trancript: add TranscriptRngBuilder

Signed-off-by: Ignacio Hagopian <[email protected]>

Author: jsign

strobe128/strobe128.go

@@ -57,7 +57,7 @@ func (s *Strobe128) PRF(data []byte, more bool) {
 	s.squeeze(data)
 }
 
-func (s *Strobe128) key(data []byte, more bool) {
+func (s *Strobe128) Key(data []byte, more bool) {
 	s.beginOp(flagA|flagC, more)
 	s.overwrite(data)
 }

strobe128/strobe128_test.go

@@ -29,7 +29,7 @@ func TestConformance(t *testing.T) {
 	require.Equal(t, exp, got)
 
 	s1.MetaAD([]byte("key"), false)
-	s1.key(prf1, false)
+	s1.Key(prf1, false)
 
 	prf1 = make([]byte, 32)
 	s1.MetaAD([]byte("prf"), false)

transcript.go

@@ -2,12 +2,14 @@ package transcript
 
 import (
 	"encoding/binary"
+	"math/rand"
 
 	"github.com/jsign/merlin/strobe128"
 )
 
 var (
-	merlinProtocolLabel  = []byte("Merlin v1.0")
+	labelMerlinProtocol  = []byte("Merlin v1.0")
+	labelRng             = []byte("rng")
 	labelDomainSeparator = []byte("dom-sep")
 )
 
@@ -18,7 +20,7 @@ type Transcript struct {
 // New returns a new Transcript object.
 func New(label []byte) *Transcript {
 	tr := &Transcript{
-		str: strobe128.New(merlinProtocolLabel),
+		str: strobe128.New(labelMerlinProtocol),
 	}
 	tr.AppendMessage(labelDomainSeparator, label)
 
@@ -46,3 +48,28 @@ func (t *Transcript) ChallengeBytes(label []byte, dest []byte) {
 	t.str.MetaAD(dataLen[:], true)
 	t.str.PRF(dest, false)
 }
+
+type TranscriptRngBuilder struct {
+	str strobe128.Strobe128
+}
+
+func (trb *TranscriptRngBuilder) RekeyWithWitnessBytes(label []byte, witness []byte) {
+	var dataLen [4]byte
+	binary.LittleEndian.PutUint32(dataLen[:], uint32(len(witness)))
+	trb.str.MetaAD(label, false)
+	trb.str.MetaAD(dataLen[:], true)
+	trb.str.Key(witness, false)
+}
+
+func (trb *TranscriptRngBuilder) Finalize(rand rand.Rand) Transcript {
+	var randbytes [32]byte
+	rand.Read(randbytes[:])
+	trb.str.MetaAD(labelRng, false)
+	trb.str.Key(randbytes[:], false)
+
+	return Transcript{
+		// A copy of trb.str is enough since the internal sturct
+		// contains no pointers.
+		str: trb.str,
+	}
+}