vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

General Improvements (#268)

Browse Source 
* Move `elliptic-curve` implementation to points to allow `Zeroize`

* Simplify `Ristretto255::random_scalar` implementation

* Fix `Ristretto255` deserialization

* Remove unnecessary check in `Ristretto255::random_scalar`

* Base `X25519` implementation on `curve25519-dalek`

* Constrain public and secret key to `Copy`

* Replace manual `ZeroizeOnDrop` implementation with `derive`

* Update dependencies

* Add `warn(unused_crate_dependencies)`

* Sync crate feature naming with `voprf`

* Remove unnecessary dependency crate features

* Never produce a zero scalar

* Rename `OprfGroup` to `OprfCs`

* Rename `TripleDH` to `TripleDh`

* Remove `slow-hash` crate feature

* Rename `NoOpHash` to `Identity`

* Rename `SlowHash` to `Ksf`

* Move `KeyExchange` type definitions down

* Deserialize secret and public keys from slices

* Remove `PrivateKey::from_bytes`

* Rename `From/ToBytes` to `De/Serialize`

* Re-export `serde_` as `serde`

* Custom `De/Serialize` implementation for keys

* Remove custom `De/Serialize` implementation

* Run Taplo v0.6
This commit is contained in:
daxpedda
2022-04-01 16:10:00 -07:00
committed by GitHub
parent f952a26e29
commit 384207acbb
25 changed files with 849 additions and 1109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/key_exchange/group/elliptic_curve.rs
+29 -27
View File
@@ -11,8 +11,7 @@ use elliptic_curve::group::cofactor::CofactorGroup;
use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
use elliptic_curve::{
AffinePoint, Curve, FieldSize, NonZeroScalar, ProjectiveArithmetic, ProjectivePoint, PublicKey,
Scalar, SecretKey,
AffinePoint, Field, FieldSize, Group, ProjectivePoint, PublicKey, Scalar, SecretKey,
};
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
use generic_array::GenericArray;
@@ -21,31 +20,34 @@ use rand::{CryptoRng, RngCore};
use super::KeGroup;
use crate::errors::InternalError;
impl<G: Curve + GroupDigest + ProjectiveArithmetic> KeGroup for G
impl<G> KeGroup for G
where
G: GroupDigest,
FieldSize<Self>: ModulusSize,
AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
ProjectivePoint<Self>: CofactorGroup + ToEncodedPoint<Self>,
Scalar<Self>: FromOkm,
{
type Pk = PublicKey<Self>;
type Pk = ProjectivePoint<Self>;
type PkLen = <FieldSize<Self> as ModulusSize>::CompressedPointSize;
type Sk = SecretKey<Self>;
type Sk = Scalar<Self>;
type SkLen = FieldSize<Self>;
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
GenericArray::clone_from_slice(pk.to_encoded_point(true).as_bytes())
}
fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
PublicKey::from_sec1_bytes(bytes).map_err(|_| InternalError::PointError)
fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
PublicKey::<Self>::from_sec1_bytes(bytes)
.map(|public_key| public_key.to_projective())
.map_err(|_| InternalError::PointError)
}
fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
SecretKey::random(rng)
*SecretKey::<Self>::random(rng).to_nonzero_scalar()
}
// Implements the `HashToScalar()` function
@@ -55,31 +57,31 @@ where
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
{
Self::hash_to_scalar::<ExpandMsgXmd<H>>(input, dst)
.ok()
.and_then(|scalar| Option::<NonZeroScalar<Self>>::from(NonZeroScalar::new(scalar)))
.map(SecretKey::from)
.ok_or(InternalError::HashToScalar)
.map_err(|_| InternalError::HashToScalar)
.and_then(|scalar| {
if bool::from(scalar.is_zero()) {
Err(InternalError::HashToScalar)
} else {
Ok(scalar)
}
})
}
fn public_key(sk: &Self::Sk) -> Self::Pk {
sk.public_key()
fn public_key(sk: Self::Sk) -> Self::Pk {
ProjectivePoint::<Self>::generator() * sk
}
fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
GenericArray::clone_from_slice(
(pk.to_projective() * sk.to_nonzero_scalar().as_ref())
.to_encoded_point(true)
.as_bytes(),
)
fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
Self::serialize_pk(pk * sk)
}
fn zeroize_sk_on_drop(_sk: &mut Self::Sk) {}
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.to_be_bytes()
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.into()
}
fn deserialize_sk(bytes: &GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError> {
SecretKey::from_be_bytes(bytes).map_err(|_| InternalError::PointError)
fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
SecretKey::<Self>::from_be_bytes(bytes)
.map(|secret_key| *secret_key.to_nonzero_scalar())
.map_err(|_| InternalError::PointError)
}
}
src/key_exchange/group/mod.rs
+9 -11
View File
@@ -18,25 +18,26 @@ use digest::Digest;
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
use generic_array::{ArrayLength, GenericArray};
use rand::{CryptoRng, RngCore};
use zeroize::Zeroize;
use crate::errors::InternalError;
/// A group representation for use in the key exchange
pub trait KeGroup {
/// Public key
type Pk: Clone;
type Pk: Copy + Zeroize;
/// Length of the public key
type PkLen: ArrayLength<u8>;
/// Secret key
type Sk: Clone;
type Sk: Copy + Zeroize;
/// Length of the secret key
type SkLen: ArrayLength<u8>;
/// Serializes `self`
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen>;
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen>;
/// Return a public key from its fixed-length bytes representation
fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError>;
fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError>;
/// Generate a random secret key
fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk;
@@ -52,17 +53,14 @@ pub trait KeGroup {
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
/// Return a public key from its secret key
fn public_key(sk: &Self::Sk) -> Self::Pk;
fn public_key(sk: Self::Sk) -> Self::Pk;
/// Diffie-Hellman key exchange
fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen>;
/// Zeroize secret key on drop.
fn zeroize_sk_on_drop(sk: &mut Self::Sk);
fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen>;
/// Serializes `self`
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen>;
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen>;
/// Return a public key from its fixed-length bytes representation
fn deserialize_sk(bytes: &GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError>;
fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError>;
}
src/key_exchange/group/ristretto255.rs
+29 -19
View File
@@ -10,6 +10,7 @@
use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::traits::Identity;
use digest::core_api::BlockSizeUser;
use digest::{Digest, OutputSizeUser};
use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
@@ -17,7 +18,6 @@ use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
use voprf::Group;
use zeroize::Zeroize;
use super::KeGroup;
use crate::errors::InternalError;
@@ -33,13 +33,18 @@ impl KeGroup for Ristretto255 {
type Sk = Scalar;
type SkLen = U32;
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
pk.compress().to_bytes().into()
}
fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
if bytes.len() != 32 {
return Err(InternalError::PointError);
}
CompressedRistretto::from_slice(bytes)
.decompress()
.filter(|point| point != &RistrettoPoint::identity())
.ok_or(InternalError::PointError)
}
@@ -48,9 +53,7 @@ impl KeGroup for Ristretto255 {
let scalar = {
#[cfg(not(test))]
{
let mut scalar_bytes = [0u8; 64];
rng.fill_bytes(&mut scalar_bytes);
Scalar::from_bytes_mod_order_wide(&scalar_bytes)
Scalar::random(rng)
}
// Tests need an exact conversion from bytes to scalar, sampling only 32 bytes
@@ -63,7 +66,7 @@ impl KeGroup for Ristretto255 {
}
};
if scalar != Scalar::zero() && scalar.is_canonical() {
if scalar != Scalar::zero() {
break scalar;
}
}
@@ -81,31 +84,38 @@ impl KeGroup for Ristretto255 {
.map_err(|_| InternalError::HashToScalar)?
.fill_bytes(&mut uniform_bytes);
Ok(Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()))
let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
if scalar == Scalar::zero() {
Err(InternalError::HashToScalar)
} else {
Ok(scalar)
}
}
fn public_key(sk: &Self::Sk) -> Self::Pk {
fn public_key(sk: Self::Sk) -> Self::Pk {
RISTRETTO_BASEPOINT_POINT * sk
}
fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
Self::serialize_pk(&(pk * sk))
fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
Self::serialize_pk(pk * sk)
}
fn zeroize_sk_on_drop(sk: &mut Self::Sk) {
sk.zeroize()
}
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.to_bytes().into()
}
fn deserialize_sk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Sk, InternalError> {
Scalar::from_canonical_bytes((*bytes).into()).ok_or(InternalError::PointError)
fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
bytes
.try_into()
.ok()
.and_then(Scalar::from_canonical_bytes)
.filter(|scalar| scalar != &Scalar::zero())
.ok_or(InternalError::PointError)
}
}
#[cfg(feature = "ristretto255_voprf")]
#[cfg(feature = "ristretto255-voprf")]
impl voprf::CipherSuite for Ristretto255 {
const ID: u16 = voprf::Ristretto255::ID;
src/key_exchange/group/x25519.rs
+36 -41
View File
@@ -7,15 +7,16 @@
//! Key Exchange group implementation for X25519
use curve25519_dalek_3::scalar::Scalar;
use curve25519_dalek::constants::ED25519_BASEPOINT_TABLE;
use curve25519_dalek::montgomery::MontgomeryPoint;
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::traits::Identity;
use digest::core_api::BlockSizeUser;
use digest::Digest;
use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
use x25519_dalek::{PublicKey, StaticSecret};
use zeroize::Zeroize;
use super::KeGroup;
use crate::errors::InternalError;
@@ -25,31 +26,30 @@ pub struct X25519;
/// The implementation of such a subgroup for Ristretto
impl KeGroup for X25519 {
type Pk = PublicKey;
type Pk = MontgomeryPoint;
type PkLen = U32;
type Sk = StaticSecret;
type Sk = Scalar;
type SkLen = U32;
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
pk.to_bytes().into()
}
fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
if **bytes == [0; 32] {
Err(InternalError::PointError)
} else {
Ok(PublicKey::from(<[_; 32]>::from(*bytes)))
}
fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
bytes
.try_into()
.ok()
.map(MontgomeryPoint)
.filter(|pk| pk != &MontgomeryPoint::identity())
.ok_or(InternalError::PointError)
}
fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
let mut scalar_bytes = [0u8; 32];
loop {
rng.fill_bytes(&mut scalar_bytes);
let scalar = Scalar::random(rng);
if scalar_bytes != [0u8; 32] {
break StaticSecret::from(scalar_bytes);
if scalar != Scalar::zero() {
break scalar;
}
}
}
@@ -66,38 +66,33 @@ impl KeGroup for X25519 {
.map_err(|_| InternalError::HashToScalar)?
.fill_bytes(&mut uniform_bytes);
Ok(StaticSecret::from(
Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()).to_bytes(),
))
let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
if scalar == Scalar::zero() {
Err(InternalError::HashToScalar)
} else {
Ok(scalar)
}
}
fn public_key(sk: &Self::Sk) -> Self::Pk {
PublicKey::from(sk)
fn public_key(sk: Self::Sk) -> Self::Pk {
(&ED25519_BASEPOINT_TABLE * &sk).to_montgomery()
}
fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
sk.diffie_hellman(pk).to_bytes().into()
fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
Self::serialize_pk(sk * pk)
}
fn zeroize_sk_on_drop(sk: &mut Self::Sk) {
sk.zeroize()
}
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.to_bytes().into()
}
fn deserialize_sk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Sk, InternalError> {
if **bytes == [0; 32] {
Err(InternalError::PointError)
} else {
let sk = StaticSecret::from(<[u8; 32]>::from(*bytes));
if sk.to_bytes() == **bytes {
Ok(sk)
} else {
Err(InternalError::PointError)
}
}
fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
bytes
.try_into()
.ok()
.and_then(Scalar::from_canonical_bytes)
.filter(|scalar| scalar != &Scalar::zero())
.ok_or(InternalError::PointError)
}
}