2016-05-13 15:45:20 -04:00
|
|
|
// Copyright (c) 2016, Monero Research Labs
|
|
|
|
//
|
|
|
|
// Author: Shen Noether <shen.noether@gmx.com>
|
|
|
|
//
|
|
|
|
// All rights reserved.
|
|
|
|
//
|
|
|
|
// Redistribution and use in source and binary forms, with or without modification, are
|
|
|
|
// permitted provided that the following conditions are met:
|
|
|
|
//
|
|
|
|
// 1. Redistributions of source code must retain the above copyright notice, this list of
|
|
|
|
// conditions and the following disclaimer.
|
|
|
|
//
|
|
|
|
// 2. Redistributions in binary form must reproduce the above copyright notice, this list
|
|
|
|
// of conditions and the following disclaimer in the documentation and/or other
|
|
|
|
// materials provided with the distribution.
|
|
|
|
//
|
|
|
|
// 3. Neither the name of the copyright holder nor the names of its contributors may be
|
|
|
|
// used to endorse or promote products derived from this software without specific
|
|
|
|
// prior written permission.
|
|
|
|
//
|
|
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
|
|
|
|
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
|
|
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
|
|
|
|
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
|
|
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
|
|
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
|
|
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
|
|
|
|
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
2016-05-14 16:58:31 -04:00
|
|
|
#include "misc_log_ex.h"
|
2016-10-10 15:47:52 -04:00
|
|
|
#include "common/perf_timer.h"
|
2017-09-13 23:39:37 -04:00
|
|
|
#include "common/threadpool.h"
|
2016-10-15 08:31:16 -04:00
|
|
|
#include "common/util.h"
|
2016-05-13 15:45:20 -04:00
|
|
|
#include "rctSigs.h"
|
2017-12-02 03:32:39 -05:00
|
|
|
#include "bulletproofs.h"
|
2017-01-26 10:07:23 -05:00
|
|
|
#include "cryptonote_basic/cryptonote_format_utils.h"
|
2016-08-12 18:11:51 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
using namespace crypto;
|
|
|
|
using namespace std;
|
|
|
|
|
Change logging to easylogging++
This replaces the epee and data_loggers logging systems with
a single one, and also adds filename:line and explicit severity
levels. Categories may be defined, and logging severity set
by category (or set of categories). epee style 0-4 log level
maps to a sensible severity configuration. Log files now also
rotate when reaching 100 MB.
To select which logs to output, use the MONERO_LOGS environment
variable, with a comma separated list of categories (globs are
supported), with their requested severity level after a colon.
If a log matches more than one such setting, the last one in
the configuration string applies. A few examples:
This one is (mostly) silent, only outputting fatal errors:
MONERO_LOGS=*:FATAL
This one is very verbose:
MONERO_LOGS=*:TRACE
This one is totally silent (logwise):
MONERO_LOGS=""
This one outputs all errors and warnings, except for the
"verify" category, which prints just fatal errors (the verify
category is used for logs about incoming transactions and
blocks, and it is expected that some/many will fail to verify,
hence we don't want the spam):
MONERO_LOGS=*:WARNING,verify:FATAL
Log levels are, in decreasing order of priority:
FATAL, ERROR, WARNING, INFO, DEBUG, TRACE
Subcategories may be added using prefixes and globs. This
example will output net.p2p logs at the TRACE level, but all
other net* logs only at INFO:
MONERO_LOGS=*:ERROR,net*:INFO,net.p2p:TRACE
Logs which are intended for the user (which Monero was using
a lot through epee, but really isn't a nice way to go things)
should use the "global" category. There are a few helper macros
for using this category, eg: MGINFO("this shows up by default")
or MGINFO_RED("this is red"), to try to keep a similar look
and feel for now.
Existing epee log macros still exist, and map to the new log
levels, but since they're used as a "user facing" UI element
as much as a logging system, they often don't map well to log
severities (ie, a log level 0 log may be an error, or may be
something we want the user to see, such as an important info).
In those cases, I tried to use the new macros. In other cases,
I left the existing macros in. When modifying logs, it is
probably best to switch to the new macros with explicit levels.
The --log-level options and set_log commands now also accept
category settings, in addition to the epee style log levels.
2017-01-01 11:34:23 -05:00
|
|
|
#undef MONERO_DEFAULT_LOG_CATEGORY
|
|
|
|
#define MONERO_DEFAULT_LOG_CATEGORY "ringct"
|
|
|
|
|
2018-05-04 03:22:57 -04:00
|
|
|
#define CHECK_AND_ASSERT_MES_L1(expr, ret, message) {if(!(expr)) {MCERROR("verify", message); return ret;}}
|
|
|
|
|
2016-11-02 16:41:43 -04:00
|
|
|
namespace rct {
|
2017-12-02 03:32:39 -05:00
|
|
|
Bulletproof proveRangeBulletproof(key &C, key &mask, uint64_t amount)
|
|
|
|
{
|
|
|
|
mask = rct::skGen();
|
|
|
|
Bulletproof proof = bulletproof_PROVE(amount, mask);
|
2017-12-02 16:17:42 -05:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(proof.V.size() == 1, "V has not exactly one element");
|
|
|
|
C = proof.V[0];
|
2017-12-02 03:32:39 -05:00
|
|
|
return proof;
|
|
|
|
}
|
|
|
|
|
2018-01-17 16:50:03 -05:00
|
|
|
Bulletproof proveRangeBulletproof(keyV &C, keyV &masks, const std::vector<uint64_t> &amounts)
|
|
|
|
{
|
|
|
|
masks = rct::skvGen(amounts.size());
|
|
|
|
Bulletproof proof = bulletproof_PROVE(amounts, masks);
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(proof.V.size() == amounts.size(), "V does not have the expected size");
|
|
|
|
C = proof.V;
|
|
|
|
return proof;
|
|
|
|
}
|
|
|
|
|
2018-01-06 12:02:05 -05:00
|
|
|
bool verBulletproof(const Bulletproof &proof)
|
|
|
|
{
|
|
|
|
try { return bulletproof_VERIFY(proof); }
|
|
|
|
// we can get deep throws from ge_frombytes_vartime if input isn't valid
|
|
|
|
catch (...) { return false; }
|
|
|
|
}
|
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
bool verBulletproof(const std::vector<const Bulletproof*> &proofs)
|
|
|
|
{
|
|
|
|
try { return bulletproof_VERIFY(proofs); }
|
|
|
|
// we can get deep throws from ge_frombytes_vartime if input isn't valid
|
|
|
|
catch (...) { return false; }
|
|
|
|
}
|
|
|
|
|
2016-11-17 18:17:21 -05:00
|
|
|
//Borromean (c.f. gmax/andytoshi's paper)
|
|
|
|
boroSig genBorromean(const key64 x, const key64 P1, const key64 P2, const bits indices) {
|
2016-11-17 18:27:00 -05:00
|
|
|
key64 L[2], alpha;
|
|
|
|
key c;
|
2016-11-17 18:17:21 -05:00
|
|
|
int naught = 0, prime = 0, ii = 0, jj=0;
|
2016-11-17 18:27:00 -05:00
|
|
|
boroSig bb;
|
2016-11-17 18:17:21 -05:00
|
|
|
for (ii = 0 ; ii < 64 ; ii++) {
|
|
|
|
naught = indices[ii]; prime = (indices[ii] + 1) % 2;
|
|
|
|
skGen(alpha[ii]);
|
|
|
|
scalarmultBase(L[naught][ii], alpha[ii]);
|
2016-11-17 18:27:00 -05:00
|
|
|
if (naught == 0) {
|
|
|
|
skGen(bb.s1[ii]);
|
|
|
|
c = hash_to_scalar(L[naught][ii]);
|
|
|
|
addKeys2(L[prime][ii], bb.s1[ii], c, P2[ii]);
|
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-11-17 18:27:00 -05:00
|
|
|
bb.ee = hash_to_scalar(L[1]); //or L[1]..
|
2016-11-17 18:17:21 -05:00
|
|
|
key LL, cc;
|
|
|
|
for (jj = 0 ; jj < 64 ; jj++) {
|
|
|
|
if (!indices[jj]) {
|
|
|
|
sc_mulsub(bb.s0[jj].bytes, x[jj].bytes, bb.ee.bytes, alpha[jj].bytes);
|
|
|
|
} else {
|
2016-11-17 18:27:00 -05:00
|
|
|
skGen(bb.s0[jj]);
|
|
|
|
addKeys2(LL, bb.s0[jj], bb.ee, P1[jj]); //different L0
|
2016-11-17 18:17:21 -05:00
|
|
|
cc = hash_to_scalar(LL);
|
|
|
|
sc_mulsub(bb.s1[jj].bytes, x[jj].bytes, cc.bytes, alpha[jj].bytes);
|
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-11-17 18:17:21 -05:00
|
|
|
return bb;
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
|
2016-11-17 18:17:21 -05:00
|
|
|
//see above.
|
2018-03-07 19:08:30 -05:00
|
|
|
bool verifyBorromean(const boroSig &bb, const ge_p3 P1[64], const ge_p3 P2[64]) {
|
2016-11-17 18:27:00 -05:00
|
|
|
key64 Lv1; key chash, LL;
|
2016-11-17 18:17:21 -05:00
|
|
|
int ii = 0;
|
2018-03-07 19:08:30 -05:00
|
|
|
ge_p2 p2;
|
2016-11-17 18:17:21 -05:00
|
|
|
for (ii = 0 ; ii < 64 ; ii++) {
|
2018-03-07 19:08:30 -05:00
|
|
|
// equivalent of: addKeys2(LL, bb.s0[ii], bb.ee, P1[ii]);
|
|
|
|
ge_double_scalarmult_base_vartime(&p2, bb.ee.bytes, &P1[ii], bb.s0[ii].bytes);
|
|
|
|
ge_tobytes(LL.bytes, &p2);
|
2016-11-17 18:27:00 -05:00
|
|
|
chash = hash_to_scalar(LL);
|
2018-03-07 19:08:30 -05:00
|
|
|
// equivalent of: addKeys2(Lv1[ii], bb.s1[ii], chash, P2[ii]);
|
|
|
|
ge_double_scalarmult_base_vartime(&p2, chash.bytes, &P2[ii], bb.s1[ii].bytes);
|
|
|
|
ge_tobytes(Lv1[ii].bytes, &p2);
|
2016-11-17 18:17:21 -05:00
|
|
|
}
|
2016-11-17 18:27:00 -05:00
|
|
|
key eeComputed = hash_to_scalar(Lv1); //hash function fine
|
2016-11-17 18:17:21 -05:00
|
|
|
return equalKeys(eeComputed, bb.ee);
|
|
|
|
}
|
|
|
|
|
2018-03-07 19:08:30 -05:00
|
|
|
bool verifyBorromean(const boroSig &bb, const key64 P1, const key64 P2) {
|
|
|
|
ge_p3 P1_p3[64], P2_p3[64];
|
|
|
|
for (size_t i = 0 ; i < 64 ; ++i) {
|
2018-05-04 03:22:57 -04:00
|
|
|
CHECK_AND_ASSERT_MES_L1(ge_frombytes_vartime(&P1_p3[i], P1[i].bytes) == 0, false, "point conv failed");
|
|
|
|
CHECK_AND_ASSERT_MES_L1(ge_frombytes_vartime(&P2_p3[i], P2[i].bytes) == 0, false, "point conv failed");
|
2018-03-07 19:08:30 -05:00
|
|
|
}
|
|
|
|
return verifyBorromean(bb, P1_p3, P2_p3);
|
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//Multilayered Spontaneous Anonymous Group Signatures (MLSAG signatures)
|
|
|
|
//This is a just slghtly more efficient version than the ones described below
|
|
|
|
//(will be explained in more detail in Ring Multisig paper
|
|
|
|
//These are aka MG signatutes in earlier drafts of the ring ct paper
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 2.
|
2016-05-13 15:45:20 -04:00
|
|
|
// Gen creates a signature which proves that for some column in the keymatrix "pk"
|
|
|
|
// the signer knows a secret key for each row in that column
|
|
|
|
// Ver verifies that the MG sig was created correctly
|
2018-02-20 11:01:27 -05:00
|
|
|
mgSig MLSAG_Gen(const key &message, const keyM & pk, const keyV & xx, const multisig_kLRki *kLRki, key *mscout, const unsigned int index, size_t dsRows, hw::device &hwdev) {
|
2016-05-13 15:45:20 -04:00
|
|
|
mgSig rv;
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t cols = pk.size();
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(cols >= 2, "Error! What is c if cols = 1!");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(index < cols, "Index out of range");
|
|
|
|
size_t rows = pk[0].size();
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(rows >= 1, "Empty pk");
|
|
|
|
for (size_t i = 1; i < cols; ++i) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(pk[i].size() == rows, "pk is not rectangular");
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-05-14 16:58:31 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(xx.size() == rows, "Bad xx size");
|
2016-08-08 07:54:00 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(dsRows <= rows, "Bad dsRows size");
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES((kLRki && mscout) || (!kLRki && !mscout), "Only one of kLRki/mscout is present");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(!kLRki || dsRows == 1, "Multisig requires exactly 1 dsRows");
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-08-08 07:54:00 -04:00
|
|
|
size_t i = 0, j = 0, ii = 0;
|
2016-05-13 15:45:20 -04:00
|
|
|
key c, c_old, L, R, Hi;
|
|
|
|
sc_0(c_old.bytes);
|
2016-08-08 07:54:00 -04:00
|
|
|
vector<geDsmp> Ip(dsRows);
|
|
|
|
rv.II = keyV(dsRows);
|
2016-05-13 15:45:20 -04:00
|
|
|
keyV alpha(rows);
|
|
|
|
keyV aG(rows);
|
2016-08-08 07:54:00 -04:00
|
|
|
rv.ss = keyM(cols, aG);
|
|
|
|
keyV aHP(dsRows);
|
|
|
|
keyV toHash(1 + 3 * dsRows + 2 * (rows - dsRows));
|
2016-07-09 15:04:23 -04:00
|
|
|
toHash[0] = message;
|
2016-05-13 15:45:20 -04:00
|
|
|
DP("here1");
|
2016-08-08 07:54:00 -04:00
|
|
|
for (i = 0; i < dsRows; i++) {
|
2016-07-09 15:04:23 -04:00
|
|
|
toHash[3 * i + 1] = pk[index][i];
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
if (kLRki) {
|
|
|
|
// multisig
|
|
|
|
alpha[i] = kLRki->k;
|
|
|
|
toHash[3 * i + 2] = kLRki->L;
|
|
|
|
toHash[3 * i + 3] = kLRki->R;
|
|
|
|
rv.II[i] = kLRki->ki;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
Hi = hashToPoint(pk[index][i]);
|
2018-02-20 11:01:27 -05:00
|
|
|
hwdev.mlsag_prepare(Hi, xx[i], alpha[i] , aG[i] , aHP[i] , rv.II[i]);
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
toHash[3 * i + 2] = aG[i];
|
|
|
|
toHash[3 * i + 3] = aHP[i];
|
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
precomp(Ip[i].k, rv.II[i]);
|
|
|
|
}
|
2016-08-08 07:54:00 -04:00
|
|
|
size_t ndsRows = 3 * dsRows; //non Double Spendable Rows (see identity chains paper)
|
|
|
|
for (i = dsRows, ii = 0 ; i < rows ; i++, ii++) {
|
|
|
|
skpkGen(alpha[i], aG[i]); //need to save alphas for later..
|
|
|
|
toHash[ndsRows + 2 * ii + 1] = pk[index][i];
|
|
|
|
toHash[ndsRows + 2 * ii + 2] = aG[i];
|
|
|
|
}
|
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
hwdev.mlsag_hash(toHash, c_old);
|
2016-07-09 15:04:23 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
|
|
|
|
i = (index + 1) % cols;
|
|
|
|
if (i == 0) {
|
|
|
|
copy(rv.cc, c_old);
|
|
|
|
}
|
|
|
|
while (i != index) {
|
|
|
|
|
|
|
|
rv.ss[i] = skvGen(rows);
|
|
|
|
sc_0(c.bytes);
|
2016-08-08 07:54:00 -04:00
|
|
|
for (j = 0; j < dsRows; j++) {
|
2016-05-13 15:45:20 -04:00
|
|
|
addKeys2(L, rv.ss[i][j], c_old, pk[i][j]);
|
|
|
|
hashToPoint(Hi, pk[i][j]);
|
|
|
|
addKeys3(R, rv.ss[i][j], Hi, c_old, Ip[j].k);
|
2016-07-09 15:04:23 -04:00
|
|
|
toHash[3 * j + 1] = pk[i][j];
|
|
|
|
toHash[3 * j + 2] = L;
|
|
|
|
toHash[3 * j + 3] = R;
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-08 07:54:00 -04:00
|
|
|
for (j = dsRows, ii = 0; j < rows; j++, ii++) {
|
|
|
|
addKeys2(L, rv.ss[i][j], c_old, pk[i][j]);
|
|
|
|
toHash[ndsRows + 2 * ii + 1] = pk[i][j];
|
|
|
|
toHash[ndsRows + 2 * ii + 2] = L;
|
|
|
|
}
|
2018-02-20 11:01:27 -05:00
|
|
|
hwdev.mlsag_hash(toHash, c);
|
2016-05-13 15:45:20 -04:00
|
|
|
copy(c_old, c);
|
|
|
|
i = (i + 1) % cols;
|
|
|
|
|
|
|
|
if (i == 0) {
|
|
|
|
copy(rv.cc, c_old);
|
|
|
|
}
|
|
|
|
}
|
2018-02-20 11:01:27 -05:00
|
|
|
hwdev.mlsag_sign(c, xx, alpha, rows, dsRows, rv.ss[index]);
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
if (mscout)
|
|
|
|
*mscout = c;
|
2016-05-13 15:45:20 -04:00
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
//Multilayered Spontaneous Anonymous Group Signatures (MLSAG signatures)
|
|
|
|
//This is a just slghtly more efficient version than the ones described below
|
|
|
|
//(will be explained in more detail in Ring Multisig paper
|
|
|
|
//These are aka MG signatutes in earlier drafts of the ring ct paper
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 2.
|
2016-05-13 15:45:20 -04:00
|
|
|
// Gen creates a signature which proves that for some column in the keymatrix "pk"
|
|
|
|
// the signer knows a secret key for each row in that column
|
|
|
|
// Ver verifies that the MG sig was created correctly
|
2016-10-08 17:16:23 -04:00
|
|
|
bool MLSAG_Ver(const key &message, const keyM & pk, const mgSig & rv, size_t dsRows) {
|
2016-05-13 15:45:20 -04:00
|
|
|
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t cols = pk.size();
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(cols >= 2, false, "Error! What is c if cols = 1!");
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t rows = pk[0].size();
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rows >= 1, false, "Empty pk");
|
2016-05-14 16:58:31 -04:00
|
|
|
for (size_t i = 1; i < cols; ++i) {
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(pk[i].size() == rows, false, "pk is not rectangular");
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-09 06:38:54 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.II.size() == dsRows, false, "Bad II size");
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.ss.size() == cols, false, "Bad rv.ss size");
|
2016-05-14 16:58:31 -04:00
|
|
|
for (size_t i = 0; i < cols; ++i) {
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.ss[i].size() == rows, false, "rv.ss is not rectangular");
|
2016-05-14 16:58:31 -04:00
|
|
|
}
|
2016-08-08 07:54:00 -04:00
|
|
|
CHECK_AND_ASSERT_MES(dsRows <= rows, false, "Bad dsRows value");
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-12-07 17:41:21 -05:00
|
|
|
for (size_t i = 0; i < rv.ss.size(); ++i)
|
|
|
|
for (size_t j = 0; j < rv.ss[i].size(); ++j)
|
|
|
|
CHECK_AND_ASSERT_MES(sc_check(rv.ss[i][j].bytes) == 0, false, "Bad ss slot");
|
|
|
|
CHECK_AND_ASSERT_MES(sc_check(rv.cc.bytes) == 0, false, "Bad cc");
|
|
|
|
|
2016-08-08 07:54:00 -04:00
|
|
|
size_t i = 0, j = 0, ii = 0;
|
2016-05-13 15:45:20 -04:00
|
|
|
key c, L, R, Hi;
|
|
|
|
key c_old = copy(rv.cc);
|
2016-08-08 07:54:00 -04:00
|
|
|
vector<geDsmp> Ip(dsRows);
|
|
|
|
for (i = 0 ; i < dsRows ; i++) {
|
2016-08-09 06:38:54 -04:00
|
|
|
precomp(Ip[i].k, rv.II[i]);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-08 07:54:00 -04:00
|
|
|
size_t ndsRows = 3 * dsRows; //non Double Spendable Rows (see identity chains paper
|
|
|
|
keyV toHash(1 + 3 * dsRows + 2 * (rows - dsRows));
|
2016-07-09 15:04:23 -04:00
|
|
|
toHash[0] = message;
|
2016-05-13 15:45:20 -04:00
|
|
|
i = 0;
|
|
|
|
while (i < cols) {
|
|
|
|
sc_0(c.bytes);
|
2016-08-08 07:54:00 -04:00
|
|
|
for (j = 0; j < dsRows; j++) {
|
2016-05-13 15:45:20 -04:00
|
|
|
addKeys2(L, rv.ss[i][j], c_old, pk[i][j]);
|
|
|
|
hashToPoint(Hi, pk[i][j]);
|
2018-07-25 05:10:46 -04:00
|
|
|
CHECK_AND_ASSERT_MES(!(Hi == rct::identity()), false, "Data hashed to point at infinity");
|
2016-05-13 15:45:20 -04:00
|
|
|
addKeys3(R, rv.ss[i][j], Hi, c_old, Ip[j].k);
|
2016-07-09 15:04:23 -04:00
|
|
|
toHash[3 * j + 1] = pk[i][j];
|
|
|
|
toHash[3 * j + 2] = L;
|
|
|
|
toHash[3 * j + 3] = R;
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-08 07:54:00 -04:00
|
|
|
for (j = dsRows, ii = 0 ; j < rows ; j++, ii++) {
|
|
|
|
addKeys2(L, rv.ss[i][j], c_old, pk[i][j]);
|
|
|
|
toHash[ndsRows + 2 * ii + 1] = pk[i][j];
|
|
|
|
toHash[ndsRows + 2 * ii + 2] = L;
|
|
|
|
}
|
2016-07-09 15:04:23 -04:00
|
|
|
c = hash_to_scalar(toHash);
|
2016-05-13 15:45:20 -04:00
|
|
|
copy(c_old, c);
|
|
|
|
i = (i + 1);
|
|
|
|
}
|
|
|
|
sc_sub(c.bytes, c_old.bytes, rv.cc.bytes);
|
|
|
|
return sc_isnonzero(c.bytes) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//proveRange and verRange
|
|
|
|
//proveRange gives C, and mask such that \sumCi = C
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 5.1
|
2016-05-13 15:45:20 -04:00
|
|
|
// and Ci is a commitment to either 0 or 2^i, i=0,...,63
|
|
|
|
// thus this proves that "amount" is in [0, 2^64]
|
|
|
|
// mask is a such that C = aG + bH, and b = amount
|
|
|
|
//verRange verifies that \sum Ci = C and that each Ci is a commitment to 0 or 2^i
|
|
|
|
rangeSig proveRange(key & C, key & mask, const xmr_amount & amount) {
|
|
|
|
sc_0(mask.bytes);
|
|
|
|
identity(C);
|
|
|
|
bits b;
|
|
|
|
d2b(b, amount);
|
|
|
|
rangeSig sig;
|
|
|
|
key64 ai;
|
|
|
|
key64 CiH;
|
|
|
|
int i = 0;
|
|
|
|
for (i = 0; i < ATOMS; i++) {
|
2016-05-29 20:34:43 -04:00
|
|
|
skGen(ai[i]);
|
2016-05-13 15:45:20 -04:00
|
|
|
if (b[i] == 0) {
|
|
|
|
scalarmultBase(sig.Ci[i], ai[i]);
|
|
|
|
}
|
|
|
|
if (b[i] == 1) {
|
|
|
|
addKeys1(sig.Ci[i], ai[i], H2[i]);
|
|
|
|
}
|
|
|
|
subKeys(CiH[i], sig.Ci[i], H2[i]);
|
|
|
|
sc_add(mask.bytes, mask.bytes, ai[i].bytes);
|
|
|
|
addKeys(C, C, sig.Ci[i]);
|
|
|
|
}
|
2016-11-17 18:17:21 -05:00
|
|
|
sig.asig = genBorromean(ai, sig.Ci, CiH, b);
|
2016-05-13 15:45:20 -04:00
|
|
|
return sig;
|
|
|
|
}
|
|
|
|
|
|
|
|
//proveRange and verRange
|
|
|
|
//proveRange gives C, and mask such that \sumCi = C
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 5.1
|
2016-05-13 15:45:20 -04:00
|
|
|
// and Ci is a commitment to either 0 or 2^i, i=0,...,63
|
|
|
|
// thus this proves that "amount" is in [0, 2^64]
|
|
|
|
// mask is a such that C = aG + bH, and b = amount
|
|
|
|
//verRange verifies that \sum Ci = C and that each Ci is a commitment to 0 or 2^i
|
2016-05-14 16:58:31 -04:00
|
|
|
bool verRange(const key & C, const rangeSig & as) {
|
2016-12-07 17:09:43 -05:00
|
|
|
try
|
|
|
|
{
|
2016-10-10 15:47:52 -04:00
|
|
|
PERF_TIMER(verRange);
|
2018-03-07 19:08:30 -05:00
|
|
|
ge_p3 CiH[64], asCi[64];
|
2016-05-13 15:45:20 -04:00
|
|
|
int i = 0;
|
2018-03-07 19:08:30 -05:00
|
|
|
ge_p3 Ctmp_p3 = ge_p3_identity;
|
2016-05-13 15:45:20 -04:00
|
|
|
for (i = 0; i < 64; i++) {
|
2018-03-07 19:08:30 -05:00
|
|
|
// faster equivalent of:
|
|
|
|
// subKeys(CiH[i], as.Ci[i], H2[i]);
|
|
|
|
// addKeys(Ctmp, Ctmp, as.Ci[i]);
|
|
|
|
ge_cached cached;
|
|
|
|
ge_p3 p3;
|
|
|
|
ge_p1p1 p1;
|
2018-05-04 03:22:57 -04:00
|
|
|
CHECK_AND_ASSERT_MES_L1(ge_frombytes_vartime(&p3, H2[i].bytes) == 0, false, "point conv failed");
|
2018-03-07 19:08:30 -05:00
|
|
|
ge_p3_to_cached(&cached, &p3);
|
2018-05-04 03:22:57 -04:00
|
|
|
CHECK_AND_ASSERT_MES_L1(ge_frombytes_vartime(&asCi[i], as.Ci[i].bytes) == 0, false, "point conv failed");
|
2018-03-07 19:08:30 -05:00
|
|
|
ge_sub(&p1, &asCi[i], &cached);
|
|
|
|
ge_p3_to_cached(&cached, &asCi[i]);
|
|
|
|
ge_p1p1_to_p3(&CiH[i], &p1);
|
|
|
|
ge_add(&p1, &Ctmp_p3, &cached);
|
|
|
|
ge_p1p1_to_p3(&Ctmp_p3, &p1);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2018-03-07 19:08:30 -05:00
|
|
|
key Ctmp;
|
|
|
|
ge_p3_tobytes(Ctmp.bytes, &Ctmp_p3);
|
2016-08-27 05:10:19 -04:00
|
|
|
if (!equalKeys(C, Ctmp))
|
|
|
|
return false;
|
2018-03-07 19:08:30 -05:00
|
|
|
if (!verifyBorromean(as.asig, asCi, CiH))
|
2016-08-27 05:10:19 -04:00
|
|
|
return false;
|
|
|
|
return true;
|
2016-12-07 17:09:43 -05:00
|
|
|
}
|
|
|
|
// we can get deep throws from ge_frombytes_vartime if input isn't valid
|
|
|
|
catch (...) { return false; }
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
key get_pre_mlsag_hash(const rctSig &rv, hw::device &hwdev)
|
2016-08-09 06:38:54 -04:00
|
|
|
{
|
2016-08-12 18:11:51 -04:00
|
|
|
keyV hashes;
|
2016-10-10 18:47:01 -04:00
|
|
|
hashes.reserve(3);
|
2016-08-12 18:11:51 -04:00
|
|
|
hashes.push_back(rv.message);
|
|
|
|
crypto::hash h;
|
2016-09-14 15:23:06 -04:00
|
|
|
|
|
|
|
std::stringstream ss;
|
|
|
|
binary_archive<true> ba(ss);
|
2017-12-16 06:58:58 -05:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(!rv.mixRing.empty(), "Empty mixRing");
|
2018-01-17 16:50:03 -05:00
|
|
|
const size_t inputs = is_rct_simple(rv.type) ? rv.mixRing.size() : rv.mixRing[0].size();
|
2016-09-14 15:23:06 -04:00
|
|
|
const size_t outputs = rv.ecdhInfo.size();
|
2018-02-20 11:01:27 -05:00
|
|
|
key prehash;
|
2016-09-14 15:23:06 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(const_cast<rctSig&>(rv).serialize_rctsig_base(ba, inputs, outputs),
|
|
|
|
"Failed to serialize rctSigBase");
|
|
|
|
cryptonote::get_blob_hash(ss.str(), h);
|
2016-08-12 18:11:51 -04:00
|
|
|
hashes.push_back(hash2rct(h));
|
2016-09-14 15:23:06 -04:00
|
|
|
|
2016-08-09 06:38:54 -04:00
|
|
|
keyV kv;
|
2018-03-30 15:29:42 -04:00
|
|
|
if (rv.type == RCTTypeBulletproof)
|
2016-08-09 06:38:54 -04:00
|
|
|
{
|
2017-12-09 10:22:24 -05:00
|
|
|
kv.reserve((6*2+9) * rv.p.bulletproofs.size());
|
2017-12-02 16:17:42 -05:00
|
|
|
for (const auto &p: rv.p.bulletproofs)
|
|
|
|
{
|
2017-12-09 10:22:24 -05:00
|
|
|
// V are not hashed as they're expanded from outPk.mask
|
|
|
|
// (and thus hashed as part of rctSigBase above)
|
2017-12-02 16:17:42 -05:00
|
|
|
kv.push_back(p.A);
|
|
|
|
kv.push_back(p.S);
|
|
|
|
kv.push_back(p.T1);
|
|
|
|
kv.push_back(p.T2);
|
|
|
|
kv.push_back(p.taux);
|
|
|
|
kv.push_back(p.mu);
|
|
|
|
for (size_t n = 0; n < p.L.size(); ++n)
|
|
|
|
kv.push_back(p.L[n]);
|
|
|
|
for (size_t n = 0; n < p.R.size(); ++n)
|
|
|
|
kv.push_back(p.R[n]);
|
|
|
|
kv.push_back(p.a);
|
|
|
|
kv.push_back(p.b);
|
|
|
|
kv.push_back(p.t);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
kv.reserve((64*3+1) * rv.p.rangeSigs.size());
|
|
|
|
for (const auto &r: rv.p.rangeSigs)
|
|
|
|
{
|
|
|
|
for (size_t n = 0; n < 64; ++n)
|
|
|
|
kv.push_back(r.asig.s0[n]);
|
|
|
|
for (size_t n = 0; n < 64; ++n)
|
|
|
|
kv.push_back(r.asig.s1[n]);
|
|
|
|
kv.push_back(r.asig.ee);
|
|
|
|
for (size_t n = 0; n < 64; ++n)
|
|
|
|
kv.push_back(r.Ci[n]);
|
|
|
|
}
|
2016-08-09 06:38:54 -04:00
|
|
|
}
|
2016-08-12 18:11:51 -04:00
|
|
|
hashes.push_back(cn_fast_hash(kv));
|
2018-02-20 11:01:27 -05:00
|
|
|
hwdev.mlsag_prehash(ss.str(), inputs, outputs, hashes, rv.outPk, prehash);
|
|
|
|
return prehash;
|
2016-08-09 06:38:54 -04:00
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//Ring-ct MG sigs
|
|
|
|
//Prove:
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 4. definition 10.
|
2016-05-13 15:45:20 -04:00
|
|
|
// This does the MG sig on the "dest" part of the given key matrix, and
|
|
|
|
// the last row is the sum of input commitments from that column - sum output commitments
|
|
|
|
// this shows that sum inputs = sum outputs
|
|
|
|
//Ver:
|
|
|
|
// verifies the above sig is created corretly
|
2018-02-20 11:01:27 -05:00
|
|
|
mgSig proveRctMG(const key &message, const ctkeyM & pubs, const ctkeyV & inSk, const ctkeyV &outSk, const ctkeyV & outPk, const multisig_kLRki *kLRki, key *mscout, unsigned int index, key txnFeeKey, hw::device &hwdev) {
|
2016-05-13 15:45:20 -04:00
|
|
|
mgSig mg;
|
|
|
|
//setup vars
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t cols = pubs.size();
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(cols >= 1, "Empty pubs");
|
|
|
|
size_t rows = pubs[0].size();
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(rows >= 1, "Empty pubs");
|
|
|
|
for (size_t i = 1; i < cols; ++i) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(pubs[i].size() == rows, "pubs is not rectangular");
|
|
|
|
}
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(inSk.size() == rows, "Bad inSk size");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(outSk.size() == outPk.size(), "Bad outSk/outPk size");
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES((kLRki && mscout) || (!kLRki && !mscout), "Only one of kLRki/mscout is present");
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
keyV sk(rows + 1);
|
|
|
|
keyV tmp(rows + 1);
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t i = 0, j = 0;
|
2016-05-13 15:45:20 -04:00
|
|
|
for (i = 0; i < rows + 1; i++) {
|
|
|
|
sc_0(sk[i].bytes);
|
|
|
|
identity(tmp[i]);
|
|
|
|
}
|
|
|
|
keyM M(cols, tmp);
|
|
|
|
//create the matrix to mg sig
|
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
M[i][rows] = identity();
|
|
|
|
for (j = 0; j < rows; j++) {
|
|
|
|
M[i][j] = pubs[i][j].dest;
|
2016-06-02 14:03:35 -04:00
|
|
|
addKeys(M[i][rows], M[i][rows], pubs[i][j].mask); //add input commitments in last row
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
sc_0(sk[rows].bytes);
|
|
|
|
for (j = 0; j < rows; j++) {
|
|
|
|
sk[j] = copy(inSk[j].dest);
|
2016-06-02 14:03:35 -04:00
|
|
|
sc_add(sk[rows].bytes, sk[rows].bytes, inSk[j].mask.bytes); //add masks in last row
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
for (size_t j = 0; j < outPk.size(); j++) {
|
2016-06-02 14:03:35 -04:00
|
|
|
subKeys(M[i][rows], M[i][rows], outPk[j].mask); //subtract output Ci's in last row
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-06-12 16:53:01 -04:00
|
|
|
//subtract txn fee output in last row
|
|
|
|
subKeys(M[i][rows], M[i][rows], txnFeeKey);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
for (size_t j = 0; j < outPk.size(); j++) {
|
2016-06-02 14:03:35 -04:00
|
|
|
sc_sub(sk[rows].bytes, sk[rows].bytes, outSk[j].mask.bytes); //subtract output masks in last row..
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2018-08-16 09:08:58 -04:00
|
|
|
mgSig result = MLSAG_Gen(message, M, sk, kLRki, mscout, index, rows, hwdev);
|
|
|
|
memwipe(sk.data(), sk.size() * sizeof(key));
|
|
|
|
return result;
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2016-07-09 14:30:28 -04:00
|
|
|
//Ring-ct MG sigs Simple
|
|
|
|
// Simple version for when we assume only
|
|
|
|
// post rct inputs
|
|
|
|
// here pubs is a vector of (P, C) length mixin
|
|
|
|
// inSk is x, a_in corresponding to signing index
|
|
|
|
// a_out, Cout is for the output commitment
|
|
|
|
// index is the signing index..
|
2018-02-20 11:01:27 -05:00
|
|
|
mgSig proveRctMGSimple(const key &message, const ctkeyV & pubs, const ctkey & inSk, const key &a , const key &Cout, const multisig_kLRki *kLRki, key *mscout, unsigned int index, hw::device &hwdev) {
|
2016-07-09 14:30:28 -04:00
|
|
|
mgSig mg;
|
|
|
|
//setup vars
|
|
|
|
size_t rows = 1;
|
|
|
|
size_t cols = pubs.size();
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(cols >= 1, "Empty pubs");
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES((kLRki && mscout) || (!kLRki && !mscout), "Only one of kLRki/mscout is present");
|
2016-07-09 14:30:28 -04:00
|
|
|
keyV tmp(rows + 1);
|
|
|
|
keyV sk(rows + 1);
|
|
|
|
size_t i;
|
|
|
|
keyM M(cols, tmp);
|
2018-02-21 10:35:06 -05:00
|
|
|
|
|
|
|
sk[0] = copy(inSk.dest);
|
|
|
|
sc_sub(sk[1].bytes, inSk.mask.bytes, a.bytes);
|
2016-07-09 14:30:28 -04:00
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
M[i][0] = pubs[i].dest;
|
|
|
|
subKeys(M[i][1], pubs[i].mask, Cout);
|
|
|
|
}
|
2018-08-16 09:08:58 -04:00
|
|
|
mgSig result = MLSAG_Gen(message, M, sk, kLRki, mscout, index, rows, hwdev);
|
|
|
|
memwipe(&sk[0], sizeof(key));
|
|
|
|
return result;
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//Ring-ct MG sigs
|
|
|
|
//Prove:
|
2018-06-23 15:15:29 -04:00
|
|
|
// c.f. https://eprint.iacr.org/2015/1098 section 4. definition 10.
|
2016-05-13 15:45:20 -04:00
|
|
|
// This does the MG sig on the "dest" part of the given key matrix, and
|
|
|
|
// the last row is the sum of input commitments from that column - sum output commitments
|
|
|
|
// this shows that sum inputs = sum outputs
|
|
|
|
//Ver:
|
|
|
|
// verifies the above sig is created corretly
|
2016-08-27 17:20:45 -04:00
|
|
|
bool verRctMG(const mgSig &mg, const ctkeyM & pubs, const ctkeyV & outPk, key txnFeeKey, const key &message) {
|
2016-10-10 15:47:52 -04:00
|
|
|
PERF_TIMER(verRctMG);
|
2016-05-13 15:45:20 -04:00
|
|
|
//setup vars
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t cols = pubs.size();
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(cols >= 1, false, "Empty pubs");
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t rows = pubs[0].size();
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rows >= 1, false, "Empty pubs");
|
2016-05-14 16:58:31 -04:00
|
|
|
for (size_t i = 1; i < cols; ++i) {
|
2016-06-17 15:48:36 -04:00
|
|
|
CHECK_AND_ASSERT_MES(pubs[i].size() == rows, false, "pubs is not rectangular");
|
2016-05-14 16:58:31 -04:00
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
keyV tmp(rows + 1);
|
2016-05-14 16:58:31 -04:00
|
|
|
size_t i = 0, j = 0;
|
2016-05-13 15:45:20 -04:00
|
|
|
for (i = 0; i < rows + 1; i++) {
|
|
|
|
identity(tmp[i]);
|
|
|
|
}
|
|
|
|
keyM M(cols, tmp);
|
|
|
|
|
|
|
|
//create the matrix to mg sig
|
|
|
|
for (j = 0; j < rows; j++) {
|
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
M[i][j] = pubs[i][j].dest;
|
2016-06-12 16:53:01 -04:00
|
|
|
addKeys(M[i][rows], M[i][rows], pubs[i][j].mask); //add Ci in last row
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
}
|
2016-06-12 16:53:01 -04:00
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
for (j = 0; j < outPk.size(); j++) {
|
|
|
|
subKeys(M[i][rows], M[i][rows], outPk[j].mask); //subtract output Ci's in last row
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-06-12 16:53:01 -04:00
|
|
|
//subtract txn fee output in last row
|
|
|
|
subKeys(M[i][rows], M[i][rows], txnFeeKey);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-09 06:38:54 -04:00
|
|
|
return MLSAG_Ver(message, M, mg, rows);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
|
2016-07-09 14:30:28 -04:00
|
|
|
//Ring-ct Simple MG sigs
|
|
|
|
//Ver:
|
|
|
|
//This does a simplified version, assuming only post Rct
|
|
|
|
//inputs
|
2016-08-09 06:38:54 -04:00
|
|
|
bool verRctMGSimple(const key &message, const mgSig &mg, const ctkeyV & pubs, const key & C) {
|
2016-12-07 17:09:43 -05:00
|
|
|
try
|
|
|
|
{
|
2016-10-10 15:47:52 -04:00
|
|
|
PERF_TIMER(verRctMGSimple);
|
2016-07-09 14:30:28 -04:00
|
|
|
//setup vars
|
|
|
|
size_t rows = 1;
|
|
|
|
size_t cols = pubs.size();
|
|
|
|
CHECK_AND_ASSERT_MES(cols >= 1, false, "Empty pubs");
|
|
|
|
keyV tmp(rows + 1);
|
|
|
|
size_t i;
|
|
|
|
keyM M(cols, tmp);
|
|
|
|
//create the matrix to mg sig
|
|
|
|
for (i = 0; i < cols; i++) {
|
|
|
|
M[i][0] = pubs[i].dest;
|
|
|
|
subKeys(M[i][1], pubs[i].mask, C);
|
|
|
|
}
|
|
|
|
//DP(C);
|
2016-08-09 06:38:54 -04:00
|
|
|
return MLSAG_Ver(message, M, mg, rows);
|
2016-12-07 17:09:43 -05:00
|
|
|
}
|
|
|
|
catch (...) { return false; }
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
2016-10-15 08:31:16 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//These functions get keys from blockchain
|
|
|
|
//replace these when connecting blockchain
|
|
|
|
//getKeyFromBlockchain grabs a key from the blockchain at "reference_index" to mix with
|
|
|
|
//populateFromBlockchain creates a keymatrix with "mixin" columns and one of the columns is inPk
|
|
|
|
// the return value are the key matrix, and the index where inPk was put (random).
|
|
|
|
void getKeyFromBlockchain(ctkey & a, size_t reference_index) {
|
|
|
|
a.mask = pkGen();
|
|
|
|
a.dest = pkGen();
|
|
|
|
}
|
|
|
|
|
|
|
|
//These functions get keys from blockchain
|
|
|
|
//replace these when connecting blockchain
|
|
|
|
//getKeyFromBlockchain grabs a key from the blockchain at "reference_index" to mix with
|
2016-06-04 04:37:38 -04:00
|
|
|
//populateFromBlockchain creates a keymatrix with "mixin" + 1 columns and one of the columns is inPk
|
2016-05-13 15:45:20 -04:00
|
|
|
// the return value are the key matrix, and the index where inPk was put (random).
|
|
|
|
tuple<ctkeyM, xmr_amount> populateFromBlockchain(ctkeyV inPk, int mixin) {
|
|
|
|
int rows = inPk.size();
|
2016-06-04 04:37:38 -04:00
|
|
|
ctkeyM rv(mixin + 1, inPk);
|
2016-05-13 15:45:20 -04:00
|
|
|
int index = randXmrAmount(mixin);
|
|
|
|
int i = 0, j = 0;
|
2016-06-04 04:37:38 -04:00
|
|
|
for (i = 0; i <= mixin; i++) {
|
2016-05-13 15:45:20 -04:00
|
|
|
if (i != index) {
|
|
|
|
for (j = 0; j < rows; j++) {
|
|
|
|
getKeyFromBlockchain(rv[i][j], (size_t)randXmrAmount);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return make_tuple(rv, index);
|
|
|
|
}
|
|
|
|
|
2016-07-09 14:30:28 -04:00
|
|
|
//These functions get keys from blockchain
|
|
|
|
//replace these when connecting blockchain
|
|
|
|
//getKeyFromBlockchain grabs a key from the blockchain at "reference_index" to mix with
|
|
|
|
//populateFromBlockchain creates a keymatrix with "mixin" columns and one of the columns is inPk
|
|
|
|
// the return value are the key matrix, and the index where inPk was put (random).
|
|
|
|
xmr_amount populateFromBlockchainSimple(ctkeyV & mixRing, const ctkey & inPk, int mixin) {
|
|
|
|
int index = randXmrAmount(mixin);
|
|
|
|
int i = 0;
|
|
|
|
for (i = 0; i <= mixin; i++) {
|
|
|
|
if (i != index) {
|
|
|
|
getKeyFromBlockchain(mixRing[i], (size_t)randXmrAmount(1000));
|
|
|
|
} else {
|
|
|
|
mixRing[i] = inPk;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return index;
|
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//RingCT protocol
|
|
|
|
//genRct:
|
|
|
|
// creates an rctSig with all data necessary to verify the rangeProofs and that the signer owns one of the
|
|
|
|
// columns that are claimed as inputs, and that the sum of inputs = sum of outputs.
|
|
|
|
// Also contains masked "amount" and "mask" so the receiver can see how much they received
|
|
|
|
//verRct:
|
|
|
|
// verifies that all signatures (rangeProogs, MG sig, sum inputs = outputs) are correct
|
2018-06-23 15:15:29 -04:00
|
|
|
//decodeRct: (c.f. https://eprint.iacr.org/2015/1098 section 5.1.1)
|
2016-05-13 15:45:20 -04:00
|
|
|
// uses the attached ecdh info to find the amounts represented by each output commitment
|
|
|
|
// must know the destination private key to find the correct amount, else will return a random number
|
2016-06-12 16:53:01 -04:00
|
|
|
// Note: For txn fees, the last index in the amounts vector should contain that
|
|
|
|
// Thus the amounts vector will be "one" longer than the destinations vectort
|
2018-03-30 15:29:42 -04:00
|
|
|
rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector<xmr_amount> & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, hw::device &hwdev) {
|
2016-06-12 17:41:40 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(amounts.size() == destinations.size() || amounts.size() == destinations.size() + 1, "Different number of amounts/destinations");
|
2016-10-29 08:33:08 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(amount_keys.size() == destinations.size(), "Different number of amount_keys/destinations");
|
2016-06-12 16:13:12 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(index < mixRing.size(), "Bad index into mixRing");
|
|
|
|
for (size_t n = 0; n < mixRing.size(); ++n) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(mixRing[n].size() == inSk.size(), "Bad mixRing size");
|
|
|
|
}
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES((kLRki && msout) || (!kLRki && !msout), "Only one of kLRki/msout is present");
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
rctSig rv;
|
2018-03-30 15:29:42 -04:00
|
|
|
rv.type = RCTTypeFull;
|
2016-08-09 16:34:09 -04:00
|
|
|
rv.message = message;
|
2016-05-13 15:45:20 -04:00
|
|
|
rv.outPk.resize(destinations.size());
|
2018-03-30 15:29:42 -04:00
|
|
|
rv.p.rangeSigs.resize(destinations.size());
|
2016-05-13 15:45:20 -04:00
|
|
|
rv.ecdhInfo.resize(destinations.size());
|
|
|
|
|
|
|
|
size_t i = 0;
|
|
|
|
keyV masks(destinations.size()); //sk mask..
|
2016-07-11 18:14:58 -04:00
|
|
|
outSk.resize(destinations.size());
|
2016-05-13 15:45:20 -04:00
|
|
|
for (i = 0; i < destinations.size(); i++) {
|
|
|
|
//add destination to sig
|
|
|
|
rv.outPk[i].dest = copy(destinations[i]);
|
2018-03-30 15:29:42 -04:00
|
|
|
//compute range proof
|
|
|
|
rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, amounts[i]);
|
2018-01-17 16:50:03 -05:00
|
|
|
#ifdef DBG
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof");
|
2018-01-17 16:50:03 -05:00
|
|
|
#endif
|
2016-05-13 15:45:20 -04:00
|
|
|
//mask amount and mask
|
|
|
|
rv.ecdhInfo[i].mask = copy(outSk[i].mask);
|
|
|
|
rv.ecdhInfo[i].amount = d2h(amounts[i]);
|
2018-03-05 02:16:30 -05:00
|
|
|
hwdev.ecdhEncode(rv.ecdhInfo[i], amount_keys[i]);
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
|
2016-06-12 16:53:01 -04:00
|
|
|
//set txn fee
|
2016-06-12 17:41:40 -04:00
|
|
|
if (amounts.size() > destinations.size())
|
|
|
|
{
|
|
|
|
rv.txnFee = amounts[destinations.size()];
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
rv.txnFee = 0;
|
|
|
|
}
|
2016-06-12 16:53:01 -04:00
|
|
|
key txnFeeKey = scalarmultH(d2h(rv.txnFee));
|
|
|
|
|
2016-06-12 16:13:12 -04:00
|
|
|
rv.mixRing = mixRing;
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
if (msout)
|
|
|
|
msout->c.resize(1);
|
2018-02-20 11:01:27 -05:00
|
|
|
rv.p.MGs.push_back(proveRctMG(get_pre_mlsag_hash(rv, hwdev), rv.mixRing, inSk, outSk, rv.outPk, kLRki, msout ? &msout->c[0] : NULL, index, txnFeeKey,hwdev));
|
2016-05-13 15:45:20 -04:00
|
|
|
return rv;
|
|
|
|
}
|
2016-06-12 16:13:12 -04:00
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
rctSig genRct(const key &message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const vector<xmr_amount> & amounts, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, const int mixin, hw::device &hwdev) {
|
2016-06-12 16:13:12 -04:00
|
|
|
unsigned int index;
|
|
|
|
ctkeyM mixRing;
|
2016-07-11 18:14:58 -04:00
|
|
|
ctkeyV outSk;
|
2016-06-12 16:13:12 -04:00
|
|
|
tie(mixRing, index) = populateFromBlockchain(inPk, mixin);
|
2018-03-30 15:29:42 -04:00
|
|
|
return genRct(message, inSk, destinations, amounts, mixRing, amount_keys, kLRki, msout, index, outSk, hwdev);
|
2016-06-12 16:13:12 -04:00
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
|
2016-07-09 14:30:28 -04:00
|
|
|
//RCT simple
|
|
|
|
//for post-rct only
|
2018-01-17 16:50:03 -05:00
|
|
|
rctSig genRctSimple(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector<xmr_amount> &inamounts, const vector<xmr_amount> &outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector<multisig_kLRki> *kLRki, multisig_out *msout, const std::vector<unsigned int> & index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev) {
|
|
|
|
const bool bulletproof = range_proof_type != RangeProofBorromean;
|
2016-07-09 14:30:28 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(inamounts.size() > 0, "Empty inamounts");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(inamounts.size() == inSk.size(), "Different number of inamounts/inSk");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(outamounts.size() == destinations.size(), "Different number of amounts/destinations");
|
2016-10-29 08:33:08 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(amount_keys.size() == destinations.size(), "Different number of amount_keys/destinations");
|
2016-07-09 14:30:28 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(index.size() == inSk.size(), "Different number of index/inSk");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(mixRing.size() == inSk.size(), "Different number of mixRing/inSk");
|
|
|
|
for (size_t n = 0; n < mixRing.size(); ++n) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(index[n] < mixRing[n].size(), "Bad index into mixRing");
|
|
|
|
}
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES((kLRki && msout) || (!kLRki && !msout), "Only one of kLRki/msout is present");
|
|
|
|
if (kLRki && msout) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(kLRki->size() == inamounts.size(), "Mismatched kLRki/inamounts sizes");
|
|
|
|
}
|
2016-07-09 14:30:28 -04:00
|
|
|
|
2016-07-10 07:57:22 -04:00
|
|
|
rctSig rv;
|
2018-03-30 15:29:42 -04:00
|
|
|
rv.type = bulletproof ? RCTTypeBulletproof : RCTTypeSimple;
|
2016-08-09 16:34:09 -04:00
|
|
|
rv.message = message;
|
2016-07-09 14:30:28 -04:00
|
|
|
rv.outPk.resize(destinations.size());
|
2018-03-30 15:29:42 -04:00
|
|
|
if (!bulletproof)
|
2017-12-02 03:32:39 -05:00
|
|
|
rv.p.rangeSigs.resize(destinations.size());
|
2016-07-09 14:30:28 -04:00
|
|
|
rv.ecdhInfo.resize(destinations.size());
|
|
|
|
|
|
|
|
size_t i;
|
|
|
|
keyV masks(destinations.size()); //sk mask..
|
2016-07-11 18:14:58 -04:00
|
|
|
outSk.resize(destinations.size());
|
2016-07-09 14:30:28 -04:00
|
|
|
for (i = 0; i < destinations.size(); i++) {
|
|
|
|
|
|
|
|
//add destination to sig
|
|
|
|
rv.outPk[i].dest = copy(destinations[i]);
|
|
|
|
//compute range proof
|
2018-03-30 15:29:42 -04:00
|
|
|
if (!bulletproof)
|
2017-12-02 03:32:39 -05:00
|
|
|
rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, outamounts[i]);
|
|
|
|
#ifdef DBG
|
2018-03-30 15:29:42 -04:00
|
|
|
if (!bulletproof)
|
2017-12-02 03:32:39 -05:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof");
|
|
|
|
#endif
|
2018-03-30 15:29:42 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
rv.p.bulletproofs.clear();
|
|
|
|
if (bulletproof)
|
|
|
|
{
|
|
|
|
std::vector<uint64_t> proof_amounts;
|
|
|
|
size_t n_amounts = outamounts.size();
|
|
|
|
size_t amounts_proved = 0;
|
2018-07-18 17:24:53 -04:00
|
|
|
if (range_proof_type == RangeProofPaddedBulletproof)
|
|
|
|
{
|
|
|
|
rct::keyV C, masks;
|
|
|
|
rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, outamounts));
|
|
|
|
#ifdef DBG
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof");
|
|
|
|
#endif
|
|
|
|
for (i = 0; i < outamounts.size(); ++i)
|
|
|
|
{
|
|
|
|
rv.outPk[i].mask = C[i];
|
|
|
|
outSk[i].mask = masks[i];
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else while (amounts_proved < n_amounts)
|
2018-03-30 15:29:42 -04:00
|
|
|
{
|
|
|
|
size_t batch_size = 1;
|
|
|
|
if (range_proof_type == RangeProofMultiOutputBulletproof)
|
2018-03-30 15:44:51 -04:00
|
|
|
while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= BULLETPROOF_MAX_OUTPUTS)
|
2018-03-30 15:29:42 -04:00
|
|
|
batch_size *= 2;
|
|
|
|
rct::keyV C, masks;
|
|
|
|
std::vector<uint64_t> batch_amounts(batch_size);
|
|
|
|
for (i = 0; i < batch_size; ++i)
|
|
|
|
batch_amounts[i] = outamounts[i + amounts_proved];
|
|
|
|
rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, batch_amounts));
|
|
|
|
#ifdef DBG
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof");
|
|
|
|
#endif
|
|
|
|
for (i = 0; i < batch_size; ++i)
|
|
|
|
{
|
|
|
|
rv.outPk[i + amounts_proved].mask = C[i];
|
|
|
|
outSk[i + amounts_proved].mask = masks[i];
|
|
|
|
}
|
|
|
|
amounts_proved += batch_size;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
key sumout = zero();
|
|
|
|
for (i = 0; i < outSk.size(); ++i)
|
|
|
|
{
|
2016-07-09 14:30:28 -04:00
|
|
|
sc_add(sumout.bytes, outSk[i].mask.bytes, sumout.bytes);
|
|
|
|
|
|
|
|
//mask amount and mask
|
|
|
|
rv.ecdhInfo[i].mask = copy(outSk[i].mask);
|
|
|
|
rv.ecdhInfo[i].amount = d2h(outamounts[i]);
|
2018-03-05 02:16:30 -05:00
|
|
|
hwdev.ecdhEncode(rv.ecdhInfo[i], amount_keys[i]);
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
//set txn fee
|
|
|
|
rv.txnFee = txnFee;
|
|
|
|
// TODO: unused ??
|
|
|
|
// key txnFeeKey = scalarmultH(d2h(rv.txnFee));
|
|
|
|
rv.mixRing = mixRing;
|
2017-12-16 06:58:58 -05:00
|
|
|
keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts;
|
|
|
|
pseudoOuts.resize(inamounts.size());
|
2016-08-09 16:34:09 -04:00
|
|
|
rv.p.MGs.resize(inamounts.size());
|
2016-07-09 14:30:28 -04:00
|
|
|
key sumpouts = zero(); //sum pseudoOut masks
|
2016-08-09 06:38:54 -04:00
|
|
|
keyV a(inamounts.size());
|
2016-07-09 14:30:28 -04:00
|
|
|
for (i = 0 ; i < inamounts.size() - 1; i++) {
|
2016-08-09 06:38:54 -04:00
|
|
|
skGen(a[i]);
|
|
|
|
sc_add(sumpouts.bytes, a[i].bytes, sumpouts.bytes);
|
2017-12-16 06:58:58 -05:00
|
|
|
genC(pseudoOuts[i], a[i], inamounts[i]);
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
rv.mixRing = mixRing;
|
2016-08-09 06:38:54 -04:00
|
|
|
sc_sub(a[i].bytes, sumout.bytes, sumpouts.bytes);
|
2017-12-16 06:58:58 -05:00
|
|
|
genC(pseudoOuts[i], a[i], inamounts[i]);
|
|
|
|
DP(pseudoOuts[i]);
|
2016-08-09 06:38:54 -04:00
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
key full_message = get_pre_mlsag_hash(rv,hwdev);
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
if (msout)
|
|
|
|
msout->c.resize(inamounts.size());
|
2016-08-09 06:38:54 -04:00
|
|
|
for (i = 0 ; i < inamounts.size(); i++) {
|
2018-02-20 11:01:27 -05:00
|
|
|
rv.p.MGs[i] = proveRctMGSimple(full_message, rv.mixRing[i], inSk[i], a[i], pseudoOuts[i], kLRki ? &(*kLRki)[i]: NULL, msout ? &msout->c[i] : NULL, index[i], hwdev);
|
2016-08-09 06:38:54 -04:00
|
|
|
}
|
2016-07-09 14:30:28 -04:00
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
rctSig genRctSimple(const key &message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const vector<xmr_amount> &inamounts, const vector<xmr_amount> &outamounts, const keyV &amount_keys, const std::vector<multisig_kLRki> *kLRki, multisig_out *msout, xmr_amount txnFee, unsigned int mixin, hw::device &hwdev) {
|
2016-07-09 14:30:28 -04:00
|
|
|
std::vector<unsigned int> index;
|
|
|
|
index.resize(inPk.size());
|
|
|
|
ctkeyM mixRing;
|
2016-07-11 18:14:58 -04:00
|
|
|
ctkeyV outSk;
|
2016-07-09 14:30:28 -04:00
|
|
|
mixRing.resize(inPk.size());
|
|
|
|
for (size_t i = 0; i < inPk.size(); ++i) {
|
|
|
|
mixRing[i].resize(mixin+1);
|
|
|
|
index[i] = populateFromBlockchainSimple(mixRing[i], inPk[i], mixin);
|
|
|
|
}
|
2018-01-17 16:50:03 -05:00
|
|
|
return genRctSimple(message, inSk, destinations, inamounts, outamounts, txnFee, mixRing, amount_keys, kLRki, msout, index, outSk, RangeProofBorromean, hwdev);
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//RingCT protocol
|
|
|
|
//genRct:
|
|
|
|
// creates an rctSig with all data necessary to verify the rangeProofs and that the signer owns one of the
|
|
|
|
// columns that are claimed as inputs, and that the sum of inputs = sum of outputs.
|
|
|
|
// Also contains masked "amount" and "mask" so the receiver can see how much they received
|
|
|
|
//verRct:
|
|
|
|
// verifies that all signatures (rangeProogs, MG sig, sum inputs = outputs) are correct
|
2018-06-23 15:15:29 -04:00
|
|
|
//decodeRct: (c.f. https://eprint.iacr.org/2015/1098 section 5.1.1)
|
2016-05-13 15:45:20 -04:00
|
|
|
// uses the attached ecdh info to find the amounts represented by each output commitment
|
|
|
|
// must know the destination private key to find the correct amount, else will return a random number
|
2017-01-14 08:29:08 -05:00
|
|
|
bool verRct(const rctSig & rv, bool semantics) {
|
2016-10-10 15:47:52 -04:00
|
|
|
PERF_TIMER(verRct);
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull, false, "verRct called on non-full rctSig");
|
2017-01-14 08:29:08 -05:00
|
|
|
if (semantics)
|
|
|
|
{
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.rangeSigs.size(), false, "Mismatched sizes of outPk and rv.p.rangeSigs");
|
2017-01-14 08:29:08 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.ecdhInfo.size(), false, "Mismatched sizes of outPk and rv.ecdhInfo");
|
|
|
|
CHECK_AND_ASSERT_MES(rv.p.MGs.size() == 1, false, "full rctSig has not one MG");
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
// semantics check is early, we don't have the MGs resolved yet
|
|
|
|
}
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-06-15 18:37:13 -04:00
|
|
|
// some rct ops can throw
|
|
|
|
try
|
|
|
|
{
|
2017-01-14 08:29:08 -05:00
|
|
|
if (semantics) {
|
2017-09-13 23:39:37 -04:00
|
|
|
tools::threadpool& tpool = tools::threadpool::getInstance();
|
|
|
|
tools::threadpool::waiter waiter;
|
2018-03-30 15:29:42 -04:00
|
|
|
std::deque<bool> results(rv.outPk.size(), false);
|
2017-09-13 23:39:37 -04:00
|
|
|
DP("range proofs verified?");
|
2018-03-30 15:29:42 -04:00
|
|
|
for (size_t i = 0; i < rv.outPk.size(); i++)
|
|
|
|
tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); });
|
2018-04-26 06:44:47 -04:00
|
|
|
waiter.wait(&tpool);
|
2016-11-21 14:48:42 -05:00
|
|
|
|
2018-01-17 16:50:03 -05:00
|
|
|
for (size_t i = 0; i < results.size(); ++i) {
|
2017-01-14 08:29:08 -05:00
|
|
|
if (!results[i]) {
|
2018-01-17 16:50:03 -05:00
|
|
|
LOG_PRINT_L1("Range proof verified failed for proof " << i);
|
2017-01-14 08:29:08 -05:00
|
|
|
return false;
|
|
|
|
}
|
2016-11-21 14:48:42 -05:00
|
|
|
}
|
2017-01-14 08:29:08 -05:00
|
|
|
}
|
2016-10-15 08:31:16 -04:00
|
|
|
|
2017-01-14 08:29:08 -05:00
|
|
|
if (!semantics) {
|
|
|
|
//compute txn fee
|
|
|
|
key txnFeeKey = scalarmultH(d2h(rv.txnFee));
|
2018-02-20 11:01:27 -05:00
|
|
|
bool mgVerd = verRctMG(rv.p.MGs[0], rv.mixRing, rv.outPk, txnFeeKey, get_pre_mlsag_hash(rv, hw::get_device("default")));
|
2017-01-14 08:29:08 -05:00
|
|
|
DP("mg sig verified?");
|
|
|
|
DP(mgVerd);
|
|
|
|
if (!mgVerd) {
|
|
|
|
LOG_PRINT_L1("MG signature verification failed");
|
2016-11-02 16:41:43 -04:00
|
|
|
return false;
|
2016-10-15 08:31:16 -04:00
|
|
|
}
|
2016-06-15 18:37:13 -04:00
|
|
|
}
|
2016-10-15 08:31:16 -04:00
|
|
|
|
2016-08-12 13:30:16 -04:00
|
|
|
return true;
|
2016-06-15 18:37:13 -04:00
|
|
|
}
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
catch (const std::exception &e)
|
2016-06-15 18:37:13 -04:00
|
|
|
{
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
LOG_PRINT_L1("Error in verRct: " << e.what());
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
catch (...)
|
|
|
|
{
|
|
|
|
LOG_PRINT_L1("Error in verRct, but not an actual exception");
|
2016-06-15 18:37:13 -04:00
|
|
|
return false;
|
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
2016-08-09 06:38:54 -04:00
|
|
|
|
2016-07-09 14:30:28 -04:00
|
|
|
//ver RingCT simple
|
|
|
|
//assumes only post-rct style inputs (at least for max anonymity)
|
2018-02-03 09:36:29 -05:00
|
|
|
bool verRctSemanticsSimple(const std::vector<const rctSig*> & rvv) {
|
2016-12-07 17:09:43 -05:00
|
|
|
try
|
|
|
|
{
|
2018-02-03 09:36:29 -05:00
|
|
|
PERF_TIMER(verRctSemanticsSimple);
|
2016-08-09 06:38:54 -04:00
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
tools::threadpool& tpool = tools::threadpool::getInstance();
|
|
|
|
tools::threadpool::waiter waiter;
|
|
|
|
std::deque<bool> results;
|
|
|
|
std::vector<const Bulletproof*> proofs;
|
|
|
|
size_t max_non_bp_proofs = 0, offset = 0;
|
|
|
|
|
|
|
|
for (const rctSig *rvp: rvv)
|
2017-01-14 08:29:08 -05:00
|
|
|
{
|
2018-02-03 09:36:29 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rvp, false, "rctSig pointer is NULL");
|
|
|
|
const rctSig &rv = *rvp;
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "verRctSemanticsSimple called on non simple rctSig");
|
2018-02-03 09:36:29 -05:00
|
|
|
const bool bulletproof = is_rct_bulletproof(rv.type);
|
2018-01-17 16:50:03 -05:00
|
|
|
if (bulletproof)
|
2017-12-16 06:58:58 -05:00
|
|
|
{
|
2018-01-17 16:50:03 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.outPk.size() == n_bulletproof_amounts(rv.p.bulletproofs), false, "Mismatched sizes of outPk and bulletproofs");
|
2017-12-16 06:58:58 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.p.MGs.size(), false, "Mismatched sizes of rv.p.pseudoOuts and rv.p.MGs");
|
|
|
|
CHECK_AND_ASSERT_MES(rv.pseudoOuts.empty(), false, "rv.pseudoOuts is not empty");
|
|
|
|
}
|
2017-12-02 03:32:39 -05:00
|
|
|
else
|
2017-12-16 06:58:58 -05:00
|
|
|
{
|
2017-12-02 03:32:39 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.rangeSigs.size(), false, "Mismatched sizes of outPk and rv.p.rangeSigs");
|
2017-12-16 06:58:58 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.pseudoOuts.size() == rv.p.MGs.size(), false, "Mismatched sizes of rv.pseudoOuts and rv.p.MGs");
|
|
|
|
CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.empty(), false, "rv.p.pseudoOuts is not empty");
|
|
|
|
}
|
2017-01-14 08:29:08 -05:00
|
|
|
CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.ecdhInfo.size(), false, "Mismatched sizes of outPk and rv.ecdhInfo");
|
2016-07-09 14:30:28 -04:00
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
if (!bulletproof)
|
|
|
|
max_non_bp_proofs += rv.p.rangeSigs.size();
|
|
|
|
}
|
2016-11-21 14:48:42 -05:00
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
results.resize(max_non_bp_proofs);
|
|
|
|
for (const rctSig *rvp: rvv)
|
|
|
|
{
|
|
|
|
const rctSig &rv = *rvp;
|
2016-11-21 14:48:42 -05:00
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
const bool bulletproof = is_rct_bulletproof(rv.type);
|
|
|
|
const keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts;
|
2017-12-16 06:58:58 -05:00
|
|
|
|
2017-01-14 08:29:08 -05:00
|
|
|
key sumOutpks = identity();
|
|
|
|
for (size_t i = 0; i < rv.outPk.size(); i++) {
|
2018-02-03 09:36:29 -05:00
|
|
|
addKeys(sumOutpks, sumOutpks, rv.outPk[i].mask);
|
2017-01-14 08:29:08 -05:00
|
|
|
}
|
|
|
|
DP(sumOutpks);
|
|
|
|
key txnFeeKey = scalarmultH(d2h(rv.txnFee));
|
|
|
|
addKeys(sumOutpks, txnFeeKey, sumOutpks);
|
2016-10-15 08:31:16 -04:00
|
|
|
|
2017-01-14 08:29:08 -05:00
|
|
|
key sumPseudoOuts = identity();
|
2017-12-16 06:58:58 -05:00
|
|
|
for (size_t i = 0 ; i < pseudoOuts.size() ; i++) {
|
2018-02-03 09:36:29 -05:00
|
|
|
addKeys(sumPseudoOuts, sumPseudoOuts, pseudoOuts[i]);
|
2016-11-21 14:48:42 -05:00
|
|
|
}
|
2017-01-14 08:29:08 -05:00
|
|
|
DP(sumPseudoOuts);
|
2016-11-21 14:48:42 -05:00
|
|
|
|
2017-01-14 08:29:08 -05:00
|
|
|
//check pseudoOuts vs Outs..
|
|
|
|
if (!equalKeys(sumPseudoOuts, sumOutpks)) {
|
2018-02-03 09:36:29 -05:00
|
|
|
LOG_PRINT_L1("Sum check failed");
|
|
|
|
return false;
|
2016-10-15 08:31:16 -04:00
|
|
|
}
|
2017-01-21 15:29:22 -05:00
|
|
|
|
2018-01-17 16:50:03 -05:00
|
|
|
if (bulletproof)
|
2018-02-03 09:36:29 -05:00
|
|
|
{
|
2018-01-17 16:50:03 -05:00
|
|
|
for (size_t i = 0; i < rv.p.bulletproofs.size(); i++)
|
2018-02-03 09:36:29 -05:00
|
|
|
proofs.push_back(&rv.p.bulletproofs[i]);
|
|
|
|
}
|
2018-01-17 16:50:03 -05:00
|
|
|
else
|
2018-02-03 09:36:29 -05:00
|
|
|
{
|
2018-01-17 16:50:03 -05:00
|
|
|
for (size_t i = 0; i < rv.p.rangeSigs.size(); i++)
|
2018-02-03 09:36:29 -05:00
|
|
|
tpool.submit(&waiter, [&, i, offset] { results[i+offset] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); });
|
|
|
|
offset += rv.p.rangeSigs.size();
|
2017-01-21 15:29:22 -05:00
|
|
|
}
|
2016-10-15 08:31:16 -04:00
|
|
|
}
|
2018-02-03 09:36:29 -05:00
|
|
|
if (!proofs.empty() && !verBulletproof(proofs))
|
|
|
|
{
|
|
|
|
LOG_PRINT_L1("Aggregate range proof verified failed");
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
waiter.wait(&tpool);
|
|
|
|
for (size_t i = 0; i < results.size(); ++i) {
|
|
|
|
if (!results[i]) {
|
|
|
|
LOG_PRINT_L1("Range proof verified failed for proof " << i);
|
|
|
|
return false;
|
2017-09-13 23:39:37 -04:00
|
|
|
}
|
2018-02-03 09:36:29 -05:00
|
|
|
}
|
2017-01-14 08:29:08 -05:00
|
|
|
|
2018-02-03 09:36:29 -05:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
// we can get deep throws from ge_frombytes_vartime if input isn't valid
|
|
|
|
catch (const std::exception &e)
|
|
|
|
{
|
|
|
|
LOG_PRINT_L1("Error in verRctSemanticsSimple: " << e.what());
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
catch (...)
|
|
|
|
{
|
|
|
|
LOG_PRINT_L1("Error in verRctSemanticsSimple, but not an actual exception");
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool verRctSemanticsSimple(const rctSig & rv)
|
|
|
|
{
|
|
|
|
return verRctSemanticsSimple(std::vector<const rctSig*>(1, &rv));
|
|
|
|
}
|
|
|
|
|
|
|
|
//ver RingCT simple
|
|
|
|
//assumes only post-rct style inputs (at least for max anonymity)
|
|
|
|
bool verRctNonSemanticsSimple(const rctSig & rv) {
|
|
|
|
try
|
|
|
|
{
|
|
|
|
PERF_TIMER(verRctNonSemanticsSimple);
|
|
|
|
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "verRctNonSemanticsSimple called on non simple rctSig");
|
2018-02-03 09:36:29 -05:00
|
|
|
const bool bulletproof = is_rct_bulletproof(rv.type);
|
|
|
|
// semantics check is early, and mixRing/MGs aren't resolved yet
|
|
|
|
if (bulletproof)
|
|
|
|
CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.p.pseudoOuts and mixRing");
|
|
|
|
else
|
|
|
|
CHECK_AND_ASSERT_MES(rv.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.pseudoOuts and mixRing");
|
|
|
|
|
|
|
|
const size_t threads = std::max(rv.outPk.size(), rv.mixRing.size());
|
|
|
|
|
|
|
|
std::deque<bool> results(threads);
|
|
|
|
tools::threadpool& tpool = tools::threadpool::getInstance();
|
|
|
|
tools::threadpool::waiter waiter;
|
|
|
|
|
|
|
|
const keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts;
|
|
|
|
|
|
|
|
const key message = get_pre_mlsag_hash(rv, hw::get_device("default"));
|
|
|
|
|
|
|
|
results.clear();
|
|
|
|
results.resize(rv.mixRing.size());
|
|
|
|
for (size_t i = 0 ; i < rv.mixRing.size() ; i++) {
|
|
|
|
tpool.submit(&waiter, [&, i] {
|
|
|
|
results[i] = verRctMGSimple(message, rv.p.MGs[i], rv.mixRing[i], pseudoOuts[i]);
|
|
|
|
});
|
|
|
|
}
|
|
|
|
waiter.wait(&tpool);
|
|
|
|
|
|
|
|
for (size_t i = 0; i < results.size(); ++i) {
|
|
|
|
if (!results[i]) {
|
|
|
|
LOG_PRINT_L1("verRctMGSimple failed for input " << i);
|
|
|
|
return false;
|
2017-01-14 08:29:08 -05:00
|
|
|
}
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
2016-08-12 13:30:16 -04:00
|
|
|
return true;
|
2016-12-07 17:09:43 -05:00
|
|
|
}
|
|
|
|
// we can get deep throws from ge_frombytes_vartime if input isn't valid
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
catch (const std::exception &e)
|
|
|
|
{
|
2018-02-03 09:36:29 -05:00
|
|
|
LOG_PRINT_L1("Error in verRctNonSemanticsSimple: " << e.what());
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
catch (...)
|
|
|
|
{
|
2018-02-03 09:36:29 -05:00
|
|
|
LOG_PRINT_L1("Error in verRctNonSemanticsSimple, but not an actual exception");
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
return false;
|
|
|
|
}
|
2016-07-09 14:30:28 -04:00
|
|
|
}
|
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//RingCT protocol
|
|
|
|
//genRct:
|
|
|
|
// creates an rctSig with all data necessary to verify the rangeProofs and that the signer owns one of the
|
|
|
|
// columns that are claimed as inputs, and that the sum of inputs = sum of outputs.
|
|
|
|
// Also contains masked "amount" and "mask" so the receiver can see how much they received
|
|
|
|
//verRct:
|
|
|
|
// verifies that all signatures (rangeProogs, MG sig, sum inputs = outputs) are correct
|
2018-06-23 15:15:29 -04:00
|
|
|
//decodeRct: (c.f. https://eprint.iacr.org/2015/1098 section 5.1.1)
|
2016-05-13 15:45:20 -04:00
|
|
|
// uses the attached ecdh info to find the amounts represented by each output commitment
|
|
|
|
// must know the destination private key to find the correct amount, else will return a random number
|
2018-02-20 11:01:27 -05:00
|
|
|
xmr_amount decodeRct(const rctSig & rv, const key & sk, unsigned int i, key & mask, hw::device &hwdev) {
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull, false, "decodeRct called on non-full rctSig");
|
2016-05-14 16:58:31 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(i < rv.ecdhInfo.size(), "Bad index");
|
2017-12-09 13:01:47 -05:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(rv.outPk.size() == rv.ecdhInfo.size(), "Mismatched sizes of rv.outPk and rv.ecdhInfo");
|
2016-05-14 16:58:31 -04:00
|
|
|
|
2016-05-13 15:45:20 -04:00
|
|
|
//mask amount and mask
|
2016-06-12 16:13:12 -04:00
|
|
|
ecdhTuple ecdh_info = rv.ecdhInfo[i];
|
2018-03-05 02:16:30 -05:00
|
|
|
hwdev.ecdhDecode(ecdh_info, sk);
|
2016-06-12 16:13:12 -04:00
|
|
|
mask = ecdh_info.mask;
|
|
|
|
key amount = ecdh_info.amount;
|
2016-05-13 15:45:20 -04:00
|
|
|
key C = rv.outPk[i].mask;
|
|
|
|
DP("C");
|
|
|
|
DP(C);
|
|
|
|
key Ctmp;
|
2018-07-24 15:17:32 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(sc_check(mask.bytes) == 0, "warning, bad ECDH mask");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(sc_check(amount.bytes) == 0, "warning, bad ECDH amount");
|
2016-05-13 15:45:20 -04:00
|
|
|
addKeys2(Ctmp, mask, amount, H);
|
|
|
|
DP("Ctmp");
|
|
|
|
DP(Ctmp);
|
|
|
|
if (equalKeys(C, Ctmp) == false) {
|
2016-06-12 16:13:12 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(false, "warning, amount decoded incorrectly, will be unable to spend");
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|
|
|
|
return h2d(amount);
|
|
|
|
}
|
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
xmr_amount decodeRct(const rctSig & rv, const key & sk, unsigned int i, hw::device &hwdev) {
|
2016-06-12 16:13:12 -04:00
|
|
|
key mask;
|
2018-02-20 11:01:27 -05:00
|
|
|
return decodeRct(rv, sk, i, mask, hwdev);
|
2016-06-12 16:13:12 -04:00
|
|
|
}
|
2016-07-09 14:30:28 -04:00
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
xmr_amount decodeRctSimple(const rctSig & rv, const key & sk, unsigned int i, key &mask, hw::device &hwdev) {
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "decodeRct called on non simple rctSig");
|
2016-07-09 14:30:28 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(i < rv.ecdhInfo.size(), "Bad index");
|
2017-12-09 13:01:47 -05:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(rv.outPk.size() == rv.ecdhInfo.size(), "Mismatched sizes of rv.outPk and rv.ecdhInfo");
|
2016-07-09 14:30:28 -04:00
|
|
|
|
|
|
|
//mask amount and mask
|
|
|
|
ecdhTuple ecdh_info = rv.ecdhInfo[i];
|
2018-03-05 02:16:30 -05:00
|
|
|
hwdev.ecdhDecode(ecdh_info, sk);
|
2016-07-10 07:57:22 -04:00
|
|
|
mask = ecdh_info.mask;
|
2016-07-09 14:30:28 -04:00
|
|
|
key amount = ecdh_info.amount;
|
2017-12-09 13:01:47 -05:00
|
|
|
key C = rv.outPk[i].mask;
|
2016-07-09 14:30:28 -04:00
|
|
|
DP("C");
|
|
|
|
DP(C);
|
|
|
|
key Ctmp;
|
2018-07-24 15:17:32 -04:00
|
|
|
CHECK_AND_ASSERT_THROW_MES(sc_check(mask.bytes) == 0, "warning, bad ECDH mask");
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(sc_check(amount.bytes) == 0, "warning, bad ECDH amount");
|
2016-07-09 14:30:28 -04:00
|
|
|
addKeys2(Ctmp, mask, amount, H);
|
|
|
|
DP("Ctmp");
|
|
|
|
DP(Ctmp);
|
|
|
|
if (equalKeys(C, Ctmp) == false) {
|
|
|
|
CHECK_AND_ASSERT_THROW_MES(false, "warning, amount decoded incorrectly, will be unable to spend");
|
|
|
|
}
|
|
|
|
return h2d(amount);
|
|
|
|
}
|
2016-07-10 07:57:22 -04:00
|
|
|
|
2018-02-20 11:01:27 -05:00
|
|
|
xmr_amount decodeRctSimple(const rctSig & rv, const key & sk, unsigned int i, hw::device &hwdev) {
|
2016-07-10 07:57:22 -04:00
|
|
|
key mask;
|
2018-02-20 11:01:27 -05:00
|
|
|
return decodeRctSimple(rv, sk, i, mask, hwdev);
|
2016-07-10 07:57:22 -04:00
|
|
|
}
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
|
|
|
|
bool signMultisig(rctSig &rv, const std::vector<unsigned int> &indices, const keyV &k, const multisig_out &msout, const key &secret_key) {
|
2018-03-30 15:29:42 -04:00
|
|
|
CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof,
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
false, "unsupported rct type");
|
|
|
|
CHECK_AND_ASSERT_MES(indices.size() == k.size(), false, "Mismatched k/indices sizes");
|
|
|
|
CHECK_AND_ASSERT_MES(k.size() == rv.p.MGs.size(), false, "Mismatched k/MGs size");
|
|
|
|
CHECK_AND_ASSERT_MES(k.size() == msout.c.size(), false, "Mismatched k/msout.c size");
|
2018-03-30 15:29:42 -04:00
|
|
|
if (rv.type == RCTTypeFull)
|
Add N/N multisig tx generation and signing
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
2017-06-03 17:34:26 -04:00
|
|
|
{
|
|
|
|
CHECK_AND_ASSERT_MES(rv.p.MGs.size() == 1, false, "MGs not a single element");
|
|
|
|
}
|
|
|
|
for (size_t n = 0; n < indices.size(); ++n) {
|
|
|
|
CHECK_AND_ASSERT_MES(indices[n] < rv.p.MGs[n].ss.size(), false, "Index out of range");
|
|
|
|
CHECK_AND_ASSERT_MES(!rv.p.MGs[n].ss[indices[n]].empty(), false, "empty ss line");
|
|
|
|
}
|
|
|
|
|
|
|
|
for (size_t n = 0; n < indices.size(); ++n) {
|
|
|
|
rct::key diff;
|
|
|
|
sc_mulsub(diff.bytes, msout.c[n].bytes, secret_key.bytes, k[n].bytes);
|
|
|
|
sc_add(rv.p.MGs[n].ss[indices[n]][0].bytes, rv.p.MGs[n].ss[indices[n]][0].bytes, diff.bytes);
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
2016-05-13 15:45:20 -04:00
|
|
|
}
|