mirror of
https://github.com/comit-network/xmr-btc-swap.git
synced 2025-02-21 23:29:50 -05:00
Change sign API back to taking signing key separately
This commit is contained in:
Thomas Eizinger
parent
7d3633e3ac
commit
507e2670ac
@ -13,87 +13,13 @@ const INV_EIGHT: Scalar = Scalar::from_bits([
|
||||
|
||||
pub fn sign(
|
||||
msg: &[u8; 32],
|
||||
H_p_pk: EdwardsPoint,
|
||||
alpha: Scalar,
|
||||
ring: &[EdwardsPoint; RING_SIZE],
|
||||
commitment_ring: &[EdwardsPoint; RING_SIZE],
|
||||
mut responses: [Scalar; RING_SIZE],
|
||||
signing_key: Scalar,
|
||||
signing_key_index: usize,
|
||||
z: Scalar,
|
||||
pseudo_output_commitment: EdwardsPoint,
|
||||
L: EdwardsPoint,
|
||||
R: EdwardsPoint,
|
||||
I: EdwardsPoint,
|
||||
) -> Signature {
|
||||
let D = z * H_p_pk;
|
||||
let D_inv_8 = D * INV_EIGHT;
|
||||
|
||||
let mu_P = hash_to_scalar!(
|
||||
b"CLSAG_agg_0" || ring || commitment_ring || I || D_inv_8 || pseudo_output_commitment
|
||||
);
|
||||
let mu_C = hash_to_scalar!(
|
||||
b"CLSAG_agg_1" || ring || commitment_ring || I || D_inv_8 || pseudo_output_commitment
|
||||
);
|
||||
|
||||
let adjusted_commitment_ring = commitment_ring.map(|point| point - pseudo_output_commitment);
|
||||
|
||||
let compute_ring_element = |L: EdwardsPoint, R: EdwardsPoint| {
|
||||
hash_to_scalar!(
|
||||
b"CLSAG_round" || ring || commitment_ring || pseudo_output_commitment || msg || L || R
|
||||
)
|
||||
};
|
||||
|
||||
let h_signing_index = compute_ring_element(L, R);
|
||||
|
||||
let mut h_prev = h_signing_index;
|
||||
let mut i = (signing_key_index + 1) % RING_SIZE;
|
||||
let mut h_0 = Scalar::zero();
|
||||
|
||||
if i == 0 {
|
||||
h_0 = h_signing_index
|
||||
}
|
||||
|
||||
while i != signing_key_index {
|
||||
let L_i = compute_L(
|
||||
h_prev,
|
||||
mu_P,
|
||||
mu_C,
|
||||
responses[i],
|
||||
ring[i],
|
||||
adjusted_commitment_ring[i],
|
||||
);
|
||||
let R_i = compute_R(h_prev, mu_P, mu_C, responses[i], ring[i], I, D);
|
||||
|
||||
let h = compute_ring_element(L_i, R_i);
|
||||
|
||||
i = (i + 1) % RING_SIZE;
|
||||
if i == 0 {
|
||||
h_0 = h
|
||||
}
|
||||
|
||||
h_prev = h
|
||||
}
|
||||
|
||||
responses[signing_key_index] =
|
||||
alpha - h_prev * ((mu_P * responses[signing_key_index]) + (mu_C * z));
|
||||
|
||||
Signature {
|
||||
responses,
|
||||
h_0,
|
||||
I,
|
||||
D: D_inv_8,
|
||||
}
|
||||
}
|
||||
|
||||
fn sign2(
|
||||
msg: &[u8; 32],
|
||||
H_p_pk: EdwardsPoint,
|
||||
alpha: Scalar,
|
||||
ring: &[EdwardsPoint; RING_SIZE],
|
||||
commitment_ring: &[EdwardsPoint; RING_SIZE],
|
||||
fake_responses: [Scalar; RING_SIZE - 1],
|
||||
signing_key: Scalar,
|
||||
signing_key_index: usize,
|
||||
z: Scalar,
|
||||
pseudo_output_commitment: EdwardsPoint,
|
||||
L: EdwardsPoint,
|
||||
@ -362,79 +288,15 @@ mod tests {
|
||||
|
||||
let pseudo_output_commitment = fee_key + out_pk;
|
||||
|
||||
let mut responses = random_array(|| Scalar::random(&mut rng));
|
||||
responses[signing_key_index] = signing_key;
|
||||
|
||||
let signature = sign(
|
||||
msg_to_sign,
|
||||
H_p_pk,
|
||||
alpha,
|
||||
&ring,
|
||||
&commitment_ring,
|
||||
responses,
|
||||
signing_key_index,
|
||||
real_commitment_blinding - out_pk_blinding,
|
||||
pseudo_output_commitment,
|
||||
alpha * ED25519_BASEPOINT_POINT,
|
||||
alpha * H_p_pk,
|
||||
signing_key * H_p_pk,
|
||||
);
|
||||
|
||||
assert!(verify(
|
||||
&signature,
|
||||
msg_to_sign,
|
||||
&ring,
|
||||
&commitment_ring,
|
||||
pseudo_output_commitment
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sign2_and_verify_at_every_index() {
|
||||
for signing_key_index in 0..11 {
|
||||
let mut rng = rand::rngs::StdRng::from_seed([0u8; 32]);
|
||||
|
||||
let msg_to_sign = b"hello world, monero is amazing!!";
|
||||
|
||||
let signing_key = Scalar::random(&mut rng);
|
||||
let signing_pk = signing_key * ED25519_BASEPOINT_POINT;
|
||||
let H_p_pk = hash_point_to_point(signing_pk);
|
||||
|
||||
let alpha = Scalar::random(&mut rng);
|
||||
|
||||
let amount_to_spend = 1000000u32;
|
||||
let fee = 10000u32;
|
||||
let output_amount = amount_to_spend - fee;
|
||||
|
||||
let mut ring = random_array(|| Scalar::random(&mut rng) * ED25519_BASEPOINT_POINT);
|
||||
ring[signing_key_index] = signing_pk;
|
||||
|
||||
let real_commitment_blinding = Scalar::random(&mut rng);
|
||||
let mut commitment_ring =
|
||||
random_array(|| Scalar::random(&mut rng) * ED25519_BASEPOINT_POINT);
|
||||
commitment_ring[signing_key_index] = real_commitment_blinding * ED25519_BASEPOINT_POINT
|
||||
+ Scalar::from(amount_to_spend) * H.point.decompress().unwrap();
|
||||
|
||||
let fee_key = Scalar::from(fee) * H.point.decompress().unwrap();
|
||||
|
||||
let out_pk_blinding = Scalar::random(&mut rng);
|
||||
let out_pk = out_pk_blinding * ED25519_BASEPOINT_POINT
|
||||
+ Scalar::from(output_amount) * H.point.decompress().unwrap();
|
||||
|
||||
let pseudo_output_commitment = fee_key + out_pk;
|
||||
|
||||
let responses = random_array(|| Scalar::random(&mut rng));
|
||||
|
||||
let signature = sign2(
|
||||
msg_to_sign,
|
||||
H_p_pk,
|
||||
alpha,
|
||||
&ring,
|
||||
&commitment_ring,
|
||||
responses,
|
||||
signing_key,
|
||||
signing_key_index,
|
||||
H_p_pk,
|
||||
alpha,
|
||||
&ring,
|
||||
&commitment_ring,
|
||||
random_array(|| Scalar::random(&mut rng)),
|
||||
real_commitment_blinding - out_pk_blinding,
|
||||
pseudo_output_commitment,
|
||||
alpha * ED25519_BASEPOINT_POINT,
|
||||
|
||||
@ -155,28 +155,15 @@ impl Alice0 {
|
||||
msg.pi_b
|
||||
.verify(ED25519_BASEPOINT_POINT, msg.T_b, self.H_p_pk, msg.I_hat_b)?;
|
||||
|
||||
let responses = [
|
||||
self.s_prime_a,
|
||||
self.fake_responses[0],
|
||||
self.fake_responses[1],
|
||||
self.fake_responses[2],
|
||||
self.fake_responses[3],
|
||||
self.fake_responses[4],
|
||||
self.fake_responses[5],
|
||||
self.fake_responses[6],
|
||||
self.fake_responses[7],
|
||||
self.fake_responses[8],
|
||||
self.fake_responses[9],
|
||||
];
|
||||
|
||||
let sig = clsag::sign(
|
||||
&self.msg,
|
||||
self.s_prime_a,
|
||||
0,
|
||||
self.H_p_pk,
|
||||
self.alpha_a,
|
||||
&self.ring,
|
||||
&self.commitment_ring,
|
||||
responses,
|
||||
0,
|
||||
self.fake_responses,
|
||||
z,
|
||||
self.pseudo_output_commitment,
|
||||
self.T_a + msg.T_b + self.R_a,
|
||||
@ -341,29 +328,16 @@ impl Bob1 {
|
||||
self.pi_a
|
||||
.verify(ED25519_BASEPOINT_POINT, T_a, self.H_p_pk, I_hat_a)?;
|
||||
|
||||
let responses = [
|
||||
self.s_b,
|
||||
fake_responses[0],
|
||||
fake_responses[1],
|
||||
fake_responses[2],
|
||||
fake_responses[3],
|
||||
fake_responses[4],
|
||||
fake_responses[5],
|
||||
fake_responses[6],
|
||||
fake_responses[7],
|
||||
fake_responses[8],
|
||||
fake_responses[9],
|
||||
];
|
||||
|
||||
let I = I_a + self.I_b;
|
||||
let sig = clsag::sign(
|
||||
&self.msg,
|
||||
self.s_b,
|
||||
0,
|
||||
self.H_p_pk,
|
||||
self.alpha_b,
|
||||
&self.ring,
|
||||
&self.commitment_ring,
|
||||
responses,
|
||||
0,
|
||||
fake_responses,
|
||||
z,
|
||||
self.pseudo_output_commitment,
|
||||
T_a + self.T_b + self.R_a,
|
||||
|
||||
@ -239,8 +239,7 @@ async fn monerod_integration_test() {
|
||||
|
||||
let alpha = Scalar::random(&mut rng);
|
||||
|
||||
let mut responses = random_array(|| Scalar::random(&mut rng));
|
||||
responses[signing_index] = actual_signing_key;
|
||||
let responses = random_array(|| Scalar::random(&mut rng));
|
||||
|
||||
let out_pk = out_pk
|
||||
.iter()
|
||||
@ -305,12 +304,13 @@ async fn monerod_integration_test() {
|
||||
|
||||
let sig = monero_adaptor::clsag::sign(
|
||||
&message,
|
||||
actual_signing_key,
|
||||
signing_index,
|
||||
H_p_pk,
|
||||
alpha,
|
||||
&ring,
|
||||
&commitment_ring,
|
||||
responses,
|
||||
signing_index,
|
||||
real_commitment_blinder - (out_blinding_0 + out_blinding_1), // * Scalar::from(MONERO_MUL_FACTOR), TODO DOESN'T VERIFY WITH THIS
|
||||
pseudo_out,
|
||||
alpha * ED25519_BASEPOINT_POINT,
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user