Skip to content

Commit 16e072d

Browse files
authored
Group trait overhaul part 2 (#53)
* Rely on elliptic-curve for hash-to-curve and P-256 implementations * Update MSRV * Remove unnecessary `#[macro_use]` * Re-introduce `CipherSuite` * Provide types for length shortcuts * Remove `SUITE_ID` from `Group` * Blanket implementation for RustCrypto `Curve`s * Remove the p256 crate feature * Rename `ristretto_*` crate features to `ristretto-*` for consistency * Remove unnecessary allowed Clippy lints * Remove some unnecessary constraints
1 parent 652fd1d commit 16e072d

File tree

15 files changed

+1028
-1633
lines changed

15 files changed

+1028
-1633
lines changed

.github/workflows/main.yml

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -35,22 +35,16 @@ jobs:
3535
fail-fast: false
3636
matrix:
3737
backend_feature:
38-
- ristretto255_u64
39-
- ristretto255_u32
40-
- p256
41-
- ristretto255_u64,p256
38+
- --features ristretto255-ciphersuite,ristretto255-u64
39+
- --features ristretto255-ciphersuite,ristretto255-u32
40+
-
4241
frontend_feature:
4342
-
4443
- --features danger
4544
- --features serde
4645
toolchain:
4746
- stable
48-
- 1.51.0
49-
exclude:
50-
- backend_feature: p256
51-
toolchain: 1.51.0
52-
- backend_feature: ristretto255_u64,p256
53-
toolchain: 1.51.0
47+
- 1.57.0
5448
name: test
5549
steps:
5650
- name: Checkout sources
@@ -67,19 +61,19 @@ jobs:
6761
uses: actions-rs/cargo@v1
6862
with:
6963
command: test
70-
args: --no-default-features --features ${{ matrix.backend_feature }}
64+
args: --no-default-features ${{ matrix.backend_feature }}
7165

7266
- name: Run cargo test with alloc
7367
uses: actions-rs/cargo@v1
7468
with:
7569
command: test
76-
args: --no-default-features ${{ matrix.frontend_feature }},alloc --features ${{ matrix.backend_feature }}
70+
args: --no-default-features ${{ matrix.frontend_feature }},alloc ${{ matrix.backend_feature }}
7771

7872
- name: Run cargo test with std
7973
uses: actions-rs/cargo@v1
8074
with:
8175
command: test
82-
args: --no-default-features ${{ matrix.frontend_feature }},std --features ${{ matrix.backend_feature }}
76+
args: --no-default-features ${{ matrix.frontend_feature }},std ${{ matrix.backend_feature }}
8377

8478
build-no-std:
8579
name: Build with no-std on ${{ matrix.target }}
@@ -94,9 +88,8 @@ jobs:
9488
- thumbv6m-none-eabi
9589
backend_feature:
9690
-
97-
- --features ristretto255_u64
98-
- --features ristretto255_u32
99-
- --features p256
91+
- --features ristretto255-ciphersuite,ristretto255-u64
92+
- --features ristretto255-ciphersuite,ristretto255-u32
10093
frontend_feature:
10194
-
10295
- --features danger
@@ -135,7 +128,7 @@ jobs:
135128
RUSTDOCFLAGS: -D warnings
136129
with:
137130
command: doc
138-
args: --no-deps --document-private-items --features std,p256
131+
args: --no-deps --document-private-items --features danger,std
139132

140133

141134
rustfmt:

Cargo.toml

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2,65 +2,60 @@
22
authors = ["Kevin Lewi <[email protected]>"]
33
categories = ["no-std", "algorithms", "cryptography"]
44
description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)"
5-
edition = "2018"
5+
edition = "2021"
66
keywords = ["oprf"]
77
license = "MIT"
88
name = "voprf"
99
readme = "README.md"
1010
repository = "https://github.com/novifinancial/voprf/"
11-
resolver = "2"
12-
rust-version = "1.51"
11+
rust-version = "1.57"
1312
version = "0.3.0"
1413

1514
[features]
1615
alloc = []
1716
danger = []
18-
default = ["ristretto255_u64", "serde"]
19-
p256 = [
20-
"alloc",
21-
"num-bigint",
22-
"num-integer",
23-
"num-traits",
24-
"once_cell",
25-
"p256_",
26-
]
17+
default = ["ristretto255-ciphersuite", "ristretto255-u64", "serde"]
2718
ristretto255 = ["generic-array/more_lengths"]
28-
ristretto255_fiat_u32 = ["curve25519-dalek/fiat_u32_backend", "ristretto255"]
29-
ristretto255_fiat_u64 = ["curve25519-dalek/fiat_u64_backend", "ristretto255"]
30-
ristretto255_simd = ["curve25519-dalek/simd_backend", "ristretto255"]
31-
ristretto255_u32 = ["curve25519-dalek/u32_backend", "ristretto255"]
32-
ristretto255_u64 = ["curve25519-dalek/u64_backend", "ristretto255"]
19+
ristretto255-ciphersuite = ["ristretto255", "sha2"]
20+
ristretto255-fiat-u32 = ["curve25519-dalek/fiat_u32_backend", "ristretto255"]
21+
ristretto255-fiat-u64 = ["curve25519-dalek/fiat_u64_backend", "ristretto255"]
22+
ristretto255-simd = ["curve25519-dalek/simd_backend", "ristretto255"]
23+
ristretto255-u32 = ["curve25519-dalek/u32_backend", "ristretto255"]
24+
ristretto255-u64 = ["curve25519-dalek/u64_backend", "ristretto255"]
3325
std = ["alloc"]
3426

3527
[dependencies]
3628
curve25519-dalek = { version = "3", default-features = false, optional = true }
3729
derive-where = { version = "1.0.0-rc.1", features = ["zeroize"] }
3830
digest = "0.10"
3931
displaydoc = { version = "0.2", default-features = false }
32+
elliptic-curve = { version = "0.12.0-pre.1", features = [
33+
"hash2curve",
34+
"sec1",
35+
"voprf",
36+
] }
4037
generic-array = "0.14"
41-
num-bigint = { version = "0.4", default-features = false, optional = true }
42-
num-integer = { version = "0.1", default-features = false, optional = true }
43-
num-traits = { version = "0.2", default-features = false, optional = true }
44-
once_cell = { version = "1", default-features = false, optional = true }
45-
p256_ = { package = "p256", version = "0.10", default-features = false, features = [
46-
"arithmetic",
47-
], optional = true }
4838
rand_core = { version = "0.6", default-features = false }
4939
serde = { version = "1", default-features = false, features = [
5040
"derive",
5141
], optional = true }
42+
sha2 = { version = "0.10", default-features = false, optional = true }
5243
subtle = { version = "2.3", default-features = false }
5344
zeroize = { version = "1", default-features = false }
5445

5546
[dev-dependencies]
5647
generic-array = { version = "0.14", features = ["more_lengths"] }
5748
hex = "0.4"
5849
json = "0.12"
50+
p256 = { version = "0.11.0-pre.0", default-features = false, features = [
51+
"hash2curve",
52+
"voprf",
53+
] }
5954
proptest = "1"
6055
rand = "0.8"
6156
regex = "1"
6257
sha2 = "0.10"
6358

6459
[package.metadata.docs.rs]
65-
features = ["danger", "p256", "std"]
60+
features = ["danger", "std"]
6661
targets = []

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ voprf = "0.3"
2121

2222
### Minimum Supported Rust Version
2323

24-
Rust **1.51** or higher.
24+
Rust **1.57** or higher.
2525

2626
Contributors
2727
------------

src/ciphersuite.rs

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Copyright (c) Facebook, Inc. and its affiliates.
2+
//
3+
// This source code is licensed under both the MIT license found in the
4+
// LICENSE-MIT file in the root directory of this source tree and the Apache
5+
// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
6+
// of this source tree.
7+
8+
//! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
9+
10+
use digest::core_api::BlockSizeUser;
11+
use digest::{Digest, OutputSizeUser};
12+
use elliptic_curve::VoprfParameters;
13+
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
14+
15+
use crate::Group;
16+
17+
/// Configures the underlying primitives used in VOPRF
18+
pub trait CipherSuite
19+
where
20+
<Self::Hash as OutputSizeUser>::OutputSize:
21+
IsLess<U256> + IsLessOrEqual<<Self::Hash as BlockSizeUser>::BlockSize>,
22+
{
23+
/// The ciphersuite identifier as dictated by
24+
/// <https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html>
25+
const ID: u16;
26+
27+
/// A finite cyclic group along with a point representation that allows some
28+
/// customization on how to hash an input to a curve point. See [`Group`].
29+
type Group: Group;
30+
31+
/// The main hash function to use (for HKDF computations and hashing
32+
/// transcripts).
33+
type Hash: BlockSizeUser + Digest;
34+
}
35+
36+
impl<T: VoprfParameters> CipherSuite for T
37+
where
38+
T: Group,
39+
T::Hash: BlockSizeUser + Digest,
40+
<T::Hash as OutputSizeUser>::OutputSize:
41+
IsLess<U256> + IsLessOrEqual<<T::Hash as BlockSizeUser>::BlockSize>,
42+
{
43+
const ID: u16 = T::ID;
44+
45+
type Group = T;
46+
47+
type Hash = T::Hash;
48+
}

src/group/elliptic_curve.rs

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
// Copyright (c) Facebook, Inc. and its affiliates.
2+
//
3+
// This source code is licensed under both the MIT license found in the
4+
// LICENSE-MIT file in the root directory of this source tree and the Apache
5+
// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
6+
// of this source tree.
7+
8+
use digest::core_api::BlockSizeUser;
9+
use digest::OutputSizeUser;
10+
use elliptic_curve::group::cofactor::CofactorGroup;
11+
use elliptic_curve::hash2curve::{ExpandMsgXmd, FromOkm, GroupDigest};
12+
use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint};
13+
use elliptic_curve::{
14+
AffinePoint, Field, FieldSize, Group as _, ProjectivePoint, PublicKey, Scalar, SecretKey,
15+
};
16+
use generic_array::sequence::Concat;
17+
use generic_array::typenum::{IsLess, IsLessOrEqual, U256};
18+
use generic_array::GenericArray;
19+
use rand_core::{CryptoRng, RngCore};
20+
21+
use super::Group;
22+
use crate::group::{STR_HASH_TO_GROUP, STR_HASH_TO_SCALAR};
23+
use crate::voprf::{self, Mode};
24+
use crate::{CipherSuite, Error, Result};
25+
26+
impl<C> Group for C
27+
where
28+
C: GroupDigest,
29+
ProjectivePoint<Self>: CofactorGroup,
30+
FieldSize<Self>: ModulusSize,
31+
AffinePoint<Self>: FromEncodedPoint<Self> + ToEncodedPoint<Self>,
32+
Scalar<Self>: FromOkm,
33+
{
34+
type Elem = ProjectivePoint<Self>;
35+
36+
type ElemLen = <FieldSize<Self> as ModulusSize>::CompressedPointSize;
37+
38+
type Scalar = Scalar<Self>;
39+
40+
type ScalarLen = FieldSize<Self>;
41+
42+
// Implements the `hash_to_curve()` function from
43+
// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
44+
fn hash_to_curve<CS: CipherSuite>(msg: &[&[u8]], mode: Mode) -> Result<Self::Elem>
45+
where
46+
<CS::Hash as OutputSizeUser>::OutputSize:
47+
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
48+
{
49+
let dst =
50+
GenericArray::from(STR_HASH_TO_GROUP).concat(voprf::get_context_string::<CS>(mode));
51+
52+
Self::hash_from_bytes::<ExpandMsgXmd<CS::Hash>>(msg, &dst).map_err(|_| Error::PointError)
53+
}
54+
55+
// Implements the `HashToScalar()` function
56+
fn hash_to_scalar<CS: CipherSuite>(input: &[&[u8]], mode: Mode) -> Result<Self::Scalar>
57+
where
58+
<CS::Hash as OutputSizeUser>::OutputSize:
59+
IsLess<U256> + IsLessOrEqual<<CS::Hash as BlockSizeUser>::BlockSize>,
60+
{
61+
let dst =
62+
GenericArray::from(STR_HASH_TO_SCALAR).concat(voprf::get_context_string::<CS>(mode));
63+
64+
<Self as GroupDigest>::hash_to_scalar::<ExpandMsgXmd<CS::Hash>>(input, &dst)
65+
.map_err(|_| Error::PointError)
66+
}
67+
68+
fn base_elem() -> Self::Elem {
69+
ProjectivePoint::<Self>::generator()
70+
}
71+
72+
fn identity_elem() -> Self::Elem {
73+
ProjectivePoint::<Self>::identity()
74+
}
75+
76+
fn serialize_elem(elem: Self::Elem) -> GenericArray<u8, Self::ElemLen> {
77+
let point: AffinePoint<Self> = elem.into();
78+
let bytes = point.to_encoded_point(true);
79+
let bytes = bytes.as_bytes();
80+
let mut result = GenericArray::default();
81+
result[..bytes.len()].copy_from_slice(bytes);
82+
result
83+
}
84+
85+
fn deserialize_elem(element_bits: &GenericArray<u8, Self::ElemLen>) -> Result<Self::Elem> {
86+
PublicKey::<Self>::from_sec1_bytes(element_bits)
87+
.map(|public_key| public_key.to_projective())
88+
.map_err(|_| Error::PointError)
89+
}
90+
91+
fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Self::Scalar {
92+
*SecretKey::<Self>::random(rng).to_nonzero_scalar()
93+
}
94+
95+
fn invert_scalar(scalar: Self::Scalar) -> Self::Scalar {
96+
Option::from(scalar.invert()).unwrap()
97+
}
98+
99+
#[cfg(test)]
100+
fn zero_scalar() -> Self::Scalar {
101+
Scalar::<Self>::zero()
102+
}
103+
104+
fn serialize_scalar(scalar: Self::Scalar) -> GenericArray<u8, Self::ScalarLen> {
105+
scalar.into()
106+
}
107+
108+
fn deserialize_scalar(scalar_bits: &GenericArray<u8, Self::ScalarLen>) -> Result<Self::Scalar> {
109+
SecretKey::<Self>::from_be_bytes(scalar_bits)
110+
.map(|secret_key| *secret_key.to_nonzero_scalar())
111+
.map_err(|_| Error::ScalarError)
112+
}
113+
}

0 commit comments

Comments
 (0)