search

cfrg / draft-irtf-cfrg-voprf

Oblivious Pseudorandom Functions (OPRFs) using Prime-Order Groups
https://cfrg.github.io/draft-irtf-cfrg-voprf/#go.draft-irtf-cfrg-voprf.html
Other
39 stars 15 forks source link

`HashToGroup` and `HashToScalar` can produce invalid keys #305

Closed daxpedda closed 2 years ago

daxpedda commented 2 years ago

HashToGroup can produce the identity element and HashToScalar can produce a zero scalar. It is extremely unlikely though.

Currently it's not specified how to behave when this happens. Potentially, on failure to produce a valid output, the program might just automatically try again, which would simply be rejection sampling. Maybe that's fine, IANA cryptographer.

In addition DeriveKeyPair relies on HashToScalar, but it's currently undefined how to handler zero scalars.

def DeriveKeyPair(mode, suite, seed):
  skS = GG.HashToScalar(seed, DST = "HashToScalar-" || contextString)
  pkS = ScalarBaseMult(skS)
  return skS, pkS

https://www.ietf.org/archive/id/draft-irtf-cfrg-voprf-08.html#section-2.1-5

Two functions can be used for generating a (V)OPRF key pair (skS, pkS) where skS is a non-zero integer less than p and pkS = ScalarBaseMult(skS): GenerateKeyPair and DeriveKeyPair.

Related: cfrg/draft-irtf-cfrg-opaque#298.

chris-wood commented 2 years ago

Let's track this in #307.