Make commitments SHA512

// FREEBIE

build.gradle

@@ -1,7 +1,7 @@
 subprojects {
     ext.version_number     = "2.2.0"
     ext.group_info         = "org.whispersystems"
-    ext.curve25519_version = "0.2.4"
+    ext.curve25519_version = "0.2.5"
 
     if (JavaVersion.current().isJava8Compatible()) {
         allprojects {

java/src/main/java/org/whispersystems/libsignal/devices/DeviceConsistencyCodeGenerator.java

@@ -0,0 +1,54 @@
+package org.whispersystems.libsignal.devices;
+
+import org.whispersystems.libsignal.util.ByteArrayComparator;
+import org.whispersystems.libsignal.util.ByteUtil;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+
+public class DeviceConsistencyCodeGenerator {
+
+  private static final int VERSION = 0;
+
+  public static String generateFor(DeviceConsistencyCommitment commitment,
+                                   List<DeviceConsistencySignature> signatures)
+  {
+    try {
+      ArrayList<DeviceConsistencySignature> sortedSignatures = new ArrayList<>(signatures);
+      Collections.sort(sortedSignatures, new SignatureComparator());
+
+      MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");
+      messageDigest.update(ByteUtil.shortToByteArray(VERSION));
+      messageDigest.update(commitment.toByteArray());
+
+      for (DeviceConsistencySignature signature : sortedSignatures) {
+        messageDigest.update(signature.getRevealBytes());
+      }
+
+      byte[] hash = messageDigest.digest();
+
+      String digits = getEncodedChunk(hash, 0) + getEncodedChunk(hash, 5);
+      return digits.substring(0, 6);
+
+    } catch (NoSuchAlgorithmException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+  private static String getEncodedChunk(byte[] hash, int offset) {
+    long chunk = ByteUtil.byteArray5ToLong(hash, offset) % 100000;
+    return String.format("%05d", chunk);
+  }
+
+
+  private static class SignatureComparator extends ByteArrayComparator implements Comparator<DeviceConsistencySignature> {
+    @Override
+    public int compare(DeviceConsistencySignature first, DeviceConsistencySignature second) {
+      return compare(first.toByteArray(), second.toByteArray());
+    }
+  }
+}

java/src/main/java/org/whispersystems/libsignal/devices/DeviceConsistencyCommitment.java

@@ -0,0 +1,55 @@
+package org.whispersystems.libsignal.devices;
+
+import org.whispersystems.libsignal.IdentityKey;
+import org.whispersystems.libsignal.util.ByteArrayComparator;
+import org.whispersystems.libsignal.util.ByteUtil;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+
+public class DeviceConsistencyCommitment {
+
+  private final int generation;
+  private final byte[] serialized;
+
+  public DeviceConsistencyCommitment(int generation, List<IdentityKey> identityKeys) {
+    try {
+      ArrayList<IdentityKey> sortedIdentityKeys = new ArrayList<>(identityKeys);
+      Collections.sort(sortedIdentityKeys, new IdentityKeyComparator());
+
+      MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");
+      messageDigest.update(ByteUtil.intToByteArray(generation));
+
+      for (IdentityKey commitment : sortedIdentityKeys) {
+        messageDigest.update(commitment.getPublicKey().serialize());
+      }
+
+      this.generation = generation;
+      this.serialized = messageDigest.digest();
+    } catch (NoSuchAlgorithmException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+  public byte[] toByteArray() {
+    return serialized;
+  }
+
+  public int getGeneration() {
+    return generation;
+  }
+
+  private static class IdentityKeyComparator extends ByteArrayComparator implements Comparator<IdentityKey> {
+
+    @Override
+    public int compare(IdentityKey first, IdentityKey second) {
+      return compare(first.getPublicKey().serialize(), second.getPublicKey().serialize());
+    }
+  }
+
+
+}

java/src/main/java/org/whispersystems/libsignal/devices/DeviceConsistencySignature.java

@@ -0,0 +1,20 @@
+package org.whispersystems.libsignal.devices;
+
+public class DeviceConsistencySignature {
+
+  private byte[] serialized;
+
+  public DeviceConsistencySignature(byte[] serialized) {
+    this.serialized = serialized;
+  }
+
+  public byte[] getRevealBytes() {
+    byte[] reveal = new byte[32];
+    System.arraycopy(serialized, 0, reveal, 0, reveal.length);
+    return reveal;
+  }
+
+  public byte[] toByteArray() {
+    return serialized;
+  }
+}

java/src/main/java/org/whispersystems/libsignal/ecc/Curve.java

@@ -83,4 +83,27 @@ public class Curve {
       throw new InvalidKeyException("Unknown type: " + signingKey.getType());
     }
   }
+
+  public static byte[] calculateUniqueSignature(ECPrivateKey signingKey, byte[] message)
+      throws InvalidKeyException
+  {
+    if (signingKey.getType() == DJB_TYPE) {
+      return Curve25519.getInstance(BEST)
+          .calculateUniqueSignature(((DjbECPrivateKey)signingKey).getPrivateKey(), message);
+    } else {
+      throw new InvalidKeyException("Unknown type: " + signingKey.getType());
+    }
+  }
+
+  public static boolean verifyUniqueSignature(ECPublicKey signingKey, byte[] message, byte[] signature)
+      throws InvalidKeyException
+  {
+    if (signingKey.getType() == DJB_TYPE) {
+      return Curve25519.getInstance(BEST)
+                       .verifyUniqueSignature(((DjbECPublicKey) signingKey).getPublicKey(), message, signature);
+    } else {
+      throw new InvalidKeyException("Unknown type: " + signingKey.getType());
+    }
+  }
+
 }

java/src/main/java/org/whispersystems/libsignal/protocol/DeviceConsistencyMessage.java

@@ -0,0 +1,54 @@
+package org.whispersystems.libsignal.protocol;
+
+import com.google.protobuf.ByteString;
+import com.google.protobuf.InvalidProtocolBufferException;
+
+import org.whispersystems.libsignal.IdentityKey;
+import org.whispersystems.libsignal.IdentityKeyPair;
+import org.whispersystems.libsignal.InvalidKeyException;
+import org.whispersystems.libsignal.InvalidMessageException;
+import org.whispersystems.libsignal.devices.DeviceConsistencyCommitment;
+import org.whispersystems.libsignal.devices.DeviceConsistencySignature;
+import org.whispersystems.libsignal.ecc.Curve;
+
+public class DeviceConsistencyMessage {
+
+  private final DeviceConsistencySignature signature;
+  private final byte[]                     serialized;
+
+  public DeviceConsistencyMessage(DeviceConsistencyCommitment commitment, IdentityKeyPair identityKeyPair) {
+    try {
+      this.signature  = new DeviceConsistencySignature(Curve.calculateUniqueSignature(identityKeyPair.getPrivateKey(), commitment.toByteArray()));
+      this.serialized = SignalProtos.DeviceConsistencyCodeMessage.newBuilder()
+                                                                  .setGeneration(commitment.getGeneration())
+                                                                  .setSignature(ByteString.copyFrom(signature.toByteArray()))
+                                                                  .build()
+                                                                  .toByteArray();
+    } catch (InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+  public DeviceConsistencyMessage(DeviceConsistencyCommitment commitment, byte[] serialized, IdentityKey identityKey) throws InvalidMessageException {
+    try {
+      SignalProtos.DeviceConsistencyCodeMessage message = SignalProtos.DeviceConsistencyCodeMessage.parseFrom(serialized);
+
+      if (!Curve.verifyUniqueSignature(identityKey.getPublicKey(), commitment.toByteArray(), message.getSignature().toByteArray())) {
+        throw new InvalidMessageException("Bad signature!");
+      }
+
+      this.signature  = new DeviceConsistencySignature(message.getSignature().toByteArray());
+      this.serialized = serialized;
+    } catch (InvalidProtocolBufferException | InvalidKeyException e) {
+      throw new InvalidMessageException(e);
+    }
+  }
+
+  public byte[] getSerialized() {
+    return serialized;
+  }
+
+  public DeviceConsistencySignature getSignature() {
+    return signature;
+  }
+}

java/src/main/java/org/whispersystems/libsignal/protocol/SignalProtos.java

@@ -3433,6 +3433,486 @@ public final class SignalProtos {
     // @@protoc_insertion_point(class_scope:textsecure.SenderKeyDistributionMessage)
   }
 
+  public interface DeviceConsistencyCodeMessageOrBuilder
+      extends com.google.protobuf.MessageOrBuilder {
+
+    // optional uint32 generation = 1;
+    /**
+     * <code>optional uint32 generation = 1;</code>
+     */
+    boolean hasGeneration();
+    /**
+     * <code>optional uint32 generation = 1;</code>
+     */
+    int getGeneration();
+
+    // optional bytes signature = 2;
+    /**
+     * <code>optional bytes signature = 2;</code>
+     */
+    boolean hasSignature();
+    /**
+     * <code>optional bytes signature = 2;</code>
+     */
+    com.google.protobuf.ByteString getSignature();
+  }
+  /**
+   * Protobuf type {@code textsecure.DeviceConsistencyCodeMessage}
+   */
+  public static final class DeviceConsistencyCodeMessage extends
+      com.google.protobuf.GeneratedMessage
+      implements DeviceConsistencyCodeMessageOrBuilder {
+    // Use DeviceConsistencyCodeMessage.newBuilder() to construct.
+    private DeviceConsistencyCodeMessage(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
+      super(builder);
+      this.unknownFields = builder.getUnknownFields();
+    }
+    private DeviceConsistencyCodeMessage(boolean noInit) { this.unknownFields = com.google.protobuf.UnknownFieldSet.getDefaultInstance(); }
+
+    private static final DeviceConsistencyCodeMessage defaultInstance;
+    public static DeviceConsistencyCodeMessage getDefaultInstance() {
+      return defaultInstance;
+    }
+
+    public DeviceConsistencyCodeMessage getDefaultInstanceForType() {
+      return defaultInstance;
+    }
+
+    private final com.google.protobuf.UnknownFieldSet unknownFields;
+    @java.lang.Override
+    public final com.google.protobuf.UnknownFieldSet
+        getUnknownFields() {
+      return this.unknownFields;
+    }
+    private DeviceConsistencyCodeMessage(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      initFields();
+      int mutable_bitField0_ = 0;
+      com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+          com.google.protobuf.UnknownFieldSet.newBuilder();
+      try {
+        boolean done = false;
+        while (!done) {
+          int tag = input.readTag();
+          switch (tag) {
+            case 0:
+              done = true;
+              break;
+            default: {
+              if (!parseUnknownField(input, unknownFields,
+                                     extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+            case 8: {
+              bitField0_ |= 0x00000001;
+              generation_ = input.readUInt32();
+              break;
+            }
+            case 18: {
+              bitField0_ |= 0x00000002;
+              signature_ = input.readBytes();
+              break;
+            }
+          }
+        }
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        throw e.setUnfinishedMessage(this);
+      } catch (java.io.IOException e) {
+        throw new com.google.protobuf.InvalidProtocolBufferException(
+            e.getMessage()).setUnfinishedMessage(this);
+      } finally {
+        this.unknownFields = unknownFields.build();
+        makeExtensionsImmutable();
+      }
+    }
+    public static final com.google.protobuf.Descriptors.Descriptor
+        getDescriptor() {
+      return org.whispersystems.libsignal.protocol.SignalProtos.internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor;
+    }
+
+    protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return org.whispersystems.libsignal.protocol.SignalProtos.internal_static_textsecure_DeviceConsistencyCodeMessage_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.class, org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.Builder.class);
+    }
+
+    public static com.google.protobuf.Parser<DeviceConsistencyCodeMessage> PARSER =
+        new com.google.protobuf.AbstractParser<DeviceConsistencyCodeMessage>() {
+      public DeviceConsistencyCodeMessage parsePartialFrom(
+          com.google.protobuf.CodedInputStream input,
+          com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+          throws com.google.protobuf.InvalidProtocolBufferException {
+        return new DeviceConsistencyCodeMessage(input, extensionRegistry);
+      }
+    };
+
+    @java.lang.Override
+    public com.google.protobuf.Parser<DeviceConsistencyCodeMessage> getParserForType() {
+      return PARSER;
+    }
+
+    private int bitField0_;
+    // optional uint32 generation = 1;
+    public static final int GENERATION_FIELD_NUMBER = 1;
+    private int generation_;
+    /**
+     * <code>optional uint32 generation = 1;</code>
+     */
+    public boolean hasGeneration() {
+      return ((bitField0_ & 0x00000001) == 0x00000001);
+    }
+    /**
+     * <code>optional uint32 generation = 1;</code>
+     */
+    public int getGeneration() {
+      return generation_;
+    }
+
+    // optional bytes signature = 2;
+    public static final int SIGNATURE_FIELD_NUMBER = 2;
+    private com.google.protobuf.ByteString signature_;
+    /**
+     * <code>optional bytes signature = 2;</code>
+     */
+    public boolean hasSignature() {
+      return ((bitField0_ & 0x00000002) == 0x00000002);
+    }
+    /**
+     * <code>optional bytes signature = 2;</code>
+     */
+    public com.google.protobuf.ByteString getSignature() {
+      return signature_;
+    }
+
+    private void initFields() {
+      generation_ = 0;
+      signature_ = com.google.protobuf.ByteString.EMPTY;
+    }
+    private byte memoizedIsInitialized = -1;
+    public final boolean isInitialized() {
+      byte isInitialized = memoizedIsInitialized;
+      if (isInitialized != -1) return isInitialized == 1;
+
+      memoizedIsInitialized = 1;
+      return true;
+    }
+
+    public void writeTo(com.google.protobuf.CodedOutputStream output)
+                        throws java.io.IOException {
+      getSerializedSize();
+      if (((bitField0_ & 0x00000001) == 0x00000001)) {
+        output.writeUInt32(1, generation_);
+      }
+      if (((bitField0_ & 0x00000002) == 0x00000002)) {
+        output.writeBytes(2, signature_);
+      }
+      getUnknownFields().writeTo(output);
+    }
+
+    private int memoizedSerializedSize = -1;
+    public int getSerializedSize() {
+      int size = memoizedSerializedSize;
+      if (size != -1) return size;
+
+      size = 0;
+      if (((bitField0_ & 0x00000001) == 0x00000001)) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeUInt32Size(1, generation_);
+      }
+      if (((bitField0_ & 0x00000002) == 0x00000002)) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeBytesSize(2, signature_);
+      }
+      size += getUnknownFields().getSerializedSize();
+      memoizedSerializedSize = size;
+      return size;
+    }
+
+    private static final long serialVersionUID = 0L;
+    @java.lang.Override
+    protected java.lang.Object writeReplace()
+        throws java.io.ObjectStreamException {
+      return super.writeReplace();
+    }
+
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        com.google.protobuf.ByteString data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        com.google.protobuf.ByteString data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(byte[] data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        byte[] data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(java.io.InputStream input)
+        throws java.io.IOException {
+      return PARSER.parseFrom(input);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        java.io.InputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return PARSER.parseFrom(input, extensionRegistry);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseDelimitedFrom(java.io.InputStream input)
+        throws java.io.IOException {
+      return PARSER.parseDelimitedFrom(input);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseDelimitedFrom(
+        java.io.InputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return PARSER.parseDelimitedFrom(input, extensionRegistry);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        com.google.protobuf.CodedInputStream input)
+        throws java.io.IOException {
+      return PARSER.parseFrom(input);
+    }
+    public static org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parseFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return PARSER.parseFrom(input, extensionRegistry);
+    }
+
+    public static Builder newBuilder() { return Builder.create(); }
+    public Builder newBuilderForType() { return newBuilder(); }
+    public static Builder newBuilder(org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage prototype) {
+      return newBuilder().mergeFrom(prototype);
+    }
+    public Builder toBuilder() { return newBuilder(this); }
+
+    @java.lang.Override
+    protected Builder newBuilderForType(
+        com.google.protobuf.GeneratedMessage.BuilderParent parent) {
+      Builder builder = new Builder(parent);
+      return builder;
+    }
+    /**
+     * Protobuf type {@code textsecure.DeviceConsistencyCodeMessage}
+     */
+    public static final class Builder extends
+        com.google.protobuf.GeneratedMessage.Builder<Builder>
+       implements org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessageOrBuilder {
+      public static final com.google.protobuf.Descriptors.Descriptor
+          getDescriptor() {
+        return org.whispersystems.libsignal.protocol.SignalProtos.internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor;
+      }
+
+      protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
+          internalGetFieldAccessorTable() {
+        return org.whispersystems.libsignal.protocol.SignalProtos.internal_static_textsecure_DeviceConsistencyCodeMessage_fieldAccessorTable
+            .ensureFieldAccessorsInitialized(
+                org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.class, org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.Builder.class);
+      }
+
+      // Construct using org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.newBuilder()
+      private Builder() {
+        maybeForceBuilderInitialization();
+      }
+
+      private Builder(
+          com.google.protobuf.GeneratedMessage.BuilderParent parent) {
+        super(parent);
+        maybeForceBuilderInitialization();
+      }
+      private void maybeForceBuilderInitialization() {
+        if (com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders) {
+        }
+      }
+      private static Builder create() {
+        return new Builder();
+      }
+
+      public Builder clear() {
+        super.clear();
+        generation_ = 0;
+        bitField0_ = (bitField0_ & ~0x00000001);
+        signature_ = com.google.protobuf.ByteString.EMPTY;
+        bitField0_ = (bitField0_ & ~0x00000002);
+        return this;
+      }
+
+      public Builder clone() {
+        return create().mergeFrom(buildPartial());
+      }
+
+      public com.google.protobuf.Descriptors.Descriptor
+          getDescriptorForType() {
+        return org.whispersystems.libsignal.protocol.SignalProtos.internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor;
+      }
+
+      public org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage getDefaultInstanceForType() {
+        return org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.getDefaultInstance();
+      }
+
+      public org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage build() {
+        org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage result = buildPartial();
+        if (!result.isInitialized()) {
+          throw newUninitializedMessageException(result);
+        }
+        return result;
+      }
+
+      public org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage buildPartial() {
+        org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage result = new org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage(this);
+        int from_bitField0_ = bitField0_;
+        int to_bitField0_ = 0;
+        if (((from_bitField0_ & 0x00000001) == 0x00000001)) {
+          to_bitField0_ |= 0x00000001;
+        }
+        result.generation_ = generation_;
+        if (((from_bitField0_ & 0x00000002) == 0x00000002)) {
+          to_bitField0_ |= 0x00000002;
+        }
+        result.signature_ = signature_;
+        result.bitField0_ = to_bitField0_;
+        onBuilt();
+        return result;
+      }
+
+      public Builder mergeFrom(com.google.protobuf.Message other) {
+        if (other instanceof org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage) {
+          return mergeFrom((org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage)other);
+        } else {
+          super.mergeFrom(other);
+          return this;
+        }
+      }
+
+      public Builder mergeFrom(org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage other) {
+        if (other == org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage.getDefaultInstance()) return this;
+        if (other.hasGeneration()) {
+          setGeneration(other.getGeneration());
+        }
+        if (other.hasSignature()) {
+          setSignature(other.getSignature());
+        }
+        this.mergeUnknownFields(other.getUnknownFields());
+        return this;
+      }
+
+      public final boolean isInitialized() {
+        return true;
+      }
+
+      public Builder mergeFrom(
+          com.google.protobuf.CodedInputStream input,
+          com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+          throws java.io.IOException {
+        org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage parsedMessage = null;
+        try {
+          parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+        } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+          parsedMessage = (org.whispersystems.libsignal.protocol.SignalProtos.DeviceConsistencyCodeMessage) e.getUnfinishedMessage();
+          throw e;
+        } finally {
+          if (parsedMessage != null) {
+            mergeFrom(parsedMessage);
+          }
+        }
+        return this;
+      }
+      private int bitField0_;
+
+      // optional uint32 generation = 1;
+      private int generation_ ;
+      /**
+       * <code>optional uint32 generation = 1;</code>
+       */
+      public boolean hasGeneration() {
+        return ((bitField0_ & 0x00000001) == 0x00000001);
+      }
+      /**
+       * <code>optional uint32 generation = 1;</code>
+       */
+      public int getGeneration() {
+        return generation_;
+      }
+      /**
+       * <code>optional uint32 generation = 1;</code>
+       */
+      public Builder setGeneration(int value) {
+        bitField0_ |= 0x00000001;
+        generation_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <code>optional uint32 generation = 1;</code>
+       */
+      public Builder clearGeneration() {
+        bitField0_ = (bitField0_ & ~0x00000001);
+        generation_ = 0;
+        onChanged();
+        return this;
+      }
+
+      // optional bytes signature = 2;
+      private com.google.protobuf.ByteString signature_ = com.google.protobuf.ByteString.EMPTY;
+      /**
+       * <code>optional bytes signature = 2;</code>
+       */
+      public boolean hasSignature() {
+        return ((bitField0_ & 0x00000002) == 0x00000002);
+      }
+      /**
+       * <code>optional bytes signature = 2;</code>
+       */
+      public com.google.protobuf.ByteString getSignature() {
+        return signature_;
+      }
+      /**
+       * <code>optional bytes signature = 2;</code>
+       */
+      public Builder setSignature(com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  bitField0_ |= 0x00000002;
+        signature_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <code>optional bytes signature = 2;</code>
+       */
+      public Builder clearSignature() {
+        bitField0_ = (bitField0_ & ~0x00000002);
+        signature_ = getDefaultInstance().getSignature();
+        onChanged();
+        return this;
+      }
+
+      // @@protoc_insertion_point(builder_scope:textsecure.DeviceConsistencyCodeMessage)
+    }
+
+    static {
+      defaultInstance = new DeviceConsistencyCodeMessage(true);
+      defaultInstance.initFields();
+    }
+
+    // @@protoc_insertion_point(class_scope:textsecure.DeviceConsistencyCodeMessage)
+  }
+
   private static com.google.protobuf.Descriptors.Descriptor
     internal_static_textsecure_SignalMessage_descriptor;
   private static
@@ -3458,6 +3938,11 @@ public final class SignalProtos {
   private static
     com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internal_static_textsecure_SenderKeyDistributionMessage_fieldAccessorTable;
+  private static com.google.protobuf.Descriptors.Descriptor
+    internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor;
+  private static
+    com.google.protobuf.GeneratedMessage.FieldAccessorTable
+      internal_static_textsecure_DeviceConsistencyCodeMessage_fieldAccessorTable;
 
   public static com.google.protobuf.Descriptors.FileDescriptor
       getDescriptor() {
@@ -3481,8 +3966,10 @@ public final class SignalProtos {
       "ration\030\002 \001(\r\022\022\n\nciphertext\030\003 \001(\014\"c\n\034Send" +
       "erKeyDistributionMessage\022\n\n\002id\030\001 \001(\r\022\021\n\t" +
       "iteration\030\002 \001(\r\022\020\n\010chainKey\030\003 \001(\014\022\022\n\nsig" +
-      "ningKey\030\004 \001(\014B5\n%org.whispersystems.libs" +
-      "ignal.protocolB\014SignalProtos"
+      "ningKey\030\004 \001(\014\"E\n\034DeviceConsistencyCodeMe" +
+      "ssage\022\022\n\ngeneration\030\001 \001(\r\022\021\n\tsignature\030\002" +
+      " \001(\014B5\n%org.whispersystems.libsignal.pro" +
+      "tocolB\014SignalProtos"
     };
     com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner assigner =
       new com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner() {
@@ -3519,6 +4006,12 @@ public final class SignalProtos {
             com.google.protobuf.GeneratedMessage.FieldAccessorTable(
               internal_static_textsecure_SenderKeyDistributionMessage_descriptor,
               new java.lang.String[] { "Id", "Iteration", "ChainKey", "SigningKey", });
+          internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor =
+            getDescriptor().getMessageTypes().get(5);
+          internal_static_textsecure_DeviceConsistencyCodeMessage_fieldAccessorTable = new
+            com.google.protobuf.GeneratedMessage.FieldAccessorTable(
+              internal_static_textsecure_DeviceConsistencyCodeMessage_descriptor,
+              new java.lang.String[] { "Generation", "Signature", });
           return null;
         }
       };

java/src/main/java/org/whispersystems/libsignal/util/ByteArrayComparator.java

@@ -0,0 +1,18 @@
+package org.whispersystems.libsignal.util;
+
+public abstract class ByteArrayComparator {
+
+  protected int compare(byte[] left, byte[] right) {
+    for (int i = 0, j = 0; i < left.length && j < right.length; i++, j++) {
+      int a = (left[i] & 0xff);
+      int b = (right[j] & 0xff);
+
+      if (a != b) {
+        return a - b;
+      }
+    }
+
+    return left.length - right.length;
+  }
+
+}

protobuf/WhisperTextProtocol.proto

@@ -38,4 +38,9 @@ message SenderKeyDistributionMessage {
   optional uint32 iteration  = 2;
   optional bytes  chainKey   = 3;
   optional bytes  signingKey = 4;
+}
+
+message DeviceConsistencyCodeMessage {
+  optional uint32 generation = 1;
+  optional bytes  signature  = 2;
 }

tests/src/test/java/org/whispersystems/libsignal/devices/DeviceConsistencyTest.java

@@ -0,0 +1,74 @@
+package org.whispersystems.libsignal.devices;
+
+import junit.framework.TestCase;
+
+import org.whispersystems.libsignal.IdentityKey;
+import org.whispersystems.libsignal.IdentityKeyPair;
+import org.whispersystems.libsignal.InvalidMessageException;
+import org.whispersystems.libsignal.protocol.DeviceConsistencyMessage;
+import org.whispersystems.libsignal.util.KeyHelper;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+
+public class DeviceConsistencyTest extends TestCase {
+
+  public void testDeviceConsistency() throws InvalidMessageException {
+    final IdentityKeyPair deviceOne   = KeyHelper.generateIdentityKeyPair();
+    final IdentityKeyPair deviceTwo   = KeyHelper.generateIdentityKeyPair();
+    final IdentityKeyPair deviceThree = KeyHelper.generateIdentityKeyPair();
+
+    List<IdentityKey> keyList = new LinkedList<IdentityKey>() {{
+      add(deviceOne.getPublicKey());
+      add(deviceTwo.getPublicKey());
+      add(deviceThree.getPublicKey());
+    }};
+
+    Collections.shuffle(keyList);
+    DeviceConsistencyCommitment deviceOneCommitment = new DeviceConsistencyCommitment(1, keyList);
+
+    Collections.shuffle(keyList);
+    DeviceConsistencyCommitment deviceTwoCommitment = new DeviceConsistencyCommitment(1, keyList);
+
+    Collections.shuffle(keyList);
+    DeviceConsistencyCommitment deviceThreeCommitment = new DeviceConsistencyCommitment(1, keyList);
+
+    assertTrue(Arrays.equals(deviceOneCommitment.toByteArray(), deviceTwoCommitment.toByteArray()));
+    assertTrue(Arrays.equals(deviceTwoCommitment.toByteArray(), deviceThreeCommitment.toByteArray()));
+
+    DeviceConsistencyMessage deviceOneMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceOne);
+    DeviceConsistencyMessage deviceTwoMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceTwo);
+    DeviceConsistencyMessage deviceThreeMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceThree);
+
+    DeviceConsistencyMessage receivedDeviceOneMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceOneMessage.getSerialized(), deviceOne.getPublicKey());
+    DeviceConsistencyMessage receivedDeviceTwoMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceTwoMessage.getSerialized(), deviceTwo.getPublicKey());
+    DeviceConsistencyMessage receivedDeviceThreeMessage = new DeviceConsistencyMessage(deviceOneCommitment, deviceThreeMessage.getSerialized(), deviceThree.getPublicKey());
+
+    assertTrue(Arrays.equals(deviceOneMessage.getSignature().getRevealBytes(), receivedDeviceOneMessage.getSignature().getRevealBytes()));
+    assertTrue(Arrays.equals(deviceTwoMessage.getSignature().getRevealBytes(), receivedDeviceTwoMessage.getSignature().getRevealBytes()));
+    assertTrue(Arrays.equals(deviceThreeMessage.getSignature().getRevealBytes(), receivedDeviceThreeMessage.getSignature().getRevealBytes()));
+
+    String codeOne = generateCode(deviceOneCommitment, deviceOneMessage, receivedDeviceTwoMessage, receivedDeviceThreeMessage);
+    String codeTwo = generateCode(deviceTwoCommitment, deviceTwoMessage, receivedDeviceThreeMessage, receivedDeviceOneMessage);
+    String codeThree = generateCode(deviceThreeCommitment, deviceThreeMessage, receivedDeviceTwoMessage, receivedDeviceOneMessage);
+
+    assertEquals(codeOne, codeTwo);
+    assertEquals(codeTwo, codeThree);
+  }
+
+  private String generateCode(DeviceConsistencyCommitment commitment,
+                              DeviceConsistencyMessage... messages)
+  {
+    List<DeviceConsistencySignature> signatures = new LinkedList<>();
+
+    for (DeviceConsistencyMessage message : messages) {
+      signatures.add(message.getSignature());
+    }
+
+    return DeviceConsistencyCodeGenerator.generateFor(commitment, signatures);
+  }
+
+
+}