From 344e8ad8d1c38ff173e7485f4f13f35d443045e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Garillot?= Date: Thu, 10 Sep 2020 17:01:06 -0400 Subject: [PATCH 1/8] Updating serialization for RegisterFirstMessage (#35) --- src/envelope.rs | 28 ++- src/errors.rs | 2 + src/lib.rs | 1 + src/opaque.rs | 218 +++++++++++++++++++--- src/serialization.rs | 352 ++++++++++++++++++++++++++++++++++++ src/tests/mod.rs | 1 - src/tests/opaque_ke_test.rs | 40 ++-- 7 files changed, 598 insertions(+), 44 deletions(-) create mode 100644 src/serialization.rs diff --git a/src/envelope.rs b/src/envelope.rs index 79f4252..0b079af 100644 --- a/src/envelope.rs +++ b/src/envelope.rs @@ -3,8 +3,9 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. -use crate::errors::InternalPakeError; +use crate::errors::{InternalPakeError, ProtocolError}; use crate::hash::Hash; +use crate::serialization::{serialize, tokenize}; use digest::Digest; use generic_array::{ typenum::{Unsigned, U32}, @@ -92,6 +93,31 @@ impl Envelope { [&self.nonce[..], &self.ciphertext[..], &self.hmac[..]].concat() } + pub(crate) fn serialize(&self) -> Vec { + [ + &self.nonce[..], + &serialize((&self.ciphertext).to_vec(), 2)[..], + &serialize(vec![], 2)[..], + &serialize((&self.hmac).to_vec(), 2)[..], + ] + .concat() + } + + pub(crate) fn deserialize(input: &[u8]) -> Result<(Self, Vec), ProtocolError> { + let nonce = &input[..NONCE_LEN]; + let (ciphertext, remainder) = tokenize(input[NONCE_LEN..].to_vec(), 2)?; + let (_, remainder) = tokenize(remainder, 2)?; + let (hmac, remainder) = tokenize(remainder, 2)?; + Ok(( + Self::new( + nonce.to_vec(), + ciphertext, + GenericArray::clone_from_slice(&hmac[..]), + ), + remainder, + )) + } + /// Uses a key to convert the plaintext into an envelope, authenticated by the aad field. /// Note that a new nonce is sampled for each call to seal. pub(crate) fn seal( diff --git a/src/errors.rs b/src/errors.rs index 6be81bf..b5b524b 100644 --- a/src/errors.rs +++ b/src/errors.rs @@ -58,6 +58,8 @@ pub enum PakeError { KeyExchangeMacValidationError, /// Error in validating credentials InvalidLoginError, + /// Error with serializing / deserializing protocol messages + SerializationError, } // This is meant to express future(ly) non-trivial ways of converting the diff --git a/src/lib.rs b/src/lib.rs index 096304c..d0de782 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -416,6 +416,7 @@ pub mod opaque; pub mod ciphersuite; mod envelope; pub mod hash; +mod serialization; mod elligator; pub mod group; diff --git a/src/opaque.rs b/src/opaque.rs index f97e920..4eedb5d 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -15,6 +15,7 @@ use crate::{ keypair::{KeyPair, SizedBytes}, oprf, oprf::OprfClientBytes, + serialization::{serialize, tokenize}, slow_hash::SlowHash, }; use generic_array::{typenum::Unsigned, GenericArray}; @@ -22,6 +23,15 @@ use rand_core::{CryptoRng, RngCore}; use std::{convert::TryFrom, marker::PhantomData}; use zeroize::Zeroize; +const REGISTRATION_REQUEST: u8 = 0x01; +const REGISTRATION_RESPONSE: u8 = 0x02; +const REGISTRATION_UPLOAD: u8 = 0x03; +const CREDENTIAL_REQUEST: u8 = 0x04; +const CREDENTIAL_RESPONSE: u8 = 0x05; + +const CREDENTIAL_TYPE_SKU: u8 = 0x01; +const CREDENTIAL_TYPE_PKS: u8 = 0x03; + // Messages // ========= @@ -49,11 +59,46 @@ impl TryFrom<&[u8]> for RegisterFirstMessage { impl RegisterFirstMessage { /// byte representation for the registration request - pub fn to_bytes(&self) -> GenericArray { + fn to_bytes(&self) -> GenericArray { self.alpha.to_arr() } } +impl RegisterFirstMessage { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut registration_request: Vec = Vec::new(); + registration_request.extend_from_slice(&serialize(Vec::new(), 2)); + registration_request.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2)); + + let mut output: Vec = Vec::new(); + output.push(REGISTRATION_REQUEST); + output.extend_from_slice(&serialize(registration_request, 3)); + output + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + if input[0] != REGISTRATION_REQUEST { + return Err(PakeError::SerializationError.into()); + } + + let (data, remainder) = tokenize(input[1..].to_vec(), 3)?; + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + let (_, remainder) = tokenize(data, 2)?; + let (alpha_bytes, remainder) = tokenize(remainder, 2)?; + + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + Self::try_from(&alpha_bytes[..]) + } +} + /// The answer sent by the server to the user, upon reception of the /// registration attempt pub struct RegisterSecondMessage { @@ -86,9 +131,51 @@ where Grp: Group, { /// byte representation for the registration response message - pub fn to_bytes(&self) -> Vec { + fn to_bytes(&self) -> Vec { self.beta.to_arr().to_vec() } + + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut registration_response: Vec = Vec::new(); + registration_response.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2)); + registration_response.extend_from_slice(&serialize(Vec::new(), 2)); + + // TODO: The following should not be hardcoded, but instead be customizable + registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_SKU], 1)); + registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_PKS], 1)); + + let mut output: Vec = Vec::new(); + output.push(REGISTRATION_RESPONSE); + output.extend_from_slice(&serialize(registration_response, 3)); + output + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + if input[0] != REGISTRATION_RESPONSE { + return Err(PakeError::SerializationError.into()); + } + + let (data, remainder) = tokenize(input[1..].to_vec(), 3)?; + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + let (beta_bytes, remainder) = tokenize(data, 2)?; + let (_, remainder) = tokenize(remainder, 2)?; + + // TODO: The following should affect what is placed in the envelope rather than + // being ignored + let (_, remainder) = tokenize(remainder, 1)?; + let (_, remainder) = tokenize(remainder, 1)?; + + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + Self::try_from(&beta_bytes[..]) + } } /// The final message from the client, containing sealed cryptographic @@ -101,17 +188,6 @@ pub struct RegisterThirdMessage { client_s_pk: KeyFormat::Repr, } -impl RegisterThirdMessage -where - KeyFormat: KeyPair, - D: Hash, -{ - /// byte representation for the registration upload message - pub fn to_bytes(&self) -> Vec { - [&self.envelope.to_bytes(), &self.client_s_pk.to_arr()[..]].concat() - } -} - impl TryFrom<&[u8]> for RegisterThirdMessage where KeyFormat: KeyPair, @@ -137,6 +213,48 @@ where } } +impl RegisterThirdMessage +where + KeyFormat: KeyPair, + D: Hash, +{ + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut registration_upload: Vec = Vec::new(); + registration_upload.extend_from_slice(&self.envelope.serialize()); + registration_upload.extend_from_slice(&serialize(self.client_s_pk.to_arr().to_vec(), 2)); + + let mut output: Vec = Vec::new(); + output.push(REGISTRATION_UPLOAD); + output.extend_from_slice(&serialize(registration_upload, 3)); + output + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + if input[0] != REGISTRATION_UPLOAD { + return Err(PakeError::SerializationError.into()); + } + + let (data, remainder) = tokenize(input[1..].to_vec(), 3)?; + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + let (envelope, remainder) = Envelope::::deserialize(&data)?; + let (client_s_pk, remainder) = tokenize(remainder, 2)?; + + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + Ok(Self { + envelope, + client_s_pk: KeyFormat::check_public_key(KeyFormat::Repr::from_bytes(&client_s_pk)?)?, + }) + } +} + /// The message sent by the user to the server, to initiate registration pub struct LoginFirstMessage { /// blinded password information @@ -173,9 +291,41 @@ impl TryFrom<&[u8]> for LoginFirstMessage { impl LoginFirstMessage { /// byte representation for the login request - pub fn to_bytes(&self) -> Vec { + fn to_bytes(&self) -> Vec { [&self.alpha.to_arr()[..], &self.ke1_message.to_bytes()].concat() } + + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut credential_request: Vec = Vec::new(); + credential_request.extend_from_slice(&serialize(Vec::new(), 2)); + credential_request.extend_from_slice(&serialize((&self.alpha.to_arr()).to_vec(), 2)); + + let mut output: Vec = Vec::new(); + output.push(CREDENTIAL_REQUEST); + output.extend_from_slice(&serialize(credential_request, 3)); + output.extend_from_slice(&self.ke1_message.to_bytes()); + output + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + if input[0] != CREDENTIAL_REQUEST { + return Err(PakeError::SerializationError.into()); + } + + let (data, ke1m) = tokenize(input[1..].to_vec(), 3)?; + + let (_, remainder) = tokenize(data, 2)?; + let (alpha_bytes, remainder) = tokenize(remainder, 2)?; + + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + let concatenated = [&alpha_bytes[..], &ke1m[..]].concat(); + Self::try_from(&concatenated[..]) + } } /// The answer sent by the server to the user, upon reception of the @@ -189,14 +339,38 @@ pub struct LoginSecondMessage { } impl LoginSecondMessage { - /// byte representation for the login response - pub fn to_bytes(&self) -> Vec { - [ - &self.beta.to_arr()[..], - &self.envelope.to_bytes()[..], - &self.ke2_message.to_bytes()[..], - ] - .concat() + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut credential_response: Vec = Vec::new(); + credential_response.extend_from_slice(&serialize((&self.beta.to_arr()).to_vec(), 2)); + credential_response.extend_from_slice(&serialize((&self.envelope.to_bytes()).to_vec(), 2)); + credential_response.extend_from_slice(&serialize(Vec::new(), 2)); + + let mut output: Vec = Vec::new(); + output.push(CREDENTIAL_RESPONSE); + output.extend_from_slice(&serialize(credential_response, 3)); + output.extend_from_slice(&self.ke2_message.to_bytes()); + output + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + if input[0] != CREDENTIAL_RESPONSE { + return Err(PakeError::SerializationError.into()); + } + + let (data, ke2m) = tokenize(input[1..].to_vec(), 3)?; + + let (beta_bytes, remainder) = tokenize(data, 2)?; + let (envelope_bytes, remainder) = tokenize(remainder, 2)?; + let (_, remainder) = tokenize(remainder, 2)?; + + if !remainder.is_empty() { + return Err(PakeError::SerializationError.into()); + } + + let concatenated = [&beta_bytes[..], &envelope_bytes[..], &ke2m[..]].concat(); + Self::try_from(&concatenated[..]) } } diff --git a/src/serialization.rs b/src/serialization.rs new file mode 100644 index 0000000..dbef5f2 --- /dev/null +++ b/src/serialization.rs @@ -0,0 +1,352 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use crate::errors::PakeError; + +pub(crate) fn serialize(input: Vec, max_bytes: usize) -> Vec { + let mut output: Vec = Vec::new(); + output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]); + output.extend_from_slice(&input[..]); + output +} + +pub(crate) fn tokenize(input: Vec, size_bytes: usize) -> Result<(Vec, Vec), PakeError> { + if size_bytes > 8 { + return Err(PakeError::SerializationError); + } + + let mut size_array = [0u8; 8]; + for i in 0..size_bytes { + size_array[8 - size_bytes + i] = input[i]; + } + let size = usize::from_be_bytes(size_array); + + if size_bytes + size > input.len() { + return Err(PakeError::SerializationError); + } + + Ok(( + input[size_bytes..size_bytes + size].to_vec(), + input[size_bytes + size..].to_vec(), + )) +} + +#[cfg(test)] +mod tests { + use crate::{ + ciphersuite::CipherSuite, + envelope::Envelope, + group::Group, + key_exchange::{ + traits::{KeyExchange, ToBytes}, + tripledh::{TripleDH, NONCE_LEN}, + }, + keypair::{KeyPair, SizedBytes, X25519KeyPair}, + opaque::*, + }; + + use curve25519_dalek::ristretto::RistrettoPoint; + use generic_array::typenum::Unsigned; + use proptest::{collection::vec, prelude::*}; + use rand_core::{OsRng, RngCore}; + + use sha2::{Digest, Sha256}; + use std::convert::TryFrom; + + struct Default; + impl CipherSuite for Default { + type Group = RistrettoPoint; + type KeyFormat = crate::keypair::X25519KeyPair; + type KeyExchange = TripleDH; + type Hash = sha2::Sha256; + type SlowHash = crate::slow_hash::NoOpHash; + } + + fn random_ristretto_point() -> RistrettoPoint { + let mut rng = OsRng; + let mut random_bits = [0u8; 64]; + rng.fill_bytes(&mut random_bits); + + // This is because RistrettoPoint is on an obsolete sha2 version + let mut bits = [0u8; 64]; + let mut hasher = sha2::Sha512::new(); + hasher.update(&random_bits[..]); + bits.copy_from_slice(&hasher.finalize()); + + RistrettoPoint::from_uniform_bytes(&bits) + } + + #[test] + fn client_registration_roundtrip() { + let pw = b"hunter2"; + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + // serialization order: scalar, password + let bytes: Vec = [&sc.as_bytes()[..], &pw[..]].concat(); + let reg = ClientRegistration::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); + } + + #[test] + fn server_registration_roundtrip() { + // If we don't have envelope and client_pk, the server registration just + // contains the prf key + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + let mut oprf_bytes: Vec = vec![]; + oprf_bytes.extend_from_slice(sc.as_bytes()); + let reg = ServerRegistration::::try_from(&oprf_bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, oprf_bytes); + // If we do have envelope and client pk, the server registration contains + // the whole kit + let key_len = + <<::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize(); + let envelope_size = key_len + Envelope::::additional_size(); + let mut mock_envelope_bytes = vec![0u8; envelope_size]; + rng.fill_bytes(&mut mock_envelope_bytes); + println!("{}", mock_envelope_bytes.len()); + let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap(); + // serialization order: scalar, public key, envelope + let mut bytes = Vec::::new(); + bytes.extend_from_slice(sc.as_bytes()); + bytes.extend_from_slice(&mock_client_kp.public().to_arr()); + bytes.extend_from_slice(&mock_envelope_bytes); + let reg = ServerRegistration::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); + } + + #[test] + fn register_first_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [1, 0, 0, 36, 0, 0, 0, 32]; + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + + let r1 = RegisterFirstMessage::::deserialize(input.as_slice()).unwrap(); + let r1_bytes = r1.serialize(); + assert_eq!(input, r1_bytes); + } + + #[test] + fn register_second_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr(); + let header = [2, 0, 0, 40, 0, 32]; + let tail = [0, 0, 1, 1, 1, 3]; + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&tail); + + let r2 = RegisterSecondMessage::::deserialize(input.as_slice()).unwrap(); + let r2_bytes = r2.serialize(); + assert_eq!(input, r2_bytes); + } + + #[test] + fn register_third_message_roundtrip() { + let mut rng = OsRng; + let skp = Default::generate_random_keypair(&mut rng).unwrap(); + let pubkey_bytes = skp.public().to_arr(); + + let header = [3, 0, 0, 136]; + let intermediate = [0, 32]; + + let mut key = [0u8; 32]; + rng.fill_bytes(&mut key); + + let mut msg = [0u8; 32]; + rng.fill_bytes(&mut msg); + + let (envelope, _) = + Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(&envelope.serialize()); + input.extend_from_slice(&intermediate); + input.extend_from_slice(&pubkey_bytes[..]); + + let r3 = + RegisterThirdMessage::::deserialize(&input[..]).unwrap(); + let r3_bytes = r3.serialize(); + assert_eq!(input, r3_bytes); + } + + #[test] + fn login_first_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [4, 0, 0, 36, 0, 0, 0, 32]; + + let mut rng = OsRng; + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&ke1m[..]); + + let l1 = LoginFirstMessage::::deserialize(input.as_slice()).unwrap(); + let l1_bytes = l1.serialize(); + assert_eq!(input, l1_bytes); + } + + #[test] + fn login_second_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [5, 0, 0, 134, 0, 32]; + + let mut rng = OsRng; + let skp = Default::generate_random_keypair(&mut rng).unwrap(); + let pubkey_bytes = skp.public().to_arr(); + + let intermediate1 = [0, 96]; + let intermediate2 = [0, 0]; + + let mut key = [0u8; 32]; + rng.fill_bytes(&mut key); + + let mut msg = [0u8; 32]; + rng.fill_bytes(&mut msg); + + let (envelope, _) = + Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + + let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut mac = [0u8; 32]; + rng.fill_bytes(&mut mac); + let mut server_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut server_nonce); + + let ke2m: Vec = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&intermediate1[..]); + input.extend_from_slice(&envelope.to_bytes()); + input.extend_from_slice(&intermediate2[..]); + input.extend_from_slice(&ke2m[..]); + + let l2 = LoginSecondMessage::::deserialize(input.as_slice()).unwrap(); + let l2_bytes = l2.serialize(); + assert_eq!(input, l2_bytes); + } + + #[test] + fn client_login_roundtrip() { + let pw = b"hunter2"; + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat(); + let mut hasher = Sha256::new(); + hasher.update(l1_data); + let hashed_l1 = hasher.finalize(); + + // serialization order: scalar, password, ke1_state + let bytes: Vec = [ + &sc.as_bytes()[..], + &pw[..], + client_e_kp.public(), + &client_nonce, + hashed_l1.as_slice(), + ] + .concat(); + let reg = ClientLogin::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); + } + + #[test] + fn ke1_message_roundtrip() { + let mut rng = OsRng; + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); + let reg = + >::KE1Message::try_from( + ke1m[..].to_vec(), + ) + .unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, ke1m); + } + + proptest! { + + #[test] + fn test_nocrash_register_first_message(bytes in vec(any::(), 0..200)) { + RegisterFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_register_second_message(bytes in vec(any::(), 0..200)) { + RegisterSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_register_third_message(bytes in vec(any::(), 0..200)) { + RegisterThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_login_first_message(bytes in vec(any::(), 0..500)) { + LoginFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_login_second_message(bytes in vec(any::(), 0..500)) { + LoginSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_login_third_message(bytes in vec(any::(), 0..500)) { + LoginThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_client_registration(bytes in vec(any::(), 0..700)) { + ClientRegistration::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_server_registration(bytes in vec(any::(), 0..700)) { + ServerRegistration::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_client_login(bytes in vec(any::(), 0..700)) { + ClientLogin::::try_from(&bytes[..]).map_or(true, |_| true); + } + + #[test] + fn test_nocrash_server_login(bytes in vec(any::(), 0..700)) { + ServerLogin::::try_from(&bytes[..]).map_or(true, |_| true); + } + + } +} diff --git a/src/tests/mod.rs b/src/tests/mod.rs index 09ac24f..1449398 100644 --- a/src/tests/mod.rs +++ b/src/tests/mod.rs @@ -5,4 +5,3 @@ pub mod mock_rng; mod opaque_ke_test; -mod serialization; diff --git a/src/tests/opaque_ke_test.rs b/src/tests/opaque_ke_test.rs index 748cf1b..56be884 100644 --- a/src/tests/opaque_ke_test.rs +++ b/src/tests/opaque_ke_test.rs @@ -80,11 +80,11 @@ static TEST_VECTOR: &str = r#" "envelope_nonce": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8", "client_nonce": "b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572", "server_nonce": "a213c02274e7f20fc3b571d25e98854c5dae2cfde6c9bf228a66bf3eff3e2a97", - "r1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5", - "r2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea", - "r3": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29", - "l1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e", - "l2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931eab0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a", + "r1": "01000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5", + "r2": "020000280020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea000001010103", + "r3": "03000088b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f80020923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb400000020b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330020b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29", + "l1": "04000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e", + "l2": "050000860020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea0060b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330000a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a", "l3": "127144e6469e001d56237a58c8c869a8173e042bf2ff19d8331441d36ada9c3f", "client_registration_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0270617373776f7264", "client_login_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0280616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572f258311568d792d6ebecee225c0fde4512139e29a435e9f9a0b82dc3809a83ab70617373776f7264", @@ -259,14 +259,14 @@ where &mut blinding_factor_registration_rng, ) .unwrap(); - let r1_bytes = r1.to_bytes().to_vec(); + let r1_bytes = r1.serialize().to_vec(); let blinding_factor_bytes = CS::Group::scalar_as_bytes(&client_registration.blinding_factor).clone(); let client_registration_state = client_registration.to_bytes().to_vec(); let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec()); let (r2, server_registration) = ServerRegistration::::start(r1, &mut oprf_key_rng).unwrap(); - let r2_bytes = r2.to_bytes().to_vec(); + let r2_bytes = r2.serialize().to_vec(); let oprf_key_bytes = CS::Group::scalar_as_bytes(&server_registration.oprf_key).clone(); let server_registration_state = server_registration.to_bytes().to_vec(); @@ -278,7 +278,7 @@ where let (r3, export_key_registration) = client_registration .finish(r2, server_s_kp.public(), &mut finish_registration_rng) .unwrap(); - let r3_bytes = r3.to_bytes().to_vec(); + let r3_bytes = r3.serialize().to_vec(); let password_file = server_registration.finish(r3).unwrap(); let password_file_bytes = password_file.to_bytes(); @@ -291,7 +291,7 @@ where let mut client_login_start_rng = CycleRng::new(client_login_start); let (l1, client_login) = ClientLogin::::start(password, Some(pepper), &mut client_login_start_rng).unwrap(); - let l1_bytes = l1.to_bytes().to_vec(); + let l1_bytes = l1.serialize().to_vec(); let client_login_state = client_login.to_bytes().to_vec(); let mut server_e_sk_rng = CycleRng::new(server_e_kp.private().to_arr().to_vec()); @@ -302,7 +302,7 @@ where &mut server_e_sk_rng, ) .unwrap(); - let l2_bytes = l2.to_bytes().to_vec(); + let l2_bytes = l2.serialize().to_vec(); let server_login_state = server_login.to_bytes().to_vec(); let mut client_e_sk_rng = CycleRng::new(client_e_kp.private().to_arr().to_vec()); @@ -360,7 +360,7 @@ fn test_r1() -> Result<(), PakeError> { &mut blinding_factor_rng, ) .unwrap(); - assert_eq!(hex::encode(¶meters.r1), hex::encode(r1.to_bytes())); + assert_eq!(hex::encode(¶meters.r1), hex::encode(r1.serialize())); assert_eq!( hex::encode(¶meters.client_registration_state), hex::encode(client_registration.to_bytes()) @@ -373,11 +373,11 @@ fn test_r2() -> Result<(), PakeError> { let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap()); let mut oprf_key_rng = CycleRng::new(parameters.oprf_key); let (r2, server_registration) = ServerRegistration::::start( - RegisterFirstMessage::try_from(¶meters.r1[..]).unwrap(), + RegisterFirstMessage::deserialize(¶meters.r1[..]).unwrap(), &mut oprf_key_rng, ) .unwrap(); - assert_eq!(hex::encode(parameters.r2), hex::encode(r2.to_bytes())); + assert_eq!(hex::encode(parameters.r2), hex::encode(r2.serialize())); assert_eq!( hex::encode(¶meters.server_registration_state), hex::encode(server_registration.to_bytes()) @@ -397,13 +397,13 @@ fn test_r3() -> Result<(), PakeError> { ) .unwrap() .finish( - RegisterSecondMessage::try_from(¶meters.r2[..]).unwrap(), + RegisterSecondMessage::deserialize(¶meters.r2[..]).unwrap(), &Key::try_from(¶meters.server_s_pk[..]).unwrap(), &mut finish_registration_rng, ) .unwrap(); - assert_eq!(hex::encode(parameters.r3), hex::encode(r3.to_bytes())); + assert_eq!(hex::encode(parameters.r3), hex::encode(r3.serialize())); assert_eq!( hex::encode(parameters.export_key), hex::encode(export_key_registration.to_vec()) @@ -421,7 +421,7 @@ fn test_password_file() -> Result<(), PakeError> { ) .unwrap(); let password_file = server_registration - .finish(RegisterThirdMessage::try_from(¶meters.r3[..]).unwrap()) + .finish(RegisterThirdMessage::deserialize(¶meters.r3[..]).unwrap()) .unwrap(); assert_eq!( @@ -448,7 +448,7 @@ fn test_l1() -> Result<(), PakeError> { &mut client_login_start_rng, ) .unwrap(); - assert_eq!(hex::encode(¶meters.l1), hex::encode(l1.to_bytes())); + assert_eq!(hex::encode(¶meters.l1), hex::encode(l1.serialize())); assert_eq!( hex::encode(¶meters.client_login_state), hex::encode(client_login.to_bytes()) @@ -464,12 +464,12 @@ fn test_l2() -> Result<(), PakeError> { let (l2, server_login) = ServerLogin::::start( ServerRegistration::try_from(¶meters.password_file[..]).unwrap(), &Key::try_from(¶meters.server_s_sk[..]).unwrap(), - LoginFirstMessage::::try_from(¶meters.l1[..]).unwrap(), + LoginFirstMessage::::deserialize(¶meters.l1[..]).unwrap(), &mut server_e_sk_rng, ) .unwrap(); - assert_eq!(hex::encode(¶meters.l2), hex::encode(l2.to_bytes())); + assert_eq!(hex::encode(¶meters.l2), hex::encode(l2.serialize())); assert_eq!( hex::encode(¶meters.server_login_state), hex::encode(server_login.to_bytes()) @@ -486,7 +486,7 @@ fn test_l3() -> Result<(), PakeError> { ClientLogin::::try_from(¶meters.client_login_state[..]) .unwrap() .finish( - LoginSecondMessage::::try_from(¶meters.l2[..]).unwrap(), + LoginSecondMessage::::deserialize(¶meters.l2[..]).unwrap(), &Key::try_from(¶meters.server_s_pk[..])?, &mut client_e_sk_rng, ) From 9c06c98ad665558a437a378a950101b5a46cf717 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Garillot?= Date: Fri, 14 Aug 2020 16:20:42 -0400 Subject: [PATCH 2/8] Introduce enum structs to replicate TLS message format This PR favors native coercions of enums to numerical types to help ser/de operations. Small rearrangement of the serialization module. --- benches/oprf.rs | 3 +- src/elligator/field.rs | 13 +- src/envelope.rs | 8 +- src/group.rs | 3 +- src/lib.rs | 3 +- src/opaque.rs | 28 ++- src/serialization.rs | 352 ------------------------------------- src/serialization/mod.rs | 92 ++++++++++ src/serialization/tests.rs | 314 +++++++++++++++++++++++++++++++++ src/slow_hash.rs | 3 +- 10 files changed, 432 insertions(+), 387 deletions(-) delete mode 100644 src/serialization.rs create mode 100644 src/serialization/mod.rs create mode 100644 src/serialization/tests.rs diff --git a/benches/oprf.rs b/benches/oprf.rs index 13aa16f..ab8c776 100644 --- a/benches/oprf.rs +++ b/benches/oprf.rs @@ -7,8 +7,7 @@ extern crate criterion; use criterion::Criterion; -use curve25519_dalek::edwards::EdwardsPoint; -use curve25519_dalek::ristretto::RistrettoPoint; +use curve25519_dalek::{edwards::EdwardsPoint, ristretto::RistrettoPoint}; use generic_array::arr; use opaque_ke::{ group::Group, diff --git a/src/elligator/field.rs b/src/elligator/field.rs index 1c070e7..511d5be 100644 --- a/src/elligator/field.rs +++ b/src/elligator/field.rs @@ -7,15 +7,12 @@ //! Field arithmetic modulo \\(p = 2\^{255} - 19\\), using \\(64\\)-bit //! limbs with \\(128\\)-bit products. -use core::fmt::Debug; -use core::ops::Neg; -use core::ops::{Add, AddAssign}; -use core::ops::{Mul, MulAssign}; +use core::{ + fmt::Debug, + ops::{Add, AddAssign, Mul, MulAssign, Neg}, +}; -use subtle::Choice; -use subtle::ConditionallyNegatable; -use subtle::ConditionallySelectable; -use subtle::ConstantTimeEq; +use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq}; use zeroize::Zeroize; diff --git a/src/envelope.rs b/src/envelope.rs index 0b079af..a6beec7 100644 --- a/src/envelope.rs +++ b/src/envelope.rs @@ -3,9 +3,11 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. -use crate::errors::{InternalPakeError, ProtocolError}; -use crate::hash::Hash; -use crate::serialization::{serialize, tokenize}; +use crate::{ + errors::{InternalPakeError, ProtocolError}, + hash::Hash, + serialization::{serialize, tokenize}, +}; use digest::Digest; use generic_array::{ typenum::{Unsigned, U32}, diff --git a/src/group.rs b/src/group.rs index 7a4ed55..de3e4d7 100644 --- a/src/group.rs +++ b/src/group.rs @@ -6,8 +6,7 @@ //! Defines the Group trait to specify the underlying prime order group used in //! OPAQUE's OPRF -use crate::elligator; -use crate::errors::InternalPakeError; +use crate::{elligator, errors::InternalPakeError}; use curve25519_dalek::{ edwards::{CompressedEdwardsY, EdwardsPoint}, diff --git a/src/lib.rs b/src/lib.rs index d0de782..d8e2bb5 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -416,7 +416,6 @@ pub mod opaque; pub mod ciphersuite; mod envelope; pub mod hash; -mod serialization; mod elligator; pub mod group; @@ -433,5 +432,7 @@ mod oprf; pub mod slow_hash; +mod serialization; + #[cfg(test)] mod tests; diff --git a/src/opaque.rs b/src/opaque.rs index 4eedb5d..c9c6b41 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -15,7 +15,7 @@ use crate::{ keypair::{KeyPair, SizedBytes}, oprf, oprf::OprfClientBytes, - serialization::{serialize, tokenize}, + serialization::{serialize, tokenize, ProtocolMessageType}, slow_hash::SlowHash, }; use generic_array::{typenum::Unsigned, GenericArray}; @@ -23,12 +23,6 @@ use rand_core::{CryptoRng, RngCore}; use std::{convert::TryFrom, marker::PhantomData}; use zeroize::Zeroize; -const REGISTRATION_REQUEST: u8 = 0x01; -const REGISTRATION_RESPONSE: u8 = 0x02; -const REGISTRATION_UPLOAD: u8 = 0x03; -const CREDENTIAL_REQUEST: u8 = 0x04; -const CREDENTIAL_RESPONSE: u8 = 0x05; - const CREDENTIAL_TYPE_SKU: u8 = 0x01; const CREDENTIAL_TYPE_PKS: u8 = 0x03; @@ -72,14 +66,14 @@ impl RegisterFirstMessage { registration_request.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2)); let mut output: Vec = Vec::new(); - output.push(REGISTRATION_REQUEST); + output.push(ProtocolMessageType::from(self) as u8 + 1); output.extend_from_slice(&serialize(registration_request, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != REGISTRATION_REQUEST { + if input[0] != ProtocolMessageType::RegistrationRequest as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -146,14 +140,14 @@ where registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_PKS], 1)); let mut output: Vec = Vec::new(); - output.push(REGISTRATION_RESPONSE); + output.push(ProtocolMessageType::from(self) as u8 + 1); output.extend_from_slice(&serialize(registration_response, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != REGISTRATION_RESPONSE { + if input[0] != ProtocolMessageType::RegistrationResponse as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -225,14 +219,14 @@ where registration_upload.extend_from_slice(&serialize(self.client_s_pk.to_arr().to_vec(), 2)); let mut output: Vec = Vec::new(); - output.push(REGISTRATION_UPLOAD); + output.push(ProtocolMessageType::from(self) as u8 + 1); output.extend_from_slice(&serialize(registration_upload, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != REGISTRATION_UPLOAD { + if input[0] != ProtocolMessageType::RegistrationUpload as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -302,7 +296,7 @@ impl LoginFirstMessage { credential_request.extend_from_slice(&serialize((&self.alpha.to_arr()).to_vec(), 2)); let mut output: Vec = Vec::new(); - output.push(CREDENTIAL_REQUEST); + output.push(ProtocolMessageType::from(self) as u8 + 1); output.extend_from_slice(&serialize(credential_request, 3)); output.extend_from_slice(&self.ke1_message.to_bytes()); output @@ -310,7 +304,7 @@ impl LoginFirstMessage { /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != CREDENTIAL_REQUEST { + if input[0] != ProtocolMessageType::CredentialRequest as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -347,7 +341,7 @@ impl LoginSecondMessage { credential_response.extend_from_slice(&serialize(Vec::new(), 2)); let mut output: Vec = Vec::new(); - output.push(CREDENTIAL_RESPONSE); + output.push(ProtocolMessageType::from(self) as u8 + 1); output.extend_from_slice(&serialize(credential_response, 3)); output.extend_from_slice(&self.ke2_message.to_bytes()); output @@ -355,7 +349,7 @@ impl LoginSecondMessage { /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != CREDENTIAL_RESPONSE { + if input[0] != ProtocolMessageType::CredentialResponse as u8 + 1 { return Err(PakeError::SerializationError.into()); } diff --git a/src/serialization.rs b/src/serialization.rs deleted file mode 100644 index dbef5f2..0000000 --- a/src/serialization.rs +++ /dev/null @@ -1,352 +0,0 @@ -// Copyright (c) Facebook, Inc. and its affiliates. -// -// This source code is licensed under the MIT license found in the -// LICENSE file in the root directory of this source tree. - -use crate::errors::PakeError; - -pub(crate) fn serialize(input: Vec, max_bytes: usize) -> Vec { - let mut output: Vec = Vec::new(); - output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]); - output.extend_from_slice(&input[..]); - output -} - -pub(crate) fn tokenize(input: Vec, size_bytes: usize) -> Result<(Vec, Vec), PakeError> { - if size_bytes > 8 { - return Err(PakeError::SerializationError); - } - - let mut size_array = [0u8; 8]; - for i in 0..size_bytes { - size_array[8 - size_bytes + i] = input[i]; - } - let size = usize::from_be_bytes(size_array); - - if size_bytes + size > input.len() { - return Err(PakeError::SerializationError); - } - - Ok(( - input[size_bytes..size_bytes + size].to_vec(), - input[size_bytes + size..].to_vec(), - )) -} - -#[cfg(test)] -mod tests { - use crate::{ - ciphersuite::CipherSuite, - envelope::Envelope, - group::Group, - key_exchange::{ - traits::{KeyExchange, ToBytes}, - tripledh::{TripleDH, NONCE_LEN}, - }, - keypair::{KeyPair, SizedBytes, X25519KeyPair}, - opaque::*, - }; - - use curve25519_dalek::ristretto::RistrettoPoint; - use generic_array::typenum::Unsigned; - use proptest::{collection::vec, prelude::*}; - use rand_core::{OsRng, RngCore}; - - use sha2::{Digest, Sha256}; - use std::convert::TryFrom; - - struct Default; - impl CipherSuite for Default { - type Group = RistrettoPoint; - type KeyFormat = crate::keypair::X25519KeyPair; - type KeyExchange = TripleDH; - type Hash = sha2::Sha256; - type SlowHash = crate::slow_hash::NoOpHash; - } - - fn random_ristretto_point() -> RistrettoPoint { - let mut rng = OsRng; - let mut random_bits = [0u8; 64]; - rng.fill_bytes(&mut random_bits); - - // This is because RistrettoPoint is on an obsolete sha2 version - let mut bits = [0u8; 64]; - let mut hasher = sha2::Sha512::new(); - hasher.update(&random_bits[..]); - bits.copy_from_slice(&hasher.finalize()); - - RistrettoPoint::from_uniform_bytes(&bits) - } - - #[test] - fn client_registration_roundtrip() { - let pw = b"hunter2"; - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - // serialization order: scalar, password - let bytes: Vec = [&sc.as_bytes()[..], &pw[..]].concat(); - let reg = ClientRegistration::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); - } - - #[test] - fn server_registration_roundtrip() { - // If we don't have envelope and client_pk, the server registration just - // contains the prf key - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - let mut oprf_bytes: Vec = vec![]; - oprf_bytes.extend_from_slice(sc.as_bytes()); - let reg = ServerRegistration::::try_from(&oprf_bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, oprf_bytes); - // If we do have envelope and client pk, the server registration contains - // the whole kit - let key_len = - <<::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize(); - let envelope_size = key_len + Envelope::::additional_size(); - let mut mock_envelope_bytes = vec![0u8; envelope_size]; - rng.fill_bytes(&mut mock_envelope_bytes); - println!("{}", mock_envelope_bytes.len()); - let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap(); - // serialization order: scalar, public key, envelope - let mut bytes = Vec::::new(); - bytes.extend_from_slice(sc.as_bytes()); - bytes.extend_from_slice(&mock_client_kp.public().to_arr()); - bytes.extend_from_slice(&mock_envelope_bytes); - let reg = ServerRegistration::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); - } - - #[test] - fn register_first_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr().to_vec(); - let header = [1, 0, 0, 36, 0, 0, 0, 32]; - - let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); - - let r1 = RegisterFirstMessage::::deserialize(input.as_slice()).unwrap(); - let r1_bytes = r1.serialize(); - assert_eq!(input, r1_bytes); - } - - #[test] - fn register_second_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr(); - let header = [2, 0, 0, 40, 0, 32]; - let tail = [0, 0, 1, 1, 1, 3]; - - let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&tail); - - let r2 = RegisterSecondMessage::::deserialize(input.as_slice()).unwrap(); - let r2_bytes = r2.serialize(); - assert_eq!(input, r2_bytes); - } - - #[test] - fn register_third_message_roundtrip() { - let mut rng = OsRng; - let skp = Default::generate_random_keypair(&mut rng).unwrap(); - let pubkey_bytes = skp.public().to_arr(); - - let header = [3, 0, 0, 136]; - let intermediate = [0, 32]; - - let mut key = [0u8; 32]; - rng.fill_bytes(&mut key); - - let mut msg = [0u8; 32]; - rng.fill_bytes(&mut msg); - - let (envelope, _) = - Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); - - let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(&envelope.serialize()); - input.extend_from_slice(&intermediate); - input.extend_from_slice(&pubkey_bytes[..]); - - let r3 = - RegisterThirdMessage::::deserialize(&input[..]).unwrap(); - let r3_bytes = r3.serialize(); - assert_eq!(input, r3_bytes); - } - - #[test] - fn login_first_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr().to_vec(); - let header = [4, 0, 0, 36, 0, 0, 0, 32]; - - let mut rng = OsRng; - - let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut client_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut client_nonce); - - let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); - - let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&ke1m[..]); - - let l1 = LoginFirstMessage::::deserialize(input.as_slice()).unwrap(); - let l1_bytes = l1.serialize(); - assert_eq!(input, l1_bytes); - } - - #[test] - fn login_second_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr().to_vec(); - let header = [5, 0, 0, 134, 0, 32]; - - let mut rng = OsRng; - let skp = Default::generate_random_keypair(&mut rng).unwrap(); - let pubkey_bytes = skp.public().to_arr(); - - let intermediate1 = [0, 96]; - let intermediate2 = [0, 0]; - - let mut key = [0u8; 32]; - rng.fill_bytes(&mut key); - - let mut msg = [0u8; 32]; - rng.fill_bytes(&mut msg); - - let (envelope, _) = - Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); - - let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut mac = [0u8; 32]; - rng.fill_bytes(&mut mac); - let mut server_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut server_nonce); - - let ke2m: Vec = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat(); - - let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&intermediate1[..]); - input.extend_from_slice(&envelope.to_bytes()); - input.extend_from_slice(&intermediate2[..]); - input.extend_from_slice(&ke2m[..]); - - let l2 = LoginSecondMessage::::deserialize(input.as_slice()).unwrap(); - let l2_bytes = l2.serialize(); - assert_eq!(input, l2_bytes); - } - - #[test] - fn client_login_roundtrip() { - let pw = b"hunter2"; - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - - let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut client_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut client_nonce); - - let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat(); - let mut hasher = Sha256::new(); - hasher.update(l1_data); - let hashed_l1 = hasher.finalize(); - - // serialization order: scalar, password, ke1_state - let bytes: Vec = [ - &sc.as_bytes()[..], - &pw[..], - client_e_kp.public(), - &client_nonce, - hashed_l1.as_slice(), - ] - .concat(); - let reg = ClientLogin::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); - } - - #[test] - fn ke1_message_roundtrip() { - let mut rng = OsRng; - - let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut client_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut client_nonce); - - let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); - let reg = - >::KE1Message::try_from( - ke1m[..].to_vec(), - ) - .unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, ke1m); - } - - proptest! { - - #[test] - fn test_nocrash_register_first_message(bytes in vec(any::(), 0..200)) { - RegisterFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_register_second_message(bytes in vec(any::(), 0..200)) { - RegisterSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_register_third_message(bytes in vec(any::(), 0..200)) { - RegisterThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_first_message(bytes in vec(any::(), 0..500)) { - LoginFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_second_message(bytes in vec(any::(), 0..500)) { - LoginSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_third_message(bytes in vec(any::(), 0..500)) { - LoginThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_client_registration(bytes in vec(any::(), 0..700)) { - ClientRegistration::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_server_registration(bytes in vec(any::(), 0..700)) { - ServerRegistration::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_client_login(bytes in vec(any::(), 0..700)) { - ClientLogin::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_server_login(bytes in vec(any::(), 0..700)) { - ServerLogin::::try_from(&bytes[..]).map_or(true, |_| true); - } - - } -} diff --git a/src/serialization/mod.rs b/src/serialization/mod.rs new file mode 100644 index 0000000..f39348e --- /dev/null +++ b/src/serialization/mod.rs @@ -0,0 +1,92 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. +use crate::errors::PakeError; + +use crate::{ + ciphersuite::CipherSuite, + hash::Hash, + keypair::KeyPair, + opaque::{ + LoginFirstMessage, LoginSecondMessage, RegisterFirstMessage, RegisterSecondMessage, + RegisterThirdMessage, + }, +}; + +pub enum ProtocolMessageType { + RegistrationRequest, + RegistrationResponse, + RegistrationUpload, + CredentialRequest, + CredentialResponse, +} + +pub enum CredentialType { + SkU, + PkU, + PkS, + IdU, + IdS, +} + +impl From<&RegisterFirstMessage> for ProtocolMessageType { + fn from(_mt: &RegisterFirstMessage) -> Self { + ProtocolMessageType::RegistrationRequest + } +} + +impl From<&RegisterSecondMessage> for ProtocolMessageType { + fn from(_mt: &RegisterSecondMessage) -> Self { + ProtocolMessageType::RegistrationResponse + } +} + +impl From<&RegisterThirdMessage> for ProtocolMessageType { + fn from(_mt: &RegisterThirdMessage) -> Self { + ProtocolMessageType::RegistrationUpload + } +} + +impl From<&LoginFirstMessage> for ProtocolMessageType { + fn from(_mt: &LoginFirstMessage) -> Self { + ProtocolMessageType::CredentialRequest + } +} + +impl From<&LoginSecondMessage> for ProtocolMessageType { + fn from(_mt: &LoginSecondMessage) -> Self { + ProtocolMessageType::CredentialResponse + } +} + +pub(crate) fn serialize(input: Vec, max_bytes: usize) -> Vec { + let mut output: Vec = Vec::new(); + output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]); + output.extend_from_slice(&input[..]); + output +} + +pub(crate) fn tokenize(input: Vec, size_bytes: usize) -> Result<(Vec, Vec), PakeError> { + if size_bytes > 8 { + return Err(PakeError::SerializationError); + } + + let mut size_array = [0u8; 8]; + for i in 0..size_bytes { + size_array[8 - size_bytes + i] = input[i]; + } + let size = usize::from_be_bytes(size_array); + + if size_bytes + size > input.len() { + return Err(PakeError::SerializationError); + } + + Ok(( + input[size_bytes..size_bytes + size].to_vec(), + input[size_bytes + size..].to_vec(), + )) +} + +#[cfg(test)] +mod tests; diff --git a/src/serialization/tests.rs b/src/serialization/tests.rs new file mode 100644 index 0000000..c7221ec --- /dev/null +++ b/src/serialization/tests.rs @@ -0,0 +1,314 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. +use crate::{ + ciphersuite::CipherSuite, + envelope::Envelope, + group::Group, + key_exchange::{ + traits::{KeyExchange, ToBytes}, + tripledh::{TripleDH, NONCE_LEN}, + }, + keypair::{KeyPair, SizedBytes, X25519KeyPair}, + opaque::*, +}; + +use curve25519_dalek::ristretto::RistrettoPoint; +use generic_array::typenum::Unsigned; +use proptest::{collection::vec, prelude::*}; +use rand_core::{OsRng, RngCore}; + +use sha2::{Digest, Sha256}; +use std::convert::TryFrom; + +struct Default; +impl CipherSuite for Default { + type Group = RistrettoPoint; + type KeyFormat = crate::keypair::X25519KeyPair; + type KeyExchange = TripleDH; + type Hash = sha2::Sha256; + type SlowHash = crate::slow_hash::NoOpHash; +} + +fn random_ristretto_point() -> RistrettoPoint { + let mut rng = OsRng; + let mut random_bits = [0u8; 64]; + rng.fill_bytes(&mut random_bits); + + // This is because RistrettoPoint is on an obsolete sha2 version + let mut bits = [0u8; 64]; + let mut hasher = sha2::Sha512::new(); + hasher.update(&random_bits[..]); + bits.copy_from_slice(&hasher.finalize()); + + RistrettoPoint::from_uniform_bytes(&bits) +} + +#[test] +fn client_registration_roundtrip() { + let pw = b"hunter2"; + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + // serialization order: scalar, password + let bytes: Vec = [&sc.as_bytes()[..], &pw[..]].concat(); + let reg = ClientRegistration::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); +} + +#[test] +fn server_registration_roundtrip() { + // If we don't have envelope and client_pk, the server registration just + // contains the prf key + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + let mut oprf_bytes: Vec = vec![]; + oprf_bytes.extend_from_slice(sc.as_bytes()); + let reg = ServerRegistration::::try_from(&oprf_bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, oprf_bytes); + // If we do have envelope and client pk, the server registration contains + // the whole kit + let key_len = + <<::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize(); + let envelope_size = key_len + Envelope::::additional_size(); + let mut mock_envelope_bytes = vec![0u8; envelope_size]; + rng.fill_bytes(&mut mock_envelope_bytes); + println!("{}", mock_envelope_bytes.len()); + let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap(); + // serialization order: scalar, public key, envelope + let mut bytes = Vec::::new(); + bytes.extend_from_slice(sc.as_bytes()); + bytes.extend_from_slice(&mock_client_kp.public().to_arr()); + bytes.extend_from_slice(&mock_envelope_bytes); + let reg = ServerRegistration::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); +} + +#[test] +fn register_first_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [1, 0, 0, 36, 0, 0, 0, 32]; + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + + let r1 = RegisterFirstMessage::::deserialize(input.as_slice()).unwrap(); + let r1_bytes = r1.serialize(); + assert_eq!(input, r1_bytes); +} + +#[test] +fn register_second_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr(); + let header = [2, 0, 0, 40, 0, 32]; + let tail = [0, 0, 1, 1, 1, 3]; + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&tail); + + let r2 = RegisterSecondMessage::::deserialize(input.as_slice()).unwrap(); + let r2_bytes = r2.serialize(); + assert_eq!(input, r2_bytes); +} + +#[test] +fn register_third_message_roundtrip() { + let mut rng = OsRng; + let skp = Default::generate_random_keypair(&mut rng).unwrap(); + let pubkey_bytes = skp.public().to_arr(); + + let header = [3, 0, 0, 136]; + let intermediate = [0, 32]; + + let mut key = [0u8; 32]; + rng.fill_bytes(&mut key); + + let mut msg = [0u8; 32]; + rng.fill_bytes(&mut msg); + + let (envelope, _) = + Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(&envelope.serialize()); + input.extend_from_slice(&intermediate); + input.extend_from_slice(&pubkey_bytes[..]); + + let r3 = RegisterThirdMessage::::deserialize(&input[..]).unwrap(); + let r3_bytes = r3.serialize(); + assert_eq!(input, r3_bytes); +} + +#[test] +fn login_first_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [4, 0, 0, 36, 0, 0, 0, 32]; + + let mut rng = OsRng; + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&ke1m[..]); + + let l1 = LoginFirstMessage::::deserialize(input.as_slice()).unwrap(); + let l1_bytes = l1.serialize(); + assert_eq!(input, l1_bytes); +} + +#[test] +fn login_second_message_roundtrip() { + let pt = random_ristretto_point(); + let pt_bytes = pt.to_arr().to_vec(); + let header = [5, 0, 0, 134, 0, 32]; + + let mut rng = OsRng; + let skp = Default::generate_random_keypair(&mut rng).unwrap(); + let pubkey_bytes = skp.public().to_arr(); + + let intermediate1 = [0, 96]; + let intermediate2 = [0, 0]; + + let mut key = [0u8; 32]; + rng.fill_bytes(&mut key); + + let mut msg = [0u8; 32]; + rng.fill_bytes(&mut msg); + + let (envelope, _) = + Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + + let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut mac = [0u8; 32]; + rng.fill_bytes(&mut mac); + let mut server_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut server_nonce); + + let ke2m: Vec = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat(); + + let mut input = Vec::new(); + input.extend_from_slice(&header); + input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&intermediate1[..]); + input.extend_from_slice(&envelope.to_bytes()); + input.extend_from_slice(&intermediate2[..]); + input.extend_from_slice(&ke2m[..]); + + let l2 = LoginSecondMessage::::deserialize(input.as_slice()).unwrap(); + let l2_bytes = l2.serialize(); + assert_eq!(input, l2_bytes); +} + +#[test] +fn client_login_roundtrip() { + let pw = b"hunter2"; + let mut rng = OsRng; + let sc = ::random_scalar(&mut rng); + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat(); + let mut hasher = Sha256::new(); + hasher.update(l1_data); + let hashed_l1 = hasher.finalize(); + + // serialization order: scalar, password, ke1_state + let bytes: Vec = [ + &sc.as_bytes()[..], + &pw[..], + client_e_kp.public(), + &client_nonce, + hashed_l1.as_slice(), + ] + .concat(); + let reg = ClientLogin::::try_from(&bytes[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, bytes); +} + +#[test] +fn ke1_message_roundtrip() { + let mut rng = OsRng; + + let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); + let mut client_nonce = [0u8; NONCE_LEN]; + rng.fill_bytes(&mut client_nonce); + + let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); + let reg = + >::KE1Message::try_from(&ke1m[..]).unwrap(); + let reg_bytes = reg.to_bytes(); + assert_eq!(reg_bytes, ke1m); +} + +proptest! { + +#[test] +fn test_nocrash_register_first_message(bytes in vec(any::(), 0..200)) { + RegisterFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_register_second_message(bytes in vec(any::(), 0..200)) { + RegisterSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_register_third_message(bytes in vec(any::(), 0..200)) { + RegisterThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_login_first_message(bytes in vec(any::(), 0..500)) { + LoginFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_login_second_message(bytes in vec(any::(), 0..500)) { + LoginSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_login_third_message(bytes in vec(any::(), 0..500)) { + LoginThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_client_registration(bytes in vec(any::(), 0..700)) { + ClientRegistration::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_server_registration(bytes in vec(any::(), 0..700)) { + ServerRegistration::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_client_login(bytes in vec(any::(), 0..700)) { + ClientLogin::::try_from(&bytes[..]).map_or(true, |_| true); +} + +#[test] +fn test_nocrash_server_login(bytes in vec(any::(), 0..700)) { + ServerLogin::::try_from(&bytes[..]).map_or(true, |_| true); +} + +} diff --git a/src/slow_hash.rs b/src/slow_hash.rs index 129fafc..5c51df8 100644 --- a/src/slow_hash.rs +++ b/src/slow_hash.rs @@ -5,8 +5,7 @@ //! Trait specifying a slow hashing function -use crate::errors::InternalPakeError; -use crate::hash::Hash; +use crate::{errors::InternalPakeError, hash::Hash}; use digest::Digest; use generic_array::GenericArray; From 7cc1c0992abe8b9e9c52abcab504414c34b5446c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Garillot?= Date: Mon, 24 Aug 2020 13:13:14 -0400 Subject: [PATCH 3/8] remove the last few constants --- src/opaque.rs | 9 +++------ src/serialization/mod.rs | 1 + 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/src/opaque.rs b/src/opaque.rs index c9c6b41..c704faf 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -15,7 +15,7 @@ use crate::{ keypair::{KeyPair, SizedBytes}, oprf, oprf::OprfClientBytes, - serialization::{serialize, tokenize, ProtocolMessageType}, + serialization::{serialize, tokenize, CredentialType, ProtocolMessageType}, slow_hash::SlowHash, }; use generic_array::{typenum::Unsigned, GenericArray}; @@ -23,9 +23,6 @@ use rand_core::{CryptoRng, RngCore}; use std::{convert::TryFrom, marker::PhantomData}; use zeroize::Zeroize; -const CREDENTIAL_TYPE_SKU: u8 = 0x01; -const CREDENTIAL_TYPE_PKS: u8 = 0x03; - // Messages // ========= @@ -136,8 +133,8 @@ where registration_response.extend_from_slice(&serialize(Vec::new(), 2)); // TODO: The following should not be hardcoded, but instead be customizable - registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_SKU], 1)); - registration_response.extend_from_slice(&serialize(vec![CREDENTIAL_TYPE_PKS], 1)); + registration_response.extend_from_slice(&[1u8, CredentialType::SkU as u8 + 1]); + registration_response.extend_from_slice(&[1u8, CredentialType::PkS as u8 + 1]); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); diff --git a/src/serialization/mod.rs b/src/serialization/mod.rs index f39348e..97f5e95 100644 --- a/src/serialization/mod.rs +++ b/src/serialization/mod.rs @@ -22,6 +22,7 @@ pub enum ProtocolMessageType { CredentialResponse, } +#[allow(dead_code)] pub enum CredentialType { SkU, PkU, From 0fc34487773be5cbc1fca5a611b628e1982f1865 Mon Sep 17 00:00:00 2001 From: Kevin Lewi Date: Fri, 9 Oct 2020 10:51:58 -0700 Subject: [PATCH 4/8] Updating opaque interfaces to include ids from the internet draft (#56) --- src/envelope.rs | 170 ++++++++++++-- src/errors.rs | 21 ++ src/opaque.rs | 430 +++++++++++++++++++++++++----------- src/serialization/mod.rs | 29 ++- src/serialization/tests.rs | 147 ++++++++---- src/tests/opaque_ke_test.rs | 54 ++--- src/tests/serialization.rs | 230 ------------------- 7 files changed, 625 insertions(+), 456 deletions(-) delete mode 100644 src/tests/serialization.rs diff --git a/src/envelope.rs b/src/envelope.rs index a6beec7..02ec225 100644 --- a/src/envelope.rs +++ b/src/envelope.rs @@ -4,9 +4,9 @@ // LICENSE file in the root directory of this source tree. use crate::{ - errors::{InternalPakeError, ProtocolError}, + errors::{InternalPakeError, PakeError, ProtocolError}, hash::Hash, - serialization::{serialize, tokenize}, + serialization::{serialize, tokenize, u8_to_credential_type, CredentialType}, }; use digest::Digest; use generic_array::{ @@ -16,6 +16,7 @@ use generic_array::{ use hkdf::Hkdf; use hmac::{Hmac, Mac, NewMac}; use rand_core::{CryptoRng, RngCore}; +use std::collections::HashMap; // Constant string used as salt for HKDF computation const STR_ENVU: &[u8] = b"EnvU"; @@ -39,14 +40,59 @@ const NONCE_LEN: usize = 32; pub(crate) struct Envelope { nonce: Vec, ciphertext: Vec, + auth_data: Vec, hmac: GenericArray::OutputSize>, } +pub(crate) struct OpenedEnvelopeECF { + pub(crate) credentials_map: HashMap>, + pub(crate) export_key: GenericArray, +} + pub(crate) struct OpenedEnvelope { pub(crate) plaintext: Vec, pub(crate) export_key: GenericArray, } +/// Representation for the format of the envelope +pub struct EnvelopeCredentialsFormat { + pub(crate) secret_credentials: Vec, + pub(crate) cleartext_credentials: Vec, +} + +impl EnvelopeCredentialsFormat { + /// Creates a new envelope credentials format with validity checking + /// An ECF is valid if: + /// - skU is a secret credential + /// - pkS is either a secret or cleartext credential + pub fn new( + secret_credentials: Vec, + cleartext_credentials: Vec, + ) -> Result { + if !secret_credentials.iter().any(|&v| v == CredentialType::SkU) { + // No skU found in secret credentials + return Err(ProtocolError::ServerInvalidEnvelopeCredentialsFormatError); + } + if !secret_credentials.iter().any(|&v| v == CredentialType::PkS) + && !cleartext_credentials + .iter() + .any(|&v| v == CredentialType::PkS) + { + // No pkS found in either secret credentials or cleartext_credentials + return Err(ProtocolError::ServerInvalidEnvelopeCredentialsFormatError); + } + Ok(Self { + secret_credentials, + cleartext_credentials, + }) + } + + /// Uses the default setting for the envelope credentials format + pub fn default() -> Result { + Self::new(vec![CredentialType::SkU], vec![CredentialType::PkS]) + } +} + impl Envelope { /// The additional number of bytes added to the plaintext pub(crate) fn additional_size() -> usize { @@ -57,10 +103,6 @@ impl Envelope { ::OutputSize::to_usize() } - fn hmac_size() -> usize { - ::OutputSize::to_usize() - } - fn export_key_size() -> usize { ExportKeySize::to_usize() } @@ -68,11 +110,13 @@ impl Envelope { pub(crate) fn new( nonce: Vec, ciphertext: Vec, + auth_data: Vec, hmac: GenericArray::OutputSize>, ) -> Self { Self { nonce, ciphertext, + auth_data, hmac, } } @@ -81,48 +125,98 @@ impl Envelope { /// nonce | ciphertext | hmac /// nonce_size bytes | variable length | hmac_size bytes pub(crate) fn from_bytes(bytes: &[u8]) -> Result { - let ciphertext_start = NONCE_LEN; - let ciphertext_end = bytes.len() - Self::hmac_size(); - - Ok(Self::new( - bytes[..ciphertext_start].to_vec(), - bytes[ciphertext_start..ciphertext_end].to_vec(), - GenericArray::clone_from_slice(&bytes[ciphertext_end..]), - )) + let (result, remainder) = Self::deserialize(bytes) + .map_err(|_| InternalPakeError::IncompatibleEnvelopeCredentialsError)?; + if !remainder.is_empty() { + return Err(InternalPakeError::IncompatibleEnvelopeCredentialsError); + } + Ok(result) } pub(crate) fn to_bytes(&self) -> Vec { - [&self.nonce[..], &self.ciphertext[..], &self.hmac[..]].concat() + self.serialize() } pub(crate) fn serialize(&self) -> Vec { [ &self.nonce[..], - &serialize((&self.ciphertext).to_vec(), 2)[..], - &serialize(vec![], 2)[..], - &serialize((&self.hmac).to_vec(), 2)[..], + &serialize(&self.ciphertext, 2)[..], + &serialize(&self.auth_data, 2)[..], + &serialize(&self.hmac, 2)[..], ] .concat() } pub(crate) fn deserialize(input: &[u8]) -> Result<(Self, Vec), ProtocolError> { + if input.len() < NONCE_LEN { + return Err(ProtocolError::VerificationError( + PakeError::SerializationError, + )); + } + let nonce = &input[..NONCE_LEN]; let (ciphertext, remainder) = tokenize(input[NONCE_LEN..].to_vec(), 2)?; - let (_, remainder) = tokenize(remainder, 2)?; + let (auth_data, remainder) = tokenize(remainder, 2)?; let (hmac, remainder) = tokenize(remainder, 2)?; Ok(( Self::new( nonce.to_vec(), ciphertext, + auth_data, GenericArray::clone_from_slice(&hmac[..]), ), remainder, )) } + fn serialize_extensions( + cred_format: Vec, + credentials: &HashMap>, + ) -> Result, InternalPakeError> { + let mut ret = Vec::new(); + for index_type in cred_format { + match &credentials.get(&index_type) { + Some(v) => { + ret.push(index_type as u8 + 1); + ret.extend(serialize(&v, 2)); + } + None => return Err(InternalPakeError::IncompatibleEnvelopeCredentialsError), + } + } + Ok(ret) + } + + fn deserialize_extensions( + bytes: &[u8], + ) -> Result>, InternalPakeError> { + let mut credentials: HashMap> = HashMap::new(); + let mut bytes_copy: Vec = Vec::new(); + bytes_copy.extend_from_slice(&bytes); + while !bytes_copy.is_empty() { + let t = u8_to_credential_type(bytes_copy[0]) + .ok_or(InternalPakeError::IncompatibleEnvelopeCredentialsError)?; + let (cred, remainder) = tokenize(bytes_copy[1..].to_vec(), 2) + .map_err(|_| InternalPakeError::IncompatibleEnvelopeCredentialsError)?; + bytes_copy = remainder; + credentials.insert(t, cred); + } + Ok(credentials) + } + + pub(crate) fn seal( + key: &[u8], + ecf: EnvelopeCredentialsFormat, + credentials: HashMap>, + rng: &mut R, + ) -> Result<(Self, GenericArray), InternalPakeError> { + let plaintext = Self::serialize_extensions(ecf.secret_credentials, &credentials)?; + let aad = Self::serialize_extensions(ecf.cleartext_credentials, &credentials)?; + Self::seal_raw(key, &plaintext, &aad, rng) + } + /// Uses a key to convert the plaintext into an envelope, authenticated by the aad field. /// Note that a new nonce is sampled for each call to seal. - pub(crate) fn seal( + pub(crate) fn seal_raw( key: &[u8], plaintext: &[u8], aad: &[u8], @@ -152,14 +246,42 @@ impl Envelope { hmac.update(&aad); Ok(( - Self::new(nonce, ciphertext.to_vec(), hmac.finalize().into_bytes()), + Self::new( + nonce, + ciphertext.to_vec(), + aad.to_vec(), + hmac.finalize().into_bytes(), + ), *GenericArray::from_slice(&export_key), )) } + pub(crate) fn open(&self, key: &[u8]) -> Result { + let mut credentials_map = Self::deserialize_extensions(&self.auth_data)?; + let opened = self.open_raw(key, &self.auth_data)?; + let plaintext_map = Self::deserialize_extensions(&opened.plaintext)?; + + for (i, plaintext) in plaintext_map { + if credentials_map.contains_key(&i) { + // Trying to set a credential that was already provided in the aad + return Err(InternalPakeError::IncompatibleEnvelopeCredentialsError); + } + credentials_map.insert(i, plaintext); + } + + Ok(OpenedEnvelopeECF { + credentials_map, + export_key: opened.export_key, + }) + } + /// Attempts to decrypt the envelope using a key, which is successful only if the key and /// aad used to construct the envelope are the same. - pub(crate) fn open(&self, key: &[u8], aad: &[u8]) -> Result { + pub(crate) fn open_raw( + &self, + key: &[u8], + aad: &[u8], + ) -> Result { let h = Hkdf::::new(Some(&self.nonce), &key); let mut okm = vec![0u8; self.ciphertext.len() + Self::hmac_key_size() + Self::export_key_size()]; @@ -205,8 +327,8 @@ mod tests { rng.fill_bytes(&mut msg); let (envelope, export_key_1) = - Envelope::::seal(&key, &msg, b"aad", &mut rng).unwrap(); - let opened_envelope = envelope.open(&key, b"aad").unwrap(); + Envelope::::seal_raw(&key, &msg, b"aad", &mut rng).unwrap(); + let opened_envelope = envelope.open_raw(&key, b"aad").unwrap(); assert_eq!(&msg.to_vec(), &opened_envelope.plaintext); assert_eq!(&export_key_1.to_vec(), &opened_envelope.export_key.to_vec()); } diff --git a/src/errors.rs b/src/errors.rs index b5b524b..359ad13 100644 --- a/src/errors.rs +++ b/src/errors.rs @@ -40,6 +40,9 @@ pub enum InternalPakeError { /// This error occurs when the envelope seal open hmac check fails /// HMAC check in seal open failed. SealOpenHmacError, + /// This error occurs when the envelope cannot be constructed properly + /// based on the credentials that were specified to be required. + IncompatibleEnvelopeCredentialsError, } /// Represents an error in password checking @@ -80,6 +83,9 @@ pub enum ProtocolError { /// This error occurs when the server answer cannot be handled /// Server response cannot be handled. ServerError, + /// This error occurs when the server specifies an envelope credentials + /// format that is invalid + ServerInvalidEnvelopeCredentialsFormatError, /// This error occurs when the client request cannot be handled /// Client request cannot be handled. ClientError, @@ -127,4 +133,19 @@ pub(crate) mod utils { } Ok(slice) } + + pub fn check_slice_size_atleast<'a>( + slice: &'a [u8], + expected_len: usize, + arg_name: &'static str, + ) -> Result<&'a [u8], InternalPakeError> { + if slice.len() < expected_len { + return Err(InternalPakeError::SizeError { + name: arg_name, + len: expected_len, + actual_len: slice.len(), + }); + } + Ok(slice) + } } diff --git a/src/opaque.rs b/src/opaque.rs index c704faf..b38ac5a 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -7,19 +7,25 @@ use crate::{ ciphersuite::CipherSuite, - envelope::{Envelope, ExportKeySize}, - errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError}, + envelope::{Envelope, EnvelopeCredentialsFormat, ExportKeySize}, + errors::{ + utils::{check_slice_size, check_slice_size_atleast}, + InternalPakeError, PakeError, ProtocolError, + }, group::Group, hash::Hash, key_exchange::traits::{KeyExchange, ToBytes}, keypair::{KeyPair, SizedBytes}, oprf, oprf::OprfClientBytes, - serialization::{serialize, tokenize, CredentialType, ProtocolMessageType}, + serialization::{ + serialize, tokenize, u8_to_credential_type, CredentialType, ProtocolMessageType, + }, slow_hash::SlowHash, }; use generic_array::{typenum::Unsigned, GenericArray}; use rand_core::{CryptoRng, RngCore}; +use std::collections::HashMap; use std::{convert::TryFrom, marker::PhantomData}; use zeroize::Zeroize; @@ -28,6 +34,8 @@ use zeroize::Zeroize; /// The message sent by the client to the server, to initiate registration pub struct RegisterFirstMessage { + /// User identity + id_u: Vec, /// blinded password information alpha: Grp, } @@ -35,42 +43,44 @@ pub struct RegisterFirstMessage { impl TryFrom<&[u8]> for RegisterFirstMessage { type Error = ProtocolError; fn try_from(first_message_bytes: &[u8]) -> Result { - let checked_slice = check_slice_size( - first_message_bytes, - Grp::ElemLen::to_usize(), - "first_message_bytes", - )?; + let elem_len = Grp::ElemLen::to_usize(); + let checked_slice = + check_slice_size_atleast(first_message_bytes, elem_len, "first_message_bytes")?; + + let id_u = checked_slice[..checked_slice.len() - elem_len].to_vec(); + // Check that the message is actually containing an element of the // correct subgroup - let arr = GenericArray::from_slice(checked_slice); + let arr = GenericArray::from_slice(&checked_slice[checked_slice.len() - elem_len..]); let alpha = Grp::from_element_slice(arr)?; - Ok(Self { alpha }) + Ok(Self { id_u, alpha }) } } impl RegisterFirstMessage { - /// byte representation for the registration request - fn to_bytes(&self) -> GenericArray { - self.alpha.to_arr() + /// Byte representation for the registration request + pub fn to_bytes(&self) -> Vec { + [&self.id_u[..], &self.alpha.to_arr().to_vec()[..]].concat() } -} -impl RegisterFirstMessage { /// Serialization into bytes pub fn serialize(&self) -> Vec { let mut registration_request: Vec = Vec::new(); - registration_request.extend_from_slice(&serialize(Vec::new(), 2)); - registration_request.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2)); + registration_request.extend_from_slice(&serialize(&self.id_u, 2)); + registration_request.extend_from_slice(&serialize(&self.alpha.to_arr(), 2)); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); - output.extend_from_slice(&serialize(registration_request, 3)); + output.extend_from_slice(&serialize(®istration_request, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != ProtocolMessageType::RegistrationRequest as u8 + 1 { + if input.is_empty() + || input.is_empty() + || input[0] != ProtocolMessageType::RegistrationRequest as u8 + 1 + { return Err(PakeError::SerializationError.into()); } @@ -79,14 +89,23 @@ impl RegisterFirstMessage { return Err(PakeError::SerializationError.into()); } - let (_, remainder) = tokenize(data, 2)?; + let (id_u, remainder) = tokenize(data, 2)?; let (alpha_bytes, remainder) = tokenize(remainder, 2)?; if !remainder.is_empty() { return Err(PakeError::SerializationError.into()); } - Self::try_from(&alpha_bytes[..]) + let checked_slice = check_slice_size( + &alpha_bytes, + Grp::ElemLen::to_usize(), + "first_message_bytes", + )?; + // Check that the message is actually containing an element of the + // correct subgroup + let arr = GenericArray::from_slice(checked_slice); + let alpha = Grp::from_element_slice(arr)?; + Ok(Self { id_u, alpha }) } } @@ -95,6 +114,10 @@ impl RegisterFirstMessage { pub struct RegisterSecondMessage { /// The server's oprf output beta: Grp, + /// Server's static public key + server_s_pk: Vec, + /// Envelope credentials format + ecf: EnvelopeCredentialsFormat, } impl TryFrom<&[u8]> for RegisterSecondMessage @@ -103,17 +126,25 @@ where { type Error = ProtocolError; - fn try_from(second_message_bytes: &[u8]) -> Result { - let checked_slice = check_slice_size( - second_message_bytes, - Grp::ElemLen::to_usize(), - "second_message_bytes", - )?; + fn try_from(bytes: &[u8]) -> Result { + let elem_len = Grp::ElemLen::to_usize(); + let checked_slice = check_slice_size_atleast(bytes, elem_len, "second_message_bytes")?; + // Check that the message is actually containing an element of the // correct subgroup - let arr = GenericArray::from_slice(&checked_slice); + let arr = GenericArray::from_slice(&checked_slice[..elem_len]); let beta = Grp::from_element_slice(arr)?; - Ok(Self { beta }) + + let server_s_pk = checked_slice[elem_len..].to_vec(); + + // Note that we use a default envelope credentials format here, since it + // is not included in the byte representation + let ecf = EnvelopeCredentialsFormat::default()?; + Ok(Self { + beta, + server_s_pk, + ecf, + }) } } @@ -121,30 +152,47 @@ impl RegisterSecondMessage where Grp: Group, { - /// byte representation for the registration response message - fn to_bytes(&self) -> Vec { - self.beta.to_arr().to_vec() + /// Byte representation for the registration response message. This does not + /// include the envelope credentials format + pub fn to_bytes(&self) -> Vec { + [&self.beta.to_arr().to_vec()[..], &self.server_s_pk[..]].concat() } /// Serialization into bytes pub fn serialize(&self) -> Vec { let mut registration_response: Vec = Vec::new(); - registration_response.extend_from_slice(&serialize((&self.to_bytes()).to_vec(), 2)); - registration_response.extend_from_slice(&serialize(Vec::new(), 2)); + registration_response.extend_from_slice(&serialize(&self.beta.to_arr(), 2)); + registration_response.extend_from_slice(&serialize(&self.server_s_pk, 2)); - // TODO: The following should not be hardcoded, but instead be customizable - registration_response.extend_from_slice(&[1u8, CredentialType::SkU as u8 + 1]); - registration_response.extend_from_slice(&[1u8, CredentialType::PkS as u8 + 1]); + // Handle ecf serialization + let secret_credentials: Vec = self + .ecf + .secret_credentials + .iter() + .map(|&x| x as u8 + 1) + .collect(); + let cleartext_credentials: Vec = self + .ecf + .cleartext_credentials + .iter() + .map(|&x| x as u8 + 1) + .collect(); + let ecf_serialized = [ + serialize(&secret_credentials, 1), + serialize(&cleartext_credentials, 1), + ] + .concat(); + registration_response.extend_from_slice(&ecf_serialized); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); - output.extend_from_slice(&serialize(registration_response, 3)); + output.extend_from_slice(&serialize(®istration_response, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != ProtocolMessageType::RegistrationResponse as u8 + 1 { + if input.is_empty() || input[0] != ProtocolMessageType::RegistrationResponse as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -154,18 +202,39 @@ where } let (beta_bytes, remainder) = tokenize(data, 2)?; - let (_, remainder) = tokenize(remainder, 2)?; + let (server_s_pk, remainder) = tokenize(remainder, 2)?; - // TODO: The following should affect what is placed in the envelope rather than - // being ignored - let (_, remainder) = tokenize(remainder, 1)?; - let (_, remainder) = tokenize(remainder, 1)?; + // Handle ecf deserialization + let (secret_credentials, remainder) = tokenize(remainder, 1)?; + let (cleartext_credentials, remainder) = tokenize(remainder, 1)?; + let sc = secret_credentials + .iter() + .map(|x| u8_to_credential_type(*x).ok_or(PakeError::SerializationError)) + .collect::, _>>()?; + let cc = cleartext_credentials + .iter() + .map(|x| u8_to_credential_type(*x).ok_or(PakeError::SerializationError)) + .collect::, _>>()?; + let ecf = EnvelopeCredentialsFormat::new(sc, cc)?; if !remainder.is_empty() { return Err(PakeError::SerializationError.into()); } - Self::try_from(&beta_bytes[..]) + let checked_slice = check_slice_size( + &beta_bytes, + Grp::ElemLen::to_usize(), + "second_message_bytes", + )?; + // Check that the message is actually containing an element of the + // correct subgroup + let arr = GenericArray::from_slice(&checked_slice); + let beta = Grp::from_element_slice(arr)?; + Ok(Self { + ecf, + server_s_pk, + beta, + }) } } @@ -213,17 +282,17 @@ where pub fn serialize(&self) -> Vec { let mut registration_upload: Vec = Vec::new(); registration_upload.extend_from_slice(&self.envelope.serialize()); - registration_upload.extend_from_slice(&serialize(self.client_s_pk.to_arr().to_vec(), 2)); + registration_upload.extend_from_slice(&serialize(&self.client_s_pk.to_arr(), 2)); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); - output.extend_from_slice(&serialize(registration_upload, 3)); + output.extend_from_slice(&serialize(®istration_upload, 3)); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != ProtocolMessageType::RegistrationUpload as u8 + 1 { + if input.is_empty() || input[0] != ProtocolMessageType::RegistrationUpload as u8 + 1 { return Err(PakeError::SerializationError.into()); } @@ -248,6 +317,8 @@ where /// The message sent by the user to the server, to initiate registration pub struct LoginFirstMessage { + /// User identity + id_u: Vec, /// blinded password information alpha: CS::Group, ke1_message: >::KE1Message, @@ -256,27 +327,7 @@ pub struct LoginFirstMessage { impl TryFrom<&[u8]> for LoginFirstMessage { type Error = ProtocolError; fn try_from(first_message_bytes: &[u8]) -> Result { - let min_expected_len = ::ElemLen::to_usize(); - let checked_slice = (if first_message_bytes.len() <= min_expected_len { - Err(InternalPakeError::SizeError { - name: "first_message_bytes", - len: min_expected_len, - actual_len: first_message_bytes.len(), - }) - } else { - Ok(first_message_bytes) - })?; - // Check that the message is actually containing an element of the - // correct subgroup - let elem_len = ::ElemLen::to_usize(); - let arr = GenericArray::from_slice(&checked_slice[..elem_len]); - let alpha = CS::Group::from_element_slice(arr)?; - - let ke1_message = - >::KE1Message::try_from( - &checked_slice[elem_len..], - )?; - Ok(Self { alpha, ke1_message }) + Self::deserialize(first_message_bytes) } } @@ -289,33 +340,46 @@ impl LoginFirstMessage { /// Serialization into bytes pub fn serialize(&self) -> Vec { let mut credential_request: Vec = Vec::new(); - credential_request.extend_from_slice(&serialize(Vec::new(), 2)); - credential_request.extend_from_slice(&serialize((&self.alpha.to_arr()).to_vec(), 2)); + credential_request.extend_from_slice(&serialize(&self.id_u, 2)); + credential_request.extend_from_slice(&serialize(&self.alpha.to_arr(), 2)); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); - output.extend_from_slice(&serialize(credential_request, 3)); + output.extend_from_slice(&serialize(&credential_request, 3)); output.extend_from_slice(&self.ke1_message.to_bytes()); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != ProtocolMessageType::CredentialRequest as u8 + 1 { + if input.is_empty() || input[0] != ProtocolMessageType::CredentialRequest as u8 + 1 { return Err(PakeError::SerializationError.into()); } let (data, ke1m) = tokenize(input[1..].to_vec(), 3)?; - let (_, remainder) = tokenize(data, 2)?; + let (id_u, remainder) = tokenize(data, 2)?; let (alpha_bytes, remainder) = tokenize(remainder, 2)?; if !remainder.is_empty() { return Err(PakeError::SerializationError.into()); } - let concatenated = [&alpha_bytes[..], &ke1m[..]].concat(); - Self::try_from(&concatenated[..]) + let elem_len = ::ElemLen::to_usize(); + let checked_slice = check_slice_size(&alpha_bytes, elem_len, "login_first_message_bytes")?; + let arr = GenericArray::from_slice(&checked_slice[..elem_len]); + let alpha = ::from_element_slice(arr)?; + + let ke1_message = + >::KE1Message::try_from( + &ke1m[..], + )?; + + Ok(Self { + id_u, + alpha, + ke1_message, + }) } } @@ -333,28 +397,25 @@ impl LoginSecondMessage { /// Serialization into bytes pub fn serialize(&self) -> Vec { let mut credential_response: Vec = Vec::new(); - credential_response.extend_from_slice(&serialize((&self.beta.to_arr()).to_vec(), 2)); - credential_response.extend_from_slice(&serialize((&self.envelope.to_bytes()).to_vec(), 2)); - credential_response.extend_from_slice(&serialize(Vec::new(), 2)); + credential_response.extend_from_slice(&serialize(&self.beta.to_arr(), 2)); + credential_response.extend_from_slice(&serialize(&self.envelope.to_bytes(), 2)); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); - output.extend_from_slice(&serialize(credential_response, 3)); + output.extend_from_slice(&serialize(&credential_response, 3)); output.extend_from_slice(&self.ke2_message.to_bytes()); output } /// Deserialization from bytes pub fn deserialize(input: &[u8]) -> Result { - if input[0] != ProtocolMessageType::CredentialResponse as u8 + 1 { + if input.is_empty() || input[0] != ProtocolMessageType::CredentialResponse as u8 + 1 { return Err(PakeError::SerializationError.into()); } let (data, ke2m) = tokenize(input[1..].to_vec(), 3)?; - let (beta_bytes, remainder) = tokenize(data, 2)?; let (envelope_bytes, remainder) = tokenize(remainder, 2)?; - let (_, remainder) = tokenize(remainder, 2)?; if !remainder.is_empty() { return Err(PakeError::SerializationError.into()); @@ -368,15 +429,9 @@ impl LoginSecondMessage { impl TryFrom<&[u8]> for LoginSecondMessage { type Error = ProtocolError; fn try_from(second_message_bytes: &[u8]) -> Result { - let key_len = <::Repr as SizedBytes>::Len::to_usize(); - let envelope_size = key_len + Envelope::::additional_size(); let elem_len = ::ElemLen::to_usize(); - let ke2_message_size = CS::KeyExchange::ke2_message_size(); - let checked_slice = check_slice_size( - second_message_bytes, - elem_len + envelope_size + ke2_message_size, - "login_second_message_bytes", - )?; + let checked_slice = + check_slice_size_atleast(second_message_bytes, elem_len, "login_second_message_bytes")?; // Check that the message is actually containing an element of the // correct subgroup @@ -384,12 +439,14 @@ impl TryFrom<&[u8]> for LoginSecondMessage { let arr = GenericArray::from_slice(beta_bytes); let beta = CS::Group::from_element_slice(arr)?; - let envelope = - Envelope::::from_bytes(&checked_slice[elem_len..elem_len + envelope_size])?; + let (envelope, remainder) = Envelope::::deserialize(&checked_slice[elem_len..])?; + let ke2_message_size = CS::KeyExchange::ke2_message_size(); + let checked_remainder = + check_slice_size_atleast(&remainder, ke2_message_size, "login_second_message_bytes")?; let ke2_message = >::KE2Message::try_from( - &checked_slice[elem_len + envelope_size..], + &checked_remainder, )?; Ok(Self { @@ -417,6 +474,14 @@ impl TryFrom<&[u8]> for LoginThirdMessage { } impl LoginThirdMessage { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + let mut output: Vec = Vec::new(); + output.push(ProtocolMessageType::from(self) as u8 + 1); + output.extend_from_slice(&self.ke3_message.to_bytes()); + output + } + /// byte representation for the login finalization pub fn to_bytes(&self) -> Vec { self.ke3_message.to_bytes() @@ -428,6 +493,10 @@ impl LoginThirdMessage { /// The state elements the client holds to register itself pub struct ClientRegistration { + /// User identity + id_u: Vec, + /// Server identity + id_s: Vec, /// a blinding factor pub(crate) blinding_factor: ::Scalar, /// the client's password @@ -436,7 +505,10 @@ pub struct ClientRegistration { impl TryFrom<&[u8]> for ClientRegistration { type Error = ProtocolError; - fn try_from(bytes: &[u8]) -> Result { + fn try_from(input: &[u8]) -> Result { + let (id_u, bytes) = tokenize(input.to_vec(), 2)?; + let (id_s, bytes) = tokenize(bytes.to_vec(), 2)?; + let min_expected_len = ::ScalarLen::to_usize(); let checked_slice = (if bytes.len() <= min_expected_len { Err(InternalPakeError::SizeError { @@ -455,6 +527,8 @@ impl TryFrom<&[u8]> for ClientRegistration { let blinding_factor = CS::Group::from_scalar_slice(blinding_factor_bytes)?; let password = checked_slice[scalar_len..].to_vec(); Ok(Self { + id_u, + id_s, blinding_factor, password, }) @@ -465,6 +539,8 @@ impl ClientRegistration { /// byte representation for the client's registration state pub fn to_bytes(&self) -> Vec { let output: Vec = [ + &serialize(&self.id_u, 2), + &serialize(&self.id_s, 2), &CS::Group::scalar_as_bytes(&self.blinding_factor)[..], &self.password, ] @@ -502,6 +578,23 @@ impl ClientRegistration { password: &[u8], pepper: Option<&[u8]>, blinding_factor_rng: &mut R, + ) -> Result<(RegisterFirstMessage, Self), ProtocolError> { + Self::start_with_user_and_server_name( + &Vec::new(), + &Vec::new(), + password, + pepper, + blinding_factor_rng, + ) + } + + /// Same as ClientRegistration::start, but also accepts a username and server name as input + pub fn start_with_user_and_server_name( + user_name: &[u8], + server_name: &[u8], + password: &[u8], + pepper: Option<&[u8]>, + blinding_factor_rng: &mut R, ) -> Result<(RegisterFirstMessage, Self), ProtocolError> { let OprfClientBytes { alpha, @@ -509,8 +602,13 @@ impl ClientRegistration { } = oprf::generate_oprf1::(&password, pepper, blinding_factor_rng)?; Ok(( - RegisterFirstMessage:: { alpha }, + RegisterFirstMessage:: { + id_u: user_name.to_vec(), + alpha, + }, Self { + id_u: user_name.to_vec(), + id_s: server_name.to_vec(), blinding_factor, password: password.to_vec(), }, @@ -561,6 +659,17 @@ impl ClientRegistration { r2: RegisterSecondMessage, server_s_pk: &::Repr, rng: &mut R, + ) -> Result, ProtocolError> { + let mut r2_cloned = r2; + r2_cloned.server_s_pk = server_s_pk.to_arr().to_vec(); + self.finish_using_transmitted_server_public_key(r2_cloned, rng) + } + + /// Same as finish, but without the server public key check + pub fn finish_using_transmitted_server_public_key( + self, + r2: RegisterSecondMessage, + rng: &mut R, ) -> Result, ProtocolError> { let client_static_keypair = CS::KeyFormat::generate_random(rng)?; @@ -570,12 +679,21 @@ impl ClientRegistration { &self.blinding_factor, )?; - let (envelope, export_key) = Envelope::::seal( - &password_derived_key, - &client_static_keypair.private().to_arr(), - &server_s_pk.to_arr(), - rng, - )?; + let mut credentials_map: HashMap> = HashMap::new(); + credentials_map.insert( + CredentialType::SkU, + client_static_keypair.private().to_arr().to_vec(), + ); + credentials_map.insert( + CredentialType::PkU, + client_static_keypair.public().to_arr().to_vec(), + ); + credentials_map.insert(CredentialType::PkS, r2.server_s_pk); + credentials_map.insert(CredentialType::IdU, self.id_u.clone()); + credentials_map.insert(CredentialType::IdS, self.id_s.clone()); + + let (envelope, export_key) = + Envelope::::seal(&password_derived_key, r2.ecf, credentials_map, rng)?; Ok(( RegisterThirdMessage { @@ -632,36 +750,36 @@ where >: generic_array::ArrayLength, { type Error = ProtocolError; - fn try_from(server_registration_bytes: &[u8]) -> Result { - let key_len = <::Repr as SizedBytes>::Len::to_usize(); - let scalar_len = ::ScalarLen::to_usize(); - let envelope_size = key_len + Envelope::::additional_size(); - if server_registration_bytes.len() == scalar_len { + /// The format of a serialized ServerRegistration object: + /// oprf_key | client_s_pk | envelope + fn try_from(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::to_usize(); + if input.len() == scalar_len { return Ok(Self { - oprf_key: CS::Group::from_scalar_slice(GenericArray::from_slice( - server_registration_bytes, - ))?, + oprf_key: CS::Group::from_scalar_slice(GenericArray::from_slice(input))?, client_s_pk: None, envelope: None, }); } - let checked_bytes = check_slice_size( - server_registration_bytes, - envelope_size + key_len + scalar_len, - "server_registration_bytes", - )?; + // Need to do this check manually because envelope is variable-size + let key_len = <::Repr as SizedBytes>::Len::to_usize(); + + let checked_bytes = + check_slice_size_atleast(&input, scalar_len + key_len, "server_registration_bytes")?; + let oprf_key_bytes = GenericArray::from_slice(&checked_bytes[..scalar_len]); let oprf_key = CS::Group::from_scalar_slice(oprf_key_bytes)?; let unchecked_client_s_pk = ::Repr::from_bytes( &checked_bytes[scalar_len..scalar_len + key_len], )?; let client_s_pk = CS::KeyFormat::check_public_key(unchecked_client_s_pk)?; + + let envelope = Envelope::::from_bytes(&checked_bytes[scalar_len + key_len..])?; + Ok(Self { - envelope: Some(Envelope::::from_bytes( - &checked_bytes[checked_bytes.len() - envelope_size..], - )?), + envelope: Some(envelope), client_s_pk: Some(client_s_pk), oprf_key, }) @@ -720,6 +838,30 @@ where pub fn start( message: RegisterFirstMessage, rng: &mut R, + ) -> Result<(RegisterSecondMessage, Self), ProtocolError> { + Self::start_with_server_pk(message, &Vec::new(), rng) + } + + /// Same as start, but with the ability to supply a server_s_pk as input + pub fn start_with_server_pk( + message: RegisterFirstMessage, + server_s_pk: &[u8], + rng: &mut R, + ) -> Result<(RegisterSecondMessage, Self), ProtocolError> { + Self::start_with_server_pk_and_ecf( + message, + server_s_pk, + EnvelopeCredentialsFormat::default()?, + rng, + ) + } + + /// Same as start, but with the ability to supply a server_s_pk as input and envelope credentials format + pub fn start_with_server_pk_and_ecf( + message: RegisterFirstMessage, + server_s_pk: &[u8], + ecf: EnvelopeCredentialsFormat, + rng: &mut R, ) -> Result<(RegisterSecondMessage, Self), ProtocolError> { // RFC: generate oprf_key (salt) and v_u = g^oprf_key let oprf_key = CS::Group::random_scalar(rng); @@ -728,7 +870,11 @@ where let beta = oprf::generate_oprf2::(message.alpha, &oprf_key)?; Ok(( - RegisterSecondMessage { beta }, + RegisterSecondMessage { + beta, + server_s_pk: server_s_pk.to_vec(), + ecf, + }, Self { envelope: None, client_s_pk: None, @@ -786,6 +932,10 @@ where /// The state elements the client holds to perform a login pub struct ClientLogin { + /// User identity + id_u: Vec, + /// Server identity + id_s: Vec, /// A blinding factor, which is used to mask (and unmask) secret /// information before transmission blinding_factor: ::Scalar, @@ -796,7 +946,10 @@ pub struct ClientLogin { impl TryFrom<&[u8]> for ClientLogin { type Error = ProtocolError; - fn try_from(bytes: &[u8]) -> Result { + fn try_from(input: &[u8]) -> Result { + let (id_u, bytes) = tokenize(input.to_vec(), 2)?; + let (id_s, bytes) = tokenize(bytes.to_vec(), 2)?; + let scalar_len = ::ScalarLen::to_usize(); let ke1_state_size = >::ke1_state_size(); @@ -809,7 +962,7 @@ impl TryFrom<&[u8]> for ClientLogin { actual_len: bytes.len(), }) } else { - Ok(bytes) + Ok(bytes.clone()) })?; let blinding_factor_bytes = GenericArray::from_slice(&checked_slice[..scalar_len]); @@ -820,6 +973,8 @@ impl TryFrom<&[u8]> for ClientLogin { )?; let password = bytes[scalar_len + ke1_state_size..].to_vec(); Ok(Self { + id_u, + id_s, blinding_factor, password, ke1_state, @@ -831,6 +986,8 @@ impl ClientLogin { /// byte representation for the client's login state pub fn to_bytes(&self) -> Vec { let output: Vec = [ + &serialize(&self.id_u, 2), + &serialize(&self.id_s, 2), &CS::Group::scalar_as_bytes(&self.blinding_factor)[..], &self.ke1_state.to_bytes(), &self.password, @@ -875,6 +1032,17 @@ impl ClientLogin { password: &[u8], pepper: Option<&[u8]>, rng: &mut R, + ) -> Result<(LoginFirstMessage, Self), ProtocolError> { + Self::start_with_user_and_server_name(&Vec::new(), &Vec::new(), password, pepper, rng) + } + + /// Same as start, but allows the user to supply a username and server name + pub fn start_with_user_and_server_name( + user_name: &[u8], + server_name: &[u8], + password: &[u8], + pepper: Option<&[u8]>, + rng: &mut R, ) -> Result<(LoginFirstMessage, Self), ProtocolError> { let OprfClientBytes { alpha, @@ -883,11 +1051,17 @@ impl ClientLogin { let (ke1_state, ke1_message) = CS::KeyExchange::generate_ke1(alpha.to_arr().to_vec(), rng)?; - let l1 = LoginFirstMessage { alpha, ke1_message }; + let l1 = LoginFirstMessage { + id_u: user_name.to_vec(), + alpha, + ke1_message, + }; Ok(( l1, Self { + id_u: user_name.to_vec(), + id_s: server_name.to_vec(), blinding_factor, password: password.to_vec(), ke1_state, @@ -933,7 +1107,7 @@ impl ClientLogin { pub fn finish( self, l2: LoginSecondMessage, - server_s_pk: &<::KeyFormat as KeyPair>::Repr, + _server_s_pk: &<::KeyFormat as KeyPair>::Repr, _client_e_sk_rng: &mut R, ) -> Result, ProtocolError> { let l2_bytes: Vec = [&l2.beta.to_arr()[..], &l2.envelope.to_bytes()].concat(); @@ -946,7 +1120,7 @@ impl ClientLogin { let opened_envelope = &l2 .envelope - .open(&password_derived_key, &server_s_pk.to_arr()) + .open(&password_derived_key) .map_err(|e| match e { InternalPakeError::SealOpenHmacError => PakeError::InvalidLoginError, err => PakeError::from(err), @@ -956,8 +1130,12 @@ impl ClientLogin { l2_bytes, l2.ke2_message, &self.ke1_state, - server_s_pk.clone(), - ::Repr::from_bytes(&opened_envelope.plaintext)?, + ::Repr::from_bytes( + &opened_envelope.credentials_map[&CredentialType::PkS], + )?, + ::Repr::from_bytes( + &opened_envelope.credentials_map[&CredentialType::SkU], + )?, )?; Ok(( diff --git a/src/serialization/mod.rs b/src/serialization/mod.rs index 97f5e95..261e589 100644 --- a/src/serialization/mod.rs +++ b/src/serialization/mod.rs @@ -2,6 +2,7 @@ // // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. + use crate::errors::PakeError; use crate::{ @@ -9,8 +10,8 @@ use crate::{ hash::Hash, keypair::KeyPair, opaque::{ - LoginFirstMessage, LoginSecondMessage, RegisterFirstMessage, RegisterSecondMessage, - RegisterThirdMessage, + LoginFirstMessage, LoginSecondMessage, LoginThirdMessage, RegisterFirstMessage, + RegisterSecondMessage, RegisterThirdMessage, }, }; @@ -20,9 +21,10 @@ pub enum ProtocolMessageType { RegistrationUpload, CredentialRequest, CredentialResponse, + KeyExchange, } -#[allow(dead_code)] +#[derive(Copy, Clone, Eq, Hash, PartialEq)] pub enum CredentialType { SkU, PkU, @@ -31,6 +33,17 @@ pub enum CredentialType { IdS, } +pub(crate) fn u8_to_credential_type(x: u8) -> Option { + match x { + 1 => Some(CredentialType::SkU), + 2 => Some(CredentialType::PkU), + 3 => Some(CredentialType::PkS), + 4 => Some(CredentialType::IdU), + 5 => Some(CredentialType::IdS), + _ => None, + } +} + impl From<&RegisterFirstMessage> for ProtocolMessageType { fn from(_mt: &RegisterFirstMessage) -> Self { ProtocolMessageType::RegistrationRequest @@ -61,7 +74,13 @@ impl From<&LoginSecondMessage> for ProtocolMessageType { } } -pub(crate) fn serialize(input: Vec, max_bytes: usize) -> Vec { +impl From<&LoginThirdMessage> for ProtocolMessageType { + fn from(_mt: &LoginThirdMessage) -> Self { + ProtocolMessageType::KeyExchange + } +} + +pub(crate) fn serialize(input: &[u8], max_bytes: usize) -> Vec { let mut output: Vec = Vec::new(); output.extend_from_slice(&input.len().to_be_bytes()[8 - max_bytes..]); output.extend_from_slice(&input[..]); @@ -69,7 +88,7 @@ pub(crate) fn serialize(input: Vec, max_bytes: usize) -> Vec { } pub(crate) fn tokenize(input: Vec, size_bytes: usize) -> Result<(Vec, Vec), PakeError> { - if size_bytes > 8 { + if size_bytes > 8 || input.len() < size_bytes { return Err(PakeError::SerializationError); } diff --git a/src/serialization/tests.rs b/src/serialization/tests.rs index c7221ec..8b73877 100644 --- a/src/serialization/tests.rs +++ b/src/serialization/tests.rs @@ -2,6 +2,7 @@ // // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. + use crate::{ ciphersuite::CipherSuite, envelope::Envelope, @@ -12,10 +13,10 @@ use crate::{ }, keypair::{KeyPair, SizedBytes, X25519KeyPair}, opaque::*, + serialization::{serialize, ProtocolMessageType}, }; use curve25519_dalek::ristretto::RistrettoPoint; -use generic_array::typenum::Unsigned; use proptest::{collection::vec, prelude::*}; use rand_core::{OsRng, RngCore}; @@ -31,6 +32,8 @@ impl CipherSuite for Default { type SlowHash = crate::slow_hash::NoOpHash; } +const MAX_ID_LENGTH: usize = 10; + fn random_ristretto_point() -> RistrettoPoint { let mut rng = OsRng; let mut random_bits = [0u8; 64]; @@ -50,8 +53,21 @@ fn client_registration_roundtrip() { let pw = b"hunter2"; let mut rng = OsRng; let sc = ::random_scalar(&mut rng); - // serialization order: scalar, password - let bytes: Vec = [&sc.as_bytes()[..], &pw[..]].concat(); + let id_u_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let id_s_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let mut id_u = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id_u); + let mut id_s = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id_s); + + // serialization order: id_u, id_s, scalar, password + let bytes: Vec = [ + &serialize(&id_u[..id_u_length], 2)[..], + &serialize(&id_s[..id_s_length], 2)[..], + &sc.as_bytes()[..], + &pw[..], + ] + .concat(); let reg = ClientRegistration::::try_from(&bytes[..]).unwrap(); let reg_bytes = reg.to_bytes(); assert_eq!(reg_bytes, bytes); @@ -62,24 +78,28 @@ fn server_registration_roundtrip() { // If we don't have envelope and client_pk, the server registration just // contains the prf key let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); + let oprf_key = ::random_scalar(&mut rng); let mut oprf_bytes: Vec = vec![]; - oprf_bytes.extend_from_slice(sc.as_bytes()); + oprf_bytes.extend_from_slice(oprf_key.as_bytes()); let reg = ServerRegistration::::try_from(&oprf_bytes[..]).unwrap(); let reg_bytes = reg.to_bytes(); assert_eq!(reg_bytes, oprf_bytes); // If we do have envelope and client pk, the server registration contains // the whole kit - let key_len = - <<::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize(); - let envelope_size = key_len + Envelope::::additional_size(); - let mut mock_envelope_bytes = vec![0u8; envelope_size]; - rng.fill_bytes(&mut mock_envelope_bytes); - println!("{}", mock_envelope_bytes.len()); + + // Construct a mock envelope + let mut mock_envelope_bytes = Vec::new(); + mock_envelope_bytes.extend_from_slice(&[0; NONCE_LEN]); // empty nonce + mock_envelope_bytes.extend_from_slice(&[0, 0]); // empty ciphertext + mock_envelope_bytes.extend_from_slice(&[0, 0]); // empty auth_data + // length-32 hmac + mock_envelope_bytes.extend_from_slice(&[0, 32]); + mock_envelope_bytes.extend_from_slice(&[0; 32]); + let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap(); - // serialization order: scalar, public key, envelope + // serialization order: oprf_key, public key, envelope let mut bytes = Vec::::new(); - bytes.extend_from_slice(sc.as_bytes()); + bytes.extend_from_slice(oprf_key.as_bytes()); bytes.extend_from_slice(&mock_client_kp.public().to_arr()); bytes.extend_from_slice(&mock_envelope_bytes); let reg = ServerRegistration::::try_from(&bytes[..]).unwrap(); @@ -91,10 +111,21 @@ fn server_registration_roundtrip() { fn register_first_message_roundtrip() { let pt = random_ristretto_point(); let pt_bytes = pt.to_arr().to_vec(); - let header = [1, 0, 0, 36, 0, 0, 0, 32]; + + let mut rng = OsRng; + let id_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let mut id = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id); + + let alpha_length: usize = 32; + let total_length: usize = alpha_length + id_length + 4; let mut input = Vec::new(); - input.extend_from_slice(&header); + input.extend_from_slice(&[ProtocolMessageType::RegistrationRequest as u8 + 1]); + input.extend_from_slice(&total_length.to_be_bytes()[8 - 3..]); + input.extend_from_slice(&id_length.to_be_bytes()[8 - 2..]); + input.extend_from_slice(&id[..id_length]); + input.extend_from_slice(&alpha_length.to_be_bytes()[8 - 2..]); input.extend_from_slice(pt_bytes.as_slice()); let r1 = RegisterFirstMessage::::deserialize(input.as_slice()).unwrap(); @@ -105,14 +136,24 @@ fn register_first_message_roundtrip() { #[test] fn register_second_message_roundtrip() { let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr(); - let header = [2, 0, 0, 40, 0, 32]; - let tail = [0, 0, 1, 1, 1, 3]; + let beta_bytes = pt.to_arr(); + let mut rng = OsRng; + let skp = Default::generate_random_keypair(&mut rng).unwrap(); + let pubkey_bytes = skp.public().to_arr(); + let credential_types = [1, 1, 1, 3]; + + let beta_length: usize = beta_bytes.len(); + let pubkey_length: usize = pubkey_bytes.len(); + let total_length: usize = beta_length + pubkey_length + credential_types.len() + 4; let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&tail); + input.extend_from_slice(&[ProtocolMessageType::RegistrationResponse as u8 + 1]); + input.extend_from_slice(&total_length.to_be_bytes()[8 - 3..]); + input.extend_from_slice(&beta_length.to_be_bytes()[8 - 2..]); + input.extend_from_slice(beta_bytes.as_slice()); + input.extend_from_slice(&pubkey_length.to_be_bytes()[8 - 2..]); + input.extend_from_slice(&pubkey_bytes.as_slice()); + input.extend_from_slice(&credential_types); let r2 = RegisterSecondMessage::::deserialize(input.as_slice()).unwrap(); let r2_bytes = r2.serialize(); @@ -125,9 +166,6 @@ fn register_third_message_roundtrip() { let skp = Default::generate_random_keypair(&mut rng).unwrap(); let pubkey_bytes = skp.public().to_arr(); - let header = [3, 0, 0, 136]; - let intermediate = [0, 32]; - let mut key = [0u8; 32]; rng.fill_bytes(&mut key); @@ -135,12 +173,17 @@ fn register_third_message_roundtrip() { rng.fill_bytes(&mut msg); let (envelope, _) = - Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + Envelope::::seal_raw(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + let envelope_bytes = envelope.serialize(); + + let pubkey_length: usize = pubkey_bytes.len(); + let total_length: usize = pubkey_length + envelope_bytes.len() + 2; let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(&envelope.serialize()); - input.extend_from_slice(&intermediate); + input.extend_from_slice(&[ProtocolMessageType::RegistrationUpload as u8 + 1]); + input.extend_from_slice(&total_length.to_be_bytes()[8 - 3..]); + input.extend_from_slice(&envelope_bytes); + input.extend_from_slice(&pubkey_length.to_be_bytes()[8 - 2..]); input.extend_from_slice(&pubkey_bytes[..]); let r3 = RegisterThirdMessage::::deserialize(&input[..]).unwrap(); @@ -150,11 +193,12 @@ fn register_third_message_roundtrip() { #[test] fn login_first_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr().to_vec(); - let header = [4, 0, 0, 36, 0, 0, 0, 32]; - let mut rng = OsRng; + let alpha = random_ristretto_point(); + let alpha_bytes = alpha.to_arr().to_vec(); + let id_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let mut id = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id); let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); let mut client_nonce = [0u8; NONCE_LEN]; @@ -162,9 +206,16 @@ fn login_first_message_roundtrip() { let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); + let alpha_length = alpha_bytes.len(); + let total_length_without_ke1m: usize = id_length + alpha_length + 4; + let mut input = Vec::new(); - input.extend_from_slice(&header); - input.extend_from_slice(pt_bytes.as_slice()); + input.extend_from_slice(&[ProtocolMessageType::CredentialRequest as u8 + 1]); + input.extend_from_slice(&total_length_without_ke1m.to_be_bytes()[8 - 3..]); + input.extend_from_slice(&id_length.to_be_bytes()[8 - 2..]); + input.extend_from_slice(&id[..id_length]); + input.extend_from_slice(&alpha_length.to_be_bytes()[8 - 2..]); + input.extend_from_slice(&alpha_bytes); input.extend_from_slice(&ke1m[..]); let l1 = LoginFirstMessage::::deserialize(input.as_slice()).unwrap(); @@ -176,15 +227,11 @@ fn login_first_message_roundtrip() { fn login_second_message_roundtrip() { let pt = random_ristretto_point(); let pt_bytes = pt.to_arr().to_vec(); - let header = [5, 0, 0, 134, 0, 32]; let mut rng = OsRng; let skp = Default::generate_random_keypair(&mut rng).unwrap(); let pubkey_bytes = skp.public().to_arr(); - let intermediate1 = [0, 96]; - let intermediate2 = [0, 0]; - let mut key = [0u8; 32]; rng.fill_bytes(&mut key); @@ -192,7 +239,7 @@ fn login_second_message_roundtrip() { rng.fill_bytes(&mut msg); let (envelope, _) = - Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); + Envelope::::seal_raw(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); let server_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); let mut mac = [0u8; 32]; @@ -202,15 +249,18 @@ fn login_second_message_roundtrip() { let ke2m: Vec = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat(); + let total_length_without_ke2m: usize = pt_bytes.len() + envelope.to_bytes().len() + 4; + let mut input = Vec::new(); - input.extend_from_slice(&header); + input.extend_from_slice(&[ProtocolMessageType::CredentialResponse as u8 + 1]); + input.extend_from_slice(&total_length_without_ke2m.to_be_bytes()[8 - 3..]); + input.extend_from_slice(&pt_bytes.len().to_be_bytes()[8 - 2..]); input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&intermediate1[..]); + input.extend_from_slice(&envelope.to_bytes().len().to_be_bytes()[8 - 2..]); input.extend_from_slice(&envelope.to_bytes()); - input.extend_from_slice(&intermediate2[..]); input.extend_from_slice(&ke2m[..]); - let l2 = LoginSecondMessage::::deserialize(input.as_slice()).unwrap(); + let l2 = LoginSecondMessage::::deserialize(&input).unwrap(); let l2_bytes = l2.serialize(); assert_eq!(input, l2_bytes); } @@ -219,6 +269,13 @@ fn login_second_message_roundtrip() { fn client_login_roundtrip() { let pw = b"hunter2"; let mut rng = OsRng; + let id_u_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let id_s_length: usize = rng.gen_range(0, MAX_ID_LENGTH); + let mut id_u = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id_u); + let mut id_s = [0u8; MAX_ID_LENGTH]; + rng.fill_bytes(&mut id_s); + let sc = ::random_scalar(&mut rng); let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); @@ -230,8 +287,10 @@ fn client_login_roundtrip() { hasher.update(l1_data); let hashed_l1 = hasher.finalize(); - // serialization order: scalar, password, ke1_state + // serialization order: id_u, id_s, scalar, password, ke1_state let bytes: Vec = [ + &serialize(&id_u[..id_u_length], 2)[..], + &serialize(&id_s[..id_s_length], 2)[..], &sc.as_bytes()[..], &pw[..], client_e_kp.public(), diff --git a/src/tests/opaque_ke_test.rs b/src/tests/opaque_ke_test.rs index 56be884..3d1cfeb 100644 --- a/src/tests/opaque_ke_test.rs +++ b/src/tests/opaque_ke_test.rs @@ -64,35 +64,35 @@ pub struct TestVectorParameters { static TEST_VECTOR: &str = r#" { - "client_s_pk": "b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29", - "client_s_sk": "701e8cd1263abd2f2a22d4dc94b1d5fe3c9cb14030e7e7c154745825b059fd7f", - "client_e_pk": "97cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e", - "client_e_sk": "80616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359", - "server_s_pk": "e12d737e520eaf8504fbf302c2945011bff360bdf02ee102f2ebd6a883c80e02", - "server_s_sk": "9075d3d3c5b6bc2f6218e7672c0532c619ce09dddf196006c5ffdaf628a3d760", - "server_e_pk": "f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a279", - "server_e_sk": "a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248", + "client_s_pk": "db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74a", + "client_s_sk": "c0580c0dcfba5b38e3bf7dd110bd5025c319678b30c8baecaf9c2ef3c959f253", + "client_e_pk": "c3a4413191704cbe3ee1cc8293a565e260a3cbadfdb091bc00e953b33883c363", + "client_e_sk": "18be455fafb4cbe97a7531c2fc4ff2ce9b7bfc0119b0fcd7660443ddd0ec4068", + "server_s_pk": "2d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d", + "server_s_sk": "48bb316e50d6c93a6d4a95eba0652ab147eb422c7207bc780ebd47f952a8f164", + "server_e_pk": "6bcb8d80d0fcf242e4ed4d414375d66a696d1bfe220af29681c89835444b9d7b", + "server_e_sk": "b88df6767ae031eb77be76b66ad467bea6ff26a41db963ff3b4db81ed6c72452", "password": "70617373776f7264", - "blinding_factor_raw": "ca2d8ae51794579bd0f46044d7daccf222b4590053536b48575bc169f7478fd0a0b580fb0aae948c26ba403a2e7b98f563e434a0aad93f4105419c474453c34e", - "blinding_factor": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e02", + "blinding_factor_raw": "7235ed80e9335579c8fbda9e61e8c92358b53267f33d14002cf1ee8e4a452190706c642cda5611d54aba2d8aebe91c20d230ce350d6bc76ccde2bbe3c3b38af3", + "blinding_factor": "ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a", "pepper": "706570706572", - "oprf_key": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907", - "envelope_nonce": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8", - "client_nonce": "b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572", - "server_nonce": "a213c02274e7f20fc3b571d25e98854c5dae2cfde6c9bf228a66bf3eff3e2a97", - "r1": "01000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5", - "r2": "020000280020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea000001010103", - "r3": "03000088b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f80020923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb400000020b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330020b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29", - "l1": "04000024000000207e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e", - "l2": "050000860020710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea0060b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb49330000a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a", - "l3": "127144e6469e001d56237a58c8c869a8173e042bf2ff19d8331441d36ada9c3f", - "client_registration_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0270617373776f7264", - "client_login_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0280616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572f258311568d792d6ebecee225c0fde4512139e29a435e9f9a0b82dc3809a83ab70617373776f7264", - "server_registration_state": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907", - "server_login_state": "ebc0953924d55ad66aa801a7c85f47f35889b90002451a04fb7134b8a2a5a33cd69098c0a81ce06f58cbe4fd6ba23c9c1404ad6f639ba64d5f0f7bf0a041fc5872b17f13bd41cbfbdfa8d74bc94ec1abcc77b9a3da8fbad918ca0a5f84a81443", - "password_file": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933", - "export_key": "da3a52148a58168c9f804df5e216e3d3f16e935d4d70a5eb249433d88e02ae4c", - "shared_secret": "72b17f13bd41cbfbdfa8d74bc94ec1abcc77b9a3da8fbad918ca0a5f84a81443" + "oprf_key": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207", + "envelope_nonce": "ed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038", + "client_nonce": "774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a6", + "server_nonce": "a627d3525b162594be0c134ccf5fd4cab719e37ec945e70a128d66abb3bb58c4", + "r1": "010000240000002060ebaf93d439cd229e8fd843b9cd2656d40cba15981f04464c9842f98557f30b", + "r2": "020000280020ab7af6fd8628eded06289ccf85ad8e2f4bc8d584129b923cdc6a2865300a8f6a000001010103", + "r3": "030000aeed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f00020db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74a", + "l1": "040000240000002060ebaf93d439cd229e8fd843b9cd2656d40cba15981f04464c9842f98557f30b774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a6c3a4413191704cbe3ee1cc8293a565e260a3cbadfdb091bc00e953b33883c363", + "l2": "050000b00020ab7af6fd8628eded06289ccf85ad8e2f4bc8d584129b923cdc6a2865300a8f6a008ced0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f0b88df6767ae031eb77be76b66ad467bea6ff26a41db963ff3b4db81ed6c724526bcb8d80d0fcf242e4ed4d414375d66a696d1bfe220af29681c89835444b9d7b3a1f7e046c1460ed3a47fff7be87b5670d568a1bab2ae7f5b7ee70ff99c3d21d", + "l3": "28b18759b0f5977c607170b7ceb1b5d75bffbc185991ae001c0fded87f826d89", + "client_registration_state": "00000000ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a70617373776f7264", + "client_login_state": "00000000ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a18be455fafb4cbe97a7531c2fc4ff2ce9b7bfc0119b0fcd7660443ddd0ec4068774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a68d5a62ba390f1ee0419616e1a135e609ad248c7a3ee7edf4fb90f575148758d070617373776f7264", + "server_registration_state": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207", + "server_login_state": "14e5fe977591bb71f1e2bcd0542d26023c818048a257781fe276a3e8f9e0be4d58075843e2050013c815c6ef3d015a4ef1294543225832281adec71e1a92fa32a783f8c52f881f276f1c780f21b3fcb4eb36b75daea84b3bb9f7ce0699842864", + "password_file": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74aed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f0", + "export_key": "48e39aeec42923ada9a239b231ff290efb1d4d01ccec8cd820a42dde10ff0d09", + "shared_secret": "a783f8c52f881f276f1c780f21b3fcb4eb36b75daea84b3bb9f7ce0699842864" } "#; diff --git a/src/tests/serialization.rs b/src/tests/serialization.rs deleted file mode 100644 index c5a5660..0000000 --- a/src/tests/serialization.rs +++ /dev/null @@ -1,230 +0,0 @@ -// Copyright (c) Facebook, Inc. and its affiliates. -// -// This source code is licensed under the MIT license found in the -// LICENSE file in the root directory of this source tree. - -use crate::{ - ciphersuite::CipherSuite, - envelope::Envelope, - group::Group, - key_exchange::{ - traits::{KeyExchange, ToBytes}, - tripledh::{TripleDH, NONCE_LEN}, - }, - keypair::{KeyPair, SizedBytes, X25519KeyPair}, - opaque::*, -}; - -use curve25519_dalek::ristretto::RistrettoPoint; -use generic_array::typenum::Unsigned; -use proptest::{collection::vec, prelude::*}; -use rand_core::{OsRng, RngCore}; - -use sha2::{Digest, Sha256}; -use std::convert::TryFrom; - -struct Default; -impl CipherSuite for Default { - type Group = RistrettoPoint; - type KeyFormat = crate::keypair::X25519KeyPair; - type KeyExchange = TripleDH; - type Hash = sha2::Sha256; - type SlowHash = crate::slow_hash::NoOpHash; -} - -fn random_ristretto_point() -> RistrettoPoint { - let mut rng = OsRng; - let mut random_bits = [0u8; 64]; - rng.fill_bytes(&mut random_bits); - - // This is because RistrettoPoint is on an obsolete sha2 version - let mut bits = [0u8; 64]; - let mut hasher = sha2::Sha512::new(); - hasher.update(&random_bits[..]); - bits.copy_from_slice(&hasher.finalize()); - - RistrettoPoint::from_uniform_bytes(&bits) -} - -#[test] -fn client_registration_roundtrip() { - let pw = b"hunter2"; - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - // serialization order: scalar, password - let bytes: Vec = [&sc.as_bytes()[..], &pw[..]].concat(); - let reg = ClientRegistration::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); -} - -#[test] -fn server_registration_roundtrip() { - // If we don't have envelope and client_pk, the server registration just - // contains the prf key - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - let mut oprf_bytes: Vec = vec![]; - oprf_bytes.extend_from_slice(sc.as_bytes()); - let reg = ServerRegistration::::try_from(&oprf_bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, oprf_bytes); - // If we do have envelope and client pk, the server registration contains - // the whole kit - let key_len = - <<::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize(); - let envelope_size = key_len + Envelope::::additional_size(); - let mut mock_envelope_bytes = vec![0u8; envelope_size]; - rng.fill_bytes(&mut mock_envelope_bytes); - println!("{}", mock_envelope_bytes.len()); - let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap(); - // serialization order: scalar, public key, envelope - let mut bytes = Vec::::new(); - bytes.extend_from_slice(sc.as_bytes()); - bytes.extend_from_slice(&mock_client_kp.public().to_arr()); - bytes.extend_from_slice(&mock_envelope_bytes); - let reg = ServerRegistration::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); -} - -#[test] -fn register_first_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr(); - let r1 = RegisterFirstMessage::::try_from(pt_bytes.as_slice()).unwrap(); - let r1_bytes = r1.to_bytes(); - assert_eq!(pt_bytes, r1_bytes); -} - -#[test] -fn register_second_message_roundtrip() { - let pt = random_ristretto_point(); - let pt_bytes = pt.to_arr(); - - let message = pt_bytes.to_vec(); - let r2 = RegisterSecondMessage::::try_from(&message[..]).unwrap(); - let r2_bytes = r2.to_bytes(); - assert_eq!(message, r2_bytes); -} - -#[test] -fn register_third_message_roundtrip() { - let mut rng = OsRng; - let skp = Default::generate_random_keypair(&mut rng).unwrap(); - let pubkey_bytes = skp.public().to_arr(); - - let mut key = [0u8; 32]; - rng.fill_bytes(&mut key); - - let mut msg = [0u8; 32]; - rng.fill_bytes(&mut msg); - - let (ciphertext, _) = - Envelope::::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap(); - - let message: Vec = [&ciphertext.to_bytes(), &pubkey_bytes[..]].concat(); - let r3 = RegisterThirdMessage::::try_from(&message[..]).unwrap(); - let r3_bytes = r3.to_bytes(); - assert_eq!(message, r3_bytes); -} - -#[test] -fn client_login_roundtrip() { - let pw = b"hunter2"; - let mut rng = OsRng; - let sc = ::random_scalar(&mut rng); - - let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut client_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut client_nonce); - - let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat(); - let mut hasher = Sha256::new(); - hasher.update(l1_data); - let hashed_l1 = hasher.finalize(); - - // serialization order: scalar, password, ke1_state - let bytes: Vec = [ - &sc.as_bytes()[..], - &pw[..], - client_e_kp.public(), - &client_nonce, - hashed_l1.as_slice(), - ] - .concat(); - let reg = ClientLogin::::try_from(&bytes[..]).unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, bytes); -} - -#[test] -fn login_first_message_roundtrip() { - let mut rng = OsRng; - - let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap(); - let mut client_nonce = [0u8; NONCE_LEN]; - rng.fill_bytes(&mut client_nonce); - - let ke1m: Vec = [&client_nonce[..], &client_e_kp.public()].concat(); - let reg = >::KE1Message::try_from( - &ke1m[..], - ) - .unwrap(); - let reg_bytes = reg.to_bytes(); - assert_eq!(reg_bytes, ke1m); -} - -proptest! { - - #[test] - fn test_nocrash_register_first_message(bytes in vec(any::(), 0..200)) { - RegisterFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_register_second_message(bytes in vec(any::(), 0..200)) { - RegisterSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_register_third_message(bytes in vec(any::(), 0..200)) { - RegisterThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_first_message(bytes in vec(any::(), 0..500)) { - LoginFirstMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_second_message(bytes in vec(any::(), 0..500)) { - LoginSecondMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_login_third_message(bytes in vec(any::(), 0..500)) { - LoginThirdMessage::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_client_registration(bytes in vec(any::(), 0..700)) { - ClientRegistration::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_server_registration(bytes in vec(any::(), 0..700)) { - ServerRegistration::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_client_login(bytes in vec(any::(), 0..700)) { - ClientLogin::::try_from(&bytes[..]).map_or(true, |_| true); - } - - #[test] - fn test_nocrash_server_login(bytes in vec(any::(), 0..700)) { - ServerLogin::::try_from(&bytes[..]).map_or(true, |_| true); - } - -} From 07f8048a3db1043d1152102ff66e25ae34da1259 Mon Sep 17 00:00:00 2001 From: Kevin Lewi Date: Tue, 20 Oct 2020 21:50:11 -0700 Subject: [PATCH 5/8] Updating to keep in sync with issue 62 fix in spec (#61) --- src/opaque.rs | 9 ++----- src/serialization/tests.rs | 3 +-- src/tests/opaque_ke_test.rs | 54 ++++++++++++++++++------------------- 3 files changed, 30 insertions(+), 36 deletions(-) diff --git a/src/opaque.rs b/src/opaque.rs index b38ac5a..160cefd 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -398,7 +398,7 @@ impl LoginSecondMessage { pub fn serialize(&self) -> Vec { let mut credential_response: Vec = Vec::new(); credential_response.extend_from_slice(&serialize(&self.beta.to_arr(), 2)); - credential_response.extend_from_slice(&serialize(&self.envelope.to_bytes(), 2)); + credential_response.extend_from_slice(&self.envelope.to_bytes()); let mut output: Vec = Vec::new(); output.push(ProtocolMessageType::from(self) as u8 + 1); @@ -414,12 +414,7 @@ impl LoginSecondMessage { } let (data, ke2m) = tokenize(input[1..].to_vec(), 3)?; - let (beta_bytes, remainder) = tokenize(data, 2)?; - let (envelope_bytes, remainder) = tokenize(remainder, 2)?; - - if !remainder.is_empty() { - return Err(PakeError::SerializationError.into()); - } + let (beta_bytes, envelope_bytes) = tokenize(data, 2)?; let concatenated = [&beta_bytes[..], &envelope_bytes[..], &ke2m[..]].concat(); Self::try_from(&concatenated[..]) diff --git a/src/serialization/tests.rs b/src/serialization/tests.rs index 8b73877..66e5aad 100644 --- a/src/serialization/tests.rs +++ b/src/serialization/tests.rs @@ -249,14 +249,13 @@ fn login_second_message_roundtrip() { let ke2m: Vec = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat(); - let total_length_without_ke2m: usize = pt_bytes.len() + envelope.to_bytes().len() + 4; + let total_length_without_ke2m: usize = pt_bytes.len() + envelope.to_bytes().len() + 2; let mut input = Vec::new(); input.extend_from_slice(&[ProtocolMessageType::CredentialResponse as u8 + 1]); input.extend_from_slice(&total_length_without_ke2m.to_be_bytes()[8 - 3..]); input.extend_from_slice(&pt_bytes.len().to_be_bytes()[8 - 2..]); input.extend_from_slice(pt_bytes.as_slice()); - input.extend_from_slice(&envelope.to_bytes().len().to_be_bytes()[8 - 2..]); input.extend_from_slice(&envelope.to_bytes()); input.extend_from_slice(&ke2m[..]); diff --git a/src/tests/opaque_ke_test.rs b/src/tests/opaque_ke_test.rs index 3d1cfeb..2c01aae 100644 --- a/src/tests/opaque_ke_test.rs +++ b/src/tests/opaque_ke_test.rs @@ -64,35 +64,35 @@ pub struct TestVectorParameters { static TEST_VECTOR: &str = r#" { - "client_s_pk": "db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74a", - "client_s_sk": "c0580c0dcfba5b38e3bf7dd110bd5025c319678b30c8baecaf9c2ef3c959f253", - "client_e_pk": "c3a4413191704cbe3ee1cc8293a565e260a3cbadfdb091bc00e953b33883c363", - "client_e_sk": "18be455fafb4cbe97a7531c2fc4ff2ce9b7bfc0119b0fcd7660443ddd0ec4068", - "server_s_pk": "2d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d", - "server_s_sk": "48bb316e50d6c93a6d4a95eba0652ab147eb422c7207bc780ebd47f952a8f164", - "server_e_pk": "6bcb8d80d0fcf242e4ed4d414375d66a696d1bfe220af29681c89835444b9d7b", - "server_e_sk": "b88df6767ae031eb77be76b66ad467bea6ff26a41db963ff3b4db81ed6c72452", + "client_s_pk": "6c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d", + "client_s_sk": "98f628dfaed00892809f1ff24f44eddb933ca593eeb88c532827249c3fdae56d", + "client_e_pk": "b20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903", + "client_e_sk": "88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a79", + "server_s_pk": "511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca1349", + "server_s_sk": "e00d089a96b19c74f77dcc6079277ba18b2dd1f603d0bc5c46664d4fe5c2867a", + "server_e_pk": "98e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd643674", + "server_e_sk": "080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b278", "password": "70617373776f7264", - "blinding_factor_raw": "7235ed80e9335579c8fbda9e61e8c92358b53267f33d14002cf1ee8e4a452190706c642cda5611d54aba2d8aebe91c20d230ce350d6bc76ccde2bbe3c3b38af3", - "blinding_factor": "ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a", + "blinding_factor_raw": "3def40a264b30c15dfcafc8d52cbe309d2d08e015d516b515f17cf98443bb39d6d164e9bd391303d890697b38dc59ee7e9ec196682528a078d51983ab18c227b", + "blinding_factor": "d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a", "pepper": "706570706572", - "oprf_key": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207", - "envelope_nonce": "ed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038", - "client_nonce": "774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a6", - "server_nonce": "a627d3525b162594be0c134ccf5fd4cab719e37ec945e70a128d66abb3bb58c4", - "r1": "010000240000002060ebaf93d439cd229e8fd843b9cd2656d40cba15981f04464c9842f98557f30b", - "r2": "020000280020ab7af6fd8628eded06289ccf85ad8e2f4bc8d584129b923cdc6a2865300a8f6a000001010103", - "r3": "030000aeed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f00020db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74a", - "l1": "040000240000002060ebaf93d439cd229e8fd843b9cd2656d40cba15981f04464c9842f98557f30b774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a6c3a4413191704cbe3ee1cc8293a565e260a3cbadfdb091bc00e953b33883c363", - "l2": "050000b00020ab7af6fd8628eded06289ccf85ad8e2f4bc8d584129b923cdc6a2865300a8f6a008ced0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f0b88df6767ae031eb77be76b66ad467bea6ff26a41db963ff3b4db81ed6c724526bcb8d80d0fcf242e4ed4d414375d66a696d1bfe220af29681c89835444b9d7b3a1f7e046c1460ed3a47fff7be87b5670d568a1bab2ae7f5b7ee70ff99c3d21d", - "l3": "28b18759b0f5977c607170b7ceb1b5d75bffbc185991ae001c0fded87f826d89", - "client_registration_state": "00000000ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a70617373776f7264", - "client_login_state": "00000000ccfacfd5e65693b9ea7b1bbe8c61d83e20bc67a54465d0659573f2801a474b0a18be455fafb4cbe97a7531c2fc4ff2ce9b7bfc0119b0fcd7660443ddd0ec4068774cd501736601475cea7a382cb1d38b34c574baab82c0e87cbe3dcf9de3d0a68d5a62ba390f1ee0419616e1a135e609ad248c7a3ee7edf4fb90f575148758d070617373776f7264", - "server_registration_state": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207", - "server_login_state": "14e5fe977591bb71f1e2bcd0542d26023c818048a257781fe276a3e8f9e0be4d58075843e2050013c815c6ef3d015a4ef1294543225832281adec71e1a92fa32a783f8c52f881f276f1c780f21b3fcb4eb36b75daea84b3bb9f7ce0699842864", - "password_file": "44f6b4ad762943517e400ce878e0c1409573ee98d96c14e5a507e601788c2207db67c19dde3ff9df4226c638056bf740811d6136b41d81a9995a29d8ae4da74aed0eb006204e163097595826da4f4e8df648fdcb54feef22cefbbdd1c9e85038002358a913a1bcdee339dde801af723f204f5cdc9335e0256eed49a4b36a226a1a062ddc9500230300202d3e373aaa1b3fb0df397789b671ca33f1b880bcc5ebc89b9e390b5ebb720e1d0020a2eb1b19e25b90e0089e543dd391ca362f05d01fa6d521d00c35312755c665f0", - "export_key": "48e39aeec42923ada9a239b231ff290efb1d4d01ccec8cd820a42dde10ff0d09", - "shared_secret": "a783f8c52f881f276f1c780f21b3fcb4eb36b75daea84b3bb9f7ce0699842864" + "oprf_key": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405", + "envelope_nonce": "3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da", + "client_nonce": "47b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f", + "server_nonce": "1bf2cc47738524a83c995122a44c7832be18b48b606897d71fc942e8ec6d9b2e", + "r1": "01000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb0", + "r2": "0200002800208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b57000001010103", + "r3": "030000ae3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba300206c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d", + "l1": "04000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb047b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79fb20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903", + "l2": "050000ae00208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b573048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b27898e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd64367476b2f0458ade73668e3aaab6e1cd7d48dacc702b9a49147d8431a18e649f814e", + "l3": "ed9d2f5af8d30d7927458a6d10f309ae6f49792d5e86d12f5e163a980f49c7ff", + "client_registration_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a70617373776f7264", + "client_login_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a7947b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f2e9c4b0c4bc9bdd4fca317dab50240fb32c31f9ec3742ec610a7e5016ad88de570617373776f7264", + "server_registration_state": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405", + "server_login_state": "54a3c257ad6e5406be86e9f983bcb25a50dcdaf8c8bd6928f17ea8b001db400c02b16899d3fe648ef86fb914dba9892d09df4a449f6f077e3ad903c01e309d6fd8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee", + "password_file": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d54056c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3", + "export_key": "90f9b6ec1edd53a60a9be4f744950befecf5bbfbd973702082fa031aa192bb5a", + "shared_secret": "d8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee" } "#; From 28645a7ceaa4d58c0a6aa2b2278e5eed8db684d0 Mon Sep 17 00:00:00 2001 From: Kevin Lewi Date: Wed, 28 Oct 2020 15:06:19 -0700 Subject: [PATCH 6/8] Add key schedule / info changes in TripleDH computation (#69) --- src/key_exchange/tripledh.rs | 158 +++++++++++++++++++++++++---------- src/tests/opaque_ke_test.rs | 54 ++++++------ 2 files changed, 139 insertions(+), 73 deletions(-) diff --git a/src/key_exchange/tripledh.rs b/src/key_exchange/tripledh.rs index dab106b..3ab08b5 100644 --- a/src/key_exchange/tripledh.rs +++ b/src/key_exchange/tripledh.rs @@ -9,6 +9,7 @@ use crate::{ hash::Hash, key_exchange::traits::{KeyExchange, ToBytes}, keypair::{KeyPair, SizedBytes}, + serialization::serialize, }; use digest::{Digest, FixedOutput}; use generic_array::{ @@ -27,6 +28,11 @@ pub(crate) type NonceLen = U32; const KE1_STATE_LEN: usize = KEY_LEN + KEY_LEN + NONCE_LEN; static STR_3DH: &[u8] = b"3DH keys"; +static STR_CLIENT_MAC: &[u8] = b"client mac"; +static STR_HANDSHAKE_SECRET: &[u8] = b"handshake secret"; +static STR_SERVER_MAC: &[u8] = b"server mac"; +static STR_SESSION_SECRET: &[u8] = b"session secret"; +static STR_OPAQUE: &[u8] = b"OPAQUE "; /// The Triple Diffie-Hellman key exchange implementation pub struct TripleDH; @@ -84,7 +90,7 @@ impl KeyExchange for TripleDH { server_nonce_bytes.into() }; - let (shared_secret, km2, km3) = derive_3dh_keys::( + let (session_secret, km2, km3) = derive_3dh_keys::( TripleDHComponents { pk1: ke1_message.client_e_pk.clone(), sk1: server_e_kp.private().clone(), @@ -122,7 +128,7 @@ impl KeyExchange for TripleDH { KE2State { km3, hashed_transcript, - shared_secret, + session_secret, }, KE2Message { server_nonce, @@ -139,7 +145,7 @@ impl KeyExchange for TripleDH { server_s_pk: KeyFormat::Repr, client_s_sk: KeyFormat::Repr, ) -> Result<(Vec, Self::KE3Message), ProtocolError> { - let (shared_secret, km2, km3) = derive_3dh_keys::( + let (session_secret, km2, km3) = derive_3dh_keys::( TripleDHComponents { pk1: ke2_message.server_e_pk.clone(), sk1: ke1_state.client_e_sk.clone(), @@ -181,7 +187,7 @@ impl KeyExchange for TripleDH { client_mac.update(&hashed_transcript); Ok(( - shared_secret.to_vec(), + session_secret.to_vec(), KE3Message { mac: client_mac.finalize().into_bytes(), }, @@ -202,7 +208,7 @@ impl KeyExchange for TripleDH { )); } - Ok(ke2_state.shared_secret.to_vec()) + Ok(ke2_state.session_secret.to_vec()) } fn ke1_state_size() -> usize { @@ -285,7 +291,7 @@ impl TryFrom<&[u8]> for KE1Message { pub struct KE2State> { km3: GenericArray, hashed_transcript: GenericArray, - shared_secret: GenericArray, + session_secret: GenericArray, } /// The second key exchange message @@ -300,7 +306,7 @@ impl> ToBytes for KE2State { let output: Vec = [ &self.km3[..], &self.hashed_transcript[..], - &self.shared_secret[..], + &self.session_secret[..], ] .concat(); output @@ -316,7 +322,7 @@ impl> TryFrom<&[u8]> for KE2State { Ok(Self { km3: GenericArray::clone_from_slice(&checked_bytes[..KEY_LEN]), hashed_transcript: GenericArray::clone_from_slice(&checked_bytes[KEY_LEN..2 * KEY_LEN]), - shared_secret: GenericArray::clone_from_slice(&checked_bytes[2 * KEY_LEN..]), + session_secret: GenericArray::clone_from_slice(&checked_bytes[2 * KEY_LEN..]), }) } } @@ -362,50 +368,13 @@ struct TripleDHComponents { sk3: KeyFormat::Repr, } -// Consists of a shared secret, followed by two mac keys +// Consists of a shared secret, followed by two mac keys: (session_secret, km2, km3) type TripleDHDerivationResult = ( GenericArray::OutputSize>, GenericArray::OutputSize>, GenericArray::OutputSize>, ); -// Internal function which takes the public and private components of the client and server keypairs, along -// with some auxiliary metadata, to produce the shared secret and two MAC keys -fn derive_3dh_keys( - dh: TripleDHComponents, - client_nonce: &GenericArray, - server_nonce: &GenericArray, - client_s_pk: KeyFormat::Repr, - server_s_pk: KeyFormat::Repr, -) -> Result, ProtocolError> { - let ikm: Vec = [ - &KeyFormat::diffie_hellman(dh.pk1, dh.sk1)[..], - &KeyFormat::diffie_hellman(dh.pk2, dh.sk2)[..], - &KeyFormat::diffie_hellman(dh.pk3, dh.sk3)[..], - ] - .concat(); - - let info: Vec = [ - STR_3DH, - &client_nonce, - &server_nonce, - &client_s_pk.to_arr(), - &server_s_pk.to_arr(), - ] - .concat(); - - const OUTPUT_SIZE: usize = 32; - let mut okm = [0u8; 3 * OUTPUT_SIZE]; - let h = Hkdf::::new(None, &ikm); - h.expand(&info, &mut okm) - .map_err(|_| InternalPakeError::HkdfError)?; - Ok(( - GenericArray::clone_from_slice(&okm[..OUTPUT_SIZE]), - GenericArray::clone_from_slice(&okm[OUTPUT_SIZE..2 * OUTPUT_SIZE]), - GenericArray::clone_from_slice(&okm[2 * OUTPUT_SIZE..]), - )) -} - /// The third key exchange message pub struct KE3Message> { mac: GenericArray, @@ -428,3 +397,100 @@ impl> TryFrom<&[u8]> for KE3Message { }) } } + +// Helper functions + +// Internal function which takes the public and private components of the client and server keypairs, along +// with some auxiliary metadata, to produce the shared secret and two MAC keys +fn derive_3dh_keys( + dh: TripleDHComponents, + client_nonce: &GenericArray, + server_nonce: &GenericArray, + client_s_pk: KeyFormat::Repr, + server_s_pk: KeyFormat::Repr, +) -> Result, ProtocolError> { + let ikm: Vec = [ + &KeyFormat::diffie_hellman(dh.pk1, dh.sk1)[..], + &KeyFormat::diffie_hellman(dh.pk2, dh.sk2)[..], + &KeyFormat::diffie_hellman(dh.pk3, dh.sk3)[..], + ] + .concat(); + + let info: Vec = [ + STR_3DH, + &serialize(&client_nonce, 2), + &serialize(&server_nonce, 2), + &serialize(&client_s_pk.to_arr(), 2), + &serialize(&server_s_pk.to_arr(), 2), + ] + .concat(); + + let extracted_ikm = Hkdf::::new(None, &ikm); + let handshake_secret = derive_secrets::(&extracted_ikm, &STR_HANDSHAKE_SECRET, &info)?; + let session_secret = derive_secrets::(&extracted_ikm, &STR_SESSION_SECRET, &info)?; + let km2 = hkdf_expand_label::( + &handshake_secret, + &STR_SERVER_MAC, + b"", + ::OutputSize::to_usize(), + )?; + let km3 = hkdf_expand_label::( + &handshake_secret, + &STR_CLIENT_MAC, + b"", + ::OutputSize::to_usize(), + )?; + + Ok(( + GenericArray::clone_from_slice(&session_secret), + GenericArray::clone_from_slice(&km2), + GenericArray::clone_from_slice(&km3), + )) +} + +fn hkdf_expand_label( + secret: &[u8], + label: &[u8], + context: &[u8], + length: usize, +) -> Result, ProtocolError> { + let h = Hkdf::::new(None, secret); + hkdf_expand_label_extracted(&h, label, context, length) +} + +fn hkdf_expand_label_extracted( + hkdf: &Hkdf, + label: &[u8], + context: &[u8], + length: usize, +) -> Result, ProtocolError> { + let mut okm = vec![0u8; length]; + + let mut hkdf_label: Vec = Vec::new(); + hkdf_label.extend_from_slice(&length.to_be_bytes()[6..]); + + let mut opaque_label: Vec = Vec::new(); + opaque_label.extend_from_slice(&STR_OPAQUE); + opaque_label.extend_from_slice(&label); + hkdf_label.extend_from_slice(&serialize(&opaque_label, 1)); + + hkdf_label.extend_from_slice(&serialize(&context, 1)); + + hkdf.expand(&hkdf_label, &mut okm) + .map_err(|_| InternalPakeError::HkdfError)?; + Ok(okm) +} + +fn derive_secrets( + hkdf: &Hkdf, + label: &[u8], + transcript: &[u8], +) -> Result, ProtocolError> { + let hashed_transcript = D::digest(transcript); + hkdf_expand_label_extracted::( + hkdf, + label, + &hashed_transcript, + ::OutputSize::to_usize(), + ) +} diff --git a/src/tests/opaque_ke_test.rs b/src/tests/opaque_ke_test.rs index 2c01aae..3275275 100644 --- a/src/tests/opaque_ke_test.rs +++ b/src/tests/opaque_ke_test.rs @@ -64,35 +64,35 @@ pub struct TestVectorParameters { static TEST_VECTOR: &str = r#" { - "client_s_pk": "6c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d", - "client_s_sk": "98f628dfaed00892809f1ff24f44eddb933ca593eeb88c532827249c3fdae56d", - "client_e_pk": "b20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903", - "client_e_sk": "88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a79", - "server_s_pk": "511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca1349", - "server_s_sk": "e00d089a96b19c74f77dcc6079277ba18b2dd1f603d0bc5c46664d4fe5c2867a", - "server_e_pk": "98e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd643674", - "server_e_sk": "080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b278", + "client_s_pk": "8ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b", + "client_s_sk": "e0937ce386f57ba61303f56851c6c1c338535ef30a046090c211fbae2b925575", + "client_e_pk": "b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46", + "client_e_sk": "481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450", + "server_s_pk": "da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d", + "server_s_sk": "50cc8c336756b9c91badaa42df728c0a06033eca4770a7912f9f2924742f4356", + "server_e_pk": "1848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349", + "server_e_sk": "b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f77973", "password": "70617373776f7264", - "blinding_factor_raw": "3def40a264b30c15dfcafc8d52cbe309d2d08e015d516b515f17cf98443bb39d6d164e9bd391303d890697b38dc59ee7e9ec196682528a078d51983ab18c227b", - "blinding_factor": "d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a", + "blinding_factor_raw": "6e5823f7d820cf6996a2cac80e239f58a9d7e8fcbf9588c07dde69dff3c330785bb85a9b1269f079bbcf4b1f428fbc3a977c324120867b9e918c97dad44576f2", + "blinding_factor": "033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07", "pepper": "706570706572", - "oprf_key": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405", - "envelope_nonce": "3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da", - "client_nonce": "47b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f", - "server_nonce": "1bf2cc47738524a83c995122a44c7832be18b48b606897d71fc942e8ec6d9b2e", - "r1": "01000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb0", - "r2": "0200002800208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b57000001010103", - "r3": "030000ae3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba300206c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d", - "l1": "04000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb047b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79fb20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903", - "l2": "050000ae00208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b573048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b27898e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd64367476b2f0458ade73668e3aaab6e1cd7d48dacc702b9a49147d8431a18e649f814e", - "l3": "ed9d2f5af8d30d7927458a6d10f309ae6f49792d5e86d12f5e163a980f49c7ff", - "client_registration_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a70617373776f7264", - "client_login_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a7947b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f2e9c4b0c4bc9bdd4fca317dab50240fb32c31f9ec3742ec610a7e5016ad88de570617373776f7264", - "server_registration_state": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405", - "server_login_state": "54a3c257ad6e5406be86e9f983bcb25a50dcdaf8c8bd6928f17ea8b001db400c02b16899d3fe648ef86fb914dba9892d09df4a449f6f077e3ad903c01e309d6fd8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee", - "password_file": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d54056c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3", - "export_key": "90f9b6ec1edd53a60a9be4f744950befecf5bbfbd973702082fa031aa192bb5a", - "shared_secret": "d8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee" + "oprf_key": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300", + "envelope_nonce": "b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f20", + "client_nonce": "e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900", + "server_nonce": "b32c16a32fe0cbb926a4926ff29bcfae2a96fe6e92b45f5ca27de3b6e413d413", + "r1": "01000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691e", + "r2": "020000280020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382000001010103", + "r3": "030000aeb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe44000208ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b", + "l1": "04000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691ee29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46", + "l2": "050000ae0020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f779731848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349732f8a81df2e21f59afd20155576e6191439e4fc4212b78a74a1198cfca92184", + "l3": "512fa64c0540a5fa5d8ee82910fc91bfff98d6272b9070e37e79832e55916ce5", + "client_registration_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a0770617373776f7264", + "client_login_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e190062259ed12ff91ba92d2cb43c7433e73e79c4d6d1536ae77cc9ca808bdffc190b70617373776f7264", + "server_registration_state": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300", + "server_login_state": "7a78a3ce25b39e78d65c9e648f13f6dbe08b3f91b0ef16565b780d42ca61c6d51a66199867f777c671a8e5fa6e8faf1e1047a26f64adea97b16b7a831204d4bdbc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589", + "password_file": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d363008ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063bb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440", + "export_key": "57da80dc58057781bf65a4f4b1ea0d77d7eb69fbb2786e26dfdfa0c440ea3611", + "shared_secret": "bc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589" } "#; From c8cbf56336078680b14d73c75622ff84fa6ee308 Mon Sep 17 00:00:00 2001 From: Kevin Lewi Date: Mon, 2 Nov 2020 13:51:43 -0800 Subject: [PATCH 7/8] Conform to voprf spec (#71) --- benches/oprf.rs | 58 +++++--------- src/lib.rs | 11 --- src/map_to_curve.rs | 13 ++-- src/opaque.rs | 150 ++++++++++++++++++++---------------- src/oprf.rs | 103 +++++++++++++------------ src/tests/opaque_ke_test.rs | 140 +++++++++++++++++---------------- 6 files changed, 238 insertions(+), 237 deletions(-) diff --git a/benches/oprf.rs b/benches/oprf.rs index ab8c776..899626e 100644 --- a/benches/oprf.rs +++ b/benches/oprf.rs @@ -11,7 +11,7 @@ use curve25519_dalek::{edwards::EdwardsPoint, ristretto::RistrettoPoint}; use generic_array::arr; use opaque_ke::{ group::Group, - oprf::{generate_oprf1_shim, generate_oprf2_shim, generate_oprf3_shim, OprfClientBytes}, + oprf::{blind_shim, evaluate_shim, unblind_and_finalize_shim}, }; use rand::{prelude::ThreadRng, thread_rng}; use sha2::Sha256; @@ -20,12 +20,9 @@ fn oprf1(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - c.bench_function("generate_oprf1 with Ristretto", move |b| { + c.bench_function("blind with Ristretto", move |b| { b.iter(|| { - let OprfClientBytes { - alpha: _alpha, - blinding_factor: _blinding_factor, - } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap(); + blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap(); }) }); } @@ -34,12 +31,9 @@ fn oprf1_edwards(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - c.bench_function("generate_oprf1 with Edwards", move |b| { + c.bench_function("blind with Edwards", move |b| { b.iter(|| { - let OprfClientBytes { - alpha: _alpha, - blinding_factor: _blinding_factor, - } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap(); + blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap(); }) }); } @@ -48,19 +42,16 @@ fn oprf2(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - let OprfClientBytes { - alpha, - blinding_factor: _blinding_factor, - } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap(); + let (_, alpha) = blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap(); let salt_bytes = arr![ u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, ]; let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap(); - c.bench_function("generate_oprf2 with Ristretto", move |b| { + c.bench_function("evaluate with Ristretto", move |b| { b.iter(|| { - let _beta = generate_oprf2_shim::(alpha, &salt).unwrap(); + let _beta = evaluate_shim::(alpha, &salt).unwrap(); }) }); } @@ -69,19 +60,16 @@ fn oprf2_edwards(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - let OprfClientBytes { - alpha, - blinding_factor: _blinding_factor, - } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap(); + let (_, alpha) = blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap(); let salt_bytes = arr![ u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, ]; let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap(); - c.bench_function("generate_oprf2 with Edwards", move |b| { + c.bench_function("evaluate with Edwards", move |b| { b.iter(|| { - let _beta = generate_oprf2_shim::(alpha, &salt).unwrap(); + let _beta = evaluate_shim::(alpha, &salt).unwrap(); }) }); } @@ -90,21 +78,17 @@ fn oprf3(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - let OprfClientBytes { - alpha, - blinding_factor, - } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap(); + let (token, alpha) = blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap(); let salt_bytes = arr![ u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, ]; let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap(); - let beta = generate_oprf2_shim::(alpha, &salt).unwrap(); + let beta = evaluate_shim::(alpha, &salt).unwrap(); - c.bench_function("generate_oprf3 with Ristretto", move |b| { + c.bench_function("unblind_and_finalize with Ristretto", move |b| { b.iter(|| { - let _res = generate_oprf3_shim::(input, beta, &blinding_factor) - .unwrap(); + let _res = unblind_and_finalize_shim::(&token, beta).unwrap(); }) }); } @@ -113,21 +97,17 @@ fn oprf3_edwards(c: &mut Criterion) { let mut csprng: ThreadRng = thread_rng(); let input = b"hunter2"; - let OprfClientBytes { - alpha, - blinding_factor, - } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap(); + let (token, alpha) = blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap(); let salt_bytes = arr![ u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, ]; let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap(); - let beta = generate_oprf2_shim::(alpha, &salt).unwrap(); + let beta = evaluate_shim::(alpha, &salt).unwrap(); - c.bench_function("generate_oprf3 with Edwards", move |b| { + c.bench_function("unblind_and_finalize with Edwards", move |b| { b.iter(|| { - let _res = - generate_oprf3_shim::(input, beta, &blinding_factor).unwrap(); + let _res = unblind_and_finalize_shim::(&token, beta).unwrap(); }) }); } diff --git a/src/lib.rs b/src/lib.rs index d8e2bb5..87cdba5 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -89,7 +89,6 @@ //! let mut client_rng = OsRng; //! let (r1, client_state) = ClientRegistration::::start( //! b"password", -//! Some(b"pepper"), //! &mut client_rng, //! )?; //! # Ok::<(), ProtocolError>(()) @@ -119,7 +118,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! use opaque_ke::opaque::ServerRegistration; @@ -153,7 +151,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # let mut server_rng = OsRng; @@ -188,7 +185,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # let mut server_rng = OsRng; @@ -232,7 +228,6 @@ //! let mut client_rng = OsRng; //! let (l1, client_state) = ClientLogin::::start( //! b"password", -//! Some(b"pepper"), //! &mut client_rng, //! )?; //! # Ok::<(), ProtocolError>(()) @@ -262,7 +257,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # let mut server_rng = OsRng; @@ -272,7 +266,6 @@ //! # let password_file_bytes = server_state.finish(r3)?.to_bytes(); //! # let (l1, client_state) = ClientLogin::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! use opaque_ke::opaque::ServerLogin; @@ -308,7 +301,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # let mut server_rng = OsRng; @@ -318,7 +310,6 @@ //! # let password_file_bytes = server_state.finish(r3)?.to_bytes(); //! # let (l1, client_state) = ClientLogin::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # use std::convert::TryFrom; @@ -365,7 +356,6 @@ //! # let mut client_rng = OsRng; //! # let (r1, client_state) = ClientRegistration::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # let mut server_rng = OsRng; @@ -375,7 +365,6 @@ //! # let password_file_bytes = server_state.finish(r3)?.to_bytes(); //! # let (l1, client_state) = ClientLogin::::start( //! # b"password", -//! # Some(b"pepper"), //! # &mut client_rng, //! # )?; //! # use std::convert::TryFrom; diff --git a/src/map_to_curve.rs b/src/map_to_curve.rs index a7667db..64ffabe 100644 --- a/src/map_to_curve.rs +++ b/src/map_to_curve.rs @@ -15,19 +15,22 @@ use sha2::{Sha256, Sha512}; /// A subtrait of Group specifying how to hash a password into a point pub trait GroupWithMapToCurve: Group { /// transforms a password and optional pepper into a curve point - fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self; + fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self; } +// TODO: incorporate expand_message_xmd from https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt +// instead of using HKDF-extract here + impl GroupWithMapToCurve for RistrettoPoint { - fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self { - let (hashed_input, _) = Hkdf::::extract(pepper, password); + fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self { + let (hashed_input, _) = Hkdf::::extract(dst, password); ::hash_to_curve(&hashed_input) } } impl GroupWithMapToCurve for EdwardsPoint { - fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self { - let (hashed_input, _) = Hkdf::::extract(pepper, password); + fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self { + let (hashed_input, _) = Hkdf::::extract(dst, password); ::hash_to_curve(&hashed_input) } } diff --git a/src/opaque.rs b/src/opaque.rs index 160cefd..d016d1f 100644 --- a/src/opaque.rs +++ b/src/opaque.rs @@ -17,7 +17,6 @@ use crate::{ key_exchange::traits::{KeyExchange, ToBytes}, keypair::{KeyPair, SizedBytes}, oprf, - oprf::OprfClientBytes, serialization::{ serialize, tokenize, u8_to_credential_type, CredentialType, ProtocolMessageType, }, @@ -492,10 +491,8 @@ pub struct ClientRegistration { id_u: Vec, /// Server identity id_s: Vec, - /// a blinding factor - pub(crate) blinding_factor: ::Scalar, - /// the client's password - password: Vec, + /// token containing the client's password and the blinding factor + pub(crate) token: oprf::Token, } impl TryFrom<&[u8]> for ClientRegistration { @@ -524,8 +521,10 @@ impl TryFrom<&[u8]> for ClientRegistration { Ok(Self { id_u, id_s, - blinding_factor, - password, + token: oprf::Token { + data: password, + blind: blinding_factor, + }, }) } } @@ -536,8 +535,8 @@ impl ClientRegistration { let output: Vec = [ &serialize(&self.id_u, 2), &serialize(&self.id_s, 2), - &CS::Group::scalar_as_bytes(&self.blinding_factor)[..], - &self.password, + &CS::Group::scalar_as_bytes(&self.token.blind)[..], + &self.token.data, ] .concat(); output @@ -566,19 +565,17 @@ impl ClientRegistration { /// type SlowHash = opaque_ke::slow_hash::NoOpHash; /// } /// let mut rng = OsRng; - /// let (register_m1, registration_state) = ClientRegistration::::start(b"hunter2", None, &mut rng)?; + /// let (register_m1, registration_state) = ClientRegistration::::start(b"hunter2", &mut rng)?; /// # Ok::<(), ProtocolError>(()) /// ``` pub fn start( password: &[u8], - pepper: Option<&[u8]>, blinding_factor_rng: &mut R, ) -> Result<(RegisterFirstMessage, Self), ProtocolError> { Self::start_with_user_and_server_name( &Vec::new(), &Vec::new(), password, - pepper, blinding_factor_rng, ) } @@ -588,13 +585,31 @@ impl ClientRegistration { user_name: &[u8], server_name: &[u8], password: &[u8], - pepper: Option<&[u8]>, blinding_factor_rng: &mut R, ) -> Result<(RegisterFirstMessage, Self), ProtocolError> { - let OprfClientBytes { - alpha, - blinding_factor, - } = oprf::generate_oprf1::(&password, pepper, blinding_factor_rng)?; + Self::start_with_user_and_server_name_and_postprocessing( + user_name, + server_name, + password, + blinding_factor_rng, + std::convert::identity, + ) + } + + /// Same as ClientRegistration::start, but also accepts a username and server name as input as well as + /// an optional postprocessing function for the blinding factor + pub fn start_with_user_and_server_name_and_postprocessing( + user_name: &[u8], + server_name: &[u8], + password: &[u8], + blinding_factor_rng: &mut R, + postprocess: fn(::Scalar) -> ::Scalar, + ) -> Result<(RegisterFirstMessage, Self), ProtocolError> { + let (token, alpha) = oprf::blind_with_postprocessing::( + &password, + blinding_factor_rng, + postprocess, + )?; Ok(( RegisterFirstMessage:: { @@ -604,8 +619,7 @@ impl ClientRegistration { Self { id_u: user_name.to_vec(), id_s: server_name.to_vec(), - blinding_factor, - password: password.to_vec(), + token, }, )) } @@ -642,7 +656,7 @@ impl ClientRegistration { /// let mut client_rng = OsRng; /// let mut server_rng = OsRng; /// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?; - /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// let (register_m2, server_state) = /// ServerRegistration::::start(register_m1, &mut server_rng)?; /// let mut client_rng = OsRng; @@ -668,11 +682,8 @@ impl ClientRegistration { ) -> Result, ProtocolError> { let client_static_keypair = CS::KeyFormat::generate_random(rng)?; - let password_derived_key = get_password_derived_key::( - self.password.clone(), - r2.beta, - &self.blinding_factor, - )?; + let password_derived_key = + get_password_derived_key::(&self.token, r2.beta)?; let mut credentials_map: HashMap> = HashMap::new(); credentials_map.insert( @@ -703,8 +714,8 @@ impl ClientRegistration { // This can't be derived because of the use of a phantom parameter impl Zeroize for ClientRegistration { fn zeroize(&mut self) { - self.password.zeroize(); - self.blinding_factor.zeroize(); + self.token.data.zeroize(); + self.token.blind.zeroize(); } } @@ -717,8 +728,8 @@ impl Drop for ClientRegistration { // This can't be derived because of the use of a phantom parameter impl Zeroize for ClientLogin { fn zeroize(&mut self) { - self.password.zeroize(); - self.blinding_factor.zeroize(); + self.token.data.zeroize(); + self.token.blind.zeroize(); } } @@ -825,7 +836,7 @@ where /// } /// let mut client_rng = OsRng; /// let mut server_rng = OsRng; - /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// let (register_m2, server_state) = /// ServerRegistration::::start(register_m1, &mut server_rng)?; /// # Ok::<(), ProtocolError>(()) @@ -862,7 +873,7 @@ where let oprf_key = CS::Group::random_scalar(rng); // Compute beta = alpha^oprf_key - let beta = oprf::generate_oprf2::(message.alpha, &oprf_key)?; + let beta = oprf::evaluate::(message.alpha, &oprf_key)?; Ok(( RegisterSecondMessage { @@ -902,7 +913,7 @@ where /// let mut client_rng = OsRng; /// let mut server_rng = OsRng; /// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?; - /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// let (register_m2, server_state) = /// ServerRegistration::::start(register_m1, &mut server_rng)?; /// let mut client_rng = OsRng; @@ -931,11 +942,8 @@ pub struct ClientLogin { id_u: Vec, /// Server identity id_s: Vec, - /// A blinding factor, which is used to mask (and unmask) secret - /// information before transmission - blinding_factor: ::Scalar, - /// The user's password - password: Vec, + /// token containing the client's password and the blinding factor + token: oprf::Token, ke1_state: >::KE1State, } @@ -970,8 +978,10 @@ impl TryFrom<&[u8]> for ClientLogin { Ok(Self { id_u, id_s, - blinding_factor, - password, + token: oprf::Token { + data: password, + blind: blinding_factor, + }, ke1_state, }) } @@ -983,9 +993,9 @@ impl ClientLogin { let output: Vec = [ &serialize(&self.id_u, 2), &serialize(&self.id_s, 2), - &CS::Group::scalar_as_bytes(&self.blinding_factor)[..], + &CS::Group::scalar_as_bytes(&self.token.blind)[..], &self.ke1_state.to_bytes(), - &self.password, + &self.token.data, ] .concat(); output @@ -1020,15 +1030,14 @@ impl ClientLogin { /// type SlowHash = opaque_ke::slow_hash::NoOpHash; /// } /// let mut client_rng = OsRng; - /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", None, &mut client_rng)?; + /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", &mut client_rng)?; /// # Ok::<(), ProtocolError>(()) /// ``` pub fn start( password: &[u8], - pepper: Option<&[u8]>, rng: &mut R, ) -> Result<(LoginFirstMessage, Self), ProtocolError> { - Self::start_with_user_and_server_name(&Vec::new(), &Vec::new(), password, pepper, rng) + Self::start_with_user_and_server_name(&Vec::new(), &Vec::new(), password, rng) } /// Same as start, but allows the user to supply a username and server name @@ -1036,13 +1045,27 @@ impl ClientLogin { user_name: &[u8], server_name: &[u8], password: &[u8], - pepper: Option<&[u8]>, rng: &mut R, ) -> Result<(LoginFirstMessage, Self), ProtocolError> { - let OprfClientBytes { - alpha, - blinding_factor, - } = oprf::generate_oprf1::(&password, pepper, rng)?; + Self::start_with_user_and_server_name_and_postprocessing( + user_name, + server_name, + password, + rng, + std::convert::identity, + ) + } + + /// Same as start, but allows the user to supply a username and server name and postprocessing function + pub fn start_with_user_and_server_name_and_postprocessing( + user_name: &[u8], + server_name: &[u8], + password: &[u8], + rng: &mut R, + postprocess: fn(::Scalar) -> ::Scalar, + ) -> Result<(LoginFirstMessage, Self), ProtocolError> { + let (token, alpha) = + oprf::blind_with_postprocessing::(&password, rng, postprocess)?; let (ke1_state, ke1_message) = CS::KeyExchange::generate_ke1(alpha.to_arr().to_vec(), rng)?; @@ -1057,8 +1080,7 @@ impl ClientLogin { Self { id_u: user_name.to_vec(), id_s: server_name.to_vec(), - blinding_factor, - password: password.to_vec(), + token, ke1_state, }, )) @@ -1089,12 +1111,12 @@ impl ClientLogin { /// } /// let mut client_rng = OsRng; /// # let mut server_rng = OsRng; - /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// # let server_kp = X25519KeyPair::generate_random(&mut server_rng)?; /// # let (register_m2, server_state) = ServerRegistration::::start(register_m1, &mut server_rng)?; /// # let (register_m3, _export_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?; /// # let p_file = server_state.finish(register_m3)?; - /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", None, &mut client_rng)?; + /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", &mut client_rng)?; /// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?; /// let (login_m3, client_transport, _export_key) = client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng)?; /// # Ok::<(), ProtocolError>(()) @@ -1107,11 +1129,8 @@ impl ClientLogin { ) -> Result, ProtocolError> { let l2_bytes: Vec = [&l2.beta.to_arr()[..], &l2.envelope.to_bytes()].concat(); - let password_derived_key = get_password_derived_key::( - self.password.clone(), - l2.beta, - &self.blinding_factor, - )?; + let password_derived_key = + get_password_derived_key::(&self.token, l2.beta)?; let opened_envelope = &l2 .envelope @@ -1194,12 +1213,12 @@ impl ServerLogin { /// let mut client_rng = OsRng; /// let mut server_rng = OsRng; /// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?; - /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// # let (register_m2, server_state) = /// ServerRegistration::::start(register_m1, &mut server_rng)?; /// # let (register_m3, _export_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?; /// # let p_file = server_state.finish(register_m3)?; - /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", None, &mut client_rng)?; + /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", &mut client_rng)?; /// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?; /// # Ok::<(), ProtocolError>(()) /// ``` @@ -1210,7 +1229,7 @@ impl ServerLogin { rng: &mut R, ) -> Result, ProtocolError> { let l1_bytes = &l1.to_bytes(); - let beta = oprf::generate_oprf2(l1.alpha, &password_file.oprf_key)?; + let beta = oprf::evaluate(l1.alpha, &password_file.oprf_key)?; let client_s_pk = password_file .client_s_pk @@ -1269,12 +1288,12 @@ impl ServerLogin { /// let mut client_rng = OsRng; /// let mut server_rng = OsRng; /// let server_kp = X25519KeyPair::generate_random(&mut server_rng)?; - /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", None, &mut client_rng)?; + /// # let (register_m1, client_state) = ClientRegistration::::start(b"hunter2", &mut client_rng)?; /// # let (register_m2, server_state) = /// ServerRegistration::::start(register_m1, &mut server_rng)?; /// # let (register_m3, _export_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?; /// # let p_file = server_state.finish(register_m3)?; - /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", None, &mut client_rng)?; + /// let (login_m1, client_login_state) = ClientLogin::::start(b"hunter2", &mut client_rng)?; /// let (login_m2, server_login_state) = ServerLogin::start(p_file, &server_kp.private(), login_m1, &mut server_rng)?; /// let (login_m3, client_transport, _export_key) = client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng)?; /// let mut server_transport = server_login_state.finish(login_m3)?; @@ -1296,10 +1315,9 @@ impl ServerLogin { // Helper functions fn get_password_derived_key, D: Hash>( - password: Vec, + token: &oprf::Token, beta: G, - blinding_factor: &G::Scalar, ) -> Result, InternalPakeError> { - let oprf_output = oprf::generate_oprf3::(&password, beta, blinding_factor)?; + let oprf_output = oprf::unblind_and_finalize::(token, beta)?; SH::hash(oprf_output) } diff --git a/src/oprf.rs b/src/oprf.rs index c00480c..d189307 100644 --- a/src/oprf.rs +++ b/src/oprf.rs @@ -11,47 +11,51 @@ use generic_array::GenericArray; use hkdf::Hkdf; use rand_core::{CryptoRng, RngCore}; -pub struct OprfClientBytes { - pub alpha: Grp, - pub blinding_factor: Grp::Scalar, +/// Used to store the OPRF input and blinding factor +pub struct Token { + pub(crate) data: Vec, + pub(crate) blind: Grp::Scalar, } +static STR_VOPRF: &[u8] = b"VOPRF05"; + /// Computes the first step for the multiplicative blinding version of DH-OPRF. This /// message is sent from the client (who holds the input) to the server (who holds the OPRF key). /// The client can also pass in an optional "pepper" string to be mixed in with the input through /// an HKDF computation. -pub(crate) fn generate_oprf1( +pub(crate) fn blind_with_postprocessing( input: &[u8], - pepper: Option<&[u8]>, blinding_factor_rng: &mut R, -) -> Result, InternalPakeError> { - let mapped_point = G::map_to_curve(input, pepper); + postprocess: fn(G::Scalar) -> G::Scalar, +) -> Result<(Token, G), InternalPakeError> { + let mapped_point = G::map_to_curve(input, Some(STR_VOPRF)); // TODO: add contextString from RFC let blinding_factor = G::random_scalar(blinding_factor_rng); - let alpha = mapped_point * &blinding_factor; - Ok(OprfClientBytes { - alpha, - blinding_factor, - }) + let blind = postprocess(blinding_factor); + let blind_token = mapped_point * &blind; + Ok(( + Token { + data: input.to_vec(), + blind, + }, + blind_token, + )) } /// Computes the second step for the multiplicative blinding version of DH-OPRF. This /// message is sent from the server (who holds the OPRF key) to the client. -pub(crate) fn generate_oprf2( - point: G, - oprf_key: &G::Scalar, -) -> Result { +pub(crate) fn evaluate(point: G, oprf_key: &G::Scalar) -> Result { Ok(point * oprf_key) } /// Computes the third step for the multiplicative blinding version of DH-OPRF, in which /// the client unblinds the server's message. -pub(crate) fn generate_oprf3( - input: &[u8], +pub(crate) fn unblind_and_finalize( + token: &Token, point: G, - blinding_factor: &G::Scalar, ) -> Result::OutputSize>, InternalPakeError> { - let unblinded = point * &G::scalar_invert(&blinding_factor); - let ikm: Vec = [&unblinded.to_arr()[..], input].concat(); + let unblinded = point * &G::scalar_invert(&token.blind); + let ikm: Vec = [&unblinded.to_arr()[..], &token.data].concat(); + // TODO: implement proper finalizing code here let (prk, _) = Hkdf::::extract(None, &ikm); Ok(prk) } @@ -59,31 +63,26 @@ pub(crate) fn generate_oprf3( // Benchmarking shims #[cfg(feature = "bench")] #[inline] -pub fn generate_oprf1_shim( +pub fn blind_shim( input: &[u8], - pepper: Option<&[u8]>, blinding_factor_rng: &mut R, -) -> Result, InternalPakeError> { - generate_oprf1(input, pepper, blinding_factor_rng) +) -> Result<(Token, G), InternalPakeError> { + blind_with_postprocessing(input, blinding_factor_rng, std::convert::identity) } #[cfg(feature = "bench")] #[inline] -pub fn generate_oprf2_shim( - point: G, - oprf_key: &G::Scalar, -) -> Result { - generate_oprf2(point, oprf_key) +pub fn evaluate_shim(point: G, oprf_key: &G::Scalar) -> Result { + evaluate(point, oprf_key) } #[cfg(feature = "bench")] #[inline] -pub fn generate_oprf3_shim( - input: &[u8], +pub fn unblind_and_finalize_shim( + token: &Token, point: G, - blinding_factor: &G::Scalar, ) -> Result::OutputSize>, InternalPakeError> { - generate_oprf3::(input, point, blinding_factor) + unblind_and_finalize::(token, point) } // Tests @@ -103,7 +102,7 @@ mod tests { input: &[u8], oprf_key: &[u8; 32], ) -> GenericArray::ElemLen> { - let (hashed_input, _) = Hkdf::::extract(None, &input); + let (hashed_input, _) = Hkdf::::extract(Some(STR_VOPRF), &input); let point = RistrettoPoint::hash_to_curve(GenericArray::from_slice(&hashed_input)); let scalar = RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&oprf_key[..])).unwrap(); @@ -118,18 +117,19 @@ mod tests { fn oprf_retrieval() -> Result<(), InternalPakeError> { let input = b"hunter2"; let mut rng = OsRng; - let OprfClientBytes { - alpha, - blinding_factor, - } = generate_oprf1::<_, RistrettoPoint>(&input[..], None, &mut rng)?; - let salt_bytes = arr![ + let (token, alpha) = blind_with_postprocessing::<_, RistrettoPoint>( + &input[..], + &mut rng, + std::convert::identity, + )?; + let oprf_key_bytes = arr![ u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, ]; - let salt = RistrettoPoint::from_scalar_slice(&salt_bytes)?; - let beta = generate_oprf2::(alpha, &salt)?; - let res = generate_oprf3::(input, beta, &blinding_factor)?; - let res2 = prf(&input[..], &salt.as_bytes()); + let oprf_key = RistrettoPoint::from_scalar_slice(&oprf_key_bytes)?; + let beta = evaluate::(alpha, &oprf_key)?; + let res = unblind_and_finalize::(&token, beta)?; + let res2 = prf(&input[..], &oprf_key.as_bytes()); assert_eq!(res, res2); Ok(()) } @@ -139,14 +139,15 @@ mod tests { let mut rng = OsRng; let mut input = vec![0u8; 64]; rng.fill_bytes(&mut input); - let OprfClientBytes { - alpha, - blinding_factor, - } = generate_oprf1::<_, RistrettoPoint>(&input, None, &mut rng).unwrap(); - let res = generate_oprf3::(&input, alpha, &blinding_factor) - .unwrap(); + let (token, alpha) = blind_with_postprocessing::<_, RistrettoPoint>( + &input, + &mut rng, + std::convert::identity, + ) + .unwrap(); + let res = unblind_and_finalize::(&token, alpha).unwrap(); - let (hashed_input, _) = Hkdf::::extract(None, &input); + let (hashed_input, _) = Hkdf::::extract(Some(STR_VOPRF), &input); let mut bits = [0u8; 64]; bits.copy_from_slice(&hashed_input); diff --git a/src/tests/opaque_ke_test.rs b/src/tests/opaque_ke_test.rs index 3275275..848afb0 100644 --- a/src/tests/opaque_ke_test.rs +++ b/src/tests/opaque_ke_test.rs @@ -14,6 +14,7 @@ use crate::{ tests::mock_rng::CycleRng, }; use curve25519_dalek::edwards::EdwardsPoint; +use generic_array::GenericArray; use rand_core::{OsRng, RngCore}; use serde_json::Value; use std::convert::TryFrom; @@ -39,10 +40,10 @@ pub struct TestVectorParameters { pub server_s_sk: Vec, pub server_e_pk: Vec, pub server_e_sk: Vec, + pub id_u: Vec, + pub id_s: Vec, pub password: Vec, - pub blinding_factor_raw: Vec, pub blinding_factor: Vec, - pub pepper: Vec, pub oprf_key: Vec, pub envelope_nonce: Vec, pub client_nonce: Vec, @@ -64,35 +65,35 @@ pub struct TestVectorParameters { static TEST_VECTOR: &str = r#" { - "client_s_pk": "8ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b", - "client_s_sk": "e0937ce386f57ba61303f56851c6c1c338535ef30a046090c211fbae2b925575", - "client_e_pk": "b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46", - "client_e_sk": "481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450", - "server_s_pk": "da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d", - "server_s_sk": "50cc8c336756b9c91badaa42df728c0a06033eca4770a7912f9f2924742f4356", - "server_e_pk": "1848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349", - "server_e_sk": "b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f77973", + "client_s_pk": "7489b55c78b380db87d664178e5a020eb2f9bbeac0a44f6fb034ccba8de4a934", + "client_s_sk": "f0499a6c8bac723debd497b672c2d89ed2d96fd190fce247e0dd3019dce8ec59", + "client_e_pk": "c87afc8a9dc82c93dc6fa9d27654c6b909de929e542e94a87ffb7b3256190a46", + "client_e_sk": "107078f8e2ddd88c3d37e611ae932d798403e475f52a6695639999f963063576", + "server_s_pk": "764f186883a88353586c2427bfbe0ff3e5a0f56af414b0c42a5a300fc426ba4d", + "server_s_sk": "c089cb11e78ea8923cc25857ba51fd5da820079a9a2b377bc87dcd496b563e5c", + "server_e_pk": "05d99649994c006a508b996d11a94f52ae68cca44087bdd69602dfceb92d950c", + "server_e_sk": "70c4df069c1a7b70c16cf6409157674c3f8adfd0919f9dd67a254cf167c7e87f", + "id_u": "696455", + "id_s": "696453", "password": "70617373776f7264", - "blinding_factor_raw": "6e5823f7d820cf6996a2cac80e239f58a9d7e8fcbf9588c07dde69dff3c330785bb85a9b1269f079bbcf4b1f428fbc3a977c324120867b9e918c97dad44576f2", - "blinding_factor": "033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07", - "pepper": "706570706572", - "oprf_key": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300", - "envelope_nonce": "b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f20", - "client_nonce": "e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900", - "server_nonce": "b32c16a32fe0cbb926a4926ff29bcfae2a96fe6e92b45f5ca27de3b6e413d413", - "r1": "01000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691e", - "r2": "020000280020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382000001010103", - "r3": "030000aeb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe44000208ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b", - "l1": "04000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691ee29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46", - "l2": "050000ae0020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f779731848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349732f8a81df2e21f59afd20155576e6191439e4fc4212b78a74a1198cfca92184", - "l3": "512fa64c0540a5fa5d8ee82910fc91bfff98d6272b9070e37e79832e55916ce5", - "client_registration_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a0770617373776f7264", - "client_login_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e190062259ed12ff91ba92d2cb43c7433e73e79c4d6d1536ae77cc9ca808bdffc190b70617373776f7264", - "server_registration_state": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300", - "server_login_state": "7a78a3ce25b39e78d65c9e648f13f6dbe08b3f91b0ef16565b780d42ca61c6d51a66199867f777c671a8e5fa6e8faf1e1047a26f64adea97b16b7a831204d4bdbc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589", - "password_file": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d363008ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063bb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440", - "export_key": "57da80dc58057781bf65a4f4b1ea0d77d7eb69fbb2786e26dfdfa0c440ea3611", - "shared_secret": "bc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589" + "blinding_factor": "c5629094a160136e99012cf9c8eb19d9d62f87cadf846636bd175064a78b2d00", + "oprf_key": "f431dcb851f3c8202b9dd1a06d8d32434bbab88de4fdd079452faf2359a8d408", + "envelope_nonce": "be38985f7e04dab53e0bddf32cc9eeb64d7f072e089650b681ba4bb04bcfaeb2", + "client_nonce": "0c51879d4ae4cbd047fbf1ba9c7512c25c8d809486f5e6018dff8c525d9f41f1", + "server_nonce": "c896afa11787f8374bbeb3876151bcf4b75c9511a70be3dddce7606a353f3bc3", + "r1": "01000027000369645500201d540787a850896d3c7407e5a2c17729772170dae61640872aeca109d64d4581", + "r2": "02000028002033f9c4bdfe3d2597cbf0c86db2b0b3e81a4400ad4c9618372f6e24d89229d9a4000001010103", + "r3": "030000aebe38985f7e04dab53e0bddf32cc9eeb64d7f072e089650b681ba4bb04bcfaeb20023441a15c5ccbbf863e0db5e03c6edc63696b05d83a66e4aa3e10aa1320936fe8357bc250023030020764f186883a88353586c2427bfbe0ff3e5a0f56af414b0c42a5a300fc426ba4d00208229fa7e73d11f6935de9d5aae17ab5ec77d6cff8d8456437a8098bb54aa9b9300207489b55c78b380db87d664178e5a020eb2f9bbeac0a44f6fb034ccba8de4a934", + "l1": "04000027000369645500201d540787a850896d3c7407e5a2c17729772170dae61640872aeca109d64d45810c51879d4ae4cbd047fbf1ba9c7512c25c8d809486f5e6018dff8c525d9f41f1c87afc8a9dc82c93dc6fa9d27654c6b909de929e542e94a87ffb7b3256190a46", + "l2": "050000ae002033f9c4bdfe3d2597cbf0c86db2b0b3e81a4400ad4c9618372f6e24d89229d9a4be38985f7e04dab53e0bddf32cc9eeb64d7f072e089650b681ba4bb04bcfaeb20023441a15c5ccbbf863e0db5e03c6edc63696b05d83a66e4aa3e10aa1320936fe8357bc250023030020764f186883a88353586c2427bfbe0ff3e5a0f56af414b0c42a5a300fc426ba4d00208229fa7e73d11f6935de9d5aae17ab5ec77d6cff8d8456437a8098bb54aa9b9370c4df069c1a7b70c16cf6409157674c3f8adfd0919f9dd67a254cf167c7e87f05d99649994c006a508b996d11a94f52ae68cca44087bdd69602dfceb92d950cbd9f8a529e49110d4bfe863d449663b0cda71ba29e0aa46f63bbc7b6b054ad8c", + "l3": "6ba92c16abdd010bc8e9a5175d639512f8b270767d4b7198d03a985935e7da6d", + "client_registration_state": "00036964550003696453c5629094a160136e99012cf9c8eb19d9d62f87cadf846636bd175064a78b2d0070617373776f7264", + "client_login_state": "00036964550003696453c5629094a160136e99012cf9c8eb19d9d62f87cadf846636bd175064a78b2d00107078f8e2ddd88c3d37e611ae932d798403e475f52a6695639999f9630635760c51879d4ae4cbd047fbf1ba9c7512c25c8d809486f5e6018dff8c525d9f41f123c1c83fbf2a84c442b079fcacff55b13a4aebf9ba326e992c83b550afbb0c8770617373776f7264", + "server_registration_state": "f431dcb851f3c8202b9dd1a06d8d32434bbab88de4fdd079452faf2359a8d408", + "server_login_state": "72486032f6ff6f079144a891fdcb5ca63ede147f327313437c6bf2fd79d08b1faf03840b6c031f7afb66e2740ae064fc140c9aec2ac42295a6d1201d6ad5cdc641d81a7e3805c996ff9fb15fbcd4eddb528a3622f0f4488bca04bace6d740ee3", + "password_file": "f431dcb851f3c8202b9dd1a06d8d32434bbab88de4fdd079452faf2359a8d4087489b55c78b380db87d664178e5a020eb2f9bbeac0a44f6fb034ccba8de4a934be38985f7e04dab53e0bddf32cc9eeb64d7f072e089650b681ba4bb04bcfaeb20023441a15c5ccbbf863e0db5e03c6edc63696b05d83a66e4aa3e10aa1320936fe8357bc250023030020764f186883a88353586c2427bfbe0ff3e5a0f56af414b0c42a5a300fc426ba4d00208229fa7e73d11f6935de9d5aae17ab5ec77d6cff8d8456437a8098bb54aa9b93", + "export_key": "c2bc61bafeb9ab541fa362dc154c7a07dab8479e486da2daf9408438d9dc562f", + "shared_secret": "41d81a7e3805c996ff9fb15fbcd4eddb528a3622f0f4488bca04bace6d740ee3" } "#; @@ -112,10 +113,10 @@ fn populate_test_vectors(values: &Value) -> TestVectorParameters { server_s_sk: decode(&values, "server_s_sk").unwrap(), server_e_pk: decode(&values, "server_e_pk").unwrap(), server_e_sk: decode(&values, "server_e_sk").unwrap(), + id_u: decode(&values, "id_u").unwrap(), + id_s: decode(&values, "id_s").unwrap(), password: decode(&values, "password").unwrap(), - blinding_factor_raw: decode(&values, "blinding_factor_raw").unwrap(), blinding_factor: decode(&values, "blinding_factor").unwrap(), - pepper: decode(&values, "pepper").unwrap(), oprf_key: decode(&values, "oprf_key").unwrap(), envelope_nonce: decode(&values, "envelope_nonce").unwrap(), client_nonce: decode(&values, "client_nonce").unwrap(), @@ -147,14 +148,9 @@ fn stringify_test_vectors(p: &TestVectorParameters) -> String { s.push_str(format!("\"server_s_sk\": \"{}\",\n", hex::encode(&p.server_s_sk)).as_str()); s.push_str(format!("\"server_e_pk\": \"{}\",\n", hex::encode(&p.server_e_pk)).as_str()); s.push_str(format!("\"server_e_sk\": \"{}\",\n", hex::encode(&p.server_e_sk)).as_str()); + s.push_str(format!("\"id_u\": \"{}\",\n", hex::encode(&p.id_u)).as_str()); + s.push_str(format!("\"id_s\": \"{}\",\n", hex::encode(&p.id_s)).as_str()); s.push_str(format!("\"password\": \"{}\",\n", hex::encode(&p.password)).as_str()); - s.push_str( - format!( - "\"blinding_factor_raw\": \"{}\",\n", - hex::encode(&p.blinding_factor_raw) - ) - .as_str(), - ); s.push_str( format!( "\"blinding_factor\": \"{}\",\n", @@ -162,7 +158,6 @@ fn stringify_test_vectors(p: &TestVectorParameters) -> String { ) .as_str(), ); - s.push_str(format!("\"pepper\": \"{}\",\n", hex::encode(&p.pepper)).as_str()); s.push_str(format!("\"oprf_key\": \"{}\",\n", hex::encode(&p.oprf_key)).as_str()); s.push_str( format!( @@ -239,8 +234,9 @@ where let server_e_kp = CS::generate_random_keypair(&mut rng).unwrap(); let client_s_kp = CS::generate_random_keypair(&mut rng).unwrap(); let client_e_kp = CS::generate_random_keypair(&mut rng).unwrap(); + let id_u = b"idU"; + let id_s = b"idS"; let password = b"password"; - let pepper = b"pepper"; let mut blinding_factor_raw = [0u8; 64]; rng.fill_bytes(&mut blinding_factor_raw); let mut oprf_key_raw = [0u8; 32]; @@ -253,15 +249,16 @@ where rng.fill_bytes(&mut server_nonce); let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_raw.to_vec()); - let (r1, client_registration) = ClientRegistration::::start( + let (r1, client_registration) = ClientRegistration::::start_with_user_and_server_name( + id_u, + id_s, password, - Some(pepper), &mut blinding_factor_registration_rng, ) .unwrap(); let r1_bytes = r1.serialize().to_vec(); let blinding_factor_bytes = - CS::Group::scalar_as_bytes(&client_registration.blinding_factor).clone(); + CS::Group::scalar_as_bytes(&client_registration.token.blind).clone(); let client_registration_state = client_registration.to_bytes().to_vec(); let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec()); @@ -289,8 +286,13 @@ where client_login_start.extend_from_slice(&client_nonce); let mut client_login_start_rng = CycleRng::new(client_login_start); - let (l1, client_login) = - ClientLogin::::start(password, Some(pepper), &mut client_login_start_rng).unwrap(); + let (l1, client_login) = ClientLogin::::start_with_user_and_server_name( + id_u, + id_s, + password, + &mut client_login_start_rng, + ) + .unwrap(); let l1_bytes = l1.serialize().to_vec(); let client_login_state = client_login.to_bytes().to_vec(); @@ -320,10 +322,10 @@ where server_s_sk: server_s_kp.private().to_arr().to_vec(), server_e_pk: server_e_kp.public().to_arr().to_vec(), server_e_sk: server_e_kp.private().to_arr().to_vec(), + id_u: id_u.to_vec(), + id_s: id_s.to_vec(), password: password.to_vec(), - blinding_factor_raw: blinding_factor_raw.to_vec(), blinding_factor: blinding_factor_bytes.to_vec(), - pepper: pepper.to_vec(), oprf_key: oprf_key_bytes.to_vec(), envelope_nonce: envelope_nonce.to_vec(), client_nonce: client_nonce.to_vec(), @@ -350,14 +352,22 @@ fn generate_test_vectors() { println!("{}", stringify_test_vectors(¶meters)); } +// For fixing the blinding factor +fn postprocess_blinding_factor(_: G::Scalar) -> G::Scalar { + let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap()); + G::from_scalar_slice(GenericArray::from_slice(¶meters.blinding_factor[..])).unwrap() +} + #[test] fn test_r1() -> Result<(), PakeError> { let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap()); - let mut blinding_factor_rng = CycleRng::new(parameters.blinding_factor_raw); - let (r1, client_registration) = ClientRegistration::::start( + let mut rng = OsRng; + let (r1, client_registration) = ClientRegistration::::start_with_user_and_server_name_and_postprocessing( + ¶meters.id_u, + ¶meters.id_s, ¶meters.password, - Some(¶meters.pepper), - &mut blinding_factor_rng, + &mut rng, + postprocess_blinding_factor::<::Group>, ) .unwrap(); assert_eq!(hex::encode(¶meters.r1), hex::encode(r1.serialize())); @@ -436,18 +446,21 @@ fn test_l1() -> Result<(), PakeError> { let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap()); let client_login_start = [ - parameters.blinding_factor_raw, + vec![0u8; 64], // FIXME: don't hardcode this parameters.client_e_sk, parameters.client_nonce, ] .concat(); let mut client_login_start_rng = CycleRng::new(client_login_start); - let (l1, client_login) = ClientLogin::::start( - ¶meters.password, - Some(¶meters.pepper), - &mut client_login_start_rng, - ) - .unwrap(); + let (l1, client_login) = + ClientLogin::::start_with_user_and_server_name_and_postprocessing( + ¶meters.id_u, + ¶meters.id_s, + ¶meters.password, + &mut client_login_start_rng, + postprocess_blinding_factor::<::Group>, + ) + .unwrap(); assert_eq!(hex::encode(¶meters.l1), hex::encode(l1.serialize())); assert_eq!( hex::encode(¶meters.client_login_state), @@ -530,18 +543,15 @@ fn test_complete_flow( let mut client_rng = OsRng; let mut server_rng = OsRng; let server_kp = X255193dhNoSlowHash::generate_random_keypair(&mut server_rng)?; - let (register_m1, client_state) = ClientRegistration::::start( - registration_password, - None, - &mut client_rng, - )?; + let (register_m1, client_state) = + ClientRegistration::::start(registration_password, &mut client_rng)?; let (register_m2, server_state) = ServerRegistration::::start(register_m1, &mut server_rng)?; let (register_m3, registration_export_key) = client_state.finish(register_m2, server_kp.public(), &mut client_rng)?; let p_file = server_state.finish(register_m3)?; let (login_m1, client_login_state) = - ClientLogin::::start(login_password, None, &mut client_rng)?; + ClientLogin::::start(login_password, &mut client_rng)?; let (login_m2, server_login_state) = ServerLogin::::start( p_file, &server_kp.private(), From 6deddbe33c642f295ed4a159897e3692c3cc8519 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Garillot?= Date: Tue, 3 Nov 2020 01:35:49 +0000 Subject: [PATCH 8/8] adjust to_bytes -> serialize & example --- examples/simple_login.rs | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/examples/simple_login.rs b/examples/simple_login.rs index 9dd7b84..50f0f0c 100644 --- a/examples/simple_login.rs +++ b/examples/simple_login.rs @@ -56,9 +56,8 @@ fn account_registration( ) -> Vec { let mut client_rng = OsRng; let (r1, client_state) = - ClientRegistration::::start(password.as_bytes(), Some(b"pepper"), &mut client_rng) - .unwrap(); - let r1_bytes = r1.to_bytes(); + ClientRegistration::::start(password.as_bytes(), &mut client_rng).unwrap(); + let r1_bytes = r1.serialize(); // Client sends r1_bytes to server @@ -68,7 +67,7 @@ fn account_registration( &mut server_rng, ) .unwrap(); - let r2_bytes = r2.to_bytes(); + let r2_bytes = r2.serialize(); // Server sends r2_bytes to client @@ -79,7 +78,7 @@ fn account_registration( &mut client_rng, ) .unwrap(); - let r3_bytes = r3.to_bytes(); + let r3_bytes = r3.serialize(); // Client sends r3_bytes to server @@ -97,9 +96,8 @@ fn account_login( ) -> bool { let mut client_rng = OsRng; let (l1, client_state) = - ClientLogin::::start(password.as_bytes(), Some(b"pepper"), &mut client_rng) - .unwrap(); - let l1_bytes = l1.to_bytes(); + ClientLogin::::start(password.as_bytes(), &mut client_rng).unwrap(); + let l1_bytes = l1.serialize(); // Client sends l1_bytes to server @@ -112,7 +110,7 @@ fn account_login( &mut server_rng, ) .unwrap(); - let l2_bytes = l2.to_bytes(); + let l2_bytes = l2.serialize(); // Server sends l2_bytes to client @@ -127,7 +125,7 @@ fn account_login( return false; } let (l3, client_shared_secret, _) = result.unwrap(); - let l3_bytes = l3.to_bytes(); + let l3_bytes = l3.serialize(); // Client sends l3_bytes to server