vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Updating to version 08 (#271)

Browse Source
This commit is contained in:
Kevin Lewi
2022-04-17 16:23:31 -07:00
committed by GitHub
parent 384207acbb
commit 3fe6bbb80f
13 changed files with 609 additions and 543 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/key_exchange/group/elliptic_curve.rs
+6 -1
View File
@@ -50,7 +50,8 @@ where
*SecretKey::<Self>::random(rng).to_nonzero_scalar()
}
// Implements the `HashToScalar()` function
// Implements the `HashToScalar()` function from
// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-4.1>
fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Sk, InternalError>
where
H: Digest + BlockSizeUser,
@@ -71,6 +72,10 @@ where
ProjectivePoint::<Self>::generator() * sk
}
fn is_zero_scalar(scalar: Self::Sk) -> subtle::Choice {
scalar.is_zero()
}
fn diffie_hellman(pk: Self::Pk, sk: Self::Sk) -> GenericArray<u8, Self::PkLen> {
Self::serialize_pk(pk * sk)
}
src/key_exchange/group/mod.rs
+68 -2
View File
@@ -14,8 +14,9 @@ pub mod ristretto255;
pub mod x25519;
use digest::core_api::BlockSizeUser;
use digest::Digest;
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
use digest::{Digest, OutputSizeUser};
use generic_array::sequence::Concat;
use generic_array::typenum::{IsLess, IsLessOrEqual, U11, U256};
use generic_array::{ArrayLength, GenericArray};
use rand::{CryptoRng, RngCore};
use zeroize::Zeroize;
@@ -52,6 +53,47 @@ pub trait KeGroup {
H: Digest + BlockSizeUser,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
/// Corresponds to the DeriveAuthKeyPair() function defined in
/// <https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-08.html#section-6.4.2>
///
/// Note that we cannot call the voprf crate directly since we need to
/// ensure that the KeGroup is used for the hash_to_scalar operation (as
/// opposed to the OprfGroup).
fn derive_auth_keypair<CS: voprf::CipherSuite>(
seed: &[u8],
info: &[u8],
) -> Result<Self::Sk, InternalError>
where
<CS::Hash as OutputSizeUser>::OutputSize:
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
{
let context_string = create_context_string::<CS>(voprf::Mode::Oprf);
let dst = GenericArray::from(STR_DERIVE_KEYPAIR).concat(context_string);
let info_len = i2osp_2(info.len())
.map_err(|_| InternalError::OprfError(voprf::Error::DeriveKeyPair))?;
for counter in 0_u8..=u8::MAX {
// deriveInput = seed || I2OSP(len(info), 2) || info
// skS = G.HashToScalar(deriveInput || I2OSP(counter, 1), DST = "DeriveKeyPair"
// || contextString)
let sk_s = Self::hash_to_scalar::<CS::Hash>(
&[seed, &info_len, info, &counter.to_be_bytes()],
&dst,
)
.map_err(|_| InternalError::OprfError(voprf::Error::DeriveKeyPair))?;
if !bool::from(Self::is_zero_scalar(sk_s)) {
return Ok(sk_s);
}
}
Err(InternalError::OprfError(voprf::Error::DeriveKeyPair))
}
/// Returns `true` if the scalar is zero.
fn is_zero_scalar(scalar: Self::Sk) -> subtle::Choice;
/// Return a public key from its secret key
fn public_key(sk: Self::Sk) -> Self::Pk;
@@ -64,3 +106,27 @@ pub trait KeGroup {
/// Return a public key from its fixed-length bytes representation
fn deserialize_sk(bytes: &[u8]) -> Result<Self::Sk, InternalError>;
}
// Helper functions used to compute DeriveAuthKeyPair() (taken from the voprf
// crate)
const STR_VOPRF: [u8; 8] = *b"VOPRF09-";
const STR_DERIVE_KEYPAIR: [u8; 13] = *b"DeriveKeyPair";
/// Generates the contextString parameter as defined in
/// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
fn create_context_string<CS: voprf::CipherSuite>(mode: voprf::Mode) -> GenericArray<u8, U11>
where
<CS::Hash as OutputSizeUser>::OutputSize:
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
{
GenericArray::from(STR_VOPRF)
.concat([mode.to_u8()].into())
.concat(CS::ID.to_be_bytes().into())
}
fn i2osp_2(input: usize) -> Result<[u8; 2], InternalError> {
u16::try_from(input)
.map(|input| input.to_be_bytes())
.map_err(|_| InternalError::OprfInternalError(voprf::InternalError::I2osp))
}
src/key_exchange/group/ristretto255.rs
+17 -23
View File
@@ -12,11 +12,11 @@ use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::traits::Identity;
use digest::core_api::BlockSizeUser;
use digest::{Digest, OutputSizeUser};
use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
use digest::Digest;
use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32};
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
use subtle::ConstantTimeEq;
use voprf::Group;
use super::KeGroup;
@@ -73,24 +73,18 @@ impl KeGroup for Ristretto255 {
}
// Implements the `HashToScalar()` function from
// https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html#section-4.1
// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-4.1>
fn hash_to_scalar<'a, H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Sk, InternalError>
where
H: Digest + BlockSizeUser,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
{
let mut uniform_bytes = GenericArray::<_, U64>::default();
ExpandMsgXmd::<H>::expand_message(input, dst, 64)
.map_err(|_| InternalError::HashToScalar)?
.fill_bytes(&mut uniform_bytes);
<voprf::Ristretto255 as Group>::hash_to_scalar::<H>(input, dst)
.map_err(InternalError::OprfInternalError)
}
let scalar = Scalar::from_bytes_mod_order_wide(&uniform_bytes.into());
if scalar == Scalar::zero() {
Err(InternalError::HashToScalar)
} else {
Ok(scalar)
}
fn is_zero_scalar(scalar: Self::Sk) -> subtle::Choice {
scalar.ct_eq(&Scalar::zero())
}
fn public_key(sk: Self::Sk) -> Self::Pk {
@@ -133,26 +127,26 @@ impl Group for Ristretto255 {
type ScalarLen = <voprf::Ristretto255 as Group>::ScalarLen;
fn hash_to_curve<CS: voprf::CipherSuite>(
fn hash_to_curve<H>(
input: &[&[u8]],
dst: &[u8],
) -> voprf::Result<Self::Elem, voprf::InternalError>
where
<CS::Hash as OutputSizeUser>::OutputSize:
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
H: Digest + BlockSizeUser,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
{
<voprf::Ristretto255 as Group>::hash_to_curve::<CS>(input, dst)
<voprf::Ristretto255 as Group>::hash_to_curve::<H>(input, dst)
}
fn hash_to_scalar<CS: voprf::CipherSuite>(
fn hash_to_scalar<H>(
input: &[&[u8]],
dst: &[u8],
) -> voprf::Result<Self::Scalar, voprf::InternalError>
where
<CS::Hash as OutputSizeUser>::OutputSize:
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
H: Digest + BlockSizeUser,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
{
<voprf::Ristretto255 as Group>::hash_to_scalar::<CS>(input, dst)
<voprf::Ristretto255 as Group>::hash_to_scalar::<H>(input, dst)
}
fn base_elem() -> Self::Elem {
src/key_exchange/group/x25519.rs
+6 -1
View File
@@ -17,6 +17,7 @@ use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
use subtle::ConstantTimeEq;
use super::KeGroup;
use crate::errors::InternalError;
@@ -55,7 +56,7 @@ impl KeGroup for X25519 {
}
// Implements the `HashToScalar()` function from
// https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html#section-4.1
// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-4.1>
fn hash_to_scalar<'a, H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Sk, InternalError>
where
H: Digest + BlockSizeUser,
@@ -75,6 +76,10 @@ impl KeGroup for X25519 {
}
}
fn is_zero_scalar(scalar: Self::Sk) -> subtle::Choice {
scalar.ct_eq(&Scalar::zero())
}
fn public_key(sk: Self::Sk) -> Self::Pk {
(&ED25519_BASEPOINT_TABLE * &sk).to_montgomery()
}