From 5c30a9085bf477a02681624789114b1b42b305cd Mon Sep 17 00:00:00 2001 From: ID Bot Date: Sat, 21 Sep 2024 13:49:41 +0000 Subject: [PATCH] Script updating gh-pages from ceafef6. [ci skip] --- draft-irtf-cfrg-opaque.html | 76 +++++++++++++++++++++++++----------- draft-irtf-cfrg-opaque.txt | 78 ++++++++++++++++++++++++++----------- 2 files changed, 109 insertions(+), 45 deletions(-) diff --git a/draft-irtf-cfrg-opaque.html b/draft-irtf-cfrg-opaque.html index 5a6770e..f1e3fe6 100644 --- a/draft-irtf-cfrg-opaque.html +++ b/draft-irtf-cfrg-opaque.html @@ -1880,8 +1880,12 @@

if client_identity == nil client_identity = client_public_key - Create CleartextCredentials cleartext_credentials with - (server_public_key, server_identity, client_identity) + cleartext_credentials = CleartextCredentials { + server_public_key, + server_identity, + client_identity + } + return cleartext_credentials @@ -1902,14 +1906,14 @@ 

 struct {
-  uint8 nonce[Nn];
+  uint8 envelope_nonce[Nn];
   uint8 auth_tag[Nm];
 } Envelope;
-

nonce: A randomly-sampled nonce of length Nn, used to protect this Envelope.

+

envelope_nonce: A randomly-sampled nonce of length Nn, used to protect this Envelope.

auth_tag: An authentication tag protecting the contents of the envelope, covering -the envelope nonce and CleartextCredentials.

+envelope_nonce and CleartextCredentials.

@@ -1960,7 +1964,11 @@

auth_tag = MAC(auth_key, concat(envelope_nonce, cleartext_credentials)) - Create Envelope envelope with (envelope_nonce, auth_tag) + envelope = Envelope { + envelope_nonce, + auth_tag + } + return (envelope, client_public_key, masking_key, export_key)

@@ -2175,7 +2183,9 @@

def CreateRegistrationRequest(password): (blind, blinded_element) = Blind(password) blinded_message = SerializeElement(blinded_element) - Create RegistrationRequest request with blinded_message + request = RegistrationRequest { + blinded_message + } return (request, blind) @@ -2220,8 +2230,10 @@

evaluated_element = BlindEvaluate(oprf_key, blinded_element) evaluated_message = SerializeElement(evaluated_element) - Create RegistrationResponse response with - (evaluated_message, server_public_key) + response = RegistrationResponse { + evaluated_message, + server_public_key + } return response @@ -2266,8 +2278,11 @@

Store(randomized_password, response.server_public_key, server_identity, client_identity) - Create RegistrationRecord record with - (client_public_key, masking_key, envelope) + record = RegistrationRecord { + client_public_key, + masking_key, + envelope + } return (record, export_key) @@ -2549,7 +2564,10 @@

record.client_public_key, ke1, credential_response) - Create KE2 ke2 with (credential_response, auth_response) + ke2 = KE2 { + credential_response, + auth_response + } return ke2 @@ -2703,7 +2721,9 @@

def CreateCredentialRequest(password): (blind, blinded_element) = Blind(password) blinded_message = SerializeElement(blinded_element) - Create CredentialRequest request with blinded_message + request = CredentialRequest { + blinded_message + } return (request, blind) @@ -2762,8 +2782,11 @@
masked_response = xor(credential_response_pad, concat(server_public_key, record.envelope)) - Create CredentialResponse response with - (evaluated_message, masking_nonce, masked_response) + response = CredentialResponse { + evaluated_message, + masking_nonce, + masked_response + } return response @@ -3112,11 +3135,15 @@

(client_secret, client_public_keyshare) = DeriveDiffieHellmanKeyPair(client_keyshare_seed) - Create AuthRequest auth_request with - (client_nonce, client_public_keyshare) + auth_request = AuthRequest { + client_nonce, + client_public_keyshare + } - Create KE1 ke1 with - (credential_request, auth_request) + ke1 = KE1 { + credential_request, + auth_request + } state.client_secret = client_secret state.ke1 = ke1 @@ -3166,7 +3193,9 @@

if !ct_equal(ke2.auth_response.server_mac, expected_server_mac), raise ServerAuthenticationError client_mac = MAC(Km3, Hash(concat(preamble, expected_server_mac))) - Create KE3 ke3 with client_mac + ke3 = KE3 { + client_mac + } return (ke3, session_key) @@ -3226,8 +3255,11 @@

MAC(Km3, Hash(concat(preamble, server_mac))) state.session_key = session_key - Create AuthResponse auth_response with - (server_nonce, server_public_keyshare, server_mac) + auth_response = AuthResponse { + server_nonce, + server_public_keyshare, + server_mac + } return auth_response diff --git a/draft-irtf-cfrg-opaque.txt b/draft-irtf-cfrg-opaque.txt index abbdce6..bdf7829 100644 --- a/draft-irtf-cfrg-opaque.txt +++ b/draft-irtf-cfrg-opaque.txt @@ -555,8 +555,12 @@ def CreateCleartextCredentials(server_public_key, client_public_key, if client_identity == nil client_identity = client_public_key - Create CleartextCredentials cleartext_credentials with - (server_public_key, server_identity, client_identity) + cleartext_credentials = CleartextCredentials { + server_public_key, + server_identity, + client_identity + } + return cleartext_credentials 4.1. Key Recovery @@ -571,15 +575,15 @@ def CreateCleartextCredentials(server_public_key, client_public_key, The key recovery mechanism defines its Envelope as follows: struct { - uint8 nonce[Nn]; + uint8 envelope_nonce[Nn]; uint8 auth_tag[Nm]; } Envelope; - nonce: A randomly-sampled nonce of length Nn, used to protect this - Envelope. + envelope_nonce: A randomly-sampled nonce of length Nn, used to + protect this Envelope. auth_tag: An authentication tag protecting the contents of the - envelope, covering the envelope nonce and CleartextCredentials. + envelope, covering envelope_nonce and CleartextCredentials. 4.1.2. Envelope Creation @@ -625,7 +629,11 @@ def CreateCleartextCredentials(server_public_key, client_public_key, auth_tag = MAC(auth_key, concat(envelope_nonce, cleartext_credentials)) - Create Envelope envelope with (envelope_nonce, auth_tag) + envelope = Envelope { + envelope_nonce, + auth_tag + } + return (envelope, client_public_key, masking_key, export_key) 4.1.3. Envelope Recovery @@ -808,7 +816,9 @@ def CreateCleartextCredentials(server_public_key, client_public_key, def CreateRegistrationRequest(password): (blind, blinded_element) = Blind(password) blinded_message = SerializeElement(blinded_element) - Create RegistrationRequest request with blinded_message + request = RegistrationRequest { + blinded_message + } return (request, blind) 5.2.2. CreateRegistrationResponse @@ -846,8 +856,10 @@ def CreateCleartextCredentials(server_public_key, client_public_key, evaluated_element = BlindEvaluate(oprf_key, blinded_element) evaluated_message = SerializeElement(evaluated_element) - Create RegistrationResponse response with - (evaluated_message, server_public_key) + response = RegistrationResponse { + evaluated_message, + server_public_key + } return response @@ -886,8 +898,11 @@ def CreateCleartextCredentials(server_public_key, client_public_key, Store(randomized_password, response.server_public_key, server_identity, client_identity) - Create RegistrationRecord record with - (client_public_key, masking_key, envelope) + record = RegistrationRecord { + client_public_key, + masking_key, + envelope + } return (record, export_key) @@ -1130,7 +1145,10 @@ def CreateCleartextCredentials(server_public_key, client_public_key, record.client_public_key, ke1, credential_response) - Create KE2 ke2 with (credential_response, auth_response) + ke2 = KE2 { + credential_response, + auth_response + } return ke2 @@ -1257,7 +1275,9 @@ def CreateCleartextCredentials(server_public_key, client_public_key, def CreateCredentialRequest(password): (blind, blinded_element) = Blind(password) blinded_message = SerializeElement(blinded_element) - Create CredentialRequest request with blinded_message + request = CredentialRequest { + blinded_message + } return (request, blind) 6.3.2.2. CreateCredentialResponse @@ -1312,8 +1332,11 @@ def CreateCleartextCredentials(server_public_key, client_public_key, masked_response = xor(credential_response_pad, concat(server_public_key, record.envelope)) - Create CredentialResponse response with - (evaluated_message, masking_nonce, masked_response) + response = CredentialResponse { + evaluated_message, + masking_nonce, + masked_response + } return response @@ -1599,11 +1622,15 @@ def Preamble(client_identity, ke1, server_identity, credential_response, (client_secret, client_public_keyshare) = DeriveDiffieHellmanKeyPair(client_keyshare_seed) - Create AuthRequest auth_request with - (client_nonce, client_public_keyshare) + auth_request = AuthRequest { + client_nonce, + client_public_keyshare + } - Create KE1 ke1 with - (credential_request, auth_request) + ke1 = KE1 { + credential_request, + auth_request + } state.client_secret = client_secret state.ke1 = ke1 @@ -1651,7 +1678,9 @@ def Preamble(client_identity, ke1, server_identity, credential_response, if !ct_equal(ke2.auth_response.server_mac, expected_server_mac), raise ServerAuthenticationError client_mac = MAC(Km3, Hash(concat(preamble, expected_server_mac))) - Create KE3 ke3 with client_mac + ke3 = KE3 { + client_mac + } return (ke3, session_key) 6.4.4. 3DH Server Functions @@ -1705,8 +1734,11 @@ def Preamble(client_identity, ke1, server_identity, credential_response, MAC(Km3, Hash(concat(preamble, server_mac))) state.session_key = session_key - Create AuthResponse auth_response with - (server_nonce, server_public_keyshare, server_mac) + auth_response = AuthResponse { + server_nonce, + server_public_keyshare, + server_mac + } return auth_response