[omemo] Refactor Plugin

- Adapt to nbxmpp supporting OMEMO
- Move python-axolotl code into backend folder

omemo/backend/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

omemo/backend/aes.py

@@ -0,0 +1,86 @@
+# Copyright (C) 2019 Philipp Hörist <philipp AT hoerist.com>
+#
+# This file is part of OMEMO Gajim Plugin.
+#
+# OMEMO Gajim Plugin is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published
+# by the Free Software Foundation; version 3 only.
+#
+# OMEMO Gajim Plugin is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OMEMO Gajim Plugin. If not, see <http://www.gnu.org/licenses/>.
+
+
+import os
+import logging
+from collections import namedtuple
+
+from cryptography.hazmat.primitives.ciphers import Cipher
+from cryptography.hazmat.primitives.ciphers import algorithms
+from cryptography.hazmat.primitives.ciphers.modes import GCM
+from cryptography.hazmat.backends import default_backend
+
+log = logging.getLogger('gajim.plugin_system.omemo')
+
+EncryptionResult = namedtuple('EncryptionResult', 'payload key iv')
+
+
+def _decrypt(key, iv, tag, data):
+    decryptor = Cipher(
+        algorithms.AES(key),
+        GCM(iv, tag=tag),
+        backend=default_backend()).decryptor()
+    return decryptor.update(data) + decryptor.finalize()
+
+
+def aes_decrypt(_key, iv, payload):
+    if len(_key) >= 32:
+        # XEP-0384
+        log.debug('XEP Compliant Key/Tag')
+        data = payload
+        key = _key[:16]
+        tag = _key[16:]
+    else:
+        # Legacy
+        log.debug('Legacy Key/Tag')
+        data = payload[:-16]
+        key = _key
+        tag = payload[-16:]
+
+    return _decrypt(key, iv, tag, data).decode()
+
+
+def aes_decrypt_file(key, iv, payload):
+    data = payload[:-16]
+    tag = payload[-16:]
+    return _decrypt(key, iv, tag, data)
+
+
+def _encrypt(data, key_size, iv_size):
+    if isinstance(data, str):
+        data = data.encode()
+    key = os.urandom(key_size)
+    iv = os.urandom(iv_size)
+    encryptor = Cipher(
+        algorithms.AES(key),
+        GCM(iv),
+        backend=default_backend()).encryptor()
+
+    payload = encryptor.update(data) + encryptor.finalize()
+    return key, iv, encryptor.tag, payload
+
+
+def aes_encrypt(plaintext):
+    key, iv, tag, payload = _encrypt(plaintext, 16, 16)
+    key += tag
+    return EncryptionResult(payload=payload, key=key, iv=iv)
+
+
+def aes_encrypt_file(data):
+    key, iv, tag, payload, = _encrypt(data, 32, 16)
+    payload += tag
+    return EncryptionResult(payload=payload, key=key, iv=iv)

omemo/backend/db_helpers.py

@@ -0,0 +1,15 @@
+''' Database helper functions '''
+
+
+def table_exists(db, name):
+    """ Check if the specified table exists in the db. """
+
+    query = """ SELECT name FROM sqlite_master
+            WHERE type='table' AND name=?;
+        """
+    return db.execute(query, (name, )).fetchone() is not None
+
+
+def user_version(db):
+    """ Return the value of PRAGMA user_version. """
+    return db.execute('PRAGMA user_version').fetchone()[0]

omemo/backend/encryption.py

@@ -0,0 +1,64 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Bahtiar `kalkin-` Gadimov <bahtiar@gadimov.de>
+# Copyright 2015 Daniel Gultsch <daniel@cgultsch.de>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+
+class EncryptionState():
+    """ Used to store if OMEMO is enabled or not between gajim restarts """
+
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+
+    def activate(self, jid):
+        q = """INSERT OR REPLACE INTO encryption_state (jid, encryption)
+               VALUES (?, 1) """
+
+        c = self.dbConn.cursor()
+        c.execute(q, (jid, ))
+        self.dbConn.commit()
+
+    def deactivate(self, jid):
+        q = """INSERT OR REPLACE INTO encryption_state (jid, encryption)
+               VALUES (?, 0)"""
+
+        c = self.dbConn.cursor()
+        c.execute(q, (jid, ))
+        self.dbConn.commit()
+
+    def is_active(self, jid):
+        q = 'SELECT encryption FROM encryption_state where jid = ?;'
+        c = self.dbConn.cursor()
+        c.execute(q, (jid, ))
+        result = c.fetchone()
+        if result is None:
+            return False
+        return result[0]
+
+    def exist(self, jid):
+        q = 'SELECT encryption FROM encryption_state where jid = ?;'
+        c = self.dbConn.cursor()
+        c.execute(q, (jid, ))
+        result = c.fetchone()
+        if result is None:
+            return False
+        else:
+            return True

omemo/backend/liteaxolotlstore.py

@@ -0,0 +1,186 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import logging
+
+from axolotl.state.axolotlstore import AxolotlStore
+from axolotl.util.keyhelper import KeyHelper
+
+from .liteidentitykeystore import LiteIdentityKeyStore
+from .liteprekeystore import LitePreKeyStore
+from .litesessionstore import LiteSessionStore
+from .litesignedprekeystore import LiteSignedPreKeyStore
+from .encryption import EncryptionState
+from .sql import SQLDatabase
+
+log = logging.getLogger('gajim.plugin_system.omemo')
+
+DEFAULT_PREKEY_AMOUNT = 100
+MIN_PREKEY_AMOUNT = 80
+SPK_ARCHIVE_TIME = 86400 * 15  # 15 Days
+SPK_CYCLE_TIME = 86400         # 24 Hours
+
+
+class LiteAxolotlStore(AxolotlStore):
+    def __init__(self, connection):
+        try:
+            connection.text_factory = bytes
+        except(AttributeError):
+            raise AssertionError('Expected a sqlite3.Connection got ' +
+                                 str(connection))
+
+        self.sql = SQLDatabase(connection)
+        self.identityKeyStore = LiteIdentityKeyStore(connection)
+        self.preKeyStore = LitePreKeyStore(connection)
+        self.signedPreKeyStore = LiteSignedPreKeyStore(connection)
+        self.sessionStore = LiteSessionStore(connection)
+        self.encryptionStore = EncryptionState(connection)
+
+        if not self.getLocalRegistrationId():
+            log.info("Generating Axolotl keys")
+            self._generate_axolotl_keys()
+
+    def _generate_axolotl_keys(self):
+        identityKeyPair = KeyHelper.generateIdentityKeyPair()
+        registrationId = KeyHelper.generateRegistrationId()
+        preKeys = KeyHelper.generatePreKeys(KeyHelper.getRandomSequence(),
+                                            DEFAULT_PREKEY_AMOUNT)
+        self.storeLocalData(registrationId, identityKeyPair)
+
+        signedPreKey = KeyHelper.generateSignedPreKey(
+            identityKeyPair, KeyHelper.getRandomSequence(65536))
+
+        self.storeSignedPreKey(signedPreKey.getId(), signedPreKey)
+
+        for preKey in preKeys:
+            self.storePreKey(preKey.getId(), preKey)
+
+    def getIdentityKeyPair(self):
+        return self.identityKeyStore.getIdentityKeyPair()
+
+    def storeLocalData(self, registrationId, identityKeyPair):
+        self.identityKeyStore.storeLocalData(registrationId, identityKeyPair)
+
+    def getLocalRegistrationId(self):
+        return self.identityKeyStore.getLocalRegistrationId()
+
+    def saveIdentity(self, recepientId, identityKey):
+        self.identityKeyStore.saveIdentity(recepientId, identityKey)
+
+    def deleteIdentity(self, recipientId, identityKey):
+        self.identityKeyStore.deleteIdentity(recipientId, identityKey)
+
+    def isTrustedIdentity(self, recepientId, identityKey):
+        return self.identityKeyStore.isTrustedIdentity(recepientId,
+                                                       identityKey)
+
+    def setTrust(self, identityKey, trust):
+        return self.identityKeyStore.setTrust(identityKey, trust)
+
+    def getTrustedFingerprints(self, jid):
+        return self.identityKeyStore.getTrustedFingerprints(jid)
+
+    def getUndecidedFingerprints(self, jid):
+        return self.identityKeyStore.getUndecidedFingerprints(jid)
+
+    def setShownFingerprints(self, jid):
+        return self.identityKeyStore.setShownFingerprints(jid)
+
+    def getNewFingerprints(self, jid):
+        return self.identityKeyStore.getNewFingerprints(jid)
+
+    def loadPreKey(self, preKeyId):
+        return self.preKeyStore.loadPreKey(preKeyId)
+
+    def loadPreKeys(self):
+        return self.preKeyStore.loadPendingPreKeys()
+
+    def storePreKey(self, preKeyId, preKeyRecord):
+        self.preKeyStore.storePreKey(preKeyId, preKeyRecord)
+
+    def containsPreKey(self, preKeyId):
+        return self.preKeyStore.containsPreKey(preKeyId)
+
+    def removePreKey(self, preKeyId):
+        self.preKeyStore.removePreKey(preKeyId)
+
+    def loadSession(self, recepientId, deviceId):
+        return self.sessionStore.loadSession(recepientId, deviceId)
+
+    def getActiveDeviceTuples(self):
+        return self.sessionStore.getActiveDeviceTuples()
+
+    def getInactiveSessionsKeys(self, recipientId):
+        return self.sessionStore.getInactiveSessionsKeys(recipientId)
+
+    def getSubDeviceSessions(self, recepientId):
+        # TODO Reuse this
+        return self.sessionStore.getSubDeviceSessions(recepientId)
+
+    def getJidFromDevice(self, device_id):
+        return self.sessionStore.getJidFromDevice(device_id)
+
+    def storeSession(self, recepientId, deviceId, sessionRecord):
+        self.sessionStore.storeSession(recepientId, deviceId, sessionRecord)
+
+    def containsSession(self, recepientId, deviceId):
+        return self.sessionStore.containsSession(recepientId, deviceId)
+
+    def deleteSession(self, recepientId, deviceId):
+        self.sessionStore.deleteSession(recepientId, deviceId)
+
+    def deleteAllSessions(self, recepientId):
+        self.sessionStore.deleteAllSessions(recepientId)
+
+    def getSessionsFromJid(self, recipientId):
+        return self.sessionStore.getSessionsFromJid(recipientId)
+
+    def getSessionsFromJids(self, recipientId):
+        return self.sessionStore.getSessionsFromJids(recipientId)
+
+    def getAllSessions(self):
+        return self.sessionStore.getAllSessions()
+
+    def loadSignedPreKey(self, signedPreKeyId):
+        return self.signedPreKeyStore.loadSignedPreKey(signedPreKeyId)
+
+    def loadSignedPreKeys(self):
+        return self.signedPreKeyStore.loadSignedPreKeys()
+
+    def storeSignedPreKey(self, signedPreKeyId, signedPreKeyRecord):
+        self.signedPreKeyStore.storeSignedPreKey(signedPreKeyId,
+                                                 signedPreKeyRecord)
+
+    def containsSignedPreKey(self, signedPreKeyId):
+        return self.signedPreKeyStore.containsSignedPreKey(signedPreKeyId)
+
+    def removeSignedPreKey(self, signedPreKeyId):
+        self.signedPreKeyStore.removeSignedPreKey(signedPreKeyId)
+
+    def getNextSignedPreKeyId(self):
+        return self.signedPreKeyStore.getNextSignedPreKeyId()
+
+    def getCurrentSignedPreKeyId(self):
+        return self.signedPreKeyStore.getCurrentSignedPreKeyId()
+
+    def getSignedPreKeyTimestamp(self, signedPreKeyId):
+        return self.signedPreKeyStore.getSignedPreKeyTimestamp(signedPreKeyId)
+
+    def removeOldSignedPreKeys(self, timestamp):
+        self.signedPreKeyStore.removeOldSignedPreKeys(timestamp)

omemo/backend/liteidentitykeystore.py

@@ -0,0 +1,174 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from axolotl.ecc.djbec import DjbECPrivateKey, DjbECPublicKey
+from axolotl.identitykey import IdentityKey
+from axolotl.identitykeypair import IdentityKeyPair
+from axolotl.state.identitykeystore import IdentityKeyStore
+
+UNDECIDED = 2
+TRUSTED = 1
+UNTRUSTED = 0
+
+
+class LiteIdentityKeyStore(IdentityKeyStore):
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+
+    def getIdentityKeyPair(self):
+        q = "SELECT public_key, private_key FROM identities " + \
+            "WHERE recipient_id = -1"
+        c = self.dbConn.cursor()
+        c.execute(q)
+        result = c.fetchone()
+
+        publicKey, privateKey = result
+        return IdentityKeyPair(
+            IdentityKey(DjbECPublicKey(publicKey[1:])),
+            DjbECPrivateKey(privateKey))
+
+    def getLocalRegistrationId(self):
+        q = "SELECT registration_id FROM identities WHERE recipient_id = -1"
+        c = self.dbConn.cursor()
+        c.execute(q)
+        result = c.fetchone()
+        return result[0] if result else None
+
+    def storeLocalData(self, registrationId, identityKeyPair):
+        q = "INSERT INTO identities( " + \
+            "recipient_id, registration_id, public_key, private_key) " + \
+            "VALUES(-1, ?, ?, ?)"
+        c = self.dbConn.cursor()
+        c.execute(q,
+                  (registrationId,
+                   identityKeyPair.getPublicKey().getPublicKey().serialize(),
+                   identityKeyPair.getPrivateKey().serialize()))
+
+        self.dbConn.commit()
+
+    def saveIdentity(self, recipientId, identityKey):
+        q = "INSERT INTO identities (recipient_id, public_key, trust) " \
+            "VALUES(?, ?, ?)"
+        c = self.dbConn.cursor()
+
+        if not self.getIdentity(recipientId, identityKey):
+            c.execute(q, (recipientId,
+                          identityKey.getPublicKey().serialize(),
+                          UNDECIDED))
+            self.dbConn.commit()
+
+    def getIdentity(self, recipientId, identityKey):
+        q = "SELECT * FROM identities WHERE recipient_id = ? " \
+            "AND public_key = ?"
+        c = self.dbConn.cursor()
+
+        c.execute(q, (recipientId, identityKey.getPublicKey().serialize()))
+        result = c.fetchone()
+
+        return result is not None
+
+    def deleteIdentity(self, recipientId, identityKey):
+        q = "DELETE FROM identities WHERE recipient_id = ? AND public_key = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (recipientId,
+                      identityKey.getPublicKey().serialize()))
+        self.dbConn.commit()
+
+    def isTrustedIdentity(self, recipientId, identityKey):
+        q = "SELECT trust FROM identities WHERE recipient_id = ? " \
+            "AND public_key = ?"
+        c = self.dbConn.cursor()
+
+        c.execute(q, (recipientId, identityKey.getPublicKey().serialize()))
+        result = c.fetchone()
+
+        states = [UNTRUSTED, TRUSTED, UNDECIDED]
+
+        if result and result[0] in states:
+            return result[0]
+        else:
+            return True
+
+    def getAllFingerprints(self):
+        q = "SELECT _id, recipient_id, public_key, trust FROM identities " \
+            "WHERE recipient_id != -1 ORDER BY recipient_id ASC"
+        c = self.dbConn.cursor()
+
+        result = []
+        for row in c.execute(q):
+            result.append((row[0], row[1], row[2], row[3]))
+        return result
+
+    def getFingerprints(self, jid):
+        q = "SELECT _id, recipient_id, public_key, trust FROM identities " \
+            "WHERE recipient_id =? ORDER BY trust ASC"
+        c = self.dbConn.cursor()
+
+        result = []
+        c.execute(q, (jid,))
+        rows = c.fetchall()
+        for row in rows:
+            result.append((row[0], row[1], row[2], row[3]))
+        return result
+
+    def getTrustedFingerprints(self, jid):
+        q = "SELECT public_key FROM identities WHERE recipient_id = ? AND trust = ?"
+        c = self.dbConn.cursor()
+
+        result = []
+        c.execute(q, (jid, TRUSTED))
+        rows = c.fetchall()
+        for row in rows:
+            result.append(row[0])
+        return result
+
+    def getUndecidedFingerprints(self, jid):
+        q = "SELECT trust FROM identities WHERE recipient_id = ? AND trust = ?"
+        c = self.dbConn.cursor()
+
+        result = []
+        c.execute(q, (jid, UNDECIDED))
+        result = c.fetchall()
+
+        return result
+
+    def getNewFingerprints(self, jid):
+        q = "SELECT _id FROM identities WHERE shown = 0 AND " \
+            "recipient_id = ?"
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q, (jid,)):
+            result.append(row[0])
+        return result
+
+    def setShownFingerprints(self, fingerprints):
+        q = "UPDATE identities SET shown = 1 WHERE _id IN ({})" \
+            .format(', '.join(['?'] * len(fingerprints)))
+        c = self.dbConn.cursor()
+        c.execute(q, fingerprints)
+        self.dbConn.commit()
+
+    def setTrust(self, identityKey, trust):
+        q = "UPDATE identities SET trust = ? WHERE public_key = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (trust, identityKey.getPublicKey().serialize()))
+        self.dbConn.commit()

omemo/backend/liteprekeystore.py

@@ -0,0 +1,87 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from axolotl.state.prekeyrecord import PreKeyRecord
+from axolotl.state.prekeystore import PreKeyStore
+from axolotl.util.keyhelper import KeyHelper
+
+
+class LitePreKeyStore(PreKeyStore):
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+
+    def loadPreKey(self, preKeyId):
+        q = "SELECT record FROM prekeys WHERE prekey_id = ?"
+
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (preKeyId, ))
+
+        result = cursor.fetchone()
+        if not result:
+            raise Exception("No such prekeyRecord!")
+
+        return PreKeyRecord(serialized=result[0])
+
+    def loadPendingPreKeys(self):
+        q = "SELECT record FROM prekeys"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q)
+        result = cursor.fetchall()
+
+        return [PreKeyRecord(serialized=r[0]) for r in result]
+
+    def storePreKey(self, preKeyId, preKeyRecord):
+        q = "INSERT INTO prekeys (prekey_id, record) VALUES(?,?)"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (preKeyId, preKeyRecord.serialize()))
+        self.dbConn.commit()
+
+    def containsPreKey(self, preKeyId):
+        q = "SELECT record FROM prekeys WHERE prekey_id = ?"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (preKeyId, ))
+        return cursor.fetchone() is not None
+
+    def removePreKey(self, preKeyId):
+        q = "DELETE FROM prekeys WHERE prekey_id = ?"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (preKeyId, ))
+        self.dbConn.commit()
+
+    def getCurrentPreKeyId(self):
+        q = "SELECT MAX(prekey_id) FROM prekeys"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q)
+        return cursor.fetchone()[0]
+
+    def getPreKeyCount(self):
+        q = "SELECT COUNT(prekey_id) FROM prekeys"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q)
+        return cursor.fetchone()[0]
+
+    def generateNewPreKeys(self, count):
+        startId = self.getCurrentPreKeyId() + 1
+        preKeys = KeyHelper.generatePreKeys(startId, count)
+
+        for preKey in preKeys:
+            self.storePreKey(preKey.getId(), preKey)

omemo/backend/litesessionstore.py

@@ -0,0 +1,143 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from axolotl.state.sessionrecord import SessionRecord
+from axolotl.state.sessionstore import SessionStore
+
+
+class LiteSessionStore(SessionStore):
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+
+    def loadSession(self, recipientId, deviceId):
+        q = "SELECT record FROM sessions WHERE recipient_id = ? AND device_id = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (recipientId, deviceId))
+        result = c.fetchone()
+
+        if result:
+            return SessionRecord(serialized=result[0])
+        else:
+            return SessionRecord()
+
+    def getSubDeviceSessions(self, recipientId):
+        q = "SELECT device_id from sessions WHERE recipient_id = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (recipientId, ))
+        result = c.fetchall()
+
+        deviceIds = [r[0] for r in result]
+        return deviceIds
+
+    def getJidFromDevice(self, device_id):
+        q = "SELECT recipient_id from sessions WHERE device_id = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (device_id, ))
+        result = c.fetchone()
+
+        return result[0].decode('utf-8') if result else None
+
+    def getActiveDeviceTuples(self):
+        q = "SELECT recipient_id, device_id FROM sessions WHERE active = 1"
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q):
+            result.append((row[0].decode('utf-8'), row[1]))
+        return result
+
+    def storeSession(self, recipientId, deviceId, sessionRecord):
+        self.deleteSession(recipientId, deviceId)
+
+        q = "INSERT INTO sessions(recipient_id, device_id, record) VALUES(?,?,?)"
+        c = self.dbConn.cursor()
+        c.execute(q, (recipientId, deviceId, sessionRecord.serialize()))
+        self.dbConn.commit()
+
+    def containsSession(self, recipientId, deviceId):
+        q = "SELECT record FROM sessions WHERE recipient_id = ? AND device_id = ?"
+        c = self.dbConn.cursor()
+        c.execute(q, (recipientId, deviceId))
+        result = c.fetchone()
+
+        return result is not None
+
+    def deleteSession(self, recipientId, deviceId):
+        q = "DELETE FROM sessions WHERE recipient_id = ? AND device_id = ?"
+        self.dbConn.cursor().execute(q, (recipientId, deviceId))
+        self.dbConn.commit()
+
+    def deleteAllSessions(self, recipientId):
+        q = "DELETE FROM sessions WHERE recipient_id = ?"
+        self.dbConn.cursor().execute(q, (recipientId, ))
+        self.dbConn.commit()
+
+    def getAllSessions(self):
+        q = "SELECT _id, recipient_id, device_id, record, active from sessions"
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q):
+            result.append((row[0], row[1].decode('utf-8'), row[2], row[3], row[4]))
+        return result
+
+    def getSessionsFromJid(self, recipientId):
+        q = "SELECT _id, recipient_id, device_id, record, active from sessions" \
+            " WHERE recipient_id = ?"
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q, (recipientId,)):
+            result.append((row[0], row[1].decode('utf-8'), row[2], row[3], row[4]))
+        return result
+
+    def getSessionsFromJids(self, recipientId):
+        q = "SELECT _id, recipient_id, device_id, record, active from sessions" \
+            " WHERE recipient_id IN ({})" \
+            .format(', '.join(['?'] * len(recipientId)))
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q, recipientId):
+            result.append((row[0], row[1].decode('utf-8'), row[2], row[3], row[4]))
+        return result
+
+    def setActiveState(self, deviceList, jid):
+        c = self.dbConn.cursor()
+
+        q = "UPDATE sessions SET active = {} " \
+            "WHERE recipient_id = '{}' AND device_id IN ({})" \
+            .format(1, jid, ', '.join(['?'] * len(deviceList)))
+        c.execute(q, deviceList)
+
+        q = "UPDATE sessions SET active = {} " \
+            "WHERE recipient_id = '{}' AND device_id NOT IN ({})" \
+            .format(0, jid, ', '.join(['?'] * len(deviceList)))
+        c.execute(q, deviceList)
+        self.dbConn.commit()
+
+    def getInactiveSessionsKeys(self, recipientId):
+        q = "SELECT record FROM sessions WHERE active = 0 AND recipient_id = ?"
+        c = self.dbConn.cursor()
+        result = []
+        for row in c.execute(q, (recipientId,)):
+            public_key = (SessionRecord(serialized=row[0]).
+                          getSessionState().getRemoteIdentityKey().
+                          getPublicKey())
+            result.append(public_key.serialize())
+        return result

omemo/backend/litesignedprekeystore.py

@@ -0,0 +1,113 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from axolotl.invalidkeyidexception import InvalidKeyIdException
+from axolotl.state.signedprekeyrecord import SignedPreKeyRecord
+from axolotl.state.signedprekeystore import SignedPreKeyStore
+from axolotl.util.medium import Medium
+
+
+class LiteSignedPreKeyStore(SignedPreKeyStore):
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+
+    def loadSignedPreKey(self, signedPreKeyId):
+        q = "SELECT record FROM signed_prekeys WHERE prekey_id = ?"
+
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (signedPreKeyId, ))
+
+        result = cursor.fetchone()
+        if not result:
+            raise InvalidKeyIdException("No such signedprekeyrecord! %s " %
+                                        signedPreKeyId)
+
+        return SignedPreKeyRecord(serialized=result[0])
+
+    def loadSignedPreKeys(self):
+        q = "SELECT record FROM signed_prekeys"
+
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, )
+        result = cursor.fetchall()
+        results = []
+        for row in result:
+            results.append(SignedPreKeyRecord(serialized=row[0]))
+
+        return results
+
+    def storeSignedPreKey(self, signedPreKeyId, signedPreKeyRecord):
+        q = "INSERT INTO signed_prekeys (prekey_id, record) VALUES(?,?)"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (signedPreKeyId, signedPreKeyRecord.serialize()))
+        self.dbConn.commit()
+
+    def containsSignedPreKey(self, signedPreKeyId):
+        q = "SELECT record FROM signed_prekeys WHERE prekey_id = ?"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (signedPreKeyId, ))
+        return cursor.fetchone() is not None
+
+    def removeSignedPreKey(self, signedPreKeyId):
+        q = "DELETE FROM signed_prekeys WHERE prekey_id = ?"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (signedPreKeyId, ))
+        self.dbConn.commit()
+
+    def getNextSignedPreKeyId(self):
+        result = self.getCurrentSignedPreKeyId()
+        if not result:
+            return 1  # StartId if no SignedPreKeys exist
+        else:
+            return (result % (Medium.MAX_VALUE - 1)) + 1
+
+    def getCurrentSignedPreKeyId(self):
+        q = "SELECT MAX(prekey_id) FROM signed_prekeys"
+
+        cursor = self.dbConn.cursor()
+        cursor.execute(q)
+        result = cursor.fetchone()
+        if not result:
+            return None
+        else:
+            return result[0]
+
+    def getSignedPreKeyTimestamp(self, signedPreKeyId):
+        q = "SELECT strftime('%s', timestamp) FROM " \
+            "signed_prekeys WHERE prekey_id = ?"
+
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (signedPreKeyId, ))
+
+        result = cursor.fetchone()
+        if not result:
+            raise InvalidKeyIdException("No such signedprekeyrecord! %s " %
+                                        signedPreKeyId)
+
+        return result[0]
+
+    def removeOldSignedPreKeys(self, timestamp):
+        q = "DELETE FROM signed_prekeys " \
+            "WHERE timestamp < datetime(?, 'unixepoch')"
+        cursor = self.dbConn.cursor()
+        cursor.execute(q, (timestamp, ))
+        self.dbConn.commit()

omemo/backend/sql.py

@@ -0,0 +1,154 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Tarek Galal <tare2.galal@gmail.com>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+from .db_helpers import user_version
+
+
+class SQLDatabase():
+    """ SQL Database """
+
+    def __init__(self, dbConn):
+        """
+        :type dbConn: Connection
+        """
+        self.dbConn = dbConn
+        self.createDb()
+        self.migrateDb()
+        c = self.dbConn.cursor()
+        c.execute("PRAGMA synchronous=NORMAL;")
+        c.execute("PRAGMA journal_mode;")
+        mode = c.fetchone()[0]
+        # WAL is a persistent DB mode, don't override it if user has set it
+        if mode != 'wal':
+            c.execute("PRAGMA journal_mode=MEMORY;")
+        self.dbConn.commit()
+
+    def createDb(self):
+        if user_version(self.dbConn) == 0:
+
+            # Creates
+            # IdentityKeyStore
+            # PreKeyStore
+            # SignedPreKeyStore
+            # SessionStore
+            # EncryptionStore
+
+            create_tables = '''
+                CREATE TABLE IF NOT EXISTS identities (
+                    _id INTEGER PRIMARY KEY AUTOINCREMENT, recipient_id TEXT,
+                    registration_id INTEGER, public_key BLOB, private_key BLOB,
+                    next_prekey_id INTEGER, timestamp INTEGER, trust INTEGER,
+                    shown INTEGER DEFAULT 0);
+
+                CREATE UNIQUE INDEX IF NOT EXISTS
+                    public_key_index ON identities (public_key, recipient_id);
+
+                CREATE TABLE IF NOT EXISTS prekeys(
+                    _id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    prekey_id INTEGER UNIQUE, sent_to_server BOOLEAN,
+                    record BLOB);
+
+                CREATE TABLE IF NOT EXISTS signed_prekeys (
+                    _id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    prekey_id INTEGER UNIQUE,
+                    timestamp NUMERIC DEFAULT CURRENT_TIMESTAMP, record BLOB);
+
+                CREATE TABLE IF NOT EXISTS sessions (
+                    _id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    recipient_id TEXT, device_id INTEGER,
+                    record BLOB, timestamp INTEGER, active INTEGER DEFAULT 1,
+                    UNIQUE(recipient_id, device_id));
+
+                CREATE TABLE IF NOT EXISTS encryption_state (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    jid TEXT UNIQUE,
+                    encryption INTEGER
+                    );
+                '''
+
+            create_db_sql = """
+                BEGIN TRANSACTION;
+                %s
+                PRAGMA user_version=5;
+                END TRANSACTION;
+                """ % (create_tables)
+            self.dbConn.executescript(create_db_sql)
+
+    def migrateDb(self):
+        """ Migrates the DB
+        """
+
+        # Find all double entries and delete them
+        if user_version(self.dbConn) < 2:
+            delete_dupes = """ DELETE FROM identities WHERE _id not in (
+                                SELECT MIN(_id)
+                                FROM identities
+                                GROUP BY
+                                recipient_id, public_key
+                                );
+                            """
+
+            self.dbConn.executescript(""" BEGIN TRANSACTION;
+                                     %s
+                                     PRAGMA user_version=2;
+                                     END TRANSACTION;
+                                 """ % (delete_dupes))
+
+        if user_version(self.dbConn) < 3:
+            # Create a UNIQUE INDEX so every public key/recipient_id tuple
+            # can only be once in the db
+            add_index = """ CREATE UNIQUE INDEX IF NOT EXISTS
+                            public_key_index
+                            ON identities (public_key, recipient_id);
+                        """
+
+            self.dbConn.executescript(""" BEGIN TRANSACTION;
+                                          %s
+                                          PRAGMA user_version=3;
+                                          END TRANSACTION;
+                                      """ % (add_index))
+
+        if user_version(self.dbConn) < 4:
+            # Adds column "active" to the sessions table
+            add_active = """ ALTER TABLE sessions
+                             ADD COLUMN active INTEGER DEFAULT 1;
+                         """
+
+            self.dbConn.executescript(""" BEGIN TRANSACTION;
+                                          %s
+                                          PRAGMA user_version=4;
+                                          END TRANSACTION;
+                                      """ % (add_active))
+
+        if user_version(self.dbConn) < 5:
+            # Adds DEFAULT Timestamp
+            add_timestamp = """
+                DROP TABLE signed_prekeys;
+                CREATE TABLE IF NOT EXISTS signed_prekeys (
+                    _id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    prekey_id INTEGER UNIQUE,
+                    timestamp NUMERIC DEFAULT CURRENT_TIMESTAMP, record BLOB);
+                ALTER TABLE identities ADD COLUMN shown INTEGER DEFAULT 0;
+                UPDATE identities SET shown = 1;
+            """
+
+            self.dbConn.executescript(""" BEGIN TRANSACTION;
+                                          %s
+                                          PRAGMA user_version=5;
+                                          END TRANSACTION;
+                                      """ % (add_timestamp))

omemo/backend/state.py

@@ -0,0 +1,472 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 Bahtiar `kalkin-` Gadimov <bahtiar@gadimov.de>
+#
+# This file is part of Gajim-OMEMO plugin.
+#
+# The Gajim-OMEMO plugin is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# Gajim-OMEMO is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# the Gajim-OMEMO plugin.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import logging
+import time
+
+from nbxmpp.structs import OMEMOBundle
+from nbxmpp.structs import OMEMOMessage
+
+from axolotl.ecc.djbec import DjbECPublicKey
+from axolotl.identitykey import IdentityKey
+from axolotl.untrustedidentityexception import UntrustedIdentityException
+
+from axolotl.protocol.prekeywhispermessage import PreKeyWhisperMessage
+from axolotl.protocol.whispermessage import WhisperMessage
+from axolotl.sessionbuilder import SessionBuilder
+from axolotl.sessioncipher import SessionCipher
+from axolotl.state.prekeybundle import PreKeyBundle
+from axolotl.util.keyhelper import KeyHelper
+
+from omemo.backend.aes import aes_decrypt, aes_encrypt
+from .liteaxolotlstore import (LiteAxolotlStore, DEFAULT_PREKEY_AMOUNT,
+                               MIN_PREKEY_AMOUNT, SPK_CYCLE_TIME,
+                               SPK_ARCHIVE_TIME)
+
+log = logging.getLogger('gajim.plugin_system.omemo')
+
+
+UNTRUSTED = 0
+TRUSTED = 1
+UNDECIDED = 2
+
+
+class OmemoState:
+    def __init__(self, own_jid, db_con, account, xmpp_con):
+        """ Instantiates an OmemoState object.
+
+            :param connection: an :py:class:`sqlite3.Connection`
+        """
+        self.account = account
+        self.xmpp_con = xmpp_con
+        self.session_ciphers = {}
+        self.own_jid = own_jid
+        self.device_ids = {}
+        self.own_devices = []
+        self.store = LiteAxolotlStore(db_con)
+        self.encryption = self.store.encryptionStore
+        for jid, device_id in self.store.getActiveDeviceTuples():
+            if jid != own_jid:
+                self.add_device(jid, device_id)
+            else:
+                self.add_own_device(device_id)
+
+        log.info(self.account + ' => Roster devices after boot:' +
+                 str(self.device_ids))
+        log.info(self.account + ' => Own devices after boot:' +
+                 str(self.own_devices))
+        log.debug(self.account + ' => ' +
+                  str(self.store.preKeyStore.getPreKeyCount()) +
+                  ' PreKeys available')
+
+    def build_session(self, recipient_id, device_id, bundle):
+        sessionBuilder = SessionBuilder(self.store, self.store, self.store,
+                                        self.store, recipient_id, device_id)
+
+        registration_id = self.store.getLocalRegistrationId()
+
+        prekey = bundle.pick_prekey()
+        preKeyPublic = DjbECPublicKey(prekey['key'][1:])
+
+        signedPreKeyPublic = DjbECPublicKey(bundle.spk['key'][1:])
+        identityKey = IdentityKey(DjbECPublicKey(bundle.ik[1:]))
+
+        prekey_bundle = PreKeyBundle(
+            registration_id, device_id,
+            prekey['id'], preKeyPublic,
+            bundle.spk['id'], signedPreKeyPublic,
+            bundle.spk_signature,
+            identityKey)
+
+        sessionBuilder.processPreKeyBundle(prekey_bundle)
+        return self.get_session_cipher(recipient_id, device_id)
+
+    def set_devices(self, name, devices):
+        """ Return a an.
+
+            Parameters
+            ----------
+            jid : string
+                The contacts jid
+
+            devices: [int]
+                A list of devices
+        """
+
+        self.device_ids[name] = devices
+        log.info(self.account + ' => Saved devices for ' + name)
+
+    def add_device(self, name, device_id):
+        if name not in self.device_ids:
+            self.device_ids[name] = [device_id]
+        elif device_id not in self.device_ids[name]:
+            self.device_ids[name].append(device_id)
+
+    def set_own_devices(self, devices):
+        """ Overwrite the current :py:attribute:`OmemoState.own_devices` with
+            the given devices.
+
+            Parameters
+            ----------
+            devices : [int]
+                A list of device_ids
+        """
+        self.own_devices = devices
+        log.info(self.account + ' => Saved own devices')
+
+    def add_own_device(self, device_id):
+        if device_id not in self.own_devices:
+            self.own_devices.append(device_id)
+
+    @property
+    def own_device_id(self):
+        reg_id = self.store.getLocalRegistrationId()
+        assert reg_id is not None, \
+            "Requested device_id but there is no generated"
+
+        return ((reg_id % 2147483646) + 1)
+
+    def own_device_id_published(self):
+        """ Return `True` only if own device id was added via
+            :py:method:`OmemoState.set_own_devices()`.
+        """
+        return self.own_device_id in self.own_devices
+
+    @property
+    def bundle(self):
+        self.checkPreKeyAmount()
+
+        bundle = {'otpks': []}
+        for k in self.store.loadPreKeys():
+            key = k.getKeyPair().getPublicKey().serialize()
+            bundle['otpks'].append({'key': key, 'id': k.getId()})
+
+        identityKeyPair = self.store.getIdentityKeyPair()
+        bundle['ik'] = identityKeyPair.getPublicKey().serialize()
+
+        self.cycleSignedPreKey(identityKeyPair)
+
+        signedPreKey = self.store.loadSignedPreKey(
+            self.store.getCurrentSignedPreKeyId())
+        bundle['spk_signature'] = signedPreKey.getSignature()
+        bundle['spk'] = {'key': signedPreKey.getKeyPair().getPublicKey().serialize(),
+                         'id': signedPreKey.getId()}
+
+        return OMEMOBundle(**bundle)
+
+    def decrypt_msg(self, omemo_message, jid):
+        own_id = self.own_device_id
+        if omemo_message.sid == own_id:
+            log.info('Received previously sent message by us')
+            return
+        if own_id not in omemo_message.keys:
+            log.warning('OMEMO message does not contain our device key')
+            return
+
+        encrypted_key, prekey = omemo_message.keys[own_id]
+
+        if prekey:
+            try:
+                key = self.handlePreKeyWhisperMessage(
+                    jid, omemo_message.sid, encrypted_key)
+            except Exception as error:
+                log.warning(error)
+                return
+
+        else:
+            try:
+                key = self.handleWhisperMessage(
+                    jid, omemo_message.sid, encrypted_key)
+            except Exception as error:
+                log.warning(error)
+                return
+
+        if omemo_message.payload is None:
+            result = None
+            log.debug("Decrypted Key Exchange Message")
+        else:
+            result = aes_decrypt(key, omemo_message.iv, omemo_message.payload)
+            log.debug("Decrypted Message => %s", result)
+        return result
+
+    def create_msg(self, from_jid, jid, plaintext):
+        encrypted_keys = {}
+
+        devices_list = self.device_list_for(jid)
+        if not devices_list:
+            log.error('No known devices')
+            return
+
+        result = aes_encrypt(plaintext)
+
+        # Encrypt the message key with for each of receivers devices
+        for device in devices_list:
+            try:
+                if self.isTrusted(jid, device) == TRUSTED:
+                    cipher = self.get_session_cipher(jid, device)
+                    cipher_key = cipher.encrypt(result.key)
+                    prekey = isinstance(cipher_key, PreKeyWhisperMessage)
+                    encrypted_keys[device] = (cipher_key.serialize(), prekey)
+                else:
+                    log.debug('Skipped Device because Trust is: %s',
+                              self.isTrusted(jid, device))
+            except Exception:
+                log.warning('Failed to find key for device: %s', device)
+
+        if not encrypted_keys:
+            log.error('Encrypted keys empty')
+            raise NoValidSessions('Encrypted keys empty')
+
+        my_other_devices = set(self.own_devices) - set({self.own_device_id})
+        # Encrypt the message key with for each of our own devices
+        for device in my_other_devices:
+            try:
+                if self.isTrusted(from_jid, device) == TRUSTED:
+                    cipher = self.get_session_cipher(from_jid, device)
+                    cipher_key = cipher.encrypt(result.key)
+                    prekey = isinstance(cipher_key, PreKeyWhisperMessage)
+                    encrypted_keys[device] = (cipher_key.serialize(), prekey)
+                else:
+                    log.debug('Skipped own Device because Trust is: %s',
+                              self.isTrusted(from_jid, device))
+            except Exception:
+                log.warning('Failed to find key for device: %s', device)
+
+        log.debug('Finished encrypting message')
+        return OMEMOMessage(sid=self.own_device_id,
+                            keys=encrypted_keys,
+                            iv=result.iv,
+                            payload=result.payload)
+
+    def create_gc_msg(self, from_jid, jid, plaintext):
+        encrypted_keys = {}
+        room = jid
+        encrypted_jids = []
+
+        devices_list = self.device_list_for(jid, True)
+
+        result = aes_encrypt(plaintext, append_tag=True)
+
+        for tup in devices_list:
+            self.get_session_cipher(tup[0], tup[1])
+
+        # Encrypt the message key with for each of receivers devices
+        for nick in self.xmpp_con.groupchat[room]:
+            jid_to = self.xmpp_con.groupchat[room][nick]
+            if jid_to == self.own_jid:
+                continue
+            if jid_to in encrypted_jids:  # We already encrypted to this JID
+                continue
+            if jid_to not in self.session_ciphers:
+                continue
+            for rid, cipher in self.session_ciphers[jid_to].items():
+                try:
+                    if self.isTrusted(jid_to, rid) == TRUSTED:
+                        cipher_key = cipher.encrypt(result.key)
+                        prekey = isinstance(cipher_key, PreKeyWhisperMessage)
+                        encrypted_keys[rid] = (cipher_key.serialize(), prekey)
+                    else:
+                        log.debug('Skipped Device because Trust is: %s',
+                                  self.isTrusted(jid_to, rid))
+                except Exception:
+                    log.exception('ERROR:')
+                    log.warning('Failed to find key for device %s', rid)
+            encrypted_jids.append(jid_to)
+
+        my_other_devices = set(self.own_devices) - set({self.own_device_id})
+        # Encrypt the message key with for each of our own devices
+        for dev in my_other_devices:
+            try:
+                cipher = self.get_session_cipher(from_jid, dev)
+                if self.isTrusted(from_jid, dev) == TRUSTED:
+                    cipher_key = cipher.encrypt(result.key)
+                    prekey = isinstance(cipher_key, PreKeyWhisperMessage)
+                    encrypted_keys[dev] = (cipher_key.serialize(), prekey)
+                else:
+                    log.debug('Skipped own Device because Trust is: %s',
+                              self.isTrusted(from_jid, dev))
+            except Exception:
+                log.exception('ERROR:')
+                log.warning('Failed to find key for device: %s', dev)
+
+        if not encrypted_keys:
+            log.error('Encrypted keys empty')
+            raise NoValidSessions('Encrypted keys empty')
+
+        log.debug('Finished encrypting message')
+        return OMEMOMessage(sid=self.own_device_id,
+                            keys=encrypted_keys,
+                            iv=result.iv,
+                            payload=result.payload)
+
+    def device_list_for(self, jid, gc=False):
+        """ Return a list of known device ids for the specified jid.
+            Parameters
+            ----------
+            jid : string
+                The contacts jid
+            gc : bool
+                Groupchat Message
+        """
+        if gc:
+            room = jid
+            devicelist = []
+            for nick in self.xmpp_con.groupchat[room]:
+                jid_to = self.xmpp_con.groupchat[room][nick]
+                if jid_to == self.own_jid:
+                    continue
+                try:
+                    for device in self.device_ids[jid_to]:
+                        devicelist.append((jid_to, device))
+                except KeyError:
+                    log.warning('no device ids found for %s', jid_to)
+                    continue
+            return devicelist
+
+        if jid == self.own_jid:
+            return set(self.own_devices) - set({self.own_device_id})
+        if jid not in self.device_ids:
+            return set()
+        return set(self.device_ids[jid])
+
+    def isTrusted(self, recipient_id, device_id):
+        record = self.store.loadSession(recipient_id, device_id)
+        identity_key = record.getSessionState().getRemoteIdentityKey()
+        return self.store.isTrustedIdentity(recipient_id, identity_key)
+
+    def getTrustedFingerprints(self, recipient_id):
+        inactive = self.store.getInactiveSessionsKeys(recipient_id)
+        trusted = self.store.getTrustedFingerprints(recipient_id)
+        trusted = set(trusted) - set(inactive)
+
+        return trusted
+
+    def getUndecidedFingerprints(self, recipient_id):
+        inactive = self.store.getInactiveSessionsKeys(recipient_id)
+        undecided = self.store.getUndecidedFingerprints(recipient_id)
+        undecided = set(undecided) - set(inactive)
+
+        return undecided
+
+    def devices_without_sessions(self, jid):
+        """ List device_ids for the given jid which have no axolotl session.
+
+            Parameters
+            ----------
+            jid : string
+                The contacts jid
+
+            Returns
+            -------
+            [int]
+                A list of device_ids
+        """
+        known_devices = self.device_list_for(jid)
+        missing_devices = [dev
+                           for dev in known_devices
+                           if not self.store.containsSession(jid, dev)]
+        if missing_devices:
+            log.info(self.account + ' => Missing device sessions for ' +
+                     jid + ': ' + str(missing_devices))
+        return missing_devices
+
+    def get_session_cipher(self, jid, device_id):
+        if jid not in self.session_ciphers:
+            self.session_ciphers[jid] = {}
+
+        if device_id not in self.session_ciphers[jid]:
+            cipher = SessionCipher(self.store, self.store, self.store,
+                                   self.store, jid, device_id)
+            self.session_ciphers[jid][device_id] = cipher
+
+        return self.session_ciphers[jid][device_id]
+
+    def handlePreKeyWhisperMessage(self, recipient_id, device_id, key):
+        preKeyWhisperMessage = PreKeyWhisperMessage(serialized=key)
+        if not preKeyWhisperMessage.getPreKeyId():
+            raise Exception("Received PreKeyWhisperMessage without PreKey =>" +
+                            recipient_id)
+        sessionCipher = self.get_session_cipher(recipient_id, device_id)
+        try:
+            log.debug(self.account +
+                      " => Received PreKeyWhisperMessage from " +
+                      recipient_id)
+            key = sessionCipher.decryptPkmsg(preKeyWhisperMessage)
+            # Publish new bundle after PreKey has been used
+            # for building a new Session
+            self.xmpp_con.set_bundle()
+            self.add_device(recipient_id, device_id)
+            return key
+        except UntrustedIdentityException as e:
+            log.info(self.account + " => Received WhisperMessage " +
+                     "from Untrusted Fingerprint! => " + e.getName())
+
+    def handleWhisperMessage(self, recipient_id, device_id, key):
+        whisperMessage = WhisperMessage(serialized=key)
+        log.debug(self.account + " => Received WhisperMessage from " +
+                  recipient_id)
+        if self.isTrusted(recipient_id, device_id):
+            sessionCipher = self.get_session_cipher(recipient_id, device_id)
+            key = sessionCipher.decryptMsg(whisperMessage, textMsg=False)
+            self.add_device(recipient_id, device_id)
+            return key
+        else:
+            raise Exception("Received WhisperMessage "
+                            "from Untrusted Fingerprint! => " + recipient_id)
+
+    def checkPreKeyAmount(self):
+        # Check if enough PreKeys are available
+        preKeyCount = self.store.preKeyStore.getPreKeyCount()
+        if preKeyCount < MIN_PREKEY_AMOUNT:
+            newKeys = DEFAULT_PREKEY_AMOUNT - preKeyCount
+            self.store.preKeyStore.generateNewPreKeys(newKeys)
+            log.info(self.account + ' => ' + str(newKeys) +
+                     ' PreKeys created')
+
+    def cycleSignedPreKey(self, identityKeyPair):
+        # Publish every SPK_CYCLE_TIME a new SignedPreKey
+        # Delete all exsiting SignedPreKeys that are older
+        # then SPK_ARCHIVE_TIME
+
+        # Check if SignedPreKey exist and create if not
+        if not self.store.getCurrentSignedPreKeyId():
+            signedPreKey = KeyHelper.generateSignedPreKey(
+                identityKeyPair, self.store.getNextSignedPreKeyId())
+            self.store.storeSignedPreKey(signedPreKey.getId(), signedPreKey)
+            log.debug(self.account +
+                      ' => New SignedPreKey created, because none existed')
+
+        # if SPK_CYCLE_TIME is reached, generate a new SignedPreKey
+        now = int(time.time())
+        timestamp = self.store.getSignedPreKeyTimestamp(
+            self.store.getCurrentSignedPreKeyId())
+
+        if int(timestamp) < now - SPK_CYCLE_TIME:
+            signedPreKey = KeyHelper.generateSignedPreKey(
+                identityKeyPair, self.store.getNextSignedPreKeyId())
+            self.store.storeSignedPreKey(signedPreKey.getId(), signedPreKey)
+            log.debug(self.account + ' => Cycled SignedPreKey')
+
+        # Delete all SignedPreKeys that are older than SPK_ARCHIVE_TIME
+        timestamp = now - SPK_ARCHIVE_TIME
+        self.store.removeOldSignedPreKeys(timestamp)
+
+
+class NoValidSessions(Exception):
+    pass