extras: Add EC toolbox abstractions and OPRF(P-384, SHA-384) VOPRF API #292

simonjbeaumont · 2024-11-06T11:00:17Z

Motivation

We would like to provide support for the P384-SHA384 Verifiable Oblivious Pseudorandom Function (VOPRF) as defined in RFC 9497: VOPRF Protocol.

Modifications

Add protocols for some "ECToolbox" abstractions: Group, GroupElement, GroupScalar, HashToGroup.
Add implementations backed by BoringSSL.
Duplicate some utilities from Crypto into _CryptoExtras: hexadecimal bytes and I2OSP.
Add VOPRF API, rooted at enum P384._VOPRF.

Results

New internal abstractions that make it easier to bring up new implementations.
New API for OPRF(P-384, SHA-384) in VOPRF mode.

Tests

Test vectors for internal HashToField implementation.
Test vectors for internal VOPRF implementation.
Tests of the VOPRF public API.

simonjbeaumont · 2024-11-11T10:24:26Z

@Lukasa PTAL when you have time 🙏

Lukasa · 2024-11-20T11:48:17Z

Sources/CryptoBoringWrapper/EC/EllipticCurve.swift

@@ -72,6 +72,14 @@ extension BoringSSLEllipticCurveGroup {
        return try! ArbitraryPrecisionInteger(copying: baseOrder)
    }

+    @usableFromInline
+    package var generator: EllipticCurvePoint { get throws {


Might be worth not squishing this in, get throws { can be on its own line.

OK, I moved this onto its own line.

Aside: I have a task to add the swift-format job to this repo soon, which will squash all these inconsistencies away.

Lukasa · 2024-11-20T11:49:18Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+            try group.withUnsafeGroupPointer { groupPtr in
+                guard
+                    let pointPtr = CCryptoBoringSSL_EC_POINT_new(groupPtr),
+                    CCryptoBoringSSL_EC_POINT_mul(groupPtr, pointPtr, scalarPtr, nil, nil, nil) == 1


Not a new issue, but this leaks the pointPtr if the mul fails.

I've addressed this by factoring out the EC_POINT_new into a designated init(_pointAtInfinityOn group:) and made all these convenience initialisers.

Lukasa · 2024-11-20T11:50:33Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+                try domainSeparationTag.withUnsafeBytes { dstPtr in
+                    guard
+                        let pointPtr = CCryptoBoringSSL_EC_POINT_new(groupPtr),
+                        hashToCurveFunction(


If this fails, we leak the point.

Resolved in the same manner as https://github.com/apple/swift-crypto/pull/292/files/fda1a2c6df294e87b24b77ad28a7cd5950d74d25#r1850181741.

Lukasa · 2024-11-20T11:51:11Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+                    switch CCryptoBoringSSL_EC_POINT_cmp(groupPtr, selfPtr, rhsPtr, nil) {
+                    case 0: return true
+                    case 1: return false
+                    default: fatalError("Unexpected error testing EC point equality")


I don't know that we need to be this strict. 0 is true, everything else is false. Happy to have an assertion for the other codes, but probably shouldn't fatal error.

I think that's not quite right since the docs say that EC_POINT_cmp can return an error:

EC_POINT_cmp returns 1 if the points are not equal, 0 if they are, or -1 on error.

I think this can happen if you provide a point on a different group for an equality test, for instance.

This function isn't throwing so the best we can do is fatal error, which seems to be in line with what we do elsewhere?

I'm not sure we need the error to be this loud, though. Perhaps we drop this to an assertion and then return false?

After further consideration, given we allow folks to pass in the group, we shouldn't even assert, but just return false if comparing two points from different groups.

I've updated the code to clear the BoringSSL error and return false in this scenario.

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

simonjbeaumont

Thanks for the feedback @Lukasa. I've addressed your comments. Could you take another look when you get a minute.

simonjbeaumont · 2024-11-20T20:01:12Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+                    switch CCryptoBoringSSL_EC_POINT_cmp(groupPtr, selfPtr, rhsPtr, nil) {
+                    case 0: return true
+                    case 1: return false
+                    default: fatalError("Unexpected error testing EC point equality")


I think that's not quite right since the docs say that EC_POINT_cmp can return an error:

EC_POINT_cmp returns 1 if the points are not equal, 0 if they are, or -1 on error.

I think this can happen if you provide a point on a different group for an equality test, for instance.

This function isn't throwing so the best we can do is fatal error, which seems to be in line with what we do elsewhere?

simonjbeaumont · 2024-11-20T20:02:47Z

Sources/CryptoBoringWrapper/EC/EllipticCurve.swift

@@ -72,6 +72,14 @@ extension BoringSSLEllipticCurveGroup {
        return try! ArbitraryPrecisionInteger(copying: baseOrder)
    }

+    @usableFromInline
+    package var generator: EllipticCurvePoint { get throws {


OK, I moved this onto its own line.

Aside: I have a task to add the swift-format job to this repo soon, which will squash all these inconsistencies away.

simonjbeaumont · 2024-11-20T20:06:14Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+            try group.withUnsafeGroupPointer { groupPtr in
+                guard
+                    let pointPtr = CCryptoBoringSSL_EC_POINT_new(groupPtr),
+                    CCryptoBoringSSL_EC_POINT_mul(groupPtr, pointPtr, scalarPtr, nil, nil, nil) == 1


I've addressed this by factoring out the EC_POINT_new into a designated init(_pointAtInfinityOn group:) and made all these convenience initialisers.

simonjbeaumont · 2024-11-20T20:06:41Z

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

+                try domainSeparationTag.withUnsafeBytes { dstPtr in
+                    guard
+                        let pointPtr = CCryptoBoringSSL_EC_POINT_new(groupPtr),
+                        hashToCurveFunction(


Resolved in the same manner as https://github.com/apple/swift-crypto/pull/292/files/fda1a2c6df294e87b24b77ad28a7cd5950d74d25#r1850181741.

Sources/CryptoBoringWrapper/EC/EllipticCurvePoint.swift

…ty test

Lukasa

Nice one, thanks @simonjbeaumont!

simonjbeaumont · 2024-11-21T19:41:13Z

Thanks @Lukasa :) please merge when convenient.

simonjbeaumont added 3 commits November 6, 2024 09:05

extras: Add ECToolbox abstraction, H2G, DLEQ, and VOPRF

4e82c4b

shims: Add shims for EC_hash_to_curve_*, EC_POINT_point2oct

170b62d

wrapper: Add more EC functions to support ECToolbox

2719c48

simonjbeaumont marked this pull request as draft November 6, 2024 11:01

simonjbeaumont added 5 commits November 6, 2024 11:12

extras: Duplicate PrettyBytes and I2OSP from Crypto module

47b558b

extras: Add XCTestAssertThrowsError utility for equatable errors

8e7607c

extras: Implement ECToolbox backend using BoringSSL

107f879

extras: Add public VOPRF API and tests

aa6c637

cmake: Update CMakeLists

0807220

simonjbeaumont force-pushed the sb/voprf-p384-sha384 branch from c1c4ba9 to 0807220 Compare November 6, 2024 11:15

Add availability guards

fda1a2c

simonjbeaumont force-pushed the sb/voprf-p384-sha384 branch from 9e94b78 to fda1a2c Compare November 6, 2024 13:36

simonjbeaumont marked this pull request as ready for review November 8, 2024 13:37

Lukasa added the 🆕 semver/minor Adds new public API. label Nov 20, 2024

Lukasa reviewed Nov 20, 2024

View reviewed changes

simonjbeaumont added 2 commits November 20, 2024 20:03

feedback: Move getter effects onto own line

857b1a9

feedback: Avoid leaks from errors in class init

4534eaf

simonjbeaumont commented Nov 20, 2024

View reviewed changes

simonjbeaumont requested a review from Lukasa November 20, 2024 20:08

feedback: Swallow error from EC_POINT_cmp and return false for equali…

65325b4

…ty test

Lukasa approved these changes Nov 21, 2024

View reviewed changes

Merge branch 'main' into sb/voprf-p384-sha384

24119bd

Lukasa enabled auto-merge (squash) November 22, 2024 09:26

Lukasa merged commit ff0f781 into apple:main Nov 22, 2024
31 of 34 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

extras: Add EC toolbox abstractions and OPRF(P-384, SHA-384) VOPRF API #292

extras: Add EC toolbox abstractions and OPRF(P-384, SHA-384) VOPRF API #292

simonjbeaumont commented Nov 6, 2024 •

edited

Loading

simonjbeaumont commented Nov 11, 2024

Lukasa Nov 20, 2024

simonjbeaumont Nov 20, 2024

Lukasa Nov 20, 2024

simonjbeaumont Nov 20, 2024

Lukasa Nov 20, 2024

simonjbeaumont Nov 20, 2024

Lukasa Nov 20, 2024

simonjbeaumont Nov 20, 2024

Lukasa Nov 21, 2024

simonjbeaumont Nov 21, 2024

simonjbeaumont left a comment

simonjbeaumont Nov 20, 2024

simonjbeaumont Nov 20, 2024

simonjbeaumont Nov 20, 2024

simonjbeaumont Nov 20, 2024

Lukasa left a comment

simonjbeaumont commented Nov 21, 2024

extras: Add EC toolbox abstractions and OPRF(P-384, SHA-384) VOPRF API #292

extras: Add EC toolbox abstractions and OPRF(P-384, SHA-384) VOPRF API #292

Conversation

simonjbeaumont commented Nov 6, 2024 • edited Loading

Motivation

Modifications

Results

Tests

simonjbeaumont commented Nov 11, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

simonjbeaumont left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Lukasa left a comment

Choose a reason for hiding this comment

simonjbeaumont commented Nov 21, 2024

simonjbeaumont commented Nov 6, 2024 •

edited

Loading