Using voprf as a dependency (#248)

* Using voprf as a dependency * Adding back x25519 and KeGroup * Addressing comments
2021-10-25 02:54:32 -07:00
parent f1f4184400
commit 29b2ebef1b
34 changed files with 1638 additions and 2452 deletions
@@ -0,0 +1,39 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Includes the KeGroup trait and definitions for the
+//! key exchange groups
+
+use crate::errors::InternalError;
+use generic_array::{ArrayLength, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// A group representation for use in the key exchange
+pub trait KeGroup: Sized + Clone {
+    /// Length of the public key
+    type PkLen: ArrayLength<u8> + 'static;
+    /// Length of the secret key
+    type SkLen: ArrayLength<u8> + 'static;
+
+    /// Return a public key from its fixed-length bytes representation
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError>;
+
+    /// Generate a random secret key
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen>;
+
+    /// Return a public key from its secret key
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self;
+
+    /// Serializes `self`
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen>;
+
+    /// Diffie-Hellman key exchange
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen>;
+}
+
+#[cfg(feature = "p256")]
+pub mod p256;
+pub mod ristretto255;
+pub mod x25519;
@@ -0,0 +1,47 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for p256
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use generic_array::typenum::{U32, U33};
+use generic_array::GenericArray;
+use rand::{CryptoRng, RngCore};
+
+impl KeGroup for p256_::ProjectivePoint {
+    type PkLen = U33;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        use p256_::elliptic_curve::group::GroupEncoding;
+
+        Option::from(Self::from_bytes(element_bits)).ok_or(InternalError::PointError)
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        use p256_::elliptic_curve::Field;
+
+        p256_::Scalar::random(rng).into()
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        Self::generator() * p256_::Scalar::from_bytes_reduced(sk)
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        use p256_::elliptic_curve::sec1::ToEncodedPoint;
+
+        let bytes = self.to_affine().to_encoded_point(true);
+        let bytes = bytes.as_bytes();
+        let mut result = GenericArray::default();
+        result[..bytes.len()].copy_from_slice(bytes);
+        result
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * &p256_::Scalar::from_bytes_reduced(sk)).to_arr()
+    }
+}
@@ -0,0 +1,63 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for ristretto255
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
+use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
+use curve25519_dalek::scalar::Scalar;
+use generic_array::typenum::U32;
+use generic_array::GenericArray;
+use rand::{CryptoRng, RngCore};
+
+impl KeGroup for RistrettoPoint {
+    type PkLen = U32;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        CompressedRistretto::from_slice(element_bits)
+            .decompress()
+            .ok_or(InternalError::PointError)
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar.to_bytes().into();
+            }
+        }
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        RISTRETTO_BASEPOINT_POINT * Scalar::from_bits(*sk.as_ref())
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        self.compress().to_bytes().into()
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * Scalar::from_bits(*sk.as_ref())).to_arr()
+    }
+}
@@ -0,0 +1,154 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Key Exchange group implementation for x25519
+
+use super::KeGroup;
+use crate::errors::InternalError;
+use curve25519_dalek::{constants::X25519_BASEPOINT, montgomery::MontgomeryPoint, scalar::Scalar};
+use generic_array::{typenum::U32, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// The implementation of such a subgroup for Ristretto
+impl KeGroup for MontgomeryPoint {
+    type PkLen = U32;
+    type SkLen = U32;
+
+    fn from_pk_slice(element_bits: &GenericArray<u8, Self::PkLen>) -> Result<Self, InternalError> {
+        Ok(Self(*element_bits.as_ref()))
+    }
+
+    fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Self::SkLen> {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break GenericArray::clone_from_slice(&scalar.to_bytes());
+            }
+        }
+    }
+
+    fn public_key(sk: &GenericArray<u8, Self::SkLen>) -> Self {
+        X25519_BASEPOINT * Scalar::from_bits(*sk.as_ref())
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::PkLen> {
+        self.to_bytes().into()
+    }
+
+    fn diffie_hellman(&self, sk: &GenericArray<u8, Self::SkLen>) -> GenericArray<u8, Self::PkLen> {
+        (self * Scalar::from_bits(*sk.as_ref())).to_arr()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::errors::ProtocolError;
+
+    #[test]
+    fn test_x25519() -> Result<(), ProtocolError> {
+        use crate::{
+            key_exchange::tripledh::TripleDH, slow_hash::NoOpHash, CipherSuite, ClientLogin,
+            ClientLoginFinishParameters, ClientLoginFinishResult, ClientLoginStartResult,
+            ClientRegistration, ClientRegistrationFinishParameters, ClientRegistrationFinishResult,
+            ClientRegistrationStartResult, ServerLogin, ServerLoginStartParameters,
+            ServerLoginStartResult, ServerRegistration, ServerSetup,
+        };
+        use curve25519_dalek::ristretto::RistrettoPoint;
+        use rand::rngs::OsRng;
+
+        struct X25519Sha512NoSlowHash;
+        impl CipherSuite for X25519Sha512NoSlowHash {
+            type OprfGroup = RistrettoPoint;
+            type KeGroup = MontgomeryPoint;
+            type KeyExchange = TripleDH;
+            type Hash = sha2::Sha512;
+            type SlowHash = NoOpHash;
+        }
+
+        const PASSWORD: &[u8] = b"1234";
+
+        let server_setup = ServerSetup::<X25519Sha512NoSlowHash>::new(&mut OsRng)?;
+
+        let ClientRegistrationStartResult {
+            message,
+            state: client,
+        } = ClientRegistration::start(&mut OsRng, PASSWORD)?;
+        let message = ServerRegistration::start(&server_setup, message, &[])?.message;
+        let ClientRegistrationFinishResult {
+            message,
+            export_key: register_export_key,
+            ..
+        } = client.finish(
+            &mut OsRng,
+            message,
+            ClientRegistrationFinishParameters::default(),
+        )?;
+        let server_registration = ServerRegistration::finish(message);
+
+        let ClientLoginStartResult {
+            message,
+            state: client,
+        } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+        let ServerLoginStartResult {
+            message,
+            state: server,
+            ..
+        } = ServerLogin::start(
+            &mut OsRng,
+            &server_setup,
+            Some(server_registration),
+            message,
+            &[],
+            ServerLoginStartParameters::default(),
+        )?;
+        let ClientLoginFinishResult {
+            message,
+            session_key: client_session_key,
+            export_key: login_export_key,
+            ..
+        } = client.finish(message, ClientLoginFinishParameters::default())?;
+        let server_session_key = server.finish(message)?.session_key;
+
+        assert_eq!(register_export_key, login_export_key);
+        assert_eq!(client_session_key, server_session_key);
+
+        let ClientLoginStartResult {
+            message,
+            state: client,
+        } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+        let ServerLoginStartResult { message, .. } = ServerLogin::start(
+            &mut OsRng,
+            &server_setup,
+            None,
+            message,
+            &[],
+            ServerLoginStartParameters::default(),
+        )?;
+
+        assert!(matches!(
+            client.finish(message, ClientLoginFinishParameters::default()),
+            Err(ProtocolError::InvalidLoginError)
+        ));
+
+        Ok(())
+    }
+}