vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Remove Zeroize Tests (#381)

Browse Source 
* Remove Zeroize tests

* Remove `Zeroize` requirements from `Group::Pk`

* Remove `Copy` requirements from `Group::Pk`

* Change to `ZeroizeOnDrop` requirements for `Group::Sk`

* Add note why we don't use `elliptic_curve::PublicKey`
This commit is contained in:
daxpedda
2025-07-17 13:15:30 -07:00
committed by GitHub
parent 1b6633cdcc
commit c04fb97b5c
21 changed files with 110 additions and 841 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/envelope.rs
+2 -23
View File
@@ -16,7 +16,7 @@ use generic_array::typenum::{Sum, U32};
use hkdf::Hkdf;
use hmac::{Hmac, Mac};
use rand::{CryptoRng, RngCore};
use zeroize::{Zeroize, ZeroizeOnDrop};
use zeroize::Zeroize;
use crate::ciphersuite::{CipherSuite, KeGroup, OprfHash};
use crate::errors::{InternalError, ProtocolError};
@@ -34,7 +34,7 @@ const STR_PRIVATE_KEY: [u8; 10] = *b"PrivateKey";
pub(crate) type NonceLen = U32;
#[cfg_attr(feature = "serde", derive(serde::Deserialize, serde::Serialize))]
#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, ZeroizeOnDrop)]
#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
pub(crate) enum InnerEnvelopeMode {
Zero = 0,
Internal = 1,
@@ -310,24 +310,3 @@ fn construct_aad<'a>(
) -> impl Iterator<Item = &'a [u8]> {
[server_s_pk].into_iter().chain(id_s).chain(id_u)
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for Envelope<CS> {
fn assert_zeroized(&self) {
let Self { mode, nonce, hmac } = self;
assert_eq!(mode, &InnerEnvelopeMode::Zero);
for byte in nonce.iter().chain(hmac) {
assert_eq!(byte, &0);
}
}
}
src/key_exchange/group/curve25519.rs
+8 -30
View File
@@ -16,7 +16,7 @@ use generic_array::GenericArray;
use generic_array::typenum::U32;
use rand::{CryptoRng, RngCore};
use subtle::ConstantTimeEq;
use zeroize::Zeroize;
use zeroize::ZeroizeOnDrop;
use super::Group;
use crate::errors::{InternalError, ProtocolError};
@@ -33,7 +33,7 @@ impl Group for Curve25519 {
type Sk = Scalar;
type SkLen = U32;
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
pk.0.to_bytes().into()
}
@@ -56,11 +56,11 @@ impl Group for Curve25519 {
Ok(Scalar(scalar::clamp_integer(seed.into())))
}
fn public_key(sk: Self::Sk) -> Self::Pk {
fn public_key(sk: &Self::Sk) -> Self::Pk {
NonIdentity(MontgomeryPoint::mul_base_clamped(sk.0))
}
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.0.into()
}
@@ -72,14 +72,14 @@ impl Group for Curve25519 {
}
impl DiffieHellman<Curve25519> for Scalar {
fn diffie_hellman(self, pk: NonIdentity) -> GenericArray<u8, U32> {
Curve25519::serialize_pk(NonIdentity(pk.0.mul_clamped(self.0)))
fn diffie_hellman(&self, pk: &NonIdentity) -> GenericArray<u8, U32> {
Curve25519::serialize_pk(&NonIdentity(pk.0.mul_clamped(self.0)))
}
}
/// Non-identity point wrapper for [`MontgomeryPoint`].
#[cfg_attr(feature = "serde", derive(serde::Deserialize, serde::Serialize))]
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Zeroize)]
#[derive(Clone, Debug, Eq, Hash, PartialEq)]
pub struct NonIdentity(
#[cfg_attr(feature = "serde", serde(deserialize_with = "serde_deserialize_pk"))]
MontgomeryPoint,
@@ -113,7 +113,7 @@ where
/// Curve25519 scalar.
#[cfg_attr(feature = "serde", derive(serde::Deserialize, serde::Serialize))]
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Zeroize)]
#[derive(Clone, Debug, Eq, Hash, PartialEq, ZeroizeOnDrop)]
pub struct Scalar(
#[cfg_attr(feature = "serde", serde(deserialize_with = "serde_deserialize_sk"))] [u8; 32],
);
@@ -142,28 +142,6 @@ where
.map_err(D::Error::custom)
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl AssertZeroized for NonIdentity {
fn assert_zeroized(&self) {
assert_eq!(self.0, MontgomeryPoint::default());
}
}
#[cfg(test)]
impl AssertZeroized for Scalar {
fn assert_zeroized(&self) {
assert_eq!(*self, Scalar(<_>::default()));
}
}
#[test]
fn non_zero_scalar() {
use std::vec;
src/key_exchange/group/ed25519.rs
+7 -45
View File
@@ -21,7 +21,7 @@ use generic_array::GenericArray;
use generic_array::sequence::Concat;
use generic_array::typenum::{U32, U64};
use rand::{CryptoRng, RngCore};
use zeroize::Zeroize;
use zeroize::{Zeroize, ZeroizeOnDrop};
use super::Group;
use crate::ciphersuite::CipherSuite;
@@ -41,7 +41,7 @@ impl Group for Ed25519 {
type Sk = SigningKey;
type SkLen = U32;
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
pk.compressed.0.into()
}
@@ -62,11 +62,11 @@ impl Group for Ed25519 {
Ok(SigningKey::from_bytes(seed.into()))
}
fn public_key(sk: Self::Sk) -> Self::Pk {
fn public_key(sk: &Self::Sk) -> Self::Pk {
sk.verifying_key
}
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.sk.into()
}
@@ -300,7 +300,7 @@ impl serde::Serialize for VerifyingKey {
/// Ed25519 signing key.
// We store the `ExpandedSecret` in memory to avoid computing it on demand and then discarding it
// again.
#[derive(Clone, Copy, Debug, Eq, PartialEq, Zeroize)]
#[derive(Clone, Debug, Eq, PartialEq, ZeroizeOnDrop)]
pub struct SigningKey {
// `ed25519_dalek::SigningKey` doesn't implement `Zeroize`. See
// https://github.com/dalek-cryptography/curve25519-dalek/pull/747
@@ -428,44 +428,6 @@ impl Zeroize for Signature {
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl AssertZeroized for VerifyingKey {
fn assert_zeroized(&self) {
use curve25519_dalek::traits::Identity;
let Self { point, compressed } = self;
assert_eq!(point, &EdwardsPoint::identity());
assert_eq!(compressed, &EdwardsPoint::identity().compress());
}
}
#[cfg(test)]
impl AssertZeroized for SigningKey {
fn assert_zeroized(&self) {
let Self {
sk,
verifying_key,
scalar,
hash_prefix,
} = self;
verifying_key.assert_zeroized();
for byte in sk.iter().chain(scalar.to_bytes().iter()).chain(hash_prefix) {
assert_eq!(byte, &0);
}
}
}
#[cfg(test)]
mod test {
use std::iter;
@@ -497,7 +459,7 @@ mod test {
let verifying_key = VerifyingKey::from(&signing_key);
verifying_key.verify(&message, &signature).unwrap();
let custom_pk = Ed25519::public_key(custom_sk);
let custom_pk = Ed25519::public_key(&custom_sk);
verify(
&custom_pk,
false,
@@ -533,7 +495,7 @@ mod test {
.verify_prehashed(message, None, &signature)
.unwrap();
let custom_pk = Ed25519::public_key(custom_sk);
let custom_pk = Ed25519::public_key(&custom_sk);
verify(
&custom_pk,
true,
src/key_exchange/group/elliptic_curve.rs
+25 -48
View File
@@ -15,13 +15,11 @@ use elliptic_curve::group::GroupEncoding;
use elliptic_curve::ops::MulByGenerator;
use elliptic_curve::sec1::{ModulusSize, ToEncodedPoint};
use elliptic_curve::{
CurveArithmetic, FieldBytesSize, Group as _, NonZeroScalar, ProjectivePoint, Scalar, SecretKey,
point,
CurveArithmetic, FieldBytesSize, NonZeroScalar, ProjectivePoint, Scalar, SecretKey, point,
};
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
use voprf::Mode;
use zeroize::Zeroize;
use super::{Group, STR_OPAQUE_DERIVE_AUTH_KEY_PAIR};
use crate::errors::{InternalError, ProtocolError};
@@ -36,15 +34,18 @@ where
Repr = GenericArray<u8, <FieldBytesSize<Self> as ModulusSize>::CompressedPointSize>,
> + ToEncodedPoint<Self>,
{
// We don't use `elliptic_curve::PublicKey` because it stores its internals in a
// format ideal for serialization and not computation. This is inconsistent with
// our other implementations.
type Pk = NonIdentity<Self>;
type PkLen = <FieldBytesSize<Self> as ModulusSize>::CompressedPointSize;
type Sk = NonZeroScalar<Self>;
type Sk = SecretKey<Self>;
type SkLen = FieldBytesSize<Self>;
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
GenericArray::clone_from_slice(pk.0.to_encoded_point(true).as_bytes())
}
@@ -56,7 +57,7 @@ where
}
fn random_sk<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Sk {
SecretKey::<Self>::random(rng).to_nonzero_scalar()
SecretKey::<Self>::random(rng)
}
fn derive_scalar(seed: GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError> {
@@ -64,29 +65,31 @@ where
.map(|scalar| {
NonZeroScalar::new(scalar).expect("`voprf::derive_key()` returned a zero scalar")
})
.map(SecretKey::from)
.map_err(InternalError::from)
}
fn public_key(sk: Self::Sk) -> Self::Pk {
fn public_key(sk: &Self::Sk) -> Self::Pk {
// Non-panicking version in https://github.com/RustCrypto/traits/pull/1833.
NonIdentity(
point::NonIdentity::new(ProjectivePoint::<Self>::mul_by_generator(&*sk))
.expect("multiplying with a non-zero scalar can never yield the identity element"),
point::NonIdentity::new(ProjectivePoint::<Self>::mul_by_generator(
&sk.to_nonzero_scalar(),
))
.expect("multiplying with a non-zero scalar can never yield the identity element"),
)
}
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.into()
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.to_bytes()
}
fn deserialize_take_sk(bytes: &mut &[u8]) -> Result<Self::Sk, ProtocolError> {
SecretKey::<Self>::from_bytes(&bytes.take_array("secret key")?)
.map(|secret_key| secret_key.to_nonzero_scalar())
.map_err(|_| ProtocolError::SerializationError)
}
}
impl<G> DiffieHellman<G> for NonZeroScalar<G>
impl<G> DiffieHellman<G> for SecretKey<G>
where
G: CurveArithmetic + voprf::CipherSuite<Group = G> + voprf::Group<Scalar = Scalar<G>>,
FieldBytesSize<G>: ModulusSize,
@@ -95,15 +98,19 @@ where
> + ToEncodedPoint<G>,
{
fn diffie_hellman(
self,
pk: NonIdentity<G>,
&self,
pk: &NonIdentity<G>,
) -> GenericArray<u8, <FieldBytesSize<G> as ModulusSize>::CompressedPointSize> {
GenericArray::clone_from_slice((pk.0 * self).to_encoded_point(true).as_bytes())
GenericArray::clone_from_slice(
(pk.0 * self.to_nonzero_scalar())
.to_encoded_point(true)
.as_bytes(),
)
}
}
/// Wrapper around [`NonIdentity`](point::NonIdentity) to implement [`Zeroize`].
// TODO: remove after https://github.com/RustCrypto/traits/pull/1832.
/// Wrapper around [`NonIdentity`](point::NonIdentity) to [`Eq`].
// TODO: remove after https://github.com/RustCrypto/traits/pull/1834.
#[derive_where(Clone, Copy)]
#[cfg_attr(
feature = "serde",
@@ -133,33 +140,3 @@ impl<G: CurveArithmetic> PartialEq for NonIdentity<G> {
}
impl<G: CurveArithmetic> Eq for NonIdentity<G> {}
impl<G: CurveArithmetic> Zeroize for NonIdentity<G> {
fn zeroize(&mut self) {
self.0 = point::NonIdentity::new(ProjectivePoint::<G>::generator()).unwrap();
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<G: CurveArithmetic> AssertZeroized for NonIdentity<G> {
fn assert_zeroized(&self) {
assert_eq!(self.0.to_point(), ProjectivePoint::<G>::generator());
}
}
#[cfg(test)]
impl<G: CurveArithmetic> AssertZeroized for NonZeroScalar<G> {
fn assert_zeroized(&self) {
use elliptic_curve::Field;
assert_eq!(**self, Scalar::<G>::ONE);
}
}
src/key_exchange/group/mod.rs
+6 -6
View File
@@ -18,7 +18,7 @@ pub mod ristretto255;
use generic_array::{ArrayLength, GenericArray};
use rand::{CryptoRng, RngCore};
use zeroize::Zeroize;
use zeroize::ZeroizeOnDrop;
use crate::errors::{InternalError, ProtocolError};
@@ -27,16 +27,16 @@ const STR_OPAQUE_DERIVE_AUTH_KEY_PAIR: [u8; 33] = *b"OPAQUE-DeriveDiffieHellmanK
/// A group representation for use in the key exchange
pub trait Group {
/// Public key
type Pk: Copy + Zeroize;
type Pk: Clone;
/// Length of the public key
type PkLen: ArrayLength<u8>;
/// Secret key
type Sk: Copy + Zeroize;
type Sk: Clone + ZeroizeOnDrop;
/// Length of the secret key
type SkLen: ArrayLength<u8>;
/// Serializes `self`
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen>;
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen>;
/// Return a public key from its fixed-length bytes representation
///
@@ -50,10 +50,10 @@ pub trait Group {
fn derive_scalar(seed: GenericArray<u8, Self::SkLen>) -> Result<Self::Sk, InternalError>;
/// Return a public key from its secret key
fn public_key(sk: Self::Sk) -> Self::Pk;
fn public_key(sk: &Self::Sk) -> Self::Pk;
/// Serializes `self`
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen>;
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen>;
/// Return a public key from its fixed-length bytes representation
///
src/key_exchange/group/ristretto255.rs
+8 -30
View File
@@ -19,7 +19,7 @@ use generic_array::GenericArray;
use generic_array::typenum::{IsLess, IsLessOrEqual, U32, U256};
use rand::{CryptoRng, RngCore};
use voprf::Mode;
use zeroize::Zeroize;
use zeroize::ZeroizeOnDrop;
use super::{Group, STR_OPAQUE_DERIVE_AUTH_KEY_PAIR};
use crate::errors::{InternalError, ProtocolError};
@@ -37,7 +37,7 @@ impl Group for Ristretto255 {
type Sk = NonZeroScalar;
type SkLen = U32;
fn serialize_pk(pk: Self::Pk) -> GenericArray<u8, Self::PkLen> {
fn serialize_pk(pk: &Self::Pk) -> GenericArray<u8, Self::PkLen> {
pk.0.compress().to_bytes().into()
}
@@ -64,11 +64,11 @@ impl Group for Ristretto255 {
.map_err(InternalError::from)
}
fn public_key(sk: Self::Sk) -> Self::Pk {
fn public_key(sk: &Self::Sk) -> Self::Pk {
NonIdentity(RISTRETTO_BASEPOINT_POINT * sk.0)
}
fn serialize_sk(sk: Self::Sk) -> GenericArray<u8, Self::SkLen> {
fn serialize_sk(sk: &Self::Sk) -> GenericArray<u8, Self::SkLen> {
sk.0.to_bytes().into()
}
@@ -81,14 +81,14 @@ impl Group for Ristretto255 {
}
impl DiffieHellman<Ristretto255> for NonZeroScalar {
fn diffie_hellman(self, pk: NonIdentity) -> GenericArray<u8, U32> {
Ristretto255::serialize_pk(NonIdentity(pk.0 * self.0))
fn diffie_hellman(&self, pk: &NonIdentity) -> GenericArray<u8, U32> {
Ristretto255::serialize_pk(&NonIdentity(pk.0 * self.0))
}
}
/// Non-identity point wrapper for [`RistrettoPoint`].
#[cfg_attr(feature = "serde", derive(serde::Deserialize, serde::Serialize))]
#[derive(Clone, Copy, Debug, Eq, PartialEq, Zeroize)]
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct NonIdentity(
#[cfg_attr(feature = "serde", serde(deserialize_with = "serde_deserialize_pk"))] RistrettoPoint,
);
@@ -119,7 +119,7 @@ where
/// Non-zero scalar wrapper for [`Scalar`]
#[cfg_attr(feature = "serde", derive(serde::Deserialize, serde::Serialize))]
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Zeroize)]
#[derive(Clone, Debug, Eq, Hash, PartialEq, ZeroizeOnDrop)]
pub struct NonZeroScalar(
#[cfg_attr(feature = "serde", serde(deserialize_with = "serde_deserialize_sk"))] Scalar,
);
@@ -223,25 +223,3 @@ impl voprf::Group for Ristretto255 {
<voprf::Ristretto255 as voprf::Group>::deserialize_scalar(scalar_bits)
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl AssertZeroized for NonIdentity {
fn assert_zeroized(&self) {
assert_eq!(self.0, RistrettoPoint::default());
}
}
#[cfg(test)]
impl AssertZeroized for NonZeroScalar {
fn assert_zeroized(&self) {
assert_eq!(self.0, Scalar::default());
}
}
src/key_exchange/mod.rs
-38
View File
@@ -405,41 +405,3 @@ pub(crate) type Ke2MessageLen<CS: CipherSuite> =
<<CS::KeyExchange as KeyExchange>::KE2Message as Serialize>::Len;
pub(crate) type Ke3MessageLen<CS: CipherSuite> =
<<CS::KeyExchange as KeyExchange>::KE3Message as Serialize>::Len;
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for SerializedCredentialRequest<CS> {
fn assert_zeroized(&self) {
let Self(blinded_element) = self;
for byte in blinded_element.iter() {
assert_eq!(byte, &0);
}
}
}
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for SerializedCredentialResponse<CS> {
fn assert_zeroized(&self) {
let Self {
evaluation_element,
masking_nonce,
masked_response,
} = self;
for byte in evaluation_element
.iter()
.chain(masking_nonce)
.chain(masked_response.iter().flatten())
{
assert_eq!(byte, &0);
}
}
}
src/key_exchange/shared.rs
+2 -55
View File
@@ -50,7 +50,7 @@ static STR_OPAQUE: &[u8] = b"OPAQUE-";
/// [`TripleDh`](crate::TripleDh) and [`SigmaI`](crate::SigmaI).
pub trait DiffieHellman<G: Group> {
/// Diffie-Hellman key exchange.
fn diffie_hellman(self, pk: G::Pk) -> GenericArray<u8, G::PkLen>;
fn diffie_hellman(&self, pk: &G::Pk) -> GenericArray<u8, G::PkLen>;
}
/// The client state produced after the first key exchange message
@@ -82,6 +82,7 @@ pub struct Ke1State<G: Group> {
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; G::Pk)]
pub struct Ke1Message<G: Group> {
pub(super) client_nonce: GenericArray<u8, NonceLen>,
#[derive_where(skip(Zeroize))]
pub(super) client_e_pk: PublicKey<G>,
}
@@ -345,57 +346,3 @@ where
self.client_nonce.concat(self.client_e_pk.clone())
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<G: Group> AssertZeroized for Ke1State<G>
where
G::Sk: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self {
client_e_sk,
client_nonce,
} = self;
client_e_sk.assert_zeroized();
assert_eq!(client_nonce, &GenericArray::default());
}
}
#[cfg(test)]
impl<G: Group> AssertZeroized for Ke1Message<G>
where
G::Pk: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self {
client_nonce,
client_e_pk,
} = self;
assert_eq!(client_nonce, &GenericArray::default());
client_e_pk.assert_zeroized();
}
}
#[cfg(test)]
impl<G: Group> AssertZeroized for Ke1MessageIter<G> {
fn assert_zeroized(&self) {
let Self {
client_nonce,
client_e_pk,
} = self;
for byte in client_nonce.iter().chain(client_e_pk) {
assert_eq!(byte, &0);
}
}
}
src/key_exchange/sigma_i/ecdsa.rs
+8 -8
View File
@@ -16,8 +16,8 @@ use digest::core_api::BlockSizeUser;
use digest::{FixedOutputReset, HashMarker};
use ecdsa::{PrimeCurve, SignatureSize, hazmat};
use elliptic_curve::{
CurveArithmetic, Field, FieldBytes, FieldBytesEncoding, FieldBytesSize, NonZeroScalar,
PrimeField, Scalar,
CurveArithmetic, Field, FieldBytes, FieldBytesEncoding, FieldBytesSize, PrimeField, Scalar,
SecretKey,
};
use generic_array::{ArrayLength, GenericArray};
use rand::{CryptoRng, RngCore};
@@ -39,7 +39,7 @@ pub struct Ecdsa<G, H>(PhantomData<(G, H)>);
impl<G, H> SignatureProtocol for Ecdsa<G, H>
where
G: CurveArithmetic + Group<Sk = NonZeroScalar<G>, Pk = NonIdentity<G>> + PrimeCurve,
G: CurveArithmetic + Group<Sk = SecretKey<G>, Pk = NonIdentity<G>> + PrimeCurve,
SignatureSize<G>: ArrayLength<u8>,
H: Clone
+ Default
@@ -88,14 +88,14 @@ where
}
}
fn sign<R, C, H>(sk: &NonZeroScalar<C>, rng: &mut R, pre_hash: &[u8]) -> ecdsa::Signature<C>
fn sign<R, C, H>(sk: &SecretKey<C>, rng: &mut R, pre_hash: &[u8]) -> ecdsa::Signature<C>
where
R: CryptoRng + RngCore,
C: CurveArithmetic + PrimeCurve,
SignatureSize<C>: ArrayLength<u8>,
H: Default + BlockSizeUser + FixedOutputReset<OutputSize = FieldBytesSize<C>> + HashMarker,
{
let repr = sk.to_repr();
let repr = sk.to_bytes();
let order = C::ORDER.encode_field_bytes();
let z =
hazmat::bits2field::<C>(pre_hash).expect("hash output can not be shorter than a scalar");
@@ -109,7 +109,7 @@ where
let k =
Scalar::<C>::from_repr(rfc6979::generate_k::<H, _>(&repr, &order, &z, &ad)).unwrap();
if let Ok((signature, _)) = hazmat::sign_prehashed::<C, _>(sk, k, &z) {
if let Ok((signature, _)) = hazmat::sign_prehashed::<C, _>(&sk.to_nonzero_scalar(), k, &z) {
break signature;
}
}
@@ -175,14 +175,14 @@ fn ecdsa() {
let hash = Sha256::new_with_prefix(message);
let sk = NistP256::random_sk(&mut OsRng);
let signing_key = SigningKey::from(sk);
let signing_key = SigningKey::from(sk.clone());
let signature: Signature = signing_key.sign_digest_with_rng(&mut rng, hash.clone());
let custom_signature = sign::<_, _, Sha256>(&sk, &mut rng, &hash.clone().finalize());
assert_eq!(signature, custom_signature);
let pk = NistP256::public_key(sk);
let pk = NistP256::public_key(&sk);
let verifying_key = VerifyingKey::from(PublicKey::from(pk.0));
verifying_key
src/key_exchange/sigma_i/message.rs
+7 -1
View File
@@ -192,12 +192,18 @@ impl<CS: CipherSuite, KE: Group> CachedMessage<CS, KE> {
derive(serde::Deserialize, serde::Serialize),
serde(bound = "")
)]
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Zeroize)]
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
pub(super) enum Role {
Server,
Client,
}
impl Zeroize for Role {
fn zeroize(&mut self) {
*self = Self::Server;
}
}
enum Stage {
Sign,
Verify,
src/key_exchange/sigma_i/mod.rs
+4 -58
View File
@@ -155,7 +155,9 @@ pub trait SignatureProtocol {
pub struct Ke2Builder<'a, CS: CipherSuite, KE: Group> {
transcript: Message<'a, CS, KE>,
server_nonce: GenericArray<u8, NonceLen>,
#[derive_where(skip(Zeroize))]
client_s_pk: PublicKey<KeGroup<CS>>,
#[derive_where(skip(Zeroize))]
server_e_pk: PublicKey<KE>,
expected_mac: Output<KeHash<CS>>,
session_key: Output<KeHash<CS>>,
@@ -179,6 +181,7 @@ pub struct Ke2Builder<'a, CS: CipherSuite, KE: Group> {
#[derive_where(Clone, ZeroizeOnDrop)]
#[derive_where(Debug, Eq, Hash, PartialEq; <SIG::Group as Group>::Pk, SIG::VerifyState<CS, KE>)]
pub struct Ke2State<CS: CipherSuite, SIG: SignatureProtocol, KE: Group> {
#[derive_where(skip(Zeroize))]
client_s_pk: PublicKey<SIG::Group>,
session_key: Output<KeHash<CS>>,
verify_state: SIG::VerifyState<CS, KE>,
@@ -203,6 +206,7 @@ where
Le<<KEH::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{
server_nonce: GenericArray<u8, NonceLen>,
#[derive_where(skip(Zeroize))]
server_e_pk: PublicKey<KE>,
signature: SIG::Signature,
mac: Output<KEH>,
@@ -583,61 +587,3 @@ where
SIG::serialize_signature(&self.signature).concat(self.mac.clone())
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::key_exchange::shared::Ke1MessageIter;
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<CS: CipherSuite, KE: Group> AssertZeroized for CachedMessage<CS, KE>
where
Ke1MessageIter<KE>: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self {
credential_request,
ke1_message,
credential_response,
server_nonce,
server_e_pk,
server_mac,
} = self;
credential_request.assert_zeroized();
ke1_message.assert_zeroized();
credential_response.assert_zeroized();
for byte in server_nonce.iter().chain(server_e_pk).chain(server_mac) {
assert_eq!(byte, &0);
}
}
}
#[cfg(test)]
impl<CS: CipherSuite, SIG: SignatureProtocol, KE: Group> AssertZeroized for Ke2State<CS, SIG, KE>
where
<SIG::Group as Group>::Pk: AssertZeroized,
SIG::VerifyState<CS, KE>: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self {
client_s_pk,
session_key,
verify_state,
expected_mac,
} = self;
client_s_pk.assert_zeroized();
verify_state.assert_zeroized();
for byte in session_key.iter().chain(expected_mac) {
assert_eq!(byte, &0);
}
}
}
src/key_exchange/sigma_i/shared.rs
-15
View File
@@ -37,18 +37,3 @@ impl<H: OutputSizeUser> Serialize for PreHash<H> {
self.0.clone()
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<H: OutputSizeUser> AssertZeroized for PreHash<H> {
fn assert_zeroized(&self) {
assert_eq!(self.0, GenericArray::default());
}
}
src/key_exchange/tripledh.rs
+5 -28
View File
@@ -109,6 +109,7 @@ where
Le<<H::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{
server_nonce: GenericArray<u8, NonceLen>,
#[derive_where(skip(Zeroize))]
server_e_pk: PublicKey<G>,
mac: Output<H>,
}
@@ -375,6 +376,8 @@ where
}
}
/// TODO: implement via derive after hash crates get `Zeroize` support in
/// `digest` v11.
impl<G: Group, H: Hash> Drop for Ke2Builder<G, H>
where
H::Core: ProxyHash,
@@ -382,21 +385,17 @@ where
Le<<H::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{
fn drop(&mut self) {
struct AssertZeroizeOnDrop<'a, T: ZeroizeOnDrop>(#[allow(unused)] &'a T);
let Self {
server_nonce,
transcript_hasher,
client_e_pk,
server_e_pk,
client_e_pk: _,
server_e_pk: _,
shared_secret_1,
shared_secret_3,
} = self;
server_nonce.zeroize();
transcript_hasher.reset();
let _ = AssertZeroizeOnDrop(client_e_pk);
let _ = AssertZeroizeOnDrop(server_e_pk);
shared_secret_1.zeroize();
shared_secret_3.zeroize();
}
@@ -469,25 +468,3 @@ where
self.mac.clone()
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<H: OutputSizeUser> AssertZeroized for Ke2State<H> {
fn assert_zeroized(&self) {
let Self {
session_key,
expected_mac,
} = self;
for byte in session_key.iter().chain(expected_mac) {
assert_eq!(byte, &0);
}
}
}
src/keypair.rs
+9 -58
View File
@@ -62,7 +62,7 @@ impl<G: Group, SK: Clone> KeyPair<G, SK> {
impl<G: Group> KeyPair<G> {
pub(crate) fn random<R: RngCore + CryptoRng>(rng: &mut R) -> Self {
let sk = G::random_sk(rng);
let pk = G::public_key(sk);
let pk = G::public_key(&sk);
Self {
pk: PublicKey(pk),
sk: PrivateKey(sk),
@@ -74,7 +74,7 @@ impl<G: Group> KeyPair<G> {
let mut scalar_bytes = GenericArray::<_, <G as Group>::SkLen>::default();
rng.fill_bytes(&mut scalar_bytes);
let sk = G::derive_scalar(scalar_bytes).unwrap();
let pk = G::public_key(sk);
let pk = G::public_key(&sk);
Self {
pk: PublicKey(pk),
sk: PrivateKey(sk),
@@ -102,12 +102,12 @@ impl<G: Group> PrivateKey<G> {
/// Returns public key from private key
pub fn public_key(&self) -> PublicKey<G> {
PublicKey(G::public_key(self.0))
PublicKey(G::public_key(&self.0))
}
/// Serializes this private key to a fixed-length byte array.
pub fn serialize(&self) -> GenericArray<u8, G::SkLen> {
G::serialize_sk(self.0)
G::serialize_sk(&self.0)
}
/// Creates a [`PrivateKey`] from the given bytes.
@@ -126,7 +126,7 @@ where
{
/// Diffie-Hellman key exchange implementation
pub(crate) fn ke_diffie_hellman(&self, pk: &PublicKey<G>) -> GenericArray<u8, G::PkLen> {
self.0.diffie_hellman(pk.0)
self.0.diffie_hellman(&pk.0)
}
}
@@ -190,7 +190,7 @@ impl<G: Group> PrivateKeySerialization<G> for PrivateKey<G> {
serialize = "G::Pk: serde::Serialize"
))
)]
#[derive_where(Clone, ZeroizeOnDrop)]
#[derive_where(Clone)]
#[derive_where(Debug, Eq, Hash, Ord, PartialEq, PartialOrd; G::Pk)]
pub struct PublicKey<G: Group + ?Sized>(G::Pk);
@@ -206,12 +206,12 @@ impl<G: Group> PublicKey<G> {
/// Convert to bytes
pub fn serialize(&self) -> GenericArray<u8, G::PkLen> {
G::serialize_pk(self.0)
G::serialize_pk(&self.0)
}
/// Returns the inner [`Group::Pk`].
pub fn to_group_type(&self) -> G::Pk {
self.0
pub fn to_group_type(&self) -> &G::Pk {
&self.0
}
}
@@ -274,9 +274,6 @@ impl<H: OutputSizeUser, E> OprfSeedSerialization<H, E> for OprfSeed<H> {
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<G: Group> KeyPair<G> {
/// Test-only strategy returning a proptest Strategy based on
@@ -298,36 +295,13 @@ impl<G: Group> KeyPair<G> {
}
}
#[cfg(test)]
impl<G: Group> AssertZeroized for PublicKey<G>
where
G::Pk: AssertZeroized,
{
fn assert_zeroized(&self) {
self.0.assert_zeroized();
}
}
#[cfg(test)]
impl<G: Group> AssertZeroized for PrivateKey<G>
where
G::Sk: AssertZeroized,
{
fn assert_zeroized(&self) {
self.0.assert_zeroized();
}
}
#[cfg(test)]
mod tests {
use core::ptr;
use hkdf::Hkdf;
use rand::rngs::OsRng;
use super::*;
use crate::ciphersuite::{KeGroup, OprfHash};
use crate::serialization::AssertZeroized;
use crate::{
CipherSuite, ClientLogin, ClientLoginFinishParameters, ClientLoginFinishResult,
ClientLoginStartResult, ClientRegistration, ClientRegistrationFinishParameters,
@@ -336,29 +310,6 @@ mod tests {
ServerRegistrationStartResult, ServerSetup,
};
#[test]
fn test_zeroize_key() {
fn inner<G: Group>()
where
G::Sk: AssertZeroized,
{
let mut rng = OsRng;
let mut key = PrivateKey::<G>(G::random_sk(&mut rng));
unsafe { ptr::drop_in_place(&mut key) };
key.0.assert_zeroized();
}
#[cfg(feature = "ristretto255")]
inner::<crate::Ristretto255>();
inner::<::p256::NistP256>();
inner::<::p384::NistP384>();
inner::<::p521::NistP521>();
#[cfg(feature = "curve25519")]
inner::<crate::Curve25519>();
#[cfg(feature = "ed25519")]
inner::<crate::Ed25519>();
}
macro_rules! test {
($mod:ident, $point:ty) => {
mod $mod {
src/lib.rs
+6 -6
View File
@@ -1003,7 +1003,7 @@
//! # struct YourRemoteKey(<Ristretto255 as Group>::Sk);
//! # impl YourRemoteKey {
//! # fn diffie_hellman(&self, pk: &PublicKey<Ristretto255>) -> Result<GenericArray<u8, <Ristretto255 as Group>::PkLen>, YourRemoteKeyError> {
//! # Ok(<<Ristretto255 as Group>::Sk as DiffieHellman<Ristretto255>>::diffie_hellman(self.0, pk.to_group_type()))
//! # Ok(<<Ristretto255 as Group>::Sk as DiffieHellman<Ristretto255>>::diffie_hellman(&self.0, pk.to_group_type()))
//! # }
//! # }
//! use opaque_ke::{ServerLogin, ServerLoginParameters, ServerSetup};
@@ -1025,8 +1025,8 @@
//! }
//!
//! # let sk = Ristretto255::random_sk(&mut OsRng);
//! # let pk = Ristretto255::public_key(sk);
//! # let pk = Ristretto255::serialize_pk(pk);
//! # let pk = Ristretto255::public_key(&sk);
//! # let pk = Ristretto255::serialize_pk(&pk);
//! # let public_key = PublicKey::deserialize(&pk).unwrap();
//! # let remote_key = YourRemoteKey(sk);
//! # let mut server_rng = OsRng;
@@ -1112,7 +1112,7 @@
//! # struct YourRemoteKey(<Ristretto255 as Group>::Sk);
//! # impl YourRemoteKey {
//! # fn diffie_hellman(&self, pk: &PublicKey<Ristretto255>) -> Result<GenericArray<u8, <Ristretto255 as Group>::PkLen>, YourRemoteSecretsError> {
//! # Ok(<<Ristretto255 as Group>::Sk as DiffieHellman<Ristretto255>>::diffie_hellman(self.0, pk.to_group_type()))
//! # Ok(<<Ristretto255 as Group>::Sk as DiffieHellman<Ristretto255>>::diffie_hellman(&self.0, pk.to_group_type()))
//! # }
//! # }
//! use opaque_ke::{ServerLogin, ServerLoginParameters, ServerRegistration, ServerSetup};
@@ -1135,8 +1135,8 @@
//! # let mut oprf_seed = YourRemoteSeed(GenericArray::default());
//! # OsRng.fill_bytes(&mut oprf_seed.0);
//! # let sk = Ristretto255::random_sk(&mut OsRng);
//! # let pk = Ristretto255::public_key(sk);
//! # let pk = Ristretto255::serialize_pk(pk);
//! # let pk = Ristretto255::public_key(&sk);
//! # let pk = Ristretto255::serialize_pk(&pk);
//! # let public_key = PublicKey::deserialize(&pk).unwrap();
//! # let remote_key = YourRemoteKey(sk);
//! # let mut server_rng = OsRng;
src/messages.rs
+1
View File
@@ -91,6 +91,7 @@ pub struct RegistrationUpload<CS: CipherSuite> {
/// The masking key used to mask the envelope
pub(crate) masking_key: Output<OprfHash<CS>>,
/// The user's public key
#[derive_where(skip(Zeroize))]
pub(crate) client_s_pk: PublicKey<KeGroup<CS>>,
}
src/opaque.rs
-88
View File
@@ -1157,91 +1157,3 @@ fn blind<CS: CipherSuite, R: RngCore + CryptoRng>(
Ok(result)
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for ClientRegistration<CS> {
fn assert_zeroized(&self) {
let Self {
oprf_client,
blinded_element,
} = self;
for byte in oprf_client
.serialize()
.iter()
.chain(&blinded_element.serialize())
{
assert_eq!(byte, &0);
}
}
}
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for ServerRegistration<CS>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
{
fn assert_zeroized(&self) {
let RegistrationUpload {
envelope,
masking_key,
client_s_pk,
} = &self.0;
envelope.assert_zeroized();
assert_eq!(masking_key, &GenericArray::default());
client_s_pk.assert_zeroized();
}
}
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for ClientLogin<CS>
where
<CS::KeyExchange as KeyExchange>::KE1State: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE1Message: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self {
ke1_state,
credential_request,
oprf_client,
} = self;
let CredentialRequest {
blinded_element,
ke1_message,
} = credential_request;
ke1_state.assert_zeroized();
ke1_message.assert_zeroized();
for byte in oprf_client
.serialize()
.iter()
.chain(&blinded_element.serialize())
{
assert_eq!(byte, &0);
}
}
}
#[cfg(test)]
impl<CS: CipherSuite> AssertZeroized for ServerLogin<CS>
where
PublicKey<KeGroup<CS>>: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE2State<CS>: AssertZeroized,
{
fn assert_zeroized(&self) {
let Self { ke2_state } = self;
ke2_state.assert_zeroized();
}
}
src/serialization/mod.rs
-5
View File
@@ -119,11 +119,6 @@ where
}
}
#[cfg(test)]
pub(crate) trait AssertZeroized {
fn assert_zeroized(&self);
}
#[cfg(test)]
mod tests;
src/serialization/tests.rs
+10 -10
View File
@@ -123,7 +123,7 @@ impl CipherSuite for SigmaIEd25519Ph {
fn random_point<CS: CipherSuite>() -> <KeGroup<CS> as Group>::Pk {
let mut rng = OsRng;
let sk = KeGroup::<CS>::random_sk(&mut rng);
KeGroup::<CS>::public_key(sk)
KeGroup::<CS>::public_key(&sk)
}
fn random_element<CS: CipherSuite>() -> <OprfGroup<CS> as voprf::Group>::Elem {
@@ -557,7 +557,7 @@ fn sigma_i_ecdsa_credential_response_roundtrip() -> Result<(), ProtocolError> {
CredentialResponseLen<CS>: ArrayLength<u8>,
{
let pt = random_point::<CS>();
let pt_bytes = KeGroup::<CS>::serialize_pk(pt);
let pt_bytes = KeGroup::<CS>::serialize_pk(&pt);
let mut rng = OsRng;
@@ -569,8 +569,8 @@ fn sigma_i_ecdsa_credential_response_roundtrip() -> Result<(), ProtocolError> {
rng.fill_bytes(&mut masked_response);
let server_e_kp = KeyPair::<KeGroup<CS>>::derive_random(&mut rng);
let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let r = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let mut mac = Output::<OprfHash<CS>>::default();
rng.fill_bytes(&mut mac);
let mut server_nonce = [0u8; NonceLen::USIZE];
@@ -662,8 +662,8 @@ fn sigma_i_ecdsa_credential_finalization_roundtrip() -> Result<(), ProtocolError
{
let mut rng = OsRng;
let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let r = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let mut mac = Output::<OprfHash<CS>>::default();
rng.fill_bytes(&mut mac);
@@ -845,8 +845,8 @@ fn sigma_i_ecdsa_ke2_message_roundtrip() -> Result<(), ProtocolError> {
rng.fill_bytes(&mut mac);
let mut server_nonce = vec![0u8; NonceLen::USIZE];
rng.fill_bytes(&mut server_nonce);
let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let r = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let ke2m: Vec<u8> = [
server_nonce.as_slice(),
@@ -910,8 +910,8 @@ fn sigma_i_ecdsa_ke3_message_roundtrip() -> Result<(), ProtocolError> {
<CS::KeyExchange as KeyExchange>::KE3Message: Deserialize + Serialize,
{
let mut rng = OsRng;
let r = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(KeGroup::<CS>::random_sk(&mut rng));
let r = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let s = KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut rng));
let mut mac = Output::<OprfHash<CS>>::default();
rng.fill_bytes(&mut mac);
src/tests/full_test.rs
+1 -285
View File
@@ -11,7 +11,7 @@
use core::ops::Add;
use std::string::String;
use std::vec::Vec;
use std::{format, println, ptr, vec};
use std::{format, println, vec};
use digest::Output;
use generic_array::typenum::{Sum, Unsigned};
@@ -36,7 +36,6 @@ use crate::messages::{
RegistrationResponseLen, RegistrationUploadLen,
};
use crate::opaque::*;
use crate::serialization::AssertZeroized;
use crate::tests::mock_rng::CycleRng;
use crate::*;
@@ -226,7 +225,6 @@ pub struct TestVectorParameters {
}
static STR_PASSWORD: &str = "password";
static STR_CREDENTIAL_IDENTIFIER: &str = "credential_identifier";
fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
values[key].as_str().and_then(|s| hex::decode(s).ok())
@@ -1218,288 +1216,6 @@ fn test_complete_flow_fail() -> Result<(), ProtocolError> {
Ok(())
}
// Zeroize tests
#[test]
fn test_zeroize_client_registration_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let mut state = client_registration_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let mut state = client_registration_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_registration_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
// RegistrationUpload: (KePk + Hash) + Envelope
<KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
ArrayLength<u8> + Add<EnvelopeLen<CS>>,
RegistrationUploadLen<CS>: ArrayLength<u8>,
// ServerRegistration = RegistrationUpload
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let mut state = p_file;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_login_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1State: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE1Message: AssertZeroized,
{
let mut client_rng = OsRng;
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let mut state = client_login_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE2State<CS>: Serialize + AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let mut state = server_login_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1State: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE1Message: AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let client_login_finish_result = client_login_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_login_start_result.message,
ClientLoginFinishParameters::default(),
)?;
let mut state = client_login_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_login_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE2State<CS>: Serialize + AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let client_login_finish_result = client_login_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_login_start_result.message,
ClientLoginFinishParameters::default(),
)?;
let server_login_finish_result = server_login_start_result.state.finish(
client_login_finish_result.message,
ServerLoginParameters::default(),
)?;
let mut state = server_login_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_scalar_always_nonzero() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
src/tests/test_opaque_vectors.rs
+1 -4
View File
@@ -98,10 +98,7 @@ fn populate_test_vectors<CS: CipherSuite>(values: &Value) -> OpaqueTestVectorPar
dummy_public_key: {
match decode(values, "client_public_key") {
Some(value) => value,
None => KeGroup::<CS>::serialize_pk(KeGroup::<CS>::public_key(
KeGroup::<CS>::random_sk(&mut OsRng),
))
.to_vec(),
None => KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut OsRng)).to_vec(),
}
},
dummy_masking_key: {