h2c 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3de2455d74c152fea54a81e553295ba16f3122e1af6e3d2196e52055eb179180
-  data.tar.gz: 6bc78d7cbfa6110f5cee57aff3d099e1a86a25f3a511b7ea13ad4b366aa38bab
+  metadata.gz: 0a7b6c9428d078ca27c842f19c62bde2898392719ea38eba400ad7da05b42b14
+  data.tar.gz: 2f25543f2e98f350b200c2674639a49922f1a211dbe58d2bb2673bdc924cf384
 SHA512:
-  metadata.gz: 7654446bc65c08a1eb073f4f4de149809e9b44c58d19f9eb420ff2a6c9f9277c5e2b7e7827cde92514e3807fa1ea7544e344be9441c9ac636d256dbdff522af6
-  data.tar.gz: 8e4f8ee2aed37e8639869ea488a276f597dc0264cacd50bd8dc1a22ff2316da3ee2adc879af92a922f54e2f6cd7307d57368ec53be8a4d95a6e551fe38465239
+  metadata.gz: e76d02628e7938801beaf24275793d26e1811aca3adfc4b180951b9b9ea419c9eb7705e06b2eb76503c1955a100ec5e209a6ad8fdabbcf9634aaa8299d104e4b
+  data.tar.gz: a580f648bc69621849c7bb825e90cd2f3b58d27619e6a8a05f8b79b7396598682751d628e2ea6e257641ffab3f44cf47959966e4f495f97dd7ada0c9c15ddc97

data/.rubocop.yml

@@ -1,4 +1,4 @@
-require:
+plugins:
   - rubocop-rake
   - rubocop-rspec
 inherit_gem:
@@ -17,5 +17,7 @@ Style/WhileUntilModifier:
   Enabled: false
 Naming/MethodParameterName:
   Enabled: false
-RSpec/FilePath:
+RSpec/SpecFilePathFormat:
+  Enabled: false
+RSpec/SpecFilePathSuffix:
   Enabled: false

data/README.md

@@ -4,6 +4,22 @@ This is a Ruby implementation of the [Hash to Curves](https://github.com/cfrg/dr
 
 It has been tested using the Test Vector provided, but the code has not been audited to ensure functional specification and safety. Also It is under development and is subject to change without backward compatibility.
 
+## Security considerations
+
+**This library is not constant-time and must not be used with secret input messages.**
+
+[RFC 9380 Section 4](https://www.rfc-editor.org/rfc/rfc9380.html#section-4) requires a constant-time implementation when the message being hashed is secret. This library does not meet that requirement:
+
+* Field arithmetic is performed with Ruby's arbitrary-precision `Integer`, whose execution time depends on the operand values.
+* The mapping in `H2C::M2C::SSWU#map` selects between candidates with ordinary `if`/ternary branches rather than constant-time conditional moves.
+* Byte-string handling in `H2C::Expander` allocates and copies in ways that depend on the requested length.
+
+An attacker able to measure timing or cache behaviour may therefore be able to recover information about the input. Hashing a **public** message to a curve point (the primary use case of RFC 9380) is unaffected.
+
+In particular, do not use this library to derive nonces or key material directly from secret values — for example, FROST's `nonce_generate`, which hashes a secret share. Such protocols require a constant-time implementation.
+
+Additionally, `H2C::HashToPoint` and the `H2C::Expander` instance it holds keep mutable digest state, so a single instance must not be shared across threads. Create one instance per thread instead.
+
 The following cipher suites are currently supported:
 
 * secp256k1_XMD:SHA-256_SSWU_NU_

data/lib/h2c/expander/xmd.rb

@@ -46,7 +46,8 @@ module H2C
 
         bi = digest.digest
         pseudo = bi
-        (2..(ell + 1)).each do |i|
+        # b_1 is already computed above, so this yields b_1, ..., b_ell in total.
+        (2..ell).each do |i|
           digest.reset
           digest.update(Expander.xor(b0, bi))
           digest.update([i].pack("C"))

data/lib/h2c/expander.rb

@@ -32,12 +32,15 @@ module H2C
 
     # Get expander implementation
     # @param [String] func Hash function name. Currently supported by 'SHA-256' and 'SHA-512'.
-    # @raise [H2C::Error] If invalid func specified.
+    # @param [String] dst Domain separation tag with binary format. Must not be empty.
+    # @raise [H2C::Error] If invalid func or empty dst specified.
     # @return [XMD] expander implementation, currently only XMD is supported.
     def get(func, dst, _k)
       unless HashFunc::XMD_FUNCS.include?(func)
         raise H2C::Error, "func #{func} is unsupported."
       end
+      # RFC 9380 3.1 requires domain separation tags to have nonzero length.
+      raise H2C::Error, "dst must not be empty." if dst.nil? || dst.empty?
       XMD.new(func, dst)
       # TODO: XOR
     end

data/lib/h2c/hash_to_point.rb

@@ -42,7 +42,7 @@ module H2C
         v = []
         suite.m.times do |j|
           offset = suite.l * (j + i * suite.m)
-          t = pseudo[offset, (offset + suite.l)]
+          t = pseudo[offset, suite.l]
           vj = t.unpack1("H*").to_i(16)
           v[j] = vj % modulo
         end

data/lib/h2c/m2c/sswu.rb

@@ -25,8 +25,9 @@ module H2C
         t1 = f.mod(f.power(u, 2) * f.mod(z))
         t2 = f.power(t1, 2)
         x1 = f.mod(t1 + t2)
-        x1 = f.inverse(x1)
         e1 = x1.zero?
+        # inv0(x) is the multiplicative inverse of x, with inv0(0) = 0.
+        x1 = e1 ? 0 : f.inverse(x1)
         x1 = f.mod(x1 + 1)
         x1 = e1 ? c2 : x1
         x1 = f.mod(x1 * c1)
@@ -47,7 +48,7 @@ module H2C
       end
 
       def square?(x)
-        test = curve.field.power(x, ((curve.field.prime - 1) / 2))
+        test = curve.field.power(x, (curve.field.prime - 1) / 2)
         [0, 1].include?(test)
       end
 

data/lib/h2c/suite.rb

@@ -56,7 +56,7 @@ module H2C
         @map = M2C::SSWU.new(ECDSA::Group::Nistp521, -4)
         @ro = (id == P521_XMDSHA512_SSWU_RO_)
       else
-        raise H2C::Error, "suite #{curve} unsupported."
+        raise H2C::Error, "suite #{id} unsupported."
       end
     end
   end

data/lib/h2c/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module H2C
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: h2c
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - azuchi
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-02-06 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa
@@ -69,7 +68,6 @@ metadata:
   homepage_uri: https://github.com/azuchi/h2c
   source_code_uri: https://github.com/azuchi/h2c
   changelog_uri: https://github.com/azuchi/h2c
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -84,8 +82,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby implementation of hash to curve.
 test_files: []