Support no-std builds of bitcoin-serai

Arguably not meaningful, as it adds the scanner yet not the RPC, and no signing
code since modular-frost doesn't support no-std yet. It's a step in the right
direction though.

coins/bitcoin/src/crypto.rs

@@ -1,26 +1,6 @@
-use core::fmt::Debug;
-use std::io;
-
-use lazy_static::lazy_static;
-
-use zeroize::Zeroizing;
-use rand_core::{RngCore, CryptoRng};
-
-use sha2::{Digest, Sha256};
-use transcript::Transcript;
-
-use secp256k1::schnorr::Signature;
 use k256::{
-  elliptic_curve::{
-    ops::Reduce,
-    sec1::{Tag, ToEncodedPoint},
-  },
-  U256, Scalar, ProjectivePoint,
-};
-use frost::{
-  curve::{Ciphersuite, Secp256k1},
-  Participant, ThresholdKeys, ThresholdView, FrostError,
-  algorithm::{Hram as HramTrait, Algorithm, Schnorr as FrostSchnorr},
+  elliptic_curve::sec1::{Tag, ToEncodedPoint},
+  ProjectivePoint,
 };
 
 use bitcoin::key::XOnlyPublicKey;
@@ -40,6 +20,7 @@ pub fn x_only(key: &ProjectivePoint) -> XOnlyPublicKey {
 /// Make a point even by adding the generator until it is even.
 ///
 /// Returns the even point and the amount of additions required.
+#[cfg(any(feature = "std", feature = "hazmat"))]
 pub fn make_even(mut key: ProjectivePoint) -> (ProjectivePoint, u64) {
   let mut c = 0;
   while key.to_encoded_point(true).tag() == Tag::CompressedOddY {
@@ -49,116 +30,143 @@ pub fn make_even(mut key: ProjectivePoint) -> (ProjectivePoint, u64) {
   (key, c)
 }
 
-/// A BIP-340 compatible HRAm for use with the modular-frost Schnorr Algorithm.
-///
-/// If passed an odd nonce, it will have the generator added until it is even.
-///
-/// If the key is odd, this will panic.
-#[derive(Clone, Copy, Debug)]
-pub struct Hram;
+#[cfg(feature = "std")]
+mod frost_crypto {
+  use core::fmt::Debug;
+  use std_shims::{sync::OnceLock, vec::Vec, io};
 
-lazy_static! {
-  static ref TAG_HASH: [u8; 32] = Sha256::digest(b"BIP0340/challenge").into();
-}
+  use zeroize::Zeroizing;
+  use rand_core::{RngCore, CryptoRng};
 
-#[allow(non_snake_case)]
-impl HramTrait<Secp256k1> for Hram {
-  fn hram(R: &ProjectivePoint, A: &ProjectivePoint, m: &[u8]) -> Scalar {
-    // Convert the nonce to be even
-    let (R, _) = make_even(*R);
+  use sha2::{Digest, Sha256};
+  use transcript::Transcript;
 
-    let mut data = Sha256::new();
-    data.update(*TAG_HASH);
-    data.update(*TAG_HASH);
-    data.update(x(&R));
-    data.update(x(A));
-    data.update(m);
+  use secp256k1::schnorr::Signature;
+  use k256::{elliptic_curve::ops::Reduce, U256, Scalar};
 
-    Scalar::reduce(U256::from_be_slice(&data.finalize()))
-  }
-}
-
-/// BIP-340 Schnorr signature algorithm.
-///
-/// This must be used with a ThresholdKeys whose group key is even. If it is odd, this will panic.
-#[derive(Clone)]
-pub struct Schnorr<T: Sync + Clone + Debug + Transcript>(FrostSchnorr<Secp256k1, T, Hram>);
-impl<T: Sync + Clone + Debug + Transcript> Schnorr<T> {
-  /// Construct a Schnorr algorithm continuing the specified transcript.
-  pub fn new(transcript: T) -> Schnorr<T> {
-    Schnorr(FrostSchnorr::new(transcript))
-  }
-}
-
-impl<T: Sync + Clone + Debug + Transcript> Algorithm<Secp256k1> for Schnorr<T> {
-  type Transcript = T;
-  type Addendum = ();
-  type Signature = Signature;
-
-  fn transcript(&mut self) -> &mut Self::Transcript {
-    self.0.transcript()
-  }
-
-  fn nonces(&self) -> Vec<Vec<ProjectivePoint>> {
-    self.0.nonces()
-  }
-
-  fn preprocess_addendum<R: RngCore + CryptoRng>(
-    &mut self,
-    rng: &mut R,
-    keys: &ThresholdKeys<Secp256k1>,
-  ) {
-    self.0.preprocess_addendum(rng, keys)
-  }
-
-  fn read_addendum<R: io::Read>(&self, reader: &mut R) -> io::Result<Self::Addendum> {
-    self.0.read_addendum(reader)
-  }
-
-  fn process_addendum(
-    &mut self,
-    view: &ThresholdView<Secp256k1>,
-    i: Participant,
-    addendum: (),
-  ) -> Result<(), FrostError> {
-    self.0.process_addendum(view, i, addendum)
-  }
-
-  fn sign_share(
-    &mut self,
-    params: &ThresholdView<Secp256k1>,
-    nonce_sums: &[Vec<<Secp256k1 as Ciphersuite>::G>],
-    nonces: Vec<Zeroizing<<Secp256k1 as Ciphersuite>::F>>,
-    msg: &[u8],
-  ) -> <Secp256k1 as Ciphersuite>::F {
-    self.0.sign_share(params, nonce_sums, nonces, msg)
-  }
-
-  #[must_use]
-  fn verify(
-    &self,
-    group_key: ProjectivePoint,
-    nonces: &[Vec<ProjectivePoint>],
-    sum: Scalar,
-  ) -> Option<Self::Signature> {
-    self.0.verify(group_key, nonces, sum).map(|mut sig| {
-      // Make the R of the final signature even
-      let offset;
-      (sig.R, offset) = make_even(sig.R);
-      // s = r + cx. Since we added to the r, add to s
-      sig.s += Scalar::from(offset);
-      // Convert to a secp256k1 signature
-      Signature::from_slice(&sig.serialize()[1 ..])
-        .expect("couldn't convert SchnorrSignature to Signature")
-    })
-  }
-
-  fn verify_share(
-    &self,
-    verification_share: ProjectivePoint,
-    nonces: &[Vec<ProjectivePoint>],
-    share: Scalar,
-  ) -> Result<Vec<(Scalar, ProjectivePoint)>, ()> {
-    self.0.verify_share(verification_share, nonces, share)
+  use frost::{
+    curve::{Ciphersuite, Secp256k1},
+    Participant, ThresholdKeys, ThresholdView, FrostError,
+    algorithm::{Hram as HramTrait, Algorithm, Schnorr as FrostSchnorr},
+  };
+
+  use super::*;
+
+  /// A BIP-340 compatible HRAm for use with the modular-frost Schnorr Algorithm.
+  ///
+  /// If passed an odd nonce, it will have the generator added until it is even.
+  ///
+  /// If the key is odd, this will panic.
+  #[derive(Clone, Copy, Debug)]
+  pub struct Hram;
+
+  static TAG_HASH_CELL: OnceLock<[u8; 32]> = OnceLock::new();
+  #[allow(non_snake_case)]
+  fn TAG_HASH() -> [u8; 32] {
+    *TAG_HASH_CELL.get_or_init(|| Sha256::digest(b"BIP0340/challenge").into())
+  }
+
+  #[allow(non_snake_case)]
+  impl HramTrait<Secp256k1> for Hram {
+    fn hram(R: &ProjectivePoint, A: &ProjectivePoint, m: &[u8]) -> Scalar {
+      // Convert the nonce to be even
+      let (R, _) = make_even(*R);
+
+      let mut data = Sha256::new();
+      data.update(TAG_HASH());
+      data.update(TAG_HASH());
+      data.update(x(&R));
+      data.update(x(A));
+      data.update(m);
+
+      Scalar::reduce(U256::from_be_slice(&data.finalize()))
+    }
+  }
+
+  /// BIP-340 Schnorr signature algorithm.
+  ///
+  /// This must be used with a ThresholdKeys whose group key is even. If it is odd, this will panic.
+  #[derive(Clone)]
+  pub struct Schnorr<T: Sync + Clone + Debug + Transcript>(FrostSchnorr<Secp256k1, T, Hram>);
+  impl<T: Sync + Clone + Debug + Transcript> Schnorr<T> {
+    /// Construct a Schnorr algorithm continuing the specified transcript.
+    pub fn new(transcript: T) -> Schnorr<T> {
+      Schnorr(FrostSchnorr::new(transcript))
+    }
+  }
+
+  impl<T: Sync + Clone + Debug + Transcript> Algorithm<Secp256k1> for Schnorr<T> {
+    type Transcript = T;
+    type Addendum = ();
+    type Signature = Signature;
+
+    fn transcript(&mut self) -> &mut Self::Transcript {
+      self.0.transcript()
+    }
+
+    fn nonces(&self) -> Vec<Vec<ProjectivePoint>> {
+      self.0.nonces()
+    }
+
+    fn preprocess_addendum<R: RngCore + CryptoRng>(
+      &mut self,
+      rng: &mut R,
+      keys: &ThresholdKeys<Secp256k1>,
+    ) {
+      self.0.preprocess_addendum(rng, keys)
+    }
+
+    fn read_addendum<R: io::Read>(&self, reader: &mut R) -> io::Result<Self::Addendum> {
+      self.0.read_addendum(reader)
+    }
+
+    fn process_addendum(
+      &mut self,
+      view: &ThresholdView<Secp256k1>,
+      i: Participant,
+      addendum: (),
+    ) -> Result<(), FrostError> {
+      self.0.process_addendum(view, i, addendum)
+    }
+
+    fn sign_share(
+      &mut self,
+      params: &ThresholdView<Secp256k1>,
+      nonce_sums: &[Vec<<Secp256k1 as Ciphersuite>::G>],
+      nonces: Vec<Zeroizing<<Secp256k1 as Ciphersuite>::F>>,
+      msg: &[u8],
+    ) -> <Secp256k1 as Ciphersuite>::F {
+      self.0.sign_share(params, nonce_sums, nonces, msg)
+    }
+
+    #[must_use]
+    fn verify(
+      &self,
+      group_key: ProjectivePoint,
+      nonces: &[Vec<ProjectivePoint>],
+      sum: Scalar,
+    ) -> Option<Self::Signature> {
+      self.0.verify(group_key, nonces, sum).map(|mut sig| {
+        // Make the R of the final signature even
+        let offset;
+        (sig.R, offset) = make_even(sig.R);
+        // s = r + cx. Since we added to the r, add to s
+        sig.s += Scalar::from(offset);
+        // Convert to a secp256k1 signature
+        Signature::from_slice(&sig.serialize()[1 ..])
+          .expect("couldn't convert SchnorrSignature to Signature")
+      })
+    }
+
+    fn verify_share(
+      &self,
+      verification_share: ProjectivePoint,
+      nonces: &[Vec<ProjectivePoint>],
+      share: Scalar,
+    ) -> Result<Vec<(Scalar, ProjectivePoint)>, ()> {
+      self.0.verify_share(verification_share, nonces, share)
+    }
   }
 }
+#[cfg(feature = "std")]
+pub use frost_crypto::*;

coins/bitcoin/src/lib.rs

@@ -1,5 +1,9 @@
 #![cfg_attr(docsrs, feature(doc_auto_cfg))]
 #![doc = include_str!("../README.md")]
+#![cfg_attr(not(feature = "std"), no_std)]
+
+#[cfg(not(feature = "std"))]
+extern crate alloc;
 
 /// The bitcoin Rust library.
 pub use bitcoin;
@@ -13,6 +17,7 @@ pub(crate) mod crypto;
 /// Wallet functionality to create transactions.
 pub mod wallet;
 /// A minimal asynchronous Bitcoin RPC client.
+#[cfg(feature = "std")]
 pub mod rpc;
 
 #[cfg(test)]

coins/bitcoin/src/tests/crypto.rs

@@ -2,7 +2,7 @@ use rand_core::OsRng;
 
 use sha2::{Digest, Sha256};
 
-use secp256k1::{SECP256K1, Message};
+use secp256k1::{Secp256k1 as BContext, Message};
 
 use k256::Scalar;
 use transcript::{Transcript, RecommendedTranscript};
@@ -37,7 +37,7 @@ fn test_algorithm() {
     &Sha256::digest(MESSAGE),
   );
 
-  SECP256K1
+  BContext::new()
     .verify_schnorr(
       &sig,
       &Message::from(Hash::hash(MESSAGE)),

coins/bitcoin/src/wallet/mod.rs

@@ -1,33 +1,45 @@
-use std::{
-  io::{self, Read, Write},
+use std_shims::{
+  vec::Vec,
   collections::HashMap,
+  io::{self, Write},
 };
+#[cfg(feature = "std")]
+use std_shims::io::Read;
 
 use k256::{
   elliptic_curve::sec1::{Tag, ToEncodedPoint},
   Scalar, ProjectivePoint,
 };
+
+#[cfg(feature = "std")]
 use frost::{
   curve::{Ciphersuite, Secp256k1},
   ThresholdKeys,
 };
 
 use bitcoin::{
-  consensus::encode::{Decodable, serialize},
+  consensus::encode::serialize,
   key::TweakedPublicKey,
   address::Payload,
   OutPoint, ScriptBuf, TxOut, Transaction, Block,
 };
+#[cfg(feature = "std")]
+use bitcoin::consensus::encode::Decodable;
 
-use crate::crypto::{x_only, make_even};
+use crate::crypto::x_only;
+#[cfg(feature = "std")]
+use crate::crypto::make_even;
 
+#[cfg(feature = "std")]
 mod send;
+#[cfg(feature = "std")]
 pub use send::*;
 
 /// Tweak keys to ensure they're usable with Bitcoin.
 ///
 /// Taproot keys, which these keys are used as, must be even. This offsets the keys until they're
 /// even.
+#[cfg(feature = "std")]
 pub fn tweak_keys(keys: &ThresholdKeys<Secp256k1>) -> ThresholdKeys<Secp256k1> {
   let (_, offset) = make_even(keys.group_key());
   keys.offset(Scalar::from(offset))
@@ -72,6 +84,7 @@ impl ReceivedOutput {
   }
 
   /// Read a ReceivedOutput from a generic satisfying Read.
+  #[cfg(feature = "std")]
   pub fn read<R: Read>(r: &mut R) -> io::Result<ReceivedOutput> {
     Ok(ReceivedOutput {
       offset: Secp256k1::read_F(r)?,
@@ -89,9 +102,9 @@ impl ReceivedOutput {
     w.write_all(&serialize(&self.outpoint))
   }
 
-  /// Serialize a ReceivedOutput to a Vec<u8>.
+  /// Serialize a ReceivedOutput to a `Vec<u8>`.
   pub fn serialize(&self) -> Vec<u8> {
-    let mut res = vec![];
+    let mut res = Vec::new();
     self.write(&mut res).unwrap();
     res
   }
@@ -143,7 +156,7 @@ impl Scanner {
 
   /// Scan a transaction.
   pub fn scan_transaction(&self, tx: &Transaction) -> Vec<ReceivedOutput> {
-    let mut res = vec![];
+    let mut res = Vec::new();
     for (vout, output) in tx.output.iter().enumerate() {
       // If the vout index exceeds 2**32, stop scanning outputs
       let Ok(vout) = u32::try_from(vout) else { break };
@@ -165,7 +178,7 @@ impl Scanner {
   /// must be immediately spendable, a post-processing pass is needed to remove those outputs.
   /// Alternatively, scan_transaction can be called on `block.txdata[1 ..]`.
   pub fn scan_block(&self, block: &Block) -> Vec<ReceivedOutput> {
-    let mut res = vec![];
+    let mut res = Vec::new();
     for tx in &block.txdata {
       res.extend(self.scan_transaction(tx));
     }

coins/bitcoin/src/wallet/send.rs

@@ -1,4 +1,4 @@
-use std::{
+use std_shims::{
   io::{self, Read},
   collections::HashMap,
 };