Break out into a multi-module project

service/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+import com.codahale.metrics.Meter;
+import com.codahale.metrics.MetricRegistry;
+import com.codahale.metrics.SharedMetricRegistries;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Constants;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import java.util.Optional;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.auth.AuthenticationException;
+import io.dropwizard.auth.Authenticator;
+import io.dropwizard.auth.basic.BasicCredentials;
+
+public class AccountAuthenticator implements Authenticator<BasicCredentials, Account> {
+
+  private final MetricRegistry metricRegistry               = SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME);
+  private final Meter          authenticationFailedMeter    = metricRegistry.meter(name(getClass(), "authentication", "failed"   ));
+  private final Meter          authenticationSucceededMeter = metricRegistry.meter(name(getClass(), "authentication", "succeeded"));
+
+  private final Logger logger = LoggerFactory.getLogger(AccountAuthenticator.class);
+
+  private final AccountsManager accountsManager;
+
+  public AccountAuthenticator(AccountsManager accountsManager) {
+    this.accountsManager = accountsManager;
+  }
+
+  @Override
+  public Optional<Account> authenticate(BasicCredentials basicCredentials)
+      throws AuthenticationException
+  {
+    try {
+      AuthorizationHeader authorizationHeader = AuthorizationHeader.fromUserAndPassword(basicCredentials.getUsername(), basicCredentials.getPassword());
+      Optional<Account>   account             = accountsManager.get(authorizationHeader.getNumber());
+
+      if (!account.isPresent()) {
+        return Optional.empty();
+      }
+
+      Optional<Device> device = account.get().getDevice(authorizationHeader.getDeviceId());
+
+      if (!device.isPresent()) {
+        return Optional.empty();
+      }
+
+      if (!device.get().isMaster() && device.get().isIdleInactive()) {
+        return Optional.empty();
+      }
+
+      if (device.get().getAuthenticationCredentials().verify(basicCredentials.getPassword())) {
+        authenticationSucceededMeter.mark();
+        account.get().setAuthenticatedDevice(device.get());
+        updateLastSeen(account.get(), device.get());
+        return account;
+      }
+
+      authenticationFailedMeter.mark();
+      return Optional.empty();
+    } catch (InvalidAuthorizationHeaderException iahe) {
+      return Optional.empty();
+    }
+  }
+
+  private void updateLastSeen(Account account, Device device) {
+    if (device.getLastSeen() != Util.todayInMillis()) {
+      device.setLastSeen(Util.todayInMillis());
+      accountsManager.update(account);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/Anonymous.java

@@ -0,0 +1,24 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+
+public class Anonymous {
+
+  private final byte[] unidentifiedSenderAccessKey;
+
+  public Anonymous(String header) {
+    try {
+      this.unidentifiedSenderAccessKey = Base64.decode(header);
+    } catch (IOException e) {
+      throw new WebApplicationException(e, Response.Status.UNAUTHORIZED);
+    }
+  }
+
+  public byte[] getAccessKey() {
+    return unidentifiedSenderAccessKey;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/AuthenticationCredentials.java

@@ -0,0 +1,72 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+
+public class AuthenticationCredentials {
+
+  private final Logger logger = LoggerFactory.getLogger(AuthenticationCredentials.class);
+
+  private final String hashedAuthenticationToken;
+  private final String salt;
+
+  public AuthenticationCredentials(String hashedAuthenticationToken, String salt) {
+    this.hashedAuthenticationToken = hashedAuthenticationToken;
+    this.salt                      = salt;
+  }
+
+  public AuthenticationCredentials(String authenticationToken) {
+    this.salt                      = Math.abs(new SecureRandom().nextInt()) + "";
+    this.hashedAuthenticationToken = getHashedValue(salt, authenticationToken);
+  }
+
+  public String getHashedAuthenticationToken() {
+    return hashedAuthenticationToken;
+  }
+
+  public String getSalt() {
+    return salt;
+  }
+
+  public boolean verify(String authenticationToken) {
+    String theirValue = getHashedValue(salt, authenticationToken);
+
+    logger.debug("Comparing: " + theirValue + " , " + this.hashedAuthenticationToken);
+
+    return theirValue.equals(this.hashedAuthenticationToken);
+  }
+
+  private static String getHashedValue(String salt, String token) {
+    Logger logger = LoggerFactory.getLogger(AuthenticationCredentials.class);
+    logger.debug("Getting hashed token: " + salt + " , " + token);
+
+    try {
+      return new String(Hex.encodeHex(MessageDigest.getInstance("SHA1").digest((salt + token).getBytes("UTF-8"))));
+    } catch (NoSuchAlgorithmException | UnsupportedEncodingException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/AuthorizationHeader.java

@@ -0,0 +1,93 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import java.io.IOException;
+
+public class AuthorizationHeader {
+
+  private final String number;
+  private final long   accountId;
+  private final String password;
+
+  private AuthorizationHeader(String number, long accountId, String password) {
+    this.number    = number;
+    this.accountId = accountId;
+    this.password  = password;
+  }
+
+  public static AuthorizationHeader fromUserAndPassword(String user, String password) throws InvalidAuthorizationHeaderException {
+    try {
+      String[] numberAndId = user.split("\\.");
+      return new AuthorizationHeader(numberAndId[0],
+                                     numberAndId.length > 1 ? Long.parseLong(numberAndId[1]) : 1,
+                                     password);
+    } catch (NumberFormatException nfe) {
+      throw new InvalidAuthorizationHeaderException(nfe);
+    }
+  }
+
+  public static AuthorizationHeader fromFullHeader(String header) throws InvalidAuthorizationHeaderException {
+    try {
+      if (header == null) {
+        throw new InvalidAuthorizationHeaderException("Null header");
+      }
+
+      String[] headerParts = header.split(" ");
+
+      if (headerParts == null || headerParts.length < 2) {
+        throw new InvalidAuthorizationHeaderException("Invalid authorization header: " + header);
+      }
+
+      if (!"Basic".equals(headerParts[0])) {
+        throw new InvalidAuthorizationHeaderException("Unsupported authorization method: " + headerParts[0]);
+      }
+
+      String concatenatedValues = new String(Base64.decode(headerParts[1]));
+
+      if (Util.isEmpty(concatenatedValues)) {
+        throw new InvalidAuthorizationHeaderException("Bad decoded value: " + concatenatedValues);
+      }
+
+      String[] credentialParts = concatenatedValues.split(":");
+
+      if (credentialParts == null || credentialParts.length < 2) {
+        throw new InvalidAuthorizationHeaderException("Badly formated credentials: " + concatenatedValues);
+      }
+
+      return fromUserAndPassword(credentialParts[0], credentialParts[1]);
+    } catch (IOException ioe) {
+      throw new InvalidAuthorizationHeaderException(ioe);
+    }
+  }
+
+  public String getNumber() {
+    return number;
+  }
+
+  public long getDeviceId() {
+    return accountId;
+  }
+
+  public String getPassword() {
+    return password;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/CertificateGenerator.java

@@ -0,0 +1,50 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.google.protobuf.ByteString;
+import com.google.protobuf.InvalidProtocolBufferException;
+import org.whispersystems.textsecuregcm.crypto.Curve;
+import org.whispersystems.textsecuregcm.crypto.ECPrivateKey;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.SenderCertificate;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.ServerCertificate;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import java.io.IOException;
+import java.security.InvalidKeyException;
+import java.util.concurrent.TimeUnit;
+
+public class CertificateGenerator {
+
+  private final ECPrivateKey      privateKey;
+  private final int               expiresDays;
+  private final ServerCertificate serverCertificate;
+
+  public CertificateGenerator(byte[] serverCertificate, ECPrivateKey privateKey, int expiresDays)
+      throws InvalidProtocolBufferException
+  {
+    this.privateKey        = privateKey;
+    this.expiresDays       = expiresDays;
+    this.serverCertificate = ServerCertificate.parseFrom(serverCertificate);
+  }
+
+  public byte[] createFor(Account account, Device device) throws IOException, InvalidKeyException {
+    byte[] certificate = SenderCertificate.Certificate.newBuilder()
+                                                      .setSender(account.getNumber())
+                                                      .setSenderDevice(Math.toIntExact(device.getId()))
+                                                      .setExpires(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(expiresDays))
+                                                      .setIdentityKey(ByteString.copyFrom(Base64.decode(account.getIdentityKey())))
+                                                      .setSigner(serverCertificate)
+                                                      .build()
+                                                      .toByteArray();
+
+    byte[] signature = Curve.calculateSignature(privateKey, certificate);
+
+    return SenderCertificate.newBuilder()
+                            .setCertificate(ByteString.copyFrom(certificate))
+                            .setSignature(ByteString.copyFrom(signature))
+                            .build()
+                            .toByteArray();
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/DirectoryCredentials.java

@@ -0,0 +1,28 @@
+package org.whispersystems.textsecuregcm.auth;
+
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class DirectoryCredentials {
+
+  @JsonProperty
+  private String username;
+
+  @JsonProperty
+  private String password;
+
+  public DirectoryCredentials(String username, String password) {
+    this.username = username;
+    this.password = password;
+  }
+
+  public DirectoryCredentials() {}
+
+  public String getUsername() {
+    return username;
+  }
+
+  public String getPassword() {
+    return password;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/DirectoryCredentialsGenerator.java

@@ -0,0 +1,105 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.google.common.base.Optional;
+import org.apache.commons.codec.DecoderException;
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.concurrent.TimeUnit;
+
+public class DirectoryCredentialsGenerator {
+
+  private final Logger logger = LoggerFactory.getLogger(DirectoryCredentialsGenerator.class);
+
+  private final byte[] key;
+  private final byte[] userIdKey;
+
+  public DirectoryCredentialsGenerator(byte[] key, byte[] userIdKey) {
+    this.key       = key;
+    this.userIdKey = userIdKey;
+  }
+
+  public DirectoryCredentials generateFor(String number) {
+    Mac    mac                = getMacInstance();
+    String username           = getUserId(number, mac);
+    long   currentTimeSeconds = System.currentTimeMillis() / 1000;
+    String prefix             = username + ":"  + currentTimeSeconds;
+    String output             = Hex.encodeHexString(Util.truncate(getHmac(key, prefix.getBytes(), mac), 10));
+    String token              = prefix + ":" + output;
+
+    return new DirectoryCredentials(username, token);
+  }
+
+
+  public boolean isValid(String token, String number, long currentTimeMillis) {
+    String[] parts = token.split(":");
+    Mac      mac   = getMacInstance();
+
+    if (parts.length != 3) {
+      return false;
+    }
+
+    if (!getUserId(number, mac).equals(parts[0])) {
+      return false;
+    }
+
+    if (!isValidTime(parts[1], currentTimeMillis)) {
+      return false;
+    }
+
+    return isValidSignature(parts[0] + ":" + parts[1], parts[2], mac);
+  }
+
+  private String getUserId(String number, Mac mac) {
+      return Hex.encodeHexString(Util.truncate(getHmac(userIdKey, number.getBytes(), mac), 10));
+  }
+
+  private boolean isValidTime(String timeString, long currentTimeMillis) {
+    try {
+      long tokenTime = Long.parseLong(timeString);
+      long ourTime   = TimeUnit.MILLISECONDS.toSeconds(currentTimeMillis);
+
+      return TimeUnit.SECONDS.toHours(Math.abs(ourTime - tokenTime)) < 24;
+    } catch (NumberFormatException e) {
+      logger.warn("Number Format", e);
+      return false;
+    }
+  }
+
+  private boolean isValidSignature(String prefix, String suffix, Mac mac) {
+    try {
+      byte[] ourSuffix   = Util.truncate(getHmac(key, prefix.getBytes(), mac), 10);
+      byte[] theirSuffix = Hex.decodeHex(suffix.toCharArray());
+
+      return MessageDigest.isEqual(ourSuffix, theirSuffix);
+    } catch (DecoderException e) {
+      logger.warn("DirectoryCredentials", e);
+      return false;
+    }
+  }
+
+  private Mac getMacInstance() {
+    try {
+      return Mac.getInstance("HmacSHA256");
+    } catch (NoSuchAlgorithmException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+  private byte[] getHmac(byte[] key, byte[] input, Mac mac) {
+    try {
+      mac.init(new SecretKeySpec(key, "HmacSHA256"));
+      return mac.doFinal(input);
+    } catch (InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/InvalidAuthorizationHeaderException.java

@@ -0,0 +1,28 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+
+public class InvalidAuthorizationHeaderException extends Exception {
+  public InvalidAuthorizationHeaderException(String s) {
+    super(s);
+  }
+
+  public InvalidAuthorizationHeaderException(Exception e) {
+    super(e);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/OptionalAccess.java

@@ -0,0 +1,74 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Hex;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Response;
+import java.security.MessageDigest;
+import java.util.Optional;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+public class OptionalAccess {
+
+  public static final String UNIDENTIFIED = "Unidentified-Access-Key";
+
+  public static void verify(Optional<Account>   requestAccount,
+                            Optional<Anonymous> accessKey,
+                            Optional<Account>   targetAccount,
+                            String              deviceSelector)
+  {
+    try {
+      verify(requestAccount, accessKey, targetAccount);
+
+      if (!deviceSelector.equals("*")) {
+        long deviceId = Long.parseLong(deviceSelector);
+
+        Optional<Device> targetDevice = targetAccount.get().getDevice(deviceId);
+
+        if (targetDevice.isPresent() && targetDevice.get().isActive()) {
+          return;
+        }
+
+        if (requestAccount.isPresent()) {
+          throw new WebApplicationException(Response.Status.NOT_FOUND);
+        } else {
+          throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+        }
+      }
+    } catch (NumberFormatException e) {
+      throw new WebApplicationException(Response.status(422).build());
+    }
+  }
+
+  public static void verify(Optional<Account>   requestAccount,
+                            Optional<Anonymous> accessKey,
+                            Optional<Account>   targetAccount)
+  {
+    if (requestAccount.isPresent() && targetAccount.isPresent() && targetAccount.get().isActive()) {
+      return;
+    }
+
+    //noinspection ConstantConditions
+    if (requestAccount.isPresent() && (!targetAccount.isPresent() || (targetAccount.isPresent() && !targetAccount.get().isActive()))) {
+      throw new WebApplicationException(Response.Status.NOT_FOUND);
+    }
+
+    if (accessKey.isPresent() && targetAccount.isPresent() && targetAccount.get().isActive() && targetAccount.get().isUnrestrictedUnidentifiedAccess()) {
+      return;
+    }
+
+    if (accessKey.isPresent()                                      &&
+        targetAccount.isPresent()                                  &&
+        targetAccount.get().getUnidentifiedAccessKey().isPresent() &&
+        targetAccount.get().isActive()                             &&
+        MessageDigest.isEqual(accessKey.get().getAccessKey(), targetAccount.get().getUnidentifiedAccessKey().get()))
+    {
+      return;
+    }
+
+    throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/StoredVerificationCode.java

@@ -0,0 +1,41 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.security.MessageDigest;
+import java.util.concurrent.TimeUnit;
+
+public class StoredVerificationCode {
+
+  @JsonProperty
+  private String code;
+
+  @JsonProperty
+  private long   timestamp;
+
+  public StoredVerificationCode() {}
+
+  public StoredVerificationCode(String code, long timestamp) {
+    this.code      = code;
+    this.timestamp = timestamp;
+  }
+
+  public String getCode() {
+    return code;
+  }
+
+  public long getTimestamp() {
+    return timestamp;
+  }
+
+  public boolean isValid(String theirCodeString) {
+    if (timestamp + TimeUnit.MINUTES.toMillis(30) < System.currentTimeMillis()) {
+      return false;
+    }
+
+    byte[] ourCode   = code.getBytes();
+    byte[] theirCode = theirCodeString.getBytes();
+
+    return MessageDigest.isEqual(ourCode, theirCode);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/TurnToken.java

@@ -0,0 +1,23 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.List;
+
+public class TurnToken {
+
+  @JsonProperty
+  private String username;
+
+  @JsonProperty
+  private String password;
+
+  @JsonProperty
+  private List<String> urls;
+
+  public TurnToken(String username, String password, List<String> urls) {
+    this.username = username;
+    this.password = password;
+    this.urls     = urls;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/TurnTokenGenerator.java

@@ -0,0 +1,39 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.configuration.TurnConfiguration;
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+
+public class TurnTokenGenerator {
+
+  private final byte[]       key;
+  private final List<String> urls;
+
+  public TurnTokenGenerator(TurnConfiguration configuration) {
+    this.key  = configuration.getSecret().getBytes();
+    this.urls = configuration.getUris();
+  }
+
+  public TurnToken generate() {
+    try {
+      Mac    mac                = Mac.getInstance("HmacSHA1");
+      long   validUntilSeconds  = (System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1)) / 1000;
+      long   user               = Math.abs(new SecureRandom().nextInt());
+      String userTime           = validUntilSeconds + ":"  + user;
+
+      mac.init(new SecretKeySpec(key, "HmacSHA1"));
+      String password = Base64.encodeBytes(mac.doFinal(userTime.getBytes()));
+
+      return new TurnToken(userTime, password, urls);
+    } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/UnidentifiedAccessChecksum.java

@@ -0,0 +1,27 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Optional;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+public class UnidentifiedAccessChecksum {
+
+  public static String generateFor(Optional<byte[]> unidentifiedAccessKey) {
+    try {
+      if (!unidentifiedAccessKey.isPresent()|| unidentifiedAccessKey.get().length != 16) return null;
+
+      Mac mac = Mac.getInstance("HmacSHA256");
+      mac.init(new SecretKeySpec(unidentifiedAccessKey.get(), "HmacSHA256"));
+
+      return Base64.encodeBytes(mac.doFinal(new byte[32]));
+    } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}