Merge 'upstream/master'

6 files changed, 747 insertions, 0 deletions

diff --git a/libdino/src/crypto/openssl/cipher.vala b/libdino/src/crypto/openssl/cipher.vala
new file mode 100644
index 00000000..02064770
--- /dev/null
+++ b/libdino/src/crypto/openssl/cipher.vala
@@ -0,0 +1,156 @@
+namespace Dino.Crypto {
+
+internal class SymmetricCipherEncryptionOpenssl : SymmetricCipher, SymmetricCipherEncryption, Object {
+    private OpenSSL.EVP.CipherContext? cipher;
+    private bool is_finalized = false;
+
+    public SymmetricCipherEncryptionOpenssl(string algo_name) throws Error {
+        if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+        cipher = new OpenSSL.EVP.CipherContext();
+    }
+
+    public void set_key(uint8[] key) throws Error {
+        unowned OpenSSL.EVP.Cipher algo;
+        if (key.length == 16) {
+            algo = OpenSSL.EVP.aes_128_gcm();
+        } else if (key.length == 32) {
+            algo = OpenSSL.EVP.aes_256_gcm();
+        } else {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+        }
+        try {
+            cipher.encrypt_init(algo, null, null);
+            cipher.encrypt_init(null, key, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_iv(uint8[] iv) throws Error {
+        if (iv.length != 12) {
+            cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+        }
+        try {
+            cipher.encrypt_init(null, null, iv);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void reset() throws Error {
+        throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+    }
+
+    public uint8[] get_tag(size_t taglen) throws Error {
+        uint8[] tag = new uint8[taglen];
+        if (!is_finalized) {
+            uint8[] empty = new uint8[0];
+            int empty_len = 0;
+            try {
+                cipher.encrypt_final(empty, out empty_len);
+            } catch (GLib.Error e) {
+                throw new Crypto.Error.OPENSSL(e.message);
+            }
+            if (empty_len != 0) {
+                throw new Crypto.Error.ILLEGAL_ARGUMENTS("get_tag called on a stream with remaining data");
+            }
+        }
+        if (cipher.ctrl(OpenSSL.EVP.Control.GCM_GET_TAG, (int)taglen, tag) != 1) {
+            openssl_error();
+        }
+        return tag;
+    }
+
+    public int encrypt(uint8[] output, uint8[] input) throws Error {
+        int output_length = output.length;
+        if (is_finalized) {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("encrypt called after get_tag");
+        }
+        try {
+            cipher.encrypt_update(output, out output_length, input);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+        return output_length;
+    }
+}
+
+internal class SymmetricCipherDecryptionOpenssl : SymmetricCipher, SymmetricCipherDecryption, Object {
+    private OpenSSL.EVP.CipherContext? cipher;
+    private bool is_finalized = false;
+
+    public SymmetricCipherDecryptionOpenssl(string algo_name) throws Error {
+        if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+        cipher = new OpenSSL.EVP.CipherContext();
+        try {
+            cipher.decrypt_init(OpenSSL.EVP.aes_128_gcm(), null, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_key(uint8[] key) throws Error {
+        unowned OpenSSL.EVP.Cipher algo;
+        if (key.length == 16) {
+            algo = OpenSSL.EVP.aes_128_gcm();
+        } else if (key.length == 32) {
+            algo = OpenSSL.EVP.aes_256_gcm();
+        } else {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+        }
+        try {
+            cipher.decrypt_init(algo, null, null);
+            cipher.decrypt_init(null, key, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_iv(uint8[] iv) throws Error {
+        if (iv.length != 12) {
+            cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+        }
+        try {
+            cipher.decrypt_init(null, null, iv);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void reset() throws Error {
+        throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+    }
+
+    public void check_tag(uint8[] tag) throws Error {
+        if (cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_TAG, tag.length, tag) != 1) {
+            openssl_error();
+        }
+        if (!is_finalized) {
+            uint8[] empty = new uint8[0];
+            int empty_len = 0;
+            try {
+                cipher.decrypt_final(empty, out empty_len);
+            } catch (GLib.Error e) {
+                throw new Crypto.Error.OPENSSL(e.message);
+            }
+            if (empty_len != 0) {
+                throw new Crypto.Error.ILLEGAL_ARGUMENTS("check_tag called on a stream with remaining data");
+            }
+        }
+    }
+
+    public int decrypt(uint8[] output, uint8[] input) throws Error {
+        if (is_finalized) {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("decrypt called after check_tag");
+        }
+        int output_length = output.length;
+        try {
+            cipher.decrypt_update(output, out output_length, input);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+        return output_length;
+    }
+}
+
+}
diff --git a/libdino/src/crypto/openssl/dtls_srtp.vala b/libdino/src/crypto/openssl/dtls_srtp.vala
new file mode 100644
index 00000000..192f0da2
--- /dev/null
+++ b/libdino/src/crypto/openssl/dtls_srtp.vala
@@ -0,0 +1,202 @@
+using OpenSSL;
+
+namespace Dino.Crypto.DtlsSrtp {
+
+public class CredentialsCapsuleOpenSSL : CredentialsCapsule {
+    internal X509.Certificate own_cert;
+    internal EVP.Key private_key;
+}
+
+public CredentialsCapsule generate_credentials () throws GLib.Error {
+    EVP.Key key = new EVP.Key.generate_ecdsa ("prime256v1");
+
+    var start_time = new DateTime.now_local().add_days(-1);
+    var end_time = start_time.add_days (2);
+
+    X509.Certificate cert = new X509.Certificate ();
+    cert.set_public_key (key);
+    cert.set_version (1);
+    cert.not_before.set ((time_t) start_time.to_unix ());
+    cert.not_after.set ((time_t) end_time.to_unix ());
+    cert.serial_number.set (1);
+
+    cert.sign (key, EVP.sha256 ());
+
+    CredentialsCapsuleOpenSSL credentials = new CredentialsCapsuleOpenSSL ();
+    credentials.own_fingerprint = cert.digest (EVP.sha256 ());
+    credentials.own_cert = (owned) cert;
+    credentials.private_key = (owned) key;
+    return credentials;
+}
+
+public class Handler : AbstractHandler {
+
+    public Handler.with_cert (CredentialsCapsule creds) {
+        base.with_cert (creds);
+    }
+
+    protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread () {
+        debug("Setting up DTLS connection using OpenSSL. We're %s", mode.to_string());
+        SSL.Context context = new SSL.Context (mode == Mode.SERVER ? SSL.Method.DTLS_SERVER : SSL.Method.DTLS_CLIENT);
+        context.set_tlsext_use_srtp ("SRTP_AES128_CM_SHA1_80");
+        context.use_certificate (((CredentialsCapsuleOpenSSL) credentials).own_cert);
+        context.use_private_key (((CredentialsCapsuleOpenSSL) credentials).private_key);
+        SSL session = new SSL (context);
+        BIO<Handler> bio = new BIO<Handler>(get_handler_based_bio_method());
+        bio.data = this;
+        session.rbio = bio;
+        session.wbio = bio;
+
+        DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
+        int err = 0;
+        if (mode == Mode.SERVER) {
+            session.set_accept_state ();
+        } else {
+            session.set_connect_state ();
+        }
+        do {
+            try {
+                SSL.Error ret = session.do_handshake();
+                switch (ret) {
+                    case SSL.Error.NONE:
+                        err = 1;
+                        break;
+                    case SSL.Error.WANT_READ:
+                        debug ("DTLS wants to read, but nothing in queue, wait for buffer");
+                        buffer_mutex.lock();
+                        if (buffer_queue.size == 0) {
+                            buffer_cond.wait_until(buffer_mutex, get_monotonic_time() + maximum_time.difference(new DateTime.now_utc()));
+                        }
+                        buffer_mutex.unlock();
+                        err = -1;
+                        break;
+                    default:
+                        warning ("DTLS Error: %s", @"$ret");
+                        err = 4;
+                        break;
+                }
+            } catch (Error e) {
+                warning ("DTLS Error: %s", e.message);
+                err = e.code;
+            }
+
+            DateTime current_time = new DateTime.now_utc();
+            if (maximum_time.compare(current_time) < 0) {
+                debug ("DTLS handshake timeouted");
+                err = 2;
+                break;
+            }
+            if (stop) {
+                debug ("DTLS handshake stopped");
+                err = 3;
+                break;
+            }
+        } while (err < 0);
+
+        buffer_mutex.lock();
+        if (stop) {
+            stop = false;
+            running = false;
+            bool restart = restart;
+            buffer_mutex.unlock();
+            if (restart) {
+                debug ("Restarting DTLS handshake");
+                return setup_dtls_connection_thread();
+            }
+            return null;
+        }
+        buffer_mutex.unlock();
+        if (err != 1) {
+            debug ("DTLS handshake failed");
+            return null;
+        }
+
+        // TODO: Check peer certificate
+
+        uint8[] km = new uint8[60];
+        session.export_keying_material (km, "EXTRACTOR-dtls_srtp");
+        uint8[] client_key = km[0:16];
+        uint8[] server_key = km[16:32];
+        uint8[] client_salt = km[32:46];
+        uint8[] server_salt = km[46:60];
+
+        debug ("Finished DTLS connection. We're %s", mode.to_string());
+        if (mode == Mode.SERVER) {
+            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
+            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
+        } else {
+            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
+            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
+        }
+        return new Xmpp.Xep.Jingle.ContentEncryption (Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint);
+    }
+
+    private int read_impl (BIO<Handler> bio, uint8[] out_buf) {
+        Bytes data = get_buffer_if_present ();
+        if (data == null) {
+            if (!stop) {
+                debug ("No pending buffer in queue, but end not reached yet, set_retry_read");
+                bio.set_retry_read ();
+            }
+            return -1;
+        }
+        if (data.length > out_buf.length) {
+            warning ("Buffer in queue does not fit in out_buf");
+            return -1;
+        }
+        debug ("Read %d bytes from queue", data.length);
+
+        uint8[] data_uint8 = Bytes.unref_to_data((owned) data);
+        Memory.copy (out_buf, data_uint8, data_uint8.length);
+        bio.clear_retry_flags ();
+        return data_uint8.length;
+    }
+
+    private int write_impl (BIO<Handler> bio, uint8[] buf) {
+        debug ("Write %d bytes to network", buf.length);
+        send_data (buf);
+        return buf.length;
+    }
+
+    private long ctrl_impl (BIO<Handler> bio, BIO.ControlCommand cmd, long num, void* ptr) {
+        switch (cmd) {
+            case BIO.ControlCommand.FLUSH:
+                // Datagrams are sent out immediately
+                return 1;
+            case BIO.ControlCommand.DGRAM_SET_NEXT_TIMEOUT:
+                // Datagrams are sent out immediately
+                return 1;
+            case BIO.ControlCommand.DGRAM_GET_MTU_OVERHEAD:
+                // Just some safe estimate
+                return 70;
+            case BIO.ControlCommand.DGRAM_QUERY_MTU:
+                // Just some safe estimate
+                return 1200;
+            case BIO.ControlCommand.WPENDING:
+                // Datagrams are sent out immediately
+                return 0;
+            case BIO.ControlCommand.POP:
+            case BIO.ControlCommand.PUSH:
+                // Ignored
+                return 0;
+            default:
+                warning (@"Unimplemented ctrl cmd:$cmd, num:$num");
+                return 0;
+        }
+    }
+
+    private static BIO.Method<Handler> _handler_based_bio_method_instance = null;
+
+    private static unowned BIO.Method<Handler> get_handler_based_bio_method () {
+        if (_handler_based_bio_method_instance != null) return _handler_based_bio_method_instance;
+        _handler_based_bio_method_instance = new BIO.Method<Handler> (BIO.Type.SOURCE_SINK | BIO.Type.DGRAM, "Dino DTLS Handler BIO");
+        _handler_based_bio_method_instance.read = (bio, out_buf) => bio.data.read_impl (bio, out_buf);
+        _handler_based_bio_method_instance.write = (bio, buf) => bio.data.write_impl (bio, buf);
+        _handler_based_bio_method_instance.ctrl = (bio, cmd, num, ptr) => bio.data.ctrl_impl (bio, cmd, num, ptr);
+        return _handler_based_bio_method_instance;
+    }
+}
+
+
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/openssl/omemo.c b/libdino/src/crypto/openssl/omemo.c
new file mode 100644
index 00000000..0912c172
--- /dev/null
+++ b/libdino/src/crypto/openssl/omemo.c
@@ -0,0 +1,313 @@
+#include "../omemo/helper.h"
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+
+int signal_vala_random_generator(uint8_t *data, size_t len, void *user_data) {
+    return RAND_bytes(data, len) == 1 ? SG_SUCCESS : SG_ERR_UNKNOWN;
+}
+
+struct SIGNAL_VALA_HMAC_CTX {
+    EVP_PKEY *pkey;
+    EVP_MD_CTX *ctx;
+};
+
+int signal_vala_hmac_sha256_init(void **hmac_context, const uint8_t *key, size_t key_len, void *user_data) {
+    EVP_PKEY *pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, key, key_len);
+    if (!pkey) {
+        return SG_ERR_NOMEM;
+    }
+    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+    if (!ctx) {
+        EVP_PKEY_free(pkey);
+        return SG_ERR_NOMEM;
+    }
+    if (EVP_DigestSignInit(ctx, NULL, EVP_sha256(), NULL, pkey) != 1) {
+        EVP_MD_CTX_free(ctx);
+        EVP_PKEY_free(pkey);
+        return SG_ERR_UNKNOWN;
+    }
+
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = malloc(sizeof(*hmac_ctx));
+    hmac_ctx->pkey = pkey;
+    hmac_ctx->ctx = ctx;
+    *hmac_context = hmac_ctx;
+
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_update(void *hmac_context, const uint8_t *data, size_t data_len, void *user_data) {
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (EVP_DigestSignUpdate(hmac_ctx->ctx, data, data_len) != 1) {
+        return SG_ERR_UNKNOWN;
+    }
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_final(void *hmac_context, signal_buffer **output, void *user_data) {
+    size_t len;
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (EVP_DigestSignFinal(hmac_ctx->ctx, NULL, &len) != 1) {
+        return SG_ERR_UNKNOWN;
+    }
+    signal_buffer *output_buffer = signal_buffer_alloc(len);
+    if (!output_buffer) {
+        return SG_ERR_NOMEM;
+    }
+    size_t another_len = len;
+    if (EVP_DigestSignFinal(hmac_ctx->ctx, signal_buffer_data(output_buffer), &another_len) != 1) {
+        signal_buffer_free(output_buffer);
+        return SG_ERR_UNKNOWN;
+    }
+    if (another_len != len) {
+        signal_buffer_free(output_buffer);
+        return SG_ERR_UNKNOWN;
+    }
+    *output = output_buffer;
+    return SG_SUCCESS;
+}
+
+void signal_vala_hmac_sha256_cleanup(void *hmac_context, void *user_data) {
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (hmac_ctx) {
+        EVP_MD_CTX_free(hmac_ctx->ctx);
+        EVP_PKEY_free(hmac_ctx->pkey);
+        free(hmac_ctx);
+    }
+}
+
+static const EVP_CIPHER *aes_cipher(int cipher, size_t key_len) {
+    switch (cipher) {
+        case SG_CIPHER_AES_CBC_PKCS5:
+            switch (key_len) {
+                case 16: return EVP_aes_128_cbc();
+                case 24: return EVP_aes_192_cbc();
+                case 32: return EVP_aes_256_cbc();
+            }
+            break;
+        case SG_CIPHER_AES_CTR_NOPADDING:
+            switch (key_len) {
+                case 16: return EVP_aes_128_ctr();
+                case 24: return EVP_aes_192_ctr();
+                case 32: return EVP_aes_256_ctr();
+            }
+            break;
+        case SG_CIPHER_AES_GCM_NOPADDING:
+            switch (key_len) {
+                case 16: return EVP_aes_128_gcm();
+                case 24: return EVP_aes_192_gcm();
+                case 32: return EVP_aes_256_gcm();
+            }
+            break;
+
+    }
+    return NULL;
+}
+
+int signal_vala_encrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *plaintext, size_t plaintext_len,
+        void *user_data) {
+    int result = 0;
+    uint8_t *out_buf = NULL;
+    const EVP_CIPHER *evp_cipher = aes_cipher(cipher, key_len);
+    if (!evp_cipher) {
+        // fprintf(stderr, "invalid AES mode or key size: %zu\n", key_len);
+        return SG_ERR_INVAL;
+    }
+    if (plaintext_len > INT_MAX - EVP_CIPHER_block_size(evp_cipher)) {
+        // fprintf(stderr, "invalid plaintext length: %zu\n", plaintext_len);
+        return SG_ERR_UNKNOWN;
+    }
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+    int buf_extra = 0;
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        // In GCM mode we use the last 16 bytes as auth tag
+        buf_extra += 16;
+
+        if (EVP_EncryptInit_ex(ctx, evp_cipher, NULL, NULL, NULL) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL) != 1) {
+            // fprintf(stderr, "cannot set iv size\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv) != 1) {
+            // fprintf(stderr, "cannot set key/iv\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    } else {
+        // TODO: set ivlen?
+        if (EVP_EncryptInit_ex(ctx, evp_cipher, 0, key, iv) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    if (cipher == SG_CIPHER_AES_CTR_NOPADDING || cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            // fprintf(stderr, "cannot set padding\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    out_buf = malloc(plaintext_len + EVP_CIPHER_block_size(evp_cipher) + buf_extra);
+    if (!out_buf) {
+        // fprintf(stderr, "cannot allocate output buffer\n");
+        result = SG_ERR_NOMEM;
+        goto complete;
+    }
+
+    int out_len = 0;
+    if (EVP_EncryptUpdate(ctx, out_buf, &out_len, plaintext, plaintext_len) != 1) {
+        // fprintf(stderr, "cannot encrypt plaintext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    int final_len = 0;
+    if (EVP_EncryptFinal_ex(ctx, out_buf + out_len, &final_len) != 1) {
+        // fprintf(stderr, "cannot finish encrypting plaintext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, out_buf + out_len + final_len) != 1) {
+            // fprintf(stderr, "cannot get tag\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    *output = signal_buffer_create(out_buf, out_len + final_len + buf_extra);
+
+complete:
+    EVP_CIPHER_CTX_free(ctx);
+    if (out_buf) {
+        free(out_buf);
+    }
+    return result;
+}
+
+int signal_vala_decrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *ciphertext, size_t ciphertext_len,
+        void *user_data) {
+    int result = 0;
+    uint8_t *out_buf = NULL;
+    const EVP_CIPHER *evp_cipher = aes_cipher(cipher, key_len);
+    if (!evp_cipher) {
+        // fprintf(stderr, "invalid AES mode or key size: %zu\n", key_len);
+        return SG_ERR_INVAL;
+    }
+    if (ciphertext_len > INT_MAX - EVP_CIPHER_block_size(evp_cipher)) {
+        // fprintf(stderr, "invalid ciphertext length: %zu\n", ciphertext_len);
+        return SG_ERR_UNKNOWN;
+    }
+
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        // In GCM mode we use the last 16 bytes as auth tag
+        ciphertext_len -= 16;
+
+        if (EVP_DecryptInit_ex(ctx, evp_cipher, NULL, NULL, NULL) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL) != 1) {
+            // fprintf(stderr, "cannot set iv size\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv) != 1) {
+            // fprintf(stderr, "cannot set key/iv\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    } else {
+        // TODO: set ivlen?
+        if (EVP_DecryptInit_ex(ctx, evp_cipher, 0, key, iv) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    if (cipher == SG_CIPHER_AES_CTR_NOPADDING || cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            // fprintf(stderr, "cannot set padding\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    out_buf = malloc(ciphertext_len + EVP_CIPHER_block_size(evp_cipher));
+    if (!out_buf) {
+        // fprintf(stderr, "cannot allocate output buffer\n");
+        result = SG_ERR_NOMEM;
+        goto complete;
+    }
+
+    int out_len = 0;
+    if (EVP_DecryptUpdate(ctx, out_buf, &out_len, ciphertext, ciphertext_len) != 1) {
+        // fprintf(stderr, "cannot decrypt ciphertext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, (void *)(ciphertext + ciphertext_len)) != 1) {
+            // fprintf(stderr, "cannot set tag\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    int final_len = 0;
+    if (EVP_DecryptFinal_ex(ctx, out_buf + out_len, &final_len) != 1) {
+        // fprintf(stderr, "cannot finish decrypting ciphertexts\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    *output = signal_buffer_create(out_buf, out_len + final_len);
+
+complete:
+    EVP_CIPHER_CTX_free(ctx);
+    if (out_buf) {
+        free(out_buf);
+    }
+    return result;
+}
+
+void setup_signal_vala_crypto_provider(signal_context *context) {
+    signal_crypto_provider provider = {
+            .random_func = signal_vala_random_generator,
+            .hmac_sha256_init_func = signal_vala_hmac_sha256_init,
+            .hmac_sha256_update_func = signal_vala_hmac_sha256_update,
+            .hmac_sha256_final_func = signal_vala_hmac_sha256_final,
+            .hmac_sha256_cleanup_func = signal_vala_hmac_sha256_cleanup,
+            .encrypt_func = signal_vala_encrypt,
+            .decrypt_func = signal_vala_decrypt,
+            .user_data = 0
+    };
+
+    signal_context_set_crypto_provider(context, &provider);
+}
diff --git a/libdino/src/crypto/openssl/utils.c b/libdino/src/crypto/openssl/utils.c
new file mode 100644
index 00000000..1a84f642
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.c
@@ -0,0 +1,49 @@
+#include "utils.h"
+#include <openssl/opensslv.h>
+#include <openssl/ec.h>
+
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
+// This is for OpenSSL 3.0.0 and newer
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
+    // Generate EVP_PKEY directly
+    EVP_PKEY *pkey = EVP_EC_gen (curve);
+    return pkey;
+}
+
+#else
+// This is for OpenSSL before 3.0.0 and forks of earlier OpenSSL versions like LibreSSL
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
+    // Get NID from curve name
+    int nid = OBJ_sn2nid (curve);
+    if (nid == NID_undef) return NULL;
+
+    // Create EC_KEY
+    EC_KEY *ec_key = EC_KEY_new_by_curve_name (nid);
+    if (!ec_key) return NULL;
+
+    // Generate key
+    if (!EC_KEY_generate_key (ec_key)) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // Create EVP_PKEY
+    EVP_PKEY *pkey = EVP_PKEY_new ();
+    if (!pkey) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // Assign EC_KEY to EVP_PKEY
+    if (!EVP_PKEY_assign_EC_KEY (pkey, ec_key)) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // EVP_PKEY_assign_EC_KEY takes ownership of ec_key, no need to free it explicitly
+    return pkey;
+}
+
+#endif
diff --git a/libdino/src/crypto/openssl/utils.h b/libdino/src/crypto/openssl/utils.h
new file mode 100644
index 00000000..bcc6f53a
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.h
@@ -0,0 +1,8 @@
+#ifndef DINO_OPENSSL_UTILS_H
+#define DINO_OPENSSL_UTILS_H
+
+#include <openssl/evp.h>
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve);
+
+#endif //DINO_OPENSSL_UTILS_H
\ No newline at end of file
diff --git a/libdino/src/crypto/openssl/utils.vala b/libdino/src/crypto/openssl/utils.vala
new file mode 100644
index 00000000..7a9ed9b6
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.vala
@@ -0,0 +1,19 @@
+namespace Dino.Crypto {
+
+public static void randomize(uint8[] buffer) {
+    OpenSSL.RAND.bytes(buffer);
+}
+
+internal void openssl_error() throws Error {
+    throw new Crypto.Error.OPENSSL(OpenSSL.ERR.reason_error_string(OpenSSL.ERR.get_error()));
+}
+
+public SymmetricCipherEncryption create_symmetric_cipher_encryption(string algo_name) throws Error {
+    return new SymmetricCipherEncryptionOpenssl(algo_name);
+}
+
+public SymmetricCipherDecryption create_symmetric_cipher_decryption(string algo_name) throws Error {
+    return new SymmetricCipherDecryptionOpenssl(algo_name);
+}
+
+}