Implements Verifiable modes: VOPRF and POPRF

src/client.ts

@@ -3,34 +3,54 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { Blind, Blinded, Evaluation, Oprf } from './oprf.js'
+import {
+    Blind,
+    Blinded,
+    Evaluation,
+    EvaluationRequest,
+    FinalizeData,
+    ModeID,
+    Oprf,
+    SuiteID
+} from './oprf.js'
 import { Group, Scalar } from './group.js'
 
-export class OPRFClient extends Oprf {
+class baseClient extends Oprf {
+    constructor(mode: ModeID, suite: SuiteID) {
+        super(mode, suite)
+    }
+
     async randomBlinder(): Promise<{ scalar: Scalar; blind: Blind }> {
-        const scalar = await this.params.gg.randomScalar()
-        const blind = new Blind(this.params.gg.serializeScalar(scalar))
+        const scalar = await this.gg.randomScalar()
+        const blind = new Blind(this.gg.serializeScalar(scalar))
         return { scalar, blind }
     }
 
-    async blind(input: Uint8Array): Promise<{ blind: Blind; blindedElement: Blinded }> {
+    async blind(input: Uint8Array): Promise<[FinalizeData, EvaluationRequest]> {
         const { scalar, blind } = await this.randomBlinder()
-        const dst = Oprf.getHashToGroupDST(this.params.id)
-        const P = await this.params.gg.hashToGroup(input, dst)
-        if (this.params.gg.isIdentity(P)) {
+        const dst = this.getDST(Oprf.LABELS.HashToGroupDST)
+        const P = await this.gg.hashToGroup(input, dst)
+        if (this.gg.isIdentity(P)) {
             throw new Error('InvalidInputError')
         }
         const Q = Group.mul(scalar, P)
-        const blindedElement = new Blinded(this.params.gg.serialize(Q))
-        return { blind, blindedElement }
+        const evalReq = new EvaluationRequest(new Blinded(this.gg.serialize(Q)))
+        const finData = new FinalizeData(input, blind, evalReq)
+        return [finData, evalReq]
     }
 
-    finalize(input: Uint8Array, blind: Blind, evaluation: Evaluation): Promise<Uint8Array> {
-        const blindScalar = this.params.gg.deserializeScalar(blind)
-        const blindScalarInv = this.params.gg.invScalar(blindScalar)
-        const Z = this.params.gg.deserialize(evaluation)
+    finalize(finData: FinalizeData, evaluation: Evaluation): Promise<Uint8Array> {
+        const blindScalar = this.gg.deserializeScalar(finData.blind)
+        const blindScalarInv = this.gg.invScalar(blindScalar)
+        const Z = this.gg.deserialize(evaluation.element)
         const N = Group.mul(blindScalarInv, Z)
-        const unblinded = this.params.gg.serialize(N)
-        return this.coreFinalize(input, unblinded)
+        const unblinded = this.gg.serialize(N)
+        return this.coreFinalize(finData.input, unblinded)
+    }
+}
+
+export class OPRFClient extends baseClient {
+    constructor(suite: SuiteID) {
+        super(Oprf.Mode.OPRF, suite)
     }
 }

src/group.ts

@@ -3,7 +3,7 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { hashParams, joinAll, xor } from './util.js'
+import { joinAll, xor } from './util.js'
 
 import sjcl from './sjcl/index.js'
 
@@ -20,6 +20,24 @@ export type Scalar = sjcl.bn
 export type Curve = sjcl.ecc.curve
 export type FieldElt = sjcl.bn
 
+function hashParams(hash: string): {
+    outLenBytes: number // returns the size in bytes of the output.
+    blockLenBytes: number // returns the size of the internal block.
+} {
+    switch (hash) {
+        case 'SHA-1':
+            return { outLenBytes: 20, blockLenBytes: 64 }
+        case 'SHA-256':
+            return { outLenBytes: 32, blockLenBytes: 64 }
+        case 'SHA-384':
+            return { outLenBytes: 48, blockLenBytes: 128 }
+        case 'SHA-512':
+            return { outLenBytes: 64, blockLenBytes: 128 }
+        default:
+            throw new Error(`invalid hash name: ${hash}`)
+    }
+}
+
 async function expandXMD(
     hash: string,
     msg: Uint8Array,

src/keys.ts

@@ -3,84 +3,86 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { Oprf, OprfID } from './oprf.js'
-import { SerializedElt, SerializedScalar } from './group.js'
+import { ModeID, Oprf, SuiteID } from './oprf.js'
+import { Scalar, SerializedElt, SerializedScalar } from './group.js'
 import { joinAll, to16bits } from './util.js'
 
-export function getKeySizes(id: OprfID): { Nsk: number; Npk: number } {
-    const { gg } = Oprf.params(id)
+export function getKeySizes(id: SuiteID): { Nsk: number; Npk: number } {
+    const gg = Oprf.getGroup(id)
     return { Nsk: gg.size, Npk: 1 + gg.size }
 }
 
-export function validatePrivateKey(id: OprfID, privateKey: Uint8Array): boolean {
+export function validatePrivateKey(id: SuiteID, privateKey: Uint8Array): boolean {
     try {
-        const { gg } = Oprf.params(id)
+        const gg = Oprf.getGroup(id)
         const s = gg.deserializeScalar(new SerializedScalar(privateKey))
         return !s.equals(0)
     } catch (_) {
         return false
     }
 }
 
-export function validatePublicKey(id: OprfID, publicKey: Uint8Array): boolean {
+export function validatePublicKey(id: SuiteID, publicKey: Uint8Array): boolean {
     try {
-        const { gg } = Oprf.params(id)
+        const gg = Oprf.getGroup(id)
         const P = gg.deserialize(new SerializedElt(publicKey))
         return !P.isIdentity
     } catch (_) {
         return false
     }
 }
 
-export async function randomPrivateKey(id: OprfID): Promise<Uint8Array> {
-    const { gg } = Oprf.params(id)
+export async function randomPrivateKey(id: SuiteID): Promise<Uint8Array> {
+    const gg = Oprf.getGroup(id)
     const priv = await gg.randomScalar()
     return new Uint8Array(gg.serializeScalar(priv))
 }
 
 export async function derivePrivateKey(
-    id: OprfID,
+    mode: ModeID,
+    id: SuiteID,
     seed: Uint8Array,
     info: Uint8Array
 ): Promise<Uint8Array> {
-    const { gg } = Oprf.params(id)
+    const gg = Oprf.getGroup(id)
     const deriveInput = joinAll([seed, to16bits(info.length), info])
     let counter = 0
-    let priv
+    let priv: Scalar
 
     do {
         if (counter > 255) {
             throw new Error('DeriveKeyPairError')
         }
         const hashInput = joinAll([deriveInput, Uint8Array.from([counter])])
-        priv = await gg.hashToScalar(hashInput, Oprf.getDeriveKeyPairDST(id))
+        priv = await gg.hashToScalar(hashInput, Oprf.getDST(mode, id, Oprf.LABELS.DeriveKeyPairDST))
         counter++
     } while (gg.isScalarZero(priv))
 
     return new Uint8Array(gg.serializeScalar(priv))
 }
 
-export function generatePublicKey(id: OprfID, privateKey: Uint8Array): Uint8Array {
-    const { gg } = Oprf.params(id)
+export function generatePublicKey(id: SuiteID, privateKey: Uint8Array): Uint8Array {
+    const gg = Oprf.getGroup(id)
     const priv = gg.deserializeScalar(new SerializedScalar(privateKey))
     const pub = gg.mulBase(priv)
     return new Uint8Array(gg.serialize(pub))
 }
 
 export async function generateKeyPair(
-    id: OprfID
+    id: SuiteID
 ): Promise<{ privateKey: Uint8Array; publicKey: Uint8Array }> {
     const privateKey = await randomPrivateKey(id)
     const publicKey = generatePublicKey(id, privateKey)
     return { privateKey, publicKey }
 }
 
 export async function deriveKeyPair(
-    id: OprfID,
+    mode: ModeID,
+    id: SuiteID,
     seed: Uint8Array,
     info: Uint8Array
 ): Promise<{ privateKey: Uint8Array; publicKey: Uint8Array }> {
-    const privateKey = await derivePrivateKey(id, seed, info)
+    const privateKey = await derivePrivateKey(mode, id, seed, info)
     const publicKey = generatePublicKey(id, privateKey)
     return { privateKey, publicKey }
 }