Matching to latest test vectors with metadata mode (#3)

src/group/mod.rs

@@ -13,14 +13,19 @@ mod ristretto;
 
 use crate::errors::InternalError;
 use crate::hash::Hash;
-use core::ops::Mul;
+use core::ops::{Add, Mul, Sub};
 use generic_array::{ArrayLength, GenericArray};
 use rand::{CryptoRng, RngCore};
 use zeroize::Zeroize;
 
 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
 /// subgroup is noted additively — as in the draft RFC — in this trait.
-pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self> {
+pub trait Group:
+    Copy
+    + Sized
+    + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self>
+    + for<'a> Add<&'a Self, Output = Self>
+{
     /// The ciphersuite identifier as dictated by
     /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
     const SUITE_ID: usize;
@@ -31,16 +36,12 @@ pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output
     /// Hashes a slice of pseudo-random bytes to a scalar
     fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError>;
 
-    /// Generates the contextString parameter as defined in
-    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
-    fn get_context_string(mode: u8) -> Result<alloc::vec::Vec<u8>, InternalError> {
-        use crate::serialization::i2osp;
-
-        Ok([i2osp(mode as usize, 1)?, i2osp(Self::SUITE_ID, 2)?].concat())
-    }
-
     /// The type of base field scalars
-    type Scalar: Zeroize + Copy;
+    type Scalar: Zeroize
+        + Copy
+        + for<'a> Add<&'a Self::Scalar, Output = Self::Scalar>
+        + for<'a> Sub<&'a Self::Scalar, Output = Self::Scalar>
+        + for<'a> Mul<&'a Self::Scalar, Output = Self::Scalar>;
     /// The byte length necessary to represent scalars
     type ScalarLen: ArrayLength<u8> + 'static;
     /// Return a scalar from its fixed-length bytes representation
@@ -70,8 +71,16 @@ pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output
     fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self;
 
     /// Returns if the group element is equal to the identity (1)
-    fn is_identity(&self) -> bool;
+    fn is_identity(&self) -> bool {
+        self.ct_equal(&<Self as Group>::identity())
+    }
+
+    /// Returns the identity group element
+    fn identity() -> Self;
 
     /// Compares in constant time if the group elements are equal
     fn ct_equal(&self, other: &Self) -> bool;
+
+    /// Compares in constant time if the scalars are equal
+    fn ct_equal_scalar(s1: &Self::Scalar, s2: &Self::Scalar) -> bool;
 }