pub fn start<R: RngCore + CryptoRng, S: SecretKey<CS::KeGroup>>(
        rng: &mut R,
        server_setup: &ServerSetup<CS, S>,
        password_file: Option<ServerRegistration<CS>>,
        credential_request: CredentialRequest<CS>,
        credential_identifier: &[u8],
        params: ServerLoginStartParameters,
    ) -> Result<ServerLoginStartResult<CS>, ProtocolError<S::Error>> {
        let record = match password_file {
            Some(x) => x,
            None => ServerRegistration::dummy(rng, server_setup),
        };

        let client_s_pk = record.0.client_s_pk.clone();

        let (context, optional_ids) = match params {
            ServerLoginStartParameters::WithContext(context) => (context, None),
            ServerLoginStartParameters::WithIdentifiers(ids) => (Vec::new(), Some(ids)),
            ServerLoginStartParameters::WithContextAndIdentifiers(context, ids) => {
                (context, Some(ids))
            }
        };

        let server_s_sk = server_setup.keypair.private();
        let server_s_pk = server_s_sk.public_key()?;

        let mut masking_nonce = vec![0u8; 32];
        rng.fill_bytes(&mut masking_nonce);

        let masked_response = mask_response(
            &record.0.masking_key,
            &masking_nonce,
            &server_s_pk,
            &record.0.envelope,
        )
        .map_err(ProtocolError::into_custom)?;

        let (id_u, id_s) = bytestrings_from_identifiers(
            &optional_ids,
            &client_s_pk.to_arr(),
            &server_s_pk.to_arr(),
        )
        .map_err(ProtocolError::into_custom)?;

        let credential_request_bytes = credential_request
            .serialize()
            .map_err(ProtocolError::into_custom)?;

        let oprf_key = oprf_key_from_seed::<CS::OprfGroup, CS::Hash>(
            &server_setup.oprf_seed,
            credential_identifier,
        )
        .map_err(ProtocolError::into_custom)?;
        let server = voprf::NonVerifiableServer::new_with_key(&oprf_key)
            .map_err(|e| ProtocolError::into_custom(e.into()))?;
        let evaluate_result = server
            .evaluate(credential_request.blinded_element, None)
            .map_err(|e| ProtocolError::into_custom(e.into()))?;
        let evaluation_element = evaluate_result.message;

        let credential_response_component = CredentialResponse::<CS>::serialize_without_ke(
            &evaluation_element.value(),
            &masking_nonce,
            &masked_response,
        );

        let result = CS::KeyExchange::generate_ke2(
            rng,
            credential_request_bytes,
            credential_response_component,
            credential_request.ke1_message,
            client_s_pk,
            server_s_sk.clone(),
            id_u,
            id_s,
            context,
        )?;

        let credential_response = CredentialResponse {
            evaluation_element,
            masking_nonce,
            masked_response,
            ke2_message: result.1,
        };

        Ok(ServerLoginStartResult {
            message: credential_response,
            state: Self {
                _cs: PhantomData,
                ke2_state: result.0,
            },
            #[cfg(test)]
            handshake_secret: result.2,
            #[cfg(test)]
            server_mac_key: result.3,
            #[cfg(test)]
            oprf_key: GenericArray::clone_from_slice(&oprf_key),
        })
    }
/// From the client's "blinded" password, returns a challenge to be
/// sent back to the client, as well as a ServerLogin
From the client's "blinded" password, returns a challenge to be
sent back to the client, as well as a ServerLogin
From the client ' s " blinded " password returns a challenge to be sent back to the client as well as a ServerLogin
pub fn start<R: RngCore + CryptoRng, S: SecretKey<CS::KeGroup>>(
        rng: &mut R,
        server_setup: &ServerSetup<CS, S>,
        password_file: Option<ServerRegistration<CS>>,
        credential_request: CredentialRequest<CS>,
        credential_identifier: &[u8],
        params: ServerLoginStartParameters,
    ) -> Result<ServerLoginStartResult<CS>, ProtocolError<S::Error>> {
        let record = match password_file {
            Some(x) => x,
            None => ServerRegistration::dummy(rng, server_setup),
        };
        let client_s_pk = record.0.client_s_pk.clone();
        let (context, optional_ids) = match params {
            ServerLoginStartParameters::WithContext(context) => (context, None),
            ServerLoginStartParameters::WithIdentifiers(ids) => (Vec::new(), Some(ids)),
            ServerLoginStartParameters::WithContextAndIdentifiers(context, ids) => {
                (context, Some(ids))
            }
        };
        let server_s_sk = server_setup.keypair.private();
        let server_s_pk = server_s_sk.public_key()?;
        let mut masking_nonce = vec![0u8; 32];
        rng.fill_bytes(&mut masking_nonce);
        let masked_response = mask_response(
            &record.0.masking_key,
            &masking_nonce,
            &server_s_pk,
            &record.0.envelope,
        )
        .map_err(ProtocolError::into_custom)?;
        let (id_u, id_s) = bytestrings_from_identifiers(
            &optional_ids,
            &client_s_pk.to_arr(),
            &server_s_pk.to_arr(),
        )
        .map_err(ProtocolError::into_custom)?;
        let credential_request_bytes = credential_request
            .serialize()
            .map_err(ProtocolError::into_custom)?;
        let oprf_key = oprf_key_from_seed::<CS::OprfGroup, CS::Hash>(
            &server_setup.oprf_seed,
            credential_identifier,
        )
        .map_err(ProtocolError::into_custom)?;
        let server = voprf::NonVerifiableServer::new_with_key(&oprf_key)
            .map_err(|e| ProtocolError::into_custom(e.into()))?;
        let evaluate_result = server
            .evaluate(credential_request.blinded_element, None)
            .map_err(|e| ProtocolError::into_custom(e.into()))?;
        let evaluation_element = evaluate_result.message;
        let credential_response_component = CredentialResponse::<CS>::serialize_without_ke(
            &evaluation_element.value(),
            &masking_nonce,
            &masked_response,
        );
        let result = CS::KeyExchange::generate_ke2(
            rng,
            credential_request_bytes,
            credential_response_component,
            credential_request.ke1_message,
            client_s_pk,
            server_s_sk.clone(),
            id_u,
            id_s,
            context,
        )?;
        let credential_response = CredentialResponse {
            evaluation_element,
            masking_nonce,
            masked_response,
            ke2_message: result.1,
        };
        Ok(ServerLoginStartResult {
            message: credential_response,
            state: Self {
                _cs: PhantomData,
                ke2_state: result.0,
            },
            #[cfg(test)]
            handshake_secret: result.2,
            #[cfg(test)]
            server_mac_key: result.3,
            #[cfg(test)]
            oprf_key: GenericArray::clone_from_slice(&oprf_key),
        })
    }
pub fn start < R : RngCore + CryptoRng , S : SecretKey < CS :: KeGroup > > ( rng : & mut R , server_setup : & ServerSetup < CS , S > , password_file : Option < ServerRegistration < CS > > , credential_request : CredentialRequest < CS > , credential_identifier : & [ u8 ] , params : ServerLoginStartParameters , ) -> Result < ServerLoginStartResult < CS > , ProtocolError < S :: Error > > { let record = match password_file { Some ( x ) => x , None => ServerRegistration :: dummy ( rng , server_setup ) , } ; let client_s_pk = record . 0 . client_s_pk . clone ( ) ; let ( context , optional_ids ) = match params { ServerLoginStartParameters :: WithContext ( context ) => ( context , None ) , ServerLoginStartParameters :: WithIdentifiers ( ids ) => ( Vec :: new ( ) , Some ( ids ) ) , ServerLoginStartParameters :: WithContextAndIdentifiers ( context , ids ) => { ( context , Some ( ids ) ) } } ; let server_s_sk = server_setup . keypair . private ( ) ; let server_s_pk = server_s_sk . public_key ( ) ? ; let mut masking_nonce = vec ! [ 0u8 32 ] ; rng . fill_bytes ( & mut masking_nonce ) ; let masked_response = mask_response ( & record . 0 . masking_key , & masking_nonce , & server_s_pk , & record . 0 . envelope , ) . map_err ( ProtocolError :: into_custom ) ? ; let ( id_u , id_s ) = bytestrings_from_identifiers ( & optional_ids , & client_s_pk . to_arr ( ) , & server_s_pk . to_arr ( ) , ) . map_err ( ProtocolError :: into_custom ) ? ; let credential_request_bytes = credential_request . serialize ( ) . map_err ( ProtocolError :: into_custom ) ? ; let oprf_key = oprf_key_from_seed :: < CS :: OprfGroup , CS :: Hash > ( & server_setup . oprf_seed , credential_identifier , ) . map_err ( ProtocolError :: into_custom ) ? ; let server = voprf :: NonVerifiableServer :: new_with_key ( & oprf_key ) . map_err ( | e | ProtocolError :: into_custom ( e . into ( ) ) ) ? ; let evaluate_result = server . evaluate ( credential_request . blinded_element , None ) . map_err ( | e | ProtocolError :: into_custom ( e . into ( ) ) ) ? ; let evaluation_element = evaluate_result . message ; let credential_response_component = CredentialResponse :: < CS > :: serialize_without_ke ( & evaluation_element . value ( ) , & masking_nonce , & masked_response , ) ; let result = CS :: KeyExchange :: generate_ke2 ( rng , credential_request_bytes , credential_response_component , credential_request . ke1_message , client_s_pk , server_s_sk . clone ( ) , id_u , id_s , context , ) ? ; let credential_response = CredentialResponse { evaluation_element , masking_nonce , masked_response , ke2_message : result . 1 , } ; Ok ( ServerLoginStartResult { message : credential_response , state : Self { _cs : PhantomData , ke2_state : result . 0 , } , # [ cfg ( test ) ] handshake_secret : result . 2 , # [ cfg ( test ) ] server_mac_key : result . 3 , # [ cfg ( test ) ] oprf_key : GenericArray :: clone_from_slice ( & oprf_key ) , } ) }
From the client's "blinded" password, returns a challenge to be
sent back to the client, as well as a ServerLogin
From the client ' s " blinded " password returns a challenge to be sent back to the client as well as a ServerLogin
rng
&mut R
server_setup
&ServerSetup<CS, S>
password_file
Option<ServerRegistration<CS>>
credential_request
CredentialRequest<CS>
credential_identifier
&[u8]
params
ServerLoginStartParameters
rng
&mut R
server_setup
&ServerSetup<CS, S>
password_file
Option<ServerRegistration<CS>>
credential_request
CredentialRequest<CS>
credential_identifier
&[u8]
params
ServerLoginStartParameters