Enable no_std on transcript

Removes the Vec challenge for an associated type.

Fixes the merlin feature which was horribly broken.

Also adds no_std to dalek-ff-group.

crypto/dalek-ff-group/src/lib.rs

@@ -1,3 +1,5 @@
+#![no_std]
+
 use core::{
   ops::{Deref, Add, AddAssign, Sub, SubAssign, Neg, Mul, MulAssign},
   borrow::Borrow,

crypto/frost/src/algorithm.rs

@@ -62,6 +62,8 @@ pub trait Algorithm<C: Curve>: Clone {
 #[derive(Clone, Debug)]
 pub struct IetfTranscript(Vec<u8>);
 impl Transcript for IetfTranscript {
+  type Challenge = Vec<u8>;
+
   fn domain_separate(&mut self, _: &[u8]) {}
 
   fn append_message(&mut self, _: &'static [u8], message: &[u8]) {

crypto/frost/src/sign.rs

@@ -164,7 +164,7 @@ fn sign_with_share<C: Curve, A: Algorithm<C>>(
     transcript.append_message(b"message", &C::hash_msg(&msg));
 
     // Calculate the binding factor
-    C::hash_binding_factor(&transcript.challenge(b"binding"))
+    C::hash_binding_factor(transcript.challenge(b"binding").as_ref())
   };
 
   // Process the addendums

crypto/transcript/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "flexible-transcript"
-version = "0.1.1"
+version = "0.1.2"
 description = "A simple transcript trait definition, along with viable options"
 license = "MIT"
 repository = "https://github.com/serai-dex/serai"

crypto/transcript/src/lib.rs

@@ -1,16 +1,18 @@
-use core::fmt::Debug;
+#![no_std]
 
-#[cfg(features = "merlin")]
+#[cfg(feature = "merlin")]
 mod merlin;
-#[cfg(features = "merlin")]
+#[cfg(feature = "merlin")]
-pub use merlin::MerlinTranscript;
+pub use crate::merlin::MerlinTranscript;
 
-use digest::{typenum::type_operators::IsGreaterOrEqual, consts::U256, Digest};
+use digest::{typenum::type_operators::IsGreaterOrEqual, consts::U256, Digest, Output};
 
 pub trait Transcript {
+  type Challenge: Clone + Send + Sync + AsRef<[u8]>;
+
   fn domain_separate(&mut self, label: &'static [u8]);
   fn append_message(&mut self, label: &'static [u8], message: &[u8]);
-  fn challenge(&mut self, label: &'static [u8]) -> Vec<u8>;
+  fn challenge(&mut self, label: &'static [u8]) -> Self::Challenge;
   fn rng_seed(&mut self, label: &'static [u8]) -> [u8; 32];
 }
 
@@ -34,10 +36,13 @@ impl DigestTranscriptMember {
   }
 }
 
-#[derive(Clone, Debug)]
+pub trait SecureDigest: Clone + Digest {}
-pub struct DigestTranscript<D: Clone + Digest>(D) where D::OutputSize: IsGreaterOrEqual<U256>;
+impl<D: Clone + Digest> SecureDigest for D where D::OutputSize: IsGreaterOrEqual<U256> {}
 
-impl<D: Clone + Digest> DigestTranscript<D> where D::OutputSize: IsGreaterOrEqual<U256> {
+#[derive(Clone, Debug)]
+pub struct DigestTranscript<D: SecureDigest>(D);
+
+impl<D: SecureDigest> DigestTranscript<D> {
   fn append(&mut self, kind: DigestTranscriptMember, value: &[u8]) {
     self.0.update(&[kind.as_u8()]);
     // Assumes messages don't exceed 16 exabytes
@@ -52,8 +57,9 @@ impl<D: Clone + Digest> DigestTranscript<D> where D::OutputSize: IsGreaterOrEqua
   }
 }
 
-impl<D: Digest + Clone> Transcript for DigestTranscript<D>
+impl<D: SecureDigest> Transcript for DigestTranscript<D> {
-  where D::OutputSize: IsGreaterOrEqual<U256> {
+  type Challenge = Output<D>;
+
   fn domain_separate(&mut self, label: &[u8]) {
     self.append(DigestTranscriptMember::Domain, label);
   }
@@ -63,14 +69,14 @@ impl<D: Digest + Clone> Transcript for DigestTranscript<D>
     self.append(DigestTranscriptMember::Value, message);
   }
 
-  fn challenge(&mut self, label: &'static [u8]) -> Vec<u8> {
+  fn challenge(&mut self, label: &'static [u8]) -> Self::Challenge {
     self.append(DigestTranscriptMember::Challenge, label);
-    self.0.clone().finalize().to_vec()
+    self.0.clone().finalize()
   }
 
   fn rng_seed(&mut self, label: &'static [u8]) -> [u8; 32] {
     let mut seed = [0; 32];
-    seed.copy_from_slice(&self.challenge(label)[0 .. 32]);
+    seed.copy_from_slice(&self.challenge(label)[.. 32]);
     seed
   }
 }

crypto/transcript/src/merlin.rs

@@ -1,15 +1,22 @@
-use core::{marker::PhantomData, fmt::{Debug, Formatter}};
+use core::fmt::{Debug, Formatter};
 
-use digest::Digest;
+use crate::Transcript;
 
-#[derive(Clone, PartialEq)]
+#[derive(Clone)]
 pub struct MerlinTranscript(pub merlin::Transcript);
 // Merlin doesn't implement Debug so provide a stub which won't panic
 impl Debug for MerlinTranscript {
-  fn fmt(&self, _: &mut Formatter<'_>) -> Result<(), std::fmt::Error> { Ok(()) }
+  fn fmt(&self, _: &mut Formatter<'_>) -> Result<(), core::fmt::Error> { Ok(()) }
 }
 
 impl Transcript for MerlinTranscript {
+  // Uses a challenge length of 64 bytes to support wide reduction on generated scalars
+  // From a security level standpoint, this should just be 32 bytes
+  // From a Merlin standpoint, this should be variable per call
+  // From a practical standpoint, this is a demo file not planned to be used and anything using
+  // this wrapper should be secure with this setting
+  type Challenge = [u8; 64];
+
   fn domain_separate(&mut self, label: &'static [u8]) {
     self.append_message(b"dom-sep", label);
   }
@@ -18,21 +25,15 @@ impl Transcript for MerlinTranscript {
     self.0.append_message(label, message);
   }
 
-  fn challenge(&mut self, label: &'static [u8]) -> Vec<u8> {
+  fn challenge(&mut self, label: &'static [u8]) -> Self::Challenge {
-    let mut challenge = vec![];
+    let mut challenge = [0; 64];
-    // Uses a challenge length of 64 bytes to support wide reduction on generated scalars
-    // From a security level standpoint, this should just be 32 bytes
-    // From a Merlin standpoint, this should be variable per call
-    // From a practical standpoint, this is a demo file not planned to be used and anything using
-    // this wrapper is fine without any settings it uses
-    challenge.resize(64, 0);
     self.0.challenge_bytes(label, &mut challenge);
     challenge
   }
 
   fn rng_seed(&mut self, label: &'static [u8]) -> [u8; 32] {
     let mut seed = [0; 32];
-    transcript.challenge_bytes(label, &mut seed);
+    seed.copy_from_slice(&self.challenge(label)[.. 32]);
     seed
   }
 }