Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update docs: clarify export_key and session_key length #338

Merged
merged 1 commit into from
Aug 14, 2023

Conversation

nikgraf
Copy link
Contributor

@nikgraf nikgraf commented Aug 7, 2023

Maybe I missed something and it's due some configuration, but so far we have only seen 64 byte export_key and session_key.

@daxpedda
Copy link
Contributor

daxpedda commented Aug 8, 2023

The size is as big as voprf::CipherSuite::Hash, so it depends on the configuration.
We should probably still adjust the documentation to say that instead of "32-bytes".

@kevinlewi
Copy link
Contributor

I wasn't able to modify your PR directly, but if you could make the following wording changes, that would be great!

diff --git a/src/lib.rs b/src/lib.rs
index 1600364..a0ea56f 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -523,8 +523,9 @@
 //!
 //! Upon a successful completion of the OPAQUE protocol (the client runs login
 //! with the same password used during registration), the client and server have
-//! access to a session key, which is a pseudorandomly distributed 32-byte
-//! string which only the client and server know. Multiple login runs using the
+//! access to a session key, which is a pseudorandomly distributed byte
+//! string (of length equal to the output size of [voprf::CipherSuite::Hash])
+//! which only the client and server know. Multiple login runs using the
 //! same password for the same client will produce different session keys,
 //! distributed as uniformly random strings. Thus, the session key can be used
 //! to establish a secure channel between the client and server.
@@ -620,7 +621,8 @@
 //!
 //! ## Export Key
 //!
-//! The export key is a pseudorandomly distributed 32-byte string output by both
+//! The export key is a pseudorandomly distributed byte string
+//! (of length equal to the output size of [voprf::CipherSuite::Hash]) output by both
 //! the [Client Registration Finish](#client-registration-finish) and [Client
 //! Login Finish](#client-login-finish) steps. The same export key string will
 //! be output by both functions only if the exact same password is passed to

Copy link
Contributor

@kevinlewi kevinlewi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^

@nikgraf
Copy link
Contributor Author

nikgraf commented Aug 14, 2023

@kevinlewi thanks, I updated the PR

@nikgraf nikgraf changed the title update docs: 32 bytes to 64 bytes for export_key and session_key update docs: clarify export_key and session_key length Aug 14, 2023
Copy link
Contributor

@kevinlewi kevinlewi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you!

@kevinlewi kevinlewi merged commit 07c3f74 into facebook:main Aug 14, 2023
57 checks passed
kevinlewi added a commit that referenced this pull request Oct 10, 2024
* Fix Clippy (#289)

* Add Dependabot (#287)

* Fix Clippy

* Add Dependabot

* Bump actions/checkout from 2 to 3 (#291)

Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/cache from 2 to 3 (#292)

Bumps [actions/cache](https://github.com/actions/cache) from 2 to 3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v2...v3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update dependencies (#288)

* Fix Clippy

* Update dependencies

* Fix CI (#298)

* Rename X25519 to Curve25519 (#302)

* Update `curve25519-dalek` to 4.0.0-pre.5 (#301)

* Update `curve25519-dalek`

* Improve documentation

* Update `voprf` to 0.5.0-pre.1

* Bump `voprf` to v0.5.0-pre.2 (#304)

* Only use explicit crate features (#306)

* Publishing v3.0.0-pre.1 (#309)

* Update `rustyline` to v0.11 (#313)

* Update VOPRF to draft 19 (#307)

* Update `argon2` to v0.5 (#314)

* Test P-384 (#290)

* Update scrypt requirement from 0.10 to 0.11 (#315)

Updates the requirements on [scrypt](https://github.com/RustCrypto/password-hashes) to permit the latest version.
- [Release notes](https://github.com/RustCrypto/password-hashes/releases)
- [Commits](RustCrypto/password-hashes@scrypt-v0.10.0...scrypt-v0.11.0)

---
updated-dependencies:
- dependency-name: scrypt
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Publishing v3.0.0-pre.2 (#318)

* Bump `voprf` to v0.5.0-pre.4 (#322)

* Correctly clamp Curve25519 secret keys (#323)

* Curve25519 test vectors (#319)

* Curve25519 test vectors

* Adjust `derive_auth_keypair()` for Curve25519

* Update test vectors

* Fix Curve25519 random scalar generation

Co-Authored-By: Kevin Lewi <[email protected]>

* Update test vectors

* Update test vectors

* Update test vectors

---------

Co-authored-by: Kevin Lewi <[email protected]>

* Updating dual-license language (#324)

* Update criterion requirement from 0.4 to 0.5 (#325)

Updates the requirements on [criterion](https://github.com/bheisler/criterion.rs) to permit the latest version.
- [Changelog](https://github.com/bheisler/criterion.rs/blob/master/CHANGELOG.md)
- [Commits](bheisler/criterion.rs@0.4.0...0.5.0)

---
updated-dependencies:
- dependency-name: criterion
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update keypair generation to use derive_auth_keypair (#326)

* Fixing simple_login test to enable argon2 feature (#328)

* Publishing v3.0.0-pre.3 (#327)

* Update rustyline requirement from 11 to 12 (#332)

Updates the requirements on [rustyline](https://github.com/kkawakam/rustyline) to permit the latest version.
- [Release notes](https://github.com/kkawakam/rustyline/releases)
- [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md)
- [Commits](kkawakam/rustyline@v11.0.0...v12.0.0)

---
updated-dependencies:
- dependency-name: rustyline
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* update parameter from sk to private_key (#329)

* Bump `curve25519-dalek` to v4.0.0-rc.3 (#330)

* add more resources (WebAssembly and React Native) (#335)

* add more resources (WebAssembly and React Native)

* Fixing clippy

---------

Co-authored-by: Kevin Lewi <[email protected]>

* Publishing v3.0.0-pre.4 (#337)

* update docs: clarify export_key and session_key length (#338)

* Increase MSRV to 1.70 and update workflow dependencies (#342)

* Clarifying the persisting of server setup (#344)

* Add `clippy::doc_markdown` (#346)

* Fixing clippy errors (#347)

* Test P-521 (#349)

* Test P-521

* De-duplicate generic calls

* Simplify full test vectors generation

* Adding copyright header to generated test file (#351)

* Update rustyline requirement from 12 to 13 (#352)

Updates the requirements on [rustyline](https://github.com/kkawakam/rustyline) to permit the latest version.
- [Release notes](https://github.com/kkawakam/rustyline/releases)
- [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md)
- [Commits](kkawakam/rustyline@v12.0.0...v13.0.0)

---
updated-dependencies:
- dependency-name: rustyline
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/cache from 3 to 4 (#354)

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Updating dependencies (#360)

* docs: add details for client login final step (#358)

This tweaks the documentation on the main module, in order to
add some details on the outcome of the client login final step.
In particular, it clarifies the result of `ClientLogin::finish()`
both on success and on errors and it adds some intra-crate links
to the relevant structures and fields.

* Publishing v3.0.0-pre.5 (#364)

* Revert "Update keypair generation to use derive_auth_keypair (#326)"

This reverts commit deb7ca3.

* Fixups to keep in sync with draft-10

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: daxpedda <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nik Graf <[email protected]>
Co-authored-by: Luca Bruno <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants