vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Releases 3 Activity

Remove Zeroize Tests (#381)

Browse Source 
* Remove Zeroize tests

* Remove `Zeroize` requirements from `Group::Pk`

* Remove `Copy` requirements from `Group::Pk`

* Change to `ZeroizeOnDrop` requirements for `Group::Sk`

* Add note why we don't use `elliptic_curve::PublicKey`
This commit is contained in:
daxpedda
2025-07-17 13:15:30 -07:00
committed by GitHub
parent 1b6633cdcc
commit c04fb97b5c
21 changed files with 110 additions and 841 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/tests/full_test.rs
+1 -285
View File
@@ -11,7 +11,7 @@
use core::ops::Add;
use std::string::String;
use std::vec::Vec;
use std::{format, println, ptr, vec};
use std::{format, println, vec};
use digest::Output;
use generic_array::typenum::{Sum, Unsigned};
@@ -36,7 +36,6 @@ use crate::messages::{
RegistrationResponseLen, RegistrationUploadLen,
};
use crate::opaque::*;
use crate::serialization::AssertZeroized;
use crate::tests::mock_rng::CycleRng;
use crate::*;
@@ -226,7 +225,6 @@ pub struct TestVectorParameters {
}
static STR_PASSWORD: &str = "password";
static STR_CREDENTIAL_IDENTIFIER: &str = "credential_identifier";
fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
values[key].as_str().and_then(|s| hex::decode(s).ok())
@@ -1218,288 +1216,6 @@ fn test_complete_flow_fail() -> Result<(), ProtocolError> {
Ok(())
}
// Zeroize tests
#[test]
fn test_zeroize_client_registration_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let mut state = client_registration_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let mut state = client_registration_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_registration_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
// RegistrationUpload: (KePk + Hash) + Envelope
<KeGroup<CS> as Group>::PkLen: Add<OutputSize<OprfHash<CS>>>,
Sum<<KeGroup<CS> as Group>::PkLen, OutputSize<OprfHash<CS>>>:
ArrayLength<u8> + Add<EnvelopeLen<CS>>,
RegistrationUploadLen<CS>: ArrayLength<u8>,
// ServerRegistration = RegistrationUpload
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let mut state = p_file;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_login_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1State: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE1Message: AssertZeroized,
{
let mut client_rng = OsRng;
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let mut state = client_login_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE2State<CS>: Serialize + AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let mut state = server_login_start_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<CS::KeyExchange as KeyExchange>::KE1State: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE1Message: AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let client_login_finish_result = client_login_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_login_start_result.message,
ClientLoginFinishParameters::default(),
)?;
let mut state = client_login_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_zeroize_server_login_finish() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError>
where
<KeGroup<CS> as Group>::Pk: AssertZeroized,
<CS::KeyExchange as KeyExchange>::KE2State<CS>: Serialize + AssertZeroized,
{
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_setup = ServerSetup::<CS>::new(&mut server_rng);
let client_registration_start_result =
ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_registration_start_result = ServerRegistration::<CS>::start(
&server_setup,
client_registration_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
)?;
let client_registration_finish_result = client_registration_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_registration_start_result.message,
ClientRegistrationFinishParameters::default(),
)?;
let p_file = ServerRegistration::finish(client_registration_finish_result.message);
let client_login_start_result =
ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
let server_login_start_result = ServerLogin::<CS>::start(
&mut server_rng,
&server_setup,
Some(p_file),
client_login_start_result.message,
STR_CREDENTIAL_IDENTIFIER.as_bytes(),
ServerLoginParameters::default(),
)?;
let client_login_finish_result = client_login_start_result.state.finish(
&mut client_rng,
STR_PASSWORD.as_bytes(),
server_login_start_result.message,
ClientLoginFinishParameters::default(),
)?;
let server_login_finish_result = server_login_start_result.state.finish(
client_login_finish_result.message,
ServerLoginParameters::default(),
)?;
let mut state = server_login_finish_result.state;
unsafe { ptr::drop_in_place(&mut state) };
state.assert_zeroized();
Ok(())
}
triple_dh_ciphersuites!(run_all!(inner));
sigma_i_ciphersuites!(run_all!(inner));
Ok(())
}
#[test]
fn test_scalar_always_nonzero() -> Result<(), ProtocolError> {
fn inner<CS: CipherSuite>(_test_vector: &str) -> Result<(), ProtocolError> {
src/tests/test_opaque_vectors.rs
+1 -4
View File
@@ -98,10 +98,7 @@ fn populate_test_vectors<CS: CipherSuite>(values: &Value) -> OpaqueTestVectorPar
dummy_public_key: {
match decode(values, "client_public_key") {
Some(value) => value,
None => KeGroup::<CS>::serialize_pk(KeGroup::<CS>::public_key(
KeGroup::<CS>::random_sk(&mut OsRng),
))
.to_vec(),
None => KeGroup::<CS>::serialize_sk(&KeGroup::<CS>::random_sk(&mut OsRng)).to_vec(),
}
},
dummy_masking_key: {