Merge GroupWithMapToCurve into Group (#219)

* Merge `GroupWithMapToCurve` into `Group`

* Remove `hash_to_curve`

* Ristretto improvements

* P-256 improvements

src/ciphersuite.rs

@@ -5,25 +5,20 @@
 
 //! Defines the CipherSuite trait to specify the underlying primitives for OPAQUE
 
-use crate::{
-    hash::Hash, key_exchange::traits::KeyExchange, map_to_curve::GroupWithMapToCurve,
-    slow_hash::SlowHash,
-};
+use crate::{group::Group, hash::Hash, key_exchange::traits::KeyExchange, slow_hash::SlowHash};
 
 /// Configures the underlying primitives used in OPAQUE
 /// * `Group`: a finite cyclic group along with a point representation, along
 ///   with an extension trait PasswordToCurve that allows some customization on
-///   how to hash a password to a curve point. See `group::Group` and
-///   `map_to_curve::GroupWithMapToCurve`.
+///   how to hash a password to a curve point. See `group::Group`.
 /// * `KeyExchange`: The key exchange protocol to use in the login step
 /// * `Hash`: The main hashing function to use
 /// * `SlowHash`: A slow hashing function, typically used for password hashing
 pub trait CipherSuite {
     /// A finite cyclic group along with a point representation along with
     /// an extension trait PasswordToCurve that allows some customization on
-    /// how to hash a password to a curve point. See `group::Group` and
-    /// `map_to_curve::GroupWithMapToCurve`.
-    type Group: GroupWithMapToCurve;
+    /// how to hash a password to a curve point. See `group::Group`.
+    type Group: Group;
     /// A key exchange protocol
     type KeyExchange: KeyExchange<Self::Hash, Self::Group>;
     /// The main hash function use (for HKDF computations and hashing transcripts)

src/envelope.rs

@@ -9,7 +9,6 @@ use crate::{
     group::Group,
     hash::Hash,
     keypair::{KeyPair, PrivateKey, PublicKey},
-    map_to_curve::GroupWithMapToCurve,
     opaque::{bytestrings_from_identifiers, Identifiers},
 };
 use digest::Digest;

src/group/expand.rs

@@ -3,91 +3,11 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-//! Defines the GroupWithMapToCurve trait to specify how to map a password to a
-//! curve point
-
 use crate::errors::{InternalPakeError, ProtocolError};
-use crate::group::Group;
 use crate::hash::Hash;
 use crate::serialization::i2osp;
-use curve25519_dalek::ristretto::RistrettoPoint;
 use digest::{BlockInput, Digest};
 use generic_array::typenum::Unsigned;
-use generic_array::GenericArray;
-
-/// A subtrait of Group specifying how to hash a password into a point
-pub trait GroupWithMapToCurve: Group {
-    /// The ciphersuite identifier as dictated by
-    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
-    const SUITE_ID: usize;
-
-    /// transforms a password and domain separation tag (DST) into a curve point
-    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError>;
-
-    /// Hashes a slice of pseudo-random bytes to a scalar
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError>;
-
-    /// Generates the contextString parameter as defined in
-    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
-    fn get_context_string(mode: u8) -> Result<Vec<u8>, ProtocolError> {
-        Ok([i2osp(mode as usize, 1)?, i2osp(Self::SUITE_ID, 2)?].concat())
-    }
-}
-
-impl GroupWithMapToCurve for RistrettoPoint {
-    const SUITE_ID: usize = 0x0001;
-
-    // Implements the hash_to_ristretto255() function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
-    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError> {
-        let uniform_bytes =
-            expand_message_xmd::<H>(msg, dst, <H as Digest>::OutputSize::to_usize())?;
-        <Self as Group>::hash_to_curve(&GenericArray::clone_from_slice(&uniform_bytes[..]))
-            .map_err(ProtocolError::from)
-    }
-
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
-        const LEN_IN_BYTES: usize = 64;
-        let uniform_bytes = expand_message_xmd::<H>(input, dst, LEN_IN_BYTES)?;
-        let mut bits = [0u8; LEN_IN_BYTES];
-        bits.copy_from_slice(&uniform_bytes[..]);
-
-        Ok(Self::Scalar::from_bytes_mod_order_wide(&bits))
-    }
-}
-
-#[cfg(feature = "p256")]
-impl GroupWithMapToCurve for p256_::ProjectivePoint {
-    const SUITE_ID: usize = 0x0003;
-
-    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError> {
-        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
-        // `hash_to_curve` calls `hash_to_field` with a `count` of `2`
-        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
-        // `hash_to_field` calls `expand_message` with a `len_in_bytes` of `count * L`
-        let uniform_bytes = expand_message_xmd::<H>(msg, dst, 2 * crate::group::p256::L)?;
-
-        <Self as Group>::hash_to_curve(&GenericArray::clone_from_slice(&uniform_bytes[..]))
-            .map_err(ProtocolError::from)
-    }
-
-    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
-        use num_bigint::{BigInt, Sign};
-        use num_integer::Integer;
-
-        let uniform_bytes = expand_message_xmd::<H>(input, dst, crate::group::p256::L)?;
-        #[allow(clippy::borrow_interior_mutable_const)]
-        let mut bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes)
-            .mod_floor(&crate::group::p256::R)
-            .to_bytes_be()
-            .1;
-        bytes.resize(32, 0);
-
-        Ok(p256_::Scalar::from_bytes_reduced(GenericArray::from_slice(
-            &bytes,
-        )))
-    }
-}
 
 // Computes ceil(x / y)
 fn div_ceil(x: usize, y: usize) -> usize {

src/group/mod.rs

@@ -6,14 +6,14 @@
 //! Defines the Group trait to specify the underlying prime order group used in
 //! OPAQUE's OPRF
 
+mod expand;
 #[cfg(feature = "p256")]
 pub(crate) mod p256;
 mod ristretto;
 
-use crate::errors::InternalPakeError;
-
+use crate::errors::{InternalPakeError, ProtocolError};
+use crate::hash::Hash;
 use generic_array::{ArrayLength, GenericArray};
-
 use rand::{CryptoRng, RngCore};
 use std::ops::Mul;
 use zeroize::Zeroize;
@@ -21,6 +21,24 @@ use zeroize::Zeroize;
 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
 /// subgroup is noted additively — as in the draft RFC — in this trait.
 pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self> {
+    /// The ciphersuite identifier as dictated by
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    const SUITE_ID: usize;
+
+    /// transforms a password and domain separation tag (DST) into a curve point
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError>;
+
+    /// Hashes a slice of pseudo-random bytes to a scalar
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError>;
+
+    /// Generates the contextString parameter as defined in
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    fn get_context_string(mode: u8) -> Result<Vec<u8>, ProtocolError> {
+        use crate::serialization::i2osp;
+
+        Ok([i2osp(mode as usize, 1)?, i2osp(Self::SUITE_ID, 2)?].concat())
+    }
+
     /// The type of base field scalars
     type Scalar: Zeroize + Copy;
     /// The byte length necessary to represent scalars
@@ -45,17 +63,6 @@ pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output
     /// Serializes the `self` group element
     fn to_arr(&self) -> GenericArray<u8, Self::ElemLen>;
 
-    /// Hashes points presumed to be uniformly random to the curve. The
-    /// impl is allowed to perform additional hashes if it needs to, but this
-    /// may not be necessary as this function is going to be called with the
-    /// output of a kdf.
-    type UniformBytesLen: ArrayLength<u8>;
-
-    /// Hashes a slice of pseudo-random bytes of the correct length to a curve point
-    fn hash_to_curve(
-        uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>,
-    ) -> Result<Self, InternalPakeError>;
-
     /// Get the base point for the group
     fn base_point() -> Self;
 

src/group/p256.rs

@@ -8,10 +8,10 @@
     clippy::declare_interior_mutable_const
 )]
 
-use std::ops::Mul;
-use std::str::FromStr;
-
-use generic_array::typenum::{U32, U33, U96};
+use super::Group;
+use crate::errors::{InternalPakeError, ProtocolError};
+use crate::hash::Hash;
+use generic_array::typenum::{U32, U33};
 use generic_array::{ArrayLength, GenericArray};
 use num_bigint::{BigInt, Sign};
 use num_integer::Integer;
@@ -24,11 +24,8 @@ use p256_::elliptic_curve::subtle::ConstantTimeEq;
 use p256_::elliptic_curve::Field;
 use p256_::{AffinePoint, EncodedPoint, ProjectivePoint};
 use rand::{CryptoRng, RngCore};
-use std::ops::{Add, Div, Neg, Sub};
-
-use crate::errors::InternalPakeError;
-
-use super::Group;
+use std::ops::{Add, Div, Mul, Neg, Sub};
+use std::str::FromStr;
 
 // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-8.2
 // `p: 2^256 - 2^224 + 2^192 + 2^96 - 1`
@@ -54,7 +51,7 @@ pub const L: usize = 48;
 const Z: Lazy<BigInt> = Lazy::new(|| BigInt::from(-10));
 // https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#[{%22num%22:211,%22gen%22:0},{%22name%22:%22XYZ%22},70,700,0]
 // P-256 `n` is defined as `115792089210356248762697446949407573529996955224135760342 422259061068512044369`
-pub const R: Lazy<BigInt> = Lazy::new(|| {
+pub const N: Lazy<BigInt> = Lazy::new(|| {
     BigInt::from_str(
         "115792089210356248762697446949407573529996955224135760342422259061068512044369",
     )
@@ -63,10 +60,57 @@ pub const R: Lazy<BigInt> = Lazy::new(|| {
 
 #[cfg(feature = "p256")]
 impl Group for ProjectivePoint {
+    const SUITE_ID: usize = 0x0003;
+
+    // Implements the `hash_to_curve()` function from
+    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError> {
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
+        // `hash_to_curve` calls `hash_to_field` with a `count` of `2`
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
+        // `hash_to_field` calls `expand_message` with a `len_in_bytes` of `count * L`
+        let uniform_bytes =
+            super::expand::expand_message_xmd::<H>(msg, dst, 2 * crate::group::p256::L)?;
+
+        // map to curve
+        let (q0x, q0y) = map_to_curve_simple_swu(&uniform_bytes[..L], &A, &B, &P, &Z);
+        let (q1x, q1y) = map_to_curve_simple_swu(&uniform_bytes[L..], &A, &B, &P, &Z);
+
+        // convert to `p256` types
+        let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+            &q0x, &q0y, false,
+        ))
+        .ok_or(InternalPakeError::PointError)?
+        .to_curve();
+        let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+            &q1x, &q1y, false,
+        ))
+        .ok_or(InternalPakeError::PointError)?;
+
+        Ok(p0 + p1)
+    }
+
+    // Implements the `HashToScalar()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.3
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
+        // `HashToScalar` is `hash_to_field`
+        let uniform_bytes =
+            super::expand::expand_message_xmd::<H>(input, dst, crate::group::p256::L)?;
+        let mut bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes)
+            .mod_floor(&crate::group::p256::N)
+            .to_bytes_be()
+            .1;
+        bytes.resize(32, 0);
+
+        Ok(p256_::Scalar::from_bytes_reduced(GenericArray::from_slice(
+            &bytes,
+        )))
+    }
+
     type ElemLen = U33;
     type Scalar = p256_::Scalar;
     type ScalarLen = U32;
-    type UniformBytesLen = U96;
 
     fn from_scalar_slice(
         scalar_bits: &GenericArray<u8, Self::ScalarLen>,
@@ -95,32 +139,7 @@ impl Group for ProjectivePoint {
     fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
         let mut bytes = self.to_affine().to_encoded_point(true).as_bytes().to_vec();
         bytes.resize(33, 0);
-        GenericArray::clone_from_slice(&bytes)
-    }
-
-    fn hash_to_curve(
-        uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>,
-    ) -> Result<Self, InternalPakeError> {
-        // extract points
-        let u0 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[0..L]);
-        let u1 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[L..L * 2]);
-
-        // map to curve
-        let (q0x, q0y) = map_to_curve_simple_swu(&u0, &A, &B, &P, &Z);
-        let (q1x, q1y) = map_to_curve_simple_swu(&u1, &A, &B, &P, &Z);
-
-        // convert to `p256` types
-        let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
-            &q0x, &q0y, false,
-        ))
-        .ok_or(InternalPakeError::PointError)?
-        .to_curve();
-        let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
-            &q1x, &q1y, false,
-        ))
-        .ok_or(InternalPakeError::PointError)?;
-
-        Ok(p0 + p1)
+        *GenericArray::from_slice(&bytes)
     }
 
     fn base_point() -> Self {
@@ -143,7 +162,7 @@ impl Group for ProjectivePoint {
 /// <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-F.2>
 #[allow(clippy::many_single_char_names)]
 fn map_to_curve_simple_swu<N: ArrayLength<u8>>(
-    u: &BigInt,
+    u: &[u8],
     a: &BigInt,
     b: &BigInt,
     p: &BigInt,
@@ -318,7 +337,7 @@ fn map_to_curve_simple_swu<N: ArrayLength<u8>>(
     let a = f.element(a);
     let b = f.element(b);
     let z = f.element(z);
-    let u = f.element(u);
+    let u = f.element(&BigInt::from_bytes_be(Sign::Plus, u));
 
     // Constants:
     // 1.  c1 = -B / A
@@ -463,7 +482,7 @@ mod tests {
         let dst = "QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_";
 
         for tv in test_vectors {
-            let uniform_bytes = crate::map_to_curve::expand_message_xmd::<sha2::Sha256>(
+            let uniform_bytes = super::super::expand::expand_message_xmd::<sha2::Sha256>(
                 tv.msg.as_bytes(),
                 dst.as_bytes(),
                 96,
@@ -476,8 +495,8 @@ mod tests {
             assert_eq!(BigInt::parse_bytes(tv.u0.as_bytes(), 16).unwrap(), u0);
             assert_eq!(BigInt::parse_bytes(tv.u1.as_bytes(), 16).unwrap(), u1);
 
-            let (q0x, q0y) = super::map_to_curve_simple_swu(&u0, &A, &B, &P, &Z);
-            let (q1x, q1y) = super::map_to_curve_simple_swu(&u1, &A, &B, &P, &Z);
+            let (q0x, q0y) = super::map_to_curve_simple_swu(&u0.to_bytes_be().1, &A, &B, &P, &Z);
+            let (q1x, q1y) = super::map_to_curve_simple_swu(&u1.to_bytes_be().1, &A, &B, &P, &Z);
 
             assert_eq!(tv.q0x, hex::encode(q0x));
             assert_eq!(tv.q0y, hex::encode(q0y));

src/group/ristretto.rs

@@ -3,34 +3,56 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-use crate::errors::InternalPakeError;
-
+use super::Group;
+use crate::errors::{InternalPakeError, ProtocolError};
+use crate::hash::Hash;
 use curve25519_dalek::{
     constants::RISTRETTO_BASEPOINT_POINT,
     ristretto::{CompressedRistretto, RistrettoPoint},
     scalar::Scalar,
     traits::Identity,
 };
-use generic_array::{
-    typenum::{U32, U64},
-    GenericArray,
-};
-use std::convert::TryInto;
-
+use generic_array::{typenum::U32, GenericArray};
 use rand::{CryptoRng, RngCore};
-
-use super::Group;
+use std::convert::TryInto;
+use subtle::ConstantTimeEq;
 
 /// The implementation of such a subgroup for Ristretto
 impl Group for RistrettoPoint {
+    const SUITE_ID: usize = 0x0001;
+
+    // Implements the `hash_to_ristretto255()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError> {
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(msg, dst, 64)?;
+
+        Ok(RistrettoPoint::from_uniform_bytes(
+            uniform_bytes
+                .as_slice()
+                .try_into()
+                .map_err(|_| InternalPakeError::HashToCurveError)?,
+        ))
+    }
+
+    // Implements the `HashToScalar()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(input, dst, 64)?;
+
+        Ok(Scalar::from_bytes_mod_order_wide(
+            uniform_bytes
+                .as_slice()
+                .try_into()
+                .map_err(|_| InternalPakeError::HashToCurveError)?,
+        ))
+    }
+
     type Scalar = Scalar;
     type ScalarLen = U32;
     fn from_scalar_slice(
         scalar_bits: &GenericArray<u8, Self::ScalarLen>,
     ) -> Result<Self::Scalar, InternalPakeError> {
-        let mut bits = [0u8; 32];
-        bits.copy_from_slice(scalar_bits);
-        Ok(Scalar::from_bytes_mod_order(bits))
+        Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref()))
     }
     fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
         loop {
@@ -74,21 +96,7 @@ impl Group for RistrettoPoint {
     }
     // serialization of a group element
     fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
-        let c = self.compress();
-        *GenericArray::from_slice(c.as_bytes())
-    }
-
-    type UniformBytesLen = U64;
-    fn hash_to_curve(
-        uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>,
-    ) -> Result<Self, InternalPakeError> {
-        // https://caniuse.rs/features/array_gt_32_impls
-        let bits: [u8; 64] = {
-            let mut bytes = [0u8; 64];
-            bytes.copy_from_slice(uniform_bytes);
-            bytes
-        };
-        Ok(RistrettoPoint::from_uniform_bytes(&bits))
+        self.compress().to_bytes().into()
     }
 
     fn base_point() -> Self {
@@ -96,8 +104,7 @@ impl Group for RistrettoPoint {
     }
 
     fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
-        let arr: [u8; 32] = scalar.as_slice().try_into().expect("Wrong length");
-        self * Scalar::from_bits(arr)
+        self * Scalar::from_bits(*scalar.as_ref())
     }
 
     /// Returns if the group element is equal to the identity (1)
@@ -106,6 +113,6 @@ impl Group for RistrettoPoint {
     }
 
     fn ct_equal(&self, other: &Self) -> bool {
-        constant_time_eq::constant_time_eq(&self.to_arr(), &other.to_arr())
+        ConstantTimeEq::ct_eq(self, other).into()
     }
 }

src/lib.rs

@@ -832,8 +832,6 @@ pub mod hash;
 
 pub mod group;
 
-pub mod map_to_curve;
-
 pub mod key_exchange;
 pub mod keypair;
 

src/opaque.rs

@@ -13,7 +13,6 @@ use crate::{
     hash::Hash,
     key_exchange::traits::{FromBytes, KeyExchange, ToBytesWithPointers},
     keypair::{KeyPair, PrivateKey, PublicKey, SecretKey},
-    map_to_curve::GroupWithMapToCurve,
     oprf,
     serialization::{serialize, tokenize},
     slow_hash::SlowHash,
@@ -1011,7 +1010,7 @@ impl<CS: CipherSuite> Drop for ServerLogin<CS> {
 
 // Helper functions
 
-fn get_password_derived_key<G: GroupWithMapToCurve, SH: SlowHash<D>, D: Hash>(
+fn get_password_derived_key<G: Group, SH: SlowHash<D>, D: Hash>(
     token: &oprf::Token<G>,
     beta: G,
 ) -> Result<Vec<u8>, ProtocolError> {
@@ -1019,7 +1018,7 @@ fn get_password_derived_key<G: GroupWithMapToCurve, SH: SlowHash<D>, D: Hash>(
     SH::hash(oprf_output).map_err(ProtocolError::from)
 }
 
-fn oprf_key_from_seed<G: GroupWithMapToCurve, D: Hash>(
+fn oprf_key_from_seed<G: Group, D: Hash>(
     oprf_seed: &GenericArray<u8, D::OutputSize>,
     credential_identifier: &[u8],
 ) -> Result<G::Scalar, ProtocolError> {

src/oprf.rs

@@ -3,10 +3,7 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-use crate::{
-    errors::ProtocolError, group::Group, hash::Hash, map_to_curve::GroupWithMapToCurve,
-    serialization::serialize,
-};
+use crate::{errors::ProtocolError, group::Group, hash::Hash, serialization::serialize};
 use digest::Digest;
 use generic_array::GenericArray;
 use rand::{CryptoRng, RngCore};
@@ -29,7 +26,7 @@ static MODE_BASE: u8 = 0x00;
 /// message is sent from the client (who holds the input) to the server (who holds the OPRF key).
 /// The client can also pass in an optional "pepper" string to be mixed in with the input through
 /// an HKDF computation.
-pub(crate) fn blind<R: RngCore + CryptoRng, G: GroupWithMapToCurve, H: Hash>(
+pub(crate) fn blind<R: RngCore + CryptoRng, G: Group, H: Hash>(
     input: &[u8],
     blinding_factor_rng: &mut R,
 ) -> Result<(Token<G>, G), ProtocolError> {
@@ -55,7 +52,7 @@ pub(crate) fn evaluate<G: Group>(point: G, oprf_key: &G::Scalar) -> G {
 
 /// Computes the third step for the multiplicative blinding version of DH-OPRF, in which
 /// the client unblinds the server's message.
-pub(crate) fn finalize<G: GroupWithMapToCurve, H: Hash>(
+pub(crate) fn finalize<G: Group, H: Hash>(
     input: &[u8],
     blind: &G::Scalar,
     evaluated_element: G,
@@ -64,7 +61,7 @@ pub(crate) fn finalize<G: GroupWithMapToCurve, H: Hash>(
     finalize_after_unblind::<G, H>(input, unblinded_element)
 }
 
-fn finalize_after_unblind<G: GroupWithMapToCurve, H: Hash>(
+fn finalize_after_unblind<G: Group, H: Hash>(
     input: &[u8],
     unblinded_element: G,
 ) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, ProtocolError> {
@@ -85,7 +82,7 @@ fn finalize_after_unblind<G: GroupWithMapToCurve, H: Hash>(
 #[cfg(feature = "bench")]
 #[doc(hidden)]
 #[inline]
-pub fn blind_shim<R: RngCore + CryptoRng, G: GroupWithMapToCurve, H: Hash>(
+pub fn blind_shim<R: RngCore + CryptoRng, G: Group, H: Hash>(
     input: &[u8],
     blinding_factor_rng: &mut R,
 ) -> Result<(Token<G>, G), ProtocolError> {
@@ -102,7 +99,7 @@ pub fn evaluate_shim<G: Group>(point: G, oprf_key: &G::Scalar) -> G {
 #[cfg(feature = "bench")]
 #[doc(hidden)]
 #[inline]
-pub fn finalize_shim<G: GroupWithMapToCurve, H: Hash>(
+pub fn finalize_shim<G: Group, H: Hash>(
     token: &Token<G>,
     point: G,
 ) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, ProtocolError> {

src/tests/voprf_test_vectors.rs

@@ -3,8 +3,8 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
+use crate::group::Group;
 use crate::hash::Hash;
-use crate::map_to_curve::GroupWithMapToCurve;
 use crate::tests::mock_rng::CycleRng;
 use crate::{errors::*, oprf};
 use curve25519_dalek::ristretto::RistrettoPoint;
@@ -106,7 +106,7 @@ fn tests() -> Result<(), ProtocolError> {
 }
 
 // Tests input -> blind, blinded_element
-fn test_blind<G: GroupWithMapToCurve, H: Hash>(tvs: &[&str]) -> Result<(), ProtocolError> {
+fn test_blind<G: Group, H: Hash>(tvs: &[&str]) -> Result<(), ProtocolError> {
     for tv in tvs {
         let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
         let mut rng = CycleRng::new(parameters.blind.to_vec());
@@ -123,7 +123,7 @@ fn test_blind<G: GroupWithMapToCurve, H: Hash>(tvs: &[&str]) -> Result<(), Proto
 }
 
 // Tests sksm, blinded_element -> evaluation_element
-fn test_evaluate<G: GroupWithMapToCurve>(tvs: &[&str]) -> Result<(), PakeError> {
+fn test_evaluate<G: Group>(tvs: &[&str]) -> Result<(), PakeError> {
     for tv in tvs {
         let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
         let evaluation_element = oprf::evaluate::<G>(
@@ -140,7 +140,7 @@ fn test_evaluate<G: GroupWithMapToCurve>(tvs: &[&str]) -> Result<(), PakeError>
 }
 
 // Tests input, blind, evaluation_element -> output
-fn test_finalize<G: GroupWithMapToCurve, H: Hash>(tvs: &[&str]) -> Result<(), ProtocolError> {
+fn test_finalize<G: Group, H: Hash>(tvs: &[&str]) -> Result<(), ProtocolError> {
     for tv in tvs {
         let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());