General Improvements (#268)

* Move `elliptic-curve` implementation to points to allow `Zeroize`

* Simplify `Ristretto255::random_scalar` implementation

* Fix `Ristretto255` deserialization

* Remove unnecessary check in `Ristretto255::random_scalar`

* Base `X25519` implementation on `curve25519-dalek`

* Constrain public and secret key to `Copy`

* Replace manual `ZeroizeOnDrop` implementation with `derive`

* Update dependencies

* Add `warn(unused_crate_dependencies)`

* Sync crate feature naming with `voprf`

* Remove unnecessary dependency crate features

* Never produce a zero scalar

* Rename `OprfGroup` to `OprfCs`

* Rename `TripleDH` to `TripleDh`

* Remove `slow-hash` crate feature

* Rename `NoOpHash` to `Identity`

* Rename `SlowHash` to `Ksf`

* Move `KeyExchange` type definitions down

* Deserialize secret and public keys from slices

* Remove `PrivateKey::from_bytes`

* Rename `From/ToBytes` to `De/Serialize`

* Re-export `serde_` as `serde`

* Custom `De/Serialize` implementation for keys

* Remove custom `De/Serialize` implementation

* Run Taplo v0.6

src/key_exchange/group/elliptic_curve.rs

@@ -11,8 +11,7 @@ use elliptic_curve::group::cofactor::CofactorGroup;
 use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
 use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
 use elliptic_curve::{
-    AffinePoint, Curve, FieldSize, NonZeroScalar, ProjectiveArithmetic, ProjectivePoint, PublicKey,
-    Scalar, SecretKey,
+    AffinePoint, Field, FieldSize, Group, ProjectivePoint, PublicKey, Scalar, SecretKey,
 };
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
 use generic_array::GenericArray;
@@ -21,31 +20,34 @@ use rand::{CryptoRng, RngCore};
 use super::KeGroup;
 use crate::errors::InternalError;
 
-impl<G: Curve + GroupDigest + ProjectiveArithmetic> KeGroup for G
+impl<G> KeGroup for G
 where
+    G: GroupDigest,
     FieldSize<Self>: ModulusSize,
     AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
     ProjectivePoint<Self>: CofactorGroup + ToEncodedPoint<Self>,
     Scalar<Self>: FromOkm,
 {
-    type Pk = PublicKey<Self>;
+    type Pk = ProjectivePoint<Self>;
 
     type PkLen = <FieldSize<Self> as ModulusSize>::CompressedPointSize;
 
-    type Sk = SecretKey<Self>;
+    type Sk = Scalar<Self>;
 
     type SkLen = FieldSize<Self>;
 
-    fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
+    fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
         GenericArray::clone_from_slice(pk.to_encoded_point(true).as_bytes())
     }
 
-    fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
-        PublicKey::from_sec1_bytes(bytes).map_err(|_| InternalError::PointError)
+    fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
+        PublicKey::<Self>::from_sec1_bytes(bytes)
+            .map(|public_key| public_key.to_projective())
+            .map_err(|_| InternalError::PointError)
     }
 
     fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
-        SecretKey::random(rng)
+        *SecretKey::<Self>::random(rng).to_nonzero_scalar()
     }
 
     // Implements the `HashToScalar()` function
@@ -55,31 +57,31 @@ where
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         Self::hash_to_scalar::<ExpandMsgXmd<H>>(input, dst)
-            .ok()
-            .and_then(|scalar| Option::<NonZeroScalar<Self>>::from(NonZeroScalar::new(scalar)))
-            .map(SecretKey::from)
-            .ok_or(InternalError::HashToScalar)
+            .map_err(|_| InternalError::HashToScalar)
+            .and_then(|scalar| {
+                if bool::from(scalar.is_zero()) {
+                    Err(InternalError::HashToScalar)
+                } else {
+                    Ok(scalar)
+                }
+            })
     }
 
-    fn public_key(sk: &Self::Sk) -> Self::Pk {
-        sk.public_key()
+    fn public_key(sk: Self::Sk) -> Self::Pk {
+        ProjectivePoint::<Self>::generator() * sk
     }
 
-    fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
-        GenericArray::clone_from_slice(
-            (pk.to_projective() * sk.to_nonzero_scalar().as_ref())
-                .to_encoded_point(true)
-                .as_bytes(),
-        )
+    fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
+        Self::serialize_pk(pk * sk)
     }
 
-    fn zeroize_sk_on_drop(_sk: &mut Self::Sk) {}
-
-    fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
-        sk.to_be_bytes()
+    fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
+        sk.into()
     }
 
-    fn deserialize_sk(bytes: &GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError> {
-        SecretKey::from_be_bytes(bytes).map_err(|_| InternalError::PointError)
+    fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
+        SecretKey::<Self>::from_be_bytes(bytes)
+            .map(|secret_key| *secret_key.to_nonzero_scalar())
+            .map_err(|_| InternalError::PointError)
     }
 }

src/key_exchange/group/mod.rs

@@ -18,25 +18,26 @@ use digest::Digest;
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
 use generic_array::{ArrayLength, GenericArray};
 use rand::{CryptoRng, RngCore};
+use zeroize::Zeroize;
 
 use crate::errors::InternalError;
 
 /// A group representation for use in the key exchange
 pub trait KeGroup {
     /// Public key
-    type Pk: Clone;
+    type Pk: Copy + Zeroize;
     /// Length of the public key
     type PkLen: ArrayLength<u8>;
     /// Secret key
-    type Sk: Clone;
+    type Sk: Copy + Zeroize;
     /// Length of the secret key
     type SkLen: ArrayLength<u8>;
 
     /// Serializes `self`
-    fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen>;
+    fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen>;
 
     /// Return a public key from its fixed-length bytes representation
-    fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError>;
+    fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError>;
 
     /// Generate a random secret key
     fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk;
@@ -52,17 +53,14 @@ pub trait KeGroup {
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
 
     /// Return a public key from its secret key
-    fn public_key(sk: &Self::Sk) -> Self::Pk;
+    fn public_key(sk: Self::Sk) -> Self::Pk;
 
     /// Diffie-Hellman key exchange
-    fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen>;
-
-    /// Zeroize secret key on drop.
-    fn zeroize_sk_on_drop(sk: &mut Self::Sk);
+    fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen>;
 
     /// Serializes `self`
-    fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen>;
+    fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen>;
 
     /// Return a public key from its fixed-length bytes representation
-    fn deserialize_sk(bytes: &GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError>;
+    fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError>;
 }

src/key_exchange/group/ristretto255.rs

@@ -10,6 +10,7 @@
 use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
 use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
 use curve25519_dalek::scalar::Scalar;
+use curve25519_dalek::traits::Identity;
 use digest::core_api::BlockSizeUser;
 use digest::{Digest, OutputSizeUser};
 use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
@@ -17,7 +18,6 @@ use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
 use generic_array::GenericArray;
 use rand::{CryptoRng, RngCore};
 use voprf::Group;
-use zeroize::Zeroize;
 
 use super::KeGroup;
 use crate::errors::InternalError;
@@ -33,13 +33,18 @@ impl KeGroup for Ristretto255 {
     type Sk = Scalar;
     type SkLen = U32;
 
-    fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
+    fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
         pk.compress().to_bytes().into()
     }
 
-    fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
+    fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
+        if bytes.len() != 32 {
+            return Err(InternalError::PointError);
+        }
+
         CompressedRistretto::from_slice(bytes)
             .decompress()
+            .filter(|point| point != &RistrettoPoint::identity())
             .ok_or(InternalError::PointError)
     }
 
@@ -48,9 +53,7 @@ impl KeGroup for Ristretto255 {
             let scalar = {
                 #[cfg(not(test))]
                 {
-                    let mut scalar_bytes = [0u8; 64];
-                    rng.fill_bytes(&mut scalar_bytes);
-                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                    Scalar::random(rng)
                 }
 
                 // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes
@@ -63,7 +66,7 @@ impl KeGroup for Ristretto255 {
                 }
             };
 
-            if scalar != Scalar::zero() && scalar.is_canonical() {
+            if scalar != Scalar::zero() {
                 break scalar;
             }
         }
@@ -81,31 +84,38 @@ impl KeGroup for Ristretto255 {
             .map_err(|_| InternalError::HashToScalar)?
             .fill_bytes(&mut uniform_bytes);
 
-        Ok(Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()))
+        let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
+
+        if scalar == Scalar::zero() {
+            Err(InternalError::HashToScalar)
+        } else {
+            Ok(scalar)
+        }
     }
 
-    fn public_key(sk: &Self::Sk) -> Self::Pk {
+    fn public_key(sk: Self::Sk) -> Self::Pk {
         RISTRETTO_BASEPOINT_POINT * sk
     }
 
-    fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
-        Self::serialize_pk(&(pk * sk))
+    fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
+        Self::serialize_pk(pk * sk)
     }
 
-    fn zeroize_sk_on_drop(sk: &mut Self::Sk) {
-        sk.zeroize()
-    }
-
-    fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
+    fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
         sk.to_bytes().into()
     }
 
-    fn deserialize_sk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Sk, InternalError> {
-        Scalar::from_canonical_bytes((*bytes).into()).ok_or(InternalError::PointError)
+    fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
+        bytes
+            .try_into()
+            .ok()
+            .and_then(Scalar::from_canonical_bytes)
+            .filter(|scalar| scalar != &Scalar::zero())
+            .ok_or(InternalError::PointError)
     }
 }
 
-#[cfg(feature = "ristretto255_voprf")]
+#[cfg(feature = "ristretto255-voprf")]
 impl voprf::CipherSuite for Ristretto255 {
     const ID: u16 = voprf::Ristretto255::ID;
 

src/key_exchange/group/x25519.rs

@@ -7,15 +7,16 @@
 
 //! Key Exchange group implementation for X25519
 
-use curve25519_dalek_3::scalar::Scalar;
+use curve25519_dalek::constants::ED25519_BASEPOINT_TABLE;
+use curve25519_dalek::montgomery::MontgomeryPoint;
+use curve25519_dalek::scalar::Scalar;
+use curve25519_dalek::traits::Identity;
 use digest::core_api::BlockSizeUser;
 use digest::Digest;
 use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
 use generic_array::GenericArray;
 use rand::{CryptoRng, RngCore};
-use x25519_dalek::{PublicKey, StaticSecret};
-use zeroize::Zeroize;
 
 use super::KeGroup;
 use crate::errors::InternalError;
@@ -25,31 +26,30 @@ pub struct X25519;
 
 /// The implementation of such a subgroup for Ristretto
 impl KeGroup for X25519 {
-    type Pk = PublicKey;
+    type Pk = MontgomeryPoint;
     type PkLen = U32;
-    type Sk = StaticSecret;
+    type Sk = Scalar;
     type SkLen = U32;
 
-    fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
+    fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
         pk.to_bytes().into()
     }
 
-    fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
-        if **bytes == [0; 32] {
-            Err(InternalError::PointError)
-        } else {
-            Ok(PublicKey::from(<[_; 32]>::from(*bytes)))
-        }
+    fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
+        bytes
+            .try_into()
+            .ok()
+            .map(MontgomeryPoint)
+            .filter(|pk| pk != &MontgomeryPoint::identity())
+            .ok_or(InternalError::PointError)
     }
 
     fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
-        let mut scalar_bytes = [0u8; 32];
-
         loop {
-            rng.fill_bytes(&mut scalar_bytes);
+            let scalar = Scalar::random(rng);
 
-            if scalar_bytes != [0u8; 32] {
-                break StaticSecret::from(scalar_bytes);
+            if scalar != Scalar::zero() {
+                break scalar;
             }
         }
     }
@@ -66,38 +66,33 @@ impl KeGroup for X25519 {
             .map_err(|_| InternalError::HashToScalar)?
             .fill_bytes(&mut uniform_bytes);
 
-        Ok(StaticSecret::from(
-            Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()).to_bytes(),
-        ))
+        let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
+
+        if scalar == Scalar::zero() {
+            Err(InternalError::HashToScalar)
+        } else {
+            Ok(scalar)
+        }
     }
 
-    fn public_key(sk: &Self::Sk) -> Self::Pk {
-        PublicKey::from(sk)
+    fn public_key(sk: Self::Sk) -> Self::Pk {
+        (&ED25519_BASEPOINT_TABLE * &sk).to_montgomery()
     }
 
-    fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
-        sk.diffie_hellman(pk).to_bytes().into()
+    fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
+        Self::serialize_pk(sk * pk)
     }
 
-    fn zeroize_sk_on_drop(sk: &mut Self::Sk) {
-        sk.zeroize()
-    }
-
-    fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
+    fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
         sk.to_bytes().into()
     }
 
-    fn deserialize_sk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Sk, InternalError> {
-        if **bytes == [0; 32] {
-            Err(InternalError::PointError)
-        } else {
-            let sk = StaticSecret::from(<[u8; 32]>::from(*bytes));
-
-            if sk.to_bytes() == **bytes {
-                Ok(sk)
-            } else {
-                Err(InternalError::PointError)
-            }
-        }
+    fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
+        bytes
+            .try_into()
+            .ok()
+            .and_then(Scalar::from_canonical_bytes)
+            .filter(|scalar| scalar != &Scalar::zero())
+            .ok_or(InternalError::PointError)
     }
 }

src/key_exchange/traits.rs

@@ -18,39 +18,17 @@ use crate::hash::{Hash, ProxyHash};
 use crate::key_exchange::group::KeGroup;
 use crate::keypair::{PrivateKey, PublicKey, SecretKey};
 
-#[cfg(not(test))]
-pub type GenerateKe2Result<K, D, G> = (
-    <K as KeyExchange<D, G>>::KE2State,
-    <K as KeyExchange<D, G>>::KE2Message,
-);
-#[cfg(test)]
-pub type GenerateKe2Result<K, D, G> = (
-    <K as KeyExchange<D, G>>::KE2State,
-    <K as KeyExchange<D, G>>::KE2Message,
-    Output<D>,
-    Output<D>,
-);
-#[cfg(not(test))]
-pub type GenerateKe3Result<K, D, G> = (Output<D>, <K as KeyExchange<D, G>>::KE3Message);
-#[cfg(test)]
-pub type GenerateKe3Result<K, D, G> = (
-    Output<D>,
-    <K as KeyExchange<D, G>>::KE3Message,
-    Output<D>,
-    Output<D>,
-);
-
 pub trait KeyExchange<D: Hash, G: KeGroup>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
     Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
 {
-    type KE1State: FromBytes + ToBytes + ZeroizeOnDrop + Clone;
-    type KE2State: FromBytes + ToBytes + ZeroizeOnDrop + Clone;
-    type KE1Message: FromBytes + ToBytes + ZeroizeOnDrop + Clone;
-    type KE2Message: FromBytes + ToBytes + ZeroizeOnDrop + Clone;
-    type KE3Message: FromBytes + ToBytes + ZeroizeOnDrop + Clone;
+    type KE1State: Deserialize + Serialize + ZeroizeOnDrop + Clone;
+    type KE2State: Deserialize + Serialize + ZeroizeOnDrop + Clone;
+    type KE1Message: Deserialize + Serialize + ZeroizeOnDrop + Clone;
+    type KE2Message: Deserialize + Serialize + ZeroizeOnDrop + Clone;
+    type KE3Message: Deserialize + Serialize + ZeroizeOnDrop + Clone;
 
     fn generate_ke1<R: RngCore + CryptoRng>(
         rng: &mut R,
@@ -88,23 +66,45 @@ where
     ) -> Result<Output<D>, ProtocolError>;
 }
 
-pub trait FromBytes: Sized {
-    fn from_bytes(input: &[u8]) -> Result<Self, ProtocolError>;
+pub trait Deserialize: Sized {
+    fn deserialize(input: &[u8]) -> Result<Self, ProtocolError>;
 }
 
-pub trait ToBytes {
+pub trait Serialize {
     type Len: ArrayLength<u8>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len>;
+    fn serialize(&self) -> GenericArray<u8, Self::Len>;
 }
 
+#[cfg(not(test))]
+pub type GenerateKe2Result<K, D, G> = (
+    <K as KeyExchange<D, G>>::KE2State,
+    <K as KeyExchange<D, G>>::KE2Message,
+);
+#[cfg(test)]
+pub type GenerateKe2Result<K, D, G> = (
+    <K as KeyExchange<D, G>>::KE2State,
+    <K as KeyExchange<D, G>>::KE2Message,
+    Output<D>,
+    Output<D>,
+);
+#[cfg(not(test))]
+pub type GenerateKe3Result<K, D, G> = (Output<D>, <K as KeyExchange<D, G>>::KE3Message);
+#[cfg(test)]
+pub type GenerateKe3Result<K, D, G> = (
+    Output<D>,
+    <K as KeyExchange<D, G>>::KE3Message,
+    Output<D>,
+    Output<D>,
+);
+
 pub type Ke1StateLen<CS: CipherSuite> =
-    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1State as ToBytes>::Len;
+    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1State as Serialize>::Len;
 pub type Ke1MessageLen<CS: CipherSuite> =
-    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message as ToBytes>::Len;
+    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message as Serialize>::Len;
 pub type Ke2StateLen<CS: CipherSuite> =
-    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2State as ToBytes>::Len;
+    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2State as Serialize>::Len;
 pub type Ke2MessageLen<CS: CipherSuite> =
-    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message as ToBytes>::Len;
+    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message as Serialize>::Len;
 pub type Ke3MessageLen<CS: CipherSuite> =
-    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message as ToBytes>::Len;
+    <<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message as Serialize>::Len;

src/key_exchange/tripledh.rs

@@ -18,17 +18,16 @@ use generic_array::{ArrayLength, GenericArray};
 use hkdf::{Hkdf, HkdfExtract};
 use hmac::{Hmac, Mac};
 use rand::{CryptoRng, RngCore};
-use zeroize::{Zeroize, ZeroizeOnDrop};
 
 use crate::errors::utils::{check_slice_size, check_slice_size_atleast};
 use crate::errors::{InternalError, ProtocolError};
 use crate::hash::{Hash, OutputSize, ProxyHash};
 use crate::key_exchange::group::KeGroup;
 use crate::key_exchange::traits::{
-    FromBytes, GenerateKe2Result, GenerateKe3Result, KeyExchange, ToBytes,
+    Deserialize, GenerateKe2Result, GenerateKe3Result, KeyExchange, Serialize,
 };
 use crate::keypair::{KeyPair, PrivateKey, PublicKey, SecretKey};
-use crate::serialization::{Serialize, UpdateExt};
+use crate::serialization::{Input, UpdateExt};
 
 ///////////////
 // Constants //
@@ -48,71 +47,42 @@ static STR_OPAQUE: &[u8] = b"OPAQUE-";
 // ====================== //
 ////////////////////////////
 
-#[allow(clippy::upper_case_acronyms)]
 /// The Triple Diffie-Hellman key exchange implementation
-pub struct TripleDH;
+pub struct TripleDh;
 
 /// The client state produced after the first key exchange message
 #[cfg_attr(
     feature = "serde",
-    derive(serde_::Deserialize, serde_::Serialize),
-    serde(
-        bound(
-            deserialize = "KG::Sk: serde_::Deserialize<'de>",
-            serialize = "KG::Sk: serde_::Serialize",
-        ),
-        crate = "serde_"
-    )
+    derive(serde::Deserialize, serde::Serialize),
+    serde(bound = "", crate = "serde")
 )]
-#[derive_where(Clone)]
+#[derive_where(Clone, ZeroizeOnDrop)]
 #[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; KG::Sk)]
 pub struct Ke1State<KG: KeGroup> {
     client_e_sk: PrivateKey<KG>,
     client_nonce: GenericArray<u8, NonceLen>,
 }
 
-impl<KG: KeGroup> Drop for Ke1State<KG> {
-    fn drop(&mut self) {
-        self.client_nonce.zeroize();
-    }
-}
-
-impl<KG: KeGroup> ZeroizeOnDrop for Ke1State<KG> {}
-
 /// The first key exchange message
 #[cfg_attr(
     feature = "serde",
-    derive(serde_::Deserialize, serde_::Serialize),
-    serde(
-        bound(
-            deserialize = "KG::Pk: serde_::Deserialize<'de>",
-            serialize = "KG::Pk: serde_::Serialize",
-        ),
-        crate = "serde_"
-    )
+    derive(serde::Deserialize, serde::Serialize),
+    serde(bound = "", crate = "serde")
 )]
-#[derive_where(Clone)]
+#[derive_where(Clone, ZeroizeOnDrop)]
 #[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; KG::Pk)]
 pub struct Ke1Message<KG: KeGroup> {
     pub(crate) client_nonce: GenericArray<u8, NonceLen>,
     pub(crate) client_e_pk: PublicKey<KG>,
 }
 
-impl<KG: KeGroup> Drop for Ke1Message<KG> {
-    fn drop(&mut self) {
-        self.client_nonce.zeroize();
-    }
-}
-
-impl<KG: KeGroup> ZeroizeOnDrop for Ke1Message<KG> {}
-
 /// The server state produced after the second key exchange message
 #[cfg_attr(
     feature = "serde",
-    derive(serde_::Deserialize, serde_::Serialize),
-    serde(bound = "", crate = "serde_")
+    derive(serde::Deserialize, serde::Serialize),
+    serde(bound = "", crate = "serde")
 )]
-#[derive_where(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+#[derive_where(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, ZeroizeOnDrop)]
 pub struct Ke2State<D: Hash>
 where
     D::Core: ProxyHash,
@@ -124,40 +94,13 @@ where
     session_key: Output<D>,
 }
 
-impl<D: Hash> Drop for Ke2State<D>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-    fn drop(&mut self) {
-        self.km3.zeroize();
-        self.hashed_transcript.zeroize();
-        self.session_key.zeroize();
-    }
-}
-
-impl<D: Hash> ZeroizeOnDrop for Ke2State<D>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-}
-
 /// The second key exchange message
 #[cfg_attr(
     feature = "serde",
-    derive(serde_::Deserialize, serde_::Serialize),
-    serde(
-        bound(
-            deserialize = "KG::Pk: serde_::Deserialize<'de>",
-            serialize = "KG::Pk: serde_::Serialize",
-        ),
-        crate = "serde_"
-    )
+    derive(serde::Deserialize, serde::Serialize),
+    serde(bound = "", crate = "serde")
 )]
-#[derive_where(Clone)]
+#[derive_where(Clone, ZeroizeOnDrop)]
 #[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; KG::Pk)]
 pub struct Ke2Message<D: Hash, KG: KeGroup>
 where
@@ -170,33 +113,13 @@ where
     mac: Output<D>,
 }
 
-impl<D: Hash, KG: KeGroup> Drop for Ke2Message<D, KG>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-    fn drop(&mut self) {
-        self.server_nonce.zeroize();
-        self.mac.zeroize();
-    }
-}
-
-impl<D: Hash, KG: KeGroup> ZeroizeOnDrop for Ke2Message<D, KG>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-}
-
 /// The third key exchange message
 #[cfg_attr(
     feature = "serde",
-    derive(serde_::Deserialize, serde_::Serialize),
-    serde(bound = "", crate = "serde_")
+    derive(serde::Deserialize, serde::Serialize),
+    serde(bound = "", crate = "serde")
 )]
-#[derive_where(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+#[derive_where(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, ZeroizeOnDrop)]
 pub struct Ke3Message<D: Hash>
 where
     D::Core: ProxyHash,
@@ -206,31 +129,12 @@ where
     mac: Output<D>,
 }
 
-impl<D: Hash> Drop for Ke3Message<D>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-    fn drop(&mut self) {
-        self.mac.zeroize();
-    }
-}
-
-impl<D: Hash> ZeroizeOnDrop for Ke3Message<D>
-where
-    D::Core: ProxyHash,
-    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
-    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
-{
-}
-
 ////////////////////////////////
 // High-level Implementations //
 // ========================== //
 ////////////////////////////////
 
-impl<D: Hash, KG: KeGroup> KeyExchange<D, KG> for TripleDH
+impl<D: Hash, KG: KeGroup> KeyExchange<D, KG> for TripleDh
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
@@ -294,7 +198,7 @@ where
         let mut transcript_hasher = D::new()
             .chain(STR_RFC)
             .chain_iter(
-                Serialize::<U2>::from(context)
+                Input::<U2>::from(context)
                     .map_err(ProtocolError::into_custom)?
                     .iter(),
             )
@@ -303,10 +207,10 @@ where
             .chain_iter(id_s.into_iter())
             .chain_iter(l2_bytes)
             .chain(server_nonce)
-            .chain(&server_e_kp.public().to_bytes());
+            .chain(&server_e_kp.public().serialize());
 
         let result = derive_3dh_keys::<D, KG, S>(
-            TripleDHComponents {
+            TripleDhComponents {
                 pk1: ke1_message.client_e_pk.clone(),
                 sk1: server_e_kp.private().clone(),
                 pk2: ke1_message.client_e_pk.clone(),
@@ -356,7 +260,7 @@ where
     ) -> Result<GenerateKe3Result<Self, D, KG>, ProtocolError> {
         let mut transcript_hasher = D::new()
             .chain(STR_RFC)
-            .chain_iter(Serialize::<U2>::from(context)?.iter())
+            .chain_iter(Input::<U2>::from(context)?.iter())
             .chain_iter(id_u)
             .chain_iter(serialized_credential_request)
             .chain_iter(id_s)
@@ -364,7 +268,7 @@ where
             .chain(ke2_message.to_bytes_without_mac());
 
         let result = derive_3dh_keys::<D, KG, PrivateKey<KG>>(
-            TripleDHComponents {
+            TripleDhComponents {
                 pk1: ke2_message.server_e_pk.clone(),
                 sk1: ke1_state.client_e_sk.clone(),
                 pk2: server_s_pk,
@@ -422,9 +326,8 @@ where
 //==================== //
 /////////////////////////
 
-#[allow(clippy::upper_case_acronyms)]
 // The triple of public and private components used in the 3DH computation
-struct TripleDHComponents<KG: KeGroup, S: SecretKey<KG>> {
+struct TripleDhComponents<KG: KeGroup, S: SecretKey<KG>> {
     pk1: PublicKey<KG>,
     sk1: PrivateKey<KG>,
     pk2: PublicKey<KG>,
@@ -435,10 +338,9 @@ struct TripleDHComponents<KG: KeGroup, S: SecretKey<KG>> {
 
 // Consists of a session key, followed by two mac keys: (session_key, km2, km3)
 #[cfg(not(test))]
-#[allow(clippy::upper_case_acronyms)]
-type TripleDHDerivationResult<D> = (Output<D>, Output<D>, Output<D>);
+type TripleDhDerivationResult<D> = (Output<D>, Output<D>, Output<D>);
 #[cfg(test)]
-type TripleDHDerivationResult<D> = (Output<D>, Output<D>, Output<D>, Output<D>);
+type TripleDhDerivationResult<D> = (Output<D>, Output<D>, Output<D>, Output<D>);
 
 ////////////////////////////////////////////////
 // Helper functions and Trait Implementations //
@@ -451,9 +353,9 @@ type TripleDHDerivationResult<D> = (Output<D>, Output<D>, Output<D>, Output<D>);
 // and server keypairs, along with some auxiliary metadata, to produce the
 // session key and two MAC keys
 fn derive_3dh_keys<D: Hash, KG: KeGroup, S: SecretKey<KG>>(
-    dh: TripleDHComponents<KG, S>,
+    dh: TripleDhComponents<KG, S>,
     hashed_derivation_transcript: &[u8],
-) -> Result<TripleDHDerivationResult<D>, ProtocolError<S::Error>>
+) -> Result<TripleDhDerivationResult<D>, ProtocolError<S::Error>>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
@@ -529,9 +431,9 @@ where
 
     let length_u16: u16 =
         u16::try_from(OutputSize::<D>::USIZE).map_err(|_| ProtocolError::SerializationError)?;
-    let label = Serialize::<U1>::from_label(STR_OPAQUE, label)?;
+    let label = Input::<U1>::from_label(STR_OPAQUE, label)?;
     let label = label.to_array_3();
-    let context = Serialize::<U1>::from(context)?;
+    let context = Input::<U1>::from(context)?;
     let context = context.to_array_2();
 
     let hkdf_label = [
@@ -570,8 +472,8 @@ fn generate_nonce<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, Nonce
 
 // Serialization and deserialization implementations
 
-impl<KG: KeGroup> FromBytes for Ke1State<KG> {
-    fn from_bytes(bytes: &[u8]) -> Result<Self, ProtocolError> {
+impl<KG: KeGroup> Deserialize for Ke1State<KG> {
+    fn deserialize(bytes: &[u8]) -> Result<Self, ProtocolError> {
         let key_len = KG::SkLen::USIZE;
 
         let nonce_len = NonceLen::USIZE;
@@ -586,7 +488,7 @@ impl<KG: KeGroup> FromBytes for Ke1State<KG> {
     }
 }
 
-impl<KG: KeGroup> ToBytes for Ke1State<KG>
+impl<KG: KeGroup> Serialize for Ke1State<KG>
 where
     // Ke1State: KeSk + Nonce
     KG::SkLen: Add<NonceLen>,
@@ -594,13 +496,13 @@ where
 {
     type Len = Sum<KG::SkLen, NonceLen>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len> {
+    fn serialize(&self) -> GenericArray<u8, Self::Len> {
         self.client_e_sk.serialize().concat(self.client_nonce)
     }
 }
 
-impl<KG: KeGroup> FromBytes for Ke1Message<KG> {
-    fn from_bytes(ke1_message_bytes: &[u8]) -> Result<Self, ProtocolError> {
+impl<KG: KeGroup> Deserialize for Ke1Message<KG> {
+    fn deserialize(ke1_message_bytes: &[u8]) -> Result<Self, ProtocolError> {
         let nonce_len = NonceLen::USIZE;
         let checked_nonce = check_slice_size(
             ke1_message_bytes,
@@ -615,7 +517,7 @@ impl<KG: KeGroup> FromBytes for Ke1Message<KG> {
     }
 }
 
-impl<KG: KeGroup> ToBytes for Ke1Message<KG>
+impl<KG: KeGroup> Serialize for Ke1Message<KG>
 where
     // Ke1Message: Nonce + KePk
     NonceLen: Add<KG::PkLen>,
@@ -623,18 +525,18 @@ where
 {
     type Len = Sum<NonceLen, KG::PkLen>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len> {
-        self.client_nonce.concat(self.client_e_pk.to_bytes())
+    fn serialize(&self) -> GenericArray<u8, Self::Len> {
+        self.client_nonce.concat(self.client_e_pk.serialize())
     }
 }
 
-impl<D: Hash> FromBytes for Ke2State<D>
+impl<D: Hash> Deserialize for Ke2State<D>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
     Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
 {
-    fn from_bytes(input: &[u8]) -> Result<Self, ProtocolError> {
+    fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
         let hash_len = OutputSize::<D>::USIZE;
         let checked_bytes = check_slice_size(input, 3 * hash_len, "ke2_state")?;
 
@@ -648,7 +550,7 @@ where
     }
 }
 
-impl<D: Hash> ToBytes for Ke2State<D>
+impl<D: Hash> Serialize for Ke2State<D>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
@@ -660,7 +562,7 @@ where
 {
     type Len = Sum<Sum<OutputSize<D>, OutputSize<D>>, OutputSize<D>>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len> {
+    fn serialize(&self) -> GenericArray<u8, Self::Len> {
         self.km3
             .clone()
             .concat(self.hashed_transcript.clone())
@@ -668,13 +570,13 @@ where
     }
 }
 
-impl<KG: KeGroup, D: Hash> FromBytes for Ke2Message<D, KG>
+impl<KG: KeGroup, D: Hash> Deserialize for Ke2Message<D, KG>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
     Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
 {
-    fn from_bytes(input: &[u8]) -> Result<Self, ProtocolError> {
+    fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
         let key_len = <KG as KeGroup>::PkLen::USIZE;
         let nonce_len = NonceLen::USIZE;
         let checked_nonce = check_slice_size_atleast(input, nonce_len, "ke2_message nonce")?;
@@ -701,7 +603,7 @@ where
     }
 }
 
-impl<D: Hash, KG: KeGroup> ToBytes for Ke2Message<D, KG>
+impl<D: Hash, KG: KeGroup> Serialize for Ke2Message<D, KG>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
@@ -713,9 +615,9 @@ where
 {
     type Len = Sum<Sum<NonceLen, KG::PkLen>, OutputSize<D>>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len> {
+    fn serialize(&self) -> GenericArray<u8, Self::Len> {
         self.server_nonce
-            .concat(self.server_e_pk.to_bytes())
+            .concat(self.server_e_pk.serialize())
             .concat(self.mac.clone())
     }
 }
@@ -729,17 +631,17 @@ where
     Sum<NonceLen, KG::PkLen>: ArrayLength<u8>,
 {
     fn to_bytes_without_mac(&self) -> GenericArray<u8, Sum<NonceLen, KG::PkLen>> {
-        self.server_nonce.concat(self.server_e_pk.to_bytes())
+        self.server_nonce.concat(self.server_e_pk.serialize())
     }
 }
 
-impl<D: Hash> FromBytes for Ke3Message<D>
+impl<D: Hash> Deserialize for Ke3Message<D>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
     Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
 {
-    fn from_bytes(bytes: &[u8]) -> Result<Self, ProtocolError> {
+    fn deserialize(bytes: &[u8]) -> Result<Self, ProtocolError> {
         let checked_bytes = check_slice_size(bytes, OutputSize::<D>::USIZE, "ke3_message")?;
 
         Ok(Self {
@@ -748,7 +650,7 @@ where
     }
 }
 
-impl<D: Hash> ToBytes for Ke3Message<D>
+impl<D: Hash> Serialize for Ke3Message<D>
 where
     D::Core: ProxyHash,
     <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
@@ -756,7 +658,7 @@ where
 {
     type Len = OutputSize<D>;
 
-    fn to_bytes(&self) -> GenericArray<u8, Self::Len> {
+    fn serialize(&self) -> GenericArray<u8, Self::Len> {
         self.mac.clone()
     }
 }