2025-08-20 04:50:37 -04:00
|
|
|
#![cfg_attr(docsrs, feature(doc_auto_cfg))]
|
|
|
|
|
#![cfg_attr(not(feature = "std"), no_std)]
|
|
|
|
|
|
2022-10-29 03:54:42 -05:00
|
|
|
use zeroize::Zeroize;
|
|
|
|
|
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
use sha2::Sha512;
|
2022-10-29 03:54:42 -05:00
|
|
|
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
use ciphersuite::Ciphersuite;
|
2022-10-29 03:54:42 -05:00
|
|
|
|
2025-08-25 09:17:29 -04:00
|
|
|
pub use k256;
|
|
|
|
|
pub use p256;
|
|
|
|
|
|
2022-10-29 03:54:42 -05:00
|
|
|
macro_rules! kp_curve {
|
|
|
|
|
(
|
|
|
|
|
$feature: literal,
|
|
|
|
|
$lib: ident,
|
|
|
|
|
|
|
|
|
|
$Ciphersuite: ident,
|
|
|
|
|
$ID: literal
|
|
|
|
|
) => {
|
|
|
|
|
impl Ciphersuite for $Ciphersuite {
|
|
|
|
|
type F = $lib::Scalar;
|
|
|
|
|
type G = $lib::ProjectivePoint;
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
type H = Sha512;
|
2022-10-29 03:54:42 -05:00
|
|
|
|
|
|
|
|
const ID: &'static [u8] = $ID;
|
|
|
|
|
|
|
|
|
|
fn generator() -> Self::G {
|
|
|
|
|
$lib::ProjectivePoint::GENERATOR
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
2023-02-23 01:03:53 -05:00
|
|
|
/// Ciphersuite for Secp256k1.
|
|
|
|
|
#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
|
|
|
|
|
pub struct Secp256k1;
|
2022-12-25 02:50:10 -05:00
|
|
|
kp_curve!("secp256k1", k256, Secp256k1, b"secp256k1");
|
|
|
|
|
#[test]
|
|
|
|
|
fn test_secp256k1() {
|
2023-02-24 06:03:56 -05:00
|
|
|
ff_group_tests::group::test_prime_group_bits::<_, k256::ProjectivePoint>(&mut rand_core::OsRng);
|
2022-12-25 02:50:10 -05:00
|
|
|
}
|
|
|
|
|
|
2023-02-23 01:03:53 -05:00
|
|
|
/// Ciphersuite for P-256.
|
|
|
|
|
#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
|
|
|
|
|
pub struct P256;
|
2022-10-29 03:54:42 -05:00
|
|
|
kp_curve!("p256", p256, P256, b"P-256");
|
2022-12-24 17:08:22 -05:00
|
|
|
#[test]
|
|
|
|
|
fn test_p256() {
|
2023-02-24 06:03:56 -05:00
|
|
|
ff_group_tests::group::test_prime_group_bits::<_, p256::ProjectivePoint>(&mut rand_core::OsRng);
|
2022-12-24 17:08:22 -05:00
|
|
|
}
|