Rewrite the cross-group DLEq API to not allow proving for biased scalars

crypto/dleq/src/tests/cross_group/mod.rs

@@ -2,23 +2,26 @@ mod scalar;
 mod schnorr;
 
 use hex_literal::hex;
-use rand_core::OsRng;
+use rand_core::{RngCore, OsRng};
 
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::{Group, GroupEncoding};
 
 use k256::{Scalar, ProjectivePoint};
-use dalek_ff_group::{EdwardsPoint, CompressedEdwardsY};
+use dalek_ff_group::{self as dfg, EdwardsPoint, CompressedEdwardsY};
+
+use blake2::{Digest, Blake2b512};
 
 use transcript::RecommendedTranscript;
 
 use crate::{Generators, cross_group::DLEqProof};
 
-#[test]
-fn test_dleq() {
-  let transcript = || RecommendedTranscript::new(b"Cross-Group DLEq Proof Test");
+fn transcript() -> RecommendedTranscript {
+  RecommendedTranscript::new(b"Cross-Group DLEq Proof Test")
+}
 
-  let generators = (
+fn generators() -> (Generators<ProjectivePoint>, Generators<EdwardsPoint>) {
+  (
     Generators::new(
       ProjectivePoint::GENERATOR,
       ProjectivePoint::from_bytes(
@@ -32,23 +35,72 @@ fn test_dleq() {
         hex!("8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94")
       ).decompress().unwrap()
     )
+  )
+}
+
+#[test]
+fn test_rejection_sampling() {
+  let mut pow_2 = Scalar::one();
+  for _ in 0 .. dfg::Scalar::CAPACITY {
+    pow_2 = pow_2.double();
+  }
+
+  assert!(
+    DLEqProof::prove_without_bias(
+      &mut OsRng,
+      &mut RecommendedTranscript::new(b""),
+      generators(),
+      pow_2
+    ).is_none()
   );
+}
 
-  let key = Scalar::random(&mut OsRng);
-  let (proof, keys) = DLEqProof::prove(&mut OsRng, &mut transcript(), generators, key);
+#[test]
+fn test_dleq() {
+  let generators = generators();
 
-  let public_keys = proof.verify(&mut transcript(), generators).unwrap();
-  assert_eq!(generators.0.primary * keys.0, public_keys.0);
-  assert_eq!(generators.1.primary * keys.1, public_keys.1);
+  for i in 0 .. 2 {
+    let (proof, keys) = if i == 0 {
+      let mut seed = [0; 32];
+      OsRng.fill_bytes(&mut seed);
 
-  #[cfg(feature = "serialize")]
-  {
-    let mut buf = vec![];
-    proof.serialize(&mut buf).unwrap();
-    let deserialized = DLEqProof::<ProjectivePoint, EdwardsPoint>::deserialize(
-      &mut std::io::Cursor::new(&buf)
-    ).unwrap();
-    assert_eq!(proof, deserialized);
-    deserialized.verify(&mut transcript(), generators).unwrap();
+      DLEqProof::prove(
+        &mut OsRng,
+        &mut transcript(),
+        generators,
+        Blake2b512::new().chain_update(seed)
+      )
+    } else {
+      let mut key;
+      let mut res;
+      while {
+        key = Scalar::random(&mut OsRng);
+        res = DLEqProof::prove_without_bias(
+          &mut OsRng,
+          &mut transcript(),
+          generators,
+          key
+        );
+        res.is_none()
+      } {}
+      let res = res.unwrap();
+      assert_eq!(key, res.1.0);
+      res
+    };
+
+    let public_keys = proof.verify(&mut transcript(), generators).unwrap();
+    assert_eq!(generators.0.primary * keys.0, public_keys.0);
+    assert_eq!(generators.1.primary * keys.1, public_keys.1);
+
+    #[cfg(feature = "serialize")]
+    {
+      let mut buf = vec![];
+      proof.serialize(&mut buf).unwrap();
+      let deserialized = DLEqProof::<ProjectivePoint, EdwardsPoint>::deserialize(
+        &mut std::io::Cursor::new(&buf)
+      ).unwrap();
+      assert_eq!(proof, deserialized);
+      deserialized.verify(&mut transcript(), generators).unwrap();
+    }
   }
 }