feat: upgrade crypto ecosystem to latest RustCrypto stack (#1)

Upgrade all core cryptographic dependencies to their latest versions: Dependencies: - digest: 0.10 to 0.11 - elliptic-curve: 0.13 to 0.14 - hkdf: 0.12 to 0.13 - hmac: 0.12 to 0.13 - rand: 0.8 to 0.10 - rand_chacha: 0.3 to 0.10 - sha2: 0.10 to 0.11 - getrandom: 0.2 to 0.4 (WASM) - ml-kem: 0.3.0-rc.0 to 0.3 - ecdsa: 0.16 to 0.17.0-rc.23 - rfc6979: 0.4 to 0.6 (now internal to ecdsa) - p256/p384/p521: 0.13 to 0.14.0-rc.15 - curve25519-dalek: 4 to 5.0.0-rc - ed25519-dalek: 2 to 3.0.0-rc - cryptoki: 0.9 to 0.12 - rustyline: 17 to 18 - scrypt: 0.11 to 0.12 - voprf replaced by voprf-vx 1.0.0-pre.0 Migration changes: - generic-array 0.14 to 1.4 with hybrid-array 0.4 interop - ArrayLength<u8> to ArrayLength (generic-array 1.x) - Added ConcatExt trait to disambiguate from [T]::concat - Replaced Hmac with SimpleHmac for digest 0.11 compatibility - Added OutputSize<H>: ArrayLength bounds throughout Hash trait - Converted hybrid_array::Array between GenericArray at API boundaries - Updated GroupEncoding Repr bound to hybrid_array::Array - ECDSA sign now uses ecdsa::hazmat::sign_prehashed_rfc6979 - Removed direct rfc6979 dependency (handled by ecdsa internally) - Replaced bincode with postcard for no_std serialization - Re-exported hybrid_array from crate root Other changes: - Renamed crate to opaque-vx - Increased MSRV to 1.89 - Added cryptography to Cargo.toml categories - Removed Facebook-specific contributions from CONTRIBUTING.md - Removed v3 to v4 migration test - Removed unstable rustfmt configurations for stable compatibility Reviewed-on: #1 Co-authored-by: UneBaguette <[email protected]> Co-committed-by: UneBaguette <[email protected]>
2026-07-01 11:52:12 +02:00
parent 5e2ba86643
commit 71df1ee49a
45 changed files with 1680 additions and 1483 deletions
@@ -19,8 +19,9 @@ use generic_array::{ArrayLength, GenericArray};
 #[cfg(feature = "kem")]
 use ml_kem::MlKem768;
 use rand::SeedableRng;
-use rand::rngs::OsRng;
+use rand::rngs::SysRng;
 use rand_chacha::ChaCha20Rng;
+use rand_core::UnwrapErr;
 use serde_json::Value;
 use subtle::ConstantTimeEq;
 use voprf::Group as _;
@@ -42,6 +43,7 @@ use crate::messages::{
    RegistrationResponseLen, RegistrationUploadLen,
 };
 use crate::opaque::*;
+use crate::tests::decode;
 use crate::tests::mock_rng::CycleRng;
 use crate::*;

@@ -70,7 +72,7 @@ macro_rules! ciphersuite_types {

 macro_rules! generate {
    ($(#[$attr:meta])* $name:ident, $oprf:ty, $ke:ty, ($output:ident)) => {
-        paste::paste! {
+        pastey::paste! {
            $(#[$attr])*
            {
                let parameters = generate_parameters::<$name>()?;
@@ -89,7 +91,7 @@ macro_rules! generate {

 macro_rules! run_all {
    ($(#[$attr:meta])* $name:ident, $oprf:ty, $ke:ty, ($fn:ident $(, $par:expr)*)) => {
-        paste::paste! {
+        pastey::paste! {
            $(#[$attr])*
            $fn::<$name>(super::full_test_vectors::[<TEST_VECTOR_ $name:snake:upper>] $(, $par)*)?;
        }
@@ -118,7 +120,7 @@ macro_rules! oprf_ciphersuites {
        #[$ke_attr_1:meta] #[$ke_attr_2:meta] [$ke_name:ident, $ke:ty],
        [$($(#[$oprf_attr:meta])? [$oprf_name:ident, $oprf:ty$(,)?]),+$(,)?],
    ) => {
-        paste::paste! {
+        pastey::paste! {
            $($macro!(#[$ke_attr_1] #[$ke_attr_2] $(#[$oprf_attr])? [<$oprf_name $ke_name>], $oprf, $ke, $par);)+
        }
    };
@@ -127,7 +129,7 @@ macro_rules! oprf_ciphersuites {
        #[$ke_attr:meta] [$ke_name:ident, $ke:ty],
        [$($(#[$oprf_attr:meta])? [$oprf_name:ident, $oprf:ty$(,)?]),+$(,)?],
    ) => {
-        paste::paste! {
+        pastey::paste! {
            $($macro!(#[$ke_attr] $(#[$oprf_attr])? [<$oprf_name $ke_name>], $oprf, $ke, $par);)+
        }
    };
@@ -136,7 +138,7 @@ macro_rules! oprf_ciphersuites {
        [$ke_name:ident, $ke:ty],
        [$($(#[$oprf_attr:meta])? [$oprf_name:ident, $oprf:ty$(,)?]),+$(,)?],
    ) => {
-        paste::paste! {
+        pastey::paste! {
            $($macro!($(#[$oprf_attr])? [<$oprf_name $ke_name>], $oprf, $ke, $par);)+
        }
    }
@@ -196,7 +198,7 @@ macro_rules! sigma_i_ciphersuites {
        $macro:ident!$par:tt =>
        [$($(#[$sig_attr:meta])? [$sig_name:ident, $sig:ty]),+$(,)?],
    ) => {
-        paste::paste! {
+        pastey::paste! {
            $(
                oprf_ciphersuites!(
                    $macro!$par => [
@@ -261,10 +263,6 @@ pub struct TestVectorParameters {

 static STR_PASSWORD: &str = "password";

-fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
-    values[key].as_str().and_then(|s| hex::decode(s).ok())
-}
-
 fn populate_test_vectors(values: &Value) -> TestVectorParameters {
    TestVectorParameters {
        client_s_pk: decode(values, "client_s_pk").unwrap(),
@@ -521,37 +519,37 @@ where
    <CS::KeyExchange as KeyExchange>::KE3Message: Serialize,
    // ClientRegistration: KgSk + KgPk
    <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<<OprfGroup<CS> as voprf::Group>::ElemLen>,
-    ClientRegistrationLen<CS>: ArrayLength<u8>,
+    ClientRegistrationLen<CS>: ArrayLength,
    // RegistrationResponse: KgPk + KePk
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<<KeGroup<CS> as Group>::PkLen>,
-    RegistrationResponseLen<CS>: ArrayLength<u8>,
+    RegistrationResponseLen<CS>: ArrayLength,
    // RegistrationUpload: (KePk + Hash) + Envelope
    <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-    RegistrationUploadLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<EnvelopeLen<CS>>,
+    RegistrationUploadLen<CS>: ArrayLength,
    // ServerRegistration = RegistrationUpload
    // CredentialRequest: KgPk + Ke1Message
    <CS::KeyExchange as KeyExchange>::KE1Message: Serialize,
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
-    CredentialRequestLen<CS>: ArrayLength<u8>,
+    CredentialRequestLen<CS>: ArrayLength,
    // ClientLogin: KgSk + CredentialRequest + Ke1State
    <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
    <CS::KeyExchange as KeyExchange>::KE1State: Serialize,
    Sum<<OprfGroup<CS> as voprf::Group>::ScalarLen, CredentialRequestLen<CS>>:
-        ArrayLength<u8> + Add<Ke1StateLen<CS>>,
-    ClientLoginLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<Ke1StateLen<CS>>,
+    ClientLoginLen<CS>: ArrayLength,
    // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
    Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
-        ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
-    CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<MaskedResponseLen<CS>>,
+    CredentialResponseWithoutKeLen<CS>: ArrayLength,
    // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
    <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
    CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
-    CredentialResponseLen<CS>: ArrayLength<u8>,
+    CredentialResponseLen<CS>: ArrayLength,
 {
-    use rand::RngCore;
+    use rand::Rng;

    use crate::keypair::KeyPair;

@@ -588,20 +586,19 @@ where
    let dummy_client_pk = dummy_client_pk.serialize();
    let server_setup = ServerSetup::<CS>::deserialize(
        &[
-            oprf_seed.as_ref(),
-            &server_s_kp.private().serialize(),
-            &dummy_client_pk,
+            oprf_seed.as_slice(),
+            server_s_kp.private().serialize().as_slice(),
+            dummy_client_pk.as_slice(),
        ]
        .concat(),
-    )
-    .unwrap();
+    )?;

-    let blinding_factor = <OprfGroup<CS> as voprf::Group>::random_scalar(&mut rng);
+    let blinding_factor = <OprfGroup<CS> as voprf::Group>::random_scalar(&mut rng)?;
    let blinding_factor_bytes = OprfGroup::<CS>::serialize_scalar(blinding_factor);

    let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_bytes.to_vec());
    let client_registration_start_result =
-        ClientRegistration::<CS>::start(&mut blinding_factor_registration_rng, password).unwrap();
+        ClientRegistration::<CS>::start(&mut blinding_factor_registration_rng, password)?;
    let blinding_factor_bytes_returned = OprfGroup::<CS>::serialize_scalar(
        client_registration_start_result
            .state
@@ -620,8 +617,8 @@ where
        &server_setup,
        client_registration_start_result.message,
        credential_identifier,
-    )
-    .unwrap();
+    )?;
+
    let registration_response_bytes = server_registration_start_result.message.serialize();

    let mut client_s_sk_and_nonce: Vec<u8> = Vec::new();
@@ -629,21 +626,18 @@ where
    client_s_sk_and_nonce.extend_from_slice(&envelope_nonce);

    let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
-    let client_registration_finish_result = client_registration_start_result
-        .state
-        .finish(
-            &mut finish_registration_rng,
-            password,
-            server_registration_start_result.message,
-            ClientRegistrationFinishParameters::new(
-                Identifiers {
-                    client: Some(id_u),
-                    server: Some(id_s),
-                },
-                None,
-            ),
-        )
-        .unwrap();
+    let client_registration_finish_result = client_registration_start_result.state.finish(
+        &mut finish_registration_rng,
+        password,
+        server_registration_start_result.message,
+        ClientRegistrationFinishParameters::new(
+            Identifiers {
+                client: Some(id_u),
+                server: Some(id_s),
+            },
+            None,
+        ),
+    )?;
    let registration_upload_bytes = client_registration_finish_result.message.serialize();

    let password_file = ServerRegistration::finish(client_registration_finish_result.message);
@@ -656,7 +650,7 @@ where

    let mut client_login_start_rng = CycleRng::new(client_login_start);
    let client_login_start_result =
-        ClientLogin::<CS>::start(&mut client_login_start_rng, password).unwrap();
+        ClientLogin::<CS>::start(&mut client_login_start_rng, password)?;
    let credential_request_bytes = client_login_start_result.message.serialize();
    let client_login_state = client_login_start_result.state.serialize().to_vec();

@@ -683,27 +677,23 @@ where
                server: Some(id_s),
            },
        },
-    )
-    .unwrap();
+    )?;
    let credential_response_bytes = server_login_start_result.message.serialize();
    let server_login_state = server_login_start_result.state.serialize();

-    let client_login_finish_result = client_login_start_result
-        .state
-        .finish(
-            &mut CycleRng::new(client_sig_rng.to_vec()),
-            password,
-            server_login_start_result.message,
-            ClientLoginFinishParameters::new(
-                Some(context),
-                Identifiers {
-                    client: Some(id_u),
-                    server: Some(id_s),
-                },
-                None,
-            ),
-        )
-        .unwrap();
+    let client_login_finish_result = client_login_start_result.state.finish(
+        &mut CycleRng::new(client_sig_rng.to_vec()),
+        password,
+        server_login_start_result.message,
+        ClientLoginFinishParameters::new(
+            Some(context),
+            Identifiers {
+                client: Some(id_u),
+                server: Some(id_s),
+            },
+            None,
+        ),
+    )?;
    let credential_finalization_bytes = client_login_finish_result.message.serialize();

    Ok(TestVectorParameters {
@@ -787,7 +777,7 @@ fn test_registration_request() -> Result<(), ProtocolError> {
    where
        // ClientRegistration: KgSk + KgPk
        <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<<OprfGroup<CS> as voprf::Group>::ElemLen>,
-        ClientRegistrationLen<CS>: ArrayLength<u8>,
+        ClientRegistrationLen<CS>: ArrayLength,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());
        let mut rng = CycleRng::new(parameters.blinding_factor.to_vec());
@@ -822,14 +812,16 @@ fn test_serialization() -> Result<(), ProtocolError> {
            ClientRegistration::<CS>::start(&mut rng, &parameters.password)?;

        // Test the bincode serialization (binary).
+        let cfg = bincode_next::config::standard();
        let registration_request =
-            bincode::serialize(&client_registration_start_result.message).unwrap();
+            bincode_next::serde::encode_to_vec(&client_registration_start_result.message, cfg)
+                .unwrap();
        assert_eq!(
            registration_request.len(),
            RegistrationRequestLen::<CS>::USIZE
        );
-        let registration_request: RegistrationRequest<CS> =
-            bincode::deserialize(&registration_request).unwrap();
+        let (registration_request, _): (RegistrationRequest<CS>, usize) =
+            bincode_next::serde::decode_from_slice(&registration_request, cfg).unwrap();
        assert_eq!(
            hex::encode(client_registration_start_result.message.serialize()),
            hex::encode(registration_request.serialize()),
@@ -852,7 +844,7 @@ fn test_registration_response() -> Result<(), ProtocolError> {
    where
        // RegistrationResponse: KgPk + KePk
        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<<KeGroup<CS> as Group>::PkLen>,
-        RegistrationResponseLen<CS>: ArrayLength<u8>,
+        RegistrationResponseLen<CS>: ArrayLength,
    {
        let parameters = populate_test_vectors(
            &serde_json::from_str(test_vector).map_err(|_| ProtocolError::SerializationError)?,
@@ -894,8 +886,8 @@ fn test_registration_upload() -> Result<(), ProtocolError> {
        // RegistrationUpload: (KePk + Hash) + Envelope
        <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-            ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-        RegistrationUploadLen<CS>: ArrayLength<u8>,
+            ArrayLength + Add<EnvelopeLen<CS>>,
+        RegistrationUploadLen<CS>: ArrayLength,
    {
        let parameters = populate_test_vectors(
            &serde_json::from_str(test_vector).map_err(|_| ProtocolError::SerializationError)?,
@@ -945,8 +937,8 @@ fn test_password_file() -> Result<(), ProtocolError> {
        // RegistrationUpload: (KePk + Hash) + Envelope
        <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-            ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-        RegistrationUploadLen<CS>: ArrayLength<u8>,
+            ArrayLength + Add<EnvelopeLen<CS>>,
+        RegistrationUploadLen<CS>: ArrayLength,
        // ServerRegistration = RegistrationUpload
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());
@@ -977,13 +969,13 @@ fn test_credential_request() -> Result<(), ProtocolError> {
        // CredentialRequest: KgPk + Ke1Message
        <CS::KeyExchange as KeyExchange>::KE1Message: Serialize,
        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
-        CredentialRequestLen<CS>: ArrayLength<u8>,
+        CredentialRequestLen<CS>: ArrayLength,
        // ClientLogin: KgSk + CredentialRequest + Ke1State
        <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
        <CS::KeyExchange as KeyExchange>::KE1State: Serialize,
        Sum<<OprfGroup<CS> as voprf::Group>::ScalarLen, CredentialRequestLen<CS>>:
-            ArrayLength<u8> + Add<Ke1StateLen<CS>>,
-        ClientLoginLen<CS>: ArrayLength<u8>,
+            ArrayLength + Add<Ke1StateLen<CS>>,
+        ClientLoginLen<CS>: ArrayLength,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

@@ -1024,12 +1016,12 @@ fn test_credential_response() -> Result<(), ProtocolError> {
        // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
        Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
-            ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
-        CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
+            ArrayLength + Add<MaskedResponseLen<CS>>,
+        CredentialResponseWithoutKeLen<CS>: ArrayLength,
        // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
        <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
        CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
-        CredentialResponseLen<CS>: ArrayLength<u8>,
+        CredentialResponseLen<CS>: ArrayLength,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

@@ -1182,8 +1174,8 @@ fn test_complete_flow<CS: CipherSuite>(
    login_password: &[u8],
 ) -> Result<(), ProtocolError> {
    let credential_identifier = b"credentialIdentifier";
-    let mut client_rng = OsRng;
-    let mut server_rng = OsRng;
+    let mut client_rng = UnwrapErr(SysRng);
+    let mut server_rng = UnwrapErr(SysRng);
    let server_setup = ServerSetup::<CS>::new(&mut server_rng);
    let client_registration_start_result =
        ClientRegistration::<CS>::start(&mut client_rng, registration_password)?;
@@ -1330,8 +1322,8 @@ fn test_reflected_value_error_registration() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
        let credential_identifier = b"credentialIdentifier";
        let password = b"password";
-        let mut client_rng = OsRng;
-        let mut server_rng = OsRng;
+        let mut client_rng = UnwrapErr(SysRng);
+        let mut server_rng = UnwrapErr(SysRng);
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, password)?;
@@ -1377,8 +1369,8 @@ fn test_reflected_value_error_login() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
        let credential_identifier = b"credentialIdentifier";
        let password = b"password";
-        let mut client_rng = OsRng;
-        let mut server_rng = OsRng;
+        let mut client_rng = UnwrapErr(SysRng);
+        let mut server_rng = UnwrapErr(SysRng);
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, password)?;
@@ -9,9 +9,10 @@
 use core::cmp::min;
 use std::vec::Vec;

-use rand::{CryptoRng, Error, RngCore};
+use core::convert::Infallible;
+use rand_core::{TryCryptoRng, TryRng};

-/// A simple implementation of `RngCore` for testing purposes.
+/// A simple implementation of `Rng` for testing purposes.
 ///
 /// This generates a cyclic sequence (i.e. cycles over an initial buffer)
 #[derive(Clone, Debug)]
@@ -38,29 +39,35 @@ fn rotate_left<T>(data: &mut [T], steps: usize) {
    data.reverse();
 }

-impl RngCore for CycleRng {
-    fn next_u32(&mut self) -> u32 {
-        unimplemented!()
+impl TryRng for CycleRng {
+    type Error = Infallible;
+
+    fn try_next_u32(&mut self) -> Result<u32, Self::Error> {
+        let mut buf = [0u8; 4];
+
+        self.try_fill_bytes(&mut buf)?;
+
+        Ok(u32::from_le_bytes(buf))
    }

-    #[inline]
-    fn next_u64(&mut self) -> u64 {
-        unimplemented!()
+    fn try_next_u64(&mut self) -> Result<u64, Self::Error> {
+        let mut buf = [0u8; 8];
+
+        self.try_fill_bytes(&mut buf)?;
+
+        Ok(u64::from_le_bytes(buf))
    }

-    #[inline]
-    fn fill_bytes(&mut self, dest: &mut [u8]) {
+    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Self::Error> {
        let len = min(self.v.len(), dest.len());
-        dest[..len].copy_from_slice(&self.v[..len]);
-        rotate_left(&mut self.v, len);
-    }

-    #[inline]
-    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
-        self.fill_bytes(dest);
+        dest[..len].copy_from_slice(&self.v[..len]);
+
+        rotate_left(&mut self.v, len);
+
        Ok(())
    }
 }

 // This is meant for testing only
-impl CryptoRng for CycleRng {}
+impl TryCryptoRng for CycleRng {}
@@ -6,6 +6,9 @@
 // of this source tree. You may select, at your option, one of the above-listed
 // licenses.

+use serde_json::Value;
+use std::vec::Vec;
+
 mod full_test;
 #[rustfmt::skip]
 #[allow(dead_code)]
@@ -14,3 +17,7 @@ pub mod mock_rng;
 mod parser;
 mod rfc9807_vectors;
 mod test_opaque_vectors;
+
+pub(crate) fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
+    values[key].as_str().and_then(|s| hex::decode(s).ok())
+}
@@ -15,20 +15,18 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
 }

 fn parse_vector_types(input: &str) -> String {
-    let re = regex::Regex::new(r"  (?P<type>.+?) Test Vectors").unwrap();
+    let re = regex::Regex::new(r" {2}(?P<type>.+?) Test Vectors").unwrap();
    let mut vector_types = vec![];

    let chunks: Vec<&str> = re.split(input).collect();

-    let mut count = 1;
-    for caps in re.captures_iter(input) {
+    for (count, caps) in (1..).zip(re.captures_iter(input)) {
        let vector_type = format!(
            "\"{}\": [\n {} \n]",
            &caps["type"].trim(),
            parse_ciphersuites(chunks[count])
        );
        vector_types.push(vector_type);
-        count += 1;
    }

    vector_types.join(",\n")
@@ -36,15 +34,14 @@ fn parse_vector_types(input: &str) -> String {

 fn parse_ciphersuites(input: &str) -> String {
    let re = regex::Regex::new(
-        r" Configuration\n(.|\n)*?OPRF: (?P<oprf>.*?)\n(.|\n)*?Group: (?P<group>.*?)\n",
+        r" Configuration\n([\s\S])*?OPRF: (?P<oprf>.*?)\n([\s\S])*?Group: (?P<group>.*?)\n",
    )
    .unwrap();
    let mut ciphersuites = vec![];

    let chunks: Vec<&str> = re.split(input).collect();

-    let mut count = 1;
-    for caps in re.captures_iter(input) {
+    for (count, caps) in (1..).zip(re.captures_iter(input)) {
        let ciphersuite = format!(
            "{{ \"{}, {}\": {{ {} }} }}",
            &caps["oprf"],
@@ -52,7 +49,6 @@ fn parse_ciphersuites(input: &str) -> String {
            parse_params(chunks[count])
        );
        ciphersuites.push(ciphersuite);
-        count += 1;
    }

    ciphersuites.join(",\n")
@@ -10,13 +10,6 @@ use core::ops::Add;
 use std::vec;
 use std::vec::Vec;

-use digest::OutputSizeUser;
-use generic_array::typenum::Sum;
-use generic_array::{ArrayLength, GenericArray};
-use rand::RngCore;
-use rand::rngs::OsRng;
-use serde_json::Value;
-
 use crate::ciphersuite::{CipherSuite, KeGroup, OprfGroup, OprfHash};
 use crate::envelope::EnvelopeLen;
 use crate::errors::*;
@@ -30,8 +23,16 @@ use crate::messages::{
    RegistrationResponseLen, RegistrationUploadLen,
 };
 use crate::opaque::*;
+use crate::tests::decode;
 use crate::tests::mock_rng::CycleRng;
 use crate::*;
+use digest::OutputSizeUser;
+use generic_array::typenum::Sum;
+use generic_array::{ArrayLength, GenericArray};
+use rand::Rng;
+use rand::rngs::SysRng;
+use rand_core::UnwrapErr;
+use serde_json::Value;

 #[allow(non_snake_case)]
 #[derive(Debug)]
@@ -87,19 +88,15 @@ macro_rules! parse_default {
    };
 }

-fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
-    values[key].as_str().and_then(|s| hex::decode(s).ok())
-}
-
 fn populate_test_vectors<CS: CipherSuite>(values: &Value) -> OpaqueTestVectorParameters {
-    let mut rng = OsRng;
+    let mut rng = UnwrapErr(SysRng);

    OpaqueTestVectorParameters {
        dummy_public_key: {
-            match decode(values, "client_public_key") {
-                Some(value) => value,
-                None => KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut OsRng)).to_vec(),
-            }
+            decode(values, "client_public_key").unwrap_or_else(|| {
+                KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut UnwrapErr(SysRng)))
+                    .to_vec()
+            })
        },
        dummy_masking_key: {
            match decode(values, "masking_key") {
@@ -151,8 +148,8 @@ where
    // RegistrationUpload: (KePk + Hash) + Envelope
    <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-    RegistrationUploadLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<EnvelopeLen<CS>>,
+    RegistrationUploadLen<CS>: ArrayLength,
    // ServerRegistration = RegistrationUpload
 {
    let password_file = ServerRegistration::<CS>::finish(
@@ -185,12 +182,14 @@ fn tests() -> Result<(), ProtocolError> {
        serde_json::from_str(super::parser::rfc_to_json(super::rfc9807_vectors::VECTORS).as_str())
            .expect("Could not parse json");

+    std::eprintln!("{}", serde_json::to_string_pretty(&rfc).unwrap());
+
    #[cfg(feature = "ristretto255")]
    {
        struct Ristretto255Sha512NoKsf;
        impl CipherSuite for Ristretto255Sha512NoKsf {
-            type OprfCs = crate::Ristretto255;
-            type KeyExchange = TripleDh<crate::Ristretto255, sha2::Sha512>;
+            type OprfCs = Ristretto255;
+            type KeyExchange = TripleDh<Ristretto255, sha2::Sha512>;
            type Ksf = Identity;
        }

@@ -331,7 +330,7 @@ fn test_registration_response<CS: CipherSuite>(
 where
    // RegistrationResponse: KgPk + KePk
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<<KeGroup<CS> as Group>::PkLen>,
-    RegistrationResponseLen<CS>: ArrayLength<u8>,
+    RegistrationResponseLen<CS>: ArrayLength,
 {
    for parameters in tvs {
        let server_setup = ServerSetup::<CS>::deserialize(
@@ -370,8 +369,8 @@ where
    // RegistrationUpload: (KePk + Hash) + Envelope
    <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-    RegistrationUploadLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<EnvelopeLen<CS>>,
+    RegistrationUploadLen<CS>: ArrayLength,
 {
    for parameters in tvs {
        let mut rng = CycleRng::new(parameters.blind_registration.to_vec());
@@ -417,7 +416,7 @@ where
    // CredentialRequest: KgPk + Ke1Message
    <CS::KeyExchange as KeyExchange>::KE1Message: Serialize,
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
-    CredentialRequestLen<CS>: ArrayLength<u8>,
+    CredentialRequestLen<CS>: ArrayLength,
 {
    for parameters in tvs {
        let client_login_start = [
@@ -444,18 +443,18 @@ where
    // RegistrationUpload: (KePk + Hash) + Envelope
    <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-    RegistrationUploadLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<EnvelopeLen<CS>>,
+    RegistrationUploadLen<CS>: ArrayLength,
    // ServerRegistration = RegistrationUpload
    // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
    Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
-        ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
-    CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<MaskedResponseLen<CS>>,
+    CredentialResponseWithoutKeLen<CS>: ArrayLength,
    // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
    <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
    CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
-    CredentialResponseLen<CS>: ArrayLength<u8>,
+    CredentialResponseLen<CS>: ArrayLength,
 {
    for parameters in tvs {
        let server_setup = ServerSetup::<CS>::deserialize(
@@ -530,7 +529,7 @@ where
            ClientLogin::<CS>::start(&mut client_login_start_rng, &parameters.password)?;

        let client_login_finish_result = client_login_start_result.state.finish(
-            &mut OsRng,
+            &mut UnwrapErr(SysRng),
            &parameters.password,
            CredentialResponse::<CS>::deserialize(&parameters.KE2)?,
            ClientLoginFinishParameters::new(
@@ -576,8 +575,8 @@ where
    // RegistrationUpload: (KePk + Hash) + Envelope
    <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
-        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
-    RegistrationUploadLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<EnvelopeLen<CS>>,
+    RegistrationUploadLen<CS>: ArrayLength,
    // ServerRegistration = RegistrationUpload
 {
    for parameters in tvs {
@@ -644,12 +643,12 @@ where
    // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
    <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
    Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
-        ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
-    CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
+        ArrayLength + Add<MaskedResponseLen<CS>>,
+    CredentialResponseWithoutKeLen<CS>: ArrayLength,
    // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
    <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
    CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
-    CredentialResponseLen<CS>: ArrayLength<u8>,
+    CredentialResponseLen<CS>: ArrayLength,
 {
    for parameters in tvs {
        let server_setup = ServerSetup::<CS>::deserialize(