Check for small subgroup components when using the EdwardsPoint group for the OPRF

A malicious attacker sending a small point could lead the server / user to leak private information. The check avoiding mixed order points (rather than just small) is prohibitively expensive, and I don't know how an attacker would extract any data from that => we focus on a small order check. Fixes #34.
2020-08-24 14:50:29 -04:00
parent c2edb2d95e
commit 29ba1b93b5
3 changed files with 74 additions and 2 deletions
@@ -31,6 +31,7 @@ x25519-dalek = { version = "0.6.0", default-features = false, features = ["std"]
 zeroize = "1.1"

 [dev-dependencies]
+anyhow = "1.0.32"
 base64 = "0.12.3"
 criterion = "0.3.3"
 hex = "0.4.2"