absolutebi/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2025-12-09 04:39:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Ciphersuite::hash_to_F

Browse Source 
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.

Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.

The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.

`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
This commit is contained in:
Luke Parker
2025-08-29 05:04:03 -04:00
parent a4811c9a41
commit 90bc364f9f
37 changed files with 355 additions and 416 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
crypto/embedwards25519/src/lib.rs
View File

@@ -10,7 +10,7 @@ use std_shims::io::{self, Read};
use prime_field::{subtle::Choice, zeroize::Zeroize};
use ciphersuite::group::{
ff::{Field, PrimeField, FromUniformBytes},
ff::{Field, PrimeField},
Group,
};
@@ -53,7 +53,7 @@ impl ShortWeierstrass for Embedwards25519 {
fn encode_compressed(x: Self::FieldElement, odd_y: Choice) -> Self::Repr {
// The LE `x` coordinate, with if `y` is odd in the unused 256th bit
let mut res = [0; 32];
res.as_mut().copy_from_slice(x.to_repr().as_ref());
res.copy_from_slice(x.to_repr().as_ref());
res[31] |= odd_y.unwrap_u8() << 7;
res
}
@@ -65,7 +65,10 @@ impl ShortWeierstrass for Embedwards25519 {
// Copy from the point's representation to the field's
let mut repr = <Self::FieldElement as PrimeField>::Repr::default();
repr.as_mut().copy_from_slice(&bytes);
{
let repr: &mut [u8] = repr.as_mut();
repr.copy_from_slice(&bytes);
}
(repr, odd_y)
}
@@ -88,18 +91,6 @@ impl ciphersuite::Ciphersuite for Embedwards25519 {
Point::generator()
}
/// `hash_to_F` is implemented with a naive concatenation of the `dst` and `data`, allowing
/// transposition between the two. This means `dst: b"abc", data: b"def"`, will produce the same
/// scalar as `dst: "abcdef", data: b""`. Please use carefully, not letting `dst` valuess be
/// substrings of each other.
fn hash_to_F(dst: &[u8], data: &[u8]) -> Self::F {
use blake2::Digest;
let mut digest = Self::H::new();
digest.update(dst);
digest.update(data);
<Scalar as FromUniformBytes<64>>::from_uniform_bytes(&digest.finalize().into())
}
// We override the provided impl, which compares against the reserialization, because
// we already require canonicity
#[cfg(feature = "alloc")]