diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 3e599d6..d91cbca 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -25,7 +25,7 @@ jobs: - --features serde toolchain: - stable - - 1.83.0 + - 1.85.0 name: test env: PKCS11_MODULE: /usr/lib/softhsm/libsofthsm2.so @@ -93,7 +93,7 @@ jobs: matrix: toolchain: - stable - - 1.83.0 + - 1.85.0 name: test simple_login command-line example steps: - name: install expect @@ -116,7 +116,7 @@ jobs: matrix: toolchain: - stable - - 1.83.0 + - 1.85.0 name: test digital_locker command-line example steps: - name: install expect diff --git a/Cargo.toml b/Cargo.toml index b100fa9..bcece58 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,14 +2,14 @@ authors = ["Kevin Lewi ", "François Garillot "] categories = ["no-std"] description = "An implementation of the OPAQUE password-authenticated key exchange protocol" -edition = "2021" +edition = "2024" exclude = ["/src/tests/"] keywords = ["cryptography", "crypto", "opaque", "passwords", "authentication"] license = "Apache-2.0 OR MIT" name = "opaque-ke" readme = "README.md" repository = "https://github.com/facebook/opaque-ke" -rust-version = "1.83" +rust-version = "1.85" version = "3.0.0" [features] diff --git a/README.md b/README.md index 71d1699..6829c81 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ opaque-ke = "3" ### Minimum Supported Rust Version -Rust **1.83** or higher. +Rust **1.85** or higher. Audit ----- diff --git a/examples/digital_locker.rs b/examples/digital_locker.rs index 173ed51..cfb3730 100644 --- a/examples/digital_locker.rs +++ b/examples/digital_locker.rs @@ -32,17 +32,17 @@ use chacha20poly1305::aead::{Aead, KeyInit}; use chacha20poly1305::{ChaCha20Poly1305, Key, Nonce}; use generic_array::GenericArray; use opaque_ke::ciphersuite::CipherSuite; -use opaque_ke::rand::rngs::OsRng; use opaque_ke::rand::RngCore; +use opaque_ke::rand::rngs::OsRng; use opaque_ke::{ ClientLogin, ClientLoginFinishParameters, ClientRegistration, ClientRegistrationFinishParameters, CredentialFinalization, CredentialRequest, CredentialResponse, RegistrationRequest, RegistrationResponse, RegistrationUpload, ServerLogin, ServerLoginParameters, ServerRegistration, ServerRegistrationLen, ServerSetup, }; +use rustyline::Editor; use rustyline::error::ReadlineError; use rustyline::history::DefaultHistory; -use rustyline::Editor; // The ciphersuite trait allows to specify the underlying primitives that will // be used in the OPAQUE protocol diff --git a/examples/simple_login.rs b/examples/simple_login.rs index 7f31b17..d08fdc6 100644 --- a/examples/simple_login.rs +++ b/examples/simple_login.rs @@ -35,9 +35,9 @@ use opaque_ke::{ CredentialResponse, RegistrationRequest, RegistrationResponse, RegistrationUpload, ServerLogin, ServerLoginParameters, ServerRegistration, ServerRegistrationLen, ServerSetup, }; +use rustyline::Editor; use rustyline::error::ReadlineError; use rustyline::history::DefaultHistory; -use rustyline::Editor; // The ciphersuite trait allows to specify the underlying primitives that will // be used in the OPAQUE protocol diff --git a/src/ciphersuite.rs b/src/ciphersuite.rs index 9e1b722..02d0143 100644 --- a/src/ciphersuite.rs +++ b/src/ciphersuite.rs @@ -12,13 +12,13 @@ use core::ops::Add; use digest::core_api::{BlockSizeUser, CoreProxy}; -use generic_array::typenum::{IsLess, Le, NonZero, Sum, U256}; use generic_array::ArrayLength; +use generic_array::typenum::{IsLess, Le, NonZero, Sum, U256}; use crate::envelope::NonceLen; use crate::hash::{Hash, OutputSize, ProxyHash}; -use crate::key_exchange::group::Group; use crate::key_exchange::KeyExchange; +use crate::key_exchange::group::Group; use crate::ksf::Ksf; use crate::opaque::MaskedResponseLen; diff --git a/src/envelope.rs b/src/envelope.rs index c41d190..88bf3fc 100644 --- a/src/envelope.rs +++ b/src/envelope.rs @@ -10,9 +10,9 @@ use core::convert::TryFrom; use derive_where::derive_where; use digest::Output; +use generic_array::GenericArray; use generic_array::sequence::Concat; use generic_array::typenum::{Sum, U32}; -use generic_array::GenericArray; use hkdf::Hkdf; use hmac::{Hmac, Mac}; use rand::{CryptoRng, RngCore}; @@ -21,8 +21,8 @@ use zeroize::{Zeroize, ZeroizeOnDrop}; use crate::ciphersuite::{CipherSuite, KeGroup, OprfHash}; use crate::errors::{InternalError, ProtocolError}; use crate::hash::OutputSize; -use crate::key_exchange::group::Group; use crate::key_exchange::SerializedIdentifiers; +use crate::key_exchange::group::Group; use crate::keypair::{KeyPair, PrivateKey, PublicKey}; use crate::opaque::Identifiers; use crate::serialization::{GenericArrayExt, SliceExt, UpdateExt}; @@ -190,7 +190,7 @@ impl Envelope { ) -> Result, ProtocolError> { let client_static_keypair = match self.mode { InnerEnvelopeMode::Zero => { - return Err(InternalError::IncompatibleEnvelopeModeError.into()) + return Err(InternalError::IncompatibleEnvelopeModeError.into()); } InnerEnvelopeMode::Internal => { recover_keys_internal::(randomized_pwd_hasher.clone(), self.nonce)? diff --git a/src/hash.rs b/src/hash.rs index 753b659..d4d25a9 100644 --- a/src/hash.rs +++ b/src/hash.rs @@ -51,14 +51,14 @@ where } impl< - T: Default - + HashMarker - + OutputSizeUser> - + BlockSizeUser - + FixedOutputReset - + CoreProxy - + Clone, - > Hash for T + T: Default + + HashMarker + + OutputSizeUser> + + BlockSizeUser + + FixedOutputReset + + CoreProxy + + Clone, +> Hash for T where ::Core: ProxyHash, <::Core as BlockSizeUser>::BlockSize: IsLess, diff --git a/src/key_exchange/group/curve25519.rs b/src/key_exchange/group/curve25519.rs index 6b2b138..bc0b949 100644 --- a/src/key_exchange/group/curve25519.rs +++ b/src/key_exchange/group/curve25519.rs @@ -12,8 +12,8 @@ pub use curve25519_dalek; use curve25519_dalek::montgomery::MontgomeryPoint; use curve25519_dalek::scalar; use curve25519_dalek::traits::Identity; -use generic_array::typenum::U32; use generic_array::GenericArray; +use generic_array::typenum::U32; use rand::{CryptoRng, RngCore}; use zeroize::Zeroize; diff --git a/src/key_exchange/group/ed25519.rs b/src/key_exchange/group/ed25519.rs index f0fa9e6..ee7fadb 100644 --- a/src/key_exchange/group/ed25519.rs +++ b/src/key_exchange/group/ed25519.rs @@ -17,9 +17,9 @@ use digest::Digest; pub use ed25519_dalek; use ed25519_dalek::hazmat::ExpandedSecretKey; use ed25519_dalek::{SecretKey, Sha512}; +use generic_array::GenericArray; use generic_array::sequence::Concat; use generic_array::typenum::{U32, U64}; -use generic_array::GenericArray; use rand::{CryptoRng, RngCore}; use zeroize::Zeroize; diff --git a/src/key_exchange/group/elliptic_curve.rs b/src/key_exchange/group/elliptic_curve.rs index 8d39699..ff9338a 100644 --- a/src/key_exchange/group/elliptic_curve.rs +++ b/src/key_exchange/group/elliptic_curve.rs @@ -15,8 +15,8 @@ use elliptic_curve::group::GroupEncoding; use elliptic_curve::ops::MulByGenerator; use elliptic_curve::sec1::{ModulusSize, ToEncodedPoint}; use elliptic_curve::{ - point, CurveArithmetic, FieldBytesSize, Group as _, NonZeroScalar, ProjectivePoint, Scalar, - SecretKey, + CurveArithmetic, FieldBytesSize, Group as _, NonZeroScalar, ProjectivePoint, Scalar, SecretKey, + point, }; use generic_array::GenericArray; use rand::{CryptoRng, RngCore}; diff --git a/src/key_exchange/group/ristretto255.rs b/src/key_exchange/group/ristretto255.rs index 311906b..c982189 100644 --- a/src/key_exchange/group/ristretto255.rs +++ b/src/key_exchange/group/ristretto255.rs @@ -15,8 +15,8 @@ use curve25519_dalek::scalar::Scalar; use curve25519_dalek::traits::Identity; use digest::core_api::BlockSizeUser; use digest::{FixedOutput, HashMarker}; -use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32}; use generic_array::GenericArray; +use generic_array::typenum::{IsLess, IsLessOrEqual, U32, U256}; use rand::{CryptoRng, RngCore}; use voprf::Mode; diff --git a/src/key_exchange/mod.rs b/src/key_exchange/mod.rs index 6b16dd9..204e6b9 100644 --- a/src/key_exchange/mod.rs +++ b/src/key_exchange/mod.rs @@ -18,8 +18,8 @@ use core::iter; use core::ops::Add; use derive_where::derive_where; -use digest::core_api::{BlockSizeUser, CoreProxy}; use digest::Output; +use digest::core_api::{BlockSizeUser, CoreProxy}; use generic_array::sequence::Concat; use generic_array::typenum::{IsLess, Le, NonZero, Sum, U2, U256}; use generic_array::{ArrayLength, GenericArray}; @@ -36,7 +36,7 @@ use crate::key_exchange::group::Group; use crate::key_exchange::shared::{NonceLen, STR_CONTEXT}; use crate::keypair::{PrivateKey, PublicKey}; use crate::opaque::{Identifiers, MaskedResponse, MaskedResponseLen}; -use crate::serialization::{i2osp, SliceExt}; +use crate::serialization::{SliceExt, i2osp}; /// The key exchange trait. pub trait KeyExchange diff --git a/src/key_exchange/shared.rs b/src/key_exchange/shared.rs index d730683..7c1032f 100644 --- a/src/key_exchange/shared.rs +++ b/src/key_exchange/shared.rs @@ -12,7 +12,7 @@ use derive_where::derive_where; use digest::core_api::BlockSizeUser; use digest::{Digest, Output, OutputSizeUser, Update}; use generic_array::sequence::Concat; -use generic_array::typenum::{IsLess, Le, NonZero, Sum, Unsigned, U1, U2, U256, U32}; +use generic_array::typenum::{IsLess, Le, NonZero, Sum, U1, U2, U32, U256, Unsigned}; use generic_array::{ArrayLength, GenericArray}; use hkdf::{Hkdf, HkdfExtract}; use rand::{CryptoRng, RngCore}; @@ -26,7 +26,7 @@ use crate::errors::{InternalError, ProtocolError}; use crate::hash::{Hash, OutputSize, ProxyHash}; use crate::key_exchange::group::Group; use crate::keypair::{KeyPair, PrivateKey, PublicKey}; -use crate::serialization::{i2osp, SliceExt, UpdateExt}; +use crate::serialization::{SliceExt, UpdateExt, i2osp}; /////////////// // Constants // diff --git a/src/key_exchange/sigma_i/ecdsa.rs b/src/key_exchange/sigma_i/ecdsa.rs index c9edd8c..ae31b22 100644 --- a/src/key_exchange/sigma_i/ecdsa.rs +++ b/src/key_exchange/sigma_i/ecdsa.rs @@ -14,7 +14,7 @@ use core::marker::PhantomData; use derive_where::derive_where; use digest::core_api::BlockSizeUser; use digest::{FixedOutputReset, HashMarker}; -use ecdsa::{hazmat, PrimeCurve, SignatureSize}; +use ecdsa::{PrimeCurve, SignatureSize, hazmat}; use elliptic_curve::{ CurveArithmetic, Field, FieldBytes, FieldBytesEncoding, FieldBytesSize, NonZeroScalar, PrimeField, Scalar, @@ -26,8 +26,8 @@ use zeroize::Zeroize; use super::{Message, MessageBuilder, SignatureProtocol}; use crate::ciphersuite::CipherSuite; use crate::errors::ProtocolError; -use crate::key_exchange::group::elliptic_curve::NonIdentity; use crate::key_exchange::group::Group; +use crate::key_exchange::group::elliptic_curve::NonIdentity; pub use crate::key_exchange::sigma_i::shared::PreHash; use crate::serialization::SliceExt; diff --git a/src/key_exchange/sigma_i/hash_eddsa.rs b/src/key_exchange/sigma_i/hash_eddsa.rs index 5fcb234..02a45bf 100644 --- a/src/key_exchange/sigma_i/hash_eddsa.rs +++ b/src/key_exchange/sigma_i/hash_eddsa.rs @@ -83,6 +83,6 @@ pub(in super::super) mod implementation { fn deserialize_take_signature(bytes: &mut &[u8]) -> Result; fn serialize_signature(signature: &Self::Signature) - -> GenericArray; + -> GenericArray; } } diff --git a/src/key_exchange/sigma_i/mod.rs b/src/key_exchange/sigma_i/mod.rs index 62cf203..0a39cdd 100644 --- a/src/key_exchange/sigma_i/mod.rs +++ b/src/key_exchange/sigma_i/mod.rs @@ -45,8 +45,8 @@ use crate::envelope::NonceLen; use crate::errors::{InternalError, ProtocolError}; use crate::hash::{Hash, OutputSize, ProxyHash}; use crate::key_exchange::group::Group; -use crate::key_exchange::shared::{derive_keys, generate_ke1, generate_nonce, transcript}; pub use crate::key_exchange::shared::{DiffieHellman, Ke1Message, Ke1State}; +use crate::key_exchange::shared::{derive_keys, generate_ke1, generate_nonce, transcript}; use crate::keypair::{KeyPair, PrivateKey, PublicKey}; use crate::opaque::Identifiers; use crate::serialization::{SliceExt, UpdateExt}; diff --git a/src/key_exchange/sigma_i/pure_eddsa.rs b/src/key_exchange/sigma_i/pure_eddsa.rs index a62191a..5691959 100644 --- a/src/key_exchange/sigma_i/pure_eddsa.rs +++ b/src/key_exchange/sigma_i/pure_eddsa.rs @@ -84,6 +84,6 @@ pub(in super::super) mod implementation { fn deserialize_take_signature(bytes: &mut &[u8]) -> Result; fn serialize_signature(signature: &Self::Signature) - -> GenericArray; + -> GenericArray; } } diff --git a/src/keypair.rs b/src/keypair.rs index 353b915..d2a7fc1 100644 --- a/src/keypair.rs +++ b/src/keypair.rs @@ -319,8 +319,8 @@ impl KeyPair { /// [`Self::derive_random`] fn uniform_keypair_strategy() -> proptest::prelude::BoxedStrategy { use proptest::prelude::*; - use rand::rngs::StdRng; use rand::SeedableRng; + use rand::rngs::StdRng; // The no_shrink is because keypairs should be fixed -- shrinking would cause a // different keypair to be generated, which appears to not be very useful. diff --git a/src/lib.rs b/src/lib.rs index d66e604..5e8d41c 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -15,7 +15,7 @@ //! //! ### Minimum Supported Rust Version //! -//! Rust **1.83** or higher. +//! Rust **1.85** or higher. //! //! # Overview //! @@ -70,8 +70,8 @@ //! # type KeyExchange = opaque_ke::TripleDh; //! # type Ksf = opaque_ke::ksf::Identity; //! # } -//! use rand::rngs::OsRng; //! use rand::RngCore; +//! use rand::rngs::OsRng; //! //! let mut rng = OsRng; //! let server_setup = ServerSetup::::new(&mut rng); @@ -127,8 +127,8 @@ //! # type Ksf = opaque_ke::ksf::Identity; //! # } //! use opaque_ke::ClientRegistration; -//! use rand::rngs::OsRng; //! use rand::RngCore; +//! use rand::rngs::OsRng; //! //! let mut client_rng = OsRng; //! let client_registration_start_result = @@ -1358,11 +1358,11 @@ pub use crate::key_exchange::group::curve25519::Curve25519; pub use crate::key_exchange::group::ed25519::Ed25519; #[cfg(feature = "ristretto255")] pub use crate::key_exchange::group::ristretto255::Ristretto255; +pub use crate::key_exchange::sigma_i::SigmaI; #[cfg(feature = "ecdsa")] pub use crate::key_exchange::sigma_i::ecdsa::Ecdsa; pub use crate::key_exchange::sigma_i::hash_eddsa::HashEddsa; pub use crate::key_exchange::sigma_i::pure_eddsa::PureEddsa; -pub use crate::key_exchange::sigma_i::SigmaI; pub use crate::key_exchange::tripledh::TripleDh; pub use crate::messages::{ CredentialFinalization, CredentialFinalizationLen, CredentialRequest, CredentialRequestLen, diff --git a/src/serialization/tests.rs b/src/serialization/tests.rs index 4c40b12..90e1a0a 100644 --- a/src/serialization/tests.rs +++ b/src/serialization/tests.rs @@ -11,12 +11,12 @@ use std::vec; use std::vec::Vec; use digest::Output; -use generic_array::typenum::{Sum, Unsigned}; use generic_array::ArrayLength; +use generic_array::typenum::{Sum, Unsigned}; use proptest::collection::vec; use proptest::prelude::*; -use rand::rngs::OsRng; use rand::RngCore; +use rand::rngs::OsRng; use voprf::Group as _; use crate::ciphersuite::{CipherSuite, KeGroup, OprfGroup, OprfHash}; diff --git a/src/tests/test_opaque_vectors.rs b/src/tests/test_opaque_vectors.rs index c8e3ed7..589fc3c 100644 --- a/src/tests/test_opaque_vectors.rs +++ b/src/tests/test_opaque_vectors.rs @@ -13,8 +13,8 @@ use std::vec::Vec; use digest::OutputSizeUser; use generic_array::typenum::Sum; use generic_array::{ArrayLength, GenericArray}; -use rand::rngs::OsRng; use rand::RngCore; +use rand::rngs::OsRng; use serde_json::Value; use crate::ciphersuite::{CipherSuite, KeGroup, OprfGroup, OprfHash}; diff --git a/tests/remote_key.rs b/tests/remote_key.rs index 0c729d9..f64398b 100644 --- a/tests/remote_key.rs +++ b/tests/remote_key.rs @@ -16,30 +16,31 @@ use std::vec::Vec; #[cfg(feature = "ecdsa")] use ::ecdsa::SignatureSize; use cryptoki::context::{CInitializeArgs, Pkcs11}; -use cryptoki::mechanism::elliptic_curve::{EcKdf, Ecdh1DeriveParams}; use cryptoki::mechanism::Mechanism; +use cryptoki::mechanism::elliptic_curve::{EcKdf, Ecdh1DeriveParams}; use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle}; use cryptoki::session::{Session, UserType}; use cryptoki::types::AuthPin; #[cfg(feature = "ecdsa")] use digest::Digest; use digest::OutputSizeUser; -use elliptic_curve::group::prime::PrimeCurveAffine; +#[cfg(feature = "ecdsa")] +use elliptic_curve::PrimeCurve; use elliptic_curve::group::Curve; +use elliptic_curve::group::prime::PrimeCurveAffine; use elliptic_curve::pkcs8::der::asn1::{OctetString, OctetStringRef}; use elliptic_curve::pkcs8::der::{Decode, Encode}; use elliptic_curve::pkcs8::{AssociatedOid, ObjectIdentifier}; use elliptic_curve::point::{AffineCoordinates, DecompressPoint}; use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, Tag, ToEncodedPoint}; -#[cfg(feature = "ecdsa")] -use elliptic_curve::PrimeCurve; use elliptic_curve::{AffinePoint, CurveArithmetic, FieldBytesSize, Group as _, ProjectivePoint}; use generic_array::typenum::Unsigned; use generic_array::{ArrayLength, GenericArray}; +use opaque_ke::key_exchange::KeyExchange; +use opaque_ke::key_exchange::group::Group; #[cfg(all(feature = "ristretto255", feature = "ed25519"))] use opaque_ke::key_exchange::group::ed25519::{self, Ed25519}; use opaque_ke::key_exchange::group::elliptic_curve::NonIdentity; -use opaque_ke::key_exchange::group::Group; #[cfg(feature = "ecdsa")] use opaque_ke::key_exchange::sigma_i::ecdsa::{self, Ecdsa, PreHash}; #[cfg(all(feature = "ristretto255", feature = "ed25519"))] @@ -47,7 +48,6 @@ use opaque_ke::key_exchange::sigma_i::pure_eddsa::PureEddsa; #[cfg(feature = "ecdsa")] use opaque_ke::key_exchange::sigma_i::{CachedMessage, HashOutput, Message, SigmaI}; use opaque_ke::key_exchange::tripledh::TripleDh; -use opaque_ke::key_exchange::KeyExchange; use opaque_ke::keypair::{KeyPair, PublicKey}; use opaque_ke::ksf::Identity; use opaque_ke::{