armfazh/h2c-rust-ref

[RFC9380] Hash to curves - Rust reference implementation

Hashing to Elliptic Curves

---

IETF Data Tracker: draft-irtf-cfrg-hash-to-curve

Internet-Draft: git repository

This document specifies a number of algorithms that may be used to encode or hash an arbitrary string to a point on an elliptic curve.

Reference Implementation

The purpose of this implementation is for generating test vectors and enabling cross compatibility with other implementations.

Warning

This implementation is not protected against any kind of attack, including side-channel attacks. It MUST NOT be used in production systems.

Limitations

• No specific architecture optimizations.
• No side-channel protection, see Warning section.

Development branch master

Draft versions implemented

Latest: v14

Previous: v12, v08, v07, v06, v05

Compatible Implementations

• Sage
• Go

Internals

License

BSD 3-Clause License

Contact

Feel free to open a github issue for anything related to the implementation, otherwise e-mail authors of the draft.

h2c-rust-ref's Issues

Remove alloc dependancy

A priori, hasher code like this should really run without an alloc or std dependency, so in particular Vec should not be used anywhere. It may be unavoidable if the standard is bad of course, but things like an XoF mode clearly never need Vec. There is also a lot of redundant hashing.

An expander trait could look like this for example:

pub trait Expander {
    fn construct_dst_prime(&self) -> ArrayVec::<[u8; { MAX_DST_LENGTH +1 }]>;
    fn expand<const LENGTH: usize>(&self, msg: &[u8]) -> [u8; LENGTH];
}

As this trait is internal, construct_dst_prime should really be some setup method, thus avoiding the AtomicRefCell, so maybe:

pub trait Expander {
    fn set_dst(&mut self, dst: &[u8]);
    fn expand<const LENGTH: usize>(&self, msg: &[u8]) -> [u8; LENGTH];
}

pub(super) struct ExpanderXof<T: Update + Clone + ExtendableOutput> {
    pub(super) xofer: T,
    pub(super) dst_prime: ArrayVec::<[u8; { MAX_DST_LENGTH +1 }]>,
    pub(super) k: usize,
}

pub(super) struct ExpanderXmd<T: DynDigest + Clone> {
    pub(super) hasher: T,
    pub(super) dst_prime: ArrayVec::<[u8; { MAX_DST_LENGTH +1 }]>,
    pub(super) block_size: usize,
}

Also, MAX_DST_LENGTH = 256 is enforced by the "I2OSP(len(DST), 1)" in the standard, but where does this DST shortening logic? I'm only seeing "ABORT .. if len(DST) > 256" in https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/16/

change sha512 to shake on curves over GF(P448)

Change expander method from sha512 to shake on curves over GF(P448)