vexahub/voprf-vx
4
0
Fork 0
Code Issues 1 Pull Requests Actions Releases 5 Activity

Matching to latest test vectors with metadata mode (#3)

Browse Source
This commit is contained in:
Kevin Lewi
2021-09-13 16:02:09 -07:00
committed by GitHub
parent fe3222d148
commit 485d18deec
10 changed files with 1317 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/voprf.rs
+407 -52
View File
@@ -3,11 +3,12 @@
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.
use crate::ciphersuite::CipherSuite;
use crate::errors::InternalError;
use crate::group::Group;
use crate::hash::Hash;
use crate::serialization::serialize;
use crate::{
ciphersuite::{CipherSuite, Mode},
errors::InternalError,
group::Group,
serialization::{i2osp, serialize},
};
use digest::Digest;
use generic_array::GenericArray;
use rand::{CryptoRng, RngCore};
@@ -15,36 +16,32 @@ use rand::{CryptoRng, RngCore};
use alloc::vec;
use generic_array::typenum::Unsigned;
static STR_VOPRF: &[u8] = b"HashToGroup-VOPRF07-";
static STR_VOPRF_FINALIZE: &[u8] = b"Finalize-VOPRF07-";
static MODE_BASE: u8 = 0x00;
static STR_HASH_TO_SCALAR: &[u8] = b"HashToScalar-";
static STR_HASH_TO_GROUP: &[u8] = b"HashToGroup-";
static STR_FINALIZE: &[u8] = b"Finalize-";
static STR_SEED: &[u8] = b"Seed-";
static STR_CONTEXT: &[u8] = b"Context-";
static STR_COMPOSITE: &[u8] = b"Composite-";
static STR_CHALLENGE: &[u8] = b"Challenge-";
pub struct Client<CS: CipherSuite> {
pub struct NonVerifiableClient<CS: CipherSuite> {
data: alloc::vec::Vec<u8>,
blind: <CS::Group as Group>::Scalar,
}
impl<CS: CipherSuite> Client<CS> {
impl<CS: CipherSuite> NonVerifiableClient<CS> {
/// Computes the first step for the multiplicative blinding version of DH-OPRF.
pub fn blind<R: RngCore + CryptoRng>(
input: &[u8],
blinding_factor_rng: &mut R,
) -> Result<(Self, CS::Group), InternalError> {
// Choose a random scalar that must be non-zero
let blind = <CS::Group as Group>::random_nonzero_scalar(blinding_factor_rng);
let dst = [
STR_VOPRF,
&<CS::Group as Group>::get_context_string(MODE_BASE)?,
]
.concat();
let mapped_point = <CS::Group as Group>::map_to_curve::<CS::Hash>(input, &dst)?;
let blind_token = mapped_point * &blind;
let (blind, blinded_element) = blind::<CS, _>(input, blinding_factor_rng)?;
Ok((
Self {
data: input.to_vec(),
blind,
},
blind_token,
blinded_element,
))
}
@@ -53,10 +50,11 @@ impl<CS: CipherSuite> Client<CS> {
pub fn finalize(
&self,
evaluated_element: CS::Group,
info: &[u8],
) -> Result<GenericArray<u8, <CS::Hash as Digest>::OutputSize>, InternalError> {
let unblinded_element =
evaluated_element * &<CS::Group as Group>::scalar_invert(&self.blind);
finalize_after_unblind::<CS::Group, CS::Hash>(&self.data, unblinded_element)
finalize_after_unblind::<CS>(&self.data, unblinded_element, info, Mode::Base)
}
#[cfg(test)]
@@ -75,42 +73,371 @@ impl<CS: CipherSuite> Client<CS> {
}
}
pub struct Server<CS: CipherSuite> {
oprf_key: <CS::Group as Group>::Scalar,
pub struct VerifiableClient<CS: CipherSuite> {
data: alloc::vec::Vec<u8>,
blind: <CS::Group as Group>::Scalar,
blinded_element: CS::Group,
}
impl<CS: CipherSuite> Server<CS> {
impl<CS: CipherSuite> VerifiableClient<CS> {
/// Computes the first step for the multiplicative blinding version of DH-OPRF.
pub fn blind<R: RngCore + CryptoRng>(
input: &[u8],
blinding_factor_rng: &mut R,
) -> Result<(Self, CS::Group), InternalError> {
let (blind, blinded_element) = blind::<CS, _>(input, blinding_factor_rng)?;
Ok((
Self {
data: input.to_vec(),
blind,
blinded_element,
},
blinded_element,
))
}
/// Computes the third step for the multiplicative blinding version of DH-OPRF, in which
/// the client unblinds the server's message.
pub fn finalize(
&self,
evaluated_element: CS::Group,
proof: Proof<CS>,
pk: CS::Group,
info: &[u8],
) -> Result<GenericArray<u8, <CS::Hash as Digest>::OutputSize>, InternalError> {
let unblinded_element = verifiable_unblind(
self.blind,
evaluated_element,
self.blinded_element,
pk,
proof,
info,
)?;
finalize_after_unblind::<CS>(&self.data, unblinded_element, info, Mode::Verifiable)
}
#[cfg(test)]
/// Only used for test functions
pub fn from_data_and_blind(
data: &[u8],
blind: &<CS::Group as Group>::Scalar,
blinded_element: &CS::Group,
) -> Self {
Self {
data: data.to_vec(),
blind: blind.clone(),
blinded_element: blinded_element.clone(),
}
}
#[cfg(test)]
/// Only used for test functions
pub fn get_blind(&self) -> <CS::Group as Group>::Scalar {
self.blind
}
}
fn verifiable_unblind<CS: CipherSuite>(
blind: <CS::Group as Group>::Scalar,
evaluated_element: CS::Group,
blinded_element: CS::Group,
pk: CS::Group,
proof: Proof<CS>,
info: &[u8],
) -> Result<CS::Group, InternalError> {
let context = [
STR_CONTEXT,
&CS::get_context_string(Mode::Verifiable)?,
&serialize(info, 2)?,
]
.concat();
let dst = [
STR_HASH_TO_SCALAR,
&CS::get_context_string(Mode::Verifiable)?,
]
.concat();
let m = CS::Group::hash_to_scalar::<CS::Hash>(&context, &dst)?;
let g = CS::Group::base_point();
let t = g * &m;
let u = t + &pk;
verify_proof(g, u, evaluated_element, blinded_element, proof)?;
let unblinded_element = evaluated_element * &CS::Group::scalar_invert(&blind);
Ok(unblinded_element)
}
pub struct NonVerifiableServer<CS: CipherSuite> {
sk: <CS::Group as Group>::Scalar,
}
impl<CS: CipherSuite> NonVerifiableServer<CS> {
pub fn new<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalError> {
let mut key = vec![0u8; <CS::Hash as Digest>::OutputSize::USIZE];
rng.fill_bytes(&mut key);
Self::new_with_key(&key)
let mut seed = vec![0u8; <CS::Hash as Digest>::OutputSize::USIZE];
rng.fill_bytes(&mut seed);
Self::new_from_seed(&seed)
}
pub fn new_with_key(key: &[u8]) -> Result<Self, InternalError> {
Ok(Self {
oprf_key: CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?,
})
let sk = CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?;
Ok(Self { sk })
}
// Corresponds to DeriveKeyPair from the VOPRF spec
pub fn new_from_seed(seed: &[u8]) -> Result<Self, InternalError> {
let dst = [STR_HASH_TO_SCALAR, &CS::get_context_string(Mode::Base)?].concat();
let sk = CS::Group::hash_to_scalar::<CS::Hash>(seed, &dst)?;
Ok(Self { sk })
}
/// Computes the second step for the multiplicative blinding version of DH-OPRF. This
/// message is sent from the server (who holds the OPRF key) to the client.
pub fn evaluate(&self, point: CS::Group) -> CS::Group {
point * &self.oprf_key
pub fn evaluate(
&self,
blinded_element: CS::Group,
info: &[u8],
) -> Result<CS::Group, InternalError> {
let context = [
STR_CONTEXT,
&CS::get_context_string(Mode::Base)?,
&serialize(info, 2)?,
]
.concat();
let dst = [STR_HASH_TO_SCALAR, &CS::get_context_string(Mode::Base)?].concat();
let m = CS::Group::hash_to_scalar::<CS::Hash>(&context, &dst)?;
let t = self.sk + &m;
let evaluated_element = blinded_element * &CS::Group::scalar_invert(&t);
Ok(evaluated_element)
}
}
fn finalize_after_unblind<G: Group, H: Hash>(
pub struct VerifiableServer<CS: CipherSuite> {
sk: <CS::Group as Group>::Scalar,
pk: CS::Group,
}
impl<CS: CipherSuite> VerifiableServer<CS> {
pub fn new<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalError> {
let mut seed = vec![0u8; <CS::Hash as Digest>::OutputSize::USIZE];
rng.fill_bytes(&mut seed);
Self::new_from_seed(&seed)
}
pub fn new_with_key(key: &[u8]) -> Result<Self, InternalError> {
let sk = CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?;
let pk = CS::Group::base_point() * &sk;
Ok(Self { sk, pk })
}
// Corresponds to DeriveKeyPair from the VOPRF spec
pub fn new_from_seed(seed: &[u8]) -> Result<Self, InternalError> {
let dst = [
STR_HASH_TO_SCALAR,
&CS::get_context_string(Mode::Verifiable)?,
]
.concat();
let sk = CS::Group::hash_to_scalar::<CS::Hash>(seed, &dst)?;
let pk = CS::Group::base_point() * &sk;
Ok(Self { sk, pk })
}
/// Computes the second step for the multiplicative blinding version of DH-OPRF. This
/// message is sent from the server (who holds the OPRF key) to the client.
pub fn evaluate<R: RngCore + CryptoRng>(
&self,
rng: &mut R,
blinded_element: CS::Group,
info: &[u8],
) -> Result<(CS::Group, Proof<CS>), InternalError> {
let context = [
STR_CONTEXT,
&CS::get_context_string(Mode::Base)?,
&serialize(info, 2)?,
]
.concat();
let dst = [STR_HASH_TO_SCALAR, &CS::get_context_string(Mode::Base)?].concat();
let m = CS::Group::hash_to_scalar::<CS::Hash>(&context, &dst)?;
let t = self.sk + &m;
let evaluated_element = blinded_element * &CS::Group::scalar_invert(&t);
let g = CS::Group::base_point();
let u = g * &t;
let proof = generate_proof(rng, t, g, u, evaluated_element, blinded_element)?;
Ok((evaluated_element, proof))
}
pub fn get_public_key(&self) -> CS::Group {
self.pk
}
}
// Inner function for blind. Returns the blind scalar and the blinded element
fn blind<CS: CipherSuite, R: RngCore + CryptoRng>(
input: &[u8],
unblinded_element: G,
) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, InternalError> {
let finalize_dst = [STR_VOPRF_FINALIZE, &G::get_context_string(MODE_BASE)?].concat();
blinding_factor_rng: &mut R,
) -> Result<(<CS::Group as Group>::Scalar, CS::Group), InternalError> {
// Choose a random scalar that must be non-zero
let blind = <CS::Group as Group>::random_nonzero_scalar(blinding_factor_rng);
let dst = [STR_HASH_TO_GROUP, &CS::get_context_string(Mode::Base)?].concat();
let mapped_point = <CS::Group as Group>::map_to_curve::<CS::Hash>(input, &dst)?;
let blinded_element = mapped_point * &blind;
Ok((blind, blinded_element))
}
#[allow(clippy::many_single_char_names)]
fn generate_proof<CS: CipherSuite, R: RngCore + CryptoRng>(
rng: &mut R,
k: <CS::Group as Group>::Scalar,
a: CS::Group,
b: CS::Group,
c: CS::Group,
d: CS::Group,
) -> Result<Proof<CS>, InternalError> {
let (m, z) = compute_composites::<CS>(Some(k), b, &[c], &[d])?;
let r = CS::Group::random_nonzero_scalar(rng);
let t2 = a * &r;
let t3 = m * &r;
let challenge_dst = [STR_CHALLENGE, &CS::get_context_string(Mode::Verifiable)?].concat();
let h2_input = [
serialize(&b.to_arr().to_vec(), 2)?,
serialize(&m.to_arr().to_vec(), 2)?,
serialize(&z.to_arr().to_vec(), 2)?,
serialize(&t2.to_arr().to_vec(), 2)?,
serialize(&t3.to_arr().to_vec(), 2)?,
serialize(&challenge_dst, 2)?,
]
.concat();
let hash_to_scalar_dst = [
STR_HASH_TO_SCALAR,
&CS::get_context_string(Mode::Verifiable)?,
]
.concat();
let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &hash_to_scalar_dst)?;
let s = r - &(c * &k);
Ok(Proof {
c_scalar: c,
s_scalar: s,
})
}
pub struct Proof<CS: CipherSuite> {
c_scalar: <CS::Group as Group>::Scalar,
s_scalar: <CS::Group as Group>::Scalar,
}
#[allow(clippy::many_single_char_names)]
fn verify_proof<CS: CipherSuite>(
a: CS::Group,
b: CS::Group,
c: CS::Group,
d: CS::Group,
proof: Proof<CS>,
) -> Result<(), InternalError> {
let (m, z) = compute_composites::<CS>(None, b, &[c], &[d])?;
let t2 = (a * &proof.s_scalar) + &(b * &proof.c_scalar);
let t3 = (m * &proof.s_scalar) + &(z * &proof.c_scalar);
let challenge_dst = [STR_CHALLENGE, &CS::get_context_string(Mode::Verifiable)?].concat();
let h2_input = [
serialize(&b.to_arr().to_vec(), 2)?,
serialize(&m.to_arr().to_vec(), 2)?,
serialize(&z.to_arr().to_vec(), 2)?,
serialize(&t2.to_arr().to_vec(), 2)?,
serialize(&t3.to_arr().to_vec(), 2)?,
serialize(&challenge_dst, 2)?,
]
.concat();
let hash_to_scalar_dst = [
STR_HASH_TO_SCALAR,
&CS::get_context_string(Mode::Verifiable)?,
]
.concat();
let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &hash_to_scalar_dst)?;
match CS::Group::ct_equal_scalar(&c, &proof.c_scalar) {
true => Ok(()),
false => Err(InternalError::ProofVerificationError),
}
}
fn finalize_after_unblind<CS: CipherSuite>(
input: &[u8],
unblinded_element: CS::Group,
info: &[u8],
mode: Mode,
) -> Result<GenericArray<u8, <CS::Hash as Digest>::OutputSize>, InternalError> {
let finalize_dst = [STR_FINALIZE, &CS::get_context_string(mode)?].concat();
let hash_input = [
serialize(input, 2)?,
serialize(info, 2)?,
serialize(&unblinded_element.to_arr().to_vec(), 2)?,
serialize(&finalize_dst, 2)?,
]
.concat();
Ok(<H as Digest>::digest(&hash_input))
Ok(<CS::Hash as Digest>::digest(&hash_input))
}
fn compute_composites<CS: CipherSuite>(
k_option: Option<<CS::Group as Group>::Scalar>,
b: CS::Group,
c_slice: &[CS::Group],
d_slice: &[CS::Group],
) -> Result<(CS::Group, CS::Group), InternalError> {
if c_slice.len() != d_slice.len() {
return Err(InternalError::MismatchedLengthsForCompositeInputs);
}
let seed_dst = [STR_SEED, &CS::get_context_string(Mode::Verifiable)?].concat();
let composite_dst = [STR_COMPOSITE, &CS::get_context_string(Mode::Verifiable)?].concat();
let h1_input = [
serialize(&b.to_arr().to_vec(), 2)?,
serialize(&seed_dst, 2)?,
]
.concat();
let seed = <CS::Hash as Digest>::digest(&h1_input);
let mut m = CS::Group::identity();
let mut z = CS::Group::identity();
for i in 0..c_slice.len() {
let h2_input = [
serialize(&seed, 2)?,
i2osp(i, 2)?,
serialize(&c_slice[i].to_arr().to_vec(), 2)?,
serialize(&d_slice[i].to_arr().to_vec(), 2)?,
serialize(&composite_dst, 2)?,
]
.concat();
let dst = [
STR_HASH_TO_SCALAR,
&CS::get_context_string(Mode::Verifiable)?,
]
.concat();
let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst)?;
m = c_slice[i] * &di + &m;
z = match k_option {
Some(_) => z,
None => d_slice[i] * &di + &z,
};
}
z = match k_option {
Some(k) => m * &k,
None => z,
};
Ok((m, z))
}
///////////
@@ -133,33 +460,58 @@ mod tests {
type Hash = Sha512;
}
fn prf(input: &[u8], oprf_key: &[u8]) -> GenericArray<u8, <Sha512 as Digest>::OutputSize> {
fn prf(
input: &[u8],
oprf_key: &[u8],
info: &[u8],
) -> GenericArray<u8, <Sha512 as Digest>::OutputSize> {
let dst = [
STR_VOPRF,
&RistrettoPoint::get_context_string(MODE_BASE).unwrap(),
STR_HASH_TO_GROUP,
&Ristretto255Sha512::get_context_string(Mode::Base).unwrap(),
]
.concat();
let point = RistrettoPoint::map_to_curve::<Sha512>(input, &dst).unwrap();
let scalar =
RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&oprf_key[..])).unwrap();
let res = point * scalar;
finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, res).unwrap()
let context = [
STR_CONTEXT,
&Ristretto255Sha512::get_context_string(Mode::Base).unwrap(),
&serialize(info, 2).unwrap(),
]
.concat();
let dst = [
STR_HASH_TO_SCALAR,
&Ristretto255Sha512::get_context_string(Mode::Base).unwrap(),
]
.concat();
let m = <<Ristretto255Sha512 as CipherSuite>::Group as Group>::hash_to_scalar::<
<Ristretto255Sha512 as CipherSuite>::Hash,
>(&context, &dst)
.unwrap();
let res = point
* &<<Ristretto255Sha512 as CipherSuite>::Group as Group>::scalar_invert(&(scalar + m));
finalize_after_unblind::<Ristretto255Sha512>(&input, res, info, Mode::Base).unwrap()
}
#[test]
fn oprf_retrieval() {
let input = b"hunter2";
let info = b"info";
let mut rng = OsRng;
let (client, alpha) = Client::<Ristretto255Sha512>::blind(&input[..], &mut rng).unwrap();
let (client, alpha) =
NonVerifiableClient::<Ristretto255Sha512>::blind(&input[..], &mut rng).unwrap();
let oprf_key_bytes = arr![
u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
24, 25, 26, 27, 28, 29, 30, 31, 32,
];
let server = Server::<Ristretto255Sha512>::new_with_key(&oprf_key_bytes).unwrap();
let beta = server.evaluate(alpha);
let res = client.finalize(beta).unwrap();
let res2 = prf(&input[..], &oprf_key_bytes);
let server =
NonVerifiableServer::<Ristretto255Sha512>::new_with_key(&oprf_key_bytes).unwrap();
let beta = server.evaluate(alpha, info).unwrap();
let res = client.finalize(beta, info).unwrap();
let res2 = prf(&input[..], &oprf_key_bytes, info);
assert_eq!(res, res2);
}
@@ -168,16 +520,19 @@ mod tests {
let mut rng = OsRng;
let mut input = alloc::vec![0u8; 64];
rng.fill_bytes(&mut input);
let (client, alpha) = Client::<Ristretto255Sha512>::blind(&input, &mut rng).unwrap();
let res = client.finalize(alpha).unwrap();
let info = b"info";
let (client, alpha) =
NonVerifiableClient::<Ristretto255Sha512>::blind(&input, &mut rng).unwrap();
let res = client.finalize(alpha, info).unwrap();
let dst = [
STR_VOPRF,
&RistrettoPoint::get_context_string(MODE_BASE).unwrap(),
STR_HASH_TO_GROUP,
&Ristretto255Sha512::get_context_string(Mode::Base).unwrap(),
]
.concat();
let point = RistrettoPoint::map_to_curve::<Sha512>(&input, &dst).unwrap();
let res2 = finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, point).unwrap();
let res2 =
finalize_after_unblind::<Ristretto255Sha512>(&input, point, info, Mode::Base).unwrap();
assert_eq!(res, res2);
}