Merge pull request #12 from huitseeker/backports

Backports from the Key Exchange customization PR

.github/workflows/main.yml

@@ -30,9 +30,10 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: -- -D warnings
+          args: --all-features -- -D warnings
 
       - name: Run cargo test
         uses: actions-rs/cargo@v1
         with:
           command: test
+          args: --all-features

README.md

@@ -1,4 +1,4 @@
-##  The OPAQUE key exchange protocol
+##  The OPAQUE key exchange protocol ![Build Status](https://github.com/novifinancial/opaque-ke/workflows/Rust%20CI/badge.svg)
 
 [OPAQUE](https://eprint.iacr.org/2018/163.pdf) is an asymmetric password-authenticated key exchange protocol. It allows a client to authenticate to a server using a password, without ever having to expose the plaintext password to the server.
 

src/key_exchange.rs

@@ -6,8 +6,12 @@
 use crate::{
     errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError},
     keypair::{Key, KeyPair, SizedBytes},
+    sized_bytes_using_constant_and_try_from,
+};
+use generic_array::{
+    typenum::{U64, U96},
+    GenericArray,
 };
-use generic_array::GenericArray;
 use hkdf::Hkdf;
 use hmac::{Hmac, Mac, NewMac};
 use rand_core::{CryptoRng, RngCore};
@@ -28,19 +32,21 @@ pub(crate) const KE2_MESSAGE_LEN: usize = NONCE_LEN + 2 * KEY_LEN;
 
 static STR_3DH: &[u8] = b"3DH keys";
 
+#[derive(PartialEq, Eq)]
 pub(crate) struct KE1State {
     client_e_sk: Key,
     client_nonce: Vec<u8>,
     hashed_l1: Vec<u8>,
 }
 
+#[derive(PartialEq, Eq)]
 pub(crate) struct KE1Message {
     pub(crate) client_nonce: Vec<u8>,
     pub(crate) client_e_pk: Key,
 }
 
 impl TryFrom<&[u8]> for KE1State {
-    type Error = ProtocolError;
+    type Error = InternalPakeError;
 
     fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
         let checked_bytes = check_slice_size(bytes, KE1_STATE_LEN, "ke1_state")?;
@@ -65,6 +71,8 @@ impl KE1State {
     }
 }
 
+sized_bytes_using_constant_and_try_from!(KE1State, U96);
+
 impl KE1Message {
     pub fn to_bytes(&self) -> Vec<u8> {
         [&self.client_nonce[..], &self.client_e_pk.to_arr()].concat()
@@ -72,7 +80,7 @@ impl KE1Message {
 }
 
 impl TryFrom<&[u8]> for KE1Message {
-    type Error = ProtocolError;
+    type Error = InternalPakeError;
 
     fn try_from(ke1_message_bytes: &[u8]) -> Result<Self, Self::Error> {
         let checked_bytes =
@@ -85,6 +93,8 @@ impl TryFrom<&[u8]> for KE1Message {
     }
 }
 
+sized_bytes_using_constant_and_try_from!(KE1Message, U64);
+
 pub(crate) fn generate_ke1<R: RngCore + CryptoRng, KeyFormat: KeyPair<Repr = Key>>(
     l1_component: Vec<u8>,
     rng: &mut R,

src/keypair.rs

@@ -39,7 +39,7 @@ pub trait SizedBytes: Sized + PartialEq {
 }
 
 /// A Keypair trait with public-private verification
-pub trait KeyPair: Sized + Debug {
+pub trait KeyPair: Sized {
     /// The single key representation must have a specific byte size itself
     type Repr: SizedBytes + Clone;
 
@@ -68,10 +68,12 @@ pub trait KeyPair: Sized + Debug {
 
     /// Computes the diffie hellman function on a public key and private key
     fn diffie_hellman(pk: Self::Repr, sk: Self::Repr) -> Vec<u8>;
+}
 
+#[cfg(test)]
+trait KeyPairExt: KeyPair + Debug {
     /// Test-only strategy returning a proptest Strategy based on
     /// generate_random
-    #[cfg(test)]
     fn uniform_keypair_strategy() -> BoxedStrategy<Self> {
         // The no_shrink is because keypairs should be fixed -- shrinking would cause a different
         // keypair to be generated, which appears to not be very useful.
@@ -85,6 +87,64 @@ pub trait KeyPair: Sized + Debug {
     }
 }
 
+// blanket implementation
+#[cfg(test)]
+impl<KP> KeyPairExt for KP where KP: KeyPair + Debug {}
+
+/// This assumes you have defined:
+/// - an `impl TryFrom<&[u8b], Error = InternalPakeError>` for a non-generic `T`
+/// - an `fn to_bytes(&self) -> Vec<u8>` in an `impl T` block
+/// and it both of the above to produce a sensible SizedBytes implementation
+///
+/// Because SizedBytes has a strong notion of size, and TryFrom/to_bytes does
+/// not, it's better to use the macro below rather than this one, where possible.
+#[macro_export]
+macro_rules! sized_bytes_using_constant_and_try_from {
+    ($sized_type: ident, $len: ident) => {
+        impl SizedBytes for $sized_type {
+            type Len = $len;
+
+            fn to_arr(&self) -> generic_array::GenericArray<u8, Self::Len> {
+                generic_array::GenericArray::clone_from_slice(&self.to_bytes())
+            }
+
+            fn from_bytes(bytes: &[u8]) -> Result<Self, InternalPakeError> {
+                let checked_bytes = check_slice_size(
+                    bytes,
+                    <Self::Len as generic_array::typenum::Unsigned>::to_usize(),
+                    "bytes",
+                )?;
+                std::convert::TryFrom::try_from(checked_bytes)
+            }
+        }
+    };
+}
+
+/// This assumes you have defined a SizedBytes instance for a `T`, and defines:
+/// - an `impl TryFrom<&[u8b], Error = InternalPakeError>` for a non-generic `T`
+/// - an `fn to_bytes(&self) -> Vec<u8>` in an `impl T` block
+///
+/// Because SizedBytes has a strong notion of size, and TryFrom/to_bytes does
+/// not, it's better to use this macro than the one above, where possible.
+macro_rules! try_from_and_to_bytes_using_sized_bytes {
+    ($sized_type: ident) => {
+        impl TryFrom<&[u8]> for $sized_type {
+            type Error = InternalPakeError;
+
+            fn try_from(bytes: &[u8]) -> Result<Self, InternalPakeError> {
+                <$sized_type as SizedBytes>::from_bytes(bytes)
+            }
+        }
+
+        #[allow(dead_code)]
+        impl $sized_type {
+            fn to_bytes(&self) -> Vec<u8> {
+                self.to_arr().to_vec()
+            }
+        }
+    };
+}
+
 /// This is a blanket implementation of SizedBytes for any instance of KeyPair
 /// with any length of keys. This encodes that we serialize the public key
 /// first, followed by the private key in binary formats (and expect it in this
@@ -127,14 +187,6 @@ impl Deref for Key {
     }
 }
 
-impl TryFrom<Vec<u8>> for Key {
-    type Error = InternalPakeError;
-
-    fn try_from(key_bytes: Vec<u8>) -> Result<Self, Self::Error> {
-        Key::from_bytes(&key_bytes[..])
-    }
-}
-
 impl SizedBytes for Key {
     type Len = U32;
 
@@ -149,6 +201,8 @@ impl SizedBytes for Key {
     }
 }
 
+try_from_and_to_bytes_using_sized_bytes!(Key);
+
 /// A representation of an X25519 keypair according to RFC7748
 #[derive(Debug, PartialEq, Eq)]
 pub struct X25519KeyPair {

src/tests/opaque_ke_test.rs

@@ -391,7 +391,7 @@ fn test_r3() -> Result<(), PakeError> {
     .unwrap()
     .finish(
         RegisterSecondMessage::try_from(&parameters.r2[..]).unwrap(),
-        &Key::try_from(parameters.server_s_pk).unwrap(),
+        &Key::try_from(&parameters.server_s_pk[..]).unwrap(),
         &mut finish_registration_rng,
     )
     .unwrap();
@@ -456,7 +456,7 @@ fn test_l2() -> Result<(), PakeError> {
     let mut server_e_sk_rng = CycleRng::new(parameters.server_e_sk);
     let (l2, server_login) = ServerLogin::start::<AesgcmX255193dhNoSlowHash, _>(
         ServerRegistration::try_from(&parameters.password_file[..]).unwrap(),
-        &Key::try_from(parameters.server_s_sk).unwrap(),
+        &Key::try_from(&parameters.server_s_sk[..]).unwrap(),
         LoginFirstMessage::<EdwardsPoint>::try_from(&parameters.l1[..]).unwrap(),
         &mut server_e_sk_rng,
     )
@@ -481,7 +481,7 @@ fn test_l3() -> Result<(), PakeError> {
             .finish(
                 LoginSecondMessage::<Aes256Gcm, EdwardsPoint>::try_from(&parameters.l2[..])
                     .unwrap(),
-                &Key::try_from(parameters.server_s_pk)?,
+                &Key::try_from(&parameters.server_s_pk[..])?,
                 &mut client_e_sk_rng,
             )
             .unwrap();

src/tests/serialization.rs

@@ -6,6 +6,7 @@
 use crate::{
     ciphersuite::CipherSuite,
     group::Group,
+    key_exchange::{KE1Message, NONCE_LEN},
     keypair::{KeyPair, SizedBytes, X25519KeyPair},
     opaque::*,
     rkr_encryption::{RKRCipher as _, RKRCiphertext},
@@ -16,7 +17,7 @@ use curve25519_dalek::ristretto::RistrettoPoint;
 use chacha20poly1305::ChaCha20Poly1305;
 use rand_core::{OsRng, RngCore};
 
-use sha2::Digest;
+use sha2::{Digest, Sha256};
 use std::convert::TryFrom;
 
 struct Default;
@@ -130,3 +131,46 @@ fn register_third_message_roundtrip() {
     let r3_bytes = r3.to_bytes();
     assert_eq!(message, r3_bytes);
 }
+
+#[test]
+fn client_login_roundtrip() {
+    let pw = b"hunter2";
+    let mut rng = OsRng;
+    let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
+
+    let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+    let mut client_nonce = [0u8; NONCE_LEN];
+    rng.fill_bytes(&mut client_nonce);
+
+    let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat();
+    let mut hasher = Sha256::new();
+    hasher.update(l1_data);
+    let hashed_l1 = hasher.finalize();
+
+    // serialization order: scalar, password, ke1_state
+    let bytes: Vec<u8> = [
+        &sc.as_bytes()[..],
+        &pw[..],
+        client_e_kp.public(),
+        &client_nonce,
+        hashed_l1.as_slice(),
+    ]
+    .concat();
+    let reg = ClientLogin::<Default>::try_from(&bytes[..]).unwrap();
+    let reg_bytes = reg.to_bytes();
+    assert_eq!(reg_bytes, bytes);
+}
+
+#[test]
+fn login_first_message_roundtrip() {
+    let mut rng = OsRng;
+
+    let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
+    let mut client_nonce = [0u8; NONCE_LEN];
+    rng.fill_bytes(&mut client_nonce);
+
+    let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
+    let reg = KE1Message::try_from(&ke1m[..]).unwrap();
+    let reg_bytes = reg.to_bytes();
+    assert_eq!(reg_bytes, ke1m);
+}