Updating serialization for RegisterFirstMessage (#35)

src/envelope.rs

@@ -3,8 +3,9 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-use crate::errors::InternalPakeError;
+use crate::errors::{InternalPakeError, ProtocolError};
 use crate::hash::Hash;
+use crate::serialization::{serialize, tokenize};
 use digest::Digest;
 use generic_array::{
     typenum::{Unsigned, U32},
@@ -92,6 +93,31 @@ impl<D: Hash> Envelope<D> {
         [&self.nonce[..], &self.ciphertext[..], &self.hmac[..]].concat()
     }
 
+    pub(crate) fn serialize(&self) -> Vec<u8> {
+        [
+            &self.nonce[..],
+            &serialize((&self.ciphertext).to_vec(), 2)[..],
+            &serialize(vec![], 2)[..],
+            &serialize((&self.hmac).to_vec(), 2)[..],
+        ]
+        .concat()
+    }
+
+    pub(crate) fn deserialize(input: &[u8]) -> Result<(Self, Vec<u8>), ProtocolError> {
+        let nonce = &input[..NONCE_LEN];
+        let (ciphertext, remainder) = tokenize(input[NONCE_LEN..].to_vec(), 2)?;
+        let (_, remainder) = tokenize(remainder, 2)?;
+        let (hmac, remainder) = tokenize(remainder, 2)?;
+        Ok((
+            Self::new(
+                nonce.to_vec(),
+                ciphertext,
+                GenericArray::clone_from_slice(&hmac[..]),
+            ),
+            remainder,
+        ))
+    }
+
     /// Uses a key to convert the plaintext into an envelope, authenticated by the aad field.
     /// Note that a new nonce is sampled for each call to seal.
     pub(crate) fn seal<R: RngCore + CryptoRng>(

src/errors.rs

@@ -58,6 +58,8 @@ pub enum PakeError {
     KeyExchangeMacValidationError,
     /// Error in validating credentials
     InvalidLoginError,
+    /// Error with serializing / deserializing protocol messages
+    SerializationError,
 }
 
 // This is meant to express future(ly) non-trivial ways of converting the

src/lib.rs

@@ -416,6 +416,7 @@ pub mod opaque;
 pub mod ciphersuite;
 mod envelope;
 pub mod hash;
+mod serialization;
 
 mod elligator;
 pub mod group;

src/opaque.rs

@@ -15,6 +15,7 @@ use crate::{
     keypair::{KeyPair, SizedBytes},
     oprf,
     oprf::OprfClientBytes,
+    serialization::{serialize, tokenize},
     slow_hash::SlowHash,
 };
 use generic_array::{typenum::Unsigned, GenericArray};
@@ -22,6 +23,15 @@ use rand_core::{CryptoRng, RngCore};
 use std::{convert::TryFrom, marker::PhantomData};
 use zeroize::Zeroize;
 
+const REGISTRATION_REQUEST: u8 = 0x01;
+const REGISTRATION_RESPONSE: u8 = 0x02;
+const REGISTRATION_UPLOAD: u8 = 0x03;
+const CREDENTIAL_REQUEST: u8 = 0x04;
+const CREDENTIAL_RESPONSE: u8 = 0x05;
+
+const CREDENTIAL_TYPE_SKU: u8 = 0x01;
+const CREDENTIAL_TYPE_PKS: u8 = 0x03;
+
 // Messages
 // =========
 
@@ -49,11 +59,46 @@ impl<Grp: Group> TryFrom<&[u8]> for RegisterFirstMessage<Grp> {
 
 impl<Grp: Group> RegisterFirstMessage<Grp> {
     /// byte representation for the registration request
-    pub fn to_bytes(&self) -> GenericArray<u8, Grp::ElemLen> {
+    fn to_bytes(&self) -> GenericArray<u8, Grp::ElemLen> {
         self.alpha.to_arr()
     }
 }
 
+impl<Grp: Group> RegisterFirstMessage<Grp> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        let mut registration_request: Vec<u8> = Vec::new();
+        registration_request.extend_from_slice(&serialize(Vec::new(), 2));
+        registration_request.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2));
+
+        let mut output: Vec<u8> = Vec::new();
+        output.push(REGISTRATION_REQUEST);
+        output.extend_from_slice(&serialize(registration_request, 3));
+        output
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        if input[0] != REGISTRATION_REQUEST {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (data, remainder) = tokenize(input[1..].to_vec(), 3)?;
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (_, remainder) = tokenize(data, 2)?;
+        let (alpha_bytes, remainder) = tokenize(remainder, 2)?;
+
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        Self::try_from(&alpha_bytes[..])
+    }
+}
+
 /// The answer sent by the server to the user, upon reception of the
 /// registration attempt
 pub struct RegisterSecondMessage<Grp> {
@@ -86,9 +131,51 @@ where
     Grp: Group,
 {
     /// byte representation for the registration response message
-    pub fn to_bytes(&self) -> Vec<u8> {
+    fn to_bytes(&self) -> Vec<u8> {
         self.beta.to_arr().to_vec()
     }
+
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        let mut registration_response: Vec<u8> = Vec::new();
+        registration_response.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2));
+        registration_response.extend_from_slice(&serialize(Vec::new(), 2));
+
+        // TODO: The following should not be hardcoded, but instead be customizable
+        registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_SKU], 1));
+        registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_PKS], 1));
+
+        let mut output: Vec<u8> = Vec::new();
+        output.push(REGISTRATION_RESPONSE);
+        output.extend_from_slice(&serialize(registration_response, 3));
+        output
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        if input[0] != REGISTRATION_RESPONSE {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (data, remainder) = tokenize(input[1..].to_vec(), 3)?;
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (beta_bytes, remainder) = tokenize(data, 2)?;
+        let (_, remainder) = tokenize(remainder, 2)?;
+
+        // TODO: The following should affect what is placed in the envelope rather than
+        // being ignored
+        let (_, remainder) = tokenize(remainder, 1)?;
+        let (_, remainder) = tokenize(remainder, 1)?;
+
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        Self::try_from(&beta_bytes[..])
+    }
 }
 
 /// The final message from the client, containing sealed cryptographic
@@ -101,17 +188,6 @@ pub struct RegisterThirdMessage<KeyFormat: KeyPair, D: Hash> {
     client_s_pk: KeyFormat::Repr,
 }
 
-impl<KeyFormat, D> RegisterThirdMessage<KeyFormat, D>
-where
-    KeyFormat: KeyPair,
-    D: Hash,
-{
-    /// byte representation for the registration upload message
-    pub fn to_bytes(&self) -> Vec<u8> {
-        [&self.envelope.to_bytes(), &self.client_s_pk.to_arr()[..]].concat()
-    }
-}
-
 impl<KeyFormat, D> TryFrom<&[u8]> for RegisterThirdMessage<KeyFormat, D>
 where
     KeyFormat: KeyPair,
@@ -137,6 +213,48 @@ where
     }
 }
 
+impl<KeyFormat, D> RegisterThirdMessage<KeyFormat, D>
+where
+    KeyFormat: KeyPair,
+    D: Hash,
+{
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        let mut registration_upload: Vec<u8> = Vec::new();
+        registration_upload.extend_from_slice(&self.envelope.serialize());
+        registration_upload.extend_from_slice(&serialize(self.client_s_pk.to_arr().to_vec(), 2));
+
+        let mut output: Vec<u8> = Vec::new();
+        output.push(REGISTRATION_UPLOAD);
+        output.extend_from_slice(&serialize(registration_upload, 3));
+        output
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        if input[0] != REGISTRATION_UPLOAD {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (data, remainder) = tokenize(input[1..].to_vec(), 3)?;
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (envelope, remainder) = Envelope::<D>::deserialize(&data)?;
+        let (client_s_pk, remainder) = tokenize(remainder, 2)?;
+
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        Ok(Self {
+            envelope,
+            client_s_pk: KeyFormat::check_public_key(KeyFormat::Repr::from_bytes(&client_s_pk)?)?,
+        })
+    }
+}
+
 /// The message sent by the user to the server, to initiate registration
 pub struct LoginFirstMessage<CS: CipherSuite> {
     /// blinded password information
@@ -173,9 +291,41 @@ impl<CS: CipherSuite> TryFrom<&[u8]> for LoginFirstMessage<CS> {
 
 impl<CS: CipherSuite> LoginFirstMessage<CS> {
     /// byte representation for the login request
-    pub fn to_bytes(&self) -> Vec<u8> {
+    fn to_bytes(&self) -> Vec<u8> {
         [&self.alpha.to_arr()[..], &self.ke1_message.to_bytes()].concat()
     }
+
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        let mut credential_request: Vec<u8> = Vec::new();
+        credential_request.extend_from_slice(&serialize(Vec::new(), 2));
+        credential_request.extend_from_slice(&serialize((&self.alpha.to_arr()).to_vec(), 2));
+
+        let mut output: Vec<u8> = Vec::new();
+        output.push(CREDENTIAL_REQUEST);
+        output.extend_from_slice(&serialize(credential_request, 3));
+        output.extend_from_slice(&self.ke1_message.to_bytes());
+        output
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        if input[0] != CREDENTIAL_REQUEST {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (data, ke1m) = tokenize(input[1..].to_vec(), 3)?;
+
+        let (_, remainder) = tokenize(data, 2)?;
+        let (alpha_bytes, remainder) = tokenize(remainder, 2)?;
+
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let concatenated = [&alpha_bytes[..], &ke1m[..]].concat();
+        Self::try_from(&concatenated[..])
+    }
 }
 
 /// The answer sent by the server to the user, upon reception of the
@@ -189,14 +339,38 @@ pub struct LoginSecondMessage<CS: CipherSuite> {
 }
 
 impl<CS: CipherSuite> LoginSecondMessage<CS> {
-    /// byte representation for the login response
-    pub fn to_bytes(&self) -> Vec<u8> {
-        [
-            &self.beta.to_arr()[..],
-            &self.envelope.to_bytes()[..],
-            &self.ke2_message.to_bytes()[..],
-        ]
-        .concat()
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        let mut credential_response: Vec<u8> = Vec::new();
+        credential_response.extend_from_slice(&serialize((&self.beta.to_arr()).to_vec(), 2));
+        credential_response.extend_from_slice(&serialize((&self.envelope.to_bytes()).to_vec(), 2));
+        credential_response.extend_from_slice(&serialize(Vec::new(), 2));
+
+        let mut output: Vec<u8> = Vec::new();
+        output.push(CREDENTIAL_RESPONSE);
+        output.extend_from_slice(&serialize(credential_response, 3));
+        output.extend_from_slice(&self.ke2_message.to_bytes());
+        output
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        if input[0] != CREDENTIAL_RESPONSE {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let (data, ke2m) = tokenize(input[1..].to_vec(), 3)?;
+
+        let (beta_bytes, remainder) = tokenize(data, 2)?;
+        let (envelope_bytes, remainder) = tokenize(remainder, 2)?;
+        let (_, remainder) = tokenize(remainder, 2)?;
+
+        if !remainder.is_empty() {
+            return Err(PakeError::SerializationError.into());
+        }
+
+        let concatenated = [&beta_bytes[..], &envelope_bytes[..], &ke2m[..]].concat();
+        Self::try_from(&concatenated[..])
     }
 }
 

src/serialization.rs

@@ -0,0 +1,352 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::errors::PakeError;
+
+pub(crate) fn serialize(input: Vec<u8>, max_bytes: usize) -> Vec<u8> {
+    let mut output: Vec<u8> = Vec::new();
+    output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]);
+    output.extend_from_slice(&input[..]);
+    output
+}
+
+pub(crate) fn tokenize(input: Vec<u8>, size_bytes: usize) -> Result<(Vec<u8>, Vec<u8>), PakeError> {
+    if size_bytes > 8 {
+        return Err(PakeError::SerializationError);
+    }
+
+    let mut size_array = [0u8; 8];
+    for i in 0..size_bytes {
+        size_array[8 - size_bytes + i] = input[i];
+    }
+    let size = usize::from_be_bytes(size_array);
+
+    if size_bytes + size > input.len() {
+        return Err(PakeError::SerializationError);
+    }
+
+    Ok((
+        input[size_bytes..size_bytes + size].to_vec(),
+        input[size_bytes + size..].to_vec(),
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{
+        ciphersuite::CipherSuite,
+        envelope::Envelope,
+        group::Group,
+        key_exchange::{
+            traits::{KeyExchange, ToBytes},
+            tripledh::{TripleDH, NONCE_LEN},
+        },
+        keypair::{KeyPair, SizedBytes, X25519KeyPair},
+        opaque::*,
+    };
+
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use generic_array::typenum::Unsigned;
+    use proptest::{collection::vec, prelude::*};
+    use rand_core::{OsRng, RngCore};
+
+    use sha2::{Digest, Sha256};
+    use std::convert::TryFrom;
+
+    struct Default;
+    impl CipherSuite for Default {
+        type Group = RistrettoPoint;
+        type KeyFormat = crate::keypair::X25519KeyPair;
+        type KeyExchange = TripleDH;
+        type Hash = sha2::Sha256;
+        type SlowHash = crate::slow_hash::NoOpHash;
+    }
+
+    fn random_ristretto_point() -> RistrettoPoint {
+        let mut rng = OsRng;
+        let mut random_bits = [0u8; 64];
+        rng.fill_bytes(&mut random_bits);
+
+        // This is because RistrettoPoint is on an obsolete sha2 version
+        let mut bits = [0u8; 64];
+        let mut hasher = sha2::Sha512::new();
+        hasher.update(&random_bits[..]);
+        bits.copy_from_slice(&hasher.finalize());
+
+        RistrettoPoint::from_uniform_bytes(&bits)
+    }
+
+    #[test]
+    fn client_registration_roundtrip() {
+        let pw = b"hunter2";
+        let mut rng = OsRng;
+        let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
+        // serialization order: scalar, password
+        let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
+        let reg = ClientRegistration::<Default>::try_from(&bytes[..]).unwrap();
+        let reg_bytes = reg.to_bytes();
+        assert_eq!(reg_bytes, bytes);
+    }
+
+    #[test]
+    fn server_registration_roundtrip() {
+        // If we don't have envelope and client_pk, the server registration just
+        // contains the prf key
+        let mut rng = OsRng;
+        let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
+        let mut oprf_bytes: Vec<u8> = vec![];
+        oprf_bytes.extend_from_slice(sc.as_bytes());
+        let reg = ServerRegistration::<Default>::try_from(&oprf_bytes[..]).unwrap();
+        let reg_bytes = reg.to_bytes();
+        assert_eq!(reg_bytes, oprf_bytes);
+        // If we do have envelope and client pk, the server registration contains
+        // the whole kit
+        let key_len =
+            <<<Default as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
+        let envelope_size = key_len + Envelope::<sha2::Sha256>::additional_size();
+        let mut mock_envelope_bytes = vec![0u8; envelope_size];
+        rng.fill_bytes(&mut mock_envelope_bytes);
+        println!("{}", mock_envelope_bytes.len());
+        let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap();
+        // serialization order: scalar, public key, envelope
+        let mut bytes = Vec::<u8>::new();
+        bytes.extend_from_slice(sc.as_bytes());
+        bytes.extend_from_slice(&mock_client_kp.public().to_arr());
+        bytes.extend_from_slice(&mock_envelope_bytes);
+        let reg = ServerRegistration::<Default>::try_from(&bytes[..]).unwrap();
+        let reg_bytes = reg.to_bytes();
+        assert_eq!(reg_bytes, bytes);
+    }
+
+    #[test]
+    fn register_first_message_roundtrip() {
+        let pt = random_ristretto_point();
+        let pt_bytes = pt.to_arr().to_vec();
+        let header = [1, 0, 0, 36, 0, 0, 0, 32];
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&header);
+        input.extend_from_slice(pt_bytes.as_slice());
+
+        let r1 = RegisterFirstMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
+        let r1_bytes = r1.serialize();
+        assert_eq!(input, r1_bytes);
+    }
+
+    #[test]
+    fn register_second_message_roundtrip() {
+        let pt = random_ristretto_point();
+        let pt_bytes = pt.to_arr();
+        let header = [2, 0, 0, 40, 0, 32];
+        let tail = [0, 0, 1, 1, 1, 3];
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&header);
+        input.extend_from_slice(pt_bytes.as_slice());
+        input.extend_from_slice(&tail);
+
+        let r2 = RegisterSecondMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
+        let r2_bytes = r2.serialize();
+        assert_eq!(input, r2_bytes);
+    }
+
+    #[test]
+    fn register_third_message_roundtrip() {
+        let mut rng = OsRng;
+        let skp = Default::generate_random_keypair(&mut rng).unwrap();
+        let pubkey_bytes = skp.public().to_arr();
+
+        let header = [3, 0, 0, 136];
+        let intermediate = [0, 32];
+
+        let mut key = [0u8; 32];
+        rng.fill_bytes(&mut key);
+
+        let mut msg = [0u8; 32];
+        rng.fill_bytes(&mut msg);
+
+        let (envelope, _) =
+            Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&header);
+        input.extend_from_slice(&envelope.serialize());
+        input.extend_from_slice(&intermediate);
+        input.extend_from_slice(&pubkey_bytes[..]);
+
+        let r3 =
+            RegisterThirdMessage::<X25519KeyPair, sha2::Sha256>::deserialize(&input[..]).unwrap();
+        let r3_bytes = r3.serialize();
+        assert_eq!(input, r3_bytes);
+    }
+
+    #[test]
+    fn login_first_message_roundtrip() {
+        let pt = random_ristretto_point();
+        let pt_bytes = pt.to_arr().to_vec();
+        let header = [4, 0, 0, 36, 0, 0, 0, 32];
+
+        let mut rng = OsRng;
+
+        let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+        let mut client_nonce = [0u8; NONCE_LEN];
+        rng.fill_bytes(&mut client_nonce);
+
+        let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&header);
+        input.extend_from_slice(pt_bytes.as_slice());
+        input.extend_from_slice(&ke1m[..]);
+
+        let l1 = LoginFirstMessage::<Default>::deserialize(input.as_slice()).unwrap();
+        let l1_bytes = l1.serialize();
+        assert_eq!(input, l1_bytes);
+    }
+
+    #[test]
+    fn login_second_message_roundtrip() {
+        let pt = random_ristretto_point();
+        let pt_bytes = pt.to_arr().to_vec();
+        let header = [5, 0, 0, 134, 0, 32];
+
+        let mut rng = OsRng;
+        let skp = Default::generate_random_keypair(&mut rng).unwrap();
+        let pubkey_bytes = skp.public().to_arr();
+
+        let intermediate1 = [0, 96];
+        let intermediate2 = [0, 0];
+
+        let mut key = [0u8; 32];
+        rng.fill_bytes(&mut key);
+
+        let mut msg = [0u8; 32];
+        rng.fill_bytes(&mut msg);
+
+        let (envelope, _) =
+            Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
+
+        let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+        let mut mac = [0u8; 32];
+        rng.fill_bytes(&mut mac);
+        let mut server_nonce = [0u8; NONCE_LEN];
+        rng.fill_bytes(&mut server_nonce);
+
+        let ke2m: Vec<u8> = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat();
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&header);
+        input.extend_from_slice(pt_bytes.as_slice());
+        input.extend_from_slice(&intermediate1[..]);
+        input.extend_from_slice(&envelope.to_bytes());
+        input.extend_from_slice(&intermediate2[..]);
+        input.extend_from_slice(&ke2m[..]);
+
+        let l2 = LoginSecondMessage::<Default>::deserialize(input.as_slice()).unwrap();
+        let l2_bytes = l2.serialize();
+        assert_eq!(input, l2_bytes);
+    }
+
+    #[test]
+    fn client_login_roundtrip() {
+        let pw = b"hunter2";
+        let mut rng = OsRng;
+        let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
+
+        let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+        let mut client_nonce = [0u8; NONCE_LEN];
+        rng.fill_bytes(&mut client_nonce);
+
+        let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat();
+        let mut hasher = Sha256::new();
+        hasher.update(l1_data);
+        let hashed_l1 = hasher.finalize();
+
+        // serialization order: scalar, password, ke1_state
+        let bytes: Vec<u8> = [
+            &sc.as_bytes()[..],
+            &pw[..],
+            client_e_kp.public(),
+            &client_nonce,
+            hashed_l1.as_slice(),
+        ]
+        .concat();
+        let reg = ClientLogin::<Default>::try_from(&bytes[..]).unwrap();
+        let reg_bytes = reg.to_bytes();
+        assert_eq!(reg_bytes, bytes);
+    }
+
+    #[test]
+    fn ke1_message_roundtrip() {
+        let mut rng = OsRng;
+
+        let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+        let mut client_nonce = [0u8; NONCE_LEN];
+        rng.fill_bytes(&mut client_nonce);
+
+        let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
+        let reg =
+            <TripleDH as KeyExchange<sha2::Sha256, crate::keypair::X25519KeyPair>>::KE1Message::try_from(
+                ke1m[..].to_vec(),
+            )
+            .unwrap();
+        let reg_bytes = reg.to_bytes();
+        assert_eq!(reg_bytes, ke1m);
+    }
+
+    proptest! {
+
+    #[test]
+    fn test_nocrash_register_first_message(bytes in vec(any::<u8>(), 0..200)) {
+        RegisterFirstMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_register_second_message(bytes in vec(any::<u8>(), 0..200)) {
+        RegisterSecondMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_register_third_message(bytes in vec(any::<u8>(), 0..200)) {
+        RegisterThirdMessage::<crate::keypair::X25519KeyPair, sha2::Sha512>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_login_first_message(bytes in vec(any::<u8>(), 0..500)) {
+        LoginFirstMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_login_second_message(bytes in vec(any::<u8>(), 0..500)) {
+        LoginSecondMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_login_third_message(bytes in vec(any::<u8>(), 0..500)) {
+        LoginThirdMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_client_registration(bytes in vec(any::<u8>(), 0..700)) {
+        ClientRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_server_registration(bytes in vec(any::<u8>(), 0..700)) {
+        ServerRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_client_login(bytes in vec(any::<u8>(), 0..700)) {
+        ClientLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    #[test]
+    fn test_nocrash_server_login(bytes in vec(any::<u8>(), 0..700)) {
+        ServerLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
+    }
+
+    }
+}

src/tests/mod.rs

@@ -5,4 +5,3 @@
 
 pub mod mock_rng;
 mod opaque_ke_test;
-mod serialization;

src/tests/opaque_ke_test.rs

@@ -80,11 +80,11 @@ static TEST_VECTOR: &str = r#"
     "envelope_nonce": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8",
     "client_nonce": "b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572",
     "server_nonce": "a213c02274e7f20fc3b571d25e98854c5dae2cfde6c9bf228a66bf3eff3e2a97",
-    "r1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5",
-    "r2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea",
-    "r3": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29",
-    "l1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e",
-    "l2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931eab0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a",
+    "r1": "01000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5",
+    "r2": "020000280020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea000001010103",
+    "r3": "03000088b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f80020923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb400000020b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330020b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29",
+    "l1": "04000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e",
+    "l2": "050000860020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea0060b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330000a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a",
     "l3": "127144e6469e001d56237a58c8c869a8173e042bf2ff19d8331441d36ada9c3f",
     "client_registration_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0270617373776f7264",
     "client_login_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0280616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572f258311568d792d6ebecee225c0fde4512139e29a435e9f9a0b82dc3809a83ab70617373776f7264",
@@ -259,14 +259,14 @@ where
         &mut blinding_factor_registration_rng,
     )
     .unwrap();
-    let r1_bytes = r1.to_bytes().to_vec();
+    let r1_bytes = r1.serialize().to_vec();
     let blinding_factor_bytes =
         CS::Group::scalar_as_bytes(&client_registration.blinding_factor).clone();
     let client_registration_state = client_registration.to_bytes().to_vec();
 
     let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec());
     let (r2, server_registration) = ServerRegistration::<CS>::start(r1, &mut oprf_key_rng).unwrap();
-    let r2_bytes = r2.to_bytes().to_vec();
+    let r2_bytes = r2.serialize().to_vec();
     let oprf_key_bytes = CS::Group::scalar_as_bytes(&server_registration.oprf_key).clone();
     let server_registration_state = server_registration.to_bytes().to_vec();
 
@@ -278,7 +278,7 @@ where
     let (r3, export_key_registration) = client_registration
         .finish(r2, server_s_kp.public(), &mut finish_registration_rng)
         .unwrap();
-    let r3_bytes = r3.to_bytes().to_vec();
+    let r3_bytes = r3.serialize().to_vec();
 
     let password_file = server_registration.finish(r3).unwrap();
     let password_file_bytes = password_file.to_bytes();
@@ -291,7 +291,7 @@ where
     let mut client_login_start_rng = CycleRng::new(client_login_start);
     let (l1, client_login) =
         ClientLogin::<CS>::start(password, Some(pepper), &mut client_login_start_rng).unwrap();
-    let l1_bytes = l1.to_bytes().to_vec();
+    let l1_bytes = l1.serialize().to_vec();
     let client_login_state = client_login.to_bytes().to_vec();
 
     let mut server_e_sk_rng = CycleRng::new(server_e_kp.private().to_arr().to_vec());
@@ -302,7 +302,7 @@ where
         &mut server_e_sk_rng,
     )
     .unwrap();
-    let l2_bytes = l2.to_bytes().to_vec();
+    let l2_bytes = l2.serialize().to_vec();
     let server_login_state = server_login.to_bytes().to_vec();
 
     let mut client_e_sk_rng = CycleRng::new(client_e_kp.private().to_arr().to_vec());
@@ -360,7 +360,7 @@ fn test_r1() -> Result<(), PakeError> {
         &mut blinding_factor_rng,
     )
     .unwrap();
-    assert_eq!(hex::encode(&parameters.r1), hex::encode(r1.to_bytes()));
+    assert_eq!(hex::encode(&parameters.r1), hex::encode(r1.serialize()));
     assert_eq!(
         hex::encode(&parameters.client_registration_state),
         hex::encode(client_registration.to_bytes())
@@ -373,11 +373,11 @@ fn test_r2() -> Result<(), PakeError> {
     let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
     let mut oprf_key_rng = CycleRng::new(parameters.oprf_key);
     let (r2, server_registration) = ServerRegistration::<X255193dhNoSlowHash>::start(
-        RegisterFirstMessage::try_from(&parameters.r1[..]).unwrap(),
+        RegisterFirstMessage::deserialize(&parameters.r1[..]).unwrap(),
         &mut oprf_key_rng,
     )
     .unwrap();
-    assert_eq!(hex::encode(parameters.r2), hex::encode(r2.to_bytes()));
+    assert_eq!(hex::encode(parameters.r2), hex::encode(r2.serialize()));
     assert_eq!(
         hex::encode(&parameters.server_registration_state),
         hex::encode(server_registration.to_bytes())
@@ -397,13 +397,13 @@ fn test_r3() -> Result<(), PakeError> {
     )
     .unwrap()
     .finish(
-        RegisterSecondMessage::try_from(&parameters.r2[..]).unwrap(),
+        RegisterSecondMessage::deserialize(&parameters.r2[..]).unwrap(),
         &Key::try_from(&parameters.server_s_pk[..]).unwrap(),
         &mut finish_registration_rng,
     )
     .unwrap();
 
-    assert_eq!(hex::encode(parameters.r3), hex::encode(r3.to_bytes()));
+    assert_eq!(hex::encode(parameters.r3), hex::encode(r3.serialize()));
     assert_eq!(
         hex::encode(parameters.export_key),
         hex::encode(export_key_registration.to_vec())
@@ -421,7 +421,7 @@ fn test_password_file() -> Result<(), PakeError> {
     )
     .unwrap();
     let password_file = server_registration
-        .finish(RegisterThirdMessage::try_from(&parameters.r3[..]).unwrap())
+        .finish(RegisterThirdMessage::deserialize(&parameters.r3[..]).unwrap())
         .unwrap();
 
     assert_eq!(
@@ -448,7 +448,7 @@ fn test_l1() -> Result<(), PakeError> {
         &mut client_login_start_rng,
     )
     .unwrap();
-    assert_eq!(hex::encode(&parameters.l1), hex::encode(l1.to_bytes()));
+    assert_eq!(hex::encode(&parameters.l1), hex::encode(l1.serialize()));
     assert_eq!(
         hex::encode(&parameters.client_login_state),
         hex::encode(client_login.to_bytes())
@@ -464,12 +464,12 @@ fn test_l2() -> Result<(), PakeError> {
     let (l2, server_login) = ServerLogin::<X255193dhNoSlowHash>::start(
         ServerRegistration::try_from(&parameters.password_file[..]).unwrap(),
         &Key::try_from(&parameters.server_s_sk[..]).unwrap(),
-        LoginFirstMessage::<X255193dhNoSlowHash>::try_from(&parameters.l1[..]).unwrap(),
+        LoginFirstMessage::<X255193dhNoSlowHash>::deserialize(&parameters.l1[..]).unwrap(),
         &mut server_e_sk_rng,
     )
     .unwrap();
 
-    assert_eq!(hex::encode(&parameters.l2), hex::encode(l2.to_bytes()));
+    assert_eq!(hex::encode(&parameters.l2), hex::encode(l2.serialize()));
     assert_eq!(
         hex::encode(&parameters.server_login_state),
         hex::encode(server_login.to_bytes())
@@ -486,7 +486,7 @@ fn test_l3() -> Result<(), PakeError> {
         ClientLogin::<X255193dhNoSlowHash>::try_from(&parameters.client_login_state[..])
             .unwrap()
             .finish(
-                LoginSecondMessage::<X255193dhNoSlowHash>::try_from(&parameters.l2[..]).unwrap(),
+                LoginSecondMessage::<X255193dhNoSlowHash>::deserialize(&parameters.l2[..]).unwrap(),
                 &Key::try_from(&parameters.server_s_pk[..])?,
                 &mut client_e_sk_rng,
             )