Ecosystem/serai
Ecosystem/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2024-11-17 01:17:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix mutual_scalar_from_bytes

Browse source 
It didn't properly grab bits, nor did it double as needed.
This commit is contained in:
Luke Parker 2022-07-05 08:10:16 -04:00
parent bfe34ea6f8
commit d17c9587b5
No known key found for this signature in database
GPG key ID: F9F1386DB1E119B6
2 changed files with 22 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
crypto/dleq/src/cross_group/mod.rs
View file

@ -12,7 +12,7 @@ use group::{ff::{Field, PrimeField, PrimeFieldBits}, prime::PrimeGroup};
use crate::Generators; use crate::Generators;
pub mod scalar; pub mod scalar;
use scalar::scalar_convert; use scalar::{scalar_convert, mutual_scalar_from_bytes};
pub(crate) mod schnorr; pub(crate) mod schnorr;
use schnorr::SchnorrPoK; use schnorr::SchnorrPoK;
@ -121,22 +121,11 @@ impl<G0: PrimeGroup, G1: PrimeGroup> DLEqProof<G0, G1>
blinding_key blinding_key
} }
fn mutual_scalar_from_bytes(bytes: &[u8]) -> (G0::Scalar, G1::Scalar) {
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
debug_assert!((bytes.len() * 8) >= capacity);
let mut accum = G0::Scalar::zero();
for b in 0 .. capacity {
accum += G0::Scalar::from((bytes[b / 8] & (1 << (b % 8))).into());
}
(accum, scalar_convert(accum).unwrap())
}
#[allow(non_snake_case)] #[allow(non_snake_case)]
fn nonces<T: Transcript>(mut transcript: T, nonces: (G0, G1)) -> (G0::Scalar, G1::Scalar) { fn nonces<T: Transcript>(mut transcript: T, nonces: (G0, G1)) -> (G0::Scalar, G1::Scalar) {
transcript.append_message(b"nonce_0", nonces.0.to_bytes().as_ref()); transcript.append_message(b"nonce_0", nonces.0.to_bytes().as_ref());
transcript.append_message(b"nonce_1", nonces.1.to_bytes().as_ref()); transcript.append_message(b"nonce_1", nonces.1.to_bytes().as_ref());
Self::mutual_scalar_from_bytes(transcript.challenge(b"challenge").as_ref()) mutual_scalar_from_bytes(transcript.challenge(b"challenge").as_ref())
} }
#[allow(non_snake_case)] #[allow(non_snake_case)]
@ -268,7 +257,7 @@ impl<G0: PrimeGroup, G1: PrimeGroup> DLEqProof<G0, G1>
rng, rng,
transcript, transcript,
generators, generators,
Self::mutual_scalar_from_bytes(digest.finalize().as_ref()) mutual_scalar_from_bytes(digest.finalize().as_ref())
) )
} }

23
crypto/dleq/src/cross_group/scalar.rs
View file

@ -18,10 +18,12 @@ pub fn scalar_normalize<F0: PrimeFieldBits, F1: PrimeFieldBits>(scalar: F0) -> (
for bit in bits.iter().skip(bits.len() - usize::try_from(mutual_capacity).unwrap()) { for bit in bits.iter().skip(bits.len() - usize::try_from(mutual_capacity).unwrap()) {
res1 = res1.double(); res1 = res1.double();
res2 = res2.double(); res2 = res2.double();
if *bit {
res1 += F0::one(); let bit = *bit as u8;
res2 += F1::one(); debug_assert_eq!(bit | 1, 1);
}
res1 += F0::from(bit.into());
res2 += F1::from(bit.into());
} }
(res1, res2) (res1, res2)
@ -32,3 +34,16 @@ pub fn scalar_convert<F0: PrimeFieldBits, F1: PrimeFieldBits>(scalar: F0) -> Opt
let (valid, converted) = scalar_normalize(scalar); let (valid, converted) = scalar_normalize(scalar);
Some(converted).filter(|_| scalar == valid) Some(converted).filter(|_| scalar == valid)
} }
/// Create a mutually valid scalar from bytes via bit truncation to not introduce bias
pub fn mutual_scalar_from_bytes<F0: PrimeFieldBits, F1: PrimeFieldBits>(bytes: &[u8]) -> (F0, F1) {
let capacity = usize::try_from(F0::CAPACITY.min(F1::CAPACITY)).unwrap();
debug_assert!((bytes.len() * 8) >= capacity);
let mut accum = F0::zero();
for b in 0 .. capacity {
accum = accum.double();
accum += F0::from(((bytes[b / 8] >> (b % 8)) & 1).into());
}
(accum, scalar_convert(accum).unwrap())
}