absolutebi/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2025-12-09 12:49:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Various corrections to multisig API

Browse Source
This commit is contained in:
Luke Parker
2022-04-29 15:28:04 -04:00
parent 3a4971f28b
commit 45559e14ee
10 changed files with 169 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
coins/monero/src/clsag/mod.rs
View File

@@ -71,13 +71,17 @@ impl Input {
#[cfg(feature = "multisig")]
pub fn context(&self) -> Vec<u8> {
// image is extraneous in practice as the image should be in the msg AND the addendum when TX
// signing. This just ensures CLSAG guarantees its integrity, even when others won't
let mut context = self.image.compress().to_bytes().to_vec();
// Ring index
context.extend(&u8::try_from(self.i).unwrap().to_le_bytes());
// Ring
for pair in &self.ring {
// Doesn't include mixins[i] as CLSAG doesn't care and won't be affected by it
// Doesn't include key offsets as CLSAG doesn't care and won't be affected by it
context.extend(&pair[0].compress().to_bytes());
context.extend(&pair[1].compress().to_bytes());
}
context.extend(&u8::try_from(self.i).unwrap().to_le_bytes());
// Doesn't include commitment as the above ring + index includes the commitment
context
}

67
coins/monero/src/clsag/multisig.rs
View File

@@ -35,51 +35,45 @@ struct ClsagSignInterim {
#[allow(non_snake_case)]
#[derive(Clone, Debug)]
pub struct Multisig {
seed: [u8; 32],
b: Vec<u8>,
AH: dfg::EdwardsPoint,
AH0: dfg::EdwardsPoint,
AH1: dfg::EdwardsPoint,
msg: [u8; 32],
input: Input,
msg: Option<[u8; 32]>,
interim: Option<ClsagSignInterim>
}
impl Multisig {
pub fn new<R: RngCore + CryptoRng + SeedableRng>(
rng: &mut R,
msg: [u8; 32],
pub fn new(
input: Input
) -> Result<Multisig, MultisigError> {
let mut seed = [0; 32];
rng.fill_bytes(&mut seed);
Ok(
Multisig {
seed,
b: vec![],
AH: dfg::EdwardsPoint::identity(),
AH0: dfg::EdwardsPoint::identity(),
AH1: dfg::EdwardsPoint::identity(),
msg,
input,
msg: None,
interim: None
}
)
}
pub fn set_msg(
&mut self,
msg: [u8; 32]
) {
self.msg = Some(msg);
}
}
impl Algorithm<Ed25519> for Multisig {
type Signature = (Clsag, EdwardsPoint);
fn context(&self) -> Vec<u8> {
let mut context = vec![];
context.extend(&self.seed);
context.extend(&self.msg);
context.extend(&self.input.context());
context
}
// We arguably don't have to commit to at all thanks to xG and yG being committed to, both of
// those being proven to have the same scalar as xH and yH, yet it doesn't hurt
fn addendum_commit_len() -> usize {
@@ -95,8 +89,7 @@ impl Algorithm<Ed25519> for Multisig {
let H = hash_to_point(&view.group_key().0);
let h0 = nonces[0].0 * H;
let h1 = nonces[1].0 * H;
// 32 + 32 + 64 + 64
let mut serialized = Vec::with_capacity(192);
let mut serialized = Vec::with_capacity(32 + 32 + 64 + 64);
serialized.extend(h0.compress().to_bytes());
serialized.extend(h1.compress().to_bytes());
serialized.extend(&DLEqProof::prove(rng, &nonces[0].0, &H, &h0).serialize());
@@ -109,7 +102,6 @@ impl Algorithm<Ed25519> for Multisig {
_: &ParamsView<Ed25519>,
l: usize,
commitments: &[dfg::EdwardsPoint; 2],
p: &dfg::Scalar,
serialized: &[u8]
) -> Result<(), FrostError> {
if serialized.len() != 192 {
@@ -121,6 +113,7 @@ impl Algorithm<Ed25519> for Multisig {
let h0 = <Ed25519 as Curve>::G_from_slice(&serialized[0 .. 32]).map_err(|_| FrostError::InvalidCommitment(l))?;
DLEqProof::deserialize(&serialized[64 .. 128]).ok_or(FrostError::InvalidCommitment(l))?.verify(
l,
&alt,
&commitments[0],
&h0
@@ -128,6 +121,7 @@ impl Algorithm<Ed25519> for Multisig {
let h1 = <Ed25519 as Curve>::G_from_slice(&serialized[32 .. 64]).map_err(|_| FrostError::InvalidCommitment(l))?;
DLEqProof::deserialize(&serialized[128 .. 192]).ok_or(FrostError::InvalidCommitment(l))?.verify(
l,
&alt,
&commitments[1],
&h1
@@ -135,11 +129,26 @@ impl Algorithm<Ed25519> for Multisig {
self.b.extend(&l.to_le_bytes());
self.b.extend(&serialized[0 .. 64]);
self.AH += h0 + (h1 * p);
self.AH0 += h0;
self.AH1 += h1;
Ok(())
}
fn context(&self) -> Vec<u8> {
let mut context = vec![];
context.extend(&self.msg.unwrap());
context.extend(&self.input.context());
context
}
fn process_binding(
&mut self,
p: &dfg::Scalar,
) {
self.AH0 += self.AH1 * p;
}
fn sign_share(
&mut self,
view: &ParamsView<Ed25519>,
@@ -149,7 +158,9 @@ impl Algorithm<Ed25519> for Multisig {
) -> dfg::Scalar {
// Use everyone's commitments to derive a random source all signers can agree upon
// Cannot be manipulated to effect and all signers must, and will, know this
// Uses a parent seed (part of context) as well just to enable further privacy options
// Uses the context as well to prevent passive observers of messages from being able to break
// privacy, as the context includes the index of the output in the ring, which can only be
// known if you have the view key and know which of the wallet's TXOs is being spent
let mut seed = b"CLSAG_randomness".to_vec();
seed.extend(&self.context());
seed.extend(&self.b);
@@ -159,11 +170,11 @@ impl Algorithm<Ed25519> for Multisig {
#[allow(non_snake_case)]
let (clsag, c, mu_C, z, mu_P, C_out) = sign_core(
&mut rng,
&self.msg,
&self.msg.unwrap(),
&self.input,
mask,
nonce_sum.0,
self.AH.0
self.AH0.0
);
self.interim = Some(ClsagSignInterim { c: c * mu_P, s: c * mu_C * z, clsag, C_out });
@@ -182,7 +193,7 @@ impl Algorithm<Ed25519> for Multisig {
let mut clsag = interim.clsag.clone();
clsag.s[self.input.i] = Key { key: (sum.0 - interim.s).to_bytes() };
if verify(&clsag, &self.msg, self.input.image, &self.input.ring, interim.C_out) {
if verify(&clsag, &self.msg.unwrap(), self.input.image, &self.input.ring, interim.C_out) {
return Some((clsag, interim.C_out));
}
return None;

7
coins/monero/src/frost.rs
View File

@@ -26,8 +26,8 @@ use crate::random_scalar;
pub enum MultisigError {
#[error("internal error ({0})")]
InternalError(String),
#[error("invalid discrete log equality proof")]
InvalidDLEqProof,
#[error("invalid discrete log equality proof {0}")]
InvalidDLEqProof(usize),
#[error("invalid key image {0}")]
InvalidKeyImage(usize)
}
@@ -145,6 +145,7 @@ impl DLEqProof {
pub fn verify(
&self,
l: usize,
H: &DPoint,
primary: &DPoint,
alt: &DPoint
@@ -165,7 +166,7 @@ impl DLEqProof {
// Take the opportunity to ensure a lack of torsion in key images/randomness commitments
if (!primary.is_torsion_free()) || (!alt.is_torsion_free()) || (c != expected_c) {
Err(MultisigError::InvalidDLEqProof)?;
Err(MultisigError::InvalidDLEqProof(l))?;
}
Ok(())

2
coins/monero/src/key_image/mod.rs
View File

@@ -9,7 +9,7 @@ use crate::hash_to_point;
#[cfg(feature = "multisig")]
mod multisig;
#[cfg(feature = "multisig")]
pub use crate::key_image::multisig::{Package, multisig};
pub use crate::key_image::multisig::{generate_share, verify_share};
pub fn generate(secret: &Scalar) -> EdwardsPoint {
secret * hash_to_point(&(secret * &ED25519_BASEPOINT_TABLE))

88
coins/monero/src/key_image/multisig.rs
View File

@@ -1,34 +1,17 @@
use rand_core::{RngCore, CryptoRng};
use curve25519_dalek::edwards::EdwardsPoint;
use dalek_ff_group::Scalar;
use frost::{MultisigKeys, sign::lagrange};
use curve25519_dalek::edwards::{EdwardsPoint, CompressedEdwardsY};
use frost::sign::ParamsView;
use crate::{hash_to_point, frost::{MultisigError, Ed25519, DLEqProof}};
#[derive(Clone)]
#[allow(non_snake_case)]
pub struct Package {
// Don't serialize
H: EdwardsPoint,
i: usize,
// Serialize
image: EdwardsPoint,
proof: DLEqProof
}
#[allow(non_snake_case)]
pub fn multisig<R: RngCore + CryptoRng>(
pub fn generate_share<R: RngCore + CryptoRng>(
rng: &mut R,
keys: &MultisigKeys<Ed25519>,
included: &[usize]
) -> Package {
let i = keys.params().i();
let secret = (keys.secret_share() * lagrange::<Scalar>(i, included)).0;
let H = hash_to_point(&keys.group_key().0);
let image = secret * H;
view: &ParamsView<Ed25519>
) -> (Vec<u8>, Vec<u8>) {
let H = hash_to_point(&view.group_key().0);
let image = view.secret_share().0 * H;
// Includes a proof. Since:
// sum(lagranged_secrets) = group_private
// group_private * G = output_key
@@ -37,39 +20,32 @@ pub fn multisig<R: RngCore + CryptoRng>(
// lagranged_secret * G is known. lagranged_secret * H is being sent
// Any discrete log equality proof confirms the same secret was used,
// forming a valid key_image share
Package { H, i, image, proof: DLEqProof::prove(rng, &secret, &H, &image) }
(
image.compress().to_bytes().to_vec(),
DLEqProof::prove(rng, &view.secret_share().0, &H, &image).serialize()
)
}
#[allow(non_snake_case)]
impl Package {
pub fn resolve(
self,
shares: Vec<Option<(EdwardsPoint, Package)>>
) -> Result<EdwardsPoint, MultisigError> {
let mut included = vec![self.i];
for i in 1 .. shares.len() {
if shares[i].is_some() {
included.push(i);
}
}
let mut image = self.image;
for i in 0 .. shares.len() {
if shares[i].is_none() {
continue;
}
let (other, shares) = shares[i].as_ref().unwrap();
let other = other * lagrange::<Scalar>(i, &included).0;
// Verify their proof
let share = shares.image;
shares.proof.verify(&self.H, &other, &share).map_err(|_| MultisigError::InvalidKeyImage(i))?;
// Add their share to the image
image += share;
}
Ok(image)
pub fn verify_share(
view: &ParamsView<Ed25519>,
l: usize,
share: &[u8]
) -> Result<(EdwardsPoint, Vec<u8>), MultisigError> {
if share.len() < 96 {
Err(MultisigError::InvalidDLEqProof(l))?;
}
let image = CompressedEdwardsY(
share[0 .. 32].try_into().unwrap()
).decompress().ok_or(MultisigError::InvalidKeyImage(l))?;
let proof = DLEqProof::deserialize(
&share[(share.len() - 64) .. share.len()]
).ok_or(MultisigError::InvalidDLEqProof(l))?;
proof.verify(
l,
&hash_to_point(&view.group_key().0),
&view.verification_share(l),
&image
).map_err(|_| MultisigError::InvalidKeyImage(l))?;
Ok((image, share[32 .. (share.len() - 64)].to_vec()))
}