Utilize zeroize (#76)

* Apply Zeroize to nonces used in Bulletproofs

Also makes bit decomposition constant time for a given amount of 
outputs.

* Fix nonce reuse for single-signer CLSAG

* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data

* Zeroize private keys and nonces

* Merge prepare_outputs and prepare_transactions

* Ensure CLSAG is constant time

* Pass by borrow where needed, bug fixes

The past few commitments have been one in-progress chunk which I've 
broken up as best read.

* Add Zeroize to FROST structs

Still needs to zeroize internally, yet next step. Not quite as 
aggressive as Monero, partially due to the limitations of HashMaps, 
partially due to less concern about metadata, yet does still delete a 
few smaller items of metadata (group key, context string...).

* Remove Zeroize from most Monero multisig structs

These structs largely didn't have private data, just fields with private 
data, yet those fields implemented ZeroizeOnDrop making them already 
covered. While there is still traces of the transaction left in RAM, 
fully purging that was never the intent.

* Use Zeroize within dleq

bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.

* Use Zeroize for random_nonce

It isn't perfect, due to the inability to zeroize the digest, and due to 
kp256 requiring a few transformations. It does the best it can though.

Does move the per-curve random_nonce to a provided one, which is allowed 
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.

* Use Zeroize on FROST keygen/signing

* Zeroize constant time multiexp.

* Correct when FROST keygen zeroizes

* Move the FROST keys Arc into FrostKeys

Reduces amount of instances in memory.

* Manually implement Debug for FrostCore to not leak the secret share

* Misc bug fixes

* clippy + multiexp test bug fixes

* Correct FROST key gen share summation

It leaked our own share for ourself.

* Fix cross-group DLEq tests

coins/monero/src/ringct/bulletproofs/core.rs

@@ -4,6 +4,8 @@
 use lazy_static::lazy_static;
 use rand_core::{RngCore, CryptoRng};
 
+use subtle::{Choice, ConditionallySelectable};
+
 use curve25519_dalek::edwards::EdwardsPoint as DalekPoint;
 
 use group::{ff::Field, Group};
@@ -99,11 +101,12 @@ pub(crate) fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, Scalar
 
   for j in 0 .. M {
     for i in (0 .. N).rev() {
-      if (j < sv.len()) && ((sv[j][i / 8] & (1u8 << (i % 8))) != 0) {
-        aL.0[(j * N) + i] = Scalar::one();
-      } else {
-        aR.0[(j * N) + i] = -Scalar::one();
+      let mut bit = Choice::from(0);
+      if j < sv.len() {
+        bit = Choice::from((sv[j][i / 8] >> (i % 8)) & 1);
       }
+      aL.0[(j * N) + i] = Scalar::conditional_select(&Scalar::zero(), &Scalar::one(), bit);
+      aR.0[(j * N) + i] = Scalar::conditional_select(&-Scalar::one(), &Scalar::zero(), bit);
     }
   }
 

coins/monero/src/ringct/bulletproofs/mod.rs

@@ -2,6 +2,8 @@
 
 use rand_core::{RngCore, CryptoRng};
 
+use zeroize::Zeroize;
+
 use curve25519_dalek::edwards::EdwardsPoint;
 use multiexp::BatchVerifier;
 
@@ -73,7 +75,7 @@ impl Bulletproofs {
   }
 
   #[must_use]
-  pub fn batch_verify<ID: Copy, R: RngCore + CryptoRng>(
+  pub fn batch_verify<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
     &self,
     rng: &mut R,
     verifier: &mut BatchVerifier<ID, dalek_ff_group::EdwardsPoint>,

coins/monero/src/ringct/bulletproofs/original.rs

@@ -1,6 +1,8 @@
 use lazy_static::lazy_static;
 use rand_core::{RngCore, CryptoRng};
 
+use zeroize::Zeroize;
+
 use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint};
 
 use group::{ff::Field, Group};
@@ -47,11 +49,12 @@ impl OriginalStruct {
 
     let (aL, aR) = bit_decompose(commitments);
     let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate));
-    let (alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR);
 
     let (sL, sR) =
       ScalarVector((0 .. (MN * 2)).map(|_| Scalar::random(&mut *rng)).collect::<Vec<_>>()).split();
-    let (rho, S) = alpha_rho(&mut *rng, &GENERATORS, &sL, &sR);
+
+    let (mut alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR);
+    let (mut rho, S) = alpha_rho(&mut *rng, &GENERATORS, &sL, &sR);
 
     let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]);
     let mut cache = hash_to_scalar(&y.to_bytes());
@@ -72,23 +75,33 @@ impl OriginalStruct {
     let r0 = (&(aR + z) * &yMN) + ScalarVector(zero_twos);
     let r1 = yMN * sR;
 
-    let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0);
-    let t2 = inner_product(&l1, &r1);
+    let (T1, T2, x, mut taux) = {
+      let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0);
+      let t2 = inner_product(&l1, &r1);
 
-    let tau1 = Scalar::random(&mut *rng);
-    let tau2 = Scalar::random(rng);
+      let mut tau1 = Scalar::random(&mut *rng);
+      let mut tau2 = Scalar::random(rng);
 
-    let T1 = prove_multiexp(&[(t1, *H), (tau1, EdwardsPoint::generator())]);
-    let T2 = prove_multiexp(&[(t2, *H), (tau2, EdwardsPoint::generator())]);
+      let T1 = prove_multiexp(&[(t1, *H), (tau1, EdwardsPoint::generator())]);
+      let T2 = prove_multiexp(&[(t2, *H), (tau2, EdwardsPoint::generator())]);
 
-    let x =
-      hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]);
+      let x =
+        hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]);
+
+      let taux = (tau2 * (x * x)) + (tau1 * x);
+
+      tau1.zeroize();
+      tau2.zeroize();
+      (T1, T2, x, taux)
+    };
+
+    let mu = (x * rho) + alpha;
+    alpha.zeroize();
+    rho.zeroize();
 
-    let mut taux = (tau2 * (x * x)) + (tau1 * x);
     for (i, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() {
       taux += zpow[i + 2] * gamma;
     }
-    let mu = (x * rho) + alpha;
 
     let l = &l0 + &(l1 * x);
     let r = &r0 + &(r1 * x);
@@ -155,7 +168,7 @@ impl OriginalStruct {
   }
 
   #[must_use]
-  fn verify_core<ID: Copy, R: RngCore + CryptoRng>(
+  fn verify_core<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
     &self,
     rng: &mut R,
     verifier: &mut BatchVerifier<ID, EdwardsPoint>,
@@ -284,7 +297,7 @@ impl OriginalStruct {
   }
 
   #[must_use]
-  pub(crate) fn batch_verify<ID: Copy, R: RngCore + CryptoRng>(
+  pub(crate) fn batch_verify<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
     &self,
     rng: &mut R,
     verifier: &mut BatchVerifier<ID, EdwardsPoint>,

coins/monero/src/ringct/bulletproofs/plus.rs

@@ -1,6 +1,8 @@
 use lazy_static::lazy_static;
 use rand_core::{RngCore, CryptoRng};
 
+use zeroize::Zeroize;
+
 use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint};
 
 use group::ff::Field;
@@ -109,7 +111,7 @@ impl PlusStruct {
       let cL = weighted_inner_product(&aL, &bR, y);
       let cR = weighted_inner_product(&(&aR * ypow[aR.len()]), &bL, y);
 
-      let (dL, dR) = (Scalar::random(&mut *rng), Scalar::random(&mut *rng));
+      let (mut dL, mut dR) = (Scalar::random(&mut *rng), Scalar::random(&mut *rng));
 
       let (G_L, G_R) = G_proof.split_at(aL.len());
       let (H_L, H_R) = H_proof.split_at(aL.len());
@@ -134,12 +136,15 @@ impl PlusStruct {
       b = (bL * winv) + (bR * w);
 
       alpha1 += (dL * (w * w)) + (dR * (winv * winv));
+
+      dL.zeroize();
+      dR.zeroize();
     }
 
-    let r = Scalar::random(&mut *rng);
-    let s = Scalar::random(&mut *rng);
-    let d = Scalar::random(&mut *rng);
-    let eta = Scalar::random(rng);
+    let mut r = Scalar::random(&mut *rng);
+    let mut s = Scalar::random(&mut *rng);
+    let mut d = Scalar::random(&mut *rng);
+    let mut eta = Scalar::random(rng);
 
     let A1 = prove_multiexp(&[
       (r, G_proof[0]),
@@ -151,8 +156,13 @@ impl PlusStruct {
     let e = hash_cache(&mut cache, &[A1.compress().to_bytes(), B.compress().to_bytes()]);
 
     let r1 = (a[0] * e) + r;
+    r.zeroize();
     let s1 = (b[0] * e) + s;
+    s.zeroize();
     let d1 = ((d * e) + eta) + (alpha1 * (e * e));
+    d.zeroize();
+    eta.zeroize();
+    alpha1.zeroize();
 
     PlusStruct {
       A: *A,
@@ -167,7 +177,7 @@ impl PlusStruct {
   }
 
   #[must_use]
-  fn verify_core<ID: Copy, R: RngCore + CryptoRng>(
+  fn verify_core<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
     &self,
     rng: &mut R,
     verifier: &mut BatchVerifier<ID, EdwardsPoint>,
@@ -293,7 +303,7 @@ impl PlusStruct {
   }
 
   #[must_use]
-  pub(crate) fn batch_verify<ID: Copy, R: RngCore + CryptoRng>(
+  pub(crate) fn batch_verify<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
     &self,
     rng: &mut R,
     verifier: &mut BatchVerifier<ID, EdwardsPoint>,

coins/monero/src/ringct/bulletproofs/scalar_vector.rs

@@ -1,11 +1,13 @@
 use core::ops::{Add, Sub, Mul, Index};
 
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 use group::ff::Field;
 use dalek_ff_group::{Scalar, EdwardsPoint};
 
 use multiexp::multiexp;
 
-#[derive(Clone, PartialEq, Eq, Debug)]
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub(crate) struct ScalarVector(pub(crate) Vec<Scalar>);
 macro_rules! math_op {
   ($Op: ident, $op: ident, $f: expr) => {

coins/monero/src/ringct/clsag/mod.rs

@@ -4,6 +4,9 @@ use lazy_static::lazy_static;
 use thiserror::Error;
 use rand_core::{RngCore, CryptoRng};
 
+use zeroize::{Zeroize, ZeroizeOnDrop};
+use subtle::{ConstantTimeEq, Choice, CtOption};
+
 use curve25519_dalek::{
   constants::ED25519_BASEPOINT_TABLE,
   scalar::Scalar,
@@ -45,7 +48,7 @@ pub enum ClsagError {
   InvalidC1,
 }
 
-#[derive(Clone, PartialEq, Eq, Debug)]
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub struct ClsagInput {
   // The actual commitment for the true spend
   pub commitment: Commitment,
@@ -161,11 +164,12 @@ fn core(
   }
 
   // Perform the core loop
-  let mut c1 = None;
+  let mut c1 = CtOption::new(Scalar::zero(), Choice::from(0));
   for i in (start .. end).map(|i| i % n) {
-    if i == 0 {
-      c1 = Some(c);
-    }
+    // This will only execute once and shouldn't need to be constant time. Making it constant time
+    // removes the risk of branch prediction creating timing differences depending on ring index
+    // however
+    c1 = c1.or_else(|| CtOption::new(c, i.ct_eq(&0)));
 
     let c_p = mu_P * c;
     let c_c = mu_C * c;
@@ -224,14 +228,10 @@ impl Clsag {
   // Single signer CLSAG
   pub fn sign<R: RngCore + CryptoRng>(
     rng: &mut R,
-    inputs: &[(Scalar, EdwardsPoint, ClsagInput)],
+    mut inputs: Vec<(Scalar, EdwardsPoint, ClsagInput)>,
     sum_outputs: Scalar,
     msg: [u8; 32],
   ) -> Vec<(Clsag, EdwardsPoint)> {
-    let nonce = random_scalar(rng);
-    let mut rand_source = [0; 64];
-    rng.fill_bytes(&mut rand_source);
-
     let mut res = Vec::with_capacity(inputs.len());
     let mut sum_pseudo_outs = Scalar::zero();
     for i in 0 .. inputs.len() {
@@ -242,8 +242,7 @@ impl Clsag {
         sum_pseudo_outs += mask;
       }
 
-      let mut rand_source = [0; 64];
-      rng.fill_bytes(&mut rand_source);
+      let mut nonce = random_scalar(rng);
       let (mut clsag, pseudo_out, p, c) = Clsag::sign_core(
         rng,
         &inputs[i].1,
@@ -254,6 +253,8 @@ impl Clsag {
         nonce * hash_to_point(inputs[i].2.decoys.ring[usize::from(inputs[i].2.decoys.i)][0]),
       );
       clsag.s[usize::from(inputs[i].2.decoys.i)] = nonce - ((p * inputs[i].0) + c);
+      inputs[i].0.zeroize();
+      nonce.zeroize();
 
       res.push((clsag, pseudo_out));
     }

coins/monero/src/ringct/clsag/multisig.rs

@@ -7,6 +7,8 @@ use std::{
 use rand_core::{RngCore, CryptoRng, SeedableRng};
 use rand_chacha::ChaCha12Rng;
 
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 use curve25519_dalek::{
   constants::ED25519_BASEPOINT_TABLE,
   traits::{Identity, IsIdentity},
@@ -52,7 +54,7 @@ impl ClsagInput {
   }
 }
 
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Zeroize, ZeroizeOnDrop)]
 pub struct ClsagDetails {
   input: ClsagInput,
   mask: Scalar,
@@ -195,7 +197,7 @@ impl Algorithm<Ed25519> for ClsagMultisig {
     );
     self.interim = Some(Interim { p, c, clsag, pseudo_out });
 
-    dfg::Scalar(nonces[0].0 - (p * view.secret_share().0))
+    nonces[0] - (dfg::Scalar(p) * view.secret_share())
   }
 
   #[must_use]

coins/monero/src/ringct/mod.rs

@@ -1,3 +1,5 @@
+use zeroize::Zeroize;
+
 use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
 
 pub(crate) mod hash_to_point;
@@ -11,8 +13,10 @@ use crate::{
   ringct::{clsag::Clsag, bulletproofs::Bulletproofs},
 };
 
-pub fn generate_key_image(secret: Scalar) -> EdwardsPoint {
-  secret * hash_to_point(&secret * &ED25519_BASEPOINT_TABLE)
+pub fn generate_key_image(mut secret: Scalar) -> EdwardsPoint {
+  let res = secret * hash_to_point(&secret * &ED25519_BASEPOINT_TABLE);
+  secret.zeroize();
+  res
 }
 
 #[derive(Clone, PartialEq, Eq, Debug)]