From 2ba30c1a9fc65f9ad51df7ae4ee731a723781b61 Mon Sep 17 00:00:00 2001 From: daxpedda Date: Tue, 8 Jul 2025 19:12:49 +0200 Subject: [PATCH] Remove `hash2curve` and `oprf` --- .github/workflows/elliptic-curve.yml | 4 +- elliptic-curve/Cargo.toml | 4 +- elliptic-curve/src/hash2curve.rs | 15 - elliptic-curve/src/hash2curve/group_digest.rs | 98 ---- elliptic-curve/src/hash2curve/hash2field.rs | 58 --- .../src/hash2curve/hash2field/expand_msg.rs | 155 ------ .../hash2curve/hash2field/expand_msg/xmd.rs | 452 ------------------ .../hash2curve/hash2field/expand_msg/xof.rs | 376 --------------- elliptic-curve/src/hash2curve/isogeny.rs | 58 --- elliptic-curve/src/hash2curve/map2curve.rs | 33 -- elliptic-curve/src/hash2curve/osswu.rs | 131 ----- elliptic-curve/src/lib.rs | 8 - elliptic-curve/src/oprf.rs | 30 -- 13 files changed, 2 insertions(+), 1420 deletions(-) delete mode 100644 elliptic-curve/src/hash2curve.rs delete mode 100644 elliptic-curve/src/hash2curve/group_digest.rs delete mode 100644 elliptic-curve/src/hash2curve/hash2field.rs delete mode 100644 elliptic-curve/src/hash2curve/hash2field/expand_msg.rs delete mode 100644 elliptic-curve/src/hash2curve/hash2field/expand_msg/xmd.rs delete mode 100644 elliptic-curve/src/hash2curve/hash2field/expand_msg/xof.rs delete mode 100644 elliptic-curve/src/hash2curve/isogeny.rs delete mode 100644 elliptic-curve/src/hash2curve/map2curve.rs delete mode 100644 elliptic-curve/src/hash2curve/osswu.rs delete mode 100644 elliptic-curve/src/oprf.rs diff --git a/.github/workflows/elliptic-curve.yml b/.github/workflows/elliptic-curve.yml index 8ab5154ce..43343005d 100644 --- a/.github/workflows/elliptic-curve.yml +++ b/.github/workflows/elliptic-curve.yml @@ -43,9 +43,7 @@ jobs: - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features dev - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features digest - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features ecdh - - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features hash2curve - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features jwk - - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features oprf - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features pem - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features pkcs8 - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features sec1 @@ -54,7 +52,7 @@ jobs: - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features alloc,arithmetic,pkcs8 - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features alloc,serde - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features arithmetic,serde - - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features alloc,digest,ecdh,hash2curve,jwk,oprf,pem,pkcs8,sec1,serde + - run: cargo build --target ${{ matrix.target }} --release --no-default-features --features alloc,digest,ecdh,jwk,pem,pkcs8,sec1,serde minimal-versions: # Temporarily disabled until elliptic-curve 0.13.0-pre.0 is published diff --git a/elliptic-curve/Cargo.toml b/elliptic-curve/Cargo.toml index 66d77a514..d24885b87 100644 --- a/elliptic-curve/Cargo.toml +++ b/elliptic-curve/Cargo.toml @@ -64,12 +64,10 @@ bits = ["arithmetic", "ff/bits"] dev = ["arithmetic", "dep:hex-literal", "pem", "pkcs8"] ecdh = ["arithmetic", "digest", "dep:hkdf"] group = ["dep:group", "ff"] -hash2curve = ["arithmetic", "digest"] jwk = ["dep:base64ct", "dep:serde_json", "alloc", "serde", "zeroize/alloc"] -oprf = ["digest", "hash2curve"] pkcs8 = ["dep:pkcs8", "sec1"] pem = ["dep:pem-rfc7468", "alloc", "arithmetic", "pkcs8", "sec1/pem"] serde = ["dep:serdect", "alloc", "pkcs8", "sec1/serde"] [package.metadata.docs.rs] -features = ["bits", "ecdh", "hash2curve", "jwk", "oprf", "pem", "std"] +features = ["bits", "ecdh", "jwk", "pem", "std"] diff --git a/elliptic-curve/src/hash2curve.rs b/elliptic-curve/src/hash2curve.rs deleted file mode 100644 index da923e4d2..000000000 --- a/elliptic-curve/src/hash2curve.rs +++ /dev/null @@ -1,15 +0,0 @@ -//! Traits for hashing byte sequences to curve points. -//! -//! - -mod group_digest; -mod hash2field; -mod isogeny; -mod map2curve; -mod osswu; - -pub use group_digest::*; -pub use hash2field::*; -pub use isogeny::*; -pub use map2curve::*; -pub use osswu::*; diff --git a/elliptic-curve/src/hash2curve/group_digest.rs b/elliptic-curve/src/hash2curve/group_digest.rs deleted file mode 100644 index 052098ce8..000000000 --- a/elliptic-curve/src/hash2curve/group_digest.rs +++ /dev/null @@ -1,98 +0,0 @@ -//! Traits for handling hash to curve. - -use super::{ExpandMsg, MapToCurve, hash_to_field}; -use crate::{ProjectivePoint, Result}; -use hybrid_array::typenum::Unsigned; - -/// Hash arbitrary byte sequences to a valid group element. -pub trait GroupDigest: MapToCurve { - /// The target security level in bytes: - /// - /// - type K: Unsigned; - - /// Computes the hash to curve routine. - /// - /// From : - /// - /// > Uniform encoding from byte strings to points in G. - /// > That is, the distribution of its output is statistically close - /// > to uniform in G. - /// > This function is suitable for most applications requiring a random - /// > oracle returning points in G assuming a cryptographically secure - /// > hash function is used. - /// - /// # Errors - /// - `len_in_bytes > u16::MAX` - /// - See implementors of [`ExpandMsg`] for additional errors: - /// - [`ExpandMsgXmd`] - /// - [`ExpandMsgXof`] - /// - /// `len_in_bytes = ::Length * 2` - /// - /// [`ExpandMsgXmd`]: crate::hash2curve::ExpandMsgXmd - /// [`ExpandMsgXof`]: crate::hash2curve::ExpandMsgXof - fn hash_from_bytes(msg: &[&[u8]], dst: &[&[u8]]) -> Result> - where - X: ExpandMsg, - { - let mut u = [Self::FieldElement::default(), Self::FieldElement::default()]; - hash_to_field::(msg, dst, &mut u)?; - let q0 = Self::map_to_curve(u[0]); - let q1 = Self::map_to_curve(u[1]); - Ok(Self::add_and_map_to_subgroup(q0, q1)) - } - - /// Computes the encode to curve routine. - /// - /// From : - /// - /// > Nonuniform encoding from byte strings to - /// > points in G. That is, the distribution of its output is not - /// > uniformly random in G: the set of possible outputs of - /// > encode_to_curve is only a fraction of the points in G, and some - /// > points in this set are more likely to be output than others. - /// - /// # Errors - /// - `len_in_bytes > u16::MAX` - /// - See implementors of [`ExpandMsg`] for additional errors: - /// - [`ExpandMsgXmd`] - /// - [`ExpandMsgXof`] - /// - /// `len_in_bytes = ::Length` - /// - /// [`ExpandMsgXmd`]: crate::hash2curve::ExpandMsgXmd - /// [`ExpandMsgXof`]: crate::hash2curve::ExpandMsgXof - fn encode_from_bytes(msg: &[&[u8]], dst: &[&[u8]]) -> Result> - where - X: ExpandMsg, - { - let mut u = [Self::FieldElement::default()]; - hash_to_field::(msg, dst, &mut u)?; - let q0 = Self::map_to_curve(u[0]); - Ok(Self::map_to_subgroup(q0)) - } - - /// Computes the hash to field routine according to - /// - /// and returns a scalar. - /// - /// # Errors - /// - `len_in_bytes > u16::MAX` - /// - See implementors of [`ExpandMsg`] for additional errors: - /// - [`ExpandMsgXmd`] - /// - [`ExpandMsgXof`] - /// - /// `len_in_bytes = ::Length` - /// - /// [`ExpandMsgXmd`]: crate::hash2curve::ExpandMsgXmd - /// [`ExpandMsgXof`]: crate::hash2curve::ExpandMsgXof - fn hash_to_scalar(msg: &[&[u8]], dst: &[&[u8]]) -> Result - where - X: ExpandMsg, - { - let mut u = [Self::Scalar::default()]; - hash_to_field::(msg, dst, &mut u)?; - Ok(u[0]) - } -} diff --git a/elliptic-curve/src/hash2curve/hash2field.rs b/elliptic-curve/src/hash2curve/hash2field.rs deleted file mode 100644 index a0db0cbb3..000000000 --- a/elliptic-curve/src/hash2curve/hash2field.rs +++ /dev/null @@ -1,58 +0,0 @@ -//! Traits for hashing to field elements. -//! -//! - -mod expand_msg; - -use core::num::NonZeroU16; - -pub use expand_msg::{xmd::*, xof::*, *}; - -use crate::{Error, Result}; -use hybrid_array::{ - Array, ArraySize, - typenum::{NonZero, Unsigned}, -}; - -/// The trait for helping to convert to a field element. -pub trait FromOkm { - /// The number of bytes needed to convert to a field element. - type Length: ArraySize + NonZero; - - /// Convert a byte sequence into a field element. - fn from_okm(data: &Array) -> Self; -} - -/// Convert an arbitrary byte sequence into a field element. -/// -/// -/// -/// # Errors -/// - `len_in_bytes > u16::MAX` -/// - See implementors of [`ExpandMsg`] for additional errors: -/// - [`ExpandMsgXmd`] -/// - [`ExpandMsgXof`] -/// -/// `len_in_bytes = T::Length * out.len()` -/// -/// [`ExpandMsgXmd`]: crate::hash2field::ExpandMsgXmd -/// [`ExpandMsgXof`]: crate::hash2field::ExpandMsgXof -#[doc(hidden)] -pub fn hash_to_field(data: &[&[u8]], domain: &[&[u8]], out: &mut [T]) -> Result<()> -where - E: ExpandMsg, - T: FromOkm + Default, -{ - let len_in_bytes = T::Length::USIZE - .checked_mul(out.len()) - .and_then(|len| len.try_into().ok()) - .and_then(NonZeroU16::new) - .ok_or(Error)?; - let mut tmp = Array::::Length>::default(); - let mut expander = E::expand_message(data, domain, len_in_bytes)?; - for o in out.iter_mut() { - expander.fill_bytes(&mut tmp); - *o = T::from_okm(&tmp); - } - Ok(()) -} diff --git a/elliptic-curve/src/hash2curve/hash2field/expand_msg.rs b/elliptic-curve/src/hash2curve/hash2field/expand_msg.rs deleted file mode 100644 index c01b70e4a..000000000 --- a/elliptic-curve/src/hash2curve/hash2field/expand_msg.rs +++ /dev/null @@ -1,155 +0,0 @@ -//! `expand_message` interface `for hash_to_field`. - -pub(super) mod xmd; -pub(super) mod xof; - -use core::num::NonZero; - -use crate::{Error, Result}; -use digest::{Digest, ExtendableOutput, Update, XofReader}; -use hybrid_array::{Array, ArraySize}; - -/// Salt when the DST is too long -const OVERSIZE_DST_SALT: &[u8] = b"H2C-OVERSIZE-DST-"; -/// Maximum domain separation tag length -const MAX_DST_LEN: usize = 255; - -/// Trait for types implementing expand_message interface for `hash_to_field`. -/// -/// `K` is the target security level in bytes: -/// -/// -/// -/// # Errors -/// See implementors of [`ExpandMsg`] for errors. -pub trait ExpandMsg { - /// Type holding data for the [`Expander`]. - type Expander<'dst>: Expander + Sized; - - /// Expands `msg` to the required number of bytes. - /// - /// Returns an expander that can be used to call `read` until enough - /// bytes have been consumed - fn expand_message<'dst>( - msg: &[&[u8]], - dst: &'dst [&[u8]], - len_in_bytes: NonZero, - ) -> Result>; -} - -/// Expander that, call `read` until enough bytes have been consumed. -pub trait Expander { - /// Fill the array with the expanded bytes - fn fill_bytes(&mut self, okm: &mut [u8]); -} - -/// The domain separation tag -/// -/// Implements [section 5.3.3 of RFC9380][dst]. -/// -/// [dst]: https://www.rfc-editor.org/rfc/rfc9380.html#name-using-dsts-longer-than-255- -#[derive(Debug)] -pub(crate) enum Domain<'a, L: ArraySize> { - /// > 255 - Hashed(Array), - /// <= 255 - Array(&'a [&'a [u8]]), -} - -impl<'a, L: ArraySize> Domain<'a, L> { - pub fn xof(dst: &'a [&'a [u8]]) -> Result - where - X: Default + ExtendableOutput + Update, - { - // https://www.rfc-editor.org/rfc/rfc9380.html#section-3.1-4.2 - if dst.iter().map(|slice| slice.len()).sum::() == 0 { - Err(Error) - } else if dst.iter().map(|slice| slice.len()).sum::() > MAX_DST_LEN { - if L::USIZE > u8::MAX.into() { - return Err(Error); - } - - let mut data = Array::::default(); - let mut hash = X::default(); - hash.update(OVERSIZE_DST_SALT); - - for slice in dst { - hash.update(slice); - } - - hash.finalize_xof().read(&mut data); - - Ok(Self::Hashed(data)) - } else { - Ok(Self::Array(dst)) - } - } - - pub fn xmd(dst: &'a [&'a [u8]]) -> Result - where - X: Digest, - { - // https://www.rfc-editor.org/rfc/rfc9380.html#section-3.1-4.2 - if dst.iter().map(|slice| slice.len()).sum::() == 0 { - Err(Error) - } else if dst.iter().map(|slice| slice.len()).sum::() > MAX_DST_LEN { - if L::USIZE > u8::MAX.into() { - return Err(Error); - } - - Ok(Self::Hashed({ - let mut hash = X::new(); - hash.update(OVERSIZE_DST_SALT); - - for slice in dst { - hash.update(slice); - } - - hash.finalize() - })) - } else { - Ok(Self::Array(dst)) - } - } - - pub fn update_hash(&self, hash: &mut HashT) { - match self { - Self::Hashed(d) => hash.update(d), - Self::Array(d) => { - for d in d.iter() { - hash.update(d) - } - } - } - } - - pub fn len(&self) -> u8 { - match self { - // Can't overflow because it's checked on creation. - Self::Hashed(_) => L::U8, - // Can't overflow because it's checked on creation. - Self::Array(d) => { - u8::try_from(d.iter().map(|d| d.len()).sum::()).expect("length overflow") - } - } - } - - #[cfg(test)] - pub fn assert(&self, bytes: &[u8]) { - let data = match self { - Domain::Hashed(d) => d.to_vec(), - Domain::Array(d) => d.iter().copied().flatten().copied().collect(), - }; - assert_eq!(data, bytes); - } - - #[cfg(test)] - pub fn assert_dst(&self, bytes: &[u8]) { - let data = match self { - Domain::Hashed(d) => d.to_vec(), - Domain::Array(d) => d.iter().copied().flatten().copied().collect(), - }; - assert_eq!(data, &bytes[..bytes.len() - 1]); - assert_eq!(self.len(), bytes[bytes.len() - 1]); - } -} diff --git a/elliptic-curve/src/hash2curve/hash2field/expand_msg/xmd.rs b/elliptic-curve/src/hash2curve/hash2field/expand_msg/xmd.rs deleted file mode 100644 index a68f53ec7..000000000 --- a/elliptic-curve/src/hash2curve/hash2field/expand_msg/xmd.rs +++ /dev/null @@ -1,452 +0,0 @@ -//! `expand_message_xmd` based on a hash function. - -use core::{marker::PhantomData, num::NonZero, ops::Mul}; - -use super::{Domain, ExpandMsg, Expander}; -use crate::{Error, Result}; -use digest::{ - FixedOutput, HashMarker, - array::{ - Array, - typenum::{IsGreaterOrEqual, IsLessOrEqual, Prod, True, U2, Unsigned}, - }, - block_api::BlockSizeUser, -}; - -/// Implements `expand_message_xof` via the [`ExpandMsg`] trait: -/// -/// -/// # Errors -/// - `dst` contains no bytes -/// - `dst > 255 && HashT::OutputSize > 255` -/// - `len_in_bytes > 255 * HashT::OutputSize` -#[derive(Debug)] -pub struct ExpandMsgXmd(PhantomData) -where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - HashT::OutputSize: IsLessOrEqual; - -impl ExpandMsg for ExpandMsgXmd -where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - // The number of bits output by `HashT` MUST be at most `HashT::BlockSize`. - // https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.1-4 - HashT::OutputSize: IsLessOrEqual, - // The number of bits output by `HashT` MUST be at least `K * 2`. - // https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.1-2.1 - K: Mul, - HashT::OutputSize: IsGreaterOrEqual, Output = True>, -{ - type Expander<'dst> = ExpanderXmd<'dst, HashT>; - - fn expand_message<'dst>( - msg: &[&[u8]], - dst: &'dst [&[u8]], - len_in_bytes: NonZero, - ) -> Result> { - let b_in_bytes = HashT::OutputSize::USIZE; - - // `255 * ` can not exceed `u16::MAX` - if usize::from(len_in_bytes.get()) > 255 * b_in_bytes { - return Err(Error); - } - - let ell = u8::try_from(usize::from(len_in_bytes.get()).div_ceil(b_in_bytes)) - .expect("should never pass the previous check"); - - let domain = Domain::xmd::(dst)?; - let mut b_0 = HashT::default(); - b_0.update(&Array::::default()); - - for msg in msg { - b_0.update(msg); - } - - b_0.update(&len_in_bytes.get().to_be_bytes()); - b_0.update(&[0]); - domain.update_hash(&mut b_0); - b_0.update(&[domain.len()]); - let b_0 = b_0.finalize_fixed(); - - let mut b_vals = HashT::default(); - b_vals.update(&b_0[..]); - b_vals.update(&[1u8]); - domain.update_hash(&mut b_vals); - b_vals.update(&[domain.len()]); - let b_vals = b_vals.finalize_fixed(); - - Ok(ExpanderXmd { - b_0, - b_vals, - domain, - index: 1, - offset: 0, - ell, - }) - } -} - -/// [`Expander`] type for [`ExpandMsgXmd`]. -#[derive(Debug)] -pub struct ExpanderXmd<'a, HashT> -where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - HashT::OutputSize: IsLessOrEqual, -{ - b_0: Array, - b_vals: Array, - domain: Domain<'a, HashT::OutputSize>, - index: u8, - offset: usize, - ell: u8, -} - -impl ExpanderXmd<'_, HashT> -where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - HashT::OutputSize: IsLessOrEqual, -{ - fn next(&mut self) -> bool { - if self.index < self.ell { - self.index += 1; - self.offset = 0; - // b_0 XOR b_(idx - 1) - let mut tmp = Array::::default(); - self.b_0 - .iter() - .zip(&self.b_vals[..]) - .enumerate() - .for_each(|(j, (b0val, bi1val))| tmp[j] = b0val ^ bi1val); - let mut b_vals = HashT::default(); - b_vals.update(&tmp); - b_vals.update(&[self.index]); - self.domain.update_hash(&mut b_vals); - b_vals.update(&[self.domain.len()]); - self.b_vals = b_vals.finalize_fixed(); - true - } else { - false - } - } -} - -impl Expander for ExpanderXmd<'_, HashT> -where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - HashT::OutputSize: IsLessOrEqual, -{ - fn fill_bytes(&mut self, okm: &mut [u8]) { - for b in okm { - if self.offset == self.b_vals.len() && !self.next() { - return; - } - *b = self.b_vals[self.offset]; - self.offset += 1; - } - } -} - -#[cfg(test)] -mod test { - use super::*; - use hex_literal::hex; - use hybrid_array::{ - ArraySize, - typenum::{IsLess, U4, U8, U32, U128, U65536}, - }; - use sha2::Sha256; - - fn assert_message( - msg: &[u8], - domain: &Domain<'_, HashT::OutputSize>, - len_in_bytes: u16, - bytes: &[u8], - ) where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - { - let block = HashT::BlockSize::USIZE; - assert_eq!( - Array::::default().as_slice(), - &bytes[..block] - ); - - let msg_len = block + msg.len(); - assert_eq!(msg, &bytes[block..msg_len]); - - let l = msg_len + size_of::(); - assert_eq!(len_in_bytes.to_be_bytes(), &bytes[msg_len..l]); - - let pad = l + size_of::(); - assert_eq!([0], &bytes[l..pad]); - - let dst = pad + usize::from(domain.len()); - domain.assert(&bytes[pad..dst]); - - let dst_len = dst + size_of::(); - assert_eq!([domain.len()], &bytes[dst..dst_len]); - - assert_eq!(dst_len, bytes.len()); - } - - struct TestVector { - msg: &'static [u8], - msg_prime: &'static [u8], - uniform_bytes: &'static [u8], - } - - impl TestVector { - #[allow(clippy::panic_in_result_fn)] - fn assert( - &self, - dst: &'static [u8], - domain: &Domain<'_, HashT::OutputSize>, - ) -> Result<()> - where - HashT: BlockSizeUser + Default + FixedOutput + HashMarker, - HashT::OutputSize: IsLessOrEqual, - HashT::OutputSize: IsGreaterOrEqual, - L: ArraySize + IsLess, - { - assert_message::(self.msg, domain, L::U16, self.msg_prime); - - let dst = [dst]; - let mut expander = as ExpandMsg>::expand_message( - &[self.msg], - &dst, - NonZero::new(L::U16).ok_or(Error)?, - )?; - - let mut uniform_bytes = Array::::default(); - expander.fill_bytes(&mut uniform_bytes); - - assert_eq!(uniform_bytes.as_slice(), self.uniform_bytes); - Ok(()) - } - } - - #[test] - fn expand_message_xmd_sha_256() -> Result<()> { - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHA256-128"; - const DST_PRIME: &[u8] = - &hex!("515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"); - - let dst_prime = Domain::xmd::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("68a985b87eb6b46952128911f2a4412bbc302a9d759667f87f7a21d803f07235"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263002000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("d8ccab23b5985ccea865c6c97b6e5b8350e794e603b4b97902f53a8a0d605615"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839002000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("eff31487c770a893cfb36f912fbfcbff40d5661771ca4b2cb4eafe524333f5c1"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171002000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("b23a1d2b4d97b2ef7785562a7e8bac7eed54ed6e97e29aa51bfe3f12ddad1ff9"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161002000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("4623227bcc01293b8c130bf771da8c298dede7383243dc0993d2d94823958c4c"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("af84c27ccfd45d41914fdff5df25293e221afc53d8ad2ac06d5e3e29485dadbee0d121587713a3e0dd4d5e69e93eb7cd4f5df4cd103e188cf60cb02edc3edf18eda8576c412b18ffb658e3dd6ec849469b979d444cf7b26911a08e63cf31f9dcc541708d3491184472c2c29bb749d4286b004ceb5ee6b9a7fa5b646c993f0ced"), - }, TestVector { - msg: b"abc", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263008000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("abba86a6129e366fc877aab32fc4ffc70120d8996c88aee2fe4b32d6c7b6437a647e6c3163d40b76a73cf6a5674ef1d890f95b664ee0afa5359a5c4e07985635bbecbac65d747d3d2da7ec2b8221b17b0ca9dc8a1ac1c07ea6a1e60583e2cb00058e77b7b72a298425cd1b941ad4ec65e8afc50303a22c0f99b0509b4c895f40"), - }, TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839008000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("ef904a29bffc4cf9ee82832451c946ac3c8f8058ae97d8d629831a74c6572bd9ebd0df635cd1f208e2038e760c4994984ce73f0d55ea9f22af83ba4734569d4bc95e18350f740c07eef653cbb9f87910d833751825f0ebefa1abe5420bb52be14cf489b37fe1a72f7de2d10be453b2c9d9eb20c7e3f6edc5a60629178d9478df"), - }, TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171008000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("80be107d0884f0d881bb460322f0443d38bd222db8bd0b0a5312a6fedb49c1bbd88fd75d8b9a09486c60123dfa1d73c1cc3169761b17476d3c6b7cbbd727acd0e2c942f4dd96ae3da5de368d26b32286e32de7e5a8cb2949f866a0b80c58116b29fa7fabb3ea7d520ee603e0c25bcaf0b9a5e92ec6a1fe4e0391d1cdbce8c68a"), - }, TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161008000515555582d5630312d435330322d776974682d657870616e6465722d5348413235362d31323826"), - uniform_bytes: &hex!("546aff5444b5b79aa6148bd81728704c32decb73a3ba76e9e75885cad9def1d06d6792f8a7d12794e90efed817d96920d728896a4510864370c207f99bd4a608ea121700ef01ed879745ee3e4ceef777eda6d9e5e38b90c86ea6fb0b36504ba4a45d22e86f6db5dd43d98a294bebb9125d5b794e9d2a81181066eb954966a487"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } - - #[test] - fn expand_message_xmd_sha_256_long() -> Result<()> { - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHA256-128-long-DST-1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"; - const DST_PRIME: &[u8] = - &hex!("412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"); - - let dst_prime = Domain::xmd::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("e8dc0c8b686b7ef2074086fbdd2f30e3f8bfbd3bdf177f73f04b97ce618a3ed3"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("52dbf4f36cf560fca57dedec2ad924ee9c266341d8f3d6afe5171733b16bbb12"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("35387dcf22618f3728e6c686490f8b431f76550b0b2c61cbc1ce7001536f4521"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("01b637612bb18e840028be900a833a74414140dde0c4754c198532c3a0ba42bc"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("20cce7033cabc5460743180be6fa8aac5a103f56d481cf369a8accc0c374431b"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("14604d85432c68b757e485c8894db3117992fc57e0e136f71ad987f789a0abc287c47876978e2388a02af86b1e8d1342e5ce4f7aaa07a87321e691f6fba7e0072eecc1218aebb89fb14a0662322d5edbd873f0eb35260145cd4e64f748c5dfe60567e126604bcab1a3ee2dc0778102ae8a5cfd1429ebc0fa6bf1a53c36f55dfc"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("1a30a5e36fbdb87077552b9d18b9f0aee16e80181d5b951d0471d55b66684914aef87dbb3626eaabf5ded8cd0686567e503853e5c84c259ba0efc37f71c839da2129fe81afdaec7fbdc0ccd4c794727a17c0d20ff0ea55e1389d6982d1241cb8d165762dbc39fb0cee4474d2cbbd468a835ae5b2f20e4f959f56ab24cd6fe267"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("d2ecef3635d2397f34a9f86438d772db19ffe9924e28a1caf6f1c8f15603d4028f40891044e5c7e39ebb9b31339979ff33a4249206f67d4a1e7c765410bcd249ad78d407e303675918f20f26ce6d7027ed3774512ef5b00d816e51bfcc96c3539601fa48ef1c07e494bdc37054ba96ecb9dbd666417e3de289d4f424f502a982"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("ed6e8c036df90111410431431a232d41a32c86e296c05d426e5f44e75b9a50d335b2412bc6c91e0a6dc131de09c43110d9180d0a70f0d6289cb4e43b05f7ee5e9b3f42a1fad0f31bac6a625b3b5c50e3a83316783b649e5ecc9d3b1d9471cb5024b7ccf40d41d1751a04ca0356548bc6e703fca02ab521b505e8e45600508d32"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620"), - uniform_bytes: &hex!("78b53f2413f3c688f07732c10e5ced29a17c6a16f717179ffbe38d92d6c9ec296502eb9889af83a1928cd162e845b0d3c5424e83280fed3d10cffb2f8431f14e7a23f4c68819d40617589e4c41169d0b56e0e3535be1fd71fbb08bb70c5b5ffed953d6c14bf7618b35fc1f4c4b30538236b4b08c9fbf90462447a8ada60be495"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } - - #[test] - fn expand_message_xmd_sha_512() -> Result<()> { - use sha2::Sha512; - - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHA512-256"; - const DST_PRIME: &[u8] = - &hex!("515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"); - - let dst_prime = Domain::xmd::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("6b9a7312411d92f921c6f68ca0b6380730a1a4d982c507211a90964c394179ba"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263002000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("0da749f12fbe5483eb066a5f595055679b976e93abe9be6f0f6318bce7aca8dc"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839002000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("087e45a86e2939ee8b91100af1583c4938e0f5fc6c9db4b107b83346bc967f58"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171002000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("7336234ee9983902440f6bc35b348352013becd88938d2afec44311caf8356b3"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161002000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("57b5f7e766d5be68a6bfe1768e3c2b7f1228b3e4b3134956dd73a59b954c66f4"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("41b037d1734a5f8df225dd8c7de38f851efdb45c372887be655212d07251b921b052b62eaed99b46f72f2ef4cc96bfaf254ebbbec091e1a3b9e4fb5e5b619d2e0c5414800a1d882b62bb5cd1778f098b8eb6cb399d5d9d18f5d5842cf5d13d7eb00a7cff859b605da678b318bd0e65ebff70bec88c753b159a805d2c89c55961"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616263008000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("7f1dddd13c08b543f2e2037b14cefb255b44c83cc397c1786d975653e36a6b11bdd7732d8b38adb4a0edc26a0cef4bb45217135456e58fbca1703cd6032cb1347ee720b87972d63fbf232587043ed2901bce7f22610c0419751c065922b488431851041310ad659e4b23520e1772ab29dcdeb2002222a363f0c2b1c972b3efe1"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061626364656630313233343536373839008000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("3f721f208e6199fe903545abc26c837ce59ac6fa45733f1baaf0222f8b7acb0424814fcb5eecf6c1d38f06e9d0a6ccfbf85ae612ab8735dfdf9ce84c372a77c8f9e1c1e952c3a61b7567dd0693016af51d2745822663d0c2367e3f4f0bed827feecc2aaf98c949b5ed0d35c3f1023d64ad1407924288d366ea159f46287e61ac"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000713132385f7171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171008000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("b799b045a58c8d2b4334cf54b78260b45eec544f9f2fb5bd12fb603eaee70db7317bf807c406e26373922b7b8920fa29142703dd52bdf280084fb7ef69da78afdf80b3586395b433dc66cde048a258e476a561e9deba7060af40adf30c64249ca7ddea79806ee5beb9a1422949471d267b21bc88e688e4014087a0b592b695ed"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000613531325f6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161008000515555582d5630312d435330322d776974682d657870616e6465722d5348413531322d32353626"), - uniform_bytes: &hex!("05b0bfef265dcee87654372777b7c44177e2ae4c13a27f103340d9cd11c86cb2426ffcad5bd964080c2aee97f03be1ca18e30a1f14e27bc11ebbd650f305269cc9fb1db08bf90bfc79b42a952b46daf810359e7bc36452684784a64952c343c52e5124cd1f71d474d5197fefc571a92929c9084ffe1112cf5eea5192ebff330b"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } -} diff --git a/elliptic-curve/src/hash2curve/hash2field/expand_msg/xof.rs b/elliptic-curve/src/hash2curve/hash2field/expand_msg/xof.rs deleted file mode 100644 index 43facde53..000000000 --- a/elliptic-curve/src/hash2curve/hash2field/expand_msg/xof.rs +++ /dev/null @@ -1,376 +0,0 @@ -//! `expand_message_xof` for the `ExpandMsg` trait - -use super::{Domain, ExpandMsg, Expander}; -use crate::Result; -use core::{fmt, num::NonZero, ops::Mul}; -use digest::{ - CollisionResistance, ExtendableOutput, HashMarker, Update, XofReader, typenum::IsGreaterOrEqual, -}; -use hybrid_array::{ - ArraySize, - typenum::{Prod, True, U2}, -}; - -/// Implements `expand_message_xof` via the [`ExpandMsg`] trait: -/// -/// -/// # Errors -/// - `dst` contains no bytes -/// - `dst > 255 && K * 2 > 255` -pub struct ExpandMsgXof -where - HashT: Default + ExtendableOutput + Update + HashMarker, -{ - reader: ::Reader, -} - -impl fmt::Debug for ExpandMsgXof -where - HashT: Default + ExtendableOutput + Update + HashMarker, - ::Reader: fmt::Debug, -{ - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - f.debug_struct("ExpandMsgXof") - .field("reader", &self.reader) - .finish() - } -} - -impl ExpandMsg for ExpandMsgXof -where - HashT: Default + ExtendableOutput + Update + HashMarker, - // If DST is larger than 255 bytes, the length of the computed DST is calculated by `K * 2`. - // https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.1-2.1 - K: Mul, - // The collision resistance of `HashT` MUST be at least `K` bits. - // https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.2-2.1 - HashT: CollisionResistance>, -{ - type Expander<'dst> = Self; - - fn expand_message<'dst>( - msg: &[&[u8]], - dst: &'dst [&[u8]], - len_in_bytes: NonZero, - ) -> Result> { - let len_in_bytes = len_in_bytes.get(); - - let domain = Domain::>::xof::(dst)?; - let mut reader = HashT::default(); - - for msg in msg { - reader = reader.chain(msg); - } - - reader.update(&len_in_bytes.to_be_bytes()); - domain.update_hash(&mut reader); - reader.update(&[domain.len()]); - let reader = reader.finalize_xof(); - Ok(Self { reader }) - } -} - -impl Expander for ExpandMsgXof -where - HashT: Default + ExtendableOutput + Update + HashMarker, -{ - fn fill_bytes(&mut self, okm: &mut [u8]) { - self.reader.read(okm); - } -} - -#[cfg(test)] -mod test { - use crate::Error; - - use super::*; - use core::mem::size_of; - use hex_literal::hex; - use hybrid_array::{ - Array, ArraySize, - typenum::{IsLess, U16, U32, U128, U65536}, - }; - use sha3::Shake128; - - fn assert_message(msg: &[u8], domain: &Domain<'_, U32>, len_in_bytes: u16, bytes: &[u8]) { - let msg_len = msg.len(); - assert_eq!(msg, &bytes[..msg_len]); - - let len_in_bytes_len = msg_len + size_of::(); - assert_eq!( - len_in_bytes.to_be_bytes(), - &bytes[msg_len..len_in_bytes_len] - ); - - let dst = len_in_bytes_len + usize::from(domain.len()); - domain.assert(&bytes[len_in_bytes_len..dst]); - - let dst_len = dst + size_of::(); - assert_eq!([domain.len()], &bytes[dst..dst_len]); - - assert_eq!(dst_len, bytes.len()); - } - - struct TestVector { - msg: &'static [u8], - msg_prime: &'static [u8], - uniform_bytes: &'static [u8], - } - - impl TestVector { - #[allow(clippy::panic_in_result_fn)] - fn assert(&self, dst: &'static [u8], domain: &Domain<'_, U32>) -> Result<()> - where - HashT: Default - + ExtendableOutput - + Update - + HashMarker - + CollisionResistance>, - L: ArraySize + IsLess, - { - assert_message(self.msg, domain, L::to_u16(), self.msg_prime); - - let mut expander = as ExpandMsg>::expand_message( - &[self.msg], - &[dst], - NonZero::new(L::U16).ok_or(Error)?, - )?; - - let mut uniform_bytes = Array::::default(); - expander.fill_bytes(&mut uniform_bytes); - - assert_eq!(uniform_bytes.as_slice(), self.uniform_bytes); - Ok(()) - } - } - - #[test] - fn expand_message_xof_shake_128() -> Result<()> { - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHAKE128"; - const DST_PRIME: &[u8] = - &hex!("515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"); - - let dst_prime = Domain::::xof::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("86518c9cd86581486e9485aa74ab35ba150d1c75c88e26b7043e44e2acd735a2"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("8696af52a4d862417c0763556073f47bc9b9ba43c99b505305cb1ec04a9ab468"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("912c58deac4821c3509dbefa094df54b34b8f5d01a191d1d3108a2c89077acca"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("1adbcc448aef2a0cebc71dac9f756b22e51839d348e031e63b33ebb50faeaf3f"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("df3447cc5f3e9a77da10f819218ddf31342c310778e0e4ef72bbaecee786a4fe"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("7314ff1a155a2fb99a0171dc71b89ab6e3b2b7d59e38e64419b8b6294d03ffee42491f11370261f436220ef787f8f76f5b26bdcd850071920ce023f3ac46847744f4612b8714db8f5db83205b2e625d95afd7d7b4d3094d3bdde815f52850bb41ead9822e08f22cf41d615a303b0d9dde73263c049a7b9898208003a739a2e57"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("c952f0c8e529ca8824acc6a4cab0e782fc3648c563ddb00da7399f2ae35654f4860ec671db2356ba7baa55a34a9d7f79197b60ddae6e64768a37d699a78323496db3878c8d64d909d0f8a7de4927dcab0d3dbbc26cb20a49eceb0530b431cdf47bc8c0fa3e0d88f53b318b6739fbed7d7634974f1b5c386d6230c76260d5337a"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("19b65ee7afec6ac06a144f2d6134f08eeec185f1a890fe34e68f0e377b7d0312883c048d9b8a1d6ecc3b541cb4987c26f45e0c82691ea299b5e6889bbfe589153016d8131717ba26f07c3c14ffbef1f3eff9752e5b6183f43871a78219a75e7000fbac6a7072e2b83c790a3a5aecd9d14be79f9fd4fb180960a3772e08680495"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("ca1b56861482b16eae0f4a26212112362fcc2d76dcc80c93c4182ed66c5113fe41733ed68be2942a3487394317f3379856f4822a611735e50528a60e7ade8ec8c71670fec6661e2c59a09ed36386513221688b35dc47e3c3111ee8c67ff49579089d661caa29db1ef10eb6eace575bf3dc9806e7c4016bd50f3c0e2a6481ee6d"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4531323824"), - uniform_bytes: &hex!("9d763a5ce58f65c91531b4100c7266d479a5d9777ba761693d052acd37d149e7ac91c796a10b919cd74a591a1e38719fb91b7203e2af31eac3bff7ead2c195af7d88b8bc0a8adf3d1e90ab9bed6ddc2b7f655dd86c730bdeaea884e73741097142c92f0e3fc1811b699ba593c7fbd81da288a29d423df831652e3a01a9374999"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } - - #[test] - fn expand_message_xof_shake_128_long() -> Result<()> { - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHAKE128-long-DST-111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"; - const DST_PRIME: &[u8] = - &hex!("acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"); - - let dst_prime = Domain::::xof::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0020acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("827c6216330a122352312bccc0c8d6e7a146c5257a776dbd9ad9d75cd880fc53"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630020acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("690c8d82c7213b4282c6cb41c00e31ea1d3e2005f93ad19bbf6da40f15790c5c"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390020acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("979e3a15064afbbcf99f62cc09fa9c85028afcf3f825eb0711894dcfc2f57057"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710020acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("c5a9220962d9edc212c063f4f65b609755a1ed96e62f9db5d1fd6adb5a8dc52b"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610020acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("f7b96a5901af5d78ce1d071d9c383cac66a1dfadb508300ec6aeaea0d62d5d62"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0080acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("3890dbab00a2830be398524b71c2713bbef5f4884ac2e6f070b092effdb19208c7df943dc5dcbaee3094a78c267ef276632ee2c8ea0c05363c94b6348500fae4208345dd3475fe0c834c2beac7fa7bc181692fb728c0a53d809fc8111495222ce0f38468b11becb15b32060218e285c57a60162c2c8bb5b6bded13973cd41819"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630080acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("41b7ffa7a301b5c1441495ebb9774e2a53dbbf4e54b9a1af6a20fd41eafd69ef7b9418599c5545b1ee422f363642b01d4a53449313f68da3e49dddb9cd25b97465170537d45dcbdf92391b5bdff344db4bd06311a05bca7dcd360b6caec849c299133e5c9194f4e15e3e23cfaab4003fab776f6ac0bfae9144c6e2e1c62e7d57"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390080acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("55317e4a21318472cd2290c3082957e1242241d9e0d04f47026f03401643131401071f01aa03038b2783e795bdfa8a3541c194ad5de7cb9c225133e24af6c86e748deb52e560569bd54ef4dac03465111a3a44b0ea490fb36777ff8ea9f1a8a3e8e0de3cf0880b4b2f8dd37d3a85a8b82375aee4fa0e909f9763319b55778e71"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710080acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("19fdd2639f082e31c77717ac9bb032a22ff0958382b2dbb39020cdc78f0da43305414806abf9a561cb2d0067eb2f7bc544482f75623438ed4b4e39dd9e6e2909dd858bd8f1d57cd0fce2d3150d90aa67b4498bdf2df98c0100dd1a173436ba5d0df6be1defb0b2ce55ccd2f4fc05eb7cb2c019c35d5398b85adc676da4238bc7"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610080acb9736c0867fdfbd6385519b90fc8c034b5af04a958973212950132d035792f20"), - uniform_bytes: &hex!("945373f0b3431a103333ba6a0a34f1efab2702efde41754c4cb1d5216d5b0a92a67458d968562bde7fa6310a83f53dda1383680a276a283438d58ceebfa7ab7ba72499d4a3eddc860595f63c93b1c5e823ea41fc490d938398a26db28f61857698553e93f0574eb8c5017bfed6249491f9976aaa8d23d9485339cc85ca329308"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } - - #[test] - fn expand_message_xof_shake_256() -> Result<()> { - use sha3::Shake256; - - const DST: &[u8] = b"QUUX-V01-CS02-with-expander-SHAKE256"; - const DST_PRIME: &[u8] = - &hex!("515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"); - - let dst_prime = Domain::::xof::(&[DST])?; - dst_prime.assert_dst(DST_PRIME); - - const TEST_VECTORS_32: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("2ffc05c48ed32b95d72e807f6eab9f7530dd1c2f013914c8fed38c5ccc15ad76"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("b39e493867e2767216792abce1f2676c197c0692aed061560ead251821808e07"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("245389cf44a13f0e70af8665fe5337ec2dcd138890bb7901c4ad9cfceb054b65"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("719b3911821e6428a5ed9b8e600f2866bcf23c8f0515e52d6c6c019a03f16f0e"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610020515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("9181ead5220b1963f1b5951f35547a5ea86a820562287d6ca4723633d17ccbbc"), - }, - ]; - - for test_vector in TEST_VECTORS_32 { - test_vector.assert::(DST, &dst_prime)?; - } - - const TEST_VECTORS_128: &[TestVector] = &[ - TestVector { - msg: b"", - msg_prime: &hex!("0080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("7a1361d2d7d82d79e035b8880c5a3c86c5afa719478c007d96e6c88737a3f631dd74a2c88df79a4cb5e5d9f7504957c70d669ec6bfedc31e01e2bacc4ff3fdf9b6a00b17cc18d9d72ace7d6b81c2e481b4f73f34f9a7505dccbe8f5485f3d20c5409b0310093d5d6492dea4e18aa6979c23c8ea5de01582e9689612afbb353df"), - }, - TestVector { - msg: b"abc", - msg_prime: &hex!("6162630080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("a54303e6b172909783353ab05ef08dd435a558c3197db0c132134649708e0b9b4e34fb99b92a9e9e28fc1f1d8860d85897a8e021e6382f3eea10577f968ff6df6c45fe624ce65ca25932f679a42a404bc3681efe03fcd45ef73bb3a8f79ba784f80f55ea8a3c367408f30381299617f50c8cf8fbb21d0f1e1d70b0131a7b6fbe"), - }, - TestVector { - msg: b"abcdef0123456789", - msg_prime: &hex!("616263646566303132333435363738390080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("e42e4d9538a189316e3154b821c1bafb390f78b2f010ea404e6ac063deb8c0852fcd412e098e231e43427bd2be1330bb47b4039ad57b30ae1fc94e34993b162ff4d695e42d59d9777ea18d3848d9d336c25d2acb93adcad009bcfb9cde12286df267ada283063de0bb1505565b2eb6c90e31c48798ecdc71a71756a9110ff373"), - }, - TestVector { - msg: b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", - msg_prime: &hex!("713132385f71717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171710080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("4ac054dda0a38a65d0ecf7afd3c2812300027c8789655e47aecf1ecc1a2426b17444c7482c99e5907afd9c25b991990490bb9c686f43e79b4471a23a703d4b02f23c669737a886a7ec28bddb92c3a98de63ebf878aa363a501a60055c048bea11840c4717beae7eee28c3cfa42857b3d130188571943a7bd747de831bd6444e0"), - }, - TestVector { - msg: b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - msg_prime: &hex!("613531325f61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161610080515555582d5630312d435330322d776974682d657870616e6465722d5348414b4532353624"), - uniform_bytes: &hex!("09afc76d51c2cccbc129c2315df66c2be7295a231203b8ab2dd7f95c2772c68e500bc72e20c602abc9964663b7a03a389be128c56971ce81001a0b875e7fd17822db9d69792ddf6a23a151bf470079c518279aef3e75611f8f828994a9988f4a8a256ddb8bae161e658d5a2a09bcfe839c6396dc06ee5c8ff3c22d3b1f9deb7e"), - }, - ]; - - for test_vector in TEST_VECTORS_128 { - test_vector.assert::(DST, &dst_prime)?; - } - - Ok(()) - } -} diff --git a/elliptic-curve/src/hash2curve/isogeny.rs b/elliptic-curve/src/hash2curve/isogeny.rs deleted file mode 100644 index 5b11900d9..000000000 --- a/elliptic-curve/src/hash2curve/isogeny.rs +++ /dev/null @@ -1,58 +0,0 @@ -//! Traits for mapping an isogeny to another curve -//! -//! - -use core::ops::{AddAssign, Mul}; -use ff::Field; -use hybrid_array::{Array, ArraySize, typenum::Unsigned}; - -/// The coefficients for mapping from one isogenous curve to another -#[derive(Debug)] -pub struct IsogenyCoefficients> { - /// The coefficients for the x numerator - pub xnum: &'static [F], - /// The coefficients for the x denominator - pub xden: &'static [F], - /// The coefficients for the y numerator - pub ynum: &'static [F], - /// The coefficients for the x denominator - pub yden: &'static [F], -} - -/// The [`Isogeny`] methods to map to another curve. -pub trait Isogeny: Field + AddAssign + Mul { - /// The maximum number of coefficients - type Degree: ArraySize; - /// The isogeny coefficients - const COEFFICIENTS: IsogenyCoefficients; - - /// Map from the isogeny points to the main curve - fn isogeny(x: Self, y: Self) -> (Self, Self) { - let mut xs = Array::::default(); - xs[0] = Self::ONE; - xs[1] = x; - xs[2] = x.square(); - for i in 3..Self::Degree::to_usize() { - xs[i] = xs[i - 1] * x; - } - let x_num = Self::compute_iso(&xs, Self::COEFFICIENTS.xnum); - let x_den = Self::compute_iso(&xs, Self::COEFFICIENTS.xden) - .invert() - .unwrap(); - let y_num = Self::compute_iso(&xs, Self::COEFFICIENTS.ynum) * y; - let y_den = Self::compute_iso(&xs, Self::COEFFICIENTS.yden) - .invert() - .unwrap(); - - (x_num * x_den, y_num * y_den) - } - - /// Compute the ISO transform - fn compute_iso(xxs: &[Self], k: &[Self]) -> Self { - let mut xx = Self::ZERO; - for (xi, ki) in xxs.iter().zip(k.iter()) { - xx += *xi * ki; - } - xx - } -} diff --git a/elliptic-curve/src/hash2curve/map2curve.rs b/elliptic-curve/src/hash2curve/map2curve.rs deleted file mode 100644 index 7ab69a2af..000000000 --- a/elliptic-curve/src/hash2curve/map2curve.rs +++ /dev/null @@ -1,33 +0,0 @@ -//! Traits for mapping field elements to points on the curve. - -use crate::{CurveArithmetic, ProjectivePoint}; - -use super::FromOkm; - -/// Trait for converting field elements into a point via a mapping method like -/// Simplified Shallue-van de Woestijne-Ulas or Elligator. -pub trait MapToCurve: CurveArithmetic { - /// The intermediate representation, an element of the curve which may or may not - /// be in the curve subgroup. - type CurvePoint; - /// The field element representation for a group value with multiple elements. - type FieldElement: FromOkm + Default + Copy; - - /// Map a field element into a curve point. - fn map_to_curve(element: Self::FieldElement) -> Self::CurvePoint; - - /// Map a curve point to a point in the curve subgroup. - /// This is usually done by clearing the cofactor, if necessary. - fn map_to_subgroup(point: Self::CurvePoint) -> ProjectivePoint; - - /// Combine two curve points into a point in the curve subgroup. - /// This is usually done by clearing the cofactor of the sum. In case - /// addition is not implemented for `Self::CurvePoint`, then both terms - /// must be mapped to the subgroup individually before being added. - fn add_and_map_to_subgroup( - lhs: Self::CurvePoint, - rhs: Self::CurvePoint, - ) -> ProjectivePoint { - Self::map_to_subgroup(lhs) + Self::map_to_subgroup(rhs) - } -} diff --git a/elliptic-curve/src/hash2curve/osswu.rs b/elliptic-curve/src/hash2curve/osswu.rs deleted file mode 100644 index ea8acdc5b..000000000 --- a/elliptic-curve/src/hash2curve/osswu.rs +++ /dev/null @@ -1,131 +0,0 @@ -//! Optimized simplified Shallue-van de Woestijne-Ulas methods. -//! -//! - -use ff::Field; -use subtle::Choice; -use subtle::ConditionallySelectable; -use subtle::ConstantTimeEq; - -/// The Optimized Simplified Shallue-van de Woestijne-Ulas parameters -#[derive(Debug)] -pub struct OsswuMapParams -where - F: Field, -{ - /// The first constant term - pub c1: &'static [u64], - /// The second constant term - pub c2: F, - /// The ISO A variable or Curve A variable - pub map_a: F, - /// The ISO A variable or Curve A variable - pub map_b: F, - /// The Z parameter - pub z: F, -} - -/// Trait for determining the parity of the field -pub trait Sgn0 { - /// Return the parity of the field - /// 1 == negative - /// 0 == non-negative - fn sgn0(&self) -> Choice; -} - -/// The optimized simplified Shallue-van de Woestijne-Ulas method -/// for mapping elliptic curve scalars to affine points. -pub trait OsswuMap: Field + Sgn0 { - /// The OSSWU parameters for mapping the field to affine points. - /// For Weierstrass curves having A==0 or B==0, the parameters - /// should be for isogeny where A≠0 and B≠0. - const PARAMS: OsswuMapParams; - - /// Optimized sqrt_ratio for q = 3 mod 4. - fn sqrt_ratio_3mod4(u: Self, v: Self) -> (Choice, Self) { - // 1. tv1 = v^2 - let tv1 = v.square(); - // 2. tv2 = u * v - let tv2 = u * v; - // 3. tv1 = tv1 * tv2 - let tv1 = tv1 * tv2; - // 4. y1 = tv1^c1 - let y1 = tv1.pow_vartime(Self::PARAMS.c1); - // 5. y1 = y1 * tv2 - let y1 = y1 * tv2; - // 6. y2 = y1 * c2 - let y2 = y1 * Self::PARAMS.c2; - // 7. tv3 = y1^2 - let tv3 = y1.square(); - // 8. tv3 = tv3 * v - let tv3 = tv3 * v; - // 9. isQR = tv3 == u - let is_qr = tv3.ct_eq(&u); - // 10. y = CMOV(y2, y1, isQR) - let y = ConditionallySelectable::conditional_select(&y2, &y1, is_qr); - // 11. return (isQR, y) - (is_qr, y) - } - - /// Convert this field element into an affine point on the elliptic curve - /// returning (X, Y). For Weierstrass curves having A==0 or B==0 - /// the result is a point on an isogeny. - fn osswu(&self) -> (Self, Self) { - // 1. tv1 = u^2 - let tv1 = self.square(); - // 2. tv1 = Z * tv1 - let tv1 = Self::PARAMS.z * tv1; - // 3. tv2 = tv1^2 - let tv2 = tv1.square(); - // 4. tv2 = tv2 + tv1 - let tv2 = tv2 + tv1; - // 5. tv3 = tv2 + 1 - let tv3 = tv2 + Self::ONE; - // 6. tv3 = B * tv3 - let tv3 = Self::PARAMS.map_b * tv3; - // 7. tv4 = CMOV(Z, -tv2, tv2 != 0) - let tv4 = ConditionallySelectable::conditional_select( - &Self::PARAMS.z, - &-tv2, - !Field::is_zero(&tv2), - ); - // 8. tv4 = A * tv4 - let tv4 = Self::PARAMS.map_a * tv4; - // 9. tv2 = tv3^2 - let tv2 = tv3.square(); - // 10. tv6 = tv4^2 - let tv6 = tv4.square(); - // 11. tv5 = A * tv6 - let tv5 = Self::PARAMS.map_a * tv6; - // 12. tv2 = tv2 + tv5 - let tv2 = tv2 + tv5; - // 13. tv2 = tv2 * tv3 - let tv2 = tv2 * tv3; - // 14. tv6 = tv6 * tv4 - let tv6 = tv6 * tv4; - // 15. tv5 = B * tv6 - let tv5 = Self::PARAMS.map_b * tv6; - // 16. tv2 = tv2 + tv5 - let tv2 = tv2 + tv5; - // 17. x = tv1 * tv3 - let x = tv1 * tv3; - // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6) - let (is_gx1_square, y1) = Self::sqrt_ratio_3mod4(tv2, tv6); - // 19. y = tv1 * u - let y = tv1 * self; - // 20. y = y * y1 - let y = y * y1; - // 21. x = CMOV(x, tv3, is_gx1_square) - let x = ConditionallySelectable::conditional_select(&x, &tv3, is_gx1_square); - // 22. y = CMOV(y, y1, is_gx1_square) - let y = ConditionallySelectable::conditional_select(&y, &y1, is_gx1_square); - // 23. e1 = sgn0(u) == sgn0(y) - let e1 = self.sgn0().ct_eq(&y.sgn0()); - // 24. y = CMOV(-y, y, e1) - let y = ConditionallySelectable::conditional_select(&-y, &y, e1); - // 25. x = x / tv4 - let x = x * tv4.invert().unwrap(); - // 26. return (x, y) - (x, y) - } -} diff --git a/elliptic-curve/src/lib.rs b/elliptic-curve/src/lib.rs index ea08dd3b3..bd880be88 100644 --- a/elliptic-curve/src/lib.rs +++ b/elliptic-curve/src/lib.rs @@ -91,8 +91,6 @@ pub mod scalar; pub mod dev; #[cfg(feature = "ecdh")] pub mod ecdh; -#[cfg(feature = "hash2curve")] -pub mod hash2curve; #[cfg(feature = "arithmetic")] pub mod ops; #[cfg(feature = "sec1")] @@ -113,9 +111,6 @@ mod public_key; #[cfg(feature = "jwk")] mod jwk; -#[cfg(feature = "oprf")] -mod oprf; - pub use crate::{ error::{Error, Result}, field::{FieldBytes, FieldBytesEncoding, FieldBytesSize}, @@ -147,9 +142,6 @@ pub use crate::jwk::{JwkEcKey, JwkParameters}; #[cfg(feature = "pkcs8")] pub use pkcs8; -#[cfg(feature = "oprf")] -pub use crate::oprf::OprfParameters; - use core::{ fmt::Debug, ops::{Add, ShrAssign}, diff --git a/elliptic-curve/src/oprf.rs b/elliptic-curve/src/oprf.rs deleted file mode 100644 index b6806f74f..000000000 --- a/elliptic-curve/src/oprf.rs +++ /dev/null @@ -1,30 +0,0 @@ -//! Oblivious Pseudorandom Functions (OPRF) using prime order groups -//! -//! - -use digest::{FixedOutput, Update}; -use hybrid_array::typenum::{IsLess, True, U65536}; - -use crate::PrimeCurve; -use crate::hash2curve::{ExpandMsg, GroupDigest}; - -/// Elliptic curve parameters used by OPRF. -pub trait OprfParameters: GroupDigest + PrimeCurve { - /// The `ID` parameter which identifies a particular elliptic curve - /// as defined in [section 4 of RFC9497][oprf]. - /// - /// [oprf]: https://www.rfc-editor.org/rfc/rfc9497.html#name-ciphersuites - const ID: &'static [u8]; - - /// The `Hash` parameter which assigns a particular hash function to this - /// ciphersuite as defined in [section 4 of RFC9497][oprf]. - /// - /// [oprf]: https://www.rfc-editor.org/rfc/rfc9497.html#name-ciphersuites - type Hash: Default + FixedOutput> + Update; - - /// The `expand_message` parameter which assigns a particular algorithm for `HashToGroup` - /// and `HashToScalar` as defined in [section 4 of RFC9497][oprf]. - /// - /// [oprf]: https://www.rfc-editor.org/rfc/rfc9497.html#name-ciphersuites - type ExpandMsg: ExpandMsg<::K>; -}