vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Updating to draft-krawczyk-cfrg-opaque-06, reworking envelope construction and removing AEAD (#14)

Browse Source 
Updating to draft-krawczyk-cfrg-opaque-06, reworking envelope construction and removing AEAD
This commit is contained in:
Kevin Lewi
2020-07-02 12:24:53 -07:00
committed by GitHub
parent 4a638b8a22
commit 6d02c72aae
11 changed files with 340 additions and 571 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/opaque.rs
+60 -105
View File
@@ -7,6 +7,7 @@
use crate::{
ciphersuite::CipherSuite,
envelope::{Envelope, ExportKeySize},
errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError},
group::Group,
key_exchange::{
@@ -16,27 +17,13 @@ use crate::{
keypair::{Key, KeyPair, SizedBytes},
oprf,
oprf::OprfClientBytes,
rkr_encryption::{RKRCipher, RKRCiphertext},
slow_hash::SlowHash,
};
use generic_array::{
typenum::{Unsigned, U32},
GenericArray,
};
use hkdf::Hkdf;
use generic_array::{typenum::Unsigned, GenericArray};
use rand_core::{CryptoRng, RngCore};
use sha2::{Digest, Sha256};
use std::{convert::TryFrom, marker::PhantomData};
use zeroize::Zeroize;
// Constant string used as salt for HKDF computation
const STR_ENVU: &[u8] = b"EnvU";
/// The length of the "key-derivation key" output by the client registration
/// and login finish steps
pub const DERIVED_KEY_LEN: usize = 32;
// Messages
// =========
@@ -99,19 +86,18 @@ where
}
}
/// The final message from the client, containing encrypted cryptographic
/// The final message from the client, containing sealed cryptographic
/// identifiers
pub struct RegisterThirdMessage<Aead, KeyFormat: KeyPair> {
/// The "envelope" generated by the user, containing encrypted
pub struct RegisterThirdMessage<KeyFormat: KeyPair> {
/// The "envelope" generated by the user, containing sealed
/// cryptographic identifiers
envelope: RKRCiphertext<Aead>,
envelope: Envelope,
/// The user's public key
client_s_pk: KeyFormat::Repr,
}
impl<Aead, KeyFormat> RegisterThirdMessage<Aead, KeyFormat>
impl<KeyFormat> RegisterThirdMessage<KeyFormat>
where
Aead: aead::Aead + aead::NewAead<KeySize = U32>,
KeyFormat: KeyPair,
{
pub fn to_bytes(&self) -> Vec<u8> {
@@ -123,23 +109,25 @@ where
}
}
impl<Aead, KeyFormat> TryFrom<&[u8]> for RegisterThirdMessage<Aead, KeyFormat>
impl<KeyFormat> TryFrom<&[u8]> for RegisterThirdMessage<KeyFormat>
where
Aead: aead::Aead + aead::NewAead<KeySize = U32>,
KeyFormat: KeyPair,
{
type Error = ProtocolError;
fn try_from(third_message_bytes: &[u8]) -> Result<Self, Self::Error> {
let rkr_size = RKRCiphertext::<Aead>::rkr_with_nonce_size();
let key_len = <KeyFormat::Repr as SizedBytes>::Len::to_usize();
let checked_bytes =
check_slice_size(third_message_bytes, rkr_size + key_len, "third_message")?;
let unchecked_client_s_pk = KeyFormat::Repr::from_bytes(&checked_bytes[rkr_size..])?;
let envelope_size = key_len + Envelope::additional_size();
let checked_bytes = check_slice_size(
third_message_bytes,
envelope_size + key_len,
"third_message",
)?;
let unchecked_client_s_pk = KeyFormat::Repr::from_bytes(&checked_bytes[envelope_size..])?;
let client_s_pk = KeyFormat::check_public_key(unchecked_client_s_pk)?;
Ok(Self {
envelope: RKRCiphertext::from_bytes(&checked_bytes[..rkr_size])?,
envelope: Envelope::from_bytes(&checked_bytes[..envelope_size])?,
client_s_pk,
})
}
@@ -178,18 +166,19 @@ impl<Grp: Group> LoginFirstMessage<Grp> {
/// The answer sent by the server to the user, upon reception of the
/// login attempt.
pub struct LoginSecondMessage<Aead, Grp> {
pub struct LoginSecondMessage<Grp, KeyFormat> {
_key_format: PhantomData<KeyFormat>,
/// the server's oprf output
beta: Grp,
/// the user's encrypted information,
envelope: RKRCiphertext<Aead>,
/// the user's sealed information,
envelope: Envelope,
ke2_message: KE2Message,
}
impl<Aead, Grp> LoginSecondMessage<Aead, Grp>
impl<Grp, KeyFormat> LoginSecondMessage<Grp, KeyFormat>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair,
{
pub fn to_bytes(&self) -> Vec<u8> {
[
@@ -201,18 +190,19 @@ where
}
}
impl<Aead, Grp> TryFrom<&[u8]> for LoginSecondMessage<Aead, Grp>
impl<Grp, KeyFormat> TryFrom<&[u8]> for LoginSecondMessage<Grp, KeyFormat>
where
Aead: aead::NewAead<KeySize = U32> + aead::Aead,
Grp: Group,
KeyFormat: KeyPair,
{
type Error = ProtocolError;
fn try_from(second_message_bytes: &[u8]) -> Result<Self, Self::Error> {
let cipher_len = RKRCiphertext::<Aead>::rkr_with_nonce_size();
let key_len = <KeyFormat::Repr as SizedBytes>::Len::to_usize();
let envelope_size = key_len + Envelope::additional_size();
let elem_len = Grp::ElemLen::to_usize();
let checked_slice = check_slice_size(
second_message_bytes,
elem_len + cipher_len + KE2_MESSAGE_LEN,
elem_len + envelope_size + KE2_MESSAGE_LEN,
"login_second_message_bytes",
)?;
@@ -222,11 +212,11 @@ where
let arr = GenericArray::from_slice(beta_bytes);
let beta = Grp::from_element_slice(arr)?;
let envelope =
RKRCiphertext::<Aead>::from_bytes(&checked_slice[elem_len..elem_len + cipher_len])?;
let ke2_message = KE2Message::try_from(&checked_slice[elem_len + cipher_len..])?;
let envelope = Envelope::from_bytes(&checked_slice[elem_len..elem_len + envelope_size])?;
let ke2_message = KE2Message::try_from(&checked_slice[elem_len + envelope_size..])?;
Ok(Self {
_key_format: PhantomData,
beta,
envelope,
ke2_message,
@@ -235,7 +225,7 @@ where
}
/// The answer sent by the client to the server, upon reception of the
/// encrypted envelope
/// sealed envelope
pub struct LoginThirdMessage {
ke3_message: KE3Message,
}
@@ -260,8 +250,6 @@ impl LoginThirdMessage {
/// The state elements the client holds to register itself
pub struct ClientRegistration<CS: CipherSuite> {
/// A choice of symmetric encryption for the envelope
_aead: PhantomData<CS::Aead>,
/// a blinding factor
pub(crate) blinding_factor: <<CS as CipherSuite>::Group as Group>::Scalar,
/// the client's password
@@ -278,7 +266,6 @@ impl<CS: CipherSuite> TryFrom<&[u8]> for ClientRegistration<CS> {
let blinding_factor = CS::Group::from_scalar_slice(blinding_factor_bytes)?;
let password = bytes[scalar_len..].to_vec();
Ok(Self {
_aead: PhantomData,
blinding_factor,
password,
})
@@ -311,7 +298,6 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -333,7 +319,6 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
Ok((
RegisterFirstMessage::<CS::Group> { alpha },
Self {
_aead: PhantomData,
blinding_factor,
password: password.to_vec(),
},
@@ -341,9 +326,9 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
}
}
type ClientRegistrationFinishResult<Aead, KeyFormat> = (
RegisterThirdMessage<Aead, KeyFormat>,
GenericArray<u8, <Sha256 as Digest>::OutputSize>,
type ClientRegistrationFinishResult<KeyFormat> = (
RegisterThirdMessage<KeyFormat>,
GenericArray<u8, ExportKeySize>,
);
impl<CS: CipherSuite> ClientRegistration<CS> {
@@ -363,7 +348,6 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -383,7 +367,7 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
r2: RegisterSecondMessage<CS::Group>,
server_s_pk: &<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr,
rng: &mut R,
) -> Result<ClientRegistrationFinishResult<CS::Aead, CS::KeyFormat>, ProtocolError> {
) -> Result<ClientRegistrationFinishResult<CS::KeyFormat>, ProtocolError> {
let client_static_keypair = CS::KeyFormat::generate_random(rng)?;
let password_derived_key = get_password_derived_key::<CS::Group, CS::SlowHash>(
@@ -391,17 +375,9 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
r2.beta,
&self.blinding_factor,
)?;
let h = Hkdf::<Sha256>::new(None, &password_derived_key);
let mut okm = [0u8; 3 * DERIVED_KEY_LEN];
h.expand(STR_ENVU, &mut okm)
.map_err(|_| InternalPakeError::HkdfError)?;
let encryption_key = &okm[..DERIVED_KEY_LEN];
let hmac_key = &okm[DERIVED_KEY_LEN..2 * DERIVED_KEY_LEN];
let kd_key = &okm[2 * DERIVED_KEY_LEN..];
let envelope = RKRCiphertext::<CS::Aead>::encrypt(
&encryption_key,
&hmac_key,
let (envelope, export_key) = Envelope::seal(
&password_derived_key,
&client_static_keypair.private().to_arr(),
&server_s_pk.to_arr(),
rng,
@@ -412,7 +388,7 @@ impl<CS: CipherSuite> ClientRegistration<CS> {
envelope,
client_s_pk: client_static_keypair.public().clone(),
},
*GenericArray::from_slice(&kd_key),
export_key,
))
}
}
@@ -447,7 +423,7 @@ impl<CS: CipherSuite> Drop for ClientLogin<CS> {
/// The state elements the server holds to record a registration
pub struct ServerRegistration<CS: CipherSuite> {
envelope: Option<RKRCiphertext<CS::Aead>>,
envelope: Option<Envelope>,
client_s_pk: Option<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr>,
pub(crate) oprf_key: <<CS as CipherSuite>::Group as Group>::Scalar,
}
@@ -466,7 +442,7 @@ where
let key_len =
<<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
let scalar_len = <<CS as CipherSuite>::Group as Group>::ScalarLen::to_usize();
let rkr_size = RKRCiphertext::<CS::Aead>::rkr_with_nonce_size();
let envelope_size = key_len + Envelope::additional_size();
if server_registration_bytes.len() == scalar_len {
return Ok(Self {
@@ -480,7 +456,7 @@ where
let checked_bytes = check_slice_size(
server_registration_bytes,
rkr_size + key_len + scalar_len,
envelope_size + key_len + scalar_len,
"server_registration_bytes",
)?;
let oprf_key_bytes = GenericArray::from_slice(&checked_bytes[..scalar_len]);
@@ -490,8 +466,8 @@ where
)?;
let client_s_pk = CS::KeyFormat::check_public_key(unchecked_client_s_pk)?;
Ok(Self {
envelope: Some(RKRCiphertext::from_bytes(
&checked_bytes[checked_bytes.len() - rkr_size..],
envelope: Some(Envelope::from_bytes(
&checked_bytes[checked_bytes.len() - envelope_size..],
)?),
client_s_pk: Some(client_s_pk),
oprf_key,
@@ -536,7 +512,6 @@ where
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -583,7 +558,6 @@ where
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -601,7 +575,7 @@ where
/// ```
pub fn finish(
self,
message: RegisterThirdMessage<CS::Aead, CS::KeyFormat>,
message: RegisterThirdMessage<CS::KeyFormat>,
) -> Result<Self, ProtocolError> {
Ok(Self {
envelope: Some(message.envelope),
@@ -616,8 +590,6 @@ where
/// The state elements the client holds to perform a login
pub struct ClientLogin<CS: CipherSuite> {
/// A choice of symmetric encryption for the envelope
_aead: PhantomData<CS::Aead>,
/// A choice of the keypair type
_key_format: PhantomData<CS::KeyFormat>,
/// A blinding factor, which is used to mask (and unmask) secret
@@ -637,7 +609,6 @@ impl<CS: CipherSuite> TryFrom<&[u8]> for ClientLogin<CS> {
let ke1_state = KE1State::try_from(&bytes[scalar_len..scalar_len + KE1_STATE_LEN])?;
let password = bytes[scalar_len + KE1_STATE_LEN..].to_vec();
Ok(Self {
_aead: PhantomData,
_key_format: PhantomData,
blinding_factor,
password,
@@ -658,11 +629,7 @@ impl<CS: CipherSuite> ClientLogin<CS> {
}
}
type ClientLoginFinishResult = (
LoginThirdMessage,
Vec<u8>,
GenericArray<u8, <Sha256 as Digest>::OutputSize>,
);
type ClientLoginFinishResult = (LoginThirdMessage, Vec<u8>, GenericArray<u8, ExportKeySize>);
impl<CS: CipherSuite> ClientLogin<CS> {
/// Returns an initial "blinded" password request to send to the server, as well as a ClientLogin
@@ -679,7 +646,6 @@ impl<CS: CipherSuite> ClientLogin<CS> {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -706,7 +672,6 @@ impl<CS: CipherSuite> ClientLogin<CS> {
Ok((
l1,
Self {
_aead: PhantomData,
_key_format: PhantomData,
blinding_factor,
password: password.to_vec(),
@@ -715,7 +680,7 @@ impl<CS: CipherSuite> ClientLogin<CS> {
))
}
/// "Unblinds" the server's answer and returns the decrypted assets from
/// "Unblinds" the server's answer and returns the opened assets from
/// the server
///
/// # Arguments
@@ -732,7 +697,6 @@ impl<CS: CipherSuite> ClientLogin<CS> {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -751,7 +715,7 @@ impl<CS: CipherSuite> ClientLogin<CS> {
/// ```
pub fn finish<R: RngCore + CryptoRng>(
self,
l2: LoginSecondMessage<CS::Aead, CS::Group>,
l2: LoginSecondMessage<CS::Group, CS::KeyFormat>,
server_s_pk: &<<CS as CipherSuite>::KeyFormat as KeyPair>::Repr,
_client_e_sk_rng: &mut R,
) -> Result<ClientLoginFinishResult, ProtocolError> {
@@ -762,35 +726,27 @@ impl<CS: CipherSuite> ClientLogin<CS> {
l2.beta,
&self.blinding_factor,
)?;
let h = Hkdf::<Sha256>::new(None, &password_derived_key);
let mut okm = [0u8; 3 * DERIVED_KEY_LEN];
h.expand(STR_ENVU, &mut okm)
.map_err(|_| InternalPakeError::HkdfError)?;
let encryption_key = &okm[..DERIVED_KEY_LEN];
let hmac_key = &okm[DERIVED_KEY_LEN..2 * DERIVED_KEY_LEN];
let kd_key = &okm[2 * DERIVED_KEY_LEN..];
let client_s_sk = Key::from_bytes(
&l2.envelope
.decrypt(&encryption_key, &hmac_key, &server_s_pk.to_arr())
.map_err(|e| match e {
PakeError::DecryptionHmacError => PakeError::InvalidLoginError,
err => err,
})?,
)?;
let (client_s_sk, export_key) = &l2
.envelope
.open(&password_derived_key, &server_s_pk.to_arr())
.map_err(|e| match e {
InternalPakeError::SealOpenHmacError => PakeError::InvalidLoginError,
err => PakeError::from(err),
})?;
let (ke3_state, ke3_message) = generate_ke3::<CS::KeyFormat>(
l2_bytes,
l2.ke2_message,
&self.ke1_state,
server_s_pk.clone(),
client_s_sk,
Key::from_bytes(client_s_sk)?,
)?;
Ok((
LoginThirdMessage { ke3_message },
ke3_state.shared_secret,
*GenericArray::from_slice(&kd_key),
*export_key,
))
}
}
@@ -810,7 +766,7 @@ impl TryFrom<&[u8]> for ServerLogin {
}
type ServerLoginStartResult<CS> = (
LoginSecondMessage<<CS as CipherSuite>::Aead, <CS as CipherSuite>::Group>,
LoginSecondMessage<<CS as CipherSuite>::Group, <CS as CipherSuite>::KeyFormat>,
ServerLogin,
);
@@ -836,7 +792,6 @@ impl ServerLogin {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;
@@ -864,8 +819,8 @@ impl ServerLogin {
let client_s_pk = password_file
.client_s_pk
.ok_or(PakeError::EncryptionError)?;
let envelope = password_file.envelope.ok_or(PakeError::EncryptionError)?;
.ok_or(InternalPakeError::SealError)?;
let envelope = password_file.envelope.ok_or(InternalPakeError::SealError)?;
let l2_component: Vec<u8> = [beta.to_bytes().as_slice(), &envelope.to_bytes()].concat();
@@ -880,6 +835,7 @@ impl ServerLogin {
)?;
let l2 = LoginSecondMessage {
_key_format: PhantomData,
beta,
envelope,
ke2_message,
@@ -905,7 +861,6 @@ impl ServerLogin {
/// use opaque_ke::ciphersuite::CipherSuite;
/// struct Default;
/// impl CipherSuite for Default {
/// type Aead = chacha20poly1305::ChaCha20Poly1305;
/// type Group = curve25519_dalek::ristretto::RistrettoPoint;
/// type KeyFormat = opaque_ke::keypair::X25519KeyPair;
/// type SlowHash = opaque_ke::slow_hash::NoOpHash;