diff --git a/coins/monero/src/ringct/bulletproofs/core.rs b/coins/monero/src/ringct/bulletproofs/core.rs index 6e1a6a3a..b2d5691f 100644 --- a/coins/monero/src/ringct/bulletproofs/core.rs +++ b/coins/monero/src/ringct/bulletproofs/core.rs @@ -4,44 +4,40 @@ use lazy_static::lazy_static; use rand_core::{RngCore, CryptoRng}; -use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint}; +use curve25519_dalek::edwards::EdwardsPoint as DalekPoint; use group::{ff::Field, Group}; -use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint}; +use dalek_ff_group::{Scalar, EdwardsPoint}; -use multiexp::{BatchVerifier, multiexp as multiexp_const}; - -fn prove_multiexp(pairs: &[(Scalar, EdwardsPoint)]) -> EdwardsPoint { - multiexp_const(pairs) * *INV_EIGHT -} +use multiexp::multiexp as multiexp_const; use crate::{ H as DALEK_H, Commitment, hash, hash_to_scalar as dalek_hash, - ringct::{hash_to_point::raw_hash_to_point, bulletproofs::scalar_vector::*}, - serialize::write_varint, + ringct::hash_to_point::raw_hash_to_point, serialize::write_varint, }; +pub(crate) use crate::ringct::bulletproofs::scalar_vector::*; // Bring things into ff/group lazy_static! { - static ref INV_EIGHT: Scalar = Scalar::from(8u8).invert().unwrap(); - static ref H: EdwardsPoint = EdwardsPoint(*DALEK_H); + pub(crate) static ref INV_EIGHT: Scalar = Scalar::from(8u8).invert().unwrap(); + pub(crate) static ref H: EdwardsPoint = EdwardsPoint(*DALEK_H); } -fn hash_to_scalar(data: &[u8]) -> Scalar { +pub(crate) fn hash_to_scalar(data: &[u8]) -> Scalar { Scalar(dalek_hash(data)) } // Components common between variants pub(crate) const MAX_M: usize = 16; -const N: usize = 64; -const MAX_MN: usize = MAX_M * N; +pub(crate) const N: usize = 64; +pub(crate) const MAX_MN: usize = MAX_M * N; -struct Generators { - G: Vec, - H: Vec, +pub(crate) struct Generators { + pub(crate) G: Vec, + pub(crate) H: Vec, } -fn generators_core(prefix: &'static [u8]) -> Generators { +pub(crate) fn generators_core(prefix: &'static [u8]) -> Generators { let mut res = Generators { G: Vec::with_capacity(MAX_MN), H: Vec::with_capacity(MAX_MN) }; for i in 0 .. MAX_MN { let i = 2 * i; @@ -58,13 +54,21 @@ fn generators_core(prefix: &'static [u8]) -> Generators { res } +pub(crate) fn prove_multiexp(pairs: &[(Scalar, EdwardsPoint)]) -> EdwardsPoint { + multiexp_const(pairs) * *INV_EIGHT +} + // TODO: Have this take in other, multiplied by G, and do a single multiexp -fn vector_exponent(generators: &Generators, a: &ScalarVector, b: &ScalarVector) -> EdwardsPoint { +pub(crate) fn vector_exponent( + generators: &Generators, + a: &ScalarVector, + b: &ScalarVector, +) -> EdwardsPoint { debug_assert_eq!(a.len(), b.len()); (a * &generators.G[.. a.len()]) + (b * &generators.H[.. b.len()]) } -fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar { +pub(crate) fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar { let slice = &[cache.to_bytes().as_ref(), mash.iter().cloned().flatten().collect::>().as_ref()] .concat(); @@ -72,7 +76,7 @@ fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar { *cache } -fn MN(outputs: usize) -> (usize, usize, usize) { +pub(crate) fn MN(outputs: usize) -> (usize, usize, usize) { let logN = 6; debug_assert_eq!(N, 1 << logN); @@ -88,7 +92,7 @@ fn MN(outputs: usize) -> (usize, usize, usize) { (logM + logN, M, M * N) } -fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) { +pub(crate) fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) { let (_, M, MN) = MN(commitments.len()); let sv = commitments.iter().map(|c| Scalar::from(c.amount)).collect::>(); @@ -108,14 +112,14 @@ fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) { (aL, aR) } -fn hash_commitments>( +pub(crate) fn hash_commitments>( commitments: C, ) -> (Scalar, Vec) { let V = commitments.into_iter().map(|c| EdwardsPoint(c) * *INV_EIGHT).collect::>(); (hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::>()), V) } -fn alpha_rho( +pub(crate) fn alpha_rho( rng: &mut R, generators: &Generators, aL: &ScalarVector, @@ -125,7 +129,7 @@ fn alpha_rho( (ar, (vector_exponent(generators, aL, aR) + (EdwardsPoint::generator() * ar)) * *INV_EIGHT) } -fn LR_statements( +pub(crate) fn LR_statements( a: &ScalarVector, G_i: &[EdwardsPoint], b: &ScalarVector, @@ -145,439 +149,5 @@ fn LR_statements( } lazy_static! { - static ref TWO_N: ScalarVector = ScalarVector::powers(Scalar::from(2u8), N); -} - -// Bulletproofs-specific -lazy_static! { - static ref GENERATORS: Generators = generators_core(b"bulletproof"); - static ref ONE_N: ScalarVector = ScalarVector(vec![Scalar::one(); N]); - static ref IP12: Scalar = inner_product(&ONE_N, &TWO_N); -} - -// Bulletproofs+-specific -lazy_static! { - static ref GENERATORS_PLUS: Generators = generators_core(b"bulletproof_plus"); - static ref TRANSCRIPT_PLUS: [u8; 32] = - EdwardsPoint(raw_hash_to_point(hash(b"bulletproof_plus_transcript"))).compress().to_bytes(); -} - -// TRANSCRIPT_PLUS isn't a Scalar, so we need this alternative for the first hash -fn hash_plus(mash: &[u8]) -> Scalar { - hash_to_scalar(&[&*TRANSCRIPT_PLUS as &[u8], mash].concat()) -} - -#[derive(Clone, PartialEq, Eq, Debug)] -pub struct OriginalStruct { - pub(crate) A: DalekPoint, - pub(crate) S: DalekPoint, - pub(crate) T1: DalekPoint, - pub(crate) T2: DalekPoint, - pub(crate) taux: DalekScalar, - pub(crate) mu: DalekScalar, - pub(crate) L: Vec, - pub(crate) R: Vec, - pub(crate) a: DalekScalar, - pub(crate) b: DalekScalar, - pub(crate) t: DalekScalar, -} - -impl OriginalStruct { - #[must_use] - fn verify_core( - &self, - rng: &mut R, - verifier: &mut BatchVerifier, - id: ID, - commitments: &[DalekPoint], - ) -> bool { - // Verify commitments are valid - if commitments.is_empty() || (commitments.len() > MAX_M) { - return false; - } - - // Verify L and R are properly sized - if self.L.len() != self.R.len() { - return false; - } - - let (logMN, M, MN) = MN(commitments.len()); - if self.L.len() != logMN { - return false; - } - - // Rebuild all challenges - let (mut cache, commitments) = hash_commitments(commitments.iter().cloned()); - let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]); - - let z = hash_to_scalar(&y.to_bytes()); - cache = z; - - let x = hash_cache( - &mut cache, - &[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()], - ); - - let x_ip = hash_cache( - &mut cache, - &[x.to_bytes(), self.taux.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()], - ); - - let mut w = Vec::with_capacity(logMN); - let mut winv = Vec::with_capacity(logMN); - for (L, R) in self.L.iter().zip(&self.R) { - w.push(hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()])); - winv.push(cache.invert().unwrap()); - } - - // Convert the proof from * INV_EIGHT to its actual form - let normalize = |point: &DalekPoint| EdwardsPoint(point.mul_by_cofactor()); - - let L = self.L.iter().map(normalize).collect::>(); - let R = self.R.iter().map(normalize).collect::>(); - let T1 = normalize(&self.T1); - let T2 = normalize(&self.T2); - let A = normalize(&self.A); - let S = normalize(&self.S); - - let commitments = commitments.iter().map(|c| c.mul_by_cofactor()).collect::>(); - - // Verify it - let mut proof = Vec::with_capacity(4 + commitments.len()); - - let zpow = ScalarVector::powers(z, M + 3); - let ip1y = ScalarVector::powers(y, M * N).sum(); - let mut k = -(zpow[2] * ip1y); - for j in 1 ..= M { - k -= zpow[j + 2] * *IP12; - } - let y1 = Scalar(self.t) - ((z * ip1y) + k); - proof.push((-y1, *H)); - - proof.push((-Scalar(self.taux), G)); - - for (j, commitment) in commitments.iter().enumerate() { - proof.push((zpow[j + 2], *commitment)); - } - - proof.push((x, T1)); - proof.push((x * x, T2)); - verifier.queue(&mut *rng, id, proof); - - proof = Vec::with_capacity(4 + (2 * (MN + logMN))); - let z3 = (Scalar(self.t) - (Scalar(self.a) * Scalar(self.b))) * x_ip; - proof.push((z3, *H)); - proof.push((-Scalar(self.mu), G)); - - proof.push((Scalar::one(), A)); - proof.push((x, S)); - - { - let ypow = ScalarVector::powers(y, MN); - let yinv = y.invert().unwrap(); - let yinvpow = ScalarVector::powers(yinv, MN); - - let mut w_cache = vec![Scalar::zero(); MN]; - w_cache[0] = winv[0]; - w_cache[1] = w[0]; - for j in 1 .. logMN { - let mut slots = (1 << (j + 1)) - 1; - while slots > 0 { - w_cache[slots] = w_cache[slots / 2] * w[j]; - w_cache[slots - 1] = w_cache[slots / 2] * winv[j]; - slots = slots.saturating_sub(2); - } - } - - for w in &w_cache { - debug_assert!(!bool::from(w.is_zero())); - } - - for i in 0 .. MN { - let g = (Scalar(self.a) * w_cache[i]) + z; - proof.push((-g, GENERATORS.G[i])); - - let mut h = Scalar(self.b) * yinvpow[i] * w_cache[(!i) & (MN - 1)]; - h -= ((zpow[(i / N) + 2] * TWO_N[i % N]) + (z * ypow[i])) * yinvpow[i]; - proof.push((-h, GENERATORS.H[i])); - } - } - - for i in 0 .. logMN { - proof.push((w[i] * w[i], L[i])); - proof.push((winv[i] * winv[i], R[i])); - } - verifier.queue(rng, id, proof); - - true - } - - #[must_use] - pub(crate) fn verify( - &self, - rng: &mut R, - commitments: &[DalekPoint], - ) -> bool { - let mut verifier = BatchVerifier::new(4 + commitments.len() + 4 + (2 * (MAX_MN + 10))); - if self.verify_core(rng, &mut verifier, (), commitments) { - verifier.verify_vartime() - } else { - false - } - } - - #[must_use] - pub(crate) fn batch_verify( - &self, - rng: &mut R, - verifier: &mut BatchVerifier, - id: ID, - commitments: &[DalekPoint], - ) -> bool { - self.verify_core(rng, verifier, id, commitments) - } -} - -#[derive(Clone, PartialEq, Eq, Debug)] -pub struct PlusStruct { - pub(crate) A: DalekPoint, - pub(crate) A1: DalekPoint, - pub(crate) B: DalekPoint, - pub(crate) r1: DalekScalar, - pub(crate) s1: DalekScalar, - pub(crate) d1: DalekScalar, - pub(crate) L: Vec, - pub(crate) R: Vec, -} - -#[allow(clippy::large_enum_variant)] -#[derive(Clone, PartialEq, Eq, Debug)] -pub enum Bulletproofs { - Original(OriginalStruct), - Plus(PlusStruct), -} - -pub(crate) fn prove( - rng: &mut R, - commitments: &[Commitment], -) -> Bulletproofs { - let (logMN, M, MN) = MN(commitments.len()); - - let (aL, aR) = bit_decompose(commitments); - let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); - let (alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR); - - let (sL, sR) = - ScalarVector((0 .. (MN * 2)).map(|_| Scalar::random(&mut *rng)).collect::>()).split(); - let (rho, S) = alpha_rho(&mut *rng, &GENERATORS, &sL, &sR); - - let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]); - let mut cache = hash_to_scalar(&y.to_bytes()); - let z = cache; - - let l0 = &aL - z; - let l1 = sL; - - let mut zero_twos = Vec::with_capacity(MN); - let zpow = ScalarVector::powers(z, M + 2); - for j in 0 .. M { - for i in 0 .. N { - zero_twos.push(zpow[j + 2] * TWO_N[i]); - } - } - - let yMN = ScalarVector::powers(y, MN); - let r0 = (&(aR + z) * &yMN) + ScalarVector(zero_twos); - let r1 = yMN * sR; - - let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0); - let t2 = inner_product(&l1, &r1); - - let tau1 = Scalar::random(&mut *rng); - let tau2 = Scalar::random(rng); - - let T1 = prove_multiexp(&[(t1, *H), (tau1, EdwardsPoint::generator())]); - let T2 = prove_multiexp(&[(t2, *H), (tau2, EdwardsPoint::generator())]); - - let x = - hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]); - - let mut taux = (tau2 * (x * x)) + (tau1 * x); - for (i, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() { - taux += zpow[i + 2] * gamma; - } - let mu = (x * rho) + alpha; - - let l = &l0 + &(l1 * x); - let r = &r0 + &(r1 * x); - - let t = inner_product(&l, &r); - - let x_ip = hash_cache(&mut cache, &[x.to_bytes(), taux.to_bytes(), mu.to_bytes(), t.to_bytes()]); - - let mut a = l; - let mut b = r; - - let yinv = y.invert().unwrap(); - let yinvpow = ScalarVector::powers(yinv, MN); - - let mut G_proof = GENERATORS.G[.. a.len()].to_vec(); - let mut H_proof = GENERATORS.H[.. a.len()].to_vec(); - H_proof.iter_mut().zip(yinvpow.0.iter()).for_each(|(this_H, yinvpow)| *this_H *= yinvpow); - let U = *H * x_ip; - - let mut L = Vec::with_capacity(logMN); - let mut R = Vec::with_capacity(logMN); - - while a.len() != 1 { - let (aL, aR) = a.split(); - let (bL, bR) = b.split(); - - let cL = inner_product(&aL, &bR); - let cR = inner_product(&aR, &bL); - - let (G_L, G_R) = G_proof.split_at(aL.len()); - let (H_L, H_R) = H_proof.split_at(aL.len()); - - let L_i = prove_multiexp(&LR_statements(&aL, G_R, &bR, H_L, cL, U)); - let R_i = prove_multiexp(&LR_statements(&aR, G_L, &bL, H_R, cR, U)); - L.push(L_i); - R.push(R_i); - - let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]); - let winv = w.invert().unwrap(); - - a = (aL * w) + (aR * winv); - b = (bL * winv) + (bR * w); - - if a.len() != 1 { - G_proof = hadamard_fold(G_L, G_R, winv, w); - H_proof = hadamard_fold(H_L, H_R, w, winv); - } - } - - Bulletproofs::Original(OriginalStruct { - A: *A, - S: *S, - T1: *T1, - T2: *T2, - taux: *taux, - mu: *mu, - L: L.drain(..).map(|L| *L).collect(), - R: R.drain(..).map(|R| *R).collect(), - a: *a[0], - b: *b[0], - t: *t, - }) -} - -pub(crate) fn prove_plus( - rng: &mut R, - commitments: &[Commitment], -) -> Bulletproofs { - let (logMN, M, MN) = MN(commitments.len()); - - let (aL, aR) = bit_decompose(commitments); - let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); - cache = hash_plus(&cache.to_bytes()); - let (mut alpha1, A) = alpha_rho(&mut *rng, &GENERATORS_PLUS, &aL, &aR); - - let y = hash_cache(&mut cache, &[A.compress().to_bytes()]); - let mut cache = hash_to_scalar(&y.to_bytes()); - let z = cache; - - let zpow = ScalarVector::even_powers(z, 2 * M); - // d[j*N+i] = z**(2*(j+1)) * 2**i - let mut d = vec![Scalar::zero(); MN]; - for j in 0 .. M { - for i in 0 .. N { - d[(j * N) + i] = zpow[j] * TWO_N[i]; - } - } - - let aL1 = aL - z; - - let ypow = ScalarVector::powers(y, MN + 2); - let mut y_for_d = ScalarVector(ypow.0[1 ..= MN].to_vec()); - y_for_d.0.reverse(); - let aR1 = (aR + z) + (y_for_d * ScalarVector(d)); - - for (j, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() { - alpha1 += zpow[j] * ypow[MN + 1] * gamma; - } - - let mut a = aL1; - let mut b = aR1; - - let yinv = y.invert().unwrap(); - let yinvpow = ScalarVector::powers(yinv, MN); - - let mut G_proof = GENERATORS_PLUS.G[.. a.len()].to_vec(); - let mut H_proof = GENERATORS_PLUS.H[.. a.len()].to_vec(); - - let mut L = Vec::with_capacity(logMN); - let mut R = Vec::with_capacity(logMN); - - while a.len() != 1 { - let (aL, aR) = a.split(); - let (bL, bR) = b.split(); - - let cL = weighted_inner_product(&aL, &bR, y); - let cR = weighted_inner_product(&(&aR * ypow[aR.len()]), &bL, y); - - let (dL, dR) = (Scalar::random(&mut *rng), Scalar::random(&mut *rng)); - - let (G_L, G_R) = G_proof.split_at(aL.len()); - let (H_L, H_R) = H_proof.split_at(aL.len()); - - let mut L_i = LR_statements(&(&aL * yinvpow[aL.len()]), G_R, &bR, H_L, cL, *H); - L_i.push((dL, G)); - let L_i = prove_multiexp(&L_i); - L.push(L_i); - - let mut R_i = LR_statements(&(&aR * ypow[aR.len()]), G_L, &bL, H_R, cR, *H); - R_i.push((dR, G)); - let R_i = prove_multiexp(&R_i); - R.push(R_i); - - let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]); - let winv = w.invert().unwrap(); - - G_proof = hadamard_fold(G_L, G_R, winv, w * yinvpow[aL.len()]); - H_proof = hadamard_fold(H_L, H_R, w, winv); - - a = (&aL * w) + (aR * (winv * ypow[aL.len()])); - b = (bL * winv) + (bR * w); - - alpha1 += (dL * (w * w)) + (dR * (winv * winv)); - } - - let r = Scalar::random(&mut *rng); - let s = Scalar::random(&mut *rng); - let d = Scalar::random(&mut *rng); - let eta = Scalar::random(rng); - - let A1 = prove_multiexp(&[ - (r, G_proof[0]), - (s, H_proof[0]), - (d, G), - ((r * y * b[0]) + (s * y * a[0]), *H), - ]); - let B = prove_multiexp(&[(r * y * s, *H), (eta, G)]); - let e = hash_cache(&mut cache, &[A1.compress().to_bytes(), B.compress().to_bytes()]); - - let r1 = (a[0] * e) + r; - let s1 = (b[0] * e) + s; - let d1 = ((d * e) + eta) + (alpha1 * (e * e)); - - Bulletproofs::Plus(PlusStruct { - A: *A, - A1: *A1, - B: *B, - r1: *r1, - s1: *s1, - d1: *d1, - L: L.drain(..).map(|L| *L).collect(), - R: R.drain(..).map(|R| *R).collect(), - }) + pub(crate) static ref TWO_N: ScalarVector = ScalarVector::powers(Scalar::from(2u8), N); } diff --git a/coins/monero/src/ringct/bulletproofs/mod.rs b/coins/monero/src/ringct/bulletproofs/mod.rs index c75cc777..bf5976da 100644 --- a/coins/monero/src/ringct/bulletproofs/mod.rs +++ b/coins/monero/src/ringct/bulletproofs/mod.rs @@ -8,12 +8,22 @@ use multiexp::BatchVerifier; use crate::{Commitment, wallet::TransactionError, serialize::*}; pub(crate) mod scalar_vector; +pub(crate) mod core; -pub mod core; -pub(crate) use self::core::Bulletproofs; -use self::core::{MAX_M, OriginalStruct, PlusStruct, prove, prove_plus}; +pub(crate) mod original; +pub(crate) mod plus; -pub(crate) const MAX_OUTPUTS: usize = MAX_M; +pub(crate) use self::original::OriginalStruct; +pub(crate) use self::plus::PlusStruct; + +pub(crate) const MAX_OUTPUTS: usize = self::core::MAX_M; + +#[allow(clippy::large_enum_variant)] +#[derive(Clone, PartialEq, Eq, Debug)] +pub enum Bulletproofs { + Original(OriginalStruct), + Plus(PlusStruct), +} impl Bulletproofs { // TODO @@ -39,14 +49,18 @@ impl Bulletproofs { if outputs.len() > MAX_OUTPUTS { return Err(TransactionError::TooManyOutputs)?; } - Ok(if !plus { prove(rng, outputs) } else { prove_plus(rng, outputs) }) + Ok(if !plus { + Bulletproofs::Original(OriginalStruct::prove(rng, outputs)) + } else { + Bulletproofs::Plus(PlusStruct::prove(rng, outputs)) + }) } #[must_use] pub fn verify(&self, rng: &mut R, commitments: &[EdwardsPoint]) -> bool { match self { Bulletproofs::Original(bp) => bp.verify(rng, commitments), - Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"), + Bulletproofs::Plus(bp) => bp.verify(rng, commitments), } } @@ -60,7 +74,7 @@ impl Bulletproofs { ) -> bool { match self { Bulletproofs::Original(bp) => bp.batch_verify(rng, verifier, id, commitments), - Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"), + Bulletproofs::Plus(bp) => bp.batch_verify(rng, verifier, id, commitments), } } diff --git a/coins/monero/src/ringct/bulletproofs/original.rs b/coins/monero/src/ringct/bulletproofs/original.rs new file mode 100644 index 00000000..b94e1c32 --- /dev/null +++ b/coins/monero/src/ringct/bulletproofs/original.rs @@ -0,0 +1,303 @@ +use lazy_static::lazy_static; +use rand_core::{RngCore, CryptoRng}; + +use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint}; + +use group::{ff::Field, Group}; +use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint}; + +use multiexp::BatchVerifier; + +use crate::{Commitment, ringct::bulletproofs::core::*}; + +lazy_static! { + static ref GENERATORS: Generators = generators_core(b"bulletproof"); + static ref ONE_N: ScalarVector = ScalarVector(vec![Scalar::one(); N]); + static ref IP12: Scalar = inner_product(&ONE_N, &TWO_N); +} + +#[derive(Clone, PartialEq, Eq, Debug)] +pub struct OriginalStruct { + pub(crate) A: DalekPoint, + pub(crate) S: DalekPoint, + pub(crate) T1: DalekPoint, + pub(crate) T2: DalekPoint, + pub(crate) taux: DalekScalar, + pub(crate) mu: DalekScalar, + pub(crate) L: Vec, + pub(crate) R: Vec, + pub(crate) a: DalekScalar, + pub(crate) b: DalekScalar, + pub(crate) t: DalekScalar, +} + +impl OriginalStruct { + pub(crate) fn prove( + rng: &mut R, + commitments: &[Commitment], + ) -> OriginalStruct { + let (logMN, M, MN) = MN(commitments.len()); + + let (aL, aR) = bit_decompose(commitments); + let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); + let (alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR); + + let (sL, sR) = + ScalarVector((0 .. (MN * 2)).map(|_| Scalar::random(&mut *rng)).collect::>()).split(); + let (rho, S) = alpha_rho(&mut *rng, &GENERATORS, &sL, &sR); + + let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]); + let mut cache = hash_to_scalar(&y.to_bytes()); + let z = cache; + + let l0 = &aL - z; + let l1 = sL; + + let mut zero_twos = Vec::with_capacity(MN); + let zpow = ScalarVector::powers(z, M + 2); + for j in 0 .. M { + for i in 0 .. N { + zero_twos.push(zpow[j + 2] * TWO_N[i]); + } + } + + let yMN = ScalarVector::powers(y, MN); + let r0 = (&(aR + z) * &yMN) + ScalarVector(zero_twos); + let r1 = yMN * sR; + + let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0); + let t2 = inner_product(&l1, &r1); + + let tau1 = Scalar::random(&mut *rng); + let tau2 = Scalar::random(rng); + + let T1 = prove_multiexp(&[(t1, *H), (tau1, EdwardsPoint::generator())]); + let T2 = prove_multiexp(&[(t2, *H), (tau2, EdwardsPoint::generator())]); + + let x = + hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]); + + let mut taux = (tau2 * (x * x)) + (tau1 * x); + for (i, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() { + taux += zpow[i + 2] * gamma; + } + let mu = (x * rho) + alpha; + + let l = &l0 + &(l1 * x); + let r = &r0 + &(r1 * x); + + let t = inner_product(&l, &r); + + let x_ip = + hash_cache(&mut cache, &[x.to_bytes(), taux.to_bytes(), mu.to_bytes(), t.to_bytes()]); + + let mut a = l; + let mut b = r; + + let yinv = y.invert().unwrap(); + let yinvpow = ScalarVector::powers(yinv, MN); + + let mut G_proof = GENERATORS.G[.. a.len()].to_vec(); + let mut H_proof = GENERATORS.H[.. a.len()].to_vec(); + H_proof.iter_mut().zip(yinvpow.0.iter()).for_each(|(this_H, yinvpow)| *this_H *= yinvpow); + let U = *H * x_ip; + + let mut L = Vec::with_capacity(logMN); + let mut R = Vec::with_capacity(logMN); + + while a.len() != 1 { + let (aL, aR) = a.split(); + let (bL, bR) = b.split(); + + let cL = inner_product(&aL, &bR); + let cR = inner_product(&aR, &bL); + + let (G_L, G_R) = G_proof.split_at(aL.len()); + let (H_L, H_R) = H_proof.split_at(aL.len()); + + let L_i = prove_multiexp(&LR_statements(&aL, G_R, &bR, H_L, cL, U)); + let R_i = prove_multiexp(&LR_statements(&aR, G_L, &bL, H_R, cR, U)); + L.push(L_i); + R.push(R_i); + + let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]); + let winv = w.invert().unwrap(); + + a = (aL * w) + (aR * winv); + b = (bL * winv) + (bR * w); + + if a.len() != 1 { + G_proof = hadamard_fold(G_L, G_R, winv, w); + H_proof = hadamard_fold(H_L, H_R, w, winv); + } + } + + OriginalStruct { + A: *A, + S: *S, + T1: *T1, + T2: *T2, + taux: *taux, + mu: *mu, + L: L.drain(..).map(|L| *L).collect(), + R: R.drain(..).map(|R| *R).collect(), + a: *a[0], + b: *b[0], + t: *t, + } + } + + #[must_use] + fn verify_core( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[DalekPoint], + ) -> bool { + // Verify commitments are valid + if commitments.is_empty() || (commitments.len() > MAX_M) { + return false; + } + + // Verify L and R are properly sized + if self.L.len() != self.R.len() { + return false; + } + + let (logMN, M, MN) = MN(commitments.len()); + if self.L.len() != logMN { + return false; + } + + // Rebuild all challenges + let (mut cache, commitments) = hash_commitments(commitments.iter().cloned()); + let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]); + + let z = hash_to_scalar(&y.to_bytes()); + cache = z; + + let x = hash_cache( + &mut cache, + &[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()], + ); + + let x_ip = hash_cache( + &mut cache, + &[x.to_bytes(), self.taux.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()], + ); + + let mut w = Vec::with_capacity(logMN); + let mut winv = Vec::with_capacity(logMN); + for (L, R) in self.L.iter().zip(&self.R) { + w.push(hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()])); + winv.push(cache.invert().unwrap()); + } + + // Convert the proof from * INV_EIGHT to its actual form + let normalize = |point: &DalekPoint| EdwardsPoint(point.mul_by_cofactor()); + + let L = self.L.iter().map(normalize).collect::>(); + let R = self.R.iter().map(normalize).collect::>(); + let T1 = normalize(&self.T1); + let T2 = normalize(&self.T2); + let A = normalize(&self.A); + let S = normalize(&self.S); + + let commitments = commitments.iter().map(|c| c.mul_by_cofactor()).collect::>(); + + // Verify it + let mut proof = Vec::with_capacity(4 + commitments.len()); + + let zpow = ScalarVector::powers(z, M + 3); + let ip1y = ScalarVector::powers(y, M * N).sum(); + let mut k = -(zpow[2] * ip1y); + for j in 1 ..= M { + k -= zpow[j + 2] * *IP12; + } + let y1 = Scalar(self.t) - ((z * ip1y) + k); + proof.push((-y1, *H)); + + proof.push((-Scalar(self.taux), G)); + + for (j, commitment) in commitments.iter().enumerate() { + proof.push((zpow[j + 2], *commitment)); + } + + proof.push((x, T1)); + proof.push((x * x, T2)); + verifier.queue(&mut *rng, id, proof); + + proof = Vec::with_capacity(4 + (2 * (MN + logMN))); + let z3 = (Scalar(self.t) - (Scalar(self.a) * Scalar(self.b))) * x_ip; + proof.push((z3, *H)); + proof.push((-Scalar(self.mu), G)); + + proof.push((Scalar::one(), A)); + proof.push((x, S)); + + { + let ypow = ScalarVector::powers(y, MN); + let yinv = y.invert().unwrap(); + let yinvpow = ScalarVector::powers(yinv, MN); + + let mut w_cache = vec![Scalar::zero(); MN]; + w_cache[0] = winv[0]; + w_cache[1] = w[0]; + for j in 1 .. logMN { + let mut slots = (1 << (j + 1)) - 1; + while slots > 0 { + w_cache[slots] = w_cache[slots / 2] * w[j]; + w_cache[slots - 1] = w_cache[slots / 2] * winv[j]; + slots = slots.saturating_sub(2); + } + } + + for w in &w_cache { + debug_assert!(!bool::from(w.is_zero())); + } + + for i in 0 .. MN { + let g = (Scalar(self.a) * w_cache[i]) + z; + proof.push((-g, GENERATORS.G[i])); + + let mut h = Scalar(self.b) * yinvpow[i] * w_cache[(!i) & (MN - 1)]; + h -= ((zpow[(i / N) + 2] * TWO_N[i % N]) + (z * ypow[i])) * yinvpow[i]; + proof.push((-h, GENERATORS.H[i])); + } + } + + for i in 0 .. logMN { + proof.push((w[i] * w[i], L[i])); + proof.push((winv[i] * winv[i], R[i])); + } + verifier.queue(rng, id, proof); + + true + } + + #[must_use] + pub(crate) fn verify( + &self, + rng: &mut R, + commitments: &[DalekPoint], + ) -> bool { + let mut verifier = BatchVerifier::new(4 + commitments.len() + 4 + (2 * (MAX_MN + 10))); + if self.verify_core(rng, &mut verifier, (), commitments) { + verifier.verify_vartime() + } else { + false + } + } + + #[must_use] + pub(crate) fn batch_verify( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[DalekPoint], + ) -> bool { + self.verify_core(rng, verifier, id, commitments) + } +} diff --git a/coins/monero/src/ringct/bulletproofs/plus.rs b/coins/monero/src/ringct/bulletproofs/plus.rs new file mode 100644 index 00000000..e3b031c2 --- /dev/null +++ b/coins/monero/src/ringct/bulletproofs/plus.rs @@ -0,0 +1,186 @@ +use lazy_static::lazy_static; +use rand_core::{RngCore, CryptoRng}; + +use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint}; + +use group::ff::Field; +use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint}; + +use multiexp::BatchVerifier; + +use crate::{ + Commitment, hash, + ringct::{hash_to_point::raw_hash_to_point, bulletproofs::core::*}, +}; + +lazy_static! { + static ref GENERATORS: Generators = generators_core(b"bulletproof_plus"); + static ref TRANSCRIPT: [u8; 32] = + EdwardsPoint(raw_hash_to_point(hash(b"bulletproof_plus_transcript"))).compress().to_bytes(); +} + +// TRANSCRIPT isn't a Scalar, so we need this alternative for the first hash +fn hash_plus(mash: &[u8]) -> Scalar { + hash_to_scalar(&[&*TRANSCRIPT as &[u8], mash].concat()) +} + +#[derive(Clone, PartialEq, Eq, Debug)] +pub struct PlusStruct { + pub(crate) A: DalekPoint, + pub(crate) A1: DalekPoint, + pub(crate) B: DalekPoint, + pub(crate) r1: DalekScalar, + pub(crate) s1: DalekScalar, + pub(crate) d1: DalekScalar, + pub(crate) L: Vec, + pub(crate) R: Vec, +} + +impl PlusStruct { + pub(crate) fn prove( + rng: &mut R, + commitments: &[Commitment], + ) -> PlusStruct { + let (logMN, M, MN) = MN(commitments.len()); + + let (aL, aR) = bit_decompose(commitments); + let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate)); + cache = hash_plus(&cache.to_bytes()); + let (mut alpha1, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR); + + let y = hash_cache(&mut cache, &[A.compress().to_bytes()]); + let mut cache = hash_to_scalar(&y.to_bytes()); + let z = cache; + + let zpow = ScalarVector::even_powers(z, 2 * M); + // d[j*N+i] = z**(2*(j+1)) * 2**i + let mut d = vec![Scalar::zero(); MN]; + for j in 0 .. M { + for i in 0 .. N { + d[(j * N) + i] = zpow[j] * TWO_N[i]; + } + } + + let aL1 = aL - z; + + let ypow = ScalarVector::powers(y, MN + 2); + let mut y_for_d = ScalarVector(ypow.0[1 ..= MN].to_vec()); + y_for_d.0.reverse(); + let aR1 = (aR + z) + (y_for_d * ScalarVector(d)); + + for (j, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() { + alpha1 += zpow[j] * ypow[MN + 1] * gamma; + } + + let mut a = aL1; + let mut b = aR1; + + let yinv = y.invert().unwrap(); + let yinvpow = ScalarVector::powers(yinv, MN); + + let mut G_proof = GENERATORS.G[.. a.len()].to_vec(); + let mut H_proof = GENERATORS.H[.. a.len()].to_vec(); + + let mut L = Vec::with_capacity(logMN); + let mut R = Vec::with_capacity(logMN); + + while a.len() != 1 { + let (aL, aR) = a.split(); + let (bL, bR) = b.split(); + + let cL = weighted_inner_product(&aL, &bR, y); + let cR = weighted_inner_product(&(&aR * ypow[aR.len()]), &bL, y); + + let (dL, dR) = (Scalar::random(&mut *rng), Scalar::random(&mut *rng)); + + let (G_L, G_R) = G_proof.split_at(aL.len()); + let (H_L, H_R) = H_proof.split_at(aL.len()); + + let mut L_i = LR_statements(&(&aL * yinvpow[aL.len()]), G_R, &bR, H_L, cL, *H); + L_i.push((dL, G)); + let L_i = prove_multiexp(&L_i); + L.push(L_i); + + let mut R_i = LR_statements(&(&aR * ypow[aR.len()]), G_L, &bL, H_R, cR, *H); + R_i.push((dR, G)); + let R_i = prove_multiexp(&R_i); + R.push(R_i); + + let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]); + let winv = w.invert().unwrap(); + + G_proof = hadamard_fold(G_L, G_R, winv, w * yinvpow[aL.len()]); + H_proof = hadamard_fold(H_L, H_R, w, winv); + + a = (&aL * w) + (aR * (winv * ypow[aL.len()])); + b = (bL * winv) + (bR * w); + + alpha1 += (dL * (w * w)) + (dR * (winv * winv)); + } + + let r = Scalar::random(&mut *rng); + let s = Scalar::random(&mut *rng); + let d = Scalar::random(&mut *rng); + let eta = Scalar::random(rng); + + let A1 = prove_multiexp(&[ + (r, G_proof[0]), + (s, H_proof[0]), + (d, G), + ((r * y * b[0]) + (s * y * a[0]), *H), + ]); + let B = prove_multiexp(&[(r * y * s, *H), (eta, G)]); + let e = hash_cache(&mut cache, &[A1.compress().to_bytes(), B.compress().to_bytes()]); + + let r1 = (a[0] * e) + r; + let s1 = (b[0] * e) + s; + let d1 = ((d * e) + eta) + (alpha1 * (e * e)); + + PlusStruct { + A: *A, + A1: *A1, + B: *B, + r1: *r1, + s1: *s1, + d1: *d1, + L: L.drain(..).map(|L| *L).collect(), + R: R.drain(..).map(|R| *R).collect(), + } + } + + #[must_use] + fn verify_core( + &self, + _rng: &mut R, + _verifier: &mut BatchVerifier, + _id: ID, + _commitments: &[DalekPoint], + ) -> bool { + unimplemented!("Bulletproofs+ verification isn't implemented") + } + + #[must_use] + pub(crate) fn verify( + &self, + rng: &mut R, + commitments: &[DalekPoint], + ) -> bool { + let mut verifier = BatchVerifier::new(4 + commitments.len() + 4 + (2 * (MAX_MN + 10))); + if self.verify_core(rng, &mut verifier, (), commitments) { + verifier.verify_vartime() + } else { + false + } + } + + #[must_use] + pub(crate) fn batch_verify( + &self, + rng: &mut R, + verifier: &mut BatchVerifier, + id: ID, + commitments: &[DalekPoint], + ) -> bool { + self.verify_core(rng, verifier, id, commitments) + } +} diff --git a/coins/monero/src/tests/bulletproofs.rs b/coins/monero/src/tests/bulletproofs.rs index ede0863a..1cfd6115 100644 --- a/coins/monero/src/tests/bulletproofs.rs +++ b/coins/monero/src/tests/bulletproofs.rs @@ -6,7 +6,7 @@ use multiexp::BatchVerifier; use crate::{ Commitment, random_scalar, - ringct::bulletproofs::{Bulletproofs, core::OriginalStruct}, + ringct::bulletproofs::{Bulletproofs, original::OriginalStruct}, }; #[test]