mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-08 12:19:24 +00:00
90bc364f9f
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a DST, yet were not require to securely handle it. It was also biased towards the requirements of `modular-frost` as `ciphersuite` was originally written all those years ago, when `modular-frost` had needs exceeding what `ff`, `group` satisfied. Now, the hash is bound to produce an output which can be converted to a scalar with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument of the value to hash (removing the potential to insecurely handle the DST by removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet `FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines a `FromUniformBytes` trait taking an array (then implemented for all satisfiers of `ff::FromUniformBytes`). In order to get the array type from the `GenericArray`, the output of the hash, `digest` is updated to the `0.11` release candidate which moves to `flexible-array` which solves that problem. The existing, specific `hash_to_F` functions have been moved to `modular-frost` as necessary. `flexible-array` itself is patched to a fork due to https://github.com/RustCrypto/hybrid-array/issues/131.
46 lines
1.4 KiB
Rust
46 lines
1.4 KiB
Rust
pub use ciphersuite::{digest::Digest, group::GroupEncoding, FromUniformBytes, Ciphersuite};
|
|
use minimal_ed448::{Scalar, Point};
|
|
pub use minimal_ed448::Ed448;
|
|
|
|
use crate::{curve::Curve, algorithm::Hram};
|
|
|
|
const CONTEXT: &[u8] = b"FROST-ED448-SHAKE256-v1";
|
|
|
|
impl Curve for Ed448 {
|
|
const CONTEXT: &'static [u8] = CONTEXT;
|
|
fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
|
|
let mut digest = <Self as Ciphersuite>::H::new();
|
|
digest.update(Self::CONTEXT);
|
|
digest.update(dst);
|
|
digest.update(msg);
|
|
Self::F::from_uniform_bytes(&digest.finalize().into())
|
|
}
|
|
}
|
|
|
|
// The RFC-8032 Ed448 challenge function.
|
|
#[derive(Copy, Clone)]
|
|
pub(crate) struct Ietf8032Ed448Hram;
|
|
impl Ietf8032Ed448Hram {
|
|
#[allow(non_snake_case)]
|
|
pub(crate) fn hram(context: &[u8], R: &Point, A: &Point, m: &[u8]) -> Scalar {
|
|
let mut digest = <Ed448 as Ciphersuite>::H::new();
|
|
digest.update(b"SigEd448");
|
|
digest.update([0, u8::try_from(context.len()).unwrap()]);
|
|
digest.update(context);
|
|
digest.update(R.to_bytes());
|
|
digest.update(A.to_bytes());
|
|
digest.update(m);
|
|
Scalar::from_uniform_bytes(&digest.finalize().into())
|
|
}
|
|
}
|
|
|
|
/// The challenge function for FROST's Ed448 ciphersuite.
|
|
#[derive(Copy, Clone)]
|
|
pub struct IetfEd448Hram;
|
|
impl Hram<Ed448> for IetfEd448Hram {
|
|
#[allow(non_snake_case)]
|
|
fn hram(R: &Point, A: &Point, m: &[u8]) -> Scalar {
|
|
Ietf8032Ed448Hram::hram(&[], R, A, m)
|
|
}
|
|
}
|