vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Introduce enum structs to replicate TLS message format

Browse Source 
This PR favors native coercions of enums to numerical types to help ser/de operations.
Small rearrangement of the serialization module.
This commit is contained in:
François Garillot
2020-11-02 20:15:02 -05:00
parent 344e8ad8d1
commit 9c06c98ad6
10 changed files with 432 additions and 387 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benches/oprf.rs
+1 -2
View File
@@ -7,8 +7,7 @@
extern crate criterion;
use criterion::Criterion;
use curve25519_dalek::edwards::EdwardsPoint;
use curve25519_dalek::ristretto::RistrettoPoint;
use curve25519_dalek::{edwards::EdwardsPoint, ristretto::RistrettoPoint};
use generic_array::arr;
use opaque_ke::{
group::Group,
src/elligator/field.rs
+5 -8
View File
@@ -7,15 +7,12 @@
//! Field arithmetic modulo \\(p = 2\^{255} - 19\\), using \\(64\\)-bit
//! limbs with \\(128\\)-bit products.
use core::fmt::Debug;
use core::ops::Neg;
use core::ops::{Add, AddAssign};
use core::ops::{Mul, MulAssign};
use core::{
fmt::Debug,
ops::{Add, AddAssign, Mul, MulAssign, Neg},
};
use subtle::Choice;
use subtle::ConditionallyNegatable;
use subtle::ConditionallySelectable;
use subtle::ConstantTimeEq;
use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq};
use zeroize::Zeroize;
src/envelope.rs
+5 -3
View File
@@ -3,9 +3,11 @@
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
use crate::errors::{InternalPakeError, ProtocolError};
use crate::hash::Hash;
use crate::serialization::{serialize, tokenize};
use crate::{
errors::{InternalPakeError, ProtocolError},
hash::Hash,
serialization::{serialize, tokenize},
};
use digest::Digest;
use generic_array::{
typenum::{Unsigned, U32},
src/group.rs
+1 -2
View File
@@ -6,8 +6,7 @@
//! Defines the Group trait to specify the underlying prime order group used in
//! OPAQUE's OPRF
use crate::elligator;
use crate::errors::InternalPakeError;
use crate::{elligator, errors::InternalPakeError};
use curve25519_dalek::{
edwards::{CompressedEdwardsY, EdwardsPoint},
src/lib.rs
+2 -1
View File
@@ -416,7 +416,6 @@ pub mod opaque;
pub mod ciphersuite;
mod envelope;
pub mod hash;
mod serialization;
mod elligator;
pub mod group;
@@ -433,5 +432,7 @@ mod oprf;
pub mod slow_hash;
mod serialization;
#[cfg(test)]
mod tests;
src/opaque.rs
+11 -17
View File
@@ -15,7 +15,7 @@ use crate::{
keypair::{KeyPair, SizedBytes},
oprf,
oprf::OprfClientBytes,
serialization::{serialize, tokenize},
serialization::{serialize, tokenize, ProtocolMessageType},
slow_hash::SlowHash,
};
use generic_array::{typenum::Unsigned, GenericArray};
@@ -23,12 +23,6 @@ use rand_core::{CryptoRng, RngCore};
use std::{convert::TryFrom, marker::PhantomData};
use zeroize::Zeroize;
const REGISTRATION_REQUEST: u8 = 0x01;
const REGISTRATION_RESPONSE: u8 = 0x02;
const REGISTRATION_UPLOAD: u8 = 0x03;
const CREDENTIAL_REQUEST: u8 = 0x04;
const CREDENTIAL_RESPONSE: u8 = 0x05;
const CREDENTIAL_TYPE_SKU: u8 = 0x01;
const CREDENTIAL_TYPE_PKS: u8 = 0x03;
@@ -72,14 +66,14 @@ impl<Grp: Group> RegisterFirstMessage<Grp> {
registration_request.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2));
let mut output: Vec<u8> = Vec::new();
output.push(REGISTRATION_REQUEST);
output.push(ProtocolMessageType::from(self) as u8 + 1);
output.extend_from_slice(&serialize(registration_request, 3));
output
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
if input[0] != REGISTRATION_REQUEST {
if input[0] != ProtocolMessageType::RegistrationRequest as u8 + 1 {
return Err(PakeError::SerializationError.into());
}
@@ -146,14 +140,14 @@ where
registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_PKS], 1));
let mut output: Vec<u8> = Vec::new();
output.push(REGISTRATION_RESPONSE);
output.push(ProtocolMessageType::from(self) as u8 + 1);
output.extend_from_slice(&serialize(registration_response, 3));
output
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
if input[0] != REGISTRATION_RESPONSE {
if input[0] != ProtocolMessageType::RegistrationResponse as u8 + 1 {
return Err(PakeError::SerializationError.into());
}
@@ -225,14 +219,14 @@ where
registration_upload.extend_from_slice(&serialize(self.client_s_pk.to_arr().to_vec(), 2));
let mut output: Vec<u8> = Vec::new();
output.push(REGISTRATION_UPLOAD);
output.push(ProtocolMessageType::from(self) as u8 + 1);
output.extend_from_slice(&serialize(registration_upload, 3));
output
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
if input[0] != REGISTRATION_UPLOAD {
if input[0] != ProtocolMessageType::RegistrationUpload as u8 + 1 {
return Err(PakeError::SerializationError.into());
}
@@ -302,7 +296,7 @@ impl<CS: CipherSuite> LoginFirstMessage<CS> {
credential_request.extend_from_slice(&serialize((&self.alpha.to_arr()).to_vec(), 2));
let mut output: Vec<u8> = Vec::new();
output.push(CREDENTIAL_REQUEST);
output.push(ProtocolMessageType::from(self) as u8 + 1);
output.extend_from_slice(&serialize(credential_request, 3));
output.extend_from_slice(&self.ke1_message.to_bytes());
output
@@ -310,7 +304,7 @@ impl<CS: CipherSuite> LoginFirstMessage<CS> {
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
if input[0] != CREDENTIAL_REQUEST {
if input[0] != ProtocolMessageType::CredentialRequest as u8 + 1 {
return Err(PakeError::SerializationError.into());
}
@@ -347,7 +341,7 @@ impl<CS: CipherSuite> LoginSecondMessage<CS> {
credential_response.extend_from_slice(&serialize(Vec::new(), 2));
let mut output: Vec<u8> = Vec::new();
output.push(CREDENTIAL_RESPONSE);
output.push(ProtocolMessageType::from(self) as u8 + 1);
output.extend_from_slice(&serialize(credential_response, 3));
output.extend_from_slice(&self.ke2_message.to_bytes());
output
@@ -355,7 +349,7 @@ impl<CS: CipherSuite> LoginSecondMessage<CS> {
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
if input[0] != CREDENTIAL_RESPONSE {
if input[0] != ProtocolMessageType::CredentialResponse as u8 + 1 {
return Err(PakeError::SerializationError.into());
}
src/serialization.rs
-352
View File
@@ -1,352 +0,0 @@
// Copyright (c) Facebook, Inc. and its affiliates.
//
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
use crate::errors::PakeError;
pub(crate) fn serialize(input: Vec<u8>, max_bytes: usize) -> Vec<u8> {
let mut output: Vec<u8> = Vec::new();
output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]);
output.extend_from_slice(&input[..]);
output
}
pub(crate) fn tokenize(input: Vec<u8>, size_bytes: usize) -> Result<(Vec<u8>, Vec<u8>), PakeError> {
if size_bytes > 8 {
return Err(PakeError::SerializationError);
}
let mut size_array = [0u8; 8];
for i in 0..size_bytes {
size_array[8 - size_bytes + i] = input[i];
}
let size = usize::from_be_bytes(size_array);
if size_bytes + size > input.len() {
return Err(PakeError::SerializationError);
}
Ok((
input[size_bytes..size_bytes + size].to_vec(),
input[size_bytes + size..].to_vec(),
))
}
#[cfg(test)]
mod tests {
use crate::{
ciphersuite::CipherSuite,
envelope::Envelope,
group::Group,
key_exchange::{
traits::{KeyExchange, ToBytes},
tripledh::{TripleDH, NONCE_LEN},
},
keypair::{KeyPair, SizedBytes, X25519KeyPair},
opaque::*,
};
use curve25519_dalek::ristretto::RistrettoPoint;
use generic_array::typenum::Unsigned;
use proptest::{collection::vec, prelude::*};
use rand_core::{OsRng, RngCore};
use sha2::{Digest, Sha256};
use std::convert::TryFrom;
struct Default;
impl CipherSuite for Default {
type Group = RistrettoPoint;
type KeyFormat = crate::keypair::X25519KeyPair;
type KeyExchange = TripleDH;
type Hash = sha2::Sha256;
type SlowHash = crate::slow_hash::NoOpHash;
}
fn random_ristretto_point() -> RistrettoPoint {
let mut rng = OsRng;
let mut random_bits = [0u8; 64];
rng.fill_bytes(&mut random_bits);
// This is because RistrettoPoint is on an obsolete sha2 version
let mut bits = [0u8; 64];
let mut hasher = sha2::Sha512::new();
hasher.update(&random_bits[..]);
bits.copy_from_slice(&hasher.finalize());
RistrettoPoint::from_uniform_bytes(&bits)
}
#[test]
fn client_registration_roundtrip() {
let pw = b"hunter2";
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
// serialization order: scalar, password
let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
let reg = ClientRegistration::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn server_registration_roundtrip() {
// If we don't have envelope and client_pk, the server registration just
// contains the prf key
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let mut oprf_bytes: Vec<u8> = vec![];
oprf_bytes.extend_from_slice(sc.as_bytes());
let reg = ServerRegistration::<Default>::try_from(&oprf_bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, oprf_bytes);
// If we do have envelope and client pk, the server registration contains
// the whole kit
let key_len =
<<<Default as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
let envelope_size = key_len + Envelope::<sha2::Sha256>::additional_size();
let mut mock_envelope_bytes = vec![0u8; envelope_size];
rng.fill_bytes(&mut mock_envelope_bytes);
println!("{}", mock_envelope_bytes.len());
let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap();
// serialization order: scalar, public key, envelope
let mut bytes = Vec::<u8>::new();
bytes.extend_from_slice(sc.as_bytes());
bytes.extend_from_slice(&mock_client_kp.public().to_arr());
bytes.extend_from_slice(&mock_envelope_bytes);
let reg = ServerRegistration::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn register_first_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [1, 0, 0, 36, 0, 0, 0, 32];
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
let r1 = RegisterFirstMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
let r1_bytes = r1.serialize();
assert_eq!(input, r1_bytes);
}
#[test]
fn register_second_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr();
let header = [2, 0, 0, 40, 0, 32];
let tail = [0, 0, 1, 1, 1, 3];
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&tail);
let r2 = RegisterSecondMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
let r2_bytes = r2.serialize();
assert_eq!(input, r2_bytes);
}
#[test]
fn register_third_message_roundtrip() {
let mut rng = OsRng;
let skp = Default::generate_random_keypair(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let header = [3, 0, 0, 136];
let intermediate = [0, 32];
let mut key = [0u8; 32];
rng.fill_bytes(&mut key);
let mut msg = [0u8; 32];
rng.fill_bytes(&mut msg);
let (envelope, _) =
Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(&envelope.serialize());
input.extend_from_slice(&intermediate);
input.extend_from_slice(&pubkey_bytes[..]);
let r3 =
RegisterThirdMessage::<X25519KeyPair, sha2::Sha256>::deserialize(&input[..]).unwrap();
let r3_bytes = r3.serialize();
assert_eq!(input, r3_bytes);
}
#[test]
fn login_first_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [4, 0, 0, 36, 0, 0, 0, 32];
let mut rng = OsRng;
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&ke1m[..]);
let l1 = LoginFirstMessage::<Default>::deserialize(input.as_slice()).unwrap();
let l1_bytes = l1.serialize();
assert_eq!(input, l1_bytes);
}
#[test]
fn login_second_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [5, 0, 0, 134, 0, 32];
let mut rng = OsRng;
let skp = Default::generate_random_keypair(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let intermediate1 = [0, 96];
let intermediate2 = [0, 0];
let mut key = [0u8; 32];
rng.fill_bytes(&mut key);
let mut msg = [0u8; 32];
rng.fill_bytes(&mut msg);
let (envelope, _) =
Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut mac = [0u8; 32];
rng.fill_bytes(&mut mac);
let mut server_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut server_nonce);
let ke2m: Vec<u8> = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&intermediate1[..]);
input.extend_from_slice(&envelope.to_bytes());
input.extend_from_slice(&intermediate2[..]);
input.extend_from_slice(&ke2m[..]);
let l2 = LoginSecondMessage::<Default>::deserialize(input.as_slice()).unwrap();
let l2_bytes = l2.serialize();
assert_eq!(input, l2_bytes);
}
#[test]
fn client_login_roundtrip() {
let pw = b"hunter2";
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat();
let mut hasher = Sha256::new();
hasher.update(l1_data);
let hashed_l1 = hasher.finalize();
// serialization order: scalar, password, ke1_state
let bytes: Vec<u8> = [
&sc.as_bytes()[..],
&pw[..],
client_e_kp.public(),
&client_nonce,
hashed_l1.as_slice(),
]
.concat();
let reg = ClientLogin::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn ke1_message_roundtrip() {
let mut rng = OsRng;
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
let reg =
<TripleDH as KeyExchange<sha2::Sha256, crate::keypair::X25519KeyPair>>::KE1Message::try_from(
ke1m[..].to_vec(),
)
.unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, ke1m);
}
proptest! {
#[test]
fn test_nocrash_register_first_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterFirstMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_register_second_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterSecondMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_register_third_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterThirdMessage::<crate::keypair::X25519KeyPair, sha2::Sha512>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_first_message(bytes in vec(any::<u8>(), 0..500)) {
LoginFirstMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_second_message(bytes in vec(any::<u8>(), 0..500)) {
LoginSecondMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_third_message(bytes in vec(any::<u8>(), 0..500)) {
LoginThirdMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_client_registration(bytes in vec(any::<u8>(), 0..700)) {
ClientRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_server_registration(bytes in vec(any::<u8>(), 0..700)) {
ServerRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_client_login(bytes in vec(any::<u8>(), 0..700)) {
ClientLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_server_login(bytes in vec(any::<u8>(), 0..700)) {
ServerLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
}
}
src/serialization/mod.rs
+92
View File
@@ -0,0 +1,92 @@
// Copyright (c) Facebook, Inc. and its affiliates.
//
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
use crate::errors::PakeError;
use crate::{
ciphersuite::CipherSuite,
hash::Hash,
keypair::KeyPair,
opaque::{
LoginFirstMessage, LoginSecondMessage, RegisterFirstMessage, RegisterSecondMessage,
RegisterThirdMessage,
},
};
pub enum ProtocolMessageType {
RegistrationRequest,
RegistrationResponse,
RegistrationUpload,
CredentialRequest,
CredentialResponse,
}
pub enum CredentialType {
SkU,
PkU,
PkS,
IdU,
IdS,
}
impl<T> From<&RegisterFirstMessage<T>> for ProtocolMessageType {
fn from(_mt: &RegisterFirstMessage<T>) -> Self {
ProtocolMessageType::RegistrationRequest
}
}
impl<T> From<&RegisterSecondMessage<T>> for ProtocolMessageType {
fn from(_mt: &RegisterSecondMessage<T>) -> Self {
ProtocolMessageType::RegistrationResponse
}
}
impl<T: KeyPair, U: Hash> From<&RegisterThirdMessage<T, U>> for ProtocolMessageType {
fn from(_mt: &RegisterThirdMessage<T, U>) -> Self {
ProtocolMessageType::RegistrationUpload
}
}
impl<T: CipherSuite> From<&LoginFirstMessage<T>> for ProtocolMessageType {
fn from(_mt: &LoginFirstMessage<T>) -> Self {
ProtocolMessageType::CredentialRequest
}
}
impl<T: CipherSuite> From<&LoginSecondMessage<T>> for ProtocolMessageType {
fn from(_mt: &LoginSecondMessage<T>) -> Self {
ProtocolMessageType::CredentialResponse
}
}
pub(crate) fn serialize(input: Vec<u8>, max_bytes: usize) -> Vec<u8> {
let mut output: Vec<u8> = Vec::new();
output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]);
output.extend_from_slice(&input[..]);
output
}
pub(crate) fn tokenize(input: Vec<u8>, size_bytes: usize) -> Result<(Vec<u8>, Vec<u8>), PakeError> {
if size_bytes > 8 {
return Err(PakeError::SerializationError);
}
let mut size_array = [0u8; 8];
for i in 0..size_bytes {
size_array[8 - size_bytes + i] = input[i];
}
let size = usize::from_be_bytes(size_array);
if size_bytes + size > input.len() {
return Err(PakeError::SerializationError);
}
Ok((
input[size_bytes..size_bytes + size].to_vec(),
input[size_bytes + size..].to_vec(),
))
}
#[cfg(test)]
mod tests;
src/serialization/tests.rs
+314
View File
@@ -0,0 +1,314 @@
// Copyright (c) Facebook, Inc. and its affiliates.
//
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
use crate::{
ciphersuite::CipherSuite,
envelope::Envelope,
group::Group,
key_exchange::{
traits::{KeyExchange, ToBytes},
tripledh::{TripleDH, NONCE_LEN},
},
keypair::{KeyPair, SizedBytes, X25519KeyPair},
opaque::*,
};
use curve25519_dalek::ristretto::RistrettoPoint;
use generic_array::typenum::Unsigned;
use proptest::{collection::vec, prelude::*};
use rand_core::{OsRng, RngCore};
use sha2::{Digest, Sha256};
use std::convert::TryFrom;
struct Default;
impl CipherSuite for Default {
type Group = RistrettoPoint;
type KeyFormat = crate::keypair::X25519KeyPair;
type KeyExchange = TripleDH;
type Hash = sha2::Sha256;
type SlowHash = crate::slow_hash::NoOpHash;
}
fn random_ristretto_point() -> RistrettoPoint {
let mut rng = OsRng;
let mut random_bits = [0u8; 64];
rng.fill_bytes(&mut random_bits);
// This is because RistrettoPoint is on an obsolete sha2 version
let mut bits = [0u8; 64];
let mut hasher = sha2::Sha512::new();
hasher.update(&random_bits[..]);
bits.copy_from_slice(&hasher.finalize());
RistrettoPoint::from_uniform_bytes(&bits)
}
#[test]
fn client_registration_roundtrip() {
let pw = b"hunter2";
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
// serialization order: scalar, password
let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
let reg = ClientRegistration::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn server_registration_roundtrip() {
// If we don't have envelope and client_pk, the server registration just
// contains the prf key
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let mut oprf_bytes: Vec<u8> = vec![];
oprf_bytes.extend_from_slice(sc.as_bytes());
let reg = ServerRegistration::<Default>::try_from(&oprf_bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, oprf_bytes);
// If we do have envelope and client pk, the server registration contains
// the whole kit
let key_len =
<<<Default as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
let envelope_size = key_len + Envelope::<sha2::Sha256>::additional_size();
let mut mock_envelope_bytes = vec![0u8; envelope_size];
rng.fill_bytes(&mut mock_envelope_bytes);
println!("{}", mock_envelope_bytes.len());
let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap();
// serialization order: scalar, public key, envelope
let mut bytes = Vec::<u8>::new();
bytes.extend_from_slice(sc.as_bytes());
bytes.extend_from_slice(&mock_client_kp.public().to_arr());
bytes.extend_from_slice(&mock_envelope_bytes);
let reg = ServerRegistration::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn register_first_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [1, 0, 0, 36, 0, 0, 0, 32];
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
let r1 = RegisterFirstMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
let r1_bytes = r1.serialize();
assert_eq!(input, r1_bytes);
}
#[test]
fn register_second_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr();
let header = [2, 0, 0, 40, 0, 32];
let tail = [0, 0, 1, 1, 1, 3];
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&tail);
let r2 = RegisterSecondMessage::<RistrettoPoint>::deserialize(input.as_slice()).unwrap();
let r2_bytes = r2.serialize();
assert_eq!(input, r2_bytes);
}
#[test]
fn register_third_message_roundtrip() {
let mut rng = OsRng;
let skp = Default::generate_random_keypair(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let header = [3, 0, 0, 136];
let intermediate = [0, 32];
let mut key = [0u8; 32];
rng.fill_bytes(&mut key);
let mut msg = [0u8; 32];
rng.fill_bytes(&mut msg);
let (envelope, _) =
Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(&envelope.serialize());
input.extend_from_slice(&intermediate);
input.extend_from_slice(&pubkey_bytes[..]);
let r3 = RegisterThirdMessage::<X25519KeyPair, sha2::Sha256>::deserialize(&input[..]).unwrap();
let r3_bytes = r3.serialize();
assert_eq!(input, r3_bytes);
}
#[test]
fn login_first_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [4, 0, 0, 36, 0, 0, 0, 32];
let mut rng = OsRng;
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&ke1m[..]);
let l1 = LoginFirstMessage::<Default>::deserialize(input.as_slice()).unwrap();
let l1_bytes = l1.serialize();
assert_eq!(input, l1_bytes);
}
#[test]
fn login_second_message_roundtrip() {
let pt = random_ristretto_point();
let pt_bytes = pt.to_arr().to_vec();
let header = [5, 0, 0, 134, 0, 32];
let mut rng = OsRng;
let skp = Default::generate_random_keypair(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let intermediate1 = [0, 96];
let intermediate2 = [0, 0];
let mut key = [0u8; 32];
rng.fill_bytes(&mut key);
let mut msg = [0u8; 32];
rng.fill_bytes(&mut msg);
let (envelope, _) =
Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut mac = [0u8; 32];
rng.fill_bytes(&mut mac);
let mut server_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut server_nonce);
let ke2m: Vec<u8> = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat();
let mut input = Vec::new();
input.extend_from_slice(&header);
input.extend_from_slice(pt_bytes.as_slice());
input.extend_from_slice(&intermediate1[..]);
input.extend_from_slice(&envelope.to_bytes());
input.extend_from_slice(&intermediate2[..]);
input.extend_from_slice(&ke2m[..]);
let l2 = LoginSecondMessage::<Default>::deserialize(input.as_slice()).unwrap();
let l2_bytes = l2.serialize();
assert_eq!(input, l2_bytes);
}
#[test]
fn client_login_roundtrip() {
let pw = b"hunter2";
let mut rng = OsRng;
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat();
let mut hasher = Sha256::new();
hasher.update(l1_data);
let hashed_l1 = hasher.finalize();
// serialization order: scalar, password, ke1_state
let bytes: Vec<u8> = [
&sc.as_bytes()[..],
&pw[..],
client_e_kp.public(),
&client_nonce,
hashed_l1.as_slice(),
]
.concat();
let reg = ClientLogin::<Default>::try_from(&bytes[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
}
#[test]
fn ke1_message_roundtrip() {
let mut rng = OsRng;
let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
let mut client_nonce = [0u8; NONCE_LEN];
rng.fill_bytes(&mut client_nonce);
let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
let reg =
<TripleDH as KeyExchange<sha2::Sha256, crate::keypair::X25519KeyPair>>::KE1Message::try_from(&ke1m[..]).unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, ke1m);
}
proptest! {
#[test]
fn test_nocrash_register_first_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterFirstMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_register_second_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterSecondMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_register_third_message(bytes in vec(any::<u8>(), 0..200)) {
RegisterThirdMessage::<crate::keypair::X25519KeyPair, sha2::Sha512>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_first_message(bytes in vec(any::<u8>(), 0..500)) {
LoginFirstMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_second_message(bytes in vec(any::<u8>(), 0..500)) {
LoginSecondMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_login_third_message(bytes in vec(any::<u8>(), 0..500)) {
LoginThirdMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_client_registration(bytes in vec(any::<u8>(), 0..700)) {
ClientRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_server_registration(bytes in vec(any::<u8>(), 0..700)) {
ServerRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_client_login(bytes in vec(any::<u8>(), 0..700)) {
ClientLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
#[test]
fn test_nocrash_server_login(bytes in vec(any::<u8>(), 0..700)) {
ServerLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
}
}
src/slow_hash.rs
+1 -2
View File
@@ -5,8 +5,7 @@
//! Trait specifying a slow hashing function
use crate::errors::InternalPakeError;
use crate::hash::Hash;
use crate::{errors::InternalPakeError, hash::Hash};
use digest::Digest;
use generic_array::GenericArray;