Fix clsag context and handle the OUT_DIR changing

Also rearranges arguments a bit.

sign/monero/build.rs

@@ -29,6 +29,20 @@ fn main() {
         panic!("make failed to build Monero. Please check your dependencies");
     }
 
+    if !Command::new("touch").arg("monero")
+      .current_dir(&Path::new("c/.build")).status().unwrap().success() {
+        panic!("failed to create a file to label Monero as built");
+    }
+  }
+
+ println!("cargo:rerun-if-env-changed=OUT_DIR");
+ if !Path::new(
+    &format!(
+      "c/monero/src/crypto/{}cncrypto.{}",
+      &env::consts::DLL_PREFIX,
+      &env::consts::DLL_EXTENSION
+    )
+  ).exists() {
     if !Command::new("cp").args(&[
       &format!(
         "c/monero/src/crypto/{}cncrypto.{}",
@@ -73,28 +87,23 @@ fn main() {
       panic!("Failed to cp ringct");
     }
 
-    if !Command::new("touch").arg("monero")
+    println!("cargo:rerun-if-changed=c/wrapper.c");
-      .current_dir(&Path::new("c/.build")).status().unwrap().success() {
+    if !Command::new("g++").args(&[
-        panic!("failed to create a file to label Monero as built");
+      "-O3", "-Wall", "-shared", "-std=c++14", "-fPIC",
+      "-Imonero/contrib/epee/include", "-Imonero/src",
+      "wrapper.c", "-o", &format!(
+        "{}/{}wrapper.{}",
+        out_dir,
+        &env::consts::DLL_PREFIX,
+        &env::consts::DLL_EXTENSION
+      ),
+      &format!("-L{}", out_dir),
+      "-ldevice", "-lringct_basic", "-lringct"
+    ]).current_dir(&Path::new("c")).status().unwrap().success() {
+      panic!("g++ failed to build the wrapper");
     }
   }
 
-  println!("cargo:rerun-if-changed=c/wrapper.c");
-  if !Command::new("g++").args(&[
-    "-O3", "-Wall", "-shared", "-std=c++14", "-fPIC",
-    "-Imonero/contrib/epee/include", "-Imonero/src",
-    "wrapper.c", "-o", &format!(
-      "{}/{}wrapper.{}",
-      out_dir,
-      &env::consts::DLL_PREFIX,
-      &env::consts::DLL_EXTENSION
-    ),
-    &format!("-L{}", out_dir),
-    "-ldevice", "-lringct_basic", "-lringct"
-  ]).current_dir(&Path::new("c")).status().unwrap().success() {
-    panic!("g++ failed to build the wrapper");
-  }
-
   println!("cargo:rustc-link-search={}", out_dir);
   println!("cargo:rustc-link-lib=cncrypto");
   println!("cargo:rustc-link-lib=device");

sign/monero/c/wrapper.c

@@ -11,7 +11,7 @@ extern "C" {
     ge_p3_tobytes(point, &e_p3);
   }
 
-  bool c_verify_clsag(uint s_len, uint8_t* s, uint8_t* I, uint8_t* m, uint8_t k_len, uint8_t* k, uint8_t* p) {
+  bool c_verify_clsag(uint s_len, uint8_t* s, uint8_t* I, uint8_t k_len, uint8_t* k, uint8_t* m, uint8_t* p) {
     rct::clsag clsag;
     std::stringstream ss;
     std::string str;

sign/monero/src/clsag/mod.rs

@@ -61,8 +61,8 @@ pub(crate) fn validate_sign_args(
 pub(crate) fn sign_core(
   rand_source: [u8; 64],
   image: EdwardsPoint,
-  msg: &[u8; 32],
   ssr: &SemiSignableRing,
+  msg: &[u8; 32],
   A: EdwardsPoint,
   AH: EdwardsPoint
 ) -> (Clsag, Scalar, Scalar, Scalar, Scalar, EdwardsPoint) {
@@ -197,7 +197,8 @@ pub fn sign<R: RngCore + CryptoRng>(
   let (mut clsag, c, mu_C, z, mu_P, C_out) = sign_core(
     rand_source,
     image,
-    &msg, &ssr,
+    &ssr,
+    &msg,
     &a * &ED25519_BASEPOINT_TABLE, a * hash_to_point(&ssr.ring[ssr.i][0])
   );
   clsag.s[i as usize] = Key { key: (a - (c * ((mu_C * z) + (mu_P * private_key)))).to_bytes() };
@@ -232,7 +233,7 @@ pub fn verify(
   unsafe {
     success = c_verify_clsag(
       serialized.len(), serialized.as_ptr(), image_bytes.as_ptr(),
-      msg.as_ptr(), ring.len() as u8, ring_bytes.as_ptr(), pseudo_out_bytes.as_ptr()
+      ring.len() as u8, ring_bytes.as_ptr(), msg.as_ptr(), pseudo_out_bytes.as_ptr()
     );
   }
 

sign/monero/src/clsag/multisig.rs

@@ -40,8 +40,8 @@ pub struct Multisig {
   AH: dfg::EdwardsPoint,
 
   image: EdwardsPoint,
-  msg: [u8; 32],
   ssr: SemiSignableRing,
+  msg: [u8; 32],
 
   interim: Option<ClsagSignInterim>
 }
@@ -62,8 +62,8 @@ impl Multisig {
         AH: dfg::EdwardsPoint::identity(),
 
         image,
-        msg,
         ssr,
+        msg,
 
         interim: None
       }
@@ -78,10 +78,10 @@ impl Algorithm<Ed25519> for Multisig {
     let mut context = self.image.compress().to_bytes().to_vec();
     for pair in &self.ssr.ring {
       context.extend(&pair[0].compress().to_bytes());
+      context.extend(&pair[1].compress().to_bytes());
     }
     context.extend(&u8::try_from(self.ssr.i).unwrap().to_le_bytes());
-    context.extend(&self.ssr.randomness.to_bytes());
+    context.extend(&self.msg);
-    context.extend(&self.ssr.amount.to_le_bytes());
     context
   }
 
@@ -155,7 +155,7 @@ impl Algorithm<Ed25519> for Multisig {
     // Use everyone's commitments to derive a random source all signers can agree upon
     // Cannot be manipulated to effect and all signers must, and will, know this
     let rand_source = Keccak::v512()
-      .chain("Clsag_randomness")
+      .chain("clsag_randomness")
       .chain(&self.b)
       .finalize()
       .as_slice()
@@ -166,8 +166,8 @@ impl Algorithm<Ed25519> for Multisig {
     let (clsag, c, mu_C, z, mu_P, C_out) = sign_core(
       rand_source,
       self.image,
-      &self.msg,
       &self.ssr,
+      &self.msg,
       nonce_sum.0,
       self.AH.0
     );
@@ -191,7 +191,7 @@ impl Algorithm<Ed25519> for Multisig {
 
     let mut clsag = interim.clsag.clone();
     clsag.s[self.ssr.i] = Key { key: s.to_bytes() };
-    if verify(&clsag, self.image, &self.msg, &self.ssr.ring, interim.C_out).is_ok() {
+    if verify(&clsag, self.image, &self.ssr.ring, &self.msg, interim.C_out).is_ok() {
       return Some((clsag, interim.C_out));
     }
     return None;

sign/monero/src/lib.rs

@@ -24,7 +24,7 @@ extern "C" {
   fn c_hash_to_point(point: *const u8);
   pub(crate) fn c_verify_clsag(
     serialized_len: usize, serialized: *const u8, I: *const u8,
-    msg: *const u8, ring_size: u8, ring: *const u8, pseudo_out: *const u8
+    ring_size: u8, ring: *const u8, msg: *const u8, pseudo_out: *const u8
   ) -> bool;
 }
 

sign/monero/tests/clsag.rs

@@ -126,7 +126,7 @@ fn test_multisig() -> Result<(), SignError> {
           .enumerate()
           .map(|(idx, value)| if idx == i { None } else { value.to_owned() })
           .collect::<Vec<Option<Vec<u8>>>>(),
-        b"Hello World"
+        &vec![]
       ).unwrap()
     );
   }