pakery_opaque/
server_setup.rs

1//! Server long-term setup for OPAQUE.
2
3use alloc::vec;
4use alloc::vec::Vec;
5
6use crate::ciphersuite::OpaqueCiphersuite;
7use pakery_core::crypto::DhGroup;
8use rand_core::CryptoRngCore;
9use zeroize::{Zeroize, ZeroizeOnDrop};
10
11/// Server's long-term configuration: OPRF seed and authentication keypair.
12#[derive(Clone, Zeroize, ZeroizeOnDrop)]
13pub struct ServerSetup<C: OpaqueCiphersuite> {
14    oprf_seed: Vec<u8>,
15    server_private_key: Vec<u8>,
16    server_public_key: Vec<u8>,
17    #[zeroize(skip)]
18    _marker: core::marker::PhantomData<C>,
19}
20
21impl<C: OpaqueCiphersuite> ServerSetup<C> {
22    /// Create a new server setup with random seed and keypair.
23    pub fn new(rng: &mut impl CryptoRngCore) -> Result<Self, crate::OpaqueError> {
24        // oprf_seed must be Nh bytes per the spec (not Nseed)
25        let mut oprf_seed = vec![0u8; C::NH];
26        rng.fill_bytes(&mut oprf_seed);
27
28        let (mut server_private_key, server_public_key) = C::Dh::generate_keypair(rng)?;
29
30        Ok(Self {
31            oprf_seed,
32            server_private_key: core::mem::take(&mut *server_private_key),
33            server_public_key,
34            _marker: core::marker::PhantomData,
35        })
36    }
37
38    /// Create a server setup with pre-determined values (for testing).
39    ///
40    /// # Security
41    ///
42    /// Allows construction with arbitrary (potentially weak) keys.
43    /// This method is gated behind the `test-utils` feature.
44    #[cfg(feature = "test-utils")]
45    pub fn new_with_key(
46        oprf_seed: Vec<u8>,
47        server_private_key: Vec<u8>,
48        server_public_key: Vec<u8>,
49    ) -> Self {
50        Self {
51            oprf_seed,
52            server_private_key,
53            server_public_key,
54            _marker: core::marker::PhantomData,
55        }
56    }
57
58    /// The OPRF seed.
59    pub fn oprf_seed(&self) -> &[u8] {
60        &self.oprf_seed
61    }
62
63    /// The server's private key.
64    pub fn private_key(&self) -> &[u8] {
65        &self.server_private_key
66    }
67
68    /// The server's public key.
69    pub fn public_key(&self) -> &[u8] {
70        &self.server_public_key
71    }
72}
pakery_opaque/server_setup.rs

pakery_opaque/
server_setup.rs
