2022-12-24 20:09:09 +00:00
|
|
|
#![cfg_attr(docsrs, feature(doc_auto_cfg))]
|
2022-06-28 08:02:56 +00:00
|
|
|
#![no_std]
|
|
|
|
|
2022-04-22 01:36:18 +00:00
|
|
|
use core::{
|
|
|
|
ops::{Deref, Add, AddAssign, Sub, SubAssign, Neg, Mul, MulAssign},
|
|
|
|
borrow::Borrow,
|
2022-07-15 05:26:07 +00:00
|
|
|
iter::{Iterator, Sum},
|
2022-04-22 01:36:18 +00:00
|
|
|
};
|
|
|
|
|
Utilize zeroize (#76)
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
2022-08-03 08:25:18 +00:00
|
|
|
use zeroize::Zeroize;
|
2022-07-10 20:48:08 +00:00
|
|
|
use subtle::{ConstantTimeEq, ConditionallySelectable};
|
|
|
|
|
2022-04-22 01:36:18 +00:00
|
|
|
use rand_core::RngCore;
|
2022-09-29 09:33:46 +00:00
|
|
|
use digest::{consts::U64, Digest, HashMarker};
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
use subtle::{Choice, CtOption};
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-12-16 00:23:42 +00:00
|
|
|
use crypto_bigint::{Encoding, U256};
|
2022-04-22 01:36:18 +00:00
|
|
|
pub use curve25519_dalek as dalek;
|
|
|
|
|
|
|
|
use dalek::{
|
|
|
|
constants,
|
2022-06-03 19:35:42 +00:00
|
|
|
traits::Identity,
|
2022-04-22 01:36:18 +00:00
|
|
|
scalar::Scalar as DScalar,
|
|
|
|
edwards::{
|
2022-07-15 05:26:07 +00:00
|
|
|
EdwardsPoint as DEdwardsPoint, EdwardsBasepointTable as DEdwardsBasepointTable,
|
|
|
|
CompressedEdwardsY as DCompressedEdwards,
|
2022-06-06 08:22:49 +00:00
|
|
|
},
|
|
|
|
ristretto::{
|
2022-07-15 05:26:07 +00:00
|
|
|
RistrettoPoint as DRistrettoPoint, RistrettoBasepointTable as DRistrettoBasepointTable,
|
|
|
|
CompressedRistretto as DCompressedRistretto,
|
|
|
|
},
|
2022-04-22 01:36:18 +00:00
|
|
|
};
|
|
|
|
|
2022-06-30 07:17:15 +00:00
|
|
|
use ff::{Field, PrimeField, FieldBits, PrimeFieldBits};
|
|
|
|
use group::{Group, GroupEncoding, prime::PrimeGroup};
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 19:20:42 +00:00
|
|
|
pub mod field;
|
|
|
|
|
2022-07-09 06:01:22 +00:00
|
|
|
// Convert a boolean to a Choice in a *presumably* constant time manner
|
2022-07-08 19:30:56 +00:00
|
|
|
fn choice(value: bool) -> Choice {
|
2022-09-17 08:35:08 +00:00
|
|
|
Choice::from(u8::from(value))
|
2022-07-08 19:30:56 +00:00
|
|
|
}
|
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
macro_rules! deref_borrow {
|
|
|
|
($Source: ident, $Target: ident) => {
|
|
|
|
impl Deref for $Source {
|
|
|
|
type Target = $Target;
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
fn deref(&self) -> &Self::Target {
|
|
|
|
&self.0
|
|
|
|
}
|
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Borrow<$Target> for $Source {
|
|
|
|
fn borrow(&self) -> &$Target {
|
|
|
|
&self.0
|
|
|
|
}
|
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Borrow<$Target> for &$Source {
|
|
|
|
fn borrow(&self) -> &$Target {
|
|
|
|
&self.0
|
|
|
|
}
|
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
#[doc(hidden)]
|
|
|
|
#[macro_export]
|
|
|
|
macro_rules! constant_time {
|
|
|
|
($Value: ident, $Inner: ident) => {
|
|
|
|
impl ConstantTimeEq for $Value {
|
2022-07-15 05:26:07 +00:00
|
|
|
fn ct_eq(&self, other: &Self) -> Choice {
|
|
|
|
self.0.ct_eq(&other.0)
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
impl ConditionallySelectable for $Value {
|
|
|
|
fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
|
|
|
|
$Value($Inner::conditional_select(&a.0, &b.0, choice))
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-07-10 20:48:08 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
#[doc(hidden)]
|
|
|
|
#[macro_export]
|
|
|
|
macro_rules! math_op {
|
|
|
|
(
|
|
|
|
$Value: ident,
|
|
|
|
$Other: ident,
|
|
|
|
$Op: ident,
|
|
|
|
$op_fn: ident,
|
|
|
|
$Assign: ident,
|
|
|
|
$assign_fn: ident,
|
|
|
|
$function: expr
|
|
|
|
) => {
|
|
|
|
impl $Op<$Other> for $Value {
|
|
|
|
type Output = $Value;
|
|
|
|
fn $op_fn(self, other: $Other) -> Self::Output {
|
|
|
|
Self($function(self.0, other.0))
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-10 20:48:08 +00:00
|
|
|
impl $Assign<$Other> for $Value {
|
|
|
|
fn $assign_fn(&mut self, other: $Other) {
|
|
|
|
self.0 = $function(self.0, other.0);
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-10 20:48:08 +00:00
|
|
|
impl<'a> $Op<&'a $Other> for $Value {
|
|
|
|
type Output = $Value;
|
|
|
|
fn $op_fn(self, other: &'a $Other) -> Self::Output {
|
|
|
|
Self($function(self.0, other.0))
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-10 20:48:08 +00:00
|
|
|
impl<'a> $Assign<&'a $Other> for $Value {
|
|
|
|
fn $assign_fn(&mut self, other: &'a $Other) {
|
|
|
|
self.0 = $function(self.0, other.0);
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-07-10 20:48:08 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
#[doc(hidden)]
|
2022-08-29 07:32:59 +00:00
|
|
|
#[macro_export(local_inner_macros)]
|
2022-07-10 20:48:08 +00:00
|
|
|
macro_rules! math {
|
|
|
|
($Value: ident, $Factor: ident, $add: expr, $sub: expr, $mul: expr) => {
|
|
|
|
math_op!($Value, $Value, Add, add, AddAssign, add_assign, $add);
|
|
|
|
math_op!($Value, $Value, Sub, sub, SubAssign, sub_assign, $sub);
|
|
|
|
math_op!($Value, $Factor, Mul, mul, MulAssign, mul_assign, $mul);
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-07-10 20:48:08 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-08-29 07:32:59 +00:00
|
|
|
#[doc(hidden)]
|
|
|
|
#[macro_export(local_inner_macros)]
|
2022-07-10 20:48:08 +00:00
|
|
|
macro_rules! math_neg {
|
|
|
|
($Value: ident, $Factor: ident, $add: expr, $sub: expr, $mul: expr) => {
|
|
|
|
math!($Value, $Factor, $add, $sub, $mul);
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-07-10 20:48:08 +00:00
|
|
|
impl Neg for $Value {
|
2022-06-06 08:22:49 +00:00
|
|
|
type Output = Self;
|
2022-07-15 05:26:07 +00:00
|
|
|
fn neg(self) -> Self::Output {
|
|
|
|
Self(-self.0)
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
2022-07-10 19:20:42 +00:00
|
|
|
#[doc(hidden)]
|
|
|
|
#[macro_export]
|
|
|
|
macro_rules! from_wrapper {
|
|
|
|
($wrapper: ident, $inner: ident, $uint: ident) => {
|
|
|
|
impl From<$uint> for $wrapper {
|
2022-07-15 05:26:07 +00:00
|
|
|
fn from(a: $uint) -> $wrapper {
|
|
|
|
Self($inner::from(a))
|
|
|
|
}
|
2022-07-10 19:20:42 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-07-10 19:20:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[doc(hidden)]
|
2022-08-29 07:32:59 +00:00
|
|
|
#[macro_export(local_inner_macros)]
|
2022-07-10 19:20:42 +00:00
|
|
|
macro_rules! from_uint {
|
|
|
|
($wrapper: ident, $inner: ident) => {
|
|
|
|
from_wrapper!($wrapper, $inner, u8);
|
|
|
|
from_wrapper!($wrapper, $inner, u16);
|
|
|
|
from_wrapper!($wrapper, $inner, u32);
|
|
|
|
from_wrapper!($wrapper, $inner, u64);
|
2022-07-15 05:26:07 +00:00
|
|
|
};
|
2022-07-10 19:20:42 +00:00
|
|
|
}
|
|
|
|
|
2022-09-29 09:25:29 +00:00
|
|
|
/// Wrapper around the dalek Scalar type.
|
Utilize zeroize (#76)
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
2022-08-03 08:25:18 +00:00
|
|
|
#[derive(Clone, Copy, PartialEq, Eq, Default, Debug, Zeroize)]
|
2022-06-06 08:22:49 +00:00
|
|
|
pub struct Scalar(pub DScalar);
|
|
|
|
deref_borrow!(Scalar, DScalar);
|
2022-07-10 20:48:08 +00:00
|
|
|
constant_time!(Scalar, DScalar);
|
|
|
|
math_neg!(Scalar, Scalar, DScalar::add, DScalar::sub, DScalar::mul);
|
2022-07-10 19:20:42 +00:00
|
|
|
from_uint!(Scalar, DScalar);
|
2022-06-06 08:22:49 +00:00
|
|
|
|
2022-12-16 00:23:42 +00:00
|
|
|
const MODULUS: U256 =
|
|
|
|
U256::from_be_hex("1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed");
|
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Scalar {
|
2022-12-16 00:23:42 +00:00
|
|
|
pub fn pow(&self, other: Scalar) -> Scalar {
|
|
|
|
let mut table = [Scalar::one(); 16];
|
|
|
|
table[1] = *self;
|
|
|
|
for i in 2 .. 16 {
|
|
|
|
table[i] = table[i - 1] * self;
|
|
|
|
}
|
|
|
|
|
|
|
|
let mut res = Scalar::one();
|
|
|
|
let mut bits = 0;
|
|
|
|
for (i, bit) in other.to_le_bits().iter().rev().enumerate() {
|
|
|
|
bits <<= 1;
|
|
|
|
let bit = u8::from(*bit);
|
|
|
|
bits |= bit;
|
|
|
|
|
|
|
|
if ((i + 1) % 4) == 0 {
|
|
|
|
if i != 3 {
|
|
|
|
for _ in 0 .. 4 {
|
|
|
|
res *= res;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
res *= table[usize::from(bits)];
|
|
|
|
bits = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
res
|
|
|
|
}
|
|
|
|
|
2022-09-29 09:25:29 +00:00
|
|
|
/// Perform wide reduction on a 64-byte array to create a Scalar without bias.
|
2022-06-06 08:22:49 +00:00
|
|
|
pub fn from_bytes_mod_order_wide(bytes: &[u8; 64]) -> Scalar {
|
|
|
|
Self(DScalar::from_bytes_mod_order_wide(bytes))
|
|
|
|
}
|
|
|
|
|
2022-09-29 09:25:29 +00:00
|
|
|
/// Derive a Scalar without bias from a digest via wide reduction.
|
2022-09-29 09:33:46 +00:00
|
|
|
pub fn from_hash<D: Digest<OutputSize = U64> + HashMarker>(hash: D) -> Scalar {
|
2022-06-06 08:22:49 +00:00
|
|
|
let mut output = [0u8; 64];
|
|
|
|
output.copy_from_slice(&hash.finalize());
|
2022-08-04 18:40:54 +00:00
|
|
|
let res = Scalar(DScalar::from_bytes_mod_order_wide(&output));
|
|
|
|
output.zeroize();
|
|
|
|
res
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
impl Field for Scalar {
|
|
|
|
fn random(mut rng: impl RngCore) -> Self {
|
|
|
|
let mut r = [0; 64];
|
|
|
|
rng.fill_bytes(&mut r);
|
|
|
|
Self(DScalar::from_bytes_mod_order_wide(&r))
|
|
|
|
}
|
|
|
|
|
2022-07-15 05:26:07 +00:00
|
|
|
fn zero() -> Self {
|
|
|
|
Self(DScalar::zero())
|
|
|
|
}
|
|
|
|
fn one() -> Self {
|
|
|
|
Self(DScalar::one())
|
|
|
|
}
|
|
|
|
fn square(&self) -> Self {
|
|
|
|
*self * self
|
|
|
|
}
|
|
|
|
fn double(&self) -> Self {
|
|
|
|
*self + self
|
|
|
|
}
|
2022-05-03 12:49:46 +00:00
|
|
|
fn invert(&self) -> CtOption<Self> {
|
2022-07-08 20:05:17 +00:00
|
|
|
CtOption::new(Self(self.0.invert()), !self.is_zero())
|
2022-05-03 12:49:46 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
fn sqrt(&self) -> CtOption<Self> {
|
2022-12-16 00:23:42 +00:00
|
|
|
let mod_3_8 = MODULUS.saturating_add(&U256::from_u8(3)).wrapping_div(&U256::from_u8(8));
|
|
|
|
let mod_3_8 = Scalar::from_repr(mod_3_8.to_le_bytes()).unwrap();
|
|
|
|
|
|
|
|
let sqrt_m1 = MODULUS.saturating_sub(&U256::from_u8(1)).wrapping_div(&U256::from_u8(4));
|
|
|
|
let sqrt_m1 = Scalar::one().double().pow(Scalar::from_repr(sqrt_m1.to_le_bytes()).unwrap());
|
|
|
|
|
|
|
|
let tv1 = self.pow(mod_3_8);
|
|
|
|
let tv2 = tv1 * sqrt_m1;
|
|
|
|
let candidate = Self::conditional_select(&tv2, &tv1, tv1.square().ct_eq(self));
|
|
|
|
CtOption::new(candidate, candidate.square().ct_eq(self))
|
2022-07-15 05:26:07 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
impl PrimeField for Scalar {
|
|
|
|
type Repr = [u8; 32];
|
|
|
|
const NUM_BITS: u32 = 253;
|
|
|
|
const CAPACITY: u32 = 252;
|
2022-04-23 07:49:30 +00:00
|
|
|
fn from_repr(bytes: [u8; 32]) -> CtOption<Self> {
|
2022-07-08 19:30:56 +00:00
|
|
|
let scalar = DScalar::from_canonical_bytes(bytes);
|
2022-12-16 01:33:58 +00:00
|
|
|
// TODO: This unwrap_or isn't constant time, yet we don't exactly have an alternative...
|
2022-07-22 06:34:36 +00:00
|
|
|
CtOption::new(Scalar(scalar.unwrap_or_else(DScalar::zero)), choice(scalar.is_some()))
|
2022-04-23 07:49:30 +00:00
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
fn to_repr(&self) -> [u8; 32] {
|
|
|
|
self.0.to_bytes()
|
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-03 19:35:42 +00:00
|
|
|
const S: u32 = 2;
|
2022-07-15 05:26:07 +00:00
|
|
|
fn is_odd(&self) -> Choice {
|
2022-08-31 05:05:30 +00:00
|
|
|
choice(self.to_le_bits()[0])
|
2022-07-15 05:26:07 +00:00
|
|
|
}
|
|
|
|
fn multiplicative_generator() -> Self {
|
|
|
|
2u64.into()
|
|
|
|
}
|
|
|
|
fn root_of_unity() -> Self {
|
2022-12-16 01:33:58 +00:00
|
|
|
const ROOT: [u8; 32] = [
|
|
|
|
212, 7, 190, 235, 223, 117, 135, 190, 254, 131, 206, 66, 83, 86, 240, 14, 122, 194, 193, 171,
|
|
|
|
96, 109, 61, 125, 231, 129, 121, 224, 16, 115, 74, 9,
|
|
|
|
];
|
|
|
|
Scalar::from_repr(ROOT).unwrap()
|
2022-07-15 05:26:07 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
2022-06-30 07:17:15 +00:00
|
|
|
impl PrimeFieldBits for Scalar {
|
|
|
|
type ReprBits = [u8; 32];
|
|
|
|
|
|
|
|
fn to_le_bits(&self) -> FieldBits<Self::ReprBits> {
|
|
|
|
self.to_repr().into()
|
|
|
|
}
|
|
|
|
|
|
|
|
fn char_le_bits() -> FieldBits<Self::ReprBits> {
|
|
|
|
let mut bytes = (Scalar::zero() - Scalar::one()).to_repr();
|
|
|
|
bytes[0] += 1;
|
2022-07-09 06:01:22 +00:00
|
|
|
debug_assert_eq!(DScalar::from_bytes_mod_order(bytes), DScalar::zero());
|
2022-06-30 07:17:15 +00:00
|
|
|
bytes.into()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-07-26 07:05:15 +00:00
|
|
|
impl Sum<Scalar> for Scalar {
|
|
|
|
fn sum<I: Iterator<Item = Scalar>>(iter: I) -> Scalar {
|
|
|
|
Self(DScalar::sum(iter))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
macro_rules! dalek_group {
|
|
|
|
(
|
|
|
|
$Point: ident,
|
|
|
|
$DPoint: ident,
|
2022-06-28 05:25:26 +00:00
|
|
|
$torsion_free: expr,
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
$Table: ident,
|
|
|
|
$DTable: ident,
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
$DCompressed: ident,
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
$BASEPOINT_POINT: ident,
|
|
|
|
$BASEPOINT_TABLE: ident
|
|
|
|
) => {
|
2022-09-29 09:25:29 +00:00
|
|
|
/// Wrapper around the dalek Point type. For Ed25519, this is restricted to the prime subgroup.
|
Utilize zeroize (#76)
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
2022-08-03 08:25:18 +00:00
|
|
|
#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
|
2022-06-06 08:22:49 +00:00
|
|
|
pub struct $Point(pub $DPoint);
|
|
|
|
deref_borrow!($Point, $DPoint);
|
2022-07-10 20:48:08 +00:00
|
|
|
constant_time!($Point, $DPoint);
|
|
|
|
math_neg!($Point, Scalar, $DPoint::add, $DPoint::sub, $DPoint::mul);
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
pub const $BASEPOINT_POINT: $Point = $Point(constants::$BASEPOINT_POINT);
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Sum<$Point> for $Point {
|
2022-07-15 05:26:07 +00:00
|
|
|
fn sum<I: Iterator<Item = $Point>>(iter: I) -> $Point {
|
|
|
|
Self($DPoint::sum(iter))
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
|
|
|
impl<'a> Sum<&'a $Point> for $Point {
|
2022-07-15 05:26:07 +00:00
|
|
|
fn sum<I: Iterator<Item = &'a $Point>>(iter: I) -> $Point {
|
|
|
|
Self($DPoint::sum(iter))
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Group for $Point {
|
|
|
|
type Scalar = Scalar;
|
2022-08-29 17:02:20 +00:00
|
|
|
fn random(mut rng: impl RngCore) -> Self {
|
|
|
|
loop {
|
|
|
|
let mut bytes = field::FieldElement::random(&mut rng).to_repr();
|
|
|
|
bytes[31] |= u8::try_from(rng.next_u32() % 2).unwrap() << 7;
|
|
|
|
let opt = Self::from_bytes(&bytes);
|
|
|
|
if opt.is_some().into() {
|
|
|
|
return opt.unwrap();
|
|
|
|
}
|
|
|
|
}
|
2022-07-15 05:26:07 +00:00
|
|
|
}
|
|
|
|
fn identity() -> Self {
|
|
|
|
Self($DPoint::identity())
|
|
|
|
}
|
|
|
|
fn generator() -> Self {
|
|
|
|
$BASEPOINT_POINT
|
|
|
|
}
|
|
|
|
fn is_identity(&self) -> Choice {
|
|
|
|
self.0.ct_eq(&$DPoint::identity())
|
|
|
|
}
|
|
|
|
fn double(&self) -> Self {
|
|
|
|
*self + self
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-28 05:25:26 +00:00
|
|
|
impl GroupEncoding for $Point {
|
|
|
|
type Repr = [u8; 32];
|
|
|
|
|
|
|
|
fn from_bytes(bytes: &Self::Repr) -> CtOption<Self> {
|
2022-07-08 19:30:56 +00:00
|
|
|
let decompressed = $DCompressed(*bytes).decompress();
|
|
|
|
// TODO: Same note on unwrap_or as above
|
|
|
|
let point = decompressed.unwrap_or($DPoint::identity());
|
|
|
|
CtOption::new($Point(point), choice(decompressed.is_some()) & choice($torsion_free(point)))
|
2022-06-28 05:25:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
fn from_bytes_unchecked(bytes: &Self::Repr) -> CtOption<Self> {
|
|
|
|
$Point::from_bytes(bytes)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn to_bytes(&self) -> Self::Repr {
|
|
|
|
self.0.compress().to_bytes()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl PrimeGroup for $Point {}
|
|
|
|
|
2022-07-09 06:01:22 +00:00
|
|
|
/// Wrapper around the dalek Table type, offering efficient multiplication against the
|
2022-09-29 09:25:29 +00:00
|
|
|
/// basepoint.
|
2022-06-06 08:22:49 +00:00
|
|
|
pub struct $Table(pub $DTable);
|
|
|
|
deref_borrow!($Table, $DTable);
|
|
|
|
pub const $BASEPOINT_TABLE: $Table = $Table(constants::$BASEPOINT_TABLE);
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
impl Mul<Scalar> for &$Table {
|
|
|
|
type Output = $Point;
|
2022-07-15 05:26:07 +00:00
|
|
|
fn mul(self, b: Scalar) -> $Point {
|
|
|
|
$Point(&b.0 * &self.0)
|
|
|
|
}
|
2022-06-06 08:22:49 +00:00
|
|
|
}
|
|
|
|
};
|
2022-04-22 01:36:18 +00:00
|
|
|
}
|
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
dalek_group!(
|
|
|
|
EdwardsPoint,
|
|
|
|
DEdwardsPoint,
|
2022-06-28 05:25:26 +00:00
|
|
|
|point: DEdwardsPoint| point.is_torsion_free(),
|
2022-06-06 08:22:49 +00:00
|
|
|
EdwardsBasepointTable,
|
|
|
|
DEdwardsBasepointTable,
|
|
|
|
DCompressedEdwards,
|
|
|
|
ED25519_BASEPOINT_POINT,
|
|
|
|
ED25519_BASEPOINT_TABLE
|
|
|
|
);
|
2022-04-22 01:36:18 +00:00
|
|
|
|
2022-08-01 02:45:53 +00:00
|
|
|
impl EdwardsPoint {
|
|
|
|
pub fn mul_by_cofactor(&self) -> EdwardsPoint {
|
|
|
|
EdwardsPoint(self.0.mul_by_cofactor())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-06 08:22:49 +00:00
|
|
|
dalek_group!(
|
|
|
|
RistrettoPoint,
|
|
|
|
DRistrettoPoint,
|
2022-06-28 05:25:26 +00:00
|
|
|
|_| true,
|
2022-06-06 08:22:49 +00:00
|
|
|
RistrettoBasepointTable,
|
|
|
|
DRistrettoBasepointTable,
|
|
|
|
DCompressedRistretto,
|
|
|
|
RISTRETTO_BASEPOINT_POINT,
|
|
|
|
RISTRETTO_BASEPOINT_TABLE
|
|
|
|
);
|
2022-12-16 00:23:42 +00:00
|
|
|
|
2022-12-16 01:33:58 +00:00
|
|
|
#[test]
|
2022-12-24 20:09:09 +00:00
|
|
|
fn test_ed25519_group() {
|
|
|
|
ff_group_tests::group::test_prime_group_bits::<EdwardsPoint>();
|
2022-12-16 00:23:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
2022-12-24 20:09:09 +00:00
|
|
|
fn test_ristretto_group() {
|
|
|
|
ff_group_tests::group::test_prime_group_bits::<RistrettoPoint>();
|
2022-12-16 00:23:42 +00:00
|
|
|
}
|