permissionlesstech/bitchat
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat.git synced 2026-07-24 23:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash: Add thread safety to EncryptionService

Browse Source 
The crash was caused by concurrent access to CryptoKit signing operations
from multiple threads. Added thread-safe access using a concurrent queue
with barriers for write operations and sync reads.

This fixes the EXC_BAD_ACCESS crash seen in TestFlight build.
This commit is contained in:
jack
2025-07-06 21:02:47 +02:00
parent 7c7e23b154
commit 10656b49eb
2 changed files with 72 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitchat.xcodeproj/project.pbxproj
+12 -4
View File
@@ -482,6 +482,7 @@
DEVELOPMENT_TEAM = L3N5LHJD5Y;
ENABLE_PREVIEWS = YES;
INFOPLIST_FILE = bitchat/Info.plist;
INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.social-networking";
IPHONEOS_DEPLOYMENT_TARGET = 16.0;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
@@ -491,9 +492,12 @@
PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat;
PRODUCT_NAME = bitchat;
SDKROOT = iphoneos;
SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = YES;
SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
SUPPORTS_MACCATALYST = NO;
SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
SWIFT_VERSION = 5.0;
TARGETED_DEVICE_FAMILY = "1,2";
TARGETED_DEVICE_FAMILY = 1;
};
name = Debug;
};
@@ -528,6 +532,7 @@
DEVELOPMENT_TEAM = L3N5LHJD5Y;
ENABLE_PREVIEWS = YES;
INFOPLIST_FILE = bitchat/Info.plist;
INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.social-networking";
IPHONEOS_DEPLOYMENT_TARGET = 16.0;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
@@ -537,9 +542,12 @@
PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat;
PRODUCT_NAME = bitchat;
SDKROOT = iphoneos;
SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = YES;
SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
SUPPORTS_MACCATALYST = NO;
SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
SWIFT_VERSION = 5.0;
TARGETED_DEVICE_FAMILY = "1,2";
TARGETED_DEVICE_FAMILY = 1;
};
name = Release;
};
bitchat/Services/EncryptionService.swift
+60 -42
View File
@@ -28,6 +28,9 @@ class EncryptionService {
private let identityKey: Curve25519.Signing.PrivateKey
public let identityPublicKey: Curve25519.Signing.PublicKey
// Thread safety
private let cryptoQueue = DispatchQueue(label: "chat.bitchat.crypto", attributes: .concurrent)
init() {
// Generate ephemeral key pairs for this session
self.privateKey = Curve25519.KeyAgreement.PrivateKey()
@@ -59,46 +62,50 @@ class EncryptionService {
// Add peer's combined public keys
func addPeerPublicKey(_ peerID: String, publicKeyData: Data) throws {
// Convert to array for safe access
let keyBytes = [UInt8](publicKeyData)
guard keyBytes.count == 96 else {
// print("[CRYPTO] Invalid public key data size: \(keyBytes.count), expected 96")
throw EncryptionError.invalidPublicKey
}
// Extract all three keys: 32 for key agreement + 32 for signing + 32 for identity
let keyAgreementData = Data(keyBytes[0..<32])
let signingKeyData = Data(keyBytes[32..<64])
let identityKeyData = Data(keyBytes[64..<96])
let publicKey = try Curve25519.KeyAgreement.PublicKey(rawRepresentation: keyAgreementData)
peerPublicKeys[peerID] = publicKey
let signingKey = try Curve25519.Signing.PublicKey(rawRepresentation: signingKeyData)
peerSigningKeys[peerID] = signingKey
let identityKey = try Curve25519.Signing.PublicKey(rawRepresentation: identityKeyData)
peerIdentityKeys[peerID] = identityKey
// Stored all three keys for peer
// Generate shared secret for encryption
if let publicKey = peerPublicKeys[peerID] {
let sharedSecret = try privateKey.sharedSecretFromKeyAgreement(with: publicKey)
let symmetricKey = sharedSecret.hkdfDerivedSymmetricKey(
using: SHA256.self,
salt: "bitchat-v1".data(using: .utf8)!,
sharedInfo: Data(),
outputByteCount: 32
)
sharedSecrets[peerID] = symmetricKey
try cryptoQueue.sync(flags: .barrier) {
// Convert to array for safe access
let keyBytes = [UInt8](publicKeyData)
guard keyBytes.count == 96 else {
// print("[CRYPTO] Invalid public key data size: \(keyBytes.count), expected 96")
throw EncryptionError.invalidPublicKey
}
// Extract all three keys: 32 for key agreement + 32 for signing + 32 for identity
let keyAgreementData = Data(keyBytes[0..<32])
let signingKeyData = Data(keyBytes[32..<64])
let identityKeyData = Data(keyBytes[64..<96])
let publicKey = try Curve25519.KeyAgreement.PublicKey(rawRepresentation: keyAgreementData)
peerPublicKeys[peerID] = publicKey
let signingKey = try Curve25519.Signing.PublicKey(rawRepresentation: signingKeyData)
peerSigningKeys[peerID] = signingKey
let identityKey = try Curve25519.Signing.PublicKey(rawRepresentation: identityKeyData)
peerIdentityKeys[peerID] = identityKey
// Stored all three keys for peer
// Generate shared secret for encryption
if let publicKey = peerPublicKeys[peerID] {
let sharedSecret = try privateKey.sharedSecretFromKeyAgreement(with: publicKey)
let symmetricKey = sharedSecret.hkdfDerivedSymmetricKey(
using: SHA256.self,
salt: "bitchat-v1".data(using: .utf8)!,
sharedInfo: Data(),
outputByteCount: 32
)
sharedSecrets[peerID] = symmetricKey
}
}
}
// Get peer's persistent identity key for favorites
func getPeerIdentityKey(_ peerID: String) -> Data? {
return peerIdentityKeys[peerID]?.rawRepresentation
return cryptoQueue.sync {
return peerIdentityKeys[peerID]?.rawRepresentation
}
}
// Clear persistent identity (for panic mode)
@@ -108,8 +115,11 @@ class EncryptionService {
}
func encrypt(_ data: Data, for peerID: String) throws -> Data {
guard let symmetricKey = sharedSecrets[peerID] else {
throw EncryptionError.noSharedSecret
let symmetricKey = try cryptoQueue.sync {
guard let key = sharedSecrets[peerID] else {
throw EncryptionError.noSharedSecret
}
return key
}
let sealedBox = try AES.GCM.seal(data, using: symmetricKey)
@@ -117,8 +127,11 @@ class EncryptionService {
}
func decrypt(_ data: Data, from peerID: String) throws -> Data {
guard let symmetricKey = sharedSecrets[peerID] else {
throw EncryptionError.noSharedSecret
let symmetricKey = try cryptoQueue.sync {
guard let key = sharedSecrets[peerID] else {
throw EncryptionError.noSharedSecret
}
return key
}
let sealedBox = try AES.GCM.SealedBox(combined: data)
@@ -126,12 +139,17 @@ class EncryptionService {
}
func sign(_ data: Data) throws -> Data {
return try signingPrivateKey.signature(for: data)
// Create a local copy of the key to avoid concurrent access
let key = signingPrivateKey
return try key.signature(for: data)
}
func verify(_ signature: Data, for data: Data, from peerID: String) throws -> Bool {
guard let verifyingKey = peerSigningKeys[peerID] else {
throw EncryptionError.noSharedSecret
let verifyingKey = try cryptoQueue.sync {
guard let key = peerSigningKeys[peerID] else {
throw EncryptionError.noSharedSecret
}
return key
}
return verifyingKey.isValidSignature(signature, for: data)