François Garillot
41cd80ccb5
We used to have three problems: - overuse of the <Sha256 as Digest>::OutputSize, which is just, well, U32. Sometimes used as a parameter (as in generate_oprf1), sometimes as a constant (as in generate_oprf3). - the `hash_to_curve` operation for `RistrettoPoint` which requires 64 bits of input entropy, is fed 64 bits of which the last 32 are zero, - the `hash_to_curve` operation for `Curve25519Point` which requires 32 bits of input entropy, is fed 64 bits of which the last 32 are discarded, This corrects all three and uses U32 where the size of the digest is not meant to be a constraint. Addresses #15 partially.
The OPAQUE key exchange protocol 
OPAQUE is an asymmetric password-authenticated key exchange protocol. It allows a client to authenticate to a server using a password, without ever having to expose the plaintext password to the server.
This implementation is based on the Internet Draft for OPAQUE.
Background
Asymmetric Password Authenticated Key Exchange (aPAKE) protocols are designed to provide password authentication and mutually authenticated key exchange without relying on PKI (except during user/password registration) and without disclosing passwords to servers or other entities other than the client machine.
OPAQUE is a PKI-free aPAKE that is secure against pre-computation attacks and capable of using a secret salt.
Documentation
The API can be found here along with an example for usage.
Installation
Add the following line to the dependencies of your Cargo.toml:
opaque-ke = "0.1.0"
Resources
- OPAQUE academic publication, including formal definitions and a proof of security
- draft-krawczyk-cfrg-opaque-05, containing a specification for the OPAQUE protocol
- "Let's talk about PAKE", an introductory blog post written by Matthew Green that covers OPAQUE
Contributors
The authors of this code are Kevin Lewi (@kevinlewi) and François Garillot (@huitseeker). To learn more about contributing to this project, see this document.
Acknowledgments
Special thanks go to Hugo Krawczyk for helping to clarify discrepancies and making suggestions for improving this implementation.
License
This project is MIT licensed.