Initial implementation (#1)

src/ciphersuite.rs

@@ -0,0 +1,17 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
+
+use crate::{group::Group, hash::Hash};
+
+/// Configures the underlying primitives used in VOPRF
+pub trait CipherSuite {
+    /// A finite cyclic group along with a point representation that allows some
+    /// customization on how to hash an input to a curve point. See `group::Group`.
+    type Group: Group;
+    /// The main hash function to use (for HKDF computations and hashing transcripts).
+    type Hash: Hash;
+}

src/errors.rs

@@ -0,0 +1,57 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! A list of error types which are produced during an execution of the protocol
+use core::fmt::Debug;
+#[cfg(feature = "std")]
+use std::error::Error;
+
+use displaydoc::Display;
+
+/// Represents an error in the manipulation of internal cryptographic data
+#[derive(Clone, Display, Eq, Hash, PartialEq)]
+pub enum InternalError {
+    /// Could not parse byte sequence for key
+    InvalidByteSequence,
+    /// Invalid length for {name}: expected {len}, but is actually {actual_len}.
+    SizeError {
+        /// name
+        name: &'static str,
+        /// length
+        len: usize,
+        /// actual
+        actual_len: usize,
+    },
+    /// Could not decompress point.
+    PointError,
+    /// Computing the hash-to-curve function failed
+    HashToCurveError,
+    /// Failure to serialize or deserialize bytes
+    SerializationError,
+}
+
+impl Debug for InternalError {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::InvalidByteSequence => f.debug_tuple("InvalidByteSequence").finish(),
+            Self::SizeError {
+                name,
+                len,
+                actual_len,
+            } => f
+                .debug_struct("SizeError")
+                .field("name", name)
+                .field("len", len)
+                .field("actual_len", actual_len)
+                .finish(),
+            Self::PointError => f.debug_tuple("PointError").finish(),
+            Self::HashToCurveError => f.debug_tuple("HashToCurveError").finish(),
+            Self::SerializationError => f.debug_tuple("SerializationError").finish(),
+        }
+    }
+}
+
+#[cfg(feature = "std")]
+impl Error for InternalError {}

src/group/expand.rs

@@ -0,0 +1,190 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::errors::InternalError;
+use crate::hash::Hash;
+use crate::serialization::i2osp;
+use alloc::vec::Vec;
+use digest::{BlockInput, Digest};
+use generic_array::typenum::Unsigned;
+
+// Computes ceil(x / y)
+fn div_ceil(x: usize, y: usize) -> usize {
+    let additive = (x % y != 0) as usize;
+    x / y + additive
+}
+
+fn xor(x: &[u8], y: &[u8]) -> Result<Vec<u8>, InternalError> {
+    if x.len() != y.len() {
+        return Err(InternalError::HashToCurveError);
+    }
+
+    Ok(x.iter().zip(y).map(|(&x1, &x2)| x1 ^ x2).collect())
+}
+
+/// Corresponds to the expand_message_xmd() function defined in
+/// <https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt>
+pub fn expand_message_xmd<H: Hash>(
+    msg: &[u8],
+    dst: &[u8],
+    len_in_bytes: usize,
+) -> Result<Vec<u8>, InternalError> {
+    let b_in_bytes = <H as Digest>::OutputSize::USIZE;
+    let r_in_bytes = <H as BlockInput>::BlockSize::USIZE;
+
+    let ell = div_ceil(len_in_bytes, b_in_bytes);
+    if ell > 255 {
+        return Err(InternalError::HashToCurveError);
+    }
+    let dst_prime = [dst, &i2osp(dst.len(), 1)?].concat();
+    let z_pad = i2osp(0, r_in_bytes)?;
+    let l_i_b_str = i2osp(len_in_bytes, 2)?;
+    let msg_prime = [&z_pad, msg, &l_i_b_str, &i2osp(0, 1)?, &dst_prime].concat();
+
+    let mut b: Vec<Vec<u8>> = alloc::vec![H::digest(&msg_prime).to_vec()]; // b[0]
+
+    let mut h = H::new();
+    h.update(&b[0]);
+    h.update(&i2osp(1, 1)?);
+    h.update(&dst_prime);
+    b.push(h.finalize_reset().to_vec()); // b[1]
+
+    let mut uniform_bytes: Vec<u8> = Vec::new();
+    uniform_bytes.extend_from_slice(&b[1]);
+
+    for i in 2..(ell + 1) {
+        h.update(xor(&b[0], &b[i - 1])?);
+        h.update(&i2osp(i, 1)?);
+        h.update(&dst_prime);
+        b.push(h.finalize_reset().to_vec()); // b[i]
+        uniform_bytes.extend_from_slice(&b[i]);
+    }
+
+    Ok(uniform_bytes[..len_in_bytes].to_vec())
+}
+
+#[cfg(test)]
+mod tests {
+
+    struct Params {
+        msg: &'static str,
+        len_in_bytes: usize,
+        uniform_bytes: &'static str,
+    }
+
+    #[test]
+    fn test_expand_message_xmd() {
+        // Test vectors taken from Section K.1 of https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+        let test_vectors: alloc::vec::Vec<Params> = alloc::vec![
+            Params {
+                msg: "",
+                len_in_bytes: 0x20,
+                uniform_bytes: "f659819a6473c1835b25ea59e3d38914c98b374f0970b7e4c\
+                92181df928fca88",
+            },
+            Params {
+                msg: "abc",
+                len_in_bytes: 0x20,
+                uniform_bytes: "1c38f7c211ef233367b2420d04798fa4698080a8901021a79\
+                5a1151775fe4da7",
+            },
+            Params {
+                msg: "abcdef0123456789",
+                len_in_bytes: 0x20,
+                uniform_bytes: "8f7e7b66791f0da0dbb5ec7c22ec637f79758c0a48170bfb7c4611bd304ece89",
+            },
+            Params {
+                msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqq",
+                len_in_bytes: 0x20,
+                uniform_bytes: "72d5aa5ec810370d1f0013c0df2f1d65699494ee2a39f72e\
+                1716b1b964e1c642",
+            },
+            Params {
+                msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                len_in_bytes: 0x20,
+                uniform_bytes: "3b8e704fc48336aca4c2a12195b720882f2162a4b7b13a9c\
+                350db46f429b771b",
+            },
+            Params {
+                msg: "",
+                len_in_bytes: 0x80,
+                uniform_bytes: "8bcffd1a3cae24cf9cd7ab85628fd111bb17e3739d3b53f8\
+                9580d217aa79526f1708354a76a402d3569d6a9d19ef3de4d0b991\
+                e4f54b9f20dcde9b95a66824cbdf6c1a963a1913d43fd7ac443a02\
+                fc5d9d8d77e2071b86ab114a9f34150954a7531da568a1ea8c7608\
+                61c0cde2005afc2c114042ee7b5848f5303f0611cf297f",
+            },
+            Params {
+                msg: "abc",
+                len_in_bytes: 0x80,
+                uniform_bytes: "fe994ec51bdaa821598047b3121c149b364b178606d5e72b\
+                fbb713933acc29c186f316baecf7ea22212f2496ef3f785a27e84a\
+                40d8b299cec56032763eceeff4c61bd1fe65ed81decafff4a31d01\
+                98619c0aa0c6c51fca15520789925e813dcfd318b542f879944127\
+                1f4db9ee3b8092a7a2e8d5b75b73e28fb1ab6b4573c192",
+            },
+            Params {
+                msg: "abcdef0123456789",
+                len_in_bytes: 0x80,
+                uniform_bytes: "c9ec7941811b1e19ce98e21db28d22259354d4d0643e3011\
+                75e2f474e030d32694e9dd5520dde93f3600d8edad94e5c3649030\
+                88a7228cc9eff685d7eaac50d5a5a8229d083b51de4ccc3733917f\
+                4b9535a819b445814890b7029b5de805bf62b33a4dc7e24acdf2c9\
+                24e9fe50d55a6b832c8c84c7f82474b34e48c6d43867be",
+            },
+            Params {
+                msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                qqqqqqqqqqqqqqqqqqqqqqqqq",
+                len_in_bytes: 0x80,
+                uniform_bytes: "48e256ddba722053ba462b2b93351fc966026e6d6db49318\
+                9798181c5f3feea377b5a6f1d8368d7453faef715f9aecb078cd40\
+                2cbd548c0e179c4ed1e4c7e5b048e0a39d31817b5b24f50db58bb3\
+                720fe96ba53db947842120a068816ac05c159bb5266c63658b4f00\
+                0cbf87b1209a225def8ef1dca917bcda79a1e42acd8069",
+            },
+            Params {
+                msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                len_in_bytes: 0x80,
+                uniform_bytes: "396962db47f749ec3b5042ce2452b619607f27fd3939ece2\
+                746a7614fb83a1d097f554df3927b084e55de92c7871430d6b95c2\
+                a13896d8a33bc48587b1f66d21b128a1a8240d5b0c26dfe795a1a8\
+                42a0807bb148b77c2ef82ed4b6c9f7fcb732e7f94466c8b51e52bf\
+                378fba044a31f5cb44583a892f5969dcd73b3fa128816e",
+            },
+        ];
+        let dst = "QUUX-V01-CS02-with-expander";
+
+        for tv in test_vectors {
+            let uniform_bytes = super::expand_message_xmd::<sha2::Sha256>(
+                tv.msg.as_bytes(),
+                dst.as_bytes(),
+                tv.len_in_bytes,
+            )
+            .unwrap();
+            assert_eq!(tv.uniform_bytes, hex::encode(uniform_bytes));
+        }
+    }
+}

src/group/mod.rs

@@ -0,0 +1,78 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! Defines the Group trait to specify the underlying prime order group used in
+//! OPAQUE's OPRF
+
+mod expand;
+#[cfg(feature = "p256")]
+pub(crate) mod p256;
+mod ristretto;
+mod x25519;
+
+use crate::errors::InternalError;
+use crate::hash::Hash;
+use core::ops::Mul;
+use generic_array::{ArrayLength, GenericArray};
+use rand::{CryptoRng, RngCore};
+use zeroize::Zeroize;
+
+/// A prime-order subgroup of a base field (EC, prime-order field ...). This
+/// subgroup is noted additively — as in the draft RFC — in this trait.
+pub trait Group: Copy + Sized + for<'a> Mul<&'a <Self as Group>::Scalar, Output = Self> {
+    /// The ciphersuite identifier as dictated by
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    const SUITE_ID: usize;
+
+    /// transforms a password and domain separation tag (DST) into a curve point
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalError>;
+
+    /// Hashes a slice of pseudo-random bytes to a scalar
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError>;
+
+    /// Generates the contextString parameter as defined in
+    /// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-05.txt>
+    fn get_context_string(mode: u8) -> Result<alloc::vec::Vec<u8>, InternalError> {
+        use crate::serialization::i2osp;
+
+        Ok([i2osp(mode as usize, 1)?, i2osp(Self::SUITE_ID, 2)?].concat())
+    }
+
+    /// The type of base field scalars
+    type Scalar: Zeroize + Copy;
+    /// The byte length necessary to represent scalars
+    type ScalarLen: ArrayLength<u8> + 'static;
+    /// Return a scalar from its fixed-length bytes representation
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalError>;
+    /// picks a scalar at random
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar;
+    /// Serializes a scalar to bytes
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen>;
+    /// The multiplicative inverse of this scalar
+    fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar;
+
+    /// The byte length necessary to represent group elements
+    type ElemLen: ArrayLength<u8> + 'static;
+    /// Return an element from its fixed-length bytes representation
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalError>;
+    /// Serializes the `self` group element
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen>;
+
+    /// Get the base point for the group
+    fn base_point() -> Self;
+
+    /// Multiply the point by a scalar, represented as a slice
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self;
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool;
+
+    /// Compares in constant time if the group elements are equal
+    fn ct_equal(&self, other: &Self) -> bool;
+}

src/group/p256.rs

@@ -0,0 +1,537 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+#![allow(
+    clippy::borrow_interior_mutable_const,
+    clippy::declare_interior_mutable_const
+)]
+
+use super::Group;
+use crate::errors::{InternalError, ProtocolError};
+use crate::hash::Hash;
+use core::ops::{Add, Div, Mul, Neg, Sub};
+use core::str::FromStr;
+use generic_array::typenum::{U32, U33};
+use generic_array::{ArrayLength, GenericArray};
+use num_bigint::{BigInt, Sign};
+use num_integer::Integer;
+use num_traits::{One, ToPrimitive};
+use once_cell::unsync::Lazy;
+use p256_::elliptic_curve::group::prime::PrimeCurveAffine;
+use p256_::elliptic_curve::group::GroupEncoding;
+use p256_::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint};
+use p256_::elliptic_curve::subtle::ConstantTimeEq;
+use p256_::elliptic_curve::Field;
+use p256_::{AffinePoint, EncodedPoint, ProjectivePoint};
+use rand::{CryptoRng, RngCore};
+
+// `L: 48`
+pub const L: usize = 48;
+
+impl Group for ProjectivePoint {
+    const SUITE_ID: usize = 0x0003;
+
+    // Implements the `hash_to_curve()` function from
+    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, ProtocolError> {
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-8.2
+        // `p: 2^256 - 2^224 + 2^192 + 2^96 - 1`
+        const P: Lazy<BigInt> = Lazy::new(|| {
+            BigInt::from_str(
+                "115792089210356248762697446949407573530086143415290314195533631308867097853951",
+            )
+            .unwrap()
+        });
+        // `A: -3`
+        const A: Lazy<BigInt> = Lazy::new(|| BigInt::from(-3));
+        // `B: 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`
+        const B: Lazy<BigInt> = Lazy::new(|| {
+            BigInt::parse_bytes(
+                b"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
+                16,
+            )
+            .unwrap()
+        });
+        // `Z: -10`
+        const Z: Lazy<BigInt> = Lazy::new(|| BigInt::from(-10));
+
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
+        // `hash_to_curve` calls `hash_to_field` with a `count` of `2`
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
+        // `hash_to_field` calls `expand_message` with a `len_in_bytes` of `count * L`
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(msg, dst, 2 * L)?;
+
+        // map to curve
+        let (q0x, q0y) = map_to_curve_simple_swu(&uniform_bytes[..L], &A, &B, &P, &Z);
+        let (q1x, q1y) = map_to_curve_simple_swu(&uniform_bytes[L..], &A, &B, &P, &Z);
+
+        // convert to `p256` types
+        let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+            &q0x, &q0y, false,
+        ))
+        .ok_or(InternalError::PointError)?
+        .to_curve();
+        let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+            &q1x, &q1y, false,
+        ))
+        .ok_or(InternalError::PointError)?;
+
+        Ok(p0 + p1)
+    }
+
+    // Implements the `HashToScalar()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.3
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, ProtocolError> {
+        // https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#[{%22num%22:211,%22gen%22:0},{%22name%22:%22XYZ%22},70,700,0]
+        // P-256 `n` is defined as `115792089210356248762697446949407573529996955224135760342 422259061068512044369`
+        const N: once_cell::unsync::Lazy<BigInt> = once_cell::unsync::Lazy::new(|| {
+            BigInt::from_str(
+                "115792089210356248762697446949407573529996955224135760342422259061068512044369",
+            )
+            .unwrap()
+        });
+
+        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3
+        // `HashToScalar` is `hash_to_field`
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(input, dst, L)?;
+        let mut bytes = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes)
+            .mod_floor(&N)
+            .to_bytes_be()
+            .1;
+        bytes.resize(32, 0);
+
+        Ok(p256_::Scalar::from_bytes_reduced(GenericArray::from_slice(
+            &bytes,
+        )))
+    }
+
+    type ElemLen = U33;
+    type Scalar = p256_::Scalar;
+    type ScalarLen = U32;
+
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalError> {
+        Ok(Self::Scalar::from_bytes_reduced(scalar_bits))
+    }
+
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        Self::Scalar::random(rng)
+    }
+
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
+        scalar.into()
+    }
+
+    fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar {
+        scalar.invert().unwrap_or(Self::Scalar::zero())
+    }
+
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalError> {
+        Option::from(Self::from_bytes(element_bits)).ok_or(InternalError::PointError)
+    }
+
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
+        let mut bytes = self.to_affine().to_encoded_point(true).as_bytes().to_vec();
+        bytes.resize(33, 0);
+        *GenericArray::from_slice(&bytes)
+    }
+
+    fn base_point() -> Self {
+        Self::generator()
+    }
+
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        self * &Self::Scalar::from_bytes_reduced(scalar)
+    }
+
+    fn is_identity(&self) -> bool {
+        self == &Self::identity()
+    }
+    fn ct_equal(&self, other: &Self) -> bool {
+        self.ct_eq(other).into()
+    }
+}
+
+/// Corresponds to the map_to_curve_simple_swu() function defined in
+/// <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-F.2>
+#[allow(clippy::many_single_char_names)]
+fn map_to_curve_simple_swu<N: ArrayLength<u8>>(
+    u: &[u8],
+    a: &BigInt,
+    b: &BigInt,
+    p: &BigInt,
+    z: &BigInt,
+) -> (GenericArray<u8, N>, GenericArray<u8, N>) {
+    #[derive(Clone)]
+    struct Field<'a>(&'a BigInt);
+
+    impl<'a> Field<'a> {
+        fn new(p: &'a BigInt) -> Self {
+            Self(p)
+        }
+
+        fn element(&'a self, number: &BigInt) -> FieldElement<'a> {
+            FieldElement {
+                number: number.mod_floor(self.0),
+                f: self,
+            }
+        }
+
+        fn one(&'a self) -> FieldElement<'a> {
+            self.element(&BigInt::one())
+        }
+
+        /// See <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-4>
+        fn inv0(&'a self, number: &FieldElement<'a>) -> FieldElement<'a> {
+            number.pow_internal(&(self.0 - 2))
+        }
+    }
+
+    /// Finite field arithmetic
+    #[derive(Clone)]
+    struct FieldElement<'a> {
+        number: BigInt,
+        f: &'a Field<'a>,
+    }
+
+    impl<'a> Add for FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn add(self, rhs: Self) -> Self::Output {
+            &self + &rhs
+        }
+    }
+
+    impl<'a> Add for &FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn add(self, rhs: Self) -> Self::Output {
+            self.f.element(&(&self.number + &rhs.number))
+        }
+    }
+
+    impl<'a> Sub for &FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn sub(self, rhs: Self) -> Self::Output {
+            self.f.element(&(&self.number - &rhs.number))
+        }
+    }
+
+    impl<'a> Neg for FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn neg(self) -> Self::Output {
+            -&self
+        }
+    }
+
+    impl<'a> Neg for &FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn neg(self) -> Self::Output {
+            self.f.element(&-&self.number)
+        }
+    }
+
+    impl<'a> Mul for FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn mul(self, rhs: Self) -> Self::Output {
+            &self * &rhs
+        }
+    }
+
+    impl<'a> Mul<&Self> for FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn mul(self, rhs: &Self) -> Self::Output {
+            &self * rhs
+        }
+    }
+
+    impl<'a> Mul<FieldElement<'a>> for &FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn mul(self, rhs: FieldElement<'a>) -> Self::Output {
+            self * &rhs
+        }
+    }
+
+    impl<'a> Mul for &FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        fn mul(self, rhs: Self) -> Self::Output {
+            self.f.element(&(&self.number * &rhs.number))
+        }
+    }
+
+    impl<'a> Div<&Self> for FieldElement<'a> {
+        type Output = FieldElement<'a>;
+
+        #[allow(clippy::suspicious_arithmetic_impl)]
+        fn div(self, rhs: &Self) -> Self::Output {
+            self * rhs.f.inv0(rhs)
+        }
+    }
+
+    impl<'a> FieldElement<'a> {
+        fn square(&self) -> Self {
+            self * self
+        }
+
+        fn pow_internal(&self, exponent: &BigInt) -> Self {
+            let exponent = exponent.mod_floor(&(self.f.0 - 1));
+            self.f.element(&self.number.modpow(&exponent, self.f.0))
+        }
+
+        /// Corresponds to the sqrt_3mod4() function defined in
+        /// <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-I.1>
+        fn sqrt(&self) -> Self {
+            // constant
+            let c1 = (self.f.0 + 1) >> 2;
+
+            self.pow_internal(&c1)
+        }
+
+        /// Corresponds to the sgn0_m_eq_1() function defined in
+        /// <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-4.1>
+        fn sgn0(&self) -> i32 {
+            (&self.number % 2_usize).to_i32().unwrap()
+        }
+
+        fn is_zero(&self) -> bool {
+            self.number.is_one()
+        }
+
+        /// Corresponds to the is_square() function defined in
+        /// <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-4>
+        fn is_square(&self) -> bool {
+            // constant
+            let exponent = (self.f.0 - 1) >> 1;
+
+            let result = self.pow_internal(&exponent);
+            result.number.is_one() || result.is_zero()
+        }
+
+        fn to_bytes<N: ArrayLength<u8>>(&self) -> GenericArray<u8, N> {
+            GenericArray::clone_from_slice(&self.number.mod_floor(self.f.0).to_bytes_be().1)
+        }
+    }
+
+    fn cmov<'a>(x: &FieldElement<'a>, y: &FieldElement<'a>, b: bool) -> FieldElement<'a> {
+        if b {
+            y.clone()
+        } else {
+            x.clone()
+        }
+    }
+
+    let f = Field::new(p);
+    let a = f.element(a);
+    let b = f.element(b);
+    let z = f.element(z);
+    let u = f.element(&BigInt::from_bytes_be(Sign::Plus, u));
+
+    // Constants:
+    // 1.  c1 = -B / A
+    let c1 = -&b / &a;
+    // 2.  c2 = -1 / Z
+    let c2 = -f.one() / &z;
+
+    // Steps:
+    // 1.  tv1 = Z * u^2
+    let tv1 = z * u.square();
+    // 2.  tv2 = tv1^2
+    let mut tv2 = tv1.square();
+    // 3.   x1 = tv1 + tv2
+    let mut x1 = &tv1 + &tv2;
+    // 4.   x1 = inv0(x1)
+    x1 = f.inv0(&x1);
+    // 5.   e1 = x1 == 0
+    let e1 = x1.is_zero();
+    // 6.   x1 = x1 + 1
+    x1 = x1 + f.one();
+    // 7.   x1 = CMOV(x1, c2, e1)    # If (tv1 + tv2) == 0, set x1 = -1 / Z
+    x1 = cmov(&x1, &c2, e1);
+    // 8.   x1 = x1 * c1      # x1 = (-B / A) * (1 + (1 / (Z^2 * u^4 + Z * u^2)))
+    x1 = x1 * c1;
+    // 9.  gx1 = x1^2
+    let mut gx1 = x1.square();
+    // 10. gx1 = gx1 + A
+    gx1 = gx1 + a;
+    // 11. gx1 = gx1 * x1
+    gx1 = gx1 * &x1;
+    // 12. gx1 = gx1 + B             # gx1 = g(x1) = x1^3 + A * x1 + B
+    gx1 = gx1 + b;
+    // 13.  x2 = tv1 * x1            # x2 = Z * u^2 * x1
+    let x2 = &tv1 * &x1;
+    // 14. tv2 = tv1 * tv2
+    tv2 = tv1 * tv2;
+    // 15. gx2 = gx1 * tv2           # gx2 = (Z * u^2)^3 * gx1
+    let gx2 = &gx1 * tv2;
+    // 16.  e2 = is_square(gx1)
+    let e2 = gx1.is_square();
+    // 17.   x = CMOV(x2, x1, e2)    # If is_square(gx1), x = x1, else x = x2
+    let x = cmov(&x2, &x1, e2);
+    // 18.  y2 = CMOV(gx2, gx1, e2)  # If is_square(gx1), y2 = gx1, else y2 = gx2
+    let y2 = cmov(&gx2, &gx1, e2);
+    // 19.   y = sqrt(y2)
+    let mut y = y2.sqrt();
+    // 20.  e3 = sgn0(u) == sgn0(y)  # Fix sign of y
+    let e3 = u.sgn0() == y.sgn0();
+    // 21.   y = CMOV(-y, y, e3)
+    y = cmov(&-&y, &y, e3);
+    // 22. return (x, y)
+    (x.to_bytes(), y.to_bytes())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    struct Params {
+        msg: &'static str,
+        px: &'static str,
+        py: &'static str,
+        u0: &'static str,
+        u1: &'static str,
+        q0x: &'static str,
+        q0y: &'static str,
+        q1x: &'static str,
+        q1y: &'static str,
+    }
+
+    #[test]
+    fn map_to_curve_simple_swu() {
+        const P: Lazy<BigInt> = Lazy::new(|| {
+            BigInt::from_str(
+                "115792089210356248762697446949407573530086143415290314195533631308867097853951",
+            )
+            .unwrap()
+        });
+        const A: Lazy<BigInt> = Lazy::new(|| BigInt::from(-3));
+        const B: Lazy<BigInt> = Lazy::new(|| {
+            BigInt::parse_bytes(
+                b"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
+                16,
+            )
+            .unwrap()
+        });
+        const Z: Lazy<BigInt> = Lazy::new(|| BigInt::from(-10));
+
+        // Test vectors taken from https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-J.1.1
+        let test_vectors = alloc::vec![
+            Params {
+                msg: "",
+                px: "2c15230b26dbc6fc9a37051158c95b79656e17a1a920b11394ca91c44247d3e4",
+                py: "8a7a74985cc5c776cdfe4b1f19884970453912e9d31528c060be9ab5c43e8415",
+                u0: "ad5342c66a6dd0ff080df1da0ea1c04b96e0330dd89406465eeba11582515009",
+                u1: "8c0f1d43204bd6f6ea70ae8013070a1518b43873bcd850aafa0a9e220e2eea5a",
+                q0x: "ab640a12220d3ff283510ff3f4b1953d09fad35795140b1c5d64f313967934d5",
+                q0y: "dccb558863804a881d4fff3455716c836cef230e5209594ddd33d85c565b19b1",
+                q1x: "51cce63c50d972a6e51c61334f0f4875c9ac1cd2d3238412f84e31da7d980ef5",
+                q1y: "b45d1a36d00ad90e5ec7840a60a4de411917fbe7c82c3949a6e699e5a1b66aac",
+            },
+            Params {
+                msg: "abc",
+                px: "0bb8b87485551aa43ed54f009230450b492fead5f1cc91658775dac4a3388a0f",
+                py: "5c41b3d0731a27a7b14bc0bf0ccded2d8751f83493404c84a88e71ffd424212e",
+                u0: "afe47f2ea2b10465cc26ac403194dfb68b7f5ee865cda61e9f3e07a537220af1",
+                u1: "379a27833b0bfe6f7bdca08e1e83c760bf9a338ab335542704edcd69ce9e46e0",
+                q0x: "5219ad0ddef3cc49b714145e91b2f7de6ce0a7a7dc7406c7726c7e373c58cb48",
+                q0y: "7950144e52d30acbec7b624c203b1996c99617d0b61c2442354301b191d93ecf",
+                q1x: "019b7cb4efcfeaf39f738fe638e31d375ad6837f58a852d032ff60c69ee3875f",
+                q1y: "589a62d2b22357fed5449bc38065b760095ebe6aeac84b01156ee4252715446e",
+            },
+            Params {
+                msg: "abcdef0123456789",
+                px: "65038ac8f2b1def042a5df0b33b1f4eca6bff7cb0f9c6c1526811864e544ed80",
+                py: "cad44d40a656e7aff4002a8de287abc8ae0482b5ae825822bb870d6df9b56ca3",
+                u0: "0fad9d125a9477d55cf9357105b0eb3a5c4259809bf87180aa01d651f53d312c",
+                u1: "b68597377392cd3419d8fcc7d7660948c8403b19ea78bbca4b133c9d2196c0fb",
+                q0x: "a17bdf2965eb88074bc01157e644ed409dac97cfcf0c61c998ed0fa45e79e4a2",
+                q0y: "4f1bc80c70d411a3cc1d67aeae6e726f0f311639fee560c7f5a664554e3c9c2e",
+                q1x: "7da48bb67225c1a17d452c983798113f47e438e4202219dd0715f8419b274d66",
+                q1y: "b765696b2913e36db3016c47edb99e24b1da30e761a8a3215dc0ec4d8f96e6f9",
+            },
+            Params {
+                msg: "q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                      qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\
+                      qqqqqqqqqqqqqqqqqqqqqqqqq",
+                px: "4be61ee205094282ba8a2042bcb48d88dfbb609301c49aa8b078533dc65a0b5d",
+                py: "98f8df449a072c4721d241a3b1236d3caccba603f916ca680f4539d2bfb3c29e",
+                u0: "3bbc30446f39a7befad080f4d5f32ed116b9534626993d2cc5033f6f8d805919",
+                u1: "76bb02db019ca9d3c1e02f0c17f8baf617bbdae5c393a81d9ce11e3be1bf1d33",
+                q0x: "c76aaa823aeadeb3f356909cb08f97eee46ecb157c1f56699b5efebddf0e6398",
+                q0y: "776a6f45f528a0e8d289a4be12c4fab80762386ec644abf2bffb9b627e4352b1",
+                q1x: "418ac3d85a5ccc4ea8dec14f750a3a9ec8b85176c95a7022f391826794eb5a75",
+                q1y: "fd6604f69e9d9d2b74b072d14ea13050db72c932815523305cb9e807cc900aff",
+            },
+            Params {
+                msg: "a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\
+                      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                px: "457ae2981f70ca85d8e24c308b14db22f3e3862c5ea0f652ca38b5e49cd64bc5",
+                py: "ecb9f0eadc9aeed232dabc53235368c1394c78de05dd96893eefa62b0f4757dc",
+                u0: "4ebc95a6e839b1ae3c63b847798e85cb3c12d3817ec6ebc10af6ee51adb29fec",
+                u1: "4e21af88e22ea80156aff790750121035b3eefaa96b425a8716e0d20b4e269ee",
+                q0x: "d88b989ee9d1295df413d4456c5c850b8b2fb0f5402cc5c4c7e815412e926db8",
+                q0y: "bb4a1edeff506cf16def96afff41b16fc74f6dbd55c2210e5b8f011ba32f4f40",
+                q1x: "a281e34e628f3a4d2a53fa87ff973537d68ad4fbc28d3be5e8d9f6a2571c5a4b",
+                q1y: "f6ed88a7aab56a488100e6f1174fa9810b47db13e86be999644922961206e184",
+            },
+        ];
+        let dst = "QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_";
+
+        for tv in test_vectors {
+            let uniform_bytes = super::super::expand::expand_message_xmd::<sha2::Sha256>(
+                tv.msg.as_bytes(),
+                dst.as_bytes(),
+                96,
+            )
+            .unwrap();
+
+            let u0 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[..48]).mod_floor(&P);
+            let u1 = BigInt::from_bytes_be(Sign::Plus, &uniform_bytes[48..]).mod_floor(&P);
+
+            assert_eq!(BigInt::parse_bytes(tv.u0.as_bytes(), 16).unwrap(), u0);
+            assert_eq!(BigInt::parse_bytes(tv.u1.as_bytes(), 16).unwrap(), u1);
+
+            let (q0x, q0y) = super::map_to_curve_simple_swu(&u0.to_bytes_be().1, &A, &B, &P, &Z);
+            let (q1x, q1y) = super::map_to_curve_simple_swu(&u1.to_bytes_be().1, &A, &B, &P, &Z);
+
+            assert_eq!(tv.q0x, hex::encode(q0x));
+            assert_eq!(tv.q0y, hex::encode(q0y));
+            assert_eq!(tv.q1x, hex::encode(q1x));
+            assert_eq!(tv.q1y, hex::encode(q1y));
+
+            let p0 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+                &q0x, &q0y, false,
+            ))
+            .unwrap()
+            .to_curve();
+            let p1 = AffinePoint::from_encoded_point(&EncodedPoint::from_affine_coordinates(
+                &q1x, &q1y, false,
+            ))
+            .unwrap();
+
+            let p = (p0 + p1).to_encoded_point(false);
+
+            assert_eq!(tv.px, hex::encode(p.x().unwrap()));
+            assert_eq!(tv.py, hex::encode(p.y().unwrap()));
+        }
+    }
+}

src/group/ristretto.rs

@@ -0,0 +1,118 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use super::Group;
+use crate::errors::InternalError;
+use crate::hash::Hash;
+use core::convert::TryInto;
+use curve25519_dalek::{
+    constants::RISTRETTO_BASEPOINT_POINT,
+    ristretto::{CompressedRistretto, RistrettoPoint},
+    scalar::Scalar,
+    traits::Identity,
+};
+use generic_array::{typenum::U32, GenericArray};
+use rand::{CryptoRng, RngCore};
+use subtle::ConstantTimeEq;
+
+/// The implementation of such a subgroup for Ristretto
+impl Group for RistrettoPoint {
+    const SUITE_ID: usize = 0x0001;
+
+    // Implements the `hash_to_ristretto255()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
+    fn map_to_curve<H: Hash>(msg: &[u8], dst: &[u8]) -> Result<Self, InternalError> {
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(msg, dst, 64)?;
+
+        Ok(RistrettoPoint::from_uniform_bytes(
+            uniform_bytes
+                .as_slice()
+                .try_into()
+                .map_err(|_| InternalError::HashToCurveError)?,
+        ))
+    }
+
+    // Implements the `HashToScalar()` function from
+    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
+    fn hash_to_scalar<H: Hash>(input: &[u8], dst: &[u8]) -> Result<Self::Scalar, InternalError> {
+        let uniform_bytes = super::expand::expand_message_xmd::<H>(input, dst, 64)?;
+
+        Ok(Scalar::from_bytes_mod_order_wide(
+            uniform_bytes
+                .as_slice()
+                .try_into()
+                .map_err(|_| InternalError::HashToCurveError)?,
+        ))
+    }
+
+    type Scalar = Scalar;
+    type ScalarLen = U32;
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalError> {
+        Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref()))
+    }
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar;
+            }
+        }
+    }
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
+        scalar.to_bytes().into()
+    }
+    fn scalar_invert(scalar: &Self::Scalar) -> Self::Scalar {
+        scalar.invert()
+    }
+
+    // The byte length necessary to represent group elements
+    type ElemLen = U32;
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalError> {
+        CompressedRistretto::from_slice(element_bits)
+            .decompress()
+            .ok_or(InternalError::PointError)
+    }
+    // serialization of a group element
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
+        self.compress().to_bytes().into()
+    }
+
+    fn base_point() -> Self {
+        RISTRETTO_BASEPOINT_POINT
+    }
+
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        self * Scalar::from_bits(*scalar.as_ref())
+    }
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool {
+        self == &Self::identity()
+    }
+
+    fn ct_equal(&self, other: &Self) -> bool {
+        ConstantTimeEq::ct_eq(self, other).into()
+    }
+}

src/group/x25519.rs

@@ -0,0 +1,91 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use super::Group;
+use crate::errors::InternalError;
+use crate::hash::Hash;
+use curve25519_dalek::{constants::X25519_BASEPOINT, montgomery::MontgomeryPoint, scalar::Scalar};
+use generic_array::{typenum::U32, GenericArray};
+use rand::{CryptoRng, RngCore};
+
+/// The implementation of such a subgroup for Ristretto
+impl Group for MontgomeryPoint {
+    const SUITE_ID: usize = 0xFFFF;
+
+    fn map_to_curve<H: Hash>(_msg: &[u8], _dst: &[u8]) -> Result<Self, InternalError> {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    fn hash_to_scalar<H: Hash>(_input: &[u8], _dst: &[u8]) -> Result<Self::Scalar, InternalError> {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    type Scalar = Scalar;
+    type ScalarLen = U32;
+    fn from_scalar_slice(
+        scalar_bits: &GenericArray<u8, Self::ScalarLen>,
+    ) -> Result<Self::Scalar, InternalError> {
+        Ok(Scalar::from_bytes_mod_order(*scalar_bits.as_ref()))
+    }
+    fn random_nonzero_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
+        loop {
+            let scalar = {
+                #[cfg(not(test))]
+                {
+                    let mut scalar_bytes = [0u8; 64];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order_wide(&scalar_bytes)
+                }
+
+                // Tests need an exact conversion from bytes to scalar, sampling only 32 bytes from rng
+                #[cfg(test)]
+                {
+                    let mut scalar_bytes = [0u8; 32];
+                    rng.fill_bytes(&mut scalar_bytes);
+                    Scalar::from_bytes_mod_order(scalar_bytes)
+                }
+            };
+
+            if scalar != Scalar::zero() {
+                break scalar;
+            }
+        }
+    }
+    fn scalar_as_bytes(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
+        scalar.to_bytes().into()
+    }
+    fn scalar_invert(_scalar: &Self::Scalar) -> Self::Scalar {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    // The byte length necessary to represent group elements
+    type ElemLen = U32;
+    fn from_element_slice(
+        element_bits: &GenericArray<u8, Self::ElemLen>,
+    ) -> Result<Self, InternalError> {
+        Ok(Self(*element_bits.as_ref()))
+    }
+    // serialization of a group element
+    fn to_arr(&self) -> GenericArray<u8, Self::ElemLen> {
+        self.to_bytes().into()
+    }
+
+    fn base_point() -> Self {
+        X25519_BASEPOINT
+    }
+
+    fn mult_by_slice(&self, scalar: &GenericArray<u8, Self::ScalarLen>) -> Self {
+        self * Scalar::from_bits(*scalar.as_ref())
+    }
+
+    /// Returns if the group element is equal to the identity (1)
+    fn is_identity(&self) -> bool {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+
+    fn ct_equal(&self, _other: &Self) -> bool {
+        unreachable!("this algorithm should only be used as the `KeGroup`")
+    }
+}

src/hash.rs

@@ -0,0 +1,15 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+//! A convenience trait for digest bounds used throughout the library
+
+use digest::{BlockInput, FixedOutput, Reset, Update};
+
+/// Trait inheriting the requirements from digest::Digest for compatibility with HKDF and HMAC
+// Associated types could be simplified when they are made as defaults:
+// https://github.com/rust-lang/rust/issues/29661
+pub trait Hash: Update + BlockInput + FixedOutput + Reset + Default + Clone {}
+
+impl<T: Update + BlockInput + FixedOutput + Reset + Default + Clone> Hash for T {}

src/lib.rs

@@ -0,0 +1,22 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+// #![cfg_attr(not(feature = "bench"), deny(missing_docs))]
+#![deny(unsafe_code)]
+#![cfg_attr(not(feature = "std"), no_std)]
+
+extern crate alloc;
+
+#[macro_use]
+mod serialization;
+
+pub mod ciphersuite;
+pub mod errors;
+pub mod group;
+pub mod hash;
+pub mod voprf;
+
+#[cfg(test)]
+mod tests;

src/serialization.rs

@@ -0,0 +1,52 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::errors::InternalError;
+use alloc::vec::Vec;
+
+// Corresponds to the I2OSP() function from RFC8017
+pub(crate) fn i2osp(input: usize, length: usize) -> Result<alloc::vec::Vec<u8>, InternalError> {
+    let sizeof_usize = core::mem::size_of::<usize>();
+
+    // Check if input >= 256^length
+    if (sizeof_usize as u32 - input.leading_zeros() / 8) > length as u32 {
+        return Err(InternalError::SerializationError);
+    }
+
+    if length <= sizeof_usize {
+        return Ok((&input.to_be_bytes()[sizeof_usize - length..]).to_vec());
+    }
+
+    let mut output = alloc::vec![0u8; length];
+    output.splice(
+        length - sizeof_usize..length,
+        input.to_be_bytes().iter().cloned(),
+    );
+    Ok(output)
+}
+
+// Computes I2OSP(len(input), max_bytes) || input
+pub(crate) fn serialize(input: &[u8], max_bytes: usize) -> Result<Vec<u8>, InternalError> {
+    Ok([&i2osp(input.len(), max_bytes)?, input].concat())
+}
+
+#[cfg(test)]
+mod unit_tests {
+    use super::*;
+
+    // Test the error condition for I2OSP
+    #[test]
+    fn test_i2osp_err_check() {
+        assert!(i2osp(0, 1).is_ok());
+
+        assert!(i2osp(255, 1).is_ok());
+        assert!(i2osp(256, 1).is_err());
+        assert!(i2osp(257, 1).is_err());
+
+        assert!(i2osp(256 * 256 - 1, 2).is_ok());
+        assert!(i2osp(256 * 256, 2).is_err());
+        assert!(i2osp(256 * 256 + 1, 2).is_err());
+    }
+}

src/tests/mock_rng.rs

@@ -0,0 +1,64 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use alloc::vec::Vec;
+use core::cmp::min;
+use rand::{CryptoRng, Error, RngCore};
+
+/// A simple implementation of `RngCore` for testing purposes.
+///
+/// This generates a cyclic sequence (i.e. cycles over an initial buffer)
+///
+///
+#[derive(Debug, Clone)]
+pub struct CycleRng {
+    v: Vec<u8>,
+}
+
+impl CycleRng {
+    /// Create a `CycleRng`, yielding a sequence starting with
+    /// `initial` and looping thereafter
+    pub fn new(initial: Vec<u8>) -> Self {
+        CycleRng { v: initial }
+    }
+}
+
+fn rotate_left<T>(data: &mut [T], steps: usize) {
+    if data.is_empty() {
+        return;
+    }
+    let steps = steps % data.len();
+
+    data[..steps].reverse();
+    data[steps..].reverse();
+    data.reverse();
+}
+
+impl RngCore for CycleRng {
+    fn next_u32(&mut self) -> u32 {
+        unimplemented!()
+    }
+
+    #[inline]
+    fn next_u64(&mut self) -> u64 {
+        unimplemented!()
+    }
+
+    #[inline]
+    fn fill_bytes(&mut self, dest: &mut [u8]) {
+        let len = min(self.v.len(), dest.len());
+        (&mut dest[..len]).copy_from_slice(&self.v[..len]);
+        rotate_left(&mut self.v, len);
+    }
+
+    #[inline]
+    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
+        self.fill_bytes(dest);
+        Ok(())
+    }
+}
+
+// This is meant for testing only
+impl CryptoRng for CycleRng {}

src/tests/mod.rs

@@ -0,0 +1,7 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+mod mock_rng;
+mod voprf_test_vectors;

src/tests/voprf_test_vectors.rs

@@ -0,0 +1,176 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::ciphersuite::CipherSuite;
+use crate::errors::*;
+use crate::group::Group;
+use crate::tests::mock_rng::CycleRng;
+use crate::voprf::{Client, Server};
+use alloc::string::ToString;
+use alloc::vec::Vec;
+use curve25519_dalek::ristretto::RistrettoPoint;
+use generic_array::GenericArray;
+use serde_json::Value;
+use sha2::Sha512;
+
+struct VOPRFTestVectorParameters {
+    sksm: Vec<u8>,
+    input: Vec<u8>,
+    blind: Vec<u8>,
+    blinded_element: Vec<u8>,
+    evaluation_element: Vec<u8>,
+    output: Vec<u8>,
+}
+
+// Taken from https://github.com/cfrg/draft-irtf-cfrg-voprf/blob/master/draft-irtf-cfrg-voprf.md
+// in base mode
+static OPRF_RISTRETTO255_SHA512: &[&str] = &[
+    r#"
+    {
+        "sksm": "caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1701",
+        "input": "00",
+        "blind": "c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf8e03",
+        "blinded_element": "fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b1686c64e07ac467",
+        "evaluation_element": "7c72cc293cd7d44c0b57c273f27befd598b132edc665694bdc9c42a4d3083c0a",
+        "output": "e3a209dce2d3ea3d84fcddb282818caebb756a341e08a310d9904314f5392085d13c3f76339d745db0f46974a6049c3ea9546305af55d37760b2136d9b3f0134"
+    }
+    "#,
+    r#"
+    {
+        "sksm": "caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1701",
+        "input": "5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a",
+        "blind": "5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037e50b",
+        "blinded_element": "483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de67ce49e7d1536",
+        "evaluation_element": "026f2758fc62f02a7ff95f35ec6f20186aa57c0274361655543ea235d7b2aa34",
+        "output": "2c17dc3e9398dadb44bb2d3360c446302e99f1fe0ec40f0b1ad25c9cf002be1e4b41b4900ef056537fe8c14532ccea4d796f5feab9541af48057d83c0db86fe9"
+    }
+    "#,
+];
+#[cfg(feature = "p256")]
+static OPRF_P256_SHA256: &[&str] = &[
+    r#"
+    {
+        "sksm": "a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a7827b",
+        "input": "00",
+        "blind": "5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98af0d0",
+        "blinded_element": "03e3c379698da853d9844098fa0ac676970d5ec24167b598714cd2ee188604ddd2",
+        "evaluation_element": "03ea54e8d095332d1a601a3f8a5013188aea036bf9b563236f7fd3b046908b42fd",
+        "output": "464e3e51e4086a824d9a2f939524d7069ae4072a788bc9d5daa0762b25826437"
+    }
+    "#,
+    r#"
+    {
+        "sksm": "a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a7827b",
+        "input": "5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a",
+        "blind": "825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5fcbe",
+        "blinded_element": "030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c51608f372a02102",
+        "evaluation_element": "03115ad70ea55dbb4006da0ee3589a3582f31ef9cd143996d1e31a25ad3abdcf6f",
+        "output": "b597d58c843d0f9d2712121b0a3e2912ebee1c829eed3089eade9af4359ab275"
+    }
+    "#,
+];
+
+fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
+    values[key]
+        .as_str()
+        .and_then(|s| hex::decode(&s.to_string()).ok())
+}
+
+fn populate_test_vectors(values: &Value) -> VOPRFTestVectorParameters {
+    VOPRFTestVectorParameters {
+        sksm: decode(&values, "sksm").unwrap(),
+        input: decode(&values, "input").unwrap(),
+        blind: decode(&values, "blind").unwrap(),
+        blinded_element: decode(&values, "blinded_element").unwrap(),
+        evaluation_element: decode(&values, "evaluation_element").unwrap(),
+        output: decode(&values, "output").unwrap(),
+    }
+}
+
+struct Ristretto255Sha512;
+impl CipherSuite for Ristretto255Sha512 {
+    type Group = RistrettoPoint;
+    type Hash = Sha512;
+}
+
+#[test]
+fn tests() -> Result<(), InternalError> {
+    test_blind::<Ristretto255Sha512>(OPRF_RISTRETTO255_SHA512)?;
+    test_evaluate::<Ristretto255Sha512>(OPRF_RISTRETTO255_SHA512)?;
+    test_finalize::<Ristretto255Sha512>(OPRF_RISTRETTO255_SHA512)?;
+
+    #[cfg(feature = "p256")]
+    {
+        use p256_::ProjectivePoint;
+        use sha2::Sha256;
+
+        test_blind::<ProjectivePoint, Sha256>(OPRF_P256_SHA256)?;
+        test_evaluate::<ProjectivePoint>(OPRF_P256_SHA256)?;
+        test_finalize::<ProjectivePoint, Sha256>(OPRF_P256_SHA256)?;
+    }
+
+    Ok(())
+}
+
+// Tests input -> blind, blinded_element
+fn test_blind<CS: CipherSuite>(tvs: &[&str]) -> Result<(), InternalError> {
+    for tv in tvs {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+
+        let mut rng = CycleRng::new(parameters.blind.to_vec());
+        let (client, blinded_element) = Client::<CS>::blind(&parameters.input, &mut rng)?;
+
+        assert_eq!(
+            &parameters.blind,
+            &CS::Group::scalar_as_bytes(client.get_blind()).to_vec()
+        );
+        assert_eq!(
+            &parameters.blinded_element,
+            &blinded_element.to_arr().to_vec()
+        );
+    }
+    Ok(())
+}
+
+// Tests sksm, blinded_element -> evaluation_element
+fn test_evaluate<CS: CipherSuite>(tvs: &[&str]) -> Result<(), InternalError> {
+    for tv in tvs {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+
+        let server = Server::<CS>::new_with_key(&parameters.sksm).unwrap();
+        let evaluation_element = server.evaluate(
+            CS::Group::from_element_slice(GenericArray::from_slice(&parameters.blinded_element))
+                .unwrap(),
+        );
+
+        assert_eq!(
+            &parameters.evaluation_element,
+            &evaluation_element.to_arr().to_vec()
+        );
+    }
+    Ok(())
+}
+
+// Tests input, blind, evaluation_element -> output
+fn test_finalize<CS: CipherSuite>(tvs: &[&str]) -> Result<(), InternalError> {
+    for tv in tvs {
+        let parameters = populate_test_vectors(&serde_json::from_str(tv).unwrap());
+
+        let client = Client::<CS>::from_data_and_blind(
+            &parameters.input,
+            &<CS::Group as Group>::from_scalar_slice(&GenericArray::clone_from_slice(
+                &parameters.blind,
+            ))
+            .unwrap(),
+        );
+
+        let output = client.finalize(<CS::Group as Group>::from_element_slice(
+            GenericArray::from_slice(&parameters.evaluation_element),
+        )?)?;
+
+        assert_eq!(&parameters.output, &output.to_vec());
+    }
+    Ok(())
+}

src/voprf.rs

@@ -0,0 +1,184 @@
+// Copyright (c) Facebook, Inc. and its affiliates.
+//
+// This source code is licensed under the MIT license found in the
+// LICENSE file in the root directory of this source tree.
+
+use crate::ciphersuite::CipherSuite;
+use crate::errors::InternalError;
+use crate::group::Group;
+use crate::hash::Hash;
+use crate::serialization::serialize;
+use digest::Digest;
+use generic_array::GenericArray;
+use rand::{CryptoRng, RngCore};
+
+use alloc::vec;
+use generic_array::typenum::Unsigned;
+
+static STR_VOPRF: &[u8] = b"HashToGroup-VOPRF07-";
+static STR_VOPRF_FINALIZE: &[u8] = b"Finalize-VOPRF07-";
+static MODE_BASE: u8 = 0x00;
+
+pub struct Client<CS: CipherSuite> {
+    data: alloc::vec::Vec<u8>,
+    blind: <CS::Group as Group>::Scalar,
+}
+
+impl<CS: CipherSuite> Client<CS> {
+    /// Computes the first step for the multiplicative blinding version of DH-OPRF.
+    pub fn blind<R: RngCore + CryptoRng>(
+        input: &[u8],
+        blinding_factor_rng: &mut R,
+    ) -> Result<(Self, CS::Group), InternalError> {
+        // Choose a random scalar that must be non-zero
+        let blind = <CS::Group as Group>::random_nonzero_scalar(blinding_factor_rng);
+        let dst = [
+            STR_VOPRF,
+            &<CS::Group as Group>::get_context_string(MODE_BASE)?,
+        ]
+        .concat();
+        let mapped_point = <CS::Group as Group>::map_to_curve::<CS::Hash>(input, &dst)?;
+        let blind_token = mapped_point * &blind;
+        Ok((
+            Self {
+                data: input.to_vec(),
+                blind,
+            },
+            blind_token,
+        ))
+    }
+
+    /// Computes the third step for the multiplicative blinding version of DH-OPRF, in which
+    /// the client unblinds the server's message.
+    pub fn finalize(
+        &self,
+        evaluated_element: CS::Group,
+    ) -> Result<GenericArray<u8, <CS::Hash as Digest>::OutputSize>, InternalError> {
+        let unblinded_element =
+            evaluated_element * &<CS::Group as Group>::scalar_invert(&self.blind);
+        finalize_after_unblind::<CS::Group, CS::Hash>(&self.data, unblinded_element)
+    }
+
+    #[cfg(test)]
+    /// Only used for test functions
+    pub fn from_data_and_blind(data: &[u8], blind: &<CS::Group as Group>::Scalar) -> Self {
+        Self {
+            data: data.to_vec(),
+            blind: blind.clone(),
+        }
+    }
+
+    #[cfg(test)]
+    /// Only used for test functions
+    pub fn get_blind(&self) -> <CS::Group as Group>::Scalar {
+        self.blind
+    }
+}
+
+pub struct Server<CS: CipherSuite> {
+    oprf_key: <CS::Group as Group>::Scalar,
+}
+
+impl<CS: CipherSuite> Server<CS> {
+    pub fn new<R: RngCore + CryptoRng>(rng: &mut R) -> Result<Self, InternalError> {
+        let mut key = vec![0u8; <CS::Hash as Digest>::OutputSize::USIZE];
+        rng.fill_bytes(&mut key);
+        Self::new_with_key(&key)
+    }
+
+    pub fn new_with_key(key: &[u8]) -> Result<Self, InternalError> {
+        Ok(Self {
+            oprf_key: CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?,
+        })
+    }
+
+    /// Computes the second step for the multiplicative blinding version of DH-OPRF. This
+    /// message is sent from the server (who holds the OPRF key) to the client.
+    pub fn evaluate(&self, point: CS::Group) -> CS::Group {
+        point * &self.oprf_key
+    }
+}
+
+fn finalize_after_unblind<G: Group, H: Hash>(
+    input: &[u8],
+    unblinded_element: G,
+) -> Result<GenericArray<u8, <H as Digest>::OutputSize>, InternalError> {
+    let finalize_dst = [STR_VOPRF_FINALIZE, &G::get_context_string(MODE_BASE)?].concat();
+    let hash_input = [
+        serialize(input, 2)?,
+        serialize(&unblinded_element.to_arr().to_vec(), 2)?,
+        serialize(&finalize_dst, 2)?,
+    ]
+    .concat();
+    Ok(<H as Digest>::digest(&hash_input))
+}
+
+///////////
+// Tests //
+// ===== //
+///////////
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::group::Group;
+    use curve25519_dalek::ristretto::RistrettoPoint;
+    use generic_array::{arr, GenericArray};
+    use rand::rngs::OsRng;
+    use sha2::Sha512;
+
+    struct Ristretto255Sha512;
+    impl CipherSuite for Ristretto255Sha512 {
+        type Group = RistrettoPoint;
+        type Hash = Sha512;
+    }
+
+    fn prf(input: &[u8], oprf_key: &[u8]) -> GenericArray<u8, <Sha512 as Digest>::OutputSize> {
+        let dst = [
+            STR_VOPRF,
+            &RistrettoPoint::get_context_string(MODE_BASE).unwrap(),
+        ]
+        .concat();
+        let point = RistrettoPoint::map_to_curve::<Sha512>(input, &dst).unwrap();
+        let scalar =
+            RistrettoPoint::from_scalar_slice(GenericArray::from_slice(&oprf_key[..])).unwrap();
+        let res = point * scalar;
+
+        finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, res).unwrap()
+    }
+
+    #[test]
+    fn oprf_retrieval() {
+        let input = b"hunter2";
+        let mut rng = OsRng;
+        let (client, alpha) = Client::<Ristretto255Sha512>::blind(&input[..], &mut rng).unwrap();
+        let oprf_key_bytes = arr![
+            u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
+            24, 25, 26, 27, 28, 29, 30, 31, 32,
+        ];
+        let server = Server::<Ristretto255Sha512>::new_with_key(&oprf_key_bytes).unwrap();
+        let beta = server.evaluate(alpha);
+        let res = client.finalize(beta).unwrap();
+        let res2 = prf(&input[..], &oprf_key_bytes);
+        assert_eq!(res, res2);
+    }
+
+    #[test]
+    fn oprf_inversion_unsalted() {
+        let mut rng = OsRng;
+        let mut input = alloc::vec![0u8; 64];
+        rng.fill_bytes(&mut input);
+        let (client, alpha) = Client::<Ristretto255Sha512>::blind(&input, &mut rng).unwrap();
+        let res = client.finalize(alpha).unwrap();
+
+        let dst = [
+            STR_VOPRF,
+            &RistrettoPoint::get_context_string(MODE_BASE).unwrap(),
+        ]
+        .concat();
+        let point = RistrettoPoint::map_to_curve::<Sha512>(&input, &dst).unwrap();
+        let res2 = finalize_after_unblind::<RistrettoPoint, sha2::Sha512>(&input, point).unwrap();
+
+        assert_eq!(res, res2);
+    }
+}