Using voprf as a dependency (#248)

* Using voprf as a dependency * Adding back x25519 and KeGroup * Addressing comments
2021-10-25 02:54:32 -07:00
parent f1f4184400
commit 29b2ebef1b
34 changed files with 1638 additions and 2452 deletions
@@ -12,7 +12,6 @@ use crate::{
 use alloc::string::ToString;
 use alloc::vec;
 use alloc::vec::Vec;
-use core::slice::from_raw_parts;
 use curve25519_dalek::{ristretto::RistrettoPoint, traits::Identity};
 use rand::rngs::OsRng;
 use serde_json::Value;
@@ -71,38 +70,38 @@ static STR_CREDENTIAL_IDENTIFIER: &str = "credential_identifier";
 // To regenerate, run: cargo test -- --nocapture generate_test_vectors
 static TEST_VECTOR: &str = r#"
 {
-    "client_s_pk": "520364faf278ac5b407465c8a802ac57bf61ec4bbf3e1c508a39e1667c7cf904",
-    "client_s_sk": "e30c1ca67d865b65333bd5567a3ea54c6df36d1641953ca4470a886e7117bf06",
-    "client_e_pk": "1c0344d0e057a1f6651d80b00e188aa35efb4844173c531d186729f81411bc24",
-    "client_e_sk": "56b7ff7a43c7d6f75d881606f733c12a53af70b35d8c5cd982a8e94a816dfa0d",
-    "server_s_pk": "bcf39fe745ca2f945c7d75b542bfe4217fe6f481c49b7ce410f4a13079cd0d2b",
-    "server_s_sk": "cd4a4916bf0226c7fa1f18c97cbf5e0c03d1ae8b74d1155270202d848f4d640e",
-    "server_e_pk": "e02644fdcb782c335c0c1f801b70f7a873bc2613e3ed2a6ad05103a85dd2ec01",
-    "server_e_sk": "b9b14238988b6ea6e6aa6e8981a65c45e28ba01ddedf9437aff62a7071a64d09",
-    "fake_sk": "55ed2b029216bd0953db96c614c737001fc9c79ad4b2c896f2aeebe052e9770a",
+    "client_s_pk": "181bbea01a5e444390c4b335f8bcb9a846a1c60042669ce6d731af4587960c06",
+    "client_s_sk": "2f21529b9fb27c8c12770b765dc36750c4a51c5ccaf2f83d0182504a85a22c0b",
+    "client_e_pk": "58a16b672e100b18069d0716715a9a8d9a643954bb24c0887e46d542eab9e417",
+    "client_e_sk": "c1a4db9d650ce1700e05fbd472d30c13e0a4c6926b114e7ca11e2e9f397c5005",
+    "server_s_pk": "dc8c66b6dcf4731836a0cdb336985c77a6321ffb75db6bb1aef20974c141dd3c",
+    "server_s_sk": "410ef173f972994eeabb2cb39fd5db907e39a1abd6b36c9f514ab903d9d16305",
+    "server_e_pk": "68630597c4593cb8158f398ab6ff956a1d87232be4300be1f96a6860663d9461",
+    "server_e_sk": "155452c6b08b889b31d5a810925136adfb2d363eee4ccaed0ef15b594fb88b04",
+    "fake_sk": "b009e67b83c418f0ae271b8790d6c5e06ea3874fa5a9e66752b5ebdbec953b04",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
-    "blinding_factor": "1d906fc19848da043a39b51b22620802d7df4f11abf994a269d7ada2cc7edd04",
-    "oprf_seed": "aee2ac3f7c043526f1cbda952f34840482a63afbf959e32f9172343d8b9fe076cd0a87a017f16e6511c37f171cea277d906d6d1dc31a3de4c0cc99c46e76c94c",
-    "masking_nonce": "62f49aa47625d01466051799e1ba6f99e1916c15fa1cc651867d1bbc55c6c5255269d21a5854a9756ffd8fc33de366da1d715c5de16609f7aa55e7e8ce01c8f5",
-    "envelope_nonce": "3cf5a62a4ce8ffe7e1da0ac2066597f1d7cd7a91285e8a108943f6beea91b1aa",
-    "client_nonce": "de58ba7427030a4792107bf9f4a9334599f4e437d97a73ae1db4f1d3f9362879",
-    "server_nonce": "50d85de8a9a6fb656981a17811db0a381dd98aa37514a90d8abf990b56829daf",
+    "blinding_factor": "544ce97b02dff0201282a44cf73171a62a76e2a113d40dce8950f31bf4339403",
+    "oprf_seed": "f929fa161a065bec163bea6dbab6d6eccd960666951fc7fd3da7cf2b6baf20a2763598aba89a4e5bcaa57096c66cfded26d683e07ab1a3b37a7c82706dfaee81",
+    "masking_nonce": "4c0099b7067c7c243ed804def0fd490babd577abcd7b05a1f24a05d2d1cc344e079a75936ed36b89a3056661a2dc981a6628edde6a86da2714cce71659d84f8d",
+    "envelope_nonce": "9888ba54ffc1e1be5deb23a2efa5432f318f9a17d681d1273e909ca3bf1b2fea",
+    "client_nonce": "652a39daf155cc9b5a005b67951f19c2ccdf4667cf7bcd39f941a87565ed4c29",
+    "server_nonce": "5e2f19069ea9791d6b346b676d8d8aaf45536148ca0357a595f330c7aed107d2",
    "context": "636f6e74657874",
-    "registration_request": "7ea276a79194704a5056d17c3e2e1751d98b1d1fc5d1d78d11004e9a44c7c52c",
-    "registration_response": "389fcdd9b327e1ad9eaa30b8ea9db665b49a52b96583c4952f087d21aa47e15abcf39fe745ca2f945c7d75b542bfe4217fe6f481c49b7ce410f4a13079cd0d2b",
-    "registration_upload": "7a1daeb91dc6af4e8685287922020dda9e4445ddb107aa76f30ef3defec982046c81af9eba7baef5e5dc3aca419a62b207542315edc732834b18fa394cbfa9c210caed864e36bb19cdd7324553b7e35d1a7384f4262a15e38049f910b2ca6baae30c1ca67d865b65333bd5567a3ea54c6df36d1641953ca4470a886e7117bf06383ff4ec0a1f237f70e51cae0f859e7476917cb8d28cda3aeccd970a205a71e20d3e592eaadabc2216d0ed14e494dbf733984e607b6d5f8b68f9b2321ca01b30",
-    "credential_request": "7ea276a79194704a5056d17c3e2e1751d98b1d1fc5d1d78d11004e9a44c7c52cde58ba7427030a4792107bf9f4a9334599f4e437d97a73ae1db4f1d3f93628791c0344d0e057a1f6651d80b00e188aa35efb4844173c531d186729f81411bc24",
-    "credential_response": "389fcdd9b327e1ad9eaa30b8ea9db665b49a52b96583c4952f087d21aa47e15a62f49aa47625d01466051799e1ba6f99e1916c15fa1cc651867d1bbc55c6c5257e7d8f435b95456607ec8767840b5c192c1132d78b38cf72511ae4605a8539f570452bbfd864a34a71b635f77c9d7dee227b7906697ab0dea2dda3043672c523a0a2c651e9bbef212e85439c8f227c564470cdb6d9a74ac8b7d2f6f3eba59b43489082c93f17f7de3c2840848e2c5db07bf4a8c5011f6ff01895bcb0a3b10ca0b9b14238988b6ea6e6aa6e8981a65c45e28ba01ddedf9437aff62a7071a64d098eaf6a09f9dd3db7e9ea307c4df21852c24fdd27bc335815afdfa03237facb0834b5d393d8b5d61526d8a61077a345a864020a10be67f46a6a6a02fd86ea05a2f25e262d9fe23bfe9489d5bc585dd4a018fa5dea295e51a7824526b6360cc03a",
-    "credential_finalization": "eefb1823d84629dc0d9e149dbb07fb115e473d0d3a004e0b2dd20fdb168a7d33423347c07960d272f1fa670f45ca8e6571d3b396661383da8f07380d89488116",
-    "client_registration_state": "7ea276a79194704a5056d17c3e2e1751d98b1d1fc5d1d78d11004e9a44c7c52c1d906fc19848da043a39b51b22620802d7df4f11abf994a269d7ada2cc7edd0470617373776f7264",
-    "client_login_state": "1d906fc19848da043a39b51b22620802d7df4f11abf994a269d7ada2cc7edd0400607ea276a79194704a5056d17c3e2e1751d98b1d1fc5d1d78d11004e9a44c7c52cde58ba7427030a4792107bf9f4a9334599f4e437d97a73ae1db4f1d3f93628791c0344d0e057a1f6651d80b00e188aa35efb4844173c531d186729f81411bc24004056b7ff7a43c7d6f75d881606f733c12a53af70b35d8c5cd982a8e94a816dfa0dde58ba7427030a4792107bf9f4a9334599f4e437d97a73ae1db4f1d3f936287970617373776f7264",
-    "server_login_state": "b54d627533bf9545c5450b4c518e4cb298b118b34383db02ceddd2178683e7201d1e3ffd5eff03bc224a75760cecd10ce0a6514ba4f638fbfc21f968398d159f5f5a78b6309646b6e9ecd5856aa109abdc53d720791f198edde539d19ee7deeb5438f6a1156476d8e11404b344c2a97db92902eb2d77d723defeb3a7d3be1c5e954c3ba56dff507f6d0de3e9c02b1fe3d8935b32fbaa4be2cf5c82225b9e47c931bb51eb04a2a5345914c33a52c3f7d5184b631fe1a5efd4633f433e408589fa",
-    "password_file": "7a1daeb91dc6af4e8685287922020dda9e4445ddb107aa76f30ef3defec982046c81af9eba7baef5e5dc3aca419a62b207542315edc732834b18fa394cbfa9c210caed864e36bb19cdd7324553b7e35d1a7384f4262a15e38049f910b2ca6baae30c1ca67d865b65333bd5567a3ea54c6df36d1641953ca4470a886e7117bf06383ff4ec0a1f237f70e51cae0f859e7476917cb8d28cda3aeccd970a205a71e20d3e592eaadabc2216d0ed14e494dbf733984e607b6d5f8b68f9b2321ca01b30",
-    "export_key": "9eaea2ca345b9fac4c7924abe5783d23ac7452d61ebb026d40ecab402178c8669b135783e5dcd148554e9d861fa4af809f1e41c1ccca929000cdb3a78a2dc4fb",
-    "session_key": "954c3ba56dff507f6d0de3e9c02b1fe3d8935b32fbaa4be2cf5c82225b9e47c931bb51eb04a2a5345914c33a52c3f7d5184b631fe1a5efd4633f433e408589fa"
+    "registration_request": "f05048bb39f3f5a3a414f50254c425b36f842162a630bf73456df453351cb33d",
+    "registration_response": "2c6f5ba3de9af2719529e9a993097e8c0ecd5110a24471414e4225950189cc46dc8c66b6dcf4731836a0cdb336985c77a6321ffb75db6bb1aef20974c141dd3c",
+    "registration_upload": "08a51d9973140af4f911f235d4910e9536503157bfaffefaeaa11f69d723cc54d35d9ae50d6a0a7ab38614e571a81821cfbfec36ed9fd46e397e173252d02ff623287035e190153e9fb88509da1c225765bb200ed59249cbfd6201656d1672db2f21529b9fb27c8c12770b765dc36750c4a51c5ccaf2f83d0182504a85a22c0b19e07582aea6c5e782b15ff18f6188203f54ea62dfb1efb77d641f030b86062c9f0d1bc3c39b7f824fe81df456c702ea4fa084eba803fea7e5a80d2284c2ff15",
+    "credential_request": "f05048bb39f3f5a3a414f50254c425b36f842162a630bf73456df453351cb33d652a39daf155cc9b5a005b67951f19c2ccdf4667cf7bcd39f941a87565ed4c2958a16b672e100b18069d0716715a9a8d9a643954bb24c0887e46d542eab9e417",
+    "credential_response": "2c6f5ba3de9af2719529e9a993097e8c0ecd5110a24471414e4225950189cc464c0099b7067c7c243ed804def0fd490babd577abcd7b05a1f24a05d2d1cc344e4100aea1aa461bed485d0e441c275d0d04388e1b6b739379cd9ebabe6a53ca025375487ea73cc17ea884fb3fd91d05a8970628459ab7996e9e20aacdc613a669a687c95479814b866c43cde2ca225f43a44035ba921b5986877589013acd8eba3f4e00bd4c5e83756651c5faa0319487e4b80bcedfef82b9e46c3cace5b4aa8e155452c6b08b889b31d5a810925136adfb2d363eee4ccaed0ef15b594fb88b04605c82fb3bb14125d8274619e5ceef90151b6309610aa35c2c0a004337c44b50162d27726ed40aca064e88cff1413d7098f81b16567919ca8d9c425b8b3445684e2ad7e7d8d14475c2ca1ace56a5949199fb836f9f343d46994098955bb9f129",
+    "credential_finalization": "e13284ada3e78eed48047934115ce7e6c2cdff0c3012e9ba2d423759c4000ddf11ecd186dd7f0740ee3413ff0d253e2437eced56f3717e45c071b170d12db1dd",
+    "client_registration_state": "0028544ce97b02dff0201282a44cf73171a62a76e2a113d40dce8950f31bf433940370617373776f72640020f05048bb39f3f5a3a414f50254c425b36f842162a630bf73456df453351cb33d",
+    "client_login_state": "0028544ce97b02dff0201282a44cf73171a62a76e2a113d40dce8950f31bf433940370617373776f72640060f05048bb39f3f5a3a414f50254c425b36f842162a630bf73456df453351cb33d652a39daf155cc9b5a005b67951f19c2ccdf4667cf7bcd39f941a87565ed4c2958a16b672e100b18069d0716715a9a8d9a643954bb24c0887e46d542eab9e4170040c1a4db9d650ce1700e05fbd472d30c13e0a4c6926b114e7ca11e2e9f397c5005652a39daf155cc9b5a005b67951f19c2ccdf4667cf7bcd39f941a87565ed4c29",
+    "server_login_state": "2a009e5881454a2b42fb8c039762f78828c5b4ba7008d2e57b16ffdc937ee846b56461f9cda751b2a1c2b03793d72d5ca8c482adf8009880779323e64e12eb1d4c0cf45ec665be918cb9d655f9eca974494f0f4c0f6e714c6ddcca37b547c122cf7419984e123fa4c7981212e5171b01bfd6f8ac88e7964c8da4a88b5df4f2c85da5318465cef76fbddd389ff36be66c693cfc6feecbcf43bf16a22c97de8430e824b2812449934d13fb666b24de78a007f1fc06064304b0abfae3fc5caba7f6",
+    "password_file": "08a51d9973140af4f911f235d4910e9536503157bfaffefaeaa11f69d723cc54d35d9ae50d6a0a7ab38614e571a81821cfbfec36ed9fd46e397e173252d02ff623287035e190153e9fb88509da1c225765bb200ed59249cbfd6201656d1672db2f21529b9fb27c8c12770b765dc36750c4a51c5ccaf2f83d0182504a85a22c0b19e07582aea6c5e782b15ff18f6188203f54ea62dfb1efb77d641f030b86062c9f0d1bc3c39b7f824fe81df456c702ea4fa084eba803fea7e5a80d2284c2ff15",
+    "export_key": "ea8d1f871a3c8ad5d2a7a2d647e020105a33f8b8534055c56ab4bae2b8467d22806968159f918d9c31098602790fcad3e5969f1d8ff0b90b48c26b4132877ed4",
+    "session_key": "5da5318465cef76fbddd389ff36be66c693cfc6feecbcf43bf16a22c97de8430e824b2812449934d13fb666b24de78a007f1fc06064304b0abfae3fc5caba7f6"
 }
 "#;

@@ -272,19 +271,20 @@ fn stringify_test_vectors(p: &TestVectorParameters) -> alloc::string::String {
    s
 }

-fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
-    use crate::{group::Group, key_exchange::tripledh::NonceLen, keypair::KeyPair};
+fn generate_parameters<CS: CipherSuite>() -> Result<TestVectorParameters, ProtocolError> {
+    use crate::{key_exchange::tripledh::NonceLen, keypair::KeyPair};
    use generic_array::typenum::Unsigned;
    use rand::RngCore;
+    use voprf::group::Group;

    let mut rng = OsRng;

    // Inputs
-    let server_s_kp = KeyPair::<CS::OprfGroup>::generate_random(&mut rng);
-    let server_e_kp = KeyPair::<CS::OprfGroup>::generate_random(&mut rng);
-    let client_s_kp = KeyPair::<CS::OprfGroup>::generate_random(&mut rng);
-    let client_e_kp = KeyPair::<CS::OprfGroup>::generate_random(&mut rng);
-    let fake_kp = KeyPair::<CS::OprfGroup>::generate_random(&mut rng);
+    let server_s_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng)?;
+    let server_e_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng)?;
+    let client_s_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng)?;
+    let client_e_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng)?;
+    let fake_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng)?;
    let credential_identifier = b"credIdentifier";
    let id_u = b"idU";
    let id_s = b"idS";
@@ -313,18 +313,19 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
    let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_bytes.to_vec());
    let client_registration_start_result =
        ClientRegistration::<CS>::start(&mut blinding_factor_registration_rng, password).unwrap();
-    let blinding_factor_bytes_returned =
-        CS::OprfGroup::scalar_as_bytes(client_registration_start_result.state.token.blind);
+    let blinding_factor_bytes_returned = CS::OprfGroup::scalar_as_bytes(
+        client_registration_start_result
+            .state
+            .oprf_client
+            .get_blind(),
+    );
    assert_eq!(
        hex::encode(&blinding_factor_bytes),
        hex::encode(&blinding_factor_bytes_returned)
    );

-    let registration_request_bytes = client_registration_start_result
-        .message
-        .serialize()
-        .to_vec();
-    let client_registration_state = client_registration_start_result.state.serialize().to_vec();
+    let registration_request_bytes = client_registration_start_result.message.serialize()?;
+    let client_registration_state = client_registration_start_result.state.serialize()?;

    let server_registration_start_result = ServerRegistration::<CS>::start(
        &server_setup,
@@ -332,10 +333,7 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
        &credential_identifier[..],
    )
    .unwrap();
-    let registration_response_bytes = server_registration_start_result
-        .message
-        .serialize()
-        .to_vec();
+    let registration_response_bytes = server_registration_start_result.message.serialize()?;

    let mut client_s_sk_and_nonce: Vec<u8> = Vec::new();
    client_s_sk_and_nonce.extend_from_slice(&client_s_kp.private().to_arr());
@@ -356,13 +354,10 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
            ),
        )
        .unwrap();
-    let registration_upload_bytes = client_registration_finish_result
-        .message
-        .serialize()
-        .to_vec();
+    let registration_upload_bytes = client_registration_finish_result.message.serialize()?;

    let password_file = ServerRegistration::finish(client_registration_finish_result.message);
-    let password_file_bytes = password_file.serialize();
+    let password_file_bytes = password_file.serialize()?;

    let mut client_login_start: Vec<u8> = Vec::new();
    client_login_start.extend_from_slice(&blinding_factor_bytes);
@@ -372,7 +367,7 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
    let mut client_login_start_rng = CycleRng::new(client_login_start);
    let client_login_start_result =
        ClientLogin::<CS>::start(&mut client_login_start_rng, password).unwrap();
-    let credential_request_bytes = client_login_start_result.message.serialize().to_vec();
+    let credential_request_bytes = client_login_start_result.message.serialize()?;
    let client_login_state = client_login_start_result
        .state
        .serialize()
@@ -399,8 +394,8 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
        ),
    )
    .unwrap();
-    let credential_response_bytes = server_login_start_result.message.serialize().to_vec();
-    let server_login_state = server_login_start_result.state.serialize().to_vec();
+    let credential_response_bytes = server_login_start_result.message.serialize()?;
+    let server_login_state = server_login_start_result.state.serialize()?;

    let client_login_finish_result = client_login_start_result
        .state
@@ -416,9 +411,9 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
            ),
        )
        .unwrap();
-    let credential_finalization_bytes = client_login_finish_result.message.serialize();
+    let credential_finalization_bytes = client_login_finish_result.message.serialize()?;

-    TestVectorParameters {
+    Ok(TestVectorParameters {
        client_s_pk: client_s_kp.public().to_arr().to_vec(),
        client_s_sk: client_s_kp.private().to_arr().to_vec(),
        client_e_pk: client_e_kp.public().to_arr().to_vec(),
@@ -451,13 +446,14 @@ fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters {
        server_login_state,
        session_key: client_login_finish_result.session_key,
        export_key: client_registration_finish_result.export_key.to_vec(),
-    }
+    })
 }

 #[test]
-fn generate_test_vectors() {
-    let parameters = generate_parameters::<RistrettoSha5123dhNoSlowHash>();
+fn generate_test_vectors() -> Result<(), ProtocolError> {
+    let parameters = generate_parameters::<RistrettoSha5123dhNoSlowHash>()?;
    println!("{}", stringify_test_vectors(&parameters));
+    Ok(())
 }

 #[test]
@@ -468,11 +464,11 @@ fn test_registration_request() -> Result<(), ProtocolError> {
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(&mut rng, &parameters.password)?;
    assert_eq!(
        hex::encode(&parameters.registration_request),
-        hex::encode(client_registration_start_result.message.serialize())
+        hex::encode(client_registration_start_result.message.serialize()?)
    );
    assert_eq!(
        hex::encode(&parameters.client_registration_state),
-        hex::encode(client_registration_start_result.state.serialize())
+        hex::encode(client_registration_start_result.state.serialize()?)
    );
    Ok(())
 }
@@ -490,13 +486,13 @@ fn test_serialization() -> Result<(), ProtocolError> {
            serde_json::to_string(&client_registration_start_result.message).unwrap();
        assert_eq!(
            registration_request_json,
-            r#""fqJ2p5GUcEpQVtF8Pi4XUdmLHR/F0deNEQBOmkTHxSw=""#
+            r#""8FBIuznz9aOkFPUCVMQls2+EIWKmML9zRW30UzUcsz0=""#
        );
        let registration_request: RegistrationRequest<RistrettoSha5123dhNoSlowHash> =
            serde_json::from_str(&registration_request_json).unwrap();
        assert_eq!(
-            hex::encode(client_registration_start_result.message.serialize()),
-            hex::encode(registration_request.serialize()),
+            hex::encode(client_registration_start_result.message.serialize()?),
+            hex::encode(registration_request.serialize()?),
        );
    }
    {
@@ -507,15 +503,17 @@ fn test_serialization() -> Result<(), ProtocolError> {
        let registration_request: RegistrationRequest<RistrettoSha5123dhNoSlowHash> =
            bincode::deserialize(&registration_request_bin).unwrap();
        assert_eq!(
-            hex::encode(client_registration_start_result.message.serialize()),
-            hex::encode(registration_request.serialize()),
+            hex::encode(client_registration_start_result.message.serialize()?),
+            hex::encode(registration_request.serialize()?),
        );
    }
    Ok(())
 }
 #[test]
 fn test_registration_response() -> Result<(), ProtocolError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
+    let parameters = populate_test_vectors(
+        &serde_json::from_str(TEST_VECTOR).map_err(|_| ProtocolError::SerializationError)?,
+    );

    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::deserialize(
        &[
@@ -534,14 +532,16 @@ fn test_registration_response() -> Result<(), ProtocolError> {
        )?;
    assert_eq!(
        hex::encode(parameters.registration_response),
-        hex::encode(server_registration_start_result.message.serialize())
+        hex::encode(server_registration_start_result.message.serialize()?)
    );
    Ok(())
 }

 #[test]
 fn test_registration_upload() -> Result<(), ProtocolError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
+    let parameters = populate_test_vectors(
+        &serde_json::from_str(TEST_VECTOR).map_err(|_| ProtocolError::SerializationError)?,
+    );

    let client_s_sk_and_nonce: Vec<u8> =
        [parameters.client_s_sk, parameters.envelope_nonce].concat();
@@ -563,7 +563,7 @@ fn test_registration_upload() -> Result<(), ProtocolError> {

    assert_eq!(
        hex::encode(parameters.registration_upload),
-        hex::encode(result.message.serialize())
+        hex::encode(result.message.serialize()?)
    );
    assert_eq!(
        hex::encode(parameters.export_key),
@@ -585,7 +585,7 @@ fn test_password_file() -> Result<(), ProtocolError> {

    assert_eq!(
        hex::encode(parameters.password_file),
-        hex::encode(password_file.serialize())
+        hex::encode(password_file.serialize()?)
    );
    Ok(())
 }
@@ -607,7 +607,7 @@ fn test_credential_request() -> Result<(), ProtocolError> {
    )?;
    assert_eq!(
        hex::encode(&parameters.credential_request),
-        hex::encode(client_login_start_result.message.serialize())
+        hex::encode(client_login_start_result.message.serialize()?)
    );
    assert_eq!(
        hex::encode(&parameters.client_login_state),
@@ -654,11 +654,11 @@ fn test_credential_response() -> Result<(), ProtocolError> {
    )?;
    assert_eq!(
        hex::encode(&parameters.credential_response),
-        hex::encode(server_login_start_result.message.serialize())
+        hex::encode(server_login_start_result.message.serialize()?)
    );
    assert_eq!(
        hex::encode(&parameters.server_login_state),
-        hex::encode(server_login_start_result.state.serialize())
+        hex::encode(server_login_start_result.state.serialize()?)
    );
    Ok(())
 }
@@ -694,7 +694,7 @@ fn test_credential_finalization() -> Result<(), ProtocolError> {
    );
    assert_eq!(
        hex::encode(&parameters.credential_finalization),
-        hex::encode(client_login_finish_result.message.serialize())
+        hex::encode(client_login_finish_result.message.serialize()?)
    );
    assert_eq!(
        hex::encode(&parameters.export_key),
@@ -730,7 +730,7 @@ fn test_complete_flow(
    let credential_identifier = b"credentialIdentifier";
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -810,11 +810,8 @@ fn test_zeroize_client_registration_start() -> Result<(), ProtocolError> {
        )?;

    let mut state = client_registration_start_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.to_vec() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -825,7 +822,7 @@ fn test_zeroize_client_registration_start() -> Result<(), ProtocolError> {
 fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -844,11 +841,8 @@ fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
    )?;

    let mut state = client_registration_finish_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.to_vec() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -859,7 +853,7 @@ fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
 fn test_zeroize_server_registration_finish() -> Result<(), ProtocolError> {
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -879,11 +873,8 @@ fn test_zeroize_server_registration_finish() -> Result<(), ProtocolError> {
    let p_file = ServerRegistration::finish(client_registration_finish_result.message);

    let mut state = p_file;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.serialize() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -899,11 +890,8 @@ fn test_zeroize_client_login_start() -> Result<(), ProtocolError> {
    )?;

    let mut state = client_login_start_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.to_vec() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -914,7 +902,7 @@ fn test_zeroize_client_login_start() -> Result<(), ProtocolError> {
 fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -946,11 +934,8 @@ fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
    )?;

    let mut state = server_login_start_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.serialize() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -961,7 +946,7 @@ fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
 fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -997,11 +982,8 @@ fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
    )?;

    let mut state = client_login_finish_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.to_vec() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -1012,7 +994,7 @@ fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
 fn test_zeroize_server_login_finish() -> Result<(), ProtocolError> {
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &mut client_rng,
@@ -1051,11 +1033,8 @@ fn test_zeroize_server_login_finish() -> Result<(), ProtocolError> {
        .finish(client_login_finish_result.message)?;

    let mut state = server_login_finish_result.state;
-    let ptrs = state.as_byte_ptrs();
-    state.zeroize();
-
-    for (ptr, len) in ptrs {
-        let bytes = unsafe { from_raw_parts(ptr, len) };
+    Zeroize::zeroize(&mut state);
+    for bytes in state.serialize() {
        assert!(bytes.iter().all(|&x| x == 0));
    }

@@ -1076,7 +1055,23 @@ fn test_scalar_always_nonzero() -> Result<(), ProtocolError> {
        RistrettoPoint::identity(),
        client_registration_start_result
            .message
-            .get_alpha_for_testing()
+            .get_blinded_element_for_testing()
+            .value(),
+    );
+
+    // Start out with a bunch of zeros to force resampling of scalar
+    let mut client_login_rng = CycleRng::new([vec![0u8; 128], vec![1u8; 128]].concat());
+    let client_login_start_result = ClientLogin::<RistrettoSha5123dhNoSlowHash>::start(
+        &mut client_login_rng,
+        STR_PASSWORD.as_bytes(),
+    )?;
+
+    assert_ne!(
+        RistrettoPoint::identity(),
+        client_login_start_result
+            .message
+            .get_blinded_element_for_testing()
+            .value(),
    );

    Ok(())
@@ -1088,12 +1083,13 @@ fn test_reflected_value_error_registration() -> Result<(), ProtocolError> {
    let password = b"password";
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(&mut client_rng, password)?;
    let alpha = client_registration_start_result
        .message
-        .get_alpha_for_testing();
+        .get_blinded_element_for_testing()
+        .value();
    let server_registration_start_result =
        ServerRegistration::<RistrettoSha5123dhNoSlowHash>::start(
            &server_setup,
@@ -1103,7 +1099,7 @@ fn test_reflected_value_error_registration() -> Result<(), ProtocolError> {

    let reflected_registration_response = server_registration_start_result
        .message
-        .set_beta_for_testing(alpha);
+        .set_evaluation_element_for_testing(alpha);

    let client_registration_finish_result = client_registration_start_result.state.finish(
        &mut client_rng,
@@ -1125,7 +1121,7 @@ fn test_reflected_value_error_login() -> Result<(), ProtocolError> {
    let password = b"password";
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
-    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng);
+    let server_setup = ServerSetup::<RistrettoSha5123dhNoSlowHash>::new(&mut server_rng)?;
    let client_registration_start_result =
        ClientRegistration::<RistrettoSha5123dhNoSlowHash>::start(&mut client_rng, password)?;
    let server_registration_start_result =
@@ -1142,7 +1138,10 @@ fn test_reflected_value_error_login() -> Result<(), ProtocolError> {
    let p_file = ServerRegistration::finish(client_registration_finish_result.message);
    let client_login_start_result =
        ClientLogin::<RistrettoSha5123dhNoSlowHash>::start(&mut client_rng, password)?;
-    let alpha = client_login_start_result.message.get_alpha_for_testing();
+    let alpha = client_login_start_result
+        .message
+        .get_blinded_element_for_testing()
+        .value();
    let server_login_start_result = ServerLogin::<RistrettoSha5123dhNoSlowHash>::start(
        &mut server_rng,
        &server_setup,
@@ -1154,7 +1153,7 @@ fn test_reflected_value_error_login() -> Result<(), ProtocolError> {

    let reflected_credential_response = server_login_start_result
        .message
-        .set_beta_for_testing(alpha);
+        .set_evaluation_element_for_testing(alpha);

    let client_login_result = client_login_start_result.state.finish(
        reflected_credential_response,