End-to-End Encryption

// e2ee-worker.js: runs one RTCRtpScriptTransform for Huddle.
// Frame layout on the wire: [clear header][AES-GCM ciphertext + tag][12-byte IV][1-byte key id]
const keys = new Map(); // keyId -> CryptoKey
let sendKeyId = 0;
let counter = 0n;
const stats = { encrypted: 0, decrypted: 0, dropped: 0, byKeyId: {} };

onmessage = (event) => {
  const msg = event.data;
  if (msg.type === 'key') {
    keys.set(msg.keyId, msg.key);
    if (msg.useForSending) sendKeyId = msg.keyId;
  } else if (msg.type === 'removeKey') {
    keys.delete(msg.keyId);
  } else if (msg.type === 'stats') {
    postMessage({ type: 'stats', stats });
  }
};

// Bytes that stay in the clear so the SFU can still packetise and detect key frames.
// VP8: 10 bytes on key frames, 3 on delta frames. Opus: 1 byte.
function clearBytes(frame) {
  if (frame.type === 'key') return 10;
  if (frame.type === 'delta') return 3;
  return 1;
}

function makeIv(ssrc) {
  const iv = new Uint8Array(12);
  const view = new DataView(iv.buffer);
  view.setUint32(0, ssrc);
  view.setBigUint64(4, counter++);
  return iv;
}

async function encryptFrame(frame, controller) {
  const key = keys.get(sendKeyId);
  if (!key) return; // no key yet: drop rather than leak plaintext
  const data = new Uint8Array(frame.data);
  const n = Math.min(clearBytes(frame), data.length);
  const iv = makeIv(frame.getMetadata().synchronizationSource);
  const aad = new Uint8Array(n + 1);
  aad.set(data.subarray(0, n));
  aad[n] = sendKeyId;
  const body = new Uint8Array(await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv, additionalData: aad }, key, data.subarray(n)));
  const out = new Uint8Array(n + body.length + 12 + 1);
  out.set(data.subarray(0, n), 0);
  out.set(body, n);
  out.set(iv, n + body.length);
  out[out.length - 1] = sendKeyId;
  frame.data = out.buffer;
  stats.encrypted++;
  controller.enqueue(frame);
}

async function decryptFrame(frame, controller) {
  const data = new Uint8Array(frame.data);
  const n = clearBytes(frame);
  if (data.length < n + 16 + 12 + 1) { stats.dropped++; return; }
  const keyId = data[data.length - 1];
  const key = keys.get(keyId);
  if (!key) { stats.dropped++; return; }
  const iv = data.subarray(data.length - 13, data.length - 1);
  const aad = new Uint8Array(n + 1);
  aad.set(data.subarray(0, n));
  aad[n] = keyId;
  try {
    const plain = new Uint8Array(await crypto.subtle.decrypt(
      { name: 'AES-GCM', iv, additionalData: aad }, key, data.subarray(n, data.length - 13)));
    const out = new Uint8Array(n + plain.length);
    out.set(data.subarray(0, n), 0);
    out.set(plain, n);
    frame.data = out.buffer;
    stats.decrypted++;
    stats.byKeyId[keyId] = (stats.byKeyId[keyId] || 0) + 1;
    controller.enqueue(frame);
  } catch {
    stats.dropped++; // authentication failed: wrong key or tampered frame
  }
}

onrtctransform = (event) => {
  const { readable, writable, options } = event.transformer;
  const transform = options.operation === 'encrypt' ? encryptFrame : decryptFrame;
  readable.pipeThrough(new TransformStream({ transform })).pipeTo(writable);
};

// huddle-e2ee.js: attach end-to-end encryption to a Huddle peer connection.
export function protect(sender) {
  const worker = new Worker('/e2ee-worker.js');
  sender.transform = new RTCRtpScriptTransform(worker, { operation: 'encrypt' });
  return worker;
}

export function unprotect(receiver) {
  const worker = new Worker('/e2ee-worker.js');
  receiver.transform = new RTCRtpScriptTransform(worker, { operation: 'decrypt' });
  return worker;
}

export function preferVp8(transceiver) {
  const codecs = RTCRtpReceiver.getCapabilities('video').codecs;
  const vp8 = codecs.filter((c) => c.mimeType === 'video/VP8');
  transceiver.setCodecPreferences(vp8);
}

export function workerStats(worker) {
  return new Promise((resolve) => {
    const listener = (e) => { if (e.data.type === 'stats') { worker.removeEventListener('message', listener); resolve(e.data.stats); } };
    worker.addEventListener('message', listener);
    worker.postMessage({ type: 'stats' });
  });
}

import { protect, unprotect, preferVp8 } from '/huddle-e2ee.js';

const pc = new RTCPeerConnection({ iceServers });
const stream = await navigator.mediaDevices.getUserMedia({ audio: true, video: true });
const senders = stream.getTracks().map((track) => pc.addTrack(track, stream));
preferVp8(pc.getTransceivers().find((t) => t.sender.track.kind === 'video'));

for (const sender of senders) {
  const worker = protect(sender);
  worker.postMessage({ type: 'key', keyId: 1, key: mySenderKey, useForSending: true });
}

pc.ontrack = (event) => {
  const worker = unprotect(event.receiver);
  // keysFromSignalling maps a stream id to the unwrapped sender keys delivered over the WebSocket.
  for (const [keyId, key] of keysFromSignalling.get(event.streams[0].id)) {
    worker.postMessage({ type: 'key', keyId, key });
  }
  remoteVideo.srcObject = event.streams[0];
};

// e2ee-keys.js: key helpers for Huddle's end-to-end encryption.
const ECDH = { name: 'ECDH', namedCurve: 'P-256' };

export async function newIdentity() {
  const pair = await crypto.subtle.generateKey(ECDH, false, ['deriveKey']);
  // The public half must be exportable even when the private half is not.
  const publicRaw = new Uint8Array(await crypto.subtle.exportKey('raw', pair.publicKey));
  return { privateKey: pair.privateKey, publicRaw };
}

export async function newSenderKey() {
  return crypto.subtle.generateKey({ name: 'AES-GCM', length: 128 }, true, ['encrypt', 'decrypt']);
}

async function pairwiseKey(privateKey, theirPublicRaw) {
  const theirPublic = await crypto.subtle.importKey('raw', theirPublicRaw, ECDH, false, []);
  return crypto.subtle.deriveKey({ name: 'ECDH', public: theirPublic }, privateKey,
    { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
}

// Wrap a sender key for one participant. The result travels through the signalling server.
export async function wrapSenderKey(senderKey, myPrivate, theirPublicRaw) {
  const kek = await pairwiseKey(myPrivate, theirPublicRaw);
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const raw = await crypto.subtle.exportKey('raw', senderKey);
  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, kek, raw));
  return { iv: Array.from(iv), ct: Array.from(ct) };
}

export async function unwrapSenderKey(wrapped, myPrivate, senderPublicRaw) {
  const kek = await pairwiseKey(myPrivate, senderPublicRaw);
  const raw = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: new Uint8Array(wrapped.iv) }, kek,
    new Uint8Array(wrapped.ct));
  // Import as non-extractable: it only needs to encrypt and decrypt frames.
  return crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt']);
}

// Six-digit code both users read aloud to detect a man in the middle on the signalling channel.
export async function safetyNumber(publicA, publicB) {
  const [first, second] = [publicA, publicB].sort((a, b) => Array.from(a).join().localeCompare(Array.from(b).join()));
  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new Uint8Array([...first, ...second])));
  const value = new DataView(digest.buffer).getUint32(0) % 1000000;
  return String(value).padStart(6, '0');
}

// Data-channel messages (Huddle chat) use the same sender key.
export async function sealJson(key, value) {
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key,
    new TextEncoder().encode(JSON.stringify(value))));
  const out = new Uint8Array(12 + ct.length);
  out.set(iv); out.set(ct, 12);
  return out.buffer;
}

export async function openJson(key, buffer) {
  const bytes = new Uint8Array(buffer);
  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: bytes.subarray(0, 12) }, key, bytes.subarray(12));
  return JSON.parse(new TextDecoder().decode(plain));
}

export function e2eeSupport() {
  if (typeof RTCRtpSFrameEncryptor === 'function' && typeof RTCRtpSFrameDecryptor === 'function') {
    return 'sframe-native';
  }
  if (typeof RTCRtpScriptTransform === 'function' && 'transform' in RTCRtpSender.prototype) {
    return 'script-transform';
  }
  if (typeof RTCRtpSender.prototype.createEncodedStreams === 'function') {
    return 'legacy-insertable-streams';
  }
  return 'none';
}

export async function attachNativeSframe(rtpObject, isReceiver, key, keyId) {
  const cipherSuite = 'AES_128_GCM_SHA256_128';
  if (!isReceiver) {
    const encryptor = new RTCRtpSFrameEncryptor({ cipherSuite });
    await encryptor.setEncryptionKey(key, keyId);
    rtpObject.transform = encryptor;
  } else {
    const decryptor = new RTCRtpSFrameDecryptor({ cipherSuite });
    await decryptor.addDecryptionKey(key, keyId);
    decryptor.addEventListener('error', (e) => console.warn('SFrame error', e.errorType));
    rtpObject.transform = decryptor;
  }
}