Add e2ee for data channel messages

.changeset/chilled-oranges-try.md

@@ -0,0 +1,5 @@
+---
+"livekit-client": patch
+---
+
+Add preliminary support for data message decryption

examples/demo/demo.ts

@@ -50,7 +50,7 @@
   decoder: new TextDecoder(),
   defaultDevices: new Map<MediaDeviceKind, string>([['audioinput', 'default']]),
   bitrateInterval: undefined as any,
-  e2eeKeyProvider: new ExternalE2EEKeyProvider(),
+  e2eeKeyProvider: new ExternalE2EEKeyProvider({ ratchetWindowSize: 100 }),
   chatMessages: new Map<string, { text: string; participant?: Participant }>(),
 };
 let currentRoom: Room | undefined;
@@ -128,7 +128,7 @@
       videoCaptureDefaults: {
         resolution: VideoPresets.h720.resolution,
       },
-      e2ee: e2eeEnabled
+      encryption: e2eeEnabled
         ? { keyProvider: state.e2eeKeyProvider, worker: new E2EEWorker() }
         : undefined,
     };
@@ -273,6 +273,7 @@
       try {
         for await (const chunk of reader.withAbortSignal(streamReaderAbortController.signal)) {
           message += chunk;
+          console.log('received message', message, participant);
           handleChatMessage(
             {
               id: info.id,
@@ -434,7 +435,7 @@
   },
 
   toggleE2EE: async () => {
-    if (!currentRoom || !currentRoom.options.e2ee) {
+    if (!currentRoom || !currentRoom.hasE2EESetup) {
       return;
     }
     // read and set current key from input
@@ -488,7 +489,7 @@
   },
 
   ratchetE2EEKey: async () => {
-    if (!currentRoom || !currentRoom.options.e2ee) {
+    if (!currentRoom || !currentRoom.hasE2EESetup) {
       return;
     }
     await state.e2eeKeyProvider.ratchetKey();
@@ -767,31 +768,31 @@
     div = document.createElement('div');
     div.id = `participant-${identity}`;
     div.className = 'participant';
     div.innerHTML = `
       <video id="video-${identity}"></video>
       <audio id="audio-${identity}"></audio>
       <div class="info-bar">
         <div id="name-${identity}" class="name">
         </div>
         <div style="text-align: center;">
           <span id="codec-${identity}" class="codec">
           </span>
           <span id="size-${identity}" class="size">
           </span>
           <span id="bitrate-${identity}" class="bitrate">
           </span>
         </div>
         <div class="right">
           <span id="signal-${identity}"></span>
           <span id="mic-${identity}" class="mic-on"></span>
           <span id="e2ee-${identity}" class="e2ee-on"></span>
         </div>
       </div>
       ${
         !isLocalParticipant(participant)
           ? `<div class="volume-control">
         <input id="volume-${identity}" type="range" min="0" max="1" step="0.1" value="1" orient="vertical" />
       </div>`
           : `<progress id="local-volume" max="1" value="0" />`
       }
 
@@ -1043,7 +1044,7 @@
     'flip-video-button',
     'send-button',
   ];
-  if (currentRoom && currentRoom.options.e2ee) {
+  if (currentRoom && currentRoom.hasE2EESetup) {
     connectedSet.push('toggle-e2ee-button', 'e2ee-ratchet-button');
   }
   const disconnectedSet = ['connect-button'];

package.json

@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@livekit/mutex": "1.1.1",
-    "@livekit/protocol": "1.39.3",
+    "@livekit/protocol": "2.0.0",
     "events": "^3.3.0",
     "loglevel": "^1.9.2",
     "sdp-transform": "^2.15.0",

src/e2ee/E2eeManager.ts

@@ -11,15 +11,19 @@ import type RemoteTrack from '../room/track/RemoteTrack';
 import type { Track } from '../room/track/Track';
 import type { VideoCodec } from '../room/track/options';
 import { mimeTypeToVideoCodecString } from '../room/track/utils';
-import { isLocalTrack, isSafariBased, isVideoTrack } from '../room/utils';
+import { Future, isLocalTrack, isSafariBased, isVideoTrack } from '../room/utils';
 import type { BaseKeyProvider } from './KeyProvider';
 import { E2EE_FLAG } from './constants';
 import { type E2EEManagerCallbacks, EncryptionEvent, KeyProviderEvent } from './events';
 import type {
+  DecryptDataRequestMessage,
+  DecryptDataResponseMessage,
   E2EEManagerOptions,
   E2EEWorkerMessage,
   EnableMessage,
   EncodeMessage,
+  EncryptDataRequestMessage,
+  EncryptDataResponseMessage,
   InitMessage,
   KeyInfo,
   RTPVideoMapMessage,
@@ -35,8 +39,17 @@ import { isE2EESupported, isScriptTransformSupported } from './utils';
 export interface BaseE2EEManager {
   setup(room: Room): void;
   setupEngine(engine: RTCEngine): void;
+  isEnabled: boolean;
+  isDataChannelEncryptionEnabled: boolean;
   setParticipantCryptorEnabled(enabled: boolean, participantIdentity: string): void;
   setSifTrailer(trailer: Uint8Array): void;
+  encryptData(data: Uint8Array): Promise<EncryptDataResponseMessage['data']>;
+  handleEncryptedData(
+    payload: Uint8Array,
+    iv: Uint8Array,
+    participantIdentity: string,
+    keyIndex: number,
+  ): Promise<DecryptDataResponseMessage['data'] | EncryptDataResponseMessage['data']>;
   on<E extends keyof E2EEManagerCallbacks>(event: E, listener: E2EEManagerCallbacks[E]): this;
 }
 
@@ -55,11 +68,26 @@ export class E2EEManager
 
   private keyProvider: BaseKeyProvider;
 
-  constructor(options: E2EEManagerOptions) {
+  private decryptDataRequests: Map<string, Future<DecryptDataResponseMessage['data']>> = new Map();
+
+  private encryptDataRequests: Map<string, Future<EncryptDataResponseMessage['data']>> = new Map();
+
+  private dataChannelEncryptionEnabled: boolean;
+
+  constructor(options: E2EEManagerOptions, dcEncryptionEnabled: boolean) {
     super();
     this.keyProvider = options.keyProvider;
     this.worker = options.worker;
     this.encryptionEnabled = false;
+    this.dataChannelEncryptionEnabled = dcEncryptionEnabled;
+  }
+
+  get isEnabled(): boolean {
+    return this.encryptionEnabled;
+  }
+
+  get isDataChannelEncryptionEnabled(): boolean {
+    return this.isEnabled && this.dataChannelEncryptionEnabled;
   }
 
   /**
@@ -160,6 +188,19 @@ export class E2EEManager
           data.keyIndex,
         );
         break;
+
+      case 'decryptDataResponse':
+        const decryptFuture = this.decryptDataRequests.get(data.uuid);
+        if (decryptFuture?.resolve) {
+          decryptFuture.resolve(data);
+        }
+        break;
+      case 'encryptDataResponse':
+        const encryptFuture = this.encryptDataRequests.get(data.uuid);
+        if (encryptFuture?.resolve) {
+          encryptFuture.resolve(data as EncryptDataResponseMessage['data']);
+        }
+        break;
       default:
         break;
     }
@@ -250,6 +291,57 @@ export class E2EEManager
       );
   }
 
+  async encryptData(data: Uint8Array): Promise<EncryptDataResponseMessage['data']> {
+    if (!this.worker) {
+      throw Error('could not encrypt data, worker is missing');
+    }
+    const uuid = crypto.randomUUID();
+    const msg: EncryptDataRequestMessage = {
+      kind: 'encryptDataRequest',
+      data: {
+        uuid,
+        payload: data,
+        participantIdentity: this.room!.localParticipant.identity,
+      },
+    };
+    const future = new Future<EncryptDataResponseMessage['data']>();
+    future.onFinally = () => {
+      this.encryptDataRequests.delete(uuid);
+    };
+    this.encryptDataRequests.set(uuid, future);
+    this.worker.postMessage(msg);
+    return future!.promise!;
+  }
+
+  handleEncryptedData(
+    payload: Uint8Array,
+    iv: Uint8Array,
+    participantIdentity: string,
+    keyIndex: number,
+  ) {
+    if (!this.worker) {
+      throw Error('could not handle encrypted data, worker is missing');
+    }
+    const uuid = crypto.randomUUID();
+    const msg: DecryptDataRequestMessage = {
+      kind: 'decryptDataRequest',
+      data: {
+        uuid,
+        payload,
+        iv,
+        participantIdentity,
+        keyIndex,
+      },
+    };
+    const future = new Future<DecryptDataResponseMessage['data']>();
+    future.onFinally = () => {
+      this.decryptDataRequests.delete(uuid);
+    };
+    this.decryptDataRequests.set(uuid, future);
+    this.worker.postMessage(msg);
+    return future.promise;
+  }
+
   private postRatchetRequest(participantIdentity?: string, keyIndex?: number) {
     if (!this.worker) {
       throw Error('could not ratchet key, worker is missing');

src/e2ee/types.ts

@@ -109,6 +109,44 @@ export interface InitAck extends BaseMessage {
   };
 }
 
+export interface DecryptDataRequestMessage extends BaseMessage {
+  kind: 'decryptDataRequest';
+  data: {
+    uuid: string;
+    payload: Uint8Array;
+    iv: Uint8Array;
+    participantIdentity: string;
+    keyIndex: number;
+  };
+}
+
+export interface DecryptDataResponseMessage extends BaseMessage {
+  kind: 'decryptDataResponse';
+  data: {
+    uuid: string;
+    payload: Uint8Array;
+  };
+}
+
+export interface EncryptDataRequestMessage extends BaseMessage {
+  kind: 'encryptDataRequest';
+  data: {
+    uuid: string;
+    payload: Uint8Array;
+    participantIdentity: string;
+  };
+}
+
+export interface EncryptDataResponseMessage extends BaseMessage {
+  kind: 'encryptDataResponse';
+  data: {
+    uuid: string;
+    payload: Uint8Array;
+    iv: Uint8Array;
+    keyIndex: number;
+  };
+}
+
 export type E2EEWorkerMessage =
   | InitMessage
   | SetKeyMessage
@@ -121,7 +159,11 @@ export type E2EEWorkerMessage =
   | RatchetRequestMessage
   | RatchetMessage
   | SifTrailerMessage
-  | InitAck;
+  | InitAck
+  | DecryptDataRequestMessage
+  | DecryptDataResponseMessage
+  | EncryptDataRequestMessage
+  | EncryptDataResponseMessage;
 
 export type KeySet = { material: CryptoKey; encryptionKey: CryptoKey };
 
@@ -150,6 +192,7 @@ export type E2EEManagerOptions = {
   keyProvider: BaseKeyProvider;
   worker: Worker;
 };
+
 export type E2EEOptions =
   | E2EEManagerOptions
   | {

src/e2ee/utils.ts

@@ -1,3 +1,4 @@
+import { type DataPacket, EncryptedPacketPayload } from '@livekit/protocol';
 import { ENCRYPTION_ALGORITHM } from './constants';
 
 export function isE2EESupported() {
@@ -176,3 +177,18 @@ export function writeRbsp(data_in: Uint8Array): Uint8Array {
   }
   return new Uint8Array(dataOut);
 }
+
+export function asEncryptablePacket(packet: DataPacket): EncryptedPacketPayload | undefined {
+  if (
+    packet.value?.case !== 'sipDtmf' &&
+    packet.value?.case !== 'metrics' &&
+    packet.value?.case !== 'speaker' &&
+    packet.value?.case !== 'transcription' &&
+    packet.value?.case !== 'encryptedPacket'
+  ) {
+    return new EncryptedPacketPayload({
+      value: packet.value,
+    });
+  }
+  return undefined;
+}