vexahub/voprf-vx
4
0
Fork 0
Code Issues 1 Pull Requests Actions Releases 5 Activity

chore: bump to 0.6.0-rc.0, migrate to elliptic-curve 0.14, hash2curve 0.14, rand_core 0.10

Browse Source
This commit is contained in:
breakingbread
2026-06-27 14:38:19 +02:00
committed by breakingbread
parent d42e7948a1
commit b702b6164e
20 changed files with 357 additions and 421 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ciphersuite.rs
+13 -24
View File
@@ -8,23 +8,26 @@
//! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
use digest::core_api::BlockSizeUser;
use digest::{FixedOutput, HashMarker, OutputSizeUser};
use elliptic_curve::VoprfParameters;
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
use generic_array::ArrayLength;
use crate::Group;
use core::ops::Mul;
use digest::block_api::BlockSizeUser;
use digest::typenum::{IsLess, IsLessOrEqual, U256};
use digest::{Digest, FixedOutput, HashMarker, OutputSizeUser};
use hybrid_array::typenum::{IsGreaterOrEqual, Prod, True, U2};
use hybrid_array::ArraySize;
/// Configures the underlying primitives used in VOPRF
pub trait CipherSuite
where
<Self::Hash as OutputSizeUser>::OutputSize:
ArrayLength + IsLess<U256> + IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize>,
<Self::Group as Group>::SecurityLevel: Mul<U2>,
<Self::Hash as OutputSizeUser>::OutputSize: ArraySize
+ IsLess<U256>
+ IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize, Output = True>
+ IsGreaterOrEqual<Prod<<Self::Group as Group>::SecurityLevel, U2>, Output = True>,
{
/// The ciphersuite identifier as dictated by
/// <https://www.rfc-editor.org/rfc/rfc9497>
const ID: &'static str;
const ID: &'static [u8];
/// A finite cyclic group along with a point representation that allows some
/// customization on how to hash an input to a curve point. See [`Group`].
@@ -32,19 +35,5 @@ where
/// The main hash function to use (for HKDF computations and hashing
/// transcripts).
type Hash: BlockSizeUser + Default + FixedOutput + HashMarker;
}
impl<T: VoprfParameters> CipherSuite for T
where
T: Group,
T::Hash: BlockSizeUser + Default + FixedOutput + HashMarker,
<T::Hash as OutputSizeUser>::OutputSize:
ArrayLength + IsLess<U256> + IsLessOrEqual<<T::Hash as BlockSizeUser>::BlockSize>,
{
const ID: &'static str = T::ID;
type Group = T;
type Hash = T::Hash;
type Hash: Digest + BlockSizeUser + Default + FixedOutput + HashMarker;
}
src/common.rs
+26 -29
View File
@@ -13,10 +13,9 @@ use core::ops::Add;
use derive_where::derive_where;
use digest::{Digest, Output, OutputSizeUser};
use generic_array::sequence::Concat;
use generic_array::typenum::{IsLess, Unsigned, U2, U256, U9};
use generic_array::{ArrayLength, GenericArray};
use rand_core::{TryCryptoRng, TryRngCore};
use hybrid_array::typenum::{IsLess, Unsigned, U2, U256, U9};
use hybrid_array::{Array, ArrayN, ArraySize};
use rand_core::{TryCryptoRng, TryRng};
use subtle::ConstantTimeEq;
#[cfg(feature = "serde")]
@@ -29,14 +28,14 @@ use crate::{CipherSuite, Error, Group, InternalError, Result};
///////////////
pub(crate) const STR_FINALIZE: [u8; 8] = *b"Finalize";
pub(crate) const STR_SEED: [u8; 5] = *b"Seed-";
pub(crate) const STR_DERIVE_KEYPAIR: [u8; 13] = *b"DeriveKeyPair";
pub(crate) const STR_SEED: ArrayN<u8, 5> = Array(*b"Seed-");
pub(crate) const STR_DERIVE_KEYPAIR: ArrayN<u8, 13> = Array(*b"DeriveKeyPair");
pub(crate) const STR_COMPOSITE: [u8; 9] = *b"Composite";
pub(crate) const STR_CHALLENGE: [u8; 9] = *b"Challenge";
pub(crate) const STR_INFO: [u8; 4] = *b"Info";
pub(crate) const STR_OPRF: [u8; 7] = *b"OPRFV1-";
pub(crate) const STR_HASH_TO_SCALAR: [u8; 13] = *b"HashToScalar-";
pub(crate) const STR_HASH_TO_GROUP: [u8; 12] = *b"HashToGroup-";
pub(crate) const STR_HASH_TO_SCALAR: ArrayN<u8, 13> = Array(*b"HashToScalar-");
pub(crate) const STR_HASH_TO_GROUP: ArrayN<u8, 12> = Array(*b"HashToGroup-");
/// Determines the mode of operation (either base mode or verifiable mode). This
/// is only used for custom implementations for [`Group`].
@@ -128,7 +127,7 @@ pub struct Proof<CS: CipherSuite> {
/// Can only fail with [`Error::Batch`].
#[allow(clippy::many_single_char_names)]
pub(crate) fn generate_proof<CS: CipherSuite, R: TryRngCore + TryCryptoRng>(
pub(crate) fn generate_proof<CS: CipherSuite, R: TryRng + TryCryptoRng>(
rng: &mut R,
k: <CS::Group as Group>::Scalar,
a: <CS::Group as Group>::Elem,
@@ -178,7 +177,7 @@ pub(crate) fn generate_proof<CS: CipherSuite, R: TryRngCore + TryCryptoRng>(
&STR_CHALLENGE,
];
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_SCALAR, mode);
// This can't fail, the size of the `input` is known.
let c_scalar = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
let s_scalar = r - &(c_scalar * &k);
@@ -234,7 +233,7 @@ pub(crate) fn verify_proof<CS: CipherSuite>(
&STR_CHALLENGE,
];
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_SCALAR, mode);
// This can't fail, the size of the `input` is known.
let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
@@ -272,7 +271,7 @@ fn compute_composites<
let len = u16::try_from(c_slice.len()).map_err(|_| Error::Batch)?;
// seedDST = "Seed-" || contextString
let seed_dst = Dst::new::<CS, _, _>(STR_SEED, mode);
let seed_dst = Dst::new::<CS, _>(STR_SEED, mode);
// h1Input = I2OSP(len(Bm), 2) || Bm ||
// I2OSP(len(seedDST), 2) || seedDST
@@ -308,7 +307,7 @@ fn compute_composites<
&STR_COMPOSITE,
];
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_SCALAR, mode);
// This can't fail, the size of the `input` is known.
let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
m = c * &di + &m;
@@ -337,7 +336,7 @@ pub(crate) fn derive_key_internal<CS: CipherSuite>(
info: &[u8],
mode: Mode,
) -> Result<<CS::Group as Group>::Scalar, Error> {
let dst = Dst::new::<CS, _, _>(STR_DERIVE_KEYPAIR, mode);
let dst = Dst::new::<CS, _>(STR_DERIVE_KEYPAIR, mode);
let info_len = i2osp_2(info.len()).map_err(|_| Error::DeriveKeyPair)?;
@@ -410,7 +409,7 @@ pub(crate) fn hash_to_group<CS: CipherSuite>(
input: &[u8],
mode: Mode,
) -> Result<<CS::Group as Group>::Elem> {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, mode);
CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).map_err(|_| Error::Input)
}
@@ -419,7 +418,7 @@ pub(crate) fn hash_to_group<CS: CipherSuite>(
pub(crate) fn server_evaluate_hash_input<CS: CipherSuite>(
input: &[u8],
info: Option<&[u8]>,
issued_element: GenericArray<u8, <<CS as CipherSuite>::Group as Group>::ElemLen>,
issued_element: Array<u8, <<CS as CipherSuite>::Group as Group>::ElemLen>,
) -> Result<Output<CS::Hash>> {
// OPRF & VOPRF
// hashInput = I2OSP(len(input), 2) || input ||
@@ -448,24 +447,22 @@ pub(crate) fn server_evaluate_hash_input<CS: CipherSuite>(
.finalize())
}
pub(crate) struct Dst<L: ArrayLength> {
dst_1: GenericArray<u8, L>,
dst_2: &'static str,
pub(crate) struct Dst<L: ArraySize> {
dst_1: Array<u8, L>,
dst_2: &'static [u8],
}
impl<L: ArrayLength> Dst<L> {
pub(crate) fn new<CS, T, TL>(par_1: T, mode: Mode) -> Self
impl<L: ArraySize> Dst<L> {
pub(crate) fn new<CS, TL>(par_1: Array<u8, TL>, mode: Mode) -> Self
where
CS: CipherSuite,
T: Into<GenericArray<u8, TL>>,
TL: ArrayLength + Add<U9, Output = L>,
TL: ArraySize + Add<U9, Output = L>,
{
let par_1 = par_1.into();
// Generates the contextString parameter as defined in
// <https://www.rfc-editor.org/rfc/rfc9497#section-3.1>
let par_2 = GenericArray::from(STR_OPRF)
.concat([mode.to_u8()].into())
.concat([b'-'].into());
let par_2 = ArrayN::<u8, 7>::from(STR_OPRF)
.concat(ArrayN::<u8, 1>::from([mode.to_u8()]))
.concat(ArrayN::<u8, 1>::from([b'-']));
let dst_1 = par_1.concat(par_2);
let dst_2 = CS::ID;
@@ -480,7 +477,7 @@ impl<L: ArrayLength> Dst<L> {
}
pub(crate) fn as_dst(&self) -> [&[u8]; 2] {
[&self.dst_1, self.dst_2.as_bytes()]
[&self.dst_1, self.dst_2]
}
pub(crate) fn i2osp_2(&self) -> [u8; 2] {
@@ -518,6 +515,6 @@ pub(crate) fn i2osp_2(input: usize) -> Result<[u8; 2], InternalError> {
.map_err(|_| InternalError::I2osp)
}
pub(crate) fn i2osp_2_array<L: ArrayLength + IsLess<U256>>() -> GenericArray<u8, U2> {
pub(crate) fn i2osp_2_array<L: ArraySize + IsLess<U256>>() -> Array<u8, U2> {
L::U16.to_be_bytes().into()
}
src/group/elliptic_curve.rs
+47 -72
View File
@@ -6,43 +6,47 @@
// of this source tree. You may select, at your option, one of the above-listed
// licenses.
use core::num::NonZeroU32;
use core::ops::Add;
use digest::core_api::BlockSizeUser;
use core::ops::{Add, Mul};
use digest::block_api::BlockSizeUser;
use digest::typenum::{IsLess, IsLessOrEqual, U256};
use digest::{FixedOutput, HashMarker};
use elliptic_curve::group::cofactor::CofactorGroup;
use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
use elliptic_curve::sec1::{FromSec1Point, ModulusSize, ToSec1Point};
use elliptic_curve::{
AffinePoint, Field, FieldBytes, FieldBytesSize, Group as _, ProjectivePoint, PublicKey, Scalar,
SecretKey,
};
use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
use generic_array::{ArrayLength, GenericArray};
use rand_core::{TryCryptoRng, TryRngCore};
use hash2curve::{hash_to_scalar, ExpandMsgXmd, GroupDigest};
use hybrid_array::typenum::{IsGreaterOrEqual, Prod, Sum, True, U2};
use hybrid_array::{Array, ArraySize};
use rand_core::TryCryptoRng;
use super::Group;
use crate::{Error, InternalError, Result};
use crate::{CipherSuite, Error, InternalError, Result};
type ElemLen<C> = <ScalarLen<C> as ModulusSize>::CompressedPointSize;
type ScalarLen<C> = FieldBytesSize<C>;
impl<C> Group for C
where
C: GroupDigest,
ProjectivePoint<Self>: CofactorGroup + ToEncodedPoint<Self>,
C: GroupDigest + CipherSuite + hash2curve::MapToCurve,
C::SecurityLevel: Mul<U2>,
C::SecurityLevel: ArraySize,
<C::SecurityLevel as Mul<U2>>::Output: ArraySize,
ProjectivePoint<Self>: CofactorGroup + ToSec1Point<Self>,
ScalarLen<Self>: ModulusSize,
ScalarLen<Self>: ArrayLength,
AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
Scalar<Self>: FromOkm,
ScalarLen<Self>: ArraySize,
ScalarLen<Self>: hybrid_array::typenum::NonZero,
Scalar<Self>: elliptic_curve::ops::Reduce<Array<u8, ScalarLen<Self>>>,
Scalar<Self>: elliptic_curve::ops::Reduce<Array<u8, <C as hash2curve::MapToCurve>::Length>>,
AffinePoint<Self>: FromSec1Point<Self> + ToSec1Point<Self>,
// `VoprfClientLen`, `PoprfClientLen`, `VoprfServerLen`, `PoprfServerLen`
ScalarLen<Self>: Add<ElemLen<Self>>,
Sum<ScalarLen<Self>, ElemLen<Self>>: ArrayLength,
Sum<ScalarLen<Self>, ElemLen<Self>>: ArraySize,
// `ProofLen`
ScalarLen<Self>: Add<ScalarLen<Self>>,
Sum<ScalarLen<Self>, ScalarLen<Self>>: ArrayLength,
ElemLen<Self>: ArrayLength,
Sum<ScalarLen<Self>, ScalarLen<Self>>: ArraySize,
ElemLen<Self>: ArraySize,
{
type Elem = ProjectivePoint<Self>;
@@ -52,23 +56,25 @@ where
type ScalarLen = ScalarLen<Self>;
type SecurityLevel = C::SecurityLevel;
type OkmLen = <C as hash2curve::MapToCurve>::Length;
// Implements the `hash_to_curve()` function from
// https://www.rfc-editor.org/rfc/rfc9380.html#section-3
fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
{
Self::hash_from_bytes::<ExpandMsgXmd<H>>(input, dst).map_err(|_| InternalError::Input)
fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError> {
Self::hash_from_bytes(input, dst).map_err(|_| InternalError::Input)
}
// Implements the `HashToScalar()` function
fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize, Output = True>,
C::SecurityLevel: Mul<U2>,
H::OutputSize: IsGreaterOrEqual<Prod<C::SecurityLevel, U2>, Output = True>,
{
<Self as GroupDigest>::hash_to_scalar::<ExpandMsgXmd<H>>(input, dst)
hash_to_scalar::<C, ExpandMsgXmd<H>, <C as hash2curve::MapToCurve>::Length>(input, dst)
.map_err(|_| InternalError::Input)
}
@@ -80,10 +86,10 @@ where
ProjectivePoint::<Self>::identity()
}
fn serialize_elem(elem: Self::Elem) -> GenericArray<u8, Self::ElemLen> {
let bytes = elem.to_encoded_point(true);
fn serialize_elem(elem: Self::Elem) -> Array<u8, Self::ElemLen> {
let bytes = elem.to_sec1_point(true);
let bytes = bytes.as_bytes();
let mut result = GenericArray::default();
let mut result = Array::default();
result[..bytes.len()].copy_from_slice(bytes);
result
}
@@ -94,8 +100,16 @@ where
.map_err(|_| Error::Deserialization)
}
fn random_scalar<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar> {
Ok(*SecretKey::<Self>::random(&mut CompatRng(rng)).to_nonzero_scalar())
fn random_scalar<R: TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar> {
loop {
let mut bytes = FieldBytes::<Self>::default();
rng.try_fill_bytes(&mut bytes).map_err(|_| Error::Rng)?;
if let Ok(key) = SecretKey::<Self>::from_slice(&bytes) {
return Ok(*key.to_nonzero_scalar());
}
}
}
fn invert_scalar(scalar: Self::Scalar) -> Self::Scalar {
@@ -111,9 +125,9 @@ where
Scalar::<Self>::ZERO
}
fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
fn serialize_scalar(scalar: Self::Scalar) -> Array<u8, Self::ScalarLen> {
let bytes: FieldBytes<Self> = scalar.into();
let mut result = GenericArray::<u8, Self::ScalarLen>::default();
let mut result = Array::<u8, Self::ScalarLen>::default();
result.as_mut_slice().copy_from_slice(bytes.as_ref());
result
}
@@ -124,42 +138,3 @@ where
.map_err(|_| Error::Deserialization)
}
}
/// Adapter allowing `rand_core 0.9` RNGs to satisfy the `elliptic_curve` 0.13
/// requirement for `rand_core 0.6` traits.
///
/// TODO #150: Remove this adapter when `elliptic_curve` migrates to `rand_core
/// 0.9`.
struct CompatRng<'a, R>(&'a mut R);
impl<'a, R> elliptic_curve::rand_core::RngCore for CompatRng<'a, R>
where
R: TryRngCore,
{
fn next_u32(&mut self) -> u32 {
self.0.try_next_u32().expect("RNG failure")
}
fn next_u64(&mut self) -> u64 {
self.0.try_next_u64().expect("RNG failure")
}
fn fill_bytes(&mut self, dest: &mut [u8]) {
self.0
.try_fill_bytes(dest)
.expect("RNG failure while filling bytes");
}
fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), elliptic_curve::rand_core::Error> {
self.0.try_fill_bytes(dest).map_err(|_| compat_error())?;
Ok(())
}
}
impl<'a, R> elliptic_curve::rand_core::CryptoRng for CompatRng<'a, R> where R: TryCryptoRng {}
fn compat_error() -> elliptic_curve::rand_core::Error {
let code = NonZeroU32::new(elliptic_curve::rand_core::Error::CUSTOM_START)
.expect("CUSTOM_START must be non-zero");
elliptic_curve::rand_core::Error::from(code)
}
src/group/mod.rs
+28 -13
View File
@@ -14,11 +14,11 @@ mod ristretto;
use core::ops::{Add, Mul, Sub};
use digest::core_api::BlockSizeUser;
use digest::block_api::BlockSizeUser;
use digest::{FixedOutput, HashMarker};
use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
use generic_array::{ArrayLength, GenericArray};
use rand_core::{TryCryptoRng, TryRngCore};
use hybrid_array::typenum::{IsGreaterOrEqual, IsLess, IsLessOrEqual, Prod, Sum, True, U2, U256};
use hybrid_array::{Array, ArraySize};
use rand_core::{TryCryptoRng, TryRng};
#[cfg(feature = "ristretto255")]
pub use ristretto::Ristretto255;
use subtle::{Choice, ConstantTimeEq};
@@ -32,10 +32,10 @@ pub trait Group
where
// `VoprfClientLen`, `PoprfClientLen`, `VoprfServerLen`, `PoprfServerLen`
Self::ScalarLen: Add<Self::ElemLen>,
Sum<Self::ScalarLen, Self::ElemLen>: ArrayLength,
Sum<Self::ScalarLen, Self::ElemLen>: ArraySize,
// `ProofLen`
Self::ScalarLen: Add<Self::ScalarLen>,
Sum<Self::ScalarLen, Self::ScalarLen>: ArrayLength,
Sum<Self::ScalarLen, Self::ScalarLen>: ArraySize,
{
/// The type of group elements
type Elem: ConstantTimeEq
@@ -45,7 +45,7 @@ where
+ for<'a> Mul<&'a Self::Scalar, Output = Self::Elem>;
/// The byte length necessary to represent group elements
type ElemLen: ArrayLength + 'static;
type ElemLen: ArraySize + 'static;
/// The type of base field scalars
type Scalar: ConstantTimeEq
@@ -56,7 +56,18 @@ where
+ for<'a> Sub<&'a Self::Scalar, Output = Self::Scalar>;
/// The byte length necessary to represent scalars
type ScalarLen: ArrayLength + 'static;
type ScalarLen: ArraySize + 'static;
/// Security parameter `k` in bytes (i.e. `k / 8`), as defined in
/// [RFC 9380 §8](https://www.rfc-editor.org/rfc/rfc9380#section-8).
///
/// Used to enforce `H::OutputSize >= 2 * SecurityLevel` in
/// `hash_to_curve` and `hash_to_scalar`, which corresponds to the
/// `expand_message` requirement `len_in_bytes = 2 * k / 8`.
type SecurityLevel: ArraySize;
/// The OKM length for hash_to_scalar (>= ScalarLen, used by hash_to_field).
type OkmLen: ArraySize + hybrid_array::typenum::NonZero;
/// Transforms a password and domain separation tag (DST) into a curve point
///
@@ -66,7 +77,9 @@ where
fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize, Output = True>,
Self::SecurityLevel: Mul<U2>,
H::OutputSize: IsGreaterOrEqual<Prod<Self::SecurityLevel, U2>, Output = True>;
/// Hashes a slice of pseudo-random bytes to a scalar
///
@@ -76,7 +89,9 @@ where
fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize, Output = True>,
Self::SecurityLevel: Mul<U2>,
H::OutputSize: IsGreaterOrEqual<Prod<Self::SecurityLevel, U2>, Output = True>;
/// Get the base point for the group
fn base_elem() -> Self::Elem;
@@ -90,7 +105,7 @@ where
}
/// Serializes the `self` group element
fn serialize_elem(elem: Self::Elem) -> GenericArray<u8, Self::ElemLen>;
fn serialize_elem(elem: Self::Elem) -> Array<u8, Self::ElemLen>;
/// Return an element from its fixed-length bytes representation. If the
/// element is the identity element, return an error.
@@ -104,7 +119,7 @@ where
///
/// # Errors
/// [`Error::Rng`](crate::Error::Rng) if the random number generator fails.
fn random_scalar<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar>;
fn random_scalar<R: TryRng + TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar>;
/// The multiplicative inverse of this scalar
fn invert_scalar(scalar: Self::Scalar) -> Self::Scalar;
@@ -117,7 +132,7 @@ where
fn zero_scalar() -> Self::Scalar;
/// Serializes a scalar to bytes
fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen>;
fn serialize_scalar(scalar: Self::Scalar) -> Array<u8, Self::ScalarLen>;
/// Return a scalar from its fixed-length bytes representation. If the
/// scalar is zero or invalid, then return an error.
src/group/ristretto.rs
+45 -21
View File
@@ -6,16 +6,20 @@
// of this source tree. You may select, at your option, one of the above-listed
// licenses.
use core::num::NonZeroU16;
use core::ops::Mul;
use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::traits::Identity;
use digest::core_api::BlockSizeUser;
use digest::block_api::BlockSizeUser;
use digest::{FixedOutput, HashMarker};
use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
use generic_array::GenericArray;
use rand_core::{TryCryptoRng, TryRngCore};
use hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
use hybrid_array::typenum::{
IsGreaterOrEqual, IsLess, IsLessOrEqual, Prod, True, U16, U2, U256, U32, U64,
};
use hybrid_array::Array;
use rand_core::{TryCryptoRng, TryRng};
use subtle::ConstantTimeEq;
use super::Group;
@@ -27,7 +31,7 @@ pub struct Ristretto255;
#[cfg(feature = "ristretto255-ciphersuite")]
impl crate::CipherSuite for Ristretto255 {
const ID: &'static str = "ristretto255-SHA512";
const ID: &'static [u8] = b"ristretto255-SHA512";
type Group = Ristretto255;
@@ -43,19 +47,31 @@ impl Group for Ristretto255 {
type ScalarLen = U32;
type SecurityLevel = U16;
type OkmLen = U64;
// Implements the `hash_to_ristretto255()` function from
// https://www.rfc-editor.org/rfc/rfc9380.html#appendix-B
fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize, Output = True>,
Self::SecurityLevel: Mul<U2>,
H::OutputSize: IsGreaterOrEqual<Prod<Self::SecurityLevel, U2>, Output = True>,
{
let mut uniform_bytes = GenericArray::<_, U64>::default();
ExpandMsgXmd::<H>::expand_message(input, dst, 64)
.map_err(|_| InternalError::Input)?
.fill_bytes(&mut uniform_bytes);
let mut uniform_bytes = [0u8; 64];
Ok(RistrettoPoint::from_uniform_bytes(&uniform_bytes.into()))
<ExpandMsgXmd<H> as ExpandMsg<U16>>::expand_message(
input,
dst,
NonZeroU16::new(64).unwrap(),
)
.map_err(|_| InternalError::Input)?
.fill_bytes(&mut uniform_bytes)
.map_err(|_| InternalError::Input)?;
Ok(RistrettoPoint::from_uniform_bytes(&uniform_bytes))
}
// Implements the `HashToScalar()` function from
@@ -63,14 +79,22 @@ impl Group for Ristretto255 {
fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
where
H: BlockSizeUser + Default + FixedOutput + HashMarker,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize, Output = True>,
Self::SecurityLevel: Mul<U2>,
H::OutputSize: IsGreaterOrEqual<Prod<Self::SecurityLevel, U2>, Output = True>,
{
let mut uniform_bytes = GenericArray::<_, U64>::default();
ExpandMsgXmd::<H>::expand_message(input, dst, 64)
.map_err(|_| InternalError::Input)?
.fill_bytes(&mut uniform_bytes);
let mut uniform_bytes = [0u8; 64];
Ok(Scalar::from_bytes_mod_order_wide(&uniform_bytes.into()))
<ExpandMsgXmd<H> as ExpandMsg<U16>>::expand_message(
input,
dst,
NonZeroU16::new(64).unwrap(),
)
.map_err(|_| InternalError::Input)?
.fill_bytes(&mut uniform_bytes)
.map_err(|_| InternalError::Input)?;
Ok(Scalar::from_bytes_mod_order_wide(&uniform_bytes))
}
fn base_elem() -> Self::Elem {
@@ -82,7 +106,7 @@ impl Group for Ristretto255 {
}
// serialization of a group element
fn serialize_elem(elem: Self::Elem) -> GenericArray<u8, Self::ElemLen> {
fn serialize_elem(elem: Self::Elem) -> Array<u8, Self::ElemLen> {
elem.compress().to_bytes().into()
}
@@ -94,7 +118,7 @@ impl Group for Ristretto255 {
.ok_or(Error::Deserialization)
}
fn random_scalar<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar> {
fn random_scalar<R: TryRng + TryCryptoRng>(rng: &mut R) -> Result<Self::Scalar> {
loop {
let mut scalar_bytes = [0u8; 32];
rng.try_fill_bytes(&mut scalar_bytes)
@@ -119,7 +143,7 @@ impl Group for Ristretto255 {
Scalar::ZERO
}
fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
fn serialize_scalar(scalar: Self::Scalar) -> Array<u8, Self::ScalarLen> {
scalar.to_bytes().into()
}
src/lib.rs
+41 -41
View File
@@ -54,11 +54,11 @@
//! # type CipherSuite = voprf::Ristretto255;
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! use rand::rngs::OsRng;
//! use rand::RngCore;
//! use rand::rngs::SysRng;
//! use rand::Rng;
//! use voprf::OprfServer;
//!
//! let mut server_rng = OsRng;
//! let mut server_rng = SysRng;
//! let server = OprfServer::<CipherSuite>::new(&mut server_rng);
//! ```
//!
@@ -74,11 +74,11 @@
//! # type CipherSuite = voprf::Ristretto255;
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! use rand::rngs::OsRng;
//! use rand::RngCore;
//! use rand::rngs::SysRng;
//! use rand::Rng;
//! use voprf::OprfClient;
//!
//! let mut client_rng = OsRng;
//! let mut client_rng = SysRng;
//! let client_blind_result = OprfClient::<CipherSuite>::blind(b"input", &mut client_rng)
//! .expect("Unable to construct client");
//! ```
@@ -96,15 +96,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::OprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = OprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::OprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! let server_evaluate_result = server.blind_evaluate(&client_blind_result.message);
//! ```
@@ -121,15 +121,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::OprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = OprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::OprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! # let message = server.blind_evaluate(&client_blind_result.message);
//! let client_finalize_result = client_blind_result
@@ -154,15 +154,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::OprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = OprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::OprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! # let message = server.blind_evaluate(&client_blind_result.message);
//! let client_finalize_result = client_blind_result
@@ -200,11 +200,11 @@
//! # type CipherSuite = voprf::Ristretto255;
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! use rand::rngs::OsRng;
//! use rand::RngCore;
//! use rand::rngs::SysRng;
//! use rand::Rng;
//! use voprf::VoprfServer;
//!
//! let mut server_rng = OsRng;
//! let mut server_rng = SysRng;
//! let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//!
//! // To be sent to the client
@@ -227,11 +227,11 @@
//! # type CipherSuite = voprf::Ristretto255;
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! use rand::rngs::OsRng;
//! use rand::RngCore;
//! use rand::rngs::SysRng;
//! use rand::Rng;
//! use voprf::VoprfClient;
//!
//! let mut client_rng = OsRng;
//! let mut client_rng = SysRng;
//! let client_blind_result = VoprfClient::<CipherSuite>::blind(b"input", &mut client_rng)
//! .expect("Unable to construct client");
//! ```
@@ -250,15 +250,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::{VoprfServerEvaluateResult, VoprfClient};
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = VoprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::VoprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! let VoprfServerEvaluateResult { message, proof } =
//! server.blind_evaluate(&mut server_rng, &client_blind_result.message);
@@ -277,15 +277,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::VoprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = VoprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::VoprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! # let server_evaluate_result = server.blind_evaluate(
//! # &mut server_rng,
@@ -318,15 +318,15 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::VoprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let client_blind_result = VoprfClient::<CipherSuite>::blind(
//! # b"input",
//! # &mut client_rng,
//! # ).expect("Unable to construct client");
//! # use voprf::VoprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! # let server_evaluate_result = server.blind_evaluate(
//! # &mut server_rng,
@@ -372,9 +372,9 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::VoprfClient;
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! let mut client_rng = OsRng;
//! let mut client_rng = SysRng;
//! let mut client_states = vec![];
//! let mut client_messages = vec![];
//! for _ in 0..10 {
@@ -396,9 +396,9 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::{VoprfServerBatchEvaluateFinishResult, VoprfClient};
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let mut client_states = vec![];
//! # let mut client_messages = vec![];
//! # for _ in 0..10 {
@@ -410,7 +410,7 @@
//! # client_messages.push(client_blind_result.message);
//! # }
//! # use voprf::VoprfServer;
//! let mut server_rng = OsRng;
//! let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! let prepared_evaluation_elements = server.batch_blind_evaluate_prepare(client_messages.iter());
//! let prepared_elements: Vec<_> = prepared_evaluation_elements.collect();
@@ -430,9 +430,9 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::{VoprfServerBatchEvaluateResult, VoprfClient};
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let mut client_states = vec![];
//! # let mut client_messages = vec![];
//! # for _ in 0..10 {
@@ -444,7 +444,7 @@
//! # client_messages.push(client_blind_result.message);
//! # }
//! # use voprf::VoprfServer;
//! let mut server_rng = OsRng;
//! let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! let VoprfServerBatchEvaluateResult { messages, proof } = server
//! .batch_blind_evaluate(&mut server_rng, &client_messages)
@@ -464,9 +464,9 @@
//! # #[cfg(not(feature = "ristretto255"))]
//! # type CipherSuite = p256::NistP256;
//! # use voprf::{VoprfServerBatchEvaluateResult, VoprfClient};
//! # use rand::{rngs::OsRng, RngCore};
//! # use rand::{rngs::SysRng, Rng};
//! #
//! # let mut client_rng = OsRng;
//! # let mut client_rng = SysRng;
//! # let mut client_states = vec![];
//! # let mut client_messages = vec![];
//! # for _ in 0..10 {
@@ -478,7 +478,7 @@
//! # client_messages.push(client_blind_result.message);
//! # }
//! # use voprf::VoprfServer;
//! # let mut server_rng = OsRng;
//! # let mut server_rng = SysRng;
//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
//! # let VoprfServerBatchEvaluateResult { messages, proof } = server
//! # .batch_blind_evaluate(&mut server_rng, &client_messages)
src/oprf.rs
+15 -15
View File
@@ -12,9 +12,9 @@ use core::iter::{self, Map};
use derive_where::derive_where;
use digest::{Digest, Output};
use generic_array::typenum::Unsigned;
use generic_array::GenericArray;
use rand_core::{TryCryptoRng, TryRngCore};
use hybrid_array::typenum::Unsigned;
use hybrid_array::Array;
use rand_core::{TryCryptoRng, TryRng};
use crate::common::{
derive_key_internal, deterministic_blind_unchecked, hash_to_group, i2osp_2,
@@ -73,7 +73,7 @@ impl<CS: CipherSuite> OprfClient<CS> {
///
/// # Errors
/// [`Error::Input`] if the `input` is empty or longer then [`u16::MAX`].
pub fn blind<R: TryRngCore + TryCryptoRng>(
pub fn blind<R: TryRng + TryCryptoRng>(
input: &[u8],
blinding_factor_rng: &mut R,
) -> Result<OprfClientBlindResult<CS>> {
@@ -146,8 +146,8 @@ impl<CS: CipherSuite> OprfServer<CS> {
///
/// # Errors
/// [`Error::Protocol`] if the protocol fails and can't be completed.
pub fn new<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = GenericArray::<_, <CS::Group as Group>::ScalarLen>::default();
pub fn new<R: TryRng + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = Array::<_, <CS::Group as Group>::ScalarLen>::default();
rng.try_fill_bytes(&mut seed).map_err(|_| Error::Protocol)?;
Self::new_from_seed(&seed, &[])
}
@@ -267,8 +267,8 @@ fn finalize_after_unblind<
mod tests {
use core::ptr;
use rand::rngs::OsRng;
use rand::TryRngCore;
use rand::rngs::SysRng;
use rand::TryRng;
use super::*;
use crate::common::{Dst, STR_HASH_TO_GROUP};
@@ -280,7 +280,7 @@ mod tests {
info: &[u8],
mode: Mode,
) -> Output<CS::Hash> {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, mode);
let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
let res = point * &key;
@@ -293,7 +293,7 @@ mod tests {
fn base_retrieval<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = OprfServer::<CS>::new(&mut rng).unwrap();
let message = server.blind_evaluate(&client_blind_result.message);
@@ -303,7 +303,7 @@ mod tests {
}
fn base_inversion_unsalted<CS: CipherSuite>() {
let mut rng = OsRng;
let mut rng = SysRng;
let mut input = [0u8; 64];
rng.try_fill_bytes(&mut input).unwrap();
let client_blind_result = OprfClient::<CS>::blind(&input, &mut rng).unwrap();
@@ -312,7 +312,7 @@ mod tests {
.finalize(&input, &EvaluationElement(client_blind_result.message.0))
.unwrap();
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, Mode::Oprf);
let point = CS::Group::hash_to_curve::<CS::Hash>(&[&input], &dst.as_dst()).unwrap();
let res2 = finalize_after_unblind::<CS, _, _>(iter::once((input.as_ref(), point)), &[])
.next()
@@ -324,7 +324,7 @@ mod tests {
fn server_evaluate<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = OprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server.blind_evaluate(&client_blind_result.message);
@@ -348,7 +348,7 @@ mod tests {
fn zeroize_oprf_client<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
let mut state = client_blind_result.state;
@@ -362,7 +362,7 @@ mod tests {
fn zeroize_oprf_server<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = OprfServer::<CS>::new(&mut rng).unwrap();
let mut message = server.blind_evaluate(&client_blind_result.message);
src/poprf.rs
+22 -22
View File
@@ -14,9 +14,9 @@ use core::iter::{self, Map, Repeat, Zip};
use derive_where::derive_where;
use digest::{Digest, Output, OutputSizeUser};
use generic_array::typenum::Unsigned;
use generic_array::{ArrayLength, GenericArray};
use rand_core::{TryCryptoRng, TryRngCore};
use hybrid_array::typenum::Unsigned;
use hybrid_array::{Array, ArraySize};
use rand_core::{TryCryptoRng, TryRng};
use crate::common::{
derive_keypair, deterministic_blind_unchecked, generate_proof, hash_to_group, i2osp_2,
@@ -75,7 +75,7 @@ impl<CS: CipherSuite> PoprfClient<CS> {
///
/// # Errors
/// [`Error::Input`] if the `input` is empty or longer than [`u16::MAX`].
pub fn blind<R: TryRngCore + TryCryptoRng>(
pub fn blind<R: TryRng + TryCryptoRng>(
input: &[u8],
blinding_factor_rng: &mut R,
) -> Result<PoprfClientBlindResult<CS>> {
@@ -134,7 +134,7 @@ impl<CS: CipherSuite> PoprfClient<CS> {
info: Option<&[u8]>,
) -> Result<Output<CS::Hash>>
where
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArraySize,
{
let clients = core::array::from_ref(self);
let messages = core::array::from_ref(evaluation_element);
@@ -170,7 +170,7 @@ impl<CS: CipherSuite> PoprfClient<CS> {
<&'a IC as IntoIterator>::IntoIter: ExactSizeIterator,
&'a IM: 'a + IntoIterator<Item = &'a EvaluationElement<CS>>,
<&'a IM as IntoIterator>::IntoIter: ExactSizeIterator,
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArraySize,
{
let unblinded_elements = poprf_unblind(clients, messages, pk, proof, info)?;
@@ -189,8 +189,8 @@ impl<CS: CipherSuite> PoprfServer<CS> {
///
/// # Errors
/// [`Error::Protocol`] if the protocol fails and can't be completed.
pub fn new<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = GenericArray::<_, <CS::Group as Group>::ScalarLen>::default();
pub fn new<R: TryRng + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = Array::<_, <CS::Group as Group>::ScalarLen>::default();
rng.try_fill_bytes(&mut seed).map_err(|_| Error::Protocol)?;
Self::new_from_seed(&seed, &[])
@@ -235,7 +235,7 @@ impl<CS: CipherSuite> PoprfServer<CS> {
/// # Errors
/// - [`Error::Info`] if the `info` is longer than `u16::MAX`.
/// - [`Error::Protocol`] if the protocol fails and can't be completed.
pub fn blind_evaluate<R: TryRngCore + TryCryptoRng>(
pub fn blind_evaluate<R: TryRng + TryCryptoRng>(
&self,
rng: &mut R,
blinded_element: &BlindedElement<CS>,
@@ -273,7 +273,7 @@ impl<CS: CipherSuite> PoprfServer<CS> {
/// - [`Error::Info`] if the `info` is longer than `u16::MAX`.
/// - [`Error::Protocol`] if the protocol fails and can't be completed.
#[cfg(feature = "alloc")]
pub fn batch_blind_evaluate<'a, R: TryRngCore + TryCryptoRng, IE>(
pub fn batch_blind_evaluate<'a, R: TryRng + TryCryptoRng, IE>(
&self,
rng: &mut R,
blinded_elements: &'a IE,
@@ -346,7 +346,7 @@ impl<CS: CipherSuite> PoprfServer<CS> {
pub fn batch_blind_evaluate_finish<
'a,
'b,
R: TryRngCore + TryCryptoRng,
R: TryRng + TryCryptoRng,
IB: Iterator<Item = &'a BlindedElement<CS>> + ExactSizeIterator,
IE,
>(
@@ -569,7 +569,7 @@ fn compute_tweaked_key<CS: CipherSuite>(
let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
let framed_info = [STR_INFO.as_slice(), &info_len, info];
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
// This can't fail, the size of the `input` is known.
let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
@@ -602,7 +602,7 @@ fn compute_tweak<CS: CipherSuite>(
let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
let framed_info = [STR_INFO.as_slice(), &info_len, info];
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
// This can't fail, the size of the `input` is known.
let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
@@ -692,7 +692,7 @@ fn finalize_after_unblind<
info: Option<&'a [u8]>,
) -> Result<FinalizeAfterUnblindResult<'a, CS, IE, II>>
where
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
<<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArraySize,
{
if unblinded_elements.len() != inputs.len() {
return Err(Error::Batch);
@@ -733,7 +733,7 @@ where
mod tests {
use core::ptr;
use rand::rngs::OsRng;
use rand::rngs::SysRng;
use super::*;
use crate::common::STR_HASH_TO_GROUP;
@@ -747,7 +747,7 @@ mod tests {
) -> Output<CS::Hash> {
let t = compute_tweak::<CS>(key, Some(info)).unwrap();
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, mode);
let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
// evaluatedElement = G.ScalarInverse(t) * blindedElement
@@ -763,7 +763,7 @@ mod tests {
fn verifiable_retrieval<CS: CipherSuite>() {
let input = b"input";
let info = b"info";
let mut rng = OsRng;
let mut rng = SysRng;
let server = PoprfServer::<CS>::new(&mut rng).unwrap();
let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server_result = server
@@ -786,14 +786,14 @@ mod tests {
fn verifiable_bad_public_key<CS: CipherSuite>() {
let input = b"input";
let info = b"info";
let mut rng = OsRng;
let mut rng = SysRng;
let server = PoprfServer::<CS>::new(&mut rng).unwrap();
let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server_result = server
.blind_evaluate(&mut rng, &client_blind_result.message, Some(info))
.unwrap();
let wrong_pk = {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, Mode::Oprf);
// Choose a group element that is unlikely to be the right public key
CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
};
@@ -810,7 +810,7 @@ mod tests {
fn verifiable_server_evaluate<CS: CipherSuite>() {
let input = b"input";
let info = Some(b"info".as_slice());
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = PoprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server
@@ -842,7 +842,7 @@ mod tests {
fn zeroize_verifiable_client<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
let mut state = client_blind_result.state;
@@ -857,7 +857,7 @@ mod tests {
fn zeroize_verifiable_server<CS: CipherSuite>() {
let input = b"input";
let info = b"info";
let mut rng = OsRng;
let mut rng = SysRng;
let server = PoprfServer::<CS>::new(&mut rng).unwrap();
let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server_result = server
src/serialization.rs
+14 -15
View File
@@ -9,9 +9,8 @@
//! Handles the serialization of each of the components used in the VOPRF
//! protocol
use generic_array::sequence::Concat;
use generic_array::typenum::{Sum, Unsigned};
use generic_array::GenericArray;
use hybrid_array::typenum::{Sum, Unsigned};
use hybrid_array::Array;
use crate::{
BlindedElement, CipherSuite, Error, EvaluationElement, Group, OprfClient, OprfServer,
@@ -28,7 +27,7 @@ pub type OprfClientLen<CS> = <<CS as CipherSuite>::Group as Group>::ScalarLen;
impl<CS: CipherSuite> OprfClient<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, OprfClientLen<CS>> {
pub fn serialize(&self) -> Array<u8, OprfClientLen<CS>> {
CS::Group::serialize_scalar(self.blind)
}
@@ -51,7 +50,7 @@ pub type VoprfClientLen<CS> = Sum<
impl<CS: CipherSuite> VoprfClient<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, VoprfClientLen<CS>> {
pub fn serialize(&self) -> Array<u8, VoprfClientLen<CS>> {
<CS::Group as Group>::serialize_scalar(self.blind)
.concat(<CS::Group as Group>::serialize_elem(self.blinded_element))
}
@@ -79,7 +78,7 @@ pub type PoprfClientLen<CS> = Sum<
impl<CS: CipherSuite> PoprfClient<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, PoprfClientLen<CS>> {
pub fn serialize(&self) -> Array<u8, PoprfClientLen<CS>> {
<CS::Group as Group>::serialize_scalar(self.blind)
.concat(<CS::Group as Group>::serialize_elem(self.blinded_element))
}
@@ -104,7 +103,7 @@ pub type OprfServerLen<CS> = <<CS as CipherSuite>::Group as Group>::ScalarLen;
impl<CS: CipherSuite> OprfServer<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, OprfServerLen<CS>> {
pub fn serialize(&self) -> Array<u8, OprfServerLen<CS>> {
CS::Group::serialize_scalar(self.sk)
}
@@ -127,7 +126,7 @@ pub type VoprfServerLen<CS> = Sum<
impl<CS: CipherSuite> VoprfServer<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, VoprfServerLen<CS>> {
pub fn serialize(&self) -> Array<u8, VoprfServerLen<CS>> {
CS::Group::serialize_scalar(self.sk).concat(CS::Group::serialize_elem(self.pk))
}
@@ -151,7 +150,7 @@ pub type PoprfServerLen<CS> = Sum<
impl<CS: CipherSuite> PoprfServer<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, PoprfServerLen<CS>> {
pub fn serialize(&self) -> Array<u8, PoprfServerLen<CS>> {
CS::Group::serialize_scalar(self.sk).concat(CS::Group::serialize_elem(self.pk))
}
@@ -175,7 +174,7 @@ pub type ProofLen<CS> = Sum<
impl<CS: CipherSuite> Proof<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, ProofLen<CS>> {
pub fn serialize(&self) -> Array<u8, ProofLen<CS>> {
CS::Group::serialize_scalar(self.c_scalar)
.concat(CS::Group::serialize_scalar(self.s_scalar))
}
@@ -197,7 +196,7 @@ pub type BlindedElementLen<CS> = <<CS as CipherSuite>::Group as Group>::ElemLen;
impl<CS: CipherSuite> BlindedElement<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, BlindedElementLen<CS>> {
pub fn serialize(&self) -> Array<u8, BlindedElementLen<CS>> {
CS::Group::serialize_elem(self.0)
}
@@ -217,7 +216,7 @@ pub type EvaluationElementLen<CS> = <<CS as CipherSuite>::Group as Group>::ElemL
impl<CS: CipherSuite> EvaluationElement<CS> {
/// Serialization into bytes
pub fn serialize(&self) -> GenericArray<u8, EvaluationElementLen<CS>> {
pub fn serialize(&self) -> Array<u8, EvaluationElementLen<CS>> {
CS::Group::serialize_elem(self.0)
}
@@ -266,7 +265,7 @@ impl<T> SliceExt for [T] {
pub(crate) mod serde {
use core::marker::PhantomData;
use generic_array::GenericArray;
use hybrid_array::Array;
use serde::de::{Deserializer, Error};
use serde::ser::Serializer;
use serde::{Deserialize, Serialize};
@@ -280,7 +279,7 @@ pub(crate) mod serde {
where
D: Deserializer<'de>,
{
GenericArray::<_, G::ElemLen>::deserialize(deserializer)
Array::<_, G::ElemLen>::deserialize(deserializer)
.and_then(|bytes| G::deserialize_elem(&bytes).map_err(D::Error::custom))
}
@@ -299,7 +298,7 @@ pub(crate) mod serde {
where
D: Deserializer<'de>,
{
GenericArray::<_, G::ScalarLen>::deserialize(deserializer)
Array::<_, G::ScalarLen>::deserialize(deserializer)
.and_then(|bytes| G::deserialize_scalar(&bytes).map_err(D::Error::custom))
}
src/tests/mock_rng.rs
+23 -10
View File
@@ -9,7 +9,8 @@
use alloc::vec::Vec;
use core::cmp::min;
use rand_core::{CryptoRng, RngCore};
use core::convert::Infallible;
use rand_core::{TryCryptoRng, TryRng};
/// A simple implementation of `RngCore` for testing purposes.
///
@@ -38,23 +39,35 @@ fn rotate_left<T>(data: &mut [T], steps: usize) {
data.reverse();
}
impl RngCore for CycleRng {
fn next_u32(&mut self) -> u32 {
unimplemented!()
impl TryRng for CycleRng {
type Error = Infallible;
fn try_next_u32(&mut self) -> Result<u32, Self::Error> {
let mut buf = [0u8; 4];
self.try_fill_bytes(&mut buf)?;
Ok(u32::from_le_bytes(buf))
}
#[inline]
fn next_u64(&mut self) -> u64 {
unimplemented!()
fn try_next_u64(&mut self) -> Result<u64, Self::Error> {
let mut buf = [0u8; 8];
self.try_fill_bytes(&mut buf)?;
Ok(u64::from_le_bytes(buf))
}
#[inline]
fn fill_bytes(&mut self, dest: &mut [u8]) {
fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Self::Error> {
let len = min(self.v.len(), dest.len());
dest[..len].copy_from_slice(&self.v[..len]);
rotate_left(&mut self.v, len);
Ok(())
}
}
// This is meant for testing only
impl CryptoRng for CycleRng {}
impl TryCryptoRng for CycleRng {}
src/tests/mod.rs
+18
View File
@@ -10,3 +10,21 @@ mod cfrg_vectors;
mod mock_rng;
mod parser;
mod test_cfrg_vectors;
impl crate::CipherSuite for p256::NistP256 {
const ID: &'static [u8] = <p256::NistP256 as hash2curve::OprfParameters>::ID;
type Group = p256::NistP256;
type Hash = sha2::Sha256;
}
impl crate::CipherSuite for p384::NistP384 {
const ID: &'static [u8] = <p384::NistP384 as hash2curve::OprfParameters>::ID;
type Group = p384::NistP384;
type Hash = sha2::Sha384;
}
impl crate::CipherSuite for p521::NistP521 {
const ID: &'static [u8] = <p521::NistP521 as hash2curve::OprfParameters>::ID;
type Group = p521::NistP521;
type Hash = sha2::Sha512;
}
src/tests/parser.rs
+3 -3
View File
@@ -15,7 +15,7 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
}
fn parse_ciphersuites(input: &str) -> String {
let re = regex::Regex::new(r"\nA\.\d\. (?P<ciphersuite>.+?)\n\n").unwrap();
let re = regex::Regex::new(r"\nA\.\d\. {2}(?P<ciphersuite>.+?)\n\n").unwrap();
let mut ciphersuites = vec![];
let chunks: Vec<&str> = re.split(input).collect();
@@ -34,7 +34,7 @@ fn parse_ciphersuites(input: &str) -> String {
}
fn parse_modes(input: &str) -> String {
let re = regex::Regex::new(r"A\.\d.\d\. (?P<mode>.*?) Mode").unwrap();
let re = regex::Regex::new(r"A\.\d.\d\. {2}(?P<mode>.*?) Mode").unwrap();
let mut modes = vec![];
let chunks: Vec<&str> = re.split(input).collect();
@@ -53,7 +53,7 @@ fn parse_modes(input: &str) -> String {
}
fn parse_vectors(input: &str) -> String {
let re = regex::Regex::new(r"A\.\d.\d\.\d\. Test Vector.*+\n").unwrap();
let re = regex::Regex::new(r"A\.\d.\d\.\d\. {2}Test Vector.*+\n").unwrap();
let mut vectors = vec![];
let chunks: Vec<&str> = re.split(input).collect();
src/tests/test_cfrg_vectors.rs
+3 -4
View File
@@ -360,7 +360,7 @@ fn test_voprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters])
assert_eq!(&parameter, &message.serialize().as_slice());
}
assert_eq!(&parameters.proof, &proof.serialize().as_slice());
assert_eq!(&parameters.proof, &proof.serialize().to_vec());
}
Ok(())
}
@@ -386,8 +386,7 @@ fn test_poprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters])
blinded_elements.iter(),
&prepared_evaluation_elements,
&prepared_tweak,
)
.unwrap();
)?;
let messages: Vec<_> = messages.collect();
@@ -395,7 +394,7 @@ fn test_poprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters])
assert_eq!(&parameter, &message.serialize().as_slice());
}
assert_eq!(&parameters.proof, &proof.serialize().as_slice());
assert_eq!(&parameters.proof, &proof.serialize().to_vec());
}
Ok(())
}
src/voprf.rs
+20 -20
View File
@@ -14,9 +14,9 @@ use core::iter::{self, Map, Repeat, Zip};
use derive_where::derive_where;
use digest::{Digest, Output};
use generic_array::typenum::Unsigned;
use generic_array::GenericArray;
use rand_core::{TryCryptoRng, TryRngCore};
use hybrid_array::typenum::Unsigned;
use hybrid_array::Array;
use rand_core::{TryCryptoRng, TryRng};
use crate::common::{
derive_keypair, deterministic_blind_unchecked, generate_proof, hash_to_group, i2osp_2,
@@ -75,7 +75,7 @@ impl<CS: CipherSuite> VoprfClient<CS> {
///
/// # Errors
/// [`Error::Input`] if the `input` is empty or longer then [`u16::MAX`].
pub fn blind<R: TryRngCore + TryCryptoRng>(
pub fn blind<R: TryRng + TryCryptoRng>(
input: &[u8],
blinding_factor_rng: &mut R,
) -> Result<VoprfClientBlindResult<CS>> {
@@ -196,8 +196,8 @@ impl<CS: CipherSuite> VoprfServer<CS> {
///
/// # Errors
/// [`Error::Protocol`] if the protocol fails and can't be completed.
pub fn new<R: TryRngCore + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = GenericArray::<_, <CS::Group as Group>::ScalarLen>::default();
pub fn new<R: TryRng + TryCryptoRng>(rng: &mut R) -> Result<Self> {
let mut seed = Array::<_, <CS::Group as Group>::ScalarLen>::default();
rng.try_fill_bytes(&mut seed).map_err(|_| Error::Protocol)?;
// This can't fail as the hash output is type constrained.
Self::new_from_seed(&seed, &[])
@@ -238,7 +238,7 @@ impl<CS: CipherSuite> VoprfServer<CS> {
/// Computes the second step for the multiplicative blinding version of
/// DH-OPRF. This message is sent from the server (who holds the OPRF key)
/// to the client.
pub fn blind_evaluate<R: TryRngCore + TryCryptoRng>(
pub fn blind_evaluate<R: TryRng + TryCryptoRng>(
&self,
rng: &mut R,
blinded_element: &BlindedElement<CS>,
@@ -271,7 +271,7 @@ impl<CS: CipherSuite> VoprfServer<CS> {
/// [`Error::Batch`] if the number of `blinded_elements` and
/// `evaluation_elements` don't match or is longer then [`u16::MAX`]
#[cfg(feature = "alloc")]
pub fn batch_blind_evaluate<'a, R: TryRngCore + TryCryptoRng, I>(
pub fn batch_blind_evaluate<'a, R: TryRng + TryCryptoRng, I>(
&self,
rng: &mut R,
blinded_elements: &'a I,
@@ -322,7 +322,7 @@ impl<CS: CipherSuite> VoprfServer<CS> {
pub fn batch_blind_evaluate_finish<
'a,
'b,
R: TryRngCore + TryCryptoRng,
R: TryRng + TryCryptoRng,
IB: Iterator<Item = &'a BlindedElement<CS>> + ExactSizeIterator,
IE,
>(
@@ -550,7 +550,7 @@ mod tests {
use ::alloc::vec;
use ::alloc::vec::Vec;
use rand::rngs::OsRng;
use rand::rngs::SysRng;
use super::*;
use crate::common::{Dst, STR_HASH_TO_GROUP};
@@ -561,7 +561,7 @@ mod tests {
key: <CS::Group as Group>::Scalar,
mode: Mode,
) -> Output<CS::Hash> {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, mode);
let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
let res = point * &key;
@@ -574,7 +574,7 @@ mod tests {
fn verifiable_retrieval<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = VoprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
@@ -592,7 +592,7 @@ mod tests {
}
fn verifiable_batch_retrieval<CS: CipherSuite>() {
let mut rng = OsRng;
let mut rng = SysRng;
let mut inputs = vec![];
let mut client_states = vec![];
let mut client_messages = vec![];
@@ -636,7 +636,7 @@ mod tests {
}
fn verifiable_batch_bad_public_key<CS: CipherSuite>() {
let mut rng = OsRng;
let mut rng = SysRng;
let mut inputs = vec![];
let mut client_states = vec![];
let mut client_messages = vec![];
@@ -662,7 +662,7 @@ mod tests {
.unwrap();
let messages: Vec<_> = messages.collect();
let wrong_pk = {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, Mode::Oprf);
// Choose a group element that is unlikely to be the right public key
CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
};
@@ -673,12 +673,12 @@ mod tests {
fn verifiable_bad_public_key<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = VoprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
let wrong_pk = {
let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
let dst = Dst::new::<CS, _>(STR_HASH_TO_GROUP, Mode::Oprf);
// Choose a group element that is unlikely to be the right public key
CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
};
@@ -693,7 +693,7 @@ mod tests {
fn verifiable_server_evaluate<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = VoprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
@@ -722,7 +722,7 @@ mod tests {
fn zeroize_voprf_client<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
let mut state = client_blind_result.state;
@@ -736,7 +736,7 @@ mod tests {
fn zeroize_voprf_server<CS: CipherSuite>() {
let input = b"input";
let mut rng = OsRng;
let mut rng = SysRng;
let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
let server = VoprfServer::<CS>::new(&mut rng).unwrap();
let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);