Improve M2/M3 generation

Author: omarroth

internal/airplay/fairplay.go

@@ -9,9 +9,6 @@ import (
 	"fmt"
 )
 
-// fairPlayM1 is the fixed first message in the FairPlay SAP exchange.
-var fairPlayM1 = mustDecodeHexFP("46504c590301010000000004020003bb")
-
 var ErrFairPlayUnsupported = errors.New("receiver does not support FairPlay SAP")
 
 func mustDecodeHexFP(s string) []byte {
@@ -30,9 +27,16 @@ func (c *AirPlayClient) FairPlaySetup(ctx context.Context) error {
 
 	dbg("[FP] starting FairPlay SAP handshake...")
 
+	// Apple's sender creates one opaque FPSAP context before m1 and retains it
+	// for m3 and encrypted-key creation. Keep the equivalent state together for
+	// the lifetime of this authentication attempt.
+	fpsap, err := newFPSAPSession(rand.Reader)
+	if err != nil {
+		return fmt.Errorf("initialize FPSAP session: %w", err)
+	}
+
 	// Phase 1: Send m1, receive m2
-	m1 := make([]byte, len(fairPlayM1))
-	copy(m1, fairPlayM1)
+	m1 := fpsap.message1()
 
 	dbg("[FP] posting m1 (%d bytes) to /fp-setup", len(m1))
 	m2, err := c.httpRequest("POST", "/fp-setup", "application/octet-stream", m1,
@@ -45,14 +49,11 @@ func (c *AirPlayClient) FairPlaySetup(ctx context.Context) error {
 		return fmt.Errorf("fp-setup phase 1 (m1): %w", err)
 	}
 
-	if len(m2) < 12 {
-		return fmt.Errorf("m2 response too short: %d bytes", len(m2))
-	}
 	dbg("[FP] received m2 (%d bytes)", len(m2))
 	dbg("[FP] m2 first 32: %02x", m2[:min(32, len(m2))])
 
 	// Phase 2: Compute m3 and send it to the receiver.
-	m3, err := fpsapExchangeM3(m2)
+	m3, err := fpsap.exchangeM3(m2)
 	if err != nil {
 		return fmt.Errorf("FPSAPExchange: %w", err)
 	}
@@ -70,13 +71,11 @@ func (c *AirPlayClient) FairPlaySetup(ctx context.Context) error {
 		return fmt.Errorf("fp-setup phase 2 (m3): %w", err)
 	}
 
-	if len(m4) < 12 {
-		return fmt.Errorf("m4 response too short: %d bytes", len(m4))
+	if err := fpsap.confirmM4(m4); err != nil {
+		return fmt.Errorf("FPSAP m4: %w", err)
 	}
 	dbg("[FP] received m4 (%d bytes)", len(m4))
-
-	m4Payload := fplyUnwrap(m4)
-	dbg("[FP] m4 payload (%d bytes): %02x", len(m4Payload), m4Payload)
+	dbg("[FP] m4 payload (%d bytes): %02x", len(m4)-12, m4[12:])
 
 	// Generate and store IV for stream encryption
 	var iv [16]byte
@@ -89,17 +88,24 @@ func (c *AirPlayClient) FairPlaySetup(ctx context.Context) error {
 	c.fpM3 = make([]byte, len(m3))
 	copy(c.fpM3, m3)
 
-	// Build ekey and derive audio encryption key.
-	// Both sender and receiver call unwrapFairPlayKey(m3, ekey) with the same
-	// inputs (m3 sent during FP handshake, ekey sent in SETUP body).
-	ekey := buildEkey()
+	// Generate the raw audio key and wrap it in the FairPlay ekey record. Apple's
+	// sender API accepts the raw key as input; the receiver performs the inverse
+	// operation using the state established by m3.
+	var fpAesKey [16]byte
+	if _, err := rand.Read(fpAesKey[:]); err != nil {
+		return fmt.Errorf("generate FairPlay audio key: %w", err)
+	}
+	ekey, err := fpsap.wrapKey(fpAesKey, rand.Reader)
+	if err != nil {
+		return fmt.Errorf("wrap FairPlay audio key: %w", err)
+	}
 	c.FpEkey = ekey[:]
 	dbg("[FP] ekey chunk1 [16:32]: %02x", ekey[16:32])
+	dbg("[FP] ekey key length [32:36]: %d", 16)
 	dbg("[FP] ekey chunk2 [56:72]: %02x", ekey[56:72])
 
-	fpAesKey := unwrapFairPlayKey(c.fpM3, ekey[:])
 	c.fpAesKey = fpAesKey[:]
-	dbg("[FP] unwrapFairPlayKey fpAesKey: %02x", fpAesKey[:])
+	dbg("[FP] wrapped fpAesKey: %02x", fpAesKey[:])
 	dbg("[FP] m3 first 32 bytes: %02x", c.fpM3[:min(32, len(c.fpM3))])
 
 	// Hash with pair-verify shared secret (ECDH X25519) if available.
@@ -125,46 +131,6 @@ func (c *AirPlayClient) FairPlaySetup(ctx context.Context) error {
 	return nil
 }
 
-// buildEkey constructs a 72-byte ekey with the FPLY header format.
-// The chunk data is randomized per session so that unwrapFairPlayKey produces
-// a unique AES key for each session. Both sender and receiver compute the
-// same key from the same (m3, ekey) inputs.
-//
-// Format (72 bytes):
-//
-//	[0:4]   "FPLY"
-//	[4:8]   01 02 01 00
-//	[8:12]  00 00 00 3c  (0x3c = 60 = remaining bytes)
-//	[12:16] 00 00 00 00  (padding)
-//	[16:32] chunk1 (16 bytes, random)
-//	[32:56] padding (24 bytes, zeros)
-//	[56:72] chunk2 (16 bytes, random)
-func buildEkey() [72]byte {
-	var ekey [72]byte
-	copy(ekey[0:4], []byte("FPLY"))
-	ekey[4] = 0x01
-	ekey[5] = 0x02
-	ekey[6] = 0x01
-	ekey[7] = 0x00
-	ekey[8] = 0x00
-	ekey[9] = 0x00
-	ekey[10] = 0x00
-	ekey[11] = 0x3c
-	// Fill chunk1 [16:32] and chunk2 [56:72] with random data
-	rand.Read(ekey[16:32])
-	rand.Read(ekey[56:72])
-	return ekey
-}
-
-// fplyUnwrap strips the FPLY framing header and returns the payload.
-// If the data doesn't have FPLY framing, it's returned as-is.
-func fplyUnwrap(data []byte) []byte {
-	if len(data) >= 12 && string(data[:4]) == "FPLY" {
-		return data[12:]
-	}
-	return data
-}
-
 // deriveStreamKeys derives AES stream encryption keys from the pair-verify shared secret.
 func (c *AirPlayClient) deriveStreamKeys() error {
 	if c.encWriteKey == nil {

internal/airplay/fairplay_crypto.go

@@ -2,7 +2,11 @@ package airplay
 
 import (
 	"crypto/aes"
+	"crypto/hmac"
+	"crypto/sha1"
 	"encoding/binary"
+	"fmt"
+	"io"
 )
 
 var fairplayInitialSessionKey = [16]byte{
@@ -20,19 +24,7 @@ var fairplayKDFSuffix = [17]byte{
 	0x97, 0xae, 0x70, 0xfb, 0xe0, 0x00, 0x3f, 0x1c, 0x39,
 }
 
-// Only the second 128 bytes of the fixed SAP record participate in the KDF.
-var fairplayDefaultSAPTail = [128]byte{
-	0x00, 0x01, 0xcc, 0x34, 0x2a, 0x5e, 0x5b, 0x1a, 0x67, 0x73, 0xc2, 0x0e, 0x21, 0xb8, 0x22, 0x4d,
-	0xf8, 0x62, 0x48, 0x18, 0x64, 0xef, 0x81, 0x0a, 0xae, 0x2e, 0x37, 0x03, 0xc8, 0x81, 0x9c, 0x23,
-	0x53, 0x9d, 0xe5, 0xf5, 0xd7, 0x49, 0xbc, 0x5b, 0x7a, 0x26, 0x6c, 0x49, 0x62, 0x83, 0xce, 0x7f,
-	0x03, 0x93, 0x7a, 0xe1, 0xf6, 0x16, 0xde, 0x0c, 0x15, 0xff, 0x33, 0x8c, 0xca, 0xff, 0xb0, 0x9e,
-	0xaa, 0xbb, 0xe4, 0x0f, 0x5d, 0x5f, 0x55, 0x8f, 0xb9, 0x7f, 0x17, 0x31, 0xf8, 0xf7, 0xda, 0x60,
-	0xa0, 0xec, 0x65, 0x79, 0xc3, 0x3e, 0xa9, 0x83, 0x12, 0xc3, 0xb6, 0x71, 0x35, 0xa6, 0x69, 0x4f,
-	0xf8, 0x23, 0x05, 0xd9, 0xba, 0x5c, 0x61, 0x5f, 0xa2, 0x54, 0xd2, 0xb1, 0x83, 0x45, 0x83, 0xce,
-	0xe4, 0x2d, 0x44, 0x26, 0xc8, 0x35, 0xa7, 0xa5, 0xf6, 0xc8, 0x42, 0x1c, 0x0d, 0xa3, 0xf1, 0xc7,
-}
-
-func deriveFairPlayWrappingKey(sapTail []byte, message []byte) [16]byte {
+func deriveFairPlayWrappingKey(receiverSAP [128]byte, message []byte) [16]byte {
 	var decrypted [128]byte
 	decryptFairPlayMessage(message, decrypted[:])
 
@@ -42,7 +34,7 @@ func deriveFairPlayWrappingKey(sapTail []byte, message []byte) [16]byte {
 	var material [320]byte
 	offset := copy(material[:], fairplayKDFPrefix[:])
 	offset += copy(material[offset:], decrypted[:])
-	offset += copy(material[offset:], sapTail[:128])
+	offset += copy(material[offset:], receiverSAP[:])
 	offset += copy(material[offset:], fairplayKDFSuffix[:])
 	material[offset] = 0x80
 	binary.LittleEndian.PutUint64(material[len(material)-8:], uint64(offset)*8)
@@ -59,17 +51,54 @@ func deriveFairPlayWrappingKey(sapTail []byte, message []byte) [16]byte {
 	return fairplayWordsBigEndian(state)
 }
 
-func unwrapFairPlayKey(m3 []byte, ekey []byte) [16]byte {
-	aesKey := deriveFairPlayWrappingKey(fairplayDefaultSAPTail[:], m3)
-	cipher, err := aes.NewCipher(aesKey[:])
-	if err != nil {
-		panic(err) // aesKey always has the fixed AES-128 length.
+// wrapFairPlayKey emits the 72-byte AirPlay v3 record produced by Apple's
+// FairPlay sender:
+//
+//	[0:16]  FPLY encrypted-key header
+//	[16:32] per-key random mask
+//	[32:36] big-endian raw-key length (16)
+//	[36:56] HMAC-SHA1(session MAC key, record[0:36] || raw key)
+//	[56:72] AES-wrapped (raw key XOR mask)
+//
+// Both session keys depend on the receiver's decrypted m2 SAP. Reusing a
+// captured receiver SAP makes the record self-consistent only for that capture.
+// The native sender obtains the mask from its session PRNG; accepting an entropy
+// source here preserves the wire semantics without reproducing that PRNG.
+func wrapFairPlayKey(receiverSAP [128]byte, m3 []byte, rawKey [16]byte, entropy io.Reader) ([72]byte, error) {
+	var ekey [72]byte
+	if err := validateFPSAPRecord(m3, 3, 152); err != nil {
+		return ekey, fmt.Errorf("invalid m3: %w", err)
+	}
+	if mode := m3[12]; int(mode) >= len(fairplayMessageIV) {
+		return ekey, fmt.Errorf("unsupported FairPlay mode %d", mode)
 	}
 
-	var keyOut [16]byte
-	cipher.Decrypt(keyOut[:], ekey[56:72])
-	for i := range keyOut {
-		keyOut[i] ^= ekey[16+i]
+	copy(ekey[:], []byte{
+		'F', 'P', 'L', 'Y', 0x01, 0x02, 0x01, 0x00,
+		0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00,
+	})
+	if _, err := io.ReadFull(entropy, ekey[16:32]); err != nil {
+		return [72]byte{}, fmt.Errorf("generate FairPlay key mask: %w", err)
 	}
-	return keyOut
+	binary.BigEndian.PutUint32(ekey[32:36], uint32(len(rawKey)))
+
+	wrappingKey := deriveFairPlayWrappingKey(receiverSAP, m3)
+	cipher, err := aes.NewCipher(wrappingKey[:])
+	if err != nil {
+		return [72]byte{}, fmt.Errorf("create FairPlay wrapping cipher: %w", err)
+	}
+	var masked [16]byte
+	for i := range masked {
+		masked[i] = rawKey[i] ^ ekey[16+i]
+	}
+	cipher.Encrypt(ekey[56:72], masked[:])
+
+	var senderSAP [128]byte
+	decryptFairPlayMessage(m3, senderSAP[:])
+	macKey := fpsapDescriptorForSAP(senderSAP, receiverSAP)
+	mac := hmac.New(sha1.New, macKey[:])
+	_, _ = mac.Write(ekey[:36])
+	_, _ = mac.Write(rawKey[:])
+	copy(ekey[36:56], mac.Sum(nil))
+	return ekey, nil
 }