Implement using HKDF as the KDF.

Author: onestacked

.cargo/config.toml

@@ -14,4 +14,8 @@ rustflags = ["-C", "link-args=-ObjC"]
 rustflags = ["-C", "link-args=-ObjC"]
 
 [target.aarch64-apple-ios-sim]
-rustflags = ["-C", "link-args=-ObjC"]
+rustflags = ["-C", "link-args=-ObjC"]
+
+[env]
+# DO not merge! WIP change to for custom webrtc-sys build
+LK_CUSTOM_WEBRTC = { value = "webrtc-sys/libwebrtc/linux-x64-release", relative = true }

libwebrtc/src/native/frame_cryptor.rs

@@ -25,13 +25,29 @@ use crate::{
 
 pub type OnStateChange = Box<dyn FnMut(String, EncryptionState) + Send + Sync>;
 
+#[derive(Copy, Clone, Debug)]
+#[non_exhaustive]
+pub enum KeyDerivationAlgorithm {
+    PBKDF2,
+    HKDF,
+}
+impl Into<sys_fc::ffi::KeyDerivationAlgorithm> for KeyDerivationAlgorithm {
+    fn into(self) -> sys_fc::ffi::KeyDerivationAlgorithm {
+        match self {
+            KeyDerivationAlgorithm::PBKDF2 => sys_fc::ffi::KeyDerivationAlgorithm::PBKDF2,
+            KeyDerivationAlgorithm::HKDF => sys_fc::ffi::KeyDerivationAlgorithm::HKDF,
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct KeyProviderOptions {
     pub shared_key: bool,
     pub ratchet_window_size: i32,
     pub ratchet_salt: Vec<u8>,
     pub failure_tolerance: i32,
     pub key_ring_size: i32,
+    pub key_derivation_algorithm: KeyDerivationAlgorithm,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -274,6 +290,7 @@ impl From<KeyProviderOptions> for sys_fc::ffi::KeyProviderOptions {
             ratchet_salt: value.ratchet_salt,
             failure_tolerance: value.failure_tolerance,
             key_ring_size: value.key_ring_size,
+            key_derivation_algorithm: value.key_derivation_algorithm.into(),
         }
     }
 }

livekit-ffi/protocol/e2ee.proto

@@ -38,6 +38,13 @@ message KeyProviderOptions {
     required int32 ratchet_window_size = 2;
     required bytes ratchet_salt = 3;
     required int32 failure_tolerance = 4; // -1 = no tolerance
+    required int32 key_ring_size = 5; 
+    required KeyDerivationFunction key_derivation_function = 6;
+}
+
+enum KeyDerivationFunction {
+    PBKDF2 = 0;
+    HKDF = 1;
 }
 
 message E2eeOptions {

livekit-ffi/src/conversion/room.rs

@@ -21,7 +21,7 @@ use livekit::{
     options::{AudioEncoding, TrackPublishOptions, VideoEncoding},
     prelude::*,
     webrtc::{
-        native::frame_cryptor::EncryptionState,
+        native::frame_cryptor::{EncryptionState, KeyDerivationAlgorithm},
         prelude::{ContinualGatheringPolicy, IceServer, IceTransportsType, RtcConfiguration},
     },
     RoomInfo,
@@ -133,10 +133,22 @@ impl From<proto::DisconnectReason> for DisconnectReason {
 
 impl From<proto::KeyProviderOptions> for KeyProviderOptions {
     fn from(value: proto::KeyProviderOptions) -> Self {
+        let key_derivation_algorithm = value.key_derivation_function().into();
         Self {
             ratchet_window_size: value.ratchet_window_size,
             ratchet_salt: value.ratchet_salt,
             failure_tolerance: value.failure_tolerance,
+            key_ring_size: value.key_ring_size,
+            key_derivation_algorithm,
+        }
+    }
+}
+
+impl From<proto::KeyDerivationFunction> for KeyDerivationAlgorithm {
+    fn from(value: proto::KeyDerivationFunction) -> Self {
+        match value {
+            proto::KeyDerivationFunction::Pbkdf2 => KeyDerivationAlgorithm::PBKDF2,
+            proto::KeyDerivationFunction::Hkdf => KeyDerivationAlgorithm::HKDF,
         }
     }
 }

livekit/src/room/e2ee/key_provider.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use libwebrtc::native::frame_cryptor as fc;
+use libwebrtc::native::frame_cryptor::{self as fc, KeyDerivationAlgorithm};
 use std::sync::{
     atomic::{AtomicI32, Ordering},
     Arc,
@@ -31,6 +31,7 @@ pub struct KeyProviderOptions {
     pub ratchet_salt: Vec<u8>,
     pub failure_tolerance: i32,
     pub key_ring_size: i32,
+    pub key_derivation_algorithm: KeyDerivationAlgorithm,
 }
 
 impl Default for KeyProviderOptions {
@@ -40,6 +41,7 @@ impl Default for KeyProviderOptions {
             ratchet_salt: DEFAULT_RATCHET_SALT.to_owned().into_bytes(),
             failure_tolerance: DEFAULT_FAILURE_TOLERANCE,
             key_ring_size: DEFAULT_KEY_RING_SIZE,
+            key_derivation_algorithm: KeyDerivationAlgorithm::PBKDF2,
         }
     }
 }
@@ -60,6 +62,7 @@ impl KeyProvider {
                 ratchet_salt: options.ratchet_salt,
                 failure_tolerance: options.failure_tolerance,
                 key_ring_size: options.key_ring_size,
+                key_derivation_algorithm: options.key_derivation_algorithm,
             }),
             latest_key_index: Arc::new(AtomicI32::new(0)),
         }
@@ -72,6 +75,7 @@ impl KeyProvider {
             ratchet_salt: options.ratchet_salt,
             failure_tolerance: options.failure_tolerance,
             key_ring_size: options.key_ring_size,
+            key_derivation_algorithm: options.key_derivation_algorithm,
         });
         handle.set_shared_key(0, shared_key);
         Self { handle, latest_key_index: Arc::new(AtomicI32::new(0)) }

webrtc-sys/libwebrtc/.gclient

@@ -1,7 +1,7 @@
 solutions = [
   {
     "name": 'src',
-    "url": 'https://github.com/webrtc-sdk/webrtc.git@m137_release',
+    "url": 'https://github.com/webrtc-sdk/webrtc.git@duan/hkdf-sha256-key-derivation',
     "custom_deps": {},
     "deps_file": "DEPS",
     "managed": False,

webrtc-sys/src/frame_cryptor.cpp

@@ -40,6 +40,19 @@ webrtc::FrameCryptorTransformer::Algorithm AlgorithmToFrameCryptorAlgorithm(
   }
 }
 
+webrtc::KeyDerivationAlgorithm
+KeyDerivationAlgorithmToFrameCryptorKeyDerivationAlgorithm(
+    KeyDerivationAlgorithm algorithm) {
+  switch (algorithm) {
+    case KeyDerivationAlgorithm::PBKDF2:
+      return webrtc::KeyDerivationAlgorithm::kPBKDF2;
+    case KeyDerivationAlgorithm::HKDF:
+      return webrtc::KeyDerivationAlgorithm::kHKDF;
+    default:
+      return webrtc::KeyDerivationAlgorithm::kPBKDF2;
+  }
+}
+
 KeyProvider::KeyProvider(KeyProviderOptions options) {
   webrtc::KeyProviderOptions rtc_options;
   rtc_options.shared_key = options.shared_key;
@@ -52,7 +65,9 @@ KeyProvider::KeyProvider(KeyProviderOptions options) {
   rtc_options.ratchet_window_size = options.ratchet_window_size;
   rtc_options.failure_tolerance = options.failure_tolerance;
   rtc_options.key_ring_size = options.key_ring_size;
-
+  rtc_options.key_derivation_algorithm =
+      KeyDerivationAlgorithmToFrameCryptorKeyDerivationAlgorithm(
+          options.key_derivation_algorithm);
   impl_ =
       new rtc::RefCountedObject<webrtc::DefaultKeyProviderImpl>(rtc_options);
 }

webrtc-sys/src/frame_cryptor.rs

@@ -26,6 +26,14 @@ pub mod ffi {
         pub ratchet_salt: Vec<u8>,
         pub failure_tolerance: i32,
         pub key_ring_size: i32,
+        pub key_derivation_algorithm: KeyDerivationAlgorithm,
+    }
+
+    #[derive(Debug)]
+    #[repr(i32)]
+    pub enum KeyDerivationAlgorithm {
+        PBKDF2 = 0,
+        HKDF,
     }
 
     #[derive(Debug)]
@@ -250,6 +258,8 @@ mod tests {
             ratchet_window_size: 16,
             ratchet_salt: vec![],
             failure_tolerance: -1,
+            key_ring_size: 16,
+            key_derivation_algorithm: ffi::KeyDerivationAlgorithm::HKDF,
         };
 
         let key_provider = ffi::new_key_provider(options);