Reorganize FROST's handling of curves

crypto/frost/src/curve/dalek.rs

@@ -0,0 +1,158 @@
+use core::convert::TryInto;
+
+use rand_core::{RngCore, CryptoRng};
+
+use sha2::{Digest, Sha512};
+
+use group::{ff::PrimeField, Group};
+
+use dalek_ff_group::Scalar;
+
+use crate::{curve::{CurveError, Curve}, algorithm::Hram};
+
+macro_rules! dalek_curve {
+  (
+    $Curve:      ident,
+    $Hram:       ident,
+    $Point:      ident,
+    $Compressed: ident,
+    $Table:      ident,
+
+    $POINT: ident,
+    $TABLE: ident,
+
+    $torsioned: expr,
+
+    $ID:      literal,
+    $CONTEXT: literal,
+    $chal:    literal,
+    $digest:  literal,
+  ) => {
+    use dalek_ff_group::{$Point, $Compressed, $Table, $POINT, $TABLE};
+
+    #[derive(Clone, Copy, PartialEq, Eq, Debug)]
+    pub struct $Curve;
+    impl Curve for $Curve {
+      type F = Scalar;
+      type G = $Point;
+      type T = &'static $Table;
+
+      const ID: &'static [u8] = $ID;
+
+      const GENERATOR: Self::G = $POINT;
+      const GENERATOR_TABLE: Self::T = &$TABLE;
+
+      const LITTLE_ENDIAN: bool = true;
+
+      fn random_nonce<R: RngCore + CryptoRng>(secret: Self::F, rng: &mut R) -> Self::F {
+        let mut seed = vec![0; 32];
+        rng.fill_bytes(&mut seed);
+        seed.extend(&secret.to_bytes());
+        Self::hash_to_F(b"nonce", &seed)
+      }
+
+      fn hash_msg(msg: &[u8]) -> Vec<u8> {
+        Sha512::new()
+          .chain_update($CONTEXT)
+          .chain_update($digest)
+          .chain_update(msg)
+          .finalize()
+          .to_vec()
+      }
+
+      fn hash_binding_factor(binding: &[u8]) -> Self::F {
+        Self::hash_to_F(b"rho", binding)
+      }
+
+      fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
+        Scalar::from_hash(Sha512::new().chain_update($CONTEXT).chain_update(dst).chain_update(msg))
+      }
+
+      fn F_len() -> usize {
+        32
+      }
+
+      fn G_len() -> usize {
+        32
+      }
+
+      fn F_from_slice(slice: &[u8]) -> Result<Self::F, CurveError> {
+        let scalar = Self::F::from_repr(
+          slice.try_into().map_err(|_| CurveError::InvalidLength(32, slice.len()))?
+        );
+        if !bool::from(scalar.is_some()) {
+          Err(CurveError::InvalidScalar)?;
+        }
+        Ok(scalar.unwrap())
+      }
+
+      fn G_from_slice(slice: &[u8]) -> Result<Self::G, CurveError> {
+        let bytes = slice.try_into().map_err(|_| CurveError::InvalidLength(32, slice.len()))?;
+        let point = $Compressed::new(bytes).decompress().ok_or(CurveError::InvalidPoint)?;
+
+        // Ban identity
+        if point.is_identity().into() {
+          Err(CurveError::InvalidPoint)?;
+        }
+        // Ban torsioned points to meet the prime order group requirement
+        if $torsioned(point) {
+          Err(CurveError::InvalidPoint)?;
+        }
+        // Ban points which weren't canonically encoded
+        if point.compress().to_bytes() != bytes {
+          Err(CurveError::InvalidPoint)?;
+        }
+        Ok(point)
+      }
+
+      fn F_to_bytes(f: &Self::F) -> Vec<u8> {
+        f.to_repr().to_vec()
+      }
+
+      fn G_to_bytes(g: &Self::G) -> Vec<u8> {
+        g.compress().to_bytes().to_vec()
+      }
+    }
+
+    #[derive(Copy, Clone)]
+    pub struct $Hram;
+    impl Hram<$Curve> for $Hram {
+      #[allow(non_snake_case)]
+      fn hram(R: &$Point, A: &$Point, m: &[u8]) -> Scalar {
+        $Curve::hash_to_F($chal, &[&R.compress().to_bytes(), &A.compress().to_bytes(), m].concat())
+      }
+    }
+  }
+}
+
+#[cfg(any(test, feature = "ristretto"))]
+dalek_curve!(
+  Ristretto,
+  IetfRistrettoHram,
+  RistrettoPoint,
+  CompressedRistretto,
+  RistrettoBasepointTable,
+  RISTRETTO_BASEPOINT_POINT,
+  RISTRETTO_BASEPOINT_TABLE,
+  |_| false,
+  b"ristretto",
+  b"FROST-RISTRETTO255-SHA512-v5",
+  b"chal",
+  b"digest",
+);
+
+#[cfg(feature = "ed25519")]
+dalek_curve!(
+  Ed25519,
+  IetfEd25519Hram,
+  EdwardsPoint,
+  CompressedEdwardsY,
+  EdwardsBasepointTable,
+  ED25519_BASEPOINT_POINT,
+  ED25519_BASEPOINT_TABLE,
+  |point: EdwardsPoint| !bool::from(point.is_torsion_free()),
+  b"edwards25519",
+  b"",
+  b"",
+  b"",
+);

crypto/frost/src/curve/kp256.rs

@@ -0,0 +1,152 @@
+use core::convert::TryInto;
+
+use rand_core::{RngCore, CryptoRng};
+
+use sha2::{digest::Update, Digest, Sha256};
+
+use group::{ff::{Field, PrimeField}, Group, GroupEncoding};
+
+use elliptic_curve::{bigint::{Encoding, U384}, hash2curve::{Expander, ExpandMsg, ExpandMsgXmd}};
+
+use crate::{curve::{CurveError, Curve}, algorithm::Hram};
+
+macro_rules! kp_curve {
+  (
+    $lib:   ident,
+    $Curve: ident,
+    $Hram:  ident,
+
+    $ID:      literal,
+    $CONTEXT: literal
+  ) => {
+    #[derive(Clone, Copy, PartialEq, Eq, Debug)]
+    pub struct $Curve;
+    impl Curve for $Curve {
+      type F = $lib::Scalar;
+      type G = $lib::ProjectivePoint;
+      type T = $lib::ProjectivePoint;
+
+      const ID: &'static [u8] = $ID;
+
+      const GENERATOR: Self::G = $lib::ProjectivePoint::GENERATOR;
+      const GENERATOR_TABLE: Self::G = $lib::ProjectivePoint::GENERATOR;
+
+      const LITTLE_ENDIAN: bool = false;
+
+      fn random_nonce<R: RngCore + CryptoRng>(secret: Self::F, rng: &mut R) -> Self::F {
+        let mut seed = vec![0; 32];
+        rng.fill_bytes(&mut seed);
+        seed.extend(secret.to_bytes());
+        Self::hash_to_F(&[$CONTEXT as &[u8], b"nonce"].concat(), &seed)
+      }
+
+      fn hash_msg(msg: &[u8]) -> Vec<u8> {
+        (&Sha256::new()
+          .chain($CONTEXT)
+          .chain(b"digest")
+          .chain(msg)
+          .finalize()
+        ).to_vec()
+      }
+
+      fn hash_binding_factor(binding: &[u8]) -> Self::F {
+        Self::hash_to_F(&[$CONTEXT as &[u8], b"rho"].concat(), binding)
+      }
+
+      fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
+        let mut dst = dst;
+        let oversize = Sha256::digest([b"H2C-OVERSIZE-DST-", dst].concat());
+        if dst.len() > 255 {
+          dst = &oversize;
+        }
+
+        // While one of these two libraries does support directly hashing to the Scalar field, the
+        // other doesn't. While that's probably an oversight, this is a universally working method
+        let mut modulus = vec![0; 16];
+        modulus.extend((Self::F::zero() - Self::F::one()).to_bytes());
+        let modulus = U384::from_be_slice(&modulus).wrapping_add(&U384::ONE);
+        Self::F_from_slice(
+          &U384::from_be_slice(&{
+            let mut bytes = [0; 48];
+            ExpandMsgXmd::<Sha256>::expand_message(
+              &[msg],
+              dst,
+              48
+            ).unwrap().fill_bytes(&mut bytes);
+            bytes
+          }).reduce(&modulus).unwrap().to_be_bytes()[16 ..]
+        ).unwrap()
+      }
+
+      fn F_len() -> usize {
+        32
+      }
+
+      fn G_len() -> usize {
+        33
+      }
+
+      fn F_from_slice(slice: &[u8]) -> Result<Self::F, CurveError> {
+        let bytes: [u8; 32] = slice.try_into()
+          .map_err(|_| CurveError::InvalidLength(32, slice.len()))?;
+
+        let scalar = Self::F::from_repr(bytes.into());
+        if scalar.is_none().into() {
+          Err(CurveError::InvalidScalar)?;
+        }
+
+        Ok(scalar.unwrap())
+      }
+
+      fn G_from_slice(slice: &[u8]) -> Result<Self::G, CurveError> {
+        let bytes: [u8; 33] = slice.try_into()
+          .map_err(|_| CurveError::InvalidLength(33, slice.len()))?;
+
+        let point = Self::G::from_bytes(&bytes.into());
+        if point.is_none().into() || point.unwrap().is_identity().into() {
+          Err(CurveError::InvalidPoint)?;
+        }
+
+        Ok(point.unwrap())
+      }
+
+      fn F_to_bytes(f: &Self::F) -> Vec<u8> {
+        f.to_bytes().to_vec()
+      }
+
+      fn G_to_bytes(g: &Self::G) -> Vec<u8> {
+        g.to_bytes().to_vec()
+      }
+    }
+
+    #[derive(Clone)]
+    pub struct $Hram;
+    impl Hram<$Curve> for $Hram {
+      #[allow(non_snake_case)]
+      fn hram(R: &$lib::ProjectivePoint, A: &$lib::ProjectivePoint, m: &[u8]) -> $lib::Scalar {
+        $Curve::hash_to_F(
+          &[$CONTEXT as &[u8], b"chal"].concat(),
+          &[&$Curve::G_to_bytes(R), &$Curve::G_to_bytes(A), m].concat()
+        )
+      }
+    }
+  }
+}
+
+#[cfg(feature = "p256")]
+kp_curve!(
+  p256,
+  P256,
+  IetfP256Hram,
+  b"P-256",
+  b"FROST-P256-SHA256-v5"
+);
+
+#[cfg(feature = "secp256k1")]
+kp_curve!(
+  k256,
+  Secp256k1,
+  NonIetfSecp256k1Hram,
+  b"secp256k1",
+  b"FROST-secp256k1-SHA256-v5"
+);

crypto/frost/src/curve/mod.rs

@@ -0,0 +1,121 @@
+use core::{ops::Mul, fmt::Debug};
+
+use thiserror::Error;
+
+use rand_core::{RngCore, CryptoRng};
+
+use group::{ff::PrimeField, Group, GroupOps};
+
+#[cfg(any(test, feature = "dalek"))]
+mod dalek;
+#[cfg(any(test, feature = "ristretto"))]
+pub use dalek::{Ristretto, IetfRistrettoHram};
+#[cfg(feature = "ed25519")]
+pub use dalek::{Ed25519, IetfEd25519Hram};
+
+#[cfg(feature = "kp256")]
+mod kp256;
+#[cfg(feature = "secp256k1")]
+pub use kp256::{Secp256k1, NonIetfSecp256k1Hram};
+#[cfg(feature = "p256")]
+pub use kp256::{P256, IetfP256Hram};
+
+/// Set of errors for curve-related operations, namely encoding and decoding
+#[derive(Clone, Error, Debug)]
+pub enum CurveError {
+  #[error("invalid length for data (expected {0}, got {0})")]
+  InvalidLength(usize, usize),
+  #[error("invalid scalar")]
+  InvalidScalar,
+  #[error("invalid point")]
+  InvalidPoint,
+}
+
+/// Unified trait to manage a field/group
+// This should be moved into its own crate if the need for generic cryptography over ff/group
+// continues, which is the exact reason ff/group exists (to provide a generic interface)
+// elliptic-curve exists, yet it doesn't really serve the same role, nor does it use &[u8]/Vec<u8>
+// It uses GenericArray which will hopefully be deprecated as Rust evolves and doesn't offer enough
+// advantages in the modern day to be worth the hassle -- Kayaba
+pub trait Curve: Clone + Copy + PartialEq + Eq + Debug {
+  /// Scalar field element type
+  // This is available via G::Scalar yet `C::G::Scalar` is ambiguous, forcing horrific accesses
+  type F: PrimeField;
+  /// Group element type
+  type G: Group<Scalar = Self::F> + GroupOps;
+  /// Precomputed table type
+  type T: Mul<Self::F, Output = Self::G>;
+
+  /// ID for this curve
+  const ID: &'static [u8];
+
+  /// Generator for the group
+  // While group does provide this in its API, privacy coins will want to use a custom basepoint
+  const GENERATOR: Self::G;
+
+  /// Table for the generator for the group
+  /// If there isn't a precomputed table available, the generator itself should be used
+  const GENERATOR_TABLE: Self::T;
+
+  /// If little endian is used for the scalar field's Repr
+  const LITTLE_ENDIAN: bool;
+
+  /// Securely generate a random nonce. H4 from the IETF draft
+  fn random_nonce<R: RngCore + CryptoRng>(secret: Self::F, rng: &mut R) -> Self::F;
+
+  /// Hash the message for the binding factor. H3 from the IETF draft
+  // This doesn't actually need to be part of Curve as it does nothing with the curve
+  // This also solely relates to FROST and with a proper Algorithm/HRAM, all projects using
+  // aggregatable signatures over this curve will work without issue
+  // It is kept here as Curve + H{1, 2, 3} is effectively a ciphersuite according to the IETF draft
+  // and moving it to Schnorr would force all of them into being ciphersuite-specific
+  // H2 is left to the Schnorr Algorithm as H2 is the H used in HRAM, which Schnorr further
+  // modularizes
+  fn hash_msg(msg: &[u8]) -> Vec<u8>;
+
+  /// Hash the commitments and message to calculate the binding factor. H1 from the IETF draft
+  fn hash_binding_factor(binding: &[u8]) -> Self::F;
+
+  // The following methods would optimally be F:: and G:: yet developers can't control F/G
+  // They can control a trait they pass into this library
+
+  /// Field element from hash. Used during key gen and by other crates under Serai as a general
+  /// utility
+  // Not parameterized by Digest as it's fine for it to use its own hash function as relevant to
+  // hash_msg and hash_binding_factor
+  #[allow(non_snake_case)]
+  fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F;
+
+  /// Constant size of a serialized scalar field element
+  // The alternative way to grab this would be either serializing a junk element and getting its
+  // length or doing a naive division of its BITS property by 8 and assuming a lack of padding
+  #[allow(non_snake_case)]
+  fn F_len() -> usize;
+
+  /// Constant size of a serialized group element
+  // We could grab the serialization as described above yet a naive developer may use a
+  // non-constant size encoding, proving yet another reason to force this to be a provided constant
+  // A naive developer could still provide a constant for a variable length encoding, yet at least
+  // that is on them
+  #[allow(non_snake_case)]
+  fn G_len() -> usize;
+
+  /// Field element from slice. Preferred to be canonical yet does not have to be
+  // Required due to the lack of standardized encoding functions provided by ff/group
+  // While they do technically exist, their usage of Self::Repr breaks all potential library usage
+  // without helper functions like this
+  #[allow(non_snake_case)]
+  fn F_from_slice(slice: &[u8]) -> Result<Self::F, CurveError>;
+
+  /// Group element from slice. Must require canonicity or risks differing binding factors
+  #[allow(non_snake_case)]
+  fn G_from_slice(slice: &[u8]) -> Result<Self::G, CurveError>;
+
+  /// Obtain a vector of the byte encoding of F
+  #[allow(non_snake_case)]
+  fn F_to_bytes(f: &Self::F) -> Vec<u8>;
+
+  /// Obtain a vector of the byte encoding of G
+  #[allow(non_snake_case)]
+  fn G_to_bytes(g: &Self::G) -> Vec<u8>;
+}