From ee29f6d6d80451b38c99010bb351e18402e70c05 Mon Sep 17 00:00:00 2001 From: Luke Parker Date: Tue, 26 Jul 2022 02:05:15 -0500 Subject: [PATCH] Implement Bulletproofs in Rust (#69) * Initial attempt at Bulletproofs I don't know why this doesn't work. The generators and hash_cache lines up without issue. AFAICT, the inner product proof is valid as well, as are all included formulas. * Add yinvpow asserts * Clean code * Correct bad imports * Fix the definition of TWO_N Bulletproofs work now :D * Tidy up a bit * fmt + clippy * Compile a variety of XMR dependencies with optimizations, even under dev The Rust bulletproof implementation is 8% slower than C right now, under release. This is acceptable, even if suboptimal. Under debug, they take a quarter of a second to two seconds though, depending on the amount of outputs, which justifies this move. * Remove unnecessary deref in BPs --- Cargo.lock | 1 + Cargo.toml | 16 ++ coins/monero/Cargo.toml | 1 + coins/monero/src/ringct/bulletproofs/core.rs | 235 ++++++++++++++++++ .../{bulletproofs.rs => bulletproofs/mod.rs} | 47 +--- .../src/ringct/bulletproofs/scalar_vector.rs | 106 ++++++++ coins/monero/src/ringct/hash_to_point.rs | 13 +- coins/monero/src/tests/hash_to_point.rs | 2 +- crypto/dalek-ff-group/src/lib.rs | 6 + 9 files changed, 382 insertions(+), 45 deletions(-) create mode 100644 coins/monero/src/ringct/bulletproofs/core.rs rename coins/monero/src/ringct/{bulletproofs.rs => bulletproofs/mod.rs} (76%) create mode 100644 coins/monero/src/ringct/bulletproofs/scalar_vector.rs diff --git a/Cargo.lock b/Cargo.lock index 1723ea10..827469f6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4581,6 +4581,7 @@ dependencies = [ "modular-frost", "monero", "monero-epee-bin-serde", + "multiexp", "rand 0.8.5", "rand_chacha 0.3.1", "rand_core 0.6.3", diff --git a/Cargo.toml b/Cargo.toml index bca305b2..3b7eb7d0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -21,6 +21,22 @@ members = [ "contracts/multisig", ] +# Always compile Monero (and a variety of dependencies) with optimizations due +# to the unoptimized performance of Bulletproofs +[profile.dev.package] +subtle = { opt-level = 3 } +curve25519-dalek = { opt-level = 3 } + +ff = { opt-level = 3 } +group = { opt-level = 3 } + +crypto-bigint = { opt-level = 3 } +dalek-ff-group = { opt-level = 3 } + +multiexp = { opt-level = 3 } + +monero-serai = { opt-level = 3 } + [profile.release] panic = "unwind" diff --git a/coins/monero/Cargo.toml b/coins/monero/Cargo.toml index ba0be578..04c7a82d 100644 --- a/coins/monero/Cargo.toml +++ b/coins/monero/Cargo.toml @@ -28,6 +28,7 @@ curve25519-dalek = { version = "3", features = ["std"] } group = { version = "0.12" } dalek-ff-group = { path = "../../crypto/dalek-ff-group" } +multiexp = { path = "../../crypto/multiexp" } transcript = { package = "flexible-transcript", path = "../../crypto/transcript", features = ["recommended"], optional = true } frost = { package = "modular-frost", path = "../../crypto/frost", features = ["ed25519"], optional = true } diff --git a/coins/monero/src/ringct/bulletproofs/core.rs b/coins/monero/src/ringct/bulletproofs/core.rs new file mode 100644 index 00000000..e083dda0 --- /dev/null +++ b/coins/monero/src/ringct/bulletproofs/core.rs @@ -0,0 +1,235 @@ +// Required to be for this entire file, which isn't an issue, as it wouldn't bind to the static +#![allow(non_upper_case_globals)] + +use lazy_static::lazy_static; +use rand_core::{RngCore, CryptoRng}; + +use group::{ff::Field, Group}; +use dalek_ff_group::{Scalar, EdwardsPoint}; + +use multiexp::multiexp; + +use crate::{ + H as DALEK_H, Commitment, random_scalar as dalek_random, hash, hash_to_scalar as dalek_hash, + ringct::{ + hash_to_point::raw_hash_to_point, + bulletproofs::{scalar_vector::*, Bulletproofs}, + }, + serialize::write_varint, +}; + +pub(crate) const MAX_M: usize = 16; +pub(crate) const MAX_N: usize = 64; +const MAX_MN: usize = MAX_M * MAX_N; + +// Wrap random_scalar and hash_to_scalar into dalek_ff_group +fn random_scalar(rng: &mut R) -> Scalar { + Scalar(dalek_random(rng)) +} + +fn hash_to_scalar(data: &[u8]) -> Scalar { + let scalar = Scalar(dalek_hash(data)); + // Monero will explicitly retry on these cases, as them occurring breaks the proof + // This library acknowledges their practical impossibility of them occurring, and doesn't bother + // to code in logic to handle it. That said, if they ever occur, something must happen in order + // to not generate a proof we believe to be valid when it isn't + assert!(!bool::from(scalar.is_zero()), "ZERO HASH: {:?}", data); + scalar +} + +fn generator(i: usize) -> EdwardsPoint { + let mut transcript = (*H).compress().to_bytes().to_vec(); + transcript.extend(b"bulletproof"); + write_varint(&i.try_into().unwrap(), &mut transcript).unwrap(); + EdwardsPoint(raw_hash_to_point(hash(&transcript))) +} + +lazy_static! { + static ref INV_EIGHT: Scalar = Scalar::from(8u8).invert().unwrap(); + static ref H: EdwardsPoint = EdwardsPoint(*DALEK_H); + pub(crate) static ref ONE_N: ScalarVector = ScalarVector(vec![Scalar::one(); MAX_N]); + pub(crate) static ref TWO_N: ScalarVector = ScalarVector::powers(Scalar::from(2u8), MAX_N); + pub(crate) static ref IP12: Scalar = inner_product(&ONE_N, &TWO_N); + static ref H_i: Vec = (0 .. MAX_MN).map(|g| generator(g * 2)).collect(); + static ref G_i: Vec = (0 .. MAX_MN).map(|g| generator((g * 2) + 1)).collect(); +} + +pub(crate) fn vector_exponent(a: &ScalarVector, b: &ScalarVector) -> EdwardsPoint { + assert_eq!(a.len(), b.len()); + (a * &G_i[.. a.len()]) + (b * &H_i[.. b.len()]) +} + +fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar { + let slice = + &[cache.to_bytes().as_ref(), mash.iter().cloned().flatten().collect::>().as_ref()] + .concat(); + *cache = hash_to_scalar(slice); + *cache +} + +pub(crate) fn prove( + rng: &mut R, + commitments: &[Commitment], +) -> Bulletproofs { + let sv = ScalarVector(commitments.iter().cloned().map(|c| Scalar::from(c.amount)).collect()); + let gamma = ScalarVector(commitments.iter().cloned().map(|c| Scalar(c.mask)).collect()); + + let logN = 6; + let N = 1 << logN; + assert_eq!(N, 64); + + let mut logM = 0; + let mut M; + while { + M = 1 << logM; + (M <= MAX_M) && (M < sv.len()) + } { + logM += 1; + } + + let logMN = logM + logN; + let MN = M * N; + + let mut aL = ScalarVector::new(MN); + let mut aR = ScalarVector::new(MN); + + for j in 0 .. M { + for i in (0 .. N).rev() { + if (j < sv.len()) && ((sv[j][i / 8] & (1u8 << (i % 8))) != 0) { + aL.0[(j * N) + i] = Scalar::one(); + } else { + aR.0[(j * N) + i] = -Scalar::one(); + } + } + } + + // Commitments * INV_EIGHT + let V = commitments.iter().map(|c| EdwardsPoint(c.calculate()) * *INV_EIGHT).collect::>(); + let mut cache = + hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::>()); + + let alpha = random_scalar(&mut *rng); + let A = (vector_exponent(&aL, &aR) + (EdwardsPoint::generator() * alpha)) * *INV_EIGHT; + + let (sL, sR) = + ScalarVector((0 .. (MN * 2)).map(|_| random_scalar(&mut *rng)).collect::>()).split(); + let rho = random_scalar(&mut *rng); + let S = (vector_exponent(&sL, &sR) + (EdwardsPoint::generator() * rho)) * *INV_EIGHT; + + let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]); + let mut cache = hash_to_scalar(&y.to_bytes()); + let z = cache; + + let l0 = &aL - z; + let l1 = sL; + + let mut zero_twos = Vec::with_capacity(MN); + let zpow = ScalarVector::powers(z, M + 2); + for j in 0 .. M { + for i in 0 .. N { + zero_twos.push(zpow[j + 2] * TWO_N[i]); + } + } + + let yMN = ScalarVector::powers(y, MN); + let r0 = (&(aR + z) * &yMN) + ScalarVector(zero_twos); + let r1 = yMN * sR; + + let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0); + let t2 = inner_product(&l1, &r1); + + let tau1 = random_scalar(&mut *rng); + let tau2 = random_scalar(&mut *rng); + + let T1 = multiexp(&[(t1, *H), (tau1, EdwardsPoint::generator())]) * *INV_EIGHT; + let T2 = multiexp(&[(t2, *H), (tau2, EdwardsPoint::generator())]) * *INV_EIGHT; + + let x = + hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]); + + let mut taux = (tau2 * (x * x)) + (tau1 * x); + for i in 1 ..= sv.len() { + taux += zpow[i + 1] * gamma[i - 1]; + } + let mu = (x * rho) + alpha; + + let l = &l0 + &(l1 * x); + let r = &r0 + &(r1 * x); + + let t = inner_product(&l, &r); + + let x_ip = hash_cache(&mut cache, &[x.to_bytes(), taux.to_bytes(), mu.to_bytes(), t.to_bytes()]); + + let mut a = l; + let mut b = r; + + let yinv = y.invert().unwrap(); + let yinvpow = ScalarVector::powers(yinv, MN); + + let mut G_proof = G_i[.. a.len()].to_vec(); + let mut H_proof = H_i[.. a.len()].to_vec(); + H_proof.iter_mut().zip(yinvpow.0.iter()).for_each(|(this_H, yinvpow)| *this_H *= yinvpow); + let U = *H * x_ip; + + let mut L = Vec::with_capacity(logMN); + let mut R = Vec::with_capacity(logMN); + + while a.len() != 1 { + let (aL, aR) = a.split(); + let (bL, bR) = b.split(); + + let cL = inner_product(&aL, &bR); + let cR = inner_product(&aR, &bL); + + let (G_L, G_R) = G_proof.split_at(aL.len()); + let (H_L, H_R) = H_proof.split_at(aL.len()); + + let mut L_i_s = aL + .0 + .iter() + .cloned() + .zip(G_R.iter().cloned()) + .chain(bR.0.iter().cloned().zip(H_L.iter().cloned())) + .collect::>(); + L_i_s.push((cL, U)); + let L_i = multiexp(&L_i_s) * *INV_EIGHT; + + let mut R_i_s = aR + .0 + .iter() + .cloned() + .zip(G_L.iter().cloned()) + .chain(bL.0.iter().cloned().zip(H_R.iter().cloned())) + .collect::>(); + R_i_s.push((cR, U)); + let R_i = multiexp(&R_i_s) * *INV_EIGHT; + + L.push(L_i); + R.push(R_i); + + let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]); + let winv = w.invert().unwrap(); + + a = (aL * w) + (aR * winv); + b = (bL * winv) + (bR * w); + + if a.len() != 1 { + G_proof = hadamard_fold(G_L, G_R, winv, w); + H_proof = hadamard_fold(H_L, H_R, w, winv); + } + } + + Bulletproofs { + A: *A, + S: *S, + T1: *T1, + T2: *T2, + taux: *taux, + mu: *mu, + L: L.drain(..).map(|L| *L).collect(), + R: R.drain(..).map(|R| *R).collect(), + a: *a[0], + b: *b[0], + t: *t, + } +} diff --git a/coins/monero/src/ringct/bulletproofs.rs b/coins/monero/src/ringct/bulletproofs/mod.rs similarity index 76% rename from coins/monero/src/ringct/bulletproofs.rs rename to coins/monero/src/ringct/bulletproofs/mod.rs index 5b082c98..2599b2fc 100644 --- a/coins/monero/src/ringct/bulletproofs.rs +++ b/coins/monero/src/ringct/bulletproofs/mod.rs @@ -6,7 +6,13 @@ use curve25519_dalek::{scalar::Scalar, edwards::EdwardsPoint}; use crate::{Commitment, wallet::TransactionError, serialize::*}; -pub(crate) const MAX_OUTPUTS: usize = 16; +pub(crate) mod scalar_vector; + +mod core; +pub(crate) use self::core::MAX_M; +use self::core::prove; + +pub(crate) const MAX_OUTPUTS: usize = MAX_M; #[derive(Clone, PartialEq, Eq, Debug)] pub struct Bulletproofs { @@ -45,44 +51,7 @@ impl Bulletproofs { if outputs.len() > MAX_OUTPUTS { return Err(TransactionError::TooManyOutputs)?; } - - let mut seed = [0; 32]; - rng.fill_bytes(&mut seed); - - let masks = outputs.iter().map(|commitment| commitment.mask.to_bytes()).collect::>(); - let amounts = outputs.iter().map(|commitment| commitment.amount).collect::>(); - - let res; - unsafe { - #[link(name = "wrapper")] - extern "C" { - fn free(ptr: *const u8); - fn c_generate_bp( - seed: *const u8, - len: u8, - amounts: *const u64, - masks: *const [u8; 32], - ) -> *const u8; - } - - let ptr = c_generate_bp( - seed.as_ptr(), - u8::try_from(outputs.len()).unwrap(), - amounts.as_ptr(), - masks.as_ptr(), - ); - - let mut len = 6 * 32; - len += (2 * (1 + (usize::from(ptr.add(len).read()) * 32))) + (3 * 32); - res = Bulletproofs::deserialize( - // Wrap in a cursor to provide a mutable Reader - &mut std::io::Cursor::new(std::slice::from_raw_parts(ptr, len)), - ) - .expect("Couldn't deserialize Bulletproofs from Monero"); - free(ptr); - }; - - Ok(res) + Ok(prove(rng, outputs)) } #[must_use] diff --git a/coins/monero/src/ringct/bulletproofs/scalar_vector.rs b/coins/monero/src/ringct/bulletproofs/scalar_vector.rs new file mode 100644 index 00000000..c9812c8f --- /dev/null +++ b/coins/monero/src/ringct/bulletproofs/scalar_vector.rs @@ -0,0 +1,106 @@ +use core::ops::{Add, Sub, Mul, Index}; + +use group::ff::Field; +use dalek_ff_group::{Scalar, EdwardsPoint}; + +use multiexp::multiexp; + +#[derive(Clone, PartialEq, Eq, Debug)] +pub(crate) struct ScalarVector(pub(crate) Vec); +macro_rules! math_op { + ($Op: ident, $op: ident, $f: expr) => { + impl $Op for ScalarVector { + type Output = ScalarVector; + fn $op(self, b: Scalar) -> ScalarVector { + ScalarVector(self.0.iter().map(|a| $f((a, &b))).collect()) + } + } + + impl $Op for &ScalarVector { + type Output = ScalarVector; + fn $op(self, b: Scalar) -> ScalarVector { + ScalarVector(self.0.iter().map(|a| $f((a, &b))).collect()) + } + } + + impl $Op for ScalarVector { + type Output = ScalarVector; + fn $op(self, b: ScalarVector) -> ScalarVector { + assert_eq!(self.len(), b.len()); + ScalarVector(self.0.iter().zip(b.0.iter()).map($f).collect()) + } + } + + impl $Op<&ScalarVector> for &ScalarVector { + type Output = ScalarVector; + fn $op(self, b: &ScalarVector) -> ScalarVector { + assert_eq!(self.len(), b.len()); + ScalarVector(self.0.iter().zip(b.0.iter()).map($f).collect()) + } + } + }; +} +math_op!(Add, add, |(a, b): (&Scalar, &Scalar)| *a + *b); +math_op!(Sub, sub, |(a, b): (&Scalar, &Scalar)| *a - *b); +math_op!(Mul, mul, |(a, b): (&Scalar, &Scalar)| *a * *b); + +impl ScalarVector { + pub(crate) fn new(len: usize) -> ScalarVector { + ScalarVector(vec![Scalar::zero(); len]) + } + + pub(crate) fn powers(x: Scalar, len: usize) -> ScalarVector { + let mut res = Vec::with_capacity(len); + if len == 0 { + return ScalarVector(res); + } + + res.push(Scalar::one()); + for i in 1 .. len { + res.push(res[i - 1] * x); + } + + ScalarVector(res) + } + + pub(crate) fn len(&self) -> usize { + self.0.len() + } + + pub(crate) fn split(self) -> (ScalarVector, ScalarVector) { + let (l, r) = self.0.split_at(self.0.len() / 2); + (ScalarVector(l.to_vec()), ScalarVector(r.to_vec())) + } +} + +impl Index for ScalarVector { + type Output = Scalar; + fn index(&self, index: usize) -> &Scalar { + &self.0[index] + } +} + +pub(crate) fn inner_product(a: &ScalarVector, b: &ScalarVector) -> Scalar { + (a * b).0.drain(..).sum() +} + +impl Mul<&[EdwardsPoint]> for &ScalarVector { + type Output = EdwardsPoint; + fn mul(self, b: &[EdwardsPoint]) -> EdwardsPoint { + assert_eq!(self.len(), b.len()); + multiexp(&self.0.iter().cloned().zip(b.iter().cloned()).collect::>()) + } +} + +pub(crate) fn hadamard_fold( + l: &[EdwardsPoint], + r: &[EdwardsPoint], + a: Scalar, + b: Scalar, +) -> Vec { + let mut res = Vec::with_capacity(l.len() / 2); + for i in 0 .. l.len() { + res.push(multiexp(&[(a, l[i]), (b, r[i])])); + } + res +} diff --git a/coins/monero/src/ringct/hash_to_point.rs b/coins/monero/src/ringct/hash_to_point.rs index 789ddd80..a28c8b95 100644 --- a/coins/monero/src/ringct/hash_to_point.rs +++ b/coins/monero/src/ringct/hash_to_point.rs @@ -7,12 +7,11 @@ use dalek_ff_group::field::FieldElement; use crate::hash; -pub fn hash_to_point(point: EdwardsPoint) -> EdwardsPoint { - let mut bytes = point.compress().to_bytes(); +pub(crate) fn raw_hash_to_point(mut bytes: [u8; 32]) -> EdwardsPoint { unsafe { #[link(name = "wrapper")] extern "C" { - fn c_hash_to_point(point: *const u8); + fn c_hash_to_point(key: *const u8); } c_hash_to_point(bytes.as_mut_ptr()); @@ -24,11 +23,11 @@ pub fn hash_to_point(point: EdwardsPoint) -> EdwardsPoint { // for all branches, there still could be *some* discrepancy somewhere. There's no reason to use it // unless we're trying to purge that section of the C static library, which we aren't right now #[allow(dead_code)] -pub(crate) fn rust_hash_to_point(key: EdwardsPoint) -> EdwardsPoint { +pub(crate) fn rust_hash_to_point(bytes: [u8; 32]) -> EdwardsPoint { #[allow(non_snake_case)] let A = FieldElement::from(486662u64); - let v = FieldElement::from_square(hash(&key.compress().to_bytes())).double(); + let v = FieldElement::from_square(hash(&bytes)).double(); let w = v + FieldElement::one(); let x = w.square() + (-A.square() * v); @@ -65,3 +64,7 @@ pub(crate) fn rust_hash_to_point(key: EdwardsPoint) -> EdwardsPoint { CompressedEdwardsY(bytes).decompress().unwrap().mul_by_cofactor() } + +pub fn hash_to_point(key: EdwardsPoint) -> EdwardsPoint { + raw_hash_to_point(key.compress().to_bytes()) +} diff --git a/coins/monero/src/tests/hash_to_point.rs b/coins/monero/src/tests/hash_to_point.rs index eeaf18ef..983539e5 100644 --- a/coins/monero/src/tests/hash_to_point.rs +++ b/coins/monero/src/tests/hash_to_point.rs @@ -11,6 +11,6 @@ use crate::{ fn hash_to_point() { for _ in 0 .. 50 { let point = &random_scalar(&mut OsRng) * &ED25519_BASEPOINT_TABLE; - assert_eq!(rust_hash_to_point(point), c_hash_to_point(point)); + assert_eq!(rust_hash_to_point(point.compress().to_bytes()), c_hash_to_point(point)); } } diff --git a/crypto/dalek-ff-group/src/lib.rs b/crypto/dalek-ff-group/src/lib.rs index 7f453f53..66a32267 100644 --- a/crypto/dalek-ff-group/src/lib.rs +++ b/crypto/dalek-ff-group/src/lib.rs @@ -264,6 +264,12 @@ impl PrimeFieldBits for Scalar { } } +impl Sum for Scalar { + fn sum>(iter: I) -> Scalar { + Self(DScalar::sum(iter)) + } +} + macro_rules! dalek_group { ( $Point: ident,