Separate AKE from OPRF take 2 (#222)

* Separate AKE from OPRF

Introduce X25519 implementation

* Rename `AkeGroup` to `KeGroup` and `Group` to `OprfGroup`

* Add documentation to "Overview"

src/group/x25519.rs

@@ -0,0 +1,182 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use super::Group;
+use crate::errors::{InternalPakeError, ProtocolError};
+use crate::hash::Hash;
+use curve25519_dalek::{constants::X25519_BASEPOINT, montgomery::MontgomeryPoint, scalar::Scalar};
+use generic_array::{typenum::U32, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// The implementation of such a subgroup for Ristretto
+impl Group for MontgomeryPoint {
+    const SUITE_ID: usize = 0xFFFF;
+
+    fn map_to_curve<H: Hash>(_msg: &[u8], _dst: &[u8]) -> Result<Self, ProtocolError> {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    fn hash_to_scalar<H: Hash>(_input: &[u8], _dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    type Scalar = Scalar;
+    type ScalarLen = U32;
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalPakeError> {
+        Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref()))
+    }
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar;
+            }
+        }
+    }
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
+        scalar.to_bytes().into()
+    }
+    fn scalar_invert(_scalar: &Self::Scalar) -> Self::Scalar {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    // The byte length necessary to represent group elements
+    type ElemLen = U32;
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalPakeError> {
+        Ok(Self(*element_bits.as_ref()))
+    }
+    // serialization of a group element
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
+        self.to_bytes().into()
+    }
+
+    fn base_point() -> Self {
+        X25519_BASEPOINT
+    }
+
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        self * Scalar::from_bits(*scalar.as_ref())
+    }
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    fn ct_equal(&self, _other: &Self) -> bool {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+}
+
+#[test]
+fn test() -> Result<(), ProtocolError> {
+    use crate::{
+        errors::PakeError, key_exchange::tripledh::TripleDH, slow_hash::NoOpHash, CipherSuite,
+        ClientLogin, ClientLoginFinishParameters, ClientLoginFinishResult, ClientLoginStartResult,
+        ClientRegistration, ClientRegistrationFinishParameters, ClientRegistrationFinishResult,
+        ClientRegistrationStartResult, ServerLogin, ServerLoginStartParameters,
+        ServerLoginStartResult, ServerRegistration, ServerSetup,
+    };
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use rand::rngs::OsRng;
+
+    struct X25519Sha512NoSlowHash;
+    impl CipherSuite for X25519Sha512NoSlowHash {
+        type OprfGroup = RistrettoPoint;
+        type KeGroup = MontgomeryPoint;
+        type KeyExchange = TripleDH;
+        type Hash = sha2::Sha512;
+        type SlowHash = NoOpHash;
+    }
+
+    const PASSWORD: &[u8] = b"1234";
+
+    let server_setup = ServerSetup::<X25519Sha512NoSlowHash>::new(&mut OsRng);
+
+    let ClientRegistrationStartResult {
+        message,
+        state: client,
+    } = ClientRegistration::start(&mut OsRng, PASSWORD)?;
+    let message = ServerRegistration::start(&server_setup, message, &[])?.message;
+    let ClientRegistrationFinishResult {
+        message,
+        export_key: register_export_key,
+        ..
+    } = client.finish(
+        &mut OsRng,
+        message,
+        ClientRegistrationFinishParameters::Default,
+    )?;
+    let server_registration = ServerRegistration::finish(message);
+
+    let ClientLoginStartResult {
+        message,
+        state: client,
+    } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+    let ServerLoginStartResult {
+        message,
+        state: server,
+        ..
+    } = ServerLogin::start(
+        &mut OsRng,
+        &server_setup,
+        Some(server_registration),
+        message,
+        &[],
+        ServerLoginStartParameters::default(),
+    )?;
+    let ClientLoginFinishResult {
+        message,
+        session_key: client_session_key,
+        export_key: login_export_key,
+        ..
+    } = client.finish(message, ClientLoginFinishParameters::Default)?;
+    let server_session_key = server.finish(message)?.session_key;
+
+    assert_eq!(register_export_key, login_export_key);
+    assert_eq!(client_session_key, server_session_key);
+
+    let ClientLoginStartResult {
+        message,
+        state: client,
+    } = ClientLogin::start(&mut OsRng, PASSWORD)?;
+    let ServerLoginStartResult { message, .. } = ServerLogin::start(
+        &mut OsRng,
+        &server_setup,
+        None,
+        message,
+        &[],
+        ServerLoginStartParameters::default(),
+    )?;
+
+    assert!(matches!(
+        client.finish(message, ClientLoginFinishParameters::Default),
+        Err(ProtocolError::VerificationError(
+            PakeError::InvalidLoginError
+        ))
+    ));
+
+    Ok(())
+}