Publishing 0.5.0-pre.4 (#109)

Updates the requirements on [curve25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) to permit the latest version.
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dalek-cryptography/curve25519-dalek/compare/4.0.0-rc.1...4.0.0-rc.2)

---
updated-dependencies:
- dependency-name: curve25519-dalek
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -35,8 +35,7 @@ jobs:
       fail-fast: false
       matrix:
         backend_feature:
-          - --features ristretto255-ciphersuite,ristretto255-u64
-          - --features ristretto255-ciphersuite,ristretto255-u32
+          - --features ristretto255-ciphersuite
           -
         frontend_feature:
           -
@@ -44,7 +43,7 @@ jobs:
           - --features serde
         toolchain:
           - stable
-          - 1.57.0
+          - 1.65.0
     name: test
     steps:
       - name: Checkout sources
@@ -75,6 +74,12 @@ jobs:
           command: test
           args: --no-default-features ${{ matrix.frontend_feature }},std ${{ matrix.backend_feature }}
 
+      - name: Run cargo test with all features enabled
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --all-features
+
   build-no-std:
     name: Build with no-std on ${{ matrix.target }}
     runs-on: ubuntu-latest
@@ -88,8 +93,7 @@ jobs:
           - thumbv6m-none-eabi
         backend_feature:
           -
-          - --features ristretto255-ciphersuite,ristretto255-u64
-          - --features ristretto255-ciphersuite,ristretto255-u32
+          - --features ristretto255-ciphersuite
         frontend_feature:
           -
           - --features danger
@@ -120,7 +124,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --all-targets -- -D warnings
+          args: --all-features --all-targets -- -D warnings
 
       - name: Run cargo doc
         uses: actions-rs/cargo@v1

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.5.0-pre.4 (May 20, 2023)
+* Updated curve25519-dalek dependency to 4.0.0-rc.2
+
+## 0.5.0-pre.3 (March 4, 2023)
+* Updated to be in sync with draft-irtf-cfrg-voprf-19
+* Increased MSRV to 1.65
+* Updated p256 dependency to v0.13
+* Added p384 tests
+
+## 0.5.0-pre.2 (February 3, 2023)
+* Increased MSRV to 1.60
+* Updated p256 dependency to v0.12
+* Updated curve25519-dalek dependency to 4.0.0-rc.1
+
+## 0.5.0-pre.1 (December 19, 2022)
+* Updated curve25519-dalek dependency to 4.0.0-pre.5
+
 ## 0.4.0 (September 15, 2022)
 * Updated to be in sync with draft-irtf-cfrg-voprf-11, with
   the addition of the POPRF mode

Cargo.toml

@@ -7,37 +7,35 @@ keywords = ["oprf"]
 license = "MIT"
 name = "voprf"
 readme = "README.md"
-repository = "https://github.com/novifinancial/voprf/"
-rust-version = "1.57"
-version = "0.4.0"
+repository = "https://github.com/facebook/voprf/"
+rust-version = "1.65"
+version = "0.5.0-pre.4"
 
 [features]
 alloc = []
 danger = []
-default = ["ristretto255-ciphersuite", "ristretto255-u64", "serde"]
-ristretto255 = ["curve25519-dalek", "generic-array/more_lengths"]
-ristretto255-ciphersuite = ["ristretto255", "sha2"]
-ristretto255-fiat-u32 = ["curve25519-dalek/fiat_u32_backend", "ristretto255"]
-ristretto255-fiat-u64 = ["curve25519-dalek/fiat_u64_backend", "ristretto255"]
-ristretto255-simd = ["curve25519-dalek/simd_backend", "ristretto255"]
-ristretto255-u32 = ["curve25519-dalek/u32_backend", "ristretto255"]
-ristretto255-u64 = ["curve25519-dalek/u64_backend", "ristretto255"]
-serde = ["generic-array/serde", "serde_"]
+default = ["ristretto255-ciphersuite", "dep:serde"]
+ristretto255 = ["dep:curve25519-dalek", "generic-array/more_lengths"]
+ristretto255-ciphersuite = ["ristretto255", "dep:sha2"]
+serde = ["generic-array/serde", "dep:serde"]
 std = ["alloc"]
 
 [dependencies]
-curve25519-dalek = { version = "=4.0.0-pre.1", default-features = false, optional = true }
+curve25519-dalek = { version = "=4.0.0-rc.2", default-features = false, features = [
+  "rand_core",
+  "zeroize",
+], optional = true }
 derive-where = { version = "1", features = ["zeroize-on-drop"] }
 digest = "0.10"
 displaydoc = { version = "0.2", default-features = false }
-elliptic-curve = { version = "0.12", features = [
+elliptic-curve = { version = "0.13", features = [
   "hash2curve",
   "sec1",
   "voprf",
 ] }
 generic-array = "0.14"
 rand_core = { version = "0.6", default-features = false }
-serde_ = { version = "1", package = "serde", default-features = false, features = [
+serde = { version = "1", default-features = false, features = [
   "derive",
 ], optional = true }
 sha2 = { version = "0.10", default-features = false, optional = true }
@@ -47,16 +45,21 @@ zeroize = { version = "1.5", default-features = false }
 [dev-dependencies]
 generic-array = { version = "0.14", features = ["more_lengths"] }
 hex = "0.4"
-json = "0.12"
-p256 = { version = "0.11", default-features = false, features = [
+p256 = { version = "0.13", default-features = false, features = [
+  "hash2curve",
+  "voprf",
+] }
+p384 = { version = "0.13", default-features = false, features = [
   "hash2curve",
   "voprf",
 ] }
 proptest = "1"
 rand = "0.8"
 regex = "1"
+serde_json = "1"
 sha2 = "0.10"
 
 [package.metadata.docs.rs]
-features = ["danger", "std"]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
 targets = []

README.md

@@ -16,12 +16,12 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = "0.4"
+voprf = "0.5.0-pre.4"
 ```
 
 ### Minimum Supported Rust Version
 
-Rust **1.57** or higher.
+Rust **1.65** or higher.
 
 Contributors
 ------------

src/ciphersuite.rs

@@ -8,7 +8,7 @@
 //! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
 
 use digest::core_api::BlockSizeUser;
-use digest::{Digest, OutputSizeUser};
+use digest::{FixedOutput, HashMarker, OutputSizeUser};
 use elliptic_curve::VoprfParameters;
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
 
@@ -22,7 +22,7 @@ where
 {
     /// The ciphersuite identifier as dictated by
     /// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
-    const ID: u16;
+    const ID: &'static str;
 
     /// A finite cyclic group along with a point representation that allows some
     /// customization on how to hash an input to a curve point. See [`Group`].
@@ -30,17 +30,17 @@ where
 
     /// The main hash function to use (for HKDF computations and hashing
     /// transcripts).
-    type Hash: BlockSizeUser + Digest;
+    type Hash: BlockSizeUser + Default + FixedOutput + HashMarker;
 }
 
 impl<T: VoprfParameters> CipherSuite for T
 where
     T: Group,
-    T::Hash: BlockSizeUser + Digest,
+    T::Hash: BlockSizeUser + Default + FixedOutput + HashMarker,
     <T::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<T::Hash as BlockSizeUser>::BlockSize>,
 {
-    const ID: u16 = T::ID;
+    const ID: &'static str = T::ID;
 
     type Group = T;
 

src/common.rs

@@ -8,12 +8,13 @@
 //! Common functionality between multiple OPRF modes.
 
 use core::convert::TryFrom;
+use core::ops::Add;
 
 use derive_where::derive_where;
 use digest::core_api::BlockSizeUser;
 use digest::{Digest, Output, OutputSizeUser};
 use generic_array::sequence::Concat;
-use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U11, U2, U256};
+use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U2, U256, U9};
 use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
 use subtle::ConstantTimeEq;
@@ -33,7 +34,7 @@ pub(crate) const STR_DERIVE_KEYPAIR: [u8; 13] = *b"DeriveKeyPair";
 pub(crate) const STR_COMPOSITE: [u8; 9] = *b"Composite";
 pub(crate) const STR_CHALLENGE: [u8; 9] = *b"Challenge";
 pub(crate) const STR_INFO: [u8; 4] = *b"Info";
-pub(crate) const STR_VOPRF: [u8; 8] = *b"VOPRF10-";
+pub(crate) const STR_OPRF: [u8; 7] = *b"OPRFV1-";
 pub(crate) const STR_HASH_TO_SCALAR: [u8; 13] = *b"HashToScalar-";
 pub(crate) const STR_HASH_TO_GROUP: [u8; 12] = *b"HashToGroup-";
 
@@ -72,7 +73,7 @@ impl Mode {
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct BlindedElement<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -89,7 +90,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct EvaluationElement<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Element::<CS::Group>"))]
@@ -106,7 +107,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct PreparedEvaluationElement<CS: CipherSuite>(pub(crate) EvaluationElement<CS>)
 where
@@ -120,7 +121,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct Proof<CS: CipherSuite>
 where
@@ -194,9 +195,9 @@ where
         &STR_CHALLENGE,
     ];
 
-    let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
     // This can't fail, the size of the `input` is known.
-    let c_scalar = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+    let c_scalar = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
     let s_scalar = r - &(c_scalar * &k);
 
     Ok(Proof { c_scalar, s_scalar })
@@ -254,9 +255,9 @@ where
         &STR_CHALLENGE,
     ];
 
-    let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
     // This can't fail, the size of the `input` is known.
-    let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+    let c = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
 
     match c.ct_eq(&proof.c_scalar).into() {
         true => Ok(()),
@@ -296,16 +297,16 @@ where
     let len = u16::try_from(c_slice.len()).map_err(|_| Error::Batch)?;
 
     // seedDST = "Seed-" || contextString
-    let seed_dst = GenericArray::from(STR_SEED).concat(create_context_string::<CS>(mode));
+    let seed_dst = Dst::new::<CS, _, _>(STR_SEED, mode);
 
     // h1Input = I2OSP(len(Bm), 2) || Bm ||
     //           I2OSP(len(seedDST), 2) || seedDST
     // seed = Hash(h1Input)
     let seed = CS::Hash::new()
-        .chain_update(&elem_len)
+        .chain_update(elem_len)
         .chain_update(CS::Group::serialize_elem(b))
-        .chain_update(i2osp_2_array(&seed_dst))
-        .chain_update(seed_dst)
+        .chain_update(seed_dst.i2osp_2())
+        .chain_update_multi(&seed_dst.as_dst())
         .finalize();
     let seed_len = i2osp_2_array(&seed);
 
@@ -332,9 +333,9 @@ where
             &STR_COMPOSITE,
         ];
 
-        let dst = GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(mode));
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, mode);
         // This can't fail, the size of the `input` is known.
-        let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst).unwrap();
+        let di = CS::Group::hash_to_scalar::<CS::Hash>(&h2_input, &dst.as_dst()).unwrap();
         m = c * &di + &m;
         z = match k_option {
             Some(_) => z,
@@ -365,8 +366,7 @@ where
     <CS::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
 {
-    let context_string = create_context_string::<CS>(mode);
-    let dst = GenericArray::from(STR_DERIVE_KEYPAIR).concat(context_string);
+    let dst = Dst::new::<CS, _, _>(STR_DERIVE_KEYPAIR, mode);
 
     let info_len = i2osp_2(info.len()).map_err(|_| Error::DeriveKeyPair)?;
 
@@ -376,7 +376,7 @@ where
         // || contextString)
         let sk_s = CS::Group::hash_to_scalar::<CS::Hash>(
             &[seed, &info_len, info, &counter.to_be_bytes()],
-            &dst,
+            &dst.as_dst(),
         )
         .map_err(|_| Error::DeriveKeyPair)?;
 
@@ -388,7 +388,12 @@ where
     Err(Error::Protocol)
 }
 
-/// Can only fail with [`Error::DeriveKeyPair`] and [`Error::Protocol`].
+/// Corresponds to DeriveKeyPair() function from the VOPRF specification.
+///
+/// # Errors
+/// - [`Error::DeriveKeyPair`] if the `input` and `seed` together are longer
+///   then `u16::MAX - 3`.
+/// - [`Error::Protocol`] if the protocol fails and can't be completed.
 #[cfg(feature = "danger")]
 pub fn derive_key<CS: CipherSuite>(
     seed: &[u8],
@@ -450,8 +455,8 @@ where
     <CS::Hash as OutputSizeUser>::OutputSize:
         IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
 {
-    let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-    CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).map_err(|_| Error::Input)
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+    CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).map_err(|_| Error::Input)
 }
 
 /// Internal function that finalizes the hash input for OPRF, VOPRF & POPRF.
@@ -492,16 +497,64 @@ where
         .finalize())
 }
 
-/// Generates the contextString parameter as defined in
-/// <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
-pub(crate) fn create_context_string<CS: CipherSuite>(mode: Mode) -> GenericArray<u8, U11>
+pub(crate) struct Dst<L: ArrayLength<u8>> {
+    dst_1: GenericArray<u8, L>,
+    dst_2: &'static str,
+}
+
+impl<L: ArrayLength<u8>> Dst<L> {
+    pub(crate) fn new<CS: CipherSuite, T, TL: ArrayLength<u8>>(par_1: T, mode: Mode) -> Self
+    where
+        T: Into<GenericArray<u8, TL>>,
+        TL: Add<U9, Output = L>,
+        <CS::Hash as OutputSizeUser>::OutputSize:
+            IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
+    {
+        let par_1 = par_1.into();
+        // Generates the contextString parameter as defined in
+        // <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
+        let par_2 = GenericArray::from(STR_OPRF)
+            .concat([mode.to_u8()].into())
+            .concat([b'-'].into());
+
+        let dst_1 = par_1.concat(par_2);
+        let dst_2 = CS::ID;
+
+        assert!(
+            L::USIZE + dst_2.len() <= u16::MAX.into(),
+            "constructed DST longer then {}",
+            u16::MAX
+        );
+
+        Self { dst_1, dst_2 }
+    }
+
+    pub(crate) fn as_dst(&self) -> [&[u8]; 2] {
+        [&self.dst_1, self.dst_2.as_bytes()]
+    }
+
+    pub(crate) fn i2osp_2(&self) -> [u8; 2] {
+        u16::try_from(L::USIZE + self.dst_2.len())
+            .unwrap()
+            .to_be_bytes()
+    }
+}
+
+trait DigestExt {
+    fn chain_update_multi(self, data: &[&[u8]]) -> Self;
+}
+
+impl<T> DigestExt for T
 where
-    <CS::Hash as OutputSizeUser>::OutputSize:
-        IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
+    T: Digest,
 {
-    GenericArray::from(STR_VOPRF)
-        .concat([mode.to_u8()].into())
-        .concat(CS::ID.to_be_bytes().into())
+    fn chain_update_multi(mut self, datas: &[&[u8]]) -> Self {
+        for data in datas {
+            self.update(data)
+        }
+
+        self
+    }
 }
 
 ///////////////////////

src/group/elliptic_curve.rs

@@ -6,12 +6,12 @@
 // of this source tree.
 
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
+use digest::{FixedOutput, HashMarker};
 use elliptic_curve::group::cofactor::CofactorGroup;
 use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
 use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
 use elliptic_curve::{
-    AffinePoint, Field, FieldSize, Group as _, ProjectivePoint, PublicKey, Scalar, SecretKey,
+    AffinePoint, Field, FieldBytesSize, Group as _, ProjectivePoint, PublicKey, Scalar, SecretKey,
 };
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
 use generic_array::GenericArray;
@@ -24,32 +24,32 @@ impl<C> Group for C
 where
     C: GroupDigest,
     ProjectivePoint<Self>: CofactorGroup + ToEncodedPoint<Self>,
-    FieldSize<Self>: ModulusSize,
+    FieldBytesSize<Self>: ModulusSize,
     AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
     Scalar<Self>: FromOkm,
 {
     type Elem = ProjectivePoint<Self>;
 
-    type ElemLen = <FieldSize<Self> as ModulusSize>::CompressedPointSize;
+    type ElemLen = <FieldBytesSize<Self> as ModulusSize>::CompressedPointSize;
 
     type Scalar = Scalar<Self>;
 
-    type ScalarLen = FieldSize<Self>;
+    type ScalarLen = FieldBytesSize<Self>;
 
     // Implements the `hash_to_curve()` function from
     // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         Self::hash_from_bytes::<ExpandMsgXmd<H>>(input, dst).map_err(|_| InternalError::Input)
     }
 
     // Implements the `HashToScalar()` function
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         <Self as GroupDigest>::hash_to_scalar::<ExpandMsgXmd<H>>(input, dst)
@@ -92,7 +92,7 @@ where
 
     #[cfg(test)]
     fn zero_scalar() -> Self::Scalar {
-        Scalar::<Self>::zero()
+        Scalar::<Self>::ZERO
     }
 
     fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
@@ -100,7 +100,7 @@ where
     }
 
     fn deserialize_scalar(scalar_bits: &[u8]) -> Result<Self::Scalar> {
-        SecretKey::<Self>::from_be_bytes(scalar_bits)
+        SecretKey::<Self>::from_slice(scalar_bits)
             .map(|secret_key| *secret_key.to_nonzero_scalar())
             .map_err(|_| Error::Deserialization)
     }

src/group/mod.rs

@@ -14,7 +14,7 @@ mod ristretto;
 use core::ops::{Add, Mul, Sub};
 
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
+use digest::{FixedOutput, HashMarker};
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
 use generic_array::{ArrayLength, GenericArray};
 use rand_core::{CryptoRng, RngCore};
@@ -54,9 +54,9 @@ pub trait Group {
     /// # Errors
     /// [`Error::Input`](crate::Error::Input) if the `input` is empty or longer
     /// then [`u16::MAX`].
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
 
     /// Hashes a slice of pseudo-random bytes to a scalar
@@ -64,9 +64,9 @@ pub trait Group {
     /// # Errors
     /// [`Error::Input`](crate::Error::Input) if the `input` is empty or longer
     /// then [`u16::MAX`].
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>;
 
     /// Get the base point for the group

src/group/ristretto.rs

@@ -10,7 +10,7 @@ use curve25519_dalek::ristretto::{CompressedRistretto, RistrettoPoint};
 use curve25519_dalek::scalar::Scalar;
 use curve25519_dalek::traits::Identity;
 use digest::core_api::BlockSizeUser;
-use digest::Digest;
+use digest::{FixedOutput, HashMarker};
 use elliptic_curve::hash2curve::{ExpandMsg, ExpandMsgXmd, Expander};
 use generic_array::typenum::{IsLess, IsLessOrEqual, U256, U32, U64};
 use generic_array::GenericArray;
@@ -22,21 +22,17 @@ use crate::{Error, InternalError, Result};
 
 /// [`Group`] implementation for Ristretto255.
 #[derive(Clone, Copy, Debug, Default, Eq, Hash, Ord, PartialEq, PartialOrd)]
-// `cfg` here is only needed because of a bug in Rust's crate feature documentation. See: https://github.com/rust-lang/rust/issues/83428
-#[cfg(feature = "ristretto255")]
 pub struct Ristretto255;
 
 #[cfg(feature = "ristretto255-ciphersuite")]
 impl crate::CipherSuite for Ristretto255 {
-    const ID: u16 = 0x0001;
+    const ID: &'static str = "ristretto255-SHA512";
 
     type Group = Ristretto255;
 
     type Hash = sha2::Sha512;
 }
 
-// `cfg` here is only needed because of a bug in Rust's crate feature documentation. See: https://github.com/rust-lang/rust/issues/83428
-#[cfg(feature = "ristretto255")]
 impl Group for Ristretto255 {
     type Elem = RistrettoPoint;
 
@@ -48,9 +44,9 @@ impl Group for Ristretto255 {
 
     // Implements the `hash_to_ristretto255()` function from
     // https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
-    fn hash_to_curve<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Elem, InternalError>
+    fn hash_to_curve<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Elem, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         let mut uniform_bytes = GenericArray::<_, U64>::default();
@@ -63,9 +59,9 @@ impl Group for Ristretto255 {
 
     // Implements the `HashToScalar()` function from
     // https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-07.html#section-4.1
-    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[u8]) -> Result<Self::Scalar, InternalError>
+    fn hash_to_scalar<H>(input: &[&[u8]], dst: &[&[u8]]) -> Result<Self::Scalar, InternalError>
     where
-        H: Digest + BlockSizeUser,
+        H: BlockSizeUser + Default + FixedOutput + HashMarker,
         H::OutputSize: IsLess<U256> + IsLessOrEqual<H::BlockSize>,
     {
         let mut uniform_bytes = GenericArray::<_, U64>::default();
@@ -90,11 +86,8 @@ impl Group for Ristretto255 {
     }
 
     fn deserialize_elem(element_bits: &[u8]) -> Result<Self::Elem> {
-        if element_bits.len() != 32 {
-            return Err(Error::Deserialization);
-        }
-
         CompressedRistretto::from_slice(element_bits)
+            .map_err(|_| Error::Deserialization)?
             .decompress()
             .filter(|point| point != &RistrettoPoint::identity())
             .ok_or(Error::Deserialization)
@@ -104,7 +97,7 @@ impl Group for Ristretto255 {
         loop {
             let scalar = Scalar::random(rng);
 
-            if scalar != Scalar::zero() {
+            if scalar != Scalar::ZERO {
                 break scalar;
             }
         }
@@ -115,12 +108,12 @@ impl Group for Ristretto255 {
     }
 
     fn is_zero_scalar(scalar: Self::Scalar) -> subtle::Choice {
-        scalar.ct_eq(&Scalar::zero())
+        scalar.ct_eq(&Scalar::ZERO)
     }
 
     #[cfg(test)]
     fn zero_scalar() -> Self::Scalar {
-        Scalar::zero()
+        Scalar::ZERO
     }
 
     fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
@@ -131,8 +124,8 @@ impl Group for Ristretto255 {
         scalar_bits
             .try_into()
             .ok()
-            .and_then(Scalar::from_canonical_bytes)
-            .filter(|scalar| scalar != &Scalar::zero())
+            .and_then(|bytes| Scalar::from_canonical_bytes(bytes).into())
+            .filter(|scalar| scalar != &Scalar::ZERO)
             .ok_or(Error::Deserialization)
     }
 }

src/group/tests.rs

@@ -15,6 +15,7 @@ use crate::{Error, Group, Result};
 #[test]
 fn test_group_properties() -> Result<()> {
     use p256::NistP256;
+    use p384::NistP384;
 
     #[cfg(feature = "ristretto255")]
     {
@@ -27,6 +28,9 @@ fn test_group_properties() -> Result<()> {
     test_identity_element_error::<NistP256>()?;
     test_zero_scalar_error::<NistP256>()?;
 
+    test_identity_element_error::<NistP384>()?;
+    test_zero_scalar_error::<NistP384>()?;
+
     Ok(())
 }
 

src/lib.rs

@@ -8,7 +8,7 @@
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-11](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html),
+//! [draft-irtf-cfrg-voprf-19](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-19.html),
 //! but this specification is subject to change, until the final version
 //! published by the IETF.
 //!
@@ -532,24 +532,15 @@
 //!   a [`CipherSuite`].
 //!
 //! - The `ristretto255` feature enables using [`Ristretto255`] as the
-//!   underlying group for the [Group] choice. A backend feature, which are
-//!   re-exported from [curve25519-dalek] and allow for selecting the
-//!   corresponding backend for the curve arithmetic used, has to be selected,
-//!   otherwise compilation will fail. The `ristretto255-u64` feature is
-//!   included as the default. Other features are mapped as `ristretto255-u32`,
-//!   `ristretto255-fiat-u64` and `ristretto255-fiat-u32`. Any `ristretto255-*`
-//!   backend feature will enable the `ristretto255` feature.
-//!
-//! - The `ristretto255-simd` feature is re-exported from [curve25519-dalek] and
-//!   enables parallel formulas, using either AVX2 or AVX512-IFMA. This will
-//!   automatically enable the `ristretto255-u64` feature and requires Rust
-//!   nightly.
+//!   underlying group for the [Group] choice. To select a specific backend see
+//!   the [curve25519-dalek] documentation.
 //!
 //! [curve25519-dalek]:
-//!     (https://doc.dalek.rs/curve25519_dalek/index.html#backends-and-features)
+//!     (https://docs.rs/curve25519-dalek/4.0.0-pre.5/curve25519_dalek/index.html#backends)
 
-#![cfg_attr(not(test), deny(unsafe_code))]
 #![no_std]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![cfg_attr(not(test), deny(unsafe_code))]
 #![warn(
     clippy::cargo,
     clippy::missing_errors_doc,
@@ -564,9 +555,6 @@ extern crate alloc;
 #[cfg(feature = "std")]
 extern crate std;
 
-#[cfg(feature = "serde")]
-extern crate serde_ as serde;
-
 mod ciphersuite;
 mod common;
 mod error;

src/oprf.rs

@@ -41,7 +41,7 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct OprfClient<CS: CipherSuite>
 where
@@ -59,7 +59,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct OprfServer<CS: CipherSuite>
 where
@@ -277,7 +277,7 @@ where
             .chain_update(input.as_ref())
             .chain_update(elem_len)
             .chain_update(CS::Group::serialize_elem(unblinded_element))
-            .chain_update(&STR_FINALIZE)
+            .chain_update(STR_FINALIZE)
             .finalize())
     })
 }
@@ -291,11 +291,10 @@ where
 mod tests {
     use core::ptr;
 
-    use generic_array::sequence::Concat;
     use rand::rngs::OsRng;
 
     use super::*;
-    use crate::common::{create_context_string, STR_HASH_TO_GROUP};
+    use crate::common::{Dst, STR_HASH_TO_GROUP};
     use crate::Group;
 
     fn prf<CS: CipherSuite>(
@@ -308,8 +307,8 @@ mod tests {
         <CS::Hash as OutputSizeUser>::OutputSize:
             IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     {
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         let res = point * &key;
 
@@ -348,9 +347,8 @@ mod tests {
             .finalize(&input, &EvaluationElement(client_blind_result.message.0))
             .unwrap();
 
-        let dst =
-            GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(Mode::Oprf));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[&input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[&input], &dst.as_dst()).unwrap();
         let res2 = finalize_after_unblind::<CS, _, _>(iter::once((input.as_ref(), point)), &[])
             .next()
             .unwrap()
@@ -427,6 +425,7 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -447,6 +446,13 @@ mod tests {
         zeroize_oprf_client::<NistP256>();
         zeroize_oprf_server::<NistP256>();
 
+        base_retrieval::<NistP384>();
+        base_inversion_unsalted::<NistP384>();
+        server_evaluate::<NistP384>();
+
+        zeroize_oprf_client::<NistP384>();
+        zeroize_oprf_server::<NistP384>();
+
         Ok(())
     }
 }

src/poprf.rs

@@ -14,16 +14,14 @@ use core::iter::{self, Map, Repeat, Zip};
 use derive_where::derive_where;
 use digest::core_api::BlockSizeUser;
 use digest::{Digest, Output, OutputSizeUser};
-use generic_array::sequence::Concat;
 use generic_array::typenum::{IsLess, IsLessOrEqual, Unsigned, U256};
 use generic_array::GenericArray;
 use rand_core::{CryptoRng, RngCore};
 
 use crate::common::{
-    create_context_string, derive_keypair, deterministic_blind_unchecked, generate_proof,
-    hash_to_group, i2osp_2, server_evaluate_hash_input, verify_proof, BlindedElement,
-    EvaluationElement, Mode, PreparedEvaluationElement, Proof, STR_FINALIZE, STR_HASH_TO_SCALAR,
-    STR_INFO,
+    derive_keypair, deterministic_blind_unchecked, generate_proof, hash_to_group, i2osp_2,
+    server_evaluate_hash_input, verify_proof, BlindedElement, Dst, EvaluationElement, Mode,
+    PreparedEvaluationElement, Proof, STR_FINALIZE, STR_HASH_TO_SCALAR, STR_INFO,
 };
 #[cfg(feature = "serde")]
 use crate::serialization::serde::{Element, Scalar};
@@ -41,7 +39,7 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct PoprfClient<CS: CipherSuite>
 where
@@ -61,7 +59,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct PoprfServer<CS: CipherSuite>
 where
@@ -541,7 +539,7 @@ pub type PoprfServerBatchEvaluatePreparedEvaluationElements<CS, I> = Map<
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct PoprfPreparedTweak<CS: CipherSuite>(
     #[cfg_attr(feature = "serde", serde(with = "Scalar::<CS::Group>"))]
@@ -616,10 +614,9 @@ where
     let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
     let framed_info = [STR_INFO.as_slice(), &info_len, info];
 
-    let dst =
-        GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(Mode::Poprf));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
     // This can't fail, the size of the `input` is known.
-    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst).unwrap();
+    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
 
     let t = CS::Group::base_elem() * &m;
     let tweaked_key = t + &pk;
@@ -654,10 +651,9 @@ where
     let info_len = i2osp_2(info.len()).map_err(|_| Error::Info)?;
     let framed_info = [STR_INFO.as_slice(), &info_len, info];
 
-    let dst =
-        GenericArray::from(STR_HASH_TO_SCALAR).concat(create_context_string::<CS>(Mode::Poprf));
+    let dst = Dst::new::<CS, _, _>(STR_HASH_TO_SCALAR, Mode::Poprf);
     // This can't fail, the size of the `input` is known.
-    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst).unwrap();
+    let m = CS::Group::hash_to_scalar::<CS::Hash>(&framed_info, &dst.as_dst()).unwrap();
 
     let t = sk + &m;
 
@@ -810,8 +806,8 @@ mod tests {
     {
         let t = compute_tweak::<CS>(key, Some(info)).unwrap();
 
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         // evaluatedElement = G.ScalarInverse(t) * blindedElement
         let res = point * &CS::Group::invert_scalar(t);
@@ -864,10 +860,9 @@ mod tests {
             .blind_evaluate(&mut rng, &client_blind_result.message, Some(info))
             .unwrap();
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result = client_blind_result.state.finalize(
             input,
@@ -970,6 +965,7 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -990,6 +986,13 @@ mod tests {
         zeroize_verifiable_client::<NistP256>();
         zeroize_verifiable_server::<NistP256>();
 
+        verifiable_retrieval::<NistP384>();
+        verifiable_bad_public_key::<NistP384>();
+        verifiable_server_evaluate::<NistP384>();
+
+        zeroize_verifiable_client::<NistP384>();
+        zeroize_verifiable_server::<NistP384>();
+
         Ok(())
     }
 }

src/serialization.rs

@@ -389,6 +389,7 @@ mod test {
             }
 
             let _ = $item::<p256::NistP256>::deserialize(&$bytes[..]);
+            let _ = $item::<p384::NistP384>::deserialize(&$bytes[..]);
         };
     }
 

src/tests/mock_rng.rs

@@ -50,7 +50,7 @@ impl RngCore for CycleRng {
     #[inline]
     fn fill_bytes(&mut self, dest: &mut [u8]) {
         let len = min(self.v.len(), dest.len());
-        (&mut dest[..len]).copy_from_slice(&self.v[..len]);
+        dest[..len].copy_from_slice(&self.v[..len]);
         rotate_left(&mut self.v, len);
     }
 

src/tests/parser.rs

@@ -14,7 +14,7 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
 }
 
 fn parse_ciphersuites(input: &str) -> String {
-    let re = regex::Regex::new(r"## OPRF\((?P<ciphersuite>.+?)\)").unwrap();
+    let re = regex::Regex::new(r"\n## (?P<ciphersuite>.+?)\n").unwrap();
     let mut ciphersuites = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();
@@ -96,7 +96,7 @@ fn parse_params(input: &str) -> String {
                     let key = iter.next().unwrap().split_whitespace().next().unwrap();
                     let val = iter.next().unwrap().split_whitespace().next().unwrap();
 
-                    param = format!("    \"{}\": \"{}", key, val);
+                    param = format!("    \"{key}\": \"{val}");
                 } else {
                     let s = line.trim().to_string();
                     if s.contains('~') || s.contains('#') {

src/tests/test_cfrg_vectors.rs

@@ -14,7 +14,7 @@ use digest::core_api::BlockSizeUser;
 use digest::OutputSizeUser;
 use generic_array::typenum::{IsLess, IsLessOrEqual, Sum, U256};
 use generic_array::ArrayLength;
-use json::JsonValue;
+use serde_json::Value;
 
 use crate::tests::mock_rng::CycleRng;
 use crate::tests::parser::*;
@@ -40,7 +40,7 @@ struct VOPRFTestVectorParameters {
     output: Vec<Vec<u8>>,
 }
 
-fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters {
+fn populate_test_vectors(values: &Value) -> VOPRFTestVectorParameters {
     VOPRFTestVectorParameters {
         seed: decode(values, "Seed"),
         sksm: decode(values, "skSm"),
@@ -57,18 +57,18 @@ fn populate_test_vectors(values: &JsonValue) -> VOPRFTestVectorParameters {
     }
 }
 
-fn decode(values: &JsonValue, key: &str) -> Vec<u8> {
+fn decode(values: &Value, key: &str) -> Vec<u8> {
     values[key]
         .as_str()
-        .and_then(|s| hex::decode(&s).ok())
+        .and_then(|s| hex::decode(s).ok())
         .unwrap_or_default()
 }
 
-fn decode_vec(values: &JsonValue, key: &str) -> Vec<Vec<u8>> {
+fn decode_vec(values: &Value, key: &str) -> Vec<Vec<u8>> {
     let s = values[key].as_str().unwrap();
     let res = match s.contains(',') {
-        true => Some(s.split(',').map(|x| hex::decode(&x).unwrap()).collect()),
-        false => Some(vec![hex::decode(&s).unwrap()]),
+        true => Some(s.split(',').map(|x| hex::decode(x).unwrap()).collect()),
+        false => Some(vec![hex::decode(s).unwrap()]),
     };
     res.unwrap()
 }
@@ -76,8 +76,10 @@ fn decode_vec(values: &JsonValue, key: &str) -> Vec<Vec<u8>> {
 macro_rules! json_to_test_vectors {
     ( $v:ident, $cs:expr, $mode:expr ) => {
         $v[$cs][$mode]
-            .members()
-            .map(|x| populate_test_vectors(&x))
+            .as_array()
+            .into_iter()
+            .flatten()
+            .map(populate_test_vectors)
             .collect::<Vec<VOPRFTestVectorParameters>>()
     };
 }
@@ -85,8 +87,9 @@ macro_rules! json_to_test_vectors {
 #[test]
 fn test_vectors() -> Result<()> {
     use p256::NistP256;
+    use p384::NistP384;
 
-    let rfc = json::parse(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
+    let rfc: Value = serde_json::from_str(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
         .expect("Could not parse json");
 
     #[cfg(feature = "ristretto255")]
@@ -95,7 +98,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_oprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("OPRF")
         );
         assert_ne!(ristretto_oprf_tvs.len(), 0);
@@ -107,7 +110,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_voprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("VOPRF")
         );
         assert_ne!(ristretto_voprf_tvs.len(), 0);
@@ -119,7 +122,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_poprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255, SHA-512"),
+            String::from("ristretto255-SHA512"),
             String::from("POPRF")
         );
         assert_ne!(ristretto_poprf_tvs.len(), 0);
@@ -131,7 +134,7 @@ fn test_vectors() -> Result<()> {
     }
 
     let p256_oprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("OPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("OPRF"));
     assert_ne!(p256_oprf_tvs.len(), 0);
     test_oprf_seed_to_key::<NistP256>(&p256_oprf_tvs)?;
     test_oprf_blind::<NistP256>(&p256_oprf_tvs)?;
@@ -140,7 +143,7 @@ fn test_vectors() -> Result<()> {
     test_oprf_evaluate::<NistP256>(&p256_oprf_tvs)?;
 
     let p256_voprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("VOPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("VOPRF"));
     assert_ne!(p256_voprf_tvs.len(), 0);
     test_voprf_seed_to_key::<NistP256>(&p256_voprf_tvs)?;
     test_voprf_blind::<NistP256>(&p256_voprf_tvs)?;
@@ -149,7 +152,7 @@ fn test_vectors() -> Result<()> {
     test_voprf_evaluate::<NistP256>(&p256_voprf_tvs)?;
 
     let p256_poprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("POPRF"));
+        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("POPRF"));
     assert_ne!(p256_poprf_tvs.len(), 0);
     test_poprf_seed_to_key::<NistP256>(&p256_poprf_tvs)?;
     test_poprf_blind::<NistP256>(&p256_poprf_tvs)?;
@@ -157,6 +160,33 @@ fn test_vectors() -> Result<()> {
     test_poprf_finalize::<NistP256>(&p256_poprf_tvs)?;
     test_poprf_evaluate::<NistP256>(&p256_poprf_tvs)?;
 
+    let p384_oprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("OPRF"));
+    assert_ne!(p384_oprf_tvs.len(), 0);
+    test_oprf_seed_to_key::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_blind::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_finalize::<NistP384>(&p384_oprf_tvs)?;
+    test_oprf_evaluate::<NistP384>(&p384_oprf_tvs)?;
+
+    let p384_voprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("VOPRF"));
+    assert_ne!(p384_voprf_tvs.len(), 0);
+    test_voprf_seed_to_key::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_blind::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_finalize::<NistP384>(&p384_voprf_tvs)?;
+    test_voprf_evaluate::<NistP384>(&p384_voprf_tvs)?;
+
+    let p384_poprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("POPRF"));
+    assert_ne!(p384_poprf_tvs.len(), 0);
+    test_poprf_seed_to_key::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_blind::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_finalize::<NistP384>(&p384_poprf_tvs)?;
+    test_poprf_evaluate::<NistP384>(&p384_poprf_tvs)?;
+
     Ok(())
 }
 

src/voprf.rs

@@ -39,7 +39,7 @@ use crate::{CipherSuite, Error, Group, Result};
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct VoprfClient<CS: CipherSuite>
 where
@@ -59,7 +59,7 @@ where
 #[cfg_attr(
     feature = "serde",
     derive(serde::Deserialize, serde::Serialize),
-    serde(crate = "serde", bound = "")
+    serde(bound = "")
 )]
 pub struct VoprfServer<CS: CipherSuite>
 where
@@ -587,13 +587,12 @@ mod tests {
 
     use ::alloc::vec;
     use ::alloc::vec::Vec;
-    use generic_array::sequence::Concat;
     use generic_array::typenum::Sum;
     use generic_array::ArrayLength;
     use rand::rngs::OsRng;
 
     use super::*;
-    use crate::common::{create_context_string, STR_HASH_TO_GROUP};
+    use crate::common::{Dst, STR_HASH_TO_GROUP};
     use crate::Group;
 
     fn prf<CS: CipherSuite>(
@@ -605,8 +604,8 @@ mod tests {
         <CS::Hash as OutputSizeUser>::OutputSize:
             IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     {
-        let dst = GenericArray::from(STR_HASH_TO_GROUP).concat(create_context_string::<CS>(mode));
-        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst).unwrap();
+        let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, mode);
+        let point = CS::Group::hash_to_curve::<CS::Hash>(&[input], &dst.as_dst()).unwrap();
 
         let res = point * &key;
 
@@ -718,10 +717,9 @@ mod tests {
             .unwrap();
         let messages: Vec<_> = messages.collect();
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result =
             VoprfClient::batch_finalize(&inputs, &client_states, &messages, &proof, wrong_pk);
@@ -739,10 +737,9 @@ mod tests {
         let server = VoprfServer::<CS>::new(&mut rng).unwrap();
         let server_result = server.blind_evaluate(&mut rng, &client_blind_result.message);
         let wrong_pk = {
-            let dst = GenericArray::from(STR_HASH_TO_GROUP)
-                .concat(create_context_string::<CS>(Mode::Oprf));
+            let dst = Dst::new::<CS, _, _>(STR_HASH_TO_GROUP, Mode::Oprf);
             // Choose a group element that is unlikely to be the right public key
-            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst).unwrap()
+            CS::Group::hash_to_curve::<CS::Hash>(&[b"msg"], &dst.as_dst()).unwrap()
         };
         let client_finalize_result = client_blind_result.state.finalize(
             input,
@@ -837,6 +834,7 @@ mod tests {
     #[test]
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
+        use p384::NistP384;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -861,6 +859,15 @@ mod tests {
         zeroize_voprf_client::<NistP256>();
         zeroize_voprf_server::<NistP256>();
 
+        verifiable_retrieval::<NistP384>();
+        verifiable_batch_retrieval::<NistP384>();
+        verifiable_bad_public_key::<NistP384>();
+        verifiable_batch_bad_public_key::<NistP384>();
+        verifiable_server_evaluate::<NistP384>();
+
+        zeroize_voprf_client::<NistP384>();
+        zeroize_voprf_server::<NistP384>();
+
         Ok(())
     }
 }