General Improvements (#268)

* Move `elliptic-curve` implementation to points to allow `Zeroize`

* Simplify `Ristretto255::random_scalar` implementation

* Fix `Ristretto255` deserialization

* Remove unnecessary check in `Ristretto255::random_scalar`

* Base `X25519` implementation on `curve25519-dalek`

* Constrain public and secret key to `Copy`

* Replace manual `ZeroizeOnDrop` implementation with `derive`

* Update dependencies

* Add `warn(unused_crate_dependencies)`

* Sync crate feature naming with `voprf`

* Remove unnecessary dependency crate features

* Never produce a zero scalar

* Rename `OprfGroup` to `OprfCs`

* Rename `TripleDH` to `TripleDh`

* Remove `slow-hash` crate feature

* Rename `NoOpHash` to `Identity`

* Rename `SlowHash` to `Ksf`

* Move `KeyExchange` type definitions down

* Deserialize secret and public keys from slices

* Remove `PrivateKey::from_bytes`

* Rename `From/ToBytes` to `De/Serialize`

* Re-export `serde_` as `serde`

* Custom `De/Serialize` implementation for keys

* Remove custom `De/Serialize` implementation

* Run Taplo v0.6

src/key_exchange/group/x25519.rs

@@ -7,15 +7,16 @@
 
 //! Key Exchange group implementation for X25519
 
-use curve25519_dalek_3::scalar::Scalar;
+use curve25519_dalek::constants::ED25519_BASEPOINT_TABLE;
+use curve25519_dalek::montgomery::MontgomeryPoint;
+use curve25519_dalek::scalar::Scalar;
+use curve25519_dalek::traits::Identity;
 use digest::core_api::BlockSizeUser;
 use digest::Digest;
 use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
 use generic_array::GenericArray;
 use rand::{CryptoRng, RngCore};
-use x25519_dalek::{PublicKey, StaticSecret};
-use zeroize::Zeroize;
 
 use super::KeGroup;
 use crate::errors::InternalError;
@@ -25,31 +26,30 @@ pub struct X25519;
 
 /// The implementation of such a subgroup for Ristretto
 impl KeGroup for X25519 {
-    type Pk = PublicKey;
+    type Pk = MontgomeryPoint;
     type PkLen = U32;
-    type Sk = StaticSecret;
+    type Sk = Scalar;
     type SkLen = U32;
 
-    fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
+    fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
         pk.to_bytes().into()
     }
 
-    fn deserialize_pk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Pk, InternalError> {
-        if **bytes == [0; 32] {
-            Err(InternalError::PointError)
-        } else {
-            Ok(PublicKey::from(<[_; 32]>::from(*bytes)))
-        }
+    fn deserialize_pk(bytes: &[u8]) -> Result<Self::Pk, InternalError> {
+        bytes
+            .try_into()
+            .ok()
+            .map(MontgomeryPoint)
+            .filter(|pk| pk != &MontgomeryPoint::identity())
+            .ok_or(InternalError::PointError)
     }
 
     fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
-        let mut scalar_bytes = [0u8; 32];
-
         loop {
-            rng.fill_bytes(&mut scalar_bytes);
+            let scalar = Scalar::random(rng);
 
-            if scalar_bytes != [0u8; 32] {
-                break StaticSecret::from(scalar_bytes);
+            if scalar != Scalar::zero() {
+                break scalar;
             }
         }
     }
@@ -66,38 +66,33 @@ impl KeGroup for X25519 {
             .map_err(|_| InternalError::HashToScalar)?
             .fill_bytes(&mut uniform_bytes);
 
-        Ok(StaticSecret::from(
-            Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()).to_bytes(),
-        ))
+        let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
+
+        if scalar == Scalar::zero() {
+            Err(InternalError::HashToScalar)
+        } else {
+            Ok(scalar)
+        }
     }
 
-    fn public_key(sk: &Self::Sk) -> Self::Pk {
-        PublicKey::from(sk)
+    fn public_key(sk: Self::Sk) -> Self::Pk {
+        (&ED25519_BASEPOINT_TABLE * &sk).to_montgomery()
     }
 
-    fn diffie_hellman(pk: &Self::Pk, sk: &Self::Sk) -> GenericArray<u8, Self::PkLen> {
-        sk.diffie_hellman(pk).to_bytes().into()
+    fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
+        Self::serialize_pk(sk * pk)
     }
 
-    fn zeroize_sk_on_drop(sk: &mut Self::Sk) {
-        sk.zeroize()
-    }
-
-    fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
+    fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
         sk.to_bytes().into()
     }
 
-    fn deserialize_sk(bytes: &GenericArray<u8, Self::PkLen>) -> Result<Self::Sk, InternalError> {
-        if **bytes == [0; 32] {
-            Err(InternalError::PointError)
-        } else {
-            let sk = StaticSecret::from(<[u8; 32]>::from(*bytes));
-
-            if sk.to_bytes() == **bytes {
-                Ok(sk)
-            } else {
-                Err(InternalError::PointError)
-            }
-        }
+    fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError> {
+        bytes
+            .try_into()
+            .ok()
+            .and_then(Scalar::from_canonical_bytes)
+            .filter(|scalar| scalar != &Scalar::zero())
+            .ok_or(InternalError::PointError)
     }
 }