Publishing v0.6.0-pre.0 (#146)

* update generic-array to v1

* revert displaydoc removal

* fix cargo fmt

.cargo/license.rs

@@ -1,6 +1,7 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.

.github/workflows/main.yml

@@ -4,7 +4,7 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, repoened, synchronize]
+    types: [opened, reopened, synchronize]
 
 jobs:
   cargo-audit:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache cargo-audit
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -24,7 +24,7 @@ jobs:
         run: cargo install cargo-audit
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run cargo audit
         run: cargo audit -D warnings
@@ -35,8 +35,7 @@ jobs:
       fail-fast: false
       matrix:
         backend_feature:
-          - --features ristretto255-ciphersuite,ristretto255-u64
-          - --features ristretto255-ciphersuite,ristretto255-u32
+          - --features ristretto255-ciphersuite
           -
         frontend_feature:
           -
@@ -44,11 +43,11 @@ jobs:
           - --features serde
         toolchain:
           - stable
-          - 1.57.0
+          - 1.83.0
     name: test
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install ${{ matrix.toolchain }} toolchain
         uses: actions-rs/toolchain@v1
@@ -75,6 +74,12 @@ jobs:
           command: test
           args: --no-default-features ${{ matrix.frontend_feature }},std ${{ matrix.backend_feature }}
 
+      - name: Run cargo test with all features enabled
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --all-features
+
   build-no-std:
     name: Build with no-std on ${{ matrix.target }}
     runs-on: ubuntu-latest
@@ -88,15 +93,14 @@ jobs:
           - thumbv6m-none-eabi
         backend_feature:
           -
-          - --features ristretto255-ciphersuite,ristretto255-u64
-          - --features ristretto255-ciphersuite,ristretto255-u32
+          - --features ristretto255-ciphersuite
         frontend_feature:
           -
           - --features danger
           - --features serde
     steps:
-      - uses: actions/checkout@v3
-      - uses: hecrj/setup-rust-action@v1
+      - uses: actions/checkout@v4
+      - uses: hecrj/setup-rust-action@v2
       - run: rustup target add ${{ matrix.target }}
       - run: cargo build --verbose --target=${{ matrix.target }} --no-default-features ${{ matrix.frontend_feature }} ${{ matrix.backend_feature }}
 
@@ -106,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install stable toolchain
         uses: actions-rs/toolchain@v1
@@ -120,7 +124,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --all-targets -- -D warnings
+          args: --all-features --all-targets -- -D warnings
 
       - name: Run cargo doc
         uses: actions-rs/cargo@v1
@@ -136,7 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install nightly toolchain
         uses: actions-rs/toolchain@v1
@@ -157,7 +161,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -166,10 +170,10 @@ jobs:
           key: taplo
 
       - name: Install Taplo
-        run: cargo install taplo-cli
+        run: cargo install taplo-cli --locked
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run Taplo
         run: taplo fmt --check

.github/workflows/publish.yml

@@ -10,9 +10,10 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
+        rust: [stable]
 
     steps:
-    - uses: hecrj/setup-rust-action@v1
+    - uses: hecrj/setup-rust-action@v2
       with:
         rust-version: ${{ matrix.rust }}
     - uses: actions/checkout@master

CHANGELOG.md

@@ -1,8 +1,48 @@
 # Changelog
 
-## 0.4.0-pre.1 (April 1, 2022)
-* Updated to be in sync with draft-irtf-cfrg-voprf-09, with
+## 0.6.0-pre.0 (November 8, 2025)
+* MSRV bumped to 1.83
+* Updated Ristretto255 random scalar generation
+* Updated generic-array to v1
+
+## 0.5.0 (March 6, 2024)
+* Just a version bump from v0.5.0-pre.7
+
+## 0.5.0-pre.7 (January 11, 2024)
+* Updated to be in sync with RFC 9497
+
+## 0.5.0-pre.6 (July 24, 2023)
+* Updated curve25519-dalek dependency to 4
+
+## 0.5.0-pre.5 (June 27, 2023)
+* Updated curve25519-dalek dependency to 4.0.0-rc.3
+
+## 0.5.0-pre.4 (May 20, 2023)
+* Updated curve25519-dalek dependency to 4.0.0-rc.2
+
+## 0.5.0-pre.3 (March 4, 2023)
+* Updated to be in sync with draft-irtf-cfrg-voprf-19
+* Increased MSRV to 1.65
+* Updated p256 dependency to v0.13
+* Added p384 tests
+
+## 0.5.0-pre.2 (February 3, 2023)
+* Increased MSRV to 1.60
+* Updated p256 dependency to v0.12
+* Updated curve25519-dalek dependency to 4.0.0-rc.1
+
+## 0.5.0-pre.1 (December 19, 2022)
+* Updated curve25519-dalek dependency to 4.0.0-pre.5
+
+## 0.4.0 (September 15, 2022)
+* Updated to be in sync with draft-irtf-cfrg-voprf-11, with
   the addition of the POPRF mode
+* Adds the evaluate() function to the servers to calculate the output of the OPRF
+  directly
+* Renames the former evaluate() function to blind_evaluate to match the spec
+* Fixes the order of parameters for PoprfClient::blind to align it with the
+  other clients
+* Exposes the derive_key function under the "danger" feature
 * Added support for running the API without performing allocations
 * Revamped the way the Group trait was used, so as to be more easily
   extendable to other groups

CONTRIBUTING.md

@@ -27,4 +27,5 @@ outlined on that page and do not file a public issue.
 
 ## License
 By contributing to voprf, you agree that your contributions will be
-licensed under the LICENSE file in the root directory of this source tree.
+licensed under both the LICENSE-MIT and LICENSE-APACHE files in the root
+directory of this source tree.

Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-authors = ["Kevin Lewi <klewi@fb.com>"]
+authors = ["Kevin Lewi <lewi.kevin.k@gmail.com>"]
 categories = ["no-std", "algorithms", "cryptography"]
 description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)"
 edition = "2021"
@@ -7,37 +7,35 @@ keywords = ["oprf"]
 license = "MIT"
 name = "voprf"
 readme = "README.md"
-repository = "https://github.com/novifinancial/voprf/"
-rust-version = "1.57"
-version = "0.4.0-pre.1"
+repository = "https://github.com/facebook/voprf/"
+rust-version = "1.83"
+version = "0.6.0-pre.0"
 
 [features]
 alloc = []
 danger = []
-default = ["ristretto255-ciphersuite", "ristretto255-u64", "serde"]
-ristretto255 = ["curve25519-dalek", "generic-array/more_lengths"]
-ristretto255-ciphersuite = ["ristretto255", "sha2"]
-ristretto255-fiat-u32 = ["curve25519-dalek/fiat_u32_backend", "ristretto255"]
-ristretto255-fiat-u64 = ["curve25519-dalek/fiat_u64_backend", "ristretto255"]
-ristretto255-simd = ["curve25519-dalek/simd_backend", "ristretto255"]
-ristretto255-u32 = ["curve25519-dalek/u32_backend", "ristretto255"]
-ristretto255-u64 = ["curve25519-dalek/u64_backend", "ristretto255"]
-serde = ["generic-array/serde", "serde_"]
+default = ["ristretto255-ciphersuite", "dep:serde"]
+ristretto255 = ["dep:curve25519-dalek"]
+ristretto255-ciphersuite = ["ristretto255", "dep:sha2"]
+serde = ["curve25519-dalek?/serde", "generic-array/serde", "dep:serde"]
 std = ["alloc"]
 
 [dependencies]
-curve25519-dalek = { version = "=4.0.0-pre.1", default-features = false, optional = true }
-derive-where = { version = "=1.0.0-rc.3", features = ["zeroize-on-drop"] }
+curve25519-dalek = { version = "4", default-features = false, features = [
+  "rand_core",
+  "zeroize",
+], optional = true }
+derive-where = { version = "1", features = ["zeroize-on-drop"] }
 digest = "0.10"
 displaydoc = { version = "0.2", default-features = false }
-elliptic-curve = { version = "=0.12.0-pre.1", features = [
+elliptic-curve = { version = "0.13", features = [
   "hash2curve",
   "sec1",
   "voprf",
 ] }
-generic-array = "0.14"
+generic-array = "1"
 rand_core = { version = "0.6", default-features = false }
-serde_ = { version = "1", package = "serde", default-features = false, features = [
+serde = { version = "1", default-features = false, features = [
   "derive",
 ], optional = true }
 sha2 = { version = "0.10", default-features = false, optional = true }
@@ -45,18 +43,27 @@ subtle = { version = "2.3", default-features = false }
 zeroize = { version = "1.5", default-features = false }
 
 [dev-dependencies]
-generic-array = { version = "0.14", features = ["more_lengths"] }
+generic-array = { version = "1" }
 hex = "0.4"
-json = "0.12"
-p256 = { version = "=0.11.0-pre.0", default-features = false, features = [
+p256 = { version = "0.13", default-features = false, features = [
+  "hash2curve",
+  "voprf",
+] }
+p384 = { version = "0.13", default-features = false, features = [
+  "hash2curve",
+  "voprf",
+] }
+p521 = { version = "0.13.3", default-features = false, features = [
   "hash2curve",
   "voprf",
 ] }
 proptest = "1"
 rand = "0.8"
 regex = "1"
+serde_json = "1"
 sha2 = "0.10"
 
 [package.metadata.docs.rs]
-features = ["danger", "std"]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
 targets = []

LICENSE

@@ -1,12 +0,0 @@
-## License
-
-Licensed under either of
- * Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
- * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
-at your option.
-
-### Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally submitted
-for inclusion in the work by you, as defined in the Apache-2.0 license, shall
-be dual licensed as above, without any additional terms or conditions.

README.md

@@ -3,7 +3,7 @@ An implementation of a (verifiable) oblivious pseudorandom function (VOPRF)
 
 A VOPRF is a verifiable oblivious pseudorandom function, a protocol between a client and a server. The regular (non-verifiable) OPRF is also supported in this implementation.
 
-This implementation is based on the [Internet Draft for VOPRF](https://github.com/cfrg/draft-irtf-cfrg-voprf).
+This implementation is based on [RFC 9497](https://www.rfc-editor.org/rfc/rfc9497).
 
 Documentation
 -------------
@@ -16,12 +16,12 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = "0.4.0-pre.1"
+voprf = "0.6.0-pre.0"
 ```
 
 ### Minimum Supported Rust Version
 
-Rust **1.57** or higher.
+Rust **1.65** or higher.
 
 Contributors
 ------------
@@ -32,4 +32,6 @@ To learn more about contributing to this project, [see this document](./CONTRIBU
 License
 -------
 
-This project is [licensed](./LICENSE) under either Apache 2.0 or MIT, at your option.
+This project is dual-licensed under either the [MIT license](./LICENSE-MIT)
+or the [Apache License, Version 2.0](./LICENSE-APACHE).
+You may select, at your option, one of the above-listed licenses.

src/ciphersuite.rs

@@ -1,16 +1,18 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
 
 use digest::core_api::BlockSizeUser;
-use digest::{Digest, OutputSizeUser};
+use digest::{FixedOutput, HashMarker, OutputSizeUser};
 use elliptic_curve::VoprfParameters;
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
+use generic_array::ArrayLength;
 
 use crate::Group;
 
@@ -18,11 +20,11 @@ use crate::Group;
 pub trait CipherSuite
 where
     <Self::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize>,
+        ArrayLength + IsLess<U256> + IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize>,
 {
     /// The ciphersuite identifier as dictated by
-    /// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
-    const ID: u16;
+    /// <https://www.rfc-editor.org/rfc/rfc9497>
+    const ID: &'static str;
 
     /// A finite cyclic group along with a point representation that allows some
     /// customization on how to hash an input to a curve point. See [`Group`].
@@ -30,17 +32,17 @@ where
 
     /// The main hash function to use (for HKDF computations and hashing
     /// transcripts).
-    type Hash: BlockSizeUser + Digest;
+    type Hash: BlockSizeUser + Default + FixedOutput + HashMarker;
 }
 
 impl<T: VoprfParameters> CipherSuite for T
 where
     T: Group,
-    T::Hash: BlockSizeUser + Digest,
+    T::Hash: BlockSizeUser + Default + FixedOutput + HashMarker,
     <T::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<T::Hash as BlockSizeUser>::BlockSize>,
+        ArrayLength + IsLess<U256> + IsLessOrEqual<<T::Hash as BlockSizeUser>::BlockSize>,
 {
-    const ID: u16 = T::ID;
+    const ID: &'static str = T::ID;
 
     type Group = T;
 

src/common.rs

@@ -1,19 +1,20 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Common functionality between multiple OPRF modes.
 
 use core::convert::TryFrom;
+use core::ops::Add;
 
 use derive_where::derive_where;
-use digest::core_api::BlockSizeUser;
-use digest::{Digest, OutputSizeUser};
+use digest::{Digest, Output, OutputSizeUser};
 use generic_array::sequence::Concat;
-use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U11, U2, U256};
+use generic_array::typenum::{IsLess, Unsigned, U2, U256, U9};
 use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
 use subtle::ConstantTimeEq;
@@ -33,7 +34,7 @@ pub(crate) const STR_DERIVE_KEYPAIR: [u8; 13] = *b"DeriveKeyPair";
 pub(crate) const STR_COMPOSITE: [u8; 9] = *b"Composite";
 pub(crate) const STR_CHALLENGE: [u8; 9] = *b"Challenge";
 pub(crate) const STR_INFO: [u8; 4] = *b"Info";
-pub(crate) const STR_VOPRF: [u8; 8] = *b"VOPRF09-";
+pub(crate) const STR_OPRF: [u8; 7] = *b"OPRFV1-";
 pub(crate) const STR_HASH_TO_SCALAR: [u8; 13] = *b"HashToScalar-";
 pub(crate) const STR_HASH_TO_GROUP: [u8; 12] = *b"HashToGroup-";
 
@@ -72,15 +73,12 @@ impl Mode {
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct BlindedElement<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
     pub(crate)  <CS::Group as Group>::Elem,
-)
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>;
+);
 
 /// The server's response to the [BlindedElement] message from a client (either
 /// verifiable or not) to a server (either verifiable or not).
@@ -89,15 +87,12 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct EvaluationElement<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
     pub(crate)  <CS::Group as Group>::Elem,
-)
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>;
+);
 
 /// Contains prepared [`EvaluationElement`]s by a server batch evaluate
 /// preparation.
@@ -106,12 +101,9 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct PreparedEvaluationElement<CS: CipherSuite>(pub(crate) EvaluationElement<CS>)
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>;
+pub struct PreparedEvaluationElement<CS: CipherSuite>(pub(crate) EvaluationElement<CS>);
 
 /// A proof produced by a server that the OPRF output matches against a server
 /// public key.
@@ -120,13 +112,9 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct Proof<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct Proof<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) c_scalar: <CS::Group as Group>::Scalar,
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
@@ -145,15 +133,11 @@ pub(crate) fn generate_proof<CS: CipherSuite, R: RngCore + CryptoRng>(
     k: <CS::Group as Group>::Scalar,
     a: <CS::Group as Group>::Elem,
     b: <CS::Group as Group>::Elem,
-    cs: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
-    ds: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    cs: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
+    ds: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
     mode: Mode,
-) -> Result<Proof<CS>>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-2.2.1
+) -> Result<Proof<CS>> {
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.1
 
     let (m, z) = compute_composites::<CS, _, _>(Some(k), b, cs, ds, mode)?;
 
@@ -194,9 +178,9 @@ where
         &STR_CHALLENGE,
     ];
 
-    let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
     // This can't fail, the size of the `input` is known.
-    let c_scalar = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+    let c_scalar = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
     let s_scalar = r - &(c_scalar * &k);
 
     Ok(Proof { c_scalar, s_scalar })
@@ -207,16 +191,12 @@ where
 pub(crate) fn verify_proof<CS: CipherSuite>(
     a: <CS::Group as Group>::Elem,
     b: <CS::Group as Group>::Elem,
-    cs: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
-    ds: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    cs: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
+    ds: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
     proof: &Proof<CS>,
     mode: Mode,
-) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-2.2.2
+) -> Result<()> {
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.2
     let (m, z) = compute_composites::<CS, _, _>(None, b, cs, ds, mode)?;
     let t2 = (a * &proof.s_scalar) + &(b * &proof.c_scalar);
     let t3 = (m * &proof.s_scalar) + &(z * &proof.c_scalar);
@@ -254,9 +234,9 @@ where
         &STR_CHALLENGE,
     ];
 
-    let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
     // This can't fail, the size of the `input` is known.
-    let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+    let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
 
     match c.ct_eq(&proof.c_scalar).into() {
         true => Ok(()),
@@ -280,12 +260,8 @@ fn compute_composites<
     c_slice: IC,
     d_slice: ID,
     mode: Mode,
-) -> Result<ComputeCompositesResult<CS>>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#section-2.2.1
+) -> Result<ComputeCompositesResult<CS>> {
+    // https://www.rfc-editor.org/rfc/rfc9497#section-2.2.1
 
     let elem_len = <CS::Group as Group>::ElemLen::U16.to_be_bytes();
 
@@ -296,18 +272,18 @@ where
     let len = u16::try_from(c_slice.len()).map_err(|_| Error::Batch)?;
 
     // seedDST = "Seed-" || contextString
-    let seed_dst = GenericArray::from(STR_SEED).concat(create_context_string::<CS>(mode));
+    let seed_dst = Dst::new::<CS, _, _>(STR_SEED, mode);
 
     // h1Input = I2OSP(len(Bm), 2) || Bm ||
     //           I2OSP(len(seedDST), 2) || seedDST
     // seed = Hash(h1Input)
     let seed = CS::Hash::new()
-        .chain_update(&elem_len)
+        .chain_update(elem_len)
         .chain_update(CS::Group::serialize_elem(b))
-        .chain_update(i2osp_2_array(&seed_dst))
-        .chain_update(seed_dst)
+        .chain_update(seed_dst.i2osp_2())
+        .chain_update_multi(&seed_dst.as_dst())
         .finalize();
-    let seed_len = i2osp_2_array(&seed);
+    let seed_len = i2osp_2_array::<<CS::Hash as OutputSizeUser>::OutputSize>();
 
     let mut m = CS::Group::identity_elem();
     let mut z = CS::Group::identity_elem();
@@ -332,9 +308,9 @@ where
             &STR_COMPOSITE,
         ];
 
-        let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
         // This can't fail, the size of the `input` is known.
-        let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+        let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
         m = c * &di + &m;
         z = match k_option {
             Some(_) => z,
@@ -356,17 +332,12 @@ where
 /////////////////////
 
 /// Can only fail with [`Error::DeriveKeyPair`] and [`Error::Protocol`].
-pub(crate) fn derive_key<CS: CipherSuite>(
+pub(crate) fn derive_key_internal<CS: CipherSuite>(
     seed: &[u8],
     info: &[u8],
     mode: Mode,
-) -> Result<<CS::Group as Group>::Scalar, Error>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    let context_string = create_context_string::<CS>(mode);
-    let dst = GenericArray::from(STR_DERIVE_KEYPAIR).concat(context_string);
+) -> Result<<CS::Group as Group>::Scalar, Error> {
+    let dst = Dst::new::<CS, _, _>(STR_DERIVE_KEYPAIR, mode);
 
     let info_len = i2osp_2(info.len()).map_err(|_| Error::DeriveKeyPair)?;
 
@@ -376,7 +347,7 @@ where
         // || contextString)
         let sk_s = CS::Group::hash_to_scalar::<CS::Hash>(
             &[seed, &info_len, info, &counter.to_be_bytes()],
-            &dst,
+            &dst.as_dst(),
         )
         .map_err(|_| Error::DeriveKeyPair)?;
 
@@ -388,6 +359,21 @@ where
     Err(Error::Protocol)
 }
 
+/// Corresponds to DeriveKeyPair() function from the VOPRF specification.
+///
+/// # Errors
+/// - [`Error::DeriveKeyPair`] if the `input` and `seed` together are longer
+///   then `u16::MAX - 3`.
+/// - [`Error::Protocol`] if the protocol fails and can't be completed.
+#[cfg(feature = "danger")]
+pub fn derive_key<CS: CipherSuite>(
+    seed: &[u8],
+    info: &[u8],
+    mode: Mode,
+) -> Result<<CS::Group as Group>::Scalar, Error> {
+    derive_key_internal::<CS>(seed, info, mode)
+}
+
 type DeriveKeypairResult<CS> = (
     <<CS as CipherSuite>::Group as Group>::Scalar,
     <<CS as CipherSuite>::Group as Group>::Elem,
@@ -398,12 +384,8 @@ pub(crate) fn derive_keypair<CS: CipherSuite>(
     seed: &[u8],
     info: &[u8],
     mode: Mode,
-) -> Result<DeriveKeypairResult<CS>, Error>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    let sk_s = derive_key::<CS>(seed, info, mode)?;
+) -> Result<DeriveKeypairResult<CS>, Error> {
+    let sk_s = derive_key_internal::<CS>(seed, info, mode)?;
     let pk_s = CS::Group::base_elem() * &sk_s;
 
     Ok((sk_s, pk_s))
@@ -418,27 +400,111 @@ pub(crate) fn deterministic_blind_unchecked<CS: CipherSuite>(
     input: &[u8],
     blind: &<CS::Group as Group>::Scalar,
     mode: Mode,
-) -> Result<<CS::Group as Group>::Elem>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
-    let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-    let hashed_point =
-        CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).map_err(|_| Error::Input)?;
+) -> Result<<CS::Group as Group>::Elem> {
+    let hashed_point = hash_to_group::<CS>(input, mode)?;
     Ok(hashed_point * blind)
 }
 
-/// Generates the contextString parameter as defined in
-/// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
-pub(crate) fn create_context_string<CS: CipherSuite>(mode: Mode) -> GenericArray<u8, U11>
+/// Hashes `input` to a point on the curve
+pub(crate) fn hash_to_group<CS: CipherSuite>(
+    input: &[u8],
+    mode: Mode,
+) -> Result<<CS::Group as Group>::Elem> {
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+    CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).map_err(|_| Error::Input)
+}
+
+/// Internal function that finalizes the hash input for OPRF, VOPRF & POPRF.
+/// Returned values can only fail with [`Error::Input`].
+pub(crate) fn server_evaluate_hash_input<CS: CipherSuite>(
+    input: &[u8],
+    info: Option<&[u8]>,
+    issued_element: GenericArray<u8, <<CS as CipherSuite>::Group as Group>::ElemLen>,
+) -> Result<Output<CS::Hash>> {
+    // OPRF & VOPRF
+    // hashInput = I2OSP(len(input), 2) || input ||
+    //             I2OSP(len(issuedElement), 2) || issuedElement ||
+    //             "Finalize"
+    // return Hash(hashInput)
+    //
+    // POPRF
+    // hashInput = I2OSP(len(input), 2) || input ||
+    //             I2OSP(len(info), 2) || info ||
+    //             I2OSP(len(issuedElement), 2) || issuedElement ||
+    //             "Finalize"
+
+    let mut hash = CS::Hash::new()
+        .chain_update(i2osp_2(input.as_ref().len()).map_err(|_| Error::Input)?)
+        .chain_update(input.as_ref());
+    if let Some(info) = info {
+        hash = hash
+            .chain_update(i2osp_2(info.as_ref().len()).map_err(|_| Error::Input)?)
+            .chain_update(info.as_ref());
+    }
+    Ok(hash
+        .chain_update(i2osp_2(issued_element.as_slice().len()).map_err(|_| Error::Input)?)
+        .chain_update(issued_element)
+        .chain_update(STR_FINALIZE)
+        .finalize())
+}
+
+pub(crate) struct Dst<L: ArrayLength> {
+    dst_1: GenericArray<u8, L>,
+    dst_2: &'static str,
+}
+
+impl<L: ArrayLength> Dst<L> {
+    pub(crate) fn new<CS, T, TL>(par_1: T, mode: Mode) -> Self
+    where
+        CS: CipherSuite,
+        T: Into<GenericArray<u8, TL>>,
+        TL: ArrayLength + Add<U9, Output = L>,
+    {
+        let par_1 = par_1.into();
+        // Generates the contextString parameter as defined in
+        // <https://www.rfc-editor.org/rfc/rfc9497#section-3.1>
+        let par_2 = GenericArray::from(STR_OPRF)
+            .concat([mode.to_u8()].into())
+            .concat([b'-'].into());
+
+        let dst_1 = par_1.concat(par_2);
+        let dst_2 = CS::ID;
+
+        assert!(
+            L::USIZE + dst_2.len() <= u16::MAX.into(),
+            "constructed DST longer then {}",
+            u16::MAX
+        );
+
+        Self { dst_1, dst_2 }
+    }
+
+    pub(crate) fn as_dst(&self) -> [&[u8]; 2] {
+        [&self.dst_1, self.dst_2.as_bytes()]
+    }
+
+    pub(crate) fn i2osp_2(&self) -> [u8; 2] {
+        u16::try_from(L::USIZE + self.dst_2.len())
+            .unwrap()
+            .to_be_bytes()
+    }
+}
+
+trait DigestExt {
+    fn chain_update_multi(self, data: &[&[u8]]) -> Self;
+}
+
+impl<T> DigestExt for T
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
+    T: Digest,
 {
-    GenericArray::from(STR_VOPRF)
-        .concat([mode.to_u8()].into())
-        .concat(CS::ID.to_be_bytes().into())
+    fn chain_update_multi(mut self, datas: &[&[u8]]) -> Self {
+        for data in datas {
+            self.update(data)
+        }
+
+        self
+    }
 }
 
 ///////////////////////
@@ -452,8 +518,6 @@ pub(crate) fn i2osp_2(input: usize) -> Result<[u8; 2], InternalError> {
         .map_err(|_| InternalError::I2osp)
 }
 
-pub(crate) fn i2osp_2_array<L: ArrayLength<u8> + IsLess<U256>>(
-    _: &GenericArray<u8, L>,
-) -> GenericArray<u8, U2> {
+pub(crate) fn i2osp_2_array<L: ArrayLength + IsLess<U256>>() -> GenericArray<u8, U2> {
     L::U16.to_be_bytes().into()
 }

src/error.rs

@@ -1,19 +1,18 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Errors which are produced during an execution of the protocol
 
-use displaydoc::Display;
-
 /// [`Result`](core::result::Result) shorthand that uses [`Error`].
 pub type Result<T, E = Error> = core::result::Result<T, E>;
 
 /// Represents an error in the manipulation of internal cryptographic data
-#[derive(Clone, Copy, Debug, Display, Eq, Hash, Ord, PartialEq, PartialOrd)]
+#[derive(Clone, Copy, Debug, displaydoc::Display, Eq, Hash, Ord, PartialEq, PartialOrd)]
 pub enum Error {
     /// Size of info is longer then [`u16::MAX`].
     Info,
@@ -40,5 +39,4 @@ pub enum InternalError {
     I2osp,
 }
 
-#[cfg(feature = "std")]
-impl std::error::Error for Error {}
+impl core::error::Error for Error {}

src/group/elliptic_curve.rs

@@ -1,55 +1,70 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
+
+use core::ops::Add;
 
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
+use digest::{FixedOutput, HashMarker};
 use elliptic_curve::group::cofactor::CofactorGroup;
 use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
 use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
 use elliptic_curve::{
-    AffinePoint, Field, FieldSize, Group as _, ProjectivePoint, PublicKey, Scalar, SecretKey,
+    AffinePoint, Field, FieldBytes, FieldBytesSize, Group as _, ProjectivePoint, PublicKey, Scalar,
+    SecretKey,
 };
-use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
-use generic_array::GenericArray;
+use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
+use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
 
 use super::Group;
 use crate::{Error, InternalError, Result};
 
+type ElemLen<C> = <ScalarLen<C> as ModulusSize>::CompressedPointSize;
+type ScalarLen<C> = FieldBytesSize<C>;
+
 impl<C> Group for C
 where
     C: GroupDigest,
     ProjectivePoint<Self>: CofactorGroup + ToEncodedPoint<Self>,
-    FieldSize<Self>: ModulusSize,
+    ScalarLen<Self>: ModulusSize,
+    ScalarLen<Self>: ArrayLength,
     AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
     Scalar<Self>: FromOkm,
+    // `VoprfClientLen`, `PoprfClientLen`, `VoprfServerLen`, `PoprfServerLen`
+    ScalarLen<Self>: Add<ElemLen<Self>>,
+    Sum<ScalarLen<Self>, ElemLen<Self>>: ArrayLength,
+    // `ProofLen`
+    ScalarLen<Self>: Add<ScalarLen<Self>>,
+    Sum<ScalarLen<Self>, ScalarLen<Self>>: ArrayLength,
+    ElemLen<Self>: ArrayLength,
 {
     type Elem = ProjectivePoint<Self>;
 
-    type ElemLen = <FieldSize<Self> as ModulusSize>::CompressedPointSize;
+    type ElemLen = ElemLen<Self>;
 
     type Scalar = Scalar<Self>;
 
-    type ScalarLen = FieldSize<Self>;
+    type ScalarLen = ScalarLen<Self>;
 
     // Implements the `hash_to_curve()` function from
-    // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    // https://www.rfc-editor.org/rfc/rfc9380.html#section-3
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         Self::hash_from_bytes::<ExpandMsgXmd<H>>(input, dst).map_err(|_| InternalError::Input)
     }
 
     // Implements the `HashToScalar()` function
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         <Self as GroupDigest>::hash_to_scalar::<ExpandMsgXmd<H>>(input, dst)
@@ -92,15 +107,18 @@ where
 
     #[cfg(test)]
     fn zero_scalar() -> Self::Scalar {
-        Scalar::<Self>::zero()
+        Scalar::<Self>::ZERO
     }
 
     fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
-        scalar.into()
+        let bytes: FieldBytes<Self> = scalar.into();
+        let mut result = GenericArray::<u8, Self::ScalarLen>::default();
+        result.as_mut_slice().copy_from_slice(bytes.as_ref());
+        result
     }
 
     fn deserialize_scalar(scalar_bits: &[u8]) -> Result<Self::Scalar> {
-        SecretKey::<Self>::from_be_bytes(scalar_bits)
+        SecretKey::<Self>::from_slice(scalar_bits)
             .map(|secret_key| *secret_key.to_nonzero_scalar())
             .map_err(|_| Error::Deserialization)
     }

src/group/mod.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Defines the Group trait to specify the underlying prime order group
 
@@ -14,8 +15,8 @@ mod ristretto;
 use core::ops::{Add, Mul, Sub};
 
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
-use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
+use digest::{FixedOutput, HashMarker};
+use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
 use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
 #[cfg(feature = "ristretto255")]
@@ -26,8 +27,16 @@ use zeroize::Zeroize;
 use crate::{InternalError, Result};
 
 /// A prime-order subgroup of a base field (EC, prime-order field ...). This
-/// subgroup is noted additively — as in the draft RFC — in this trait.
-pub trait Group {
+/// subgroup is noted additively — as in the RFC — in this trait.
+pub trait Group
+where
+    // `VoprfClientLen`, `PoprfClientLen`, `VoprfServerLen`, `PoprfServerLen`
+    Self::ScalarLen: Add<Self::ElemLen>,
+    Sum<Self::ScalarLen, Self::ElemLen>: ArrayLength,
+    // `ProofLen`
+    Self::ScalarLen: Add<Self::ScalarLen>,
+    Sum<Self::ScalarLen, Self::ScalarLen>: ArrayLength,
+{
     /// The type of group elements
     type Elem: ConstantTimeEq
         + Copy
@@ -36,7 +45,7 @@ pub trait Group {
         + for<'a> Mul<&'a Self::Scalar, Output = Self::Elem>;
 
     /// The byte length necessary to represent group elements
-    type ElemLen: ArrayLength<u8> + 'static;
+    type ElemLen: ArrayLength + 'static;
 
     /// The type of base field scalars
     type Scalar: ConstantTimeEq
@@ -47,16 +56,16 @@ pub trait Group {
         + for<'a> Sub<&'a Self::Scalar, Output = Self::Scalar>;
 
     /// The byte length necessary to represent scalars
-    type ScalarLen: ArrayLength<u8> + 'static;
+    type ScalarLen: ArrayLength + 'static;
 
     /// Transforms a password and domain separation tag (DST) into a curve point
     ///
     /// # Errors
     /// [`Error::Input`](crate::Error::Input) if the `input` is empty or longer
     /// then [`u16::MAX`].
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
 
     /// Hashes a slice of pseudo-random bytes to a scalar
@@ -64,9 +73,9 @@ pub trait Group {
     /// # Errors
     /// [`Error::Input`](crate::Error::Input) if the `input` is empty or longer
     /// then [`u16::MAX`].
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
 
     /// Get the base point for the group

src/group/ristretto.rs

@@ -1,16 +1,17 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
 use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
 use curve25519_dalek::scalar::Scalar;
 use curve25519_dalek::traits::Identity;
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
+use digest::{FixedOutput, HashMarker};
 use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
 use generic_array::GenericArray;
@@ -22,21 +23,17 @@ use crate::{Error, InternalError, Result};
 
 /// [`Group`] implementation for Ristretto255.
 #[derive(Clone, Copy, Debug, Default, Eq, Hash, Ord, PartialEq, PartialOrd)]
-// `cfg` here is only needed because of a bug in Rust's crate feature documentation. See: https://github.com/rust-lang/rust/issues/83428
-#[cfg(feature = "ristretto255")]
 pub struct Ristretto255;
 
 #[cfg(feature = "ristretto255-ciphersuite")]
 impl crate::CipherSuite for Ristretto255 {
-    const ID: u16 = 0x0001;
+    const ID: &'static str = "ristretto255-SHA512";
 
     type Group = Ristretto255;
 
     type Hash = sha2::Sha512;
 }
 
-// `cfg` here is only needed because of a bug in Rust's crate feature documentation. See: https://github.com/rust-lang/rust/issues/83428
-#[cfg(feature = "ristretto255")]
 impl Group for Ristretto255 {
     type Elem = RistrettoPoint;
 
@@ -47,10 +44,10 @@ impl Group for Ristretto255 {
     type ScalarLen = U32;
 
     // Implements the `hash_to_ristretto255()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    // https://www.rfc-editor.org/rfc/rfc9380.html#appendix-B
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         let mut uniform_bytes = GenericArray::<_, U64>::default();
@@ -62,10 +59,10 @@ impl Group for Ristretto255 {
     }
 
     // Implements the `HashToScalar()` function from
-    // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    // https://www.rfc-editor.org/rfc/rfc9497#section-4.1
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         let mut uniform_bytes = GenericArray::<_, U64>::default();
@@ -90,11 +87,8 @@ impl Group for Ristretto255 {
     }
 
     fn deserialize_elem(element_bits: &[u8]) -> Result<Self::Elem> {
-        if element_bits.len() != 32 {
-            return Err(Error::Deserialization);
-        }
-
         CompressedRistretto::from_slice(element_bits)
+            .map_err(|_| Error::Deserialization)?
             .decompress()
             .filter(|point| point != &RistrettoPoint::identity())
             .ok_or(Error::Deserialization)
@@ -102,9 +96,10 @@ impl Group for Ristretto255 {
 
     fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
         loop {
-            let scalar = Scalar::random(rng);
+            let mut scalar_bytes = [0u8; 32];
+            rng.fill_bytes(&mut scalar_bytes);
 
-            if scalar != Scalar::zero() {
+            if let Ok(scalar) = Self::deserialize_scalar(&scalar_bytes) {
                 break scalar;
             }
         }
@@ -115,12 +110,12 @@ impl Group for Ristretto255 {
     }
 
     fn is_zero_scalar(scalar: Self::Scalar) -> subtle::Choice {
-        scalar.ct_eq(&Scalar::zero())
+        scalar.ct_eq(&Scalar::ZERO)
     }
 
     #[cfg(test)]
     fn zero_scalar() -> Self::Scalar {
-        Scalar::zero()
+        Scalar::ZERO
     }
 
     fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
@@ -131,8 +126,8 @@ impl Group for Ristretto255 {
         scalar_bits
             .try_into()
             .ok()
-            .and_then(Scalar::from_canonical_bytes)
-            .filter(|scalar| scalar != &Scalar::zero())
+            .and_then(|bytes| Scalar::from_canonical_bytes(bytes).into())
+            .filter(|scalar| scalar != &Scalar::ZERO)
             .ok_or(Error::Deserialization)
     }
 }

src/group/tests.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Includes a series of tests for the group implementations
 
@@ -15,6 +16,8 @@ use crate::{Error, Group, Result};
 #[test]
 fn test_group_properties() -> Result<()> {
     use p256::NistP256;
+    use p384::NistP384;
+    use p521::NistP521;
 
     #[cfg(feature = "ristretto255")]
     {
@@ -27,6 +30,12 @@ fn test_group_properties() -> Result<()> {
     test_identity_element_error::<NistP256>()?;
     test_zero_scalar_error::<NistP256>()?;
 
+    test_identity_element_error::<NistP384>()?;
+    test_zero_scalar_error::<NistP384>()?;
+
+    test_identity_element_error::<NistP521>()?;
+    test_zero_scalar_error::<NistP521>()?;
+
     Ok(())
 }
 

src/lib.rs

@@ -1,16 +1,15 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-09](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html),
-//! but this specification is subject to change, until the final version
-//! published by the IETF.
+//! [RFC 9497](https://www.rfc-editor.org/rfc/rfc9497).
 //!
 //! # Overview
 //!
@@ -36,18 +35,19 @@
 //!   VOPRF, where a public input can be supplied to the PRF computation
 //!
 //! In all of these modes, the protocol begins with a client blinding, followed
-//! by a server evaluation, and finishes with a client finalization.
+//! by a server evaluation, and finishes with a client finalization and server
+//! evaluation.
 //!
 //! ## Base Mode
 //!
-//! In base mode, an [OprfClient] interacts with an [OprfServer]
-//! to compute the output of the OPRF.
+//! In base mode, an [OprfClient] interacts with an [OprfServer] to compute the
+//! output of the OPRF.
 //!
 //! ### Server Setup
 //!
 //! The protocol begins with a setup phase, in which the server must run
-//! [OprfServer::new()] to produce an instance of itself. This instance
-//! must be persisted on the server and used for online client evaluations.
+//! [OprfServer::new()] to produce an instance of itself. This instance must be
+//! persisted on the server and used for online client evaluations.
 //!
 //! ```
 //! # #[cfg(feature = "ristretto255")]
@@ -64,11 +64,10 @@
 //!
 //! ### Client Blinding
 //!
-//! In the first step, the client chooses an input, and runs
-//! [OprfClient::blind] to produce an [OprfClientBlindResult],
-//! which consists of a [BlindedElement] to be sent to the server and an
-//! [OprfClient] which must be persisted on the client for the final
-//! step of the VOPRF protocol.
+//! In the first step, the client chooses an input, and runs [OprfClient::blind]
+//! to produce an [OprfClientBlindResult], which consists of a [BlindedElement]
+//! to be sent to the server and an [OprfClient] which must be persisted on the
+//! client for the final step of the VOPRF protocol.
 //!
 //! ```
 //! # #[cfg(feature = "ristretto255")]
@@ -84,11 +83,11 @@
 //!     .expect("Unable to construct client");
 //! ```
 //!
-//! ### Server Evaluation
+//! ### Server Blind Evaluation
 //!
 //! In the second step, the server takes as input the message from
 //! [OprfClient::blind] (a [BlindedElement]), and runs
-//! [OprfServer::evaluate] to produce [EvaluationElement] to be sent to
+//! [OprfServer::blind_evaluate] to produce [EvaluationElement] to be sent to
 //! the client.
 //!
 //! ```
@@ -107,13 +106,13 @@
 //! # use voprf::OprfServer;
 //! # let mut server_rng = OsRng;
 //! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
-//! let server_evaluate_result = server.evaluate(&client_blind_result.message);
+//! let server_evaluate_result = server.blind_evaluate(&client_blind_result.message);
 //! ```
 //!
 //! ### Client Finalization
 //!
-//! In the final step, the client takes as input the message from
-//! [OprfServer::evaluate] (an [EvaluationElement]), and runs
+//! In the final step on the client side, the client takes as input the message
+//! from [OprfServer::evaluate] (an [EvaluationElement]), and runs
 //! [OprfClient::finalize] to produce an output for the protocol.
 //!
 //! ```
@@ -132,7 +131,7 @@
 //! # use voprf::OprfServer;
 //! # let mut server_rng = OsRng;
 //! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
-//! # let message = server.evaluate(&client_blind_result.message);
+//! # let message = server.blind_evaluate(&client_blind_result.message);
 //! let client_finalize_result = client_blind_result
 //!     .state
 //!     .finalize(b"input", &message)
@@ -141,10 +140,47 @@
 //! println!("VOPRF output: {:?}", client_finalize_result.to_vec());
 //! ```
 //!
+//! ### Server Evaluation
+//!
+//! Optionally, if the server has direct access to the PRF input, then it need
+//! not perform the oblivious computation and can simply run
+//! [OprfServer::evaluate] to generate an output which matches the output
+//! produced by an execution of the oblivious protocol on the same input and
+//! key.
+//!
+//! ```
+//! # #[cfg(feature = "ristretto255")]
+//! # type CipherSuite = voprf::Ristretto255;
+//! # #[cfg(not(feature = "ristretto255"))]
+//! # type CipherSuite = p256::NistP256;
+//! # use voprf::OprfClient;
+//! # use rand::{rngs::OsRng, RngCore};
+//! #
+//! # let mut client_rng = OsRng;
+//! # let client_blind_result = OprfClient::<CipherSuite>::blind(
+//! #     b"input",
+//! #     &mut client_rng,
+//! # ).expect("Unable to construct client");
+//! # use voprf::OprfServer;
+//! # let mut server_rng = OsRng;
+//! # let server = OprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
+//! # let message = server.blind_evaluate(&client_blind_result.message);
+//! let client_finalize_result = client_blind_result
+//!     .state
+//!     .finalize(b"input", &message)
+//!     .expect("Unable to perform client finalization");
+//!
+//! let server_evaluate_result = server
+//!     .evaluate(b"input")
+//!     .expect("Unable to perform the server evaluation");
+//!
+//! assert_eq!(client_finalize_result, server_evaluate_result);
+//! ```
+//!
 //! ## Verifiable Mode
 //!
-//! In verifiable mode, a [VoprfClient] interacts with a [VoprfServer]
-//! to compute the output of the VOPRF. In order to verify the server's
+//! In verifiable mode, a [VoprfClient] interacts with a [VoprfServer] to
+//! compute the output of the VOPRF. In order to verify the server's
 //! computation, the client checks a server-generated proof against the server's
 //! public key. If the proof fails to verify, then the client does not receive
 //! an output.
@@ -156,8 +192,8 @@
 //! ### Server Setup
 //!
 //! The protocol begins with a setup phase, in which the server must run
-//! [VoprfServer::new()] to produce an instance of itself. This instance
-//! must be persisted on the server and used for online client evaluations.
+//! [VoprfServer::new()] to produce an instance of itself. This instance must be
+//! persisted on the server and used for online client evaluations.
 //!
 //! ```
 //! # #[cfg(feature = "ristretto255")]
@@ -182,10 +218,9 @@
 //! ### Client Blinding
 //!
 //! In the first step, the client chooses an input, and runs
-//! [VoprfClient::blind] to produce a [VoprfClientBlindResult], which
-//! consists of a [BlindedElement] to be sent to the server and a
-//! [VoprfClient] which must be persisted on the client for the final step
-//! of the VOPRF protocol.
+//! [VoprfClient::blind] to produce a [VoprfClientBlindResult], which consists
+//! of a [BlindedElement] to be sent to the server and a [VoprfClient] which
+//! must be persisted on the client for the final step of the VOPRF protocol.
 //!
 //! ```
 //! # #[cfg(feature = "ristretto255")]
@@ -201,11 +236,11 @@
 //!     .expect("Unable to construct client");
 //! ```
 //!
-//! ### Server Evaluation
+//! ### Server Blind Evaluation
 //!
 //! In the second step, the server takes as input the message from
 //! [VoprfClient::blind] (a [BlindedElement]), and runs
-//! [VoprfServer::evaluate] to produce a [VoprfServerEvaluateResult],
+//! [VoprfServer::blind_evaluate] to produce a [VoprfServerEvaluateResult],
 //! which consists of an [EvaluationElement] to be sent to the client along with
 //! a proof.
 //!
@@ -226,15 +261,15 @@
 //! # let mut server_rng = OsRng;
 //! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
 //! let VoprfServerEvaluateResult { message, proof } =
-//!     server.evaluate(&mut server_rng, &client_blind_result.message);
+//!     server.blind_evaluate(&mut server_rng, &client_blind_result.message);
 //! ```
 //!
 //! ### Client Finalization
 //!
 //! In the final step, the client takes as input the message from
-//! [VoprfServer::evaluate] (an [EvaluationElement]), the proof, and the
-//! server's public key, and runs [VoprfClient::finalize] to produce an
-//! output for the protocol.
+//! [VoprfServer::blind_evaluate] (an [EvaluationElement]), the proof, and the
+//! server's public key, and runs [VoprfClient::finalize] to produce an output
+//! for the protocol.
 //!
 //! ```
 //! # #[cfg(feature = "ristretto255")]
@@ -252,7 +287,7 @@
 //! # use voprf::VoprfServer;
 //! # let mut server_rng = OsRng;
 //! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
-//! # let server_evaluate_result = server.evaluate(
+//! # let server_evaluate_result = server.blind_evaluate(
 //! #     &mut server_rng,
 //! #     &client_blind_result.message,
 //! # );
@@ -269,6 +304,51 @@
 //! println!("VOPRF output: {:?}", client_finalize_result.to_vec());
 //! ```
 //!
+//! ### Server Evaluation
+//!
+//! Optionally, if the server has direct access to the PRF input, then it need
+//! not perform the oblivious computation and can simply run
+//! [VoprfServer::evaluate] to generate an output which matches the output
+//! produced by an execution of the oblivious protocol on the same input and
+//! key.
+//!
+//! ```
+//! # #[cfg(feature = "ristretto255")]
+//! # type CipherSuite = voprf::Ristretto255;
+//! # #[cfg(not(feature = "ristretto255"))]
+//! # type CipherSuite = p256::NistP256;
+//! # use voprf::VoprfClient;
+//! # use rand::{rngs::OsRng, RngCore};
+//! #
+//! # let mut client_rng = OsRng;
+//! # let client_blind_result = VoprfClient::<CipherSuite>::blind(
+//! #     b"input",
+//! #     &mut client_rng,
+//! # ).expect("Unable to construct client");
+//! # use voprf::VoprfServer;
+//! # let mut server_rng = OsRng;
+//! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
+//! # let server_evaluate_result = server.blind_evaluate(
+//! #     &mut server_rng,
+//! #     &client_blind_result.message,
+//! # );
+//! let client_finalize_result = client_blind_result
+//!     .state
+//!     .finalize(
+//!         b"input",
+//!         &server_evaluate_result.message,
+//!         &server_evaluate_result.proof,
+//!         server.get_public_key(),
+//!     )
+//!     .expect("Unable to perform client finalization");
+//!
+//! let server_evaluate_result = server
+//!     .evaluate(b"input")
+//!     .expect("Unable to perform the server evaluation");
+//!
+//! assert_eq!(client_finalize_result, server_evaluate_result);
+//! ```
+//!
 //! # Advanced Usage
 //!
 //! There are two additional (and optional) extensions to the core VOPRF
@@ -279,9 +359,9 @@
 //!
 //! It is sometimes desirable to generate only a single, constant-size proof for
 //! an unbounded number of VOPRF evaluations (on arbitrary inputs).
-//! [VoprfClient] and [VoprfServer] support a batch API for handling
-//! this case. In the following example, we show how to use the batch API to
-//! produce a single proof for 10 parallel VOPRF evaluations.
+//! [VoprfClient] and [VoprfServer] support a batch API for handling this case.
+//! In the following example, we show how to use the batch API to produce a
+//! single proof for 10 parallel VOPRF evaluations.
 //!
 //! First, the client produces 10 blindings, storing their resulting states and
 //! messages:
@@ -305,8 +385,8 @@
 //! }
 //! ```
 //!
-//! Next, the server calls the [VoprfServer::batch_evaluate_prepare] and
-//! [VoprfServer::batch_evaluate_finish] function on a set of client
+//! Next, the server calls the [VoprfServer::batch_blind_evaluate_prepare] and
+//! [VoprfServer::batch_blind_evaluate_finish] function on a set of client
 //! messages, to produce a corresponding set of messages to be returned to the
 //! client (returned in the same order), along with a single proof:
 //!
@@ -332,15 +412,15 @@
 //! # use voprf::VoprfServer;
 //! let mut server_rng = OsRng;
 //! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
-//! let prepared_evaluation_elements = server.batch_evaluate_prepare(client_messages.iter());
+//! let prepared_evaluation_elements = server.batch_blind_evaluate_prepare(client_messages.iter());
 //! let prepared_elements: Vec<_> = prepared_evaluation_elements.collect();
 //! let VoprfServerBatchEvaluateFinishResult { messages, proof } = server
-//!     .batch_evaluate_finish(&mut server_rng, client_messages.iter(), &prepared_elements)
+//!     .batch_blind_evaluate_finish(&mut server_rng, client_messages.iter(), &prepared_elements)
 //!     .expect("Unable to perform server batch evaluate");
 //! let messages: Vec<_> = messages.collect();
 //! ```
 //!
-//! If `alloc` is available, `VoprfServer::batch_evaluate` can be called
+//! If `alloc` is available, `VoprfServer::batch_blind_evaluate` can be called
 //! to avoid having to collect output manually:
 //!
 //! ```
@@ -367,15 +447,15 @@
 //! let mut server_rng = OsRng;
 //! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
 //! let VoprfServerBatchEvaluateResult { messages, proof } = server
-//!     .batch_evaluate(&mut server_rng, &client_messages)
+//!     .batch_blind_evaluate(&mut server_rng, &client_messages)
 //!     .expect("Unable to perform server batch evaluate");
 //! # }
 //! ```
 //!
-//! Then, the client calls [VoprfClient::batch_finalize] on the client
-//! states saved from the first step, along with the messages returned by the
-//! server, along with the server's proof, in order to produce a vector of
-//! outputs if the proof verifies correctly.
+//! Then, the client calls [VoprfClient::batch_finalize] on the client states
+//! saved from the first step, along with the messages returned by the server,
+//! along with the server's proof, in order to produce a vector of outputs if
+//! the proof verifies correctly.
 //!
 //! ```
 //! # #[cfg(feature = "alloc")] {
@@ -401,7 +481,7 @@
 //! # let mut server_rng = OsRng;
 //! # let server = VoprfServer::<CipherSuite>::new(&mut server_rng).unwrap();
 //! # let VoprfServerBatchEvaluateResult { messages, proof } = server
-//! #     .batch_evaluate(&mut server_rng, &client_messages)
+//! #     .batch_blind_evaluate(&mut server_rng, &client_messages)
 //! #     .expect("Unable to perform server batch evaluate");
 //! let client_batch_finalize_result = VoprfClient::batch_finalize(
 //!     &[b"input"; 10],
@@ -420,17 +500,17 @@
 //! ## Metadata
 //!
 //! The optional metadata parameter included in the POPRF mode allows clients
-//! and servers to cryptographically bind additional data to the
-//! VOPRF output. This metadata is known to both parties at the start of the
-//! protocol, and is inserted under the server's evaluate step and the client's
-//! finalize step. This metadata can be constructed with some type of
-//! higher-level domain separation to avoid cross-protocol attacks or related
-//! issues.
+//! and servers to cryptographically bind additional data to the VOPRF output.
+//! This metadata is known to both parties at the start of the protocol, and is
+//! inserted under the server's blind evaluate step and the client's finalize
+//! step. This metadata can be constructed with some type of higher-level domain
+//! separation to avoid cross-protocol attacks or related issues.
 //!
 //! The API for POPRF mode is similar to VOPRF mode, except that a [PoprfServer]
 //! and [PoprfClient] are used, and that each of the functions accept an
 //! additional (and optional) info parameter which represents the public input.
-//! See <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-09.html#name-poprf-public-input>
+//! See
+//! <https://www.rfc-editor.org/rfc/rfc9497#name-poprf-public-input>
 //! for more detailed information on how this public input should be used.
 //!
 //! # Features
@@ -451,23 +531,15 @@
 //!   a [`CipherSuite`].
 //!
 //! - The `ristretto255` feature enables using [`Ristretto255`] as the
-//!   underlying group for the [Group] choice. A backend feature, which are
-//!   re-exported from [curve25519-dalek] and allow for selecting the
-//!   corresponding backend for the curve arithmetic used, has to be selected,
-//!   otherwise compilation will fail. The `ristretto255-u64` feature is
-//!   included as the default. Other features are mapped as `ristretto255-u32`,
-//!   `ristretto255-fiat-u64` and `ristretto255-fiat-u32`. Any `ristretto255-*`
-//!   backend feature will enable the `ristretto255` feature.
+//!   underlying group for the [Group] choice. To select a specific backend see
+//!   the [curve25519-dalek] documentation.
 //!
-//! - The `ristretto255-simd` feature is re-exported from [curve25519-dalek] and
-//!   enables parallel formulas, using either AVX2 or AVX512-IFMA. This will
-//!   automatically enable the `ristretto255-u64` feature and requires Rust
-//!   nightly.
-//!
-//! [curve25519-dalek]: (https://doc.dalek.rs/curve25519_dalek/index.html#backends-and-features)
+//! [curve25519-dalek]:
+//!     (https://docs.rs/curve25519-dalek/4.0.0-pre.5/curve25519_dalek/index.html#backends)
 
-#![cfg_attr(not(test), deny(unsafe_code))]
 #![no_std]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![cfg_attr(not(test), deny(unsafe_code))]
 #![warn(
     clippy::cargo,
     clippy::missing_errors_doc,
@@ -482,9 +554,6 @@ extern crate alloc;
 #[cfg(feature = "std")]
 extern crate std;
 
-#[cfg(feature = "serde")]
-extern crate serde_ as serde;
-
 mod ciphersuite;
 mod common;
 mod error;
@@ -500,6 +569,8 @@ mod tests;
 // Exports
 
 pub use crate::ciphersuite::CipherSuite;
+#[cfg(feature = "danger")]
+pub use crate::common::derive_key;
 pub use crate::common::{
     BlindedElement, EvaluationElement, Mode, PreparedEvaluationElement, Proof,
 };

src/oprf.rs

@@ -1,24 +1,24 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Contains the main OPRF API
 
 use core::iter::{self, Map};
 
 use derive_where::derive_where;
-use digest::core_api::BlockSizeUser;
-use digest::{Digest, Output, OutputSizeUser};
-use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U256};
+use digest::{Digest, Output};
+use generic_array::typenum::Unsigned;
 use generic_array::GenericArray;
 use rand_core::{CryptoRng, RngCore};
 
 use crate::common::{
-    derive_key, deterministic_blind_unchecked, i2osp_2, BlindedElement, EvaluationElement, Mode,
-    STR_FINALIZE,
+    derive_key_internal, deterministic_blind_unchecked, hash_to_group, i2osp_2,
+    server_evaluate_hash_input, BlindedElement, EvaluationElement, Mode, STR_FINALIZE,
 };
 #[cfg(feature = "serde")]
 use crate::serialization::serde::Scalar;
@@ -41,13 +41,9 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct OprfClient<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct OprfClient<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) blind: <CS::Group as Group>::Scalar,
 }
@@ -59,13 +55,9 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct OprfServer<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct OprfServer<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) sk: <CS::Group as Group>::Scalar,
 }
@@ -75,11 +67,7 @@ where
 // =================== //
 /////////////////////////
 
-impl<CS: CipherSuite> OprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> OprfClient<CS> {
     /// Computes the first step for the multiplicative blinding version of
     /// DH-OPRF.
     ///
@@ -153,11 +141,7 @@ where
     }
 }
 
-impl<CS: CipherSuite> OprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> OprfServer<CS> {
     /// Produces a new instance of a [OprfServer] using a supplied RNG
     ///
     /// # Errors
@@ -189,11 +173,11 @@ where
     ///   then `u16::MAX - 3`.
     /// - [`Error::Protocol`] if the protocol fails and can't be completed.
     pub fn new_from_seed(seed: &[u8], info: &[u8]) -> Result<Self> {
-        let sk = derive_key::<CS>(seed, info, Mode::Oprf)?;
+        let sk = derive_key_internal::<CS>(seed, info, Mode::Oprf)?;
         Ok(Self { sk })
     }
 
-    // Only used for tests
+    /// Only used for tests
     #[cfg(test)]
     pub fn get_private_key(&self) -> <CS::Group as Group>::Scalar {
         self.sk
@@ -202,9 +186,25 @@ where
     /// Computes the second step for the multiplicative blinding version of
     /// DH-OPRF. This message is sent from the server (who holds the OPRF key)
     /// to the client.
-    pub fn evaluate(&self, blinded_element: &BlindedElement<CS>) -> EvaluationElement<CS> {
+    pub fn blind_evaluate(&self, blinded_element: &BlindedElement<CS>) -> EvaluationElement<CS> {
         EvaluationElement(blinded_element.0 * &self.sk)
     }
+
+    /// Computes the output of the OPRF on the server side
+    ///
+    /// # Errors
+    /// [`Error::Input`]  if the `input` is longer then [`u16::MAX`].
+    pub fn evaluate(&self, input: &[u8]) -> Result<Output<<CS as CipherSuite>::Hash>> {
+        let input_element = hash_to_group::<CS>(input, Mode::Oprf)?;
+        if CS::Group::is_identity_elem(input_element).into() {
+            return Err(Error::Input);
+        };
+        let evaluated_element = input_element * &self.sk;
+
+        let issued_element = CS::Group::serialize_elem(evaluated_element);
+
+        server_evaluate_hash_input::<CS>(input, None, issued_element)
+    }
 }
 
 /////////////////////////
@@ -214,11 +214,7 @@ where
 
 /// Contains the fields that are returned by a non-verifiable client blind
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
-pub struct OprfClientBlindResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct OprfClientBlindResult<CS: CipherSuite> {
     /// The state to be persisted on the client
     pub state: OprfClient<CS>,
     /// The message to send to the server
@@ -244,11 +240,7 @@ fn finalize_after_unblind<
 >(
     inputs_and_unblinded_elements: IE,
     _unused: &'a [u8],
-) -> FinalizeAfterUnblindResult<CS, I, IE>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+) -> FinalizeAfterUnblindResult<'a, CS, I, IE> {
     inputs_and_unblinded_elements.map(|(input, unblinded_element)| {
         let elem_len = <CS::Group as Group>::ElemLen::U16.to_be_bytes();
 
@@ -261,7 +253,7 @@ where
             .chain_update(input.as_ref())
             .chain_update(elem_len)
             .chain_update(CS::Group::serialize_elem(unblinded_element))
-            .chain_update(&STR_FINALIZE)
+            .chain_update(STR_FINALIZE)
             .finalize())
     })
 }
@@ -275,11 +267,10 @@ where
 mod tests {
     use core::ptr;
 
-    use generic_array::sequence::Concat;
     use rand::rngs::OsRng;
 
     use super::*;
-    use crate::common::{create_context_string, STR_HASH_TO_GROUP};
+    use crate::common::{Dst, STR_HASH_TO_GROUP};
     use crate::Group;
 
     fn prf<CS: CipherSuite>(
@@ -287,13 +278,9 @@ mod tests {
         key: <CS::Group as Group>::Scalar,
         info: &[u8],
         mode: Mode,
-    ) -> Output<CS::Hash>
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+    ) -> Output<CS::Hash> {
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         let res = point * &key;
 
@@ -303,26 +290,18 @@ mod tests {
             .unwrap()
     }
 
-    fn base_retrieval<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn base_retrieval<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server = OprfServer::<CS>::new(&mut rng).unwrap();
-        let message = server.evaluate(&client_blind_result.message);
+        let message = server.blind_evaluate(&client_blind_result.message);
         let client_finalize_result = client_blind_result.state.finalize(input, &message).unwrap();
         let res2 = prf::<CS>(input, server.get_private_key(), &[], Mode::Oprf);
         assert_eq!(client_finalize_result, res2);
     }
 
-    fn base_inversion_unsalted<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn base_inversion_unsalted<CS: CipherSuite>() {
         let mut rng = OsRng;
         let mut input = [0u8; 64];
         rng.fill_bytes(&mut input);
@@ -332,9 +311,8 @@ mod tests {
             .finalize(&input, &EvaluationElement(client_blind_result.message.0))
             .unwrap();
 
-        let dst =
-            GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(Mode::Oprf));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[&input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[&input], &dst.as_dst()).unwrap();
         let res2 = finalize_after_unblind::<CS, _, _>(iter::once((input.as_ref(), point)), &[])
             .next()
             .unwrap()
@@ -343,11 +321,31 @@ mod tests {
         assert_eq!(client_finalize_result, res2);
     }
 
-    fn zeroize_oprf_client<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn server_evaluate<CS: CipherSuite>() {
+        let input = b"input";
+        let mut rng = OsRng;
+        let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
+        let server = OprfServer::<CS>::new(&mut rng).unwrap();
+        let server_result = server.blind_evaluate(&client_blind_result.message);
+
+        let client_finalize = client_blind_result
+            .state
+            .finalize(input, &server_result)
+            .unwrap();
+
+        // We expect the outputs from client and server to be equal given an identical
+        // input
+        let server_evaluate = server.evaluate(input).unwrap();
+        assert_eq!(client_finalize, server_evaluate);
+
+        // We expect the outputs from client and server to be different given different
+        // inputs
+        let wrong_input = b"wrong input";
+        let server_evaluate = server.evaluate(wrong_input).unwrap();
+        assert!(client_finalize != server_evaluate);
+    }
+
+    fn zeroize_oprf_client<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
@@ -361,16 +359,12 @@ mod tests {
         assert!(message.serialize().iter().all(|&x| x == 0));
     }
 
-    fn zeroize_oprf_server<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn zeroize_oprf_server<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = OprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server = OprfServer::<CS>::new(&mut rng).unwrap();
-        let mut message = server.evaluate(&client_blind_result.message);
+        let mut message = server.blind_evaluate(&client_blind_result.message);
 
         let mut state = server;
         unsafe { ptr::drop_in_place(&mut state) };
@@ -383,6 +377,8 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -390,6 +386,7 @@ mod tests {
 
             base_retrieval::<Ristretto255>();
             base_inversion_unsalted::<Ristretto255>();
+            server_evaluate::<Ristretto255>();
 
             zeroize_oprf_client::<Ristretto255>();
             zeroize_oprf_server::<Ristretto255>();
@@ -397,10 +394,25 @@ mod tests {
 
         base_retrieval::<NistP256>();
         base_inversion_unsalted::<NistP256>();
+        server_evaluate::<NistP256>();
 
         zeroize_oprf_client::<NistP256>();
         zeroize_oprf_server::<NistP256>();
 
+        base_retrieval::<NistP384>();
+        base_inversion_unsalted::<NistP384>();
+        server_evaluate::<NistP384>();
+
+        zeroize_oprf_client::<NistP384>();
+        zeroize_oprf_server::<NistP384>();
+
+        base_retrieval::<NistP521>();
+        base_inversion_unsalted::<NistP521>();
+        server_evaluate::<NistP521>();
+
+        zeroize_oprf_client::<NistP521>();
+        zeroize_oprf_server::<NistP521>();
+
         Ok(())
     }
 }

src/poprf.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Contains the main POPRF API
 
@@ -12,17 +13,15 @@ use alloc::vec::Vec;
 use core::iter::{self, Map, Repeat, Zip};
 
 use derive_where::derive_where;
-use digest::core_api::BlockSizeUser;
 use digest::{Digest, Output, OutputSizeUser};
-use generic_array::sequence::Concat;
-use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U256};
-use generic_array::GenericArray;
+use generic_array::typenum::Unsigned;
+use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
 
 use crate::common::{
-    create_context_string, derive_keypair, deterministic_blind_unchecked, generate_proof, i2osp_2,
-    verify_proof, BlindedElement, EvaluationElement, Mode, PreparedEvaluationElement, Proof,
-    STR_FINALIZE, STR_HASH_TO_SCALAR, STR_INFO,
+    derive_keypair, deterministic_blind_unchecked, generate_proof, hash_to_group, i2osp_2,
+    server_evaluate_hash_input, verify_proof, BlindedElement, Dst, EvaluationElement, Mode,
+    PreparedEvaluationElement, Proof, STR_FINALIZE, STR_HASH_TO_SCALAR, STR_INFO,
 };
 #[cfg(feature = "serde")]
 use crate::serialization::serde::{Element, Scalar};
@@ -40,13 +39,9 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct PoprfClient<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfClient<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) blind: <CS::Group as Group>::Scalar,
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -60,13 +55,9 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct PoprfServer<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfServer<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) sk: <CS::Group as Group>::Scalar,
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -78,19 +69,15 @@ where
 // =================== //
 /////////////////////////
 
-impl<CS: CipherSuite> PoprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> PoprfClient<CS> {
     /// Computes the first step for the multiplicative blinding version of
     /// DH-OPRF.
     ///
     /// # Errors
     /// [`Error::Input`] if the `input` is empty or longer than [`u16::MAX`].
     pub fn blind<R: RngCore + CryptoRng>(
-        blinding_factor_rng: &mut R,
         input: &[u8],
+        blinding_factor_rng: &mut R,
     ) -> Result<PoprfClientBlindResult<CS>> {
         let blind = CS::Group::random_scalar(blinding_factor_rng);
         Self::deterministic_blind_unchecked_inner(input, blind)
@@ -145,7 +132,10 @@ where
         proof: &Proof<CS>,
         pk: <CS::Group as Group>::Elem,
         info: Option<&[u8]>,
-    ) -> Result<Output<CS::Hash>> {
+    ) -> Result<Output<CS::Hash>>
+    where
+        <<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
+    {
         let clients = core::array::from_ref(self);
         let messages = core::array::from_ref(evaluation_element);
 
@@ -180,6 +170,7 @@ where
         <&'a IC as IntoIterator>::IntoIter: ExactSizeIterator,
         &'a IM: 'a + IntoIterator<Item = &'a EvaluationElement<CS>>,
         <&'a IM as IntoIterator>::IntoIter: ExactSizeIterator,
+        <<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
     {
         let unblinded_elements = poprf_unblind(clients, messages, pk, proof, info)?;
 
@@ -193,11 +184,7 @@ where
     }
 }
 
-impl<CS: CipherSuite> PoprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> PoprfServer<CS> {
     /// Produces a new instance of a [PoprfServer] using a supplied RNG
     ///
     /// # Errors
@@ -235,7 +222,7 @@ where
         Ok(Self { sk, pk })
     }
 
-    // Only used for tests
+    /// Only used for tests
     #[cfg(test)]
     pub fn get_private_key(&self) -> <CS::Group as Group>::Scalar {
         self.sk
@@ -248,7 +235,7 @@ where
     /// # Errors
     /// - [`Error::Info`] if the `info` is longer than `u16::MAX`.
     /// - [`Error::Protocol`] if the protocol fails and can't be completed.
-    pub fn evaluate<R: RngCore + CryptoRng>(
+    pub fn blind_evaluate<R: RngCore + CryptoRng>(
         &self,
         rng: &mut R,
         blinded_element: &BlindedElement<CS>,
@@ -257,7 +244,7 @@ where
         let PoprfServerBatchEvaluatePrepareResult {
             mut prepared_evaluation_elements,
             prepared_tweak,
-        } = self.batch_evaluate_prepare(iter::once(blinded_element), info)?;
+        } = self.batch_blind_evaluate_prepare(iter::once(blinded_element), info)?;
 
         let prepared_evaluation_element = prepared_evaluation_elements.next().unwrap();
         let prepared_evaluation_elements = core::array::from_ref(&prepared_evaluation_element);
@@ -265,7 +252,7 @@ where
         let PoprfServerBatchEvaluateFinishResult {
             mut messages,
             proof,
-        } = Self::batch_evaluate_finish(
+        } = Self::batch_blind_evaluate_finish(
             rng,
             iter::once(blinded_element),
             prepared_evaluation_elements,
@@ -286,7 +273,7 @@ where
     /// - [`Error::Info`] if the `info` is longer than `u16::MAX`.
     /// - [`Error::Protocol`] if the protocol fails and can't be completed.
     #[cfg(feature = "alloc")]
-    pub fn batch_evaluate<'a, R: RngCore + CryptoRng, IE>(
+    pub fn batch_blind_evaluate<'a, R: RngCore + CryptoRng, IE>(
         &self,
         rng: &mut R,
         blinded_elements: &'a IE,
@@ -300,13 +287,13 @@ where
         let PoprfServerBatchEvaluatePrepareResult {
             prepared_evaluation_elements,
             prepared_tweak,
-        } = self.batch_evaluate_prepare(blinded_elements.into_iter(), info)?;
+        } = self.batch_blind_evaluate_prepare(blinded_elements.into_iter(), info)?;
 
         let prepared_evaluation_elements: Vec<_> = prepared_evaluation_elements.collect();
 
         // This can't fail because we know the size of the inputs.
         let PoprfServerBatchEvaluateFinishResult { messages, proof } =
-            Self::batch_evaluate_finish::<_, _, Vec<_>>(
+            Self::batch_blind_evaluate_finish::<_, _, Vec<_>>(
                 rng,
                 blinded_elements.into_iter(),
                 &prepared_evaluation_elements,
@@ -319,15 +306,15 @@ where
         Ok(PoprfServerBatchEvaluateResult { messages, proof })
     }
 
-    /// Alternative version of `batch_evaluate` without
+    /// Alternative version of `batch_blind_evaluate` without
     /// memory allocation. Returned [`PreparedEvaluationElement`] have to
     /// be [`collect`](Iterator::collect)ed and passed into
-    /// [`batch_evaluate_finish`](Self::batch_evaluate_finish).
+    /// [`batch_blind_evaluate_finish`](Self::batch_blind_evaluate_finish).
     ///
     /// # Errors
     /// - [`Error::Info`] if the `info` is longer than `u16::MAX`.
     /// - [`Error::Protocol`] if the protocol fails and can't be completed.
-    pub fn batch_evaluate_prepare<'a, I: Iterator<Item = &'a BlindedElement<CS>>>(
+    pub fn batch_blind_evaluate_prepare<'a, I: Iterator<Item = &'a BlindedElement<CS>>>(
         &self,
         blinded_elements: I,
         info: Option<&[u8]>,
@@ -349,14 +336,14 @@ where
         })
     }
 
-    /// See [`batch_evaluate_prepare`](Self::batch_evaluate_prepare) for more
-    /// details.
+    /// See [`batch_blind_evaluate_prepare`](Self::batch_blind_evaluate_prepare)
+    /// for more details.
     ///
     /// # Errors
     /// [`Error::Batch`] if the number of `blinded_elements` and
     /// `prepared_evaluation_elements` don't match or is longer then
     /// [`u16::MAX`]
-    pub fn batch_evaluate_finish<
+    pub fn batch_blind_evaluate_finish<
         'a,
         'b,
         R: RngCore + CryptoRng,
@@ -398,17 +385,36 @@ where
         Ok(PoprfServerBatchEvaluateFinishResult { messages, proof })
     }
 
+    /// Computes the output of the VOPRF on the server side
+    ///
+    /// # Errors
+    /// [`Error::Input`]  if the `input` is longer then [`u16::MAX`].
+    pub fn evaluate(
+        &self,
+        input: &[u8],
+        info: Option<&[u8]>,
+    ) -> Result<Output<<CS as CipherSuite>::Hash>> {
+        let input_element = hash_to_group::<CS>(input, Mode::Poprf)?;
+        if CS::Group::is_identity_elem(input_element).into() {
+            return Err(Error::Input);
+        };
+
+        let tweak = compute_tweak::<CS>(self.sk, info)?;
+
+        let evaluated_element = input_element * &CS::Group::invert_scalar(tweak);
+
+        let issued_element = CS::Group::serialize_elem(evaluated_element);
+
+        server_evaluate_hash_input::<CS>(input, info, issued_element)
+    }
+
     /// Retrieves the server's public key
     pub fn get_public_key(&self) -> <CS::Group as Group>::Elem {
         self.pk
     }
 }
 
-impl<CS: CipherSuite> BlindedElement<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> BlindedElement<CS> {
     /// Creates a [BlindedElement] from a raw group element.
     ///
     /// # Caution
@@ -427,11 +433,7 @@ where
     }
 }
 
-impl<CS: CipherSuite> EvaluationElement<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> EvaluationElement<CS> {
     /// Creates an [EvaluationElement] from a raw group element.
     ///
     /// # Caution
@@ -457,11 +459,7 @@ where
 
 /// Contains the fields that are returned by a verifiable client blind
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
-pub struct PoprfClientBlindResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfClientBlindResult<CS: CipherSuite> {
     /// The state to be persisted on the client
     pub state: PoprfClient<CS>,
     /// The message to send to the server
@@ -474,11 +472,7 @@ pub type PoprfClientBatchFinalizeResult<'a, CS, II, IC, IM> =
 
 /// Contains the fields that are returned by a verifiable server evaluate
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
-pub struct PoprfServerEvaluateResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfServerEvaluateResult<CS: CipherSuite> {
     /// The message to send to the client
     pub message: EvaluationElement<CS>,
     /// The proof for the client to verify
@@ -488,11 +482,7 @@ where
 /// Contains the fields that are returned by a verifiable server batch evaluate
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
 #[cfg(feature = "alloc")]
-pub struct PoprfServerBatchEvaluateResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfServerBatchEvaluateResult<CS: CipherSuite> {
     /// The messages to send to the client
     pub messages: Vec<EvaluationElement<CS>>,
     /// The proof for the client to verify
@@ -517,24 +507,17 @@ pub type PoprfServerBatchEvaluatePreparedEvaluationElements<CS, I> = Map<
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct PoprfPreparedTweak<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     <CS::Group as Group>::Scalar,
-)
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>;
+);
 
 /// Contains the fields that are returned by a partially verifiable server batch
 /// evaluate prepare
 #[derive_where(Debug; I, <CS::Group as Group>::Scalar)]
-pub struct PoprfServerBatchEvaluatePrepareResult<CS: CipherSuite, I>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct PoprfServerBatchEvaluatePrepareResult<CS: CipherSuite, I> {
     /// Prepared [`EvaluationElement`].
     pub prepared_evaluation_elements: PoprfServerBatchEvaluatePreparedEvaluationElements<CS, I>,
     /// Prepared tweak.
@@ -553,8 +536,6 @@ pub type PoprfServerBatchEvaluateFinishedMessages<'a, CS, I> = Map<
 #[derive_where(Debug; <&'a I as IntoIterator>::IntoIter, <CS::Group as Group>::Scalar)]
 pub struct PoprfServerBatchEvaluateFinishResult<'a, CS: 'a + CipherSuite, I>
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     &'a I: IntoIterator<Item = &'a PreparedEvaluationElement<CS>>,
 {
     /// The [`EvaluationElement`]s to send to the client
@@ -575,11 +556,7 @@ where
 fn compute_tweaked_key<CS: CipherSuite>(
     pk: <CS::Group as Group>::Elem,
     info: Option<&[u8]>,
-) -> Result<<CS::Group as Group>::Elem>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+) -> Result<<CS::Group as Group>::Elem> {
     // None for info is treated the same as empty bytes
     let info = info.unwrap_or_default();
 
@@ -592,10 +569,9 @@ where
     let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
     let framed_info = [STR_INFO.as_slice(), &info_len, info];
 
-    let dst =
-        GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(Mode::Poprf));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
     // This can't fail, the size of the `input` is known.
-    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst).unwrap();
+    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
 
     let t = CS::Group::base_elem() * &m;
     let tweaked_key = t + &pk;
@@ -614,11 +590,7 @@ where
 fn compute_tweak<CS: CipherSuite>(
     sk: <CS::Group as Group>::Scalar,
     info: Option<&[u8]>,
-) -> Result<<CS::Group as Group>::Scalar>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+) -> Result<<CS::Group as Group>::Scalar> {
     // None for info is treated the same as empty bytes
     let info = info.unwrap_or_default();
 
@@ -630,10 +602,9 @@ where
     let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
     let framed_info = [STR_INFO.as_slice(), &info_len, info];
 
-    let dst =
-        GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(Mode::Poprf));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
     // This can't fail, the size of the `input` is known.
-    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst).unwrap();
+    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
 
     let t = sk + &m;
 
@@ -670,8 +641,6 @@ fn poprf_unblind<'a, CS: 'a + CipherSuite, IC, IM>(
     info: Option<&[u8]>,
 ) -> Result<PoprfUnblindResult<'a, CS, IC, IM>>
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     &'a IC: 'a + IntoIterator<Item = &'a PoprfClient<CS>>,
     <&'a IC as IntoIterator>::IntoIter: ExactSizeIterator,
     &'a IM: 'a + IntoIterator<Item = &'a EvaluationElement<CS>>,
@@ -699,7 +668,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -707,7 +676,7 @@ type FinalizeAfterUnblindResult<'a, CS, IE, II> = Map<
     Zip<Zip<IE, II>, Repeat<&'a [u8]>>,
     fn(
         ((<<CS as CipherSuite>::Group as Group>::Elem, &[u8]), &[u8]),
-    ) -> Result<GenericArray<u8, <<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize>>,
+    ) -> Result<Output<<CS as CipherSuite>::Hash>>,
 >;
 
 /// Can only fail with [`Error::Batch`] and returned values can only fail with
@@ -723,8 +692,7 @@ fn finalize_after_unblind<
     info: Option<&'a [u8]>,
 ) -> Result<FinalizeAfterUnblindResult<'a, CS, IE, II>>
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
+    <<CS as CipherSuite>::Hash as OutputSizeUser>::OutputSize: ArrayLength,
 {
     if unblinded_elements.len() != inputs.len() {
         return Err(Error::Batch);
@@ -763,11 +731,8 @@ where
 
 #[cfg(test)]
 mod tests {
-    use core::ops::Add;
     use core::ptr;
 
-    use generic_array::typenum::Sum;
-    use generic_array::ArrayLength;
     use rand::rngs::OsRng;
 
     use super::*;
@@ -779,15 +744,11 @@ mod tests {
         key: <CS::Group as Group>::Scalar,
         info: &[u8],
         mode: Mode,
-    ) -> Output<CS::Hash>
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    ) -> Output<CS::Hash> {
         let t = compute_tweak::<CS>(key, Some(info)).unwrap();
 
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         // evaluatedElement = G.ScalarInverse(t) * blindedElement
         let res = point * &CS::Group::invert_scalar(t);
@@ -799,18 +760,14 @@ mod tests {
             .unwrap()
     }
 
-    fn verifiable_retrieval<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_retrieval<CS: CipherSuite>() {
         let input = b"input";
         let info = b"info";
         let mut rng = OsRng;
         let server = PoprfServer::<CS>::new(&mut rng).unwrap();
-        let client_blind_result = PoprfClient::<CS>::blind(&mut rng, input).unwrap();
+        let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server_result = server
-            .evaluate(&mut rng, &client_blind_result.message, Some(info))
+            .blind_evaluate(&mut rng, &client_blind_result.message, Some(info))
             .unwrap();
         let client_finalize_result = client_blind_result
             .state
@@ -826,24 +783,19 @@ mod tests {
         assert_eq!(client_finalize_result, res2);
     }
 
-    fn verifiable_bad_public_key<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_bad_public_key<CS: CipherSuite>() {
         let input = b"input";
         let info = b"info";
         let mut rng = OsRng;
         let server = PoprfServer::<CS>::new(&mut rng).unwrap();
-        let client_blind_result = PoprfClient::<CS>::blind(&mut rng, input).unwrap();
+        let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server_result = server
-            .evaluate(&mut rng, &client_blind_result.message, Some(info))
+            .blind_evaluate(&mut rng, &client_blind_result.message, Some(info))
             .unwrap();
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result = client_blind_result.state.finalize(
             input,
@@ -855,16 +807,43 @@ mod tests {
         assert!(client_finalize_result.is_err());
     }
 
-    fn zeroize_verifiable_client<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ElemLen>: ArrayLength<u8>,
-    {
+    fn verifiable_server_evaluate<CS: CipherSuite>() {
+        let input = b"input";
+        let info = Some(b"info".as_slice());
+        let mut rng = OsRng;
+        let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
+        let server = PoprfServer::<CS>::new(&mut rng).unwrap();
+        let server_result = server
+            .blind_evaluate(&mut rng, &client_blind_result.message, info)
+            .unwrap();
+
+        let client_finalize = client_blind_result
+            .state
+            .finalize(
+                input,
+                &server_result.message,
+                &server_result.proof,
+                server.get_public_key(),
+                info,
+            )
+            .unwrap();
+
+        // We expect the outputs from client and server to be equal given an identical
+        // input
+        let server_evaluate = server.evaluate(input, info).unwrap();
+        assert_eq!(client_finalize, server_evaluate);
+
+        // We expect the outputs from client and server to be different given different
+        // inputs
+        let wrong_input = b"wrong input";
+        let server_evaluate = server.evaluate(wrong_input, info).unwrap();
+        assert!(client_finalize != server_evaluate);
+    }
+
+    fn zeroize_verifiable_client<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
-        let client_blind_result = PoprfClient::<CS>::blind(&mut rng, input).unwrap();
+        let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
 
         let mut state = client_blind_result.state;
         unsafe { ptr::drop_in_place(&mut state) };
@@ -875,22 +854,14 @@ mod tests {
         assert!(message.serialize().iter().all(|&x| x == 0));
     }
 
-    fn zeroize_verifiable_server<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ElemLen>: ArrayLength<u8>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ScalarLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ScalarLen>: ArrayLength<u8>,
-    {
+    fn zeroize_verifiable_server<CS: CipherSuite>() {
         let input = b"input";
         let info = b"info";
         let mut rng = OsRng;
         let server = PoprfServer::<CS>::new(&mut rng).unwrap();
-        let client_blind_result = PoprfClient::<CS>::blind(&mut rng, input).unwrap();
+        let client_blind_result = PoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server_result = server
-            .evaluate(&mut rng, &client_blind_result.message, Some(info))
+            .blind_evaluate(&mut rng, &client_blind_result.message, Some(info))
             .unwrap();
 
         let mut state = server;
@@ -909,6 +880,8 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -916,6 +889,7 @@ mod tests {
 
             verifiable_retrieval::<Ristretto255>();
             verifiable_bad_public_key::<Ristretto255>();
+            verifiable_server_evaluate::<Ristretto255>();
 
             zeroize_verifiable_client::<Ristretto255>();
             zeroize_verifiable_server::<Ristretto255>();
@@ -923,10 +897,25 @@ mod tests {
 
         verifiable_retrieval::<NistP256>();
         verifiable_bad_public_key::<NistP256>();
+        verifiable_server_evaluate::<NistP256>();
 
         zeroize_verifiable_client::<NistP256>();
         zeroize_verifiable_server::<NistP256>();
 
+        verifiable_retrieval::<NistP384>();
+        verifiable_bad_public_key::<NistP384>();
+        verifiable_server_evaluate::<NistP384>();
+
+        zeroize_verifiable_client::<NistP384>();
+        zeroize_verifiable_server::<NistP384>();
+
+        verifiable_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_verifiable_client::<NistP521>();
+        zeroize_verifiable_server::<NistP521>();
+
         Ok(())
     }
 }

src/serialization.rs

@@ -1,20 +1,17 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Handles the serialization of each of the components used in the VOPRF
 //! protocol
 
-use core::ops::Add;
-
-use digest::core_api::BlockSizeUser;
-use digest::OutputSizeUser;
 use generic_array::sequence::Concat;
-use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, Unsigned, U256};
-use generic_array::{ArrayLength, GenericArray};
+use generic_array::typenum::{Sum, Unsigned};
+use generic_array::GenericArray;
 
 use crate::{
     BlindedElement, CipherSuite, Error, EvaluationElement, Group, OprfClient, OprfServer,
@@ -29,11 +26,7 @@ use crate::{
 /// Length of [`OprfClient`] in bytes for serialization.
 pub type OprfClientLen<CS> = <<CS as CipherSuite>::Group as Group>::ScalarLen;
 
-impl<CS: CipherSuite> OprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> OprfClient<CS> {
     /// Serialization into bytes
     pub fn serialize(&self) -> GenericArray<u8, OprfClientLen<CS>> {
         CS::Group::serialize_scalar(self.blind)
@@ -56,17 +49,9 @@ pub type VoprfClientLen<CS> = Sum<
     <<CS as CipherSuite>::Group as Group>::ElemLen,
 >;
 
-impl<CS: CipherSuite> VoprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> VoprfClient<CS> {
     /// Serialization into bytes
-    pub fn serialize(&self) -> GenericArray<u8, VoprfClientLen<CS>>
-    where
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        VoprfClientLen<CS>: ArrayLength<u8>,
-    {
+    pub fn serialize(&self) -> GenericArray<u8, VoprfClientLen<CS>> {
         <CS::Group as Group>::serialize_scalar(self.blind)
             .concat(<CS::Group as Group>::serialize_elem(self.blinded_element))
     }
@@ -92,17 +77,9 @@ pub type PoprfClientLen<CS> = Sum<
     <<CS as CipherSuite>::Group as Group>::ElemLen,
 >;
 
-impl<CS: CipherSuite> PoprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> PoprfClient<CS> {
     /// Serialization into bytes
-    pub fn serialize(&self) -> GenericArray<u8, PoprfClientLen<CS>>
-    where
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        PoprfClientLen<CS>: ArrayLength<u8>,
-    {
+    pub fn serialize(&self) -> GenericArray<u8, PoprfClientLen<CS>> {
         <CS::Group as Group>::serialize_scalar(self.blind)
             .concat(<CS::Group as Group>::serialize_elem(self.blinded_element))
     }
@@ -125,11 +102,7 @@ where
 /// Length of [`OprfServer`] in bytes for serialization.
 pub type OprfServerLen<CS> = <<CS as CipherSuite>::Group as Group>::ScalarLen;
 
-impl<CS: CipherSuite> OprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> OprfServer<CS> {
     /// Serialization into bytes
     pub fn serialize(&self) -> GenericArray<u8, OprfServerLen<CS>> {
         CS::Group::serialize_scalar(self.sk)
@@ -152,17 +125,9 @@ pub type VoprfServerLen<CS> = Sum<
     <<CS as CipherSuite>::Group as Group>::ElemLen,
 >;
 
-impl<CS: CipherSuite> VoprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> VoprfServer<CS> {
     /// Serialization into bytes
-    pub fn serialize(&self) -> GenericArray<u8, VoprfServerLen<CS>>
-    where
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        VoprfServerLen<CS>: ArrayLength<u8>,
-    {
+    pub fn serialize(&self) -> GenericArray<u8, VoprfServerLen<CS>> {
         CS::Group::serialize_scalar(self.sk).concat(CS::Group::serialize_elem(self.pk))
     }
 
@@ -184,17 +149,9 @@ pub type PoprfServerLen<CS> = Sum<
     <<CS as CipherSuite>::Group as Group>::ElemLen,
 >;
 
-impl<CS: CipherSuite> PoprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> PoprfServer<CS> {
     /// Serialization into bytes
-    pub fn serialize(&self) -> GenericArray<u8, PoprfServerLen<CS>>
-    where
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        PoprfServerLen<CS>: ArrayLength<u8>,
-    {
+    pub fn serialize(&self) -> GenericArray<u8, PoprfServerLen<CS>> {
         CS::Group::serialize_scalar(self.sk).concat(CS::Group::serialize_elem(self.pk))
     }
 
@@ -216,17 +173,9 @@ pub type ProofLen<CS> = Sum<
     <<CS as CipherSuite>::Group as Group>::ScalarLen,
 >;
 
-impl<CS: CipherSuite> Proof<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> Proof<CS> {
     /// Serialization into bytes
-    pub fn serialize(&self) -> GenericArray<u8, ProofLen<CS>>
-    where
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ScalarLen>,
-        ProofLen<CS>: ArrayLength<u8>,
-    {
+    pub fn serialize(&self) -> GenericArray<u8, ProofLen<CS>> {
         CS::Group::serialize_scalar(self.c_scalar)
             .concat(CS::Group::serialize_scalar(self.s_scalar))
     }
@@ -246,11 +195,7 @@ where
 /// Length of [`BlindedElement`] in bytes for serialization.
 pub type BlindedElementLen<CS> = <<CS as CipherSuite>::Group as Group>::ElemLen;
 
-impl<CS: CipherSuite> BlindedElement<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> BlindedElement<CS> {
     /// Serialization into bytes
     pub fn serialize(&self) -> GenericArray<u8, BlindedElementLen<CS>> {
         CS::Group::serialize_elem(self.0)
@@ -270,11 +215,7 @@ where
 /// Length of [`EvaluationElement`] in bytes for serialization.
 pub type EvaluationElementLen<CS> = <<CS as CipherSuite>::Group as Group>::ElemLen;
 
-impl<CS: CipherSuite> EvaluationElement<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> EvaluationElement<CS> {
     /// Serialization into bytes
     pub fn serialize(&self) -> GenericArray<u8, EvaluationElementLen<CS>> {
         CS::Group::serialize_elem(self.0)
@@ -306,11 +247,11 @@ fn deserialize_scalar<G: Group>(input: &mut &[u8]) -> Result<G::Scalar> {
 }
 
 trait SliceExt {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self>;
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self>;
 }
 
 impl<T> SliceExt for [T] {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self> {
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self> {
         if take > self.len() {
             return None;
         }
@@ -389,6 +330,8 @@ mod test {
             }
 
             let _ = $item::<p256::NistP256>::deserialize(&$bytes[..]);
+            let _ = $item::<p384::NistP384>::deserialize(&$bytes[..]);
+            let _ = $item::<p521::NistP521>::deserialize(&$bytes[..]);
         };
     }
 

src/tests/mock_rng.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 use alloc::vec::Vec;
 use core::cmp::min;
@@ -50,7 +51,7 @@ impl RngCore for CycleRng {
     #[inline]
     fn fill_bytes(&mut self, dest: &mut [u8]) {
         let len = min(self.v.len(), dest.len());
-        (&mut dest[..len]).copy_from_slice(&self.v[..len]);
+        dest[..len].copy_from_slice(&self.v[..len]);
         rotate_left(&mut self.v, len);
     }
 

src/tests/mod.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 mod cfrg_vectors;
 mod mock_rng;

src/tests/parser.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;
@@ -14,7 +15,7 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
 }
 
 fn parse_ciphersuites(input: &str) -> String {
-    let re = regex::Regex::new(r"## OPRF\((?P<ciphersuite>.+?)\)").unwrap();
+    let re = regex::Regex::new(r"\nA\.\d\.  (?P<ciphersuite>.+?)\n\n").unwrap();
     let mut ciphersuites = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -33,7 +34,7 @@ fn parse_ciphersuites(input: &str) -> String {
 }
 
 fn parse_modes(input: &str) -> String {
-    let re = regex::Regex::new(r"### (?P<mode>.*+) Mode").unwrap();
+    let re = regex::Regex::new(r"A\.\d.\d\.  (?P<mode>.*?) Mode").unwrap();
     let mut modes = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -52,7 +53,7 @@ fn parse_modes(input: &str) -> String {
 }
 
 fn parse_vectors(input: &str) -> String {
-    let re = regex::Regex::new(r"Test Vector.*+\n").unwrap();
+    let re = regex::Regex::new(r"A\.\d.\d\.\d\.  Test Vector.*+\n").unwrap();
     let mut vectors = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -96,7 +97,7 @@ fn parse_params(input: &str) -> String {
                     let key = iter.next().unwrap().split_whitespace().next().unwrap();
                     let val = iter.next().unwrap().split_whitespace().next().unwrap();
 
-                    param = format!("    \"{}\": \"{}", key, val);
+                    param = format!("    \"{key}\": \"{val}");
                 } else {
                     let s = line.trim().to_string();
                     if s.contains('~') || s.contains('#') {

src/tests/test_cfrg_vectors.rs

@@ -1,20 +1,16 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 use alloc::string::String;
 use alloc::vec;
 use alloc::vec::Vec;
-use core::ops::Add;
 
-use digest::core_api::BlockSizeUser;
-use digest::OutputSizeUser;
-use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
-use generic_array::ArrayLength;
-use json::JsonValue;
+use serde_json::Value;
 
 use crate::tests::mock_rng::CycleRng;
 use crate::tests::parser::*;
@@ -40,7 +36,7 @@ struct VOPRFTestVectorParameters {
     output: Vec<Vec<u8>>,
 }
 
-fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters {
+fn populate_test_vectors(values: &Value) -> VOPRFTestVectorParameters {
     VOPRFTestVectorParameters {
         seed: decode(values, "Seed"),
         sksm: decode(values, "skSm"),
@@ -57,18 +53,18 @@ fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters {
     }
 }
 
-fn decode(values: &JsonValue, key: &str) -> Vec<u8> {
+fn decode(values: &Value, key: &str) -> Vec<u8> {
     values[key]
         .as_str()
-        .and_then(|s| hex::decode(&s).ok())
+        .and_then(|s| hex::decode(s).ok())
         .unwrap_or_default()
 }
 
-fn decode_vec(values: &JsonValue, key: &str) -> Vec<Vec<u8>> {
+fn decode_vec(values: &Value, key: &str) -> Vec<Vec<u8>> {
     let s = values[key].as_str().unwrap();
     let res = match s.contains(',') {
-        true => Some(s.split(',').map(|x| hex::decode(&x).unwrap()).collect()),
-        false => Some(vec![hex::decode(&s).unwrap()]),
+        true => Some(s.split(',').map(|x| hex::decode(x).unwrap()).collect()),
+        false => Some(vec![hex::decode(s).unwrap()]),
     };
     res.unwrap()
 }
@@ -76,8 +72,10 @@ fn decode_vec(values: &JsonValue, key: &str) -> Vec<Vec<u8>> {
 macro_rules! json_to_test_vectors {
     ( $v:ident, $cs:expr, $mode:expr ) => {
         $v[$cs][$mode]
-            .members()
-            .map(|x| populate_test_vectors(&x))
+            .as_array()
+            .into_iter()
+            .flatten()
+            .map(populate_test_vectors)
             .collect::<Vec<VOPRFTestVectorParameters>>()
     };
 }
@@ -85,8 +83,10 @@ macro_rules! json_to_test_vectors {
 #[test]
 fn test_vectors() -> Result<()> {
     use p256::NistP256;
+    use p384::NistP384;
+    use p521::NistP521;
 
-    let rfc = json::parse(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
+    let rfc: Value = serde_json::from_str(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
         .expect("Could not parse json");
 
     #[cfg(feature = "ristretto255")]
@@ -95,70 +95,126 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_oprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("OPRF")
         );
         assert_ne!(ristretto_oprf_tvs.len(), 0);
         test_oprf_seed_to_key::<Ristretto255>(&ristretto_oprf_tvs)?;
         test_oprf_blind::<Ristretto255>(&ristretto_oprf_tvs)?;
-        test_oprf_evaluate::<Ristretto255>(&ristretto_oprf_tvs)?;
+        test_oprf_blind_evaluate::<Ristretto255>(&ristretto_oprf_tvs)?;
         test_oprf_finalize::<Ristretto255>(&ristretto_oprf_tvs)?;
+        test_oprf_evaluate::<Ristretto255>(&ristretto_oprf_tvs)?;
 
         let ristretto_voprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("VOPRF")
         );
         assert_ne!(ristretto_voprf_tvs.len(), 0);
         test_voprf_seed_to_key::<Ristretto255>(&ristretto_voprf_tvs)?;
         test_voprf_blind::<Ristretto255>(&ristretto_voprf_tvs)?;
-        test_voprf_evaluate::<Ristretto255>(&ristretto_voprf_tvs)?;
+        test_voprf_blind_evaluate::<Ristretto255>(&ristretto_voprf_tvs)?;
         test_voprf_finalize::<Ristretto255>(&ristretto_voprf_tvs)?;
+        test_voprf_evaluate::<Ristretto255>(&ristretto_voprf_tvs)?;
 
         let ristretto_poprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("POPRF")
         );
         assert_ne!(ristretto_poprf_tvs.len(), 0);
         test_poprf_seed_to_key::<Ristretto255>(&ristretto_poprf_tvs)?;
         test_poprf_blind::<Ristretto255>(&ristretto_poprf_tvs)?;
-        test_poprf_evaluate::<Ristretto255>(&ristretto_poprf_tvs)?;
+        test_poprf_blind_evaluate::<Ristretto255>(&ristretto_poprf_tvs)?;
         test_poprf_finalize::<Ristretto255>(&ristretto_poprf_tvs)?;
+        test_poprf_evaluate::<Ristretto255>(&ristretto_poprf_tvs)?;
     }
 
     let p256_oprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("OPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("OPRF"));
     assert_ne!(p256_oprf_tvs.len(), 0);
     test_oprf_seed_to_key::<NistP256>(&p256_oprf_tvs)?;
     test_oprf_blind::<NistP256>(&p256_oprf_tvs)?;
-    test_oprf_evaluate::<NistP256>(&p256_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP256>(&p256_oprf_tvs)?;
     test_oprf_finalize::<NistP256>(&p256_oprf_tvs)?;
+    test_oprf_evaluate::<NistP256>(&p256_oprf_tvs)?;
 
     let p256_voprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("VOPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("VOPRF"));
     assert_ne!(p256_voprf_tvs.len(), 0);
     test_voprf_seed_to_key::<NistP256>(&p256_voprf_tvs)?;
     test_voprf_blind::<NistP256>(&p256_voprf_tvs)?;
-    test_voprf_evaluate::<NistP256>(&p256_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP256>(&p256_voprf_tvs)?;
     test_voprf_finalize::<NistP256>(&p256_voprf_tvs)?;
+    test_voprf_evaluate::<NistP256>(&p256_voprf_tvs)?;
 
     let p256_poprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("POPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("POPRF"));
     assert_ne!(p256_poprf_tvs.len(), 0);
     test_poprf_seed_to_key::<NistP256>(&p256_poprf_tvs)?;
     test_poprf_blind::<NistP256>(&p256_poprf_tvs)?;
-    test_poprf_evaluate::<NistP256>(&p256_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP256>(&p256_poprf_tvs)?;
     test_poprf_finalize::<NistP256>(&p256_poprf_tvs)?;
+    test_poprf_evaluate::<NistP256>(&p256_poprf_tvs)?;
+
+    let p384_oprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("OPRF"));
+    assert_ne!(p384_oprf_tvs.len(), 0);
+    test_oprf_seed_to_key::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_blind::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_finalize::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_evaluate::<NistP384>(&p384_oprf_tvs)?;
+
+    let p384_voprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("VOPRF"));
+    assert_ne!(p384_voprf_tvs.len(), 0);
+    test_voprf_seed_to_key::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_blind::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_finalize::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_evaluate::<NistP384>(&p384_voprf_tvs)?;
+
+    let p384_poprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("POPRF"));
+    assert_ne!(p384_poprf_tvs.len(), 0);
+    test_poprf_seed_to_key::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_blind::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_finalize::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_evaluate::<NistP384>(&p384_poprf_tvs)?;
+
+    let p521_oprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("OPRF"));
+    assert_ne!(p521_oprf_tvs.len(), 0);
+    test_oprf_seed_to_key::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_finalize::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_evaluate::<NistP521>(&p521_oprf_tvs)?;
+
+    let p521_voprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("VOPRF"));
+    assert_ne!(p521_voprf_tvs.len(), 0);
+    test_voprf_seed_to_key::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_finalize::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_evaluate::<NistP521>(&p521_voprf_tvs)?;
+
+    let p521_poprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P521-SHA512"), String::from("POPRF"));
+    assert_ne!(p521_poprf_tvs.len(), 0);
+    test_poprf_seed_to_key::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_finalize::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_evaluate::<NistP521>(&p521_poprf_tvs)?;
 
     Ok(())
 }
 
-fn test_oprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_oprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let server = OprfServer::<CS>::new_from_seed(&parameters.seed, &parameters.key_info)?;
 
@@ -170,11 +226,7 @@ where
     Ok(())
 }
 
-fn test_voprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_voprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let server = VoprfServer::<CS>::new_from_seed(&parameters.seed, &parameters.key_info)?;
 
@@ -190,11 +242,7 @@ where
     Ok(())
 }
 
-fn test_poprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_poprf_seed_to_key<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let server = PoprfServer::<CS>::new_from_seed(&parameters.seed, &parameters.key_info)?;
 
@@ -211,11 +259,7 @@ where
 }
 
 // Tests input -> blind, blinded_element
-fn test_oprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_oprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         for i in 0..parameters.input.len() {
             let blind = CS::Group::deserialize_scalar(&parameters.blind[i])?;
@@ -236,11 +280,7 @@ where
 }
 
 // Tests input -> blind, blinded_element
-fn test_voprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_voprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         for i in 0..parameters.input.len() {
             let blind = CS::Group::deserialize_scalar(&parameters.blind[i])?;
@@ -261,11 +301,7 @@ where
 }
 
 // Tests input -> blind, blinded_element
-fn test_poprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_poprf_blind<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         for i in 0..parameters.input.len() {
             let blind = CS::Group::deserialize_scalar(&parameters.blind[i])?;
@@ -286,15 +322,11 @@ where
 }
 
 // Tests sksm, blinded_element -> evaluation_element
-fn test_oprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_oprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         for i in 0..parameters.input.len() {
             let server = OprfServer::<CS>::new_with_key(&parameters.sksm)?;
-            let message = server.evaluate(&BlindedElement::deserialize(
+            let message = server.blind_evaluate(&BlindedElement::deserialize(
                 &parameters.blinded_element[i],
             )?);
 
@@ -307,13 +339,7 @@ where
     Ok(())
 }
 
-fn test_voprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ScalarLen>,
-    Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ScalarLen>: ArrayLength<u8>,
-{
+fn test_voprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let mut rng = CycleRng::new(parameters.proof_random_scalar.clone());
         let server = VoprfServer::<CS>::new_with_key(&parameters.sksm)?;
@@ -323,10 +349,11 @@ where
             blinded_elements.push(BlindedElement::deserialize(blinded_element_bytes)?);
         }
 
-        let prepared_evaluation_elements = server.batch_evaluate_prepare(blinded_elements.iter());
+        let prepared_evaluation_elements =
+            server.batch_blind_evaluate_prepare(blinded_elements.iter());
         let prepared_elements: Vec<_> = prepared_evaluation_elements.collect();
-        let VoprfServerBatchEvaluateFinishResult { messages, proof } =
-            server.batch_evaluate_finish(&mut rng, blinded_elements.iter(), &prepared_elements)?;
+        let VoprfServerBatchEvaluateFinishResult { messages, proof } = server
+            .batch_blind_evaluate_finish(&mut rng, blinded_elements.iter(), &prepared_elements)?;
         let messages: Vec<_> = messages.collect();
 
         for (parameter, message) in parameters.evaluation_element.iter().zip(messages) {
@@ -338,13 +365,7 @@ where
     Ok(())
 }
 
-fn test_poprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ScalarLen>,
-    Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ScalarLen>: ArrayLength<u8>,
-{
+fn test_poprf_blind_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let mut rng = CycleRng::new(parameters.proof_random_scalar.clone());
         let server = PoprfServer::<CS>::new_with_key(&parameters.sksm)?;
@@ -357,10 +378,10 @@ where
         let PoprfServerBatchEvaluatePrepareResult {
             prepared_evaluation_elements,
             prepared_tweak,
-        } = server.batch_evaluate_prepare(blinded_elements.iter(), Some(&parameters.info))?;
+        } = server.batch_blind_evaluate_prepare(blinded_elements.iter(), Some(&parameters.info))?;
         let prepared_evaluation_elements: Vec<_> = prepared_evaluation_elements.collect();
         let PoprfServerBatchEvaluateFinishResult { messages, proof } =
-            PoprfServer::batch_evaluate_finish::<_, _, Vec<_>>(
+            PoprfServer::batch_blind_evaluate_finish::<_, _, Vec<_>>(
                 &mut rng,
                 blinded_elements.iter(),
                 &prepared_evaluation_elements,
@@ -380,11 +401,7 @@ where
 }
 
 // Tests input, blind, evaluation_element -> output
-fn test_oprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_oprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         for i in 0..parameters.input.len() {
             let client =
@@ -401,11 +418,7 @@ where
     Ok(())
 }
 
-fn test_voprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_voprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let mut clients = vec![];
         for i in 0..parameters.input.len() {
@@ -440,11 +453,7 @@ where
     Ok(())
 }
 
-fn test_poprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+fn test_poprf_finalize<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
     for parameters in tvs {
         let mut clients = vec![];
         for i in 0..parameters.input.len() {
@@ -476,3 +485,44 @@ where
     }
     Ok(())
 }
+
+// Tests input, sksm -> output
+fn test_oprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
+    for parameters in tvs {
+        for i in 0..parameters.input.len() {
+            let server = OprfServer::<CS>::new_with_key(&parameters.sksm)?;
+
+            let server_evaluate_result = server.evaluate(&parameters.input[i])?;
+
+            assert_eq!(&parameters.output[i], &server_evaluate_result.to_vec());
+        }
+    }
+    Ok(())
+}
+
+fn test_voprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
+    for parameters in tvs {
+        for i in 0..parameters.input.len() {
+            let server = VoprfServer::<CS>::new_with_key(&parameters.sksm)?;
+
+            let server_evaluate_result = server.evaluate(&parameters.input[i])?;
+
+            assert_eq!(&parameters.output[i], &server_evaluate_result.to_vec());
+        }
+    }
+    Ok(())
+}
+
+fn test_poprf_evaluate<CS: CipherSuite>(tvs: &[VOPRFTestVectorParameters]) -> Result<()> {
+    for parameters in tvs {
+        for i in 0..parameters.input.len() {
+            let server = PoprfServer::<CS>::new_with_key(&parameters.sksm)?;
+
+            let server_evaluate_result =
+                server.evaluate(&parameters.input[i], Some(&parameters.info))?;
+
+            assert_eq!(&parameters.output[i], &server_evaluate_result.to_vec());
+        }
+    }
+    Ok(())
+}

src/voprf.rs

@@ -1,9 +1,10 @@
-// Copyright (c) Facebook, Inc. and its affiliates.
+// Copyright (c) Meta Platforms, Inc. and affiliates.
 //
-// This source code is licensed under both the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree and the Apache
+// This source code is dual-licensed under either the MIT license found in the
+// LICENSE-MIT file in the root directory of this source tree or the Apache
 // License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree.
+// of this source tree. You may select, at your option, one of the above-listed
+// licenses.
 
 //! Contains the main VOPRF API
 
@@ -12,15 +13,15 @@ use alloc::vec::Vec;
 use core::iter::{self, Map, Repeat, Zip};
 
 use derive_where::derive_where;
-use digest::core_api::BlockSizeUser;
-use digest::{Digest, Output, OutputSizeUser};
-use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U256};
+use digest::{Digest, Output};
+use generic_array::typenum::Unsigned;
 use generic_array::GenericArray;
 use rand_core::{CryptoRng, RngCore};
 
 use crate::common::{
-    derive_keypair, deterministic_blind_unchecked, generate_proof, i2osp_2, verify_proof,
-    BlindedElement, EvaluationElement, Mode, PreparedEvaluationElement, Proof, STR_FINALIZE,
+    derive_keypair, deterministic_blind_unchecked, generate_proof, hash_to_group, i2osp_2,
+    server_evaluate_hash_input, verify_proof, BlindedElement, EvaluationElement, Mode,
+    PreparedEvaluationElement, Proof, STR_FINALIZE,
 };
 #[cfg(feature = "serde")]
 use crate::serialization::serde::{Element, Scalar};
@@ -38,13 +39,9 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct VoprfClient<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct VoprfClient<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) blind: <CS::Group as Group>::Scalar,
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -58,13 +55,9 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
-pub struct VoprfServer<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct VoprfServer<CS: CipherSuite> {
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
     pub(crate) sk: <CS::Group as Group>::Scalar,
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -76,11 +69,7 @@ where
 // =================== //
 /////////////////////////
 
-impl<CS: CipherSuite> VoprfClient<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> VoprfClient<CS> {
     /// Computes the first step for the multiplicative blinding version of
     /// DH-OPRF.
     ///
@@ -159,7 +148,7 @@ where
     ///
     /// The resulting messages can each fail individually with [`Error::Input`]
     /// if the `input` is empty or longer then [`u16::MAX`].
-    pub fn batch_finalize<'a, I: 'a, II, IC, IM>(
+    pub fn batch_finalize<'a, I, II, IC, IM>(
         inputs: &'a II,
         clients: &'a IC,
         messages: &'a IM,
@@ -168,7 +157,7 @@ where
     ) -> Result<VoprfClientBatchFinalizeResult<'a, CS, I, II, IC, IM>>
     where
         CS: 'a,
-        I: AsRef<[u8]>,
+        I: 'a + AsRef<[u8]>,
         &'a II: 'a + IntoIterator<Item = I>,
         <&'a II as IntoIterator>::IntoIter: ExactSizeIterator,
         &'a IC: 'a + IntoIterator<Item = &'a VoprfClient<CS>>,
@@ -195,18 +184,14 @@ where
         }
     }
 
-    // Only used for test functions
+    /// Only used for test functions
     #[cfg(test)]
     pub fn get_blind(&self) -> <CS::Group as Group>::Scalar {
         self.blind
     }
 }
 
-impl<CS: CipherSuite> VoprfServer<CS>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+impl<CS: CipherSuite> VoprfServer<CS> {
     /// Produces a new instance of a [VoprfServer] using a supplied RNG
     ///
     /// # Errors
@@ -244,7 +229,7 @@ where
         Ok(Self { sk, pk })
     }
 
-    // Only used for tests
+    /// Only used for tests
     #[cfg(test)]
     pub fn get_private_key(&self) -> <CS::Group as Group>::Scalar {
         self.sk
@@ -253,13 +238,13 @@ where
     /// Computes the second step for the multiplicative blinding version of
     /// DH-OPRF. This message is sent from the server (who holds the OPRF key)
     /// to the client.
-    pub fn evaluate<R: RngCore + CryptoRng>(
+    pub fn blind_evaluate<R: RngCore + CryptoRng>(
         &self,
         rng: &mut R,
         blinded_element: &BlindedElement<CS>,
     ) -> VoprfServerEvaluateResult<CS> {
         let mut prepared_evaluation_elements =
-            self.batch_evaluate_prepare(iter::once(blinded_element));
+            self.batch_blind_evaluate_prepare(iter::once(blinded_element));
         let prepared_evaluation_element = [prepared_evaluation_elements.next().unwrap()];
 
         // This can't fail because we know the size of the inputs.
@@ -267,7 +252,7 @@ where
             mut messages,
             proof,
         } = self
-            .batch_evaluate_finish(
+            .batch_blind_evaluate_finish(
                 rng,
                 iter::once(blinded_element),
                 &prepared_evaluation_element,
@@ -286,7 +271,7 @@ where
     /// [`Error::Batch`] if the number of `blinded_elements` and
     /// `evaluation_elements` don't match or is longer then [`u16::MAX`]
     #[cfg(feature = "alloc")]
-    pub fn batch_evaluate<'a, R: RngCore + CryptoRng, I>(
+    pub fn batch_blind_evaluate<'a, R: RngCore + CryptoRng, I>(
         &self,
         rng: &mut R,
         blinded_elements: &'a I,
@@ -297,10 +282,10 @@ where
         <&'a I as IntoIterator>::IntoIter: ExactSizeIterator,
     {
         let prepared_evaluation_elements = self
-            .batch_evaluate_prepare(blinded_elements.into_iter())
+            .batch_blind_evaluate_prepare(blinded_elements.into_iter())
             .collect();
         let VoprfServerBatchEvaluateFinishResult { messages, proof } = self
-            .batch_evaluate_finish::<_, _, Vec<_>>(
+            .batch_blind_evaluate_finish::<_, _, Vec<_>>(
                 rng,
                 blinded_elements.into_iter(),
                 &prepared_evaluation_elements,
@@ -310,11 +295,11 @@ where
         Ok(VoprfServerBatchEvaluateResult { messages, proof })
     }
 
-    /// Alternative version of `batch_evaluate` without
-    /// memory allocation. Returned [`PreparedEvaluationElement`] have to be
+    /// Alternative version of `batch_blind_evaluate` without memory allocation.
+    /// Returned [`PreparedEvaluationElement`] have to be
     /// [`collect`](Iterator::collect)ed and passed into
-    /// [`batch_evaluate_finish`](Self::batch_evaluate_finish).
-    pub fn batch_evaluate_prepare<'a, I: Iterator<Item = &'a BlindedElement<CS>>>(
+    /// [`batch_blind_evaluate_finish`](Self::batch_blind_evaluate_finish).
+    pub fn batch_blind_evaluate_prepare<'a, I: Iterator<Item = &'a BlindedElement<CS>>>(
         &self,
         blinded_elements: I,
     ) -> VoprfServerBatchEvaluatePreparedEvaluationElements<CS, I>
@@ -328,13 +313,13 @@ where
             })
     }
 
-    /// See [`batch_evaluate_prepare`](Self::batch_evaluate_prepare) for more
-    /// details.
+    /// See [`batch_blind_evaluate_prepare`](Self::batch_blind_evaluate_prepare)
+    /// for more details.
     ///
     /// # Errors
     /// [`Error::Batch`] if the number of `blinded_elements` and
     /// `evaluation_elements` don't match or is longer then [`u16::MAX`]
-    pub fn batch_evaluate_finish<
+    pub fn batch_blind_evaluate_finish<
         'a,
         'b,
         R: RngCore + CryptoRng,
@@ -371,6 +356,22 @@ where
         Ok(VoprfServerBatchEvaluateFinishResult { messages, proof })
     }
 
+    /// Computes the output of the POPRF on the server side
+    ///
+    /// # Errors
+    /// [`Error::Input`]  if the `input` is longer then [`u16::MAX`].
+    pub fn evaluate(&self, input: &[u8]) -> Result<Output<<CS as CipherSuite>::Hash>> {
+        let input_element = hash_to_group::<CS>(input, Mode::Voprf)?;
+        if CS::Group::is_identity_elem(input_element).into() {
+            return Err(Error::Input);
+        };
+        let evaluated_element = input_element * &self.sk;
+
+        let issued_element = CS::Group::serialize_elem(evaluated_element);
+
+        server_evaluate_hash_input::<CS>(input, None, issued_element)
+    }
+
     /// Retrieves the server's public key
     pub fn get_public_key(&self) -> <CS::Group as Group>::Elem {
         self.pk
@@ -384,11 +385,7 @@ where
 
 /// Contains the fields that are returned by a verifiable client blind
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
-pub struct VoprfClientBlindResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct VoprfClientBlindResult<CS: CipherSuite> {
     /// The state to be persisted on the client
     pub state: VoprfClient<CS>,
     /// The message to send to the server
@@ -405,11 +402,7 @@ pub type VoprfClientBatchFinalizeResult<'a, C, I, II, IC, IM> = FinalizeAfterUnb
 
 /// Contains the fields that are returned by a verifiable server evaluate
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
-pub struct VoprfServerEvaluateResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct VoprfServerEvaluateResult<CS: CipherSuite> {
     /// The message to send to the client
     pub message: EvaluationElement<CS>,
     /// The proof for the client to verify
@@ -419,11 +412,7 @@ where
 /// Contains the fields that are returned by a verifiable server batch evaluate
 #[derive_where(Debug; <CS::Group as Group>::Scalar, <CS::Group as Group>::Elem)]
 #[cfg(feature = "alloc")]
-pub struct VoprfServerBatchEvaluateResult<CS: CipherSuite>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+pub struct VoprfServerBatchEvaluateResult<CS: CipherSuite> {
     /// The messages to send to the client
     pub messages: Vec<EvaluationElement<CS>>,
     /// The proof for the client to verify
@@ -431,7 +420,7 @@ where
 }
 
 /// Concrete type of [`EvaluationElement`]s returned by
-/// [`VoprfServer::batch_evaluate_prepare`].
+/// [`VoprfServer::batch_blind_evaluate_prepare`].
 pub type VoprfServerBatchEvaluatePreparedEvaluationElements<CS, I> = Map<
     Zip<I, Repeat<<<CS as CipherSuite>::Group as Group>::Scalar>>,
     fn(
@@ -454,8 +443,6 @@ pub type VoprfServerBatchEvaluateFinishedMessages<'a, CS, I> = Map<
 #[derive_where(Debug; <&'a I as IntoIterator>::IntoIter, <CS::Group as Group>::Scalar)]
 pub struct VoprfServerBatchEvaluateFinishResult<'a, CS: 'a + CipherSuite, I>
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     &'a I: IntoIterator<Item = &'a PreparedEvaluationElement<CS>>,
 {
     /// The [`EvaluationElement`]s to send to the client
@@ -493,8 +480,6 @@ fn verifiable_unblind<'a, CS: 'a + CipherSuite, IC, IM>(
     proof: &Proof<CS>,
 ) -> Result<VoprfUnblindResult<'a, CS, IC, IM>>
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     &'a IC: 'a + IntoIterator<Item = &'a VoprfClient<CS>>,
     <&'a IC as IntoIterator>::IntoIter: ExactSizeIterator,
     &'a IM: 'a + IntoIterator<Item = &'a EvaluationElement<CS>>,
@@ -519,7 +504,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -536,11 +521,7 @@ fn finalize_after_unblind<
     IE: 'a + Iterator<Item = (I, <CS::Group as Group>::Elem)>,
 >(
     inputs_and_unblinded_elements: IE,
-) -> FinalizeAfterUnblindResult<'a, CS, I, IE>
-where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-{
+) -> FinalizeAfterUnblindResult<'a, CS, I, IE> {
     inputs_and_unblinded_elements.map(|(input, unblinded_element)| {
         let elem_len = <CS::Group as Group>::ElemLen::U16.to_be_bytes();
 
@@ -565,31 +546,23 @@ where
 
 #[cfg(test)]
 mod tests {
-    use core::ops::Add;
     use core::ptr;
 
     use ::alloc::vec;
     use ::alloc::vec::Vec;
-    use generic_array::sequence::Concat;
-    use generic_array::typenum::Sum;
-    use generic_array::ArrayLength;
     use rand::rngs::OsRng;
 
     use super::*;
-    use crate::common::{create_context_string, STR_HASH_TO_GROUP};
+    use crate::common::{Dst, STR_HASH_TO_GROUP};
     use crate::Group;
 
     fn prf<CS: CipherSuite>(
         input: &[u8],
         key: <CS::Group as Group>::Scalar,
         mode: Mode,
-    ) -> Output<CS::Hash>
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+    ) -> Output<CS::Hash> {
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         let res = point * &key;
 
@@ -599,16 +572,12 @@ mod tests {
             .unwrap()
     }
 
-    fn verifiable_retrieval<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_retrieval<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
-        let server_result = server.evaluate(&mut rng, &client_blind_result.message);
+        let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
         let client_finalize_result = client_blind_result
             .state
             .finalize(
@@ -622,11 +591,7 @@ mod tests {
         assert_eq!(client_finalize_result, res2);
     }
 
-    fn verifiable_batch_retrieval<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_batch_retrieval<CS: CipherSuite>() {
         let mut rng = OsRng;
         let mut inputs = vec![];
         let mut client_states = vec![];
@@ -642,10 +607,10 @@ mod tests {
         }
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
         let prepared_evaluation_elements: Vec<_> = server
-            .batch_evaluate_prepare(client_messages.iter())
+            .batch_blind_evaluate_prepare(client_messages.iter())
             .collect();
         let VoprfServerBatchEvaluateFinishResult { messages, proof } = server
-            .batch_evaluate_finish(
+            .batch_blind_evaluate_finish(
                 &mut rng,
                 client_messages.iter(),
                 &prepared_evaluation_elements,
@@ -670,11 +635,7 @@ mod tests {
         assert_eq!(client_finalize_result, res2);
     }
 
-    fn verifiable_batch_bad_public_key<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_batch_bad_public_key<CS: CipherSuite>() {
         let mut rng = OsRng;
         let mut inputs = vec![];
         let mut client_states = vec![];
@@ -690,10 +651,10 @@ mod tests {
         }
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
         let prepared_evaluation_elements: Vec<_> = server
-            .batch_evaluate_prepare(client_messages.iter())
+            .batch_blind_evaluate_prepare(client_messages.iter())
             .collect();
         let VoprfServerBatchEvaluateFinishResult { messages, proof } = server
-            .batch_evaluate_finish(
+            .batch_blind_evaluate_finish(
                 &mut rng,
                 client_messages.iter(),
                 &prepared_evaluation_elements,
@@ -701,31 +662,25 @@ mod tests {
             .unwrap();
         let messages: Vec<_> = messages.collect();
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result =
             VoprfClient::batch_finalize(&inputs, &client_states, &messages, &proof, wrong_pk);
         assert!(client_finalize_result.is_err());
     }
 
-    fn verifiable_bad_public_key<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-    {
+    fn verifiable_bad_public_key<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
-        let server_result = server.evaluate(&mut rng, &client_blind_result.message);
+        let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result = client_blind_result.state.finalize(
             input,
@@ -736,13 +691,36 @@ mod tests {
         assert!(client_finalize_result.is_err());
     }
 
-    fn zeroize_voprf_client<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ElemLen>: ArrayLength<u8>,
-    {
+    fn verifiable_server_evaluate<CS: CipherSuite>() {
+        let input = b"input";
+        let mut rng = OsRng;
+        let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
+        let server = VoprfServer::<CS>::new(&mut rng).unwrap();
+        let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
+
+        let client_finalize = client_blind_result
+            .state
+            .finalize(
+                input,
+                &server_result.message,
+                &server_result.proof,
+                server.get_public_key(),
+            )
+            .unwrap();
+
+        // We expect the outputs from client and server to be equal given an identical
+        // input
+        let server_evaluate = server.evaluate(input).unwrap();
+        assert_eq!(client_finalize, server_evaluate);
+
+        // We expect the outputs from client and server to be different given different
+        // inputs
+        let wrong_input = b"wrong input";
+        let server_evaluate = server.evaluate(wrong_input).unwrap();
+        assert!(client_finalize != server_evaluate);
+    }
+
+    fn zeroize_voprf_client<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
@@ -756,20 +734,12 @@ mod tests {
         assert!(message.serialize().iter().all(|&x| x == 0));
     }
 
-    fn zeroize_voprf_server<CS: CipherSuite>()
-    where
-        <CS::Hash as OutputSizeUser>::OutputSize:
-            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ElemLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ElemLen>: ArrayLength<u8>,
-        <CS::Group as Group>::ScalarLen: Add<<CS::Group as Group>::ScalarLen>,
-        Sum<<CS::Group as Group>::ScalarLen, <CS::Group as Group>::ScalarLen>: ArrayLength<u8>,
-    {
+    fn zeroize_voprf_server<CS: CipherSuite>() {
         let input = b"input";
         let mut rng = OsRng;
         let client_blind_result = VoprfClient::<CS>::blind(input, &mut rng).unwrap();
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
-        let server_result = server.evaluate(&mut rng, &client_blind_result.message);
+        let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
 
         let mut state = server;
         unsafe { ptr::drop_in_place(&mut state) };
@@ -787,6 +757,8 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -796,6 +768,7 @@ mod tests {
             verifiable_batch_retrieval::<Ristretto255>();
             verifiable_bad_public_key::<Ristretto255>();
             verifiable_batch_bad_public_key::<Ristretto255>();
+            verifiable_server_evaluate::<Ristretto255>();
 
             zeroize_voprf_client::<Ristretto255>();
             zeroize_voprf_server::<Ristretto255>();
@@ -805,10 +778,29 @@ mod tests {
         verifiable_batch_retrieval::<NistP256>();
         verifiable_bad_public_key::<NistP256>();
         verifiable_batch_bad_public_key::<NistP256>();
+        verifiable_server_evaluate::<NistP256>();
 
         zeroize_voprf_client::<NistP256>();
         zeroize_voprf_server::<NistP256>();
 
+        verifiable_retrieval::<NistP384>();
+        verifiable_batch_retrieval::<NistP384>();
+        verifiable_bad_public_key::<NistP384>();
+        verifiable_batch_bad_public_key::<NistP384>();
+        verifiable_server_evaluate::<NistP384>();
+
+        zeroize_voprf_client::<NistP384>();
+        zeroize_voprf_server::<NistP384>();
+
+        verifiable_retrieval::<NistP521>();
+        verifiable_batch_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_batch_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_voprf_client::<NistP521>();
+        zeroize_voprf_server::<NistP521>();
+
         Ok(())
     }
 }