Using voprf as a dependency (#248)

* Using voprf as a dependency

* Adding back x25519 and KeGroup

* Addressing comments

src/key_exchange/group/mod.rs

@@ -0,0 +1,39 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Includes the KeGroup trait and definitions for the
+//! key exchange groups
+
+use crate::errors::InternalError;
+use generic_array::{ArrayLength, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// A group representation for use in the key exchange
+pub trait KeGroup: Sized + Clone {
+    /// Length of the public key
+    type PkLen: ArrayLength<u8> + 'static;
+    /// Length of the secret key
+    type SkLen: ArrayLength<u8> + 'static;
+
+    /// Return a public key from its fixed-length bytes representation
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError>;
+
+    /// Generate a random secret key
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen>;
+
+    /// Return a public key from its secret key
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self;
+
+    /// Serializes `self`
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen>;
+
+    /// Diffie-Hellman key exchange
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen>;
+}
+
+#[cfg(feature = "p256")]
+pub mod p256;
+pub mod ristretto255;
+pub mod x25519;

src/key_exchange/group/p256.rs

@@ -0,0 +1,47 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for p256
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use generic_array::typenum::{U32, U33};
+use generic_array::GenericArray;
+use rand::{CryptoRng, RngCore};
+
+impl KeGroup for p256_::ProjectivePoint {
+    type PkLen = U33;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        use p256_::elliptic_curve::group::GroupEncoding;
+
+        Option::from(Self::from_bytes(element_bits)).ok_or(InternalError::PointError)
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        use p256_::elliptic_curve::Field;
+
+        p256_::Scalar::random(rng).into()
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        Self::generator() * p256_::Scalar::from_bytes_reduced(sk)
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        use p256_::elliptic_curve::sec1::ToEncodedPoint;
+
+        let bytes = self.to_affine().to_encoded_point(true);
+        let bytes = bytes.as_bytes();
+        let mut result = GenericArray::default();
+        result[..bytes.len()].copy_from_slice(bytes);
+        result
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * &p256_::Scalar::from_bytes_reduced(sk)).to_arr()
+    }
+}

src/key_exchange/group/ristretto255.rs

@@ -0,0 +1,63 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for ristretto255
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
+use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
+use curve25519_dalek::scalar::Scalar;
+use generic_array::typenum::U32;
+use generic_array::GenericArray;
+use rand::{CryptoRng, RngCore};
+
+impl KeGroup for RistrettoPoint {
+    type PkLen = U32;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        CompressedRistretto::from_slice(element_bits)
+            .decompress()
+            .ok_or(InternalError::PointError)
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar.to_bytes().into();
+            }
+        }
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        RISTRETTO_BASEPOINT_POINT * Scalar::from_bits(*sk.as_ref())
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        self.compress().to_bytes().into()
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * Scalar::from_bits(*sk.as_ref())).to_arr()
+    }
+}

src/key_exchange/group/x25519.rs

@@ -0,0 +1,154 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for x25519
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use curve25519_dalek::{constants::X25519_BASEPOINT, montgomery::MontgomeryPoint, scalar::Scalar};
+use generic_array::{typenum::U32, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// The implementation of such a subgroup for Ristretto
+impl KeGroup for MontgomeryPoint {
+    type PkLen = U32;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        Ok(Self(*element_bits.as_ref()))
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break GenericArray::clone_from_slice(&scalar.to_bytes());
+            }
+        }
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        X25519_BASEPOINT * Scalar::from_bits(*sk.as_ref())
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        self.to_bytes().into()
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * Scalar::from_bits(*sk.as_ref())).to_arr()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::errors::ProtocolError;
+
+    #[test]
+    fn test_x25519() -> Result<(), ProtocolError> {
+        use crate::{
+            key_exchange::tripledh::TripleDH, slow_hash::NoOpHash, CipherSuite, ClientLogin,
+            ClientLoginFinishParameters, ClientLoginFinishResult, ClientLoginStartResult,
+            ClientRegistration, ClientRegistrationFinishParameters, ClientRegistrationFinishResult,
+            ClientRegistrationStartResult, ServerLogin, ServerLoginStartParameters,
+            ServerLoginStartResult, ServerRegistration, ServerSetup,
+        };
+        use curve25519_dalek::ristretto::RistrettoPoint;
+        use rand::rngs::OsRng;
+
+        struct X25519Sha512NoSlowHash;
+        impl CipherSuite for X25519Sha512NoSlowHash {
+            type OprfGroup = RistrettoPoint;
+            type KeGroup = MontgomeryPoint;
+            type KeyExchange = TripleDH;
+            type Hash = sha2::Sha512;
+            type SlowHash = NoOpHash;
+        }
+
+        const PASSWORD: &[u8] = b"1234";
+
+        let server_setup = ServerSetup::<X25519Sha512NoSlowHash>::new(&mut OsRng)?;
+
+        let ClientRegistrationStartResult {
+            message,
+            state: client,
+        } = ClientRegistration::start(&mut OsRng, PASSWORD)?;
+        let message = ServerRegistration::start(&server_setup, message, &[])?.message;
+        let ClientRegistrationFinishResult {
+            message,
+            export_key: register_export_key,
+            ..
+        } = client.finish(
+            &mut OsRng,
+            message,
+            ClientRegistrationFinishParameters::default(),
+        )?;
+        let server_registration = ServerRegistration::finish(message);
+
+        let ClientLoginStartResult {
+            message,
+            state: client,
+        } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+        let ServerLoginStartResult {
+            message,
+            state: server,
+            ..
+        } = ServerLogin::start(
+            &mut OsRng,
+            &server_setup,
+            Some(server_registration),
+            message,
+            &[],
+            ServerLoginStartParameters::default(),
+        )?;
+        let ClientLoginFinishResult {
+            message,
+            session_key: client_session_key,
+            export_key: login_export_key,
+            ..
+        } = client.finish(message, ClientLoginFinishParameters::default())?;
+        let server_session_key = server.finish(message)?.session_key;
+
+        assert_eq!(register_export_key, login_export_key);
+        assert_eq!(client_session_key, server_session_key);
+
+        let ClientLoginStartResult {
+            message,
+            state: client,
+        } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+        let ServerLoginStartResult { message, .. } = ServerLogin::start(
+            &mut OsRng,
+            &server_setup,
+            None,
+            message,
+            &[],
+            ServerLoginStartParameters::default(),
+        )?;
+
+        assert!(matches!(
+            client.finish(message, ClientLoginFinishParameters::default()),
+            Err(ProtocolError::InvalidLoginError)
+        ));
+
+        Ok(())
+    }
+}

src/key_exchange/mod.rs

@@ -6,5 +6,6 @@
 //! Includes instantiations of key exchange protocols used in the
 //! login step for OPAQUE
 
+pub mod group;
 pub(crate) mod traits;
 pub mod tripledh;

src/key_exchange/traits.rs

@@ -3,10 +3,10 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
+use crate::key_exchange::group::KeGroup;
 use crate::{
     ciphersuite::CipherSuite,
     errors::ProtocolError,
-    group::Group,
     hash::Hash,
     keypair::{PrivateKey, PublicKey, SecretKey},
 };
@@ -36,9 +36,9 @@ pub type GenerateKe3Result<K, D, G> = (
     generic_array::GenericArray<u8, <D as digest::Digest>::OutputSize>,
 );
 
-pub trait KeyExchange<D: Hash, G: Group> {
-    type KE1State: FromBytes + ToBytesWithPointers + Zeroize + Clone;
-    type KE2State: FromBytes + ToBytesWithPointers + Zeroize + Clone;
+pub trait KeyExchange<D: Hash, G: KeGroup> {
+    type KE1State: FromBytes + ToBytes + Zeroize + Clone;
+    type KE2State: FromBytes + ToBytes + Zeroize + Clone;
     type KE1Message: FromBytes + ToBytes + Clone;
     type KE2Message: FromBytes + ToBytes + Clone;
     type KE3Message: FromBytes + ToBytes + Clone;
@@ -89,11 +89,3 @@ pub trait FromBytes: Sized {
 pub trait ToBytes {
     fn to_bytes(&self) -> Vec<u8>;
 }
-
-pub trait ToBytesWithPointers {
-    fn to_bytes(&self) -> Vec<u8>;
-
-    // Only used for tests to grab raw pointers to data
-    #[cfg(test)]
-    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)>;
-}

src/key_exchange/tripledh.rs

@@ -10,10 +10,10 @@ use crate::{
         utils::{check_slice_size, check_slice_size_atleast},
         InternalError, ProtocolError,
     },
-    group::Group,
     hash::Hash,
-    key_exchange::traits::{
-        FromBytes, GenerateKe2Result, GenerateKe3Result, KeyExchange, ToBytes, ToBytesWithPointers,
+    key_exchange::{
+        group::KeGroup,
+        traits::{FromBytes, GenerateKe2Result, GenerateKe3Result, KeyExchange, ToBytes},
     },
     keypair::{KeyPair, PrivateKey, PublicKey, SecretKey},
     serialization::serialize,
@@ -55,26 +55,26 @@ pub struct TripleDH;
 
 /// The client state produced after the first key exchange message
 #[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
-pub struct Ke1State<G: Group> {
-    client_e_sk: PrivateKey<G>,
+pub struct Ke1State<KG: KeGroup> {
+    client_e_sk: PrivateKey<KG>,
     client_nonce: GenericArray<u8, NonceLen>,
 }
 
 impl_clone_for!(
-    struct Ke1State<G: Group>,
+    struct Ke1State<KG: KeGroup>,
     [client_e_sk, client_nonce],
 );
 impl_debug_eq_hash_for!(
-    struct Ke1State<G: Group>,
+    struct Ke1State<KG: KeGroup>,
     [client_e_sk, client_nonce],
 );
 
 /// The first key exchange message
 #[derive(PartialEq, Eq, Debug, Hash, Clone)]
 #[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
-pub struct Ke1Message<G: Group> {
+pub struct Ke1Message<KG: KeGroup> {
     pub(crate) client_nonce: GenericArray<u8, NonceLen>,
-    pub(crate) client_e_pk: PublicKey<G>,
+    pub(crate) client_e_pk: PublicKey<KG>,
 }
 
 /// The server state produced after the second key exchange message
@@ -91,9 +91,9 @@ pub struct Ke2State<HashLen: ArrayLength<u8>> {
 #[derive(Clone, Debug, Eq, Hash, PartialEq)]
 #[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
 #[cfg_attr(feature = "serialize", serde(bound = ""))]
-pub struct Ke2Message<G: Group, HashLen: ArrayLength<u8>> {
+pub struct Ke2Message<KG: KeGroup, HashLen: ArrayLength<u8>> {
     server_nonce: GenericArray<u8, NonceLen>,
-    server_e_pk: PublicKey<G>,
+    server_e_pk: PublicKey<KG>,
     mac: GenericArray<u8, HashLen>,
 }
 
@@ -110,17 +110,17 @@ pub struct Ke3Message<HashLen: ArrayLength<u8>> {
 // ========================== //
 ////////////////////////////////
 
-impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
-    type KE1State = Ke1State<G>;
+impl<D: Hash, KG: KeGroup> KeyExchange<D, KG> for TripleDH {
+    type KE1State = Ke1State<KG>;
     type KE2State = Ke2State<<D as FixedOutput>::OutputSize>;
-    type KE1Message = Ke1Message<G>;
-    type KE2Message = Ke2Message<G, <D as FixedOutput>::OutputSize>;
+    type KE1Message = Ke1Message<KG>;
+    type KE2Message = Ke2Message<KG, <D as FixedOutput>::OutputSize>;
     type KE3Message = Ke3Message<<D as FixedOutput>::OutputSize>;
 
     fn generate_ke1<R: RngCore + CryptoRng>(
         rng: &mut R,
     ) -> Result<(Self::KE1State, Self::KE1Message), ProtocolError> {
-        let client_e_kp = KeyPair::<G>::generate_random(rng);
+        let client_e_kp = KeyPair::<KG>::generate_random(rng)?;
         let client_nonce = generate_nonce::<R>(rng);
 
         let ke1_message = Ke1Message {
@@ -138,18 +138,19 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
     }
 
     #[allow(clippy::type_complexity)]
-    fn generate_ke2<R: RngCore + CryptoRng, S: SecretKey<G>>(
+    fn generate_ke2<R: RngCore + CryptoRng, S: SecretKey<KG>>(
         rng: &mut R,
         serialized_credential_request: Vec<u8>,
         l2_bytes: Vec<u8>,
         ke1_message: Self::KE1Message,
-        client_s_pk: PublicKey<G>,
+        client_s_pk: PublicKey<KG>,
         server_s_sk: S,
         id_u: Vec<u8>,
         id_s: Vec<u8>,
         context: Vec<u8>,
-    ) -> Result<GenerateKe2Result<Self, D, G>, ProtocolError<S::Error>> {
-        let server_e_kp = KeyPair::<G>::generate_random(rng);
+    ) -> Result<GenerateKe2Result<Self, D, KG>, ProtocolError<S::Error>> {
+        let server_e_kp =
+            KeyPair::<KG>::generate_random(rng).map_err(|_| InternalError::InvalidKeypairError)?;
         let server_nonce = generate_nonce::<R>(rng);
 
         let mut transcript_hasher = D::new()
@@ -162,7 +163,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
             .chain(&server_nonce[..])
             .chain(&server_e_kp.public().to_arr());
 
-        let result = derive_3dh_keys::<D, G, S>(
+        let result = derive_3dh_keys::<D, KG, S>(
             TripleDHComponents {
                 pk1: ke1_message.client_e_pk.clone(),
                 sk1: server_e_kp.private().clone(),
@@ -205,12 +206,12 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
         ke2_message: Self::KE2Message,
         ke1_state: &Self::KE1State,
         serialized_credential_request: &[u8],
-        server_s_pk: PublicKey<G>,
-        client_s_sk: PrivateKey<G>,
+        server_s_pk: PublicKey<KG>,
+        client_s_sk: PrivateKey<KG>,
         id_u: Vec<u8>,
         id_s: Vec<u8>,
         context: Vec<u8>,
-    ) -> Result<GenerateKe3Result<Self, D, G>, ProtocolError> {
+    ) -> Result<GenerateKe3Result<Self, D, KG>, ProtocolError> {
         let mut transcript_hasher = D::new()
             .chain(STR_RFC)
             .chain(&serialize(&context, 2)?)
@@ -220,7 +221,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
             .chain(&l2_component[..])
             .chain(&ke2_message.to_bytes_without_info_or_mac());
 
-        let result = derive_3dh_keys::<D, G, PrivateKey<G>>(
+        let result = derive_3dh_keys::<D, KG, PrivateKey<KG>>(
             TripleDHComponents {
                 pk1: ke2_message.server_e_pk.clone(),
                 sk1: ke1_state.client_e_sk.clone(),
@@ -275,7 +276,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
     }
 
     fn ke2_message_size() -> usize {
-        NonceLen::USIZE + <G as Group>::ElemLen::USIZE + <D as FixedOutput>::OutputSize::USIZE
+        NonceLen::USIZE + <KG as KeGroup>::PkLen::USIZE + <D as FixedOutput>::OutputSize::USIZE
     }
 }
 
@@ -286,13 +287,13 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
 
 #[allow(clippy::upper_case_acronyms)]
 // The triple of public and private components used in the 3DH computation
-struct TripleDHComponents<G: Group, S: SecretKey<G>> {
-    pk1: PublicKey<G>,
-    sk1: PrivateKey<G>,
-    pk2: PublicKey<G>,
+struct TripleDHComponents<KG: KeGroup, S: SecretKey<KG>> {
+    pk1: PublicKey<KG>,
+    sk1: PrivateKey<KG>,
+    pk2: PublicKey<KG>,
     sk2: S,
-    pk3: PublicKey<G>,
-    sk3: PrivateKey<G>,
+    pk3: PublicKey<KG>,
+    sk3: PrivateKey<KG>,
 }
 
 // Consists of a session key, followed by two mac keys: (session_key, km2, km3)
@@ -320,8 +321,8 @@ type TripleDHDerivationResult<D> = (
 
 // Internal function which takes the public and private components of the client and server keypairs, along
 // with some auxiliary metadata, to produce the session key and two MAC keys
-fn derive_3dh_keys<D: Hash, G: Group, S: SecretKey<G>>(
-    dh: TripleDHComponents<G, S>,
+fn derive_3dh_keys<D: Hash, KG: KeGroup, S: SecretKey<KG>>(
+    dh: TripleDHComponents<KG, S>,
     hashed_derivation_transcript: &[u8],
 ) -> Result<TripleDHDerivationResult<D>, ProtocolError<S::Error>> {
     let ikm: Vec<u8> = [
@@ -430,9 +431,9 @@ fn generate_nonce<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Nonce
 
 // Serialization and deserialization implementations
 
-impl<G: Group> FromBytes for Ke1State<G> {
+impl<KG: KeGroup> FromBytes for Ke1State<KG> {
     fn from_bytes<CS: CipherSuite>(bytes: &[u8]) -> Result<Self, ProtocolError> {
-        let key_len = <G as Group>::ElemLen::USIZE;
+        let key_len = <KG as KeGroup>::PkLen::USIZE;
 
         let nonce_len = NonceLen::USIZE;
         let checked_bytes = check_slice_size_atleast(bytes, key_len + nonce_len, "ke1_state")?;
@@ -446,27 +447,19 @@ impl<G: Group> FromBytes for Ke1State<G> {
     }
 }
 
-impl<G: Group> ToBytesWithPointers for Ke1State<G> {
+impl<KG: KeGroup> ToBytes for Ke1State<KG> {
     fn to_bytes(&self) -> Vec<u8> {
         let output: Vec<u8> = [&self.client_e_sk.to_arr(), &self.client_nonce[..]].concat();
         output
     }
-
-    #[cfg(test)]
-    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
-        vec![
-            (self.client_e_sk.as_ptr(), G::ScalarLen::USIZE),
-            (self.client_nonce.as_ptr(), NonceLen::USIZE),
-        ]
-    }
 }
 
-impl<G: Group> FromBytes for Ke1Message<G> {
+impl<KG: KeGroup> FromBytes for Ke1Message<KG> {
     fn from_bytes<CS: CipherSuite>(ke1_message_bytes: &[u8]) -> Result<Self, ProtocolError> {
         let nonce_len = NonceLen::USIZE;
         let checked_nonce = check_slice_size(
             ke1_message_bytes,
-            nonce_len + <G as Group>::ElemLen::USIZE,
+            nonce_len + <KG as KeGroup>::PkLen::USIZE,
             "ke1_message nonce",
         )?;
 
@@ -477,7 +470,7 @@ impl<G: Group> FromBytes for Ke1Message<G> {
     }
 }
 
-impl<G: Group> ToBytes for Ke1Message<G> {
+impl<KG: KeGroup> ToBytes for Ke1Message<KG> {
     fn to_bytes(&self) -> Vec<u8> {
         [&self.client_nonce[..], &self.client_e_pk.to_arr()].concat()
     }
@@ -498,7 +491,7 @@ impl<HashLen: ArrayLength<u8>> FromBytes for Ke2State<HashLen> {
     }
 }
 
-impl<HashLen: ArrayLength<u8>> ToBytesWithPointers for Ke2State<HashLen> {
+impl<HashLen: ArrayLength<u8>> ToBytes for Ke2State<HashLen> {
     fn to_bytes(&self) -> Vec<u8> {
         [
             &self.km3[..],
@@ -507,20 +500,11 @@ impl<HashLen: ArrayLength<u8>> ToBytesWithPointers for Ke2State<HashLen> {
         ]
         .concat()
     }
-
-    #[cfg(test)]
-    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
-        vec![
-            (self.km3.as_ptr(), HashLen::USIZE),
-            (self.hashed_transcript.as_ptr(), HashLen::USIZE),
-            (self.session_key.as_ptr(), HashLen::USIZE),
-        ]
-    }
 }
 
-impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
+impl<KG: KeGroup, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<KG, HashLen> {
     fn from_bytes<CS: CipherSuite>(input: &[u8]) -> Result<Self, ProtocolError> {
-        let key_len = <G as Group>::ElemLen::USIZE;
+        let key_len = <KG as KeGroup>::PkLen::USIZE;
         let nonce_len = NonceLen::USIZE;
         let checked_nonce = check_slice_size_atleast(input, nonce_len, "ke2_message nonce")?;
 
@@ -536,7 +520,7 @@ impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
         )?;
 
         // Check the public key bytes
-        let server_e_pk = KeyPair::<CS::OprfGroup>::check_public_key(PublicKey::from_bytes(
+        let server_e_pk = KeyPair::<CS::KeGroup>::check_public_key(PublicKey::from_bytes(
             &unchecked_server_e_pk[..key_len],
         )?)?;
 
@@ -548,13 +532,13 @@ impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
     }
 }
 
-impl<G: Group, HashLen: ArrayLength<u8>> ToBytes for Ke2Message<G, HashLen> {
+impl<KG: KeGroup, HashLen: ArrayLength<u8>> ToBytes for Ke2Message<KG, HashLen> {
     fn to_bytes(&self) -> Vec<u8> {
         [&self.to_bytes_without_info_or_mac(), &self.mac[..]].concat()
     }
 }
 
-impl<G: Group, HashLen: ArrayLength<u8>> Ke2Message<G, HashLen> {
+impl<KG: KeGroup, HashLen: ArrayLength<u8>> Ke2Message<KG, HashLen> {
     fn to_bytes_without_info_or_mac(&self) -> Vec<u8> {
         [&self.server_nonce[..], &self.server_e_pk.to_arr()].concat()
     }
@@ -579,14 +563,14 @@ impl<HashLen: ArrayLength<u8>> ToBytes for Ke3Message<HashLen> {
 // Zeroize on drop implementations
 
 // This can't be derived because of the use of a generic parameter
-impl<G: Group> Zeroize for Ke1State<G> {
+impl<KG: KeGroup> Zeroize for Ke1State<KG> {
     fn zeroize(&mut self) {
         self.client_e_sk.zeroize();
         self.client_nonce.zeroize();
     }
 }
 
-impl<G: Group> Drop for Ke1State<G> {
+impl<KG: KeGroup> Drop for Ke1State<KG> {
     fn drop(&mut self) {
         self.zeroize();
     }