diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..da5cca7 --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,87 @@ +name: Rust CI +on: + push: + branches: + - main + pull_request: + types: [opened, repoened, synchronize] + +jobs: + test: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + backend_feature: + - u64_backend + - u32_backend + toolchain: + - stable + - 1.51.0 + name: test + steps: + - name: Checkout sources + uses: actions/checkout@v2 + + - name: Install ${{ matrix.toolchain }} toolchain + uses: actions-rs/toolchain@v1 + with: + profile: minimal + toolchain: ${{ matrix.toolchain }} + override: true + components: rustfmt, clippy + + - name: Run cargo test + uses: actions-rs/cargo@v1 + with: + command: test + args: --no-default-features --features ${{ matrix.backend_feature }} + + - name: Run cargo test with std + uses: actions-rs/cargo@v1 + with: + command: test + args: --no-default-features --features std --features ${{ matrix.backend_feature }} + + clippy: + name: cargo clippy + runs-on: ubuntu-latest + steps: + - name: Checkout sources + uses: actions/checkout@v2 + + - name: Install stable toolchain + uses: actions-rs/toolchain@v1 + with: + profile: minimal + toolchain: stable + override: true + components: rustfmt, clippy + + - name: Run cargo clippy + uses: actions-rs/cargo@v1 + with: + command: clippy + args: -- -D warnings + + + format: + name: cargo fmt + runs-on: ubuntu-latest + steps: + - name: Checkout sources + uses: actions/checkout@v2 + + - name: Install stable toolchain + uses: actions-rs/toolchain@v1 + with: + profile: minimal + toolchain: stable + override: true + components: rustfmt, clippy + + - name: Run cargo fmt + uses: actions-rs/cargo@v1 + with: + command: fmt + args: --all -- --check diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..088ba6b --- /dev/null +++ b/.gitignore @@ -0,0 +1,10 @@ +# Generated by Cargo +# will have compiled files and executables +/target/ + +# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries +# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html +Cargo.lock + +# These are backup files generated by rustfmt +**/*.rs.bk diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..f049d4c --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,76 @@ +# Code of Conduct + +## Our Pledge + +In the interest of fostering an open and welcoming environment, we as +contributors and maintainers pledge to make participation in our project and +our community a harassment-free experience for everyone, regardless of age, body +size, disability, ethnicity, sex characteristics, gender identity and expression, +level of experience, education, socio-economic status, nationality, personal +appearance, race, religion, or sexual identity and orientation. + +## Our Standards + +Examples of behavior that contributes to creating a positive environment +include: + +* Using welcoming and inclusive language +* Being respectful of differing viewpoints and experiences +* Gracefully accepting constructive criticism +* Focusing on what is best for the community +* Showing empathy towards other community members + +Examples of unacceptable behavior by participants include: + +* The use of sexualized language or imagery and unwelcome sexual attention or + advances +* Trolling, insulting/derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or electronic + address, without explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Our Responsibilities + +Project maintainers are responsible for clarifying the standards of acceptable +behavior and are expected to take appropriate and fair corrective action in +response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or +reject comments, commits, code, wiki edits, issues, and other contributions +that are not aligned to this Code of Conduct, or to ban temporarily or +permanently any contributor for other behaviors that they deem inappropriate, +threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies within all project spaces, and it also applies when +an individual is representing the project or its community in public spaces. +Examples of representing a project or community include using an official +project e-mail address, posting via an official social media account, or acting +as an appointed representative at an online or offline event. Representation of +a project may be further defined and clarified by project maintainers. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported by contacting the project team at . All +complaints will be reviewed and investigated and will result in a response that +is deemed necessary and appropriate to the circumstances. The project team is +obligated to maintain confidentiality with regard to the reporter of an incident. +Further details of specific enforcement policies may be posted separately. + +Project maintainers who do not follow or enforce the Code of Conduct in good +faith may face temporary or permanent repercussions as determined by other +members of the project's leadership. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, +available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see +https://www.contributor-covenant.org/faq diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..f4043ae --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,30 @@ +# Contributing to this library +We want to make contributing to this project as easy and transparent as +possible. + +## Pull Requests +We actively welcome your pull requests. + +1. Fork the repo and create your branch from `main`. +2. If you've added code that should be tested, add tests. +3. If you've changed APIs, update the documentation. +4. Ensure the test suite passes. +5. If you haven't already, complete the Contributor License Agreement ("CLA"). + +## Contributor License Agreement ("CLA") +In order to accept your pull request, we need you to submit a CLA. You only need +to do this once to work on any of Facebook's open source projects. + +Complete your CLA here: + +## Issues +We use GitHub issues to track public bugs. Please ensure your description is +clear and has sufficient instructions to be able to reproduce the issue. + +Facebook has a [bounty program](https://www.facebook.com/whitehat/) for the safe +disclosure of security bugs. In those cases, please go through the process +outlined on that page and do not file a public issue. + +## License +By contributing to opaque-ke, you agree that your contributions will be +licensed under the LICENSE file in the root directory of this source tree. diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..4e1553f --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,39 @@ +[package] +name = "voprf" +version = "0.0.0" +description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)" +authors = ["Kevin Lewi "] +license = "MIT" +edition = "2018" +readme = "README.md" + +[features] +default = ["u64_backend"] +u64_backend = ["curve25519-dalek/u64_backend"] +u32_backend = ["curve25519-dalek/u32_backend"] +std = ["curve25519-dalek/std", "getrandom", "rand/std", "rand/std_rng"] + +[dependencies] +constant_time_eq = "0.1" +curve25519-dalek = { version = "3", default-features = false } +digest = "0.9" +displaydoc = { version = "0.2", default-features = false } +generic-array = "0.14" +getrandom = { version = "0.2", optional = true } +hkdf = "0.11" +hmac = "0.11" +rand = { version = "0.8", default-features = false } +subtle = { version = "2.3", default-features = false } +zeroize = { version = "1", features = ["zeroize_derive"] } + +[dev-dependencies] +base64 = "0.13" +bincode = "1" +chacha20poly1305 = "0.8" +criterion = "0.3" +hex = "0.4" +lazy_static = "1" +serde_json = "1" +sha2 = "0.9" +proptest = "1" +rustyline = "8" diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..09250ca --- /dev/null +++ b/LICENSE @@ -0,0 +1,12 @@ +## License + +Licensed under either of + * Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0) + * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT) +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall +be dual licensed as above, without any additional terms or conditions. diff --git a/LICENSE-APACHE b/LICENSE-APACHE new file mode 100644 index 0000000..16fe87b --- /dev/null +++ b/LICENSE-APACHE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/LICENSE-MIT b/LICENSE-MIT new file mode 100644 index 0000000..31aa793 --- /dev/null +++ b/LICENSE-MIT @@ -0,0 +1,23 @@ +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md index 279b7cb..5b0505a 100644 --- a/README.md +++ b/README.md @@ -1 +1,7 @@ -# voprf +# voprf ![Build Status](https://github.com/novifinancial/voprf/workflows/Rust%20CI/badge.svg) +An implementation of a (verifiable) oblivious pseudorandom function (VOPRF) + +License +------- + +This project is [licensed](./LICENSE) under either Apache 2.0 or MIT, at your option. diff --git a/src/ciphersuite.rs b/src/ciphersuite.rs new file mode 100644 index 0000000..c96e166 --- /dev/null +++ b/src/ciphersuite.rs @@ -0,0 +1,17 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +//! Defines the CipherSuite trait to specify the underlying primitives for VOPRF + +use crate::{group::Group, hash::Hash}; + +/// Configures the underlying primitives used in VOPRF +pub trait CipherSuite { + /// A finite cyclic group along with a point representation that allows some + /// customization on how to hash an input to a curve point. See `group::Group`. + type Group: Group; + /// The main hash function to use (for HKDF computations and hashing transcripts). + type Hash: Hash; +} diff --git a/src/errors.rs b/src/errors.rs new file mode 100644 index 0000000..36cfc27 --- /dev/null +++ b/src/errors.rs @@ -0,0 +1,57 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +//! A list of error types which are produced during an execution of the protocol +use core::fmt::Debug; +#[cfg(feature = "std")] +use std::error::Error; + +use displaydoc::Display; + +/// Represents an error in the manipulation of internal cryptographic data +#[derive(Clone, Display, Eq, Hash, PartialEq)] +pub enum InternalError { + /// Could not parse byte sequence for key + InvalidByteSequence, + /// Invalid length for {name}: expected {len}, but is actually {actual_len}. + SizeError { + /// name + name: &'static str, + /// length + len: usize, + /// actual + actual_len: usize, + }, + /// Could not decompress point. + PointError, + /// Computing the hash-to-curve function failed + HashToCurveError, + /// Failure to serialize or deserialize bytes + SerializationError, +} + +impl Debug for InternalError { + fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result { + match self { + Self::InvalidByteSequence => f.debug_tuple("InvalidByteSequence").finish(), + Self::SizeError { + name, + len, + actual_len, + } => f + .debug_struct("SizeError") + .field("name", name) + .field("len", len) + .field("actual_len", actual_len) + .finish(), + Self::PointError => f.debug_tuple("PointError").finish(), + Self::HashToCurveError => f.debug_tuple("HashToCurveError").finish(), + Self::SerializationError => f.debug_tuple("SerializationError").finish(), + } + } +} + +#[cfg(feature = "std")] +impl Error for InternalError {} diff --git a/src/group/expand.rs b/src/group/expand.rs new file mode 100644 index 0000000..3100dc7 --- /dev/null +++ b/src/group/expand.rs @@ -0,0 +1,190 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use crate::errors::InternalError; +use crate::hash::Hash; +use crate::serialization::i2osp; +use alloc::vec::Vec; +use digest::{BlockInput, Digest}; +use generic_array::typenum::Unsigned; + +// Computes ceil(x / y) +fn div_ceil(x: usize, y: usize) -> usize { + let additive = (x % y != 0) as usize; + x / y + additive +} + +fn xor(x: &[u8], y: &[u8]) -> Result, InternalError> { + if x.len() != y.len() { + return Err(InternalError::HashToCurveError); + } + + Ok(x.iter().zip(y).map(|(&x1, &x2)| x1 ^ x2).collect()) +} + +/// Corresponds to the expand_message_xmd() function defined in +/// +pub fn expand_message_xmd( + msg: &[u8], + dst: &[u8], + len_in_bytes: usize, +) -> Result, InternalError> { + let b_in_bytes = ::OutputSize::USIZE; + let r_in_bytes = ::BlockSize::USIZE; + + let ell = div_ceil(len_in_bytes, b_in_bytes); + if ell > 255 { + return Err(InternalError::HashToCurveError); + } + let dst_prime = [dst, &i2osp(dst.len(), 1)?].concat(); + let z_pad = i2osp(0, r_in_bytes)?; + let l_i_b_str = i2osp(len_in_bytes, 2)?; + let msg_prime = [&z_pad, msg, &l_i_b_str, &i2osp(0, 1)?, &dst_prime].concat(); + + let mut b: Vec> = alloc::vec![H::digest(&msg_prime).to_vec()]; // b[0] + + let mut h = H::new(); + h.update(&b[0]); + h.update(&i2osp(1, 1)?); + h.update(&dst_prime); + b.push(h.finalize_reset().to_vec()); // b[1] + + let mut uniform_bytes: Vec = Vec::new(); + uniform_bytes.extend_from_slice(&b[1]); + + for i in 2..(ell + 1) { + h.update(xor(&b[0], &b[i - 1])?); + h.update(&i2osp(i, 1)?); + h.update(&dst_prime); + b.push(h.finalize_reset().to_vec()); // b[i] + uniform_bytes.extend_from_slice(&b[i]); + } + + Ok(uniform_bytes[..len_in_bytes].to_vec()) +} + +#[cfg(test)] +mod tests { + + struct Params { + msg: &'static str, + len_in_bytes: usize, + uniform_bytes: &'static str, + } + + #[test] + fn test_expand_message_xmd() { + // Test vectors taken from Section K.1 of https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt + let test_vectors: alloc::vec::Vec = alloc::vec![ + Params { + msg: "", + len_in_bytes: 0x20, + uniform_bytes: "f659819a6473c1835b25ea59e3d38914c98b374f0970b7e4c\ + 92181df928fca88", + }, + Params { + msg: "abc", + len_in_bytes: 0x20, + uniform_bytes: "1c38f7c211ef233367b2420d04798fa4698080a8901021a79\ + 5a1151775fe4da7", + }, + Params { + msg: "abcdef0123456789", + len_in_bytes: 0x20, + uniform_bytes: "8f7e7b66791f0da0dbb5ec7c22ec637f79758c0a48170bfb7c4611bd304ece89", + }, + Params { + msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqq", + len_in_bytes: 0x20, + uniform_bytes: "72d5aa5ec810370d1f0013c0df2f1d65699494ee2a39f72e\ + 1716b1b964e1c642", + }, + Params { + msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + len_in_bytes: 0x20, + uniform_bytes: "3b8e704fc48336aca4c2a12195b720882f2162a4b7b13a9c\ + 350db46f429b771b", + }, + Params { + msg: "", + len_in_bytes: 0x80, + uniform_bytes: "8bcffd1a3cae24cf9cd7ab85628fd111bb17e3739d3b53f8\ + 9580d217aa79526f1708354a76a402d3569d6a9d19ef3de4d0b991\ + e4f54b9f20dcde9b95a66824cbdf6c1a963a1913d43fd7ac443a02\ + fc5d9d8d77e2071b86ab114a9f34150954a7531da568a1ea8c7608\ + 61c0cde2005afc2c114042ee7b5848f5303f0611cf297f", + }, + Params { + msg: "abc", + len_in_bytes: 0x80, + uniform_bytes: "fe994ec51bdaa821598047b3121c149b364b178606d5e72b\ + fbb713933acc29c186f316baecf7ea22212f2496ef3f785a27e84a\ + 40d8b299cec56032763eceeff4c61bd1fe65ed81decafff4a31d01\ + 98619c0aa0c6c51fca15520789925e813dcfd318b542f879944127\ + 1f4db9ee3b8092a7a2e8d5b75b73e28fb1ab6b4573c192", + }, + Params { + msg: "abcdef0123456789", + len_in_bytes: 0x80, + uniform_bytes: "c9ec7941811b1e19ce98e21db28d22259354d4d0643e3011\ + 75e2f474e030d32694e9dd5520dde93f3600d8edad94e5c3649030\ + 88a7228cc9eff685d7eaac50d5a5a8229d083b51de4ccc3733917f\ + 4b9535a819b445814890b7029b5de805bf62b33a4dc7e24acdf2c9\ + 24e9fe50d55a6b832c8c84c7f82474b34e48c6d43867be", + }, + Params { + msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqq", + len_in_bytes: 0x80, + uniform_bytes: "48e256ddba722053ba462b2b93351fc966026e6d6db49318\ + 9798181c5f3feea377b5a6f1d8368d7453faef715f9aecb078cd40\ + 2cbd548c0e179c4ed1e4c7e5b048e0a39d31817b5b24f50db58bb3\ + 720fe96ba53db947842120a068816ac05c159bb5266c63658b4f00\ + 0cbf87b1209a225def8ef1dca917bcda79a1e42acd8069", + }, + Params { + msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + len_in_bytes: 0x80, + uniform_bytes: "396962db47f749ec3b5042ce2452b619607f27fd3939ece2\ + 746a7614fb83a1d097f554df3927b084e55de92c7871430d6b95c2\ + a13896d8a33bc48587b1f66d21b128a1a8240d5b0c26dfe795a1a8\ + 42a0807bb148b77c2ef82ed4b6c9f7fcb732e7f94466c8b51e52bf\ + 378fba044a31f5cb44583a892f5969dcd73b3fa128816e", + }, + ]; + let dst = "QUUX-V01-CS02-with-expander"; + + for tv in test_vectors { + let uniform_bytes = super::expand_message_xmd::( + tv.msg.as_bytes(), + dst.as_bytes(), + tv.len_in_bytes, + ) + .unwrap(); + assert_eq!(tv.uniform_bytes, hex::encode(uniform_bytes)); + } + } +} diff --git a/src/group/mod.rs b/src/group/mod.rs new file mode 100644 index 0000000..f3a7757 --- /dev/null +++ b/src/group/mod.rs @@ -0,0 +1,78 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +//! Defines the Group trait to specify the underlying prime order group used in +//! OPAQUE's OPRF + +mod expand; +#[cfg(feature = "p256")] +pub(crate) mod p256; +mod ristretto; +mod x25519; + +use crate::errors::InternalError; +use crate::hash::Hash; +use core::ops::Mul; +use generic_array::{ArrayLength, GenericArray}; +use rand::{CryptoRng, RngCore}; +use zeroize::Zeroize; + +/// A prime-order subgroup of a base field (EC, prime-order field ...). This +/// subgroup is noted additively — as in the draft RFC — in this trait. +pub trait Group: Copy + Sized + for<'a> Mul<&'a ::Scalar, Output = Self> { + /// The ciphersuite identifier as dictated by + /// + const SUITE_ID: usize; + + /// transforms a password and domain separation tag (DST) into a curve point + fn map_to_curve(msg: &[u8], dst: &[u8]) -> Result; + + /// Hashes a slice of pseudo-random bytes to a scalar + fn hash_to_scalar(input: &[u8], dst: &[u8]) -> Result; + + /// Generates the contextString parameter as defined in + /// + fn get_context_string(mode: u8) -> Result, InternalError> { + use crate::serialization::i2osp; + + Ok([i2osp(mode as usize, 1)?, i2osp(Self::SUITE_ID, 2)?].concat()) + } + + /// The type of base field scalars + type Scalar: Zeroize + Copy; + /// The byte length necessary to represent scalars + type ScalarLen: ArrayLength + 'static; + /// Return a scalar from its fixed-length bytes representation + fn from_scalar_slice( + scalar_bits: &GenericArray, + ) -> Result; + /// picks a scalar at random + fn random_nonzero_scalar(rng: &mut R) -> Self::Scalar; + /// Serializes a scalar to bytes + fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray; + /// The multiplicative inverse of this scalar + fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar; + + /// The byte length necessary to represent group elements + type ElemLen: ArrayLength + 'static; + /// Return an element from its fixed-length bytes representation + fn from_element_slice( + element_bits: &GenericArray, + ) -> Result; + /// Serializes the `self` group element + fn to_arr(&self) -> GenericArray; + + /// Get the base point for the group + fn base_point() -> Self; + + /// Multiply the point by a scalar, represented as a slice + fn mult_by_slice(&self, scalar: &GenericArray) -> Self; + + /// Returns if the group element is equal to the identity (1) + fn is_identity(&self) -> bool; + + /// Compares in constant time if the group elements are equal + fn ct_equal(&self, other: &Self) -> bool; +} diff --git a/src/group/p256.rs b/src/group/p256.rs new file mode 100644 index 0000000..7399d16 --- /dev/null +++ b/src/group/p256.rs @@ -0,0 +1,537 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +#![allow( + clippy::borrow_interior_mutable_const, + clippy::declare_interior_mutable_const +)] + +use super::Group; +use crate::errors::{InternalError, ProtocolError}; +use crate::hash::Hash; +use core::ops::{Add, Div, Mul, Neg, Sub}; +use core::str::FromStr; +use generic_array::typenum::{U32, U33}; +use generic_array::{ArrayLength, GenericArray}; +use num_bigint::{BigInt, Sign}; +use num_integer::Integer; +use num_traits::{One, ToPrimitive}; +use once_cell::unsync::Lazy; +use p256_::elliptic_curve::group::prime::PrimeCurveAffine; +use p256_::elliptic_curve::group::GroupEncoding; +use p256_::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint}; +use p256_::elliptic_curve::subtle::ConstantTimeEq; +use p256_::elliptic_curve::Field; +use p256_::{AffinePoint, EncodedPoint, ProjectivePoint}; +use rand::{CryptoRng, RngCore}; + +// `L: 48` +pub const L: usize = 48; + +impl Group for ProjectivePoint { + const SUITE_ID: usize = 0x0003; + + // Implements the `hash_to_curve()` function from + // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3 + fn map_to_curve(msg: &[u8], dst: &[u8]) -> Result { + // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-8.2 + // `p: 2^256 - 2^224 + 2^192 + 2^96 - 1` + const P: Lazy = Lazy::new(|| { + BigInt::from_str( + "115792089210356248762697446949407573530086143415290314195533631308867097853951", + ) + .unwrap() + }); + // `A: -3` + const A: Lazy = Lazy::new(|| BigInt::from(-3)); + // `B: 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b` + const B: Lazy = Lazy::new(|| { + BigInt::parse_bytes( + b"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", + 16, + ) + .unwrap() + }); + // `Z: -10` + const Z: Lazy = Lazy::new(|| BigInt::from(-10)); + + // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3 + // `hash_to_curve` calls `hash_to_field` with a `count` of `2` + // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3 + // `hash_to_field` calls `expand_message` with a `len_in_bytes` of `count * L` + let uniform_bytes = super::expand::expand_message_xmd::(msg, dst, 2 * L)?; + + // map to curve + let (q0x, q0y) = map_to_curve_simple_swu(&uniform_bytes[..L], &A, &B, &P, &Z); + let (q1x, q1y) = map_to_curve_simple_swu(&uniform_bytes[L..], &A, &B, &P, &Z); + + // convert to `p256` types + let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates( + &q0x, &q0y, false, + )) + .ok_or(InternalError::PointError)? + .to_curve(); + let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates( + &q1x, &q1y, false, + )) + .ok_or(InternalError::PointError)?; + + Ok(p0 + p1) + } + + // Implements the `HashToScalar()` function from + // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.3 + fn hash_to_scalar(input: &[u8], dst: &[u8]) -> Result { + // https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#[{%22num%22:211,%22gen%22:0},{%22name%22:%22XYZ%22},70,700,0] + // P-256 `n` is defined as `115792089210356248762697446949407573529996955224135760342 422259061068512044369` + const N: once_cell::unsync::Lazy = once_cell::unsync::Lazy::new(|| { + BigInt::from_str( + "115792089210356248762697446949407573529996955224135760342422259061068512044369", + ) + .unwrap() + }); + + // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3 + // `HashToScalar` is `hash_to_field` + let uniform_bytes = super::expand::expand_message_xmd::(input, dst, L)?; + let mut bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes) + .mod_floor(&N) + .to_bytes_be() + .1; + bytes.resize(32, 0); + + Ok(p256_::Scalar::from_bytes_reduced(GenericArray::from_slice( + &bytes, + ))) + } + + type ElemLen = U33; + type Scalar = p256_::Scalar; + type ScalarLen = U32; + + fn from_scalar_slice( + scalar_bits: &GenericArray, + ) -> Result { + Ok(Self::Scalar::from_bytes_reduced(scalar_bits)) + } + + fn random_nonzero_scalar(rng: &mut R) -> Self::Scalar { + Self::Scalar::random(rng) + } + + fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray { + scalar.into() + } + + fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar { + scalar.invert().unwrap_or(Self::Scalar::zero()) + } + + fn from_element_slice( + element_bits: &GenericArray, + ) -> Result { + Option::from(Self::from_bytes(element_bits)).ok_or(InternalError::PointError) + } + + fn to_arr(&self) -> GenericArray { + let mut bytes = self.to_affine().to_encoded_point(true).as_bytes().to_vec(); + bytes.resize(33, 0); + *GenericArray::from_slice(&bytes) + } + + fn base_point() -> Self { + Self::generator() + } + + fn mult_by_slice(&self, scalar: &GenericArray) -> Self { + self * &Self::Scalar::from_bytes_reduced(scalar) + } + + fn is_identity(&self) -> bool { + self == &Self::identity() + } + fn ct_equal(&self, other: &Self) -> bool { + self.ct_eq(other).into() + } +} + +/// Corresponds to the map_to_curve_simple_swu() function defined in +/// +#[allow(clippy::many_single_char_names)] +fn map_to_curve_simple_swu>( + u: &[u8], + a: &BigInt, + b: &BigInt, + p: &BigInt, + z: &BigInt, +) -> (GenericArray, GenericArray) { + #[derive(Clone)] + struct Field<'a>(&'a BigInt); + + impl<'a> Field<'a> { + fn new(p: &'a BigInt) -> Self { + Self(p) + } + + fn element(&'a self, number: &BigInt) -> FieldElement<'a> { + FieldElement { + number: number.mod_floor(self.0), + f: self, + } + } + + fn one(&'a self) -> FieldElement<'a> { + self.element(&BigInt::one()) + } + + /// See + fn inv0(&'a self, number: &FieldElement<'a>) -> FieldElement<'a> { + number.pow_internal(&(self.0 - 2)) + } + } + + /// Finite field arithmetic + #[derive(Clone)] + struct FieldElement<'a> { + number: BigInt, + f: &'a Field<'a>, + } + + impl<'a> Add for FieldElement<'a> { + type Output = FieldElement<'a>; + + fn add(self, rhs: Self) -> Self::Output { + &self + &rhs + } + } + + impl<'a> Add for &FieldElement<'a> { + type Output = FieldElement<'a>; + + fn add(self, rhs: Self) -> Self::Output { + self.f.element(&(&self.number + &rhs.number)) + } + } + + impl<'a> Sub for &FieldElement<'a> { + type Output = FieldElement<'a>; + + fn sub(self, rhs: Self) -> Self::Output { + self.f.element(&(&self.number - &rhs.number)) + } + } + + impl<'a> Neg for FieldElement<'a> { + type Output = FieldElement<'a>; + + fn neg(self) -> Self::Output { + -&self + } + } + + impl<'a> Neg for &FieldElement<'a> { + type Output = FieldElement<'a>; + + fn neg(self) -> Self::Output { + self.f.element(&-&self.number) + } + } + + impl<'a> Mul for FieldElement<'a> { + type Output = FieldElement<'a>; + + fn mul(self, rhs: Self) -> Self::Output { + &self * &rhs + } + } + + impl<'a> Mul<&Self> for FieldElement<'a> { + type Output = FieldElement<'a>; + + fn mul(self, rhs: &Self) -> Self::Output { + &self * rhs + } + } + + impl<'a> Mul> for &FieldElement<'a> { + type Output = FieldElement<'a>; + + fn mul(self, rhs: FieldElement<'a>) -> Self::Output { + self * &rhs + } + } + + impl<'a> Mul for &FieldElement<'a> { + type Output = FieldElement<'a>; + + fn mul(self, rhs: Self) -> Self::Output { + self.f.element(&(&self.number * &rhs.number)) + } + } + + impl<'a> Div<&Self> for FieldElement<'a> { + type Output = FieldElement<'a>; + + #[allow(clippy::suspicious_arithmetic_impl)] + fn div(self, rhs: &Self) -> Self::Output { + self * rhs.f.inv0(rhs) + } + } + + impl<'a> FieldElement<'a> { + fn square(&self) -> Self { + self * self + } + + fn pow_internal(&self, exponent: &BigInt) -> Self { + let exponent = exponent.mod_floor(&(self.f.0 - 1)); + self.f.element(&self.number.modpow(&exponent, self.f.0)) + } + + /// Corresponds to the sqrt_3mod4() function defined in + /// + fn sqrt(&self) -> Self { + // constant + let c1 = (self.f.0 + 1) >> 2; + + self.pow_internal(&c1) + } + + /// Corresponds to the sgn0_m_eq_1() function defined in + /// + fn sgn0(&self) -> i32 { + (&self.number % 2_usize).to_i32().unwrap() + } + + fn is_zero(&self) -> bool { + self.number.is_one() + } + + /// Corresponds to the is_square() function defined in + /// + fn is_square(&self) -> bool { + // constant + let exponent = (self.f.0 - 1) >> 1; + + let result = self.pow_internal(&exponent); + result.number.is_one() || result.is_zero() + } + + fn to_bytes>(&self) -> GenericArray { + GenericArray::clone_from_slice(&self.number.mod_floor(self.f.0).to_bytes_be().1) + } + } + + fn cmov<'a>(x: &FieldElement<'a>, y: &FieldElement<'a>, b: bool) -> FieldElement<'a> { + if b { + y.clone() + } else { + x.clone() + } + } + + let f = Field::new(p); + let a = f.element(a); + let b = f.element(b); + let z = f.element(z); + let u = f.element(&BigInt::from_bytes_be(Sign::Plus, u)); + + // Constants: + // 1. c1 = -B / A + let c1 = -&b / &a; + // 2. c2 = -1 / Z + let c2 = -f.one() / &z; + + // Steps: + // 1. tv1 = Z * u^2 + let tv1 = z * u.square(); + // 2. tv2 = tv1^2 + let mut tv2 = tv1.square(); + // 3. x1 = tv1 + tv2 + let mut x1 = &tv1 + &tv2; + // 4. x1 = inv0(x1) + x1 = f.inv0(&x1); + // 5. e1 = x1 == 0 + let e1 = x1.is_zero(); + // 6. x1 = x1 + 1 + x1 = x1 + f.one(); + // 7. x1 = CMOV(x1, c2, e1) # If (tv1 + tv2) == 0, set x1 = -1 / Z + x1 = cmov(&x1, &c2, e1); + // 8. x1 = x1 * c1 # x1 = (-B / A) * (1 + (1 / (Z^2 * u^4 + Z * u^2))) + x1 = x1 * c1; + // 9. gx1 = x1^2 + let mut gx1 = x1.square(); + // 10. gx1 = gx1 + A + gx1 = gx1 + a; + // 11. gx1 = gx1 * x1 + gx1 = gx1 * &x1; + // 12. gx1 = gx1 + B # gx1 = g(x1) = x1^3 + A * x1 + B + gx1 = gx1 + b; + // 13. x2 = tv1 * x1 # x2 = Z * u^2 * x1 + let x2 = &tv1 * &x1; + // 14. tv2 = tv1 * tv2 + tv2 = tv1 * tv2; + // 15. gx2 = gx1 * tv2 # gx2 = (Z * u^2)^3 * gx1 + let gx2 = &gx1 * tv2; + // 16. e2 = is_square(gx1) + let e2 = gx1.is_square(); + // 17. x = CMOV(x2, x1, e2) # If is_square(gx1), x = x1, else x = x2 + let x = cmov(&x2, &x1, e2); + // 18. y2 = CMOV(gx2, gx1, e2) # If is_square(gx1), y2 = gx1, else y2 = gx2 + let y2 = cmov(&gx2, &gx1, e2); + // 19. y = sqrt(y2) + let mut y = y2.sqrt(); + // 20. e3 = sgn0(u) == sgn0(y) # Fix sign of y + let e3 = u.sgn0() == y.sgn0(); + // 21. y = CMOV(-y, y, e3) + y = cmov(&-&y, &y, e3); + // 22. return (x, y) + (x.to_bytes(), y.to_bytes()) +} + +#[cfg(test)] +mod tests { + use super::*; + + struct Params { + msg: &'static str, + px: &'static str, + py: &'static str, + u0: &'static str, + u1: &'static str, + q0x: &'static str, + q0y: &'static str, + q1x: &'static str, + q1y: &'static str, + } + + #[test] + fn map_to_curve_simple_swu() { + const P: Lazy = Lazy::new(|| { + BigInt::from_str( + "115792089210356248762697446949407573530086143415290314195533631308867097853951", + ) + .unwrap() + }); + const A: Lazy = Lazy::new(|| BigInt::from(-3)); + const B: Lazy = Lazy::new(|| { + BigInt::parse_bytes( + b"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", + 16, + ) + .unwrap() + }); + const Z: Lazy = Lazy::new(|| BigInt::from(-10)); + + // Test vectors taken from https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-J.1.1 + let test_vectors = alloc::vec![ + Params { + msg: "", + px: "2c15230b26dbc6fc9a37051158c95b79656e17a1a920b11394ca91c44247d3e4", + py: "8a7a74985cc5c776cdfe4b1f19884970453912e9d31528c060be9ab5c43e8415", + u0: "ad5342c66a6dd0ff080df1da0ea1c04b96e0330dd89406465eeba11582515009", + u1: "8c0f1d43204bd6f6ea70ae8013070a1518b43873bcd850aafa0a9e220e2eea5a", + q0x: "ab640a12220d3ff283510ff3f4b1953d09fad35795140b1c5d64f313967934d5", + q0y: "dccb558863804a881d4fff3455716c836cef230e5209594ddd33d85c565b19b1", + q1x: "51cce63c50d972a6e51c61334f0f4875c9ac1cd2d3238412f84e31da7d980ef5", + q1y: "b45d1a36d00ad90e5ec7840a60a4de411917fbe7c82c3949a6e699e5a1b66aac", + }, + Params { + msg: "abc", + px: "0bb8b87485551aa43ed54f009230450b492fead5f1cc91658775dac4a3388a0f", + py: "5c41b3d0731a27a7b14bc0bf0ccded2d8751f83493404c84a88e71ffd424212e", + u0: "afe47f2ea2b10465cc26ac403194dfb68b7f5ee865cda61e9f3e07a537220af1", + u1: "379a27833b0bfe6f7bdca08e1e83c760bf9a338ab335542704edcd69ce9e46e0", + q0x: "5219ad0ddef3cc49b714145e91b2f7de6ce0a7a7dc7406c7726c7e373c58cb48", + q0y: "7950144e52d30acbec7b624c203b1996c99617d0b61c2442354301b191d93ecf", + q1x: "019b7cb4efcfeaf39f738fe638e31d375ad6837f58a852d032ff60c69ee3875f", + q1y: "589a62d2b22357fed5449bc38065b760095ebe6aeac84b01156ee4252715446e", + }, + Params { + msg: "abcdef0123456789", + px: "65038ac8f2b1def042a5df0b33b1f4eca6bff7cb0f9c6c1526811864e544ed80", + py: "cad44d40a656e7aff4002a8de287abc8ae0482b5ae825822bb870d6df9b56ca3", + u0: "0fad9d125a9477d55cf9357105b0eb3a5c4259809bf87180aa01d651f53d312c", + u1: "b68597377392cd3419d8fcc7d7660948c8403b19ea78bbca4b133c9d2196c0fb", + q0x: "a17bdf2965eb88074bc01157e644ed409dac97cfcf0c61c998ed0fa45e79e4a2", + q0y: "4f1bc80c70d411a3cc1d67aeae6e726f0f311639fee560c7f5a664554e3c9c2e", + q1x: "7da48bb67225c1a17d452c983798113f47e438e4202219dd0715f8419b274d66", + q1y: "b765696b2913e36db3016c47edb99e24b1da30e761a8a3215dc0ec4d8f96e6f9", + }, + Params { + msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\ + qqqqqqqqqqqqqqqqqqqqqqqqq", + px: "4be61ee205094282ba8a2042bcb48d88dfbb609301c49aa8b078533dc65a0b5d", + py: "98f8df449a072c4721d241a3b1236d3caccba603f916ca680f4539d2bfb3c29e", + u0: "3bbc30446f39a7befad080f4d5f32ed116b9534626993d2cc5033f6f8d805919", + u1: "76bb02db019ca9d3c1e02f0c17f8baf617bbdae5c393a81d9ce11e3be1bf1d33", + q0x: "c76aaa823aeadeb3f356909cb08f97eee46ecb157c1f56699b5efebddf0e6398", + q0y: "776a6f45f528a0e8d289a4be12c4fab80762386ec644abf2bffb9b627e4352b1", + q1x: "418ac3d85a5ccc4ea8dec14f750a3a9ec8b85176c95a7022f391826794eb5a75", + q1y: "fd6604f69e9d9d2b74b072d14ea13050db72c932815523305cb9e807cc900aff", + }, + Params { + msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + px: "457ae2981f70ca85d8e24c308b14db22f3e3862c5ea0f652ca38b5e49cd64bc5", + py: "ecb9f0eadc9aeed232dabc53235368c1394c78de05dd96893eefa62b0f4757dc", + u0: "4ebc95a6e839b1ae3c63b847798e85cb3c12d3817ec6ebc10af6ee51adb29fec", + u1: "4e21af88e22ea80156aff790750121035b3eefaa96b425a8716e0d20b4e269ee", + q0x: "d88b989ee9d1295df413d4456c5c850b8b2fb0f5402cc5c4c7e815412e926db8", + q0y: "bb4a1edeff506cf16def96afff41b16fc74f6dbd55c2210e5b8f011ba32f4f40", + q1x: "a281e34e628f3a4d2a53fa87ff973537d68ad4fbc28d3be5e8d9f6a2571c5a4b", + q1y: "f6ed88a7aab56a488100e6f1174fa9810b47db13e86be999644922961206e184", + }, + ]; + let dst = "QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_"; + + for tv in test_vectors { + let uniform_bytes = super::super::expand::expand_message_xmd::( + tv.msg.as_bytes(), + dst.as_bytes(), + 96, + ) + .unwrap(); + + let u0 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[..48]).mod_floor(&P); + let u1 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[48..]).mod_floor(&P); + + assert_eq!(BigInt::parse_bytes(tv.u0.as_bytes(), 16).unwrap(), u0); + assert_eq!(BigInt::parse_bytes(tv.u1.as_bytes(), 16).unwrap(), u1); + + let (q0x, q0y) = super::map_to_curve_simple_swu(&u0.to_bytes_be().1, &A, &B, &P, &Z); + let (q1x, q1y) = super::map_to_curve_simple_swu(&u1.to_bytes_be().1, &A, &B, &P, &Z); + + assert_eq!(tv.q0x, hex::encode(q0x)); + assert_eq!(tv.q0y, hex::encode(q0y)); + assert_eq!(tv.q1x, hex::encode(q1x)); + assert_eq!(tv.q1y, hex::encode(q1y)); + + let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates( + &q0x, &q0y, false, + )) + .unwrap() + .to_curve(); + let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates( + &q1x, &q1y, false, + )) + .unwrap(); + + let p = (p0 + p1).to_encoded_point(false); + + assert_eq!(tv.px, hex::encode(p.x().unwrap())); + assert_eq!(tv.py, hex::encode(p.y().unwrap())); + } + } +} diff --git a/src/group/ristretto.rs b/src/group/ristretto.rs new file mode 100644 index 0000000..61149cf --- /dev/null +++ b/src/group/ristretto.rs @@ -0,0 +1,118 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use super::Group; +use crate::errors::InternalError; +use crate::hash::Hash; +use core::convert::TryInto; +use curve25519_dalek::{ + constants::RISTRETTO_BASEPOINT_POINT, + ristretto::{CompressedRistretto, RistrettoPoint}, + scalar::Scalar, + traits::Identity, +}; +use generic_array::{typenum::U32, GenericArray}; +use rand::{CryptoRng, RngCore}; +use subtle::ConstantTimeEq; + +/// The implementation of such a subgroup for Ristretto +impl Group for RistrettoPoint { + const SUITE_ID: usize = 0x0001; + + // Implements the `hash_to_ristretto255()` function from + // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt + fn map_to_curve(msg: &[u8], dst: &[u8]) -> Result { + let uniform_bytes = super::expand::expand_message_xmd::(msg, dst, 64)?; + + Ok(RistrettoPoint::from_uniform_bytes( + uniform_bytes + .as_slice() + .try_into() + .map_err(|_| InternalError::HashToCurveError)?, + )) + } + + // Implements the `HashToScalar()` function from + // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1 + fn hash_to_scalar(input: &[u8], dst: &[u8]) -> Result { + let uniform_bytes = super::expand::expand_message_xmd::(input, dst, 64)?; + + Ok(Scalar::from_bytes_mod_order_wide( + uniform_bytes + .as_slice() + .try_into() + .map_err(|_| InternalError::HashToCurveError)?, + )) + } + + type Scalar = Scalar; + type ScalarLen = U32; + fn from_scalar_slice( + scalar_bits: &GenericArray, + ) -> Result { + Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref())) + } + fn random_nonzero_scalar(rng: &mut R) -> Self::Scalar { + loop { + let scalar = { + #[cfg(not(test))] + { + let mut scalar_bytes = [0u8; 64]; + rng.fill_bytes(&mut scalar_bytes); + Scalar::from_bytes_mod_order_wide(&scalar_bytes) + } + + // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng + #[cfg(test)] + { + let mut scalar_bytes = [0u8; 32]; + rng.fill_bytes(&mut scalar_bytes); + Scalar::from_bytes_mod_order(scalar_bytes) + } + }; + + if scalar != Scalar::zero() { + break scalar; + } + } + } + fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray { + scalar.to_bytes().into() + } + fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar { + scalar.invert() + } + + // The byte length necessary to represent group elements + type ElemLen = U32; + fn from_element_slice( + element_bits: &GenericArray, + ) -> Result { + CompressedRistretto::from_slice(element_bits) + .decompress() + .ok_or(InternalError::PointError) + } + // serialization of a group element + fn to_arr(&self) -> GenericArray { + self.compress().to_bytes().into() + } + + fn base_point() -> Self { + RISTRETTO_BASEPOINT_POINT + } + + fn mult_by_slice(&self, scalar: &GenericArray) -> Self { + self * Scalar::from_bits(*scalar.as_ref()) + } + + /// Returns if the group element is equal to the identity (1) + fn is_identity(&self) -> bool { + self == &Self::identity() + } + + fn ct_equal(&self, other: &Self) -> bool { + ConstantTimeEq::ct_eq(self, other).into() + } +} diff --git a/src/group/x25519.rs b/src/group/x25519.rs new file mode 100644 index 0000000..6643037 --- /dev/null +++ b/src/group/x25519.rs @@ -0,0 +1,91 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use super::Group; +use crate::errors::InternalError; +use crate::hash::Hash; +use curve25519_dalek::{constants::X25519_BASEPOINT, montgomery::MontgomeryPoint, scalar::Scalar}; +use generic_array::{typenum::U32, GenericArray}; +use rand::{CryptoRng, RngCore}; + +/// The implementation of such a subgroup for Ristretto +impl Group for MontgomeryPoint { + const SUITE_ID: usize = 0xFFFF; + + fn map_to_curve(_msg: &[u8], _dst: &[u8]) -> Result { + unreachable!("this algorithm should only be used as the `KeGroup`") + } + + fn hash_to_scalar(_input: &[u8], _dst: &[u8]) -> Result { + unreachable!("this algorithm should only be used as the `KeGroup`") + } + + type Scalar = Scalar; + type ScalarLen = U32; + fn from_scalar_slice( + scalar_bits: &GenericArray, + ) -> Result { + Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref())) + } + fn random_nonzero_scalar(rng: &mut R) -> Self::Scalar { + loop { + let scalar = { + #[cfg(not(test))] + { + let mut scalar_bytes = [0u8; 64]; + rng.fill_bytes(&mut scalar_bytes); + Scalar::from_bytes_mod_order_wide(&scalar_bytes) + } + + // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng + #[cfg(test)] + { + let mut scalar_bytes = [0u8; 32]; + rng.fill_bytes(&mut scalar_bytes); + Scalar::from_bytes_mod_order(scalar_bytes) + } + }; + + if scalar != Scalar::zero() { + break scalar; + } + } + } + fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray { + scalar.to_bytes().into() + } + fn scalar_invert(_scalar: &Self::Scalar) -> Self::Scalar { + unreachable!("this algorithm should only be used as the `KeGroup`") + } + + // The byte length necessary to represent group elements + type ElemLen = U32; + fn from_element_slice( + element_bits: &GenericArray, + ) -> Result { + Ok(Self(*element_bits.as_ref())) + } + // serialization of a group element + fn to_arr(&self) -> GenericArray { + self.to_bytes().into() + } + + fn base_point() -> Self { + X25519_BASEPOINT + } + + fn mult_by_slice(&self, scalar: &GenericArray) -> Self { + self * Scalar::from_bits(*scalar.as_ref()) + } + + /// Returns if the group element is equal to the identity (1) + fn is_identity(&self) -> bool { + unreachable!("this algorithm should only be used as the `KeGroup`") + } + + fn ct_equal(&self, _other: &Self) -> bool { + unreachable!("this algorithm should only be used as the `KeGroup`") + } +} diff --git a/src/hash.rs b/src/hash.rs new file mode 100644 index 0000000..94b74a3 --- /dev/null +++ b/src/hash.rs @@ -0,0 +1,15 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +//! A convenience trait for digest bounds used throughout the library + +use digest::{BlockInput, FixedOutput, Reset, Update}; + +/// Trait inheriting the requirements from digest::Digest for compatibility with HKDF and HMAC +// Associated types could be simplified when they are made as defaults: +// https://github.com/rust-lang/rust/issues/29661 +pub trait Hash: Update + BlockInput + FixedOutput + Reset + Default + Clone {} + +impl Hash for T {} diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..9e75d3a --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,22 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +// #![cfg_attr(not(feature = "bench"), deny(missing_docs))] +#![deny(unsafe_code)] +#![cfg_attr(not(feature = "std"), no_std)] + +extern crate alloc; + +#[macro_use] +mod serialization; + +pub mod ciphersuite; +pub mod errors; +pub mod group; +pub mod hash; +pub mod voprf; + +#[cfg(test)] +mod tests; diff --git a/src/serialization.rs b/src/serialization.rs new file mode 100644 index 0000000..0333eec --- /dev/null +++ b/src/serialization.rs @@ -0,0 +1,52 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use crate::errors::InternalError; +use alloc::vec::Vec; + +// Corresponds to the I2OSP() function from RFC8017 +pub(crate) fn i2osp(input: usize, length: usize) -> Result, InternalError> { + let sizeof_usize = core::mem::size_of::(); + + // Check if input >= 256^length + if (sizeof_usize as u32 - input.leading_zeros() / 8) > length as u32 { + return Err(InternalError::SerializationError); + } + + if length <= sizeof_usize { + return Ok((&input.to_be_bytes()[sizeof_usize - length..]).to_vec()); + } + + let mut output = alloc::vec![0u8; length]; + output.splice( + length - sizeof_usize..length, + input.to_be_bytes().iter().cloned(), + ); + Ok(output) +} + +// Computes I2OSP(len(input), max_bytes) || input +pub(crate) fn serialize(input: &[u8], max_bytes: usize) -> Result, InternalError> { + Ok([&i2osp(input.len(), max_bytes)?, input].concat()) +} + +#[cfg(test)] +mod unit_tests { + use super::*; + + // Test the error condition for I2OSP + #[test] + fn test_i2osp_err_check() { + assert!(i2osp(0, 1).is_ok()); + + assert!(i2osp(255, 1).is_ok()); + assert!(i2osp(256, 1).is_err()); + assert!(i2osp(257, 1).is_err()); + + assert!(i2osp(256 * 256 - 1, 2).is_ok()); + assert!(i2osp(256 * 256, 2).is_err()); + assert!(i2osp(256 * 256 + 1, 2).is_err()); + } +} diff --git a/src/tests/mock_rng.rs b/src/tests/mock_rng.rs new file mode 100644 index 0000000..1d10828 --- /dev/null +++ b/src/tests/mock_rng.rs @@ -0,0 +1,64 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use alloc::vec::Vec; +use core::cmp::min; +use rand::{CryptoRng, Error, RngCore}; + +/// A simple implementation of `RngCore` for testing purposes. +/// +/// This generates a cyclic sequence (i.e. cycles over an initial buffer) +/// +/// +#[derive(Debug, Clone)] +pub struct CycleRng { + v: Vec, +} + +impl CycleRng { + /// Create a `CycleRng`, yielding a sequence starting with + /// `initial` and looping thereafter + pub fn new(initial: Vec) -> Self { + CycleRng { v: initial } + } +} + +fn rotate_left(data: &mut [T], steps: usize) { + if data.is_empty() { + return; + } + let steps = steps % data.len(); + + data[..steps].reverse(); + data[steps..].reverse(); + data.reverse(); +} + +impl RngCore for CycleRng { + fn next_u32(&mut self) -> u32 { + unimplemented!() + } + + #[inline] + fn next_u64(&mut self) -> u64 { + unimplemented!() + } + + #[inline] + fn fill_bytes(&mut self, dest: &mut [u8]) { + let len = min(self.v.len(), dest.len()); + (&mut dest[..len]).copy_from_slice(&self.v[..len]); + rotate_left(&mut self.v, len); + } + + #[inline] + fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> { + self.fill_bytes(dest); + Ok(()) + } +} + +// This is meant for testing only +impl CryptoRng for CycleRng {} diff --git a/src/tests/mod.rs b/src/tests/mod.rs new file mode 100644 index 0000000..461d37b --- /dev/null +++ b/src/tests/mod.rs @@ -0,0 +1,7 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +mod mock_rng; +mod voprf_test_vectors; diff --git a/src/tests/voprf_test_vectors.rs b/src/tests/voprf_test_vectors.rs new file mode 100644 index 0000000..8d99fd4 --- /dev/null +++ b/src/tests/voprf_test_vectors.rs @@ -0,0 +1,176 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use crate::ciphersuite::CipherSuite; +use crate::errors::*; +use crate::group::Group; +use crate::tests::mock_rng::CycleRng; +use crate::voprf::{Client, Server}; +use alloc::string::ToString; +use alloc::vec::Vec; +use curve25519_dalek::ristretto::RistrettoPoint; +use generic_array::GenericArray; +use serde_json::Value; +use sha2::Sha512; + +struct VOPRFTestVectorParameters { + sksm: Vec, + input: Vec, + blind: Vec, + blinded_element: Vec, + evaluation_element: Vec, + output: Vec, +} + +// Taken from https://github.com/cfrg/draft-irtf-cfrg-voprf/blob/master/draft-irtf-cfrg-voprf.md +// in base mode +static OPRF_RISTRETTO255_SHA512: &[&str] = &[ + r#" + { + "sksm": "caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1701", + "input": "00", + "blind": "c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf8e03", + "blinded_element": "fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b1686c64e07ac467", + "evaluation_element": "7c72cc293cd7d44c0b57c273f27befd598b132edc665694bdc9c42a4d3083c0a", + "output": "e3a209dce2d3ea3d84fcddb282818caebb756a341e08a310d9904314f5392085d13c3f76339d745db0f46974a6049c3ea9546305af55d37760b2136d9b3f0134" + } + "#, + r#" + { + "sksm": "caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1701", + "input": "5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a", + "blind": "5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037e50b", + "blinded_element": "483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de67ce49e7d1536", + "evaluation_element": "026f2758fc62f02a7ff95f35ec6f20186aa57c0274361655543ea235d7b2aa34", + "output": "2c17dc3e9398dadb44bb2d3360c446302e99f1fe0ec40f0b1ad25c9cf002be1e4b41b4900ef056537fe8c14532ccea4d796f5feab9541af48057d83c0db86fe9" + } + "#, +]; +#[cfg(feature = "p256")] +static OPRF_P256_SHA256: &[&str] = &[ + r#" + { + "sksm": "a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a7827b", + "input": "00", + "blind": "5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98af0d0", + "blinded_element": "03e3c379698da853d9844098fa0ac676970d5ec24167b598714cd2ee188604ddd2", + "evaluation_element": "03ea54e8d095332d1a601a3f8a5013188aea036bf9b563236f7fd3b046908b42fd", + "output": "464e3e51e4086a824d9a2f939524d7069ae4072a788bc9d5daa0762b25826437" + } + "#, + r#" + { + "sksm": "a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a7827b", + "input": "5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a", + "blind": "825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5fcbe", + "blinded_element": "030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c51608f372a02102", + "evaluation_element": "03115ad70ea55dbb4006da0ee3589a3582f31ef9cd143996d1e31a25ad3abdcf6f", + "output": "b597d58c843d0f9d2712121b0a3e2912ebee1c829eed3089eade9af4359ab275" + } + "#, +]; + +fn decode(values: &Value, key: &str) -> Option> { + values[key] + .as_str() + .and_then(|s| hex::decode(&s.to_string()).ok()) +} + +fn populate_test_vectors(values: &Value) -> VOPRFTestVectorParameters { + VOPRFTestVectorParameters { + sksm: decode(&values, "sksm").unwrap(), + input: decode(&values, "input").unwrap(), + blind: decode(&values, "blind").unwrap(), + blinded_element: decode(&values, "blinded_element").unwrap(), + evaluation_element: decode(&values, "evaluation_element").unwrap(), + output: decode(&values, "output").unwrap(), + } +} + +struct Ristretto255Sha512; +impl CipherSuite for Ristretto255Sha512 { + type Group = RistrettoPoint; + type Hash = Sha512; +} + +#[test] +fn tests() -> Result<(), InternalError> { + test_blind::(OPRF_RISTRETTO255_SHA512)?; + test_evaluate::(OPRF_RISTRETTO255_SHA512)?; + test_finalize::(OPRF_RISTRETTO255_SHA512)?; + + #[cfg(feature = "p256")] + { + use p256_::ProjectivePoint; + use sha2::Sha256; + + test_blind::(OPRF_P256_SHA256)?; + test_evaluate::(OPRF_P256_SHA256)?; + test_finalize::(OPRF_P256_SHA256)?; + } + + Ok(()) +} + +// Tests input -> blind, blinded_element +fn test_blind(tvs: &[&str]) -> Result<(), InternalError> { + for tv in tvs { + let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap()); + + let mut rng = CycleRng::new(parameters.blind.to_vec()); + let (client, blinded_element) = Client::::blind(¶meters.input, &mut rng)?; + + assert_eq!( + ¶meters.blind, + &CS::Group::scalar_as_bytes(client.get_blind()).to_vec() + ); + assert_eq!( + ¶meters.blinded_element, + &blinded_element.to_arr().to_vec() + ); + } + Ok(()) +} + +// Tests sksm, blinded_element -> evaluation_element +fn test_evaluate(tvs: &[&str]) -> Result<(), InternalError> { + for tv in tvs { + let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap()); + + let server = Server::::new_with_key(¶meters.sksm).unwrap(); + let evaluation_element = server.evaluate( + CS::Group::from_element_slice(GenericArray::from_slice(¶meters.blinded_element)) + .unwrap(), + ); + + assert_eq!( + ¶meters.evaluation_element, + &evaluation_element.to_arr().to_vec() + ); + } + Ok(()) +} + +// Tests input, blind, evaluation_element -> output +fn test_finalize(tvs: &[&str]) -> Result<(), InternalError> { + for tv in tvs { + let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap()); + + let client = Client::::from_data_and_blind( + ¶meters.input, + &::from_scalar_slice(&GenericArray::clone_from_slice( + ¶meters.blind, + )) + .unwrap(), + ); + + let output = client.finalize(::from_element_slice( + GenericArray::from_slice(¶meters.evaluation_element), + )?)?; + + assert_eq!(¶meters.output, &output.to_vec()); + } + Ok(()) +} diff --git a/src/voprf.rs b/src/voprf.rs new file mode 100644 index 0000000..440b5e6 --- /dev/null +++ b/src/voprf.rs @@ -0,0 +1,184 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +use crate::ciphersuite::CipherSuite; +use crate::errors::InternalError; +use crate::group::Group; +use crate::hash::Hash; +use crate::serialization::serialize; +use digest::Digest; +use generic_array::GenericArray; +use rand::{CryptoRng, RngCore}; + +use alloc::vec; +use generic_array::typenum::Unsigned; + +static STR_VOPRF: &[u8] = b"HashToGroup-VOPRF07-"; +static STR_VOPRF_FINALIZE: &[u8] = b"Finalize-VOPRF07-"; +static MODE_BASE: u8 = 0x00; + +pub struct Client { + data: alloc::vec::Vec, + blind: ::Scalar, +} + +impl Client { + /// Computes the first step for the multiplicative blinding version of DH-OPRF. + pub fn blind( + input: &[u8], + blinding_factor_rng: &mut R, + ) -> Result<(Self, CS::Group), InternalError> { + // Choose a random scalar that must be non-zero + let blind = ::random_nonzero_scalar(blinding_factor_rng); + let dst = [ + STR_VOPRF, + &::get_context_string(MODE_BASE)?, + ] + .concat(); + let mapped_point = ::map_to_curve::(input, &dst)?; + let blind_token = mapped_point * &blind; + Ok(( + Self { + data: input.to_vec(), + blind, + }, + blind_token, + )) + } + + /// Computes the third step for the multiplicative blinding version of DH-OPRF, in which + /// the client unblinds the server's message. + pub fn finalize( + &self, + evaluated_element: CS::Group, + ) -> Result::OutputSize>, InternalError> { + let unblinded_element = + evaluated_element * &::scalar_invert(&self.blind); + finalize_after_unblind::(&self.data, unblinded_element) + } + + #[cfg(test)] + /// Only used for test functions + pub fn from_data_and_blind(data: &[u8], blind: &::Scalar) -> Self { + Self { + data: data.to_vec(), + blind: blind.clone(), + } + } + + #[cfg(test)] + /// Only used for test functions + pub fn get_blind(&self) -> ::Scalar { + self.blind + } +} + +pub struct Server { + oprf_key: ::Scalar, +} + +impl Server { + pub fn new(rng: &mut R) -> Result { + let mut key = vec![0u8; ::OutputSize::USIZE]; + rng.fill_bytes(&mut key); + Self::new_with_key(&key) + } + + pub fn new_with_key(key: &[u8]) -> Result { + Ok(Self { + oprf_key: CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?, + }) + } + + /// Computes the second step for the multiplicative blinding version of DH-OPRF. This + /// message is sent from the server (who holds the OPRF key) to the client. + pub fn evaluate(&self, point: CS::Group) -> CS::Group { + point * &self.oprf_key + } +} + +fn finalize_after_unblind( + input: &[u8], + unblinded_element: G, +) -> Result::OutputSize>, InternalError> { + let finalize_dst = [STR_VOPRF_FINALIZE, &G::get_context_string(MODE_BASE)?].concat(); + let hash_input = [ + serialize(input, 2)?, + serialize(&unblinded_element.to_arr().to_vec(), 2)?, + serialize(&finalize_dst, 2)?, + ] + .concat(); + Ok(::digest(&hash_input)) +} + +/////////// +// Tests // +// ===== // +/////////// + +#[cfg(test)] +mod tests { + use super::*; + use crate::group::Group; + use curve25519_dalek::ristretto::RistrettoPoint; + use generic_array::{arr, GenericArray}; + use rand::rngs::OsRng; + use sha2::Sha512; + + struct Ristretto255Sha512; + impl CipherSuite for Ristretto255Sha512 { + type Group = RistrettoPoint; + type Hash = Sha512; + } + + fn prf(input: &[u8], oprf_key: &[u8]) -> GenericArray::OutputSize> { + let dst = [ + STR_VOPRF, + &RistrettoPoint::get_context_string(MODE_BASE).unwrap(), + ] + .concat(); + let point = RistrettoPoint::map_to_curve::(input, &dst).unwrap(); + let scalar = + RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&oprf_key[..])).unwrap(); + let res = point * scalar; + + finalize_after_unblind::(&input, res).unwrap() + } + + #[test] + fn oprf_retrieval() { + let input = b"hunter2"; + let mut rng = OsRng; + let (client, alpha) = Client::::blind(&input[..], &mut rng).unwrap(); + let oprf_key_bytes = arr![ + u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, + 24, 25, 26, 27, 28, 29, 30, 31, 32, + ]; + let server = Server::::new_with_key(&oprf_key_bytes).unwrap(); + let beta = server.evaluate(alpha); + let res = client.finalize(beta).unwrap(); + let res2 = prf(&input[..], &oprf_key_bytes); + assert_eq!(res, res2); + } + + #[test] + fn oprf_inversion_unsalted() { + let mut rng = OsRng; + let mut input = alloc::vec![0u8; 64]; + rng.fill_bytes(&mut input); + let (client, alpha) = Client::::blind(&input, &mut rng).unwrap(); + let res = client.finalize(alpha).unwrap(); + + let dst = [ + STR_VOPRF, + &RistrettoPoint::get_context_string(MODE_BASE).unwrap(), + ] + .concat(); + let point = RistrettoPoint::map_to_curve::(&input, &dst).unwrap(); + let res2 = finalize_after_unblind::(&input, point).unwrap(); + + assert_eq!(res, res2); + } +}