From fa2d8ec19113c8988b436a95e26c36ee01f53611 Mon Sep 17 00:00:00 2001 From: Kevin Lewi Date: Wed, 15 Sep 2021 17:49:31 -0700 Subject: [PATCH] Adding serialization and docs (#6) --- Cargo.toml | 1 + src/ciphersuite.rs | 26 +- src/lib.rs | 10 +- src/serialization.rs | 176 ++++++- src/tests/mod.rs | 1 + src/tests/voprf_test_vectors.rs | 787 +++----------------------------- src/tests/voprf_vectors.rs | 640 ++++++++++++++++++++++++++ src/voprf.rs | 386 +++++++++------- 8 files changed, 1120 insertions(+), 907 deletions(-) create mode 100644 src/tests/voprf_vectors.rs diff --git a/Cargo.toml b/Cargo.toml index c37ce79..7320c69 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -33,6 +33,7 @@ p256_ = { package = "p256", version = "0.9", default-features = false, features rand = { version = "0.8", default-features = false } subtle = { version = "2.3", default-features = false } zeroize = { version = "1", features = ["zeroize_derive"] } +serde = { version = "1", default-features = false, features = ["alloc", "derive"] } [target.'cfg(target_arch = "wasm32")'.dependencies] getrandom = { version = "0.2", features = ["js"], optional = true } diff --git a/src/ciphersuite.rs b/src/ciphersuite.rs index 133e65d..0d861a9 100644 --- a/src/ciphersuite.rs +++ b/src/ciphersuite.rs @@ -5,33 +5,11 @@ //! Defines the CipherSuite trait to specify the underlying primitives for VOPRF -use crate::{errors::InternalError, group::Group, hash::Hash}; - -static STR_VOPRF: &[u8] = b"VOPRF07-"; - -pub enum Mode { - Base = 0, - Verifiable = 1, -} - /// Configures the underlying primitives used in VOPRF pub trait CipherSuite { /// A finite cyclic group along with a point representation that allows some /// customization on how to hash an input to a curve point. See `group::Group`. - type Group: Group; + type Group: crate::group::Group; /// The main hash function to use (for HKDF computations and hashing transcripts). - type Hash: Hash; - - /// Generates the contextString parameter as defined in - /// - fn get_context_string(mode: Mode) -> Result, InternalError> { - use crate::serialization::i2osp; - - Ok([ - STR_VOPRF, - &i2osp(mode as usize, 1)?, - &i2osp(Self::Group::SUITE_ID, 2)?, - ] - .concat()) - } + type Hash: crate::hash::Hash; } diff --git a/src/lib.rs b/src/lib.rs index 9e75d3a..063c5ba 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -3,7 +3,15 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. -// #![cfg_attr(not(feature = "bench"), deny(missing_docs))] +//! An implementation of a verifiable oblivious pseudorandom function (VOPRF) +//! +//! Note: This implementation is in sync with +//! [draft-irtf-cfrg-opaque-07](https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-07.html), +//! but this specification is subject to change, until the final version published by the IETF. +//! +//! + +#![cfg_attr(not(feature = "bench"), deny(missing_docs))] #![deny(unsafe_code)] #![cfg_attr(not(feature = "std"), no_std)] diff --git a/src/serialization.rs b/src/serialization.rs index 0333eec..072157b 100644 --- a/src/serialization.rs +++ b/src/serialization.rs @@ -3,8 +3,182 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. -use crate::errors::InternalError; +//! Handles the serialization of each of the components used +//! in the VOPRF protocol + +use crate::{ + ciphersuite::CipherSuite, + errors::InternalError, + group::Group, + voprf::{ + BlindedElement, EvaluationElement, NonVerifiableClient, NonVerifiableServer, Proof, + VerifiableClient, VerifiableServer, + }, +}; use alloc::vec::Vec; +use generic_array::{typenum::Unsigned, GenericArray}; + +////////////////////////////////////////////////////////// +// Serialization and Deserialization for High-Level API // +// ==================================================== // +////////////////////////////////////////////////////////// + +impl NonVerifiableClient { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + [ + CS::Group::scalar_as_bytes(self.blind).to_vec(), + self.data.clone(), + ] + .concat() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::USIZE; + if input.len() < scalar_len { + return Err(InternalError::SizeError); + } + + let blind = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?; + let data = input[scalar_len..].to_vec(); + + Ok(Self { blind, data }) + } +} + +impl VerifiableClient { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + [ + CS::Group::scalar_as_bytes(self.blind).to_vec(), + self.blinded_element.to_arr().to_vec(), + self.data.clone(), + ] + .concat() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::USIZE; + let elem_len = ::ElemLen::USIZE; + if input.len() < scalar_len + elem_len { + return Err(InternalError::SizeError); + } + + let blind = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?; + let blinded_element = CS::Group::from_element_slice(GenericArray::from_slice( + &input[scalar_len..scalar_len + elem_len], + ))?; + let data = input[scalar_len + elem_len..].to_vec(); + + Ok(Self { + blind, + blinded_element, + data, + }) + } +} + +impl NonVerifiableServer { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + CS::Group::scalar_as_bytes(self.sk).to_vec() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::USIZE; + if input.len() != scalar_len { + return Err(InternalError::SizeError); + } + + let sk = CS::Group::from_scalar_slice(GenericArray::from_slice(input))?; + + Ok(Self { sk }) + } +} + +impl VerifiableServer { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + [ + CS::Group::scalar_as_bytes(self.sk).to_vec(), + self.pk.to_arr().to_vec(), + ] + .concat() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::USIZE; + let elem_len = ::ElemLen::USIZE; + if input.len() != scalar_len + elem_len { + return Err(InternalError::SizeError); + } + + let sk = CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?; + let pk = CS::Group::from_element_slice(GenericArray::from_slice(&input[scalar_len..]))?; + + Ok(Self { sk, pk }) + } +} + +impl Proof { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + [ + CS::Group::scalar_as_bytes(self.c_scalar), + CS::Group::scalar_as_bytes(self.s_scalar), + ] + .concat() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + let scalar_len = ::ScalarLen::USIZE; + if input.len() < scalar_len + scalar_len { + return Err(InternalError::SizeError); + } + Ok(Proof { + c_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?, + s_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[scalar_len..]))?, + }) + } +} + +impl BlindedElement { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + self.0.to_arr().to_vec() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + Ok(Self(CS::Group::from_element_slice( + GenericArray::from_slice(input), + )?)) + } +} + +impl EvaluationElement { + /// Serialization into bytes + pub fn serialize(&self) -> Vec { + self.0.to_arr().to_vec() + } + + /// Deserialization from bytes + pub fn deserialize(input: &[u8]) -> Result { + Ok(Self(CS::Group::from_element_slice( + GenericArray::from_slice(input), + )?)) + } +} + +////////////////////// +// Helper Functions // +// ================ // +////////////////////// // Corresponds to the I2OSP() function from RFC8017 pub(crate) fn i2osp(input: usize, length: usize) -> Result, InternalError> { diff --git a/src/tests/mod.rs b/src/tests/mod.rs index 8a8e91b..f21c1b3 100644 --- a/src/tests/mod.rs +++ b/src/tests/mod.rs @@ -6,3 +6,4 @@ mod mock_rng; mod parser; mod voprf_test_vectors; +mod voprf_vectors; diff --git a/src/tests/voprf_test_vectors.rs b/src/tests/voprf_test_vectors.rs index be1f7fb..1c03fa5 100644 --- a/src/tests/voprf_test_vectors.rs +++ b/src/tests/voprf_test_vectors.rs @@ -3,12 +3,15 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. -use crate::ciphersuite::CipherSuite; -use crate::errors::*; -use crate::group::Group; -use crate::tests::{mock_rng::CycleRng, parser::*}; -use crate::voprf::{ - NonVerifiableClient, NonVerifiableServer, Proof, VerifiableClient, VerifiableServer, +use crate::{ + ciphersuite::CipherSuite, + errors::InternalError, + group::Group, + tests::{mock_rng::CycleRng, parser::*}, + voprf::{ + BlindedElement, EvaluationElement, NonVerifiableClient, NonVerifiableServer, Proof, + VerifiableClient, VerifiableServer, + }, }; use alloc::string::ToString; use alloc::vec::Vec; @@ -32,652 +35,40 @@ struct VOPRFTestVectorParameters { output: Vec>, } -static OPRF_TEST_VECTORS: &str = r#" -## OPRF(ristretto255, SHA-512) - -### Base Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1 -701 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf -8e03 -BlindedElement = fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b16 -86c64e07ac467 -EvaluationElement = 922e4c04b9f3b3e795d322a306c0ab9d96b667df9b949c05 -2c8c75435a9dbf2f -Output = 9e857d0e8523b8eb9e995d455ae6ae19f75d85ac8b5df62c50616fb5aa0 -ced3da5646698089c36dead28f9ad8e489fc0ee1c8e168725c38ed50f3783a5c520c -e -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037 -e50b -BlindedElement = 483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de -67ce49e7d1536 -EvaluationElement = 6eef6ee53c6fb17c77ae47e78bdca2e1094f98785e7b9a14 -f09be20797dad656 -Output = b090b2ff80028771c14fecf2f37c1b14e46deec59c83d3b943c51d315bd -3bf7d32c399ed0c4ce6003339ab9ed4ad168bfb595e43530c9d73ff02ab0f1263d93 -b -~~~ - -### Verifiable Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = ac37d5850510299406ea8eb8fa226a7bfc2467a4b070d6c7bf667948b9600 -b00 -pkSm = 0c0254e22063cae3e1bae02fb6fa20882664a117c0278eda6bda3372c0dd9 -860 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = ed8366feb6b1d05d1f46acb727061e43aadfafe9c10e5a64e7518d63e326 -3503 -BlindedElement = 3a0a53f2c57e5ee0d89e394087f8e5f95b24159db01c31933a0 -7f0e6414c954d -EvaluationElement = f8a50ed35a477b0cde91d926e1bc5ae59b97d5bd0dda51a7 -28b0f036ec557d79 -Proof = 7a5375eb1dbad259431f5c294e816a1c1483c279748da1a75d91f8a81438 -ea08355d4087d4d848b46878dcc8fb5849ac7a09133382c2c6129564a7f7b4b7bf01 -ProofRandomScalar = 019cbd1d7420292528f8cdd62f339fdabb602f04a95dac9d -bcec831b8c681a09 -Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d -eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1 -a -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = e6d0f1d89ad552e383d6c6f4e8598cc3037d6e274d22da3089e7afbd4171 -ea02 -BlindedElement = a86dd4544d0f3ea973926054230767dff16016215f2d73f26d3 -f86a81f38cf1a -EvaluationElement = 9e47810f1de1b57ebe163a95c170ec165a2063f872155c37 -6d94e8de2157af70 -Proof = 61075125d851d5164b0aa1a4d5ddeebaf097266450ac6019579af5f7abd1 -90088eb0f6f1e7f9d8bfddbc21ae3c25a065e6c4e797d15f345ed4fb9ee468d24c0a -ProofRandomScalar = 74ae06fd50d5f26c2519bd7b184f45dd3ef2cb50197d42df -9d013f7d6c312a0b -Output = fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f2 -18047d1fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0 -b -~~~ - -#### Test Vector 3, Batch Size 2 - -~~~ -Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 80513e77795feeec6d2c450589b0e1b178febd5c193a9fcba0d27f0a06e0 -d50f,533c2e6d91c934f919ac218973be55ba0d7b234160a0d4cf3bddafbda99e2e0 -c -BlindedElement = c24645d6378a4a86ec4682a8d86f368b1e7db870fd709a45102 -492bcdc17e904,0e5ec78f839a8b6e86999bc180602690a4daae57bf5d7f827f3d40 -2f56cc6c51 -EvaluationElement = 3afe48eab00493eb1b073e95f57a456cde9aefe463dd1e6d -0144bf6e99ce411c,daaf9421318fd2c7fcdf369cb348748cf4dd177cce30ee4d13c -eb1644b85b653 -Proof = 601381ecbe127ada04c057b8b1fc21d912f71e49252780dd0d0ac768b233 -ce035f9b489a994c1d14b92d603ebcffee4f5cfadc953f69bb62648c6e662613ae00 -ProofRandomScalar = 3af5aec325791592eee4a8860522f8444c8e71ac33af5186 -a9706137886dce08 -Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d -eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1 -a,fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f218047d1 -fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b -~~~ - -## OPRF(decaf448, SHAKE-256) - -### Base Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 -skSm = 78f2622804104209f7e015370ff98f4a3cbf311e6784e9f4944f8a252dc08 -e916d9ab1a60dc905f0e56631903ecd4ae6e15291776d61460b -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = d1080372f0fcf8c5eace50914e7127f576725f215cc7c111673c635ce668 -bbbb9b50601ad89b358ab8c23ed0b6c9d040365ec9d060868714 -BlindedElement = 984e0a443ee194090737df4afb402253f216b77650c91d252b6 -638e1179723d51a4154b88eae396f1320f5df3c4b17f779516c456e364bd1 -EvaluationElement = de477252a5ff3c7d51ce159cb8ccf1865d8c7d3402824163 -8d80971f13a59d87b2b1036341b98089555ab088278391794c49bbb052fdbcff -Output = df8f910c3b84d1f3ca6afd1992768608a20f2ad7b770e9d89d303c88ba1 -5bb7d991f2f7ffd5b5b51fa3bcf8fa06779609497f6c0ae4e9cb2dcd48c68b4ac6b9 -4 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = aed1ffa44fd8f0ed16373606a3cf7df589cca86d8ea1abbf5768771dbef3 -d401c74ae55ba1e28b9565e1e4018eb261a14134a4ce60c1c718 -BlindedElement = 4aa751f84b2634b73efa364b03e60b92b84f457576e6b369eea -b76140e3859d10d2e98174f13f5a2c70670529ccf093d5f1aaf355b4f830b -EvaluationElement = 085ea1cb452a2fb15b3a0d0e1c86899c7ea49fe2e4856ef4 -f95bc2542eec610fc09b0fe7d7ed7389d86af6a646695b7ad46527dc2a936aa4 -Output = b57516a737879ece1110ad5d051ac0a6c54e1dcd989c907721ecebab5b4 -5877cc693c3c05d0bd416c5a9ceba36de41a0a31679c146fe4c110c64b056eba1720 -b -~~~ - -### Verifiable Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 -skSm = 9eb722f7fee9f61f24ad31bc42309f73648cf4393929e8f5f333fe10c6975 -c827a1eba4e03ae2fa8735db2f63f6c98c7af6010e64c81f535 -pkSm = b6e2751176d57836fe1dfbdbbdc78a1b5c5a52f831226c9d8dfdf5daf8f46 -6e310e80978e9b81c387f5bc85cc7ef5567f4dd3ba7674579a2 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 4c936db1779a621b6c71475ac3111fd5703a59b713929f36dfd1e892a7fe -814479c93d8b4b6e11d1f6fe5351e51457b665fa7b76074e531f -BlindedElement = d0b8e2eecad2816d45c1f8a072fe6db77d18f4b26f0889c98e2 -ef856ac5df82090c1fbeac9c8e732f192b66c3b4c3f1e446ab8910c86be2f -EvaluationElement = d29849d8ad1e651328e8119003debd9ecd54cc786a5eb8ae -ea56487ffc09120e98792f9475605488d16623b8e3cfa5af1ec27e76bc841b75 -Proof = 8b3b8f0c9eb22527e419f5a03d4d3f34cf725837424a38c5b4f88c7759f7 -a54bade57b7930bfeff051be9bfeaabc8976ed407398e0ce462a062e068a8d57bc1c -411bc42fe714626cfb92ad854a56636c2b83f2b5215c2ff531b22e4d37031523db20 -3556959e275b46b84303ed23fc37 -ProofRandomScalar = 1b3f5a55b2f18f8c53d4ecf2e1c27e1028f1c345bb504486 -4aa9dd8439d7520a7ba6183d50ef08bdf6c781aa465660c93e8195a8d231b62f -Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93 -9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153 -d -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 15b3355179392f40c3d5a15f0d5ffc354e340454ec779f575e4573a3886a -b5e57e4da2985cea9e32f6d95539ce2c7189e1bd7462e8c5483a -BlindedElement = 0e7ddd85c8bc5382e908241c6151afe23a41e0396759b5e38a9 -affd996cd822bca242a499793555fc15f07bffdaaa93b42568b307fbdca0f -EvaluationElement = 4c81e29e8a9502fa02e00cb09cf40d9b98988ac9b4bce7cc -a0656caeb0926b59c7000d7fe6c5dd814f831864547d2360d223a50077bd04fe -Proof = 74fc8fbf2e669dc5d25898ea8ce45d1d3eb97edb4b7c3cee39865a3c66da -6b7bad4ad3e77794d6f5e82fa8a645b9b973a8612bfcd1194302f700ee3433e876d8 -3f96bb70f19ff292605ad4c9466fd71dbc2ed22ade0130574e5ee343ef45d42e834a -11a19fd6f5b1b5ef910bcccf731b -ProofRandomScalar = 2f2e9955be83a4b25743ebd3618d4fad8b7288477da50bed -9befa58af639ddd950fec34205f8a4f166fadcb8fa71a3ffdd2e98f4c8ef5e26 -Output = 2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c -07f59055e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f -9 -~~~ - -#### Test Vector 3, Batch Size 2 - -~~~ -Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 614bb578f29cc677ea9e7aea3e4839413997e020f9377b63c13584156a09 -a46dd2a425c41eac0e313a47e99d05df72c6e1d58e6592577a0d,4c115060bca87db -7d73e00cbb8559f84cb7a221b235b0950a0ab553f03f10e1386abe954011b7da62bb -6599418ef90b5d4ea98cc28aff517 -BlindedElement = 5e481a4d7eaa5bab831f53f9a6311851dafd4318c6462eed4f6 -15004afdb082da2f99670b0963985faac21c30eea19aacfc441412edb4c0b,8e043b -9b7afeafa07e39d9b8b88957ff07d69124b1a2b841e18c9ffb52ebf0c25144eb2501 -a1d7983a44604f33a36e925eebc9bec65d9c54 -EvaluationElement = 8a0d34fdb0b55121421546ff952c7bd3cbe469926ff9ad4f -aeba243823955529eeae4f1a7a64cd055ec01baa041a99dfbe1a67ca4d59f93d,5e8 -6e0b41cc88186ee0003baa46535e71acd98453b298976b92be2cca2646e88620f55d -f6bf4754456dfd8d84f6889c17b5ff93052325a1a -Proof = 1ff624a102b99771c76a9414e9b3f33127897d971bc84a922e464805e4a9 -f27b889922030adebbbd58e0ab618ade9c84bfe8aa226176f11f432958ea1e6f6926 -3aef51db9efb23ee504d233c17e9077c0373401da167637a1df4eafd9c2537c9f89c -103f9e635931fe2042419dd9bd37 -ProofRandomScalar = a614f1894bcf6a1c7cef33909b794fe6e69a642b20f4c911 -8febffaf6b6a31471fe7794aa77ced123f07e56cc27de60b0ab106c0b8eab127 -Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93 -9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153 -d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905 -5e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f9 -~~~ - -## OPRF(P-256, SHA-256) - -### Base Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a78 -27b -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98a -f0d0 -BlindedElement = 03e3c379698da853d9844098fa0ac676970d5ec24167b598714 -cd2ee188604ddd2 -EvaluationElement = 030d8d882120e8fa67ef978a9abac506acd5ec731b8e8d6f -15035e29241dd2ced2 -Output = ab653a4f3b357177b125e1c6d0bd2c0bc409b7ed5f48c99537fbd7fd11e -f8133 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5 -fcbe -BlindedElement = 030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c -51608f372a02102 -EvaluationElement = 03991df04e3e526d457065b6eafc855aa2fc4528c22d2b51 -6a3c71227b1b488f44 -Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2 -13e6e -~~~ - -### Verifiable Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = 4e7804245a743c59d624457677294e04a8bc4bdcd94f0d3bd54f568067489 -d34 -pkSm = 03b51a0af95c819b09ee80c2056cf0ab0551a5355266d3a0aaff90c3fe915 -ed892 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = cee64d86fd20ab4caa264a26c0e3d42fb773b3173ba76f9588c9b14779bd -8d91 -BlindedElement = 0222f5dba2da1ec7bd1086d0e04894ef1da1c11163daf376b2b -c76cc51edb16815 -EvaluationElement = 02f2767135f75f69b257675b38f2bcd50338a655a5092166 -3c8942ca61ea7d3c29 -Proof = ffa082fc9f9a287e7edc50e3ad879ee13aebd24b69124792bdf047c643f7 -0af2b50907b2fa188b90aff3b25e1d9abb02e9e2c8bfdc525c61ca008428940fca64 -ProofRandomScalar = 70a5204b2b606f5a28328916e1e5ea5a17862d7a261fdd6d -959759758d5e34ac -Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8 -94448 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 5c4b401063eff0bf242b4cd534a79bacfc2e715b2db1e7a3ad4ff8af1b24 -daa2 -BlindedElement = 02f84403d1ceb40a3668349f7c349f806d2c858785853324c66 -7505018d13ee160 -EvaluationElement = 0216d7d342ef50113244b444dfedaec78810959e40fef0a6 -922658d44accb1e9c1 -Proof = f496e58818c25ffb386f22ceb57a83da1200612b67aaa07608b3375c25b2 -97e03e67d1f6094a8012725dc63a0c2f4f870173b97a3daa03588f777655a087fbbf -ProofRandomScalar = 3b9217801b5d51cef66d9fdbd94a53533e7c5057e09e2200 -65ea8c257c0dd606 -Output = 90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b9 -2fe28 -~~~ - -#### Test Vector 3, Batch Size 2 - -~~~ -Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = f0c7822ba317fb5e86028c44b92bd3aedcf6744d388ca013ef33edd36930 -4eda,3b9631be9f8b274d9aaf671bfb6a775229bf435021b89c683259773bc686956 -b -BlindedElement = 02a840214a74345570dcadfc927e726901b257b447234fac509 -0a1830295ca736c,039a5a8152abb0154b4d79a90486e358ea325980f0bf590524c4 -460f700454238f -EvaluationElement = 025991aac0b0c79bb1185c0b1e64964656634dfcd755cdf5 -da9ee52be0b5d5f742,03319e3baba8fa7f60dab49ef0ba68b7a85bccb5d4968643e -2f029b6c0826911d1 -Proof = 51b5ed453168480a2e95863cda1f4d28ad5bc91e8c9c75d788569aea1679 -794a642087db120a2b3ce839f57041801f37cd4a6c05b69b327b877810293f7b09a8 -ProofRandomScalar = 8306b863276ae74049615162a416d507a6532c99c1ea3f03 -d05f6e78dc1edabe -Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8 -94448,90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b92fe -28 -~~~ - -## OPRF(P-384, SHA-512) - -### Base Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 -skSm = ef1b52c12cdf43dc260bf5425a30cde7d708ec34b38dcfbdc2946d7baf525 -361e797f6a98f1ebd80f64865f21cde1c6d -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 359073c015b92d15450f7fb395bf52c6ea98384c491fe4e4d423b59de7b0 -df382902c13bdc9993d3717bda68fc080b99 -BlindedElement = 02fa3115c21ffcacc09ca470729b725781f84333e217cfeec2b -8ba6a54ce492ede7ead3714c5b177427ef853effb1b5c24 -EvaluationElement = 033a4bdea2693686e4ce467c8a5cdfc41b86ad20aaaa9bc1 -6e75b59dbd41dab0bc9af0041e551ece3b4c9fb2315d8d1fa9 -Output = a5a0ef3fb964a36097662d1258ef0f93b224ddd81a356c37d5dd05a885a -0b6722b90c1f5181637fece7ed180ba053da23bf35cef7a87dcba75562cb7a264001 -8 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 21ece4f9b6ffd01ce82082545413bd9bb5e8f3c63b86ae88d9ce0530b01c -b1c23382c7ec9bdd6e75898e4877d8e2bc17 -BlindedElement = 025fddc89a832089a59120df742acb34dba82b26afcae977961 -57df238b5905c494a23c56b1f485cbbff78d31df7fa1492 -EvaluationElement = 02f8b59813663e7965c219c113c560482cbea7ca4c412a0c -f3fd855ee7d543ae926d29ace85296f195f988be284b2347f6 -Output = f2a0b355cae4ae2c717d0b48e39c0ee356db3ca446fddf85cddb74f397e -b85046da62d0d85d55d19d39dd9b68fcc39379ec6d3b93ba33909fcc96361d225cdd -e -~~~ - -### Verifiable Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 -skSm = 67ee1c9e67566d87bfcca9e5dac4bfdb8bdd727c031133fac2aa9ba6c41e6 -1e5f8fd401b5d76c7d54b15b15932797479 -pkSm = 029b51b2ce9c499f2056e65e0f41d60960f9c4795c0cf94af273ce840c20b -e4cdf87690b6b121b37d399b49afcc2ec9ac3 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 102f6338df84c9602bfa9e7d690b1f7a173d07e6d54a419db4a6308f8b09 -589e4283efb9cd1ee4061c6bf884e60a8774 -BlindedElement = 02a1f41323e91a6ac9fbbb5b8e4c7c58a4c5bcbaa4195557182 -cd59e826dc847f1e077de1d402ac92eafe322461fc0d582 -EvaluationElement = 03af3164f8721a57931f92884b43c58ff0ed1be249f7e1c9 -3033a5909f0ffc59ed3fea9452ec5c9cfb865b8bd2e65cd209 -Proof = 44108ca9b342f4d7e31a250aa9f41afb0de840e113dbb6bb82b5e6735aef -18a20867a63628be6e109d2d687e1faa8888270f1173bc6f916e21142096d23d1719 -4edf844074922c287a50182f87bbb5fc3a966c8851dd6799ec5cfe59c7063c7f -ProofRandomScalar = 90f67cafc0ffaa7a1e1d1ced3c477fea691e696032c8709c -86cbcda2b184ad0029d29abeabede9788d11782429bff297 -Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51 -eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe -0 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 8aec1d0c3d16afd032da7ba961449a56cec6fb918e932b06d5778ac7f67b -ecfb3e3869237f74106241777f230582e84a -BlindedElement = 02b3465d70f76de3eaf6ecb8080490288f741c622c06d023bd1 -80a55a2e3e4eaad08533651f9d278a3f59cec8277780303 -EvaluationElement = 03a53e01901893585437cd48a1eea1188fc8e9275a80cf43 -370a451c476dae3b84ca8c7bf44fcac2fa3eeab933b25da0c3 -Proof = 5ebc467e78ae29f7d741221df0ee67285df72ec482fdc8e5bde7e588b12f -cba86f4f116c23ee6b32c0f38f2daac67e869e53e7e0494cc883e4984daf10a55819 -bbb5ce7e9005f143b3dda88d8a35649269a4658a98c81c814097d15a3dcf4dbe -ProofRandomScalar = bb1876a7f7165ac7ec79bfd5213ea2e374252f29a6e19915 -f81b0c7dcea93ce6580e089ede31c1b6b5b33494581b4868 -Output = 5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920 -267a40b246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92 -c -~~~ - -#### Test Vector 3, Batch Size 2 - -~~~ -Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 41fabd4722d92472d858051ce9ad1a533176a862c697b2c392aff2aeb77e -b20c2ae6ba52fe31e13e03bf1d9f39878b23,51171628f1d28bb7402ca4aea6465e2 -67b7f977a1fb71593281099ef2625644aee0b6c5f5e6e01a2b052b3bd4caf539b -BlindedElement = 02d715dfce1a0724071fa8e530d79f7b234a31739a64166e0fe -21fa6fa0fe19e1ab5e468becca899f31e365c47f3efb2ef,028dfd0c7a38b4cb8477 -cae34f041344fb44fc9e55bfa3cf55ab7b4764b74accc7b49c0ff09a524598033dad -1152fb3a1c -EvaluationElement = 03f9a8c81c108201888eb86348c6f80691d99425272972b5 -bf41d3038af0eeb04d60edd9ea288625a7166a8c17cea0083f,02abb31980533dbf7 -eb5fee0a8969089b3e16585a2cd41a34067592a2021b1b4ea3d1cef3e7c87a6f284c -0e45546c92d98 -Proof = f0f7bd2723c3460d5c5ab03092c6861fb34253470ef430dac9aeac6ce489 -84b28d91178061cba02e3e911c4aa97229d519755db385ddd08064fdf8405897d1de -a472688934088505e89dcff91081fec1d2e37c1d4c5a9dddbdd358aa89f63b46 -ProofRandomScalar = 1b538ff23749be19e92df82df1acd3f606cc9faa9dc7ab25 -1997738a3a232f352c2059c25684e6ccea420f8d0c793fa0 -Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51 -eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe -0,5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920267a40b -246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92c -~~~ - -## OPRF(P-521, SHA-512) - -### Base Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = 016ee706f30ce7e15e4ffa3114c7d59a7b6f302d531ca60419be39d1cd43e -e13b1fc8398b7f63a900cdc49c6e99f65a74403db2fa739927a2ee288cff857d9d84 -ecf -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 01b983705fcc9a39607288b935b0797ac6b3c4b2e848823ac9ae16b3a3b5 -816be03432370deb7c3c17d9fc7cb4e0ce646e04e42d638e0fa7a434ed340772a8b5 -d626 -BlindedElement = 0301f0a8c68e58f5571bd39fe3b0b2aa055a8c34e3d68ba0d2e -d177db0bc7575d477ed8f557596feb5ac568fe738eee8cff7dcb56dc78f52bf381c0 -912e0e84b5a3f5b -EvaluationElement = 0200d7b1131aa9f8c365de7bd7903738f61bdecfaada375a -ba3905bdaad1301c7cd537f69abff04140ccca29a4c46cb4a036160e55a9621210b3 -71d84646b0199571fa -Output = 61eea8fedfa9338dd22fac279f1f3f9e96693919c59ea3918c7a441115e -6bdecb1d05b5da55d4024858c92d3911a81d4eca362123b2911e5dc58591bf7be29c -7 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 01a03b1096b0316bc8567c89bd70267d35c8ddcb2be2cdc867089a2eb5cf -471b1e6eb4b043b9644c8539857abe3a2022e9c9fd6a1695bbabe8add48bcd149ff3 -b841 -BlindedElement = 030099c35342a43221c6e03debfb17bad71b62e04c9242aa6e9 -f2f915163ef4f5b8b7fe1740a4d636c36bd5c73ca39c69992dc7f6dff8f232125efc -22af4df8352fea2 -EvaluationElement = 0300ceeba6751486eecc479ab2259e3a57c13b0710f61c82 -87acad60624974b76ea242dbcae3a9daad1bdc9c49012c8d8b384d510980cc1ef8fa -8d10502748ce63d93f -Output = 6682273a5199b2454a706cac557008e2264580ac39b6995e1f47130b985 -d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de -3 -~~~ - -### Verifiable Mode - -~~~ -seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a -3a3 -skSm = 0017674057e06c5e3e8a331f2dc3558540701c9cd0f4c19126d5972af6a01 -447b312d05a06dab3e9e07c891d749444c27ede0897ad42aea03b887eb5db93e3f29 -a86 -pkSm = 0201ee4e2eaa74728f577f4bb282c5440cd454fdee1d79b15a36d34b5e5a1 -25e3ccc0f99e32cc0a6a15b5652a0c8a424860c6753f685d0e1e150ceba24ca3386f -29216 -~~~ - -#### Test Vector 1, Batch Size 1 - -~~~ -Input = 00 -Info = 7465737420696e666f -Blind = 00bbb82117c88bbd91b8954e16c0b9ceed3ce992b198be1ebfba9ba970db -d75beefbfc6d056b7f7ba1ef79f4facbf2d912c26ce2ecc5bb8d66419b379952e96b -d6f5 -BlindedElement = 0200357f949a0a0bdfeb682734dbdeb778f3845045617b21436 -27753332e2e75458ab183b12635c75e19afaf56981e7755803026842db1b22fa42c8 -61413d07ff86545 -EvaluationElement = 0201d636bac3f77c1091b337daae32259a3eacd57e3c0fb1 -444fe5ce22af6acdcef4a46a2b5e169aa8d0e26ec2a3621c15dd366ba1978dae761c -1ef3dac63c60cbee88 -Proof = 011ebe27ebc79e5679b643c6b3a51333499c7abee86c092181c0a8e7e539 -e0ba30b1c128666708c753696ace2aa789c4975b0b80d6241a1dafe85c39a7338d1e -20d00131c8a81b5f64209f8fe53e8c6a00789a893f20596198e2521275e05d925298 -08e9f54030fc8be2ce78c6df0d29e6fd7d8e623e0ccc7b19b194493dacd2a4eb3a32 -ProofRandomScalar = 00ce4f0d824939827888f4c28773466f3c0a05741260040b -c9f302a4fea13f1d8f2f6b92a02a32d5eb06f81de7960470f06169bee12cf47965b7 -2a59946ca3879670 -Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8 -79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29 -5 -~~~ - -#### Test Vector 2, Batch Size 1 - -~~~ -Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 009055c99bf9591cb0eab2a72d044c05ca2cc2ef9b609a38546f74b6d688 -f70cf205f782fa11a0d61b2f5a8a2a1143368327f3077c68a1545e9aafbba6a90dc0 -d40a -BlindedElement = 030185e431f056e75ba7fac49da70790031daa333d16f05e1de -471e24afe0ed985c770ce77bd1bebec527e9a76feecc6afd92c5fd00481ba7fb843d -2aab52337cb716e -EvaluationElement = 02000859e1abc2ed28086b854ec5ae72311244fdeedf81d7 -69af6a6f2c83f00fa48df1f1a0c0b6fac84cc654b7757ac042107a6b3043e483bb3b -74de5d6c301b20e8f6 -Proof = 01629dd5af14c7414801d879b1018ce06bcc5c5d0a64ca422b76aaa531c8 -ecca630919fb4b51fa60fdc215f73e67e8d617d55ca6a227343d434d5e0f487567f8 -5bfa016959443267bb7d9a5c5e5b1c4d20026394b4edaca7dfbc1aa3b3c2020cf995 -79cf276c0e84f0cb5a820226fa3b81d42de2db39d8412642e70428e485a61ee9d760 -ProofRandomScalar = 00b5dfc19eb96faba6382ec845097904db87240b9dd47b1e -487ec625f11a7ba2cc3de74c5078a81806f74dd65065273c5bd886c7f87ff8c5f39f -90320718eff747e3 -Output = 7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d -1b2e936669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c13011057 -1 -~~~ - -#### Test Vector 3, Batch Size 2 - -~~~ -Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a -Info = 7465737420696e666f -Blind = 01c6cf092d80c7cf2cb55388d899515238094c800bdd9c65f71780ba85f5 -ae9b4703e17e559ca3ccd1944f9a70536c175f11a827452672b60d4e9f89eba28104 -6e29,00cba1ba1a337759061965a423d9d3d6e1e1006dc8984ad28a4c93ecfc36fc2 -171046b3c4284855cfa2434ed98db9e68a597db2c14728fade716a6a82d600444b26 -e -BlindedElement = 0301978860af75cd69acbc93e8c9fc530e5d2b2208da42c65bf -e079f0f6e0b3fc6080556c10739271d2a8fe578409d4fa9b19ef0484d9c15451c4e7 -0501e31da7608cb,0200e30565c3d7e02c822762f25db4c872811adb2cbfbad92b04 -291bc8c476d0546d1c5ecf5c58ff06b8d19aad8eca9e5f1a80ff8e981ebc490b0cfb -d5d499b47bad8e -EvaluationElement = 0300abdee910f144c3be460e724c11626e1f9986f72e2c43 -3a9c4dad2ef6fcb9249c9a5036334ba88b0892462b6f8ad419c38cc259b0c774a9bd -0c4d545d0914413ea2,02019696f91dcc178bbe6b97f822cdc4052f9b94852ff6023 -f6068848f867df40e54a5f1525e7fafa383e82fe36bf3c74427b51903032d0f89876 -05bf24ee003f37693 -Proof = 008fa896b69c1efc4e9c6bdfd0b149444532d5ba3bfd957cf7cd71c374d3 -a1cca25f17b60616164377b0734243bc878e17d3ecab36b3e3565b5c6218dae92d40 -c0be018707381f6f4b0153044737030b5d9851c15609532da8932c1fa1f4901dba05 -a4118d25142344f9ea1465c907eb13d908a45d8b98265eac48819a04cae859b0643a -ProofRandomScalar = 00d47b0d4ca4c64825ba085de242042b84d9ebe3b2e9de07 -678ff96713dfe16f40f2c662a56ed2db95e1e7bf2dea02bd1fa76e953a630772f68b -53baade9962d1646 -Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8 -79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29 -5,7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d1b2e936 -669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c130110571 -~~~ -"#; - -macro_rules! parse { - ( $v:ident, $s:expr ) => { - parse_default!($v, $s, vec![]) - }; +fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters { + VOPRFTestVectorParameters { + seed: decode(values, "seed"), + sksm: decode(values, "skSm"), + pksm: decode(values, "pkSm"), + input: decode_vec(&values, "Input"), + info: decode(values, "Info"), + blind: decode_vec(&values, "Blind"), + blinded_element: decode_vec(&values, "BlindedElement"), + evaluation_element: decode_vec(&values, "EvaluationElement"), + proof: decode(values, "Proof"), + proof_random_scalar: decode(values, "ProofRandomScalar"), + output: decode_vec(&values, "Output"), + } } -macro_rules! parse_default { - ( $v:ident, $s:expr, $d:expr ) => { - match decode(&$v, $s) { - Some(x) => x, - None => $d, - } +fn decode(values: &JsonValue, key: &str) -> Vec { + values[key] + .as_str() + .and_then(|s| hex::decode(&s.to_string()).ok()) + .unwrap_or(vec![]) +} + +fn decode_vec(values: &JsonValue, key: &str) -> Vec> { + let s = values[key].as_str().unwrap(); + let res = match s.contains(',') { + true => Some( + s.split(',') + .map(|x| hex::decode(&x.to_string()).unwrap()) + .collect(), + ), + false => Some(vec![hex::decode(&s.to_string()).unwrap()]), }; + res.unwrap() } macro_rules! json_to_test_vectors { @@ -690,54 +81,15 @@ macro_rules! json_to_test_vectors { } #[test] -fn test_print_json() -> () { - let json = rfc_to_json(OPRF_TEST_VECTORS); - println!("{}", &json); -} - -fn decode(values: &JsonValue, key: &str) -> Option> { - values[key] - .as_str() - .and_then(|s| hex::decode(&s.to_string()).ok()) -} - -fn decode_vec(values: &JsonValue, key: &str) -> Option>> { - let s = values[key].as_str().unwrap(); - match s.contains(',') { - true => Some( - s.split(',') - .map(|x| hex::decode(&x.to_string()).unwrap()) - .collect(), - ), - false => Some(vec![hex::decode(&s.to_string()).unwrap()]), - } -} - -fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters { - VOPRFTestVectorParameters { - seed: decode(&values, "seed").unwrap(), - sksm: decode(&values, "skSm").unwrap(), - pksm: parse!(values, "pkSm"), - input: decode_vec(&values, "Input").unwrap(), - info: parse!(values, "Info"), - blind: decode_vec(&values, "Blind").unwrap(), - blinded_element: decode_vec(&values, "BlindedElement").unwrap(), - evaluation_element: decode_vec(&values, "EvaluationElement").unwrap(), - proof: parse!(values, "Proof"), - proof_random_scalar: parse!(values, "ProofRandomScalar"), - output: decode_vec(&values, "Output").unwrap(), - } -} - -#[test] -fn tests() -> Result<(), InternalError> { +fn test_vectors() -> Result<(), InternalError> { struct Ristretto255Sha512; impl CipherSuite for Ristretto255Sha512 { type Group = RistrettoPoint; type Hash = Sha512; } - let rfc = json::parse(rfc_to_json(OPRF_TEST_VECTORS).as_str()).expect("Could not parse json"); + let rfc = json::parse(rfc_to_json(super::voprf_vectors::VECTORS).as_str()) + .expect("Could not parse json"); let ristretto_base_tvs = json_to_test_vectors!( rfc, @@ -835,10 +187,7 @@ fn test_base_blind( ¶meters.blind[i], &CS::Group::scalar_as_bytes(client.get_blind()).to_vec() ); - assert_eq!( - ¶meters.blinded_element[i], - &blinded_element.to_arr().to_vec() - ); + assert_eq!(¶meters.blinded_element[i], &blinded_element.serialize()); } } Ok(()) @@ -858,10 +207,7 @@ fn test_verifiable_blind( ¶meters.blind[i], &CS::Group::scalar_as_bytes(client.get_blind()).to_vec() ); - assert_eq!( - ¶meters.blinded_element[i], - &blinded_element.to_arr().to_vec() - ); + assert_eq!(¶meters.blinded_element[i], &blinded_element.serialize()); } } Ok(()) @@ -873,18 +219,15 @@ fn test_base_evaluate( ) -> Result<(), InternalError> { for parameters in tvs { for i in 0..parameters.input.len() { - let server = NonVerifiableServer::::new_with_key(¶meters.sksm).unwrap(); + let server = NonVerifiableServer::::new_with_key(¶meters.sksm)?; let evaluation_element = server.evaluate( - CS::Group::from_element_slice(GenericArray::from_slice( - ¶meters.blinded_element[i], - )) - .unwrap(), + BlindedElement::deserialize(¶meters.blinded_element[i])?, ¶meters.info, )?; assert_eq!( ¶meters.evaluation_element[i], - &evaluation_element.to_arr().to_vec() + &evaluation_element.serialize() ); } } @@ -896,21 +239,20 @@ fn test_verifiable_evaluate( ) -> Result<(), InternalError> { for parameters in tvs { let mut rng = CycleRng::new(parameters.proof_random_scalar.clone()); - let server = VerifiableServer::::new_with_key(¶meters.sksm).unwrap(); - let (evaluation_elements, proof) = server.batch_evaluate( - &mut rng, - ¶meters - .blinded_element - .iter() - .map(|x| CS::Group::from_element_slice(GenericArray::from_slice(&x)).unwrap()) - .collect::>(), - ¶meters.info, - )?; + let server = VerifiableServer::::new_with_key(¶meters.sksm)?; + + let mut blinded_elements = vec![]; + for blinded_element_bytes in ¶meters.blinded_element { + blinded_elements.push(BlindedElement::deserialize(&blinded_element_bytes)?); + } + + let (evaluation_elements, proof) = + server.batch_evaluate(&mut rng, &blinded_elements, ¶meters.info)?; for i in 0..parameters.evaluation_element.len() { assert_eq!( ¶meters.evaluation_element[i], - &evaluation_elements[i].to_arr().to_vec(), + &evaluation_elements[i].serialize(), ); } @@ -929,14 +271,11 @@ fn test_base_finalize( ¶meters.input[i], &::from_scalar_slice(&GenericArray::clone_from_slice( ¶meters.blind[i], - )) - .unwrap(), + ))?, ); let output = client.finalize( - ::from_element_slice(GenericArray::from_slice( - ¶meters.evaluation_element[i], - ))?, + EvaluationElement::deserialize(¶meters.evaluation_element[i])?, ¶meters.info, )?; @@ -967,10 +306,8 @@ fn test_verifiable_finalize( } for i in 0..parameters.input.len() { - let evaluation_element = ::from_element_slice( - GenericArray::from_slice(¶meters.evaluation_element[i]), - )?; - + let evaluation_element = + EvaluationElement::deserialize(¶meters.evaluation_element[i])?; clients_and_evaluation_elements.push((&clients[i], evaluation_element)); } diff --git a/src/tests/voprf_vectors.rs b/src/tests/voprf_vectors.rs new file mode 100644 index 0000000..1a88b0a --- /dev/null +++ b/src/tests/voprf_vectors.rs @@ -0,0 +1,640 @@ +// Copyright (c) Facebook, Inc. and its affiliates. +// +// This source code is licensed under the MIT license found in the +// LICENSE file in the root directory of this source tree. + +//! The VOPRF test vectors taken from: +//! https://github.com/cfrg/draft-irtf-cfrg-opaque/blob/master/draft-irtf-cfrg-opaque.md + +pub(crate) static VECTORS: &str = r#" +## OPRF(ristretto255, SHA-512) + +### Base Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = caeff69352df4905a9121a4997704ca8cee1524a110819eb87deba1a39ec1 +701 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = c604c785ada70d77a5256ae21767de8c3304115237d262134f5e46e512cf +8e03 +BlindedElement = fc20e03aff3a9de9b37e8d35886ade11ec7d85c2a1fb5bb0b16 +86c64e07ac467 +EvaluationElement = 922e4c04b9f3b3e795d322a306c0ab9d96b667df9b949c05 +2c8c75435a9dbf2f +Output = 9e857d0e8523b8eb9e995d455ae6ae19f75d85ac8b5df62c50616fb5aa0 +ced3da5646698089c36dead28f9ad8e489fc0ee1c8e168725c38ed50f3783a5c520c +e +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 5ed895206bfc53316d307b23e46ecc6623afb3086da74189a416012be037 +e50b +BlindedElement = 483d4f39de5ff77fa0f9a0ad2334dd5bf87f2cda868539d21de +67ce49e7d1536 +EvaluationElement = 6eef6ee53c6fb17c77ae47e78bdca2e1094f98785e7b9a14 +f09be20797dad656 +Output = b090b2ff80028771c14fecf2f37c1b14e46deec59c83d3b943c51d315bd +3bf7d32c399ed0c4ce6003339ab9ed4ad168bfb595e43530c9d73ff02ab0f1263d93 +b +~~~ + +### Verifiable Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = ac37d5850510299406ea8eb8fa226a7bfc2467a4b070d6c7bf667948b9600 +b00 +pkSm = 0c0254e22063cae3e1bae02fb6fa20882664a117c0278eda6bda3372c0dd9 +860 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = ed8366feb6b1d05d1f46acb727061e43aadfafe9c10e5a64e7518d63e326 +3503 +BlindedElement = 3a0a53f2c57e5ee0d89e394087f8e5f95b24159db01c31933a0 +7f0e6414c954d +EvaluationElement = f8a50ed35a477b0cde91d926e1bc5ae59b97d5bd0dda51a7 +28b0f036ec557d79 +Proof = 7a5375eb1dbad259431f5c294e816a1c1483c279748da1a75d91f8a81438 +ea08355d4087d4d848b46878dcc8fb5849ac7a09133382c2c6129564a7f7b4b7bf01 +ProofRandomScalar = 019cbd1d7420292528f8cdd62f339fdabb602f04a95dac9d +bcec831b8c681a09 +Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d +eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1 +a +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = e6d0f1d89ad552e383d6c6f4e8598cc3037d6e274d22da3089e7afbd4171 +ea02 +BlindedElement = a86dd4544d0f3ea973926054230767dff16016215f2d73f26d3 +f86a81f38cf1a +EvaluationElement = 9e47810f1de1b57ebe163a95c170ec165a2063f872155c37 +6d94e8de2157af70 +Proof = 61075125d851d5164b0aa1a4d5ddeebaf097266450ac6019579af5f7abd1 +90088eb0f6f1e7f9d8bfddbc21ae3c25a065e6c4e797d15f345ed4fb9ee468d24c0a +ProofRandomScalar = 74ae06fd50d5f26c2519bd7b184f45dd3ef2cb50197d42df +9d013f7d6c312a0b +Output = fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f2 +18047d1fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0 +b +~~~ + +#### Test Vector 3, Batch Size 2 + +~~~ +Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 80513e77795feeec6d2c450589b0e1b178febd5c193a9fcba0d27f0a06e0 +d50f,533c2e6d91c934f919ac218973be55ba0d7b234160a0d4cf3bddafbda99e2e0 +c +BlindedElement = c24645d6378a4a86ec4682a8d86f368b1e7db870fd709a45102 +492bcdc17e904,0e5ec78f839a8b6e86999bc180602690a4daae57bf5d7f827f3d40 +2f56cc6c51 +EvaluationElement = 3afe48eab00493eb1b073e95f57a456cde9aefe463dd1e6d +0144bf6e99ce411c,daaf9421318fd2c7fcdf369cb348748cf4dd177cce30ee4d13c +eb1644b85b653 +Proof = 601381ecbe127ada04c057b8b1fc21d912f71e49252780dd0d0ac768b233 +ce035f9b489a994c1d14b92d603ebcffee4f5cfadc953f69bb62648c6e662613ae00 +ProofRandomScalar = 3af5aec325791592eee4a8860522f8444c8e71ac33af5186 +a9706137886dce08 +Output = 4b2ff4c984985829c3cd9d90c255cdc0d6b61c4c0aafa9215769d51cf7d +eb01472ba945928a8305e010f12b7dcc75a9dc2460439e6297d57dc2ce7ca0abaae1 +a,fe1fb7fa49c37dc7cd31d64859b4a2e6ae0cef294f2764e6f12f7d809f218047d1 +fde147cf69807b8971fb2c316eb572be2b5bf491813bfec0a20668d6d07b0b +~~~ + +## OPRF(decaf448, SHAKE-256) + +### Base Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 +skSm = 78f2622804104209f7e015370ff98f4a3cbf311e6784e9f4944f8a252dc08 +e916d9ab1a60dc905f0e56631903ecd4ae6e15291776d61460b +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = d1080372f0fcf8c5eace50914e7127f576725f215cc7c111673c635ce668 +bbbb9b50601ad89b358ab8c23ed0b6c9d040365ec9d060868714 +BlindedElement = 984e0a443ee194090737df4afb402253f216b77650c91d252b6 +638e1179723d51a4154b88eae396f1320f5df3c4b17f779516c456e364bd1 +EvaluationElement = de477252a5ff3c7d51ce159cb8ccf1865d8c7d3402824163 +8d80971f13a59d87b2b1036341b98089555ab088278391794c49bbb052fdbcff +Output = df8f910c3b84d1f3ca6afd1992768608a20f2ad7b770e9d89d303c88ba1 +5bb7d991f2f7ffd5b5b51fa3bcf8fa06779609497f6c0ae4e9cb2dcd48c68b4ac6b9 +4 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = aed1ffa44fd8f0ed16373606a3cf7df589cca86d8ea1abbf5768771dbef3 +d401c74ae55ba1e28b9565e1e4018eb261a14134a4ce60c1c718 +BlindedElement = 4aa751f84b2634b73efa364b03e60b92b84f457576e6b369eea +b76140e3859d10d2e98174f13f5a2c70670529ccf093d5f1aaf355b4f830b +EvaluationElement = 085ea1cb452a2fb15b3a0d0e1c86899c7ea49fe2e4856ef4 +f95bc2542eec610fc09b0fe7d7ed7389d86af6a646695b7ad46527dc2a936aa4 +Output = b57516a737879ece1110ad5d051ac0a6c54e1dcd989c907721ecebab5b4 +5877cc693c3c05d0bd416c5a9ceba36de41a0a31679c146fe4c110c64b056eba1720 +b +~~~ + +### Verifiable Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 +skSm = 9eb722f7fee9f61f24ad31bc42309f73648cf4393929e8f5f333fe10c6975 +c827a1eba4e03ae2fa8735db2f63f6c98c7af6010e64c81f535 +pkSm = b6e2751176d57836fe1dfbdbbdc78a1b5c5a52f831226c9d8dfdf5daf8f46 +6e310e80978e9b81c387f5bc85cc7ef5567f4dd3ba7674579a2 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 4c936db1779a621b6c71475ac3111fd5703a59b713929f36dfd1e892a7fe +814479c93d8b4b6e11d1f6fe5351e51457b665fa7b76074e531f +BlindedElement = d0b8e2eecad2816d45c1f8a072fe6db77d18f4b26f0889c98e2 +ef856ac5df82090c1fbeac9c8e732f192b66c3b4c3f1e446ab8910c86be2f +EvaluationElement = d29849d8ad1e651328e8119003debd9ecd54cc786a5eb8ae +ea56487ffc09120e98792f9475605488d16623b8e3cfa5af1ec27e76bc841b75 +Proof = 8b3b8f0c9eb22527e419f5a03d4d3f34cf725837424a38c5b4f88c7759f7 +a54bade57b7930bfeff051be9bfeaabc8976ed407398e0ce462a062e068a8d57bc1c +411bc42fe714626cfb92ad854a56636c2b83f2b5215c2ff531b22e4d37031523db20 +3556959e275b46b84303ed23fc37 +ProofRandomScalar = 1b3f5a55b2f18f8c53d4ecf2e1c27e1028f1c345bb504486 +4aa9dd8439d7520a7ba6183d50ef08bdf6c781aa465660c93e8195a8d231b62f +Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93 +9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153 +d +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 15b3355179392f40c3d5a15f0d5ffc354e340454ec779f575e4573a3886a +b5e57e4da2985cea9e32f6d95539ce2c7189e1bd7462e8c5483a +BlindedElement = 0e7ddd85c8bc5382e908241c6151afe23a41e0396759b5e38a9 +affd996cd822bca242a499793555fc15f07bffdaaa93b42568b307fbdca0f +EvaluationElement = 4c81e29e8a9502fa02e00cb09cf40d9b98988ac9b4bce7cc +a0656caeb0926b59c7000d7fe6c5dd814f831864547d2360d223a50077bd04fe +Proof = 74fc8fbf2e669dc5d25898ea8ce45d1d3eb97edb4b7c3cee39865a3c66da +6b7bad4ad3e77794d6f5e82fa8a645b9b973a8612bfcd1194302f700ee3433e876d8 +3f96bb70f19ff292605ad4c9466fd71dbc2ed22ade0130574e5ee343ef45d42e834a +11a19fd6f5b1b5ef910bcccf731b +ProofRandomScalar = 2f2e9955be83a4b25743ebd3618d4fad8b7288477da50bed +9befa58af639ddd950fec34205f8a4f166fadcb8fa71a3ffdd2e98f4c8ef5e26 +Output = 2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c +07f59055e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f +9 +~~~ + +#### Test Vector 3, Batch Size 2 + +~~~ +Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 614bb578f29cc677ea9e7aea3e4839413997e020f9377b63c13584156a09 +a46dd2a425c41eac0e313a47e99d05df72c6e1d58e6592577a0d,4c115060bca87db +7d73e00cbb8559f84cb7a221b235b0950a0ab553f03f10e1386abe954011b7da62bb +6599418ef90b5d4ea98cc28aff517 +BlindedElement = 5e481a4d7eaa5bab831f53f9a6311851dafd4318c6462eed4f6 +15004afdb082da2f99670b0963985faac21c30eea19aacfc441412edb4c0b,8e043b +9b7afeafa07e39d9b8b88957ff07d69124b1a2b841e18c9ffb52ebf0c25144eb2501 +a1d7983a44604f33a36e925eebc9bec65d9c54 +EvaluationElement = 8a0d34fdb0b55121421546ff952c7bd3cbe469926ff9ad4f +aeba243823955529eeae4f1a7a64cd055ec01baa041a99dfbe1a67ca4d59f93d,5e8 +6e0b41cc88186ee0003baa46535e71acd98453b298976b92be2cca2646e88620f55d +f6bf4754456dfd8d84f6889c17b5ff93052325a1a +Proof = 1ff624a102b99771c76a9414e9b3f33127897d971bc84a922e464805e4a9 +f27b889922030adebbbd58e0ab618ade9c84bfe8aa226176f11f432958ea1e6f6926 +3aef51db9efb23ee504d233c17e9077c0373401da167637a1df4eafd9c2537c9f89c +103f9e635931fe2042419dd9bd37 +ProofRandomScalar = a614f1894bcf6a1c7cef33909b794fe6e69a642b20f4c911 +8febffaf6b6a31471fe7794aa77ced123f07e56cc27de60b0ab106c0b8eab127 +Output = 1ff5c5c2c081c76006b52c45f79728882dc48962036ea7d4d5097b04e93 +9ae81118a7fe5f0a66a6131bef18b9cd998150f10c62619ec4c2d223ea57dc67f153 +d,2753e222528f1ee5fcc6ad4bf1ca953e5d3b47c1dfae85710f46a0a030c07f5905 +5e9b05dacb729a7ce41cd2ed782f8a76a1b3f74b40196aed0b6938b89c60f9 +~~~ + +## OPRF(P-256, SHA-256) + +### Base Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = a1b2355828f2c76de6749af9d093bd9fe0f2cada3ec653cd9a6d3126a7a78 +27b +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 5d9e7f6efd3093c32ecceabd57fb03cf760c926d2a7bfa265babf29ec98a +f0d0 +BlindedElement = 03e3c379698da853d9844098fa0ac676970d5ec24167b598714 +cd2ee188604ddd2 +EvaluationElement = 030d8d882120e8fa67ef978a9abac506acd5ec731b8e8d6f +15035e29241dd2ced2 +Output = ab653a4f3b357177b125e1c6d0bd2c0bc409b7ed5f48c99537fbd7fd11e +f8133 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 825155ab61f17605af2ae2e935c78d857c9407bcd45128d57d338f1671b5 +fcbe +BlindedElement = 030b40be181ffbb3c3ae4a4911287c43261f5e4034781def69c +51608f372a02102 +EvaluationElement = 03991df04e3e526d457065b6eafc855aa2fc4528c22d2b51 +6a3c71227b1b488f44 +Output = eca4df985f7c49b091c3ce4217be1f26cdc6a148b681ed1f1638d09dfd2 +13e6e +~~~ + +### Verifiable Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = 4e7804245a743c59d624457677294e04a8bc4bdcd94f0d3bd54f568067489 +d34 +pkSm = 03b51a0af95c819b09ee80c2056cf0ab0551a5355266d3a0aaff90c3fe915 +ed892 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = cee64d86fd20ab4caa264a26c0e3d42fb773b3173ba76f9588c9b14779bd +8d91 +BlindedElement = 0222f5dba2da1ec7bd1086d0e04894ef1da1c11163daf376b2b +c76cc51edb16815 +EvaluationElement = 02f2767135f75f69b257675b38f2bcd50338a655a5092166 +3c8942ca61ea7d3c29 +Proof = ffa082fc9f9a287e7edc50e3ad879ee13aebd24b69124792bdf047c643f7 +0af2b50907b2fa188b90aff3b25e1d9abb02e9e2c8bfdc525c61ca008428940fca64 +ProofRandomScalar = 70a5204b2b606f5a28328916e1e5ea5a17862d7a261fdd6d +959759758d5e34ac +Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8 +94448 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 5c4b401063eff0bf242b4cd534a79bacfc2e715b2db1e7a3ad4ff8af1b24 +daa2 +BlindedElement = 02f84403d1ceb40a3668349f7c349f806d2c858785853324c66 +7505018d13ee160 +EvaluationElement = 0216d7d342ef50113244b444dfedaec78810959e40fef0a6 +922658d44accb1e9c1 +Proof = f496e58818c25ffb386f22ceb57a83da1200612b67aaa07608b3375c25b2 +97e03e67d1f6094a8012725dc63a0c2f4f870173b97a3daa03588f777655a087fbbf +ProofRandomScalar = 3b9217801b5d51cef66d9fdbd94a53533e7c5057e09e2200 +65ea8c257c0dd606 +Output = 90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b9 +2fe28 +~~~ + +#### Test Vector 3, Batch Size 2 + +~~~ +Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = f0c7822ba317fb5e86028c44b92bd3aedcf6744d388ca013ef33edd36930 +4eda,3b9631be9f8b274d9aaf671bfb6a775229bf435021b89c683259773bc686956 +b +BlindedElement = 02a840214a74345570dcadfc927e726901b257b447234fac509 +0a1830295ca736c,039a5a8152abb0154b4d79a90486e358ea325980f0bf590524c4 +460f700454238f +EvaluationElement = 025991aac0b0c79bb1185c0b1e64964656634dfcd755cdf5 +da9ee52be0b5d5f742,03319e3baba8fa7f60dab49ef0ba68b7a85bccb5d4968643e +2f029b6c0826911d1 +Proof = 51b5ed453168480a2e95863cda1f4d28ad5bc91e8c9c75d788569aea1679 +794a642087db120a2b3ce839f57041801f37cd4a6c05b69b327b877810293f7b09a8 +ProofRandomScalar = 8306b863276ae74049615162a416d507a6532c99c1ea3f03 +d05f6e78dc1edabe +Output = c74d46cc93e578f7048bc6b852cd9bc1d9ebb90c586308f9202b9deedc8 +94448,90a9f5ff4208a5505d1b7ed65eb233bb61b4c999ffa0d8cd1d98fb717b92fe +28 +~~~ + +## OPRF(P-384, SHA-512) + +### Base Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 +skSm = ef1b52c12cdf43dc260bf5425a30cde7d708ec34b38dcfbdc2946d7baf525 +361e797f6a98f1ebd80f64865f21cde1c6d +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 359073c015b92d15450f7fb395bf52c6ea98384c491fe4e4d423b59de7b0 +df382902c13bdc9993d3717bda68fc080b99 +BlindedElement = 02fa3115c21ffcacc09ca470729b725781f84333e217cfeec2b +8ba6a54ce492ede7ead3714c5b177427ef853effb1b5c24 +EvaluationElement = 033a4bdea2693686e4ce467c8a5cdfc41b86ad20aaaa9bc1 +6e75b59dbd41dab0bc9af0041e551ece3b4c9fb2315d8d1fa9 +Output = a5a0ef3fb964a36097662d1258ef0f93b224ddd81a356c37d5dd05a885a +0b6722b90c1f5181637fece7ed180ba053da23bf35cef7a87dcba75562cb7a264001 +8 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 21ece4f9b6ffd01ce82082545413bd9bb5e8f3c63b86ae88d9ce0530b01c +b1c23382c7ec9bdd6e75898e4877d8e2bc17 +BlindedElement = 025fddc89a832089a59120df742acb34dba82b26afcae977961 +57df238b5905c494a23c56b1f485cbbff78d31df7fa1492 +EvaluationElement = 02f8b59813663e7965c219c113c560482cbea7ca4c412a0c +f3fd855ee7d543ae926d29ace85296f195f988be284b2347f6 +Output = f2a0b355cae4ae2c717d0b48e39c0ee356db3ca446fddf85cddb74f397e +b85046da62d0d85d55d19d39dd9b68fcc39379ec6d3b93ba33909fcc96361d225cdd +e +~~~ + +### Verifiable Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3 +skSm = 67ee1c9e67566d87bfcca9e5dac4bfdb8bdd727c031133fac2aa9ba6c41e6 +1e5f8fd401b5d76c7d54b15b15932797479 +pkSm = 029b51b2ce9c499f2056e65e0f41d60960f9c4795c0cf94af273ce840c20b +e4cdf87690b6b121b37d399b49afcc2ec9ac3 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 102f6338df84c9602bfa9e7d690b1f7a173d07e6d54a419db4a6308f8b09 +589e4283efb9cd1ee4061c6bf884e60a8774 +BlindedElement = 02a1f41323e91a6ac9fbbb5b8e4c7c58a4c5bcbaa4195557182 +cd59e826dc847f1e077de1d402ac92eafe322461fc0d582 +EvaluationElement = 03af3164f8721a57931f92884b43c58ff0ed1be249f7e1c9 +3033a5909f0ffc59ed3fea9452ec5c9cfb865b8bd2e65cd209 +Proof = 44108ca9b342f4d7e31a250aa9f41afb0de840e113dbb6bb82b5e6735aef +18a20867a63628be6e109d2d687e1faa8888270f1173bc6f916e21142096d23d1719 +4edf844074922c287a50182f87bbb5fc3a966c8851dd6799ec5cfe59c7063c7f +ProofRandomScalar = 90f67cafc0ffaa7a1e1d1ced3c477fea691e696032c8709c +86cbcda2b184ad0029d29abeabede9788d11782429bff297 +Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51 +eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe +0 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 8aec1d0c3d16afd032da7ba961449a56cec6fb918e932b06d5778ac7f67b +ecfb3e3869237f74106241777f230582e84a +BlindedElement = 02b3465d70f76de3eaf6ecb8080490288f741c622c06d023bd1 +80a55a2e3e4eaad08533651f9d278a3f59cec8277780303 +EvaluationElement = 03a53e01901893585437cd48a1eea1188fc8e9275a80cf43 +370a451c476dae3b84ca8c7bf44fcac2fa3eeab933b25da0c3 +Proof = 5ebc467e78ae29f7d741221df0ee67285df72ec482fdc8e5bde7e588b12f +cba86f4f116c23ee6b32c0f38f2daac67e869e53e7e0494cc883e4984daf10a55819 +bbb5ce7e9005f143b3dda88d8a35649269a4658a98c81c814097d15a3dcf4dbe +ProofRandomScalar = bb1876a7f7165ac7ec79bfd5213ea2e374252f29a6e19915 +f81b0c7dcea93ce6580e089ede31c1b6b5b33494581b4868 +Output = 5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920 +267a40b246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92 +c +~~~ + +#### Test Vector 3, Batch Size 2 + +~~~ +Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 41fabd4722d92472d858051ce9ad1a533176a862c697b2c392aff2aeb77e +b20c2ae6ba52fe31e13e03bf1d9f39878b23,51171628f1d28bb7402ca4aea6465e2 +67b7f977a1fb71593281099ef2625644aee0b6c5f5e6e01a2b052b3bd4caf539b +BlindedElement = 02d715dfce1a0724071fa8e530d79f7b234a31739a64166e0fe +21fa6fa0fe19e1ab5e468becca899f31e365c47f3efb2ef,028dfd0c7a38b4cb8477 +cae34f041344fb44fc9e55bfa3cf55ab7b4764b74accc7b49c0ff09a524598033dad +1152fb3a1c +EvaluationElement = 03f9a8c81c108201888eb86348c6f80691d99425272972b5 +bf41d3038af0eeb04d60edd9ea288625a7166a8c17cea0083f,02abb31980533dbf7 +eb5fee0a8969089b3e16585a2cd41a34067592a2021b1b4ea3d1cef3e7c87a6f284c +0e45546c92d98 +Proof = f0f7bd2723c3460d5c5ab03092c6861fb34253470ef430dac9aeac6ce489 +84b28d91178061cba02e3e911c4aa97229d519755db385ddd08064fdf8405897d1de +a472688934088505e89dcff91081fec1d2e37c1d4c5a9dddbdd358aa89f63b46 +ProofRandomScalar = 1b538ff23749be19e92df82df1acd3f606cc9faa9dc7ab25 +1997738a3a232f352c2059c25684e6ccea420f8d0c793fa0 +Output = 065094c66d66b6541aa1e09d99e2fdaac727356e9cd1c18275b7127be51 +eb1ce7f37ad5924f7425d60828c2d1acc69bef40d11423bba8f9e34478e04c437fbe +0,5f557169680da50500b5333a26bb2ba79256c0ecc351051d32cac540920267a40b +246deb286c9ecb0025dede808465f85d6a5e75aca61088533b306d8646c92c +~~~ + +## OPRF(P-521, SHA-512) + +### Base Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = 016ee706f30ce7e15e4ffa3114c7d59a7b6f302d531ca60419be39d1cd43e +e13b1fc8398b7f63a900cdc49c6e99f65a74403db2fa739927a2ee288cff857d9d84 +ecf +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 01b983705fcc9a39607288b935b0797ac6b3c4b2e848823ac9ae16b3a3b5 +816be03432370deb7c3c17d9fc7cb4e0ce646e04e42d638e0fa7a434ed340772a8b5 +d626 +BlindedElement = 0301f0a8c68e58f5571bd39fe3b0b2aa055a8c34e3d68ba0d2e +d177db0bc7575d477ed8f557596feb5ac568fe738eee8cff7dcb56dc78f52bf381c0 +912e0e84b5a3f5b +EvaluationElement = 0200d7b1131aa9f8c365de7bd7903738f61bdecfaada375a +ba3905bdaad1301c7cd537f69abff04140ccca29a4c46cb4a036160e55a9621210b3 +71d84646b0199571fa +Output = 61eea8fedfa9338dd22fac279f1f3f9e96693919c59ea3918c7a441115e +6bdecb1d05b5da55d4024858c92d3911a81d4eca362123b2911e5dc58591bf7be29c +7 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 01a03b1096b0316bc8567c89bd70267d35c8ddcb2be2cdc867089a2eb5cf +471b1e6eb4b043b9644c8539857abe3a2022e9c9fd6a1695bbabe8add48bcd149ff3 +b841 +BlindedElement = 030099c35342a43221c6e03debfb17bad71b62e04c9242aa6e9 +f2f915163ef4f5b8b7fe1740a4d636c36bd5c73ca39c69992dc7f6dff8f232125efc +22af4df8352fea2 +EvaluationElement = 0300ceeba6751486eecc479ab2259e3a57c13b0710f61c82 +87acad60624974b76ea242dbcae3a9daad1bdc9c49012c8d8b384d510980cc1ef8fa +8d10502748ce63d93f +Output = 6682273a5199b2454a706cac557008e2264580ac39b6995e1f47130b985 +d1015de7713d3bdb121212a68de2ece73bf72e41738a01c23428753c44e3dd39b5de +3 +~~~ + +### Verifiable Mode + +~~~ +seed = a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a +3a3 +skSm = 0017674057e06c5e3e8a331f2dc3558540701c9cd0f4c19126d5972af6a01 +447b312d05a06dab3e9e07c891d749444c27ede0897ad42aea03b887eb5db93e3f29 +a86 +pkSm = 0201ee4e2eaa74728f577f4bb282c5440cd454fdee1d79b15a36d34b5e5a1 +25e3ccc0f99e32cc0a6a15b5652a0c8a424860c6753f685d0e1e150ceba24ca3386f +29216 +~~~ + +#### Test Vector 1, Batch Size 1 + +~~~ +Input = 00 +Info = 7465737420696e666f +Blind = 00bbb82117c88bbd91b8954e16c0b9ceed3ce992b198be1ebfba9ba970db +d75beefbfc6d056b7f7ba1ef79f4facbf2d912c26ce2ecc5bb8d66419b379952e96b +d6f5 +BlindedElement = 0200357f949a0a0bdfeb682734dbdeb778f3845045617b21436 +27753332e2e75458ab183b12635c75e19afaf56981e7755803026842db1b22fa42c8 +61413d07ff86545 +EvaluationElement = 0201d636bac3f77c1091b337daae32259a3eacd57e3c0fb1 +444fe5ce22af6acdcef4a46a2b5e169aa8d0e26ec2a3621c15dd366ba1978dae761c +1ef3dac63c60cbee88 +Proof = 011ebe27ebc79e5679b643c6b3a51333499c7abee86c092181c0a8e7e539 +e0ba30b1c128666708c753696ace2aa789c4975b0b80d6241a1dafe85c39a7338d1e +20d00131c8a81b5f64209f8fe53e8c6a00789a893f20596198e2521275e05d925298 +08e9f54030fc8be2ce78c6df0d29e6fd7d8e623e0ccc7b19b194493dacd2a4eb3a32 +ProofRandomScalar = 00ce4f0d824939827888f4c28773466f3c0a05741260040b +c9f302a4fea13f1d8f2f6b92a02a32d5eb06f81de7960470f06169bee12cf47965b7 +2a59946ca3879670 +Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8 +79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29 +5 +~~~ + +#### Test Vector 2, Batch Size 1 + +~~~ +Input = 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 009055c99bf9591cb0eab2a72d044c05ca2cc2ef9b609a38546f74b6d688 +f70cf205f782fa11a0d61b2f5a8a2a1143368327f3077c68a1545e9aafbba6a90dc0 +d40a +BlindedElement = 030185e431f056e75ba7fac49da70790031daa333d16f05e1de +471e24afe0ed985c770ce77bd1bebec527e9a76feecc6afd92c5fd00481ba7fb843d +2aab52337cb716e +EvaluationElement = 02000859e1abc2ed28086b854ec5ae72311244fdeedf81d7 +69af6a6f2c83f00fa48df1f1a0c0b6fac84cc654b7757ac042107a6b3043e483bb3b +74de5d6c301b20e8f6 +Proof = 01629dd5af14c7414801d879b1018ce06bcc5c5d0a64ca422b76aaa531c8 +ecca630919fb4b51fa60fdc215f73e67e8d617d55ca6a227343d434d5e0f487567f8 +5bfa016959443267bb7d9a5c5e5b1c4d20026394b4edaca7dfbc1aa3b3c2020cf995 +79cf276c0e84f0cb5a820226fa3b81d42de2db39d8412642e70428e485a61ee9d760 +ProofRandomScalar = 00b5dfc19eb96faba6382ec845097904db87240b9dd47b1e +487ec625f11a7ba2cc3de74c5078a81806f74dd65065273c5bd886c7f87ff8c5f39f +90320718eff747e3 +Output = 7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d +1b2e936669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c13011057 +1 +~~~ + +#### Test Vector 3, Batch Size 2 + +~~~ +Input = 00,5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a +Info = 7465737420696e666f +Blind = 01c6cf092d80c7cf2cb55388d899515238094c800bdd9c65f71780ba85f5 +ae9b4703e17e559ca3ccd1944f9a70536c175f11a827452672b60d4e9f89eba28104 +6e29,00cba1ba1a337759061965a423d9d3d6e1e1006dc8984ad28a4c93ecfc36fc2 +171046b3c4284855cfa2434ed98db9e68a597db2c14728fade716a6a82d600444b26 +e +BlindedElement = 0301978860af75cd69acbc93e8c9fc530e5d2b2208da42c65bf +e079f0f6e0b3fc6080556c10739271d2a8fe578409d4fa9b19ef0484d9c15451c4e7 +0501e31da7608cb,0200e30565c3d7e02c822762f25db4c872811adb2cbfbad92b04 +291bc8c476d0546d1c5ecf5c58ff06b8d19aad8eca9e5f1a80ff8e981ebc490b0cfb +d5d499b47bad8e +EvaluationElement = 0300abdee910f144c3be460e724c11626e1f9986f72e2c43 +3a9c4dad2ef6fcb9249c9a5036334ba88b0892462b6f8ad419c38cc259b0c774a9bd +0c4d545d0914413ea2,02019696f91dcc178bbe6b97f822cdc4052f9b94852ff6023 +f6068848f867df40e54a5f1525e7fafa383e82fe36bf3c74427b51903032d0f89876 +05bf24ee003f37693 +Proof = 008fa896b69c1efc4e9c6bdfd0b149444532d5ba3bfd957cf7cd71c374d3 +a1cca25f17b60616164377b0734243bc878e17d3ecab36b3e3565b5c6218dae92d40 +c0be018707381f6f4b0153044737030b5d9851c15609532da8932c1fa1f4901dba05 +a4118d25142344f9ea1465c907eb13d908a45d8b98265eac48819a04cae859b0643a +ProofRandomScalar = 00d47b0d4ca4c64825ba085de242042b84d9ebe3b2e9de07 +678ff96713dfe16f40f2c662a56ed2db95e1e7bf2dea02bd1fa76e953a630772f68b +53baade9962d1646 +Output = c51295e2a03ba59f1538734316e0d70dd81f95daba2f7b5ac4906c56ce8 +79d6cef8f583433c981a182a52dd568811b073f65fc1124941f344cc9dd3b3880f29 +5,7462f460340a52f7b7609c5e1c5e2d5334d43da7631cb549bb65163a05d1b2e936 +669e52e66c92da4b2e24fff3c118c62787577c01d2885567b476c130110571 +~~~ +"#; diff --git a/src/voprf.rs b/src/voprf.rs index 0a13cc9..d3bb669 100644 --- a/src/voprf.rs +++ b/src/voprf.rs @@ -3,8 +3,10 @@ // This source code is licensed under the MIT license found in the // LICENSE file in the root directory of this source tree. +//! Contains the main VOPRF API + use crate::{ - ciphersuite::{CipherSuite, Mode}, + ciphersuite::CipherSuite, errors::InternalError, group::Group, serialization::{i2osp, serialize}, @@ -16,6 +18,11 @@ use rand::{CryptoRng, RngCore}; use alloc::vec; use alloc::vec::Vec; +/////////////// +// Constants // +// ========= // +/////////////// + static STR_HASH_TO_SCALAR: &[u8] = b"HashToScalar-"; static STR_HASH_TO_GROUP: &[u8] = b"HashToGroup-"; static STR_FINALIZE: &[u8] = b"Finalize-"; @@ -23,25 +30,85 @@ static STR_SEED: &[u8] = b"Seed-"; static STR_CONTEXT: &[u8] = b"Context-"; static STR_COMPOSITE: &[u8] = b"Composite-"; static STR_CHALLENGE: &[u8] = b"Challenge-"; +static STR_VOPRF: &[u8] = b"VOPRF07-"; -pub struct NonVerifiableClient { - data: Vec, - blind: ::Scalar, +/// Determines the mode of operation (either base mode or +/// verifiable mode) +enum Mode { + Base = 0, + Verifiable = 1, } +//////////////////////////// +// High-level API Structs // +// ====================== // +//////////////////////////// + +/// A client which engages with a [NonVerifiableServer] +/// in base mode, meaning that the OPRF outputs are not +/// verifiable. +pub struct NonVerifiableClient { + pub(crate) blind: ::Scalar, + pub(crate) data: Vec, +} + +/// A client which engages with a [VerifiableServer] +/// in verifiable mode, meaning that the OPRF outputs +/// can be checked against a server public key. +pub struct VerifiableClient { + pub(crate) blind: ::Scalar, + pub(crate) blinded_element: CS::Group, + pub(crate) data: alloc::vec::Vec, +} + +/// A server which engages with a [NonVerifiableClient] +/// in base mode, meaning that the OPRF outputs are not +/// verifiable. +pub struct NonVerifiableServer { + pub(crate) sk: ::Scalar, +} +/// A server which engages with a [VerifiableClient] +/// in verifiable mode, meaning that the OPRF outputs +/// can be checked against a server public key. +pub struct VerifiableServer { + pub(crate) sk: ::Scalar, + pub(crate) pk: CS::Group, +} + +/// A proof produced by a [VerifiableServer] that +/// the OPRF output matches against a server public key. +pub struct Proof { + pub(crate) c_scalar: ::Scalar, + pub(crate) s_scalar: ::Scalar, +} + +/// The first client message sent from a client (either verifiable or not) +/// to a server (either verifiable or not). +pub struct BlindedElement(pub(crate) CS::Group); + +/// The server's response to the [BlindedElement] message from +/// a client (either verifiable or not) +/// to a server (either verifiable or not). +pub struct EvaluationElement(pub(crate) CS::Group); + +///////////////////////// +// API Implementations // +// =================== // +///////////////////////// + impl NonVerifiableClient { /// Computes the first step for the multiplicative blinding version of DH-OPRF. pub fn blind( input: &[u8], blinding_factor_rng: &mut R, - ) -> Result<(Self, CS::Group), InternalError> { + ) -> Result<(Self, BlindedElement), InternalError> { let (blind, blinded_element) = blind::(input, blinding_factor_rng, Mode::Base)?; Ok(( Self { data: input.to_vec(), blind, }, - blinded_element, + BlindedElement(blinded_element), )) } @@ -49,11 +116,11 @@ impl NonVerifiableClient { /// the client unblinds the server's message. pub fn finalize( &self, - evaluation_element: CS::Group, + evaluation_element: EvaluationElement, info: &[u8], ) -> Result::OutputSize>, InternalError> { let unblinded_element = - evaluation_element * &::scalar_invert(&self.blind); + evaluation_element.0 * &::scalar_invert(&self.blind); let outputs = finalize_after_unblind::( &[(self.data.clone(), unblinded_element)], info, @@ -78,28 +145,12 @@ impl NonVerifiableClient { } } -pub struct VerifiableClient { - data: alloc::vec::Vec, - blind: ::Scalar, - blinded_element: CS::Group, -} - -impl Clone for VerifiableClient { - fn clone(&self) -> Self { - Self { - data: self.data.clone(), - blind: self.blind, - blinded_element: self.blinded_element, - } - } -} - impl VerifiableClient { /// Computes the first step for the multiplicative blinding version of DH-OPRF. pub fn blind( input: &[u8], blinding_factor_rng: &mut R, - ) -> Result<(Self, CS::Group), InternalError> { + ) -> Result<(Self, BlindedElement), InternalError> { let (blind, blinded_element) = blind::(input, blinding_factor_rng, Mode::Verifiable)?; Ok(( @@ -108,7 +159,7 @@ impl VerifiableClient { blind, blinded_element, }, - blinded_element, + BlindedElement(blinded_element), )) } @@ -116,7 +167,7 @@ impl VerifiableClient { /// the client unblinds the server's message. pub fn finalize( &self, - evaluation_element: CS::Group, + evaluation_element: EvaluationElement, proof: Proof, pk: CS::Group, info: &[u8], @@ -125,9 +176,10 @@ impl VerifiableClient { Ok(outputs[0].clone()) } + /// Allows for batching of the finalization of multiple [VerifiableClient] and [EvaluationElement] pairs #[allow(clippy::type_complexity)] pub fn batch_finalize( - clients_and_evaluation_elements: &[(&VerifiableClient, CS::Group)], + clients_and_evaluation_elements: &[(&VerifiableClient, EvaluationElement)], proof: Proof, pk: CS::Group, info: &[u8], @@ -136,8 +188,8 @@ impl VerifiableClient { .iter() .map(|(client, evaluation_element)| BatchItems { blind: client.blind, - evaluation_element: *evaluation_element, - blinded_element: client.blinded_element, + evaluation_element: evaluation_element.clone(), + blinded_element: BlindedElement(client.blinded_element), }) .collect(); @@ -174,71 +226,27 @@ impl VerifiableClient { } } -/// Only used in batching -struct BatchItems { - blind: ::Scalar, - evaluation_element: CS::Group, - blinded_element: CS::Group, -} - -fn verifiable_unblind( - batch_items: &[BatchItems], - pk: CS::Group, - proof: Proof, - info: &[u8], -) -> Result, InternalError> { - let context = [ - STR_CONTEXT, - &CS::get_context_string(Mode::Verifiable)?, - &serialize(info, 2)?, - ] - .concat(); - - let dst = [ - STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, - ] - .concat(); - let m = CS::Group::hash_to_scalar::(&context, &dst)?; - - let g = CS::Group::base_point(); - let t = g * &m; - let u = t + &pk; - - let blinds: Vec<::Scalar> = batch_items.iter().map(|x| x.blind).collect(); - let evaluation_elements: Vec = - batch_items.iter().map(|x| x.evaluation_element).collect(); - let blinded_elements: Vec = batch_items.iter().map(|x| x.blinded_element).collect(); - - verify_proof(g, u, &evaluation_elements, &blinded_elements, proof)?; - - let unblinded_elements = blinds - .iter() - .zip(evaluation_elements.iter()) - .map(|(&blind, &x)| x * &CS::Group::scalar_invert(&blind)) - .collect(); - Ok(unblinded_elements) -} - -pub struct NonVerifiableServer { - sk: ::Scalar, -} - impl NonVerifiableServer { + /// Produces a new instance of a [NonVerifiableServer] using a supplied RNG pub fn new(rng: &mut R) -> Result { let mut seed = vec![0u8; ::OutputSize::USIZE]; rng.fill_bytes(&mut seed); Self::new_from_seed(&seed) } - pub fn new_with_key(key: &[u8]) -> Result { - let sk = CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?; + /// Produces a new instance of a [NonVerifiableServer] using a supplied set of bytes to + /// represent the server's private key + pub fn new_with_key(private_key_bytes: &[u8]) -> Result { + let sk = CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(private_key_bytes))?; Ok(Self { sk }) } - // Corresponds to DeriveKeyPair from the VOPRF spec + /// Produces a new instance of a [NonVerifiableServer] using a supplied set of bytes which + /// are used as a seed to derive the server's private key. + /// + /// Corresponds to DeriveKeyPair() function from the VOPRF specification. pub fn new_from_seed(seed: &[u8]) -> Result { - let dst = [STR_HASH_TO_SCALAR, &CS::get_context_string(Mode::Base)?].concat(); + let dst = [STR_HASH_TO_SCALAR, &get_context_string::(Mode::Base)?].concat(); let sk = CS::Group::hash_to_scalar::(seed, &dst)?; Ok(Self { sk }) } @@ -253,46 +261,47 @@ impl NonVerifiableServer { /// message is sent from the server (who holds the OPRF key) to the client. pub fn evaluate( &self, - blinded_element: CS::Group, + blinded_element: BlindedElement, info: &[u8], - ) -> Result { + ) -> Result, InternalError> { let context = [ STR_CONTEXT, - &CS::get_context_string(Mode::Base)?, + &get_context_string::(Mode::Base)?, &serialize(info, 2)?, ] .concat(); - let dst = [STR_HASH_TO_SCALAR, &CS::get_context_string(Mode::Base)?].concat(); + let dst = [STR_HASH_TO_SCALAR, &get_context_string::(Mode::Base)?].concat(); let m = CS::Group::hash_to_scalar::(&context, &dst)?; let t = self.sk + &m; - let evaluation_element = blinded_element * &CS::Group::scalar_invert(&t); - Ok(evaluation_element) + let evaluation_element = blinded_element.0 * &CS::Group::scalar_invert(&t); + Ok(EvaluationElement(evaluation_element)) } } -pub struct VerifiableServer { - sk: ::Scalar, - pk: CS::Group, -} - impl VerifiableServer { + /// Produces a new instance of a [VerifiableServer] using a supplied RNG pub fn new(rng: &mut R) -> Result { let mut seed = vec![0u8; ::OutputSize::USIZE]; rng.fill_bytes(&mut seed); Self::new_from_seed(&seed) } + /// Produces a new instance of a [VerifiableServer] using a supplied set of bytes to + /// represent the server's private key pub fn new_with_key(key: &[u8]) -> Result { let sk = CS::Group::from_scalar_slice(&GenericArray::clone_from_slice(key))?; let pk = CS::Group::base_point() * &sk; Ok(Self { sk, pk }) } - // Corresponds to DeriveKeyPair from the VOPRF spec + /// Produces a new instance of a [VerifiableServer] using a supplied set of bytes which + /// are used as a seed to derive the server's private key. + /// + /// Corresponds to DeriveKeyPair() function from the VOPRF specification. pub fn new_from_seed(seed: &[u8]) -> Result { let dst = [ STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, ] .concat(); let sk = CS::Group::hash_to_scalar::(seed, &dst)?; @@ -311,35 +320,36 @@ impl VerifiableServer { pub fn evaluate( &self, rng: &mut R, - blinded_element: CS::Group, + blinded_element: BlindedElement, info: &[u8], - ) -> Result<(CS::Group, Proof), InternalError> { + ) -> Result<(EvaluationElement, Proof), InternalError> { let (evaluation_elements, proof) = self.batch_evaluate(rng, &[blinded_element], info)?; - Ok((evaluation_elements[0], proof)) + Ok((evaluation_elements[0].clone(), proof)) } + /// Allows for batching of the evaluation of multiple [BlindedElement] messages from a [VerifiableClient] pub fn batch_evaluate( &self, rng: &mut R, - blinded_elements: &[CS::Group], + blinded_elements: &[BlindedElement], info: &[u8], - ) -> Result<(Vec, Proof), InternalError> { + ) -> Result<(Vec>, Proof), InternalError> { let context = [ STR_CONTEXT, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, &serialize(info, 2)?, ] .concat(); let dst = [ STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, ] .concat(); let m = CS::Group::hash_to_scalar::(&context, &dst)?; let t = self.sk + &m; - let evaluation_elements: Vec = blinded_elements + let evaluation_elements: Vec> = blinded_elements .iter() - .map(|&x| x * &CS::Group::scalar_invert(&t)) + .map(|x| EvaluationElement(x.0 * &CS::Group::scalar_invert(&t))) .collect(); let g = CS::Group::base_point(); @@ -350,11 +360,46 @@ impl VerifiableServer { Ok((evaluation_elements, proof)) } + /// Retrieves the server's public key pub fn get_public_key(&self) -> CS::Group { self.pk } } +/////////////////////////////////////////////// +// Inner functions and Trait Implementations // +// ========================================= // +/////////////////////////////////////////////// + +/// Convenience struct only used in batching APIs +struct BatchItems { + blind: ::Scalar, + evaluation_element: EvaluationElement, + blinded_element: BlindedElement, +} + +impl Clone for BlindedElement { + fn clone(&self) -> Self { + Self(self.0) + } +} + +impl Clone for EvaluationElement { + fn clone(&self) -> Self { + Self(self.0) + } +} + +impl Clone for VerifiableClient { + fn clone(&self) -> Self { + Self { + data: self.data.clone(), + blind: self.blind, + blinded_element: self.blinded_element, + } + } +} + // Inner function for blind. Returns the blind scalar and the blinded element fn blind( input: &[u8], @@ -363,20 +408,64 @@ fn blind( ) -> Result<(::Scalar, CS::Group), InternalError> { // Choose a random scalar that must be non-zero let blind = ::random_nonzero_scalar(blinding_factor_rng); - let dst = [STR_HASH_TO_GROUP, &CS::get_context_string(mode)?].concat(); + let dst = [STR_HASH_TO_GROUP, &get_context_string::(mode)?].concat(); let mapped_point = ::map_to_curve::(input, &dst)?; let blinded_element = mapped_point * &blind; Ok((blind, blinded_element)) } +fn verifiable_unblind( + batch_items: &[BatchItems], + pk: CS::Group, + proof: Proof, + info: &[u8], +) -> Result, InternalError> { + let context = [ + STR_CONTEXT, + &get_context_string::(Mode::Verifiable)?, + &serialize(info, 2)?, + ] + .concat(); + + let dst = [ + STR_HASH_TO_SCALAR, + &get_context_string::(Mode::Verifiable)?, + ] + .concat(); + let m = CS::Group::hash_to_scalar::(&context, &dst)?; + + let g = CS::Group::base_point(); + let t = g * &m; + let u = t + &pk; + + let blinds: Vec<::Scalar> = batch_items.iter().map(|x| x.blind).collect(); + let evaluation_elements: Vec> = batch_items + .iter() + .map(|x| x.evaluation_element.clone()) + .collect(); + let blinded_elements: Vec> = batch_items + .iter() + .map(|x| x.blinded_element.clone()) + .collect(); + + verify_proof(g, u, &evaluation_elements, &blinded_elements, proof)?; + + let unblinded_elements = blinds + .iter() + .zip(evaluation_elements.iter()) + .map(|(&blind, x)| x.0 * &CS::Group::scalar_invert(&blind)) + .collect(); + Ok(unblinded_elements) +} + #[allow(clippy::many_single_char_names)] fn generate_proof( rng: &mut R, k: ::Scalar, a: CS::Group, b: CS::Group, - cs: &[CS::Group], - ds: &[CS::Group], + cs: &[EvaluationElement], + ds: &[BlindedElement], ) -> Result, InternalError> { let (m, z) = compute_composites::(Some(k), b, cs, ds)?; @@ -384,7 +473,7 @@ fn generate_proof( let t2 = a * &r; let t3 = m * &r; - let challenge_dst = [STR_CHALLENGE, &CS::get_context_string(Mode::Verifiable)?].concat(); + let challenge_dst = [STR_CHALLENGE, &get_context_string::(Mode::Verifiable)?].concat(); let h2_input = [ serialize(&b.to_arr().to_vec(), 2)?, serialize(&m.to_arr().to_vec(), 2)?, @@ -397,7 +486,7 @@ fn generate_proof( let hash_to_scalar_dst = [ STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, ] .concat(); @@ -407,45 +496,19 @@ fn generate_proof( Ok(Proof { c_scalar, s_scalar }) } -pub struct Proof { - c_scalar: ::Scalar, - s_scalar: ::Scalar, -} - -impl Proof { - pub fn serialize(&self) -> Vec { - [ - CS::Group::scalar_as_bytes(self.c_scalar), - CS::Group::scalar_as_bytes(self.s_scalar), - ] - .concat() - } - - pub fn deserialize(input: &[u8]) -> Result { - let scalar_len = ::ScalarLen::to_usize(); - if input.len() < scalar_len + scalar_len { - return Err(InternalError::SizeError); - } - Ok(Proof { - c_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[..scalar_len]))?, - s_scalar: CS::Group::from_scalar_slice(GenericArray::from_slice(&input[scalar_len..]))?, - }) - } -} - #[allow(clippy::many_single_char_names)] fn verify_proof( a: CS::Group, b: CS::Group, - cs: &[CS::Group], - ds: &[CS::Group], + cs: &[EvaluationElement], + ds: &[BlindedElement], proof: Proof, ) -> Result<(), InternalError> { let (m, z) = compute_composites::(None, b, cs, ds)?; let t2 = (a * &proof.s_scalar) + &(b * &proof.c_scalar); let t3 = (m * &proof.s_scalar) + &(z * &proof.c_scalar); - let challenge_dst = [STR_CHALLENGE, &CS::get_context_string(Mode::Verifiable)?].concat(); + let challenge_dst = [STR_CHALLENGE, &get_context_string::(Mode::Verifiable)?].concat(); let h2_input = [ serialize(&b.to_arr().to_vec(), 2)?, serialize(&m.to_arr().to_vec(), 2)?, @@ -458,7 +521,7 @@ fn verify_proof( let hash_to_scalar_dst = [ STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, ] .concat(); let c = CS::Group::hash_to_scalar::(&h2_input, &hash_to_scalar_dst)?; @@ -475,7 +538,7 @@ fn finalize_after_unblind( info: &[u8], mode: Mode, ) -> Result::OutputSize>>, InternalError> { - let finalize_dst = [STR_FINALIZE, &CS::get_context_string(mode)?].concat(); + let finalize_dst = [STR_FINALIZE, &get_context_string::(mode)?].concat(); let mut outputs = vec![]; @@ -497,15 +560,15 @@ fn finalize_after_unblind( fn compute_composites( k_option: Option<::Scalar>, b: CS::Group, - c_slice: &[CS::Group], - d_slice: &[CS::Group], + c_slice: &[EvaluationElement], + d_slice: &[BlindedElement], ) -> Result<(CS::Group, CS::Group), InternalError> { if c_slice.len() != d_slice.len() { return Err(InternalError::MismatchedLengthsForCompositeInputs); } - let seed_dst = [STR_SEED, &CS::get_context_string(Mode::Verifiable)?].concat(); - let composite_dst = [STR_COMPOSITE, &CS::get_context_string(Mode::Verifiable)?].concat(); + let seed_dst = [STR_SEED, &get_context_string::(Mode::Verifiable)?].concat(); + let composite_dst = [STR_COMPOSITE, &get_context_string::(Mode::Verifiable)?].concat(); let h1_input = [ serialize(&b.to_arr().to_vec(), 2)?, @@ -521,21 +584,21 @@ fn compute_composites( let h2_input = [ serialize(&seed, 2)?, i2osp(i, 2)?, - serialize(&c_slice[i].to_arr().to_vec(), 2)?, - serialize(&d_slice[i].to_arr().to_vec(), 2)?, + serialize(&c_slice[i].0.to_arr().to_vec(), 2)?, + serialize(&d_slice[i].0.to_arr().to_vec(), 2)?, serialize(&composite_dst, 2)?, ] .concat(); let dst = [ STR_HASH_TO_SCALAR, - &CS::get_context_string(Mode::Verifiable)?, + &get_context_string::(Mode::Verifiable)?, ] .concat(); let di = CS::Group::hash_to_scalar::(&h2_input, &dst)?; - m = c_slice[i] * &di + &m; + m = c_slice[i].0 * &di + &m; z = match k_option { Some(_) => z, - None => d_slice[i] * &di + &z, + None => d_slice[i].0 * &di + &z, }; } @@ -547,6 +610,17 @@ fn compute_composites( Ok((m, z)) } +/// Generates the contextString parameter as defined in +/// +fn get_context_string(mode: Mode) -> Result, InternalError> { + Ok([ + STR_VOPRF, + &i2osp(mode as usize, 1)?, + &i2osp(CS::Group::SUITE_ID, 2)?, + ] + .concat()) +} + /////////// // Tests // // ===== // @@ -574,7 +648,7 @@ mod tests { ) -> GenericArray::OutputSize> { let dst = [ STR_HASH_TO_GROUP, - &Ristretto255Sha512::get_context_string(Mode::Base).unwrap(), + &get_context_string::(Mode::Base).unwrap(), ] .concat(); let point = RistrettoPoint::map_to_curve::(input, &dst).unwrap(); @@ -583,13 +657,13 @@ mod tests { let context = [ STR_CONTEXT, - &Ristretto255Sha512::get_context_string(Mode::Base).unwrap(), + &get_context_string::(Mode::Base).unwrap(), &serialize(info, 2).unwrap(), ] .concat(); let dst = [ STR_HASH_TO_SCALAR, - &Ristretto255Sha512::get_context_string(Mode::Base).unwrap(), + &get_context_string::(Mode::Base).unwrap(), ] .concat(); let m = <::Group as Group>::hash_to_scalar::< @@ -631,11 +705,11 @@ mod tests { let info = b"info"; let (client, alpha) = NonVerifiableClient::::blind(&input, &mut rng).unwrap(); - let res = client.finalize(alpha, info).unwrap(); + let res = client.finalize(EvaluationElement(alpha.0), info).unwrap(); let dst = [ STR_HASH_TO_GROUP, - &Ristretto255Sha512::get_context_string(Mode::Base).unwrap(), + &get_context_string::(Mode::Base).unwrap(), ] .concat(); let point = RistrettoPoint::map_to_curve::(&input, &dst).unwrap();