Skip to content

Commit c8cbf56

Browse files
kevinlewihuitseeker
kevinlewi
authored and
huitseeker
committed
Conform to voprf spec (facebook#71)
1 parent 28645a7 commit c8cbf56

File tree

6 files changed

+239
-238
lines changed

6 files changed

+239
-238
lines changed

‎benches/oprf.rs

Lines changed: 19 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ use curve25519_dalek::{edwards::EdwardsPoint, ristretto::RistrettoPoint};
1111
use generic_array::arr;
1212
use opaque_ke::{
1313
group::Group,
14-
oprf::{generate_oprf1_shim, generate_oprf2_shim, generate_oprf3_shim, OprfClientBytes},
14+
oprf::{blind_shim, evaluate_shim, unblind_and_finalize_shim},
1515
};
1616
use rand::{prelude::ThreadRng, thread_rng};
1717
use sha2::Sha256;
@@ -20,12 +20,9 @@ fn oprf1(c: &mut Criterion) {
2020
let mut csprng: ThreadRng = thread_rng();
2121
let input = b"hunter2";
2222

23-
c.bench_function("generate_oprf1 with Ristretto", move |b| {
23+
c.bench_function("blind with Ristretto", move |b| {
2424
b.iter(|| {
25-
let OprfClientBytes {
26-
alpha: _alpha,
27-
blinding_factor: _blinding_factor,
28-
} = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
25+
blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap();
2926
})
3027
});
3128
}
@@ -34,12 +31,9 @@ fn oprf1_edwards(c: &mut Criterion) {
3431
let mut csprng: ThreadRng = thread_rng();
3532
let input = b"hunter2";
3633

37-
c.bench_function("generate_oprf1 with Edwards", move |b| {
34+
c.bench_function("blind with Edwards", move |b| {
3835
b.iter(|| {
39-
let OprfClientBytes {
40-
alpha: _alpha,
41-
blinding_factor: _blinding_factor,
42-
} = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
36+
blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap();
4337
})
4438
});
4539
}
@@ -48,19 +42,16 @@ fn oprf2(c: &mut Criterion) {
4842
let mut csprng: ThreadRng = thread_rng();
4943
let input = b"hunter2";
5044

51-
let OprfClientBytes {
52-
alpha,
53-
blinding_factor: _blinding_factor,
54-
} = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
45+
let (_, alpha) = blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap();
5546
let salt_bytes = arr![
5647
u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
5748
24, 25, 26, 27, 28, 29, 30, 31, 32,
5849
];
5950
let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
6051

61-
c.bench_function("generate_oprf2 with Ristretto", move |b| {
52+
c.bench_function("evaluate with Ristretto", move |b| {
6253
b.iter(|| {
63-
let _beta = generate_oprf2_shim::<RistrettoPoint>(alpha, &salt).unwrap();
54+
let _beta = evaluate_shim::<RistrettoPoint>(alpha, &salt).unwrap();
6455
})
6556
});
6657
}
@@ -69,19 +60,16 @@ fn oprf2_edwards(c: &mut Criterion) {
6960
let mut csprng: ThreadRng = thread_rng();
7061
let input = b"hunter2";
7162

72-
let OprfClientBytes {
73-
alpha,
74-
blinding_factor: _blinding_factor,
75-
} = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
63+
let (_, alpha) = blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap();
7664
let salt_bytes = arr![
7765
u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
7866
24, 25, 26, 27, 28, 29, 30, 31, 32,
7967
];
8068
let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
8169

82-
c.bench_function("generate_oprf2 with Edwards", move |b| {
70+
c.bench_function("evaluate with Edwards", move |b| {
8371
b.iter(|| {
84-
let _beta = generate_oprf2_shim::<EdwardsPoint>(alpha, &salt).unwrap();
72+
let _beta = evaluate_shim::<EdwardsPoint>(alpha, &salt).unwrap();
8573
})
8674
});
8775
}
@@ -90,21 +78,17 @@ fn oprf3(c: &mut Criterion) {
9078
let mut csprng: ThreadRng = thread_rng();
9179
let input = b"hunter2";
9280

93-
let OprfClientBytes {
94-
alpha,
95-
blinding_factor,
96-
} = generate_oprf1_shim::<_, RistrettoPoint>(&input[..], None, &mut csprng).unwrap();
81+
let (token, alpha) = blind_shim::<_, RistrettoPoint>(&input[..], &mut csprng).unwrap();
9782
let salt_bytes = arr![
9883
u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
9984
24, 25, 26, 27, 28, 29, 30, 31, 32,
10085
];
10186
let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
102-
let beta = generate_oprf2_shim::<RistrettoPoint>(alpha, &salt).unwrap();
87+
let beta = evaluate_shim::<RistrettoPoint>(alpha, &salt).unwrap();
10388

104-
c.bench_function("generate_oprf3 with Ristretto", move |b| {
89+
c.bench_function("unblind_and_finalize with Ristretto", move |b| {
10590
b.iter(|| {
106-
let _res = generate_oprf3_shim::<RistrettoPoint, Sha256>(input, beta, &blinding_factor)
107-
.unwrap();
91+
let _res = unblind_and_finalize_shim::<RistrettoPoint, Sha256>(&token, beta).unwrap();
10892
})
10993
});
11094
}
@@ -113,21 +97,17 @@ fn oprf3_edwards(c: &mut Criterion) {
11397
let mut csprng: ThreadRng = thread_rng();
11498
let input = b"hunter2";
11599

116-
let OprfClientBytes {
117-
alpha,
118-
blinding_factor,
119-
} = generate_oprf1_shim::<_, EdwardsPoint>(&input[..], None, &mut csprng).unwrap();
100+
let (token, alpha) = blind_shim::<_, EdwardsPoint>(&input[..], &mut csprng).unwrap();
120101
let salt_bytes = arr![
121102
u8; 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
122103
24, 25, 26, 27, 28, 29, 30, 31, 32,
123104
];
124105
let salt = RistrettoPoint::from_scalar_slice(&salt_bytes).unwrap();
125-
let beta = generate_oprf2_shim::<EdwardsPoint>(alpha, &salt).unwrap();
106+
let beta = evaluate_shim::<EdwardsPoint>(alpha, &salt).unwrap();
126107

127-
c.bench_function("generate_oprf3 with Edwards", move |b| {
108+
c.bench_function("unblind_and_finalize with Edwards", move |b| {
128109
b.iter(|| {
129-
let _res =
130-
generate_oprf3_shim::<EdwardsPoint, Sha256>(input, beta, &blinding_factor).unwrap();
110+
let _res = unblind_and_finalize_shim::<EdwardsPoint, Sha256>(&token, beta).unwrap();
131111
})
132112
});
133113
}

‎src/lib.rs

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@
8989
//! let mut client_rng = OsRng;
9090
//! let (r1, client_state) = ClientRegistration::<Default>::start(
9191
//! b"password",
92-
//! Some(b"pepper"),
9392
//! &mut client_rng,
9493
//! )?;
9594
//! # Ok::<(), ProtocolError>(())
@@ -119,7 +118,6 @@
119118
//! # let mut client_rng = OsRng;
120119
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
121120
//! # b"password",
122-
//! # Some(b"pepper"),
123121
//! # &mut client_rng,
124122
//! # )?;
125123
//! use opaque_ke::opaque::ServerRegistration;
@@ -153,7 +151,6 @@
153151
//! # let mut client_rng = OsRng;
154152
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
155153
//! # b"password",
156-
//! # Some(b"pepper"),
157154
//! # &mut client_rng,
158155
//! # )?;
159156
//! # let mut server_rng = OsRng;
@@ -188,7 +185,6 @@
188185
//! # let mut client_rng = OsRng;
189186
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
190187
//! # b"password",
191-
//! # Some(b"pepper"),
192188
//! # &mut client_rng,
193189
//! # )?;
194190
//! # let mut server_rng = OsRng;
@@ -232,7 +228,6 @@
232228
//! let mut client_rng = OsRng;
233229
//! let (l1, client_state) = ClientLogin::<Default>::start(
234230
//! b"password",
235-
//! Some(b"pepper"),
236231
//! &mut client_rng,
237232
//! )?;
238233
//! # Ok::<(), ProtocolError>(())
@@ -262,7 +257,6 @@
262257
//! # let mut client_rng = OsRng;
263258
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
264259
//! # b"password",
265-
//! # Some(b"pepper"),
266260
//! # &mut client_rng,
267261
//! # )?;
268262
//! # let mut server_rng = OsRng;
@@ -272,7 +266,6 @@
272266
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
273267
//! # let (l1, client_state) = ClientLogin::<Default>::start(
274268
//! # b"password",
275-
//! # Some(b"pepper"),
276269
//! # &mut client_rng,
277270
//! # )?;
278271
//! use opaque_ke::opaque::ServerLogin;
@@ -308,7 +301,6 @@
308301
//! # let mut client_rng = OsRng;
309302
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
310303
//! # b"password",
311-
//! # Some(b"pepper"),
312304
//! # &mut client_rng,
313305
//! # )?;
314306
//! # let mut server_rng = OsRng;
@@ -318,7 +310,6 @@
318310
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
319311
//! # let (l1, client_state) = ClientLogin::<Default>::start(
320312
//! # b"password",
321-
//! # Some(b"pepper"),
322313
//! # &mut client_rng,
323314
//! # )?;
324315
//! # use std::convert::TryFrom;
@@ -365,7 +356,6 @@
365356
//! # let mut client_rng = OsRng;
366357
//! # let (r1, client_state) = ClientRegistration::<Default>::start(
367358
//! # b"password",
368-
//! # Some(b"pepper"),
369359
//! # &mut client_rng,
370360
//! # )?;
371361
//! # let mut server_rng = OsRng;
@@ -375,7 +365,6 @@
375365
//! # let password_file_bytes = server_state.finish(r3)?.to_bytes();
376366
//! # let (l1, client_state) = ClientLogin::<Default>::start(
377367
//! # b"password",
378-
//! # Some(b"pepper"),
379368
//! # &mut client_rng,
380369
//! # )?;
381370
//! # use std::convert::TryFrom;

‎src/map_to_curve.rs

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,22 @@ use sha2::{Sha256, Sha512};
1515
/// A subtrait of Group specifying how to hash a password into a point
1616
pub trait GroupWithMapToCurve: Group {
1717
/// transforms a password and optional pepper into a curve point
18-
fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self;
18+
fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self;
1919
}
2020

21+
// TODO: incorporate expand_message_xmd from https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-10.txt
22+
// instead of using HKDF-extract here
23+
2124
impl GroupWithMapToCurve for RistrettoPoint {
22-
fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self {
23-
let (hashed_input, _) = Hkdf::<Sha512>::extract(pepper, password);
25+
fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self {
26+
let (hashed_input, _) = Hkdf::<Sha512>::extract(dst, password);
2427
<Self as Group>::hash_to_curve(&hashed_input)
2528
}
2629
}
2730

2831
impl GroupWithMapToCurve for EdwardsPoint {
29-
fn map_to_curve(password: &[u8], pepper: Option<&[u8]>) -> Self {
30-
let (hashed_input, _) = Hkdf::<Sha256>::extract(pepper, password);
32+
fn map_to_curve(password: &[u8], dst: Option<&[u8]>) -> Self {
33+
let (hashed_input, _) = Hkdf::<Sha256>::extract(dst, password);
3134
<Self as Group>::hash_to_curve(&hashed_input)
3235
}
3336
}

0 commit comments

Comments
 (0)