vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

SIGMA-I Key Exchange (#378)

Browse Source 
* Move `KeGroup` to `KeyExchange::Group`

- Introduce `KeyExchange::Hash`, which separates the OPRF hash from the one used in `KeyExchange`.
- Remove `De/Serialize` requirement on key exchange messages and states, which forced a lot of where bounds on downstream users.
- Rename `KeGroup` to `Group`.
- Replace `D` generic for hash with `H`.

* Use `voprf::derive_key()` directly

* Implement SIGMA-I key exchange

* Improve `KeyExchange` for SIGMA-I and Ed25519

* Implement EdDSA

* Un-qualify some method calls

* SIGMA-I: only include client identity in client mac

* SIGMA-I: include server mac in client signature

* Expose key exchange types in `crate` & move modules

* Implement Ed25519ph

* Document `ed25519` crate feature

* Remove `ristretto255-voprf` crate feature

* Adjust CI crate feature testing

* Fix Rustdoc

* Remove unnecessary generic parameters from SIGMA-I

* Properly mark to-do's with TODO

* Assorted fixes

* SIGMA-I: include context in signature

* SIGMA-I: include identifiers in signature

* Merge `ServerLoginStart/FinishParameters`

* Re-export more necessary types

* More carefully expose types

* Add ECDSA test

* SIGMA-I: share context hashing

* De-duplicate client static public key storage

* Hide `KeyExchange` better

* Use the correct hash in the root documentation

* Bump `derive-where`

* Format documentation examples a bit further

* Add remote OPRF seed documentation

* Rename `deserialize_key_pair` to `deserialize_take_key_pair`

* Add more key tests

* Remove `SharedSecret` trait

* SIGMA-I refactor message API

* Share more implementation between 3DH and SIGMA-I

* Remove unnecessary zero scalar check for Curve25519

* Use correct hash in test

* Add some more TODOs

* Exclude `tests` folder from Cargo publishing

* Enable missing dependencies

* Use right crate for testing Ed25519

* Remove unnecessary `Sized` constraints

* Remove unnecessary `ecdsa` crate features

* Move signature de/serialization to trait methods

* Nit: move import to appropriate location

* Add warning to SIGMA-I
This commit is contained in:
daxpedda
2025-05-19 13:56:25 -07:00
committed by GitHub
parent 58b4d746c0
commit bebd2c605b
37 changed files with 9402 additions and 3375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/messages.rs
+120 -170
View File
@@ -16,24 +16,24 @@ use generic_array::sequence::Concat;
use generic_array::typenum::{Sum, Unsigned};
use generic_array::{ArrayLength, GenericArray};
use rand::{CryptoRng, RngCore};
use subtle::ConstantTimeEq;
use voprf::Group;
use voprf::{BlindedElement, BlindedElementLen, EvaluationElement, EvaluationElementLen};
use zeroize::Zeroizing;
use crate::ciphersuite::{CipherSuite, OprfGroup, OprfHash};
use crate::ciphersuite::{CipherSuite, KeGroup, OprfGroup, OprfHash};
use crate::envelope::{Envelope, EnvelopeLen};
use crate::errors::utils::{check_slice_size, check_slice_size_atleast};
use crate::errors::ProtocolError;
use crate::hash::OutputSize;
use crate::key_exchange::group::KeGroup;
use crate::key_exchange::group::Group;
use crate::key_exchange::shared::NonceLen;
use crate::key_exchange::traits::{
Deserialize, Ke1MessageLen, Ke2MessageLen, Ke3MessageLen, KeyExchange, Serialize,
CredentialRequestParts, CredentialResponseParts, Deserialize, Ke1MessageLen, Ke2MessageLen,
Ke3MessageLen, KeyExchange, Serialize,
};
use crate::key_exchange::tripledh::NonceLen;
use crate::keypair::PublicKey;
use crate::opaque::{
MaskedResponse, MaskedResponseLen, ServerLogin, ServerLoginStartResult, ServerSetup,
};
use crate::serialization::SliceExt;
////////////////////////////
// High-level API Structs //
@@ -61,12 +61,12 @@ pub struct RegistrationRequest<CS: CipherSuite> {
serde(bound = "")
)]
#[derive_where(Clone)]
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; voprf::EvaluationElement<CS::OprfCs>, <CS::KeGroup as KeGroup>::Pk)]
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; voprf::EvaluationElement<CS::OprfCs>, <KeGroup<CS> as Group>::Pk)]
pub struct RegistrationResponse<CS: CipherSuite> {
/// The server's oprf output
pub(crate) evaluation_element: voprf::EvaluationElement<CS::OprfCs>,
/// Server's static public key
pub(crate) server_s_pk: PublicKey<CS::KeGroup>,
pub(crate) server_s_pk: PublicKey<KeGroup<CS>>,
}
/// The final message from the client, containing sealed cryptographic
@@ -77,7 +77,7 @@ pub struct RegistrationResponse<CS: CipherSuite> {
serde(bound = "")
)]
#[derive_where(Clone, ZeroizeOnDrop)]
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; <CS::KeGroup as KeGroup>::Pk)]
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; <KeGroup<CS> as Group>::Pk)]
pub struct RegistrationUpload<CS: CipherSuite> {
/// The "envelope" generated by the user, containing sealed cryptographic
/// identifiers
@@ -85,7 +85,7 @@ pub struct RegistrationUpload<CS: CipherSuite> {
/// The masking key used to mask the envelope
pub(crate) masking_key: Output<OprfHash<CS>>,
/// The user's public key
pub(crate) client_s_pk: PublicKey<CS::KeGroup>,
pub(crate) client_s_pk: PublicKey<KeGroup<CS>>,
}
/// The message sent by the user to the server, to initiate registration
@@ -93,21 +93,19 @@ pub struct RegistrationUpload<CS: CipherSuite> {
feature = "serde",
derive(serde::Deserialize, serde::Serialize),
serde(bound(
deserialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message: \
serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message: \
serde::Serialize"
deserialize = "<CS::KeyExchange as KeyExchange>::KE1Message: serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange>::KE1Message: serde::Serialize"
))
)]
#[derive_where(Clone, ZeroizeOnDrop)]
#[derive_where(
Debug, Eq, Hash, PartialEq;
voprf::BlindedElement<CS::OprfCs>,
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message,
<CS::KeyExchange as KeyExchange>::KE1Message,
)]
pub struct CredentialRequest<CS: CipherSuite> {
pub(crate) blinded_element: voprf::BlindedElement<CS::OprfCs>,
pub(crate) ke1_message: <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message,
pub(crate) ke1_message: <CS::KeyExchange as KeyExchange>::KE1Message,
}
/// Builder for [`ServerLogin`](crate::ServerLogin) when using remote keys.
@@ -115,37 +113,36 @@ pub struct CredentialRequest<CS: CipherSuite> {
feature = "serde",
derive(serde::Deserialize, serde::Serialize),
serde(bound(
deserialize = "SK: serde::Deserialize<'de>, <CS::KeyExchange as KeyExchange<OprfHash<CS>, \
CS::KeGroup>>::KE2Builder: serde::Deserialize<'de>",
serialize = "SK: serde::Serialize, <CS::KeyExchange as KeyExchange<OprfHash<CS>, \
CS::KeGroup>>::KE2Builder: serde::Serialize"
deserialize = "SK: serde::Deserialize<'de>, <CS::KeyExchange as \
KeyExchange>::KE2Builder<'a, CS>: serde::Deserialize<'de>",
serialize = "SK: serde::Serialize, <CS::KeyExchange as KeyExchange>::KE2Builder<'a, CS>: \
serde::Serialize"
))
)]
#[derive_where(Clone)]
#[derive_where(
Debug, Eq, PartialEq;
<KeGroup<CS> as Group>::Pk,
SK,
voprf::EvaluationElement<CS::OprfCs>,
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Builder,
<CS::KeyExchange as KeyExchange>::KE2Builder<'a, CS>,
)]
pub struct ServerLoginBuilder<CS: CipherSuite, SK: Clone> {
pub struct ServerLoginBuilder<'a, CS: CipherSuite, SK: Clone> {
pub(crate) server_s_sk: SK,
pub(crate) evaluation_element: voprf::EvaluationElement<CS::OprfCs>,
pub(crate) masking_nonce: Zeroizing<GenericArray<u8, NonceLen>>,
pub(crate) masked_response: MaskedResponse<CS>,
#[cfg(test)]
pub(crate) oprf_key: Zeroizing<GenericArray<u8, <OprfGroup<CS> as Group>::ScalarLen>>,
pub(crate) ke2_builder: <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Builder,
pub(crate) oprf_key: Zeroizing<GenericArray<u8, <OprfGroup<CS> as voprf::Group>::ScalarLen>>,
pub(crate) ke2_builder: <CS::KeyExchange as KeyExchange>::KE2Builder<'a, CS>,
}
impl<CS: CipherSuite, SK: Clone> ServerLoginBuilder<CS, SK> {
impl<CS: CipherSuite, SK: Clone> ServerLoginBuilder<'_, CS, SK> {
/// The returned data here has to be processed and the result given as an
/// input to [`ServerLoginBuilder::build()`]. To understand what kind of
/// output is expected here and how to process it, refer to the
/// documentation of your chosen [`CipherSuite::KeyExchange`].
pub fn data(
&self,
) -> <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2BuilderData<'_> {
pub fn data(&self) -> <CS::KeyExchange as KeyExchange>::KE2BuilderData<'_, CS> {
CS::KeyExchange::ke2_builder_data(&self.ke2_builder)
}
@@ -161,7 +158,7 @@ impl<CS: CipherSuite, SK: Clone> ServerLoginBuilder<CS, SK> {
/// See [`ServerLogin::start()`] for the regular path.
pub fn build(
self,
input: <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2BuilderInput,
input: <CS::KeyExchange as KeyExchange>::KE2BuilderInput<CS>,
) -> Result<ServerLoginStartResult<CS>, ProtocolError> {
ServerLogin::build(self, input)
}
@@ -173,24 +170,22 @@ impl<CS: CipherSuite, SK: Clone> ServerLoginBuilder<CS, SK> {
feature = "serde",
derive(serde::Deserialize, serde::Serialize),
serde(bound(
deserialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message: \
serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message: \
serde::Serialize"
deserialize = "<CS::KeyExchange as KeyExchange>::KE2Message: serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange>::KE2Message: serde::Serialize"
))
)]
#[derive_where(Clone)]
#[derive_where(
Debug, Eq, Hash, PartialEq;
voprf::EvaluationElement<CS::OprfCs>,
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message,
<CS::KeyExchange as KeyExchange>::KE2Message,
)]
pub struct CredentialResponse<CS: CipherSuite> {
/// the server's oprf output
pub(crate) evaluation_element: voprf::EvaluationElement<CS::OprfCs>,
pub(crate) masking_nonce: GenericArray<u8, NonceLen>,
pub(crate) masked_response: MaskedResponse<CS>,
pub(crate) ke2_message: <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message,
pub(crate) ke2_message: <CS::KeyExchange as KeyExchange>::KE2Message,
}
/// The answer sent by the client to the server, upon reception of the sealed
@@ -199,19 +194,17 @@ pub struct CredentialResponse<CS: CipherSuite> {
feature = "serde",
derive(serde::Deserialize, serde::Serialize),
serde(bound(
deserialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message: \
serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message: \
serde::Serialize"
deserialize = "<CS::KeyExchange as KeyExchange>::KE3Message: serde::Deserialize<'de>",
serialize = "<CS::KeyExchange as KeyExchange>::KE3Message: serde::Serialize"
))
)]
#[derive_where(Clone)]
#[derive_where(
Debug, Eq, Hash, PartialEq;
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message,
<CS::KeyExchange as KeyExchange>::KE3Message,
)]
pub struct CredentialFinalization<CS: CipherSuite> {
pub(crate) ke3_message: <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message,
pub(crate) ke3_message: <CS::KeyExchange as KeyExchange>::KE3Message,
}
////////////////////////////////
@@ -220,18 +213,18 @@ pub struct CredentialFinalization<CS: CipherSuite> {
////////////////////////////////
/// Length of [`RegistrationRequest`] in bytes for serialization.
pub type RegistrationRequestLen<CS: CipherSuite> = <OprfGroup<CS> as Group>::ElemLen;
pub type RegistrationRequestLen<CS: CipherSuite> = <OprfGroup<CS> as voprf::Group>::ElemLen;
impl<CS: CipherSuite> RegistrationRequest<CS> {
/// Only used for testing purposes
#[cfg(test)]
pub fn get_blinded_element_for_testing(&self) -> voprf::BlindedElement<CS::OprfCs> {
pub(crate) fn get_blinded_element_for_testing(&self) -> voprf::BlindedElement<CS::OprfCs> {
self.blinded_element.clone()
}
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, RegistrationRequestLen<CS>> {
<OprfGroup<CS> as Group>::serialize_elem(self.blinded_element.value())
<OprfGroup<CS> as voprf::Group>::serialize_elem(self.blinded_element.value())
}
/// Deserialization from bytes
@@ -244,40 +237,38 @@ impl<CS: CipherSuite> RegistrationRequest<CS> {
/// Length of [`RegistrationResponse`] in bytes for serialization.
pub type RegistrationResponseLen<CS: CipherSuite> =
Sum<<OprfGroup<CS> as Group>::ElemLen, <CS::KeGroup as KeGroup>::PkLen>;
Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, <KeGroup<CS> as Group>::PkLen>;
impl<CS: CipherSuite> RegistrationResponse<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, RegistrationResponseLen<CS>>
where
// RegistrationResponse: KgPk + KePk
<OprfGroup<CS> as Group>::ElemLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
<OprfGroup<CS> as voprf::Group>::ElemLen: Add<<KeGroup<CS> as Group>::PkLen>,
RegistrationResponseLen<CS>: ArrayLength<u8>,
{
<OprfGroup<CS> as Group>::serialize_elem(self.evaluation_element.value())
<OprfGroup<CS> as voprf::Group>::serialize_elem(self.evaluation_element.value())
.concat(self.server_s_pk.serialize())
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
let elem_len = <OprfGroup<CS> as Group>::ElemLen::USIZE;
let key_len = <CS::KeGroup as KeGroup>::PkLen::USIZE;
let checked_slice =
check_slice_size(input, elem_len + key_len, "registration_response_bytes")?;
// Ensure that public key is valid
let server_s_pk = PublicKey::deserialize(&checked_slice[elem_len..])?;
pub fn deserialize(mut input: &[u8]) -> Result<Self, ProtocolError> {
let evaluation_element = EvaluationElement::deserialize(input)?;
input = &input[EvaluationElementLen::<CS::OprfCs>::USIZE..];
Ok(Self {
evaluation_element: voprf::EvaluationElement::deserialize(&checked_slice[..elem_len])?,
server_s_pk,
evaluation_element,
server_s_pk: PublicKey::deserialize_take(&mut input)?,
})
}
#[cfg(test)]
/// Only used for tests, where we can set the beta value to test for the
/// reflection error case
pub fn set_evaluation_element_for_testing(&self, beta: <OprfGroup<CS> as Group>::Elem) -> Self {
pub(crate) fn set_evaluation_element_for_testing(
&self,
beta: <OprfGroup<CS> as voprf::Group>::Elem,
) -> Self {
Self {
evaluation_element: voprf::EvaluationElement::from_value_unchecked(beta),
server_s_pk: self.server_s_pk.clone(),
@@ -287,18 +278,15 @@ impl<CS: CipherSuite> RegistrationResponse<CS> {
/// Length of [`RegistrationUpload`] in bytes for serialization.
pub type RegistrationUploadLen<CS: CipherSuite> =
Sum<Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>, EnvelopeLen<CS>>;
Sum<Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>, EnvelopeLen<CS>>;
impl<CS: CipherSuite> RegistrationUpload<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, RegistrationUploadLen<CS>>
where
// Envelope: Nonce + Hash
NonceLen: Add<OutputSize<OprfHash<CS>>>,
EnvelopeLen<CS>: ArrayLength<u8>,
// RegistrationUpload: (KePk + Hash) + Envelope
<CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
<KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
ArrayLength<u8> + Add<EnvelopeLen<CS>>,
RegistrationUploadLen<CS>: ArrayLength<u8>,
{
@@ -309,18 +297,11 @@ impl<CS: CipherSuite> RegistrationUpload<CS> {
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
let key_len = <CS::KeGroup as KeGroup>::PkLen::USIZE;
let hash_len = OutputSize::<OprfHash<CS>>::USIZE;
let checked_slice =
check_slice_size_atleast(input, key_len + hash_len, "registration_upload_bytes")?;
let envelope = Envelope::<CS>::deserialize(&checked_slice[key_len + hash_len..])?;
pub fn deserialize(mut input: &[u8]) -> Result<Self, ProtocolError> {
Ok(Self {
envelope,
masking_key: GenericArray::clone_from_slice(
&checked_slice[key_len..key_len + hash_len],
),
client_s_pk: PublicKey::deserialize(&checked_slice[..key_len])?,
client_s_pk: PublicKey::deserialize_take(&mut input)?,
masking_key: input.take_array("masking key")?,
envelope: Envelope::deserialize_take(&mut input)?,
})
}
@@ -342,57 +323,49 @@ impl<CS: CipherSuite> RegistrationUpload<CS> {
/// Length of [`CredentialRequest`] in bytes for serialization.
pub type CredentialRequestLen<CS: CipherSuite> =
Sum<<OprfGroup<CS> as Group>::ElemLen, Ke1MessageLen<CS>>;
Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, Ke1MessageLen<CS>>;
impl<CS: CipherSuite> CredentialRequest<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, CredentialRequestLen<CS>>
where
<CS::KeyExchange as KeyExchange>::KE1Message: Serialize,
// CredentialRequest: KgPk + Ke1Message
<OprfGroup<CS> as Group>::ElemLen: Add<Ke1MessageLen<CS>>,
<OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
CredentialRequestLen<CS>: ArrayLength<u8>,
{
<OprfGroup<CS> as Group>::serialize_elem(self.blinded_element.value())
<OprfGroup<CS> as voprf::Group>::serialize_elem(self.blinded_element.value())
.concat(self.ke1_message.serialize())
}
pub(crate) fn serialize_iter<'a>(
blinded_element: &'a GenericArray<u8, <OprfGroup<CS> as Group>::ElemLen>,
ke1_message: &'a GenericArray<u8, Ke1MessageLen<CS>>,
) -> impl Iterator<Item = &'a [u8]> {
[blinded_element.as_slice(), ke1_message].into_iter()
/// Deserialization from bytes
pub fn deserialize(mut input: &[u8]) -> Result<Self, ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1Message: Deserialize,
{
Self::deserialize_take(&mut input)
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
let elem_len = <OprfGroup<CS> as Group>::ElemLen::USIZE;
let checked_slice = check_slice_size_atleast(input, elem_len, "login_first_message_bytes")?;
// Check that the message is actually containing an element of the correct
// subgroup
let blinded_element =
voprf::BlindedElement::<CS::OprfCs>::deserialize(&checked_slice[..elem_len])?;
// Throw an error if the identity group element is encountered
if bool::from(<OprfGroup<CS> as Group>::identity_elem().ct_eq(&blinded_element.value())) {
return Err(ProtocolError::IdentityGroupElementError);
}
let ke1_message =
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message::deserialize(
&checked_slice[elem_len..],
)?;
pub(crate) fn deserialize_take(input: &mut &[u8]) -> Result<Self, ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1Message: Deserialize,
{
let blinded_element = BlindedElement::deserialize(input)?;
*input = &input[BlindedElementLen::<CS::OprfCs>::USIZE..];
Ok(Self {
blinded_element,
ke1_message,
ke1_message: <CS::KeyExchange as KeyExchange>::KE1Message::deserialize_take(input)?,
})
}
pub(crate) fn to_parts(&self) -> CredentialRequestParts<CS> {
CredentialRequestParts::new(&self.blinded_element)
}
/// Only used for testing purposes
#[cfg(test)]
pub fn get_blinded_element_for_testing(&self) -> voprf::BlindedElement<CS::OprfCs> {
pub(crate) fn get_blinded_element_for_testing(&self) -> voprf::BlindedElement<CS::OprfCs> {
self.blinded_element.clone()
}
}
@@ -402,90 +375,61 @@ pub type CredentialResponseLen<CS: CipherSuite> =
Sum<CredentialResponseWithoutKeLen<CS>, Ke2MessageLen<CS>>;
pub(crate) type CredentialResponseWithoutKeLen<CS: CipherSuite> =
Sum<Sum<<OprfGroup<CS> as Group>::ElemLen, NonceLen>, MaskedResponseLen<CS>>;
Sum<Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>, MaskedResponseLen<CS>>;
impl<CS: CipherSuite> CredentialResponse<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, CredentialResponseLen<CS>>
where
<CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
// CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
<OprfGroup<CS> as Group>::ElemLen: Add<NonceLen>,
Sum<<OprfGroup<CS> as Group>::ElemLen, NonceLen>:
<OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
// MaskedResponse: (Nonce + Hash) + KePk
NonceLen: Add<OutputSize<OprfHash<CS>>>,
Sum<NonceLen, OutputSize<OprfHash<CS>>>:
ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
MaskedResponseLen<CS>: ArrayLength<u8>,
// CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
CredentialResponseLen<CS>: ArrayLength<u8>,
{
<OprfGroup<CS> as Group>::serialize_elem(self.evaluation_element.value())
<OprfGroup<CS> as voprf::Group>::serialize_elem(self.evaluation_element.value())
.concat(self.masking_nonce)
.concat(self.masked_response.serialize())
.concat(self.ke2_message.serialize())
}
pub(crate) fn serialize_without_ke<'a>(
beta: &'a GenericArray<u8, <OprfGroup<CS> as Group>::ElemLen>,
masking_nonce: &'a GenericArray<u8, NonceLen>,
masked_response: &'a MaskedResponse<CS>,
) -> impl Iterator<Item = &'a [u8]> {
[beta.as_slice(), masking_nonce.as_slice()]
.into_iter()
.chain(masked_response.iter())
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
let elem_len = <OprfGroup<CS> as Group>::ElemLen::USIZE;
let key_len = <CS::KeGroup as KeGroup>::PkLen::USIZE;
let nonce_len = NonceLen::USIZE;
let envelope_len = Envelope::<CS>::len();
let masked_response_len = key_len + envelope_len;
let ke2_message_len = Ke2MessageLen::<CS>::USIZE;
let checked_slice = check_slice_size_atleast(
input,
elem_len + nonce_len + masked_response_len + ke2_message_len,
"credential_response_bytes",
)?;
// Check that the message is actually containing an element of the correct
// subgroup
let beta_bytes = &checked_slice[..elem_len];
let evaluation_element = voprf::EvaluationElement::<CS::OprfCs>::deserialize(beta_bytes)?;
// Throw an error if the identity group element is encountered
if bool::from(<OprfGroup<CS> as Group>::identity_elem().ct_eq(&evaluation_element.value()))
{
return Err(ProtocolError::IdentityGroupElementError);
}
let masking_nonce =
GenericArray::clone_from_slice(&checked_slice[elem_len..elem_len + nonce_len]);
let masked_response = MaskedResponse::deserialize(
&checked_slice[elem_len + nonce_len..elem_len + nonce_len + masked_response_len],
);
let ke2_message =
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message::deserialize(
&checked_slice[elem_len + nonce_len + masked_response_len..],
)?;
pub fn deserialize(mut input: &[u8]) -> Result<Self, ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE2Message: Deserialize,
{
let evaluation_element = EvaluationElement::deserialize(input)?;
input = &input[voprf::EvaluationElementLen::<CS::OprfCs>::USIZE..];
Ok(Self {
evaluation_element,
masking_nonce,
masked_response,
ke2_message,
masking_nonce: input.take_array("masking nonce")?,
masked_response: MaskedResponse::deserialize_take(&mut input)?,
ke2_message: <CS::KeyExchange as KeyExchange>::KE2Message::deserialize_take(
&mut input,
)?,
})
}
pub(crate) fn to_parts(&self) -> CredentialResponseParts<CS> {
CredentialResponseParts::new(
&self.evaluation_element,
self.masking_nonce,
self.masked_response.clone(),
)
}
#[cfg(test)]
/// Only used for tests, where we can set the beta value to test for the
/// reflection error case
pub fn set_evaluation_element_for_testing(&self, beta: <OprfGroup<CS> as Group>::Elem) -> Self {
pub(crate) fn set_evaluation_element_for_testing(
&self,
beta: <OprfGroup<CS> as voprf::Group>::Elem,
) -> Self {
Self {
evaluation_element: voprf::EvaluationElement::from_value_unchecked(beta),
masking_nonce: self.masking_nonce,
@@ -500,16 +444,22 @@ pub type CredentialFinalizationLen<CS: CipherSuite> = Ke3MessageLen<CS>;
impl<CS: CipherSuite> CredentialFinalization<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, CredentialFinalizationLen<CS>> {
pub fn serialize(&self) -> GenericArray<u8, CredentialFinalizationLen<CS>>
where
<CS::KeyExchange as KeyExchange>::KE3Message: Serialize,
{
self.ke3_message.serialize()
}
/// Deserialization from bytes
pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
let ke3_message =
<CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message::deserialize(
input,
)?;
Ok(Self { ke3_message })
pub fn deserialize(mut input: &[u8]) -> Result<Self, ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE3Message: Deserialize,
{
Ok(Self {
ke3_message: <CS::KeyExchange as KeyExchange>::KE3Message::deserialize_take(
&mut input,
)?,
})
}
}