SIGMA-I Key Exchange (#378)

* Move `KeGroup` to `KeyExchange::Group`

- Introduce `KeyExchange::Hash`, which separates the OPRF hash from the one used in `KeyExchange`.
- Remove `De/Serialize` requirement on key exchange messages and states, which forced a lot of where bounds on downstream users.
- Rename `KeGroup` to `Group`.
- Replace `D` generic for hash with `H`.

* Use `voprf::derive_key()` directly

* Implement SIGMA-I key exchange

* Improve `KeyExchange` for SIGMA-I and Ed25519

* Implement EdDSA

* Un-qualify some method calls

* SIGMA-I: only include client identity in client mac

* SIGMA-I: include server mac in client signature

* Expose key exchange types in `crate` & move modules

* Implement Ed25519ph

* Document `ed25519` crate feature

* Remove `ristretto255-voprf` crate feature

* Adjust CI crate feature testing

* Fix Rustdoc

* Remove unnecessary generic parameters from SIGMA-I

* Properly mark to-do's with TODO

* Assorted fixes

* SIGMA-I: include context in signature

* SIGMA-I: include identifiers in signature

* Merge `ServerLoginStart/FinishParameters`

* Re-export more necessary types

* More carefully expose types

* Add ECDSA test

* SIGMA-I: share context hashing

* De-duplicate client static public key storage

* Hide `KeyExchange` better

* Use the correct hash in the root documentation

* Bump `derive-where`

* Format documentation examples a bit further

* Add remote OPRF seed documentation

* Rename `deserialize_key_pair` to `deserialize_take_key_pair`

* Add more key tests

* Remove `SharedSecret` trait

* SIGMA-I refactor message API

* Share more implementation between 3DH and SIGMA-I

* Remove unnecessary zero scalar check for Curve25519

* Use correct hash in test

* Add some more TODOs

* Exclude `tests` folder from Cargo publishing

* Enable missing dependencies

* Use right crate for testing Ed25519

* Remove unnecessary `Sized` constraints

* Remove unnecessary `ecdsa` crate features

* Move signature de/serialization to trait methods

* Nit: move import to appropriate location

* Add warning to SIGMA-I

src/serialization/tests.rs

@@ -17,17 +17,17 @@ use proptest::collection::vec;
 use proptest::prelude::*;
 use rand::rngs::OsRng;
 use rand::RngCore;
-use voprf::Group;
+use voprf::Group as _;
 
-use crate::ciphersuite::{CipherSuite, OprfGroup, OprfHash};
+use crate::ciphersuite::{CipherSuite, KeGroup, OprfGroup, OprfHash};
 use crate::envelope::{Envelope, EnvelopeLen, InnerEnvelopeMode};
 use crate::errors::*;
 use crate::hash::OutputSize;
-use crate::key_exchange::group::KeGroup;
+use crate::key_exchange::group::Group;
+use crate::key_exchange::shared::NonceLen;
 use crate::key_exchange::traits::{
     Deserialize, Ke1MessageLen, Ke1StateLen, Ke2MessageLen, KeyExchange, Serialize,
 };
-use crate::key_exchange::tripledh::{NonceLen, TripleDh};
 use crate::keypair::KeyPair;
 use crate::messages::CredentialResponseWithoutKeLen;
 use crate::opaque::{ClientLoginLen, ClientRegistrationLen, MaskedResponseLen};
@@ -35,47 +35,101 @@ use crate::serialization::{i2osp, os2ip};
 use crate::*;
 
 #[cfg(feature = "ristretto255")]
-struct Ristretto255;
+struct TripleDhRistretto255;
 
 #[cfg(feature = "ristretto255")]
-impl CipherSuite for Ristretto255 {
-    type OprfCs = crate::Ristretto255;
-    type KeGroup = crate::Ristretto255;
-    type KeyExchange = TripleDh;
+impl CipherSuite for TripleDhRistretto255 {
+    type OprfCs = Ristretto255;
+    type KeyExchange = TripleDh<Ristretto255, sha2::Sha512>;
     type Ksf = crate::ksf::Identity;
 }
 
-struct P256;
+#[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+struct TripleDhCurve25519;
 
-impl CipherSuite for P256 {
+#[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+impl CipherSuite for TripleDhCurve25519 {
+    type OprfCs = Ristretto255;
+    type KeyExchange = TripleDh<Curve25519, sha2::Sha512>;
+    type Ksf = crate::ksf::Identity;
+}
+
+struct TripleDhP256;
+
+impl CipherSuite for TripleDhP256 {
     type OprfCs = ::p256::NistP256;
-    type KeGroup = ::p256::NistP256;
-    type KeyExchange = TripleDh;
+    type KeyExchange = TripleDh<::p256::NistP256, sha2::Sha256>;
     type Ksf = crate::ksf::Identity;
 }
 
-struct P384;
+struct TripleDhP384;
 
-impl CipherSuite for P384 {
+impl CipherSuite for TripleDhP384 {
     type OprfCs = ::p384::NistP384;
-    type KeGroup = ::p384::NistP384;
-    type KeyExchange = TripleDh;
+    type KeyExchange = TripleDh<::p384::NistP384, sha2::Sha384>;
     type Ksf = crate::ksf::Identity;
 }
 
-struct P521;
+struct TripleDhP521;
 
-impl CipherSuite for P521 {
+impl CipherSuite for TripleDhP521 {
     type OprfCs = ::p521::NistP521;
-    type KeGroup = ::p521::NistP521;
-    type KeyExchange = TripleDh;
+    type KeyExchange = TripleDh<::p521::NistP521, sha2::Sha512>;
     type Ksf = crate::ksf::Identity;
 }
 
-fn random_point<CS: CipherSuite>() -> <CS::KeGroup as KeGroup>::Pk {
+#[cfg(feature = "ecdsa")]
+struct SigmaIP256;
+
+#[cfg(feature = "ecdsa")]
+impl CipherSuite for SigmaIP256 {
+    type OprfCs = ::p256::NistP256;
+    type KeyExchange =
+        SigmaI<Ecdsa<::p256::NistP256, sha2::Sha256>, ::p256::NistP256, sha2::Sha256>;
+    type Ksf = crate::ksf::Identity;
+}
+
+#[cfg(feature = "ecdsa")]
+struct SigmaIP384;
+
+#[cfg(feature = "ecdsa")]
+impl CipherSuite for SigmaIP384 {
+    type OprfCs = ::p384::NistP384;
+    type KeyExchange =
+        SigmaI<Ecdsa<::p384::NistP384, sha2::Sha384>, ::p384::NistP384, sha2::Sha384>;
+    type Ksf = crate::ksf::Identity;
+}
+
+#[cfg(all(feature = "ristretto255", feature = "ed25519",))]
+struct SigmaIEd25519;
+
+#[cfg(all(feature = "ristretto255", feature = "ed25519",))]
+impl CipherSuite for SigmaIEd25519 {
+    type OprfCs = Ristretto255;
+    type KeyExchange = SigmaI<PureEddsa<Ed25519>, Ristretto255, sha2::Sha512>;
+    type Ksf = crate::ksf::Identity;
+}
+
+#[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+struct SigmaIEd25519Ph;
+
+#[cfg(all(feature = "ristretto255", feature = "ed25519",))]
+impl CipherSuite for SigmaIEd25519Ph {
+    type OprfCs = Ristretto255;
+    type KeyExchange = SigmaI<HashEddsa<Ed25519>, Ristretto255, sha2::Sha512>;
+    type Ksf = crate::ksf::Identity;
+}
+
+fn random_point<CS: CipherSuite>() -> <KeGroup<CS> as Group>::Pk {
     let mut rng = OsRng;
-    let sk = CS::KeGroup::random_sk(&mut rng);
-    CS::KeGroup::public_key(sk)
+    let sk = KeGroup::<CS>::random_sk(&mut rng);
+    KeGroup::<CS>::public_key(sk)
+}
+
+fn random_element<CS: CipherSuite>() -> <OprfGroup<CS> as voprf::Group>::Elem {
+    let mut rng = OsRng;
+    let scalar = OprfGroup::<CS>::random_scalar(&mut rng);
+    OprfGroup::<CS>::base_elem() * &scalar
 }
 
 #[test]
@@ -83,7 +137,7 @@ fn client_registration_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
         // ClientRegistration: KgSk + KgPk
-        <OprfGroup<CS> as Group>::ScalarLen: Add<<OprfGroup<CS> as Group>::ElemLen>,
+        <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<<OprfGroup<CS> as voprf::Group>::ElemLen>,
         ClientRegistrationLen<CS>: ArrayLength<u8>,
     {
         let pw = b"hunter2";
@@ -106,10 +160,20 @@ fn client_registration_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP256>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP384>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519Ph>()?;
 
     Ok(())
 }
@@ -118,12 +182,9 @@ fn client_registration_roundtrip() -> Result<(), ProtocolError> {
 fn server_registration_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
-        // Envelope: Nonce + Hash
-        NonceLen: Add<OutputSize<OprfHash<CS>>>,
-        EnvelopeLen<CS>: ArrayLength<u8>,
         // RegistrationUpload: (KePk + Hash) + Envelope
-        <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
-        Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
+        <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
+        Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
             ArrayLength<u8> + Add<EnvelopeLen<CS>>,
         RegistrationUploadLen<CS>: ArrayLength<u8>,
         // ServerRegistration = RegistrationUpload
@@ -142,7 +203,7 @@ fn server_registration_roundtrip() -> Result<(), ProtocolError> {
         // length-MAC_SIZE hmac
         mock_envelope_bytes.extend_from_slice(&Output::<OprfHash<CS>>::default());
 
-        let mock_client_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let mock_client_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         // serialization order: oprf_key, public key, envelope
         let mut bytes = Vec::<u8>::new();
         bytes.extend_from_slice(&mock_client_kp.public().serialize());
@@ -155,10 +216,20 @@ fn server_registration_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP256>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP384>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519Ph>()?;
 
     Ok(())
 }
@@ -166,11 +237,11 @@ fn server_registration_roundtrip() -> Result<(), ProtocolError> {
 #[test]
 fn registration_request_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError> {
-        let pt = random_point::<CS>();
-        let pt_bytes = CS::KeGroup::serialize_pk(pt);
+        let elem = random_element::<CS>();
+        let elem_bytes = OprfGroup::<CS>::serialize_elem(elem);
 
         let mut input = Vec::new();
-        input.extend_from_slice(&pt_bytes);
+        input.extend_from_slice(&elem_bytes);
 
         let r1 = RegistrationRequest::<CS>::deserialize(&input)?;
         let r1_bytes = r1.serialize();
@@ -191,10 +262,20 @@ fn registration_request_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP256>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP384>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519Ph>()?;
 
     Ok(())
 }
@@ -204,13 +285,13 @@ fn registration_response_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
         // RegistrationResponse: KgPk + KePk
-        <OprfGroup<CS> as Group>::ElemLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
+        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<<KeGroup<CS> as Group>::PkLen>,
         RegistrationResponseLen<CS>: ArrayLength<u8>,
     {
-        let pt = random_point::<CS>();
-        let beta_bytes = CS::KeGroup::serialize_pk(pt);
+        let elem = random_element::<CS>();
+        let beta_bytes = OprfGroup::<CS>::serialize_elem(elem);
         let mut rng = OsRng;
-        let skp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let skp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let pubkey_bytes = skp.public().serialize();
 
         let mut input = Vec::new();
@@ -238,10 +319,20 @@ fn registration_response_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP256>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP384>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519Ph>()?;
 
     Ok(())
 }
@@ -250,17 +341,14 @@ fn registration_response_roundtrip() -> Result<(), ProtocolError> {
 fn registration_upload_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
-        // Envelope: Nonce + Hash
-        NonceLen: Add<OutputSize<OprfHash<CS>>>,
-        EnvelopeLen<CS>: ArrayLength<u8>,
         // RegistrationUpload: (KePk + Hash) + Envelope
-        <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
-        Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
+        <KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
+        Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
             ArrayLength<u8> + Add<EnvelopeLen<CS>>,
         RegistrationUploadLen<CS>: ArrayLength<u8>,
     {
         let mut rng = OsRng;
-        let skp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let skp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let pubkey_bytes = skp.public().serialize();
 
         let mut key = [0u8; 32];
@@ -295,27 +383,38 @@ fn registration_upload_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP256>()?;
+    #[cfg(feature = "ecdsa")]
+    inner::<SigmaIP384>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519>()?;
+    #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+    inner::<SigmaIEd25519Ph>()?;
 
     Ok(())
 }
 
 #[test]
-fn credential_request_roundtrip() -> Result<(), ProtocolError> {
+fn triple_dh_credential_request_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
+        <CS::KeyExchange as KeyExchange>::KE1Message: Deserialize + Serialize,
         // CredentialRequest: KgPk + Ke1Message
-        <OprfGroup<CS> as Group>::ElemLen: Add<Ke1MessageLen<CS>>,
+        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
         CredentialRequestLen<CS>: ArrayLength<u8>,
     {
         let mut rng = OsRng;
-        let alpha = random_point::<CS>();
-        let alpha_bytes = CS::KeGroup::serialize_pk(alpha);
+        let alpha = random_element::<CS>();
+        let alpha_bytes = OprfGroup::<CS>::serialize_elem(alpha);
 
-        let client_e_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let client_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let mut client_nonce = [0u8; NonceLen::USIZE];
         rng.fill_bytes(&mut client_nonce);
 
@@ -348,34 +447,33 @@ fn credential_request_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
 
     Ok(())
 }
 
 #[test]
-fn credential_response_roundtrip() -> Result<(), ProtocolError> {
+fn triple_dh_credential_response_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
+        <CS::KeyExchange as KeyExchange>::KE2Message: Deserialize,
         // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
-        <OprfGroup<CS> as Group>::ElemLen: Add<NonceLen>,
-        Sum<<OprfGroup<CS> as Group>::ElemLen, NonceLen>:
+        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
+        Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
             ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
         CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
-        // MaskedResponse: (Nonce + Hash) + KePk
-        NonceLen: Add<OutputSize<OprfHash<CS>>>,
-        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
-            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
-        MaskedResponseLen<CS>: ArrayLength<u8>,
         // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
+        <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
         CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
         CredentialResponseLen<CS>: ArrayLength<u8>,
     {
-        let pt = random_point::<CS>();
-        let pt_bytes = CS::KeGroup::serialize_pk(pt);
+        let elem = random_element::<CS>();
+        let elem_bytes = OprfGroup::<CS>::serialize_elem(elem);
 
         let mut rng = OsRng;
 
@@ -383,10 +481,10 @@ fn credential_response_roundtrip() -> Result<(), ProtocolError> {
         rng.fill_bytes(&mut masking_nonce);
 
         let mut masked_response =
-            vec![0u8; <OprfGroup<CS> as Group>::ElemLen::USIZE + Envelope::<CS>::len()];
+            vec![0u8; <OprfGroup<CS> as voprf::Group>::ElemLen::USIZE + Envelope::<CS>::len()];
         rng.fill_bytes(&mut masked_response);
 
-        let server_e_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let server_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let mut mac = Output::<OprfHash<CS>>::default();
         rng.fill_bytes(&mut mac);
         let mut server_nonce = [0u8; NonceLen::USIZE];
@@ -399,6 +497,94 @@ fn credential_response_roundtrip() -> Result<(), ProtocolError> {
         ]
         .concat();
 
+        let mut input = Vec::new();
+        input.extend_from_slice(&elem_bytes);
+        input.extend_from_slice(&masking_nonce);
+        input.extend_from_slice(&masked_response);
+        input.extend_from_slice(&ke2m);
+
+        let l2 = CredentialResponse::<CS>::deserialize(&input).unwrap();
+        let l2_bytes = l2.serialize();
+        assert_eq!(input, *l2_bytes);
+
+        // Assert that identity group element is rejected
+        let identity = OprfGroup::<CS>::identity_elem();
+        let identity_bytes = OprfGroup::<CS>::serialize_elem(identity).to_vec();
+
+        assert!(matches!(
+            CredentialResponse::<CS>::deserialize(
+                &[
+                    identity_bytes,
+                    masking_nonce.to_vec(),
+                    masked_response,
+                    ke2m.to_vec()
+                ]
+                .concat()
+            ),
+            Err(ProtocolError::LibraryError(InternalError::OprfError(
+                voprf::Error::Deserialization,
+            )))
+        ));
+
+        Ok(())
+    }
+
+    #[cfg(feature = "ristretto255")]
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+
+    Ok(())
+}
+
+#[test]
+#[cfg(feature = "ecdsa")]
+fn sigma_i_ecdsa_credential_response_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE2Message: Deserialize,
+        // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
+        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<NonceLen>,
+        Sum<<OprfGroup<CS> as voprf::Group>::ElemLen, NonceLen>:
+            ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
+        CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
+        // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
+        <CS::KeyExchange as KeyExchange>::KE2Message: Serialize,
+        CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
+        CredentialResponseLen<CS>: ArrayLength<u8>,
+    {
+        let pt = random_point::<CS>();
+        let pt_bytes = KeGroup::<CS>::serialize_pk(pt);
+
+        let mut rng = OsRng;
+
+        let mut masking_nonce = [0u8; 32];
+        rng.fill_bytes(&mut masking_nonce);
+
+        let mut masked_response =
+            vec![0u8; <OprfGroup<CS> as voprf::Group>::ElemLen::USIZE + Envelope::<CS>::len()];
+        rng.fill_bytes(&mut masked_response);
+
+        let server_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
+        let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let mut mac = Output::<OprfHash<CS>>::default();
+        rng.fill_bytes(&mut mac);
+        let mut server_nonce = [0u8; NonceLen::USIZE];
+        rng.fill_bytes(&mut server_nonce);
+
+        let ke2m: Vec<u8> = [
+            server_nonce.as_ref(),
+            server_e_kp.public().serialize().as_ref(),
+            &r,
+            &s,
+            &mac,
+        ]
+        .concat();
+
         let mut input = Vec::new();
         input.extend_from_slice(&pt_bytes);
         input.extend_from_slice(&masking_nonce);
@@ -431,18 +617,18 @@ fn credential_response_roundtrip() -> Result<(), ProtocolError> {
         Ok(())
     }
 
-    #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<SigmaIP256>()?;
+    inner::<SigmaIP384>()?;
 
     Ok(())
 }
 
 #[test]
-fn credential_finalization_roundtrip() -> Result<(), ProtocolError> {
-    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError> {
+fn triple_dh_credential_finalization_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE3Message: Deserialize + Serialize,
+    {
         let mut rng = OsRng;
         let mut mac = Output::<OprfHash<CS>>::default();
         rng.fill_bytes(&mut mac);
@@ -457,31 +643,70 @@ fn credential_finalization_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
 
     Ok(())
 }
 
 #[test]
-fn client_login_roundtrip() -> Result<(), ProtocolError> {
+#[cfg(feature = "ecdsa")]
+fn sigma_i_ecdsa_credential_finalization_roundtrip() -> Result<(), ProtocolError> {
     fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
     where
+        <CS::KeyExchange as KeyExchange>::KE3Message: Deserialize + Serialize,
+    {
+        let mut rng = OsRng;
+
+        let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+
+        let mut mac = Output::<OprfHash<CS>>::default();
+        rng.fill_bytes(&mut mac);
+
+        let mut input = Vec::new();
+        input.extend_from_slice(&r);
+        input.extend_from_slice(&s);
+        input.extend_from_slice(&mac);
+
+        let l3 = CredentialFinalization::<CS>::deserialize(&input)?;
+        let l3_bytes = l3.serialize();
+        assert_eq!(input.as_slice(), l3_bytes.as_slice());
+
+        Ok(())
+    }
+
+    inner::<SigmaIP256>()?;
+    inner::<SigmaIP384>()?;
+
+    Ok(())
+}
+
+#[test]
+fn triple_dh_client_login_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE1Message: Deserialize,
+        <CS::KeyExchange as KeyExchange>::KE1State: Deserialize,
         // CredentialRequest: KgPk + Ke1Message
-        <OprfGroup<CS> as Group>::ElemLen: Add<Ke1MessageLen<CS>>,
+        <CS::KeyExchange as KeyExchange>::KE1Message: Serialize,
+        <OprfGroup<CS> as voprf::Group>::ElemLen: Add<Ke1MessageLen<CS>>,
         CredentialRequestLen<CS>: ArrayLength<u8>,
         // ClientLogin: KgSk + CredentialRequest + Ke1State
-        <OprfGroup<CS> as Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
-        Sum<<OprfGroup<CS> as Group>::ScalarLen, CredentialRequestLen<CS>>:
+        <OprfGroup<CS> as voprf::Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
+        <CS::KeyExchange as KeyExchange>::KE1State: Serialize,
+        Sum<<OprfGroup<CS> as voprf::Group>::ScalarLen, CredentialRequestLen<CS>>:
             ArrayLength<u8> + Add<Ke1StateLen<CS>>,
         ClientLoginLen<CS>: ArrayLength<u8>,
     {
         let pw = b"hunter2";
         let mut rng = OsRng;
 
-        let client_e_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let client_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let mut client_nonce = [0; NonceLen::USIZE];
         rng.fill_bytes(&mut client_nonce);
 
@@ -495,14 +720,14 @@ fn client_login_roundtrip() -> Result<(), ProtocolError> {
 
         let credential_request = CredentialRequest::<CS> {
             blinded_element: blind_result.message,
-            ke1_message:
-                <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message::deserialize(
-                    &[
-                        client_nonce.as_ref(),
-                        client_e_kp.public().serialize().as_ref(),
-                    ]
-                    .concat(),
-                )?,
+            ke1_message: <CS::KeyExchange as KeyExchange>::KE1Message::deserialize_take(
+                &mut ([
+                    client_nonce.as_ref(),
+                    client_e_kp.public().serialize().as_ref(),
+                ]
+                .concat()
+                .as_slice()),
+            )?,
         };
 
         let bytes: Vec<u8> = blind_result
@@ -520,20 +745,25 @@ fn client_login_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
 
     Ok(())
 }
 
 #[test]
-fn ke1_message_roundtrip() -> Result<(), ProtocolError> {
-    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError> {
+fn triple_dh_ke1_message_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE1Message: Deserialize + Serialize,
+    {
         let mut rng = OsRng;
 
-        let client_e_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let client_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let mut client_nonce = vec![0u8; NonceLen::USIZE];
         rng.fill_bytes(&mut client_nonce);
 
@@ -543,9 +773,7 @@ fn ke1_message_roundtrip() -> Result<(), ProtocolError> {
         ]
         .concat();
         let reg =
-            <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE1Message::deserialize(
-                &ke1m,
-            )?;
+            <CS::KeyExchange as KeyExchange>::KE1Message::deserialize_take(&mut (ke1m.as_slice()))?;
         let reg_bytes = reg.serialize();
         assert_eq!(*reg_bytes, ke1m);
 
@@ -553,20 +781,25 @@ fn ke1_message_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
 
     Ok(())
 }
 
 #[test]
-fn ke2_message_roundtrip() -> Result<(), ProtocolError> {
-    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError> {
+fn triple_dh_ke2_message_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE2Message: Deserialize + Serialize,
+    {
         let mut rng = OsRng;
 
-        let server_e_kp = KeyPair::<CS::KeGroup>::generate_random::<CS::OprfCs, _>(&mut rng);
+        let server_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
         let mut mac = Output::<OprfHash<CS>>::default();
         rng.fill_bytes(&mut mac);
         let mut server_nonce = vec![0u8; NonceLen::USIZE];
@@ -580,9 +813,7 @@ fn ke2_message_roundtrip() -> Result<(), ProtocolError> {
         .concat();
 
         let reg =
-            <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE2Message::deserialize(
-                &ke2m,
-            )?;
+            <CS::KeyExchange as KeyExchange>::KE2Message::deserialize_take(&mut (ke2m.as_slice()))?;
         let reg_bytes = reg.serialize();
         assert_eq!(*reg_bytes, ke2m);
 
@@ -590,17 +821,62 @@ fn ke2_message_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
 
     Ok(())
 }
 
 #[test]
-fn ke3_message_roundtrip() -> Result<(), ProtocolError> {
-    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError> {
+#[cfg(feature = "ecdsa")]
+fn sigma_i_ecdsa_ke2_message_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE2Message: Deserialize + Serialize,
+    {
+        let mut rng = OsRng;
+
+        let server_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
+        let mut mac = Output::<OprfHash<CS>>::default();
+        rng.fill_bytes(&mut mac);
+        let mut server_nonce = vec![0u8; NonceLen::USIZE];
+        rng.fill_bytes(&mut server_nonce);
+        let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+
+        let ke2m: Vec<u8> = [
+            server_nonce.as_slice(),
+            server_e_kp.public().serialize().as_ref(),
+            &r,
+            &s,
+            &mac,
+        ]
+        .concat();
+
+        let reg =
+            <CS::KeyExchange as KeyExchange>::KE2Message::deserialize_take(&mut (ke2m.as_slice()))?;
+        let reg_bytes = reg.serialize();
+        assert_eq!(*reg_bytes, ke2m);
+
+        Ok(())
+    }
+
+    inner::<SigmaIP256>()?;
+    inner::<SigmaIP384>()?;
+
+    Ok(())
+}
+
+#[test]
+fn triple_dh_ke3_message_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE3Message: Deserialize + Serialize,
+    {
         let mut rng = OsRng;
         let mut mac = Output::<OprfHash<CS>>::default();
         rng.fill_bytes(&mut mac);
@@ -608,9 +884,7 @@ fn ke3_message_roundtrip() -> Result<(), ProtocolError> {
         let ke3m: Vec<u8> = [mac].concat();
 
         let reg =
-            <CS::KeyExchange as KeyExchange<OprfHash<CS>, CS::KeGroup>>::KE3Message::deserialize(
-                &ke3m,
-            )?;
+            <CS::KeyExchange as KeyExchange>::KE3Message::deserialize_take(&mut (ke3m.as_slice()))?;
         let reg_bytes = reg.serialize();
         assert_eq!(*reg_bytes, ke3m);
 
@@ -618,10 +892,41 @@ fn ke3_message_roundtrip() -> Result<(), ProtocolError> {
     }
 
     #[cfg(feature = "ristretto255")]
-    inner::<Ristretto255>()?;
-    inner::<P256>()?;
-    inner::<P384>()?;
-    inner::<P521>()?;
+    inner::<TripleDhRistretto255>()?;
+    #[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+    inner::<TripleDhCurve25519>()?;
+    inner::<TripleDhP256>()?;
+    inner::<TripleDhP384>()?;
+    inner::<TripleDhP521>()?;
+
+    Ok(())
+}
+
+#[test]
+#[cfg(feature = "ecdsa")]
+fn sigma_i_ecdsa_ke3_message_roundtrip() -> Result<(), ProtocolError> {
+    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
+    where
+        <CS::KeyExchange as KeyExchange>::KE3Message: Deserialize + Serialize,
+    {
+        let mut rng = OsRng;
+        let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
+        let mut mac = Output::<OprfHash<CS>>::default();
+        rng.fill_bytes(&mut mac);
+
+        let ke3m: Vec<u8> = [mac.as_slice(), &r, &s].concat();
+
+        let reg =
+            <CS::KeyExchange as KeyExchange>::KE3Message::deserialize_take(&mut (ke3m.as_slice()))?;
+        let reg_bytes = reg.serialize();
+        assert_eq!(*reg_bytes, ke3m);
+
+        Ok(())
+    }
+
+    inner::<SigmaIP256>()?;
+    inner::<SigmaIP384>()?;
 
     Ok(())
 }
@@ -672,7 +977,7 @@ macro_rules! test {
 
                 #[test]
                 fn test_nocrash_credential_request(bytes in vec(any::<u8>(), 0..500)) {
-                    let _ = CredentialRequest::<$CS>::deserialize(&bytes).map_or(true, |_| true);
+                    let _ = CredentialRequest::<$CS>::deserialize(&mut (bytes.as_slice())).map_or(true, |_| true);
                 }
 
                 #[test]
@@ -710,7 +1015,17 @@ macro_rules! test {
 }
 
 #[cfg(feature = "ristretto255")]
-test!(ristretto255, Ristretto255);
-test!(p256, P256);
-test!(p384, P384);
-test!(p521, P521);
+test!(triple_dh_ristretto255, TripleDhRistretto255);
+#[cfg(all(feature = "ristretto255", feature = "curve25519"))]
+test!(triple_dh_curve25519, TripleDhCurve25519);
+test!(triple_dh_p256, TripleDhP256);
+test!(triple_dh_p384, TripleDhP384);
+test!(triple_dh_p521, TripleDhP521);
+#[cfg(feature = "ecdsa")]
+test!(sigma_i_p256, SigmaIP256);
+#[cfg(feature = "ecdsa")]
+test!(sigma_i_p384, SigmaIP384);
+#[cfg(all(feature = "ristretto255", feature = "ed25519",))]
+test!(sigma_i_ed25519, SigmaIEd25519);
+#[cfg(all(feature = "ristretto255", feature = "ed25519"))]
+test!(sigma_i_ed25519_ph, SigmaIEd25519Ph);