diff --git a/.github/workflows/monero-tests.yaml b/.github/workflows/monero-tests.yaml index 903a26de..c6c08f47 100644 --- a/.github/workflows/monero-tests.yaml +++ b/.github/workflows/monero-tests.yaml @@ -51,7 +51,7 @@ jobs: - name: Run Integration Tests # Don't run if the the tests workflow also will - if: ${{ matrix.version != "v0.18.0.0" }} + if: ${{ matrix.version != 'v0.18.0.0' }} run: | cargo test --package monero-serai --all-features --test '*' cargo test --package serai-processor monero diff --git a/coins/monero/Cargo.toml b/coins/monero/Cargo.toml index eb711bfe..e0213b5a 100644 --- a/coins/monero/Cargo.toml +++ b/coins/monero/Cargo.toml @@ -25,7 +25,7 @@ curve25519-dalek = { version = "3", features = ["std"] } group = { version = "0.12" } dalek-ff-group = { path = "../../crypto/dalek-ff-group" } -multiexp = { path = "../../crypto/multiexp" } +multiexp = { path = "../../crypto/multiexp", features = ["batch"] } transcript = { package = "flexible-transcript", path = "../../crypto/transcript", features = ["recommended"], optional = true } frost = { package = "modular-frost", path = "../../crypto/frost", features = ["ed25519"], optional = true } diff --git a/coins/monero/src/ringct/bulletproofs/core.rs b/coins/monero/src/ringct/bulletproofs/core.rs index fdae97da..6e1a6a3a 100644 --- a/coins/monero/src/ringct/bulletproofs/core.rs +++ b/coins/monero/src/ringct/bulletproofs/core.rs @@ -7,12 +7,12 @@ use rand_core::{RngCore, CryptoRng}; use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint}; use group::{ff::Field, Group}; -use dalek_ff_group::{ED25519_BASEPOINT_POINT, Scalar, EdwardsPoint}; +use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint}; -use multiexp::multiexp as const_multiexp; +use multiexp::{BatchVerifier, multiexp as multiexp_const}; fn prove_multiexp(pairs: &[(Scalar, EdwardsPoint)]) -> EdwardsPoint { - const_multiexp(pairs) * *INV_EIGHT + multiexp_const(pairs) * *INV_EIGHT } use crate::{ @@ -108,9 +108,11 @@ fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) { (aL, aR) } -fn hash_commitments(commitments: &[Commitment]) -> Scalar { - let V = commitments.iter().map(|c| EdwardsPoint(c.calculate()) * *INV_EIGHT).collect::>(); - hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::>()) +fn hash_commitments>( + commitments: C, +) -> (Scalar, Vec) { + let V = commitments.into_iter().map(|c| EdwardsPoint(c) * *INV_EIGHT).collect::>(); + (hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::>()), V) } fn alpha_rho( @@ -161,41 +163,198 @@ lazy_static! { } // TRANSCRIPT_PLUS isn't a Scalar, so we need this alternative for the first hash -fn hash_plus(mash: &[[u8; 32]]) -> Scalar { - let slice = - &[&*TRANSCRIPT_PLUS as &[u8], mash.iter().cloned().flatten().collect::>().as_ref()] - .concat(); - hash_to_scalar(slice) +fn hash_plus(mash: &[u8]) -> Scalar { + hash_to_scalar(&[&*TRANSCRIPT_PLUS as &[u8], mash].concat()) +} + +#[derive(Clone, PartialEq, Eq, Debug)] +pub struct OriginalStruct { + pub(crate) A: DalekPoint, + pub(crate) S: DalekPoint, + pub(crate) T1: DalekPoint, + pub(crate) T2: DalekPoint, + pub(crate) taux: DalekScalar, + pub(crate) mu: DalekScalar, + pub(crate) L: Vec, + pub(crate) R: Vec, + pub(crate) a: DalekScalar, + pub(crate) b: DalekScalar, + pub(crate) t: DalekScalar, +} + +impl OriginalStruct { + #[must_use] + fn verify_core( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[DalekPoint], + ) -> bool { + // Verify commitments are valid + if commitments.is_empty() || (commitments.len() > MAX_M) { + return false; + } + + // Verify L and R are properly sized + if self.L.len() != self.R.len() { + return false; + } + + let (logMN, M, MN) = MN(commitments.len()); + if self.L.len() != logMN { + return false; + } + + // Rebuild all challenges + let (mut cache, commitments) = hash_commitments(commitments.iter().cloned()); + let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]); + + let z = hash_to_scalar(&y.to_bytes()); + cache = z; + + let x = hash_cache( + &mut cache, + &[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()], + ); + + let x_ip = hash_cache( + &mut cache, + &[x.to_bytes(), self.taux.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()], + ); + + let mut w = Vec::with_capacity(logMN); + let mut winv = Vec::with_capacity(logMN); + for (L, R) in self.L.iter().zip(&self.R) { + w.push(hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()])); + winv.push(cache.invert().unwrap()); + } + + // Convert the proof from * INV_EIGHT to its actual form + let normalize = |point: &DalekPoint| EdwardsPoint(point.mul_by_cofactor()); + + let L = self.L.iter().map(normalize).collect::>(); + let R = self.R.iter().map(normalize).collect::>(); + let T1 = normalize(&self.T1); + let T2 = normalize(&self.T2); + let A = normalize(&self.A); + let S = normalize(&self.S); + + let commitments = commitments.iter().map(|c| c.mul_by_cofactor()).collect::>(); + + // Verify it + let mut proof = Vec::with_capacity(4 + commitments.len()); + + let zpow = ScalarVector::powers(z, M + 3); + let ip1y = ScalarVector::powers(y, M * N).sum(); + let mut k = -(zpow[2] * ip1y); + for j in 1 ..= M { + k -= zpow[j + 2] * *IP12; + } + let y1 = Scalar(self.t) - ((z * ip1y) + k); + proof.push((-y1, *H)); + + proof.push((-Scalar(self.taux), G)); + + for (j, commitment) in commitments.iter().enumerate() { + proof.push((zpow[j + 2], *commitment)); + } + + proof.push((x, T1)); + proof.push((x * x, T2)); + verifier.queue(&mut *rng, id, proof); + + proof = Vec::with_capacity(4 + (2 * (MN + logMN))); + let z3 = (Scalar(self.t) - (Scalar(self.a) * Scalar(self.b))) * x_ip; + proof.push((z3, *H)); + proof.push((-Scalar(self.mu), G)); + + proof.push((Scalar::one(), A)); + proof.push((x, S)); + + { + let ypow = ScalarVector::powers(y, MN); + let yinv = y.invert().unwrap(); + let yinvpow = ScalarVector::powers(yinv, MN); + + let mut w_cache = vec![Scalar::zero(); MN]; + w_cache[0] = winv[0]; + w_cache[1] = w[0]; + for j in 1 .. logMN { + let mut slots = (1 << (j + 1)) - 1; + while slots > 0 { + w_cache[slots] = w_cache[slots / 2] * w[j]; + w_cache[slots - 1] = w_cache[slots / 2] * winv[j]; + slots = slots.saturating_sub(2); + } + } + + for w in &w_cache { + debug_assert!(!bool::from(w.is_zero())); + } + + for i in 0 .. MN { + let g = (Scalar(self.a) * w_cache[i]) + z; + proof.push((-g, GENERATORS.G[i])); + + let mut h = Scalar(self.b) * yinvpow[i] * w_cache[(!i) & (MN - 1)]; + h -= ((zpow[(i / N) + 2] * TWO_N[i % N]) + (z * ypow[i])) * yinvpow[i]; + proof.push((-h, GENERATORS.H[i])); + } + } + + for i in 0 .. logMN { + proof.push((w[i] * w[i], L[i])); + proof.push((winv[i] * winv[i], R[i])); + } + verifier.queue(rng, id, proof); + + true + } + + #[must_use] + pub(crate) fn verify( + &self, + rng: &mut R, + commitments: &[DalekPoint], + ) -> bool { + let mut verifier = BatchVerifier::new(4 + commitments.len() + 4 + (2 * (MAX_MN + 10))); + if self.verify_core(rng, &mut verifier, (), commitments) { + verifier.verify_vartime() + } else { + false + } + } + + #[must_use] + pub(crate) fn batch_verify( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[DalekPoint], + ) -> bool { + self.verify_core(rng, verifier, id, commitments) + } +} + +#[derive(Clone, PartialEq, Eq, Debug)] +pub struct PlusStruct { + pub(crate) A: DalekPoint, + pub(crate) A1: DalekPoint, + pub(crate) B: DalekPoint, + pub(crate) r1: DalekScalar, + pub(crate) s1: DalekScalar, + pub(crate) d1: DalekScalar, + pub(crate) L: Vec, + pub(crate) R: Vec, } -// Types for all Bulletproofs #[allow(clippy::large_enum_variant)] #[derive(Clone, PartialEq, Eq, Debug)] pub enum Bulletproofs { - Original { - A: DalekPoint, - S: DalekPoint, - T1: DalekPoint, - T2: DalekPoint, - taux: DalekScalar, - mu: DalekScalar, - L: Vec, - R: Vec, - a: DalekScalar, - b: DalekScalar, - t: DalekScalar, - }, - - Plus { - A: DalekPoint, - A1: DalekPoint, - B: DalekPoint, - r1: DalekScalar, - s1: DalekScalar, - d1: DalekScalar, - L: Vec, - R: Vec, - }, + Original(OriginalStruct), + Plus(PlusStruct), } pub(crate) fn prove( @@ -205,7 +364,7 @@ pub(crate) fn prove( let (logMN, M, MN) = MN(commitments.len()); let (aL, aR) = bit_decompose(commitments); - let mut cache = hash_commitments(commitments); + let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); let (alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR); let (sL, sR) = @@ -297,7 +456,7 @@ pub(crate) fn prove( } } - Bulletproofs::Original { + Bulletproofs::Original(OriginalStruct { A: *A, S: *S, T1: *T1, @@ -309,7 +468,7 @@ pub(crate) fn prove( a: *a[0], b: *b[0], t: *t, - } + }) } pub(crate) fn prove_plus( @@ -319,7 +478,8 @@ pub(crate) fn prove_plus( let (logMN, M, MN) = MN(commitments.len()); let (aL, aR) = bit_decompose(commitments); - let mut cache = hash_plus(&[hash_commitments(commitments).to_bytes()]); + let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); + cache = hash_plus(&cache.to_bytes()); let (mut alpha1, A) = alpha_rho(&mut *rng, &GENERATORS_PLUS, &aL, &aR); let y = hash_cache(&mut cache, &[A.compress().to_bytes()]); @@ -371,12 +531,12 @@ pub(crate) fn prove_plus( let (H_L, H_R) = H_proof.split_at(aL.len()); let mut L_i = LR_statements(&(&aL * yinvpow[aL.len()]), G_R, &bR, H_L, cL, *H); - L_i.push((dL, ED25519_BASEPOINT_POINT)); + L_i.push((dL, G)); let L_i = prove_multiexp(&L_i); L.push(L_i); let mut R_i = LR_statements(&(&aR * ypow[aR.len()]), G_L, &bL, H_R, cR, *H); - R_i.push((dR, ED25519_BASEPOINT_POINT)); + R_i.push((dR, G)); let R_i = prove_multiexp(&R_i); R.push(R_i); @@ -400,17 +560,17 @@ pub(crate) fn prove_plus( let A1 = prove_multiexp(&[ (r, G_proof[0]), (s, H_proof[0]), - (d, ED25519_BASEPOINT_POINT), + (d, G), ((r * y * b[0]) + (s * y * a[0]), *H), ]); - let B = prove_multiexp(&[(r * y * s, *H), (eta, ED25519_BASEPOINT_POINT)]); + let B = prove_multiexp(&[(r * y * s, *H), (eta, G)]); let e = hash_cache(&mut cache, &[A1.compress().to_bytes(), B.compress().to_bytes()]); let r1 = (a[0] * e) + r; let s1 = (b[0] * e) + s; let d1 = ((d * e) + eta) + (alpha1 * (e * e)); - Bulletproofs::Plus { + Bulletproofs::Plus(PlusStruct { A: *A, A1: *A1, B: *B, @@ -419,5 +579,5 @@ pub(crate) fn prove_plus( d1: *d1, L: L.drain(..).map(|L| *L).collect(), R: R.drain(..).map(|R| *R).collect(), - } + }) } diff --git a/coins/monero/src/ringct/bulletproofs/mod.rs b/coins/monero/src/ringct/bulletproofs/mod.rs index 58d8dc78..c75cc777 100644 --- a/coins/monero/src/ringct/bulletproofs/mod.rs +++ b/coins/monero/src/ringct/bulletproofs/mod.rs @@ -3,14 +3,15 @@ use rand_core::{RngCore, CryptoRng}; use curve25519_dalek::edwards::EdwardsPoint; +use multiexp::BatchVerifier; use crate::{Commitment, wallet::TransactionError, serialize::*}; pub(crate) mod scalar_vector; -mod core; +pub mod core; pub(crate) use self::core::Bulletproofs; -use self::core::{MAX_M, prove, prove_plus}; +use self::core::{MAX_M, OriginalStruct, PlusStruct, prove, prove_plus}; pub(crate) const MAX_OUTPUTS: usize = MAX_M; @@ -41,35 +42,57 @@ impl Bulletproofs { Ok(if !plus { prove(rng, outputs) } else { prove_plus(rng, outputs) }) } + #[must_use] + pub fn verify(&self, rng: &mut R, commitments: &[EdwardsPoint]) -> bool { + match self { + Bulletproofs::Original(bp) => bp.verify(rng, commitments), + Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"), + } + } + + #[must_use] + pub fn batch_verify( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[EdwardsPoint], + ) -> bool { + match self { + Bulletproofs::Original(bp) => bp.batch_verify(rng, verifier, id, commitments), + Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"), + } + } + fn serialize_core std::io::Result<()>>( &self, w: &mut W, specific_write_vec: F, ) -> std::io::Result<()> { match self { - Bulletproofs::Original { A, S, T1, T2, taux, mu, L, R, a, b, t } => { - write_point(A, w)?; - write_point(S, w)?; - write_point(T1, w)?; - write_point(T2, w)?; - write_scalar(taux, w)?; - write_scalar(mu, w)?; - specific_write_vec(L, w)?; - specific_write_vec(R, w)?; - write_scalar(a, w)?; - write_scalar(b, w)?; - write_scalar(t, w) + Bulletproofs::Original(bp) => { + write_point(&bp.A, w)?; + write_point(&bp.S, w)?; + write_point(&bp.T1, w)?; + write_point(&bp.T2, w)?; + write_scalar(&bp.taux, w)?; + write_scalar(&bp.mu, w)?; + specific_write_vec(&bp.L, w)?; + specific_write_vec(&bp.R, w)?; + write_scalar(&bp.a, w)?; + write_scalar(&bp.b, w)?; + write_scalar(&bp.t, w) } - Bulletproofs::Plus { A, A1, B, r1, s1, d1, L, R } => { - write_point(A, w)?; - write_point(A1, w)?; - write_point(B, w)?; - write_scalar(r1, w)?; - write_scalar(s1, w)?; - write_scalar(d1, w)?; - specific_write_vec(L, w)?; - specific_write_vec(R, w) + Bulletproofs::Plus(bp) => { + write_point(&bp.A, w)?; + write_point(&bp.A1, w)?; + write_point(&bp.B, w)?; + write_scalar(&bp.r1, w)?; + write_scalar(&bp.s1, w)?; + write_scalar(&bp.d1, w)?; + specific_write_vec(&bp.L, w)?; + specific_write_vec(&bp.R, w) } } } @@ -83,7 +106,7 @@ impl Bulletproofs { } pub fn deserialize(r: &mut R) -> std::io::Result { - Ok(Bulletproofs::Original { + Ok(Bulletproofs::Original(OriginalStruct { A: read_point(r)?, S: read_point(r)?, T1: read_point(r)?, @@ -95,11 +118,11 @@ impl Bulletproofs { a: read_scalar(r)?, b: read_scalar(r)?, t: read_scalar(r)?, - }) + })) } pub fn deserialize_plus(r: &mut R) -> std::io::Result { - Ok(Bulletproofs::Plus { + Ok(Bulletproofs::Plus(PlusStruct { A: read_point(r)?, A1: read_point(r)?, B: read_point(r)?, @@ -108,6 +131,6 @@ impl Bulletproofs { d1: read_scalar(r)?, L: read_vec(read_point, r)?, R: read_vec(read_point, r)?, - }) + })) } } diff --git a/coins/monero/src/tests/bulletproofs.rs b/coins/monero/src/tests/bulletproofs.rs new file mode 100644 index 00000000..ede0863a --- /dev/null +++ b/coins/monero/src/tests/bulletproofs.rs @@ -0,0 +1,83 @@ +use hex_literal::hex; +use rand::rngs::OsRng; + +use curve25519_dalek::{scalar::Scalar, edwards::CompressedEdwardsY}; +use multiexp::BatchVerifier; + +use crate::{ + Commitment, random_scalar, + ringct::bulletproofs::{Bulletproofs, core::OriginalStruct}, +}; + +#[test] +fn bulletproofs_vector() { + let scalar = |scalar| Scalar::from_canonical_bytes(scalar).unwrap(); + let point = |point| CompressedEdwardsY(point).decompress().unwrap(); + + // Generated from Monero + assert!(Bulletproofs::Original(OriginalStruct { + A: point(hex!("ef32c0b9551b804decdcb107eb22aa715b7ce259bf3c5cac20e24dfa6b28ac71")), + S: point(hex!("e1285960861783574ee2b689ae53622834eb0b035d6943103f960cd23e063fa0")), + T1: point(hex!("4ea07735f184ba159d0e0eb662bac8cde3eb7d39f31e567b0fbda3aa23fe5620")), + T2: point(hex!("b8390aa4b60b255630d40e592f55ec6b7ab5e3a96bfcdcd6f1cd1d2fc95f441e")), + taux: scalar(hex!("5957dba8ea9afb23d6e81cc048a92f2d502c10c749dc1b2bd148ae8d41ec7107")), + mu: scalar(hex!("923023b234c2e64774b820b4961f7181f6c1dc152c438643e5a25b0bf271bc02")), + L: vec![ + point(hex!("c45f656316b9ebf9d357fb6a9f85b5f09e0b991dd50a6e0ae9b02de3946c9d99")), + point(hex!("9304d2bf0f27183a2acc58cc755a0348da11bd345485fda41b872fee89e72aac")), + point(hex!("1bb8b71925d155dd9569f64129ea049d6149fdc4e7a42a86d9478801d922129b")), + point(hex!("5756a7bf887aa72b9a952f92f47182122e7b19d89e5dd434c747492b00e1c6b7")), + point(hex!("6e497c910d102592830555356af5ff8340e8d141e3fb60ea24cfa587e964f07d")), + point(hex!("f4fa3898e7b08e039183d444f3d55040f3c790ed806cb314de49f3068bdbb218")), + point(hex!("0bbc37597c3ead517a3841e159c8b7b79a5ceaee24b2a9a20350127aab428713")), + ], + R: vec![ + point(hex!("609420ba1702781692e84accfd225adb3d077aedc3cf8125563400466b52dbd9")), + point(hex!("fb4e1d079e7a2b0ec14f7e2a3943bf50b6d60bc346a54fcf562fb234b342abf8")), + point(hex!("6ae3ac97289c48ce95b9c557289e82a34932055f7f5e32720139824fe81b12e5")), + point(hex!("d071cc2ffbdab2d840326ad15f68c01da6482271cae3cf644670d1632f29a15c")), + point(hex!("e52a1754b95e1060589ba7ce0c43d0060820ebfc0d49dc52884bc3c65ad18af5")), + point(hex!("41573b06140108539957df71aceb4b1816d2409ce896659aa5c86f037ca5e851")), + point(hex!("a65970b2cc3c7b08b2b5b739dbc8e71e646783c41c625e2a5b1535e3d2e0f742")), + ], + a: scalar(hex!("0077c5383dea44d3cd1bc74849376bd60679612dc4b945255822457fa0c0a209")), + b: scalar(hex!("fe80cf5756473482581e1d38644007793ddc66fdeb9404ec1689a907e4863302")), + t: scalar(hex!("40dfb08e09249040df997851db311bd6827c26e87d6f0f332c55be8eef10e603")) + }) + .verify( + &mut OsRng, + &[ + // For some reason, these vectors are * INV_EIGHT + point(hex!("8e8f23f315edae4f6c2f948d9a861e0ae32d356b933cd11d2f0e031ac744c41f")) + .mul_by_cofactor(), + point(hex!("2829cbd025aa54cd6e1b59a032564f22f0b2e5627f7f2c4297f90da438b5510f")) + .mul_by_cofactor(), + ] + )); +} + +#[test] +fn bulletproofs() { + // Create Bulletproofs for all possible output quantities + let mut verifier = BatchVerifier::new(0); + for i in 1 .. 17 { + let commitments = (1 ..= i) + .map(|i| Commitment::new(random_scalar(&mut OsRng), u64::try_from(i).unwrap())) + .collect::>(); + + let bp = Bulletproofs::prove(&mut OsRng, &commitments, false).unwrap(); + + let commitments = commitments.iter().map(Commitment::calculate).collect::>(); + assert!(bp.verify(&mut OsRng, &commitments)); + assert!(bp.batch_verify(&mut OsRng, &mut verifier, i, &commitments)); + } + assert!(verifier.verify_vartime()); +} + +#[test] +fn bulletproofs_max() { + // Check Bulletproofs errors if we try to prove for too many outputs + assert!( + Bulletproofs::prove(&mut OsRng, &[Commitment::new(Scalar::zero(), 0); 17], false).is_err() + ); +} diff --git a/coins/monero/src/tests/mod.rs b/coins/monero/src/tests/mod.rs index d9b85f0c..f92473c4 100644 --- a/coins/monero/src/tests/mod.rs +++ b/coins/monero/src/tests/mod.rs @@ -1,2 +1,3 @@ mod clsag; +mod bulletproofs; mod address; diff --git a/crypto/dalek-ff-group/src/lib.rs b/crypto/dalek-ff-group/src/lib.rs index 66a32267..d7ec7262 100644 --- a/crypto/dalek-ff-group/src/lib.rs +++ b/crypto/dalek-ff-group/src/lib.rs @@ -372,6 +372,12 @@ dalek_group!( ED25519_BASEPOINT_TABLE ); +impl EdwardsPoint { + pub fn mul_by_cofactor(&self) -> EdwardsPoint { + EdwardsPoint(self.0.mul_by_cofactor()) + } +} + dalek_group!( RistrettoPoint, DRistrettoPoint,