|
|
@ -258,218 +258,6 @@ namespace crypto { |
|
|
|
ec_point Y; |
|
|
|
ec_point Y; |
|
|
|
}; |
|
|
|
}; |
|
|
|
|
|
|
|
|
|
|
|
void crypto_ops::generate_signature(const hash &prefix_hash, const public_key &pub, const secret_key &sec, signature &sig) { |
|
|
|
|
|
|
|
ge_p3 tmp3; |
|
|
|
|
|
|
|
ec_scalar k; |
|
|
|
|
|
|
|
s_comm buf; |
|
|
|
|
|
|
|
#if !defined(NDEBUG) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
ge_p3 t; |
|
|
|
|
|
|
|
public_key t2; |
|
|
|
|
|
|
|
assert(sc_check(&sec) == 0); |
|
|
|
|
|
|
|
ge_scalarmult_base(&t, &sec); |
|
|
|
|
|
|
|
ge_p3_tobytes(&t2, &t); |
|
|
|
|
|
|
|
assert(pub == t2); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
#endif |
|
|
|
|
|
|
|
buf.h = prefix_hash; |
|
|
|
|
|
|
|
buf.key = pub; |
|
|
|
|
|
|
|
try_again: |
|
|
|
|
|
|
|
random_scalar(k); |
|
|
|
|
|
|
|
if (((const uint32_t*)(&k))[7] == 0) // we don't want tiny numbers here
|
|
|
|
|
|
|
|
goto try_again; |
|
|
|
|
|
|
|
ge_scalarmult_base(&tmp3, &k); |
|
|
|
|
|
|
|
ge_p3_tobytes(&buf.comm, &tmp3); |
|
|
|
|
|
|
|
hash_to_scalar(&buf, sizeof(s_comm), sig.c); |
|
|
|
|
|
|
|
if (!sc_isnonzero((const unsigned char*)sig.c.data)) |
|
|
|
|
|
|
|
goto try_again; |
|
|
|
|
|
|
|
sc_mulsub(&sig.r, &sig.c, &unwrap(sec), &k); |
|
|
|
|
|
|
|
if (!sc_isnonzero((const unsigned char*)sig.r.data)) |
|
|
|
|
|
|
|
goto try_again; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
bool crypto_ops::check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) { |
|
|
|
|
|
|
|
ge_p2 tmp2; |
|
|
|
|
|
|
|
ge_p3 tmp3; |
|
|
|
|
|
|
|
ec_scalar c; |
|
|
|
|
|
|
|
s_comm buf; |
|
|
|
|
|
|
|
assert(check_key(pub)); |
|
|
|
|
|
|
|
buf.h = prefix_hash; |
|
|
|
|
|
|
|
buf.key = pub; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&tmp3, &pub) != 0) { |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0 || !sc_isnonzero(&sig.c)) { |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
ge_double_scalarmult_base_vartime(&tmp2, &sig.c, &tmp3, &sig.r); |
|
|
|
|
|
|
|
ge_tobytes(&buf.comm, &tmp2); |
|
|
|
|
|
|
|
static const ec_point infinity = {{ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}; |
|
|
|
|
|
|
|
if (memcmp(&buf.comm, &infinity, 32) == 0) |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
hash_to_scalar(&buf, sizeof(s_comm), c); |
|
|
|
|
|
|
|
sc_sub(&c, &c, &sig.c); |
|
|
|
|
|
|
|
return sc_isnonzero(&c) == 0; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void crypto_ops::generate_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const boost::optional<public_key> &B, const public_key &D, const secret_key &r, signature &sig) { |
|
|
|
|
|
|
|
// sanity check
|
|
|
|
|
|
|
|
ge_p3 R_p3; |
|
|
|
|
|
|
|
ge_p3 A_p3; |
|
|
|
|
|
|
|
ge_p3 B_p3; |
|
|
|
|
|
|
|
ge_p3 D_p3; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&R_p3, &R) != 0) throw std::runtime_error("tx pubkey is invalid"); |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&A_p3, &A) != 0) throw std::runtime_error("recipient view pubkey is invalid"); |
|
|
|
|
|
|
|
if (B && ge_frombytes_vartime(&B_p3, &*B) != 0) throw std::runtime_error("recipient spend pubkey is invalid"); |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&D_p3, &D) != 0) throw std::runtime_error("key derivation is invalid"); |
|
|
|
|
|
|
|
#if !defined(NDEBUG) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
assert(sc_check(&r) == 0); |
|
|
|
|
|
|
|
// check R == r*G or R == r*B
|
|
|
|
|
|
|
|
public_key dbg_R; |
|
|
|
|
|
|
|
if (B) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
ge_p2 dbg_R_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&dbg_R_p2, &r, &B_p3); |
|
|
|
|
|
|
|
ge_tobytes(&dbg_R, &dbg_R_p2); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
else |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
ge_p3 dbg_R_p3; |
|
|
|
|
|
|
|
ge_scalarmult_base(&dbg_R_p3, &r); |
|
|
|
|
|
|
|
ge_p3_tobytes(&dbg_R, &dbg_R_p3); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
assert(R == dbg_R); |
|
|
|
|
|
|
|
// check D == r*A
|
|
|
|
|
|
|
|
ge_p2 dbg_D_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&dbg_D_p2, &r, &A_p3); |
|
|
|
|
|
|
|
public_key dbg_D; |
|
|
|
|
|
|
|
ge_tobytes(&dbg_D, &dbg_D_p2); |
|
|
|
|
|
|
|
assert(D == dbg_D); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
#endif |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// pick random k
|
|
|
|
|
|
|
|
ec_scalar k; |
|
|
|
|
|
|
|
random_scalar(k); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
s_comm_2 buf; |
|
|
|
|
|
|
|
buf.msg = prefix_hash; |
|
|
|
|
|
|
|
buf.D = D; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (B) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
// compute X = k*B
|
|
|
|
|
|
|
|
ge_p2 X_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&X_p2, &k, &B_p3); |
|
|
|
|
|
|
|
ge_tobytes(&buf.X, &X_p2); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
else |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
// compute X = k*G
|
|
|
|
|
|
|
|
ge_p3 X_p3; |
|
|
|
|
|
|
|
ge_scalarmult_base(&X_p3, &k); |
|
|
|
|
|
|
|
ge_p3_tobytes(&buf.X, &X_p3); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute Y = k*A
|
|
|
|
|
|
|
|
ge_p2 Y_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&Y_p2, &k, &A_p3); |
|
|
|
|
|
|
|
ge_tobytes(&buf.Y, &Y_p2); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// sig.c = Hs(Msg || D || X || Y)
|
|
|
|
|
|
|
|
hash_to_scalar(&buf, sizeof(buf), sig.c); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// sig.r = k - sig.c*r
|
|
|
|
|
|
|
|
sc_mulsub(&sig.r, &sig.c, &unwrap(r), &k); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
bool crypto_ops::check_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const boost::optional<public_key> &B, const public_key &D, const signature &sig) { |
|
|
|
|
|
|
|
// sanity check
|
|
|
|
|
|
|
|
ge_p3 R_p3; |
|
|
|
|
|
|
|
ge_p3 A_p3; |
|
|
|
|
|
|
|
ge_p3 B_p3; |
|
|
|
|
|
|
|
ge_p3 D_p3; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&R_p3, &R) != 0) return false; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&A_p3, &A) != 0) return false; |
|
|
|
|
|
|
|
if (B && ge_frombytes_vartime(&B_p3, &*B) != 0) return false; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&D_p3, &D) != 0) return false; |
|
|
|
|
|
|
|
if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0) return false; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute sig.c*R
|
|
|
|
|
|
|
|
ge_p3 cR_p3; |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
ge_p2 cR_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&cR_p2, &sig.c, &R_p3); |
|
|
|
|
|
|
|
public_key cR; |
|
|
|
|
|
|
|
ge_tobytes(&cR, &cR_p2); |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&cR_p3, &cR) != 0) return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ge_p1p1 X_p1p1; |
|
|
|
|
|
|
|
if (B) |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
// compute X = sig.c*R + sig.r*B
|
|
|
|
|
|
|
|
ge_p2 rB_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&rB_p2, &sig.r, &B_p3); |
|
|
|
|
|
|
|
public_key rB; |
|
|
|
|
|
|
|
ge_tobytes(&rB, &rB_p2); |
|
|
|
|
|
|
|
ge_p3 rB_p3; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&rB_p3, &rB) != 0) return false; |
|
|
|
|
|
|
|
ge_cached rB_cached; |
|
|
|
|
|
|
|
ge_p3_to_cached(&rB_cached, &rB_p3); |
|
|
|
|
|
|
|
ge_add(&X_p1p1, &cR_p3, &rB_cached); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
else |
|
|
|
|
|
|
|
{ |
|
|
|
|
|
|
|
// compute X = sig.c*R + sig.r*G
|
|
|
|
|
|
|
|
ge_p3 rG_p3; |
|
|
|
|
|
|
|
ge_scalarmult_base(&rG_p3, &sig.r); |
|
|
|
|
|
|
|
ge_cached rG_cached; |
|
|
|
|
|
|
|
ge_p3_to_cached(&rG_cached, &rG_p3); |
|
|
|
|
|
|
|
ge_add(&X_p1p1, &cR_p3, &rG_cached); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
ge_p2 X_p2; |
|
|
|
|
|
|
|
ge_p1p1_to_p2(&X_p2, &X_p1p1); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute sig.c*D
|
|
|
|
|
|
|
|
ge_p2 cD_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&cD_p2, &sig.c, &D_p3); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute sig.r*A
|
|
|
|
|
|
|
|
ge_p2 rA_p2; |
|
|
|
|
|
|
|
ge_scalarmult(&rA_p2, &sig.r, &A_p3); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute Y = sig.c*D + sig.r*A
|
|
|
|
|
|
|
|
public_key cD; |
|
|
|
|
|
|
|
public_key rA; |
|
|
|
|
|
|
|
ge_tobytes(&cD, &cD_p2); |
|
|
|
|
|
|
|
ge_tobytes(&rA, &rA_p2); |
|
|
|
|
|
|
|
ge_p3 cD_p3; |
|
|
|
|
|
|
|
ge_p3 rA_p3; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&cD_p3, &cD) != 0) return false; |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&rA_p3, &rA) != 0) return false; |
|
|
|
|
|
|
|
ge_cached rA_cached; |
|
|
|
|
|
|
|
ge_p3_to_cached(&rA_cached, &rA_p3); |
|
|
|
|
|
|
|
ge_p1p1 Y_p1p1; |
|
|
|
|
|
|
|
ge_add(&Y_p1p1, &cD_p3, &rA_cached); |
|
|
|
|
|
|
|
ge_p2 Y_p2; |
|
|
|
|
|
|
|
ge_p1p1_to_p2(&Y_p2, &Y_p1p1); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// compute c2 = Hs(Msg || D || X || Y)
|
|
|
|
|
|
|
|
s_comm_2 buf; |
|
|
|
|
|
|
|
buf.msg = prefix_hash; |
|
|
|
|
|
|
|
buf.D = D; |
|
|
|
|
|
|
|
ge_tobytes(&buf.X, &X_p2); |
|
|
|
|
|
|
|
ge_tobytes(&buf.Y, &Y_p2); |
|
|
|
|
|
|
|
ec_scalar c2; |
|
|
|
|
|
|
|
hash_to_scalar(&buf, sizeof(s_comm_2), c2); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// test if c2 == sig.c
|
|
|
|
|
|
|
|
sc_sub(&c2, &c2, &sig.c); |
|
|
|
|
|
|
|
return sc_isnonzero(&c2) == 0; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static void hash_to_ec(const public_key &key, ge_p3 &res) { |
|
|
|
static void hash_to_ec(const public_key &key, ge_p3 &res) { |
|
|
|
hash h; |
|
|
|
hash h; |
|
|
|
ge_p2 point; |
|
|
|
ge_p2 point; |
|
|
@ -567,45 +355,4 @@ POP_WARNINGS |
|
|
|
sc_mulsub(&sig[sec_index].r, &sig[sec_index].c, &unwrap(sec), &k); |
|
|
|
sc_mulsub(&sig[sec_index].r, &sig[sec_index].c, &unwrap(sec), &k); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
bool crypto_ops::check_ring_signature(const hash &prefix_hash, const key_image &image, |
|
|
|
|
|
|
|
const public_key *const *pubs, size_t pubs_count, |
|
|
|
|
|
|
|
const signature *sig) { |
|
|
|
|
|
|
|
size_t i; |
|
|
|
|
|
|
|
ge_p3 image_unp; |
|
|
|
|
|
|
|
ge_dsmp image_pre; |
|
|
|
|
|
|
|
ec_scalar sum, h; |
|
|
|
|
|
|
|
boost::shared_ptr<rs_comm> buf(reinterpret_cast<rs_comm *>(malloc(rs_comm_size(pubs_count))), free); |
|
|
|
|
|
|
|
if (!buf) |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
#if !defined(NDEBUG) |
|
|
|
|
|
|
|
for (i = 0; i < pubs_count; i++) { |
|
|
|
|
|
|
|
assert(check_key(*pubs[i])); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
#endif |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&image_unp, &image) != 0) { |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
ge_dsm_precomp(image_pre, &image_unp); |
|
|
|
|
|
|
|
sc_0(&sum); |
|
|
|
|
|
|
|
buf->h = prefix_hash; |
|
|
|
|
|
|
|
for (i = 0; i < pubs_count; i++) { |
|
|
|
|
|
|
|
ge_p2 tmp2; |
|
|
|
|
|
|
|
ge_p3 tmp3; |
|
|
|
|
|
|
|
if (sc_check(&sig[i].c) != 0 || sc_check(&sig[i].r) != 0) { |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
if (ge_frombytes_vartime(&tmp3, &*pubs[i]) != 0) { |
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
ge_double_scalarmult_base_vartime(&tmp2, &sig[i].c, &tmp3, &sig[i].r); |
|
|
|
|
|
|
|
ge_tobytes(&buf->ab[i].a, &tmp2); |
|
|
|
|
|
|
|
hash_to_ec(*pubs[i], tmp3); |
|
|
|
|
|
|
|
ge_double_scalarmult_precomp_vartime(&tmp2, &sig[i].r, &tmp3, &sig[i].c, image_pre); |
|
|
|
|
|
|
|
ge_tobytes(&buf->ab[i].b, &tmp2); |
|
|
|
|
|
|
|
sc_add(&sum, &sum, &sig[i].c); |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
hash_to_scalar(buf.get(), rs_comm_size(pubs_count), h); |
|
|
|
|
|
|
|
sc_sub(&h, &h, &sum); |
|
|
|
|
|
|
|
return sc_isnonzero(&h) == 0; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|