SIGMA-I Key Exchange (#378)

* Move `KeGroup` to `KeyExchange::Group`

- Introduce `KeyExchange::Hash`, which separates the OPRF hash from the one used in `KeyExchange`.
- Remove `De/Serialize` requirement on key exchange messages and states, which forced a lot of where bounds on downstream users.
- Rename `KeGroup` to `Group`.
- Replace `D` generic for hash with `H`.

* Use `voprf::derive_key()` directly

* Implement SIGMA-I key exchange

* Improve `KeyExchange` for SIGMA-I and Ed25519

* Implement EdDSA

* Un-qualify some method calls

* SIGMA-I: only include client identity in client mac

* SIGMA-I: include server mac in client signature

* Expose key exchange types in `crate` & move modules

* Implement Ed25519ph

* Document `ed25519` crate feature

* Remove `ristretto255-voprf` crate feature

* Adjust CI crate feature testing

* Fix Rustdoc

* Remove unnecessary generic parameters from SIGMA-I

* Properly mark to-do's with TODO

* Assorted fixes

* SIGMA-I: include context in signature

* SIGMA-I: include identifiers in signature

* Merge `ServerLoginStart/FinishParameters`

* Re-export more necessary types

* More carefully expose types

* Add ECDSA test

* SIGMA-I: share context hashing

* De-duplicate client static public key storage

* Hide `KeyExchange` better

* Use the correct hash in the root documentation

* Bump `derive-where`

* Format documentation examples a bit further

* Add remote OPRF seed documentation

* Rename `deserialize_key_pair` to `deserialize_take_key_pair`

* Add more key tests

* Remove `SharedSecret` trait

* SIGMA-I refactor message API

* Share more implementation between 3DH and SIGMA-I

* Remove unnecessary zero scalar check for Curve25519

* Use correct hash in test

* Add some more TODOs

* Exclude `tests` folder from Cargo publishing

* Enable missing dependencies

* Use right crate for testing Ed25519

* Remove unnecessary `Sized` constraints

* Remove unnecessary `ecdsa` crate features

* Move signature de/serialization to trait methods

* Nit: move import to appropriate location

* Add warning to SIGMA-I

examples/digital_locker.rs

@@ -38,7 +38,7 @@ use opaque_ke::{
     ClientLogin, ClientLoginFinishParameters, ClientRegistration,
     ClientRegistrationFinishParameters, CredentialFinalization, CredentialRequest,
     CredentialResponse, RegistrationRequest, RegistrationResponse, RegistrationUpload, ServerLogin,
-    ServerLoginStartParameters, ServerRegistration, ServerRegistrationLen, ServerSetup,
+    ServerLoginParameters, ServerRegistration, ServerRegistrationLen, ServerSetup,
 };
 use rustyline::error::ReadlineError;
 use rustyline::history::DefaultHistory;
@@ -52,16 +52,14 @@ struct DefaultCipherSuite;
 #[cfg(feature = "ristretto255")]
 impl CipherSuite for DefaultCipherSuite {
     type OprfCs = opaque_ke::Ristretto255;
-    type KeGroup = opaque_ke::Ristretto255;
-    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDh;
+    type KeyExchange = opaque_ke::TripleDh<opaque_ke::Ristretto255, sha2::Sha512>;
     type Ksf = opaque_ke::ksf::Identity;
 }
 
 #[cfg(not(feature = "ristretto255"))]
 impl CipherSuite for DefaultCipherSuite {
     type OprfCs = p256::NistP256;
-    type KeGroup = p256::NistP256;
-    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDh;
+    type KeyExchange = opaque_ke::TripleDh<p256::NistP256, sha2::Sha256>;
     type Ksf = opaque_ke::ksf::Identity;
 }
 
@@ -172,7 +170,7 @@ fn open_locker(
         Some(password_file),
         CredentialRequest::deserialize(&credential_request_bytes).unwrap(),
         &locker_id.to_be_bytes(),
-        ServerLoginStartParameters::default(),
+        ServerLoginParameters::default(),
     )
     .unwrap();
     let credential_response_bytes = server_login_start_result.message.serialize();
@@ -180,6 +178,7 @@ fn open_locker(
     // Server sends credential_response_bytes to client
 
     let result = client_login_start_result.state.finish(
+        &mut client_rng,
         password.as_bytes(),
         CredentialResponse::deserialize(&credential_response_bytes).unwrap(),
         ClientLoginFinishParameters::default(),
@@ -196,7 +195,10 @@ fn open_locker(
 
     let server_login_finish_result = server_login_start_result
         .state
-        .finish(CredentialFinalization::deserialize(&credential_finalization_bytes).unwrap())
+        .finish(
+            CredentialFinalization::deserialize(&credential_finalization_bytes).unwrap(),
+            ServerLoginParameters::default(),
+        )
         .unwrap();
 
     // Server sends locker contents, encrypted under the session key, to the client

examples/simple_login.rs

@@ -33,7 +33,7 @@ use opaque_ke::{
     ClientLogin, ClientLoginFinishParameters, ClientRegistration,
     ClientRegistrationFinishParameters, CredentialFinalization, CredentialRequest,
     CredentialResponse, RegistrationRequest, RegistrationResponse, RegistrationUpload, ServerLogin,
-    ServerLoginStartParameters, ServerRegistration, ServerRegistrationLen, ServerSetup,
+    ServerLoginParameters, ServerRegistration, ServerRegistrationLen, ServerSetup,
 };
 use rustyline::error::ReadlineError;
 use rustyline::history::DefaultHistory;
@@ -47,8 +47,7 @@ struct DefaultCipherSuite;
 #[cfg(feature = "ristretto255")]
 impl CipherSuite for DefaultCipherSuite {
     type OprfCs = opaque_ke::Ristretto255;
-    type KeGroup = opaque_ke::Ristretto255;
-    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDh;
+    type KeyExchange = opaque_ke::TripleDh<opaque_ke::Ristretto255, sha2::Sha512>;
 
     type Ksf = Argon2<'static>;
 }
@@ -56,8 +55,7 @@ impl CipherSuite for DefaultCipherSuite {
 #[cfg(not(feature = "ristretto255"))]
 impl CipherSuite for DefaultCipherSuite {
     type OprfCs = p256::NistP256;
-    type KeGroup = p256::NistP256;
-    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDh;
+    type KeyExchange = opaque_ke::TripleDh<p256::NistP256, sha2::Sha256>;
 
     type Ksf = Argon2<'static>;
 }
@@ -128,7 +126,7 @@ fn account_login(
         Some(password_file),
         CredentialRequest::deserialize(&credential_request_bytes).unwrap(),
         username.as_bytes(),
-        ServerLoginStartParameters::default(),
+        ServerLoginParameters::default(),
     )
     .unwrap();
     let credential_response_bytes = server_login_start_result.message.serialize();
@@ -136,6 +134,7 @@ fn account_login(
     // Server sends credential_response_bytes to client
 
     let result = client_login_start_result.state.finish(
+        &mut client_rng,
         password.as_bytes(),
         CredentialResponse::deserialize(&credential_response_bytes).unwrap(),
         ClientLoginFinishParameters::default(),
@@ -152,7 +151,10 @@ fn account_login(
 
     let server_login_finish_result = server_login_start_result
         .state
-        .finish(CredentialFinalization::deserialize(&credential_finalization_bytes).unwrap())
+        .finish(
+            CredentialFinalization::deserialize(&credential_finalization_bytes).unwrap(),
+            ServerLoginParameters::default(),
+        )
         .unwrap();
 
     client_login_finish_result.session_key == server_login_finish_result.session_key