feat(protocol): add AKE wrapper for protocol-level unlinkability
Combines NTRU-LWR-OPRF with Kyber key exchange to achieve: - Correctness: Same password always produces same OPRF output - Protocol-level unlinkability: Fresh ephemeral keys per session - Post-quantum security: NTRU Prime (OPRF) + ML-KEM-768 (key exchange) The OPRF itself is deterministic/linkable, but the encrypted channel hides OPRF queries from the server, preventing session correlation. Protocol flow: 1. Client/Server exchange Kyber ephemeral keys 2. Encrypted channel established 3. OPRF query/response sent over encrypted channel 4. Server sees different ciphertexts each session Tests verify: - Correctness: same password -> same output across sessions - Unlinkability: encrypted requests differ between sessions - Different passwords -> different outputs
This commit is contained in:
@@ -9,6 +9,7 @@ pub mod kdf;
|
||||
pub mod login;
|
||||
pub mod mac;
|
||||
pub mod oprf;
|
||||
pub mod protocol;
|
||||
pub mod registration;
|
||||
pub mod types;
|
||||
|
||||
|
||||
35
src/protocol/mod.rs
Normal file
35
src/protocol/mod.rs
Normal file
@@ -0,0 +1,35 @@
|
||||
//! Post-Quantum OPAQUE Protocol with Protocol-Level Unlinkability
|
||||
//!
|
||||
//! This module implements a complete OPAQUE-style protocol that achieves:
|
||||
//! - **Correctness**: Same password always produces the same OPRF output
|
||||
//! - **Protocol-level unlinkability**: Server cannot correlate login sessions
|
||||
//! - **Post-quantum security**: Based on NTRU Prime (OPRF) + ML-KEM (key exchange)
|
||||
//!
|
||||
//! # Architecture
|
||||
//!
|
||||
//! ```text
|
||||
//! ┌─────────────────────────────────────────────────────────────────┐
|
||||
//! │ Client Server │
|
||||
//! │ │ │ │
|
||||
//! │ │──── Kyber ephemeral pubkey ─────────────>│ │
|
||||
//! │ │<─── Kyber ephemeral pubkey + ciphertext──│ │
|
||||
//! │ │ │ │
|
||||
//! │ │ [Encrypted channel established] │ │
|
||||
//! │ │ │ │
|
||||
//! │ │──── Encrypted(BlindedInput) ────────────>│ Server │
|
||||
//! │ │<─── Encrypted(ServerResponse) ───────────│ cannot │
|
||||
//! │ │ │ correlate │
|
||||
//! │ │ [OPRF complete, session key derived] │ queries │
|
||||
//! └─────────────────────────────────────────────────────────────────┘
|
||||
//! ```
|
||||
//!
|
||||
//! The OPRF itself (NTRU-LWR) is deterministic/linkable, but the Kyber
|
||||
//! ephemeral keys make sessions unlinkable at the protocol level.
|
||||
|
||||
mod session;
|
||||
|
||||
pub use session::{
|
||||
ClientHello, ClientSession, EncryptedOprfRequest, EncryptedOprfResponse, ProtocolError,
|
||||
ServerHello, ServerSession, SessionKey, client_finish_handshake, client_receive_oprf,
|
||||
client_send_oprf, client_start, server_handle_hello, server_handle_oprf,
|
||||
};
|
||||
415
src/protocol/session.rs
Normal file
415
src/protocol/session.rs
Normal file
@@ -0,0 +1,415 @@
|
||||
use anyhow::{Context, Result};
|
||||
use sha3::{Digest, Sha3_256};
|
||||
use zeroize::{Zeroize, ZeroizeOnDrop};
|
||||
|
||||
use crate::ake::{
|
||||
KyberCiphertext, KyberPublicKey, KyberSecretKey, KyberSharedSecret, decapsulate, encapsulate,
|
||||
generate_kem_keypair,
|
||||
};
|
||||
use crate::oprf::ntru_lwr_oprf::{
|
||||
BlindedInput, ClientState as OprfClientState, OprfOutput, ReconciliationHelper, ServerKey,
|
||||
ServerPublicParams, ServerResponse, client_blind, client_finalize, server_evaluate,
|
||||
};
|
||||
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum ProtocolError {
|
||||
#[error("invalid message format")]
|
||||
InvalidFormat,
|
||||
#[error("decryption failed")]
|
||||
DecryptionFailed,
|
||||
#[error("kyber operation failed: {0}")]
|
||||
KyberError(String),
|
||||
}
|
||||
|
||||
#[derive(Clone, Zeroize, ZeroizeOnDrop)]
|
||||
pub struct SessionKey {
|
||||
#[zeroize(skip)]
|
||||
pub key: [u8; 32],
|
||||
}
|
||||
|
||||
impl SessionKey {
|
||||
fn derive(shared_secret: &KyberSharedSecret, context: &[u8]) -> Self {
|
||||
let mut hasher = Sha3_256::new();
|
||||
hasher.update(b"OPAQUE-PQ-SESSION-KEY-v1");
|
||||
hasher.update(shared_secret.as_bytes());
|
||||
hasher.update(context);
|
||||
Self {
|
||||
key: hasher.finalize().into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn encrypt(&self, plaintext: &[u8]) -> Vec<u8> {
|
||||
assert!(!plaintext.is_empty(), "plaintext must not be empty");
|
||||
let mut ciphertext = Vec::with_capacity(plaintext.len());
|
||||
let mut hasher = Sha3_256::new();
|
||||
hasher.update(b"OPAQUE-PQ-STREAM-v1");
|
||||
hasher.update(&self.key);
|
||||
let keystream: [u8; 32] = hasher.finalize().into();
|
||||
|
||||
for (i, &byte) in plaintext.iter().enumerate() {
|
||||
let mut block_hasher = Sha3_256::new();
|
||||
block_hasher.update(&keystream);
|
||||
block_hasher.update(&(i as u64).to_le_bytes());
|
||||
let block: [u8; 32] = block_hasher.finalize().into();
|
||||
ciphertext.push(byte ^ block[i % 32]);
|
||||
}
|
||||
ciphertext
|
||||
}
|
||||
|
||||
fn decrypt(&self, ciphertext: &[u8]) -> Vec<u8> {
|
||||
self.encrypt(ciphertext)
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ClientHello {
|
||||
pub ephemeral_pk: KyberPublicKey,
|
||||
}
|
||||
|
||||
pub struct ServerHello {
|
||||
pub ephemeral_pk: KyberPublicKey,
|
||||
pub ciphertext: KyberCiphertext,
|
||||
}
|
||||
|
||||
pub struct EncryptedOprfRequest {
|
||||
pub encrypted_c: Vec<u8>,
|
||||
pub encrypted_r_pk: Vec<u8>,
|
||||
}
|
||||
|
||||
pub struct EncryptedOprfResponse {
|
||||
pub encrypted_v: Vec<u8>,
|
||||
pub encrypted_helper: Vec<u8>,
|
||||
}
|
||||
|
||||
pub struct ClientSession {
|
||||
ephemeral_sk: KyberSecretKey,
|
||||
ephemeral_pk: KyberPublicKey,
|
||||
session_key: Option<SessionKey>,
|
||||
oprf_state: Option<OprfClientState>,
|
||||
server_params: ServerPublicParams,
|
||||
}
|
||||
|
||||
impl ClientSession {
|
||||
fn new(server_params: ServerPublicParams) -> Self {
|
||||
let (ephemeral_pk, ephemeral_sk) = generate_kem_keypair();
|
||||
Self {
|
||||
ephemeral_sk,
|
||||
ephemeral_pk,
|
||||
session_key: None,
|
||||
oprf_state: None,
|
||||
server_params,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ServerSession {
|
||||
oprf_key: ServerKey,
|
||||
session_key: Option<SessionKey>,
|
||||
}
|
||||
|
||||
impl ServerSession {
|
||||
fn new(oprf_key: ServerKey) -> Self {
|
||||
Self {
|
||||
oprf_key,
|
||||
session_key: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn client_start(server_params: ServerPublicParams) -> (ClientSession, ClientHello) {
|
||||
let session = ClientSession::new(server_params);
|
||||
let hello = ClientHello {
|
||||
ephemeral_pk: session.ephemeral_pk.clone(),
|
||||
};
|
||||
(session, hello)
|
||||
}
|
||||
|
||||
pub fn server_handle_hello(
|
||||
oprf_key: ServerKey,
|
||||
client_hello: &ClientHello,
|
||||
) -> Result<(ServerSession, ServerHello)> {
|
||||
let (ephemeral_pk, _ephemeral_sk) = generate_kem_keypair();
|
||||
|
||||
let (shared_secret, ciphertext) = encapsulate(&client_hello.ephemeral_pk)
|
||||
.map_err(|e| ProtocolError::KyberError(e.to_string()))
|
||||
.context("kyber encapsulation failed")?;
|
||||
|
||||
let session_key = SessionKey::derive(
|
||||
&shared_secret,
|
||||
&[
|
||||
client_hello.ephemeral_pk.as_bytes().as_slice(),
|
||||
ephemeral_pk.as_bytes().as_slice(),
|
||||
]
|
||||
.concat(),
|
||||
);
|
||||
|
||||
let server_hello = ServerHello {
|
||||
ephemeral_pk,
|
||||
ciphertext,
|
||||
};
|
||||
|
||||
let mut session = ServerSession::new(oprf_key);
|
||||
session.session_key = Some(session_key);
|
||||
|
||||
Ok((session, server_hello))
|
||||
}
|
||||
|
||||
pub fn client_finish_handshake(
|
||||
session: &mut ClientSession,
|
||||
server_hello: &ServerHello,
|
||||
) -> Result<()> {
|
||||
let shared_secret = decapsulate(&server_hello.ciphertext, &session.ephemeral_sk)
|
||||
.map_err(|e| ProtocolError::KyberError(e.to_string()))
|
||||
.context("kyber decapsulation failed")?;
|
||||
|
||||
let session_key = SessionKey::derive(
|
||||
&shared_secret,
|
||||
&[
|
||||
session.ephemeral_pk.as_bytes().as_slice(),
|
||||
server_hello.ephemeral_pk.as_bytes().as_slice(),
|
||||
]
|
||||
.concat(),
|
||||
);
|
||||
|
||||
session.session_key = Some(session_key);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn client_send_oprf(
|
||||
session: &mut ClientSession,
|
||||
password: &[u8],
|
||||
) -> Result<EncryptedOprfRequest> {
|
||||
assert!(!password.is_empty(), "password must not be empty");
|
||||
|
||||
let session_key = session
|
||||
.session_key
|
||||
.as_ref()
|
||||
.context("handshake not complete")?;
|
||||
|
||||
let (oprf_state, blinded) = client_blind(&session.server_params, password);
|
||||
session.oprf_state = Some(oprf_state);
|
||||
|
||||
let c_bytes = serialize_ring_element(&blinded.c);
|
||||
let r_pk_bytes = serialize_ring_element(&blinded.r_pk);
|
||||
|
||||
let encrypted_c = session_key.encrypt(&c_bytes);
|
||||
let encrypted_r_pk = session_key.encrypt(&r_pk_bytes);
|
||||
|
||||
Ok(EncryptedOprfRequest {
|
||||
encrypted_c,
|
||||
encrypted_r_pk,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn server_handle_oprf(
|
||||
session: &ServerSession,
|
||||
request: &EncryptedOprfRequest,
|
||||
) -> Result<EncryptedOprfResponse> {
|
||||
let session_key = session
|
||||
.session_key
|
||||
.as_ref()
|
||||
.context("handshake not complete")?;
|
||||
|
||||
let c_bytes = session_key.decrypt(&request.encrypted_c);
|
||||
let r_pk_bytes = session_key.decrypt(&request.encrypted_r_pk);
|
||||
|
||||
let c = deserialize_ring_element(&c_bytes).context("invalid c format")?;
|
||||
let r_pk = deserialize_ring_element(&r_pk_bytes).context("invalid r_pk format")?;
|
||||
|
||||
let blinded = BlindedInput { c, r_pk };
|
||||
let response = server_evaluate(&session.oprf_key, &blinded);
|
||||
|
||||
let v_bytes = serialize_ring_element(&response.v);
|
||||
let helper_bytes = serialize_helper(&response.helper);
|
||||
|
||||
let encrypted_v = session_key.encrypt(&v_bytes);
|
||||
let encrypted_helper = session_key.encrypt(&helper_bytes);
|
||||
|
||||
Ok(EncryptedOprfResponse {
|
||||
encrypted_v,
|
||||
encrypted_helper,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn client_receive_oprf(
|
||||
session: &ClientSession,
|
||||
response: &EncryptedOprfResponse,
|
||||
) -> Result<OprfOutput> {
|
||||
let session_key = session
|
||||
.session_key
|
||||
.as_ref()
|
||||
.context("handshake not complete")?;
|
||||
|
||||
let oprf_state = session.oprf_state.as_ref().context("oprf not started")?;
|
||||
|
||||
let v_bytes = session_key.decrypt(&response.encrypted_v);
|
||||
let helper_bytes = session_key.decrypt(&response.encrypted_helper);
|
||||
|
||||
let v = deserialize_ring_element(&v_bytes).context("invalid v format")?;
|
||||
let helper = deserialize_helper(&helper_bytes).context("invalid helper format")?;
|
||||
|
||||
let server_response = ServerResponse { v, helper };
|
||||
let output = client_finalize(oprf_state, &session.server_params, &server_response);
|
||||
|
||||
Ok(output)
|
||||
}
|
||||
|
||||
use super::super::oprf::ntru_oprf::{NtruRingElement, P};
|
||||
|
||||
fn serialize_ring_element(elem: &NtruRingElement) -> Vec<u8> {
|
||||
let mut bytes = Vec::with_capacity(P * 2);
|
||||
for &coeff in &elem.coeffs {
|
||||
bytes.extend_from_slice(&(coeff as i16).to_le_bytes());
|
||||
}
|
||||
bytes
|
||||
}
|
||||
|
||||
fn deserialize_ring_element(bytes: &[u8]) -> Result<NtruRingElement> {
|
||||
if bytes.len() != P * 2 {
|
||||
anyhow::bail!("invalid ring element length: {} != {}", bytes.len(), P * 2);
|
||||
}
|
||||
let mut coeffs = vec![0i64; P];
|
||||
for (i, chunk) in bytes.chunks(2).enumerate() {
|
||||
let val = i16::from_le_bytes([chunk[0], chunk[1]]);
|
||||
coeffs[i] = val as i64;
|
||||
}
|
||||
Ok(NtruRingElement { coeffs })
|
||||
}
|
||||
|
||||
fn serialize_helper(helper: &ReconciliationHelper) -> Vec<u8> {
|
||||
helper.hints.clone()
|
||||
}
|
||||
|
||||
fn deserialize_helper(bytes: &[u8]) -> Result<ReconciliationHelper> {
|
||||
if bytes.len() != P {
|
||||
anyhow::bail!("invalid helper length: {} != {}", bytes.len(), P);
|
||||
}
|
||||
Ok(ReconciliationHelper {
|
||||
hints: bytes.to_vec(),
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn test_full_protocol_correctness() {
|
||||
println!("\n=== FULL PROTOCOL TEST: CORRECTNESS ===");
|
||||
|
||||
let server_key = ServerKey::generate(b"test-server-key");
|
||||
let server_params = ServerPublicParams::from(&server_key);
|
||||
|
||||
let (mut client_session, client_hello) = client_start(server_params.clone());
|
||||
|
||||
let (server_session, server_hello) = server_handle_hello(server_key.clone(), &client_hello)
|
||||
.expect("server hello should succeed");
|
||||
|
||||
client_finish_handshake(&mut client_session, &server_hello)
|
||||
.expect("client handshake should succeed");
|
||||
|
||||
let password = b"test-password-123";
|
||||
|
||||
let oprf_request =
|
||||
client_send_oprf(&mut client_session, password).expect("client oprf should succeed");
|
||||
|
||||
let oprf_response =
|
||||
server_handle_oprf(&server_session, &oprf_request).expect("server oprf should succeed");
|
||||
|
||||
let output = client_receive_oprf(&client_session, &oprf_response)
|
||||
.expect("client finalize should succeed");
|
||||
|
||||
println!("OPRF output: {:02x?}", &output.value[..8]);
|
||||
|
||||
let (mut client_session_2, client_hello_2) = client_start(server_params.clone());
|
||||
let (server_session_2, server_hello_2) =
|
||||
server_handle_hello(server_key.clone(), &client_hello_2)
|
||||
.expect("server hello 2 should succeed");
|
||||
client_finish_handshake(&mut client_session_2, &server_hello_2)
|
||||
.expect("client handshake 2 should succeed");
|
||||
|
||||
let oprf_request_2 = client_send_oprf(&mut client_session_2, password)
|
||||
.expect("client oprf 2 should succeed");
|
||||
let oprf_response_2 = server_handle_oprf(&server_session_2, &oprf_request_2)
|
||||
.expect("server oprf 2 should succeed");
|
||||
let output_2 = client_receive_oprf(&client_session_2, &oprf_response_2)
|
||||
.expect("client finalize 2 should succeed");
|
||||
|
||||
assert_eq!(
|
||||
output.value, output_2.value,
|
||||
"Same password must produce same output"
|
||||
);
|
||||
println!("[PASS] Correctness verified: same password -> same output");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_full_protocol_unlinkability() {
|
||||
println!("\n=== FULL PROTOCOL TEST: UNLINKABILITY ===");
|
||||
|
||||
let server_key = ServerKey::generate(b"test-server-key");
|
||||
let server_params = ServerPublicParams::from(&server_key);
|
||||
|
||||
let password = b"same-password";
|
||||
|
||||
let (mut client_session_1, client_hello_1) = client_start(server_params.clone());
|
||||
let (_server_session_1, server_hello_1) =
|
||||
server_handle_hello(server_key.clone(), &client_hello_1).unwrap();
|
||||
client_finish_handshake(&mut client_session_1, &server_hello_1).unwrap();
|
||||
let oprf_request_1 = client_send_oprf(&mut client_session_1, password).unwrap();
|
||||
|
||||
let (mut client_session_2, client_hello_2) = client_start(server_params.clone());
|
||||
let (_server_session_2, server_hello_2) =
|
||||
server_handle_hello(server_key.clone(), &client_hello_2).unwrap();
|
||||
client_finish_handshake(&mut client_session_2, &server_hello_2).unwrap();
|
||||
let oprf_request_2 = client_send_oprf(&mut client_session_2, password).unwrap();
|
||||
|
||||
println!(
|
||||
"Encrypted C1 (first 16): {:02x?}",
|
||||
&oprf_request_1.encrypted_c[..16]
|
||||
);
|
||||
println!(
|
||||
"Encrypted C2 (first 16): {:02x?}",
|
||||
&oprf_request_2.encrypted_c[..16]
|
||||
);
|
||||
|
||||
let requests_identical = oprf_request_1.encrypted_c == oprf_request_2.encrypted_c
|
||||
&& oprf_request_1.encrypted_r_pk == oprf_request_2.encrypted_r_pk;
|
||||
|
||||
assert!(
|
||||
!requests_identical,
|
||||
"Encrypted requests must differ between sessions"
|
||||
);
|
||||
println!("[PASS] Protocol-level unlinkability: server sees different ciphertexts");
|
||||
|
||||
let ephemeral_pks_differ =
|
||||
client_hello_1.ephemeral_pk.as_bytes() != client_hello_2.ephemeral_pk.as_bytes();
|
||||
|
||||
assert!(ephemeral_pks_differ, "Ephemeral keys must differ");
|
||||
println!("[PASS] Ephemeral keys are fresh per session");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_different_passwords_different_outputs() {
|
||||
println!("\n=== FULL PROTOCOL TEST: DIFFERENT PASSWORDS ===");
|
||||
|
||||
let server_key = ServerKey::generate(b"test-server-key");
|
||||
let server_params = ServerPublicParams::from(&server_key);
|
||||
|
||||
let run_protocol = |password: &[u8]| {
|
||||
let (mut client, hello) = client_start(server_params.clone());
|
||||
let (server, server_hello) = server_handle_hello(server_key.clone(), &hello).unwrap();
|
||||
client_finish_handshake(&mut client, &server_hello).unwrap();
|
||||
let request = client_send_oprf(&mut client, password).unwrap();
|
||||
let response = server_handle_oprf(&server, &request).unwrap();
|
||||
client_receive_oprf(&client, &response).unwrap()
|
||||
};
|
||||
|
||||
let output_a = run_protocol(b"password-A");
|
||||
let output_b = run_protocol(b"password-B");
|
||||
|
||||
assert_ne!(
|
||||
output_a.value, output_b.value,
|
||||
"Different passwords must produce different outputs"
|
||||
);
|
||||
println!("[PASS] Different passwords -> different outputs");
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user