clean up (#53)

* clean up Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> * remove unnecessary check Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> * remove unnecessary check Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> * some cleanup in tests Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> * updated workflows Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> --------- Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com>
bytemare · Feb 12, 2023 · deaafdf · deaafdf
1 parent 7dd75ce
commit deaafdf
Show file tree

Hide file tree

Showing 19 changed files with 136 additions and 179 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # pin@v3
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
         with:
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # pin@v3
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # pin@v3
         with:
           go-version-file: ./go.mod
 
@@ -38,11 +38,11 @@ jobs:
         go: [ '1.19', '1.18' ]
     steps:
       - name: Checkout repo
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # pin@v3
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
         with:
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # pin@v3
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # pin@v3
         with:
           go-version: ${{ matrix.go }}
 
@@ -55,11 +55,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # pin@v3
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # pin@v3
         with:
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # pin@v3
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # pin@v3
         with:
           go-version-file: ./go.mod
 
@@ -75,15 +75,10 @@ jobs:
 
       # Sonar
       - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@156db6fef3e168e4972abb76de0b32bbce8ec77a # pin@master
+        uses: SonarSource/sonarcloud-github-action@cb201f3b2d7a38231a8c042dfea4539c8bea180b # pin@master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
           args: >
-            -Dsonar.organization=bytemare-github
-            -Dsonar.projectKey=bytemare_opaque
-            -Dsonar.go.coverage.reportPaths=.github/coverage.out
-            -Dsonar.sources=. -Dsonar.test.exclusions=examples_test.go,tests/**
-            -Dsonar.coverage.exclusions=examples_test.go,tests/**
-            -Dsonar.tests=tests/ -Dsonar.verbose=true
+            -Dsonar.organization=bytemare-github -Dsonar.projectKey=bytemare_opaque -Dsonar.go.coverage.reportPaths=.github/coverage.out -Dsonar.sources=. -Dsonar.test.exclusions=examples_test.go,tests/** -Dsonar.coverage.exclusions=examples_test.go,tests/** -Dsonar.tests=tests/ -Dsonar.verbose=true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -24,16 +24,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # pin@v2
+        uses: actions/checkout@dc323e67f16fb5f7663d20ff7941f27f5809e9b6 # pin@v2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fe2e30bafc62994571bcacc370c0818cf12a231e # pin@v1
+        uses: github/codeql-action/init@231aa2c8a89117b126725a0e11897209b7118144 # pin@v1
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@fe2e30bafc62994571bcacc370c0818cf12a231e # pin@v1
+        uses: github/codeql-action/autobuild@231aa2c8a89117b126725a0e11897209b7118144 # pin@v1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@fe2e30bafc62994571bcacc370c0818cf12a231e # pin@v1
+        uses: github/codeql-action/analyze@231aa2c8a89117b126725a0e11897209b7118144 # pin@v1
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # pin@master
       - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/golang@e0bb9436303033a6ecc7f3d3af5e842c269a969d # pin@master
+        uses: snyk/actions/golang@806182742461562b67788a64410098c9d9b96adb # pin@master
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:

diff --git a/client.go b/client.go
@@ -67,7 +67,7 @@ func (c *Client) GetConf() *internal.Configuration {
 // buildPRK derives the randomized password from the OPRF output.
 func (c *Client) buildPRK(evaluation *group.Element) []byte {
 	output := c.OPRF.Finalize(evaluation)
-	stretched := c.conf.KSF.Harden(output, nil, c.conf.OPRFPointLength)
+	stretched := c.conf.KSF.Harden(output, nil, c.conf.OPRF.Group().ElementLength())
 
 	return c.conf.KDF.Extract(nil, encoding.Concat(output, stretched))
 }
@@ -217,7 +217,7 @@ func (c *Client) LoginFinish(
 	}
 
 	// This test is very important as it avoids buffer overflows in subsequent parsing.
-	if len(ke2.MaskedResponse) != c.conf.AkePointLength+c.conf.EnvelopeSize {
+	if len(ke2.MaskedResponse) != c.conf.Group.ElementLength()+c.conf.EnvelopeSize {
 		return nil, nil, errInvalidMaskedLength
 	}
 

diff --git a/deserializer.go b/deserializer.go
@@ -36,20 +36,20 @@ type Deserializer struct {
 // RegistrationRequest takes a serialized RegistrationRequest message and returns a deserialized
 // RegistrationRequest structure.
 func (d *Deserializer) RegistrationRequest(registrationRequest []byte) (*message.RegistrationRequest, error) {
-	if len(registrationRequest) != d.conf.OPRFPointLength {
+	if len(registrationRequest) != d.conf.OPRF.Group().ElementLength() {
 		return nil, errInvalidMessageLength
 	}
 
 	blindedMessage := d.conf.OPRF.Group().NewElement()
-	if err := blindedMessage.Decode(registrationRequest[:d.conf.OPRFPointLength]); err != nil {
+	if err := blindedMessage.Decode(registrationRequest[:d.conf.OPRF.Group().ElementLength()]); err != nil {
 		return nil, errInvalidBlindedData
 	}
 
 	return &message.RegistrationRequest{BlindedMessage: blindedMessage}, nil
 }
 
 func (d *Deserializer) registrationResponseLength() int {
-	return d.conf.OPRFPointLength + d.conf.AkePointLength
+	return d.conf.OPRF.Group().ElementLength() + d.conf.Group.ElementLength()
 }
 
 // RegistrationResponse takes a serialized RegistrationResponse message and returns a deserialized
@@ -60,12 +60,12 @@ func (d *Deserializer) RegistrationResponse(registrationResponse []byte) (*messa
 	}
 
 	evaluatedMessage := d.conf.OPRF.Group().NewElement()
-	if err := evaluatedMessage.Decode(registrationResponse[:d.conf.OPRFPointLength]); err != nil {
+	if err := evaluatedMessage.Decode(registrationResponse[:d.conf.OPRF.Group().ElementLength()]); err != nil {
 		return nil, errInvalidEvaluatedData
 	}
 
 	pks := d.conf.Group.NewElement()
-	if err := pks.Decode(registrationResponse[d.conf.OPRFPointLength:]); err != nil {
+	if err := pks.Decode(registrationResponse[d.conf.OPRF.Group().ElementLength():]); err != nil {
 		return nil, errInvalidServerPK
 	}
 
@@ -76,7 +76,7 @@ func (d *Deserializer) RegistrationResponse(registrationResponse []byte) (*messa
 }
 
 func (d *Deserializer) recordLength() int {
-	return d.conf.AkePointLength + d.conf.Hash.Size() + d.conf.EnvelopeSize
+	return d.conf.Group.ElementLength() + d.conf.Hash.Size() + d.conf.EnvelopeSize
 }
 
 // RegistrationRecord takes a serialized RegistrationRecord message and returns a deserialized
@@ -86,9 +86,9 @@ func (d *Deserializer) RegistrationRecord(record []byte) (*message.RegistrationR
 		return nil, errInvalidMessageLength
 	}
 
-	pk := record[:d.conf.AkePointLength]
-	maskingKey := record[d.conf.AkePointLength : d.conf.AkePointLength+d.conf.Hash.Size()]
-	env := record[d.conf.AkePointLength+d.conf.Hash.Size():]
+	pk := record[:d.conf.Group.ElementLength()]
+	maskingKey := record[d.conf.Group.ElementLength() : d.conf.Group.ElementLength()+d.conf.Hash.Size()]
+	env := record[d.conf.Group.ElementLength()+d.conf.Hash.Size():]
 
 	pku := d.conf.Group.NewElement()
 	if err := pku.Decode(pk); err != nil {
@@ -104,7 +104,7 @@ func (d *Deserializer) RegistrationRecord(record []byte) (*message.RegistrationR
 
 func (d *Deserializer) deserializeCredentialRequest(input []byte) (*message.CredentialRequest, error) {
 	blindedMessage := d.conf.OPRF.Group().NewElement()
-	if err := blindedMessage.Decode(input[:d.conf.OPRFPointLength]); err != nil {
+	if err := blindedMessage.Decode(input[:d.conf.OPRF.Group().ElementLength()]); err != nil {
 		return nil, errInvalidBlindedData
 	}
 
@@ -116,17 +116,17 @@ func (d *Deserializer) deserializeCredentialResponse(
 	maxResponseLength int,
 ) (*message.CredentialResponse, error) {
 	data := d.conf.OPRF.Group().NewElement()
-	if err := data.Decode(input[:d.conf.OPRFPointLength]); err != nil {
+	if err := data.Decode(input[:d.conf.OPRF.Group().ElementLength()]); err != nil {
 		return nil, errInvalidEvaluatedData
 	}
 
 	return message.NewCredentialResponse(data,
-		input[d.conf.OPRFPointLength:d.conf.OPRFPointLength+d.conf.NonceLen],
-		input[d.conf.OPRFPointLength+d.conf.NonceLen:maxResponseLength]), nil
+		input[d.conf.OPRF.Group().ElementLength():d.conf.OPRF.Group().ElementLength()+d.conf.NonceLen],
+		input[d.conf.OPRF.Group().ElementLength()+d.conf.NonceLen:maxResponseLength]), nil
 }
 
 func (d *Deserializer) ke1Length() int {
-	return d.conf.OPRFPointLength + d.conf.NonceLen + d.conf.AkePointLength
+	return d.conf.OPRF.Group().ElementLength() + d.conf.NonceLen + d.conf.Group.ElementLength()
 }
 
 // KE1 takes a serialized KE1 message and returns a deserialized KE1 structure.
@@ -140,10 +140,10 @@ func (d *Deserializer) KE1(ke1 []byte) (*message.KE1, error) {
 		return nil, err
 	}
 
-	nonceU := ke1[d.conf.OPRFPointLength : d.conf.OPRFPointLength+d.conf.NonceLen]
+	nonceU := ke1[d.conf.OPRF.Group().ElementLength() : d.conf.OPRF.Group().ElementLength()+d.conf.NonceLen]
 
 	epku := d.conf.Group.NewElement()
-	if err := epku.Decode(ke1[d.conf.OPRFPointLength+d.conf.NonceLen:]); err != nil {
+	if err := epku.Decode(ke1[d.conf.OPRF.Group().ElementLength()+d.conf.NonceLen:]); err != nil {
 		return nil, errInvalidClientEPK
 	}
 
@@ -155,11 +155,11 @@ func (d *Deserializer) KE1(ke1 []byte) (*message.KE1, error) {
 }
 
 func (d *Deserializer) ke2LengthWithoutCreds() int {
-	return d.conf.NonceLen + d.conf.AkePointLength + d.conf.MAC.Size()
+	return d.conf.NonceLen + d.conf.Group.ElementLength() + d.conf.MAC.Size()
 }
 
 func (d *Deserializer) credentialResponseLength() int {
-	return d.conf.OPRFPointLength + d.conf.NonceLen + d.conf.AkePointLength + d.conf.EnvelopeSize
+	return d.conf.OPRF.Group().ElementLength() + d.conf.NonceLen + d.conf.Group.ElementLength() + d.conf.EnvelopeSize
 }
 
 // KE2 takes a serialized KE2 message and returns a deserialized KE2 structure.
@@ -179,8 +179,8 @@ func (d *Deserializer) KE2(ke2 []byte) (*message.KE2, error) {
 
 	nonceS := ke2[maxResponseLength : maxResponseLength+d.conf.NonceLen]
 	offset := maxResponseLength + d.conf.NonceLen
-	epk := ke2[offset : offset+d.conf.AkePointLength]
-	offset += d.conf.AkePointLength
+	epk := ke2[offset : offset+d.conf.Group.ElementLength()]
+	offset += d.conf.Group.ElementLength()
 	mac := ke2[offset:]
 
 	epks := d.conf.Group.NewElement()

diff --git a/go.mod b/go.mod
@@ -3,7 +3,7 @@ module github.com/bytemare/opaque
 go 1.19
 
 require (
-	github.com/bytemare/crypto v0.4.1
+	github.com/bytemare/crypto v0.4.2
 	github.com/bytemare/hash v0.1.3
 	github.com/bytemare/ksf v0.1.0
 )
@@ -13,6 +13,6 @@ require (
 	filippo.io/nistec v0.0.0-20220825075812-a82cab4ea6f0 // indirect
 	github.com/bytemare/hash2curve v0.1.2 // indirect
 	github.com/gtank/ristretto255 v0.1.2 // indirect
-	golang.org/x/crypto v0.5.0 // indirect
+	golang.org/x/crypto v0.6.0 // indirect
 	golang.org/x/sys v0.5.0 // indirect
 )
diff --git a/go.sum b/go.sum
@@ -2,8 +2,8 @@ filippo.io/edwards25519 v1.0.0 h1:0wAIcmJUqRdI8IJ/3eGi5/HwXZWPujYXXlkrQogz0Ek=
 filippo.io/edwards25519 v1.0.0/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
 filippo.io/nistec v0.0.0-20220825075812-a82cab4ea6f0 h1:infQBtlEPAdRCqMIoddLS8K27zaaz05FLnrXskk0TtE=
 filippo.io/nistec v0.0.0-20220825075812-a82cab4ea6f0/go.mod h1:84fxC9mi+MhC2AERXI4LSa8cmSVOzrFikg6hZ4IfCyw=
-github.com/bytemare/crypto v0.4.1 h1:XqbZHc0wuDHJMSRFgF3JLx8ROQmgSkdGKkiDk4br8Xg=
-github.com/bytemare/crypto v0.4.1/go.mod h1:O/pUglImCf2zLj7Ii1FZAaDb4hEV5jcEZCgXVRx4blQ=
+github.com/bytemare/crypto v0.4.2 h1:oiW774YijBNYgtNdrfEUJu0WuIlRRHYumPiY78jojcg=
+github.com/bytemare/crypto v0.4.2/go.mod h1:Np4x+E72kixwgqg5cV/8jZ4ZpIi6rzB30cBW0zb8Q1E=
 github.com/bytemare/hash v0.1.3 h1:E2v/+gqvLTjaR8W2JdhqaB2L9161yFBlSXDnYEyMt94=
 github.com/bytemare/hash v0.1.3/go.mod h1:5WJSSK+ftRTLt9fOMHT+S4eXTTAb0Uz+NJJZKHLKovM=
 github.com/bytemare/hash2curve v0.1.2 h1:V/TSdU/WsfYS3Bk73ap+odLCOOm2/B02rKE8lb91djI=
@@ -12,7 +12,7 @@ github.com/bytemare/ksf v0.1.0 h1:t0VobAtBVSb1SyX1RltuZ+c4gVVHLKQnUN5oYd3o3qc=
 github.com/bytemare/ksf v0.1.0/go.mod h1:wKBp7KmpY482R8lOfcGFh01MsJEU0vZHw8qFEMzNoRU=
 github.com/gtank/ristretto255 v0.1.2 h1:JEqUCPA1NvLq5DwYtuzigd7ss8fwbYay9fi4/5uMzcc=
 github.com/gtank/ristretto255 v0.1.2/go.mod h1:Ph5OpO6c7xKUGROZfWVLiJf9icMDwUeIvY4OmlYW69o=
-golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/internal/configuration.go b/internal/configuration.go
@@ -32,17 +32,16 @@ var ErrConfigurationInvalidLength = errors.New("invalid encoded configuration le
 
 // Configuration is the internal representation of the instance runtime parameters.
 type Configuration struct {
-	KDF             *KDF
-	MAC             *Mac
-	Hash            *Hash
-	KSF             *KSF
-	OPRF            oprf.Identifier
-	Context         []byte
-	NonceLen        int
-	EnvelopeSize    int
-	OPRFPointLength int
-	AkePointLength  int
-	Group           group.Group
+	KDF            *KDF
+	MAC            *Mac
+	Hash           *Hash
+	KSF            *KSF
+	OPRF           oprf.Identifier
+	Context        []byte
+	NonceLen       int
+	EnvelopeSize   int
+	AkePointLength uint
+	Group          group.Group
 }
 
 // RandomBytes returns random bytes of length len (wrapper for crypto/rand).

diff --git a/internal/encoding/group.go b/internal/encoding/group.go
diff --git a/internal/masking/masking.go b/internal/masking/masking.go
@@ -55,8 +55,8 @@ func Unmask(
 ) (serverPublicKey *group.Element, serverPublicKeyBytes []byte, envelope *keyrecovery.Envelope, err error) {
 	maskingKey := conf.KDF.Expand(randomizedPwd, []byte(tag.MaskingKey), conf.Hash.Size())
 	clear := xorResponse(conf, maskingKey, nonce, maskedResponse)
-	serverPublicKeyBytes = clear[:encoding.PointLength[conf.Group]]
-	env := clear[encoding.PointLength[conf.Group]:]
+	serverPublicKeyBytes = clear[:conf.Group.ElementLength()]
+	env := clear[conf.Group.ElementLength():]
 	envelope = &keyrecovery.Envelope{
 		Nonce:   env[:conf.NonceLen],
 		AuthTag: env[conf.NonceLen:],
@@ -77,7 +77,7 @@ func xorResponse(c *internal.Configuration, key, nonce, in []byte) []byte {
 	pad := c.KDF.Expand(
 		key,
 		encoding.SuffixString(nonce, tag.CredentialResponsePad),
-		encoding.PointLength[c.Group]+c.EnvelopeSize,
+		c.Group.ElementLength()+c.EnvelopeSize,
 	)
 
 	dst := make([]byte, len(pad))

diff --git a/internal/oprf/oprf.go b/internal/oprf/oprf.go
@@ -12,7 +12,6 @@ package oprf
 
 import (
 	"crypto"
-	"fmt"
 
 	group "github.com/bytemare/crypto"
 
@@ -57,13 +56,9 @@ func init() {
 }
 
 func (i Identifier) register(g group.Group, h crypto.Hash) {
-	if g.Available() && h.Available() {
-		suites[g] = i
-		groups[i] = g
-		hashes[i] = h
-	} else {
-		panic(fmt.Sprintf("OPRF dependencies not available - Group: %v, Hash: %v", g.Available(), h.Available()))
-	}
+	suites[g] = i
+	groups[i] = g
+	hashes[i] = h
 }
 
 func (i Identifier) dst(prefix string) []byte {
@@ -95,15 +90,6 @@ func (i Identifier) Available() bool {
 		return false
 	}
 
-	// Check for unregistered groups and hashes
-	if _, ok := groups[i]; !ok {
-		return false
-	}
-
-	if _, ok := hashes[i]; !ok {
-		return false
-	}
-
 	return true
 }