Implement IHAT over P-256, cross-verified against the ihat-rs reference implementation

.github/workflows/ci.yml

@@ -50,11 +50,35 @@ jobs:
       - name: Build for a bare-metal target
         run: cargo build --no-default-features --target thumbv7em-none-eabi
 
+      # The experimental IHAT profile pulls in p256, so it gets its own no_std
+      # check — the point of the profile is not to cost the core crate its
+      # bare-metal story.
+      - name: Build the exp-ihat profile for a bare-metal target
+        run: cargo build --no-default-features --features exp-ihat --target thumbv7em-none-eabi
+
+  interop:
+    name: Interop and end-to-end
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      # Two things live here, both needing dependencies the library refuses to
+      # take: differential tests against ihat-rs (the reference implementation
+      # published by a MoLE draft author), and an end-to-end run of Appendix A
+      # with real RFC 9578 Privacy Pass credentials via `privacypass`.
+      - name: Cross-verify with ihat-rs, and run Appendix A end to end
+        run: cargo test --manifest-path interop/Cargo.toml
+
   msrv:
     name: MSRV (1.75)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.75.0
       - uses: Swatinem/rust-cache@v2
-      - run: cargo build --all-features
+      # --locked matters here: holding 1.75 depends on the committed lockfile
+      # pinning zeroize below the version that requires edition2024. See #12.
+      # Running the tests, not just building, is what catches a post-1.75 API
+      # sneaking into test code.
+      - run: cargo test --all-features --locked

.gitignore

@@ -5,3 +5,5 @@
 .DS_Store
 .idea/
 .vscode/
+/interop/target
+/.git-worktrees

Cargo.toml

@@ -1,30 +1,43 @@
 [package]
-name = "mole"
+name = "mole-exp"
 version = "0.1.0"
 edition = "2021"
 rust-version = "1.75"
 license = "MIT"
-description = "Wire format, HTTP transport, and Moderator state machine for Moderation of unLinkable Endorsements (MoLE), per draft-jms-mole-{architecture,protocols,http-transport}-00"
+description = "EXPERIMENTAL. Wire format, HTTP transport, and Moderator state machine for Moderation of unLinkable Endorsements (MoLE), per draft-jms-mole-{architecture,protocols,http-transport}-00, plus an explicitly-guessed IHAT profile that is not interoperable with anything"
 repository = "https://github.com/OR13/mole"
-documentation = "https://docs.rs/mole"
-readme = "README.md"
+publish = false
 keywords = ["mole", "privacypass", "unlinkable", "ietf", "tokens"]
 categories = ["cryptography", "encoding", "network-programming"]
 exclude = ["/.github"]
 
+[lib]
+name = "mole"
+
 [dependencies]
 sha2 = { version = "0.10", default-features = false }
 base64 = { version = "0.22", default-features = false, features = ["alloc"] }
 
+# Only for the `exp-ihat` profile. P-256 is the group the drafts point at, and
+# `hash2curve` gives the RFC 9380 P256_XMD:SHA-256_SSWU_RO_ suite the crypto
+# draft's "RO based Hash2Curve" calls for. Held at the 0.13 line because 0.14
+# requires Rust 1.85 and this crate's MSRV is 1.75.
+p256 = { version = "0.13.2", default-features = false, features = [
+    "arithmetic",
+    "hash2curve",
+], optional = true }
+
 [features]
 default = ["std"]
 std = []
 
-# Enables `crypto::insecure_mock`, a DELIBERATELY INSECURE stand-in for the
-# unpublished [CRYPTO] document. It exists so the end-to-end message flow can be
-# exercised in tests. It provides NO unlinkability, NO issuer hiding, and NO
-# blindness. Never enable this outside tests. See README.md.
-insecure-mock = []
+# Enables `crypto::exp_ihat`, an implementation of IHAT over P-256 aligned
+# byte-for-byte with `ihat-rs`, the reference implementation published in the MoLE
+# org by a draft author, and cross-verified against it by `interop/`. It
+# interoperates — but `ihat-rs` states it has not been audited, the construction
+# has no security proof or public cryptanalysis, and it is still under revision
+# upstream. Never enable this outside tests. See `EXP-IHAT-PROFILE.md`.
+exp-ihat = ["dep:p256"]
 
 [lints.rust]
 missing_docs = "warn"