vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Using voprf as a dependency (#248)

Browse Source 
* Using voprf as a dependency

* Adding back x25519 and KeGroup

* Addressing comments
This commit is contained in:
Kevin Lewi
2021-10-25 02:54:32 -07:00
committed by GitHub
parent f1f4184400
commit 29b2ebef1b
34 changed files with 1638 additions and 2452 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/key_exchange/tripledh.rs
+49 -65
View File
@@ -10,10 +10,10 @@ use crate::{
utils::{check_slice_size, check_slice_size_atleast},
InternalError, ProtocolError,
},
group::Group,
hash::Hash,
key_exchange::traits::{
FromBytes, GenerateKe2Result, GenerateKe3Result, KeyExchange, ToBytes, ToBytesWithPointers,
key_exchange::{
group::KeGroup,
traits::{FromBytes, GenerateKe2Result, GenerateKe3Result, KeyExchange, ToBytes},
},
keypair::{KeyPair, PrivateKey, PublicKey, SecretKey},
serialization::serialize,
@@ -55,26 +55,26 @@ pub struct TripleDH;
/// The client state produced after the first key exchange message
#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
pub struct Ke1State<G: Group> {
client_e_sk: PrivateKey<G>,
pub struct Ke1State<KG: KeGroup> {
client_e_sk: PrivateKey<KG>,
client_nonce: GenericArray<u8, NonceLen>,
}
impl_clone_for!(
struct Ke1State<G: Group>,
struct Ke1State<KG: KeGroup>,
[client_e_sk, client_nonce],
);
impl_debug_eq_hash_for!(
struct Ke1State<G: Group>,
struct Ke1State<KG: KeGroup>,
[client_e_sk, client_nonce],
);
/// The first key exchange message
#[derive(PartialEq, Eq, Debug, Hash, Clone)]
#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
pub struct Ke1Message<G: Group> {
pub struct Ke1Message<KG: KeGroup> {
pub(crate) client_nonce: GenericArray<u8, NonceLen>,
pub(crate) client_e_pk: PublicKey<G>,
pub(crate) client_e_pk: PublicKey<KG>,
}
/// The server state produced after the second key exchange message
@@ -91,9 +91,9 @@ pub struct Ke2State<HashLen: ArrayLength<u8>> {
#[derive(Clone, Debug, Eq, Hash, PartialEq)]
#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
#[cfg_attr(feature = "serialize", serde(bound = ""))]
pub struct Ke2Message<G: Group, HashLen: ArrayLength<u8>> {
pub struct Ke2Message<KG: KeGroup, HashLen: ArrayLength<u8>> {
server_nonce: GenericArray<u8, NonceLen>,
server_e_pk: PublicKey<G>,
server_e_pk: PublicKey<KG>,
mac: GenericArray<u8, HashLen>,
}
@@ -110,17 +110,17 @@ pub struct Ke3Message<HashLen: ArrayLength<u8>> {
// ========================== //
////////////////////////////////
impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
type KE1State = Ke1State<G>;
impl<D: Hash, KG: KeGroup> KeyExchange<D, KG> for TripleDH {
type KE1State = Ke1State<KG>;
type KE2State = Ke2State<<D as FixedOutput>::OutputSize>;
type KE1Message = Ke1Message<G>;
type KE2Message = Ke2Message<G, <D as FixedOutput>::OutputSize>;
type KE1Message = Ke1Message<KG>;
type KE2Message = Ke2Message<KG, <D as FixedOutput>::OutputSize>;
type KE3Message = Ke3Message<<D as FixedOutput>::OutputSize>;
fn generate_ke1<R: RngCore + CryptoRng>(
rng: &mut R,
) -> Result<(Self::KE1State, Self::KE1Message), ProtocolError> {
let client_e_kp = KeyPair::<G>::generate_random(rng);
let client_e_kp = KeyPair::<KG>::generate_random(rng)?;
let client_nonce = generate_nonce::<R>(rng);
let ke1_message = Ke1Message {
@@ -138,18 +138,19 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
}
#[allow(clippy::type_complexity)]
fn generate_ke2<R: RngCore + CryptoRng, S: SecretKey<G>>(
fn generate_ke2<R: RngCore + CryptoRng, S: SecretKey<KG>>(
rng: &mut R,
serialized_credential_request: Vec<u8>,
l2_bytes: Vec<u8>,
ke1_message: Self::KE1Message,
client_s_pk: PublicKey<G>,
client_s_pk: PublicKey<KG>,
server_s_sk: S,
id_u: Vec<u8>,
id_s: Vec<u8>,
context: Vec<u8>,
) -> Result<GenerateKe2Result<Self, D, G>, ProtocolError<S::Error>> {
let server_e_kp = KeyPair::<G>::generate_random(rng);
) -> Result<GenerateKe2Result<Self, D, KG>, ProtocolError<S::Error>> {
let server_e_kp =
KeyPair::<KG>::generate_random(rng).map_err(|_| InternalError::InvalidKeypairError)?;
let server_nonce = generate_nonce::<R>(rng);
let mut transcript_hasher = D::new()
@@ -162,7 +163,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
.chain(&server_nonce[..])
.chain(&server_e_kp.public().to_arr());
let result = derive_3dh_keys::<D, G, S>(
let result = derive_3dh_keys::<D, KG, S>(
TripleDHComponents {
pk1: ke1_message.client_e_pk.clone(),
sk1: server_e_kp.private().clone(),
@@ -205,12 +206,12 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
ke2_message: Self::KE2Message,
ke1_state: &Self::KE1State,
serialized_credential_request: &[u8],
server_s_pk: PublicKey<G>,
client_s_sk: PrivateKey<G>,
server_s_pk: PublicKey<KG>,
client_s_sk: PrivateKey<KG>,
id_u: Vec<u8>,
id_s: Vec<u8>,
context: Vec<u8>,
) -> Result<GenerateKe3Result<Self, D, G>, ProtocolError> {
) -> Result<GenerateKe3Result<Self, D, KG>, ProtocolError> {
let mut transcript_hasher = D::new()
.chain(STR_RFC)
.chain(&serialize(&context, 2)?)
@@ -220,7 +221,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
.chain(&l2_component[..])
.chain(&ke2_message.to_bytes_without_info_or_mac());
let result = derive_3dh_keys::<D, G, PrivateKey<G>>(
let result = derive_3dh_keys::<D, KG, PrivateKey<KG>>(
TripleDHComponents {
pk1: ke2_message.server_e_pk.clone(),
sk1: ke1_state.client_e_sk.clone(),
@@ -275,7 +276,7 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
}
fn ke2_message_size() -> usize {
NonceLen::USIZE + <G as Group>::ElemLen::USIZE + <D as FixedOutput>::OutputSize::USIZE
NonceLen::USIZE + <KG as KeGroup>::PkLen::USIZE + <D as FixedOutput>::OutputSize::USIZE
}
}
@@ -286,13 +287,13 @@ impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
#[allow(clippy::upper_case_acronyms)]
// The triple of public and private components used in the 3DH computation
struct TripleDHComponents<G: Group, S: SecretKey<G>> {
pk1: PublicKey<G>,
sk1: PrivateKey<G>,
pk2: PublicKey<G>,
struct TripleDHComponents<KG: KeGroup, S: SecretKey<KG>> {
pk1: PublicKey<KG>,
sk1: PrivateKey<KG>,
pk2: PublicKey<KG>,
sk2: S,
pk3: PublicKey<G>,
sk3: PrivateKey<G>,
pk3: PublicKey<KG>,
sk3: PrivateKey<KG>,
}
// Consists of a session key, followed by two mac keys: (session_key, km2, km3)
@@ -320,8 +321,8 @@ type TripleDHDerivationResult<D> = (
// Internal function which takes the public and private components of the client and server keypairs, along
// with some auxiliary metadata, to produce the session key and two MAC keys
fn derive_3dh_keys<D: Hash, G: Group, S: SecretKey<G>>(
dh: TripleDHComponents<G, S>,
fn derive_3dh_keys<D: Hash, KG: KeGroup, S: SecretKey<KG>>(
dh: TripleDHComponents<KG, S>,
hashed_derivation_transcript: &[u8],
) -> Result<TripleDHDerivationResult<D>, ProtocolError<S::Error>> {
let ikm: Vec<u8> = [
@@ -430,9 +431,9 @@ fn generate_nonce<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Nonce
// Serialization and deserialization implementations
impl<G: Group> FromBytes for Ke1State<G> {
impl<KG: KeGroup> FromBytes for Ke1State<KG> {
fn from_bytes<CS: CipherSuite>(bytes: &[u8]) -> Result<Self, ProtocolError> {
let key_len = <G as Group>::ElemLen::USIZE;
let key_len = <KG as KeGroup>::PkLen::USIZE;
let nonce_len = NonceLen::USIZE;
let checked_bytes = check_slice_size_atleast(bytes, key_len + nonce_len, "ke1_state")?;
@@ -446,27 +447,19 @@ impl<G: Group> FromBytes for Ke1State<G> {
}
}
impl<G: Group> ToBytesWithPointers for Ke1State<G> {
impl<KG: KeGroup> ToBytes for Ke1State<KG> {
fn to_bytes(&self) -> Vec<u8> {
let output: Vec<u8> = [&self.client_e_sk.to_arr(), &self.client_nonce[..]].concat();
output
}
#[cfg(test)]
fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
vec![
(self.client_e_sk.as_ptr(), G::ScalarLen::USIZE),
(self.client_nonce.as_ptr(), NonceLen::USIZE),
]
}
}
impl<G: Group> FromBytes for Ke1Message<G> {
impl<KG: KeGroup> FromBytes for Ke1Message<KG> {
fn from_bytes<CS: CipherSuite>(ke1_message_bytes: &[u8]) -> Result<Self, ProtocolError> {
let nonce_len = NonceLen::USIZE;
let checked_nonce = check_slice_size(
ke1_message_bytes,
nonce_len + <G as Group>::ElemLen::USIZE,
nonce_len + <KG as KeGroup>::PkLen::USIZE,
"ke1_message nonce",
)?;
@@ -477,7 +470,7 @@ impl<G: Group> FromBytes for Ke1Message<G> {
}
}
impl<G: Group> ToBytes for Ke1Message<G> {
impl<KG: KeGroup> ToBytes for Ke1Message<KG> {
fn to_bytes(&self) -> Vec<u8> {
[&self.client_nonce[..], &self.client_e_pk.to_arr()].concat()
}
@@ -498,7 +491,7 @@ impl<HashLen: ArrayLength<u8>> FromBytes for Ke2State<HashLen> {
}
}
impl<HashLen: ArrayLength<u8>> ToBytesWithPointers for Ke2State<HashLen> {
impl<HashLen: ArrayLength<u8>> ToBytes for Ke2State<HashLen> {
fn to_bytes(&self) -> Vec<u8> {
[
&self.km3[..],
@@ -507,20 +500,11 @@ impl<HashLen: ArrayLength<u8>> ToBytesWithPointers for Ke2State<HashLen> {
]
.concat()
}
#[cfg(test)]
fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
vec![
(self.km3.as_ptr(), HashLen::USIZE),
(self.hashed_transcript.as_ptr(), HashLen::USIZE),
(self.session_key.as_ptr(), HashLen::USIZE),
]
}
}
impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
impl<KG: KeGroup, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<KG, HashLen> {
fn from_bytes<CS: CipherSuite>(input: &[u8]) -> Result<Self, ProtocolError> {
let key_len = <G as Group>::ElemLen::USIZE;
let key_len = <KG as KeGroup>::PkLen::USIZE;
let nonce_len = NonceLen::USIZE;
let checked_nonce = check_slice_size_atleast(input, nonce_len, "ke2_message nonce")?;
@@ -536,7 +520,7 @@ impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
)?;
// Check the public key bytes
let server_e_pk = KeyPair::<CS::OprfGroup>::check_public_key(PublicKey::from_bytes(
let server_e_pk = KeyPair::<CS::KeGroup>::check_public_key(PublicKey::from_bytes(
&unchecked_server_e_pk[..key_len],
)?)?;
@@ -548,13 +532,13 @@ impl<G: Group, HashLen: ArrayLength<u8>> FromBytes for Ke2Message<G, HashLen> {
}
}
impl<G: Group, HashLen: ArrayLength<u8>> ToBytes for Ke2Message<G, HashLen> {
impl<KG: KeGroup, HashLen: ArrayLength<u8>> ToBytes for Ke2Message<KG, HashLen> {
fn to_bytes(&self) -> Vec<u8> {
[&self.to_bytes_without_info_or_mac(), &self.mac[..]].concat()
}
}
impl<G: Group, HashLen: ArrayLength<u8>> Ke2Message<G, HashLen> {
impl<KG: KeGroup, HashLen: ArrayLength<u8>> Ke2Message<KG, HashLen> {
fn to_bytes_without_info_or_mac(&self) -> Vec<u8> {
[&self.server_nonce[..], &self.server_e_pk.to_arr()].concat()
}
@@ -579,14 +563,14 @@ impl<HashLen: ArrayLength<u8>> ToBytes for Ke3Message<HashLen> {
// Zeroize on drop implementations
// This can't be derived because of the use of a generic parameter
impl<G: Group> Zeroize for Ke1State<G> {
impl<KG: KeGroup> Zeroize for Ke1State<KG> {
fn zeroize(&mut self) {
self.client_e_sk.zeroize();
self.client_nonce.zeroize();
}
}
impl<G: Group> Drop for Ke1State<G> {
impl<KG: KeGroup> Drop for Ke1State<KG> {
fn drop(&mut self) {
self.zeroize();
}