Add a dedicated send/recv CLSAG mask struct

Abstracts the types used internally.

Also moves the tests from monero-serai to monero-clsag.

coins/monero/ringct/clsag/Cargo.toml

@@ -39,6 +39,9 @@ monero-io = { path = "../../io", version = "0.1", default-features = false }
 monero-generators = { path = "../../generators", version = "0.4", default-features = false }
 monero-primitives = { path = "../../primitives", version = "0.1", default-features = false }
 
+[dev-dependencies]
+frost = { package = "modular-frost", path = "../../../../crypto/frost", default-features = false, features = ["ed25519", "tests"] }
+
 [features]
 std = [
   "std-shims/std",

coins/monero/ringct/clsag/src/lib.rs

@@ -28,7 +28,10 @@ use monero_primitives::{INV_EIGHT, BASEPOINT_PRECOMP, Commitment, Decoys, keccak
 #[cfg(feature = "multisig")]
 mod multisig;
 #[cfg(feature = "multisig")]
-pub use multisig::{ClsagAddendum, ClsagMultisig};
+pub use multisig::{ClsagMultisigMaskSender, ClsagAddendum, ClsagMultisig};
+
+#[cfg(all(feature = "std", test))]
+mod tests;
 
 /// Errors when working with CLSAGs.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
@@ -219,8 +222,7 @@ fn core(
 pub struct Clsag {
   D: EdwardsPoint,
   s: Vec<Scalar>,
-  // TODO: Remove pub
-  pub c1: Scalar,
+  c1: Scalar,
 }
 
 struct ClsagSignCore {

coins/monero/ringct/clsag/src/multisig.rs

@@ -1,9 +1,9 @@
 use core::{ops::Deref, fmt::Debug};
 use std_shims::{
+  sync::{Arc, Mutex},
   io::{self, Read, Write},
   collections::HashMap,
 };
-use std::sync::{Arc, Mutex};
 
 use rand_core::{RngCore, CryptoRng, SeedableRng};
 use rand_chacha::ChaCha20Rng;
@@ -54,6 +54,35 @@ impl ClsagContext {
   }
 }
 
+/// A channel to send the mask to use for the pseudo-out (rerandomized commitment) with.
+///
+/// A mask must be sent along this channel before any preprocess addendums are handled. Breaking
+/// this rule will cause a panic.
+#[derive(Clone, Debug)]
+pub struct ClsagMultisigMaskSender {
+  buf: Arc<Mutex<Option<Scalar>>>,
+}
+#[derive(Clone, Debug)]
+struct ClsagMultisigMaskReceiver {
+  buf: Arc<Mutex<Option<Scalar>>>,
+}
+impl ClsagMultisigMaskSender {
+  fn new() -> (ClsagMultisigMaskSender, ClsagMultisigMaskReceiver) {
+    let buf = Arc::new(Mutex::new(None));
+    (ClsagMultisigMaskSender { buf: buf.clone() }, ClsagMultisigMaskReceiver { buf })
+  }
+
+  /// Send a mask to a CLSAG multisig instance.
+  pub fn send(self, mask: Scalar) {
+    *self.buf.lock() = Some(mask);
+  }
+}
+impl ClsagMultisigMaskReceiver {
+  fn recv(self) -> Scalar {
+    self.buf.lock().unwrap()
+  }
+}
+
 /// Addendum produced during the signing process.
 #[derive(Clone, PartialEq, Eq, Zeroize, Debug)]
 pub struct ClsagAddendum {
@@ -61,6 +90,7 @@ pub struct ClsagAddendum {
 }
 
 impl ClsagAddendum {
+  /// The key image share within this addendum.
   pub fn key_image_share(&self) -> dfg::EdwardsPoint {
     self.key_image_share
   }
@@ -94,7 +124,7 @@ pub struct ClsagMultisig {
 
   context: ClsagContext,
 
-  mask_mutex: Arc<Mutex<Option<Scalar>>>,
+  mask_recv: Option<ClsagMultisigMaskReceiver>,
   mask: Option<Scalar>,
 
   msg: Option<[u8; 32]>,
@@ -108,23 +138,26 @@ impl ClsagMultisig {
   pub fn new(
     transcript: RecommendedTranscript,
     context: ClsagContext,
-    mask_mutex: Arc<Mutex<Option<Scalar>>>,
-  ) -> ClsagMultisig {
-    ClsagMultisig {
-      transcript,
+  ) -> (ClsagMultisig, ClsagMultisigMaskSender) {
+    let (mask_send, mask_recv) = ClsagMultisigMaskSender::new();
+    (
+      ClsagMultisig {
+        transcript,
 
-      key_image_generator: hash_to_point(context.decoys.signer_ring_members()[0].compress().0),
-      key_image_shares: HashMap::new(),
-      image: None,
+        key_image_generator: hash_to_point(context.decoys.signer_ring_members()[0].compress().0),
+        key_image_shares: HashMap::new(),
+        image: None,
 
-      context,
+        context,
 
-      mask_mutex,
-      mask: None,
+        mask_recv: Some(mask_recv),
+        mask: None,
 
-      msg: None,
-      interim: None,
-    }
+        msg: None,
+        interim: None,
+      },
+      mask_send,
+    )
   }
 
   /// The key image generator used by the signer.
@@ -182,7 +215,7 @@ impl Algorithm<Ed25519> for ClsagMultisig {
       // Fetch the mask from the Mutex
       // We set it to a variable to ensure our view of it is consistent
       // It was this or a mpsc channel... std doesn't have oneshot :/
-      self.mask = Some(self.mask_mutex.lock().unwrap().unwrap());
+      self.mask = Some(self.mask_recv.take().unwrap().recv());
       // Transcript the mask
       self.transcript.append_message(b"mask", self.mask.expect("mask wasn't set").to_bytes());
 

coins/monero/ringct/clsag/src/tests.rs

@@ -0,0 +1,119 @@
+use core::ops::Deref;
+
+use zeroize::Zeroizing;
+use rand_core::{RngCore, OsRng};
+
+use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar};
+
+#[cfg(feature = "multisig")]
+use transcript::{Transcript, RecommendedTranscript};
+#[cfg(feature = "multisig")]
+use frost::curve::Ed25519;
+
+use monero_generators::hash_to_point;
+use monero_primitives::{Commitment, Decoys};
+use crate::{ClsagContext, Clsag};
+#[cfg(feature = "multisig")]
+use crate::ClsagMultisig;
+
+#[cfg(feature = "multisig")]
+use frost::{
+  Participant,
+  tests::{key_gen, algorithm_machines, sign},
+};
+
+const RING_LEN: u64 = 11;
+const AMOUNT: u64 = 1337;
+
+#[cfg(feature = "multisig")]
+const RING_INDEX: u8 = 3;
+
+#[test]
+fn clsag() {
+  for real in 0 .. RING_LEN {
+    let msg = [1; 32];
+
+    let mut secrets = (Zeroizing::new(Scalar::ZERO), Scalar::ZERO);
+    let mut ring = vec![];
+    for i in 0 .. RING_LEN {
+      let dest = Zeroizing::new(Scalar::random(&mut OsRng));
+      let mask = Scalar::random(&mut OsRng);
+      let amount;
+      if i == real {
+        secrets = (dest.clone(), mask);
+        amount = AMOUNT;
+      } else {
+        amount = OsRng.next_u64();
+      }
+      ring
+        .push([dest.deref() * ED25519_BASEPOINT_TABLE, Commitment::new(mask, amount).calculate()]);
+    }
+
+    let (mut clsag, pseudo_out) = Clsag::sign(
+      &mut OsRng,
+      vec![(
+        secrets.0.clone(),
+        ClsagContext::new(
+          Decoys::new((1 ..= RING_LEN).collect(), u8::try_from(real).unwrap(), ring.clone())
+            .unwrap(),
+          Commitment::new(secrets.1, AMOUNT),
+        )
+        .unwrap(),
+      )],
+      Scalar::random(&mut OsRng),
+      msg,
+    )
+    .unwrap()
+    .swap_remove(0);
+
+    let image =
+      hash_to_point((ED25519_BASEPOINT_TABLE * secrets.0.deref()).compress().0) * secrets.0.deref();
+    clsag.verify(&ring, &image, &pseudo_out, &msg).unwrap();
+
+    // make sure verification fails if we throw a random `c1` at it.
+    clsag.c1 = Scalar::random(&mut OsRng);
+    assert!(clsag.verify(&ring, &image, &pseudo_out, &msg).is_err());
+  }
+}
+
+#[cfg(feature = "multisig")]
+#[test]
+fn clsag_multisig() {
+  let keys = key_gen::<_, Ed25519>(&mut OsRng);
+
+  let randomness = Scalar::random(&mut OsRng);
+  let mut ring = vec![];
+  for i in 0 .. RING_LEN {
+    let dest;
+    let mask;
+    let amount;
+    if i != u64::from(RING_INDEX) {
+      dest = &Scalar::random(&mut OsRng) * ED25519_BASEPOINT_TABLE;
+      mask = Scalar::random(&mut OsRng);
+      amount = OsRng.next_u64();
+    } else {
+      dest = keys[&Participant::new(1).unwrap()].group_key().0;
+      mask = randomness;
+      amount = AMOUNT;
+    }
+    ring.push([dest, Commitment::new(mask, amount).calculate()]);
+  }
+
+  let (algorithm, mask_send) = ClsagMultisig::new(
+    RecommendedTranscript::new(b"Monero Serai CLSAG Test"),
+    ClsagContext::new(
+      Decoys::new((1 ..= RING_LEN).collect(), RING_INDEX, ring.clone()).unwrap(),
+      Commitment::new(randomness, AMOUNT),
+    )
+    .unwrap(),
+  );
+  mask_send.send(Scalar::random(&mut OsRng));
+
+  sign(
+    &mut OsRng,
+    &algorithm,
+    keys.clone(),
+    algorithm_machines(&mut OsRng, &algorithm, &keys),
+    &[1; 32],
+  );
+}