Implement auth_key test

src/envelope.rs

@@ -121,6 +121,31 @@ pub(crate) struct OpenedInnerEnvelope<D: Hash> {
     pub(crate) export_key: GenericArray<u8, <D as Digest>::OutputSize>,
 }
 
+#[cfg(not(test))]
+type SealRaw<CS> = (
+    Envelope<CS>,
+    GenericArray<u8, <<CS as CipherSuite>::Hash as Digest>::OutputSize>,
+);
+#[cfg(test)]
+type SealRaw<CS> = (
+    Envelope<CS>,
+    GenericArray<u8, <<CS as CipherSuite>::Hash as Digest>::OutputSize>,
+    Vec<u8>,
+);
+#[cfg(not(test))]
+type Seal<CS> = (
+    Envelope<CS>,
+    PublicKey<<CS as CipherSuite>::Group>,
+    GenericArray<u8, <<CS as CipherSuite>::Hash as Digest>::OutputSize>,
+);
+#[cfg(test)]
+type Seal<CS> = (
+    Envelope<CS>,
+    PublicKey<<CS as CipherSuite>::Group>,
+    GenericArray<u8, <<CS as CipherSuite>::Hash as Digest>::OutputSize>,
+    Vec<u8>,
+);
+
 impl<CS: CipherSuite> Envelope<CS> {
     fn hmac_key_size() -> usize {
         <CS::Hash as Digest>::OutputSize::to_usize()
@@ -182,14 +207,7 @@ impl<CS: CipherSuite> Envelope<CS> {
         key: &[u8],
         server_s_pk: &[u8],
         optional_ids: Option<Identifiers>,
-    ) -> Result<
+    ) -> Result<Seal<CS>, ProtocolError> {
-        (
-            Self,
-            PublicKey<CS::Group>,
-            GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
-        ),
-        ProtocolError,
-    > {
         let mut nonce = vec![0u8; NONCE_LEN];
         rng.fill_bytes(&mut nonce);
 
@@ -202,8 +220,14 @@ impl<CS: CipherSuite> Envelope<CS> {
             bytestrings_from_identifiers(&optional_ids, &client_s_pk.to_arr(), server_s_pk)?;
         let aad = construct_aad(&id_u, &id_s, server_s_pk);
 
-        let (envelope, export_key) = Self::seal_raw(key, &nonce, &aad, mode)?;
+        let result = Self::seal_raw(key, &nonce, &aad, mode)?;
-        Ok((envelope, client_s_pk, export_key))
+        Ok((
+            result.0,
+            client_s_pk,
+            result.1,
+            #[cfg(test)]
+            result.2,
+        ))
     }
 
     /// Uses a key to convert the plaintext into an envelope, authenticated by the aad field.
@@ -214,7 +238,7 @@ impl<CS: CipherSuite> Envelope<CS> {
         nonce: &[u8],
         aad: &[u8],
         mode: InnerEnvelopeMode,
-    ) -> Result<(Self, GenericArray<u8, <CS::Hash as Digest>::OutputSize>), InternalPakeError> {
+    ) -> Result<SealRaw<CS>, InternalPakeError> {
         let h = Hkdf::<CS::Hash>::new(None, key);
         let mut hmac_key = vec![0u8; Self::hmac_key_size()];
         let mut export_key = vec![0u8; Self::export_key_size()];
@@ -238,6 +262,8 @@ impl<CS: CipherSuite> Envelope<CS> {
                 hmac: hmac_bytes,
             },
             GenericArray::clone_from_slice(&export_key),
+            #[cfg(test)]
+            hmac_key,
         ))
     }
 

src/opaque.rs

@@ -278,6 +278,9 @@ pub struct ClientRegistrationFinishResult<CS: CipherSuite> {
     /// Instance of the ClientRegistration, only used in tests for checking zeroize
     #[cfg(test)]
     pub state: ClientRegistration<CS>,
+    /// AuthKey, only used in tests
+    #[cfg(test)]
+    pub auth_key: Vec<u8>,
     /// Password derived key, only used in tests
     #[cfg(test)]
     pub randomized_pwd: GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
@@ -293,6 +296,8 @@ impl<CS: CipherSuite> Clone for ClientRegistrationFinishResult<CS> {
             #[cfg(test)]
             state: self.state.clone(),
             #[cfg(test)]
+            auth_key: self.auth_key.clone(),
+            #[cfg(test)]
             randomized_pwd: self.randomized_pwd.clone(),
         }
     }
@@ -326,20 +331,22 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
         h.expand(STR_MASKING_KEY, &mut masking_key)
             .map_err(|_| InternalPakeError::HkdfError)?;
 
-        let (envelope, client_s_pk, export_key) =
+        let result =
             Envelope::<CS>::seal(rng, &password_derived_key, &r2.server_s_pk, optional_ids)?;
 
         Ok(ClientRegistrationFinishResult {
             message: RegistrationUpload {
-                envelope,
+                envelope: result.0,
                 masking_key: GenericArray::clone_from_slice(&masking_key[..]),
-                client_s_pk,
+                client_s_pk: result.1,
             },
-            export_key,
+            export_key: result.2,
             server_s_pk: r2.server_s_pk,
             #[cfg(test)]
             state: self,
             #[cfg(test)]
+            auth_key: result.3,
+            #[cfg(test)]
             randomized_pwd,
         })
     }

src/serialization/tests.rs

@@ -155,7 +155,7 @@ fn registration_upload_roundtrip() {
     let mut masking_key = vec![0u8; <sha2::Sha512 as Digest>::OutputSize::to_usize()];
     rng.fill_bytes(&mut masking_key);
 
-    let (envelope, _) =
+    let (envelope, _, _) =
         Envelope::<Default>::seal_raw(&key, &nonce, &pubkey_bytes, InnerEnvelopeMode::Internal)
             .unwrap();
     let envelope_bytes = envelope.serialize();

src/tests/opaque_test_vectors.rs

@@ -63,6 +63,7 @@ pub struct TestVectorParameters {
     pub KE3: Vec<u8>,
     pub export_key: Vec<u8>,
     pub session_key: Vec<u8>,
+    pub auth_key: Vec<u8>,
     pub randomized_pwd: Vec<u8>,
 }
 
@@ -483,6 +484,7 @@ fn populate_test_vectors(values: &Value) -> TestVectorParameters {
         blind_login: parse!(values, "blind_login"),
         export_key: parse!(values, "export_key"),
         session_key: parse!(values, "session_key"),
+        auth_key: parse!(values, "auth_key"),
         randomized_pwd: parse!(values, "randomized_pwd"),
     }
 }
@@ -569,6 +571,10 @@ fn test_registration_upload() -> Result<(), ProtocolError> {
             },
         )?;
 
+        assert_eq!(
+            hex::encode(parameters.auth_key),
+            hex::encode(result.auth_key)
+        );
         assert_eq!(
             hex::encode(parameters.randomized_pwd),
             hex::encode(result.randomized_pwd)