some no tests were made whatsoever

the JSON structure sent does not map well to Go types, but it should be ok now to do JSON marshalling

final commit before testing

one more error to go!

rfc2119 · 2020-04-19T10:21:32Z

m-242 · 2020-04-21T08:41:39Z

This needs formatting, use go fmt $file on the files.
Also, this might interest you.

it turns out that req.WriteReq() consumes the req, hence subsequent calls find an empty request, which generates all sorts of error encoded paste data with zlib (will be removed later) authenticated aData; re-added docker-compose file

as it turned out, the key used in decryption is derived from the base58 encoded key and paste password; Initially, I thought the key used in AES is the random-looking key Interestingly enough, the KDF package is released 4 days ago by the Go crypto team, with version number v0.0.0

Instead of looking for a "NAN" field which may or may not be there (are you sorry, Canada?) we should run a collector value that adds the totals for each province in a given country code.

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

* Add .deepsource.toml * Remove unnecessary blank (_) identifier * Fix Yoda conditions (testing deepsource) Co-authored-by: DeepSource Bot <bot@deepsource.io> Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>

…on named triggers. used ```shell cd bitbot grep -R "NamedTrigger" | cut -d":" -f 1 | xargs -I f sed -i "s,NamedTrigger{,& //nolint:gochecknoglobals," f ``` Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

…ts it to have an error return which it doesn't have. Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

…ture/pastebin

…t touch the code.

Clarifying comments, and fmt-ing

rfc2119 and others added 7 commits March 30, 2020 16:56

Merge branch 'master' of github.com:rfc2119/bitbot into dev

6288136

Merge branch 'dev' of https://github.com/bbriggs/bitbot into dev

b83cabc

Added sequence_pastebin.png

77e7d58

Added sequence_pastebin.png

69d9bdd

squash me

a52a57e

Merge branch 'feature/pastebin' of github.com:rfc2119/bitbot into fea…

fcb6b34

…ture/pastebin

[WIP] privatebin plugin for bitbot

4cc3dea

rfc2119 added 2 commits April 5, 2020 14:10

types and routines for encrypting locally

95ef333

added routine for sending/receiving paste

9d48ec9

changed some types in earlier commit to suit json; still unclear about some no tests were made whatsoever

rfc2119 force-pushed the feature/pastebin branch from 86168f7 to 9d48ec9 Compare April 6, 2020 15:37

rfc2119 added 3 commits April 7, 2020 20:11

adapting Go structrures to suit the JSON

b6d6050

the JSON structure sent does not map well to Go types, but it should be ok now to do JSON marshalling

manually created the paste request

1b8f859

final commit before testing

reworked the struct for pasteReq

856c78b

one more error to go!

m-242 marked this pull request as ready for review April 12, 2020 18:19

m-242 requested review from bbriggs, m-242 and parsec as code owners April 12, 2020 18:19

m-242 marked this pull request as draft April 12, 2020 18:22

m-242 removed request for bbriggs, m-242 and parsec April 12, 2020 19:01

m-242 added do not merge WIP labels Apr 15, 2020

rfc2119 marked this pull request as ready for review April 19, 2020 10:22

m-242 removed WIP do not merge labels Apr 21, 2020

removed the misleading req.WriteReq()

5aee7a8

it turns out that req.WriteReq() consumes the req, hence subsequent calls find an empty request, which generates all sorts of error encoded paste data with zlib (will be removed later) authenticated aData; re-added docker-compose file

rfc2119 and others added 13 commits April 25, 2020 19:42

Uppercase arguments to covid19 stats function

3dcc8a5

Get total for country by summing all provinces (bbriggs#152)

fd733e7

Instead of looking for a "NAN" field which may or may not be there (are you sorry, Canada?) we should run a collector value that adds the totals for each province in a given country code.

Basic Province trigger patch

d898ade

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Fixed total trigger addition loops

3b4a7c5

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

test rebasing

71dcbd0

Do not remind us that bitbot global vars are global.

29d5660

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Ignored False Positives on the Body.Close() method, golangci-lint wan…

dd543e5

…ts it to have an error return which it doesn't have. Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Corrected mistakes

a4f413c

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Added a linter to already nolinted false positives

340d614

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

Fixed improper definition sanitizing

16f853f

Signed-off-by: Olivier Moreau m242 <m242@protonmail.com>

rfc2119 force-pushed the feature/pastebin branch from efbaab5 to 16f853f Compare April 25, 2020 17:45

m-242 and others added 5 commits April 25, 2020 19:53

Merge branch 'dev' into feature/pastebin

466b0d5

!paste now activates on a private message only

eb6261c

Merge branch 'feature/pastebin' of github.com:rfc2119/bitbot into fea…

a468ba7

…ture/pastebin

Formatted and other small changes that help with the linting but don'…

09a52c8

…t touch the code.

Merge pull request #1 from m-242/feature/pastebin

306da39

Clarifying comments, and fmt-ing

m-242 added the WIP label May 26, 2020

m-242 linked an issue May 29, 2020 that may be closed by this pull request

Feature Request - Intergrated pastebin #135

Open

Merge branch 'dev' into feature/pastebin

95f112d

bbriggs changed the title ~~[WIP] privatebin plugin for bitbot~~ Privatebin plugin Sep 29, 2020

bbriggs removed the WIP label Sep 29, 2020

Navigation Menu

Privatebin plugin - #153

Privatebin plugin#153
rfc2119 wants to merge 32 commits into
bbriggs:devfrom
rfc2119:feature/pastebin

rfc2119 commented Apr 1, 2020 •

edited

Loading

Uh oh!

bbriggs commented Apr 1, 2020

Uh oh!

rfc2119 commented Apr 19, 2020 •

edited

Loading

Uh oh!

m-242 commented Apr 21, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

rfc2119 commented Apr 1, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

usage and scenario

encryption format

Key derivation (PBKDF2)

generating paste_password

repsonse

todo

Uh oh!

bbriggs commented Apr 1, 2020

Uh oh!

rfc2119 commented Apr 19, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

m-242 commented Apr 21, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rfc2119 commented Apr 1, 2020 •

edited

Loading

generating `paste_password`

rfc2119 commented Apr 19, 2020 •

edited

Loading