P256 implementation (#213)

* Initial P256 implementation * Add P256 VOPRF test vectors * Fix implementation * Forgot `Cargo.toml` and CI * Fix MSRV * Fix MSRV tests * Remove accidental leftovers * Document constants * Use included constant time checks * Add P-256 VOPRF test vector checks * Remove unnecessary bound on `CipherSuite::Group` * P-256 improvement and fixes * Add OPAQUE test vectors for P-256 * Remove fixed key size for 3DH * Hide P-256 test vectors behind feature flag * Split `Group` into modules * Fix `hash_to_scalar` * Point to source * Move constants to `once_cell` Co-authored-by: Kevin Lewi <[email protected]>
2021-07-30 16:02:02 -07:00
parent 2373ca8680
commit e491c1b533
11 changed files with 1074 additions and 167 deletions
@@ -0,0 +1,111 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::errors::InternalPakeError;
+
+use curve25519_dalek::{
+    constants::RISTRETTO_BASEPOINT_POINT,
+    ristretto::{CompressedRistretto, RistrettoPoint},
+    scalar::Scalar,
+    traits::Identity,
+};
+use generic_array::{
+    typenum::{U32, U64},
+    GenericArray,
+};
+use std::convert::TryInto;
+
+use rand::{CryptoRng, RngCore};
+
+use super::Group;
+
+/// The implementation of such a subgroup for Ristretto
+impl Group for RistrettoPoint {
+    type Scalar = Scalar;
+    type ScalarLen = U32;
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalPakeError> {
+        let mut bits = [0u8; 32];
+        bits.copy_from_slice(scalar_bits);
+        Ok(Scalar::from_bytes_mod_order(bits))
+    }
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar;
+            }
+        }
+    }
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
+        scalar.to_bytes().into()
+    }
+    fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar {
+        scalar.invert()
+    }
+
+    // The byte length necessary to represent group elements
+    type ElemLen = U32;
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalPakeError> {
+        CompressedRistretto::from_slice(element_bits)
+            .decompress()
+            .ok_or(InternalPakeError::PointError)
+    }
+    // serialization of a group element
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
+        let c = self.compress();
+        *GenericArray::from_slice(c.as_bytes())
+    }
+
+    type UniformBytesLen = U64;
+    fn hash_to_curve(
+        uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>,
+    ) -> Result<Self, InternalPakeError> {
+        // https://caniuse.rs/features/array_gt_32_impls
+        let bits: [u8; 64] = {
+            let mut bytes = [0u8; 64];
+            bytes.copy_from_slice(uniform_bytes);
+            bytes
+        };
+        Ok(RistrettoPoint::from_uniform_bytes(&bits))
+    }
+
+    fn base_point() -> Self {
+        RISTRETTO_BASEPOINT_POINT
+    }
+
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        let arr: [u8; 32] = scalar.as_slice().try_into().expect("Wrong length");
+        self * Scalar::from_bits(arr)
+    }
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool {
+        self == &Self::identity()
+    }
+
+    fn ct_equal(&self, other: &Self) -> bool {
+        constant_time_eq::constant_time_eq(&self.to_arr(), &other.to_arr())
+    }
+}