vexahub/opaque-vx
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions 1 Releases 3 Activity

Remove SignalKeyPair, rename all instances of SignalKeyPair to X25519KeyPair, pass all tests.

Browse Source
This commit is contained in:
François Garillot
2020-06-13 09:07:55 -04:00
parent e9add9fd7a
commit e9fa474c58
3 changed files with 23 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/keypair.rs
-130
View File
@@ -219,93 +219,9 @@ impl KeyPair for X25519KeyPair {
}
}
/// A custom, minimalistic Key pair struct built on Key, aimed at reproducing the behavior of libsignal's keypairs
#[derive(Debug, PartialEq, Eq)]
pub struct SignalKeyPair {
pk: Key,
sk: Key,
}
impl SignalKeyPair {
fn clamp_scalar(mut scalar: [u8; 32]) -> ::curve25519_dalek::scalar::Scalar {
scalar[0] &= 248;
scalar[31] &= 127;
scalar[31] |= 64;
::curve25519_dalek::scalar::Scalar::from_bits(scalar)
}
fn gen<R: RngCore + CryptoRng>(rng: &mut R) -> (Vec<u8>, Vec<u8>) {
let mut bits = [0u8; 32];
rng.fill_bytes(&mut bits);
// It's proper to sanitize the scalar here, and reproduces x25519::StaticSecret::new
let sk = SignalKeyPair::clamp_scalar(bits);
let pk = ::curve25519_dalek::constants::X25519_BASEPOINT * sk;
(pk.as_bytes().to_vec(), sk.as_bytes().to_vec())
}
}
impl KeyPair for SignalKeyPair {
type Repr = Key;
fn public(&self) -> &Self::Repr {
&self.pk
}
fn private(&self) -> &Self::Repr {
&self.sk
}
fn new(public: Self::Repr, private: Self::Repr) -> Result<Self, InternalPakeError> {
Ok(SignalKeyPair {
pk: public,
sk: private,
})
}
fn generate_random<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalPakeError> {
let (public, private) = SignalKeyPair::gen(rng);
Ok(SignalKeyPair {
pk: Key(public),
sk: Key(private),
})
}
fn public_from_private(secret: &Self::Repr) -> Self::Repr {
let mut secret_data = [0u8; 32];
secret_data.copy_from_slice(&secret.0[..]);
let base_data = ::x25519_dalek::X25519_BASEPOINT_BYTES;
Key(::x25519_dalek::x25519(secret_data, base_data).to_vec())
}
fn check_public_key(key: Self::Repr) -> Result<Self::Repr, InternalPakeError> {
let mut key_bytes = [0u8; 32];
key_bytes.copy_from_slice(&key);
let point = ::curve25519_dalek::montgomery::MontgomeryPoint(key_bytes)
.to_edwards(1)
.ok_or(InternalPakeError::PointError)?;
if !point.is_torsion_free() {
Err(InternalPakeError::SubGroupError)
} else {
Ok(key)
}
}
fn diffie_hellman(pk: Self::Repr, sk: Self::Repr) -> Vec<u8> {
let mut pk_data = [0; 32];
pk_data.copy_from_slice(&pk.0[..]);
let mut sk_data = [0; 32];
sk_data.copy_from_slice(&sk.0[..]);
::x25519_dalek::x25519(sk_data, pk_data).to_vec()
}
}
#[cfg(test)]
mod tests {
use super::*;
use proptest::prelude::*;
proptest! {
#[test]
@@ -321,51 +237,5 @@ mod tests {
prop_assert_eq!(&X25519KeyPair::public_from_private(sk), pk);
}
#[test]
fn test_signal_check(kp in SignalKeyPair::uniform_keypair_strategy()) {
let pk = kp.public();
prop_assert!(SignalKeyPair::check_public_key(pk.clone()).is_ok());
}
#[test]
fn test_signal_pub_from_priv(kp in SignalKeyPair::uniform_keypair_strategy()) {
let pk = kp.public();
let sk = kp.private();
prop_assert_eq!(&SignalKeyPair::public_from_private(sk), pk);
}
#[test]
fn test_signal_x25519_roundtrips(kp_signal in SignalKeyPair::uniform_keypair_strategy(),
kp_x25519 in X25519KeyPair::uniform_keypair_strategy()) {
let kp_signal_bytes: &[u8] = &kp_signal.to_arr();
let kp_x25519_bytes: &[u8] = &kp_x25519.to_arr();
let reinterpret_signal = X25519KeyPair::from_bytes(kp_signal_bytes).unwrap();
let reinterpret_x25519 = SignalKeyPair::from_bytes(kp_x25519_bytes).unwrap();
prop_assert_eq!(kp_signal_bytes, &reinterpret_signal.to_arr()[..]);
prop_assert_eq!(kp_x25519_bytes, &reinterpret_x25519.to_arr()[..]);
}
#[test]
fn test_signal_as_x25519(kp_signal in SignalKeyPair::uniform_keypair_strategy()) {
let kp: X25519KeyPair = X25519KeyPair::from_bytes(&kp_signal.to_arr()).unwrap();
let pk = kp.public();
prop_assert!(X25519KeyPair::check_public_key(pk.clone()).is_ok());
let sk = kp.private();
prop_assert_eq!(&X25519KeyPair::public_from_private(sk), pk);
}
#[test]
fn test_x25519_as_signal(kp_x25519 in X25519KeyPair::uniform_keypair_strategy()) {
let kp: SignalKeyPair = SignalKeyPair::from_bytes(&kp_x25519.to_arr()).unwrap();
let pk = kp.public();
prop_assert!(SignalKeyPair::check_public_key(pk.clone()).is_ok());
let sk = kp.private();
prop_assert_eq!(&SignalKeyPair::public_from_private(sk), pk);
}
}
}
src/tests/opaque_ke_test.rs
+17 -17
View File
@@ -7,7 +7,7 @@ use crate::{
errors::*,
group::Group,
key_exchange::NONCE_LEN,
keypair::{Key, KeyPair, SignalKeyPair},
keypair::{Key, KeyPair, X25519KeyPair},
opaque::*,
slow_hash::NoOpHash,
tests::mock_rng::CycleRng,
@@ -215,10 +215,10 @@ fn generate_parameters() -> TestVectorParameters {
let mut rng = OsRng;
// Inputs
let server_s_kp = SignalKeyPair::generate_random(&mut rng).unwrap();
let server_e_kp = SignalKeyPair::generate_random(&mut rng).unwrap();
let client_s_kp = SignalKeyPair::generate_random(&mut rng).unwrap();
let client_e_kp = SignalKeyPair::generate_random(&mut rng).unwrap();
let server_s_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let server_e_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let client_s_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let client_e_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
let password = b"password";
let pepper = b"pepper";
let mut blinding_factor_raw = [0u8; 64];
@@ -245,7 +245,7 @@ fn generate_parameters() -> TestVectorParameters {
let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec());
let (r2, server_registration) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(r1, &mut oprf_key_rng)
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(r1, &mut oprf_key_rng)
.unwrap();
let r2_bytes = r2.to_bytes().to_vec();
let oprf_key = server_registration.oprf_key;
@@ -258,7 +258,7 @@ fn generate_parameters() -> TestVectorParameters {
let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
let (r3, opaque_key_registration) = client_registration
.finish::<_, SignalKeyPair, NoOpHash>(
.finish::<_, X25519KeyPair, NoOpHash>(
r2,
server_s_kp.public(),
&mut finish_registration_rng,
@@ -275,7 +275,7 @@ fn generate_parameters() -> TestVectorParameters {
client_login_start.extend_from_slice(&client_nonce);
let mut client_login_start_rng = CycleRng::new(client_login_start);
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
password,
Some(pepper),
&mut client_login_start_rng,
@@ -363,7 +363,7 @@ fn test_r2() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let mut oprf_key_rng = CycleRng::new(parameters.oprf_key);
let (r2, server_registration) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
RegisterFirstMessage::try_from(&parameters.r1[..]).unwrap(),
&mut oprf_key_rng,
)
@@ -387,7 +387,7 @@ fn test_r3() -> Result<(), PakeError> {
&parameters.client_registration_state[..],
)
.unwrap()
.finish::<CycleRng, SignalKeyPair, NoOpHash>(
.finish::<CycleRng, X25519KeyPair, NoOpHash>(
RegisterSecondMessage::try_from(&parameters.r2[..]).unwrap(),
&Key::try_from(parameters.server_s_pk).unwrap(),
&mut finish_registration_rng,
@@ -408,7 +408,7 @@ fn test_password_file() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let server_registration =
ServerRegistration::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::try_from(
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::try_from(
&parameters.server_registration_state[..],
)
.unwrap();
@@ -434,7 +434,7 @@ fn test_l1() -> Result<(), PakeError> {
]
.concat();
let mut client_login_start_rng = CycleRng::new(client_login_start);
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(
let (l1, client_login) = ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
&parameters.password,
Some(&parameters.pepper),
&mut client_login_start_rng,
@@ -453,7 +453,7 @@ fn test_l2() -> Result<(), PakeError> {
let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
let mut server_e_sk_rng = CycleRng::new(parameters.server_e_sk);
let (l2, server_login) = ServerLogin::start::<_, Aes256Gcm, _, SignalKeyPair>(
let (l2, server_login) = ServerLogin::start::<_, Aes256Gcm, _, X25519KeyPair>(
ServerRegistration::try_from(&parameters.password_file[..]).unwrap(),
&Key::try_from(parameters.server_s_sk).unwrap(),
LoginFirstMessage::<EdwardsPoint>::try_from(&parameters.l1[..]).unwrap(),
@@ -475,7 +475,7 @@ fn test_l3() -> Result<(), PakeError> {
let mut client_e_sk_rng = CycleRng::new(parameters.client_e_sk.to_vec());
let (l3, shared_secret, opaque_key_login) =
ClientLogin::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::try_from(
ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::try_from(
&parameters.client_login_state[..],
)
.unwrap()
@@ -522,14 +522,14 @@ fn test_complete_flow(
) -> Result<(), ProtocolError> {
let mut client_rng = OsRng;
let mut server_rng = OsRng;
let server_kp = SignalKeyPair::generate_random(&mut server_rng)?;
let server_kp = X25519KeyPair::generate_random(&mut server_rng)?;
let (register_m1, client_state) = ClientRegistration::<Aes256Gcm, EdwardsPoint>::start(
registration_password,
None,
&mut client_rng,
)?;
let (register_m2, server_state) =
ServerRegistration::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(
ServerRegistration::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
register_m1,
&mut server_rng,
)?;
@@ -537,7 +537,7 @@ fn test_complete_flow(
client_state.finish::<_, _, NoOpHash>(register_m2, server_kp.public(), &mut client_rng)?;
let p_file = server_state.finish(register_m3)?;
let (login_m1, client_login_state) =
ClientLogin::<Aes256Gcm, EdwardsPoint, SignalKeyPair>::start(
ClientLogin::<Aes256Gcm, EdwardsPoint, X25519KeyPair>::start(
login_password,
None,
&mut client_rng,
src/tests/serialization.rs
+6 -6
View File
@@ -5,7 +5,7 @@
use crate::{
group::Group,
keypair::{KeyPair, SignalKeyPair, SizedBytes},
keypair::{KeyPair, SizedBytes, X25519KeyPair},
opaque::*,
rkr_encryption::{RKRCipher as _, RKRCiphertext},
};
@@ -43,7 +43,7 @@ fn server_registration_roundtrip() {
let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
let mut oprf_bytes: Vec<u8> = vec![];
oprf_bytes.extend_from_slice(sc.as_bytes());
let reg = ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, SignalKeyPair>::try_from(
let reg = ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(
&oprf_bytes[..],
)
.unwrap();
@@ -55,14 +55,14 @@ fn server_registration_roundtrip() {
let mut mock_rkr_bytes = vec![0u8; rkr_size];
rng.fill_bytes(&mut mock_rkr_bytes);
println!("{}", mock_rkr_bytes.len());
let mock_client_kp = SignalKeyPair::generate_random(&mut rng).unwrap();
let mock_client_kp = X25519KeyPair::generate_random(&mut rng).unwrap();
// serialization order: scalar, public key, envelope
let mut bytes = Vec::<u8>::new();
bytes.extend_from_slice(sc.as_bytes());
bytes.extend_from_slice(&mock_client_kp.public().to_arr());
bytes.extend_from_slice(&mock_rkr_bytes);
let reg =
ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, SignalKeyPair>::try_from(&bytes[..])
ServerRegistration::<ChaCha20Poly1305, RistrettoPoint, X25519KeyPair>::try_from(&bytes[..])
.unwrap();
let reg_bytes = reg.to_bytes();
assert_eq!(reg_bytes, bytes);
@@ -91,7 +91,7 @@ fn register_second_message_roundtrip() {
#[test]
fn register_third_message_roundtrip() {
let mut rng = OsRng;
let skp = SignalKeyPair::generate_random(&mut rng).unwrap();
let skp = X25519KeyPair::generate_random(&mut rng).unwrap();
let pubkey_bytes = skp.public().to_arr();
let mut encryption_key = [0u8; 32];
@@ -113,7 +113,7 @@ fn register_third_message_roundtrip() {
let message: Vec<u8> = [&ciphertext.to_bytes(), &pubkey_bytes[..]].concat();
let r3 =
RegisterThirdMessage::<ChaCha20Poly1305, SignalKeyPair>::try_from(&message[..]).unwrap();
RegisterThirdMessage::<ChaCha20Poly1305, X25519KeyPair>::try_from(&message[..]).unwrap();
let r3_bytes = r3.to_bytes();
assert_eq!(message, r3_bytes);
}