From aef7580bea1d42c048fdf493accf10c62211ccc1 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Fri, 22 Dec 2017 19:11:36 +0200
Subject: [PATCH 01/10] whisper: bloom filter logic introduced

---
 whisper/whisperv6/api.go | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/whisper/whisperv6/api.go b/whisper/whisperv6/api.go
index 0e8490b419..f11e8b6dca 100644
--- a/whisper/whisperv6/api.go
+++ b/whisper/whisperv6/api.go
@@ -113,17 +113,29 @@ func (api *PublicWhisperAPI) Info(ctx context.Context) Info {
 // SetMaxMessageSize sets the maximum message size that is accepted.
 // Upper limit is defined by MaxMessageSize.
 func (api *PublicWhisperAPI) SetMaxMessageSize(ctx context.Context, size uint32) (bool, error) {
-	return true, api.w.SetMaxMessageSize(size)
+	err := api.w.SetMaxMessageSize(size)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
 }
 
 // SetMinPow sets the minimum PoW, and notifies the peers.
 func (api *PublicWhisperAPI) SetMinPoW(ctx context.Context, pow float64) (bool, error) {
-	return true, api.w.SetMinimumPoW(pow)
+	err := api.w.SetMinimumPoW(pow)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
 }
 
 // SetBloomFilter sets the new value of bloom filter, and notifies the peers.
 func (api *PublicWhisperAPI) SetBloomFilter(ctx context.Context, bloom hexutil.Bytes) (bool, error) {
-	return true, api.w.SetBloomFilter(bloom)
+	err := api.w.SetBloomFilter(bloom)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
 }
 
 // MarkTrustedPeer marks a peer trusted, which will allow it to send historic (expired) messages.

From 9ecbc535c74afa92f4e99702e30d702cb0652c45 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Tue, 2 Jan 2018 12:59:15 +0200
Subject: [PATCH 02/10] whisper: pow exchange and bloom exchange protocols
 implemented

---
 whisper/whisperv6/whisper.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index bc89aadccd..3d431e504d 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -273,6 +273,13 @@ func (w *Whisper) SetMinimumPowTest(val float64) {
 	w.settings.Store(minPowToleranceIdx, val)
 }
 
+// SetBloomFilterTest sets the Bloom Filter in test environment
+func (w *Whisper) SetBloomFilterTest(bloom []byte) {
+	w.settings.Store(bloomFilterIdx, bloom)
+	w.notifyPeersAboutBloomFilterChange(bloom)
+	w.settings.Store(bloomFilterToleranceIdx, bloom)
+}
+
 func (w *Whisper) notifyPeersAboutPowRequirementChange(pow float64) {
 	arr := w.getPeers()
 	for _, p := range arr {

From b493e462aab52d9e2e5a24da6066907c642422bf Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Wed, 3 Jan 2018 21:16:48 +0200
Subject: [PATCH 03/10] whisper: Status message changed, more params added

---
 whisper/whisperv6/whisper.go | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index 3d431e504d..bc89aadccd 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -273,13 +273,6 @@ func (w *Whisper) SetMinimumPowTest(val float64) {
 	w.settings.Store(minPowToleranceIdx, val)
 }
 
-// SetBloomFilterTest sets the Bloom Filter in test environment
-func (w *Whisper) SetBloomFilterTest(bloom []byte) {
-	w.settings.Store(bloomFilterIdx, bloom)
-	w.notifyPeersAboutBloomFilterChange(bloom)
-	w.settings.Store(bloomFilterToleranceIdx, bloom)
-}
-
 func (w *Whisper) notifyPeersAboutPowRequirementChange(pow float64) {
 	arr := w.getPeers()
 	for _, p := range arr {

From 90cf7a1727daa0e9f655a72de2dc9c5956a53abe Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Sun, 7 Jan 2018 21:12:05 +0200
Subject: [PATCH 04/10] whisper: minor refactoring

---
 whisper/whisperv6/envelope.go | 1 +
 whisper/whisperv6/whisper.go  | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/whisper/whisperv6/envelope.go b/whisper/whisperv6/envelope.go
index 9ed712b934..304608fdeb 100644
--- a/whisper/whisperv6/envelope.go
+++ b/whisper/whisperv6/envelope.go
@@ -51,6 +51,7 @@ type Envelope struct {
 
 // size returns the size of envelope as it is sent (i.e. public fields only)
 func (e *Envelope) size() int {
+	const EnvelopeHeaderLength = 20
 	return EnvelopeHeaderLength + len(e.Data)
 }
 
diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index bc89aadccd..e4fb273005 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -1067,3 +1067,12 @@ func addBloom(a, b []byte) []byte {
 	}
 	return c
 }
+
+func isBloomFilterEqual(a, b []byte) bool {
+	for i := 0; i < bloomFilterSize; i++ {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}

From 9f26907196dd39e0e22247e5a118735e20d11757 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Tue, 9 Jan 2018 00:09:53 +0200
Subject: [PATCH 05/10] whisper: moved a constant

---
 whisper/whisperv6/envelope.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/whisper/whisperv6/envelope.go b/whisper/whisperv6/envelope.go
index 304608fdeb..9ed712b934 100644
--- a/whisper/whisperv6/envelope.go
+++ b/whisper/whisperv6/envelope.go
@@ -51,7 +51,6 @@ type Envelope struct {
 
 // size returns the size of envelope as it is sent (i.e. public fields only)
 func (e *Envelope) size() int {
-	const EnvelopeHeaderLength = 20
 	return EnvelopeHeaderLength + len(e.Data)
 }
 

From bb7b29c362d043908f330dc907c81ba72d1ce09a Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Tue, 9 Jan 2018 13:39:36 +0200
Subject: [PATCH 06/10] whisper: minor refactoring

---
 whisper/whisperv6/api.go     | 18 +++---------------
 whisper/whisperv6/whisper.go |  9 ---------
 2 files changed, 3 insertions(+), 24 deletions(-)

diff --git a/whisper/whisperv6/api.go b/whisper/whisperv6/api.go
index f11e8b6dca..0e8490b419 100644
--- a/whisper/whisperv6/api.go
+++ b/whisper/whisperv6/api.go
@@ -113,29 +113,17 @@ func (api *PublicWhisperAPI) Info(ctx context.Context) Info {
 // SetMaxMessageSize sets the maximum message size that is accepted.
 // Upper limit is defined by MaxMessageSize.
 func (api *PublicWhisperAPI) SetMaxMessageSize(ctx context.Context, size uint32) (bool, error) {
-	err := api.w.SetMaxMessageSize(size)
-	if err != nil {
-		return false, err
-	}
-	return true, nil
+	return true, api.w.SetMaxMessageSize(size)
 }
 
 // SetMinPow sets the minimum PoW, and notifies the peers.
 func (api *PublicWhisperAPI) SetMinPoW(ctx context.Context, pow float64) (bool, error) {
-	err := api.w.SetMinimumPoW(pow)
-	if err != nil {
-		return false, err
-	}
-	return true, nil
+	return true, api.w.SetMinimumPoW(pow)
 }
 
 // SetBloomFilter sets the new value of bloom filter, and notifies the peers.
 func (api *PublicWhisperAPI) SetBloomFilter(ctx context.Context, bloom hexutil.Bytes) (bool, error) {
-	err := api.w.SetBloomFilter(bloom)
-	if err != nil {
-		return false, err
-	}
-	return true, nil
+	return true, api.w.SetBloomFilter(bloom)
 }
 
 // MarkTrustedPeer marks a peer trusted, which will allow it to send historic (expired) messages.
diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index e4fb273005..bc89aadccd 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -1067,12 +1067,3 @@ func addBloom(a, b []byte) []byte {
 	}
 	return c
 }
-
-func isBloomFilterEqual(a, b []byte) bool {
-	for i := 0; i < bloomFilterSize; i++ {
-		if a[i] != b[i] {
-			return false
-		}
-	}
-	return true
-}

From cd73f598441d37e0b136772b3a839a330ee4f6b1 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Tue, 9 Jan 2018 00:03:59 +0200
Subject: [PATCH 07/10] whisper: message format refactoring, initial commit

---
 whisper/whisperv6/doc.go          |   8 +-
 whisper/whisperv6/envelope.go     |   5 +-
 whisper/whisperv6/message.go      | 229 +++++++++++++++++++-----------
 whisper/whisperv6/message_test.go |   2 +-
 4 files changed, 152 insertions(+), 92 deletions(-)

diff --git a/whisper/whisperv6/doc.go b/whisper/whisperv6/doc.go
index da1b4ee5ba..eae2dcb77f 100644
--- a/whisper/whisperv6/doc.go
+++ b/whisper/whisperv6/doc.go
@@ -48,13 +48,13 @@ const (
 	p2pMessageCode       = 127 // peer-to-peer message (to be consumed by the peer, but not forwarded any further)
 	NumberOfMessageCodes = 128
 
-	paddingMask   = byte(3)
-	signatureFlag = byte(4)
+	auxFieldSizeMask = byte(3) // mask used to extract the size of auxiliary field from the flags
+	signatureFlag    = byte(4)
 
 	TopicLength     = 4  // in bytes
 	signatureLength = 65 // in bytes
 	aesKeyLength    = 32 // in bytes
-	AESNonceLength  = 12 // in bytes
+	AESNonceLength  = 12 // in bytes; also returned by aesgcm.NonceSize()
 	keyIdSize       = 32 // in bytes
 	bloomFilterSize = 64 // in bytes
 
@@ -64,7 +64,7 @@ const (
 	DefaultMaxMessageSize = uint32(1024 * 1024)
 	DefaultMinimumPoW     = 0.2
 
-	padSizeLimit      = 256 // just an arbitrary number, could be changed without breaking the protocol (must not exceed 2^24)
+	padSizeLimit      = 256 // just an arbitrary number, could be changed without breaking the protocol
 	messageQueueLimit = 1024
 
 	expirationCycle   = time.Second
diff --git a/whisper/whisperv6/envelope.go b/whisper/whisperv6/envelope.go
index 9ed712b934..6cbefaef67 100644
--- a/whisper/whisperv6/envelope.go
+++ b/whisper/whisperv6/envelope.go
@@ -204,20 +204,23 @@ func (e *Envelope) Open(watcher *Filter) (msg *ReceivedMessage) {
 		return nil
 	}
 
+	var symmetric bool
 	if watcher.expectsAsymmetricEncryption() {
 		msg, _ = e.OpenAsymmetric(watcher.KeyAsym)
 		if msg != nil {
+			symmetric = false
 			msg.Dst = &watcher.KeyAsym.PublicKey
 		}
 	} else if watcher.expectsSymmetricEncryption() {
 		msg, _ = e.OpenSymmetric(watcher.KeySym)
 		if msg != nil {
+			symmetric = true
 			msg.SymKeyHash = crypto.Keccak256Hash(watcher.KeySym)
 		}
 	}
 
 	if msg != nil {
-		ok := msg.Validate()
+		ok := msg.ValidateAndParse(symmetric)
 		if !ok {
 			return nil
 		}
diff --git a/whisper/whisperv6/message.go b/whisper/whisperv6/message.go
index f8df50336e..09425f098f 100644
--- a/whisper/whisperv6/message.go
+++ b/whisper/whisperv6/message.go
@@ -25,6 +25,7 @@ import (
 	crand "crypto/rand"
 	"encoding/binary"
 	"errors"
+	mrand "math/rand"
 	"strconv"
 
 	"github.com/ethereum/go-ethereum/common"
@@ -89,80 +90,95 @@ func (msg *ReceivedMessage) isAsymmetricEncryption() bool {
 // NewMessage creates and initializes a non-signed, non-encrypted Whisper message.
 func NewSentMessage(params *MessageParams) (*sentMessage, error) {
 	msg := sentMessage{}
-	msg.Raw = make([]byte, 1, len(params.Payload)+len(params.Padding)+signatureLength+padSizeLimit)
+	msg.Raw = make([]byte, 1, 5+len(params.Payload)+len(params.Padding)+signatureLength+padSizeLimit)
 	msg.Raw[0] = 0 // set all the flags to zero
-	err := msg.appendPadding(params)
-	if err != nil {
-		return nil, err
-	}
+	msg.addPayloadSizeField(params.Payload)
 	msg.Raw = append(msg.Raw, params.Payload...)
-	return &msg, nil
+	err := msg.appendPadding(params)
+	return &msg, err
 }
 
-// getSizeOfLength returns the number of bytes necessary to encode the entire size padding (including these bytes)
-func getSizeOfLength(b []byte) (sz int, err error) {
-	sz = intSize(len(b))      // first iteration
-	sz = intSize(len(b) + sz) // second iteration
-	if sz > 3 {
-		err = errors.New("oversized padding parameter")
-	}
-	return sz, err
+// appendPayloadSizeField appends the auxiliary field containing the size of payload
+func (msg *sentMessage) addPayloadSizeField(payload []byte) {
+	fieldSize := getAuxFieldSize(payload)
+	field := make([]byte, fieldSize)
+	binary.LittleEndian.PutUint32(field, uint32(len(payload)))
+	msg.Raw = append(msg.Raw, field...)
+	msg.Raw[0] |= byte(fieldSize)
 }
 
-// sizeOfIntSize returns minimal number of bytes necessary to encode an integer value
-func intSize(i int) (s int) {
-	for s = 1; i >= 256; s++ {
-		i /= 256
+// getSizeOfLength returns the number of bytes necessary to encode the size of padding
+//func getAuxFieldSize(payload []byte) (sz int, err error) {
+//	sz = intSize(len(b))      // first iteration
+//	sz = intSize(len(b) + sz) // second iteration
+//	if sz > 3 {
+//		err = errors.New("oversized padding parameter")
+//	}
+//	return sz, err
+//}
+
+// getAuxFieldSize returns the number of bytes necessary to encode the size of payload
+func getAuxFieldSize(payload []byte) int {
+	s := 1
+	for i := len(payload); i >= 256; i /= 256 {
+		s++
 	}
 	return s
 }
 
-// appendPadding appends the pseudorandom padding bytes and sets the padding flag.
-// The last byte contains the size of padding (thus, its size must not exceed 256).
+// appendPadding appends the padding specified in params.
+// If no padding is provided in params, then random padding is generated.
 func (msg *sentMessage) appendPadding(params *MessageParams) error {
-	rawSize := len(params.Payload) + 1
+	if len(params.Padding) != 0 {
+		// padding data was provided by the Dapp, just use it as is
+		msg.Raw = append(msg.Raw, params.Padding...)
+		return nil
+	}
+
+	auxFieldSize := getAuxFieldSize(params.Payload)
+	rawSize := 1 + auxFieldSize + len(params.Payload)
 	if params.Src != nil {
 		rawSize += signatureLength
 	}
-
 	if params.KeySym != nil {
 		rawSize += AESNonceLength
 	}
 	odd := rawSize % padSizeLimit
 
-	if len(params.Padding) != 0 {
-		padSize := len(params.Padding)
-		padLengthSize, err := getSizeOfLength(params.Padding)
-		if err != nil {
-			return err
-		}
-		totalPadSize := padSize + padLengthSize
-		buf := make([]byte, 8)
-		binary.LittleEndian.PutUint32(buf, uint32(totalPadSize))
-		buf = buf[:padLengthSize]
-		msg.Raw = append(msg.Raw, buf...)
-		msg.Raw = append(msg.Raw, params.Padding...)
-		msg.Raw[0] |= byte(padLengthSize) // number of bytes indicating the padding size
-	} else if odd != 0 {
-		totalPadSize := padSizeLimit - odd
-		if totalPadSize > 255 {
-			// this algorithm is only valid if padSizeLimit < 256.
-			// if padSizeLimit will ever change, please fix the algorithm
-			// (please see also ReceivedMessage.extractPadding() function).
-			panic("please fix the padding algorithm before releasing new version")
-		}
-		buf := make([]byte, totalPadSize)
-		_, err := crand.Read(buf[1:])
-		if err != nil {
-			return err
-		}
-		if totalPadSize > 6 && !validateSymmetricKey(buf) {
-			return errors.New("failed to generate random padding of size " + strconv.Itoa(totalPadSize))
-		}
-		buf[0] = byte(totalPadSize)
-		msg.Raw = append(msg.Raw, buf...)
-		msg.Raw[0] |= byte(0x1) // number of bytes indicating the padding size
+	//if len(params.Padding) != 0 {
+	//	// padding data was provided by the Dapp, just use it as is
+	//	padSize := len(params.Padding)
+	//	padLengthSize, err := intSize(len(params.Padding))
+	//	if err != nil {
+	//		return err
+	//	}
+	//	totalPadSize := padSize + padLengthSize
+	//	buf := make([]byte, 8)
+	//	binary.LittleEndian.PutUint32(buf, uint32(totalPadSize))
+	//	buf = buf[:padLengthSize]
+	//	msg.Raw = append(msg.Raw, buf...)
+	//	msg.Raw = append(msg.Raw, params.Padding...)
+	//	msg.Raw[0] |= byte(padLengthSize) // number of bytes indicating the padding size
+	//} else if odd != 0 {
+	paddingSize := padSizeLimit - odd
+	//if totalPadSize > 255 {
+	//	// this algorithm is only valid if padSizeLimit < 256.
+	//	// if padSizeLimit will ever change, please fix the algorithm
+	//	// (please see also ReceivedMessage.extractPadding() function).
+	//	panic("please fix the padding algorithm before releasing new version")
+	//}
+	pad := make([]byte, paddingSize)
+	_, err := crand.Read(pad)
+	if err != nil {
+		return err
 	}
+	if !validateSymmetricKey(pad) {
+		return errors.New("failed to generate random padding of size " + strconv.Itoa(paddingSize))
+	}
+	//buf[0] = byte(totalPadSize)
+	msg.Raw = append(msg.Raw, pad...)
+	//msg.Raw[0] |= byte(0x1) // number of bytes indicating the padding size
+	//}
 	return nil
 }
 
@@ -175,14 +191,15 @@ func (msg *sentMessage) sign(key *ecdsa.PrivateKey) error {
 		return nil
 	}
 
-	msg.Raw[0] |= signatureFlag
+	msg.Raw[0] |= signatureFlag // it is important to set this flag before signing
 	hash := crypto.Keccak256(msg.Raw)
 	signature, err := crypto.Sign(hash, key)
 	if err != nil {
-		msg.Raw[0] &= ^signatureFlag // clear the flag
+		msg.Raw[0] ^= signatureFlag // clear the flag
 		return err
 	}
 	msg.Raw = append(msg.Raw, signature...)
+
 	return nil
 }
 
@@ -204,7 +221,6 @@ func (msg *sentMessage) encryptSymmetric(key []byte) (err error) {
 	if !validateSymmetricKey(key) {
 		return errors.New("invalid key provided for symmetric encryption")
 	}
-
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return err
@@ -213,20 +229,43 @@ func (msg *sentMessage) encryptSymmetric(key []byte) (err error) {
 	if err != nil {
 		return err
 	}
-
-	// never use more than 2^32 random nonces with a given key
-	salt := make([]byte, aesgcm.NonceSize())
-	_, err = crand.Read(salt)
+	salt, err := generateSalt(aesgcm)
 	if err != nil {
 		return err
-	} else if !validateSymmetricKey(salt) {
-		return errors.New("crypto/rand failed to generate salt")
 	}
-
-	msg.Raw = append(aesgcm.Seal(nil, salt, msg.Raw, nil), salt...)
+	encrypted := aesgcm.Seal(nil, salt, msg.Raw, nil)
+	msg.Raw = append(encrypted, salt...)
 	return nil
 }
 
+func generateSalt(aesgcm cipher.AEAD) ([]byte, error) {
+	// never use more than 2^32 random nonces with a given key
+	sz := aesgcm.NonceSize()
+	x1 := make([]byte, sz)
+	x2 := make([]byte, sz)
+	salt := make([]byte, sz)
+
+	_, err := crand.Read(x1)
+	if err != nil {
+		return nil, err
+	} else if !validateSymmetricKey(x1) {
+		return nil, errors.New("crypto/rand failed to generate salt")
+	}
+	_, err = mrand.Read(x2)
+	if err != nil {
+		return nil, err
+	} else if !validateSymmetricKey(x2) {
+		return nil, errors.New("math/rand failed to generate salt")
+	}
+	for i := 0; i < sz; i++ {
+		salt[i] = x1[i] ^ x2[i]
+	}
+	if !validateSymmetricKey(salt) {
+		return nil, errors.New("failed to generate salt")
+	}
+	return salt, nil
+}
+
 // Wrap bundles the message into an Envelope to transmit over the network.
 func (msg *sentMessage) Wrap(options *MessageParams) (envelope *Envelope, err error) {
 	if options.TTL == 0 {
@@ -295,31 +334,50 @@ func (msg *ReceivedMessage) decryptAsymmetric(key *ecdsa.PrivateKey) error {
 	return err
 }
 
-// Validate checks the validity and extracts the fields in case of success
-func (msg *ReceivedMessage) Validate() bool {
+// Validate checks the message validity and extracts the fields in case of success.
+func (msg *ReceivedMessage) ValidateAndParse(symmetric bool) bool {
 	end := len(msg.Raw)
 	if end < 1 {
 		return false
 	}
 
+	if symmetric {
+		end -= AESNonceLength
+	}
+
 	if isMessageSigned(msg.Raw[0]) {
 		end -= signatureLength
 		if end <= 1 {
 			return false
 		}
-		msg.Signature = msg.Raw[end:]
+		msg.Signature = msg.Raw[end : end+signatureLength]
 		msg.Src = msg.SigToPubKey()
 		if msg.Src == nil {
 			return false
 		}
 	}
 
-	padSize, ok := msg.extractPadding(end)
-	if !ok {
-		return false
+	beg := 1
+	payloadSize := 0
+	auxFieldSize := int(msg.Raw[0] & auxFieldSizeMask) // number of bytes indicating the size of payload
+	if auxFieldSize != 0 {
+		payloadSize = int(bytesToUintLittleEndian(msg.Raw[beg : beg+auxFieldSize]))
+		if payloadSize+1 > end {
+			return false
+		}
+		beg += auxFieldSize
+		msg.Payload = msg.Raw[beg : beg+payloadSize]
 	}
 
-	msg.Payload = msg.Raw[1+padSize : end]
+	beg += payloadSize
+	msg.Padding = msg.Raw[beg:end]
+
+	//padSize, ok := msg.extractPadding(end)
+	//if !ok {
+	//	return false
+	//}
+	//msg.Payload = msg.Raw[1+padSize : end]
+
 	return true
 }
 
@@ -327,19 +385,18 @@ func (msg *ReceivedMessage) Validate() bool {
 // although we don't support sending messages with padding size
 // exceeding 255 bytes, such messages are perfectly valid, and
 // can be successfully decrypted.
-func (msg *ReceivedMessage) extractPadding(end int) (int, bool) {
-	paddingSize := 0
-	sz := int(msg.Raw[0] & paddingMask) // number of bytes indicating the entire size of padding (including these bytes)
-	// could be zero -- it means no padding
-	if sz != 0 {
-		paddingSize = int(bytesToUintLittleEndian(msg.Raw[1 : 1+sz]))
-		if paddingSize < sz || paddingSize+1 > end {
-			return 0, false
-		}
-		msg.Padding = msg.Raw[1+sz : 1+paddingSize]
-	}
-	return paddingSize, true
-}
+//func (msg *ReceivedMessage) extractPadding(end int) (int, bool) {
+//	payloadSize := 0
+//	auxFieldSize := int(msg.Raw[0] & auxFieldSizeMask) // number of bytes indicating the size of payload
+//	if sz != 0 {
+//		paddingSize = int(bytesToUintLittleEndian(msg.Raw[1 : 1+sz]))
+//		if paddingSize < sz || paddingSize+1 > end {
+//			return 0, false
+//		}
+//		msg.Padding = msg.Raw[1+sz : 1+paddingSize]
+//	}
+//	return paddingSize, true
+//}
 
 // Recover retrieves the public key of the message signer.
 func (msg *ReceivedMessage) SigToPubKey() *ecdsa.PublicKey {
@@ -353,7 +410,7 @@ func (msg *ReceivedMessage) SigToPubKey() *ecdsa.PublicKey {
 	return pub
 }
 
-// hash calculates the SHA3 checksum of the message flags, payload and padding.
+// hash calculates the SHA3 checksum of the message flags, auxiliary field, payload and padding.
 func (msg *ReceivedMessage) hash() []byte {
 	if isMessageSigned(msg.Raw[0]) {
 		sz := len(msg.Raw) - signatureLength
diff --git a/whisper/whisperv6/message_test.go b/whisper/whisperv6/message_test.go
index c90bcc01ed..d0305c2e60 100644
--- a/whisper/whisperv6/message_test.go
+++ b/whisper/whisperv6/message_test.go
@@ -90,7 +90,7 @@ func singleMessageTest(t *testing.T, symmetric bool) {
 		t.Fatalf("failed to encrypt with seed %d: %s.", seed, err)
 	}
 
-	if !decrypted.Validate() {
+	if !decrypted.ValidateAndParse(symmetric) {
 		t.Fatalf("failed to validate with seed %d.", seed)
 	}
 

From fb12a4958993a01d7bc8525a43b370c775f96eb4 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Tue, 9 Jan 2018 17:22:07 +0200
Subject: [PATCH 08/10] whisper: message format changed

---
 whisper/whisperv6/envelope.go     |  8 +---
 whisper/whisperv6/message.go      | 74 +++----------------------------
 whisper/whisperv6/message_test.go | 12 ++---
 3 files changed, 13 insertions(+), 81 deletions(-)

diff --git a/whisper/whisperv6/envelope.go b/whisper/whisperv6/envelope.go
index 6cbefaef67..d7dac073a6 100644
--- a/whisper/whisperv6/envelope.go
+++ b/whisper/whisperv6/envelope.go
@@ -198,29 +198,25 @@ func (e *Envelope) OpenSymmetric(key []byte) (msg *ReceivedMessage, err error) {
 
 // Open tries to decrypt an envelope, and populates the message fields in case of success.
 func (e *Envelope) Open(watcher *Filter) (msg *ReceivedMessage) {
-	// The API interface forbids filters doing both symmetric and
-	// asymmetric encryption.
+	// The API interface forbids filters doing both symmetric and asymmetric encryption.
 	if watcher.expectsAsymmetricEncryption() && watcher.expectsSymmetricEncryption() {
 		return nil
 	}
 
-	var symmetric bool
 	if watcher.expectsAsymmetricEncryption() {
 		msg, _ = e.OpenAsymmetric(watcher.KeyAsym)
 		if msg != nil {
-			symmetric = false
 			msg.Dst = &watcher.KeyAsym.PublicKey
 		}
 	} else if watcher.expectsSymmetricEncryption() {
 		msg, _ = e.OpenSymmetric(watcher.KeySym)
 		if msg != nil {
-			symmetric = true
 			msg.SymKeyHash = crypto.Keccak256Hash(watcher.KeySym)
 		}
 	}
 
 	if msg != nil {
-		ok := msg.ValidateAndParse(symmetric)
+		ok := msg.ValidateAndParse()
 		if !ok {
 			return nil
 		}
diff --git a/whisper/whisperv6/message.go b/whisper/whisperv6/message.go
index 09425f098f..45b33ec557 100644
--- a/whisper/whisperv6/message.go
+++ b/whisper/whisperv6/message.go
@@ -101,22 +101,13 @@ func NewSentMessage(params *MessageParams) (*sentMessage, error) {
 // appendPayloadSizeField appends the auxiliary field containing the size of payload
 func (msg *sentMessage) addPayloadSizeField(payload []byte) {
 	fieldSize := getAuxFieldSize(payload)
-	field := make([]byte, fieldSize)
+	field := make([]byte, 4)
 	binary.LittleEndian.PutUint32(field, uint32(len(payload)))
+	field = field[:fieldSize]
 	msg.Raw = append(msg.Raw, field...)
 	msg.Raw[0] |= byte(fieldSize)
 }
 
-// getSizeOfLength returns the number of bytes necessary to encode the size of padding
-//func getAuxFieldSize(payload []byte) (sz int, err error) {
-//	sz = intSize(len(b))      // first iteration
-//	sz = intSize(len(b) + sz) // second iteration
-//	if sz > 3 {
-//		err = errors.New("oversized padding parameter")
-//	}
-//	return sz, err
-//}
-
 // getAuxFieldSize returns the number of bytes necessary to encode the size of payload
 func getAuxFieldSize(payload []byte) int {
 	s := 1
@@ -144,29 +135,7 @@ func (msg *sentMessage) appendPadding(params *MessageParams) error {
 		rawSize += AESNonceLength
 	}
 	odd := rawSize % padSizeLimit
-
-	//if len(params.Padding) != 0 {
-	//	// padding data was provided by the Dapp, just use it as is
-	//	padSize := len(params.Padding)
-	//	padLengthSize, err := intSize(len(params.Padding))
-	//	if err != nil {
-	//		return err
-	//	}
-	//	totalPadSize := padSize + padLengthSize
-	//	buf := make([]byte, 8)
-	//	binary.LittleEndian.PutUint32(buf, uint32(totalPadSize))
-	//	buf = buf[:padLengthSize]
-	//	msg.Raw = append(msg.Raw, buf...)
-	//	msg.Raw = append(msg.Raw, params.Padding...)
-	//	msg.Raw[0] |= byte(padLengthSize) // number of bytes indicating the padding size
-	//} else if odd != 0 {
 	paddingSize := padSizeLimit - odd
-	//if totalPadSize > 255 {
-	//	// this algorithm is only valid if padSizeLimit < 256.
-	//	// if padSizeLimit will ever change, please fix the algorithm
-	//	// (please see also ReceivedMessage.extractPadding() function).
-	//	panic("please fix the padding algorithm before releasing new version")
-	//}
 	pad := make([]byte, paddingSize)
 	_, err := crand.Read(pad)
 	if err != nil {
@@ -175,10 +144,7 @@ func (msg *sentMessage) appendPadding(params *MessageParams) error {
 	if !validateSymmetricKey(pad) {
 		return errors.New("failed to generate random padding of size " + strconv.Itoa(paddingSize))
 	}
-	//buf[0] = byte(totalPadSize)
 	msg.Raw = append(msg.Raw, pad...)
-	//msg.Raw[0] |= byte(0x1) // number of bytes indicating the padding size
-	//}
 	return nil
 }
 
@@ -195,11 +161,10 @@ func (msg *sentMessage) sign(key *ecdsa.PrivateKey) error {
 	hash := crypto.Keccak256(msg.Raw)
 	signature, err := crypto.Sign(hash, key)
 	if err != nil {
-		msg.Raw[0] ^= signatureFlag // clear the flag
+		msg.Raw[0] &= (0xFF ^ signatureFlag) // clear the flag
 		return err
 	}
 	msg.Raw = append(msg.Raw, signature...)
-
 	return nil
 }
 
@@ -297,8 +262,7 @@ func (msg *sentMessage) Wrap(options *MessageParams) (envelope *Envelope, err er
 // decryptSymmetric decrypts a message with a topic key, using AES-GCM-256.
 // nonce size should be 12 bytes (see cipher.gcmStandardNonceSize).
 func (msg *ReceivedMessage) decryptSymmetric(key []byte) error {
-	// In v6, symmetric messages are expected to contain the 12-byte
-	// "salt" at the end of the payload.
+	// symmetric messages are expected to contain the 12-byte nonce at the end of the payload
 	if len(msg.Raw) < AESNonceLength {
 		return errors.New("missing salt or invalid payload in symmetric message")
 	}
@@ -335,16 +299,12 @@ func (msg *ReceivedMessage) decryptAsymmetric(key *ecdsa.PrivateKey) error {
 }
 
 // Validate checks the message validity and extracts the fields in case of success.
-func (msg *ReceivedMessage) ValidateAndParse(symmetric bool) bool {
+func (msg *ReceivedMessage) ValidateAndParse() bool {
 	end := len(msg.Raw)
 	if end < 1 {
 		return false
 	}
 
-	if symmetric {
-		end -= AESNonceLength
-	}
-
 	if isMessageSigned(msg.Raw[0]) {
 		end -= signatureLength
 		if end <= 1 {
@@ -371,33 +331,9 @@ func (msg *ReceivedMessage) ValidateAndParse(symmetric bool) bool {
 
 	beg += payloadSize
 	msg.Padding = msg.Raw[beg:end]
-
-	//padSize, ok := msg.extractPadding(end)
-	//if !ok {
-	//	return false
-	//}
-	//msg.Payload = msg.Raw[1+padSize : end]
-
 	return true
 }
 
-// extractPadding extracts the padding from raw message.
-// although we don't support sending messages with padding size
-// exceeding 255 bytes, such messages are perfectly valid, and
-// can be successfully decrypted.
-//func (msg *ReceivedMessage) extractPadding(end int) (int, bool) {
-//	payloadSize := 0
-//	auxFieldSize := int(msg.Raw[0] & auxFieldSizeMask) // number of bytes indicating the size of payload
-//	if sz != 0 {
-//		paddingSize = int(bytesToUintLittleEndian(msg.Raw[1 : 1+sz]))
-//		if paddingSize < sz || paddingSize+1 > end {
-//			return 0, false
-//		}
-//		msg.Padding = msg.Raw[1+sz : 1+paddingSize]
-//	}
-//	return paddingSize, true
-//}
-
 // Recover retrieves the public key of the message signer.
 func (msg *ReceivedMessage) SigToPubKey() *ecdsa.PublicKey {
 	defer func() { recover() }() // in case of invalid signature
diff --git a/whisper/whisperv6/message_test.go b/whisper/whisperv6/message_test.go
index d0305c2e60..81db58dedd 100644
--- a/whisper/whisperv6/message_test.go
+++ b/whisper/whisperv6/message_test.go
@@ -90,8 +90,8 @@ func singleMessageTest(t *testing.T, symmetric bool) {
 		t.Fatalf("failed to encrypt with seed %d: %s.", seed, err)
 	}
 
-	if !decrypted.ValidateAndParse(symmetric) {
-		t.Fatalf("failed to validate with seed %d.", seed)
+	if !decrypted.ValidateAndParse() {
+		t.Fatalf("failed to validate with seed %d, symmetric = %v.", seed, symmetric)
 	}
 
 	if !bytes.Equal(text, decrypted.Payload) {
@@ -427,7 +427,7 @@ func TestPaddingAppendedToSymMessages(t *testing.T) {
 	// payload + flag + aesnonce > 256. Check that the result
 	// is padded on the next 256 boundary.
 	msg := sentMessage{}
-	msg.Raw = make([]byte, len(params.Payload)+1+AESNonceLength)
+	msg.Raw = make([]byte, 1+1+len(params.Payload))
 
 	err := msg.appendPadding(params)
 
@@ -436,7 +436,7 @@ func TestPaddingAppendedToSymMessages(t *testing.T) {
 		return
 	}
 
-	if len(msg.Raw) != 512 {
+	if len(msg.Raw) != 512-AESNonceLength {
 		t.Errorf("Invalid size %d != 512", len(msg.Raw))
 	}
 }
@@ -459,7 +459,7 @@ func TestPaddingAppendedToSymMessagesWithSignature(t *testing.T) {
 	// payload + flag + aesnonce > 256. Check that the result
 	// is padded on the next 256 boundary.
 	msg := sentMessage{}
-	msg.Raw = make([]byte, len(params.Payload)+1+AESNonceLength+signatureLength)
+	msg.Raw = make([]byte, 1+1+len(params.Payload))
 
 	err = msg.appendPadding(params)
 
@@ -468,7 +468,7 @@ func TestPaddingAppendedToSymMessagesWithSignature(t *testing.T) {
 		return
 	}
 
-	if len(msg.Raw) != 512 {
+	if len(msg.Raw) != 512-AESNonceLength-signatureLength {
 		t.Errorf("Invalid size %d != 512", len(msg.Raw))
 	}
 }

From ba2b3d38aba0d7499b195cce6234c0a3a7e34601 Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Thu, 11 Jan 2018 13:51:36 +0200
Subject: [PATCH 09/10] whisper: message format changed

---
 whisper/whisperv6/api.go          |  6 +--
 whisper/whisperv6/doc.go          |  2 +-
 whisper/whisperv6/message.go      | 62 +++++++++++++++----------------
 whisper/whisperv6/message_test.go | 50 ++++++++++++-------------
 whisper/whisperv6/peer_test.go    |  3 +-
 whisper/whisperv6/whisper.go      | 18 ++++-----
 whisper/whisperv6/whisper_test.go | 18 ++-------
 7 files changed, 69 insertions(+), 90 deletions(-)

diff --git a/whisper/whisperv6/api.go b/whisper/whisperv6/api.go
index 0e8490b419..4f38188cd1 100644
--- a/whisper/whisperv6/api.go
+++ b/whisper/whisperv6/api.go
@@ -277,7 +277,7 @@ func (api *PublicWhisperAPI) Post(ctx context.Context, req NewMessage) (bool, er
 		if params.KeySym, err = api.w.GetSymKey(req.SymKeyID); err != nil {
 			return false, err
 		}
-		if !validateSymmetricKey(params.KeySym) {
+		if !validateRandomData(params.KeySym, aesKeyLength) {
 			return false, ErrInvalidSymmetricKey
 		}
 	}
@@ -383,7 +383,7 @@ func (api *PublicWhisperAPI) Messages(ctx context.Context, crit Criteria) (*rpc.
 		if err != nil {
 			return nil, err
 		}
-		if !validateSymmetricKey(key) {
+		if !validateRandomData(key, aesKeyLength) {
 			return nil, ErrInvalidSymmetricKey
 		}
 		filter.KeySym = key
@@ -555,7 +555,7 @@ func (api *PublicWhisperAPI) NewMessageFilter(req Criteria) (string, error) {
 		if keySym, err = api.w.GetSymKey(req.SymKeyID); err != nil {
 			return "", err
 		}
-		if !validateSymmetricKey(keySym) {
+		if !validateRandomData(keySym, aesKeyLength) {
 			return "", ErrInvalidSymmetricKey
 		}
 	}
diff --git a/whisper/whisperv6/doc.go b/whisper/whisperv6/doc.go
index eae2dcb77f..abb8012e45 100644
--- a/whisper/whisperv6/doc.go
+++ b/whisper/whisperv6/doc.go
@@ -54,7 +54,7 @@ const (
 	TopicLength     = 4  // in bytes
 	signatureLength = 65 // in bytes
 	aesKeyLength    = 32 // in bytes
-	AESNonceLength  = 12 // in bytes; also returned by aesgcm.NonceSize()
+	aesNonceLength  = 12 // in bytes; for more info please see cipher.gcmStandardNonceSize & aesgcm.NonceSize()
 	keyIdSize       = 32 // in bytes
 	bloomFilterSize = 64 // in bytes
 
diff --git a/whisper/whisperv6/message.go b/whisper/whisperv6/message.go
index 45b33ec557..21849060e2 100644
--- a/whisper/whisperv6/message.go
+++ b/whisper/whisperv6/message.go
@@ -55,7 +55,7 @@ type sentMessage struct {
 }
 
 // ReceivedMessage represents a data packet to be received through the
-// Whisper protocol.
+// Whisper protocol and successfully decrypted.
 type ReceivedMessage struct {
 	Raw []byte
 
@@ -71,7 +71,7 @@ type ReceivedMessage struct {
 	Dst   *ecdsa.PublicKey // Message recipient (identity used to decode the message)
 	Topic TopicType
 
-	SymKeyHash   common.Hash // The Keccak256Hash of the key, associated with the Topic
+	SymKeyHash   common.Hash // The Keccak256Hash of the key
 	EnvelopeHash common.Hash // Message envelope hash to act as a unique id
 }
 
@@ -131,9 +131,6 @@ func (msg *sentMessage) appendPadding(params *MessageParams) error {
 	if params.Src != nil {
 		rawSize += signatureLength
 	}
-	if params.KeySym != nil {
-		rawSize += AESNonceLength
-	}
 	odd := rawSize % padSizeLimit
 	paddingSize := padSizeLimit - odd
 	pad := make([]byte, paddingSize)
@@ -141,7 +138,7 @@ func (msg *sentMessage) appendPadding(params *MessageParams) error {
 	if err != nil {
 		return err
 	}
-	if !validateSymmetricKey(pad) {
+	if !validateRandomData(pad, paddingSize) {
 		return errors.New("failed to generate random padding of size " + strconv.Itoa(paddingSize))
 	}
 	msg.Raw = append(msg.Raw, pad...)
@@ -183,8 +180,8 @@ func (msg *sentMessage) encryptAsymmetric(key *ecdsa.PublicKey) error {
 // encryptSymmetric encrypts a message with a topic key, using AES-GCM-256.
 // nonce size should be 12 bytes (see cipher.gcmStandardNonceSize).
 func (msg *sentMessage) encryptSymmetric(key []byte) (err error) {
-	if !validateSymmetricKey(key) {
-		return errors.New("invalid key provided for symmetric encryption")
+	if !validateRandomData(key, aesKeyLength) {
+		return errors.New("invalid key provided for symmetric encryption, size: " + strconv.Itoa(len(key)))
 	}
 	block, err := aes.NewCipher(key)
 	if err != nil {
@@ -194,7 +191,7 @@ func (msg *sentMessage) encryptSymmetric(key []byte) (err error) {
 	if err != nil {
 		return err
 	}
-	salt, err := generateSalt(aesgcm)
+	salt, err := generateSecureRandomData(aesNonceLength) // never use more than 2^32 random nonces with a given key
 	if err != nil {
 		return err
 	}
@@ -203,32 +200,35 @@ func (msg *sentMessage) encryptSymmetric(key []byte) (err error) {
 	return nil
 }
 
-func generateSalt(aesgcm cipher.AEAD) ([]byte, error) {
-	// never use more than 2^32 random nonces with a given key
-	sz := aesgcm.NonceSize()
-	x1 := make([]byte, sz)
-	x2 := make([]byte, sz)
-	salt := make([]byte, sz)
+// generateSecureRandomData generates random data where extra security is required.
+// The purpose of this function is to prevent some bugs in software or in hardware
+// from delivering not-very-random data. This is especially useful for AES nonce,
+// where true randomness does not really matter, but it is very important to have
+// a unique nonce for every message.
+func generateSecureRandomData(length int) ([]byte, error) {
+	x := make([]byte, length)
+	y := make([]byte, length)
+	res := make([]byte, length)
 
-	_, err := crand.Read(x1)
+	_, err := crand.Read(x)
 	if err != nil {
 		return nil, err
-	} else if !validateSymmetricKey(x1) {
-		return nil, errors.New("crypto/rand failed to generate salt")
+	} else if !validateRandomData(x, length) {
+		return nil, errors.New("crypto/rand failed to generate secure random data")
 	}
-	_, err = mrand.Read(x2)
+	_, err = mrand.Read(y)
 	if err != nil {
 		return nil, err
-	} else if !validateSymmetricKey(x2) {
-		return nil, errors.New("math/rand failed to generate salt")
+	} else if !validateRandomData(y, length) {
+		return nil, errors.New("math/rand failed to generate secure random data")
 	}
-	for i := 0; i < sz; i++ {
-		salt[i] = x1[i] ^ x2[i]
+	for i := 0; i < length; i++ {
+		res[i] = x[i] ^ y[i]
 	}
-	if !validateSymmetricKey(salt) {
-		return nil, errors.New("failed to generate salt")
+	if !validateRandomData(res, length) {
+		return nil, errors.New("failed to generate secure random data")
 	}
-	return salt, nil
+	return res, nil
 }
 
 // Wrap bundles the message into an Envelope to transmit over the network.
@@ -263,10 +263,10 @@ func (msg *sentMessage) Wrap(options *MessageParams) (envelope *Envelope, err er
 // nonce size should be 12 bytes (see cipher.gcmStandardNonceSize).
 func (msg *ReceivedMessage) decryptSymmetric(key []byte) error {
 	// symmetric messages are expected to contain the 12-byte nonce at the end of the payload
-	if len(msg.Raw) < AESNonceLength {
+	if len(msg.Raw) < aesNonceLength {
 		return errors.New("missing salt or invalid payload in symmetric message")
 	}
-	salt := msg.Raw[len(msg.Raw)-AESNonceLength:]
+	salt := msg.Raw[len(msg.Raw)-aesNonceLength:]
 
 	block, err := aes.NewCipher(key)
 	if err != nil {
@@ -276,11 +276,7 @@ func (msg *ReceivedMessage) decryptSymmetric(key []byte) error {
 	if err != nil {
 		return err
 	}
-	if len(salt) != aesgcm.NonceSize() {
-		log.Error("decrypting the message", "AES salt size", len(salt))
-		return errors.New("wrong AES salt size")
-	}
-	decrypted, err := aesgcm.Open(nil, salt, msg.Raw[:len(msg.Raw)-AESNonceLength], nil)
+	decrypted, err := aesgcm.Open(nil, salt, msg.Raw[:len(msg.Raw)-aesNonceLength], nil)
 	if err != nil {
 		return err
 	}
diff --git a/whisper/whisperv6/message_test.go b/whisper/whisperv6/message_test.go
index 81db58dedd..f8e61c31ab 100644
--- a/whisper/whisperv6/message_test.go
+++ b/whisper/whisperv6/message_test.go
@@ -18,9 +18,12 @@ package whisperv6
 
 import (
 	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
 	mrand "math/rand"
 	"testing"
 
+	"github.com/ethereum/go-ethereum/common/hexutil"
 	"github.com/ethereum/go-ethereum/crypto"
 	"github.com/ethereum/go-ethereum/rlp"
 )
@@ -206,7 +209,7 @@ func TestEnvelopeOpen(t *testing.T) {
 	InitSingleTest()
 
 	var symmetric bool
-	for i := 0; i < 256; i++ {
+	for i := 0; i < 32; i++ {
 		singleEnvelopeOpenTest(t, symmetric)
 		symmetric = !symmetric
 	}
@@ -417,30 +420,6 @@ func TestPadding(t *testing.T) {
 	}
 }
 
-func TestPaddingAppendedToSymMessages(t *testing.T) {
-	params := &MessageParams{
-		Payload: make([]byte, 246),
-		KeySym:  make([]byte, aesKeyLength),
-	}
-
-	// Simulate a message with a payload just under 256 so that
-	// payload + flag + aesnonce > 256. Check that the result
-	// is padded on the next 256 boundary.
-	msg := sentMessage{}
-	msg.Raw = make([]byte, 1+1+len(params.Payload))
-
-	err := msg.appendPadding(params)
-
-	if err != nil {
-		t.Fatalf("Error appending padding to message %v", err)
-		return
-	}
-
-	if len(msg.Raw) != 512-AESNonceLength {
-		t.Errorf("Invalid size %d != 512", len(msg.Raw))
-	}
-}
-
 func TestPaddingAppendedToSymMessagesWithSignature(t *testing.T) {
 	params := &MessageParams{
 		Payload: make([]byte, 246),
@@ -456,7 +435,7 @@ func TestPaddingAppendedToSymMessagesWithSignature(t *testing.T) {
 	params.Src = pSrc
 
 	// Simulate a message with a payload just under 256 so that
-	// payload + flag + aesnonce > 256. Check that the result
+	// payload + flag + signature > 256. Check that the result
 	// is padded on the next 256 boundary.
 	msg := sentMessage{}
 	msg.Raw = make([]byte, 1+1+len(params.Payload))
@@ -468,7 +447,24 @@ func TestPaddingAppendedToSymMessagesWithSignature(t *testing.T) {
 		return
 	}
 
-	if len(msg.Raw) != 512-AESNonceLength-signatureLength {
+	if len(msg.Raw) != 512-signatureLength {
 		t.Errorf("Invalid size %d != 512", len(msg.Raw))
 	}
 }
+
+func TestAesNonce(t *testing.T) {
+	key := hexutil.MustDecode("0x03ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31")
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		t.Fatalf("NewCipher failed: %s", err)
+	}
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		t.Fatalf("NewGCM failed: %s", err)
+	}
+	// This is the most important single test in this package.
+	// If it fails, whisper will not be working.
+	if aesgcm.NonceSize() != aesNonceLength {
+		t.Fatalf("Nonce size is wrong. This is a critical error. Apparently AES nonce size have changed in the new version of AES GCM package. Whisper will not be working untill this problem is resolved.")
+	}
+}
diff --git a/whisper/whisperv6/peer_test.go b/whisper/whisperv6/peer_test.go
index 8a65cb7143..29f1172968 100644
--- a/whisper/whisperv6/peer_test.go
+++ b/whisper/whisperv6/peer_test.go
@@ -27,6 +27,7 @@ import (
 	"time"
 
 	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/common/hexutil"
 	"github.com/ethereum/go-ethereum/crypto"
 	"github.com/ethereum/go-ethereum/p2p"
 	"github.com/ethereum/go-ethereum/p2p/discover"
@@ -85,7 +86,7 @@ type TestNode struct {
 
 var result TestData
 var nodes [NumNodes]*TestNode
-var sharedKey []byte = []byte("some arbitrary data here")
+var sharedKey []byte = hexutil.MustDecode("0x03ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31")
 var sharedTopic TopicType = TopicType{0xF, 0x1, 0x2, 0}
 var expectedMessage []byte = []byte("per rectum ad astra")
 var masterBloomFilter []byte
diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index bc89aadccd..f7d71f612d 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -19,7 +19,6 @@ package whisperv6
 import (
 	"bytes"
 	"crypto/ecdsa"
-	crand "crypto/rand"
 	"crypto/sha256"
 	"fmt"
 	"math"
@@ -442,11 +441,10 @@ func (w *Whisper) GetPrivateKey(id string) (*ecdsa.PrivateKey, error) {
 // GenerateSymKey generates a random symmetric key and stores it under id,
 // which is then returned. Will be used in the future for session key exchange.
 func (w *Whisper) GenerateSymKey() (string, error) {
-	key := make([]byte, aesKeyLength)
-	_, err := crand.Read(key)
+	key, err := generateSecureRandomData(aesKeyLength)
 	if err != nil {
 		return "", err
-	} else if !validateSymmetricKey(key) {
+	} else if !validateRandomData(key, aesKeyLength) {
 		return "", fmt.Errorf("error in GenerateSymKey: crypto/rand failed to generate random data")
 	}
 
@@ -983,9 +981,10 @@ func validatePrivateKey(k *ecdsa.PrivateKey) bool {
 	return ValidatePublicKey(&k.PublicKey)
 }
 
-// validateSymmetricKey returns false if the key contains all zeros
-func validateSymmetricKey(k []byte) bool {
-	return len(k) > 0 && !containsOnlyZeros(k)
+// validateSymmetricKey returns false if the key contains all zeros,
+// which is a simplest and the most common bug.
+func validateRandomData(k []byte, expectedSize int) bool {
+	return len(k) == expectedSize && !containsOnlyZeros(k)
 }
 
 // containsOnlyZeros checks if the data contain only zeros.
@@ -1019,12 +1018,11 @@ func BytesToUintBigEndian(b []byte) (res uint64) {
 
 // GenerateRandomID generates a random string, which is then returned to be used as a key id
 func GenerateRandomID() (id string, err error) {
-	buf := make([]byte, keyIdSize)
-	_, err = crand.Read(buf)
+	buf, err := generateSecureRandomData(keyIdSize)
 	if err != nil {
 		return "", err
 	}
-	if !validateSymmetricKey(buf) {
+	if !validateRandomData(buf, keyIdSize) {
 		return "", fmt.Errorf("error in generateRandomID: crypto/rand failed to generate random data")
 	}
 	id = common.Bytes2Hex(buf)
diff --git a/whisper/whisperv6/whisper_test.go b/whisper/whisperv6/whisper_test.go
index fa14acb1b1..b10c59844e 100644
--- a/whisper/whisperv6/whisper_test.go
+++ b/whisper/whisperv6/whisper_test.go
@@ -81,7 +81,7 @@ func TestWhisperBasic(t *testing.T) {
 	}
 
 	derived := pbkdf2.Key([]byte(peerID), nil, 65356, aesKeyLength, sha256.New)
-	if !validateSymmetricKey(derived) {
+	if !validateRandomData(derived, aesKeyLength) {
 		t.Fatalf("failed validateSymmetricKey with param = %v.", derived)
 	}
 	if containsOnlyZeros(derived) {
@@ -448,24 +448,12 @@ func TestWhisperSymKeyManagement(t *testing.T) {
 	if !w.HasSymKey(id2) {
 		t.Fatalf("HasSymKey(id2) failed.")
 	}
-	if k1 == nil {
-		t.Fatalf("k1 does not exist.")
-	}
-	if k2 == nil {
-		t.Fatalf("k2 does not exist.")
+	if !validateRandomData(k2, aesKeyLength) {
+		t.Fatalf("key validation failed.")
 	}
 	if !bytes.Equal(k1, k2) {
 		t.Fatalf("k1 != k2.")
 	}
-	if len(k1) != aesKeyLength {
-		t.Fatalf("wrong length of k1.")
-	}
-	if len(k2) != aesKeyLength {
-		t.Fatalf("wrong length of k2.")
-	}
-	if !validateSymmetricKey(k2) {
-		t.Fatalf("key validation failed.")
-	}
 }
 
 func TestExpiry(t *testing.T) {

From fd0a2390a64339d305747a4aa7011bfd5beda1fb Mon Sep 17 00:00:00 2001
From: Vlad <gluk256@gmail.com>
Date: Thu, 11 Jan 2018 20:46:05 +0200
Subject: [PATCH 10/10] whisper: minor update

---
 whisper/whisperv6/message_test.go | 2 +-
 whisper/whisperv6/whisper.go      | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/whisper/whisperv6/message_test.go b/whisper/whisperv6/message_test.go
index f8e61c31ab..884bc71d76 100644
--- a/whisper/whisperv6/message_test.go
+++ b/whisper/whisperv6/message_test.go
@@ -465,6 +465,6 @@ func TestAesNonce(t *testing.T) {
 	// This is the most important single test in this package.
 	// If it fails, whisper will not be working.
 	if aesgcm.NonceSize() != aesNonceLength {
-		t.Fatalf("Nonce size is wrong. This is a critical error. Apparently AES nonce size have changed in the new version of AES GCM package. Whisper will not be working untill this problem is resolved.")
+		t.Fatalf("Nonce size is wrong. This is a critical error. Apparently AES nonce size have changed in the new version of AES GCM package. Whisper will not be working until this problem is resolved.")
 	}
 }
diff --git a/whisper/whisperv6/whisper.go b/whisper/whisperv6/whisper.go
index f7d71f612d..859546c671 100644
--- a/whisper/whisperv6/whisper.go
+++ b/whisper/whisperv6/whisper.go
@@ -984,7 +984,13 @@ func validatePrivateKey(k *ecdsa.PrivateKey) bool {
 // validateSymmetricKey returns false if the key contains all zeros,
 // which is a simplest and the most common bug.
 func validateRandomData(k []byte, expectedSize int) bool {
-	return len(k) == expectedSize && !containsOnlyZeros(k)
+	if len(k) != expectedSize {
+		return false
+	}
+	if expectedSize > 4 && containsOnlyZeros(k) {
+		return false
+	}
+	return true
 }
 
 // containsOnlyZeros checks if the data contain only zeros.