This still sends a fingerprinting flare up if you send to a subaddress which
needs to be fixed. Despite that, Monero no should no longer fail to scan TXs
from monero-serai regarding additional keys.
Previously it failed becuase we supplied one key as THE key, and n-1 as
additional. Monero expects n for additional.
This does correctly select when to use THE key versus when to use the additional
key when sending. That removes the ability for recipients to fingerprint
monero-serai by receiving to a standard address yet needing to use an additional
key.
* Initial work on an In Inherents pallet
* Add an event for when a batch is executed
* Add a dummy provider for InInstructions
* Add in-instructions to the node
* Add the Serai runtime API to the processor
* Move processor tests around
* Build a subxt Client around Serai
* Successfully get Batch events from Serai
Renamed processor/substrate to processor/serai.
* Much more robust InInstruction pallet
* Implement the workaround from https://github.com/paritytech/subxt/issues/602
* Initial prototype of processor generated InInstructions
* Correct PendingCoins data flow for InInstructions
* Minor lint to in-instructions
* Remove the global Serai connection for a partial re-impl
* Correct ID handling of the processor test
* Workaround the delay in the subscription
* Make an unwrap an if let Some, remove old comments
* Lint the processor toml
* Rebase and update
* Move substrate/in-instructions to substrate/in-instructions/pallet
* Start an in-instructions primitives lib
* Properly update processor to subxt 0.24
Also corrects failures from the rebase.
* in-instructions cargo update
* Implement IsFatalError
* is_inherent -> true
* Rename in-instructions crates and misc cleanup
* Update documentation
* cargo update
* Misc update fixes
* Replace height with block_number
* Update processor src to latest subxt
* Correct pipeline for InInstructions testing
* Remove runtime::AccountId for serai_primitives::NativeAddress
* Rewrite the in-instructions pallet
Complete with respect to the currently written docs.
Drops the custom serializer for just using SCALE.
Makes slight tweaks as relevant.
* Move instructions' InherentDataProvider to a client crate
* Correct doc gen
* Add serde to in-instructions-primitives
* Add in-instructions-primitives to pallet
* Heights -> BlockNumbers
* Get batch pub test loop working
* Update in instructions pallet terminology
Removes the ambiguous Coin for Update.
Removes pending/artificial latency for furture client work.
Also moves to using serai_primitives::Coin.
* Add a BlockNumber primitive
* Belated cargo fmt
* Further document why DifferentBatch isn't fatal
* Correct processor sleeps
* Remove metadata at compile time, add test framework for Serai nodes
* Remove manual RPC client
* Simplify update test
* Improve re-exporting behavior of serai-runtime
It now re-exports all pallets underneath it.
* Add a function to get storage values to the Serai RPC
* Update substrate/ to latest substrate
* Create a dedicated crate for the Serai RPC
* Remove unused dependencies in substrate/
* Remove unused dependencies in coins/
Out of scope for this branch, just minor and path of least resistance.
* Use substrate/serai/client for the Serai RPC lib
It's a bit out of place, since these client folders are intended for the node to
access pallets and so on. This is for end-users to access Serai as a whole.
In that sense, it made more sense as a top level folder, yet that also felt
out of place.
* Move InInstructions test to serai-client for now
* Final cleanup
* Update deny.toml
* Cargo.lock update from merging develop
* Update nightly
Attempt to work around the current CI failure, which is a Rust ICE.
We previously didn't upgrade due to clippy 10134, yet that's been reverted.
* clippy
* clippy
* fmt
* NativeAddress -> SeraiAddress
* Sec fix on non-provided updates and doc fixes
* Add Serai as a Coin
Necessary in order to swap to Serai.
* Add a BlockHash type, used for batch IDs
* Remove origin from InInstruction
Makes InInstructionTarget. Adds RefundableInInstruction with origin.
* Document storage items in in-instructions
* Rename serai/client/tests/serai.rs to updates.rs
It only tested publishing updates and their successful acceptance.
* convert AddressSpec subbaddress to tuple
* add wallet-rpc tests
* fix payment id decryption bug
* run fmt
* fix CI
* use monero-rs wallet-rpc for tests
* update the subaddress index type
* fix wallet-rpc CI
* fix monero-wallet-rpc CI actions
* pull latest monero for CI
* fix pr issues
* detach monero wallet rpc
Co-authored-by: Luke Parker <lukeparker5132@gmail.com>
Not only did we already have multiple booleans in it, yet it theoretically
could expand in the future. Not only is this more explicit, it actually cleans
some existing code.
commit e0a9e8825d6c22c797fb84e26ed6ef10136ca9c2
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Fri Jan 6 04:24:08 2023 -0500
Remove Scanner::address
It either needed to return an Option, panic on misconfiguration, or return a
distinct Scanner type based on burning bug immunity to offer this API properly.
Panicking wouldn't be proper, and the Option<Address> would've been... awkward.
The new register_subaddress function, maintaining the needed functionality,
also provides further clarity on the intended side effect of the previously
present Scanner::address function.
commit 7359360ab2fc8c9255c6f58250c214252ce217a4
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Fri Jan 6 01:35:02 2023 -0500
fmt/clippy from last commit
commit 80d912fc19cd268f3b019a9d9961a48b2c45e828
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Thu Jan 5 19:36:49 2023 -0500
Add Substrate "assets" pallet
While over-engineered for our purposes, it's still usable.
Also cleans the runtime a bit.
commit 2ed2944b6598d75bdc3c995aaf39b717846207de
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Wed Jan 4 23:09:58 2023 -0500
Remove the timestamp pallet
It was needed for contracts, which has since been removed. We now no longer
need it.
commit 7fc1fc2dccecebe1d94cb7b4c00f2b5cb271c87b
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Wed Jan 4 22:52:41 2023 -0500
Initial validator sets pallet (#187)
* Initial work on a Validator Sets pallet
* Update Validator Set docs per current discussions
* Update validator-sets primitives and storage handling
* Add validator set pallets to deny.toml
* Remove Curve from primitives
Since we aren't reusing keys across coins, there's no reason for it to be
on-chain (as previously planned).
* Update documentation on Validator Sets
* Use Twox64Concat instead of Identity
Ensures an even distribution of keys. While xxhash is breakable, these keys
aren't manipulatable by users.
* Add math ops on Amount and define a coin as 1e8
* Add validator-sets to the runtime and remove contracts
Also removes the randomness pallet which was only required by the contracts
runtime.
Does not remove the contracts folder yet so they can still be referred to while
validator-sets is under development. Does remove them from Cargo.toml.
* Add vote function to validator-sets
* Remove contracts folder
* Create an event for the Validator Sets pallet
* Remove old contracts crates from deny.toml
* Remove line from staking branch
* Remove staking from runtime
* Correct VS Config in runtime
* cargo update
* Resolve a few PR comments on terminology
* Create a serai-primitives crate
Move types such as Amount/Coin out of validator-sets. Will be expanded in the
future.
* Fixes for last commit
* Don't reserve set 0
* Further fixes
* Add files meant for last commit
* Remove Staking transfer
commit 3309295911d22177bd68972d138aea2f8658eb5f
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Wed Jan 4 06:17:00 2023 -0500
Reorder coins in README by market cap
commit db5d19cad33ccf067d876b7f5b7cca47c228e2fc
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Wed Jan 4 06:07:58 2023 -0500
Update README
commit 606484d744b1c6cc408382994c77f1def25d3e7d
Author: Luke Parker <lukeparker5132@gmail.com>
Date: Wed Jan 4 03:17:36 2023 -0500
cargo update
commit 3a319b229f
Author: akildemir <aeg_asd@hotmail.com>
Date: Wed Jan 4 16:26:25 2023 +0300
update address public API design
commit d9fa88fa76
Author: akildemir <aeg_asd@hotmail.com>
Date: Mon Jan 2 13:35:06 2023 +0300
fix clippy error
commit cc722e897b
Merge: cafa9b3eeca440
Author: akildemir <aeg_asd@hotmail.com>
Date: Mon Jan 2 11:39:04 2023 +0300
Merge https://github.com/serai-dex/serai into develop
commit cafa9b361e
Author: akildemir <aeg_asd@hotmail.com>
Date: Mon Jan 2 11:38:26 2023 +0300
fix build errors
commit ce5b5f2b37
Merge: f502d6749c4acf
Author: akildemir <aeg_asd@hotmail.com>
Date: Sun Jan 1 15:16:25 2023 +0300
Merge https://github.com/serai-dex/serai into develop
commit f502d67282
Author: akildemir <aeg_asd@hotmail.com>
Date: Thu Dec 22 13:13:09 2022 +0300
fix pr issues
commit 26ffb226d4
Author: akildemir <aeg_asd@hotmail.com>
Date: Thu Dec 22 13:11:43 2022 +0300
remove extraneous rpc call
commit 0e829f8531
Author: akildemir <aeg_asd@hotmail.com>
Date: Thu Dec 15 13:56:53 2022 +0300
add scan tests
commit 5123c7f121
Author: akildemir <aeg_asd@hotmail.com>
Date: Thu Dec 15 13:56:13 2022 +0300
add new address functions & comments
* Standardize the DLEq serialization function naming
They mismatched from the rest of the project.
This commit is technically incomplete as it doesn't update the dkg crate.
* Rewrite DKG encryption to enable per-message decryption without side effects
This isn't technically true as I already know a break in this which I'll
correct for shortly.
Does update documentation to explain the new scheme. Required for blame.
* Add a verifiable system for blame during the FROST DKG
Previously, if sent an invalid key share, the participant would realize that
and could accuse the sender. Without further evidence, either the accuser
or the accused could be guilty. Now, the accuser has a proof the accused is
in the wrong.
Reworks KeyMachine to return BlameMachine. This explicitly acknowledges how
locally complete keys still need group acknowledgement before the protocol
can be complete and provides a way for others to verify blame, even after a
locally successful run.
If any blame is cast, the protocol is no longer considered complete-able
(instead aborting). Further accusations of blame can still be handled however.
Updates documentation on network behavior.
Also starts to remove "OnDrop". We now use Zeroizing for anything which should
be zeroized on drop. This is a lot more piece-meal and reduces clones.
* Tweak Zeroizing and Debug impls
Expands Zeroizing to be more comprehensive.
Also updates Zeroizing<CachedPreprocess([u8; 32])> to
CachedPreprocess(Zeroizing<[u8; 32]>) so zeroizing is the first thing done
and last step before exposing the copy-able [u8; 32].
Removes private keys from Debug.
* Fix a bug where adversaries could claim to be using another user's encryption keys to learn their messages
Mentioned a few commits ago, now fixed.
This wouldn't have affected Serai, which aborts on failure, nor any DKG
currently supported. It's just about ensuring the DKG encryption is robust and
proper.
* Finish moving dleq from ser/deser to write/read
* Add tests for dkg blame
* Add a FROST test for invalid signature shares
* Batch verify encrypted messages' ephemeral keys' PoP
While the previous construction achieved n/2 average detection,
this will run in log2(n). Unfortunately, the need to keep entropy
around (or take in an RNG here) remains.
Technically, non-0-amount outputs can still appear and this considered them
as part of the global 0-amount pool. Now, only outputs which are 0-amount are
counted.
* Remove the explicit included participants from FROST
Now, whoever submits preprocesses becomes the signing set. Better separates
preprocess from sign, at the cost of slightly more annoying integrations
(Monero needs to now independently lagrange/offset its key images).
* Support caching preprocesses
Closes https://github.com/serai-dex/serai/issues/40.
I *could* have added a serialization trait to Algorithm and written a ton of
data to disk, while requiring Algorithm implementors also accept such work.
Instead, I moved preprocess to a seeded RNG (Chacha20) which should be as
secure as the regular RNG. Rebuilding from cache simply loads the previously
used Chacha seed, making the Algorithm oblivious to the fact it's being
rebuilt from a cache. This removes any requirements for it to be modified
while guaranteeing equivalency.
This builds on the last commit which delayed determining the signing set till
post-preprocess acquisition. Unfortunately, that commit did force preprocess
from ThresholdView to ThresholdKeys which had visible effects on Monero.
Serai will actually need delayed set determination for #163, and overall,
it remains better, hence it's inclusion.
* Document FROST preprocess caching
* Update ethereum to new FROST
* Fix bug in Monero offset calculation and update processor
A type alias of MoneroAddress is provided to abstract away the generic.
To keep the rest of the library sane, MoneroAddress is used everywhere.
If someone wants to use this library with another coin, they *should* be
able to parse a custom address and then recreate it as a Monero address.
While that's annoying to them, better them than any person using this
lib for Monero.
Closes#152.
* Add dkg crate
* Remove F_len and G_len
They're generally no longer used.
* Replace hash_to_vec with a provided method around associated type H: Digest
Part of trying to minimize this trait so it can be moved elsewhere. Vec,
which isn't std, may have been a blocker.
* Encrypt secret shares within the FROST library
Reduces requirements on callers in order to be correct.
* Update usage of Zeroize within FROST
* Inline functions in key_gen
There was no reason to have them separated as they were. sign probably
has the same statement available, yet that isn't the focus right now.
* Add a ciphersuite package which provides hash_to_F
* Set the Ciphersuite version to something valid
* Have ed448 export Scalar/FieldElement/Point at the top level
* Move FROST over to Ciphersuite
* Correct usage of ff in ciphersuite
* Correct documentation handling
* Move Schnorr signatures to their own crate
* Remove unused feature from schnorr
* Fix Schnorr tests
* Split DKG into a separate crate
* Add serialize to Commitments and SecretShare
Helper for buf = vec![]; .write(buf).unwrap(); buf
* Move FROST over to the new dkg crate
* Update Monero lib to latest FROST
* Correct ethereum's usage of features
* Add serialize to GeneratorProof
* Add serialize helper function to FROST
* Rename AddendumSerialize to WriteAddendum
* Update processor
* Slight fix to processor
* Create message types for FROST key gen
Taking in reader borrows absolutely wasn't feasible. Now, proper types
which can be read (and then passed directly, without a mutable borrow)
exist for key_gen. sign coming next.
* Move FROST signing to messages, not Readers/Writers/Vec<u8>
Also takes the nonce handling code and makes a dedicated file for it,
aiming to resolve complex types and make the code more legible by
replacing its previously inlined state.
* clippy
* Update FROST tests
* read_signature_share
* Update the Monero library to the new FROST packages
* Update processor to latest FROST
* Tweaks to terminology and documentation
Unbeknowst to me, height doesn't have a universal definition of the
chain length.
Bitcoin defines height as the block number, with getblockcount existing
for the chain length.
Ethereum uses the unambiguous term "block number".
Monero defines height as both the block number and the chain length.
Instead of arguing about who's right, it's agreed it referring to both
isn't productive. While we could provide our own definition, taking a
side, moving to the unambiguous block number prevents future hiccups.
height is now only a term in the Monero code, where it takes its
Monero-specific definition, as documented in the processor.
* Label the version as an alpha
* Add versions to Cargo.tomls
* Update to Zeroize 1.5
* Drop patch versions from monero-serai Cargo.toml
* Add a repository field
* Move generators to OUT_DIR
IIRC, I didn't do this originally as it constantly re-generated them.
Unfortunately, since cargo is complaining about .generators, we have to.
* Remove Timelock::fee_weight
Transaction::fee_weight's has a comment, "Assumes Timelock::None since
this library won't let you create a TX with a timelock". Accordingly,
this is dead code.
Despite being slower and only used for blinding values, its still
extremely performant. 20 is far more standard and will avoid an eye
raise from reviewers.
There is a slight note we only implement u64 varint's, while Monero does
it for arbitrary uints, yet that's not relevant at this time. It is
documented in #25.
Creates a new monero-generators crate so the monero crate can run the
code in question at build time.
Saves several seconds from running the tests.
Closes https://github.com/serai-dex/serai/issues/101.
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
Considering they take 7 seconds to generate, thanks to #68, the ability
to generate them at the start instead of on first BP is greatly
appreciated.
Also performs minor cleanups regarding BPs.
* Use a struct in an enum for Bulletproofs
* verification bp working for just one proof
* add some more assert tests
* Clean BP verification
* Implement batch verification
* Add a debug assertion w_cache isn't 0
It's initially set to 0 and if not updated, this would be broken.
* Correct Monero workflow yaml
* Again try to corrent Monero workflow yaml
* Again
* Finally
* Re-apply weights as required by Bulletproofs
Removing these was insecure and my fault.
Co-authored-by: DangerousFreedom <dangfreed@tutanota.com>
* Initial stab at Bulletproofs+
Does move around the existing Bulletproofs code, does still work as
expected.
* Make the Clsag RCTPrunable type work with BP and BP+
* Initial set of BP+ bug fixes
* Further bug fixes
* Remove RING_LEN as a constant
* Monero v16 TX support
Doesn't implement view tags, nor going back to v14, nor the updated BP
clawback logic.
* Support v14 and v16 at the same time
Introduces missing CLSAG checks. The only difference now should be the
additional rejection of torsioned points, which is relevant to
https://github.com/serai-dex/serai/issues/25. Considering this is only
currently used for FROST verification, this should be fine.
Closes https://github.com/serai-dex/serai/issues/19 by making it
irrelevant.
Increases priority of https://github.com/serai-dex/serai/issues/68, as
now it's used for the BP generators which are done at first-proof.
Also merges BP's stricter hash_to_point with the library's, since CLSAG
has the same bound.
* Initial attempt at Bulletproofs
I don't know why this doesn't work. The generators and hash_cache lines
up without issue. AFAICT, the inner product proof is valid as well, as
are all included formulas.
* Add yinvpow asserts
* Clean code
* Correct bad imports
* Fix the definition of TWO_N
Bulletproofs work now :D
* Tidy up a bit
* fmt + clippy
* Compile a variety of XMR dependencies with optimizations, even under dev
The Rust bulletproof implementation is 8% slower than C right now, under
release. This is acceptable, even if suboptimal. Under debug, they take
a quarter of a second to two seconds though, depending on the amount of
outputs, which justifies this move.
* Remove unnecessary deref in BPs
Currently intended to be done with:
cargo clippy --features "recommended merlin batch serialize experimental
ed25519 ristretto p256 secp256k1 multisig" -- -A clippy::type_complexity
-A dead_code
The two-generator limit wasn't required nor beneficial. This does
theoretically optimize FROST, yet not for any current constructions. A
follow up proof which would optimize current constructions has been
noted in #38.
Adds explicit no_std support to the core DLEq proof.
Closes#34.
While Serai only needs the simple DLEq which was already present under
monero, this migrates the implementation of the cross-group DLEq I
maintain into Serai. This was to have full access to the ecosystem of
libraries built under Serai while also ensuring support for it.
The cross_group curve, which is extremely experimental, is feature
flagged off. So is the built in serialization functionality, as this
should be possible to make nostd once const generics are full featured,
yet the implemented serialization adds the additional barrier of
std::io.
Increases usage of standardization while expanding dalek_ff_group.
Closes https://github.com/serai-dex/serai/issues/26 by moving
dfg::EdwardsPoint to only be for the prime subgroup.
Updates how change outputs are handled, with a far more logical
construction offering greater flexibility.
prepare_outputs can not longer error. SignaableTransaction::new will.
Modifies FROST behavior so group_key has the offset applied regardless
of if view was called. The unaltered secret_share and
verification_shares (as they have differing values depending on the
signing set) are no longer publicly accessible.
Doesn't fully utilize ec's hash2curve module as k256 Scalar doesn't have
FromOkm for some reason. The previously present bigint reduction is
preserved.
Updates ff/group to 0.12.
Premised on https://github.com/cfrg/draft-irtf-cfrg-frost/pull/205 being
merged, as while this Ed25519 is vector compliant, it's technically not
spec compliant due to that conflict.
While it was fine as-is, as it only had one variable length property,
this is a bit more robust. Also binds the Curve ID, which should declare
differently even for just different basepoints, and therefore adds two
variable length properties (justifying the transcript).
No functional changes have been made to signing, with solely slight API
changes being made.
Technically not actually FROST v5 compatible, due to differing on zero
checks and randomness, yet the vectors do confirm the core algorithm.
For any valid FROST implementation, this will be interoperable if they
can successfully communicate. For any devious FROST implementation, this
will be fingerprintable, yet should still be valid.
Relevant to https://github.com/serai-dex/serai/issues/9 as any curve can
now specify vectors for itself and be tested against them.
Moves the FROST testing curve from k256 to p256. Does not expose p256
despite being compliant. It's not at a point I'm happy with it, notably
regarding hash to curve, and I'm not sure I care to support p256. If it
has value to the larger FROST ecosystem...
It was never used as we derive entropy via the other fields in the
transcript, and explicitly add fields directly as needed for entropy.
Also drops an unused crate and corrects a bug in FROST's Schnorr
implementation which used the Group's generator, instead of the Curve's.
Also updates the Monero crate's description.
Also updates Bulletproofs from C to not be length prefixed, yet rather
have Rust calculate their length.
Corrects an error in key_gen where self was blamed, instead of the
faulty participant.
Saves roughly 0.8s when running the tests, which took 16.6s and now take
15.8 (5%).
Removes the larger sample size, which replaced the closest selected
decoy with the real spend, per advice of Rucknium.
Saves ~8% during FROST key gen, even with dropping a vartime for a
constant time (as needed to be secure), as the new batch verifier is
used where batch verification previously wasn't. The new multiexp API
itself also offered a very slight performance boost, which may solely be
a measurement error.
Handles most of https://github.com/serai-dex/serai/issues/10. The blame
function isn't binary searched nor randomly sorted yet.
Changes the output index to a u8. While it may expand to a u16 at some
point, this can remain canonical using little endian serialization while
dropping the latter byte if it's 0 (or simply only using u16 when it's
actually possible).
Honestly, the borrowed keys are frustrating, and this probably reduces
performance while no longer offering an order when iterating. That said,
they enable full u16 indexing and should mildly improve the API.
Cleans the Proof of Knowledge handling present in key gen.
