Skip to content

Commit 28645a7

Browse files
kevinlewihuitseeker
kevinlewi
authored and
huitseeker
committed
Add key schedule / info changes in TripleDH computation (facebook#69)
1 parent 07f8048 commit 28645a7

File tree

2 files changed

+130
-64
lines changed

2 files changed

+130
-64
lines changed

‎src/key_exchange/tripledh.rs

Lines changed: 103 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ use crate::{
99
hash::Hash,
1010
key_exchange::traits::{KeyExchange, ToBytes},
1111
keypair::{KeyPair, SizedBytes},
12+
serialization::serialize,
1213
};
1314
use digest::{Digest, FixedOutput};
1415
use generic_array::{
@@ -27,6 +28,11 @@ pub(crate) type NonceLen = U32;
2728
const KE1_STATE_LEN: usize = KEY_LEN + KEY_LEN + NONCE_LEN;
2829

2930
static STR_3DH: &[u8] = b"3DH keys";
31+
static STR_CLIENT_MAC: &[u8] = b"client mac";
32+
static STR_HANDSHAKE_SECRET: &[u8] = b"handshake secret";
33+
static STR_SERVER_MAC: &[u8] = b"server mac";
34+
static STR_SESSION_SECRET: &[u8] = b"session secret";
35+
static STR_OPAQUE: &[u8] = b"OPAQUE ";
3036

3137
/// The Triple Diffie-Hellman key exchange implementation
3238
pub struct TripleDH;
@@ -84,7 +90,7 @@ impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
8490
server_nonce_bytes.into()
8591
};
8692

87-
let (shared_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
93+
let (session_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
8894
TripleDHComponents {
8995
pk1: ke1_message.client_e_pk.clone(),
9096
sk1: server_e_kp.private().clone(),
@@ -122,7 +128,7 @@ impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
122128
KE2State {
123129
km3,
124130
hashed_transcript,
125-
shared_secret,
131+
session_secret,
126132
},
127133
KE2Message {
128134
server_nonce,
@@ -139,7 +145,7 @@ impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
139145
server_s_pk: KeyFormat::Repr,
140146
client_s_sk: KeyFormat::Repr,
141147
) -> Result<(Vec<u8>, Self::KE3Message), ProtocolError> {
142-
let (shared_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
148+
let (session_secret, km2, km3) = derive_3dh_keys::<KeyFormat, D>(
143149
TripleDHComponents {
144150
pk1: ke2_message.server_e_pk.clone(),
145151
sk1: ke1_state.client_e_sk.clone(),
@@ -181,7 +187,7 @@ impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
181187
client_mac.update(&hashed_transcript);
182188

183189
Ok((
184-
shared_secret.to_vec(),
190+
session_secret.to_vec(),
185191
KE3Message {
186192
mac: client_mac.finalize().into_bytes(),
187193
},
@@ -202,7 +208,7 @@ impl<D: Hash, KeyFormat: KeyPair> KeyExchange<D, KeyFormat> for TripleDH {
202208
));
203209
}
204210

205-
Ok(ke2_state.shared_secret.to_vec())
211+
Ok(ke2_state.session_secret.to_vec())
206212
}
207213

208214
fn ke1_state_size() -> usize {
@@ -285,7 +291,7 @@ impl<KeyFormat: KeyPair> TryFrom<&[u8]> for KE1Message<KeyFormat> {
285291
pub struct KE2State<HashLen: ArrayLength<u8>> {
286292
km3: GenericArray<u8, HashLen>,
287293
hashed_transcript: GenericArray<u8, HashLen>,
288-
shared_secret: GenericArray<u8, HashLen>,
294+
session_secret: GenericArray<u8, HashLen>,
289295
}
290296

291297
/// The second key exchange message
@@ -300,7 +306,7 @@ impl<HashLen: ArrayLength<u8>> ToBytes for KE2State<HashLen> {
300306
let output: Vec<u8> = [
301307
&self.km3[..],
302308
&self.hashed_transcript[..],
303-
&self.shared_secret[..],
309+
&self.session_secret[..],
304310
]
305311
.concat();
306312
output
@@ -316,7 +322,7 @@ impl<HashLen: ArrayLength<u8>> TryFrom<&[u8]> for KE2State<HashLen> {
316322
Ok(Self {
317323
km3: GenericArray::clone_from_slice(&checked_bytes[..KEY_LEN]),
318324
hashed_transcript: GenericArray::clone_from_slice(&checked_bytes[KEY_LEN..2 * KEY_LEN]),
319-
shared_secret: GenericArray::clone_from_slice(&checked_bytes[2 * KEY_LEN..]),
325+
session_secret: GenericArray::clone_from_slice(&checked_bytes[2 * KEY_LEN..]),
320326
})
321327
}
322328
}
@@ -362,13 +368,38 @@ struct TripleDHComponents<KeyFormat: KeyPair> {
362368
sk3: KeyFormat::Repr,
363369
}
364370

365-
// Consists of a shared secret, followed by two mac keys
371+
// Consists of a shared secret, followed by two mac keys: (session_secret, km2, km3)
366372
type TripleDHDerivationResult<D> = (
367373
GenericArray<u8, <D as FixedOutput>::OutputSize>,
368374
GenericArray<u8, <D as FixedOutput>::OutputSize>,
369375
GenericArray<u8, <D as FixedOutput>::OutputSize>,
370376
);
371377

378+
/// The third key exchange message
379+
pub struct KE3Message<HashLen: ArrayLength<u8>> {
380+
mac: GenericArray<u8, HashLen>,
381+
}
382+
383+
impl<HashLen: ArrayLength<u8>> ToBytes for KE3Message<HashLen> {
384+
fn to_bytes(&self) -> Vec<u8> {
385+
self.mac.to_vec()
386+
}
387+
}
388+
389+
impl<HashLen: ArrayLength<u8>> TryFrom<&[u8]> for KE3Message<HashLen> {
390+
type Error = InternalPakeError;
391+
392+
fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
393+
let checked_bytes = check_slice_size(bytes, KEY_LEN, "ke3_message")?;
394+
395+
Ok(Self {
396+
mac: GenericArray::clone_from_slice(&checked_bytes),
397+
})
398+
}
399+
}
400+
401+
// Helper functions
402+
372403
// Internal function which takes the public and private components of the client and server keypairs, along
373404
// with some auxiliary metadata, to produce the shared secret and two MAC keys
374405
fn derive_3dh_keys<KeyFormat: KeyPair, D: Hash>(
@@ -387,44 +418,79 @@ fn derive_3dh_keys<KeyFormat: KeyPair, D: Hash>(
387418

388419
let info: Vec<u8> = [
389420
STR_3DH,
390-
&client_nonce,
391-
&server_nonce,
392-
&client_s_pk.to_arr(),
393-
&server_s_pk.to_arr(),
421+
&serialize(&client_nonce, 2),
422+
&serialize(&server_nonce, 2),
423+
&serialize(&client_s_pk.to_arr(), 2),
424+
&serialize(&server_s_pk.to_arr(), 2),
394425
]
395426
.concat();
396427

397-
const OUTPUT_SIZE: usize = 32;
398-
let mut okm = [0u8; 3 * OUTPUT_SIZE];
399-
let h = Hkdf::<D>::new(None, &ikm);
400-
h.expand(&info, &mut okm)
401-
.map_err(|_| InternalPakeError::HkdfError)?;
428+
let extracted_ikm = Hkdf::<D>::new(None, &ikm);
429+
let handshake_secret = derive_secrets::<D>(&extracted_ikm, &STR_HANDSHAKE_SECRET, &info)?;
430+
let session_secret = derive_secrets::<D>(&extracted_ikm, &STR_SESSION_SECRET, &info)?;
431+
let km2 = hkdf_expand_label::<D>(
432+
&handshake_secret,
433+
&STR_SERVER_MAC,
434+
b"",
435+
<D as Digest>::OutputSize::to_usize(),
436+
)?;
437+
let km3 = hkdf_expand_label::<D>(
438+
&handshake_secret,
439+
&STR_CLIENT_MAC,
440+
b"",
441+
<D as Digest>::OutputSize::to_usize(),
442+
)?;
443+
402444
Ok((
403-
GenericArray::clone_from_slice(&okm[..OUTPUT_SIZE]),
404-
GenericArray::clone_from_slice(&okm[OUTPUT_SIZE..2 * OUTPUT_SIZE]),
405-
GenericArray::clone_from_slice(&okm[2 * OUTPUT_SIZE..]),
445+
GenericArray::clone_from_slice(&session_secret),
446+
GenericArray::clone_from_slice(&km2),
447+
GenericArray::clone_from_slice(&km3),
406448
))
407449
}
408450

409-
/// The third key exchange message
410-
pub struct KE3Message<HashLen: ArrayLength<u8>> {
411-
mac: GenericArray<u8, HashLen>,
451+
fn hkdf_expand_label<D: Hash>(
452+
secret: &[u8],
453+
label: &[u8],
454+
context: &[u8],
455+
length: usize,
456+
) -> Result<Vec<u8>, ProtocolError> {
457+
let h = Hkdf::<D>::new(None, secret);
458+
hkdf_expand_label_extracted(&h, label, context, length)
412459
}
413460

414-
impl<HashLen: ArrayLength<u8>> ToBytes for KE3Message<HashLen> {
415-
fn to_bytes(&self) -> Vec<u8> {
416-
self.mac.to_vec()
417-
}
418-
}
461+
fn hkdf_expand_label_extracted<D: Hash>(
462+
hkdf: &Hkdf<D>,
463+
label: &[u8],
464+
context: &[u8],
465+
length: usize,
466+
) -> Result<Vec<u8>, ProtocolError> {
467+
let mut okm = vec![0u8; length];
419468

420-
impl<HashLen: ArrayLength<u8>> TryFrom<&[u8]> for KE3Message<HashLen> {
421-
type Error = InternalPakeError;
469+
let mut hkdf_label: Vec<u8> = Vec::new();
470+
hkdf_label.extend_from_slice(&length.to_be_bytes()[6..]);
422471

423-
fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
424-
let checked_bytes = check_slice_size(bytes, KEY_LEN, "ke3_message")?;
472+
let mut opaque_label: Vec<u8> = Vec::new();
473+
opaque_label.extend_from_slice(&STR_OPAQUE);
474+
opaque_label.extend_from_slice(&label);
475+
hkdf_label.extend_from_slice(&serialize(&opaque_label, 1));
425476

426-
Ok(Self {
427-
mac: GenericArray::clone_from_slice(&checked_bytes),
428-
})
429-
}
477+
hkdf_label.extend_from_slice(&serialize(&context, 1));
478+
479+
hkdf.expand(&hkdf_label, &mut okm)
480+
.map_err(|_| InternalPakeError::HkdfError)?;
481+
Ok(okm)
482+
}
483+
484+
fn derive_secrets<D: Hash>(
485+
hkdf: &Hkdf<D>,
486+
label: &[u8],
487+
transcript: &[u8],
488+
) -> Result<Vec<u8>, ProtocolError> {
489+
let hashed_transcript = D::digest(transcript);
490+
hkdf_expand_label_extracted::<D>(
491+
hkdf,
492+
label,
493+
&hashed_transcript,
494+
<D as Digest>::OutputSize::to_usize(),
495+
)
430496
}

‎src/tests/opaque_ke_test.rs

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -64,35 +64,35 @@ pub struct TestVectorParameters {
6464

6565
static TEST_VECTOR: &str = r#"
6666
{
67-
"client_s_pk": "6c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d",
68-
"client_s_sk": "98f628dfaed00892809f1ff24f44eddb933ca593eeb88c532827249c3fdae56d",
69-
"client_e_pk": "b20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903",
70-
"client_e_sk": "88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a79",
71-
"server_s_pk": "511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca1349",
72-
"server_s_sk": "e00d089a96b19c74f77dcc6079277ba18b2dd1f603d0bc5c46664d4fe5c2867a",
73-
"server_e_pk": "98e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd643674",
74-
"server_e_sk": "080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b278",
67+
"client_s_pk": "8ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b",
68+
"client_s_sk": "e0937ce386f57ba61303f56851c6c1c338535ef30a046090c211fbae2b925575",
69+
"client_e_pk": "b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46",
70+
"client_e_sk": "481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450",
71+
"server_s_pk": "da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d",
72+
"server_s_sk": "50cc8c336756b9c91badaa42df728c0a06033eca4770a7912f9f2924742f4356",
73+
"server_e_pk": "1848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349",
74+
"server_e_sk": "b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f77973",
7575
"password": "70617373776f7264",
76-
"blinding_factor_raw": "3def40a264b30c15dfcafc8d52cbe309d2d08e015d516b515f17cf98443bb39d6d164e9bd391303d890697b38dc59ee7e9ec196682528a078d51983ab18c227b",
77-
"blinding_factor": "d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a",
76+
"blinding_factor_raw": "6e5823f7d820cf6996a2cac80e239f58a9d7e8fcbf9588c07dde69dff3c330785bb85a9b1269f079bbcf4b1f428fbc3a977c324120867b9e918c97dad44576f2",
77+
"blinding_factor": "033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07",
7878
"pepper": "706570706572",
79-
"oprf_key": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405",
80-
"envelope_nonce": "3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da",
81-
"client_nonce": "47b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f",
82-
"server_nonce": "1bf2cc47738524a83c995122a44c7832be18b48b606897d71fc942e8ec6d9b2e",
83-
"r1": "01000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb0",
84-
"r2": "0200002800208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b57000001010103",
85-
"r3": "030000ae3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba300206c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d",
86-
"l1": "04000024000000204df6277df3ee67e084af0d24e27a6567b75589dc887d5acbe5e5830dc8dc7eb047b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79fb20d78da45e7d91fb9185be968ba20c680bfb735e5dbdec36c2aefdb261d6903",
87-
"l2": "050000ae00208d04d78807ed18542f65707f964d96089a322a8bb06dad269cb7a4bee8c20b573048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3080f051060d51c9f1406e7cf5d9ac3212d8ba3829ca94fdd7c8f43e80fa8b27898e12670ffd22a9a827d74bfa5ac44c9f83cb52b477b1ab201a589a8fd64367476b2f0458ade73668e3aaab6e1cd7d48dacc702b9a49147d8431a18e649f814e",
88-
"l3": "ed9d2f5af8d30d7927458a6d10f309ae6f49792d5e86d12f5e163a980f49c7ff",
89-
"client_registration_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a70617373776f7264",
90-
"client_login_state": "00000000d315d7e6c81d5398c015af3d55ded87f0979dfdb28b6f222ee8699905fd41e0a88f058f4de21fc364603318edce30931a60fe78f7953722e3214203c02d52a7947b20166a022bb319ba9a09d5c328b6e2d6cc5813018f7dd5b53f380f914e79f2e9c4b0c4bc9bdd4fca317dab50240fb32c31f9ec3742ec610a7e5016ad88de570617373776f7264",
91-
"server_registration_state": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d5405",
92-
"server_login_state": "54a3c257ad6e5406be86e9f983bcb25a50dcdaf8c8bd6928f17ea8b001db400c02b16899d3fe648ef86fb914dba9892d09df4a449f6f077e3ad903c01e309d6fd8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee",
93-
"password_file": "75e559c8cc7a81642e61b77651bc61b71d3eb7d8b6cd9ca13d8532cb684d54056c3f4c134a1697cda1d494cef349e99117aaedecb6792c3aeab06fc1da5f463d3048ea382aa7357dbcd480047c884b717c4fea3ca627f2c498001b2a46e015da0023469a6c15d59bc2b9cf07e4e37138292e58070a34eb76f8cb5e3015c542b8e96346482f0023030020511b18e0a82493d9b0d7988f5a7e2d05fe6886cb26e9813d476e3fe6d3ca13490020b3fc2eb3ffc0ddfa3b9d94a33874d297263cb768077f128e7ec798b03c5c7ba3",
94-
"export_key": "90f9b6ec1edd53a60a9be4f744950befecf5bbfbd973702082fa031aa192bb5a",
95-
"shared_secret": "d8e21fc482f3d3a396b8c1f5587e00806c860e5a2b82f0da989333ce870ee1ee"
79+
"oprf_key": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300",
80+
"envelope_nonce": "b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f20",
81+
"client_nonce": "e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900",
82+
"server_nonce": "b32c16a32fe0cbb926a4926ff29bcfae2a96fe6e92b45f5ca27de3b6e413d413",
83+
"r1": "01000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691e",
84+
"r2": "020000280020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382000001010103",
85+
"r3": "030000aeb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe44000208ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063b",
86+
"l1": "04000024000000200e0a8b356d7c81a331dddd6987a888943892863b23e14202895eb27b69da691ee29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e1900b2c126715667420809d14b6056d9492051dc31c77cbb39cd61e9d76736118e46",
87+
"l2": "050000ae0020d63f9afe21e3246534cbfbd230b4497255e0a7bb68c3ad6e2dd9b3f4283c8382b25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440b8d7358f35d79cfa5e288e8ca8356bc806d4463710144767caf65eb9b4f779731848442db55ef8301a28b078317be3c40590fc40b3a356f704ced8c552f59349732f8a81df2e21f59afd20155576e6191439e4fc4212b78a74a1198cfca92184",
88+
"l3": "512fa64c0540a5fa5d8ee82910fc91bfff98d6272b9070e37e79832e55916ce5",
89+
"client_registration_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a0770617373776f7264",
90+
"client_login_state": "00000000033a794ce47e3fb19206b8e1f2d74e54c874efcf5b5055d2a31d2164efd41a07481a41606adc0d8aa358cee44e36e5cb02f80d445e42551a90f15e1be59bf450e29650629c1463124cb2283068557ba10d35637876b131040b4f8702276e190062259ed12ff91ba92d2cb43c7433e73e79c4d6d1536ae77cc9ca808bdffc190b70617373776f7264",
91+
"server_registration_state": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d36300",
92+
"server_login_state": "7a78a3ce25b39e78d65c9e648f13f6dbe08b3f91b0ef16565b780d42ca61c6d51a66199867f777c671a8e5fa6e8faf1e1047a26f64adea97b16b7a831204d4bdbc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589",
93+
"password_file": "fd76f0e1cfa9f971bc5dada4caa87dcba1d69d7ace0064d56107ca1932d363008ede26558ada44c55f44a39b3e4811bb71533b52c8331799349f5bf579b0063bb25a32f7d33a1225675a8ea65dd4ca0b1a09845ce1f917f66ccc62a695c79f200023b73a7e011120604ac7d44a5ae7f65102ee79a4f6cc4b544d64b5dc064318cfb35230a70023030020da106c3619e8c17c2356f4827b33f6f869ab6f99badc8002324925458fecbd0d002016ba53f6b3b80db59717025c3a9246d5256bef434ce5f7d2c53b961cb5afe440",
94+
"export_key": "57da80dc58057781bf65a4f4b1ea0d77d7eb69fbb2786e26dfdfa0c440ea3611",
95+
"shared_secret": "bc293cebd5bc7f82054b142b10617ee8f2e30f2e39fbcacb3566167fc2021589"
9696
}
9797
"#;
9898

0 commit comments

Comments
 (0)