Publishing v0.4.1 (#136)

* Fix Clippy (#85)

* Update `curve25519-dalek` to 4.0.0-pre.5 (#86)

* Update `curve25519-dalek`

* Improve documentation

* Adding all-features CI test (#87)

* Upgrade `p256` to v0.12 (#90)

* Upgrade `p256` to v0.12

* Upgrade MSRV to 1.60

(cherry picked from commit daa8dc048f)

* Replace `json` with `serde_json` (#92)

(cherry picked from commit c8de51672b)

* Fix Clippy (#96)

(cherry picked from commit 74eaebe446)

* Depend on `ProjectivePoint: ToEncodedPoint` (#95)

(cherry picked from commit 0409db6f40)

* Update `curve25519-dalek` (#94)

(cherry picked from commit 2787151e1d)

* Use explicit crate features (#100)

(cherry picked from commit 5bce3e3206)

* Bump `curve25519-dalek` to v4.0.0-rc.1 (#102)

(cherry picked from commit 8363d26f6f)

* Test P-384 (#84)

(cherry picked from commit 83eb78b232)

* Update RustCrypto dependencies to v0.13 (#106)

(cherry picked from commit 8b895cc631)

* Update curve25519-dalek requirement from =4.0.0-rc.1 to =4.0.0-rc.2 (#108)

Updates the requirements on [curve25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) to permit the latest version.
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dalek-cryptography/curve25519-dalek/compare/4.0.0-rc.1...4.0.0-rc.2)

---
updated-dependencies:
- dependency-name: curve25519-dalek
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4bd2cf466e)

* Updating dual-license language (#110)

(cherry picked from commit f79ebf9844)

* Bump `curve25519-dalek` to v4.0.0-rc.3 (#113)

(cherry picked from commit 209b957ae4)

* Bump `curve25519-dalek` to v4 (#116)

(cherry picked from commit 0fdfdfdaee)

* Fixing clippy IntoIterator warnings (#123)

(cherry picked from commit c0162ec8d9)

* Bump actions/checkout from 3 to 4 (#120)

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 8da56845b8)

* Updating setup-rust-action (#125)

(cherry picked from commit 59e3fedb21)

* Test P-521 (#127)

(cherry picked from commit 68cc7d3709)

* Fix ambiguous lifetime elision (#131)

(cherry picked from commit 40769f7eca)

* Bump actions/cache from 3 to 4 (#132)

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit c93884aca3)

* Fixups + cherry-picking changes from #101

* Fix Clippy warnings

* More fixups, tests passing

* Ensure CI runs on branch v0.4

---------

Co-authored-by: daxpedda <[email protected]>
Co-authored-by: Kevin Lewi <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -3,8 +3,9 @@ on:
   push:
     branches:
       - main
+      - v0.4
   pull_request:
-    types: [opened, repoened, synchronize]
+    types: [opened, reopened, synchronize]
 
 jobs:
   cargo-audit:
@@ -12,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache cargo-audit
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -24,7 +25,7 @@ jobs:
         run: cargo install cargo-audit
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run cargo audit
         run: cargo audit -D warnings
@@ -47,7 +48,7 @@ jobs:
     name: test
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install ${{ matrix.toolchain }} toolchain
         uses: actions-rs/toolchain@v1
@@ -99,8 +100,8 @@ jobs:
           - --features danger
           - --features serde
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
-      - uses: hecrj/setup-rust-action@v1
+      - uses: hecrj/setup-rust-action@v2
       - run: rustup target add ${{ matrix.target }}
       - run: cargo build --verbose --target=${{ matrix.target }} --no-default-features ${{ matrix.frontend_feature }} ${{ matrix.backend_feature }}
 
@@ -110,7 +111,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install stable toolchain
         uses: actions-rs/toolchain@v1
@@ -140,7 +141,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install nightly toolchain
         uses: actions-rs/toolchain@v1
@@ -161,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/.crates.toml
@@ -170,10 +171,10 @@ jobs:
           key: taplo
 
       - name: Install Taplo
-        run: cargo install taplo-cli
+        run: cargo install taplo-cli --locked
 
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run Taplo
         run: taplo fmt --check

.github/workflows/publish.yml

@@ -10,9 +10,10 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
+        rust: [stable]
 
     steps:
-    - uses: hecrj/setup-rust-action@v1
+    - uses: hecrj/setup-rust-action@v2
       with:
         rust-version: ${{ matrix.rust }}
     - uses: actions/checkout@master

.gitignore

@@ -8,3 +8,7 @@ Cargo.lock
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
+
+# Editors
+.idea
+.vscode

CHANGELOG.md

@@ -1,24 +1,9 @@
 # Changelog
 
-## 0.5.0-pre.5 (June 27, 2023)
+## 0.4.1 (September 24, 2024)
-* Updated curve25519-dalek dependency to 4.0.0-rc.3
+* Backport all non-protocol-breaking changes from versions 0.5+
-
+  * Fixes Rust 1.81+ compatibility, compatible with 0.4.0 (draft 11), incompatible with 0.5+ (final RFC)
-## 0.5.0-pre.4 (May 20, 2023)
+* Updated dependencies
-* Updated curve25519-dalek dependency to 4.0.0-rc.2
-
-## 0.5.0-pre.3 (March 4, 2023)
-* Updated to be in sync with draft-irtf-cfrg-voprf-19
-* Increased MSRV to 1.65
-* Updated p256 dependency to v0.13
-* Added p384 tests
-
-## 0.5.0-pre.2 (February 3, 2023)
-* Increased MSRV to 1.60
-* Updated p256 dependency to v0.12
-* Updated curve25519-dalek dependency to 4.0.0-rc.1
-
-## 0.5.0-pre.1 (December 19, 2022)
-* Updated curve25519-dalek dependency to 4.0.0-pre.5
 
 ## 0.4.0 (September 15, 2022)
 * Updated to be in sync with draft-irtf-cfrg-voprf-11, with

Cargo.toml

@@ -9,7 +9,7 @@ name = "voprf"
 readme = "README.md"
 repository = "https://github.com/facebook/voprf/"
 rust-version = "1.65"
-version = "0.5.0-pre.5"
+version = "0.4.1"
 
 [features]
 alloc = []
@@ -21,7 +21,7 @@ serde = ["generic-array/serde", "dep:serde"]
 std = ["alloc"]
 
 [dependencies]
-curve25519-dalek = { version = "=4.0.0-rc.3", default-features = false, features = [
+curve25519-dalek = { version = "4", default-features = false, features = [
   "rand_core",
   "zeroize",
 ], optional = true }
@@ -39,8 +39,8 @@ serde = { version = "1", default-features = false, features = [
   "derive",
 ], optional = true }
 sha2 = { version = "0.10", default-features = false, optional = true }
-subtle = { version = "2.3", default-features = false }
+subtle = { version = "2.6", default-features = false }
-zeroize = { version = "1.5", default-features = false }
+zeroize = { version = "1.8", default-features = false }
 
 [dev-dependencies]
 generic-array = { version = "0.14", features = ["more_lengths"] }
@@ -53,6 +53,10 @@ p384 = { version = "0.13", default-features = false, features = [
   "hash2curve",
   "voprf",
 ] }
+p521 = { version = "0.13.3", default-features = false, features = [
+  "hash2curve",
+  "voprf",
+] }
 proptest = "1"
 rand = "0.8"
 regex = "1"

README.md

@@ -1,4 +1,4 @@
-# voprf ![Build Status](https://github.com/novifinancial/voprf/workflows/Rust%20CI/badge.svg)
+# voprf ![Build Status](https://github.com/facebook/voprf/workflows/Rust%20CI/badge.svg)
 An implementation of a (verifiable) oblivious pseudorandom function (VOPRF)
 
 A VOPRF is a verifiable oblivious pseudorandom function, a protocol between a client and a server. The regular (non-verifiable) OPRF is also supported in this implementation.
@@ -16,7 +16,7 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = "0.5.0-pre.4"
+voprf = "0.4.1"
 ```
 
 ### Minimum Supported Rust Version

src/common.rs

@@ -35,7 +35,7 @@ pub(crate) const STR_DERIVE_KEYPAIR: [u8; 13] = *b"DeriveKeyPair";
 pub(crate) const STR_COMPOSITE: [u8; 9] = *b"Composite";
 pub(crate) const STR_CHALLENGE: [u8; 9] = *b"Challenge";
 pub(crate) const STR_INFO: [u8; 4] = *b"Info";
-pub(crate) const STR_OPRF: [u8; 7] = *b"OPRFV1-";
+pub(crate) const STR_VOPRF: [u8; 8] = *b"VOPRF10-";
 pub(crate) const STR_HASH_TO_SCALAR: [u8; 13] = *b"HashToScalar-";
 pub(crate) const STR_HASH_TO_GROUP: [u8; 12] = *b"HashToGroup-";
 
@@ -147,8 +147,8 @@ pub(crate) fn generate_proof<CS: CipherSuite, R: RngCore + CryptoRng>(
     k: <CS::Group as Group>::Scalar,
     a: <CS::Group as Group>::Elem,
     b: <CS::Group as Group>::Elem,
-    cs: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    cs: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
-    ds: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    ds: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
     mode: Mode,
 ) -> Result<Proof<CS>>
 where
@@ -209,8 +209,8 @@ where
 pub(crate) fn verify_proof<CS: CipherSuite>(
     a: <CS::Group as Group>::Elem,
     b: <CS::Group as Group>::Elem,
-    cs: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    cs: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
-    ds: impl Iterator<Item = <CS::Group as Group>::Elem> + ExactSizeIterator,
+    ds: impl ExactSizeIterator<Item = <CS::Group as Group>::Elem>,
     proof: &Proof<CS>,
     mode: Mode,
 ) -> Result<()>
@@ -500,29 +500,37 @@ where
 
 pub(crate) struct Dst<L: ArrayLength<u8>> {
     dst_1: GenericArray<u8, L>,
-    dst_2: &'static str,
+    dst_2: [u8; 2],
 }
 
 impl<L: ArrayLength<u8>> Dst<L> {
-    pub(crate) fn new<CS: CipherSuite, T, TL: ArrayLength<u8>>(par_1: T, mode: Mode) -> Self
+    pub(crate) fn new<CS: CipherSuite, T, TL>(par_1: T, mode: Mode) -> Self
     where
         T: Into<GenericArray<u8, TL>>,
-        TL: Add<U9, Output = L>,
+        TL: ArrayLength<u8> + Add<U9, Output = L>,
         <CS::Hash as OutputSizeUser>::OutputSize:
             IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
     {
         let par_1 = par_1.into();
         // Generates the contextString parameter as defined in
         // <https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/>
-        let par_2 = GenericArray::from(STR_OPRF)
+        let par_2 = GenericArray::from(STR_VOPRF).concat([mode.to_u8()].into());
-            .concat([mode.to_u8()].into())
+
-            .concat([b'-'].into());
+        // See <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html#section-4.1>
+        let cs_id_u16: u16 = match CS::ID {
+            "ristretto255-SHA512" => 0x0001,
+            "decaf448-SHAKE256" => 0x0002,
+            "P256-SHA256" => 0x0003,
+            "P384-SHA384" => 0x0004,
+            "P521-SHA512" => 0x0005,
+            _ => panic!("Incompatible ciphersuite: {}", CS::ID),
+        };
 
         let dst_1 = par_1.concat(par_2);
-        let dst_2 = CS::ID;
+        let dst_2 = cs_id_u16.to_be_bytes();
 
         assert!(
-            L::USIZE + dst_2.len() <= u16::MAX.into(),
+            L::USIZE + 2 <= u16::MAX.into(),
             "constructed DST longer then {}",
             u16::MAX
         );
@@ -531,13 +539,11 @@ impl<L: ArrayLength<u8>> Dst<L> {
     }
 
     pub(crate) fn as_dst(&self) -> [&[u8]; 2] {
-        [&self.dst_1, self.dst_2.as_bytes()]
+        [&self.dst_1, &self.dst_2]
     }
 
     pub(crate) fn i2osp_2(&self) -> [u8; 2] {
-        u16::try_from(L::USIZE + self.dst_2.len())
+        u16::try_from(L::USIZE + 2).unwrap().to_be_bytes()
-            .unwrap()
-            .to_be_bytes()
     }
 }
 

src/group/tests.rs

@@ -17,6 +17,7 @@ use crate::{Error, Group, Result};
 fn test_group_properties() -> Result<()> {
     use p256::NistP256;
     use p384::NistP384;
+    use p521::NistP521;
 
     #[cfg(feature = "ristretto255")]
     {
@@ -32,6 +33,9 @@ fn test_group_properties() -> Result<()> {
     test_identity_element_error::<NistP384>()?;
     test_zero_scalar_error::<NistP384>()?;
 
+    test_identity_element_error::<NistP521>()?;
+    test_zero_scalar_error::<NistP521>()?;
+
     Ok(())
 }
 

src/lib.rs

@@ -9,7 +9,7 @@
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!
 //! Note: This implementation is in sync with
-//! [draft-irtf-cfrg-voprf-19](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-19.html),
+//! [draft-irtf-cfrg-voprf-11](https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-11.html),
 //! but this specification is subject to change, until the final version
 //! published by the IETF.
 //!

src/oprf.rs

@@ -427,6 +427,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -454,6 +455,13 @@ mod tests {
         zeroize_oprf_client::<NistP384>();
         zeroize_oprf_server::<NistP384>();
 
+        base_retrieval::<NistP521>();
+        base_inversion_unsalted::<NistP521>();
+        server_evaluate::<NistP521>();
+
+        zeroize_oprf_client::<NistP521>();
+        zeroize_oprf_server::<NistP521>();
+
         Ok(())
     }
 }

src/poprf.rs

@@ -720,7 +720,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -967,6 +967,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -994,6 +995,13 @@ mod tests {
         zeroize_verifiable_client::<NistP384>();
         zeroize_verifiable_server::<NistP384>();
 
+        verifiable_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_verifiable_client::<NistP521>();
+        zeroize_verifiable_server::<NistP521>();
+
         Ok(())
     }
 }

src/serialization.rs

@@ -307,11 +307,11 @@ fn deserialize_scalar<G: Group>(input: &mut &[u8]) -> Result<G::Scalar> {
 }
 
 trait SliceExt {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self>;
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self>;
 }
 
 impl<T> SliceExt for [T] {
-    fn take_ext(self: &mut &Self, take: usize) -> Option<&Self> {
+    fn take_ext<'a>(self: &mut &'a Self, take: usize) -> Option<&'a Self> {
         if take > self.len() {
             return None;
         }
@@ -391,6 +391,7 @@ mod test {
 
             let _ = $item::<p256::NistP256>::deserialize(&$bytes[..]);
             let _ = $item::<p384::NistP384>::deserialize(&$bytes[..]);
+            let _ = $item::<p521::NistP521>::deserialize(&$bytes[..]);
         };
     }
 

src/tests/parser.rs

@@ -15,7 +15,7 @@ pub(crate) fn rfc_to_json(input: &str) -> String {
 }
 
 fn parse_ciphersuites(input: &str) -> String {
-    let re = regex::Regex::new(r"\n## (?P<ciphersuite>.+?)\n").unwrap();
+    let re = regex::Regex::new(r"## OPRF\((?P<ciphersuite>.+?)\)").unwrap();
     let mut ciphersuites = vec![];
 
     let chunks: Vec<&str> = re.split(input).collect();

src/tests/test_cfrg_vectors.rs

@@ -89,6 +89,7 @@ macro_rules! json_to_test_vectors {
 fn test_vectors() -> Result<()> {
     use p256::NistP256;
     use p384::NistP384;
+    use p521::NistP521;
 
     let rfc: Value = serde_json::from_str(rfc_to_json(super::cfrg_vectors::VECTORS).as_str())
         .expect("Could not parse json");
@@ -99,7 +100,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_oprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255-SHA512"),
+            String::from("ristretto255, SHA-512"),
             String::from("OPRF")
         );
         assert_ne!(ristretto_oprf_tvs.len(), 0);
@@ -111,7 +112,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_voprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255-SHA512"),
+            String::from("ristretto255, SHA-512"),
             String::from("VOPRF")
         );
         assert_ne!(ristretto_voprf_tvs.len(), 0);
@@ -123,7 +124,7 @@ fn test_vectors() -> Result<()> {
 
         let ristretto_poprf_tvs = json_to_test_vectors!(
             rfc,
-            String::from("ristretto255-SHA512"),
+            String::from("ristretto255, SHA-512"),
             String::from("POPRF")
         );
         assert_ne!(ristretto_poprf_tvs.len(), 0);
@@ -135,7 +136,7 @@ fn test_vectors() -> Result<()> {
     }
 
     let p256_oprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("OPRF"));
+        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("OPRF"));
     assert_ne!(p256_oprf_tvs.len(), 0);
     test_oprf_seed_to_key::<NistP256>(&p256_oprf_tvs)?;
     test_oprf_blind::<NistP256>(&p256_oprf_tvs)?;
@@ -144,7 +145,7 @@ fn test_vectors() -> Result<()> {
     test_oprf_evaluate::<NistP256>(&p256_oprf_tvs)?;
 
     let p256_voprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("VOPRF"));
+        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("VOPRF"));
     assert_ne!(p256_voprf_tvs.len(), 0);
     test_voprf_seed_to_key::<NistP256>(&p256_voprf_tvs)?;
     test_voprf_blind::<NistP256>(&p256_voprf_tvs)?;
@@ -153,7 +154,7 @@ fn test_vectors() -> Result<()> {
     test_voprf_evaluate::<NistP256>(&p256_voprf_tvs)?;
 
     let p256_poprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P256-SHA256"), String::from("POPRF"));
+        json_to_test_vectors!(rfc, String::from("P-256, SHA-256"), String::from("POPRF"));
     assert_ne!(p256_poprf_tvs.len(), 0);
     test_poprf_seed_to_key::<NistP256>(&p256_poprf_tvs)?;
     test_poprf_blind::<NistP256>(&p256_poprf_tvs)?;
@@ -162,7 +163,7 @@ fn test_vectors() -> Result<()> {
     test_poprf_evaluate::<NistP256>(&p256_poprf_tvs)?;
 
     let p384_oprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("OPRF"));
+        json_to_test_vectors!(rfc, String::from("P-384, SHA-384"), String::from("OPRF"));
     assert_ne!(p384_oprf_tvs.len(), 0);
     test_oprf_seed_to_key::<NistP384>(&p384_oprf_tvs)?;
     test_oprf_blind::<NistP384>(&p384_oprf_tvs)?;
@@ -171,7 +172,7 @@ fn test_vectors() -> Result<()> {
     test_oprf_evaluate::<NistP384>(&p384_oprf_tvs)?;
 
     let p384_voprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("VOPRF"));
+        json_to_test_vectors!(rfc, String::from("P-384, SHA-384"), String::from("VOPRF"));
     assert_ne!(p384_voprf_tvs.len(), 0);
     test_voprf_seed_to_key::<NistP384>(&p384_voprf_tvs)?;
     test_voprf_blind::<NistP384>(&p384_voprf_tvs)?;
@@ -180,7 +181,7 @@ fn test_vectors() -> Result<()> {
     test_voprf_evaluate::<NistP384>(&p384_voprf_tvs)?;
 
     let p384_poprf_tvs =
-        json_to_test_vectors!(rfc, String::from("P384-SHA384"), String::from("POPRF"));
+        json_to_test_vectors!(rfc, String::from("P-384, SHA-384"), String::from("POPRF"));
     assert_ne!(p384_poprf_tvs.len(), 0);
     test_poprf_seed_to_key::<NistP384>(&p384_poprf_tvs)?;
     test_poprf_blind::<NistP384>(&p384_poprf_tvs)?;
@@ -188,6 +189,33 @@ fn test_vectors() -> Result<()> {
     test_poprf_finalize::<NistP384>(&p384_poprf_tvs)?;
     test_poprf_evaluate::<NistP384>(&p384_poprf_tvs)?;
 
+    let p521_oprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P-521, SHA-512"), String::from("OPRF"));
+    assert_ne!(p521_oprf_tvs.len(), 0);
+    test_oprf_seed_to_key::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_blind_evaluate::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_finalize::<NistP521>(&p521_oprf_tvs)?;
+    test_oprf_evaluate::<NistP521>(&p521_oprf_tvs)?;
+
+    let p521_voprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P-521, SHA-512"), String::from("VOPRF"));
+    assert_ne!(p521_voprf_tvs.len(), 0);
+    test_voprf_seed_to_key::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_blind_evaluate::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_finalize::<NistP521>(&p521_voprf_tvs)?;
+    test_voprf_evaluate::<NistP521>(&p521_voprf_tvs)?;
+
+    let p521_poprf_tvs =
+        json_to_test_vectors!(rfc, String::from("P-521, SHA-512"), String::from("POPRF"));
+    assert_ne!(p521_poprf_tvs.len(), 0);
+    test_poprf_seed_to_key::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_blind_evaluate::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_finalize::<NistP521>(&p521_poprf_tvs)?;
+    test_poprf_evaluate::<NistP521>(&p521_poprf_tvs)?;
+
     Ok(())
 }
 

src/voprf.rs

@@ -161,7 +161,7 @@ where
     ///
     /// The resulting messages can each fail individually with [`Error::Input`]
     /// if the `input` is empty or longer then [`u16::MAX`].
-    pub fn batch_finalize<'a, I: 'a, II, IC, IM>(
+    pub fn batch_finalize<'a, I, II, IC, IM>(
         inputs: &'a II,
         clients: &'a IC,
         messages: &'a IM,
@@ -170,7 +170,7 @@ where
     ) -> Result<VoprfClientBatchFinalizeResult<'a, CS, I, II, IC, IM>>
     where
         CS: 'a,
-        I: AsRef<[u8]>,
+        I: 'a + AsRef<[u8]>,
         &'a II: 'a + IntoIterator<Item = I>,
         <&'a II as IntoIterator>::IntoIter: ExactSizeIterator,
         &'a IC: 'a + IntoIterator<Item = &'a VoprfClient<CS>>,
@@ -537,7 +537,7 @@ where
     )?;
 
     Ok(blinds
-        .zip(messages.into_iter())
+        .zip(messages)
         .map(|(blind, x)| x.0 * &CS::Group::invert_scalar(blind)))
 }
 
@@ -836,6 +836,7 @@ mod tests {
     fn test_functionality() -> Result<()> {
         use p256::NistP256;
         use p384::NistP384;
+        use p521::NistP521;
 
         #[cfg(feature = "ristretto255")]
         {
@@ -869,6 +870,15 @@ mod tests {
         zeroize_voprf_client::<NistP384>();
         zeroize_voprf_server::<NistP384>();
 
+        verifiable_retrieval::<NistP521>();
+        verifiable_batch_retrieval::<NistP521>();
+        verifiable_bad_public_key::<NistP521>();
+        verifiable_batch_bad_public_key::<NistP521>();
+        verifiable_server_evaluate::<NistP521>();
+
+        zeroize_voprf_client::<NistP521>();
+        zeroize_voprf_server::<NistP521>();
+
         Ok(())
     }
 }