Skip to content

fix(kos): make domain-separation salt non-invertible (tccr mix) #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
AdamDawidKrol wants to merge 1 commit into from
Closed

fix(kos): make domain-separation salt non-invertible (tccr mix) #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions crates/ot-core/src/kos/attack_poc.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,8 +88,12 @@ fn domain_separation_must_prevent_delta_recovery_under_seed_precompensation() {
assert_ne!(id_a, id_b);

let tweak = id_a ^ id_b;
let receiver_seeds_b: [[Block; 2]; CSP] =
std::array::from_fn(|i| [receiver_seeds_a[i][0] ^ tweak, receiver_seeds_a[i][1] ^ tweak]);
let receiver_seeds_b: [[Block; 2]; CSP] = std::array::from_fn(|i| {
[
receiver_seeds_a[i][0] ^ tweak,
receiver_seeds_a[i][1] ^ tweak,
]
});
let sender_seeds_b = sender_seeds_for(delta, &receiver_seeds_b);

let a = run_instance(delta, id_a, sender_seeds_a, receiver_seeds_a);
Expand All @@ -101,7 +105,10 @@ fn domain_separation_must_prevent_delta_recovery_under_seed_precompensation() {
let j = (0..COUNT)
.find(|&j| a.receiver_choices[j] != b.receiver_choices[j])
.unwrap();
println!("receiver-only msg XOR = {:?}", a.receiver_msgs[j] ^ b.receiver_msgs[j]);
println!(
"receiver-only msg XOR = {:?}",
a.receiver_msgs[j] ^ b.receiver_msgs[j]
);
println!("true Δ = {:?}", delta);
println!("recovered Δ = {:?}", recovered);

Expand Down
11 changes: 8 additions & 3 deletions crates/ot-core/src/kos/receiver.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use crate::{

use itybity::{BitLength, FromBitIterator, IntoBitIterator, IntoBits};
use mpz_common::future::{MaybeDone, Sender, new_output};
use mpz_core::{Block, prg::Prg};
use mpz_core::{Block, aes::FIXED_KEY_AES, prg::Prg};

use rand::{Rng as _, SeedableRng};
use rand_core::RngCore;
Expand Down Expand Up @@ -82,10 +82,15 @@ impl Receiver {
instance_id,
state: state::Extension {
// Domain-separate the base-OT-derived PRG seeds by the instance
// id, matching the sender's transform.
// id via a tweakable correlation-robust hash (tccr), matching the
// sender's transform. Must be non-invertible in `seed` — see the
// note in `sender.rs::setup` for the pre-compensation attack a
// linear XOR mix would enable.
rngs: seeds
.into_iter()
.map(|seeds| seeds.map(|seed| Prg::from_seed(seed ^ instance_id)))
.map(|seeds| {
seeds.map(|seed| Prg::from_seed(FIXED_KEY_AES.tccr(instance_id, seed)))
})
.collect(),
msgs: Vec::default(),
choices: Vec::default(),
Expand Down
13 changes: 9 additions & 4 deletions crates/ot-core/src/kos/sender.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use crate::{

use itybity::ToBits;
use mpz_common::future::{MaybeDone, Sender as OutputSender, new_output};
use mpz_core::{Block, prg::Prg};
use mpz_core::{Block, aes::FIXED_KEY_AES, prg::Prg};

use rand::{Rng as _, SeedableRng, rng};

Expand Down Expand Up @@ -93,11 +93,16 @@ impl Sender<state::Initialized> {
instance_id,
state: state::Extension {
// Domain-separate the base-OT-derived PRG seeds by the instance
// id. Both parties transform the same chosen seed identically,
// so extension correctness is preserved.
// id via a tweakable correlation-robust hash (tccr) keyed by the
// instance id. Both parties transform the same chosen seed
// identically, so extension correctness is preserved. The mix must
// be non-invertible in `seed`: a plain XOR (`seed ^ instance_id`)
// lets a malicious receiver, who controls the base-OT seeds,
// pre-compensate `seed_B = seed_A ^ id_A ^ id_B` to collapse two
// instances onto the same PRG stream and recover `delta`.
rngs: seeds
.into_iter()
.map(|seed| Prg::from_seed(seed ^ instance_id))
.map(|seed| Prg::from_seed(FIXED_KEY_AES.tccr(instance_id, seed)))
.collect(),
keys: Vec::default(),
extended: false,
Expand Down