Use Libsignal to validate sealed-sender certificates

ts/textsecure/MessageReceiver.ts

@@ -39,7 +39,6 @@ import {
   Sessions,
   SignedPreKeys,
 } from '../LibSignalStores';
-import { verifySignature } from '../Curve';
 import { createName } from '../util/attachmentPath';
 import { assertDev, strictAssert } from '../util/assert';
 import type { BatcherType } from '../util/batcher';
@@ -1623,60 +1622,35 @@ export default class MessageReceiver
   }
 
   #validateUnsealedEnvelope(envelope: UnsealedEnvelope): void {
-    const { unsealedContent: messageContent, certificate } = envelope;
+    const {
+      unsealedContent: messageContent,
+      certificate,
+      serverTimestamp,
+    } = envelope;
+
+    const envelopeId = getEnvelopeId(envelope);
+    const logId = `MessageReceiver.validateUnsealedEnvelope(${envelopeId})`;
+
     strictAssert(
       messageContent !== undefined,
-      'Missing message content for sealed sender message'
+      `${logId}: Missing message content for sealed sender message`
     );
     strictAssert(
       certificate !== undefined,
-      'Missing sender certificate for sealed sender message'
+      `${logId}: Missing sender certificate for sealed sender message`
     );
-
+    strictAssert(
-    if (!envelope.serverTimestamp) {
+      serverTimestamp > 0,
-      throw new Error(
+      `${logId}: Sealed sender message was missing serverTimestamp`
-        'MessageReceiver.decryptSealedSender: ' +
-          'Sealed sender message was missing serverTimestamp'
     );
-    }
-
-    const serverCertificate = certificate.serverCertificate();
 
     if (
-      !verifySignature(
+      !certificate.validate(
-        this.#serverTrustRoot,
+        PublicKey.deserialize(Buffer.from(this.#serverTrustRoot)),
-        serverCertificate.certificateData(),
+        serverTimestamp
-        serverCertificate.signature()
       )
     ) {
-      throw new Error(
+      throw new Error(`${logId}: Sealed sender certificate validation failed`);
-        'MessageReceiver.validateUnsealedEnvelope: ' +
-          'Server certificate trust root validation failed'
-      );
-    }
-
-    if (
-      !verifySignature(
-        serverCertificate.key().serialize(),
-        certificate.certificate(),
-        certificate.signature()
-      )
-    ) {
-      throw new Error(
-        'MessageReceiver.validateUnsealedEnvelope: ' +
-          'Server certificate server signature validation failed'
-      );
-    }
-
-    const logId = getEnvelopeId(envelope);
-
-    if (envelope.serverTimestamp > certificate.expiration()) {
-      throw new Error(
-        'MessageReceiver.validateUnsealedEnvelope: ' +
-          `Sender certificate is expired for envelope ${logId}, ` +
-          `serverTimestamp: ${envelope.serverTimestamp}, ` +
-          `expiration: ${certificate.expiration()}`
-      );
     }
 
     return undefined;