vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Adding CipherSuite trait to handle bundling of underlying crypto primitives

Browse Source
This commit is contained in:
Kevin Lewi
2020-06-14 23:25:31 -07:00
parent f030fca1cb
commit 0cf13c2266
7 changed files with 446 additions and 371 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ciphersuite.rs
+27 -3
View File
@@ -1,6 +1,30 @@
// Copyright (c) Facebook, Inc. and its affiliates.
//
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
//! Defines the CipherSuite trait to specify the underlying primitives for OPAQUE
use crate::{
errors::InternalPakeError,
group::Group,
keypair::{Key, KeyPair},
slow_hash::SlowHash,
};
use generic_array::typenum::{U32, U64};
use rand_core::{CryptoRng, RngCore};
/// Configures the underlying primitives used in OPAQUE
pub trait CipherSuite {
type Aead;
type Group;
type Keypair;
type Aead: aead::NewAead<KeySize = U32> + aead::Aead;
type Group: Group<ScalarLen = U32, UniformBytesLen = U64>;
type KeyFormat: KeyPair<Repr = Key> + PartialEq;
type SlowHash: SlowHash;
/// Generating a random key pair given a cryptographic rng
fn generate_random_keypair<R: RngCore + CryptoRng>(
rng: &mut R,
) -> Result<Self::KeyFormat, InternalPakeError> {
Self::KeyFormat::generate_random(rng)
}
}
src/lib.rs
+117 -87
View File
@@ -13,15 +13,20 @@
//! OPAQUE is a protocol between a client and a server. They must first agree on a collection of primitives
//! to be kept consistent throughout protocol execution. These include:
//! * an authenticated encryption scheme,
//! * a finite cyclic group along with a point representation, and
//! * a keypair type.
//! * a finite cyclic group along with a point representation,
//! * a keypair type, and
//! * a slow hashing function.
//!
//! We will use the following choices in this example:
//! ```
//! use chacha20poly1305::ChaCha20Poly1305;
//! use curve25519_dalek::ristretto::RistrettoPoint;
//! use opaque_ke::keypair::X25519KeyPair;
//! use opaque_ke::slow_hash::NoOpHash;
//! use opaque_ke::ciphersuite::CipherSuite;
//! struct Default;
//! impl CipherSuite for Default {
//! type Aead = chacha20poly1305::ChaCha20Poly1305;
//! type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! }
//! ```
//!
//! Note that our choice of slow hashing function in this example, `NoOpHash`, is selected only to ensure
@@ -35,9 +40,17 @@
//! ```
//! # use opaque_ke::keypair::{KeyPair, X25519KeyPair, SizedBytes};
//! # use opaque_ke::errors::ProtocolError;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! use rand_core::{OsRng, RngCore};
//! let mut rng = OsRng;
//! let server_kp = X25519KeyPair::generate_random(&mut rng)?;
//! let server_kp = Default::generate_random_keypair(&mut rng)?;
//! # Ok::<(), ProtocolError>(())
//! ```
//! The server must persist this keypair for the registration and login steps, where the public component will be
@@ -59,11 +72,17 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! use rand_core::{OsRng, RngCore};
//! let mut client_rng = OsRng;
//! let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! let (r1, client_state) = ClientRegistration::<Default>::start(
//! b"password",
//! Some(b"pepper"),
//! &mut client_rng,
@@ -82,21 +101,23 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! let mut server_rng = OsRng;
//! let (r2, server_state) =
//! ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! r1,
//! &mut server_rng,
//! )?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # Ok::<(), ProtocolError>(())
//! ```
//! `r2` is returned to the client, and `server_state` must be persisted on the server for the final step of server
@@ -112,24 +133,26 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # let mut server_rng = OsRng;
//! # let (r2, server_state) =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # r1,
//! # &mut server_rng,
//! # )?;
//! # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # let server_kp = Default::generate_random_keypair(&mut server_rng)?;
//! let (r3, kd_key_registration) =
//! client_state.finish::<_, X25519KeyPair, NoOpHash>(r2, server_kp.public(), &mut client_rng)?;
//! client_state.finish(r2, server_kp.public(), &mut client_rng)?;
//! # Ok::<(), ProtocolError>(())
//! ```
//! `r3` is sent to the server, and the client can optionally use `kd_key_registration` for applications that choose to
@@ -144,24 +167,25 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # let mut server_rng = OsRng;
//! # let (r2, server_state) =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # r1,
//! # &mut server_rng,
//! # )?;
//! # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
//! # let (r3, kd_key_registration) =
//! # client_state.finish::<_, X25519KeyPair, NoOpHash>(r2, server_kp.public(), &mut client_rng)?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # let server_kp = Default::generate_random_keypair(&mut server_rng)?;
//! # let (r3, kd_key_registration) = client_state.finish(r2, server_kp.public(), &mut client_rng)?;
//! let password_file = server_state.finish(r3)?;
//! # Ok::<(), ProtocolError>(())
//! ```
@@ -185,11 +209,17 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! let mut client_rng = OsRng;
//! let (l1, client_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! let (l1, client_state) = ClientLogin::<Default>::start(
//! b"password",
//! Some(b"pepper"),
//! &mut client_rng,
@@ -208,35 +238,33 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # let mut server_rng = OsRng;
//! # let (r2, server_state) =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # r1,
//! # &mut server_rng,
//! # )?;
//! # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
//! # let (r3, kd_key_registration) =
//! # client_state.finish::<_, X25519KeyPair, NoOpHash>(r2, server_kp.public(), &mut client_rng)?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # let server_kp = Default::generate_random_keypair(&mut server_rng)?;
//! # let (r3, kd_key_registration) = client_state.finish(r2, server_kp.public(), &mut client_rng)?;
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
//! # let (l1, client_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # let (l1, client_state) = ClientLogin::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! use std::convert::TryFrom;
//! let password_file =
//! ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(
//! &password_file_bytes[..],
//! )?;
//! let password_file = ServerRegistration::<Default>::try_from(&password_file_bytes[..])?;
//! let mut server_rng = OsRng;
//! let (l2, server_state) =
//! ServerLogin::start(password_file, &server_kp.private(), l1, &mut server_rng)?;
@@ -254,38 +282,39 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # let mut server_rng = OsRng;
//! # let (r2, server_state) =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # r1,
//! # &mut server_rng,
//! # )?;
//! # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
//! # let (r3, kd_key_registration) =
//! # client_state.finish::<_, X25519KeyPair, NoOpHash>(r2, server_kp.public(), &mut client_rng)?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # let server_kp = Default::generate_random_keypair(&mut server_rng)?;
//! # let (r3, kd_key_registration) = client_state.finish(r2, server_kp.public(), &mut client_rng)?;
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
//! # let (l1, client_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # let (l1, client_state) = ClientLogin::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # use std::convert::TryFrom;
//! # let password_file =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(
//! # ServerRegistration::<Default>::try_from(
//! # &password_file_bytes[..],
//! # )?;
//! # let (l2, server_state) =
//! # ServerLogin::start(password_file, &server_kp.private(), l1, &mut server_rng)?;
//! let (l3, client_shared_secret, kd_key_login) = client_state.finish::<_, NoOpHash>(
//! let (l3, client_shared_secret, kd_key_login) = client_state.finish(
//! l2,
//! &server_kp.public(),
//! &mut client_rng,
@@ -309,38 +338,39 @@
//! # keypair::{KeyPair, X25519KeyPair, SizedBytes},
//! # slow_hash::NoOpHash,
//! # };
//! # use curve25519_dalek::ristretto::RistrettoPoint;
//! # use chacha20poly1305::ChaCha20Poly1305;
//! # use opaque_ke::ciphersuite::CipherSuite;
//! # struct Default;
//! # impl CipherSuite for Default {
//! # type Aead = chacha20poly1305::ChaCha20Poly1305;
//! # type Group = curve25519_dalek::ristretto::RistrettoPoint;
//! # type KeyFormat = opaque_ke::keypair::X25519KeyPair;
//! # type SlowHash = opaque_ke::slow_hash::NoOpHash;
//! # }
//! # use rand_core::{OsRng, RngCore};
//! # let mut client_rng = OsRng;
//! # let (r1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # let mut server_rng = OsRng;
//! # let (r2, server_state) =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # r1,
//! # &mut server_rng,
//! # )?;
//! # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
//! # let (r3, kd_key) =
//! # client_state.finish::<_, X25519KeyPair, NoOpHash>(r2, server_kp.public(), &mut client_rng)?;
//! let (r2, server_state) = ServerRegistration::<Default>::start(r1, &mut server_rng)?;
//! # let server_kp = Default::generate_random_keypair(&mut server_rng)?;
//! # let (r3, kd_key) = client_state.finish(r2, server_kp.public(), &mut client_rng)?;
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
//! # let (l1, client_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(
//! # let (l1, client_state) = ClientLogin::<Default>::start(
//! # b"password",
//! # Some(b"pepper"),
//! # &mut client_rng,
//! # )?;
//! # use std::convert::TryFrom;
//! # let password_file =
//! # ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(
//! # ServerRegistration::<Default>::try_from(
//! # &password_file_bytes[..],
//! # )?;
//! # let (l2, server_state) =
//! # ServerLogin::start(password_file, &server_kp.private(), l1, &mut server_rng)?;
//! # let (l3, client_shared_secret, kd_key) = client_state.finish::<_, NoOpHash>(
//! # let (l3, client_shared_secret, kd_key) = client_state.finish(
//! # l2,
//! # &server_kp.public(),
//! # &mut client_rng,
@@ -358,6 +388,7 @@ pub mod errors;
// High-level API
pub mod opaque;
pub mod ciphersuite;
// Your choice of RKR encryption
mod rkr_encryption;
// Your choice of KE
@@ -369,7 +400,6 @@ mod oprf;
// do the oprf on
mod group;
pub mod slow_hash;
pub mod ciphersuite;
#[cfg(test)]
mod tests;
src/opaque.rs
+173 -159
View File
@@ -6,6 +6,7 @@
//! Provides the main OPAQUE API
use crate::{
ciphersuite::CipherSuite,
errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError},
group::Group,
key_exchange::{
@@ -19,7 +20,7 @@ use crate::{
slow_hash::SlowHash,
};
use generic_array::{
typenum::{Unsigned, U32, U64},
typenum::{Unsigned, U32},
GenericArray,
};
use hkdf::Hkdf;
@@ -257,25 +258,23 @@ impl LoginThirdMessage {
// ============
/// The state elements the client holds to register itself
pub struct ClientRegistration<Aead, Grp: Group> {
pub struct ClientRegistration<CS: CipherSuite> {
/// A choice of symmetric encryption for the envelope
_aead: PhantomData<Aead>,
_aead: PhantomData<CS::Aead>,
/// a blinding factor
pub(crate) blinding_factor: Grp::Scalar,
pub(crate) blinding_factor: <<CS as CipherSuite>::Group as Group>::Scalar,
/// the client's password
password: Vec<u8>,
}
impl<Aead: aead::NewAead<KeySize = U32> + aead::Aead, Grp: Group> TryFrom<&[u8]>
for ClientRegistration<Aead, Grp>
{
impl<CS: CipherSuite> TryFrom<&[u8]> for ClientRegistration<CS> {
type Error = ProtocolError;
fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
// Check that the message is actually containing an element of the
// correct subgroup
let scalar_len = Grp::ScalarLen::to_usize();
let scalar_len = <<CS as CipherSuite>::Group as Group>::ScalarLen::to_usize();
let blinding_factor_bytes = GenericArray::from_slice(&bytes[..scalar_len]);
let blinding_factor = Grp::from_scalar_slice(blinding_factor_bytes)?;
let blinding_factor = CS::Group::from_scalar_slice(blinding_factor_bytes)?;
let password = bytes[scalar_len..].to_vec();
Ok(Self {
_aead: PhantomData,
@@ -285,14 +284,10 @@ impl<Aead: aead::NewAead<KeySize = U32> + aead::Aead, Grp: Group> TryFrom<&[u8]>
}
}
impl<Aead, Grp> ClientRegistration<Aead, Grp>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
{
impl<CS: CipherSuite> ClientRegistration<CS> {
pub fn to_bytes(&self) -> Vec<u8> {
let output: Vec<u8> = [
Grp::scalar_as_bytes(&self.blinding_factor).as_slice(),
CS::Group::scalar_as_bytes(&self.blinding_factor).as_slice(),
&self.password,
]
.concat();
@@ -300,10 +295,7 @@ where
}
}
impl<Aead, Grp> ClientRegistration<Aead, Grp>
where
Grp: Group<ScalarLen = U32, UniformBytesLen = U64>,
{
impl<CS: CipherSuite> ClientRegistration<CS> {
/// Returns an initial "blinded" request to send to the server, as well as a ClientRegistration
///
/// # Arguments
@@ -314,25 +306,31 @@ where
/// ```
/// use opaque_ke::opaque::ClientRegistration;
/// # use opaque_ke::errors::ProtocolError;
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use rand_core::{OsRng, RngCore};
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut rng = OsRng;
/// let (register_m1, registration_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut rng)?;
/// let (register_m1, registration_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn start<R: RngCore + CryptoRng>(
password: &[u8],
pepper: Option<&[u8]>,
blinding_factor_rng: &mut R,
) -> Result<(RegisterFirstMessage<Grp>, Self), ProtocolError> {
) -> Result<(RegisterFirstMessage<CS::Group>, Self), ProtocolError> {
let OprfClientBytes {
alpha,
blinding_factor,
} = oprf::generate_oprf1::<R, Grp>(&password, pepper, blinding_factor_rng)?;
} = oprf::generate_oprf1::<R, CS::Group>(&password, pepper, blinding_factor_rng)?;
Ok((
RegisterFirstMessage::<Grp> { alpha },
RegisterFirstMessage::<CS::Group> { alpha },
Self {
_aead: PhantomData,
blinding_factor,
@@ -347,11 +345,7 @@ type ClientRegistrationFinishResult<Aead, KeyFormat> = (
GenericArray<u8, <Sha256 as Digest>::OutputSize>,
);
impl<Aead, Grp> ClientRegistration<Aead, Grp>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
{
impl<CS: CipherSuite> ClientRegistration<CS> {
/// "Unblinds" the server's answer and returns a final message containing
/// cryptographic identifiers, to be sent to the server on setup finalization
///
@@ -364,29 +358,34 @@ where
/// use opaque_ke::{opaque::{ClientRegistration, ServerRegistration}, keypair::{X25519KeyPair, SizedBytes}};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::KeyPair;
/// # use opaque_ke::slow_hash::NoOpHash;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let mut server_rng = OsRng;
/// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
/// let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m2, server_state) =
/// ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// let mut client_rng = OsRng;
/// let register_m3 = client_state.finish::<_, X25519KeyPair, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
/// let register_m3 = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn finish<R: CryptoRng + RngCore, KeyFormat: KeyPair, SH: SlowHash>(
pub fn finish<R: CryptoRng + RngCore>(
self,
r2: RegisterSecondMessage<Grp>,
server_s_pk: &KeyFormat::Repr,
r2: RegisterSecondMessage<CS::Group>,
server_s_pk: &<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr,
rng: &mut R,
) -> Result<ClientRegistrationFinishResult<Aead, KeyFormat>, ProtocolError> {
let client_static_keypair = KeyFormat::generate_random(rng)?;
) -> Result<ClientRegistrationFinishResult<CS::Aead, CS::KeyFormat>, ProtocolError> {
let client_static_keypair = CS::KeyFormat::generate_random(rng)?;
let password_derived_key = get_password_derived_key::<Grp, SH>(
let password_derived_key = get_password_derived_key::<CS::Group, CS::SlowHash>(
self.password.clone(),
r2.beta,
&self.blinding_factor,
@@ -399,7 +398,7 @@ where
let hmac_key = &okm[DERIVED_KEY_LEN..2 * DERIVED_KEY_LEN];
let kd_key = &okm[2 * DERIVED_KEY_LEN..];
let envelope = RKRCiphertext::<Aead>::encrypt(
let envelope = RKRCiphertext::<CS::Aead>::encrypt(
&encryption_key,
&hmac_key,
&client_static_keypair.private().to_arr(),
@@ -418,60 +417,59 @@ where
}
// This can't be derived because of the use of a phantom parameter
impl<Aead, Grp: Group> Zeroize for ClientRegistration<Aead, Grp> {
impl<CS: CipherSuite> Zeroize for ClientRegistration<CS> {
fn zeroize(&mut self) {
self.password.zeroize();
self.blinding_factor.zeroize();
}
}
impl<Aead, Grp: Group> Drop for ClientRegistration<Aead, Grp> {
impl<CS: CipherSuite> Drop for ClientRegistration<CS> {
fn drop(&mut self) {
self.zeroize();
}
}
// This can't be derived because of the use of a phantom parameter
impl<Aead, Grp: Group, KeyFormat> Zeroize for ClientLogin<Aead, Grp, KeyFormat> {
impl<CS: CipherSuite> Zeroize for ClientLogin<CS> {
fn zeroize(&mut self) {
self.password.zeroize();
self.blinding_factor.zeroize();
}
}
impl<Aead, Grp: Group, KeyFormat> Drop for ClientLogin<Aead, Grp, KeyFormat> {
impl<CS: CipherSuite> Drop for ClientLogin<CS> {
fn drop(&mut self) {
self.zeroize();
}
}
/// The state elements the server holds to record a registration
pub struct ServerRegistration<Aead, Grp: Group, KeyFormat: KeyPair> {
envelope: Option<RKRCiphertext<Aead>>,
client_s_pk: Option<KeyFormat::Repr>,
pub(crate) oprf_key: Grp::Scalar,
pub struct ServerRegistration<CS: CipherSuite> {
envelope: Option<RKRCiphertext<CS::Aead>>,
client_s_pk: Option<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr>,
pub(crate) oprf_key: <<CS as CipherSuite>::Group as Group>::Scalar,
}
impl<Aead, Grp, KeyFormat> TryFrom<&[u8]> for ServerRegistration<Aead, Grp, KeyFormat>
impl<CS: CipherSuite> TryFrom<&[u8]> for ServerRegistration<CS>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair + PartialEq,
<KeyFormat::Repr as SizedBytes>::Len: std::ops::Add<<KeyFormat::Repr as SizedBytes>::Len>,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len:
std::ops::Add<<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len>,
generic_array::typenum::Sum<
<KeyFormat::Repr as SizedBytes>::Len,
<KeyFormat::Repr as SizedBytes>::Len,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
>: generic_array::ArrayLength<u8>,
{
type Error = ProtocolError;
fn try_from(server_registration_bytes: &[u8]) -> Result<Self, Self::Error> {
let key_len = <KeyFormat::Repr as SizedBytes>::Len::to_usize();
let scalar_len = Grp::ScalarLen::to_usize();
let rkr_size = RKRCiphertext::<Aead>::rkr_with_nonce_size();
let key_len =
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
let scalar_len = <<CS as CipherSuite>::Group as Group>::ScalarLen::to_usize();
let rkr_size = RKRCiphertext::<CS::Aead>::rkr_with_nonce_size();
if server_registration_bytes.len() == scalar_len {
return Ok(Self {
oprf_key: Grp::from_scalar_slice(GenericArray::from_slice(
oprf_key: CS::Group::from_scalar_slice(GenericArray::from_slice(
server_registration_bytes,
))?,
client_s_pk: None,
@@ -485,10 +483,11 @@ where
"server_registration_bytes",
)?;
let oprf_key_bytes = GenericArray::from_slice(&checked_bytes[..scalar_len]);
let oprf_key = Grp::from_scalar_slice(oprf_key_bytes)?;
let unchecked_client_s_pk =
KeyFormat::Repr::from_bytes(&checked_bytes[scalar_len..scalar_len + key_len])?;
let client_s_pk = KeyFormat::check_public_key(unchecked_client_s_pk)?;
let oprf_key = CS::Group::from_scalar_slice(oprf_key_bytes)?;
let unchecked_client_s_pk = <<CS as CipherSuite>::KeyFormat as KeyPair>::Repr::from_bytes(
&checked_bytes[scalar_len..scalar_len + key_len],
)?;
let client_s_pk = CS::KeyFormat::check_public_key(unchecked_client_s_pk)?;
Ok(Self {
envelope: Some(RKRCiphertext::from_bytes(
&checked_bytes[checked_bytes.len() - rkr_size..],
@@ -499,19 +498,17 @@ where
}
}
impl<Aead, Grp, KeyFormat> ServerRegistration<Aead, Grp, KeyFormat>
impl<CS: CipherSuite> ServerRegistration<CS>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair + PartialEq,
<KeyFormat::Repr as SizedBytes>::Len: std::ops::Add<<KeyFormat::Repr as SizedBytes>::Len>,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len:
std::ops::Add<<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len>,
generic_array::typenum::Sum<
<KeyFormat::Repr as SizedBytes>::Len,
<KeyFormat::Repr as SizedBytes>::Len,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
>: generic_array::ArrayLength<u8>,
{
pub fn to_bytes(&self) -> Vec<u8> {
let mut output: Vec<u8> = Grp::scalar_as_bytes(&self.oprf_key).to_vec();
let mut output: Vec<u8> = CS::Group::scalar_as_bytes(&self.oprf_key).to_vec();
match &self.client_s_pk {
Some(v) => output.extend_from_slice(&v.to_arr()),
None => {}
@@ -534,26 +531,31 @@ where
/// ```
/// use opaque_ke::{opaque::*, keypair::{X25519KeyPair, SizedBytes}};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::KeyPair;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let mut server_rng = OsRng;
/// let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m2, server_state) =
/// ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn start<R: RngCore + CryptoRng>(
message: RegisterFirstMessage<Grp>,
message: RegisterFirstMessage<CS::Group>,
rng: &mut R,
) -> Result<(RegisterSecondMessage<Grp>, Self), ProtocolError> {
) -> Result<(RegisterSecondMessage<CS::Group>, Self), ProtocolError> {
// RFC: generate oprf_key (salt) and v_u = g^oprf_key
let oprf_key = Grp::random_scalar(rng);
let oprf_key = CS::Group::random_scalar(rng);
// Compute beta = alpha^oprf_key
let beta = oprf::generate_oprf2::<Grp>(message.alpha, &oprf_key)?;
let beta = oprf::generate_oprf2::<CS::Group>(message.alpha, &oprf_key)?;
Ok((
RegisterSecondMessage { beta },
@@ -574,27 +576,31 @@ where
/// # Example
///
/// ```
/// use opaque_ke::{opaque::*, keypair::{X25519KeyPair, SizedBytes}};
/// use opaque_ke::{opaque::*, keypair::{KeyPair, X25519KeyPair, SizedBytes}};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::KeyPair;
/// # use opaque_ke::slow_hash::NoOpHash;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let mut server_rng = OsRng;
/// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
/// let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (register_m2, server_state) =
/// ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// let mut client_rng = OsRng;
/// let (register_m3, _opaque_key) = client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
/// let (register_m3, _opaque_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
/// let client_record = server_state.finish(register_m3)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn finish(
self,
message: RegisterThirdMessage<Aead, KeyFormat>,
message: RegisterThirdMessage<CS::Aead, CS::KeyFormat>,
) -> Result<Self, ProtocolError> {
Ok(Self {
envelope: Some(message.envelope),
@@ -608,27 +614,25 @@ where
// =====
/// The state elements the client holds to perform a login
pub struct ClientLogin<Aead, Grp: Group, KeyFormat> {
pub struct ClientLogin<CS: CipherSuite> {
/// A choice of symmetric encryption for the envelope
_aead: PhantomData<Aead>,
_aead: PhantomData<CS::Aead>,
/// A choice of the keypair type
_key_format: PhantomData<KeyFormat>,
_key_format: PhantomData<CS::KeyFormat>,
/// A blinding factor, which is used to mask (and unmask) secret
/// information before transmission
blinding_factor: Grp::Scalar,
blinding_factor: <<CS as CipherSuite>::Group as Group>::Scalar,
/// The user's password
password: Vec<u8>,
ke1_state: KE1State,
}
impl<Aead: aead::NewAead<KeySize = U32> + aead::Aead, Grp: Group, KeyFormat: KeyPair> TryFrom<&[u8]>
for ClientLogin<Aead, Grp, KeyFormat>
{
impl<CS: CipherSuite> TryFrom<&[u8]> for ClientLogin<CS> {
type Error = ProtocolError;
fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
let scalar_len = Grp::ScalarLen::to_usize();
let scalar_len = <<CS as CipherSuite>::Group as Group>::ScalarLen::to_usize();
let blinding_factor_bytes = GenericArray::from_slice(&bytes[..scalar_len]);
let blinding_factor = Grp::from_scalar_slice(blinding_factor_bytes)?;
let blinding_factor = CS::Group::from_scalar_slice(blinding_factor_bytes)?;
let ke1_state = KE1State::try_from(&bytes[scalar_len..scalar_len + KE1_STATE_LEN])?;
let password = bytes[scalar_len + KE1_STATE_LEN..].to_vec();
Ok(Self {
@@ -641,15 +645,10 @@ impl<Aead: aead::NewAead<KeySize = U32> + aead::Aead, Grp: Group, KeyFormat: Key
}
}
impl<Aead, Grp, KeyFormat> ClientLogin<Aead, Grp, KeyFormat>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair,
{
impl<CS: CipherSuite> ClientLogin<CS> {
pub fn to_bytes(&self) -> Vec<u8> {
let output: Vec<u8> = [
Grp::scalar_as_bytes(&self.blinding_factor).as_slice(),
CS::Group::scalar_as_bytes(&self.blinding_factor).as_slice(),
&self.ke1_state.to_bytes(),
&self.password,
]
@@ -664,12 +663,7 @@ type ClientLoginFinishResult = (
GenericArray<u8, <Sha256 as Digest>::OutputSize>,
);
impl<Aead, Grp, KeyFormat> ClientLogin<Aead, Grp, KeyFormat>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group<UniformBytesLen = U64>,
KeyFormat: KeyPair<Repr = Key>,
{
impl<CS: CipherSuite> ClientLogin<CS> {
/// Returns an initial "blinded" password request to send to the server, as well as a ClientLogin
///
/// # Arguments
@@ -680,26 +674,31 @@ where
/// ```
/// use opaque_ke::opaque::ClientLogin;
/// # use opaque_ke::errors::ProtocolError;
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::keypair::X25519KeyPair;
/// use rand_core::{OsRng, RngCore};
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let (login_m1, client_login_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m1, client_login_state) = ClientLogin::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn start<R: RngCore + CryptoRng>(
password: &[u8],
pepper: Option<&[u8]>,
rng: &mut R,
) -> Result<(LoginFirstMessage<Grp>, Self), ProtocolError> {
) -> Result<(LoginFirstMessage<CS::Group>, Self), ProtocolError> {
let OprfClientBytes {
alpha,
blinding_factor,
} = oprf::generate_oprf1::<R, Grp>(&password, pepper, rng)?;
} = oprf::generate_oprf1::<R, CS::Group>(&password, pepper, rng)?;
let (ke1_state, ke1_message) =
generate_ke1::<_, KeyFormat>(alpha.to_bytes().to_vec(), rng)?;
generate_ke1::<_, CS::KeyFormat>(alpha.to_bytes().to_vec(), rng)?;
let l1 = LoginFirstMessage { alpha, ke1_message };
@@ -728,31 +727,36 @@ where
/// # use opaque_ke::opaque::{ClientRegistration, ServerRegistration};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::{X25519KeyPair, KeyPair};
/// # use opaque_ke::slow_hash::NoOpHash;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// # let mut server_rng = OsRng;
/// # let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// # let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
/// # let (register_m2, server_state) = ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
/// # let (register_m2, server_state) = ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
/// # let p_file = server_state.finish(register_m3)?;
/// let (login_m1, client_login_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m1, client_login_state) = ClientLogin::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?;
/// let (login_m3, client_transport, _opaque_key) = client_login_state.finish::<_, NoOpHash>(login_m2, &server_kp.public(), &mut client_rng)?;
/// let (login_m3, client_transport, _opaque_key) = client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn finish<R: RngCore + CryptoRng, SH: SlowHash>(
pub fn finish<R: RngCore + CryptoRng>(
self,
l2: LoginSecondMessage<Aead, Grp>,
server_s_pk: &KeyFormat::Repr,
l2: LoginSecondMessage<CS::Aead, CS::Group>,
server_s_pk: &<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr,
_client_e_sk_rng: &mut R,
) -> Result<ClientLoginFinishResult, ProtocolError> {
let l2_bytes: Vec<u8> = [l2.beta.to_bytes().as_slice(), &l2.envelope.to_bytes()].concat();
let password_derived_key = get_password_derived_key::<Grp, SH>(
let password_derived_key = get_password_derived_key::<CS::Group, CS::SlowHash>(
self.password.clone(),
l2.beta,
&self.blinding_factor,
@@ -774,7 +778,7 @@ where
})?,
)?;
let (ke3_state, ke3_message) = generate_ke3::<KeyFormat>(
let (ke3_state, ke3_message) = generate_ke3::<CS::KeyFormat>(
l2_bytes,
l2.ke2_message,
&self.ke1_state,
@@ -804,6 +808,11 @@ impl TryFrom<&[u8]> for ServerLogin {
}
}
type ServerLoginStartResult<CS> = (
LoginSecondMessage<<CS as CipherSuite>::Aead, <CS as CipherSuite>::Group>,
ServerLogin,
);
impl ServerLogin {
pub fn to_bytes(&self) -> Vec<u8> {
self.ke2_state.to_bytes()
@@ -822,33 +831,33 @@ impl ServerLogin {
/// # use opaque_ke::opaque::{ClientRegistration, ServerRegistration};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::{KeyPair, X25519KeyPair};
/// # use opaque_ke::slow_hash::NoOpHash;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let mut server_rng = OsRng;
/// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
/// # let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// # let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// # let (register_m2, server_state) =
/// ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
/// ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
/// # let p_file = server_state.finish(register_m3)?;
/// let (login_m1, client_login_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m1, client_login_state) = ClientLogin::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?;
/// # Ok::<(), ProtocolError>(())
/// ```
pub fn start<
R: RngCore + CryptoRng,
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair<Repr = Key>,
>(
password_file: ServerRegistration<Aead, Grp, KeyFormat>,
pub fn start<CS: CipherSuite, R: RngCore + CryptoRng>(
password_file: ServerRegistration<CS>,
server_s_sk: &Key,
l1: LoginFirstMessage<Grp>,
l1: LoginFirstMessage<CS::Group>,
rng: &mut R,
) -> Result<(LoginSecondMessage<Aead, Grp>, Self), ProtocolError> {
) -> Result<ServerLoginStartResult<CS>, ProtocolError> {
let l1_bytes = &l1.to_bytes();
let beta = oprf::generate_oprf2(l1.alpha, &password_file.oprf_key)?;
@@ -859,7 +868,7 @@ impl ServerLogin {
let l2_component: Vec<u8> = [beta.to_bytes().as_slice(), &envelope.to_bytes()].concat();
let (ke2_state, ke2_message) = generate_ke2::<_, KeyFormat>(
let (ke2_state, ke2_message) = generate_ke2::<_, CS::KeyFormat>(
rng,
l1_bytes.to_vec(),
l2_component,
@@ -891,21 +900,26 @@ impl ServerLogin {
/// # use opaque_ke::opaque::{ClientRegistration, ServerRegistration};
/// # use opaque_ke::errors::ProtocolError;
/// # use opaque_ke::keypair::{KeyPair, X25519KeyPair};
/// # use opaque_ke::slow_hash::NoOpHash;
/// use rand_core::{OsRng, RngCore};
/// use chacha20poly1305::ChaCha20Poly1305;
/// use curve25519_dalek::ristretto::RistrettoPoint;
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
/// }
/// let mut client_rng = OsRng;
/// let mut server_rng = OsRng;
/// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
/// # let (register_m1, client_state) = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::start(b"hunter2", None, &mut client_rng)?;
/// # let (register_m1, client_state) = ClientRegistration::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// # let (register_m2, server_state) =
/// ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
/// ServerRegistration::<Default>::start(register_m1, &mut server_rng)?;
/// # let (register_m3, _opaque_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
/// # let p_file = server_state.finish(register_m3)?;
/// let (login_m1, client_login_state) = ClientLogin::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m1, client_login_state) = ClientLogin::<Default>::start(b"hunter2", None, &mut client_rng)?;
/// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?;
/// let (login_m3, client_transport, _opaque_key) = client_login_state.finish::<_, NoOpHash>(login_m2, &server_kp.public(), &mut client_rng)?;
/// let (login_m3, client_transport, _opaque_key) = client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng)?;
/// let mut server_transport = server_login_state.finish(login_m3)?;
/// # Ok::<(), ProtocolError>(())
/// ```
src/slow_hash.rs
+5
View File
@@ -3,17 +3,22 @@
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
//! Trait specifying a slow hashing function
use crate::errors::InternalPakeError;
use generic_array::GenericArray;
use sha2::{Digest, Sha256};
/// Used for the slow hashing function in OPAQUE
pub trait SlowHash {
/// Computes the slow hashing function
fn hash(
input: GenericArray<u8, <Sha256 as Digest>::OutputSize>,
) -> Result<Vec<u8>, InternalPakeError>;
}
/// A no-op hash which simply returns its input
pub struct NoOpHash;
impl SlowHash for NoOpHash {
src/tests/opaque_ke_test.rs
+48 -55
View File
@@ -4,12 +4,12 @@
// LICENSE file in the root directory of this source tree.
use crate::{
ciphersuite::CipherSuite,
errors::*,
group::Group,
key_exchange::NONCE_LEN,
keypair::{Key, KeyPair, X25519KeyPair},
keypair::{Key, KeyPair},
opaque::*,
slow_hash::NoOpHash,
tests::mock_rng::CycleRng,
};
use aes_gcm::Aes256Gcm;
@@ -21,6 +21,14 @@ use std::convert::TryFrom;
// Tests
// =====
struct AesgcmX255193dhNoSlowHash;
impl CipherSuite for AesgcmX255193dhNoSlowHash {
type Aead = Aes256Gcm;
type Group = EdwardsPoint;
type KeyFormat = crate::keypair::X25519KeyPair;
type SlowHash = crate::slow_hash::NoOpHash;
}
pub struct TestVectorParameters {
pub client_s_pk: Vec<u8>,
pub client_s_sk: Vec<u8>,
@@ -215,10 +223,10 @@ fn generate_parameters() -> TestVectorParameters {
let mut rng = OsRng;
// Inputs
let server_s_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let server_e_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let client_s_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let client_e_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let server_s_kp = AesgcmX255193dhNoSlowHash::generate_random_keypair(&mut rng).unwrap();
let server_e_kp = AesgcmX255193dhNoSlowHash::generate_random_keypair(&mut rng).unwrap();
let client_s_kp = AesgcmX255193dhNoSlowHash::generate_random_keypair(&mut rng).unwrap();
let client_e_kp = AesgcmX255193dhNoSlowHash::generate_random_keypair(&mut rng).unwrap();
let password = b"password";
let pepper = b"pepper";
let mut blinding_factor_raw = [0u8; 64];
@@ -233,7 +241,7 @@ fn generate_parameters() -> TestVectorParameters {
rng.fill_bytes(&mut server_nonce);
let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_raw.to_vec());
let (r1, client_registration) = ClientRegistration::<Aes256Gcm, EdwardsPoint>::start(
let (r1, client_registration) = ClientRegistration::<AesgcmX255193dhNoSlowHash>::start(
password,
Some(pepper),
&mut blinding_factor_registration_rng,
@@ -245,8 +253,7 @@ fn generate_parameters() -> TestVectorParameters {
let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec());
let (r2, server_registration) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(r1, &mut oprf_key_rng)
.unwrap();
ServerRegistration::<AesgcmX255193dhNoSlowHash>::start(r1, &mut oprf_key_rng).unwrap();
let r2_bytes = r2.to_bytes().to_vec();
let oprf_key = server_registration.oprf_key;
let oprf_key_bytes = EdwardsPoint::scalar_as_bytes(&oprf_key);
@@ -258,11 +265,7 @@ fn generate_parameters() -> TestVectorParameters {
let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
let (r3, opaque_key_registration) = client_registration
.finish::<_, X25519KeyPair, NoOpHash>(
r2,
server_s_kp.public(),
&mut finish_registration_rng,
)
.finish(r2, server_s_kp.public(), &mut finish_registration_rng)
.unwrap();
let r3_bytes = r3.to_bytes().to_vec();
@@ -275,7 +278,7 @@ fn generate_parameters() -> TestVectorParameters {
client_login_start.extend_from_slice(&client_nonce);
let mut client_login_start_rng = CycleRng::new(client_login_start);
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
let (l1, client_login) = ClientLogin::<AesgcmX255193dhNoSlowHash>::start(
password,
Some(pepper),
&mut client_login_start_rng,
@@ -297,7 +300,7 @@ fn generate_parameters() -> TestVectorParameters {
let mut client_e_sk_rng = CycleRng::new(client_e_kp.private().to_vec());
let (l3, client_shared_secret, _opaque_key_login) = client_login
.finish::<_, NoOpHash>(l2, server_s_kp.public(), &mut client_e_sk_rng)
.finish(l2, server_s_kp.public(), &mut client_e_sk_rng)
.unwrap();
let l3_bytes = l3.to_bytes().to_vec();
@@ -344,7 +347,7 @@ fn generate_test_vectors() {
fn test_r1() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let mut blinding_factor_rng = CycleRng::new(parameters.blinding_factor_raw);
let (r1, client_registration) = ClientRegistration::<Aes256Gcm, EdwardsPoint>::start(
let (r1, client_registration) = ClientRegistration::<AesgcmX255193dhNoSlowHash>::start(
&parameters.password,
Some(&parameters.pepper),
&mut blinding_factor_rng,
@@ -362,12 +365,11 @@ fn test_r1() -> Result<(), PakeError> {
fn test_r2() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let mut oprf_key_rng = CycleRng::new(parameters.oprf_key);
let (r2, server_registration) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
RegisterFirstMessage::try_from(&parameters.r1[..]).unwrap(),
&mut oprf_key_rng,
)
.unwrap();
let (r2, server_registration) = ServerRegistration::<AesgcmX255193dhNoSlowHash>::start(
RegisterFirstMessage::try_from(&parameters.r1[..]).unwrap(),
&mut oprf_key_rng,
)
.unwrap();
assert_eq!(hex::encode(parameters.r2), hex::encode(r2.to_bytes()));
assert_eq!(
hex::encode(&parameters.server_registration_state),
@@ -383,11 +385,11 @@ fn test_r3() -> Result<(), PakeError> {
let client_s_sk_and_nonce: Vec<u8> =
[parameters.client_s_sk, parameters.envelope_nonce].concat();
let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
let (r3, opaque_key_registration) = ClientRegistration::<Aes256Gcm, EdwardsPoint>::try_from(
let (r3, opaque_key_registration) = ClientRegistration::<AesgcmX255193dhNoSlowHash>::try_from(
&parameters.client_registration_state[..],
)
.unwrap()
.finish::<CycleRng, X25519KeyPair, NoOpHash>(
.finish(
RegisterSecondMessage::try_from(&parameters.r2[..]).unwrap(),
&Key::try_from(parameters.server_s_pk).unwrap(),
&mut finish_registration_rng,
@@ -407,11 +409,10 @@ fn test_r3() -> Result<(), PakeError> {
fn test_password_file() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let server_registration =
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::try_from(
&parameters.server_registration_state[..],
)
.unwrap();
let server_registration = ServerRegistration::<AesgcmX255193dhNoSlowHash>::try_from(
&parameters.server_registration_state[..],
)
.unwrap();
let password_file = server_registration
.finish(RegisterThirdMessage::try_from(&parameters.r3[..]).unwrap())
.unwrap();
@@ -434,7 +435,7 @@ fn test_l1() -> Result<(), PakeError> {
]
.concat();
let mut client_login_start_rng = CycleRng::new(client_login_start);
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
let (l1, client_login) = ClientLogin::<AesgcmX255193dhNoSlowHash>::start(
&parameters.password,
Some(&parameters.pepper),
&mut client_login_start_rng,
@@ -453,7 +454,7 @@ fn test_l2() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let mut server_e_sk_rng = CycleRng::new(parameters.server_e_sk);
let (l2, server_login) = ServerLogin::start::<_, Aes256Gcm, _, X25519KeyPair>(
let (l2, server_login) = ServerLogin::start::<AesgcmX255193dhNoSlowHash, _>(
ServerRegistration::try_from(&parameters.password_file[..]).unwrap(),
&Key::try_from(parameters.server_s_sk).unwrap(),
LoginFirstMessage::<EdwardsPoint>::try_from(&parameters.l1[..]).unwrap(),
@@ -475,16 +476,15 @@ fn test_l3() -> Result<(), PakeError> {
let mut client_e_sk_rng = CycleRng::new(parameters.client_e_sk.to_vec());
let (l3, shared_secret, opaque_key_login) =
ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::try_from(
&parameters.client_login_state[..],
)
.unwrap()
.finish::<_, NoOpHash>(
LoginSecondMessage::<Aes256Gcm, EdwardsPoint>::try_from(&parameters.l2[..]).unwrap(),
&Key::try_from(parameters.server_s_pk)?,
&mut client_e_sk_rng,
)
.unwrap();
ClientLogin::<AesgcmX255193dhNoSlowHash>::try_from(&parameters.client_login_state[..])
.unwrap()
.finish(
LoginSecondMessage::<Aes256Gcm, EdwardsPoint>::try_from(&parameters.l2[..])
.unwrap(),
&Key::try_from(parameters.server_s_pk)?,
&mut client_e_sk_rng,
)
.unwrap();
assert_eq!(
hex::encode(&parameters.shared_secret),
@@ -522,31 +522,24 @@ fn test_complete_flow(
) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
let (register_m1, client_state) = ClientRegistration::<Aes256Gcm, EdwardsPoint>::start(
let server_kp = AesgcmX255193dhNoSlowHash::generate_random_keypair(&mut server_rng)?;
let (register_m1, client_state) = ClientRegistration::<AesgcmX255193dhNoSlowHash>::start(
registration_password,
None,
&mut client_rng,
)?;
let (register_m2, server_state) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
register_m1,
&mut server_rng,
)?;
ServerRegistration::<AesgcmX255193dhNoSlowHash>::start(register_m1, &mut server_rng)?;
let (register_m3, registration_opaque_key) =
client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
let p_file = server_state.finish(register_m3)?;
let (login_m1, client_login_state) =
ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
login_password,
None,
&mut client_rng,
)?;
ClientLogin::<AesgcmX255193dhNoSlowHash>::start(login_password, None, &mut client_rng)?;
let (login_m2, server_login_state) =
ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?;
let client_login_result =
client_login_state.finish::<_, NoOpHash>(login_m2, &server_kp.public(), &mut client_rng);
client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng);
if hex::encode(registration_password) == hex::encode(login_password) {
let (login_m3, client_shared_secret, login_opaque_key) = client_login_result?;
src/tests/serialization.rs
+14 -5
View File
@@ -4,6 +4,7 @@
// LICENSE file in the root directory of this source tree.
use crate::{
ciphersuite::CipherSuite,
group::Group,
keypair::{KeyPair, SizedBytes, X25519KeyPair},
opaque::*,
@@ -16,6 +17,14 @@ use chacha20poly1305::ChaCha20Poly1305;
use rand_core::{OsRng, RngCore};
use std::convert::TryFrom;
struct Default;
impl CipherSuite for Default {
type Aead = ChaCha20Poly1305;
type Group = RistrettoPoint;
type KeyFormat = crate::keypair::X25519KeyPair;
type SlowHash = crate::slow_hash::NoOpHash;
}
fn random_ristretto_point() -> RistrettoPoint {
let mut rng = OsRng;
let mut bits = [0u8; 64];
@@ -30,7 +39,7 @@ fn client_registration_roundtrip() {
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
// serialization order: scalar, password
let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
let reg = ClientRegistration::<ChaCha20Poly1305, RistrettoPoint>::try_from(&bytes[..]).unwrap();
let reg = ClientRegistration::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
@@ -43,7 +52,7 @@ fn server_registration_roundtrip() {
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let mut oprf_bytes: Vec<u8> = vec![];
oprf_bytes.extend_from_slice(sc.as_bytes());
let reg = ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(
let reg = ServerRegistration::<Default>::try_from(
&oprf_bytes[..],
)
.unwrap();
@@ -55,14 +64,14 @@ fn server_registration_roundtrip() {
let mut mock_rkr_bytes = vec![0u8; rkr_size];
rng.fill_bytes(&mut mock_rkr_bytes);
println!("{}", mock_rkr_bytes.len());
let mock_client_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap();
// serialization order: scalar, public key, envelope
let mut bytes = Vec::<u8>::new();
bytes.extend_from_slice(sc.as_bytes());
bytes.extend_from_slice(&mock_client_kp.public().to_arr());
bytes.extend_from_slice(&mock_rkr_bytes);
let reg =
ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(&bytes[..])
ServerRegistration::<Default>::try_from(&bytes[..])
.unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
@@ -91,7 +100,7 @@ fn register_second_message_roundtrip() {
#[test]
fn register_third_message_roundtrip() {
let mut rng = OsRng;
let skp = X25519KeyPair::generate_random(&mut rng).unwrap();
let skp = Default::generate_random_keypair(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let mut encryption_key = [0u8; 32];