Export some missing OPRF pieces. Clean up unit tests.

Author: chris-wood

oprf/oprf.go

@@ -1,6 +1,5 @@
-//
 // Package oprf provides an implementation of Oblivious Pseudorandom Functions
-// (OPRFs), as defined on draft-irtf-cfrg-voprf.
+// (OPRFs), as defined on draft-irtf-cfrg-voprf: https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/
 // It implements:
 // For a Client:
 //   - Blind
@@ -11,8 +10,6 @@
 //   - Setup
 //   - Evaluate
 //   - VerifyFinalize
-// References
-//  - OPRF draft: https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf/
 package oprf
 
 import (
@@ -22,6 +19,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"hash"
+	"io"
 
 	"github.com/cloudflare/circl/oprf/group"
 )
@@ -45,7 +43,7 @@ var (
 
 var (
 	// ErrUnsupportedGroup is an error stating that the ciphersuite chosen is not supported
-	ErrUnsupportedGroup = errors.New("the chosen group is not supported")
+	ErrUnsupportedGroup = errors.New("unsupported group")
 )
 
 // BlindToken corresponds to a token that has been blinded.
@@ -75,21 +73,21 @@ type KeyPair struct {
 
 // Client is a representation of a Client during protocol execution.
 type Client struct {
-	suite *group.Ciphersuite
-	ctx   []byte
+	suite   *group.Ciphersuite
+	context []byte
 }
 
 // Server is a representation of a Server during protocol execution.
 type Server struct {
-	suite *group.Ciphersuite
-	ctx   []byte
-	Kp    *KeyPair
+	suite   *group.Ciphersuite
+	context []byte
+	Kp      *KeyPair
 }
 
 func generateContext(id SuiteID) []byte {
-	ctx := [3]byte{OPRFMode, 0, byte(id)}
+	context := [3]byte{OPRFMode, 0, byte(id)}
 
-	return ctx[:]
+	return context[:]
 }
 
 // Serialize serializes a KeyPair elements into byte arrays.
@@ -132,11 +130,11 @@ func assignKeyPair(suite *group.Ciphersuite, privK, pubK []byte) (*KeyPair, erro
 	return kp, nil
 }
 
-func suiteFromID(id SuiteID, ctx []byte) (*group.Ciphersuite, error) {
+func suiteFromID(id SuiteID, context []byte) (*group.Ciphersuite, error) {
 	var err error
 	var suite *group.Ciphersuite
 
-	suite, err = group.NewSuite(uint16(id), ctx)
+	suite, err = group.NewSuite(uint16(id), context)
 	if err != nil {
 		return nil, err
 	}
@@ -146,26 +144,26 @@ func suiteFromID(id SuiteID, ctx []byte) (*group.Ciphersuite, error) {
 
 // NewServer creates a new instantiation of a Server.
 func NewServer(id SuiteID) (*Server, error) {
-	ctx := generateContext(id)
+	context := generateContext(id)
 
-	suite, err := suiteFromID(id, ctx)
+	suite, err := suiteFromID(id, context)
 	if err != nil {
 		return nil, err
 	}
 	keyPair := GenerateKeyPair(suite)
 
 	return &Server{
-		suite: suite,
-		ctx:   ctx,
-		Kp:    keyPair}, nil
+		suite:   suite,
+		context: context,
+		Kp:      keyPair}, nil
 }
 
 // NewServerWithKeyPair creates a new instantiation of a Server. It can create
 // a server with existing keys or use pre-generated keys.
 func NewServerWithKeyPair(id SuiteID, privK, pubK []byte) (*Server, error) {
-	ctx := generateContext(id)
+	context := generateContext(id)
 
-	suite, err := suiteFromID(id, ctx)
+	suite, err := suiteFromID(id, context)
 	if err != nil {
 		return nil, err
 	}
@@ -176,9 +174,9 @@ func NewServerWithKeyPair(id SuiteID, privK, pubK []byte) (*Server, error) {
 	}
 
 	return &Server{
-		suite: suite,
-		ctx:   ctx,
-		Kp:    keyPair}, nil
+		suite:   suite,
+		context: context,
+		Kp:      keyPair}, nil
 }
 
 // Evaluate blindly signs a client token.
@@ -195,8 +193,18 @@ func (s *Server) Evaluate(b BlindToken) (*Evaluation, error) {
 	return &Evaluation{ser}, nil
 }
 
+func mustWrite(h io.Writer, data []byte) {
+	dataLen, err := h.Write(data)
+	if err != nil {
+		panic(err)
+	}
+	if len(data) != dataLen {
+		panic("failed to write")
+	}
+}
+
 // FinalizeHash computes the final hash for the suite.
-func finalizeHash(c *group.Ciphersuite, data, iToken, info, ctx []byte) []byte {
+func finalizeHash(c *group.Ciphersuite, data, iToken, info, context []byte) []byte {
 	var h hash.Hash
 	if c.Hash == "sha256" {
 		h = sha256.New()
@@ -207,23 +215,23 @@ func finalizeHash(c *group.Ciphersuite, data, iToken, info, ctx []byte) []byte {
 	lenBuf := make([]byte, 2)
 
 	binary.BigEndian.PutUint16(lenBuf, uint16(len(data)))
-	_, _ = h.Write(lenBuf)
-	_, _ = h.Write(data)
+	mustWrite(h, lenBuf)
+	mustWrite(h, data)
 
 	binary.BigEndian.PutUint16(lenBuf, uint16(len(iToken)))
-	_, _ = h.Write(lenBuf)
-	_, _ = h.Write(iToken)
+	mustWrite(h, lenBuf)
+	mustWrite(h, iToken)
 
 	binary.BigEndian.PutUint16(lenBuf, uint16(len(info)))
-	_, _ = h.Write(lenBuf)
-	_, _ = h.Write(info)
+	mustWrite(h, lenBuf)
+	mustWrite(h, info)
 
 	dst := []byte("VOPRF05-Finalize-")
-	dst = append(dst, ctx...)
+	dst = append(dst, context...)
 
 	binary.BigEndian.PutUint16(lenBuf, uint16(len(dst)))
-	_, _ = h.Write(lenBuf)
-	_, _ = h.Write(dst)
+	mustWrite(h, lenBuf)
+	mustWrite(h, dst)
 
 	return h.Sum(nil)
 }
@@ -238,7 +246,7 @@ func (s *Server) FullEvaluate(in, info []byte) ([]byte, error) {
 	t := p.ScalarMult(s.Kp.PrivK)
 	iToken := t.Serialize()
 
-	h := finalizeHash(s.suite, in, iToken, info, s.ctx)
+	h := finalizeHash(s.suite, in, iToken, info, s.context)
 
 	return h, nil
 }
@@ -257,30 +265,30 @@ func (s *Server) VerifyFinalize(in, info, out []byte) bool {
 		return false
 	}
 
-	h := finalizeHash(s.suite, in, e.element, info, s.ctx)
+	h := finalizeHash(s.suite, in, e.element, info, s.context)
 	return subtle.ConstantTimeCompare(h, out) == 1
 }
 
 // NewClient creates a new instantiation of a Client.
 func NewClient(id SuiteID) (*Client, error) {
-	ctx := generateContext(id)
+	context := generateContext(id)
 
-	suite, err := suiteFromID(id, ctx)
+	suite, err := suiteFromID(id, context)
 	if err != nil {
 		return nil, err
 	}
 
 	return &Client{
-		suite: suite,
-		ctx:   ctx}, nil
+		suite:   suite,
+		context: context}, nil
 }
 
 // ClientRequest is a structure to encapsulate the output of a Request call.
 type ClientRequest struct {
-	suite  *group.Ciphersuite
-	ctx    []byte
-	token  *Token
-	bToken BlindToken
+	suite        *group.Ciphersuite
+	context      []byte
+	token        *Token
+	BlindedToken BlindToken
 }
 
 // Request generates a token and its blinded version.
@@ -293,10 +301,10 @@ func (c *Client) Request(in []byte) (*ClientRequest, error) {
 	}
 
 	t := p.ScalarMult(r)
-	bToken := t.Serialize()
+	BlindedToken := t.Serialize()
 
 	tk := &Token{in, r}
-	return &ClientRequest{c.suite, c.ctx, tk, bToken}, nil
+	return &ClientRequest{c.suite, c.context, tk, BlindedToken}, nil
 }
 
 // Finalize computes the signed token from the server Evaluation and returns
@@ -314,6 +322,6 @@ func (cr *ClientRequest) Finalize(e *Evaluation, info []byte) ([]byte, error) {
 	tt := p.ScalarMult(rInv)
 	iToken := tt.Serialize()
 
-	h := finalizeHash(cr.suite, cr.token.data, iToken, info, cr.ctx)
+	h := finalizeHash(cr.suite, cr.token.data, iToken, info, cr.context)
 	return h, nil
 }