Backport zeroize fix (#266)

* Backport `zeroize` fix

* Update version

* Fix CI

* Remove bench for CI MSRV

* Downgrade rustyline for MSRV

* Downgrade proptest for MSRV

* Downgrade zeroize for MSRV

.github/workflows/main.yml

@@ -2,7 +2,6 @@ name: Rust CI
 on:
   push:
     branches:
-      - tls
       - master
   pull_request:
     types: [opened, repoened, synchronize]
@@ -16,16 +15,19 @@ jobs:
         backend_feature:
           - u64_backend
           - u32_backend
+        toolchain:
+          - nightly
+          - 1.41.0
     name: test
     steps:
       - name: Checkout sources
         uses: actions/checkout@v2
 
-      - name: Install nightly toolchain
+      - name: Install ${{ matrix.toolchain }} toolchain
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: nightly
+          toolchain: ${{ matrix.toolchain }}
           override: true
           components: rustfmt, clippy
 
@@ -35,25 +37,103 @@ jobs:
           command: test
           args: --no-default-features --features ${{ matrix.backend_feature }}
 
-  benches:
-    name: cargo bench compilation
+  cross-test:
+    name: Test on ${{ matrix.target }} (using cross)
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          # 32-bit x86
+          - i686-unknown-linux-gnu
+        backend_feature:
+          - u64_backend
+          - u32_backend
     steps:
+      - uses: actions/checkout@v2
+      - uses: hecrj/setup-rust-action@v1
+      - run: cargo install cross
+      # Note: just use `cross` as you would `cargo`, but always
+      # pass the `--target=${{ matrix.target }}` arg. (Yes, really).
+      - run: cross test --verbose --target=${{ matrix.target }} --no-default-features --features ${{ matrix.backend_feature }}
+
+
+  slow-hash-test:
+    name: Test on ${{ matrix.target }} with slow hash
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        backend_feature:
+          - u64_backend
+          - u32_backend
+    steps:
+      - uses: actions/checkout@v2
+      - uses: hecrj/setup-rust-action@v1
+      - run: cargo test --verbose --features slow-hash --no-default-features --features ${{ matrix.backend_feature }}
+
+  serde-test:
+    name: Test on ${{ matrix.target }} with serde support
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        backend_feature:
+          - u64_backend
+          - u32_backend
+    steps:
+      - uses: actions/checkout@v2
+      - uses: hecrj/setup-rust-action@v1
+      - run: cargo test --verbose --features serialize --no-default-features --features ${{ matrix.backend_feature }}
+
+
+  simple-login-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain:
+          - nightly
+          - 1.41.0
+    name: test simple_login command-line example
+    steps:
+      - name: install expect
+        run: sudo apt-get install expect
       - name: Checkout sources
         uses: actions/checkout@v2
-
-      - name: Install nightly toolchain
+      - name: install rust
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: stable
+          toolchain: ${{ matrix.toolchain }}
           override: true
+          components: rustfmt, clippy
+      - name: Run expect (which then runs cargo run)
+        run: expect -f scripts/simple_login.exp
 
-      - name: Run cargo bench --no-run
-        uses: actions-rs/cargo@v1
+  digital-locker-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain:
+          - nightly
+          - 1.41.0
+    name: test digital_locker command-line example
+    steps:
+      - name: install expect
+        run: sudo apt-get install expect
+      - name: Checkout sources
+        uses: actions/checkout@v2
+      - name: install rust
+        uses: actions-rs/toolchain@v1
         with:
-          command: bench
-          args: --features "bench" --no-run
+          profile: minimal
+          toolchain: ${{ matrix.toolchain }}
+          override: true
+          components: rustfmt, clippy
+      - name: Run expect (which then runs cargo run)
+        run: expect -f scripts/digital_locker.exp
 
   clippy:
     name: cargo clippy

.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: Publish
+
+on:
+  release:
+    types: [published] # Only publish to crates.io when we formally publish a release
+  # For more on how to formally release on Github, read https://help.github.com/en/articles/creating-releases
+
+jobs:
+  publish:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+
+    steps:
+    - uses: hecrj/setup-rust-action@v1
+      with:
+        rust-version: ${{ matrix.rust }}
+    - uses: actions/checkout@master
+    - name: Login to crates.io
+      run: cargo login $CRATES_IO_TOKEN
+      env:
+        CRATES_IO_TOKEN: ${{ secrets.crates_io_token }} # https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets
+    - name: Dry run publish opaque-ke
+      run: cargo publish --dry-run --manifest-path Cargo.toml
+    - name: Publish opaque-ke
+      run: cargo publish --manifest-path Cargo.toml
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ secrets.crates_io_token }}

.gitignore

@@ -2,4 +2,5 @@
 .vscode/
 src/.DS_Store
 /target
+Cargo.lock
 **/*.rs.bk

CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.6.1 (January 25, 2022)
+
+* Fix `zeroize` implementing `Drop` on `enum`s now
+
+## 0.6.0 (June 30, 2021)
+
+* Synced implementation with draft-irtf-cfrg-opaque-05, which changes
+  the envelope structure and introduces a ServerSetup object to be
+  maintained by the server
+* Various security improvements: non-zero scalars, zeroizing on drop,
+  constant-time operations
+* Adding serde support behind a feature
+* Supporting common traits (eb59676)
+* Swapping out scrypt for argon2 (535b9b8) for the slow-hash feature
+* Adding support for common traits on public structs
+* Updated dependencies
+
+## 0.5.0 (March 1, 2021)
+
+* Removed dependency on generic-bytes-derive package
+
+## 0.4.0 (February 26, 2021)
+
+* Adherence to protocol format described in
+  https://tools.ietf.org/html/draft-irtf-cfrg-opaque-03
+* Renamed to_bytes() and try_from() to serialize() and deserialize() for
+  top-level structs
+* Conformed all message type parameters to be parameterized in the
+  Ciphersuite object
+
+## 0.3.1 (February 11, 2021)
+
+* Re-exporting the rand library (and including it as a dependency instead of
+  just rand_core)
+* Exposing a convenience function for converting from byte array to Key type
+
+## 0.3.0 (February 8, 2021)
+
+* General API and documentation improvements, including the support of custom
+  identifiers, optional result parameters, and the use of the export key
+* Compliance with RFC 8017 on data serialization functions (I2OSP / OS2IP)
+* Adherence to protocol format described in
+  https://tools.ietf.org/html/draft-irtf-cfrg-opaque-02
+* Added parameters for key exchange additional data
+* Added simple_login and digital_locker examples
+
 ## 0.2.1 (October 22, 2020)
 
 * Changed visibility of hash module to be public

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "opaque-ke"
-version = "0.2.1"
+version = "0.6.1"
 repository = "https://github.com/novifinancial/opaque-ke"
 keywords = ["cryptography", "crypto", "opaque", "passwords", "authentication"]
 description = "An implementation of the OPAQUE password-authenticated key exchange protocol"
@@ -10,39 +10,37 @@ edition = "2018"
 readme = "README.md"
 
 [features]
-default = ["u64_backend"]
-slow-hash = ["scrypt"]
+default = ["u64_backend", "serialize"]
+slow-hash = ["argon2"]
 bench = []
-u64_backend = ["curve25519-dalek/u64_backend", "x25519-dalek/u64_backend"]
-u32_backend = ["curve25519-dalek/u32_backend", "x25519-dalek/u32_backend"]
+u64_backend = ["curve25519-dalek/u64_backend"]
+u32_backend = ["curve25519-dalek/u32_backend"]
+serialize = ["serde", "base64", "generic-array/serde", "curve25519-dalek/serde"]
 
 [dependencies]
-curve25519-dalek = { version = "3.0.0", default-features = false, features = ["std"] }
+argon2 = { version = "0.2", optional = true }
+base64 = { version = "0.13", optional = true }
+curve25519-dalek = { version = "3.1.0", default-features = false, features = ["std"] }
 digest = "0.9.0"
 displaydoc = "0.1.7"
-fiat-crypto = { version = "0.1.5"}
 generic-array = "0.14.4"
-hkdf = "0.9.0"
-hmac = "0.9.0"
-rand_core = "0.5.1"
-scrypt = { version = "0.4.1", optional = true }
-sha2 = "0.9.1"
-subtle = { version = "^2.2.1", default-features = false }
-thiserror = "1.0.20"
-x25519-dalek = { version = "1.0.1", default-features = false, features = ["std"] }
-zeroize = "1.1"
+generic-bytes = { version = "0.1.0" }
+hkdf = "0.11.0"
+hmac = "0.11.0"
+rand = "0.8"
+serde = { version = "1", features = ["derive"], optional = true }
+subtle = { version = "2.3.0", default-features = false }
+thiserror = "1.0.22"
+zeroize = { version = "~1.1", features = ["zeroize_derive"] }
 
 [dev-dependencies]
-anyhow = "1.0.32"
-base64 = "0.12.3"
-criterion = "0.3.3"
+anyhow = "1.0.35"
+base64 = "0.13.0"
+bincode = "1"
+chacha20poly1305 = "0.7.1"
 hex = "0.4.2"
 lazy_static = "1.4.0"
-serde_json = "1.0.57"
-proptest = "0.10.1"
-rand = "0.7"
-
-[[bench]]
-name = "oprf"
-harness = false
-required-features = ["bench"]
+serde_json = "1.0.60"
+sha2 = "0.9.2"
+proptest = "0.3"
+rustyline = "1"

README.md

@@ -14,7 +14,7 @@ OPAQUE is a PKI-free aPAKE that is secure against pre-computation attacks and ca
 Documentation
 -------------
 
-The API can be found [here](https://docs.rs/opaque-ke/) along with an example for usage.
+The API can be found [here](https://docs.rs/opaque-ke/) along with an example for usage. More examples can be found in the [examples](./examples) directory.
 
 Installation
 ------------
@@ -22,15 +22,16 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-opaque-ke = "0.2.1"
+opaque-ke = "0.6.1"
 ```
 
 Resources
 ---------
 
 - [OPAQUE academic publication](https://eprint.iacr.org/2018/163.pdf), including formal definitions and a proof of security
-- [draft-krawczyk-cfrg-opaque-05](https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-06), containing a specification for the OPAQUE protocol
+- [draft-irtf-cfrg-opaque-05](https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-05.html), containing a detailed (byte-level) specification for OPAQUE
 - ["Let's talk about PAKE"](https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/), an introductory blog post written by Matthew Green that covers OPAQUE
+- [opaque-wasm](https://github.com/marucjmar/opaque-wasm), a WebAssembly package for this library
 
 Contributors
 ------------
@@ -41,7 +42,7 @@ To learn more about contributing to this project, [see this document](./CONTRIBU
 
 #### Acknowledgments
 
-Special thanks go to Hugo Krawczyk for helping to clarify discrepancies and making suggestions for improving
+Special thanks go to Hugo Krawczyk and Chris Wood for helping to clarify discrepancies and making suggestions for improving
 this implementation.
 
 

benches/oprf.rs

@@ -1,145 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under the MIT license found in the
-// LICENSE file in the root directory of this source tree.
-
-#[macro_use]
-extern crate criterion;
-
-use criterion::Criterion;
-use curve25519_dalek::edwards::EdwardsPoint;
-use curve25519_dalek::ristretto::RistrettoPoint;
-use generic_array::arr;
-use opaque_ke::{
-    group::Group,
-    oprf::{generate_oprf1_shim, generate_oprf2_shim, generate_oprf3_shim, OprfClientBytes},
-};
-use rand::{prelude::ThreadRng, thread_rng};
-use sha2::Sha256;
-
-fn oprf1(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    c.bench_function("generate_oprf1 with Ristretto", move |b| {
-        b.iter(|| {
-            let OprfClientBytes {
-                alpha: _alpha,
-                blinding_factor: _blinding_factor,
-            } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
-        })
-    });
-}
-
-fn oprf1_edwards(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    c.bench_function("generate_oprf1 with Edwards", move |b| {
-        b.iter(|| {
-            let OprfClientBytes {
-                alpha: _alpha,
-                blinding_factor: _blinding_factor,
-            } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
-        })
-    });
-}
-
-fn oprf2(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    let OprfClientBytes {
-        alpha,
-        blinding_factor: _blinding_factor,
-    } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
-    let salt_bytes = arr![
-        u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
-        24, 25, 26, 27, 28, 29, 30, 31, 32,
-    ];
-    let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
-
-    c.bench_function("generate_oprf2 with Ristretto", move |b| {
-        b.iter(|| {
-            let _beta = generate_oprf2_shim::<RistrettoPoint>(alpha, &salt).unwrap();
-        })
-    });
-}
-
-fn oprf2_edwards(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    let OprfClientBytes {
-        alpha,
-        blinding_factor: _blinding_factor,
-    } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
-    let salt_bytes = arr![
-        u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
-        24, 25, 26, 27, 28, 29, 30, 31, 32,
-    ];
-    let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
-
-    c.bench_function("generate_oprf2 with Edwards", move |b| {
-        b.iter(|| {
-            let _beta = generate_oprf2_shim::<EdwardsPoint>(alpha, &salt).unwrap();
-        })
-    });
-}
-
-fn oprf3(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    let OprfClientBytes {
-        alpha,
-        blinding_factor,
-    } = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
-    let salt_bytes = arr![
-        u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
-        24, 25, 26, 27, 28, 29, 30, 31, 32,
-    ];
-    let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
-    let beta = generate_oprf2_shim::<RistrettoPoint>(alpha, &salt).unwrap();
-
-    c.bench_function("generate_oprf3 with Ristretto", move |b| {
-        b.iter(|| {
-            let _res = generate_oprf3_shim::<RistrettoPoint, Sha256>(input, beta, &blinding_factor)
-                .unwrap();
-        })
-    });
-}
-
-fn oprf3_edwards(c: &mut Criterion) {
-    let mut csprng: ThreadRng = thread_rng();
-    let input = b"hunter2";
-
-    let OprfClientBytes {
-        alpha,
-        blinding_factor,
-    } = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
-    let salt_bytes = arr![
-        u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
-        24, 25, 26, 27, 28, 29, 30, 31, 32,
-    ];
-    let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
-    let beta = generate_oprf2_shim::<EdwardsPoint>(alpha, &salt).unwrap();
-
-    c.bench_function("generate_oprf3 with Edwards", move |b| {
-        b.iter(|| {
-            let _res =
-                generate_oprf3_shim::<EdwardsPoint, Sha256>(input, beta, &blinding_factor).unwrap();
-        })
-    });
-}
-
-criterion_group!(
-    oprf_benches,
-    oprf1,
-    oprf2,
-    oprf3,
-    oprf1_edwards,
-    oprf2_edwards,
-    oprf3_edwards
-);
-criterion_main!(oprf_benches);

deny.toml

@@ -34,7 +34,7 @@ targets = [
 # The path where the advisory database is cloned/fetched into
 db-path = "~/.cargo/advisory-db"
 # The url of the advisory database to use
-db-url = "https://github.com/rustsec/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
 # The lint level for security vulnerabilities
 vulnerability = "deny"
 # The lint level for unmaintained crates
@@ -44,7 +44,7 @@ yanked = "warn"
 # The lint level for crates with security notices. Note that as of
 # 2019-12-17 there are no security notice advisories in
 # https://github.com/rustsec/advisory-db
-notice = "warn"
+notice = "deny"
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [

examples/digital_locker.rs

@@ -0,0 +1,329 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Demonstrates an implementation of a server-side secured digital locker using
+//! the client's OPAQUE export key, over a command-line interface
+//!
+//! A client can password-protect a secret message to be stored in a digital locker,
+//! controlled by the server. The locker's contents are only revealed to the holder
+//! of the password when attempting to open the locker.
+//!
+//! The client-server interactions are executed in a three-step protocol
+//! within the account_registration (for password registration) and
+//! account_login (for password login) functions. These steps
+//! must be performed in the specific sequence outlined in each of these
+//! functions.
+//!
+//! The CipherSuite trait allows the application to configure the
+//! primitives used by OPAQUE, but must be kept consistent across the steps
+//! of the protocol.
+//!
+//! In a more realistic client-server interaction, the client must send
+//! messages over "the wire" to the server. These bytes are serialized
+//! and explicitly annotated in the below functions.
+
+use chacha20poly1305::aead::{Aead, NewAead};
+use chacha20poly1305::{ChaCha20Poly1305, Key, Nonce};
+use rustyline::error::ReadlineError;
+use rustyline::Editor;
+use std::process::exit;
+
+use opaque_ke::{
+    ciphersuite::CipherSuite,
+    rand::{rngs::OsRng, RngCore},
+    ClientLogin, ClientLoginFinishParameters, ClientRegistration,
+    ClientRegistrationFinishParameters, CredentialFinalization, CredentialRequest,
+    CredentialResponse, RegistrationRequest, RegistrationResponse, RegistrationUpload, ServerLogin,
+    ServerLoginStartParameters, ServerRegistration, ServerSetup,
+};
+
+// The ciphersuite trait allows to specify the underlying primitives
+// that will be used in the OPAQUE protocol
+#[allow(dead_code)]
+struct Default;
+impl CipherSuite for Default {
+    type Group = curve25519_dalek::ristretto::RistrettoPoint;
+    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDH;
+    type Hash = sha2::Sha512;
+    type SlowHash = opaque_ke::slow_hash::NoOpHash;
+}
+
+struct Locker {
+    contents: Vec<u8>,
+    password_file: Vec<u8>,
+}
+
+// Given a key and plaintext, produce an AEAD ciphertext along with a nonce
+fn encrypt(key: &[u8], plaintext: &[u8]) -> Vec<u8> {
+    let cipher = ChaCha20Poly1305::new(Key::from_slice(&key[..32]));
+
+    let mut rng = OsRng;
+    let mut nonce_bytes = [0u8; 12];
+    rng.fill_bytes(&mut nonce_bytes);
+    let nonce = Nonce::from_slice(&nonce_bytes);
+
+    let ciphertext = cipher.encrypt(nonce, plaintext.as_ref()).unwrap();
+    [nonce_bytes.to_vec(), ciphertext].concat()
+}
+
+// Decrypt using a key and a ciphertext (nonce included) to recover the original plaintext
+fn decrypt(key: &[u8], ciphertext: &[u8]) -> Vec<u8> {
+    let cipher = ChaCha20Poly1305::new(Key::from_slice(&key[..32]));
+    cipher
+        .decrypt(
+            Nonce::from_slice(&ciphertext[..12]),
+            ciphertext[12..].as_ref(),
+        )
+        .unwrap()
+}
+
+// Password-based registration and encryption of client secret message between a client and server
+fn register_locker(
+    server_setup: &ServerSetup<Default>,
+    locker_id: usize,
+    password: String,
+    secret_message: String,
+) -> Locker {
+    let mut client_rng = OsRng;
+    let client_registration_start_result =
+        ClientRegistration::<Default>::start(&mut client_rng, password.as_bytes()).unwrap();
+    let registration_request_bytes = client_registration_start_result.message.serialize();
+
+    // Client sends registration_request_bytes to server
+    let server_registration_start_result = ServerRegistration::<Default>::start(
+        &server_setup,
+        RegistrationRequest::deserialize(&registration_request_bytes[..]).unwrap(),
+        &locker_id.to_be_bytes(),
+    )
+    .unwrap();
+    let registration_response_bytes = server_registration_start_result.message.serialize();
+
+    // Server sends registration_response_bytes to client
+
+    let client_finish_registration_result = client_registration_start_result
+        .state
+        .finish(
+            &mut client_rng,
+            RegistrationResponse::deserialize(&registration_response_bytes[..]).unwrap(),
+            ClientRegistrationFinishParameters::default(),
+        )
+        .unwrap();
+    let message_bytes = client_finish_registration_result.message.serialize();
+
+    // Client encrypts secret message using export key
+    let ciphertext = encrypt(
+        &client_finish_registration_result.export_key,
+        secret_message.as_bytes(),
+    );
+
+    // Client sends message_bytes to server
+
+    let password_file = ServerRegistration::finish(
+        RegistrationUpload::<Default>::deserialize(&message_bytes[..]).unwrap(),
+    );
+
+    Locker {
+        contents: ciphertext,
+        password_file: password_file.serialize(),
+    }
+}
+
+// Open the contents of a locker with a password between a client and server
+fn open_locker(
+    server_setup: &ServerSetup<Default>,
+    locker_id: usize,
+    password: String,
+    locker: &Locker,
+) -> Result<String, String> {
+    let mut client_rng = OsRng;
+    let client_login_start_result =
+        ClientLogin::<Default>::start(&mut client_rng, password.as_bytes()).unwrap();
+    let credential_request_bytes = client_login_start_result.message.serialize();
+
+    // Client sends credential_request_bytes to server
+
+    let password_file =
+        ServerRegistration::<Default>::deserialize(&locker.password_file[..]).unwrap();
+    let mut server_rng = OsRng;
+    let server_login_start_result = ServerLogin::start(
+        &mut server_rng,
+        &server_setup,
+        Some(password_file),
+        CredentialRequest::deserialize(&credential_request_bytes[..]).unwrap(),
+        &locker_id.to_be_bytes(),
+        ServerLoginStartParameters::default(),
+    )
+    .unwrap();
+    let credential_response_bytes = server_login_start_result.message.serialize();
+
+    // Server sends credential_response_bytes to client
+
+    let result = client_login_start_result.state.finish(
+        CredentialResponse::deserialize(&credential_response_bytes[..]).unwrap(),
+        ClientLoginFinishParameters::default(),
+    );
+
+    if result.is_err() {
+        // Client-detected login failure
+        return Err(String::from("Incorrect password, please try again."));
+    }
+    let client_login_finish_result = result.unwrap();
+    let credential_finalization_bytes = client_login_finish_result.message.serialize();
+
+    // Client sends credential_finalization_bytes to server
+
+    let server_login_finish_result = server_login_start_result
+        .state
+        .finish(CredentialFinalization::deserialize(&credential_finalization_bytes[..]).unwrap())
+        .unwrap();
+
+    // Server sends locker contents, encrypted under the session key, to the client
+    let encrypted_locker_contents =
+        encrypt(&server_login_finish_result.session_key, &locker.contents);
+
+    // Client decrypts contents of locker, first under the session key, and then under the export key
+    let plaintext = decrypt(
+        &client_login_finish_result.export_key,
+        &decrypt(
+            &client_login_finish_result.session_key,
+            &encrypted_locker_contents,
+        ),
+    );
+    String::from_utf8(plaintext).map_err(|_| String::from("UTF8 error"))
+}
+
+fn main() {
+    let mut rng = OsRng;
+    let server_setup = ServerSetup::<Default>::new(&mut rng);
+
+    let mut rl = Editor::<()>::new();
+    let mut registered_lockers: Vec<Locker> = vec![];
+    loop {
+        display_lockers(&registered_lockers);
+
+        println!("Enter an option (1 or 2):");
+        println!("1) Register a locker");
+        println!("2) Open a locker\n");
+        let readline = rl.readline("> ");
+        match readline {
+            Ok(line) => {
+                if line != "1" && line != "2" {
+                    println!("Error: Invalid option (either specify 1 or 2)");
+                    continue;
+                }
+                match line.as_ref() {
+                    "1" => {
+                        let (password, secret_message) = get_two_strings(
+                            "Choose a password",
+                            "Set a secret message",
+                            &mut rl,
+                            None,
+                        );
+                        let locker_id = registered_lockers.len();
+                        registered_lockers.push(register_locker(
+                            &server_setup,
+                            locker_id,
+                            password,
+                            secret_message,
+                        ));
+                        continue;
+                    }
+                    "2" => {
+                        let (locker, password) = get_two_strings(
+                            "Choose a locker number",
+                            "Enter the password",
+                            &mut rl,
+                            None,
+                        );
+                        let locker_index: usize = match locker.parse() {
+                            Ok(index) => index,
+                            Err(_) => {
+                                println!("Error: Could not find locker number");
+                                continue;
+                            }
+                        };
+
+                        if locker_index >= registered_lockers.len() {
+                            println!("Error: Could not find locker number");
+                            continue;
+                        }
+
+                        match open_locker(
+                            &server_setup,
+                            locker_index,
+                            password,
+                            &registered_lockers[locker_index],
+                        ) {
+                            Ok(contents) => {
+                                println!("\n\nSuccess! Contents: {}\n\n", contents);
+                            }
+                            Err(err) => {
+                                println!(
+                                    "\n\nError encountered, could not open locker: {}\n\n",
+                                    err
+                                );
+                            }
+                        }
+                    }
+                    _ => exit(0),
+                }
+            }
+            Err(err) => {
+                handle_error(err);
+                exit(0)
+            }
+        }
+    }
+}
+
+// Helper functions
+
+fn display_lockers(lockers: &Vec<Locker>) {
+    let mut locker_numbers = vec![];
+    for (i, _) in lockers.iter().enumerate() {
+        locker_numbers.push(i);
+    }
+
+    println!(
+        "\nCurrently registered locker numbers: {:?}\n",
+        locker_numbers
+    );
+}
+
+// Handle readline errors
+fn handle_error(err: ReadlineError) {
+    match err {
+        ReadlineError::Interrupted => {
+            println!("CTRL-C");
+        }
+        ReadlineError::Eof => {
+            println!("CTRL-D");
+        }
+        err => {
+            println!("Error: {:?}", err);
+        }
+    }
+}
+
+// A function run on the client which extracts two strings from the CLI
+fn get_two_strings(
+    s1: &str,
+    s2: &str,
+    rl: &mut Editor<()>,
+    string1: Option<String>,
+) -> (String, String) {
+    let query = if string1.is_none() { s1 } else { s2 };
+    let readline = rl.readline(&format!("{}: ", query));
+    match readline {
+        Ok(line) => match string1 {
+            Some(x) => (x, line),
+            None => get_two_strings(s1, s2, rl, Some(line)),
+        },
+        Err(err) => {
+            handle_error(err);
+            exit(0)
+        }
+    }
+}

examples/simple_login.rs

@@ -0,0 +1,232 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Demonstrates a simple client-server password-based login protocol
+//! using OPAQUE, over a command-line interface
+//!
+//! The client-server interactions are executed in a three-step protocol
+//! within the account_registration (for password registration) and
+//! account_login (for password login) functions. These steps
+//! must be performed in the specific sequence outlined in each of these
+//! functions.
+//!
+//! The CipherSuite trait allows the application to configure the
+//! primitives used by OPAQUE, but must be kept consistent across the steps
+//! of the protocol.
+//!
+//! In a more realistic client-server interaction, the client must send
+//! messages over "the wire" to the server. These bytes are serialized
+//! and explicitly annotated in the below functions.
+
+use rustyline::error::ReadlineError;
+use rustyline::Editor;
+use std::collections::HashMap;
+use std::process::exit;
+
+use opaque_ke::{
+    ciphersuite::CipherSuite, rand::rngs::OsRng, ClientLogin, ClientLoginFinishParameters,
+    ClientRegistration, ClientRegistrationFinishParameters, CredentialFinalization,
+    CredentialRequest, CredentialResponse, RegistrationRequest, RegistrationResponse,
+    RegistrationUpload, ServerLogin, ServerLoginStartParameters, ServerRegistration, ServerSetup,
+};
+
+// The ciphersuite trait allows to specify the underlying primitives
+// that will be used in the OPAQUE protocol
+#[allow(dead_code)]
+struct Default;
+impl CipherSuite for Default {
+    type Group = curve25519_dalek::ristretto::RistrettoPoint;
+    type KeyExchange = opaque_ke::key_exchange::tripledh::TripleDH;
+    type Hash = sha2::Sha512;
+    type SlowHash = opaque_ke::slow_hash::NoOpHash;
+}
+
+// Password-based registration between a client and server
+fn account_registration(
+    server_setup: &ServerSetup<Default>,
+    username: String,
+    password: String,
+) -> Vec<u8> {
+    let mut client_rng = OsRng;
+    let client_registration_start_result =
+        ClientRegistration::<Default>::start(&mut client_rng, password.as_bytes()).unwrap();
+    let registration_request_bytes = client_registration_start_result.message.serialize();
+
+    // Client sends registration_request_bytes to server
+
+    let server_registration_start_result = ServerRegistration::<Default>::start(
+        &server_setup,
+        RegistrationRequest::deserialize(&registration_request_bytes[..]).unwrap(),
+        username.as_bytes(),
+    )
+    .unwrap();
+    let registration_response_bytes = server_registration_start_result.message.serialize();
+
+    // Server sends registration_response_bytes to client
+
+    let client_finish_registration_result = client_registration_start_result
+        .state
+        .finish(
+            &mut client_rng,
+            RegistrationResponse::deserialize(&registration_response_bytes[..]).unwrap(),
+            ClientRegistrationFinishParameters::default(),
+        )
+        .unwrap();
+    let message_bytes = client_finish_registration_result.message.serialize();
+
+    // Client sends message_bytes to server
+
+    let password_file = ServerRegistration::finish(
+        RegistrationUpload::<Default>::deserialize(&message_bytes[..]).unwrap(),
+    );
+    password_file.serialize()
+}
+
+// Password-based login between a client and server
+fn account_login(
+    server_setup: &ServerSetup<Default>,
+    username: String,
+    password: String,
+    password_file_bytes: &[u8],
+) -> bool {
+    let mut client_rng = OsRng;
+    let client_login_start_result =
+        ClientLogin::<Default>::start(&mut client_rng, password.as_bytes()).unwrap();
+    let credential_request_bytes = client_login_start_result.message.serialize();
+
+    // Client sends credential_request_bytes to server
+
+    let password_file = ServerRegistration::<Default>::deserialize(password_file_bytes).unwrap();
+    let mut server_rng = OsRng;
+    let server_login_start_result = ServerLogin::start(
+        &mut server_rng,
+        &server_setup,
+        Some(password_file),
+        CredentialRequest::deserialize(&credential_request_bytes[..]).unwrap(),
+        username.as_bytes(),
+        ServerLoginStartParameters::default(),
+    )
+    .unwrap();
+    let credential_response_bytes = server_login_start_result.message.serialize();
+
+    // Server sends credential_response_bytes to client
+
+    let result = client_login_start_result.state.finish(
+        CredentialResponse::deserialize(&credential_response_bytes[..]).unwrap(),
+        ClientLoginFinishParameters::default(),
+    );
+
+    if result.is_err() {
+        // Client-detected login failure
+        return false;
+    }
+    let client_login_finish_result = result.unwrap();
+    let credential_finalization_bytes = client_login_finish_result.message.serialize();
+
+    // Client sends credential_finalization_bytes to server
+
+    let server_login_finish_result = server_login_start_result
+        .state
+        .finish(CredentialFinalization::deserialize(&credential_finalization_bytes[..]).unwrap())
+        .unwrap();
+
+    client_login_finish_result.session_key == server_login_finish_result.session_key
+}
+
+fn main() {
+    let mut rng = OsRng;
+    let server_setup = ServerSetup::<Default>::new(&mut rng);
+
+    let mut rl = Editor::<()>::new();
+    let mut registered_users = HashMap::<String, Vec<u8>>::new();
+    loop {
+        println!(
+            "\nCurrently registered usernames: {:?}\n",
+            registered_users.keys()
+        );
+
+        println!("Enter an option (1 or 2):");
+        println!("1) Register a user");
+        println!("2) Login as a user\n");
+        let readline = rl.readline("> ");
+        match readline {
+            Ok(line) => {
+                if line != "1" && line != "2" {
+                    println!("Error: Invalid option (either specify 1 or 2)");
+                    continue;
+                }
+                let (username, password) = get_two_strings("Username", "Password", &mut rl, None);
+                match line.as_ref() {
+                    "1" => {
+                        registered_users.insert(
+                            username.clone(),
+                            account_registration(&server_setup, username, password),
+                        );
+                        continue;
+                    }
+                    "2" => match registered_users.get(&username) {
+                        Some(password_file_bytes) => {
+                            if account_login(&server_setup, username, password, password_file_bytes)
+                            {
+                                println!("\nLogin success!");
+                            } else {
+                                // Note that at this point, the client knows whether or not the login
+                                // succeeded. In this example, we simply rely on client-reported result
+                                // of login, but in a real client-server implementation, the server may not
+                                // know the outcome of login yet, and extra care must be taken to ensure
+                                // that the server can learn the outcome as well.
+                                println!("\nIncorrect password, please try again.");
+                            }
+                        }
+                        None => println!("Error: Could not find username registered"),
+                    },
+                    _ => exit(0),
+                }
+            }
+            Err(err) => {
+                handle_error(err);
+                exit(0)
+            }
+        }
+    }
+}
+
+// Helper functions
+
+// Handle readline errors
+fn handle_error(err: ReadlineError) {
+    match err {
+        ReadlineError::Interrupted => {
+            println!("CTRL-C");
+        }
+        ReadlineError::Eof => {
+            println!("CTRL-D");
+        }
+        err => {
+            println!("Error: {:?}", err);
+        }
+    }
+}
+
+// A function run on the client which extracts two strings from the CLI
+fn get_two_strings(
+    s1: &str,
+    s2: &str,
+    rl: &mut Editor<()>,
+    string1: Option<String>,
+) -> (String, String) {
+    let query = if string1.is_none() { s1 } else { s2 };
+    let readline = rl.readline(&format!("{}: ", query));
+    match readline {
+        Ok(line) => match string1 {
+            Some(x) => (x, line),
+            None => get_two_strings(s1, s2, rl, Some(line)),
+        },
+        Err(err) => {
+            handle_error(err);
+            exit(0)
+        }
+    }
+}

scripts/digital_locker.exp

@@ -0,0 +1,84 @@
+#!/bin/expect -f
+# Copyright (c) Facebook, Inc. and its affiliates.
+#
+# This source code is licensed under the MIT license found in the
+# LICENSE file in the root directory of this source tree.
+
+set timeout 1
+spawn cargo run --example digital_locker
+match_max 100000
+sleep 1
+expect "*
+\r
+Currently registered locker numbers: \\\[\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a locker\r
+2) Open a locker\r
+\r
+"
+sleep .1
+send -- "1\r"
+expect "Choose a password: \r"
+send -- "foo\r"
+expect "Set a secret message: \r"
+send -- "bar\r"
+expect "*
+\r
+Currently registered locker numbers: \\\[0\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a locker\r
+2) Open a locker\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Choose a locker number: \r"
+send -- "1\r"
+expect "Password: \r"
+send -- "foo\r"
+expect "*Error: Could not find locker number\r
+\r
+Currently registered locker numbers: \\\[0\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a locker\r
+2) Open a locker\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Choose a locker number: \r"
+send -- "0\r"
+expect "Password: \r"
+send -- "baz\r"
+expect "*Error encountered, could not open locker: Incorrect password, please try again.\r
+\r
+Currently registered locker numbers: \\\[0\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a locker\r
+2) Open a locker\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Choose a locker number: \r"
+send -- "0\r"
+expect "Password: \r"
+send -- "foo\r"
+expect "*
+\r
+*Success! Contents: bar\r
+\r
+Currently registered locker numbers: \\\[0\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a locker\r
+2) Open a locker\r
+\r
+"
+sleep .1
+send -- ""
+expect eof

scripts/simple_login.exp

@@ -0,0 +1,84 @@
+#!/bin/expect -f
+# Copyright (c) Facebook, Inc. and its affiliates.
+#
+# This source code is licensed under the MIT license found in the
+# LICENSE file in the root directory of this source tree.
+
+set timeout 1
+spawn cargo run --example simple_login
+match_max 100000
+sleep 1
+expect "*
+\r
+Currently registered usernames: \\\[\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a user\r
+2) Login as a user\r
+\r
+"
+sleep .1
+send -- "1\r"
+expect "Username: \r"
+send -- "foo\r"
+expect "Password: \r"
+send -- "bar\r"
+expect "*
+\r
+Currently registered usernames: \\\[\"foo\"\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a user\r
+2) Login as a user\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Username: \r"
+send -- "baz\r"
+expect "Password: \r"
+send -- "quux\r"
+expect "*Error: Could not find username registered\r
+\r
+Currently registered usernames: \\\[\"foo\"\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a user\r
+2) Login as a user\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Username: \r"
+send -- "foo\r"
+expect "Password: \r"
+send -- "baz\r"
+expect "*Incorrect password, please try again.\r
+\r
+Currently registered usernames: \\\[\"foo\"\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a user\r
+2) Login as a user\r
+\r
+"
+sleep .1
+send -- "2\r"
+expect "Username: \r"
+send -- "foo\r"
+expect "Password: \r"
+send -- "bar\r"
+expect "*
+\r
+*Login success!\r
+\r
+Currently registered usernames: \\\[\"foo\"\\\]\r
+\r
+Enter an option (1 or 2):\r
+1) Register a user\r
+2) Login as a user\r
+\r
+"
+sleep .1
+send -- ""
+expect eof

src/ciphersuite.rs

@@ -6,18 +6,16 @@
 //! Defines the CipherSuite trait to specify the underlying primitives for OPAQUE
 
 use crate::{
-    errors::InternalPakeError, hash::Hash, key_exchange::traits::KeyExchange, keypair::KeyPair,
-    map_to_curve::GroupWithMapToCurve, slow_hash::SlowHash,
+    hash::Hash, key_exchange::traits::KeyExchange, map_to_curve::GroupWithMapToCurve,
+    slow_hash::SlowHash,
 };
-
-use rand_core::{CryptoRng, RngCore};
+use digest::Digest;
 
 /// Configures the underlying primitives used in OPAQUE
 /// * `Group`: a finite cyclic group along with a point representation, along
 ///   with an extension trait PasswordToCurve that allows some customization on
 ///   how to hash a password to a curve point. See `group::Group` and
 ///   `map_to_curve::GroupWithMapToCurve`.
-/// * `KeyFormat`: a keypair type composed of public and private components
 /// * `KeyExchange`: The key exchange protocol to use in the login step
 /// * `Hash`: The main hashing function to use
 /// * `SlowHash`: A slow hashing function, typically used for password hashing
@@ -26,19 +24,11 @@ pub trait CipherSuite {
     /// an extension trait PasswordToCurve that allows some customization on
     /// how to hash a password to a curve point. See `group::Group` and
     /// `map_to_curve::GroupWithMapToCurve`.
-    type Group: GroupWithMapToCurve;
-    /// A keypair type composed of public and private components
-    type KeyFormat: KeyPair + PartialEq;
+    type Group: GroupWithMapToCurve<UniformBytesLen = <Self::Hash as Digest>::OutputSize>;
     /// A key exchange protocol
-    type KeyExchange: KeyExchange<Self::Hash, Self::KeyFormat>;
+    type KeyExchange: KeyExchange<Self::Hash, Self::Group>;
     /// The main hash function use (for HKDF computations and hashing transcripts)
     type Hash: Hash;
     /// A slow hashing function, typically used for password hashing
     type SlowHash: SlowHash<Self::Hash>;
-    /// Generating a random key pair given a cryptographic rng
-    fn generate_random_keypair<R: RngCore + CryptoRng>(
-        rng: &mut R,
-    ) -> Result<Self::KeyFormat, InternalPakeError> {
-        Self::KeyFormat::generate_random(rng)
-    }
 }

src/elligator/field.rs

@@ -1,353 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under the MIT license found in the
-// LICENSE file in the root directory of this source tree.
-#![allow(clippy::let_and_return)]
-
-//! Field arithmetic modulo \\(p = 2\^{255} - 19\\), using \\(64\\)-bit
-//! limbs with \\(128\\)-bit products.
-
-use core::fmt::Debug;
-use core::ops::Neg;
-use core::ops::{Add, AddAssign};
-use core::ops::{Mul, MulAssign};
-
-use subtle::Choice;
-use subtle::ConditionallyNegatable;
-use subtle::ConditionallySelectable;
-use subtle::ConstantTimeEq;
-
-use zeroize::Zeroize;
-
-use fiat_crypto::curve25519_64::*;
-
-/// A `FieldElement51` represents an element of the field
-/// \\( \mathbb Z / (2\^{255} - 19)\\).
-///
-/// In the 64-bit implementation, a `FieldElement` is represented in
-/// radix \\(2\^{51}\\) as five `u64`s; the coefficients are allowed to
-/// grow up to \\(2\^{54}\\) between reductions modulo \\(p\\).
-///
-/// # Note
-///
-/// The `curve25519_dalek::field` module provides a type alias
-/// `curve25519_dalek::field::FieldElement` to either `FieldElement51`
-/// or `FieldElement2625`.
-///
-/// The backend-specific type `FieldElement51` should not be used
-/// outside of the `curve25519_dalek::field` module.
-#[derive(Copy, Clone)]
-pub struct FieldElement51(pub(crate) [u64; 5]);
-
-impl Debug for FieldElement51 {
-    fn fmt(&self, f: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
-        write!(f, "FieldElement51({:?})", &self.0[..])
-    }
-}
-
-impl Zeroize for FieldElement51 {
-    fn zeroize(&mut self) {
-        self.0.zeroize();
-    }
-}
-
-impl ConstantTimeEq for FieldElement51 {
-    /// Test equality between two `FieldElement`s.  Since the
-    /// internal representation is not canonical, the field elements
-    /// are normalized to wire format before comparison.
-    fn ct_eq(&self, other: &FieldElement51) -> Choice {
-        self.to_bytes().ct_eq(&other.to_bytes())
-    }
-}
-
-impl<'b> AddAssign<&'b FieldElement51> for FieldElement51 {
-    fn add_assign(&mut self, _rhs: &'b FieldElement51) {
-        let input = self.0;
-        fiat_25519_add(&mut self.0, &input, &_rhs.0);
-        let input = self.0;
-        fiat_25519_carry(&mut self.0, &input);
-    }
-}
-
-impl<'a, 'b> Add<&'b FieldElement51> for &'a FieldElement51 {
-    type Output = FieldElement51;
-    fn add(self, _rhs: &'b FieldElement51) -> FieldElement51 {
-        let mut output = *self;
-        fiat_25519_add(&mut output.0, &self.0, &_rhs.0);
-        let input = output.0;
-        fiat_25519_carry(&mut output.0, &input);
-        output
-    }
-}
-
-impl<'b> MulAssign<&'b FieldElement51> for FieldElement51 {
-    fn mul_assign(&mut self, _rhs: &'b FieldElement51) {
-        let input = self.0;
-        fiat_25519_carry_mul(&mut self.0, &input, &_rhs.0);
-    }
-}
-
-impl<'a, 'b> Mul<&'b FieldElement51> for &'a FieldElement51 {
-    type Output = FieldElement51;
-    fn mul(self, _rhs: &'b FieldElement51) -> FieldElement51 {
-        let mut output = *self;
-        fiat_25519_carry_mul(&mut output.0, &self.0, &_rhs.0);
-        output
-    }
-}
-
-impl<'a> Neg for &'a FieldElement51 {
-    type Output = FieldElement51;
-    fn neg(self) -> FieldElement51 {
-        let mut output = *self;
-        fiat_25519_opp(&mut output.0, &self.0);
-        let input = output.0;
-        fiat_25519_carry(&mut output.0, &input);
-        output
-    }
-}
-
-impl ConditionallySelectable for FieldElement51 {
-    fn conditional_select(
-        a: &FieldElement51,
-        b: &FieldElement51,
-        choice: Choice,
-    ) -> FieldElement51 {
-        let mut output = [0u64; 5];
-        fiat_25519_selectznz(&mut output, choice.unwrap_u8() as fiat_25519_u1, &a.0, &b.0);
-        FieldElement51(output)
-    }
-
-    fn conditional_swap(a: &mut FieldElement51, b: &mut FieldElement51, choice: Choice) {
-        u64::conditional_swap(&mut a.0[0], &mut b.0[0], choice);
-        u64::conditional_swap(&mut a.0[1], &mut b.0[1], choice);
-        u64::conditional_swap(&mut a.0[2], &mut b.0[2], choice);
-        u64::conditional_swap(&mut a.0[3], &mut b.0[3], choice);
-        u64::conditional_swap(&mut a.0[4], &mut b.0[4], choice);
-    }
-
-    fn conditional_assign(&mut self, _rhs: &FieldElement51, choice: Choice) {
-        let mut output = [0u64; 5];
-        let choicebit = choice.unwrap_u8() as fiat_25519_u1;
-        fiat_25519_cmovznz_u64(&mut output[0], choicebit, self.0[0], _rhs.0[0]);
-        fiat_25519_cmovznz_u64(&mut output[1], choicebit, self.0[1], _rhs.0[1]);
-        fiat_25519_cmovznz_u64(&mut output[2], choicebit, self.0[2], _rhs.0[2]);
-        fiat_25519_cmovznz_u64(&mut output[3], choicebit, self.0[3], _rhs.0[3]);
-        fiat_25519_cmovznz_u64(&mut output[4], choicebit, self.0[4], _rhs.0[4]);
-        *self = FieldElement51(output);
-    }
-}
-
-impl FieldElement51 {
-    /// Construct zero.
-    pub fn zero() -> FieldElement51 {
-        FieldElement51([0, 0, 0, 0, 0])
-    }
-
-    /// Construct one.
-    pub fn one() -> FieldElement51 {
-        FieldElement51([1, 0, 0, 0, 0])
-    }
-
-    pub fn is_negative(&self) -> Choice {
-        let bytes = self.to_bytes();
-        (bytes[0] & 1).into()
-    }
-
-    /// Raise this field element to the power (p-5)/8 = 2^252 -3.
-    fn pow_p58(&self) -> FieldElement51 {
-        // The bits of (p-5)/8 are 101111.....11.
-        //
-        //                                 nonzero bits of exponent
-        let (t19, _) = self.pow22501(); // 249..0
-        let t20 = t19.pow2k(2); // 251..2
-        let t21 = self * &t20; // 251..2,0
-
-        t21
-    }
-
-    /// Given a nonzero field element, compute its inverse.
-    ///
-    /// The inverse is computed as self^(p-2), since
-    /// x^(p-2)x = x^(p-1) = 1 (mod p).
-    ///
-    /// This function returns zero on input zero.
-    pub fn invert(&self) -> FieldElement51 {
-        // The bits of p-2 = 2^255 -19 -2 are 11010111111...11.
-        //
-        //                                 nonzero bits of exponent
-        let (t19, t3) = self.pow22501(); // t19: 249..0 ; t3: 3,1,0
-        let t20 = t19.pow2k(5); // 254..5
-        let t21 = &t20 * &t3; // 254..5,3,1,0
-
-        t21
-    }
-
-    /// Compute (self^(2^250-1), self^11), used as a helper function
-    /// within invert() and pow22523().
-    fn pow22501(&self) -> (FieldElement51, FieldElement51) {
-        // Instead of managing which temporary variables are used
-        // for what, we define as many as we need and leave stack
-        // allocation to the compiler
-        //
-        // Each temporary variable t_i is of the form (self)^e_i.
-        // Squaring t_i corresponds to multiplying e_i by 2,
-        // so the pow2k function shifts e_i left by k places.
-        // Multiplying t_i and t_j corresponds to adding e_i + e_j.
-        //
-        // Temporary t_i                      Nonzero bits of e_i
-        //
-        let t0 = self.square(); // 1         e_0 = 2^1
-        let t1 = t0.square().square(); // 3         e_1 = 2^3
-        let t2 = self * &t1; // 3,0       e_2 = 2^3 + 2^0
-        let t3 = &t0 * &t2; // 3,1,0
-        let t4 = t3.square(); // 4,2,1
-        let t5 = &t2 * &t4; // 4,3,2,1,0
-        let t6 = t5.pow2k(5); // 9,8,7,6,5
-        let t7 = &t6 * &t5; // 9,8,7,6,5,4,3,2,1,0
-        let t8 = t7.pow2k(10); // 19..10
-        let t9 = &t8 * &t7; // 19..0
-        let t10 = t9.pow2k(20); // 39..20
-        let t11 = &t10 * &t9; // 39..0
-        let t12 = t11.pow2k(10); // 49..10
-        let t13 = &t12 * &t7; // 49..0
-        let t14 = t13.pow2k(50); // 99..50
-        let t15 = &t14 * &t13; // 99..0
-        let t16 = t15.pow2k(100); // 199..100
-        let t17 = &t16 * &t15; // 199..0
-        let t18 = t17.pow2k(50); // 249..50
-        let t19 = &t18 * &t13; // 249..0
-
-        (t19, t3)
-    }
-
-    /// Load a `FieldElement51` from the low 255 bits of a 256-bit
-    /// input.
-    ///
-    /// # Warning
-    ///
-    /// This function does not check that the input used the canonical
-    /// representative.  It masks the high bit, but it will happily
-    /// decode 2^255 - 18 to 1.  Applications that require a canonical
-    /// encoding of every field element should decode, re-encode to
-    /// the canonical encoding, and check that the input was
-    /// canonical.
-    ///
-    pub fn from_bytes(bytes: &[u8; 32]) -> FieldElement51 {
-        let mut temp = [0u8; 32];
-        temp.copy_from_slice(bytes);
-        temp[31] &= 127u8;
-        let mut output = [0u64; 5];
-        fiat_25519_from_bytes(&mut output, &temp);
-        FieldElement51(output)
-    }
-
-    /// Serialize this `FieldElement51` to a 32-byte array.  The
-    /// encoding is canonical.
-    pub fn to_bytes(&self) -> [u8; 32] {
-        let mut bytes = [0u8; 32];
-        fiat_25519_to_bytes(&mut bytes, &self.0);
-        bytes
-    }
-
-    /// Given `k > 0`, return `self^(2^k)`.
-    pub fn pow2k(&self, mut k: u32) -> FieldElement51 {
-        let mut output = *self;
-        loop {
-            let input = output.0;
-            fiat_25519_carry_square(&mut output.0, &input);
-            k -= 1;
-            if k == 0 {
-                return output;
-            }
-        }
-    }
-
-    /// Given `FieldElements` `u` and `v`, compute either `sqrt(u/v)`
-    /// or `sqrt(i*u/v)` in constant time.
-    ///
-    /// This function always returns the nonnegative square root.
-    ///
-    /// # Return
-    ///
-    /// - `(Choice(1), +sqrt(u/v))  ` if `v` is nonzero and `u/v` is square;
-    /// - `(Choice(1), zero)        ` if `u` is zero;
-    /// - `(Choice(0), zero)        ` if `v` is zero and `u` is nonzero;
-    /// - `(Choice(0), +sqrt(i*u/v))` if `u/v` is nonsquare (so `i*u/v` is square).
-    ///
-    pub fn sqrt_ratio_i(u: &FieldElement51, v: &FieldElement51) -> (Choice, FieldElement51) {
-        // Using the same trick as in ed25519 decoding, we merge the
-        // inversion, the square root, and the square test as follows.
-        //
-        // To compute sqrt(α), we can compute β = α^((p+3)/8).
-        // Then β^2 = ±α, so multiplying β by sqrt(-1) if necessary
-        // gives sqrt(α).
-        //
-        // To compute 1/sqrt(α), we observe that
-        //    1/β = α^(p-1 - (p+3)/8) = α^((7p-11)/8)
-        //                            = α^3 * (α^7)^((p-5)/8).
-        //
-        // We can therefore compute sqrt(u/v) = sqrt(u)/sqrt(v)
-        // by first computing
-        //    r = u^((p+3)/8) v^(p-1-(p+3)/8)
-        //      = u u^((p-5)/8) v^3 (v^7)^((p-5)/8)
-        //      = (uv^3) (uv^7)^((p-5)/8).
-        //
-        // If v is nonzero and u/v is square, then r^2 = ±u/v,
-        //                                     so vr^2 = ±u.
-        // If vr^2 =  u, then sqrt(u/v) = r.
-        // If vr^2 = -u, then sqrt(u/v) = r*sqrt(-1).
-        //
-        // If v is zero, r is also zero.
-
-        let v3 = &v.square() * v;
-        let v7 = &v3.square() * v;
-        let mut r = &(u * &v3) * &(u * &v7).pow_p58();
-        let check = v * &r.square();
-
-        let i = &SQRT_M1;
-
-        let correct_sign_sqrt = check.ct_eq(u);
-        let flipped_sign_sqrt = check.ct_eq(&(-u));
-        let flipped_sign_sqrt_i = check.ct_eq(&(&(-u) * i));
-
-        let r_prime = &SQRT_M1 * &r;
-        r.conditional_assign(&r_prime, flipped_sign_sqrt | flipped_sign_sqrt_i);
-
-        // Choose the nonnegative square root.
-        let r_is_negative = r.is_negative();
-        r.conditional_negate(r_is_negative);
-
-        let was_nonzero_square = correct_sign_sqrt | flipped_sign_sqrt;
-
-        (was_nonzero_square, r)
-    }
-
-    /// Returns the square of this field element.
-    pub fn square(&self) -> FieldElement51 {
-        let mut output = *self;
-        fiat_25519_carry_square(&mut output.0, &self.0);
-        output
-    }
-
-    /// Returns 2 times the square of this field element.
-    pub fn square2(&self) -> FieldElement51 {
-        let mut output = *self;
-        let mut temp = *self;
-        // Void vs return type, measure cost of copying self
-        fiat_25519_carry_square(&mut temp.0, &self.0);
-        fiat_25519_add(&mut output.0, &temp.0, &temp.0);
-        let input = output.0;
-        fiat_25519_carry(&mut output.0, &input);
-        output
-    }
-}
-
-/// Precomputed value of one of the square roots of -1 (mod p)
-pub(crate) const SQRT_M1: FieldElement51 = FieldElement51([
-    1718705420411056,
-    234908883556509,
-    2233514472574048,
-    2117202627021982,
-    765476049583133,
-]);

src/elligator/mod.rs

@@ -1,177 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under the MIT license found in the
-// LICENSE file in the root directory of this source tree.
-#![allow(non_snake_case)]
-
-mod field;
-
-use curve25519_dalek::{edwards::EdwardsPoint, montgomery::MontgomeryPoint};
-use field::FieldElement51;
-use sha2::Digest;
-use subtle::{ConditionallyNegatable, ConditionallySelectable};
-
-const MONT_A: FieldElement51 = FieldElement51([486662, 0, 0, 0, 0]);
-
-fn elligator_signal(r_0: &FieldElement51) -> MontgomeryPoint {
-    let minus_a = -&MONT_A; /* A = 486662 */
-    let one = FieldElement51::one();
-    let d_1 = &one + &r_0.square2(); /* 2r^2 */
-
-    let d = &minus_a * &(d_1.invert()); /* A/(1+2r^2) */
-
-    let d_sq = &d.square();
-    let au = &MONT_A * &d;
-
-    let inner = &(d_sq + &au) + &one;
-    let eps = &d * &inner; /* eps = d^3 + Ad^2 + d */
-
-    let (eps_is_sq, _eps) = FieldElement51::sqrt_ratio_i(&eps, &one);
-
-    let zero = FieldElement51::zero();
-    let Atemp = FieldElement51::conditional_select(&MONT_A, &zero, eps_is_sq); /* 0, or A if nonsquare*/
-    let mut u = &d + &Atemp; /* d, or d+A if nonsquare */
-    u.conditional_negate(!eps_is_sq); /* d, or -d-A if nonsquare */
-
-    MontgomeryPoint(u.to_bytes())
-}
-
-pub fn hash_to_point(bytes: &[u8]) -> EdwardsPoint {
-    let mut hash = sha2::Sha512::new();
-    hash.update(bytes);
-    let h = hash.finalize();
-    let mut res = [0u8; 32];
-    res.copy_from_slice(&h[..32]);
-
-    let sign_bit = (res[31] & 0x80) >> 7;
-
-    let fe = FieldElement51::from_bytes(&res);
-
-    let M1 = elligator_signal(&fe);
-    let E1_opt = M1.to_edwards(sign_bit);
-
-    E1_opt
-        .expect("Montgomery conversion to Edwards point in Elligator failed")
-        .mul_by_cofactor()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::convert::TryInto;
-
-    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-    // Signal tests from                                                                                                              //
-    //     https://github.com/signalapp/libsignal-protocol-c/blob/master/src/curve25519/ed25519/tests/internal_fast_tests.c#L222-L282 //
-    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-
-    const ELLIGATOR_CORRECT_OUTPUT: [u8; 32] = [
-        0x5f, 0x35, 0x20, 0x00, 0x1c, 0x6c, 0x99, 0x36, 0xa3, 0x12, 0x06, 0xaf, 0xe7, 0xc7, 0xac,
-        0x22, 0x4e, 0x88, 0x61, 0x61, 0x9b, 0xf9, 0x88, 0x72, 0x44, 0x49, 0x15, 0x89, 0x9d, 0x95,
-        0xf4, 0x6e,
-    ];
-
-    #[test]
-    fn elligator_correct() {
-        let bytes: Vec<u8> = (0u8..32u8).collect();
-        let bits_in: [u8; 32] = (&bytes[..]).try_into().expect("Range invariant broken");
-
-        let fe = FieldElement51::from_bytes(&bits_in);
-        let eg = elligator_signal(&fe);
-        assert_eq!(eg.to_bytes(), ELLIGATOR_CORRECT_OUTPUT);
-    }
-
-    #[test]
-    fn elligator_zero_zero() {
-        let zero = [0u8; 32];
-        let fe = FieldElement51::from_bytes(&zero);
-        let eg = elligator_signal(&fe);
-        assert_eq!(eg.to_bytes(), zero);
-    }
-
-    const HASHTOPOINT_CORRECT_OUTPUT1: [u8; 32] = [
-        0xce, 0x89, 0x9f, 0xb2, 0x8f, 0xf7, 0x20, 0x91, 0x5e, 0x14, 0xf5, 0xb7, 0x99, 0x08, 0xab,
-        0x17, 0xaa, 0x2e, 0xe2, 0x45, 0xb4, 0xfc, 0x2b, 0xf6, 0x06, 0x36, 0x29, 0x40, 0xed, 0x7d,
-        0xe7, 0xed,
-    ];
-
-    const HASHTOPOINT_CORRECT_OUTPUT2: [u8; 32] = [
-        0xa0, 0x35, 0xbb, 0xa9, 0x4d, 0x30, 0x55, 0x33, 0x0d, 0xce, 0xc2, 0x7f, 0x83, 0xde, 0x79,
-        0xd0, 0x89, 0x67, 0x72, 0x4c, 0x07, 0x8d, 0x68, 0x9d, 0x61, 0x52, 0x1d, 0xf9, 0x2c, 0x5c,
-        0xba, 0x77,
-    ];
-
-    #[test]
-    fn test_hash_to_point_1() {
-        let bits: Vec<u8> = (0u8..32u8).collect();
-        let hashed = hash_to_point(&bits);
-        assert_eq!(hashed.compress().to_bytes(), HASHTOPOINT_CORRECT_OUTPUT1);
-    }
-
-    #[test]
-    fn test_hash_to_point_2() {
-        let bits: Vec<u8> = (0u8..32u8).map(|u| u + 1).collect();
-        let hashed = hash_to_point(&bits);
-        assert_eq!(hashed.compress().to_bytes(), HASHTOPOINT_CORRECT_OUTPUT2);
-    }
-
-    /////////////////////////////////////////
-    // Additional test vectors from Signal //
-    /////////////////////////////////////////
-
-    fn test_vectors() -> Vec<Vec<&'static str>> {
-        vec![
-            vec![
-                "214f306e1576f5a7577636fe303ca2c625b533319f52442b22a9fa3b7ede809f",
-                "c95becf0f93595174633b9d4d6bbbeb88e16fa257176f877ce426e1424626052",
-            ],
-            vec![
-                "2eb10d432702ea7f79207da95d206f82d5a3b374f5f89f17a199531f78d3bea6",
-                "d8f8b508edffbb8b6dab0f602f86a9dd759f800fe18f782fdcac47c234883e7f",
-            ],
-            vec![
-                "84cbe9accdd32b46f4a8ef51c85fd39d028711f77fb00e204a613fc235fd68b9",
-                "93c73e0289afd1d1fc9e4e78a505d5d1b2642fbdf91a1eff7d281930654b1453",
-            ],
-            vec![
-                "c85165952490dc1839cb69012a3d9f2cc4b02343613263ab93a26dc89fd58267",
-                "43cbe8685fd3c90665b91835debb89ff1477f906f5170f38a192f6a199556537",
-            ],
-            vec![
-                "26e7fc4a78d863b1a4ccb2ce0951fbcd021e106350730ee4157bacb4502e1b76",
-                "b6fc3d738c2c40719479b2f23818180cdafa72a14254d4016bbed8f0b788a835",
-            ],
-            vec![
-                "1618c08ef0233f94f0f163f9435ec7457cd7a8cd4bb6b160315d15818c30f7a2",
-                "da0b703593b29dbcd28ebd6e7baea17b6f61971f3641cae774f6a5137a12294c",
-            ],
-            vec![
-                "48b73039db6fcdcb6030c4a38e8be80b6390d8ae46890e77e623f87254ef149c",
-                "ca11b25acbc80566603eabeb9364ebd50e0306424c61049e1ce9385d9f349966",
-            ],
-            vec![
-                "a744d582b3a34d14d311b7629da06d003045ae77cebceeb4e0e72734d63bd07d",
-                "fad25a5ea15d4541258af8785acaf697a886c1b872c793790e60a6837b1adbc0",
-            ],
-            vec![
-                "80a6ff33494c471c5eff7efb9febfbcf30a946fe6535b3451cda79f2154a7095",
-                "57ac03913309b3f8cd3c3d4c49d878bb21f4d97dc74a1eaccbe5c601f7f06f47",
-            ],
-            vec![
-                "f06fc939bc10551a0fd415aebf107ef0b9c4ee1ef9a164157bdd089127782617",
-                "785b2a6a00a5579cc9da1ff997ce8339b6f9fb46c6f10cf7a12ff2986341a6e0",
-            ],
-        ]
-    }
-
-    #[test]
-    fn additional_signal_test_vectors() {
-        for vector in test_vectors().iter() {
-            let input = hex::decode(vector[0]).unwrap();
-            let output = hex::decode(vector[1]).unwrap();
-
-            let point = hash_to_point(&input);
-            assert_eq!(point.compress().to_bytes(), output[..]);
-        }
-    }
-}

src/envelope.rs

@@ -3,26 +3,81 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-use crate::errors::InternalPakeError;
-use crate::hash::Hash;
-use digest::Digest;
-use generic_array::{
-    typenum::{Unsigned, U32},
-    GenericArray,
+use crate::{
+    ciphersuite::CipherSuite,
+    errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError},
+    group::Group,
+    hash::Hash,
+    keypair::{KeyPair, PrivateKey, PublicKey},
+    map_to_curve::GroupWithMapToCurve,
+    opaque::{bytestrings_from_identifiers, Identifiers},
 };
+use digest::Digest;
+use generic_array::{typenum::Unsigned, GenericArray};
+use generic_bytes::SizedBytes;
 use hkdf::Hkdf;
 use hmac::{Hmac, Mac, NewMac};
-use rand_core::{CryptoRng, RngCore};
+use rand::{CryptoRng, RngCore};
+use std::convert::TryFrom;
+use zeroize::Zeroize;
 
 // Constant string used as salt for HKDF computation
-const STR_ENVU: &[u8] = b"EnvU";
-
-/// The length of the "export key" output by the client registration
-/// and login finish steps
-pub(crate) type ExportKeySize = U32;
+const STR_AUTH_KEY: &[u8] = b"AuthKey";
+const STR_EXPORT_KEY: &[u8] = b"ExportKey";
+const STR_PRIVATE_KEY: &[u8] = b"PrivateKey";
+const STR_OPAQUE_HASH_TO_SCALAR: &[u8] = b"OPAQUE-HashToScalar";
 
 const NONCE_LEN: usize = 32;
 
+fn build_inner_envelope_internal<CS: CipherSuite>(
+    random_pwd: &[u8],
+    nonce: &[u8],
+) -> Result<PublicKey, InternalPakeError> {
+    let h = Hkdf::<CS::Hash>::new(None, random_pwd);
+    let mut keypair_seed = vec![0u8; <PrivateKey as SizedBytes>::Len::to_usize()];
+    h.expand(&[nonce, STR_PRIVATE_KEY].concat(), &mut keypair_seed)
+        .map_err(|_| InternalPakeError::HkdfError)?;
+    let client_static_keypair =
+        KeyPair::<CS::Group>::from_private_key_slice(CS::Group::scalar_as_bytes(
+            &CS::Group::hash_to_scalar::<CS::Hash>(&keypair_seed[..], STR_OPAQUE_HASH_TO_SCALAR)?,
+        ))?;
+
+    Ok(client_static_keypair.public().clone())
+}
+
+fn recover_keys_internal<CS: CipherSuite>(
+    random_pwd: &[u8],
+    nonce: &[u8],
+) -> Result<KeyPair<CS::Group>, InternalPakeError> {
+    let h = Hkdf::<CS::Hash>::new(None, random_pwd);
+    let mut keypair_seed = vec![0u8; <PrivateKey as SizedBytes>::Len::to_usize()];
+    h.expand(&[nonce, STR_PRIVATE_KEY].concat(), &mut keypair_seed)
+        .map_err(|_| InternalPakeError::HkdfError)?;
+    let client_static_keypair =
+        KeyPair::<CS::Group>::from_private_key_slice(CS::Group::scalar_as_bytes(
+            &CS::Group::hash_to_scalar::<CS::Hash>(&keypair_seed[..], STR_OPAQUE_HASH_TO_SCALAR)?,
+        ))?;
+
+    Ok(client_static_keypair)
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq, Zeroize)]
+#[zeroize(drop)]
+pub(crate) enum InnerEnvelopeMode {
+    Zero = 0,
+    Internal = 1,
+}
+
+impl TryFrom<u8> for InnerEnvelopeMode {
+    type Error = PakeError;
+    fn try_from(x: u8) -> Result<Self, Self::Error> {
+        match x {
+            1 => Ok(InnerEnvelopeMode::Internal),
+            _ => Err(PakeError::SerializationError),
+        }
+    }
+}
+
 /// This struct is an instantiation of the envelope as described in
 /// https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-06#section-4
 ///
@@ -33,153 +88,243 @@ const NONCE_LEN: usize = 32;
 /// The specification update has simplified this assumption by taking
 /// an XOR-based approach without compromising on security, and to avoid
 /// the confusion around the implementation of an RKR-secure encryption.
-pub(crate) struct Envelope<D: Hash> {
+pub(crate) struct Envelope<CS: CipherSuite> {
+    mode: InnerEnvelopeMode,
     nonce: Vec<u8>,
-    ciphertext: Vec<u8>,
-    hmac: GenericArray<u8, <D as Digest>::OutputSize>,
+    hmac: GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
 }
 
-pub(crate) struct OpenedEnvelope {
-    pub(crate) plaintext: Vec<u8>,
-    pub(crate) export_key: GenericArray<u8, ExportKeySize>,
-}
-
-impl<D: Hash> Envelope<D> {
-    /// The additional number of bytes added to the plaintext
-    pub(crate) fn additional_size() -> usize {
-        NONCE_LEN + <D as Digest>::OutputSize::to_usize()
+// Cannot be derived because it would require for CS to be Clone.
+impl<CS: CipherSuite> Clone for Envelope<CS> {
+    fn clone(&self) -> Self {
+        Self {
+            mode: self.mode.clone(),
+            nonce: self.nonce.clone(),
+            hmac: self.hmac.clone(),
+        }
     }
+}
 
+impl_debug_eq_hash_for!(struct Envelope<CS: CipherSuite>, [mode, nonce, hmac]);
+
+// Note that this struct represents an envelope that has been "opened" with the asssociated
+// key. This key is also used to derive the export_key parameter, which is technically
+// unrelated to the envelope's encrypted and authenticated contents.
+pub(crate) struct OpenedEnvelope<CS: CipherSuite> {
+    pub(crate) client_static_keypair: KeyPair<CS::Group>,
+    pub(crate) export_key: GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
+    pub(crate) id_u: Vec<u8>,
+    pub(crate) id_s: Vec<u8>,
+}
+
+pub(crate) struct OpenedInnerEnvelope<D: Hash> {
+    pub(crate) export_key: GenericArray<u8, <D as Digest>::OutputSize>,
+}
+
+impl<CS: CipherSuite> Envelope<CS> {
     fn hmac_key_size() -> usize {
-        <D as Digest>::OutputSize::to_usize()
-    }
-
-    fn hmac_size() -> usize {
-        <D as Digest>::OutputSize::to_usize()
+        <CS::Hash as Digest>::OutputSize::to_usize()
     }
 
     fn export_key_size() -> usize {
-        ExportKeySize::to_usize()
+        <CS::Hash as Digest>::OutputSize::to_usize()
     }
 
-    pub(crate) fn new(
-        nonce: Vec<u8>,
-        ciphertext: Vec<u8>,
-        hmac: GenericArray<u8, <D as Digest>::OutputSize>,
-    ) -> Self {
-        Self {
+    pub(crate) fn len() -> usize {
+        <CS::Hash as Digest>::OutputSize::to_usize() + NONCE_LEN
+    }
+
+    pub(crate) fn serialize(&self) -> Vec<u8> {
+        [&self.nonce[..], &self.hmac[..]].concat()
+    }
+    pub(crate) fn deserialize(bytes: &[u8]) -> Result<Self, ProtocolError> {
+        let mode = InnerEnvelopeMode::Internal; // Better way to hard-code this?
+
+        if bytes.len() < NONCE_LEN {
+            return Err(ProtocolError::VerificationError(
+                PakeError::SerializationError,
+            ));
+        }
+        let nonce = bytes[..NONCE_LEN].to_vec();
+
+        let remainder = match mode {
+            InnerEnvelopeMode::Zero => {
+                return Err(InternalPakeError::IncompatibleEnvelopeModeError.into())
+            }
+            InnerEnvelopeMode::Internal => bytes[NONCE_LEN..].to_vec(),
+        };
+
+        let hmac_key_size = Self::hmac_key_size();
+        let hmac = check_slice_size(&remainder, hmac_key_size, "hmac_key_size")?;
+
+        Ok(Self {
+            mode,
             nonce,
-            ciphertext,
-            hmac,
+            hmac: GenericArray::clone_from_slice(hmac),
+        })
+    }
+
+    // Creates a dummy envelope object that serializes to the all-zeros byte string
+    pub(crate) fn dummy() -> Self {
+        Self {
+            mode: InnerEnvelopeMode::Zero,
+            nonce: vec![0u8; NONCE_LEN],
+            hmac: GenericArray::clone_from_slice(&vec![
+                0u8;
+                <CS::Hash as Digest>::OutputSize::to_usize()
+            ]),
         }
     }
 
-    /// The format of the output is:
-    /// nonce             | ciphertext       | hmac
-    /// nonce_size bytes  | variable length  | hmac_size bytes
-    pub(crate) fn from_bytes(bytes: &[u8]) -> Result<Self, InternalPakeError> {
-        let ciphertext_start = NONCE_LEN;
-        let ciphertext_end = bytes.len() - Self::hmac_size();
+    #[allow(clippy::type_complexity)]
+    pub(crate) fn seal<R: RngCore + CryptoRng>(
+        rng: &mut R,
+        key: &[u8],
+        server_s_pk: &[u8],
+        optional_ids: Option<Identifiers>,
+    ) -> Result<
+        (
+            Self,
+            PublicKey,
+            GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
+        ),
+        InternalPakeError,
+    > {
+        let mut nonce = vec![0u8; NONCE_LEN];
+        rng.fill_bytes(&mut nonce);
 
-        Ok(Self::new(
-            bytes[..ciphertext_start].to_vec(),
-            bytes[ciphertext_start..ciphertext_end].to_vec(),
-            GenericArray::clone_from_slice(&bytes[ciphertext_end..]),
-        ))
-    }
+        let (mode, client_s_pk) = (
+            InnerEnvelopeMode::Internal,
+            build_inner_envelope_internal::<CS>(key, &nonce)?,
+        );
 
-    pub(crate) fn to_bytes(&self) -> Vec<u8> {
-        [&self.nonce[..], &self.ciphertext[..], &self.hmac[..]].concat()
+        let (id_u, id_s) =
+            bytestrings_from_identifiers(&optional_ids, &client_s_pk.to_arr(), server_s_pk);
+        let aad = construct_aad(&id_u, &id_s, server_s_pk);
+
+        let (envelope, export_key) = Self::seal_raw(key, &nonce, &aad, mode)?;
+        Ok((envelope, client_s_pk, export_key))
     }
 
     /// Uses a key to convert the plaintext into an envelope, authenticated by the aad field.
     /// Note that a new nonce is sampled for each call to seal.
-    pub(crate) fn seal<R: RngCore + CryptoRng>(
+    #[allow(clippy::type_complexity)]
+    pub(crate) fn seal_raw(
         key: &[u8],
-        plaintext: &[u8],
+        nonce: &[u8],
         aad: &[u8],
-        rng: &mut R,
-    ) -> Result<(Self, GenericArray<u8, ExportKeySize>), InternalPakeError> {
-        let mut nonce = vec![0u8; NONCE_LEN];
-        rng.fill_bytes(&mut nonce);
+        mode: InnerEnvelopeMode,
+    ) -> Result<(Self, GenericArray<u8, <CS::Hash as Digest>::OutputSize>), InternalPakeError> {
+        let h = Hkdf::<CS::Hash>::new(None, key);
+        let mut hmac_key = vec![0u8; Self::hmac_key_size()];
+        let mut export_key = vec![0u8; Self::export_key_size()];
 
-        let h = Hkdf::<D>::new(Some(&nonce), &key);
-        let mut okm = vec![0u8; plaintext.len() + Self::hmac_key_size() + Self::export_key_size()];
-        h.expand(STR_ENVU, &mut okm)
+        h.expand(&[nonce, STR_AUTH_KEY].concat(), &mut hmac_key)
+            .map_err(|_| InternalPakeError::HkdfError)?;
+        h.expand(&[nonce, STR_EXPORT_KEY].concat(), &mut export_key)
             .map_err(|_| InternalPakeError::HkdfError)?;
-        let xor_key = &okm[..plaintext.len()];
-        let hmac_key = &okm[plaintext.len()..plaintext.len() + Self::hmac_key_size()];
-        let export_key = &okm[plaintext.len() + Self::hmac_key_size()..];
 
-        let ciphertext: Vec<u8> = xor_key
-            .iter()
-            .zip(plaintext.iter())
-            .map(|(&x1, &x2)| x1 ^ x2)
-            .collect();
+        let mut hmac = Hmac::<CS::Hash>::new_from_slice(&hmac_key)
+            .map_err(|_| InternalPakeError::HmacError)?;
+        hmac.update(nonce);
+        hmac.update(aad);
 
-        let mut hmac =
-            Hmac::<D>::new_varkey(&hmac_key).map_err(|_| InternalPakeError::HmacError)?;
-        hmac.update(&nonce);
-        hmac.update(&ciphertext);
-        hmac.update(&aad);
+        let hmac_bytes = hmac.finalize().into_bytes();
 
         Ok((
-            Self::new(nonce, ciphertext.to_vec(), hmac.finalize().into_bytes()),
-            *GenericArray::from_slice(&export_key),
+            Self {
+                mode,
+                nonce: nonce.to_vec(),
+                hmac: hmac_bytes,
+            },
+            GenericArray::clone_from_slice(&export_key),
         ))
     }
 
+    pub(crate) fn open(
+        &self,
+        key: &[u8],
+        server_s_pk: &[u8],
+        optional_ids: &Option<Identifiers>,
+    ) -> Result<OpenedEnvelope<CS>, InternalPakeError> {
+        let client_static_keypair = match self.mode {
+            InnerEnvelopeMode::Zero => {
+                return Err(InternalPakeError::IncompatibleEnvelopeModeError)
+            }
+            InnerEnvelopeMode::Internal => recover_keys_internal::<CS>(key, &self.nonce)?,
+        };
+
+        let (id_u, id_s) = bytestrings_from_identifiers(
+            optional_ids,
+            &client_static_keypair.public().to_arr(),
+            server_s_pk,
+        );
+        let aad = construct_aad(&id_u, &id_s, server_s_pk);
+
+        let opened = self.open_raw(key, &aad)?;
+
+        Ok(OpenedEnvelope {
+            client_static_keypair,
+            export_key: opened.export_key,
+            id_u,
+            id_s,
+        })
+    }
+
     /// Attempts to decrypt the envelope using a key, which is successful only if the key and
     /// aad used to construct the envelope are the same.
-    pub(crate) fn open(&self, key: &[u8], aad: &[u8]) -> Result<OpenedEnvelope, InternalPakeError> {
-        let h = Hkdf::<D>::new(Some(&self.nonce), &key);
-        let mut okm =
-            vec![0u8; self.ciphertext.len() + Self::hmac_key_size() + Self::export_key_size()];
-        h.expand(STR_ENVU, &mut okm)
-            .map_err(|_| InternalPakeError::HkdfError)?;
-        let xor_key = &okm[..self.ciphertext.len()];
-        let hmac_key = &okm[self.ciphertext.len()..self.ciphertext.len() + Self::hmac_key_size()];
-        let export_key = &okm[self.ciphertext.len() + Self::hmac_key_size()..];
+    pub(crate) fn open_raw(
+        &self,
+        key: &[u8],
+        aad: &[u8],
+    ) -> Result<OpenedInnerEnvelope<CS::Hash>, InternalPakeError> {
+        let h = Hkdf::<CS::Hash>::new(None, key);
+        let mut hmac_key = vec![0u8; Self::hmac_key_size()];
+        let mut export_key = vec![0u8; Self::export_key_size()];
 
-        let mut hmac =
-            Hmac::<D>::new_varkey(&hmac_key).map_err(|_| InternalPakeError::HmacError)?;
+        h.expand(&[&self.nonce, STR_AUTH_KEY].concat(), &mut hmac_key)
+            .map_err(|_| InternalPakeError::HkdfError)?;
+        h.expand(&[&self.nonce, STR_EXPORT_KEY].concat(), &mut export_key)
+            .map_err(|_| InternalPakeError::HkdfError)?;
+
+        let mut hmac = Hmac::<CS::Hash>::new_from_slice(&hmac_key)
+            .map_err(|_| InternalPakeError::HmacError)?;
         hmac.update(&self.nonce);
-        hmac.update(&self.ciphertext);
         hmac.update(aad);
         if hmac.verify(&self.hmac).is_err() {
             return Err(InternalPakeError::SealOpenHmacError);
         }
 
-        let plaintext: Vec<u8> = xor_key
-            .iter()
-            .zip(self.ciphertext.iter())
-            .map(|(&x1, &x2)| x1 ^ x2)
-            .collect();
-        Ok(OpenedEnvelope {
-            plaintext,
-            export_key: *GenericArray::from_slice(&export_key),
+        Ok(OpenedInnerEnvelope {
+            export_key: GenericArray::<u8, <CS::Hash as Digest>::OutputSize>::clone_from_slice(
+                &export_key,
+            ),
         })
     }
-}
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rand_core::OsRng;
-
-    #[test]
-    fn seal_and_open() {
-        let mut rng = OsRng;
-        let mut key = [0u8; 32];
-        rng.fill_bytes(&mut key);
-
-        let mut msg = [0u8; 100];
-        rng.fill_bytes(&mut msg);
-
-        let (envelope, export_key_1) =
-            Envelope::<sha2::Sha256>::seal(&key, &msg, b"aad", &mut rng).unwrap();
-        let opened_envelope = envelope.open(&key, b"aad").unwrap();
-        assert_eq!(&msg.to_vec(), &opened_envelope.plaintext);
-        assert_eq!(&export_key_1.to_vec(), &opened_envelope.export_key.to_vec());
+    #[cfg(test)]
+    pub fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
+        vec![(self.hmac.as_ptr(), self.hmac.len())]
     }
 }
+
+// This can't be derived because of the use of a phantom parameter
+impl<CS: CipherSuite> Zeroize for Envelope<CS> {
+    fn zeroize(&mut self) {
+        self.mode.zeroize();
+        self.nonce.zeroize();
+        self.hmac.zeroize();
+    }
+}
+
+impl<CS: CipherSuite> Drop for Envelope<CS> {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}
+
+// Helper functions
+
+fn construct_aad(id_u: &[u8], id_s: &[u8], server_s_pk: &[u8]) -> Vec<u8> {
+    [server_s_pk, id_s, id_u].concat()
+}

src/errors.rs

@@ -8,8 +8,10 @@ use displaydoc::Display;
 use thiserror::Error;
 
 /// Represents an error in the manipulation of internal cryptographic data
-#[derive(Debug, Display, Error)]
+#[derive(Clone, Debug, Display, Error, Eq, Hash, PartialEq)]
 pub enum InternalPakeError {
+    /// Deserializing from a byte sequence failed
+    InvalidByteSequence,
     /// Invalid length for {name}: expected {len}, but is actually {actual_len}.
     SizeError {
         /// name
@@ -25,6 +27,8 @@ pub enum InternalPakeError {
     SubGroupError,
     /// hashing to a key failed
     HashingFailure,
+    /// Computing the hash-to-curve function failed
+    HashToCurveError,
     /// Computing HKDF failed while deriving subkeys
     HkdfError,
     /// Computing HMAC failed while supplying a secret key
@@ -40,10 +44,19 @@ pub enum InternalPakeError {
     /// This error occurs when the envelope seal open hmac check fails
     /// HMAC check in seal open failed.
     SealOpenHmacError,
+    /// This error occurs when the envelope cannot be constructed properly
+    /// based on the credentials that were specified to be required.
+    InvalidEnvelopeStructureError,
+    /// This error occurs when attempting to open an envelope of the wrong
+    /// type (base mode, custom identifier)
+    IncompatibleEnvelopeModeError,
+    /// This error occurs when the envelope is opened and deserialization
+    /// fails
+    UnexpectedEnvelopeContentsError,
 }
 
 /// Represents an error in password checking
-#[derive(Debug, Display, Error)]
+#[derive(Clone, Debug, Display, Error, Eq, Hash, PartialEq)]
 pub enum PakeError {
     /// This error results from an internal error during PRF construction
     ///
@@ -58,6 +71,10 @@ pub enum PakeError {
     KeyExchangeMacValidationError,
     /// Error in validating credentials
     InvalidLoginError,
+    /// Error with serializing / deserializing protocol messages
+    SerializationError,
+    /// Identity group element was encountered during deserialization, which is invalid
+    IdentityGroupElementError,
 }
 
 // This is meant to express future(ly) non-trivial ways of converting the
@@ -69,15 +86,20 @@ impl From<InternalPakeError> for PakeError {
 }
 
 /// Represents an error in protocol handling
-#[derive(Debug, Display, Error)]
+#[derive(Clone, Debug, Display, Error, Eq, Hash, PartialEq)]
 pub enum ProtocolError {
     /// This error results from an error during password verification
     ///
     /// Internal error during password verification: {0}
     VerificationError(PakeError),
+    /// This error occurs when the inner envelope is malformed
+    InvalidInnerEnvelopeError,
     /// This error occurs when the server answer cannot be handled
     /// Server response cannot be handled.
     ServerError,
+    /// This error occurs when the server specifies an envelope credentials
+    /// format that is invalid
+    ServerInvalidEnvelopeCredentialsFormatError,
     /// This error occurs when the client request cannot be handled
     /// Client request cannot be handled.
     ClientError,
@@ -108,6 +130,24 @@ impl From<::std::convert::Infallible> for ProtocolError {
     }
 }
 
+impl From<generic_bytes::TryFromSizedBytesError> for InternalPakeError {
+    fn from(_: generic_bytes::TryFromSizedBytesError) -> Self {
+        InternalPakeError::InvalidByteSequence
+    }
+}
+
+impl From<generic_bytes::TryFromSizedBytesError> for PakeError {
+    fn from(e: generic_bytes::TryFromSizedBytesError) -> Self {
+        PakeError::CryptoError(e.into())
+    }
+}
+
+impl From<generic_bytes::TryFromSizedBytesError> for ProtocolError {
+    fn from(e: generic_bytes::TryFromSizedBytesError) -> Self {
+        PakeError::CryptoError(e.into()).into()
+    }
+}
+
 pub(crate) mod utils {
     use super::*;
 
@@ -125,4 +165,19 @@ pub(crate) mod utils {
         }
         Ok(slice)
     }
+
+    pub fn check_slice_size_atleast<'a>(
+        slice: &'a [u8],
+        expected_len: usize,
+        arg_name: &'static str,
+    ) -> Result<&'a [u8], InternalPakeError> {
+        if slice.len() < expected_len {
+            return Err(InternalPakeError::SizeError {
+                name: arg_name,
+                len: expected_len,
+                actual_len: slice.len(),
+            });
+        }
+        Ok(slice)
+    }
 }

src/group.rs

@@ -6,35 +6,37 @@
 //! Defines the Group trait to specify the underlying prime order group used in
 //! OPAQUE's OPRF
 
-use crate::elligator;
 use crate::errors::InternalPakeError;
 
 use curve25519_dalek::{
-    edwards::{CompressedEdwardsY, EdwardsPoint},
+    constants::RISTRETTO_BASEPOINT_POINT,
     ristretto::{CompressedRistretto, RistrettoPoint},
     scalar::Scalar,
+    traits::Identity,
 };
 use generic_array::{
     typenum::{U32, U64},
     ArrayLength, GenericArray,
 };
-use rand_core::{CryptoRng, RngCore};
+use std::convert::TryInto;
+
+use rand::{CryptoRng, RngCore};
 use std::ops::Mul;
 use zeroize::Zeroize;
 
 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
 /// subgroup is noted additively — as in the draft RFC — in this trait.
-pub trait Group: Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self> {
+pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self> {
     /// The type of base field scalars
-    type Scalar: Zeroize;
+    type Scalar: Zeroize + Clone;
     /// The byte length necessary to represent scalars
     type ScalarLen: ArrayLength<u8>;
-    /// Return a scalat from its fixed-length bytes representation
+    /// Return a scalar from its fixed-length bytes representation
     fn from_scalar_slice(
         scalar_bits: &GenericArray<u8, Self::ScalarLen>,
     ) -> Result<Self::Scalar, InternalPakeError>;
     /// picks a scalar at random
-    fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar;
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar;
     /// Serializes a scalar to bytes
     fn scalar_as_bytes(scalar: &Self::Scalar) -> &GenericArray<u8, Self::ScalarLen>;
     /// The multiplicative inverse of this scalar
@@ -57,6 +59,15 @@ pub trait Group: Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self>
 
     /// Hashes a slice of pseudo-random bytes of the correct length to a curve point
     fn hash_to_curve(uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>) -> Self;
+
+    /// Get the base point for the group
+    fn base_point() -> Self;
+
+    /// Multiply the point by a scalar, represented as a slice
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self;
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool;
 }
 
 /// The implementation of such a subgroup for Ristretto
@@ -70,8 +81,29 @@ impl Group for RistrettoPoint {
         bits.copy_from_slice(scalar_bits);
         Ok(Scalar::from_bytes_mod_order(bits))
     }
-    fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
-        Scalar::random(rng)
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar;
+            }
+        }
     }
     fn scalar_as_bytes(scalar: &Self::Scalar) -> &GenericArray<u8, Self::ScalarLen> {
         GenericArray::from_slice(scalar.as_bytes())
@@ -105,111 +137,18 @@ impl Group for RistrettoPoint {
         };
         RistrettoPoint::from_uniform_bytes(&bits)
     }
-}
 
-/// The implementation of such a subgroup for points on the large Curve25519-subgroup
-impl Group for EdwardsPoint {
-    type Scalar = Scalar;
-    type ScalarLen = U32;
-    fn from_scalar_slice(
-        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
-    ) -> Result<Self::Scalar, InternalPakeError> {
-        let mut bits = [0u8; 32];
-        bits.copy_from_slice(scalar_bits);
-        Ok(Scalar::from_bytes_mod_order(bits))
-    }
-    fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
-        Scalar::random(rng)
-    }
-    fn scalar_as_bytes(scalar: &Self::Scalar) -> &GenericArray<u8, Self::ScalarLen> {
-        GenericArray::from_slice(scalar.as_bytes())
-    }
-    fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar {
-        scalar.invert()
+    fn base_point() -> Self {
+        RISTRETTO_BASEPOINT_POINT
     }
 
-    // The byte length necessary to represent group elements
-    type ElemLen = U32;
-    fn from_element_slice(
-        element_bits: &GenericArray<u8, Self::ElemLen>,
-    ) -> Result<Self, InternalPakeError> {
-        let point = CompressedEdwardsY::from_slice(element_bits)
-            .decompress()
-            .ok_or(InternalPakeError::PointError)?;
-
-        if point.is_small_order() {
-            return Err(InternalPakeError::SubGroupError);
-        }
-        Ok(point)
-    }
-    // serialization of a group element
-    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
-        let c = self.compress();
-        *GenericArray::from_slice(c.as_bytes())
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        let arr: [u8; 32] = scalar.as_slice().try_into().expect("Wrong length");
+        self * Scalar::from_bits(arr)
     }
 
-    type UniformBytesLen = U32;
-    fn hash_to_curve(uniform_bytes: &GenericArray<u8, Self::UniformBytesLen>) -> Self {
-        elligator::hash_to_point(uniform_bytes)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use anyhow::{anyhow, Result};
-    use std::convert::TryInto;
-
-    const EIGHT_TORSION: [[u8; 32]; 8] = [
-        [
-            1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-            0, 0, 0,
-        ],
-        [
-            199, 23, 106, 112, 61, 77, 216, 79, 186, 60, 11, 118, 13, 16, 103, 15, 42, 32, 83, 250,
-            44, 57, 204, 198, 78, 199, 253, 119, 146, 172, 3, 122,
-        ],
-        [
-            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-            0, 0, 128,
-        ],
-        [
-            38, 232, 149, 143, 194, 178, 39, 176, 69, 195, 244, 137, 242, 239, 152, 240, 213, 223,
-            172, 5, 211, 198, 51, 57, 177, 56, 2, 136, 109, 83, 252, 5,
-        ],
-        [
-            236, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
-            255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 127,
-        ],
-        [
-            38, 232, 149, 143, 194, 178, 39, 176, 69, 195, 244, 137, 242, 239, 152, 240, 213, 223,
-            172, 5, 211, 198, 51, 57, 177, 56, 2, 136, 109, 83, 252, 133,
-        ],
-        [
-            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-            0, 0, 0,
-        ],
-        [
-            199, 23, 106, 112, 61, 77, 216, 79, 186, 60, 11, 118, 13, 16, 103, 15, 42, 32, 83, 250,
-            44, 57, 204, 198, 78, 199, 253, 119, 146, 172, 3, 250,
-        ],
-    ];
-
-    fn deserialize_point(pt: &[u8]) -> Result<EdwardsPoint> {
-        let bytes: [u8; 32] = (&pt[..32])
-            .try_into()
-            .expect("Slice pattern invariant broken");
-
-        curve25519_dalek::edwards::CompressedEdwardsY(bytes)
-            .decompress()
-            .ok_or_else(|| anyhow!("Point decompression failed!"))
-    }
-
-    #[test]
-    fn test_small_subgroup_edwards() {
-        for pt in &EIGHT_TORSION[..] {
-            assert!(deserialize_point(&pt[..]).is_ok());
-            assert!(EdwardsPoint::from_element_slice(GenericArray::from_slice(&pt[..])).is_err());
-        }
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool {
+        self == &Self::identity()
     }
 }

src/impls.rs

@@ -0,0 +1,102 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+macro_rules! impl_debug_eq_hash_for {
+    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
+        impl$(<$($gen$(: $bound)?),+>)? std::fmt::Debug for $name$(<$($gen),+>)?
+        $(where $($type: std::fmt::Debug,)+)?
+        {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                f.debug_struct("$name")
+                .field("$field1", &self.$field1)
+                $(.field("$field2", &self.$field2))*
+                .finish()
+            }
+        }
+
+        impl$(<$($gen$(: $bound)?),+>)? Eq for $name$(<$($gen),+>)?
+        $(where $($type: Eq,)+)?
+        {}
+
+        impl$(<$($gen$(: $bound)?),+>)? PartialEq for $name$(<$($gen),+>)?
+        $(where $($type: PartialEq,)+)?
+        {
+            fn eq(&self, other: &Self) -> bool {
+                PartialEq::eq(&self.$field1, &other.$field1)
+                $(&& PartialEq::eq(&self.$field2, &other.$field2))*
+            }
+        }
+
+        impl$(<$($gen$(: $bound)?),+>)? std::hash::Hash for $name$(<$($gen),+>)?
+        $(where $($type: std::hash::Hash,)+)?
+        {
+            fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+                std::hash::Hash::hash(&self.$field1, state);
+                $(std::hash::Hash::hash(&self.$field2, state);)*
+            }
+        }
+    };
+    (tuple $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:tt$(, $field2:tt)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
+        impl$(<$($gen$(: $bound)?),+>)? std::fmt::Debug for $name$(<$($gen),+>)?
+        $(where $($type: std::fmt::Debug,)+)?
+        {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                f.debug_tuple("$name")
+                .field(&self.$field1)
+                $(.field(&self.$field2))*
+                .finish()
+            }
+        }
+
+        impl$(<$($gen$(: $bound)?),+>)? Eq for $name$(<$($gen),+>)?
+        $(where $($type: Eq,)+)?
+        {}
+
+        impl$(<$($gen$(: $bound)?),+>)? PartialEq for $name$(<$($gen),+>)?
+        $(where $($type: PartialEq,)+)?
+        {
+            fn eq(&self, other: &Self) -> bool {
+                PartialEq::eq(&self.$field1, &other.$field1)
+                $(&& PartialEq::eq(&self.$field2, &other.$field2))*
+            }
+        }
+
+        impl$(<$($gen$(: $bound)?),+>)? std::hash::Hash for $name$(<$($gen),+>)?
+        $(where $($type: std::hash::Hash,)+)?
+        {
+            fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+                std::hash::Hash::hash(&self.$field1, state);
+                $(std::hash::Hash::hash(&self.$field2, state);)*
+            }
+        }
+    };
+}
+
+macro_rules! impl_clone_for {
+    (struct $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:ident$(, $field2:ident)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
+        impl$(<$($gen$(: $bound)?),+>)? Clone for $name$(<$($gen),+>)?
+        $(where $($type: Clone,)+)?
+        {
+            fn clone(&self) -> Self {
+                Self {
+                    $field1: self.$field1.clone(),
+                    $($field2: self.$field2.clone(),)*
+                }
+            }
+        }
+    };
+    (tuple $name:ident$(<$($gen:ident$(: $bound:tt)?),+$(,)?>)?, [$field1:tt$(, $field2:tt)*$(,)?]$(, )?$([$($type:ty),+$(,)?]$(,)?)?) => {
+        impl$(<$($gen$(: $bound)?),+>)? Clone for $name$(<$($gen),+>)?
+        $(where $($type: Clone,)+)?
+        {
+            fn clone(&self) -> Self {
+                Self(
+                    self.$field1.clone(),
+                    $(self.$field2.clone(),)*
+                )
+            }
+        }
+    };
+}

src/key_exchange/traits.rs

@@ -4,53 +4,73 @@
 // LICENSE file in the root directory of this source tree.
 
 use crate::{
-    errors::{InternalPakeError, ProtocolError},
+    ciphersuite::CipherSuite,
+    errors::{PakeError, ProtocolError},
+    group::Group,
     hash::Hash,
-    keypair::KeyPair,
+    keypair::{PrivateKey, PublicKey},
 };
-use rand_core::{CryptoRng, RngCore};
+use rand::{CryptoRng, RngCore};
+use zeroize::Zeroize;
 
-use std::convert::TryFrom;
-
-pub trait KeyExchange<D: Hash, KeyFormat: KeyPair> {
-    type KE1State: for<'r> TryFrom<&'r [u8], Error = InternalPakeError> + ToBytes;
-    type KE2State: for<'r> TryFrom<&'r [u8], Error = InternalPakeError> + ToBytes;
-    type KE1Message: for<'r> TryFrom<&'r [u8], Error = InternalPakeError> + ToBytes;
-    type KE2Message: for<'r> TryFrom<&'r [u8], Error = InternalPakeError> + ToBytes;
-    type KE3Message: for<'r> TryFrom<&'r [u8], Error = InternalPakeError> + ToBytes;
+pub trait KeyExchange<D: Hash, G: Group> {
+    type KE1State: FromBytes + ToBytesWithPointers + Zeroize + Clone;
+    type KE2State: FromBytes + ToBytesWithPointers + Zeroize + Clone;
+    type KE1Message: FromBytes + ToBytes + Clone;
+    type KE2Message: FromBytes + ToBytes + Clone;
+    type KE3Message: FromBytes + ToBytes + Clone;
 
     fn generate_ke1<R: RngCore + CryptoRng>(
-        l1_component: Vec<u8>,
         rng: &mut R,
     ) -> Result<(Self::KE1State, Self::KE1Message), ProtocolError>;
 
+    #[allow(clippy::too_many_arguments, clippy::type_complexity)]
     fn generate_ke2<R: RngCore + CryptoRng>(
         rng: &mut R,
         l1_bytes: Vec<u8>,
         l2_bytes: Vec<u8>,
         ke1_message: Self::KE1Message,
-        client_s_pk: KeyFormat::Repr,
-        server_s_sk: KeyFormat::Repr,
+        client_s_pk: PublicKey,
+        server_s_sk: PrivateKey,
+        id_u: Vec<u8>,
+        id_s: Vec<u8>,
+        context: Vec<u8>,
     ) -> Result<(Self::KE2State, Self::KE2Message), ProtocolError>;
 
+    #[allow(clippy::too_many_arguments, clippy::type_complexity)]
     fn generate_ke3(
         l2_component: Vec<u8>,
         ke2_message: Self::KE2Message,
         ke1_state: &Self::KE1State,
-        server_s_pk: KeyFormat::Repr,
-        client_s_sk: KeyFormat::Repr,
+        serialized_credential_request: &[u8],
+        server_s_pk: PublicKey,
+        client_s_sk: PrivateKey,
+        id_u: Vec<u8>,
+        id_s: Vec<u8>,
+        context: Vec<u8>,
     ) -> Result<(Vec<u8>, Self::KE3Message), ProtocolError>;
 
+    #[allow(clippy::type_complexity)]
     fn finish_ke(
         ke3_message: Self::KE3Message,
         ke2_state: &Self::KE2State,
     ) -> Result<Vec<u8>, ProtocolError>;
 
-    fn ke1_state_size() -> usize;
-
     fn ke2_message_size() -> usize;
 }
 
+pub trait FromBytes: Sized {
+    fn from_bytes<CS: CipherSuite>(input: &[u8]) -> Result<Self, PakeError>;
+}
+
 pub trait ToBytes {
     fn to_bytes(&self) -> Vec<u8>;
 }
+
+pub trait ToBytesWithPointers {
+    fn to_bytes(&self) -> Vec<u8>;
+
+    // Only used for tests to grab raw pointers to data
+    #[cfg(test)]
+    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)>;
+}

src/key_exchange/tripledh.rs

@@ -5,426 +5,527 @@
 
 //! An implementation of the Triple Diffie-Hellman key exchange protocol
 use crate::{
-    errors::{utils::check_slice_size, InternalPakeError, PakeError, ProtocolError},
+    ciphersuite::CipherSuite,
+    errors::{
+        utils::{check_slice_size, check_slice_size_atleast},
+        InternalPakeError, PakeError, ProtocolError,
+    },
+    group::Group,
     hash::Hash,
-    key_exchange::traits::{KeyExchange, ToBytes},
-    keypair::{KeyPair, SizedBytes},
+    key_exchange::traits::{FromBytes, KeyExchange, ToBytes, ToBytesWithPointers},
+    keypair::{KeyPair, PrivateKey, PublicKey, SizedBytesExt},
+    serialization::serialize,
 };
 use digest::{Digest, FixedOutput};
 use generic_array::{
     typenum::{Unsigned, U32},
     ArrayLength, GenericArray,
 };
+use generic_bytes::SizedBytes;
 use hkdf::Hkdf;
 use hmac::{Hmac, Mac, NewMac};
-use rand_core::{CryptoRng, RngCore};
-
+use rand::{CryptoRng, RngCore};
 use std::convert::TryFrom;
+use zeroize::Zeroize;
 
 const KEY_LEN: usize = 32;
-pub(crate) const NONCE_LEN: usize = 32;
 pub(crate) type NonceLen = U32;
-const KE1_STATE_LEN: usize = KEY_LEN + KEY_LEN + NONCE_LEN;
 
-static STR_3DH: &[u8] = b"3DH keys";
+static STR_RFC: &[u8] = b"RFCXXXX";
+static STR_CLIENT_MAC: &[u8] = b"ClientMAC";
+static STR_HANDSHAKE_SECRET: &[u8] = b"HandshakeSecret";
+static STR_SERVER_MAC: &[u8] = b"ServerMAC";
+static STR_SESSION_KEY: &[u8] = b"SessionKey";
+static STR_OPAQUE: &[u8] = b"OPAQUE-";
 
+#[allow(clippy::upper_case_acronyms)]
 /// The Triple Diffie-Hellman key exchange implementation
 pub struct TripleDH;
 
-impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
-    type KE1State = KE1State<<D as FixedOutput>::OutputSize, KeyFormat>;
-    type KE2State = KE2State<<D as FixedOutput>::OutputSize>;
-    type KE1Message = KE1Message<KeyFormat>;
-    type KE2Message = KE2Message<<D as FixedOutput>::OutputSize, KeyFormat>;
-    type KE3Message = KE3Message<<D as FixedOutput>::OutputSize>;
+impl<D: Hash, G: Group> KeyExchange<D, G> for TripleDH {
+    type KE1State = Ke1State;
+    type KE2State = Ke2State<<D as FixedOutput>::OutputSize>;
+    type KE1Message = Ke1Message;
+    type KE2Message = Ke2Message<<D as FixedOutput>::OutputSize>;
+    type KE3Message = Ke3Message<<D as FixedOutput>::OutputSize>;
 
     fn generate_ke1<R: RngCore + CryptoRng>(
-        l1_component: Vec<u8>,
         rng: &mut R,
     ) -> Result<(Self::KE1State, Self::KE1Message), ProtocolError> {
-        let client_e_kp = KeyFormat::generate_random(rng)?;
-        let client_nonce: GenericArray<u8, NonceLen> = {
-            let mut client_nonce_bytes = [0u8; NONCE_LEN];
-            rng.fill_bytes(&mut client_nonce_bytes);
-            client_nonce_bytes.into()
-        };
+        let client_e_kp = KeyPair::<G>::generate_random(rng);
+        let client_nonce = generate_nonce::<R>(rng);
 
-        let ke1_message = KE1Message {
+        let ke1_message = Ke1Message {
             client_nonce,
             client_e_pk: client_e_kp.public().clone(),
         };
 
-        let l1_data: Vec<u8> = [&l1_component[..], &ke1_message.to_bytes()].concat();
-        let mut hasher = D::new();
-        hasher.update(&l1_data);
-        let hashed_l1 = hasher.finalize();
-
         Ok((
-            KE1State {
+            Ke1State {
                 client_e_sk: client_e_kp.private().clone(),
                 client_nonce,
-                hashed_l1,
             },
             ke1_message,
         ))
     }
 
+    #[allow(clippy::type_complexity)]
     fn generate_ke2<R: RngCore + CryptoRng>(
         rng: &mut R,
-        l1_bytes: Vec<u8>,
+        serialized_credential_request: Vec<u8>,
         l2_bytes: Vec<u8>,
         ke1_message: Self::KE1Message,
-        client_s_pk: KeyFormat::Repr,
-        server_s_sk: KeyFormat::Repr,
+        client_s_pk: PublicKey,
+        server_s_sk: PrivateKey,
+        id_u: Vec<u8>,
+        id_s: Vec<u8>,
+        context: Vec<u8>,
     ) -> Result<(Self::KE2State, Self::KE2Message), ProtocolError> {
-        let server_e_kp = KeyFormat::generate_random(rng)?;
-        let server_nonce: GenericArray<u8, NonceLen> = {
-            let mut server_nonce_bytes = [0u8; NONCE_LEN];
-            rng.fill_bytes(&mut server_nonce_bytes);
-            server_nonce_bytes.into()
-        };
+        let server_e_kp = KeyPair::<G>::generate_random(rng);
+        let server_nonce = generate_nonce::<R>(rng);
 
-        let (shared_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
+        let mut transcript_hasher = D::new()
+            .chain(STR_RFC)
+            .chain(&serialize(&context, 2))
+            .chain(&id_u)
+            .chain(&serialized_credential_request[..])
+            .chain(&id_s)
+            .chain(&l2_bytes[..])
+            .chain(&server_nonce[..])
+            .chain(&server_e_kp.public().to_arr());
+
+        let (session_key, km2, km3) = derive_3dh_keys::<D, G>(
             TripleDHComponents {
                 pk1: ke1_message.client_e_pk.clone(),
                 sk1: server_e_kp.private().clone(),
                 pk2: ke1_message.client_e_pk,
-                sk2: server_s_sk.clone(),
-                pk3: client_s_pk.clone(),
+                sk2: server_s_sk,
+                pk3: client_s_pk,
                 sk3: server_e_kp.private().clone(),
             },
-            &ke1_message.client_nonce,
-            &server_nonce,
-            client_s_pk,
-            KeyFormat::public_from_private(&server_s_sk),
+            &transcript_hasher.clone().finalize(),
         )?;
 
-        let mut hasher = D::new();
-        hasher.update(&l1_bytes);
-        let hashed_l1 = hasher.finalize();
+        let mut mac_hasher =
+            Hmac::<D>::new_from_slice(&km2).map_err(|_| InternalPakeError::HmacError)?;
+        mac_hasher.update(&transcript_hasher.clone().finalize());
+        let mac = mac_hasher.finalize().into_bytes();
 
-        let transcript2: Vec<u8> = [
-            &hashed_l1[..],
-            &l2_bytes[..],
-            &server_nonce[..],
-            &server_e_kp.public().to_arr(),
-        ]
-        .concat();
-
-        let mut hasher2 = D::new();
-        hasher2.update(&transcript2);
-        let hashed_transcript = hasher2.finalize();
-
-        let mut mac = Hmac::<D>::new_varkey(&km2).map_err(|_| InternalPakeError::HmacError)?;
-        mac.update(&hashed_transcript);
+        transcript_hasher.update(&mac);
 
         Ok((
-            KE2State {
+            Ke2State {
                 km3,
-                hashed_transcript,
-                shared_secret,
+                hashed_transcript: transcript_hasher.finalize(),
+                session_key,
             },
-            KE2Message {
+            Ke2Message {
                 server_nonce,
                 server_e_pk: server_e_kp.public().clone(),
-                mac: mac.finalize().into_bytes(),
+                mac,
             },
         ))
     }
 
+    #[allow(clippy::type_complexity)]
     fn generate_ke3(
         l2_component: Vec<u8>,
         ke2_message: Self::KE2Message,
         ke1_state: &Self::KE1State,
-        server_s_pk: KeyFormat::Repr,
-        client_s_sk: KeyFormat::Repr,
+        serialized_credential_request: &[u8],
+        server_s_pk: PublicKey,
+        client_s_sk: PrivateKey,
+        id_u: Vec<u8>,
+        id_s: Vec<u8>,
+        context: Vec<u8>,
     ) -> Result<(Vec<u8>, Self::KE3Message), ProtocolError> {
-        let (shared_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
+        let mut transcript_hasher = D::new()
+            .chain(STR_RFC)
+            .chain(&serialize(&context, 2))
+            .chain(&id_u)
+            .chain(&serialized_credential_request)
+            .chain(&id_s)
+            .chain(&l2_component[..])
+            .chain(&ke2_message.to_bytes_without_info_or_mac());
+
+        let (session_key, km2, km3) = derive_3dh_keys::<D, G>(
             TripleDHComponents {
                 pk1: ke2_message.server_e_pk.clone(),
                 sk1: ke1_state.client_e_sk.clone(),
-                pk2: server_s_pk.clone(),
+                pk2: server_s_pk,
                 sk2: ke1_state.client_e_sk.clone(),
                 pk3: ke2_message.server_e_pk.clone(),
-                sk3: client_s_sk.clone(),
+                sk3: client_s_sk,
             },
-            &ke1_state.client_nonce,
-            &ke2_message.server_nonce,
-            KeyFormat::public_from_private(&client_s_sk),
-            server_s_pk,
+            &transcript_hasher.clone().finalize(),
         )?;
 
-        let transcript: Vec<u8> = [
-            &ke1_state.hashed_l1[..],
-            &l2_component[..],
-            &ke2_message.server_nonce[..],
-            &ke2_message.server_e_pk.to_arr(),
-        ]
-        .concat();
-
-        let mut hasher = D::new();
-        hasher.update(&transcript);
-        let hashed_transcript = hasher.finalize();
-
         let mut server_mac =
-            Hmac::<D>::new_varkey(&km2).map_err(|_| InternalPakeError::HmacError)?;
-        server_mac.update(&hashed_transcript);
+            Hmac::<D>::new_from_slice(&km2).map_err(|_| InternalPakeError::HmacError)?;
+        server_mac.update(&transcript_hasher.clone().finalize());
 
-        if ke2_message.mac != server_mac.finalize().into_bytes() {
+        if server_mac.verify(&ke2_message.mac).is_err() {
             return Err(ProtocolError::VerificationError(
                 PakeError::KeyExchangeMacValidationError,
             ));
         }
 
+        transcript_hasher.update(ke2_message.mac);
+
         let mut client_mac =
-            Hmac::<D>::new_varkey(&km3).map_err(|_| InternalPakeError::HmacError)?;
-        client_mac.update(&hashed_transcript);
+            Hmac::<D>::new_from_slice(&km3).map_err(|_| InternalPakeError::HmacError)?;
+        client_mac.update(&transcript_hasher.finalize());
 
         Ok((
-            shared_secret.to_vec(),
-            KE3Message {
+            session_key.to_vec(),
+            Ke3Message {
                 mac: client_mac.finalize().into_bytes(),
             },
         ))
     }
 
+    #[allow(clippy::type_complexity)]
     fn finish_ke(
         ke3_message: Self::KE3Message,
         ke2_state: &Self::KE2State,
     ) -> Result<Vec<u8>, ProtocolError> {
         let mut client_mac =
-            Hmac::<D>::new_varkey(&ke2_state.km3).map_err(|_| InternalPakeError::HmacError)?;
+            Hmac::<D>::new_from_slice(&ke2_state.km3).map_err(|_| InternalPakeError::HmacError)?;
         client_mac.update(&ke2_state.hashed_transcript);
 
-        if ke3_message.mac != client_mac.finalize().into_bytes() {
+        if client_mac.verify(&ke3_message.mac).is_err() {
             return Err(ProtocolError::VerificationError(
                 PakeError::KeyExchangeMacValidationError,
             ));
         }
 
-        Ok(ke2_state.shared_secret.to_vec())
-    }
-
-    fn ke1_state_size() -> usize {
-        KE1_STATE_LEN
+        Ok(ke2_state.session_key.to_vec())
     }
 
     fn ke2_message_size() -> usize {
-        NONCE_LEN + KEY_LEN + <<D as FixedOutput>::OutputSize as Unsigned>::to_usize()
+        NonceLen::to_usize() + KEY_LEN + <<D as FixedOutput>::OutputSize as Unsigned>::to_usize()
     }
 }
 
 /// The client state produced after the first key exchange message
-#[derive(PartialEq, Eq)]
-pub struct KE1State<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> {
-    client_e_sk: KeyFormat::Repr,
+#[derive(PartialEq, Eq, Debug, Hash, Zeroize, Clone)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+#[zeroize(drop)]
+pub struct Ke1State {
+    client_e_sk: PrivateKey,
     client_nonce: GenericArray<u8, NonceLen>,
-    hashed_l1: GenericArray<u8, HashLen>,
 }
 
 /// The first key exchange message
-#[derive(PartialEq, Eq)]
-pub struct KE1Message<KeyFormat: KeyPair> {
+#[derive(PartialEq, Eq, Debug, Hash, Clone)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+pub struct Ke1Message {
     pub(crate) client_nonce: GenericArray<u8, NonceLen>,
-    pub(crate) client_e_pk: KeyFormat::Repr,
+    pub(crate) client_e_pk: PublicKey,
 }
 
-impl<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> TryFrom<&[u8]> for KE1State<HashLen, KeyFormat> {
-    type Error = InternalPakeError;
-
-    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
-        let checked_bytes = check_slice_size(
-            bytes,
-            KEY_LEN + NONCE_LEN + HashLen::to_usize(),
-            "ke1_state",
-        )?;
+impl FromBytes for Ke1State {
+    fn from_bytes<CS: CipherSuite>(bytes: &[u8]) -> Result<Self, PakeError> {
+        let nonce_len = NonceLen::to_usize();
+        let checked_bytes = check_slice_size_atleast(bytes, KEY_LEN + nonce_len, "ke1_state")?;
 
         Ok(Self {
-            client_e_sk: KeyFormat::Repr::from_bytes(&checked_bytes[..KEY_LEN])?,
+            client_e_sk: PrivateKey::from_bytes(&checked_bytes[..KEY_LEN])?,
             client_nonce: GenericArray::clone_from_slice(
-                &checked_bytes[KEY_LEN..KEY_LEN + NONCE_LEN],
+                &checked_bytes[KEY_LEN..KEY_LEN + nonce_len],
             ),
-            hashed_l1: GenericArray::clone_from_slice(&checked_bytes[KEY_LEN + NONCE_LEN..]),
         })
     }
 }
 
-impl<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> ToBytes for KE1State<HashLen, KeyFormat> {
+impl ToBytesWithPointers for Ke1State {
     fn to_bytes(&self) -> Vec<u8> {
-        let output: Vec<u8> = [
-            &self.client_e_sk.to_arr(),
-            &self.client_nonce[..],
-            &self.hashed_l1[..],
-        ]
-        .concat();
+        let output: Vec<u8> = [&self.client_e_sk.to_arr(), &self.client_nonce[..]].concat();
         output
     }
+
+    #[cfg(test)]
+    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
+        vec![
+            (
+                self.client_e_sk.as_ptr(),
+                <PrivateKey as SizedBytes>::Len::to_usize(),
+            ),
+            (self.client_nonce.as_ptr(), NonceLen::to_usize()),
+        ]
+    }
 }
 
-impl<KeyFormat: KeyPair> ToBytes for KE1Message<KeyFormat> {
+impl ToBytes for Ke1Message {
     fn to_bytes(&self) -> Vec<u8> {
         [&self.client_nonce[..], &self.client_e_pk.to_arr()].concat()
     }
 }
 
-impl<KeyFormat: KeyPair> TryFrom<&[u8]> for KE1Message<KeyFormat> {
-    type Error = InternalPakeError;
-
-    fn try_from(ke1_message_bytes: &[u8]) -> Result<Self, Self::Error> {
-        let checked_bytes =
-            check_slice_size(ke1_message_bytes, NONCE_LEN + KEY_LEN, "ke1_message")?;
+impl FromBytes for Ke1Message {
+    fn from_bytes<CS: CipherSuite>(ke1_message_bytes: &[u8]) -> Result<Self, PakeError> {
+        let nonce_len = NonceLen::to_usize();
+        let checked_nonce =
+            check_slice_size(ke1_message_bytes, nonce_len + KEY_LEN, "ke1_message nonce")?;
 
         Ok(Self {
-            client_nonce: GenericArray::clone_from_slice(&checked_bytes[..NONCE_LEN]),
-            client_e_pk: KeyFormat::Repr::from_bytes(&checked_bytes[NONCE_LEN..])?,
+            client_nonce: GenericArray::clone_from_slice(&checked_nonce[..nonce_len]),
+            client_e_pk: PublicKey::from_bytes(&checked_nonce[nonce_len..])?,
         })
     }
 }
-
 /// The server state produced after the second key exchange message
-pub struct KE2State<HashLen: ArrayLength<u8>> {
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+#[cfg_attr(feature = "serialize", serde(bound = ""))]
+pub struct Ke2State<HashLen: ArrayLength<u8>> {
     km3: GenericArray<u8, HashLen>,
     hashed_transcript: GenericArray<u8, HashLen>,
-    shared_secret: GenericArray<u8, HashLen>,
+    session_key: GenericArray<u8, HashLen>,
+}
+
+// This can't be derived because of the use of a phantom parameter
+impl<HashLen: ArrayLength<u8>> Zeroize for Ke2State<HashLen> {
+    fn zeroize(&mut self) {
+        self.km3.zeroize();
+        self.hashed_transcript.zeroize();
+        self.session_key.zeroize();
+    }
+}
+
+impl<HashLen: ArrayLength<u8>> Drop for Ke2State<HashLen> {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}
+
+impl<HashLen: ArrayLength<u8>> ToBytesWithPointers for Ke2State<HashLen> {
+    fn to_bytes(&self) -> Vec<u8> {
+        [
+            &self.km3[..],
+            &self.hashed_transcript[..],
+            &self.session_key[..],
+        ]
+        .concat()
+    }
+
+    #[cfg(test)]
+    fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
+        vec![
+            (self.km3.as_ptr(), HashLen::to_usize()),
+            (self.hashed_transcript.as_ptr(), HashLen::to_usize()),
+            (self.session_key.as_ptr(), HashLen::to_usize()),
+        ]
+    }
 }
 
 /// The second key exchange message
-pub struct KE2Message<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> {
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+#[cfg_attr(feature = "serialize", serde(bound = ""))]
+pub struct Ke2Message<HashLen: ArrayLength<u8>> {
     server_nonce: GenericArray<u8, NonceLen>,
-    server_e_pk: KeyFormat::Repr,
+    server_e_pk: PublicKey,
     mac: GenericArray<u8, HashLen>,
 }
 
-impl<HashLen: ArrayLength<u8>> ToBytes for KE2State<HashLen> {
-    fn to_bytes(&self) -> Vec<u8> {
-        let output: Vec<u8> = [
-            &self.km3[..],
-            &self.hashed_transcript[..],
-            &self.shared_secret[..],
-        ]
-        .concat();
-        output
-    }
-}
-
-impl<HashLen: ArrayLength<u8>> TryFrom<&[u8]> for KE2State<HashLen> {
-    type Error = InternalPakeError;
-
-    fn try_from(ke1_message_bytes: &[u8]) -> Result<Self, Self::Error> {
-        let checked_bytes = check_slice_size(ke1_message_bytes, 3 * KEY_LEN, "ke2_state")?;
+impl<HashLen: ArrayLength<u8>> FromBytes for Ke2State<HashLen> {
+    fn from_bytes<CS: CipherSuite>(input: &[u8]) -> Result<Self, PakeError> {
+        let hash_len = HashLen::to_usize();
+        let checked_bytes = check_slice_size(input, 3 * hash_len, "ke2_state")?;
 
         Ok(Self {
-            km3: GenericArray::clone_from_slice(&checked_bytes[..KEY_LEN]),
-            hashed_transcript: GenericArray::clone_from_slice(&checked_bytes[KEY_LEN..2 * KEY_LEN]),
-            shared_secret: GenericArray::clone_from_slice(&checked_bytes[2 * KEY_LEN..]),
+            km3: GenericArray::clone_from_slice(&checked_bytes[..hash_len]),
+            hashed_transcript: GenericArray::clone_from_slice(
+                &checked_bytes[hash_len..2 * hash_len],
+            ),
+            session_key: GenericArray::clone_from_slice(&checked_bytes[2 * hash_len..3 * hash_len]),
         })
     }
 }
 
-impl<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> ToBytes for KE2Message<HashLen, KeyFormat> {
+impl<HashLen: ArrayLength<u8>> ToBytes for Ke2Message<HashLen> {
     fn to_bytes(&self) -> Vec<u8> {
-        let output: Vec<u8> = [
-            &self.server_nonce[..],
-            &self.server_e_pk.to_arr(),
-            &self.mac[..],
-        ]
-        .concat();
-        output
+        [&self.to_bytes_without_info_or_mac(), &self.mac[..]].concat()
     }
 }
 
-impl<HashLen: ArrayLength<u8>, KeyFormat: KeyPair> TryFrom<&[u8]>
-    for KE2Message<HashLen, KeyFormat>
-{
-    type Error = InternalPakeError;
+impl<HashLen: ArrayLength<u8>> Ke2Message<HashLen> {
+    fn to_bytes_without_info_or_mac(&self) -> Vec<u8> {
+        [&self.server_nonce[..], &self.server_e_pk.to_arr()].concat()
+    }
+}
 
-    fn try_from(ke2_message_bytes: &[u8]) -> Result<Self, Self::Error> {
-        let ke2_message_len = NONCE_LEN + KEY_LEN + HashLen::to_usize();
-        let checked_bytes = check_slice_size(ke2_message_bytes, ke2_message_len, "ke2_message")?;
+impl<HashLen: ArrayLength<u8>> FromBytes for Ke2Message<HashLen> {
+    fn from_bytes<CS: CipherSuite>(input: &[u8]) -> Result<Self, PakeError> {
+        let nonce_len = NonceLen::to_usize();
+        let checked_nonce = check_slice_size_atleast(input, nonce_len, "ke2_message nonce")?;
+
+        let unchecked_server_e_pk = check_slice_size_atleast(
+            &checked_nonce[nonce_len..],
+            KEY_LEN,
+            "ke2_message server_e_pk",
+        )?;
+        let checked_mac = check_slice_size(
+            &unchecked_server_e_pk[KEY_LEN..],
+            HashLen::to_usize(),
+            "ke1_message mac",
+        )?;
+
+        // Check the public key bytes
+        let server_e_pk = KeyPair::<CS::Group>::check_public_key(PublicKey::from_bytes(
+            &unchecked_server_e_pk[..KEY_LEN],
+        )?)?;
 
         Ok(Self {
-            server_nonce: GenericArray::clone_from_slice(&checked_bytes[..NONCE_LEN]),
-            server_e_pk: KeyFormat::Repr::from_bytes(
-                &checked_bytes[NONCE_LEN..NONCE_LEN + KEY_LEN],
-            )?,
-            mac: GenericArray::clone_from_slice(&checked_bytes[NONCE_LEN + KEY_LEN..]),
+            server_nonce: GenericArray::clone_from_slice(&checked_nonce[..nonce_len]),
+            server_e_pk: PublicKey::from_bytes(&server_e_pk)?,
+            mac: GenericArray::clone_from_slice(checked_mac),
         })
     }
 }
 
+#[allow(clippy::upper_case_acronyms)]
 // The triple of public and private components used in the 3DH computation
-struct TripleDHComponents<KeyFormat: KeyPair> {
-    pk1: KeyFormat::Repr,
-    sk1: KeyFormat::Repr,
-    pk2: KeyFormat::Repr,
-    sk2: KeyFormat::Repr,
-    pk3: KeyFormat::Repr,
-    sk3: KeyFormat::Repr,
+struct TripleDHComponents {
+    pk1: PublicKey,
+    sk1: PrivateKey,
+    pk2: PublicKey,
+    sk2: PrivateKey,
+    pk3: PublicKey,
+    sk3: PrivateKey,
 }
 
-// Consists of a shared secret, followed by two mac keys
+#[allow(clippy::upper_case_acronyms)]
+// Consists of a session key, followed by two mac keys: (session_key, km2, km3)
 type TripleDHDerivationResult<D> = (
     GenericArray<u8, <D as FixedOutput>::OutputSize>,
     GenericArray<u8, <D as FixedOutput>::OutputSize>,
     GenericArray<u8, <D as FixedOutput>::OutputSize>,
 );
 
-// Internal function which takes the public and private components of the client and server keypairs, along
-// with some auxiliary metadata, to produce the shared secret and two MAC keys
-fn derive_3dh_keys<KeyFormat: KeyPair, D: Hash>(
-    dh: TripleDHComponents<KeyFormat>,
-    client_nonce: &GenericArray<u8, NonceLen>,
-    server_nonce: &GenericArray<u8, NonceLen>,
-    client_s_pk: KeyFormat::Repr,
-    server_s_pk: KeyFormat::Repr,
-) -> Result<TripleDHDerivationResult<D>, ProtocolError> {
-    let ikm: Vec<u8> = [
-        &KeyFormat::diffie_hellman(dh.pk1, dh.sk1)[..],
-        &KeyFormat::diffie_hellman(dh.pk2, dh.sk2)[..],
-        &KeyFormat::diffie_hellman(dh.pk3, dh.sk3)[..],
-    ]
-    .concat();
-
-    let info: Vec<u8> = [
-        STR_3DH,
-        &client_nonce,
-        &server_nonce,
-        &client_s_pk.to_arr(),
-        &server_s_pk.to_arr(),
-    ]
-    .concat();
-
-    const OUTPUT_SIZE: usize = 32;
-    let mut okm = [0u8; 3 * OUTPUT_SIZE];
-    let h = Hkdf::<D>::new(None, &ikm);
-    h.expand(&info, &mut okm)
-        .map_err(|_| InternalPakeError::HkdfError)?;
-    Ok((
-        GenericArray::clone_from_slice(&okm[..OUTPUT_SIZE]),
-        GenericArray::clone_from_slice(&okm[OUTPUT_SIZE..2 * OUTPUT_SIZE]),
-        GenericArray::clone_from_slice(&okm[2 * OUTPUT_SIZE..]),
-    ))
-}
-
 /// The third key exchange message
-pub struct KE3Message<HashLen: ArrayLength<u8>> {
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+#[cfg_attr(feature = "serialize", serde(bound = ""))]
+pub struct Ke3Message<HashLen: ArrayLength<u8>> {
     mac: GenericArray<u8, HashLen>,
 }
 
-impl<HashLen: ArrayLength<u8>> ToBytes for KE3Message<HashLen> {
+impl<HashLen: ArrayLength<u8>> ToBytes for Ke3Message<HashLen> {
     fn to_bytes(&self) -> Vec<u8> {
         self.mac.to_vec()
     }
 }
 
-impl<HashLen: ArrayLength<u8>> TryFrom<&[u8]> for KE3Message<HashLen> {
-    type Error = InternalPakeError;
-
-    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
-        let checked_bytes = check_slice_size(bytes, KEY_LEN, "ke3_message")?;
+impl<HashLen: ArrayLength<u8>> FromBytes for Ke3Message<HashLen> {
+    fn from_bytes<CS: CipherSuite>(bytes: &[u8]) -> Result<Self, PakeError> {
+        let checked_bytes = check_slice_size(bytes, HashLen::to_usize(), "ke3_message")?;
 
         Ok(Self {
-            mac: GenericArray::clone_from_slice(&checked_bytes),
+            mac: GenericArray::clone_from_slice(checked_bytes),
         })
     }
 }
+
+// Helper functions
+
+// Internal function which takes the public and private components of the client and server keypairs, along
+// with some auxiliary metadata, to produce the session key and two MAC keys
+fn derive_3dh_keys<D: Hash, G: Group>(
+    dh: TripleDHComponents,
+    hashed_derivation_transcript: &[u8],
+) -> Result<TripleDHDerivationResult<D>, ProtocolError> {
+    let ikm: Vec<u8> = [
+        &KeyPair::<G>::diffie_hellman(dh.pk1, dh.sk1)?[..],
+        &KeyPair::<G>::diffie_hellman(dh.pk2, dh.sk2)?[..],
+        &KeyPair::<G>::diffie_hellman(dh.pk3, dh.sk3)?[..],
+    ]
+    .concat();
+
+    let extracted_ikm = Hkdf::<D>::new(None, &ikm);
+    let handshake_secret = derive_secrets::<D>(
+        &extracted_ikm,
+        STR_HANDSHAKE_SECRET,
+        hashed_derivation_transcript,
+    )?;
+    let session_key = derive_secrets::<D>(
+        &extracted_ikm,
+        STR_SESSION_KEY,
+        hashed_derivation_transcript,
+    )?;
+
+    let km2 = hkdf_expand_label::<D>(
+        &handshake_secret,
+        STR_SERVER_MAC,
+        b"",
+        <D as Digest>::OutputSize::to_usize(),
+    )?;
+    let km3 = hkdf_expand_label::<D>(
+        &handshake_secret,
+        STR_CLIENT_MAC,
+        b"",
+        <D as Digest>::OutputSize::to_usize(),
+    )?;
+
+    Ok((
+        GenericArray::clone_from_slice(&session_key),
+        GenericArray::clone_from_slice(&km2),
+        GenericArray::clone_from_slice(&km3),
+    ))
+}
+
+fn hkdf_expand_label<D: Hash>(
+    secret: &[u8],
+    label: &[u8],
+    context: &[u8],
+    length: usize,
+) -> Result<Vec<u8>, ProtocolError> {
+    let h = Hkdf::<D>::from_prk(secret).map_err(|_| InternalPakeError::HkdfError)?;
+    hkdf_expand_label_extracted(&h, label, context, length)
+}
+
+fn hkdf_expand_label_extracted<D: Hash>(
+    hkdf: &Hkdf<D>,
+    label: &[u8],
+    context: &[u8],
+    length: usize,
+) -> Result<Vec<u8>, ProtocolError> {
+    let mut okm = vec![0u8; length];
+
+    let mut hkdf_label: Vec<u8> = Vec::new();
+
+    let length_u16: u16 = u16::try_from(length).map_err(|_| PakeError::SerializationError)?;
+    hkdf_label.extend_from_slice(&length_u16.to_be_bytes());
+
+    let mut opaque_label: Vec<u8> = Vec::new();
+    opaque_label.extend_from_slice(STR_OPAQUE);
+    opaque_label.extend_from_slice(label);
+    hkdf_label.extend_from_slice(&serialize(&opaque_label, 1));
+
+    hkdf_label.extend_from_slice(&serialize(context, 1));
+
+    hkdf.expand(&hkdf_label, &mut okm)
+        .map_err(|_| InternalPakeError::HkdfError)?;
+    Ok(okm)
+}
+
+fn derive_secrets<D: Hash>(
+    hkdf: &Hkdf<D>,
+    label: &[u8],
+    hashed_derivation_transcript: &[u8],
+) -> Result<Vec<u8>, ProtocolError> {
+    hkdf_expand_label_extracted::<D>(
+        hkdf,
+        label,
+        hashed_derivation_transcript,
+        <D as Digest>::OutputSize::to_usize(),
+    )
+}
+
+// Generate a random nonce up to NonceLen::to_usize() bytes.
+fn generate_nonce<R: RngCore + CryptoRng>(rng: &mut R) -> GenericArray<u8, NonceLen> {
+    let mut nonce_bytes = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut nonce_bytes);
+    GenericArray::clone_from_slice(&nonce_bytes)
+}

src/keypair.rs

@@ -5,149 +5,162 @@
 
 //! Contains the keypair types that must be supplied for the OPAQUE API
 
-use crate::errors::{utils::check_slice_size, InternalPakeError};
-use generic_array::{
-    sequence::Concat,
-    typenum::{Sum, Unsigned, U32},
-    ArrayLength, GenericArray,
-};
+#![allow(unsafe_code)]
+
+use crate::errors::InternalPakeError;
+use crate::group::Group;
+#[cfg(test)]
+use generic_array::typenum::Unsigned;
+use generic_array::{typenum::U32, GenericArray};
+use generic_bytes::{SizedBytes, TryFromSizedBytesError};
 #[cfg(test)]
 use proptest::prelude::*;
 #[cfg(test)]
 use rand::{rngs::StdRng, SeedableRng};
-use rand_core::{CryptoRng, RngCore};
-use std::convert::TryInto;
+use rand::{CryptoRng, RngCore};
 use std::fmt::Debug;
-use x25519_dalek::{PublicKey, StaticSecret};
+use std::marker::PhantomData;
+use std::ops::Deref;
+use zeroize::Zeroize;
 
-use std::convert::TryFrom;
-
-use std::ops::{Add, Deref};
-
-/// A trait for sized key material that can be represented within a fixed byte
-/// array size, used to represent our DH key types
-pub trait SizedBytes: Sized + PartialEq {
-    /// The typed representation of the byte length
-    type Len: ArrayLength<u8>;
-
-    /// Converts this sized key material to a `GenericArray` of the same
-    /// size. One can convert this to a `&[u8]` with `GenericArray::as_slice()`
-    /// but the size information is then lost from the type.
-    fn to_arr(&self) -> GenericArray<u8, Self::Len>;
-
-    /// How to parse such sized material from a byte slice.
-    fn from_bytes(key_bytes: &[u8]) -> Result<Self, InternalPakeError>;
+/// Convenience extension trait of SizedBytes
+pub trait SizedBytesExt: SizedBytes {
+    /// Convert from bytes
+    fn from_bytes(bytes: &[u8]) -> Result<Self, TryFromSizedBytesError> {
+        <Self as SizedBytes>::from_arr(GenericArray::from_slice(bytes))
+    }
 }
 
-/// A Keypair trait with public-private verification
-pub trait KeyPair: Sized {
-    /// The single key representation must have a specific byte size itself
-    type Repr: SizedBytes + Clone;
+// blanket implementation
+impl<T> SizedBytesExt for T where T: SizedBytes {}
 
+/// A Keypair trait with public-private verification
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+pub struct KeyPair<G> {
+    pk: PublicKey,
+    sk: PrivateKey,
+    _g: PhantomData<G>,
+}
+
+impl_clone_for!(
+    struct KeyPair<G>,
+    [pk, sk, _g],
+);
+impl_debug_eq_hash_for!(
+    struct KeyPair<G>,
+    [pk, sk, _g],
+);
+
+// This can't be derived because of the use of a phantom parameter
+impl<G> Zeroize for KeyPair<G> {
+    fn zeroize(&mut self) {
+        self.pk.zeroize();
+        self.sk.zeroize();
+    }
+}
+
+impl<G> Drop for KeyPair<G> {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}
+
+impl<G: Group> KeyPair<G> {
     /// The public key component
-    fn public(&self) -> &Self::Repr;
+    pub fn public(&self) -> &PublicKey {
+        &self.pk
+    }
 
     /// The private key component
-    fn private(&self) -> &Self::Repr;
-
-    /// A constructor that receives public and private key independently as
-    /// bytes
-    fn new(public: Self::Repr, private: Self::Repr) -> Result<Self, InternalPakeError>;
+    pub fn private(&self) -> &PrivateKey {
+        &self.sk
+    }
 
     /// Generating a random key pair given a cryptographic rng
-    fn generate_random<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalPakeError>;
+    pub(crate) fn generate_random<R: RngCore + CryptoRng>(rng: &mut R) -> Self {
+        let sk = G::random_nonzero_scalar(rng);
+        let sk_bytes = G::scalar_as_bytes(&sk);
+        let pk = G::base_point().mult_by_slice(sk_bytes);
+        Self {
+            pk: PublicKey(Key(pk.to_arr().to_vec())),
+            sk: PrivateKey(Key(sk_bytes.to_vec())),
+            _g: PhantomData,
+        }
+    }
 
     /// Obtaining a public key from secret bytes. At all times, we should have
     /// &public_from_private(self.private()) == self.public()
-    fn public_from_private(secret: &Self::Repr) -> Self::Repr;
+    pub(crate) fn public_from_private(bytes: &PrivateKey) -> PublicKey {
+        let bytes_data = GenericArray::<u8, G::ScalarLen>::from_slice(&bytes.0[..]);
+        PublicKey(Key(G::base_point()
+            .mult_by_slice(bytes_data)
+            .to_arr()
+            .to_vec()))
+    }
 
     /// Check whether a public key is valid. This is meant to be applied on
     /// material provided through the network which fits the key
     /// representation (i.e. can be mapped to a curve point), but presents
     /// some risk - e.g. small subgroup check
-    fn check_public_key(key: Self::Repr) -> Result<Self::Repr, InternalPakeError>;
+    pub(crate) fn check_public_key(key: PublicKey) -> Result<PublicKey, InternalPakeError> {
+        G::from_element_slice(GenericArray::from_slice(&key.0)).map(|_| key)
+    }
 
     /// Computes the diffie hellman function on a public key and private key
-    fn diffie_hellman(pk: Self::Repr, sk: Self::Repr) -> Vec<u8>;
+    pub(crate) fn diffie_hellman(
+        pk: PublicKey,
+        sk: PrivateKey,
+    ) -> Result<Vec<u8>, InternalPakeError> {
+        let pk_data = GenericArray::<u8, G::ElemLen>::from_slice(&pk.0[..]);
+        let point = G::from_element_slice(pk_data)?;
+        let secret_data = GenericArray::<u8, G::ScalarLen>::from_slice(&sk.0[..]);
+        Ok(G::mult_by_slice(&point, secret_data).to_arr().to_vec())
+    }
+
+    /// Obtains a KeyPair from a slice representing the private key
+    pub fn from_private_key_slice(input: &[u8]) -> Result<Self, InternalPakeError> {
+        let sk = PrivateKey(Key::from_arr(GenericArray::from_slice(input))?);
+        let pk = Self::public_from_private(&sk);
+        Ok(Self {
+            pk,
+            sk,
+            _g: PhantomData,
+        })
+    }
+
+    #[cfg(test)]
+    pub fn as_byte_ptrs(&self) -> Vec<(*const u8, usize)> {
+        vec![
+            (self.pk.as_ptr(), KeyLen::to_usize()),
+            (self.sk.as_ptr(), KeyLen::to_usize()),
+        ]
+    }
 }
 
 #[cfg(test)]
-trait KeyPairExt: KeyPair + Debug {
+impl<G: Group + Debug> KeyPair<G> {
     /// Test-only strategy returning a proptest Strategy based on
     /// generate_random
     fn uniform_keypair_strategy() -> BoxedStrategy<Self> {
         // The no_shrink is because keypairs should be fixed -- shrinking would cause a different
         // keypair to be generated, which appears to not be very useful.
-        any::<[u8; 32]>()
-            .prop_filter_map("valid random keypair", |seed| {
+        prop::array::uniform32(0_u8..)
+            .prop_map(|seed| {
                 let mut rng = StdRng::from_seed(seed);
-                Self::generate_random(&mut rng).ok()
+                Self::generate_random(&mut rng)
             })
             .no_shrink()
             .boxed()
     }
 }
 
-// blanket implementation
-#[cfg(test)]
-impl<KP> KeyPairExt for KP where KP: KeyPair + Debug {}
+type KeyLen = U32;
 
-/// This assumes you have defined a SizedBytes instance for a `T`, and defines:
-/// - an `impl TryFrom<&[u8b], Error = InternalPakeError>` for a non-generic `T`
-/// - an `fn to_bytes(&self) -> Vec<u8>` in an `impl T` block
-///
-/// Because SizedBytes has a strong notion of size, and TryFrom/to_bytes does
-/// not, it's better to use this macro than the one above, where possible.
-macro_rules! try_from_and_to_bytes_using_sized_bytes {
-    ($sized_type: ident) => {
-        impl TryFrom<&[u8]> for $sized_type {
-            type Error = InternalPakeError;
-
-            fn try_from(bytes: &[u8]) -> Result<Self, InternalPakeError> {
-                <$sized_type as SizedBytes>::from_bytes(bytes)
-            }
-        }
-
-        #[allow(dead_code)]
-        impl $sized_type {
-            fn to_bytes(&self) -> Vec<u8> {
-                self.to_arr().to_vec()
-            }
-        }
-    };
-}
-
-/// This is a blanket implementation of SizedBytes for any instance of KeyPair
-/// with any length of keys. This encodes that we serialize the public key
-/// first, followed by the private key in binary formats (and expect it in this
-/// order upon decoding).
-impl<T, KP> SizedBytes for KP
-where
-    T: SizedBytes + Clone,
-    KP: KeyPair<Repr = T> + PartialEq,
-    T::Len: Add<T::Len>,
-    Sum<T::Len, T::Len>: ArrayLength<u8>,
-{
-    type Len = Sum<T::Len, T::Len>;
-
-    fn to_arr(&self) -> GenericArray<u8, Self::Len> {
-        let private = self.private().to_arr();
-        let public = self.public().to_arr();
-        public.concat(private)
-    }
-
-    fn from_bytes(key_bytes: &[u8]) -> Result<Self, InternalPakeError> {
-        let checked_bytes =
-            check_slice_size(key_bytes, <Self::Len as Unsigned>::to_usize(), "key_bytes")?;
-        let single_key_len = <<KP::Repr as SizedBytes>::Len as Unsigned>::to_usize();
-        let public = <T as SizedBytes>::from_bytes(&checked_bytes[..single_key_len])?;
-        let private = <T as SizedBytes>::from_bytes(&checked_bytes[single_key_len..])?;
-        KP::new(public, private)
-    }
-}
-
-/// A minimalist key type built around [u8;32]
-#[derive(Debug, PartialEq, Eq, Clone)]
+/// A minimalist key type built around a \[u8; 32\]
+#[derive(Debug, PartialEq, Eq, Clone, Hash, Zeroize)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+// Ensure Key material is zeroed after use.
+#[zeroize(drop)]
 #[repr(transparent)]
 pub struct Key(Vec<u8>);
 
@@ -159,119 +172,145 @@ impl Deref for Key {
     }
 }
 
-impl SizedBytes for Key {
-    type Len = U32;
-
-    fn to_arr(&self) -> GenericArray<u8, Self::Len> {
+// Don't make it implement SizedBytes so that it's not constructible outside of this module.
+impl Key {
+    fn to_arr(&self) -> GenericArray<u8, KeyLen> {
         GenericArray::clone_from_slice(&self.0[..])
     }
 
-    fn from_bytes(key_bytes: &[u8]) -> Result<Self, InternalPakeError> {
-        let checked_bytes =
-            check_slice_size(key_bytes, <Self::Len as Unsigned>::to_usize(), "key_bytes")?;
-        Ok(Key(checked_bytes.to_vec()))
+    #[allow(clippy::unnecessary_wraps)]
+    fn from_arr(key_bytes: &GenericArray<u8, KeyLen>) -> Result<Self, TryFromSizedBytesError> {
+        Ok(Key(key_bytes.to_vec()))
     }
 }
 
-try_from_and_to_bytes_using_sized_bytes!(Key);
+/// Wrapper around a Key to enforce that it's a private one.
+#[derive(Debug, PartialEq, Eq, Clone, Hash, Zeroize)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+// Ensure Key material is zeroed after use.
+#[zeroize(drop)]
+#[repr(transparent)]
+pub struct PrivateKey(Key);
 
-/// A representation of an X25519 keypair according to RFC7748
-#[derive(Debug, PartialEq, Eq)]
-pub struct X25519KeyPair {
-    pk: Key,
-    sk: Key,
-}
+impl Deref for PrivateKey {
+    type Target = Key;
 
-impl X25519KeyPair {
-    fn gen<R: RngCore + CryptoRng>(rng: &mut R) -> (Vec<u8>, Vec<u8>) {
-        let sk = StaticSecret::new(rng);
-        let pk = PublicKey::from(&sk);
-        (pk.as_bytes().to_vec(), sk.to_bytes().to_vec())
+    fn deref(&self) -> &Self::Target {
+        &self.0
     }
 }
 
-impl KeyPair for X25519KeyPair {
-    type Repr = Key;
+impl SizedBytes for PrivateKey {
+    type Len = KeyLen;
 
-    fn public(&self) -> &Self::Repr {
-        &self.pk
+    fn to_arr(&self) -> GenericArray<u8, Self::Len> {
+        self.0.to_arr()
     }
 
-    fn private(&self) -> &Self::Repr {
-        &self.sk
+    fn from_arr(key_bytes: &GenericArray<u8, Self::Len>) -> Result<Self, TryFromSizedBytesError> {
+        Ok(PrivateKey(Key::from_arr(key_bytes)?))
+    }
+}
+
+/// Wrapper around a Key to enforce that it's a public one.
+#[derive(Debug, PartialEq, Eq, Clone, Hash, Zeroize)]
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+// Ensure Key material is zeroed after use.
+#[zeroize(drop)]
+#[repr(transparent)]
+pub struct PublicKey(Key);
+
+impl Deref for PublicKey {
+    type Target = Key;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl SizedBytes for PublicKey {
+    type Len = KeyLen;
+
+    fn to_arr(&self) -> GenericArray<u8, Self::Len> {
+        self.0.to_arr()
     }
 
-    fn new(public: Self::Repr, private: Self::Repr) -> Result<Self, InternalPakeError> {
-        Ok(X25519KeyPair {
-            pk: public,
-            sk: private,
-        })
-    }
-
-    fn generate_random<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalPakeError> {
-        let (public, private) = X25519KeyPair::gen(rng);
-        Ok(X25519KeyPair {
-            pk: Key(public),
-            sk: Key(private),
-        })
-    }
-
-    fn public_from_private(secret: &Self::Repr) -> Self::Repr {
-        let secret_data: [u8; 32] = (&secret.0[..])
-            .try_into()
-            .expect("Keypair::Repr invariant broken");
-        let base_data = ::x25519_dalek::X25519_BASEPOINT_BYTES;
-        Key(::x25519_dalek::x25519(secret_data, base_data).to_vec())
-    }
-
-    fn check_public_key(key: Self::Repr) -> Result<Self::Repr, InternalPakeError> {
-        let key_bytes: [u8; 32] = (&key[..]).try_into().expect("Key invariant broken");
-        let point = ::curve25519_dalek::montgomery::MontgomeryPoint(key_bytes)
-            .to_edwards(1)
-            .ok_or(InternalPakeError::PointError)?;
-        if !point.is_torsion_free() {
-            Err(InternalPakeError::SubGroupError)
-        } else {
-            Ok(key)
-        }
-    }
-
-    fn diffie_hellman(pk: Self::Repr, sk: Self::Repr) -> Vec<u8> {
-        let mut pk_data = [0; 32];
-        pk_data.copy_from_slice(&pk.0[..]);
-        let mut sk_data = [0; 32];
-        sk_data.copy_from_slice(&sk.0[..]);
-        ::x25519_dalek::x25519(sk_data, pk_data).to_vec()
+    fn from_arr(key_bytes: &GenericArray<u8, Self::Len>) -> Result<Self, TryFromSizedBytesError> {
+        Ok(PublicKey(Key::from_arr(key_bytes)?))
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::errors::*;
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use generic_array::typenum::Unsigned;
+    use rand::rngs::OsRng;
+    use std::slice::from_raw_parts;
+
+    #[test]
+    fn test_zeroize_key() -> Result<(), ProtocolError> {
+        let key_len = KeyLen::to_usize();
+        let mut key = Key(vec![1u8; key_len]);
+        let ptr = key.as_ptr();
+
+        key.zeroize();
+
+        let bytes = unsafe { from_raw_parts(ptr, key_len) };
+        assert!(bytes.iter().all(|&x| x == 0));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_zeroize_keypair() -> Result<(), ProtocolError> {
+        let mut rng = OsRng;
+        let mut keypair = KeyPair::<RistrettoPoint>::generate_random(&mut rng);
+        let ptrs = keypair.as_byte_ptrs();
+
+        keypair.zeroize();
+
+        for (ptr, len) in ptrs {
+            let bytes = unsafe { from_raw_parts(ptr, len) };
+            assert!(bytes.iter().all(|&x| x == 0));
+        }
+
+        Ok(())
+    }
 
     proptest! {
         #[test]
-        fn test_x25519_check(kp in X25519KeyPair::uniform_keypair_strategy()) {
+        fn test_ristretto_check(ref kp in KeyPair::<RistrettoPoint>::uniform_keypair_strategy()) {
             let pk = kp.public();
-            prop_assert!(X25519KeyPair::check_public_key(pk.clone()).is_ok());
+            prop_assert!(KeyPair::<RistrettoPoint>::check_public_key(pk.clone()).is_ok());
         }
 
         #[test]
-        fn test_x25519_pub_from_priv(kp in X25519KeyPair::uniform_keypair_strategy()) {
+        fn test_ristretto_pub_from_priv(ref kp in KeyPair::<RistrettoPoint>::uniform_keypair_strategy()) {
             let pk = kp.public();
             let sk = kp.private();
-            prop_assert_eq!(&X25519KeyPair::public_from_private(sk), pk);
+            prop_assert_eq!(&KeyPair::<RistrettoPoint>::public_from_private(sk), pk);
         }
 
+        #[test]
+        fn test_ristretto_dh(ref kp1 in KeyPair::<RistrettoPoint>::uniform_keypair_strategy(),
+        ref kp2 in KeyPair::<RistrettoPoint>::uniform_keypair_strategy()) {
+
+            let dh1 = KeyPair::<RistrettoPoint>::diffie_hellman(kp1.public().clone(), kp2.private().clone())?;
+            let dh2 = KeyPair::<RistrettoPoint>::diffie_hellman(kp2.public().clone(), kp1.private().clone())?;
+
+            prop_assert_eq!(dh1, dh2);
+        }
 
         #[test]
-        fn test_x25519_dh(kp1 in X25519KeyPair::uniform_keypair_strategy(),
-                          kp2 in X25519KeyPair::uniform_keypair_strategy()) {
+        fn test_private_key_slice(ref kp in KeyPair::<RistrettoPoint>::uniform_keypair_strategy()) {
+            let sk_bytes = kp.private().to_vec();
 
-            let dh1 = X25519KeyPair::diffie_hellman(kp1.public().clone(), kp2.private().clone());
-            let dh2 = X25519KeyPair::diffie_hellman(kp2.public().clone(), kp1.private().clone());
+            let kp2 = KeyPair::<RistrettoPoint>::from_private_key_slice(&sk_bytes)?;
+            let kp2_private_bytes = kp2.private().to_vec();
 
-            prop_assert_eq!(dh1,dh2);
+            prop_assert_eq!(sk_bytes, kp2_private_bytes);
         }
     }
 }

src/map_to_curve.rs

@@ -6,28 +6,236 @@
 //! Defines the GroupWithMapToCurve trait to specify how to map a password to a
 //! curve point
 
+use crate::errors::InternalPakeError;
 use crate::group::Group;
-use curve25519_dalek::{edwards::EdwardsPoint, ristretto::RistrettoPoint};
-
-use hkdf::Hkdf;
-use sha2::{Sha256, Sha512};
+use crate::hash::Hash;
+use crate::serialization::i2osp;
+use curve25519_dalek::ristretto::RistrettoPoint;
+use digest::{BlockInput, Digest};
+use generic_array::typenum::Unsigned;
+use generic_array::GenericArray;
 
 /// A subtrait of Group specifying how to hash a password into a point
 pub trait GroupWithMapToCurve: Group {
-    /// transforms a password and optional pepper into a curve point
-    fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self;
+    /// The ciphersuite identifier as dictated by
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    const SUITE_ID: usize;
+
+    /// transforms a password and domain separation tag (DST) into a curve point
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalPakeError>;
+
+    /// Hashes a slice of pseudo-random bytes to a scalar
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8])
+        -> Result<Self::Scalar, InternalPakeError>;
+
+    /// Generates the contextString parameter as defined in
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    fn get_context_string(mode: u8) -> Vec<u8> {
+        [i2osp(mode as usize, 1), i2osp(Self::SUITE_ID, 2)].concat()
+    }
 }
 
 impl GroupWithMapToCurve for RistrettoPoint {
-    fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self {
-        let (hashed_input, _) = Hkdf::<Sha512>::extract(pepper, password);
-        <Self as Group>::hash_to_curve(&hashed_input)
+    const SUITE_ID: usize = 0x0001;
+
+    // Implements the hash_to_ristretto255() function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalPakeError> {
+        let uniform_bytes =
+            expand_message_xmd::<H>(msg, dst, <H as Digest>::OutputSize::to_usize())?;
+        Ok(<Self as Group>::hash_to_curve(
+            &GenericArray::clone_from_slice(&uniform_bytes[..]),
+        ))
+    }
+
+    fn hash_to_scalar<H: Hash>(
+        input: &[u8],
+        dst: &[u8],
+    ) -> Result<Self::Scalar, InternalPakeError> {
+        const LEN_IN_BYTES: usize = 64;
+        let uniform_bytes = expand_message_xmd::<H>(input, dst, LEN_IN_BYTES)?;
+        let mut bits = [0u8; LEN_IN_BYTES];
+        bits.copy_from_slice(&uniform_bytes[..]);
+
+        Ok(Self::Scalar::from_bytes_mod_order_wide(&bits))
     }
 }
 
-impl GroupWithMapToCurve for EdwardsPoint {
-    fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self {
-        let (hashed_input, _) = Hkdf::<Sha256>::extract(pepper, password);
-        <Self as Group>::hash_to_curve(&hashed_input)
+// Computes ceil(x / y)
+fn div_ceil(x: usize, y: usize) -> usize {
+    let additive = (x % y != 0) as usize;
+    x / y + additive
+}
+
+fn xor(x: &[u8], y: &[u8]) -> Result<Vec<u8>, InternalPakeError> {
+    if x.len() != y.len() {
+        return Err(InternalPakeError::HashToCurveError);
+    }
+
+    Ok(x.iter().zip(y).map(|(&x1, &x2)| x1 ^ x2).collect())
+}
+
+// Corresponds to the expand_message_xmd() function defined in
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+pub(crate) fn expand_message_xmd<H: Hash>(
+    msg: &[u8],
+    dst: &[u8],
+    len_in_bytes: usize,
+) -> Result<Vec<u8>, InternalPakeError> {
+    let b_in_bytes = <H as Digest>::OutputSize::to_usize();
+    let r_in_bytes = <H as BlockInput>::BlockSize::to_usize();
+
+    let ell = div_ceil(len_in_bytes, b_in_bytes);
+    if ell > 255 {
+        return Err(InternalPakeError::HashToCurveError);
+    }
+    let dst_prime = [dst, &i2osp(dst.len(), 1)].concat();
+    let z_pad = i2osp(0, r_in_bytes);
+    let l_i_b_str = i2osp(len_in_bytes, 2);
+    let msg_prime = [&z_pad, msg, &l_i_b_str, &i2osp(0, 1), &dst_prime].concat();
+
+    let mut b: Vec<Vec<u8>> = vec![H::digest(&msg_prime).to_vec()]; // b[0]
+
+    let mut h = H::new();
+    h.update(&b[0]);
+    h.update(&i2osp(1, 1));
+    h.update(&dst_prime);
+    b.push(h.finalize_reset().to_vec()); // b[1]
+
+    let mut uniform_bytes: Vec<u8> = Vec::new();
+    uniform_bytes.extend_from_slice(&b[1]);
+
+    for i in 2..(ell + 1) {
+        h.update(xor(&b[0], &b[i - 1])?);
+        h.update(&i2osp(i, 1));
+        h.update(&dst_prime);
+        b.push(h.finalize_reset().to_vec()); // b[i]
+        uniform_bytes.extend_from_slice(&b[i]);
+    }
+
+    Ok(uniform_bytes[..len_in_bytes].to_vec())
+}
+
+#[cfg(test)]
+mod tests {
+
+    struct Params {
+        msg: &'static str,
+        len_in_bytes: usize,
+        uniform_bytes: &'static str,
+    }
+
+    #[test]
+    fn test_expand_message_xmd() {
+        // Test vectors taken from Section K.1 of https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+        let test_vectors: Vec<Params> = vec![
+            Params {
+                msg: "",
+                len_in_bytes: 0x20,
+                uniform_bytes: "f659819a6473c1835b25ea59e3d38914c98b374f0970b7e4c\
+                92181df928fca88",
+            },
+            Params {
+                msg: "abc",
+                len_in_bytes: 0x20,
+                uniform_bytes: "1c38f7c211ef233367b2420d04798fa4698080a8901021a79\
+                5a1151775fe4da7",
+            },
+            Params {
+                msg: "abcdef0123456789",
+                len_in_bytes: 0x20,
+                uniform_bytes: "8f7e7b66791f0da0dbb5ec7c22ec637f79758c0a48170bfb7c4611bd304ece89",
+            },
+            Params {
+                msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqq",
+                len_in_bytes: 0x20,
+                uniform_bytes: "72d5aa5ec810370d1f0013c0df2f1d65699494ee2a39f72e\
+                1716b1b964e1c642",
+            },
+            Params {
+                msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                len_in_bytes: 0x20,
+                uniform_bytes: "3b8e704fc48336aca4c2a12195b720882f2162a4b7b13a9c\
+                350db46f429b771b",
+            },
+            Params {
+                msg: "",
+                len_in_bytes: 0x80,
+                uniform_bytes: "8bcffd1a3cae24cf9cd7ab85628fd111bb17e3739d3b53f8\
+                9580d217aa79526f1708354a76a402d3569d6a9d19ef3de4d0b991\
+                e4f54b9f20dcde9b95a66824cbdf6c1a963a1913d43fd7ac443a02\
+                fc5d9d8d77e2071b86ab114a9f34150954a7531da568a1ea8c7608\
+                61c0cde2005afc2c114042ee7b5848f5303f0611cf297f",
+            },
+            Params {
+                msg: "abc",
+                len_in_bytes: 0x80,
+                uniform_bytes: "fe994ec51bdaa821598047b3121c149b364b178606d5e72b\
+                fbb713933acc29c186f316baecf7ea22212f2496ef3f785a27e84a\
+                40d8b299cec56032763eceeff4c61bd1fe65ed81decafff4a31d01\
+                98619c0aa0c6c51fca15520789925e813dcfd318b542f879944127\
+                1f4db9ee3b8092a7a2e8d5b75b73e28fb1ab6b4573c192",
+            },
+            Params {
+                msg: "abcdef0123456789",
+                len_in_bytes: 0x80,
+                uniform_bytes: "c9ec7941811b1e19ce98e21db28d22259354d4d0643e3011\
+                75e2f474e030d32694e9dd5520dde93f3600d8edad94e5c3649030\
+                88a7228cc9eff685d7eaac50d5a5a8229d083b51de4ccc3733917f\
+                4b9535a819b445814890b7029b5de805bf62b33a4dc7e24acdf2c9\
+                24e9fe50d55a6b832c8c84c7f82474b34e48c6d43867be",
+            },
+            Params {
+                msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqq",
+                len_in_bytes: 0x80,
+                uniform_bytes: "48e256ddba722053ba462b2b93351fc966026e6d6db49318\
+                9798181c5f3feea377b5a6f1d8368d7453faef715f9aecb078cd40\
+                2cbd548c0e179c4ed1e4c7e5b048e0a39d31817b5b24f50db58bb3\
+                720fe96ba53db947842120a068816ac05c159bb5266c63658b4f00\
+                0cbf87b1209a225def8ef1dca917bcda79a1e42acd8069",
+            },
+            Params {
+                msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                len_in_bytes: 0x80,
+                uniform_bytes: "396962db47f749ec3b5042ce2452b619607f27fd3939ece2\
+                746a7614fb83a1d097f554df3927b084e55de92c7871430d6b95c2\
+                a13896d8a33bc48587b1f66d21b128a1a8240d5b0c26dfe795a1a8\
+                42a0807bb148b77c2ef82ed4b6c9f7fcb732e7f94466c8b51e52bf\
+                378fba044a31f5cb44583a892f5969dcd73b3fa128816e",
+            },
+        ];
+        let dst = "QUUX-V01-CS02-with-expander";
+
+        for tv in test_vectors {
+            let uniform_bytes = super::expand_message_xmd::<sha2::Sha256>(
+                tv.msg.as_bytes(),
+                dst.as_bytes(),
+                tv.len_in_bytes,
+            )
+            .unwrap();
+            assert_eq!(tv.uniform_bytes, hex::encode(uniform_bytes));
+        }
     }
 }

src/messages.rs

@@ -0,0 +1,386 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Contains the messages used for OPAQUE
+
+use crate::{
+    ciphersuite::CipherSuite,
+    envelope::Envelope,
+    errors::{
+        utils::{check_slice_size, check_slice_size_atleast},
+        PakeError, ProtocolError,
+    },
+    group::Group,
+    key_exchange::traits::{FromBytes, KeyExchange, ToBytes},
+    keypair::{KeyPair, PublicKey, SizedBytesExt},
+    opaque::ServerSetup,
+};
+use digest::Digest;
+use generic_array::{typenum::Unsigned, GenericArray};
+use generic_bytes::SizedBytes;
+use rand::{CryptoRng, RngCore};
+
+// Messages
+// =========
+
+/// The message sent by the client to the server, to initiate registration
+pub struct RegistrationRequest<CS: CipherSuite> {
+    /// blinded password information
+    pub(crate) alpha: CS::Group,
+}
+
+impl<CS: CipherSuite> RegistrationRequest<CS> {
+    /// Only used for testing purposes
+    #[cfg(test)]
+    pub fn get_alpha_for_testing(&self) -> CS::Group {
+        self.alpha
+    }
+}
+
+// Cannot be derived because it would require for CS to be Clone.
+impl<CS: CipherSuite> Clone for RegistrationRequest<CS> {
+    fn clone(&self) -> Self {
+        Self { alpha: self.alpha }
+    }
+}
+
+impl_debug_eq_hash_for!(struct RegistrationRequest<CS: CipherSuite>, [alpha], [CS::Group]);
+
+impl<CS: CipherSuite> RegistrationRequest<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        self.alpha.to_arr().to_vec()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let elem_len = <CS::Group as Group>::ElemLen::to_usize();
+        let checked_slice = check_slice_size(input, elem_len, "first_message_bytes")?;
+        // Check that the message is actually containing an element of the
+        // correct subgroup
+        let arr = GenericArray::from_slice(checked_slice);
+        let alpha = CS::Group::from_element_slice(arr)?;
+
+        // Throw an error if the identity group element is encountered
+        if alpha.is_identity() {
+            return Err(PakeError::IdentityGroupElementError.into());
+        }
+        Ok(Self { alpha })
+    }
+}
+
+impl_serialize_and_deserialize_for!(RegistrationRequest);
+
+/// The answer sent by the server to the user, upon reception of the
+/// registration attempt
+pub struct RegistrationResponse<CS: CipherSuite> {
+    /// The server's oprf output
+    pub(crate) beta: CS::Group,
+    /// Server's static public key
+    pub(crate) server_s_pk: PublicKey,
+}
+
+// Cannot be derived because it would require for CS to be Clone.
+impl<CS: CipherSuite> Clone for RegistrationResponse<CS> {
+    fn clone(&self) -> Self {
+        Self {
+            beta: self.beta,
+            server_s_pk: self.server_s_pk.clone(),
+        }
+    }
+}
+
+impl_debug_eq_hash_for!(
+    struct RegistrationResponse<CS: CipherSuite>,
+    [beta, server_s_pk],
+    [CS::Group],
+);
+
+impl<CS: CipherSuite> RegistrationResponse<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        [self.beta.to_arr().to_vec(), self.server_s_pk.to_vec()].concat()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let elem_len = <CS::Group as Group>::ElemLen::to_usize();
+        let key_len = <PublicKey as SizedBytes>::Len::to_usize();
+        let checked_slice =
+            check_slice_size(input, elem_len + key_len, "registration_response_bytes")?;
+
+        // Check that the message is actually containing an element of the
+        // correct subgroup
+        let arr = GenericArray::from_slice(&checked_slice[..elem_len]);
+        let beta = CS::Group::from_element_slice(arr)?;
+
+        // Throw an error if the identity group element is encountered
+        if beta.is_identity() {
+            return Err(PakeError::IdentityGroupElementError.into());
+        }
+
+        // Ensure that public key is valid
+        let server_s_pk = KeyPair::<CS::Group>::check_public_key(PublicKey::from_bytes(
+            &checked_slice[elem_len..],
+        )?)?;
+
+        Ok(Self { server_s_pk, beta })
+    }
+}
+
+impl_serialize_and_deserialize_for!(RegistrationResponse);
+
+/// The final message from the client, containing sealed cryptographic
+/// identifiers
+pub struct RegistrationUpload<CS: CipherSuite> {
+    /// The "envelope" generated by the user, containing sealed
+    /// cryptographic identifiers
+    pub(crate) envelope: Envelope<CS>,
+    /// The masking key used to mask the envelope
+    pub(crate) masking_key: GenericArray<u8, <CS::Hash as Digest>::OutputSize>,
+    /// The user's public key
+    pub(crate) client_s_pk: PublicKey,
+}
+
+impl_clone_for!(
+    struct RegistrationUpload<CS: CipherSuite>,
+    [envelope, masking_key, client_s_pk],
+);
+impl_debug_eq_hash_for!(
+    struct RegistrationUpload<CS: CipherSuite>,
+    [envelope, masking_key, client_s_pk],
+);
+
+impl<CS: CipherSuite> RegistrationUpload<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        [
+            self.client_s_pk.to_arr().to_vec(),
+            self.masking_key.to_vec(),
+            self.envelope.serialize(),
+        ]
+        .concat()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let key_len = <PublicKey as SizedBytes>::Len::to_usize();
+        let hash_len = <CS::Hash as Digest>::OutputSize::to_usize();
+        let checked_slice =
+            check_slice_size_atleast(input, key_len + hash_len, "registration_upload_bytes")?;
+        let envelope = Envelope::<CS>::deserialize(&checked_slice[key_len + hash_len..])?;
+        Ok(Self {
+            envelope,
+            masking_key: GenericArray::clone_from_slice(
+                &checked_slice[key_len..key_len + hash_len],
+            ),
+            client_s_pk: KeyPair::<CS::Group>::check_public_key(PublicKey::from_bytes(
+                &checked_slice[..key_len],
+            )?)?,
+        })
+    }
+
+    // Creates a dummy instance used for faking a [CredentialResponse]
+    pub(crate) fn dummy<R: RngCore + CryptoRng>(
+        rng: &mut R,
+        server_setup: &ServerSetup<CS>,
+    ) -> Self {
+        let mut masking_key = vec![0u8; <CS::Hash as Digest>::OutputSize::to_usize()];
+        rng.fill_bytes(&mut masking_key);
+
+        Self {
+            envelope: Envelope::<CS>::dummy(),
+            masking_key: GenericArray::clone_from_slice(&masking_key),
+            client_s_pk: server_setup.fake_keypair.public().clone(),
+        }
+    }
+}
+
+impl_serialize_and_deserialize_for!(RegistrationUpload);
+
+/// The message sent by the user to the server, to initiate registration
+pub struct CredentialRequest<CS: CipherSuite> {
+    /// blinded password information
+    pub(crate) alpha: CS::Group,
+    pub(crate) ke1_message: <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE1Message,
+}
+
+// Cannot be derived because it would require for CS to be Clone.
+impl<CS: CipherSuite> Clone for CredentialRequest<CS> {
+    fn clone(&self) -> Self {
+        Self {
+            alpha: self.alpha,
+            ke1_message: self.ke1_message.clone(),
+        }
+    }
+}
+
+impl_debug_eq_hash_for!(
+    struct CredentialRequest<CS: CipherSuite>,
+    [alpha, ke1_message],
+    [
+        CS::Group,
+        <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE1Message
+    ],
+);
+
+impl<CS: CipherSuite> CredentialRequest<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        [self.alpha.to_arr().to_vec(), self.ke1_message.to_bytes()].concat()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let elem_len = <CS::Group as Group>::ElemLen::to_usize();
+
+        let checked_slice = check_slice_size_atleast(input, elem_len, "login_first_message_bytes")?;
+
+        // Check that the message is actually containing an element of the
+        // correct subgroup
+        let arr = GenericArray::from_slice(&checked_slice[..elem_len]);
+        let alpha = CS::Group::from_element_slice(arr)?;
+
+        // Throw an error if the identity group element is encountered
+        if alpha.is_identity() {
+            return Err(PakeError::IdentityGroupElementError.into());
+        }
+
+        let ke1_message =
+            <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE1Message::from_bytes::<CS>(
+                &checked_slice[elem_len..],
+            )?;
+
+        Ok(Self { alpha, ke1_message })
+    }
+}
+
+impl_serialize_and_deserialize_for!(CredentialRequest);
+
+/// The answer sent by the server to the user, upon reception of the
+/// login attempt
+pub struct CredentialResponse<CS: CipherSuite> {
+    /// the server's oprf output
+    pub(crate) beta: CS::Group,
+    pub(crate) masking_nonce: Vec<u8>,
+    pub(crate) masked_response: Vec<u8>,
+    pub(crate) ke2_message: <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE2Message,
+}
+
+// Cannot be derived because it would require for CS to be Clone.
+impl<CS: CipherSuite> Clone for CredentialResponse<CS> {
+    fn clone(&self) -> Self {
+        Self {
+            beta: self.beta,
+            masking_nonce: self.masking_nonce.clone(),
+            masked_response: self.masked_response.clone(),
+            ke2_message: self.ke2_message.clone(),
+        }
+    }
+}
+
+impl_debug_eq_hash_for!(
+    struct CredentialResponse<CS: CipherSuite>,
+    [beta, masking_nonce, masked_response, ke2_message],
+    [
+        CS::Group,
+        <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE2Message,
+    ],
+);
+
+impl<CS: CipherSuite> CredentialResponse<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        [
+            Self::serialize_without_ke(&self.beta, &self.masking_nonce, &self.masked_response),
+            self.ke2_message.to_bytes(),
+        ]
+        .concat()
+    }
+
+    pub(crate) fn serialize_without_ke(
+        beta: &CS::Group,
+        masking_nonce: &[u8],
+        masked_response: &[u8],
+    ) -> Vec<u8> {
+        [&beta.to_arr(), masking_nonce, masked_response].concat()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let elem_len = <CS::Group as Group>::ElemLen::to_usize();
+        let key_len = <PublicKey as SizedBytes>::Len::to_usize();
+        let nonce_len: usize = 32;
+        let envelope_len = Envelope::<CS>::len();
+        let masked_response_len = key_len + envelope_len;
+        let ke2_message_len = CS::KeyExchange::ke2_message_size();
+
+        let checked_slice = check_slice_size_atleast(
+            input,
+            elem_len + nonce_len + masked_response_len + ke2_message_len,
+            "credential_response_bytes",
+        )?;
+
+        // Check that the message is actually containing an element of the
+        // correct subgroup
+        let beta_bytes = &checked_slice[..elem_len];
+        let arr = GenericArray::from_slice(beta_bytes);
+        let beta = CS::Group::from_element_slice(arr)?;
+
+        // Throw an error if the identity group element is encountered
+        if beta.is_identity() {
+            return Err(PakeError::IdentityGroupElementError.into());
+        }
+
+        let masking_nonce = checked_slice[elem_len..elem_len + nonce_len].to_vec();
+        let masked_response = checked_slice
+            [elem_len + nonce_len..elem_len + nonce_len + masked_response_len]
+            .to_vec();
+        let ke2_message =
+            <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE2Message::from_bytes::<CS>(
+                &checked_slice[elem_len + nonce_len + masked_response_len..],
+            )?;
+
+        Ok(Self {
+            beta,
+            masking_nonce,
+            masked_response,
+            ke2_message,
+        })
+    }
+}
+
+impl_serialize_and_deserialize_for!(CredentialResponse);
+
+/// The answer sent by the client to the server, upon reception of the
+/// sealed envelope
+pub struct CredentialFinalization<CS: CipherSuite> {
+    pub(crate) ke3_message: <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE3Message,
+}
+
+impl_clone_for!(struct CredentialFinalization<CS: CipherSuite>, [ke3_message]);
+impl_debug_eq_hash_for!(
+    struct CredentialFinalization<CS: CipherSuite>,
+    [ke3_message],
+    [<CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE3Message],
+);
+
+impl<CS: CipherSuite> CredentialFinalization<CS> {
+    /// Serialization into bytes
+    pub fn serialize(&self) -> Vec<u8> {
+        self.ke3_message.to_bytes()
+    }
+
+    /// Deserialization from bytes
+    pub fn deserialize(input: &[u8]) -> Result<Self, ProtocolError> {
+        let ke3_message =
+            <CS::KeyExchange as KeyExchange<CS::Hash, CS::Group>>::KE3Message::from_bytes::<CS>(
+                input,
+            )?;
+        Ok(Self { ke3_message })
+    }
+}
+
+impl_serialize_and_deserialize_for!(CredentialFinalization);

src/oprf.rs

@@ -5,89 +5,114 @@
 
 use crate::{
     errors::InternalPakeError, group::Group, hash::Hash, map_to_curve::GroupWithMapToCurve,
+    serialization::serialize,
 };
 use digest::Digest;
 use generic_array::GenericArray;
-use hkdf::Hkdf;
-use rand_core::{CryptoRng, RngCore};
+use rand::{CryptoRng, RngCore};
 
-pub struct OprfClientBytes<Grp: Group> {
-    pub alpha: Grp,
-    pub blinding_factor: Grp::Scalar,
+/// Used to store the OPRF input and blinding factor
+#[cfg_attr(feature = "serialize", derive(serde::Deserialize, serde::Serialize))]
+pub struct Token<Grp: Group> {
+    pub(crate) data: Vec<u8>,
+    pub(crate) blind: Grp::Scalar,
 }
 
+impl_clone_for!(struct Token<Grp: Group>, [data, blind]);
+impl_debug_eq_hash_for!(struct Token<Grp: Group>, [data, blind], [Grp::Scalar]);
+
+static STR_VOPRF: &[u8] = b"VOPRF06-HashToGroup-";
+static STR_VOPRF_FINALIZE: &[u8] = b"VOPRF06-Finalize-";
+static MODE_BASE: u8 = 0x00;
+
 /// Computes the first step for the multiplicative blinding version of DH-OPRF. This
 /// message is sent from the client (who holds the input) to the server (who holds the OPRF key).
 /// The client can also pass in an optional "pepper" string to be mixed in with the input through
 /// an HKDF computation.
-pub(crate) fn generate_oprf1<R: RngCore + CryptoRng, G: GroupWithMapToCurve>(
+pub(crate) fn blind<R: RngCore + CryptoRng, G: GroupWithMapToCurve, H: Hash>(
     input: &[u8],
-    pepper: Option<&[u8]>,
     blinding_factor_rng: &mut R,
-) -> Result<OprfClientBytes<G>, InternalPakeError> {
-    let mapped_point = G::map_to_curve(input, pepper);
-    let blinding_factor = G::random_scalar(blinding_factor_rng);
-    let alpha = mapped_point * &blinding_factor;
-    Ok(OprfClientBytes {
-        alpha,
-        blinding_factor,
-    })
+) -> Result<(Token<G>, G), InternalPakeError> {
+    // Choose a random scalar that must be non-zero
+    let blind = G::random_nonzero_scalar(blinding_factor_rng);
+    let dst = [STR_VOPRF, &G::get_context_string(MODE_BASE)].concat();
+    let mapped_point = G::map_to_curve::<H>(input, &dst)?;
+    let blind_token = mapped_point * &blind;
+    Ok((
+        Token {
+            data: input.to_vec(),
+            blind,
+        },
+        blind_token,
+    ))
 }
 
 /// Computes the second step for the multiplicative blinding version of DH-OPRF. This
 /// message is sent from the server (who holds the OPRF key) to the client.
-pub(crate) fn generate_oprf2<G: Group>(
-    point: G,
-    oprf_key: &G::Scalar,
-) -> Result<G, InternalPakeError> {
-    Ok(point * oprf_key)
+pub(crate) fn evaluate<G: Group>(point: G, oprf_key: &G::Scalar) -> G {
+    point * oprf_key
 }
 
 /// Computes the third step for the multiplicative blinding version of DH-OPRF, in which
 /// the client unblinds the server's message.
-pub(crate) fn generate_oprf3<G: Group, H: Hash>(
+pub(crate) fn finalize<G: GroupWithMapToCurve, H: Hash>(
     input: &[u8],
-    point: G,
-    blinding_factor: &G::Scalar,
-) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, InternalPakeError> {
-    let unblinded = point * &G::scalar_invert(&blinding_factor);
-    let ikm: Vec<u8> = [&unblinded.to_arr()[..], input].concat();
-    let (prk, _) = Hkdf::<H>::extract(None, &ikm);
-    Ok(prk)
+    blind: &G::Scalar,
+    evaluated_element: G,
+) -> GenericArray<u8, <H as Digest>::OutputSize> {
+    let unblinded_element = evaluated_element * &G::scalar_invert(blind);
+    finalize_after_unblind::<G, H>(input, unblinded_element)
 }
 
-// Benchmarking shims
-#[cfg(feature = "bench")]
-#[inline]
-pub fn generate_oprf1_shim<R: RngCore + CryptoRng, G: GroupWithMapToCurve>(
+fn finalize_after_unblind<G: GroupWithMapToCurve, H: Hash>(
+    input: &[u8],
+    unblinded_element: G,
+) -> GenericArray<u8, <H as Digest>::OutputSize> {
+    let finalize_dst = [STR_VOPRF_FINALIZE, &G::get_context_string(MODE_BASE)].concat();
+    let hash_input = [
+        serialize(input, 2),
+        serialize(&unblinded_element.to_arr().to_vec(), 2),
+        serialize(&finalize_dst, 2),
+    ]
+    .concat();
+    <H as Digest>::digest(&hash_input)
+}
+
+////////////////////////
+// Benchmarking shims //
+////////////////////////
+
+#[cfg(feature = "bench")]
+#[doc(hidden)]
+#[inline]
+pub fn blind_shim<R: RngCore + CryptoRng, G: GroupWithMapToCurve, H: Hash>(
     input: &[u8],
-    pepper: Option<&[u8]>,
     blinding_factor_rng: &mut R,
-) -> Result<OprfClientBytes<G>, InternalPakeError> {
-    generate_oprf1(input, pepper, blinding_factor_rng)
+) -> Result<(Token<G>, G), InternalPakeError> {
+    blind::<R, G, H>(input, blinding_factor_rng)
 }
 
 #[cfg(feature = "bench")]
+#[doc(hidden)]
 #[inline]
-pub fn generate_oprf2_shim<G: Group>(
-    point: G,
-    oprf_key: &G::Scalar,
-) -> Result<G, InternalPakeError> {
-    generate_oprf2(point, oprf_key)
+pub fn evaluate_shim<G: Group>(point: G, oprf_key: &G::Scalar) -> G {
+    evaluate(point, oprf_key)
 }
 
 #[cfg(feature = "bench")]
+#[doc(hidden)]
 #[inline]
-pub fn generate_oprf3_shim<G: Group, H: Hash>(
-    input: &[u8],
+pub fn finalize_shim<G: GroupWithMapToCurve, H: Hash>(
+    token: &Token<G>,
     point: G,
-    blinding_factor: &G::Scalar,
 ) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, InternalPakeError> {
-    generate_oprf3::<G, H>(input, point, blinding_factor)
+    Ok(finalize::<G, H>(&token.data, &token.blind, point))
 }
 
-// Tests
-// =====
+///////////
+// Tests //
+// ===== //
+///////////
 
 #[cfg(test)]
 mod tests {
@@ -95,41 +120,32 @@ mod tests {
     use crate::group::Group;
     use curve25519_dalek::ristretto::RistrettoPoint;
     use generic_array::{arr, GenericArray};
-    use hkdf::Hkdf;
-    use rand_core::OsRng;
-    use sha2::{Sha256, Sha512};
+    use rand::rngs::OsRng;
+    use sha2::Sha512;
 
-    fn prf(
-        input: &[u8],
-        oprf_key: &[u8; 32],
-    ) -> GenericArray<u8, <RistrettoPoint as Group>::ElemLen> {
-        let (hashed_input, _) = Hkdf::<Sha512>::extract(None, &input);
-        let point = RistrettoPoint::hash_to_curve(GenericArray::from_slice(&hashed_input));
+    fn prf(input: &[u8], oprf_key: &[u8; 32]) -> GenericArray<u8, <Sha512 as Digest>::OutputSize> {
+        let dst = [STR_VOPRF, &RistrettoPoint::get_context_string(MODE_BASE)].concat();
+        let point = RistrettoPoint::map_to_curve::<Sha512>(input, &dst).unwrap();
         let scalar =
             RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&oprf_key[..])).unwrap();
         let res = point * scalar;
-        let ikm: Vec<u8> = [&res.to_arr()[..], &input].concat();
 
-        let (prk, _) = Hkdf::<Sha256>::extract(None, &ikm);
-        prk
+        finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, res)
     }
 
     #[test]
     fn oprf_retrieval() -> Result<(), InternalPakeError> {
         let input = b"hunter2";
         let mut rng = OsRng;
-        let OprfClientBytes {
-            alpha,
-            blinding_factor,
-        } = generate_oprf1::<_, RistrettoPoint>(&input[..], None, &mut rng)?;
-        let salt_bytes = arr![
+        let (token, alpha) = blind::<_, RistrettoPoint, Sha512>(&input[..], &mut rng)?;
+        let oprf_key_bytes = arr![
             u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
             24, 25, 26, 27, 28, 29, 30, 31, 32,
         ];
-        let salt = RistrettoPoint::from_scalar_slice(&salt_bytes)?;
-        let beta = generate_oprf2::<RistrettoPoint>(alpha, &salt)?;
-        let res = generate_oprf3::<RistrettoPoint, sha2::Sha256>(input, beta, &blinding_factor)?;
-        let res2 = prf(&input[..], &salt.as_bytes());
+        let oprf_key = RistrettoPoint::from_scalar_slice(&oprf_key_bytes)?;
+        let beta = evaluate::<RistrettoPoint>(alpha, &oprf_key);
+        let res = finalize::<RistrettoPoint, sha2::Sha512>(&token.data, &token.blind, beta);
+        let res2 = prf(&input[..], &oprf_key.as_bytes());
         assert_eq!(res, res2);
         Ok(())
     }
@@ -139,23 +155,13 @@ mod tests {
         let mut rng = OsRng;
         let mut input = vec![0u8; 64];
         rng.fill_bytes(&mut input);
-        let OprfClientBytes {
-            alpha,
-            blinding_factor,
-        } = generate_oprf1::<_, RistrettoPoint>(&input, None, &mut rng).unwrap();
-        let res = generate_oprf3::<RistrettoPoint, sha2::Sha256>(&input, alpha, &blinding_factor)
-            .unwrap();
+        let (token, alpha) = blind::<_, RistrettoPoint, sha2::Sha512>(&input, &mut rng).unwrap();
+        let res = finalize::<RistrettoPoint, sha2::Sha512>(&token.data, &token.blind, alpha);
 
-        let (hashed_input, _) = Hkdf::<Sha512>::extract(None, &input);
-        let mut bits = [0u8; 64];
-        bits.copy_from_slice(&hashed_input);
+        let dst = [STR_VOPRF, &RistrettoPoint::get_context_string(MODE_BASE)].concat();
+        let point = RistrettoPoint::map_to_curve::<Sha512>(&input, &dst).unwrap();
+        let res2 = finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, point);
 
-        let point = RistrettoPoint::from_uniform_bytes(&bits);
-        let mut ikm: Vec<u8> = Vec::new();
-        ikm.extend_from_slice(&point.to_arr());
-        ikm.extend_from_slice(&input);
-        let (prk, _) = Hkdf::<Sha256>::extract(None, &ikm);
-
-        assert_eq!(res, prk);
+        assert_eq!(res, res2);
     }
 }

src/serialization/mod.rs

@@ -0,0 +1,124 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::errors::PakeError;
+
+// Corresponds to the I2OSP() function from RFC8017
+pub(crate) fn i2osp(input: usize, length: usize) -> Vec<u8> {
+    if length <= std::mem::size_of::<usize>() {
+        return (&input.to_be_bytes()[std::mem::size_of::<usize>() - length..]).to_vec();
+    }
+
+    let mut output = vec![0u8; length];
+    output.splice(
+        length - std::mem::size_of::<usize>()..length,
+        input.to_be_bytes().iter().cloned(),
+    );
+    output
+}
+
+// Corresponds to the OS2IP() function from RFC8017
+pub(crate) fn os2ip(input: &[u8]) -> Result<usize, PakeError> {
+    if input.len() > std::mem::size_of::<usize>() {
+        return Err(PakeError::SerializationError);
+    }
+
+    let mut output_array = [0u8; std::mem::size_of::<usize>()];
+    output_array[std::mem::size_of::<usize>() - input.len()..].copy_from_slice(input);
+    Ok(usize::from_be_bytes(output_array))
+}
+
+// Computes I2OSP(len(input), max_bytes) || input
+pub(crate) fn serialize(input: &[u8], max_bytes: usize) -> Vec<u8> {
+    [&i2osp(input.len(), max_bytes), input].concat()
+}
+
+// Tokenizes an input of the format I2OSP(len(input), max_bytes) || input, outputting
+// (input, remainder)
+pub(crate) fn tokenize(input: &[u8], size_bytes: usize) -> Result<(Vec<u8>, Vec<u8>), PakeError> {
+    if size_bytes > std::mem::size_of::<usize>() || input.len() < size_bytes {
+        return Err(PakeError::SerializationError);
+    }
+
+    let size = os2ip(&input[..size_bytes])?;
+    if size_bytes + size > input.len() {
+        return Err(PakeError::SerializationError);
+    }
+
+    Ok((
+        input[size_bytes..size_bytes + size].to_vec(),
+        input[size_bytes + size..].to_vec(),
+    ))
+}
+
+/// Inner macro used for deriving `serde`'s `Serialize` and `Deserialize` traits.
+macro_rules! impl_serialize_and_deserialize_for {
+    ($t:ident) => {
+        #[cfg(feature = "serialize")]
+        impl<CS: CipherSuite> serde::Serialize for $t<CS> {
+            fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+            where
+                S: serde::Serializer,
+            {
+                if serializer.is_human_readable() {
+                    serializer.serialize_str(&base64::encode(&self.serialize()))
+                } else {
+                    serializer.serialize_bytes(&self.serialize())
+                }
+            }
+        }
+
+        #[cfg(feature = "serialize")]
+        impl<'de, CS: CipherSuite> serde::Deserialize<'de> for $t<CS> {
+            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+            where
+                D: serde::Deserializer<'de>,
+            {
+                if deserializer.is_human_readable() {
+                    let s = <&str>::deserialize(deserializer)?;
+                    $t::<CS>::deserialize(&base64::decode(s).map_err(serde::de::Error::custom)?)
+                        .map_err(serde::de::Error::custom)
+                } else {
+                    struct ByteVisitor<CS: CipherSuite> {
+                        marker: std::marker::PhantomData<CS>,
+                    }
+                    impl<'de, CS: CipherSuite> serde::de::Visitor<'de> for ByteVisitor<CS> {
+                        type Value = $t<CS>;
+                        fn expecting(
+                            &self,
+                            formatter: &mut std::fmt::Formatter,
+                        ) -> std::fmt::Result {
+                            formatter.write_str(std::concat!(
+                                "the byte representation of a ",
+                                std::stringify!($t)
+                            ))
+                        }
+
+                        fn visit_bytes<E>(self, value: &[u8]) -> Result<Self::Value, E>
+                        where
+                            E: serde::de::Error,
+                        {
+                            $t::<CS>::deserialize(value).map_err(|_| {
+                                serde::de::Error::invalid_value(
+                                    serde::de::Unexpected::Bytes(value),
+                                    &std::concat!(
+                                        "invalid byte sequence for ",
+                                        std::stringify!($t)
+                                    ),
+                                )
+                            })
+                        }
+                    }
+                    deserializer.deserialize_bytes(ByteVisitor::<CS> {
+                        marker: std::marker::PhantomData,
+                    })
+                }
+            }
+        }
+    };
+}
+
+#[cfg(test)]
+mod tests;

src/serialization/tests.rs

@@ -0,0 +1,403 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::{
+    ciphersuite::CipherSuite,
+    envelope::{Envelope, InnerEnvelopeMode},
+    errors::*,
+    group::Group,
+    key_exchange::{
+        traits::{FromBytes, KeyExchange, ToBytes},
+        tripledh::{NonceLen, TripleDH},
+    },
+    keypair::{KeyPair, PublicKey},
+    serialization::{i2osp, os2ip, serialize},
+    *,
+};
+
+use curve25519_dalek::{ristretto::RistrettoPoint, traits::Identity};
+use generic_array::typenum::Unsigned;
+use generic_bytes::SizedBytes;
+use proptest::{collection::vec, prelude::*};
+use rand::{rngs::OsRng, RngCore};
+
+use sha2::Digest;
+
+struct Default;
+impl CipherSuite for Default {
+    type Group = RistrettoPoint;
+    type KeyExchange = TripleDH;
+    type Hash = sha2::Sha512;
+    type SlowHash = crate::slow_hash::NoOpHash;
+}
+
+const HASH_SIZE: usize = 64; // Because of SHA512
+const MAC_SIZE: usize = 64; // Because of SHA512
+
+fn random_ristretto_point() -> RistrettoPoint {
+    let mut rng = OsRng;
+    let mut random_bits = [0u8; 64];
+    rng.fill_bytes(&mut random_bits);
+
+    // This is because RistrettoPoint is on an obsolete sha2 version
+    let mut bits = [0u8; 64];
+    let mut hasher = sha2::Sha512::new();
+    hasher.update(&random_bits[..]);
+    bits.copy_from_slice(&hasher.finalize());
+
+    RistrettoPoint::from_uniform_bytes(&bits)
+}
+
+#[test]
+fn client_registration_roundtrip() {
+    let pw = b"hunter2";
+    let mut rng = OsRng;
+    let sc = <RistrettoPoint as Group>::random_nonzero_scalar(&mut rng);
+
+    // serialization order: scalar, password
+    let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
+    let reg = ClientRegistration::<Default>::deserialize(&bytes[..]).unwrap();
+    let reg_bytes = reg.serialize();
+    assert_eq!(reg_bytes, bytes);
+}
+
+#[test]
+fn server_registration_roundtrip() {
+    // If we don't have envelope and client_pk, the server registration just
+    // contains the prf key
+    let mut rng = OsRng;
+    let mut masking_key = [0u8; HASH_SIZE];
+    rng.fill_bytes(&mut masking_key);
+
+    // Construct a mock envelope
+    let mut mock_envelope_bytes = Vec::new();
+    mock_envelope_bytes.extend_from_slice(&vec![0; NonceLen::to_usize()]); // empty nonce
+                                                                           // mock_envelope_bytes.extend_from_slice(&ciphertext); // ciphertext which is an encrypted private key
+    mock_envelope_bytes.extend_from_slice(&[0; MAC_SIZE]); // length-MAC_SIZE hmac
+
+    let mock_client_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    // serialization order: oprf_key, public key, envelope
+    let mut bytes = Vec::<u8>::new();
+    bytes.extend_from_slice(&mock_client_kp.public().to_arr());
+    bytes.extend_from_slice(&masking_key);
+    bytes.extend_from_slice(&mock_envelope_bytes);
+    let reg = ServerRegistration::<Default>::deserialize(&bytes[..]).unwrap();
+    let reg_bytes = reg.serialize();
+    assert_eq!(reg_bytes, bytes);
+}
+
+#[test]
+fn registration_request_roundtrip() {
+    let pt = random_ristretto_point();
+    let pt_bytes = pt.to_arr().to_vec();
+
+    let mut input = Vec::new();
+    input.extend_from_slice(pt_bytes.as_slice());
+
+    let r1 = RegistrationRequest::<Default>::deserialize(input.as_slice()).unwrap();
+    let r1_bytes = r1.serialize();
+    assert_eq!(input, r1_bytes);
+
+    // Assert that identity group element is rejected
+    let identity = RistrettoPoint::identity();
+    let identity_bytes = identity.to_arr().to_vec();
+
+    assert!(
+        match RegistrationRequest::<Default>::deserialize(identity_bytes.as_slice()) {
+            Err(ProtocolError::VerificationError(PakeError::IdentityGroupElementError)) => true,
+            _ => false,
+        }
+    );
+}
+
+#[test]
+fn registration_response_roundtrip() {
+    let pt = random_ristretto_point();
+    let beta_bytes = pt.to_arr();
+    let mut rng = OsRng;
+    let skp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let pubkey_bytes = skp.public().to_arr();
+
+    let mut input = Vec::new();
+    input.extend_from_slice(beta_bytes.as_slice());
+    input.extend_from_slice(&pubkey_bytes.as_slice());
+
+    let r2 = RegistrationResponse::<Default>::deserialize(input.as_slice()).unwrap();
+    let r2_bytes = r2.serialize();
+    assert_eq!(input, r2_bytes);
+
+    // Assert that identity group element is rejected
+    let identity = RistrettoPoint::identity();
+    let identity_bytes = identity.to_arr().to_vec();
+
+    assert!(match RegistrationResponse::<Default>::deserialize(
+        &[identity_bytes, pubkey_bytes.to_vec()].concat()
+    ) {
+        Err(ProtocolError::VerificationError(PakeError::IdentityGroupElementError)) => true,
+        _ => false,
+    });
+}
+
+#[test]
+fn registration_upload_roundtrip() {
+    let mut rng = OsRng;
+    let skp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let pubkey_bytes = skp.public().to_arr();
+
+    let mut key = [0u8; 32];
+    rng.fill_bytes(&mut key);
+    let mut nonce = [0u8; 32];
+    rng.fill_bytes(&mut nonce);
+
+    let mut masking_key = vec![0u8; <sha2::Sha512 as Digest>::OutputSize::to_usize()];
+    rng.fill_bytes(&mut masking_key);
+
+    let (envelope, _) =
+        Envelope::<Default>::seal_raw(&key, &nonce, &pubkey_bytes, InnerEnvelopeMode::Internal)
+            .unwrap();
+    let envelope_bytes = envelope.serialize();
+
+    let mut input = Vec::new();
+    input.extend_from_slice(&pubkey_bytes[..]);
+    input.extend_from_slice(&masking_key[..]);
+    input.extend_from_slice(&envelope_bytes);
+
+    let r3 = RegistrationUpload::<Default>::deserialize(&input[..]).unwrap();
+    let r3_bytes = r3.serialize();
+    assert_eq!(input, r3_bytes);
+}
+
+#[test]
+fn credential_request_roundtrip() {
+    let mut rng = OsRng;
+    let alpha = random_ristretto_point();
+    let alpha_bytes = alpha.to_arr().to_vec();
+
+    let client_e_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let mut client_nonce = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut client_nonce);
+
+    let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
+
+    let mut input = Vec::new();
+    input.extend_from_slice(&alpha_bytes);
+    input.extend_from_slice(&ke1m[..]);
+
+    let l1 = CredentialRequest::<Default>::deserialize(input.as_slice()).unwrap();
+    let l1_bytes = l1.serialize();
+    assert_eq!(input, l1_bytes);
+
+    // Assert that identity group element is rejected
+    let identity = RistrettoPoint::identity();
+    let identity_bytes = identity.to_arr().to_vec();
+
+    assert!(match CredentialRequest::<Default>::deserialize(
+        &[identity_bytes, ke1m.to_vec()].concat()
+    ) {
+        Err(ProtocolError::VerificationError(PakeError::IdentityGroupElementError)) => true,
+        _ => false,
+    });
+}
+
+#[test]
+fn credential_response_roundtrip() {
+    let pt = random_ristretto_point();
+    let pt_bytes = pt.to_arr().to_vec();
+
+    let mut rng = OsRng;
+
+    let mut masking_nonce = vec![0u8; 32];
+    rng.fill_bytes(&mut masking_nonce);
+
+    let mut masked_response =
+        vec![0u8; <PublicKey as SizedBytes>::Len::to_usize() + Envelope::<Default>::len()];
+    rng.fill_bytes(&mut masked_response);
+
+    let server_e_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let mut mac = [0u8; MAC_SIZE];
+    rng.fill_bytes(&mut mac);
+    let mut server_nonce = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut server_nonce);
+
+    let ke2m: Vec<u8> = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat();
+
+    let mut input = Vec::new();
+    input.extend_from_slice(pt_bytes.as_slice());
+    input.extend_from_slice(&masking_nonce);
+    input.extend_from_slice(&masked_response);
+    input.extend_from_slice(&ke2m[..]);
+
+    let l2 = CredentialResponse::<Default>::deserialize(&input).unwrap();
+    let l2_bytes = l2.serialize();
+    assert_eq!(input, l2_bytes);
+
+    // Assert that identity group element is rejected
+    let identity = RistrettoPoint::identity();
+    let identity_bytes = identity.to_arr().to_vec();
+
+    assert!(match CredentialResponse::<Default>::deserialize(
+        &[
+            identity_bytes,
+            masking_nonce.to_vec(),
+            masked_response,
+            ke2m.to_vec()
+        ]
+        .concat()
+    ) {
+        Err(ProtocolError::VerificationError(PakeError::IdentityGroupElementError)) => true,
+        _ => false,
+    });
+}
+
+#[test]
+fn login_third_message_roundtrip() {
+    let mut rng = OsRng;
+    let mut mac = [0u8; MAC_SIZE];
+    rng.fill_bytes(&mut mac);
+
+    let input: Vec<u8> = [&mac[..]].concat();
+
+    let l3 = CredentialFinalization::<Default>::deserialize(&input).unwrap();
+    let l3_bytes = l3.serialize();
+    assert_eq!(input, l3_bytes);
+}
+
+#[test]
+fn client_login_roundtrip() {
+    let pw = b"hunter2";
+    let mut rng = OsRng;
+    let sc = <RistrettoPoint as Group>::random_nonzero_scalar(&mut rng);
+
+    let client_e_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let mut client_nonce = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut client_nonce);
+
+    let serialized_credential_request = b"serialized credential_request".to_vec();
+    let l1_data = [client_e_kp.private().to_arr().to_vec(), client_nonce].concat();
+
+    // serialization order: scalar, credential_request, ke1_state, password
+    let bytes: Vec<u8> = [
+        &sc.as_bytes()[..],
+        &serialize(&serialized_credential_request, 2),
+        &serialize(&l1_data, 2),
+        &pw[..],
+    ]
+    .concat();
+    let reg = ClientLogin::<Default>::deserialize(&bytes[..]).unwrap();
+    let reg_bytes = reg.serialize();
+    assert_eq!(reg_bytes, bytes);
+}
+
+#[test]
+fn ke1_message_roundtrip() {
+    let mut rng = OsRng;
+
+    let client_e_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let mut client_nonce = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut client_nonce);
+
+    let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
+    let reg = <TripleDH as KeyExchange<sha2::Sha512, RistrettoPoint>>::KE1Message::from_bytes::<
+        Default,
+    >(&ke1m[..])
+    .unwrap();
+    let reg_bytes = reg.to_bytes();
+    assert_eq!(reg_bytes, ke1m);
+}
+
+#[test]
+fn ke2_message_roundtrip() {
+    let mut rng = OsRng;
+
+    let server_e_kp = KeyPair::<<Default as CipherSuite>::Group>::generate_random(&mut rng);
+    let mut mac = [0u8; MAC_SIZE];
+    rng.fill_bytes(&mut mac);
+    let mut server_nonce = vec![0u8; NonceLen::to_usize()];
+    rng.fill_bytes(&mut server_nonce);
+
+    let ke2m: Vec<u8> = [&server_nonce[..], &server_e_kp.public(), &mac[..]].concat();
+
+    let reg = <TripleDH as KeyExchange<sha2::Sha512, RistrettoPoint>>::KE2Message::from_bytes::<
+        Default,
+    >(&ke2m[..])
+    .unwrap();
+    let reg_bytes = reg.to_bytes();
+    assert_eq!(reg_bytes, ke2m);
+}
+
+#[test]
+fn ke3_message_roundtrip() {
+    let mut rng = OsRng;
+    let mut mac = [0u8; MAC_SIZE];
+    rng.fill_bytes(&mut mac);
+
+    let ke3m: Vec<u8> = [&mac[..]].concat();
+
+    let reg = <TripleDH as KeyExchange<sha2::Sha512, RistrettoPoint>>::KE3Message::from_bytes::<
+        Default,
+    >(&ke3m[..])
+    .unwrap();
+    let reg_bytes = reg.to_bytes();
+    assert_eq!(reg_bytes, ke3m);
+}
+
+proptest! {
+
+#[test]
+fn test_i2osp_os2ip(ref bytes in vec(prop::num::u8::ANY, 0..std::mem::size_of::<usize>())) {
+    assert_eq!(&i2osp(os2ip(&bytes)?, bytes.len()), bytes);
+}
+
+#[test]
+fn test_nocrash_registration_request(ref bytes in vec(prop::num::u8::ANY, 0..200)) {
+    RegistrationRequest::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_registration_response(ref bytes in vec(prop::num::u8::ANY, 0..200)) {
+    RegistrationResponse::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_registration_upload(ref bytes in vec(prop::num::u8::ANY, 0..200)) {
+    RegistrationUpload::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_credential_request(ref bytes in vec(prop::num::u8::ANY, 0..500)) {
+    CredentialRequest::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_credential_response(ref bytes in vec(prop::num::u8::ANY, 0..500)) {
+    CredentialResponse::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_credential_finalization(ref bytes in vec(prop::num::u8::ANY, 0..500)) {
+    CredentialFinalization::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_client_registration(ref bytes in vec(prop::num::u8::ANY, 0..700)) {
+    ClientRegistration::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_server_registration(ref bytes in vec(prop::num::u8::ANY, 0..700)) {
+    ServerRegistration::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_client_login(ref bytes in vec(prop::num::u8::ANY, 0..700)) {
+    ClientLogin::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+#[test]
+fn test_nocrash_server_login(ref bytes in vec(prop::num::u8::ANY, 0..700)) {
+    ServerLogin::<Default>::deserialize(&bytes[..]).map_or(true, |_| true);
+}
+
+}

src/slow_hash.rs

@@ -5,9 +5,10 @@
 
 //! Trait specifying a slow hashing function
 
-use crate::errors::InternalPakeError;
-use crate::hash::Hash;
+use crate::{errors::InternalPakeError, hash::Hash};
 use digest::Digest;
+#[cfg(feature = "slow-hash")]
+use generic_array::typenum::Unsigned;
 use generic_array::GenericArray;
 
 /// Used for the slow hashing function in OPAQUE
@@ -30,14 +31,21 @@ impl<D: Hash> SlowHash<D> for NoOpHash {
 }
 
 #[cfg(feature = "slow-hash")]
-impl<D: Hash> SlowHash<D> for scrypt::ScryptParams {
+impl<D: Hash> SlowHash<D> for argon2::Argon2<'_> {
     fn hash(
         input: GenericArray<u8, <D as Digest>::OutputSize>,
     ) -> Result<Vec<u8>, InternalPakeError> {
-        let params = scrypt::ScryptParams::new(15, 8, 1).unwrap();
-        let mut output = [0u8; <D as Digest>::OutputSize::to_usize()];
-        scrypt::scrypt(&input, &[], &params, &mut output)
+        let params = argon2::Argon2::default();
+        let mut output = vec![0u8; <D as Digest>::OutputSize::to_usize()];
+        params
+            .hash_password_into(
+                argon2::Algorithm::Argon2id,
+                &input,
+                &[0; argon2::MIN_SALT_LENGTH],
+                &[],
+                &mut output,
+            )
             .map_err(|_| InternalPakeError::SlowHashError)?;
-        Ok(output.to_vec())
+        Ok(output)
     }
 }

src/tests/mock_rng.rs

@@ -3,7 +3,7 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
-use rand_core::{CryptoRng, Error, RngCore};
+use rand::{CryptoRng, Error, RngCore};
 use std::cmp::min;
 
 /// A simple implementation of `RngCore` for testing purposes.

src/tests/mod.rs

@@ -3,6 +3,7 @@
 // This source code is licensed under the MIT license found in the
 // LICENSE file in the root directory of this source tree.
 
+mod full_test;
 pub mod mock_rng;
-mod opaque_ke_test;
-mod serialization;
+mod opaque_test_vectors;
+mod voprf_test_vectors;

src/tests/opaque_ke_test.rs

@@ -1,588 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under the MIT license found in the
-// LICENSE file in the root directory of this source tree.
-
-use crate::{
-    ciphersuite::CipherSuite,
-    errors::*,
-    group::Group,
-    key_exchange::tripledh::{TripleDH, NONCE_LEN},
-    keypair::{Key, KeyPair, SizedBytes, X25519KeyPair},
-    opaque::*,
-    slow_hash::NoOpHash,
-    tests::mock_rng::CycleRng,
-};
-use curve25519_dalek::edwards::EdwardsPoint;
-use rand_core::{OsRng, RngCore};
-use serde_json::Value;
-use std::convert::TryFrom;
-
-// Tests
-// =====
-
-struct X255193dhNoSlowHash;
-impl CipherSuite for X255193dhNoSlowHash {
-    type Group = EdwardsPoint;
-    type KeyFormat = X25519KeyPair;
-    type KeyExchange = TripleDH;
-    type Hash = sha2::Sha256;
-    type SlowHash = NoOpHash;
-}
-
-pub struct TestVectorParameters {
-    pub client_s_pk: Vec<u8>,
-    pub client_s_sk: Vec<u8>,
-    pub client_e_pk: Vec<u8>,
-    pub client_e_sk: Vec<u8>,
-    pub server_s_pk: Vec<u8>,
-    pub server_s_sk: Vec<u8>,
-    pub server_e_pk: Vec<u8>,
-    pub server_e_sk: Vec<u8>,
-    pub password: Vec<u8>,
-    pub blinding_factor_raw: Vec<u8>,
-    pub blinding_factor: Vec<u8>,
-    pub pepper: Vec<u8>,
-    pub oprf_key: Vec<u8>,
-    pub envelope_nonce: Vec<u8>,
-    pub client_nonce: Vec<u8>,
-    pub server_nonce: Vec<u8>,
-    pub r1: Vec<u8>,
-    pub r2: Vec<u8>,
-    pub r3: Vec<u8>,
-    pub l1: Vec<u8>,
-    pub l2: Vec<u8>,
-    pub l3: Vec<u8>,
-    client_registration_state: Vec<u8>,
-    server_registration_state: Vec<u8>,
-    client_login_state: Vec<u8>,
-    server_login_state: Vec<u8>,
-    pub password_file: Vec<u8>,
-    pub export_key: Vec<u8>,
-    pub shared_secret: Vec<u8>,
-}
-
-static TEST_VECTOR: &str = r#"
-{
-    "client_s_pk": "b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29",
-    "client_s_sk": "701e8cd1263abd2f2a22d4dc94b1d5fe3c9cb14030e7e7c154745825b059fd7f",
-    "client_e_pk": "97cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e",
-    "client_e_sk": "80616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359",
-    "server_s_pk": "e12d737e520eaf8504fbf302c2945011bff360bdf02ee102f2ebd6a883c80e02",
-    "server_s_sk": "9075d3d3c5b6bc2f6218e7672c0532c619ce09dddf196006c5ffdaf628a3d760",
-    "server_e_pk": "f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a279",
-    "server_e_sk": "a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248",
-    "password": "70617373776f7264",
-    "blinding_factor_raw": "ca2d8ae51794579bd0f46044d7daccf222b4590053536b48575bc169f7478fd0a0b580fb0aae948c26ba403a2e7b98f563e434a0aad93f4105419c474453c34e",
-    "blinding_factor": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e02",
-    "pepper": "706570706572",
-    "oprf_key": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907",
-    "envelope_nonce": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8",
-    "client_nonce": "b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572",
-    "server_nonce": "a213c02274e7f20fc3b571d25e98854c5dae2cfde6c9bf228a66bf3eff3e2a97",
-    "r1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5",
-    "r2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931ea",
-    "r3": "b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29",
-    "l1": "7e2c67a156ab27490f20008fcae9e9f722d8a9f4eeac373a711259981ca05dd5b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d0557297cb1eb93a69542597517b110ccca457d5ce8d8bfcbfb2a9258bb7b4bd7f716e",
-    "l2": "710fdd19883e869e784c84f2864fa0bfc227662404b77cc8a54d79ae7fb931eab0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933a0e59a07908fc793c590fd83343003a54330e24af908ed31c921e6e6504c3248f73d27d7ca78ded52209bc3bae000f9d95b147360edac1e97c148a3a7396a27939ccf2a17a5b281068665b4865e6c6331533461a8e10a4ceffc4c6a6609c326a",
-    "l3": "127144e6469e001d56237a58c8c869a8173e042bf2ff19d8331441d36ada9c3f",
-    "client_registration_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0270617373776f7264",
-    "client_login_state": "5a9a073b1a1efedebdb404bc073ae74b316920d68ab628bed0c500cae95d6e0280616968ed8daae02c02d3ba41a70104ed0deecd2276e058994d601a1351b359b9f09e9b0606fa88c4194011d5c204861b73c43cbf1ea0d08c03ec2fd6d05572f258311568d792d6ebecee225c0fde4512139e29a435e9f9a0b82dc3809a83ab70617373776f7264",
-    "server_registration_state": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907",
-    "server_login_state": "ebc0953924d55ad66aa801a7c85f47f35889b90002451a04fb7134b8a2a5a33cd69098c0a81ce06f58cbe4fd6ba23c9c1404ad6f639ba64d5f0f7bf0a041fc5872b17f13bd41cbfbdfa8d74bc94ec1abcc77b9a3da8fbad918ca0a5f84a81443",
-    "password_file": "203fabe2af9c8dc668b81db1ece9c2412c94c276495f33202479886de1b12907b2341df425f90244c72d8e19b249ca0d6d1a3a3dfe6ee1773e1b782a81efef29b0076712e01fecdb12301d5d7da92236e47f20494e68defb32084f1ab6c3d4f8923b1d26cac4e3d91cec445b3322f4cc69a727f184353cb4dfe6d55a4c7d2bb4b77fbd41eacb8434f102c8c29cd4831e708046d38615df566675421ae8eb4933",
-    "export_key": "da3a52148a58168c9f804df5e216e3d3f16e935d4d70a5eb249433d88e02ae4c",
-    "shared_secret": "72b17f13bd41cbfbdfa8d74bc94ec1abcc77b9a3da8fbad918ca0a5f84a81443"
-}
-"#;
-
-fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
-    values[key]
-        .as_str()
-        .and_then(|s| hex::decode(&s.to_string()).ok())
-}
-
-fn populate_test_vectors(values: &Value) -> TestVectorParameters {
-    TestVectorParameters {
-        client_s_pk: decode(&values, "client_s_pk").unwrap(),
-        client_s_sk: decode(&values, "client_s_sk").unwrap(),
-        client_e_pk: decode(&values, "client_e_pk").unwrap(),
-        client_e_sk: decode(&values, "client_e_sk").unwrap(),
-        server_s_pk: decode(&values, "server_s_pk").unwrap(),
-        server_s_sk: decode(&values, "server_s_sk").unwrap(),
-        server_e_pk: decode(&values, "server_e_pk").unwrap(),
-        server_e_sk: decode(&values, "server_e_sk").unwrap(),
-        password: decode(&values, "password").unwrap(),
-        blinding_factor_raw: decode(&values, "blinding_factor_raw").unwrap(),
-        blinding_factor: decode(&values, "blinding_factor").unwrap(),
-        pepper: decode(&values, "pepper").unwrap(),
-        oprf_key: decode(&values, "oprf_key").unwrap(),
-        envelope_nonce: decode(&values, "envelope_nonce").unwrap(),
-        client_nonce: decode(&values, "client_nonce").unwrap(),
-        server_nonce: decode(&values, "server_nonce").unwrap(),
-        r1: decode(&values, "r1").unwrap(),
-        r2: decode(&values, "r2").unwrap(),
-        r3: decode(&values, "r3").unwrap(),
-        l1: decode(&values, "l1").unwrap(),
-        l2: decode(&values, "l2").unwrap(),
-        l3: decode(&values, "l3").unwrap(),
-        client_registration_state: decode(&values, "client_registration_state").unwrap(),
-        client_login_state: decode(&values, "client_login_state").unwrap(),
-        server_registration_state: decode(&values, "server_registration_state").unwrap(),
-        server_login_state: decode(&values, "server_login_state").unwrap(),
-        password_file: decode(&values, "password_file").unwrap(),
-        export_key: decode(&values, "export_key").unwrap(),
-        shared_secret: decode(&values, "shared_secret").unwrap(),
-    }
-}
-
-fn stringify_test_vectors(p: &TestVectorParameters) -> String {
-    let mut s = String::new();
-    s.push_str("{\n");
-    s.push_str(format!("\"client_s_pk\": \"{}\",\n", hex::encode(&p.client_s_pk)).as_str());
-    s.push_str(format!("\"client_s_sk\": \"{}\",\n", hex::encode(&p.client_s_sk)).as_str());
-    s.push_str(format!("\"client_e_pk\": \"{}\",\n", hex::encode(&p.client_e_pk)).as_str());
-    s.push_str(format!("\"client_e_sk\": \"{}\",\n", hex::encode(&p.client_e_sk)).as_str());
-    s.push_str(format!("\"server_s_pk\": \"{}\",\n", hex::encode(&p.server_s_pk)).as_str());
-    s.push_str(format!("\"server_s_sk\": \"{}\",\n", hex::encode(&p.server_s_sk)).as_str());
-    s.push_str(format!("\"server_e_pk\": \"{}\",\n", hex::encode(&p.server_e_pk)).as_str());
-    s.push_str(format!("\"server_e_sk\": \"{}\",\n", hex::encode(&p.server_e_sk)).as_str());
-    s.push_str(format!("\"password\": \"{}\",\n", hex::encode(&p.password)).as_str());
-    s.push_str(
-        format!(
-            "\"blinding_factor_raw\": \"{}\",\n",
-            hex::encode(&p.blinding_factor_raw)
-        )
-        .as_str(),
-    );
-    s.push_str(
-        format!(
-            "\"blinding_factor\": \"{}\",\n",
-            hex::encode(&p.blinding_factor)
-        )
-        .as_str(),
-    );
-    s.push_str(format!("\"pepper\": \"{}\",\n", hex::encode(&p.pepper)).as_str());
-    s.push_str(format!("\"oprf_key\": \"{}\",\n", hex::encode(&p.oprf_key)).as_str());
-    s.push_str(
-        format!(
-            "\"envelope_nonce\": \"{}\",\n",
-            hex::encode(&p.envelope_nonce)
-        )
-        .as_str(),
-    );
-    s.push_str(format!("\"client_nonce\": \"{}\",\n", hex::encode(&p.client_nonce)).as_str());
-    s.push_str(format!("\"server_nonce\": \"{}\",\n", hex::encode(&p.server_nonce)).as_str());
-    s.push_str(format!("\"r1\": \"{}\",\n", hex::encode(&p.r1)).as_str());
-    s.push_str(format!("\"r2\": \"{}\",\n", hex::encode(&p.r2)).as_str());
-    s.push_str(format!("\"r3\": \"{}\",\n", hex::encode(&p.r3)).as_str());
-    s.push_str(format!("\"l1\": \"{}\",\n", hex::encode(&p.l1)).as_str());
-    s.push_str(format!("\"l2\": \"{}\",\n", hex::encode(&p.l2)).as_str());
-    s.push_str(format!("\"l3\": \"{}\",\n", hex::encode(&p.l3)).as_str());
-    s.push_str(
-        format!(
-            "\"client_registration_state\": \"{}\",\n",
-            hex::encode(&p.client_registration_state)
-        )
-        .as_str(),
-    );
-    s.push_str(
-        format!(
-            "\"client_login_state\": \"{}\",\n",
-            hex::encode(&p.client_login_state)
-        )
-        .as_str(),
-    );
-    s.push_str(
-        format!(
-            "\"server_registration_state\": \"{}\",\n",
-            hex::encode(&p.server_registration_state)
-        )
-        .as_str(),
-    );
-    s.push_str(
-        format!(
-            "\"server_login_state\": \"{}\",\n",
-            hex::encode(&p.server_login_state)
-        )
-        .as_str(),
-    );
-    s.push_str(
-        format!(
-            "\"password_file\": \"{}\",\n",
-            hex::encode(&p.password_file)
-        )
-        .as_str(),
-    );
-    s.push_str(format!("\"export_key\": \"{}\",\n", hex::encode(&p.export_key)).as_str());
-    s.push_str(format!("\"shared_secret\": \"{}\"\n", hex::encode(&p.shared_secret)).as_str());
-    s.push_str("}\n");
-    s
-}
-
-fn generate_parameters<CS: CipherSuite>() -> TestVectorParameters
-where
-    // Unsightly constraints due to the (required) use of the SizedBytes
-    // instance for KP in ServerRegistration::start. See also the impl
-    // Tryfrom<&[u8]> for ServerRegistration (those are the same constraints).
-    <<CS::KeyFormat as KeyPair>::Repr as SizedBytes>::Len:
-        std::ops::Add<<<CS::KeyFormat as KeyPair>::Repr as SizedBytes>::Len>,
-    generic_array::typenum::Sum<
-        <<CS::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
-        <<CS::KeyFormat as KeyPair>::Repr as SizedBytes>::Len,
-    >: generic_array::ArrayLength<u8>,
-{
-    let mut rng = OsRng;
-
-    // Inputs
-    let server_s_kp = CS::generate_random_keypair(&mut rng).unwrap();
-    let server_e_kp = CS::generate_random_keypair(&mut rng).unwrap();
-    let client_s_kp = CS::generate_random_keypair(&mut rng).unwrap();
-    let client_e_kp = CS::generate_random_keypair(&mut rng).unwrap();
-    let password = b"password";
-    let pepper = b"pepper";
-    let mut blinding_factor_raw = [0u8; 64];
-    rng.fill_bytes(&mut blinding_factor_raw);
-    let mut oprf_key_raw = [0u8; 32];
-    rng.fill_bytes(&mut oprf_key_raw);
-    let mut envelope_nonce = [0u8; 32];
-    rng.fill_bytes(&mut envelope_nonce);
-    let mut client_nonce = [0u8; NONCE_LEN];
-    rng.fill_bytes(&mut client_nonce);
-    let mut server_nonce = [0u8; NONCE_LEN];
-    rng.fill_bytes(&mut server_nonce);
-
-    let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_raw.to_vec());
-    let (r1, client_registration) = ClientRegistration::<CS>::start(
-        password,
-        Some(pepper),
-        &mut blinding_factor_registration_rng,
-    )
-    .unwrap();
-    let r1_bytes = r1.to_bytes().to_vec();
-    let blinding_factor_bytes =
-        CS::Group::scalar_as_bytes(&client_registration.blinding_factor).clone();
-    let client_registration_state = client_registration.to_bytes().to_vec();
-
-    let mut oprf_key_rng = CycleRng::new(oprf_key_raw.to_vec());
-    let (r2, server_registration) = ServerRegistration::<CS>::start(r1, &mut oprf_key_rng).unwrap();
-    let r2_bytes = r2.to_bytes().to_vec();
-    let oprf_key_bytes = CS::Group::scalar_as_bytes(&server_registration.oprf_key).clone();
-    let server_registration_state = server_registration.to_bytes().to_vec();
-
-    let mut client_s_sk_and_nonce: Vec<u8> = Vec::new();
-    client_s_sk_and_nonce.extend_from_slice(&client_s_kp.private().to_arr());
-    client_s_sk_and_nonce.extend_from_slice(&envelope_nonce);
-
-    let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
-    let (r3, export_key_registration) = client_registration
-        .finish(r2, server_s_kp.public(), &mut finish_registration_rng)
-        .unwrap();
-    let r3_bytes = r3.to_bytes().to_vec();
-
-    let password_file = server_registration.finish(r3).unwrap();
-    let password_file_bytes = password_file.to_bytes();
-
-    let mut client_login_start: Vec<u8> = Vec::new();
-    client_login_start.extend_from_slice(&blinding_factor_raw);
-    client_login_start.extend_from_slice(&client_e_kp.private().to_arr());
-    client_login_start.extend_from_slice(&client_nonce);
-
-    let mut client_login_start_rng = CycleRng::new(client_login_start);
-    let (l1, client_login) =
-        ClientLogin::<CS>::start(password, Some(pepper), &mut client_login_start_rng).unwrap();
-    let l1_bytes = l1.to_bytes().to_vec();
-    let client_login_state = client_login.to_bytes().to_vec();
-
-    let mut server_e_sk_rng = CycleRng::new(server_e_kp.private().to_arr().to_vec());
-    let (l2, server_login) = ServerLogin::<CS>::start(
-        password_file,
-        server_s_kp.private(),
-        l1,
-        &mut server_e_sk_rng,
-    )
-    .unwrap();
-    let l2_bytes = l2.to_bytes().to_vec();
-    let server_login_state = server_login.to_bytes().to_vec();
-
-    let mut client_e_sk_rng = CycleRng::new(client_e_kp.private().to_arr().to_vec());
-    let (l3, client_shared_secret, _export_key_login) = client_login
-        .finish(l2, server_s_kp.public(), &mut client_e_sk_rng)
-        .unwrap();
-    let l3_bytes = l3.to_bytes().to_vec();
-
-    TestVectorParameters {
-        client_s_pk: client_s_kp.public().to_arr().to_vec(),
-        client_s_sk: client_s_kp.private().to_arr().to_vec(),
-        client_e_pk: client_e_kp.public().to_arr().to_vec(),
-        client_e_sk: client_e_kp.private().to_arr().to_vec(),
-        server_s_pk: server_s_kp.public().to_arr().to_vec(),
-        server_s_sk: server_s_kp.private().to_arr().to_vec(),
-        server_e_pk: server_e_kp.public().to_arr().to_vec(),
-        server_e_sk: server_e_kp.private().to_arr().to_vec(),
-        password: password.to_vec(),
-        blinding_factor_raw: blinding_factor_raw.to_vec(),
-        blinding_factor: blinding_factor_bytes.to_vec(),
-        pepper: pepper.to_vec(),
-        oprf_key: oprf_key_bytes.to_vec(),
-        envelope_nonce: envelope_nonce.to_vec(),
-        client_nonce: client_nonce.to_vec(),
-        server_nonce: server_nonce.to_vec(),
-        r1: r1_bytes,
-        r2: r2_bytes,
-        r3: r3_bytes,
-        l1: l1_bytes,
-        l2: l2_bytes,
-        l3: l3_bytes,
-        password_file: password_file_bytes,
-        client_registration_state,
-        server_registration_state,
-        client_login_state,
-        server_login_state,
-        shared_secret: client_shared_secret,
-        export_key: export_key_registration.to_vec(),
-    }
-}
-
-#[test]
-fn generate_test_vectors() {
-    let parameters = generate_parameters::<X255193dhNoSlowHash>();
-    println!("{}", stringify_test_vectors(&parameters));
-}
-
-#[test]
-fn test_r1() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-    let mut blinding_factor_rng = CycleRng::new(parameters.blinding_factor_raw);
-    let (r1, client_registration) = ClientRegistration::<X255193dhNoSlowHash>::start(
-        &parameters.password,
-        Some(&parameters.pepper),
-        &mut blinding_factor_rng,
-    )
-    .unwrap();
-    assert_eq!(hex::encode(&parameters.r1), hex::encode(r1.to_bytes()));
-    assert_eq!(
-        hex::encode(&parameters.client_registration_state),
-        hex::encode(client_registration.to_bytes())
-    );
-    Ok(())
-}
-
-#[test]
-fn test_r2() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-    let mut oprf_key_rng = CycleRng::new(parameters.oprf_key);
-    let (r2, server_registration) = ServerRegistration::<X255193dhNoSlowHash>::start(
-        RegisterFirstMessage::try_from(&parameters.r1[..]).unwrap(),
-        &mut oprf_key_rng,
-    )
-    .unwrap();
-    assert_eq!(hex::encode(parameters.r2), hex::encode(r2.to_bytes()));
-    assert_eq!(
-        hex::encode(&parameters.server_registration_state),
-        hex::encode(server_registration.to_bytes())
-    );
-    Ok(())
-}
-
-#[test]
-fn test_r3() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let client_s_sk_and_nonce: Vec<u8> =
-        [parameters.client_s_sk, parameters.envelope_nonce].concat();
-    let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
-    let (r3, export_key_registration) = ClientRegistration::<X255193dhNoSlowHash>::try_from(
-        &parameters.client_registration_state[..],
-    )
-    .unwrap()
-    .finish(
-        RegisterSecondMessage::try_from(&parameters.r2[..]).unwrap(),
-        &Key::try_from(&parameters.server_s_pk[..]).unwrap(),
-        &mut finish_registration_rng,
-    )
-    .unwrap();
-
-    assert_eq!(hex::encode(parameters.r3), hex::encode(r3.to_bytes()));
-    assert_eq!(
-        hex::encode(parameters.export_key),
-        hex::encode(export_key_registration.to_vec())
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_password_file() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let server_registration = ServerRegistration::<X255193dhNoSlowHash>::try_from(
-        &parameters.server_registration_state[..],
-    )
-    .unwrap();
-    let password_file = server_registration
-        .finish(RegisterThirdMessage::try_from(&parameters.r3[..]).unwrap())
-        .unwrap();
-
-    assert_eq!(
-        hex::encode(parameters.password_file),
-        hex::encode(password_file.to_bytes())
-    );
-    Ok(())
-}
-
-#[test]
-fn test_l1() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let client_login_start = [
-        parameters.blinding_factor_raw,
-        parameters.client_e_sk,
-        parameters.client_nonce,
-    ]
-    .concat();
-    let mut client_login_start_rng = CycleRng::new(client_login_start);
-    let (l1, client_login) = ClientLogin::<X255193dhNoSlowHash>::start(
-        &parameters.password,
-        Some(&parameters.pepper),
-        &mut client_login_start_rng,
-    )
-    .unwrap();
-    assert_eq!(hex::encode(&parameters.l1), hex::encode(l1.to_bytes()));
-    assert_eq!(
-        hex::encode(&parameters.client_login_state),
-        hex::encode(client_login.to_bytes())
-    );
-    Ok(())
-}
-
-#[test]
-fn test_l2() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let mut server_e_sk_rng = CycleRng::new(parameters.server_e_sk);
-    let (l2, server_login) = ServerLogin::<X255193dhNoSlowHash>::start(
-        ServerRegistration::try_from(&parameters.password_file[..]).unwrap(),
-        &Key::try_from(&parameters.server_s_sk[..]).unwrap(),
-        LoginFirstMessage::<X255193dhNoSlowHash>::try_from(&parameters.l1[..]).unwrap(),
-        &mut server_e_sk_rng,
-    )
-    .unwrap();
-
-    assert_eq!(hex::encode(&parameters.l2), hex::encode(l2.to_bytes()));
-    assert_eq!(
-        hex::encode(&parameters.server_login_state),
-        hex::encode(server_login.to_bytes())
-    );
-    Ok(())
-}
-
-#[test]
-fn test_l3() -> Result<(), PakeError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let mut client_e_sk_rng = CycleRng::new(parameters.client_e_sk.to_vec());
-    let (l3, shared_secret, export_key_login) =
-        ClientLogin::<X255193dhNoSlowHash>::try_from(&parameters.client_login_state[..])
-            .unwrap()
-            .finish(
-                LoginSecondMessage::<X255193dhNoSlowHash>::try_from(&parameters.l2[..]).unwrap(),
-                &Key::try_from(&parameters.server_s_pk[..])?,
-                &mut client_e_sk_rng,
-            )
-            .unwrap();
-
-    assert_eq!(
-        hex::encode(&parameters.shared_secret),
-        hex::encode(&shared_secret)
-    );
-    assert_eq!(hex::encode(&parameters.l3), hex::encode(l3.to_bytes()));
-    assert_eq!(
-        hex::encode(&parameters.export_key),
-        hex::encode(export_key_login)
-    );
-
-    Ok(())
-}
-
-#[test]
-fn test_server_login_finish() -> Result<(), ProtocolError> {
-    let parameters = populate_test_vectors(&serde_json::from_str(TEST_VECTOR).unwrap());
-
-    let shared_secret =
-        ServerLogin::<X255193dhNoSlowHash>::try_from(&parameters.server_login_state[..])
-            .unwrap()
-            .finish(LoginThirdMessage::try_from(&parameters.l3[..])?)
-            .unwrap();
-
-    assert_eq!(
-        hex::encode(parameters.shared_secret),
-        hex::encode(shared_secret)
-    );
-
-    Ok(())
-}
-
-fn test_complete_flow(
-    registration_password: &[u8],
-    login_password: &[u8],
-) -> Result<(), ProtocolError> {
-    let mut client_rng = OsRng;
-    let mut server_rng = OsRng;
-    let server_kp = X255193dhNoSlowHash::generate_random_keypair(&mut server_rng)?;
-    let (register_m1, client_state) = ClientRegistration::<X255193dhNoSlowHash>::start(
-        registration_password,
-        None,
-        &mut client_rng,
-    )?;
-    let (register_m2, server_state) =
-        ServerRegistration::<X255193dhNoSlowHash>::start(register_m1, &mut server_rng)?;
-    let (register_m3, registration_export_key) =
-        client_state.finish(register_m2, server_kp.public(), &mut client_rng)?;
-    let p_file = server_state.finish(register_m3)?;
-    let (login_m1, client_login_state) =
-        ClientLogin::<X255193dhNoSlowHash>::start(login_password, None, &mut client_rng)?;
-    let (login_m2, server_login_state) = ServerLogin::<X255193dhNoSlowHash>::start(
-        p_file,
-        &server_kp.private(),
-        login_m1,
-        &mut server_rng,
-    )?;
-
-    let client_login_result =
-        client_login_state.finish(login_m2, &server_kp.public(), &mut client_rng);
-
-    if hex::encode(registration_password) == hex::encode(login_password) {
-        let (login_m3, client_shared_secret, login_export_key) = client_login_result?;
-        let server_shared_secret = server_login_state.finish(login_m3)?;
-
-        assert_eq!(
-            hex::encode(server_shared_secret),
-            hex::encode(client_shared_secret)
-        );
-        assert_eq!(
-            hex::encode(registration_export_key),
-            hex::encode(login_export_key)
-        );
-    } else {
-        let res = matches!(
-            client_login_result,
-            Err(ProtocolError::VerificationError(
-                PakeError::InvalidLoginError
-            ))
-        );
-        assert!(res);
-    }
-
-    Ok(())
-}
-
-#[test]
-fn test_complete_flow_success() -> Result<(), ProtocolError> {
-    test_complete_flow(b"good password", b"good password")
-}
-
-#[test]
-fn test_complete_flow_fail() -> Result<(), ProtocolError> {
-    test_complete_flow(b"good password", b"bad password")
-}

src/tests/opaque_test_vectors.rs

@@ -0,0 +1,787 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::{
+    ciphersuite::CipherSuite, errors::*, key_exchange::tripledh::TripleDH, keypair::PrivateKey,
+    opaque::*, slow_hash::NoOpHash, tests::mock_rng::CycleRng, *,
+};
+use curve25519_dalek::ristretto::RistrettoPoint;
+use generic_array::typenum::Unsigned;
+use generic_bytes::SizedBytes;
+use serde_json::Value;
+
+// Tests
+// =====
+
+struct Ristretto255Sha512NoSlowHash;
+impl CipherSuite for Ristretto255Sha512NoSlowHash {
+    type Group = RistrettoPoint;
+    type KeyExchange = TripleDH;
+    type Hash = sha2::Sha512;
+    type SlowHash = NoOpHash;
+}
+
+#[derive(PartialEq)]
+pub enum EnvelopeMode {
+    Base,
+    CustomIdentifier,
+}
+
+#[allow(non_snake_case)]
+pub struct TestVectorParameters {
+    pub dummy_private_key: Vec<u8>,
+    pub dummy_masking_key: Vec<u8>,
+    pub context: Vec<u8>,
+    pub envelope_mode: EnvelopeMode,
+    pub client_private_key: Option<Vec<u8>>,
+    pub client_keyshare: Vec<u8>,
+    pub client_private_keyshare: Vec<u8>,
+    pub server_public_key: Vec<u8>,
+    pub server_private_key: Vec<u8>,
+    pub server_keyshare: Vec<u8>,
+    pub server_private_keyshare: Vec<u8>,
+    pub client_identity: Option<Vec<u8>>,
+    pub server_identity: Option<Vec<u8>>,
+    pub credential_identifier: Vec<u8>,
+    pub password: Vec<u8>,
+    pub blind_registration: Vec<u8>,
+    pub oprf_seed: Vec<u8>,
+    pub masking_nonce: Vec<u8>,
+    pub envelope_nonce: Vec<u8>,
+    pub client_nonce: Vec<u8>,
+    pub server_nonce: Vec<u8>,
+    pub client_info: Vec<u8>,
+    pub server_info: Vec<u8>,
+    pub registration_request: Vec<u8>,
+    pub registration_response: Vec<u8>,
+    pub registration_upload: Vec<u8>,
+    pub KE1: Vec<u8>,
+    pub blind_login: Vec<u8>,
+    pub KE2: Vec<u8>,
+    pub KE3: Vec<u8>,
+    pub export_key: Vec<u8>,
+    pub session_key: Vec<u8>,
+}
+
+// Pulled from "OPAQUE-3DH Test Vector 1" and "OPAQUE-3DH Test Vector 6"
+// of https://datatracker.ietf.org/doc/draft-irtf-cfrg-opaque/
+static TEST_VECTORS: &[&str] = &[
+    r#"
+## OPAQUE-3DH Test Vector 1
+
+### Configuration
+
+~~~
+OPRF: 0001
+Hash: SHA512
+MHF: Identity
+KDF: HKDF-SHA512
+MAC: HMAC-SHA512
+EnvelopeMode: 01
+Group: ristretto255
+Context: 4f50415155452d504f43
+Nh: 64
+Npk: 32
+Nsk: 32
+Nm: 64
+Nx: 64
+Nok: 32
+~~~
+
+### Input Values
+
+~~~
+oprf_seed: 5c4f99877d253be5817b4b03f37b6da680b0d5671d1ec5351fa61c5d82
+eab28b9de4c4e170f27e433ba377c71c49aa62ad26391ee1cac17011d8a7e9406657c
+8
+credential_identifier: 31323334
+password: 436f7272656374486f72736542617474657279537461706c65
+envelope_nonce: 71b8f14b7a1059cdadc414c409064a22cf9e970b0ffc6f1fc6fdd
+539c4676775
+masking_nonce: 54f9341ca183700f6b6acf28dbfe4a86afad788805de49f2d680ab
+86ff39ed7f
+server_private_key: 16eb9dc74a3df2033cd738bf2cfb7a3670c569d7749f284b2
+b241cb237e7d10f
+server_public_key: 18d5035fd0a9c1d6412226df037125901a43f4dff660c0549d
+402f672bcc0933
+server_nonce: f9c5ec75a8cd571370add249e99cb8a8c43f6ef05610ac6e354642b
+f4fedbf69
+client_nonce: 804133133e7ee6836c8515752e24bb44d323fef4ead34cde967798f
+2e9784f69
+server_keyshare: 6e77d4749eb304c4d74be9457c597546bc22aed699225499910f
+c913b3e90712
+client_keyshare: f67926bd036c5dc4971816b9376e9f64737f361ef8269c18f69f
+1ab555e96d4a
+server_private_keyshare: f8e3e31543dd6fc86833296726773d51158291ab9afd
+666bb55dce83474c1101
+client_private_keyshare: 4230d62ea740b13e178185fc517cf2c313e6908c4cd9
+fb42154870ff3490c608
+blind_registration: c62937d17dc9aa213c9038f84fe8c5bf3d953356db01c4d48
+acb7cae48e6a504
+blind_login: b5f458822ea11c900ad776e38e29d7be361f75b4d79b55ad74923299
+bf8d6503
+oprf_key: 23d431bab39aea4d2737ac391a50076300210730971788e3a6a8c29ad3c
+5930e
+~~~
+
+### Intermediate Values
+
+~~~
+client_public_key: f692d6b738b4e240d5f59d534371363b47817c00c7058d4a33
+439911e66c3c27
+auth_key: 27972f9b1cf2ce524d50a7afa40a2ee6957904e2bef29976bdbda452a84
+fcf01023f3ddd8182e64ea5287f99765dd39b83fa89fe189db227212a144134684783
+randomized_pwd: 750ef06299c2fb102242fd84e59613616338f83e69c09c1dc3f91
+c57ac0642876ccbe785e94aa094262efdc6aed08b3faff7c1bddfa14c434c5a908ad6
+c5f9d5
+envelope: 71b8f14b7a1059cdadc414c409064a22cf9e970b0ffc6f1fc6fdd539c46
+76775455739db882585a7c8b3e9ae7955da7135900d85ab832aa83a34b3ce481efc9e
+43d4c2276220c8bcb9d27b5a827a5a2d655700321f3b32d21f578c21316195d8
+handshake_secret: 02fb23a668b7138b029c95d21f1e0eec9e10377be933bdbf3e5
+33ea39073d3ce9d1ef16b55a8a8464f3bf6a991cc645d14c1fa3d9d6cfe36c6c0dcc2
+691d7109
+server_mac_key: e75ce46beeebd26f22540d7988de9809a69cf34fec6c050750708
+e91232297fdbb51e875cd37167d5ce661ebccf0004dbbf96311daf64ddec7faae04c4
+8bbd89
+client_mac_key: 4bce132daa031fff2a6e5ac29287c4641e3b9dc2560394b8c73f3
+b748f1e51e577b932a960b236981217b33bee220b0bce2696638cfb7791f427ade292
+d60f55
+~~~
+
+### Output Values
+
+~~~
+registration_request: 80576bce33c6ce89f9e1a06d8595cd9d09d9aef46b20dad
+d57a845dc50e7c074
+registration_response: 1a80fdb4f4eb1985587b5b95661d2cff1ef2493cdcdd88
+b5699f39048f0d6c2618d5035fd0a9c1d6412226df037125901a43f4dff660c0549d4
+02f672bcc0933
+registration_upload: f692d6b738b4e240d5f59d534371363b47817c00c7058d4a
+33439911e66c3c2795014d8fc0c710bd763c981c5b9329c95e149c6717af91bad2cec
+daf87f2c3c9c11914cb6d44aaee5679e3e61e1b65241fda74902cca908a065495c0b2
+8b799e71b8f14b7a1059cdadc414c409064a22cf9e970b0ffc6f1fc6fdd539c467677
+5455739db882585a7c8b3e9ae7955da7135900d85ab832aa83a34b3ce481efc9e43d4
+c2276220c8bcb9d27b5a827a5a2d655700321f3b32d21f578c21316195d8
+KE1: 60d71c9f5d2a14568807b869e2c251a8e5f7ad8951cd8386c7e32c0634b26b16
+804133133e7ee6836c8515752e24bb44d323fef4ead34cde967798f2e9784f69f6792
+6bd036c5dc4971816b9376e9f64737f361ef8269c18f69f1ab555e96d4a
+KE2: 78a428204f552d3532bad040c961324edb22c738d98f1dd770d65caba0bd8966
+54f9341ca183700f6b6acf28dbfe4a86afad788805de49f2d680ab86ff39ed7fbcbbb
+84a18810b8eb1dc898d9af686f5901a21d0768720b325279fde4931ee52f0d4a0d0d9
+cd1cd7c424d4622b1588ba554cd9241352a59ef52bbe85e0f865021404b115ba954f5
+540cf2d811a6566a93876cac1239b1f75f39b070250af5a84a819e08b13e9e437a80f
+c25cc130f8475dde43efe6d900c664e9bac300298bb0f9c5ec75a8cd571370add249e
+99cb8a8c43f6ef05610ac6e354642bf4fedbf696e77d4749eb304c4d74be9457c5975
+46bc22aed699225499910fc913b3e907120485942e3e077f71c1dd2d87053b39f0d31
+bfe5d5f90df0e85ad9ce771e4f4d1ab697a10a02002cd73916051b887da9554465d58
+68811fd8b22b8f457ed5a4b0
+KE3: b4f8aece9fb4f6b7b5ffe1c98747a91f4ec7bf5481fe5719ba4baad668e3fd4e
+8aba4fa227bd4c688ed9e17f6c6d28ab5e5617a883207d80979dc4797ca89304
+export_key: 045f61f4baa0a945c2e85dfb7a85fe4df8a49e6c31344920e863c286b
+c8a17fe25fc16c84836335b4b5ecc9743c5d3a221101ab004aa99ce65026b6953ad6c
+c0
+session_key: 91187690e5ea0da3110a1dd7d5ffd7c4c3111950c587d9fcf3b9f34b
+f73b86dbeafed42a05024fa875a32415c6143d20c39cd732eb0e31db5e60ea3fb2551
+cf7
+~~~
+"#,
+    r#"
+## OPAQUE-3DH Test Vector 2
+
+### Configuration
+
+~~~
+OPRF: 0001
+Hash: SHA512
+MHF: Identity
+KDF: HKDF-SHA512
+MAC: HMAC-SHA512
+EnvelopeMode: 01
+Group: ristretto255
+Context: 4f50415155452d504f43
+Nh: 64
+Npk: 32
+Nsk: 32
+Nm: 64
+Nx: 64
+Nok: 32
+~~~
+
+### Input Values
+
+~~~
+client_identity: 616c696365
+server_identity: 626f62
+oprf_seed: db5c1c16e264b8933d5da56439e7cfed23ab7287b474fe3cdcd58df089
+a365a426ea849258d9f4bc13573601f2e727c90ecc19d448cf3145a662e0065f157ba
+5
+credential_identifier: 31323334
+password: 436f7272656374486f72736542617474657279537461706c65
+envelope_nonce: d0c7b0f0047682bd87a87e0c3553b9bcdce7e1ae3348570df20bf
+2747829b2d2
+masking_nonce: 30635396b708ddb7fc10fb73c4e3a9258cd9c3f6f761b2c227853b
+5def228c85
+server_private_key: eeb2fcc794f98501b16139771720a0713a2750b9e528adfd3
+662ad56a7e19b04
+server_public_key: 8aa90cb321a38759fc253c444f317782962ca18d33101eab2c
+8cda04405a181f
+server_nonce: 3fa57f7ef652185f89114109f5a61cc8c9216fdd7398246bb7a0c20
+e2fbca2d8
+client_nonce: a6bcd29b5aecc3507fc1f8f7631af3d2f5105155222e48099e5e608
+5d8c1187a
+server_keyshare: ae070cdffe5bb4b1c373e71be8e7d8f356ee5de37881533f1039
+7bcd84d35445
+client_keyshare: 642e7eecf19b804a62817486663d6c6c239396f709b663a4350c
+da67d025687a
+server_private_keyshare: 0974010a8528b813f5b33ae0d791df88516c8839c152
+b030697637878b2d8b0a
+client_private_keyshare: 03b52f066898929f4aca48014b2b97365205ce691ee3
+444b0a7cecec3c7efb01
+blind_registration: a66ffb41ccf1194a8d7dda900f8b6b0652e4c7fac4610066f
+e0489a804d3bb05
+blind_login: e6f161ac189e6873a19a54efca4baa0719e801e336d929d35ca28b5b
+4f60560e
+oprf_key: 1e0550d2dbb9ce5dd9bdbb5f808afbb724c573dc03306dcfc7217796465
+ce607
+~~~
+
+### Intermediate Values
+
+~~~
+client_public_key: ba6cb41f1870e9db7e858440a664e6559d01fdbfb638bbf7e1
+c9004f20d5db71
+auth_key: 5142ae6f6bd80686039656fd7a03cdd7e39cc6e869aa637220d4b5fb64f
+afee2f284a1581fff95ad3a5261b413c5e5b91115f78a3c35486fa56023c300d1726b
+randomized_pwd: cea240b632b9c1d704034920cc3dc3c664ed8cd82cf5c0339af76
+4d6350d2ee9ba1f675ce8df7b6cf8692d1efb158bafa3c2695ac03a2d92346c19810c
+1a698b
+envelope: d0c7b0f0047682bd87a87e0c3553b9bcdce7e1ae3348570df20bf274782
+9b2d26e18240c0cbad3b4cdbd7d9d86512f87e43fac39e3785a17504aaa8508f81e3c
+1517b150259be478720935e175b1e34bbe625d0828a62ca9983f9a27aed27f5e
+handshake_secret: 7925c12d7bf3050e62fe5c8caaece3c85737754c5df79bc59a6
+0fa87929ab1f4a4730f903b87be8b7d89ded8ec97aaec97bc8e7d53a555fd4ad74c4f
+33b9bc83
+server_mac_key: 27d6036335c5654132fb08cc81d95b3067ef7fe795f017531231a
+e3fa03cd3ab72f1f5e81473318f9c01f990263d885dfce4b6ac8630fdc8ee8abc6a36
+7c2339
+client_mac_key: ebb3693bac6310075a89922c7a40599d14d03d9104b7a331106e8
+a578a32a4944751f9d3c230a6690a5747137388a86159cf587969d13dadc0a3830218
+dfbca5
+~~~
+
+### Output Values
+
+~~~
+registration_request: f841cbb85844967568c7405f3831a58c4f5f37ccddb0baa
+4972ea912c960ae66
+registration_response: 0256257cc6e2b04444edc076b9ad44d8b31593e050bea8
+06485707a818f8a93f8aa90cb321a38759fc253c444f317782962ca18d33101eab2c8
+cda04405a181f
+registration_upload: ba6cb41f1870e9db7e858440a664e6559d01fdbfb638bbf7
+e1c9004f20d5db71146e42585d25fa19913876edce4b5ee99b638eb37b1d8a8a76607
+efaa12299e828641ba4fbf1c46fc2c3776e0a0c9791f88a15b9ddfb5495d63ce92d8f
+58823bd0c7b0f0047682bd87a87e0c3553b9bcdce7e1ae3348570df20bf2747829b2d
+26e18240c0cbad3b4cdbd7d9d86512f87e43fac39e3785a17504aaa8508f81e3c1517
+b150259be478720935e175b1e34bbe625d0828a62ca9983f9a27aed27f5e
+KE1: 14cc586d982b6db9846c78e0b3c543591e95fbf2fc877fa0e5eff89897dd3050
+a6bcd29b5aecc3507fc1f8f7631af3d2f5105155222e48099e5e6085d8c1187a642e7
+eecf19b804a62817486663d6c6c239396f709b663a4350cda67d025687a
+KE2: 8ab71c17547f376ae787741c367142790087090cdde6327dabb2581197bffa59
+30635396b708ddb7fc10fb73c4e3a9258cd9c3f6f761b2c227853b5def228c85dd973
+a1ac59244f674da4a1c057961886661bd29e0c1346f0fcf75bf1c78d4781815c2f9f6
+f2f9fe0e370b256f6e82fb2e14c7ffc374d42caf26abf13dca169a6faafd5cff8baa9
+717090bc1fc5e1ba56acb93492d1a8b789f33ff29b6004c4be9a755ff590d7d00d6e8
+893e7e54e639aebf69d18f2182a9bb0f2e1c27c81ba73fa57f7ef652185f89114109f
+5a61cc8c9216fdd7398246bb7a0c20e2fbca2d8ae070cdffe5bb4b1c373e71be8e7d8
+f356ee5de37881533f10397bcd84d35445401c619d464ab3a134c71da4d9874f2f736
+189b8bbb659c28f8db25a58b9f089272132e3091efa87d6b07d10321ba464047be011
+3e91514aba299fd1553bcebb
+KE3: c4a0d5b8148f3ac0f8611b38de38bda085d4eb00d561397ae59676f36dc705be
+1c939e7bfdd7301103af5eb164bdfb70298aab889bd2ac797e419a82bfb442e6
+export_key: 6b50ae4dba956930c0465b4a26c3cee58e05afcab623c1c254ae34acc
+38babf954530a53475672ff46a1cf7fd53ef9e808f85b08793d021bb5c6d2a1bb9204
+f6
+session_key: c9bc2b7e2237f6fbeccd92dc6ec6d51faeb886492f8d23f21743a967
+597025215df02a4afb75349acbafeef9dfd4f19e6d38da8bea4912f7b691b70849b0d
+78e
+~~~
+"#,
+];
+
+static FAKE_TEST_VECTORS: &[&str] = &[r#"
+### OPAQUE-3DH Fake Test Vector 1
+
+#### Configuration
+
+~~~
+OPRF: 0001
+Hash: SHA512
+MHF: Identity
+KDF: HKDF-SHA512
+MAC: HMAC-SHA512
+EnvelopeMode: 01
+Group: ristretto255
+Context: 4f50415155452d504f43
+Nh: 64
+Npk: 32
+Nsk: 32
+Nm: 64
+Nx: 64
+Nok: 32
+~~~
+
+#### Input Values
+
+~~~
+client_identity: 616c696365
+server_identity: 626f62
+oprf_seed: d3cb00535339fe4063c7ba5506a990c243a2b5c77b06848a0be9a0568c
+252fb0d7425382babd267deeed669e56d1d5654c036211f49b42f4489f96f37100779
+f
+credential_identifier: 31323334
+masking_nonce: 3058799f42516228746821dc8c8530d0e8273ebde81941591d69ca
+5aea773090
+client_private_key: 83c9bcc31a9da0ffa4489900d3d1f85bb65c27f26e9ae4e3b
+66f6e02e098c503
+client_public_key: 56717b74a5e1770edb14c65f22cee0487046bd96e122ba97da
+ffed06c4bf4052
+server_private_key: 8d3a9355f9757e7071b3f836e3fb1461a6436e92971625b17
+cd7e580dd27c009
+server_public_key: 7a464761cb19c8b6e832fdfcfd18779b0edc246fe808f5de6c
+e7bdb54df41b67
+server_nonce: 4e2a8098173efa2968036f1762f2e5df41ab976fb1bfb91dae29950
+f8526de4c
+server_keyshare: 0e247410004d83d7cbe3af89c62ff03f942127aec4b0084c9eb5
+88e74ce6dd06
+server_private_keyshare: 326345820acc8aacf4948fce775a1fd265e4e93fd579
+cec8177d6389ee379b0a
+masking_key: e968bfe56ad934c3e1088115bcbf1af8b405fd0de94cdf301f9192cc
+2781de00617e568b14b7235cc1189265811ea354031ea39b62e31a104f181c01d3dae
+4b8
+KE1: 480b6c0066c9320c50dce20f8b6b63e4ded7681defd9da3f70ecdc15770f9e68
+05603c1acb64ea417c0dabaab858a5f9da046d4a0cdbf092034c00451ccdc6e1ee835
+5c91d5ed7aa5ea75b8a730ba8dc45f6b41ae9713e6aa7126211346e8754
+~~~
+
+#### Output Values
+
+~~~
+KE2: 04013bca360b4b9ba95b2f494927375e0f234dac23053822e466a9738f781522
+3058799f42516228746821dc8c8530d0e8273ebde81941591d69ca5aea77309078577
+13efdc95f69166737cd7a80ead60e1a1f805c1da9cccbc0d29120f34be291518798c7
+00793f232374e66182495b76b388d9e11f479580cc2297da02fecee88a99cea6bc411
+b9467e8bfa9a4006aba7f21b74b4ce3bccd686785878b0ec9b3fc4200228014d5d073
+69d42d1d1b1669ecd2ad8905734ca0a641d8f16667ca4e2a8098173efa2968036f176
+2f2e5df41ab976fb1bfb91dae29950f8526de4c0e247410004d83d7cbe3af89c62ff0
+3f942127aec4b0084c9eb588e74ce6dd06fb1a0fd81da51bc1d87c740c186d881ed79
+71fdba5ad1d5cfc94ffe6a731241c78ea7ea5dae503e987edc37355b7348883dc65cd
+b57aec04e64593007f98a405
+~~~
+"#];
+
+macro_rules! parse {
+    ( $v:ident, $s:expr ) => {
+        parse_default!($v, $s, vec![])
+    };
+}
+
+macro_rules! parse_default {
+    ( $v:ident, $s:expr, $d:expr ) => {
+        match decode(&$v, $s) {
+            Some(x) => x,
+            None => $d,
+        }
+    };
+}
+
+macro_rules! rfc_to_params {
+    ( $v:ident ) => {
+        $v.iter()
+            .map(|x| populate_test_vectors(&serde_json::from_str(rfc_to_json(x).as_str()).unwrap()))
+            .collect::<Vec<TestVectorParameters>>()
+    };
+}
+
+fn rfc_to_json(input: &str) -> String {
+    let mut json = vec![];
+    for line in input.lines() {
+        // If line contains colon, then
+        if line.contains(':') {
+            if !json.is_empty() {
+                // Adding closing quote for previous line, comma, and newline
+                json.push("\",\n".to_string());
+            }
+
+            let mut iter = line.split(':');
+            let key = iter.next().unwrap().split_whitespace().next().unwrap();
+            let val = iter.next().unwrap().split_whitespace().next().unwrap();
+
+            json.push(format!("    \"{}\": \"{}", key, val));
+        } else {
+            let s = line.trim().to_string();
+            if s.contains("~") || s.contains("#") {
+                // Ignore comment lines
+                continue;
+            }
+            if s.len() > 0 {
+                json.push(s);
+            }
+        }
+    }
+
+    format!("{{\n{}\"\n}}", json.join(""))
+}
+
+fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
+    values[key]
+        .as_str()
+        .and_then(|s| hex::decode(&s.to_string()).ok())
+}
+
+fn populate_test_vectors(values: &Value) -> TestVectorParameters {
+    TestVectorParameters {
+        dummy_private_key: parse_default!(
+            values,
+            "client_private_key",
+            vec![0u8; <PrivateKey as SizedBytes>::Len::to_usize()]
+        ),
+        dummy_masking_key: parse_default!(values, "masking_key", vec![0u8; 64]),
+        context: parse!(values, "Context"),
+        envelope_mode: match values["EnvelopeMode"].as_str() {
+            Some("01") => EnvelopeMode::Base,
+            Some("02") => EnvelopeMode::CustomIdentifier,
+            _ => panic!("Could not match envelope mode"),
+        },
+        client_private_key: decode(values, "client_private_key"),
+        client_keyshare: parse!(values, "client_keyshare"),
+        client_private_keyshare: parse!(values, "client_private_keyshare"),
+        server_public_key: parse!(values, "server_public_key"),
+        server_private_key: parse!(values, "server_private_key"),
+        server_keyshare: parse!(values, "server_keyshare"),
+        server_private_keyshare: parse!(values, "server_private_keyshare"),
+        client_identity: decode(values, "client_identity"),
+        server_identity: decode(values, "server_identity"),
+        credential_identifier: parse!(values, "credential_identifier"),
+        password: parse!(values, "password"),
+        blind_registration: parse!(values, "blind_registration"),
+        oprf_seed: parse!(values, "oprf_seed"),
+        masking_nonce: parse!(values, "masking_nonce"),
+        envelope_nonce: parse!(values, "envelope_nonce"),
+        client_nonce: parse!(values, "client_nonce"),
+        server_nonce: parse!(values, "server_nonce"),
+        client_info: parse!(values, "client_info"),
+        server_info: parse!(values, "server_info"),
+        registration_request: parse!(values, "registration_request"),
+        registration_response: parse!(values, "registration_response"),
+        registration_upload: parse!(values, "registration_upload"),
+        KE1: parse!(values, "KE1"),
+        KE2: parse!(values, "KE2"),
+        KE3: parse!(values, "KE3"),
+        blind_login: parse!(values, "blind_login"),
+        export_key: parse!(values, "export_key"),
+        session_key: parse!(values, "session_key"),
+    }
+}
+
+fn get_password_file_bytes(parameters: &TestVectorParameters) -> Result<Vec<u8>, ProtocolError> {
+    let password_file = ServerRegistration::<Ristretto255Sha512NoSlowHash>::finish(
+        RegistrationUpload::deserialize(&parameters.registration_upload[..]).unwrap(),
+    );
+
+    Ok(password_file.serialize())
+}
+
+fn parse_identifiers(
+    client_identity: Option<Vec<u8>>,
+    server_identity: Option<Vec<u8>>,
+) -> Option<Identifiers> {
+    match (client_identity, server_identity) {
+        (None, None) => None,
+        (Some(x), None) => Some(Identifiers::ClientIdentifier(x)),
+        (None, Some(y)) => Some(Identifiers::ServerIdentifier(y)),
+        (Some(x), Some(y)) => Some(Identifiers::ClientAndServerIdentifiers(x, y)),
+    }
+}
+
+#[test]
+fn test_registration_request() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let mut rng = CycleRng::new(parameters.blind_registration.to_vec());
+        let client_registration_start_result =
+            ClientRegistration::<Ristretto255Sha512NoSlowHash>::start(
+                &mut rng,
+                &parameters.password,
+            )?;
+        assert_eq!(
+            hex::encode(&parameters.registration_request),
+            hex::encode(client_registration_start_result.message.serialize())
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_registration_response() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let server_setup = ServerSetup::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &[
+                &parameters.oprf_seed[..],
+                &parameters.server_private_key[..],
+                &parameters.dummy_private_key[..],
+            ]
+            .concat(),
+        )?;
+        let server_registration_start_result =
+            ServerRegistration::<Ristretto255Sha512NoSlowHash>::start(
+                &server_setup,
+                RegistrationRequest::deserialize(&parameters.registration_request[..]).unwrap(),
+                &parameters.credential_identifier,
+            )?;
+        assert_eq!(
+            hex::encode(parameters.registration_response),
+            hex::encode(server_registration_start_result.message.serialize())
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_registration_upload() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let mut rng = CycleRng::new(parameters.blind_registration.to_vec());
+        let client_registration_start_result =
+            ClientRegistration::<Ristretto255Sha512NoSlowHash>::start(
+                &mut rng,
+                &parameters.password,
+            )?;
+
+        let mut finish_registration_rng = CycleRng::new(parameters.envelope_nonce);
+        let result = client_registration_start_result.state.finish(
+            &mut finish_registration_rng,
+            RegistrationResponse::deserialize(&parameters.registration_response[..]).unwrap(),
+            match parse_identifiers(parameters.client_identity, parameters.server_identity) {
+                None => ClientRegistrationFinishParameters::Default,
+                Some(ids) => ClientRegistrationFinishParameters::WithIdentifiers(ids),
+            },
+        )?;
+
+        assert_eq!(
+            hex::encode(parameters.registration_upload),
+            hex::encode(result.message.serialize())
+        );
+        assert_eq!(
+            hex::encode(parameters.export_key),
+            hex::encode(result.export_key.to_vec())
+        );
+    }
+
+    Ok(())
+}
+
+#[test]
+fn test_ke1() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let client_login_start = [
+            parameters.blind_login,
+            parameters.client_private_keyshare,
+            parameters.client_nonce,
+        ]
+        .concat();
+        let mut client_login_start_rng = CycleRng::new(client_login_start);
+        let client_login_start_result = ClientLogin::<Ristretto255Sha512NoSlowHash>::start(
+            &mut client_login_start_rng,
+            &parameters.password,
+        )?;
+        assert_eq!(
+            hex::encode(&parameters.KE1),
+            hex::encode(client_login_start_result.message.serialize())
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_ke2() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let server_setup = ServerSetup::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &[
+                &parameters.oprf_seed[..],
+                &parameters.server_private_key[..],
+                &parameters.dummy_private_key[..],
+            ]
+            .concat(),
+        )?;
+
+        let record = ServerRegistration::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &get_password_file_bytes(&parameters)?[..],
+        )?;
+
+        let mut server_private_keyshare_and_nonce_rng = CycleRng::new(
+            [
+                parameters.masking_nonce,
+                parameters.server_private_keyshare,
+                parameters.server_nonce,
+            ]
+            .concat(),
+        );
+        let server_login_start_result = ServerLogin::<Ristretto255Sha512NoSlowHash>::start(
+            &mut server_private_keyshare_and_nonce_rng,
+            &server_setup,
+            Some(record),
+            CredentialRequest::<Ristretto255Sha512NoSlowHash>::deserialize(&parameters.KE1[..])
+                .unwrap(),
+            &parameters.credential_identifier,
+            match parse_identifiers(parameters.client_identity, parameters.server_identity) {
+                None => ServerLoginStartParameters::WithContext(parameters.context.to_vec()),
+                Some(ids) => ServerLoginStartParameters::WithContextAndIdentifiers(
+                    parameters.context.to_vec(),
+                    ids,
+                ),
+            },
+        )?;
+        assert_eq!(
+            hex::encode(&parameters.KE2),
+            hex::encode(server_login_start_result.message.serialize())
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_ke3() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let client_login_start = [
+            parameters.blind_login,
+            parameters.client_private_keyshare,
+            parameters.client_nonce,
+        ]
+        .concat();
+        let mut client_login_start_rng = CycleRng::new(client_login_start);
+        let client_login_start_result = ClientLogin::<Ristretto255Sha512NoSlowHash>::start(
+            &mut client_login_start_rng,
+            &parameters.password,
+        )?;
+
+        let client_login_finish_result = client_login_start_result.state.finish(
+            CredentialResponse::<Ristretto255Sha512NoSlowHash>::deserialize(&parameters.KE2[..])?,
+            match parse_identifiers(parameters.client_identity, parameters.server_identity) {
+                None => ClientLoginFinishParameters::WithContext(parameters.context),
+                Some(ids) => {
+                    ClientLoginFinishParameters::WithContextAndIdentifiers(parameters.context, ids)
+                }
+            },
+        )?;
+
+        assert_eq!(
+            hex::encode(&parameters.session_key),
+            hex::encode(&client_login_finish_result.session_key)
+        );
+        assert_eq!(
+            hex::encode(&parameters.KE3),
+            hex::encode(client_login_finish_result.message.serialize())
+        );
+        assert_eq!(
+            hex::encode(&parameters.export_key),
+            hex::encode(client_login_finish_result.export_key)
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_server_login_finish() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(TEST_VECTORS) {
+        let server_setup = ServerSetup::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &[
+                &parameters.oprf_seed[..],
+                &parameters.server_private_key[..],
+                &parameters.dummy_private_key[..],
+            ]
+            .concat(),
+        )?;
+
+        let record = ServerRegistration::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &get_password_file_bytes(&parameters)?[..],
+        )?;
+
+        let mut server_private_keyshare_and_nonce_rng = CycleRng::new(
+            [
+                parameters.masking_nonce,
+                parameters.server_private_keyshare,
+                parameters.server_nonce,
+            ]
+            .concat(),
+        );
+        let server_login_start_result = ServerLogin::<Ristretto255Sha512NoSlowHash>::start(
+            &mut server_private_keyshare_and_nonce_rng,
+            &server_setup,
+            Some(record),
+            CredentialRequest::<Ristretto255Sha512NoSlowHash>::deserialize(&parameters.KE1[..])
+                .unwrap(),
+            &parameters.credential_identifier,
+            match parse_identifiers(parameters.client_identity, parameters.server_identity) {
+                None => ServerLoginStartParameters::WithContext(parameters.context.to_vec()),
+                Some(ids) => ServerLoginStartParameters::WithContextAndIdentifiers(
+                    parameters.context.to_vec(),
+                    ids,
+                ),
+            },
+        )?;
+
+        let server_login_result = server_login_start_result
+            .state
+            .finish(CredentialFinalization::deserialize(&parameters.KE3[..])?)?;
+
+        assert_eq!(
+            hex::encode(parameters.session_key),
+            hex::encode(&server_login_result.session_key)
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_fake_vectors() -> Result<(), ProtocolError> {
+    for parameters in rfc_to_params!(FAKE_TEST_VECTORS) {
+        let server_setup = ServerSetup::<Ristretto255Sha512NoSlowHash>::deserialize(
+            &[
+                &parameters.oprf_seed[..],
+                &parameters.server_private_key[..],
+                &parameters.dummy_private_key[..],
+            ]
+            .concat(),
+        )?;
+
+        let mut server_private_keyshare_and_nonce_rng = CycleRng::new(
+            [
+                parameters.dummy_masking_key,
+                parameters.masking_nonce,
+                parameters.server_private_keyshare,
+                parameters.server_nonce,
+            ]
+            .concat(),
+        );
+        let server_login_start_result = ServerLogin::<Ristretto255Sha512NoSlowHash>::start(
+            &mut server_private_keyshare_and_nonce_rng,
+            &server_setup,
+            None,
+            CredentialRequest::<Ristretto255Sha512NoSlowHash>::deserialize(&parameters.KE1[..])
+                .unwrap(),
+            &parameters.credential_identifier,
+            match parse_identifiers(parameters.client_identity, parameters.server_identity) {
+                None => ServerLoginStartParameters::WithContext(parameters.context.to_vec()),
+                Some(ids) => ServerLoginStartParameters::WithContextAndIdentifiers(
+                    parameters.context.to_vec(),
+                    ids,
+                ),
+            },
+        )?;
+        assert_eq!(
+            hex::encode(&parameters.KE2),
+            hex::encode(server_login_start_result.message.serialize())
+        );
+    }
+    Ok(())
+}

src/tests/serialization.rs

@@ -1,230 +0,0 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
-//
-// This source code is licensed under the MIT license found in the
-// LICENSE file in the root directory of this source tree.
-
-use crate::{
-    ciphersuite::CipherSuite,
-    envelope::Envelope,
-    group::Group,
-    key_exchange::{
-        traits::{KeyExchange, ToBytes},
-        tripledh::{TripleDH, NONCE_LEN},
-    },
-    keypair::{KeyPair, SizedBytes, X25519KeyPair},
-    opaque::*,
-};
-
-use curve25519_dalek::ristretto::RistrettoPoint;
-use generic_array::typenum::Unsigned;
-use proptest::{collection::vec, prelude::*};
-use rand_core::{OsRng, RngCore};
-
-use sha2::{Digest, Sha256};
-use std::convert::TryFrom;
-
-struct Default;
-impl CipherSuite for Default {
-    type Group = RistrettoPoint;
-    type KeyFormat = crate::keypair::X25519KeyPair;
-    type KeyExchange = TripleDH;
-    type Hash = sha2::Sha256;
-    type SlowHash = crate::slow_hash::NoOpHash;
-}
-
-fn random_ristretto_point() -> RistrettoPoint {
-    let mut rng = OsRng;
-    let mut random_bits = [0u8; 64];
-    rng.fill_bytes(&mut random_bits);
-
-    // This is because RistrettoPoint is on an obsolete sha2 version
-    let mut bits = [0u8; 64];
-    let mut hasher = sha2::Sha512::new();
-    hasher.update(&random_bits[..]);
-    bits.copy_from_slice(&hasher.finalize());
-
-    RistrettoPoint::from_uniform_bytes(&bits)
-}
-
-#[test]
-fn client_registration_roundtrip() {
-    let pw = b"hunter2";
-    let mut rng = OsRng;
-    let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
-    // serialization order: scalar, password
-    let bytes: Vec<u8> = [&sc.as_bytes()[..], &pw[..]].concat();
-    let reg = ClientRegistration::<Default>::try_from(&bytes[..]).unwrap();
-    let reg_bytes = reg.to_bytes();
-    assert_eq!(reg_bytes, bytes);
-}
-
-#[test]
-fn server_registration_roundtrip() {
-    // If we don't have envelope and client_pk, the server registration just
-    // contains the prf key
-    let mut rng = OsRng;
-    let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
-    let mut oprf_bytes: Vec<u8> = vec![];
-    oprf_bytes.extend_from_slice(sc.as_bytes());
-    let reg = ServerRegistration::<Default>::try_from(&oprf_bytes[..]).unwrap();
-    let reg_bytes = reg.to_bytes();
-    assert_eq!(reg_bytes, oprf_bytes);
-    // If we do have envelope and client pk, the server registration contains
-    // the whole kit
-    let key_len =
-        <<<Default as CipherSuite>::KeyFormat as KeyPair>::Repr as SizedBytes>::Len::to_usize();
-    let envelope_size = key_len + Envelope::<sha2::Sha256>::additional_size();
-    let mut mock_envelope_bytes = vec![0u8; envelope_size];
-    rng.fill_bytes(&mut mock_envelope_bytes);
-    println!("{}", mock_envelope_bytes.len());
-    let mock_client_kp = Default::generate_random_keypair(&mut rng).unwrap();
-    // serialization order: scalar, public key, envelope
-    let mut bytes = Vec::<u8>::new();
-    bytes.extend_from_slice(sc.as_bytes());
-    bytes.extend_from_slice(&mock_client_kp.public().to_arr());
-    bytes.extend_from_slice(&mock_envelope_bytes);
-    let reg = ServerRegistration::<Default>::try_from(&bytes[..]).unwrap();
-    let reg_bytes = reg.to_bytes();
-    assert_eq!(reg_bytes, bytes);
-}
-
-#[test]
-fn register_first_message_roundtrip() {
-    let pt = random_ristretto_point();
-    let pt_bytes = pt.to_arr();
-    let r1 = RegisterFirstMessage::<RistrettoPoint>::try_from(pt_bytes.as_slice()).unwrap();
-    let r1_bytes = r1.to_bytes();
-    assert_eq!(pt_bytes, r1_bytes);
-}
-
-#[test]
-fn register_second_message_roundtrip() {
-    let pt = random_ristretto_point();
-    let pt_bytes = pt.to_arr();
-
-    let message = pt_bytes.to_vec();
-    let r2 = RegisterSecondMessage::<RistrettoPoint>::try_from(&message[..]).unwrap();
-    let r2_bytes = r2.to_bytes();
-    assert_eq!(message, r2_bytes);
-}
-
-#[test]
-fn register_third_message_roundtrip() {
-    let mut rng = OsRng;
-    let skp = Default::generate_random_keypair(&mut rng).unwrap();
-    let pubkey_bytes = skp.public().to_arr();
-
-    let mut key = [0u8; 32];
-    rng.fill_bytes(&mut key);
-
-    let mut msg = [0u8; 32];
-    rng.fill_bytes(&mut msg);
-
-    let (ciphertext, _) =
-        Envelope::<sha2::Sha256>::seal(&key, &msg, &pubkey_bytes, &mut rng).unwrap();
-
-    let message: Vec<u8> = [&ciphertext.to_bytes(), &pubkey_bytes[..]].concat();
-    let r3 = RegisterThirdMessage::<X25519KeyPair, sha2::Sha256>::try_from(&message[..]).unwrap();
-    let r3_bytes = r3.to_bytes();
-    assert_eq!(message, r3_bytes);
-}
-
-#[test]
-fn client_login_roundtrip() {
-    let pw = b"hunter2";
-    let mut rng = OsRng;
-    let sc = <RistrettoPoint as Group>::random_scalar(&mut rng);
-
-    let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
-    let mut client_nonce = [0u8; NONCE_LEN];
-    rng.fill_bytes(&mut client_nonce);
-
-    let l1_data = [&sc.to_bytes()[..], &client_nonce, client_e_kp.public()].concat();
-    let mut hasher = Sha256::new();
-    hasher.update(l1_data);
-    let hashed_l1 = hasher.finalize();
-
-    // serialization order: scalar, password, ke1_state
-    let bytes: Vec<u8> = [
-        &sc.as_bytes()[..],
-        &pw[..],
-        client_e_kp.public(),
-        &client_nonce,
-        hashed_l1.as_slice(),
-    ]
-    .concat();
-    let reg = ClientLogin::<Default>::try_from(&bytes[..]).unwrap();
-    let reg_bytes = reg.to_bytes();
-    assert_eq!(reg_bytes, bytes);
-}
-
-#[test]
-fn login_first_message_roundtrip() {
-    let mut rng = OsRng;
-
-    let client_e_kp = Default::generate_random_keypair(&mut rng).unwrap();
-    let mut client_nonce = [0u8; NONCE_LEN];
-    rng.fill_bytes(&mut client_nonce);
-
-    let ke1m: Vec<u8> = [&client_nonce[..], &client_e_kp.public()].concat();
-    let reg = <TripleDH as KeyExchange<sha2::Sha256, crate::keypair::X25519KeyPair>>::KE1Message::try_from(
-        &ke1m[..],
-    )
-    .unwrap();
-    let reg_bytes = reg.to_bytes();
-    assert_eq!(reg_bytes, ke1m);
-}
-
-proptest! {
-
-    #[test]
-    fn test_nocrash_register_first_message(bytes in vec(any::<u8>(), 0..200)) {
-        RegisterFirstMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_register_second_message(bytes in vec(any::<u8>(), 0..200)) {
-        RegisterSecondMessage::<RistrettoPoint>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_register_third_message(bytes in vec(any::<u8>(), 0..200)) {
-        RegisterThirdMessage::<crate::keypair::X25519KeyPair, sha2::Sha512>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_login_first_message(bytes in vec(any::<u8>(), 0..500)) {
-        LoginFirstMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_login_second_message(bytes in vec(any::<u8>(), 0..500)) {
-        LoginSecondMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_login_third_message(bytes in vec(any::<u8>(), 0..500)) {
-        LoginThirdMessage::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_client_registration(bytes in vec(any::<u8>(), 0..700)) {
-        ClientRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_server_registration(bytes in vec(any::<u8>(), 0..700)) {
-        ServerRegistration::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_client_login(bytes in vec(any::<u8>(), 0..700)) {
-        ClientLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-    #[test]
-    fn test_nocrash_server_login(bytes in vec(any::<u8>(), 0..700)) {
-        ServerLogin::<Default>::try_from(&bytes[..]).map_or(true, |_| true);
-    }
-
-}

src/tests/voprf_test_vectors.rs

@@ -0,0 +1,124 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::tests::mock_rng::CycleRng;
+use crate::{errors::*, group::Group, oprf};
+use curve25519_dalek::ristretto::RistrettoPoint;
+use generic_array::GenericArray;
+use serde_json::Value;
+use sha2::Sha512;
+
+struct VOPRFTestVectorParameters {
+    sksm: Vec<u8>,
+    input: Vec<u8>,
+    blind: Vec<u8>,
+    blinded_element: Vec<u8>,
+    evaluation_element: Vec<u8>,
+    output: Vec<u8>,
+}
+
+// Taken from https://github.com/cfrg/draft-irtf-cfrg-voprf/blob/master/draft-irtf-cfrg-voprf.md
+// in base mode
+static OPRF_RISTRETTO255_SHA512: &[&str] = &[
+    r#"
+    {
+        "sksm": "758cbac0e1eb4265d80f6e6489d9a74d788f7ddeda67d7fb3c08b08f44bda30a",
+        "input": "00",
+        "blind": "c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf8e03",
+        "blinded_element": "3c7f2d901c0d4f245503a186086fbdf5d8b4408432b25c5163e8b5a19c258348",
+        "evaluation_element": "fc6c2b854553bf1ed6674072ed0bde1a9911e02b4bd64aa02cfb428f30251e77",
+        "output": "d8ed12382086c74564ae19b7a2b5ed9bdc52656d1fc151faaae51aaba86291e8df0b2143a92f24d44d5efd0892e2e26721d27d88745343493634a66d3a925e3a"
+    }
+    "#,
+    r#"
+    {
+        "sksm": "758cbac0e1eb4265d80f6e6489d9a74d788f7ddeda67d7fb3c08b08f44bda30a",
+        "input": "5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a",
+        "blind": "5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037e50b",
+        "blinded_element": "28a5e797b710f76d20a52507145fbf320a574ec2c8ab0e33e65dd2c277d0ee56",
+        "evaluation_element": "345e140b707257ae83d4911f7ead3177891e7a62c54097732802c4c7a98ab25a",
+        "output": "4d5f4221b5ebfd4d1a9dd54830e1ed0bce5a8f30a792723a6fddfe6cfe9f86bb1d95a3725818aeb725eb0b1b52e01ee9a72f47042372ef66c307770054d674fc"
+    }
+    "#,
+];
+
+fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
+    values[key]
+        .as_str()
+        .and_then(|s| hex::decode(&s.to_string()).ok())
+}
+
+fn populate_test_vectors(values: &Value) -> VOPRFTestVectorParameters {
+    VOPRFTestVectorParameters {
+        sksm: decode(&values, "sksm").unwrap(),
+        input: decode(&values, "input").unwrap(),
+        blind: decode(&values, "blind").unwrap(),
+        blinded_element: decode(&values, "blinded_element").unwrap(),
+        evaluation_element: decode(&values, "evaluation_element").unwrap(),
+        output: decode(&values, "output").unwrap(),
+    }
+}
+
+// Tests input -> blind, blinded_element
+#[test]
+fn test_blind() -> Result<(), PakeError> {
+    for tv in OPRF_RISTRETTO255_SHA512 {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+        let mut rng = CycleRng::new(parameters.blind.to_vec());
+
+        let (token, blinded_element) =
+            oprf::blind::<_, RistrettoPoint, Sha512>(&parameters.input, &mut rng)?;
+
+        assert_eq!(
+            &parameters.blind,
+            &RistrettoPoint::scalar_as_bytes(&token.blind).to_vec()
+        );
+        assert_eq!(
+            &parameters.blinded_element,
+            &blinded_element.to_arr().to_vec()
+        );
+    }
+    Ok(())
+}
+
+// Tests sksm, blinded_element -> evaluation_element
+#[test]
+fn test_evaluate() -> Result<(), PakeError> {
+    for tv in OPRF_RISTRETTO255_SHA512 {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+        let evaluation_element = oprf::evaluate::<RistrettoPoint>(
+            RistrettoPoint::from_element_slice(GenericArray::from_slice(
+                &parameters.blinded_element,
+            ))
+            .unwrap(),
+            &RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&parameters.sksm)).unwrap(),
+        );
+
+        assert_eq!(
+            &parameters.evaluation_element,
+            &evaluation_element.to_arr().to_vec()
+        );
+    }
+    Ok(())
+}
+
+// Tests input, blind, evaluation_element -> output
+#[test]
+fn test_finalize() -> Result<(), PakeError> {
+    for tv in OPRF_RISTRETTO255_SHA512 {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+
+        let output = oprf::finalize::<RistrettoPoint, Sha512>(
+            &parameters.input,
+            &RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&parameters.blind))?,
+            RistrettoPoint::from_element_slice(GenericArray::from_slice(
+                &parameters.evaluation_element,
+            ))?,
+        );
+
+        assert_eq!(&parameters.output, &output.to_vec());
+    }
+    Ok(())
+}