diff --git a/crypto/frost/src/curve/dalek.rs b/crypto/frost/src/curve/dalek.rs index 334e978a..58cd63d3 100644 --- a/crypto/frost/src/curve/dalek.rs +++ b/crypto/frost/src/curve/dalek.rs @@ -16,13 +16,18 @@ macro_rules! dalek_curve { $ID: literal, $CONTEXT: literal, - $chal: literal, - $digest: literal, + $chal: literal, ) => { use dalek_ff_group::{$Point, $POINT}; #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)] pub struct $Curve; + impl $Curve { + fn hash(dst: &[u8], data: &[u8]) -> Sha512 { + Sha512::new().chain_update(&[$CONTEXT.as_ref(), dst, data].concat()) + } + } + impl Curve for $Curve { type F = Scalar; type G = $Point; @@ -33,21 +38,12 @@ macro_rules! dalek_curve { $POINT } - fn hash_msg(msg: &[u8]) -> Vec { - Sha512::new() - .chain_update($CONTEXT) - .chain_update($digest) - .chain_update(msg) - .finalize() - .to_vec() + fn hash_to_vec(dst: &[u8], data: &[u8]) -> Vec { + Self::hash(dst, data).finalize().to_vec() } - fn hash_binding_factor(binding: &[u8]) -> Self::F { - Self::hash_to_F(b"rho", binding) - } - - fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F { - Scalar::from_hash(Sha512::new().chain_update($CONTEXT).chain_update(dst).chain_update(msg)) + fn hash_to_F(dst: &[u8], data: &[u8]) -> Self::F { + Scalar::from_hash(Self::hash(dst, data)) } } @@ -56,7 +52,13 @@ macro_rules! dalek_curve { impl Hram<$Curve> for $Hram { #[allow(non_snake_case)] fn hram(R: &$Point, A: &$Point, m: &[u8]) -> Scalar { - $Curve::hash_to_F($chal, &[&R.compress().to_bytes(), &A.compress().to_bytes(), m].concat()) + let mut hash = Sha512::new(); + if $chal.len() != 0 { + hash.update(&[$CONTEXT.as_ref(), $chal].concat()); + } + Scalar::from_hash( + hash.chain_update(&[&R.compress().to_bytes(), &A.compress().to_bytes(), m].concat()), + ) } } }; @@ -69,9 +71,8 @@ dalek_curve!( RistrettoPoint, RISTRETTO_BASEPOINT_POINT, b"ristretto", - b"FROST-RISTRETTO255-SHA512-v5", + b"FROST-RISTRETTO255-SHA512-v8", b"chal", - b"digest", ); #[cfg(feature = "ed25519")] @@ -81,7 +82,6 @@ dalek_curve!( EdwardsPoint, ED25519_BASEPOINT_POINT, b"edwards25519", - b"", - b"", + b"FROST-ED25519-SHA512-v8", b"", ); diff --git a/crypto/frost/src/curve/kp256.rs b/crypto/frost/src/curve/kp256.rs index 1bc427f6..f3724d96 100644 --- a/crypto/frost/src/curve/kp256.rs +++ b/crypto/frost/src/curve/kp256.rs @@ -1,6 +1,6 @@ use zeroize::Zeroize; -use sha2::{digest::Update, Digest, Sha256}; +use sha2::{Digest, Sha256}; use group::{ ff::{Field, PrimeField}, @@ -26,6 +26,12 @@ macro_rules! kp_curve { ) => { #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)] pub struct $Curve; + impl $Curve { + fn hash(dst: &[u8], data: &[u8]) -> Sha256 { + Sha256::new().chain_update(&[$CONTEXT.as_ref(), dst, data].concat()) + } + } + impl Curve for $Curve { type F = $lib::Scalar; type G = $lib::ProjectivePoint; @@ -36,17 +42,13 @@ macro_rules! kp_curve { $lib::ProjectivePoint::GENERATOR } - fn hash_msg(msg: &[u8]) -> Vec { - (&Sha256::new().chain($CONTEXT).chain(b"digest").chain(msg).finalize()).to_vec() - } - - fn hash_binding_factor(binding: &[u8]) -> Self::F { - Self::hash_to_F(&[$CONTEXT as &[u8], b"rho"].concat(), binding) + fn hash_to_vec(dst: &[u8], data: &[u8]) -> Vec { + Self::hash(dst, data).finalize().to_vec() } fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F { - let mut dst = dst; - let oversize = Sha256::digest([b"H2C-OVERSIZE-DST-", dst].concat()); + let mut dst = &[$CONTEXT, dst].concat(); + let oversize = Sha256::digest([b"H2C-OVERSIZE-DST-".as_ref(), dst].concat()).to_vec(); if dst.len() > 255 { dst = &oversize; } @@ -79,17 +81,14 @@ macro_rules! kp_curve { impl Hram<$Curve> for $Hram { #[allow(non_snake_case)] fn hram(R: &$lib::ProjectivePoint, A: &$lib::ProjectivePoint, m: &[u8]) -> $lib::Scalar { - $Curve::hash_to_F( - &[$CONTEXT as &[u8], b"chal"].concat(), - &[R.to_bytes().as_ref(), A.to_bytes().as_ref(), m].concat(), - ) + $Curve::hash_to_F(b"chal", &[R.to_bytes().as_ref(), A.to_bytes().as_ref(), m].concat()) } } }; } #[cfg(feature = "p256")] -kp_curve!(p256, P256, IetfP256Hram, b"P-256", b"FROST-P256-SHA256-v5"); +kp_curve!(p256, P256, IetfP256Hram, b"P-256", b"FROST-P256-SHA256-v8"); #[cfg(feature = "secp256k1")] -kp_curve!(k256, Secp256k1, NonIetfSecp256k1Hram, b"secp256k1", b"FROST-secp256k1-SHA256-v7"); +kp_curve!(k256, Secp256k1, IetfSecp256k1Hram, b"secp256k1", b"FROST-secp256k1-SHA256-v8"); diff --git a/crypto/frost/src/curve/mod.rs b/crypto/frost/src/curve/mod.rs index 4c10d138..08e946a3 100644 --- a/crypto/frost/src/curve/mod.rs +++ b/crypto/frost/src/curve/mod.rs @@ -20,7 +20,7 @@ pub use dalek::{Ed25519, IetfEd25519Hram}; #[cfg(feature = "kp256")] mod kp256; #[cfg(feature = "secp256k1")] -pub use kp256::{Secp256k1, NonIetfSecp256k1Hram}; +pub use kp256::{Secp256k1, IetfSecp256k1Hram}; #[cfg(feature = "p256")] pub use kp256::{P256, IetfP256Hram}; @@ -53,20 +53,30 @@ pub trait Curve: Clone + Copy + PartialEq + Eq + Debug + Zeroize { // While group does provide this in its API, privacy coins may want to use a custom basepoint fn generator() -> Self::G; - /// Hash the message for the binding factor. H3 from the IETF draft - // This doesn't actually need to be part of Curve as it does nothing with the curve - // This also solely relates to FROST and with a proper Algorithm/HRAM, all projects using - // aggregatable signatures over this curve will work without issue - // It is kept here as Curve + H{1, 2, 3, 4} is effectively a ciphersuite according to the IETF - // draft and moving it to Schnorr would force all of them into being ciphersuite-specific - // H2 is left to the Schnorr Algorithm as H2 is the H used in HRAM, which Schnorr further - // modularizes - fn hash_msg(msg: &[u8]) -> Vec; + /// Hash the given dst and data to a byte vector. Used to instantiate H4 and H5. + fn hash_to_vec(dst: &[u8], data: &[u8]) -> Vec; + + /// Field element from hash. Used during key gen and by other crates under Serai as a general + /// utility. Used to instantiate H1 and H3. + #[allow(non_snake_case)] + fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F; + + /// Hash the message for the binding factor. H4 from the IETF draft + fn hash_msg(msg: &[u8]) -> Vec { + Self::hash_to_vec(b"msg", msg) + } + + /// Hash the commitments for the binding factor. H5 from the IETF draft + fn hash_commitments(commitments: &[u8]) -> Vec { + Self::hash_to_vec(b"com", commitments) + } /// Hash the commitments and message to calculate the binding factor. H1 from the IETF draft - fn hash_binding_factor(binding: &[u8]) -> Self::F; + fn hash_binding_factor(binding: &[u8]) -> Self::F { + Self::hash_to_F(b"rho", binding) + } - /// Securely generate a random nonce. H4 from the IETF draft + /// Securely generate a random nonce. H3 from the IETF draft fn random_nonce(mut secret: Self::F, rng: &mut R) -> Self::F { let mut seed = vec![0; 32]; rng.fill_bytes(&mut seed); @@ -84,13 +94,6 @@ pub trait Curve: Clone + Copy + PartialEq + Eq + Debug + Zeroize { res } - /// Field element from hash. Used during key gen and by other crates under Serai as a general - /// utility - // Not parameterized by Digest as it's fine for it to use its own hash function as relevant to - // hash_msg and hash_binding_factor - #[allow(non_snake_case)] - fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F; - #[allow(non_snake_case)] fn F_len() -> usize { ::Repr::default().as_ref().len() diff --git a/crypto/frost/src/sign.rs b/crypto/frost/src/sign.rs index 7faf3d4c..47c3254c 100644 --- a/crypto/frost/src/sign.rs +++ b/crypto/frost/src/sign.rs @@ -253,7 +253,7 @@ fn sign_with_share>( // protocol rho_transcript.append_message( b"commitments", - &C::hash_msg(params.algorithm.transcript().challenge(b"commitments").as_ref()), + &C::hash_commitments(params.algorithm.transcript().challenge(b"commitments").as_ref()), ); // Include the offset, if one exists diff --git a/crypto/frost/src/tests/literal/dalek.rs b/crypto/frost/src/tests/literal/dalek.rs index 835f2141..524b0f6b 100644 --- a/crypto/frost/src/tests/literal/dalek.rs +++ b/crypto/frost/src/tests/literal/dalek.rs @@ -24,20 +24,20 @@ fn ristretto_vectors() { included: &[1, 3], nonces: &[ [ - "eb0dc12ae7b746d36e3f2de46ce3833a05b9d4af5434eeb8cafaefda76906d00", - "491e91aa9df514ef598d5e0c7c5cdd088fbde4965b96069d546c0f04f1822b03", + "1eaee906e0554a5e533415e971eefa909f3c614c7c75e27f381b0270a9afe308", + "16175fc2e7545baf7180e8f5b6e1e73c4f2769323cc76754bdd79fe93ab0bd0b", ], [ - "abd12b8e6f255ee1e540eab029003a6e956567617720f61115f0941615892209", - "218e22625f93f262f025bd2d13c46ba722aa29fe585ceed66ff442d98fe4e509", + "48d78b8c2de1a515513f9d3fc464a19a72304fac522f17cc647706cb22c21403", + "5c0f10966b3f1386660a87de0fafd69decbe9ffae1a152a88b7d83bb4fb1c908", ], ], sig_shares: &[ - "efae3a83437fa8cd96194aacc56a7eb841630c280da99e7764a81d1340323306", - "96ddc4582e45eabce46f07b9e9375f8b49d35d1510fd34ac02b1e79d6100a602", + "5ae13621ebeef844e39454eb3478a50c4531d25939e1065f44f5b04a8535090e", + "aa432dcf274a9441c205e76fe43497be99efe374f9853477bd5add2075f6970c", ], - sig: "7ec584cef9a383afb43883b73bcaa6313afe878bd5fe75a608311b866a76ec67".to_owned() + - "858cffdb71c4928a7b895165afa2dd438b366a3d1da6d323675905b1a132d908", + sig: "9c407badb8cacf10f306d94e31fb2a71d6a8398039802b4d80a1278472397206".to_owned() + + "17516e93f8d57a2ecffd43b83ab35db6de20b6ce32673bd601508e6bfa2ba10a", }, ); } @@ -61,20 +61,20 @@ fn ed25519_vectors() { included: &[1, 3], nonces: &[ [ - "d9aad97e1a1127bb87702ce8d81d8c07c7cbca89e784868d8e3876ff6b459700", - "5063be2774520d08a5ccd7f1213fb1179a5fa292bf13bc91cb28e7bd4d4a690c", + "1c406170127e33142b8611bc02bf14d5909e49d5cb87150eff3ec9804212920c", + "5be4edde8b7acd79528721191626810c94fbc2bcc814b7a67d301fbd7fc16e07", ], [ - "86961f3a429ac0c5696f49e6d796817ff653f83c07f34e9e1f4d4c8c515b7900", - "72225ec11c1315d9f1ea0e78b1160ed95800fadd0191d23fd2f2c90ac96cb307", + "795f87122f05b7efc4b1a52f435c3d28597411b1a6fec198ce9c818c5451c401", + "c9193aaef37bc074ea3286d0361c815f7201bf764cd9e7d8bb4eb5ecca840a09", ], ], sig_shares: &[ - "caae171b83bff0c2c6f56a1276892918ba228146f6344b85d2ec6efeb6f16d0d", - "ea6fdbf61683cf5f1f742e1b91583f0f667f0369efd2e33399b96d5a3ff0300d", + "1f16a3989b4aa2cc3782a503331b9a21d7ba56c9c5455d06981b5425306c9d01", + "4c8f33c301c05871b434a686847d5818417a01e50a59e9e7fddaefde7d244207", ], - sig: "5da10008c13c04dd72328ba8e0f72b63cad43c3bf4b7eaada1c78225afbd977e".to_owned() + - "c74afdb47fdfadca0fcda18a28e8891220a284afe5072fb96ba6dc58f6e19e0a", + sig: "1aff2259ecb59cfcbb36ae77e02a9b134422abeae47cf7ff56c85fdf90932b18".to_owned() + + "6ba5d65b9d0afb3decb64b8ab798f239183558aed09e46ee95f64304ae90df08", }, ); } diff --git a/crypto/frost/src/tests/literal/kp256.rs b/crypto/frost/src/tests/literal/kp256.rs index 24d5dc73..5f9e00a9 100644 --- a/crypto/frost/src/tests/literal/kp256.rs +++ b/crypto/frost/src/tests/literal/kp256.rs @@ -4,15 +4,15 @@ use rand_core::OsRng; use crate::tests::vectors::{Vectors, test_with_vectors}; #[cfg(feature = "secp256k1")] -use crate::curve::{Secp256k1, NonIetfSecp256k1Hram}; +use crate::curve::{Secp256k1, IetfSecp256k1Hram}; #[cfg(feature = "p256")] use crate::curve::{P256, IetfP256Hram}; #[cfg(feature = "secp256k1")] #[test] -fn secp256k1_non_ietf() { - test_with_vectors::<_, Secp256k1, NonIetfSecp256k1Hram>( +fn secp256k1_ietf() { + test_with_vectors::<_, Secp256k1, IetfSecp256k1Hram>( &mut OsRng, Vectors { threshold: 2, @@ -28,20 +28,20 @@ fn secp256k1_non_ietf() { included: &[1, 3], nonces: &[ [ - "31c3c1b76b76664569859b9251fbabed9d4d432c6f5aaa03ed41f9c231935798", - "206f4ffaeb602ccb57cbe50e146ac690e6d7317d4b93377061d9d1b4caf78a26", + "95f352cf568508bce96ef3cb816bf9229eb521ca9c2aff6a4fe8b86bf49ae16f", + "c675aea50ff2510ae6b0fcb55432b97ad0b55a28b959bacb0e8b466dbf43dd26", ], [ - "0d3945bc1553676a5dd910cb4f14437d99ed421516b2617357b984820fdca520", - "635e0fd90caaf40b5e986d0ee0f58778e4d88731bc6ac70350ef702ffe20a21b", + "b5089ebf363630d3477711005173c1419f4f40514f7287b4ca6ff110967a2d70", + "5e50ce9975cfc6164e85752f52094b11091fdbca846a9c245fdbfa4bab1ae28c", ], ], sig_shares: &[ - "18b71e284c5d008896ed8847b234ec829eda376d6208838ee7faf2ce21b154c1", - "a452a49c8116124d0a283f3589a96b704894b43246e47e59d376353bcc638311", + "280c44c6c37cd64c7f5a552ae8416a57d21c115cab524dbff5fbcebbf5c0019d", + "e372bca35133a80ca140dcac2125c966b763a934678f40e09fb8b0ae9d4aee1b", ], - sig: "03dafb28ee7ad033fd15ed470d07156617260d74a9d76a15d371d7b613d2b111e".to_owned() + - "7bd09c2c4cd7312d5a115c77d3bde57f2e76eeb9fa8ed01e8bb712809ee14d7d2", + sig: "0364b02292a4b0e61f849f4d6fac0e67c2f698a21e1cba9e4a5b8fa535f2f9310d".to_owned() + + "0b7f016a14b07e59209b31d7096733bfced0ddaa6398ee64d5e220ddc2d4ae77", }, ); } @@ -65,20 +65,20 @@ fn p256_vectors() { included: &[1, 3], nonces: &[ [ - "33a519cf070a166f9ef41a798d03423743f3e7d0b0efd5d0d963773c4c53205e", - "307d208d0c5728f323ae374f1ebd7f14a1a49b77d9d4bc1eab222218a17765ff", + "e9165dad654fc20a9e31ca6f32ac032ec327b551a50e8ac5cf25f5c4c9e20757", + "e9059a232598a0fba0e495a687580e624ab425337c3221246fb2c716905bc9e7", ], [ - "a614eadb972dc37b88aeceb6e899903f3104742d13f379a0e014541decbea4a4", - "e509791018504c5bb87edaf0f44761cc840888507c4cd80237971d78e65f70f2", + "b9d136e29eb758bd77cb83c317ac4e336cf8cda830c089deddf6d5ec81da9884", + "5261e2d00ce227e67bb9b38990294e2c82970f335b2e6d9f1d07a72ba43d01f0", ], ], sig_shares: &[ - "61e8b9c474df2e66ad19fd80a6e6cec1c6fe43c0a1cffd2d1c28299e93e1bbdb", - "9651d355ca1dea2557ba1f73e38a9f4ff1f1afc565323ef27f88a9d14df8370e", + "bdaa275f10ca57e3a3a9a7a0d95aeabb517897d8482873a8f9713d458f94756f", + "0e8fd85386939e8974a8748e66641df0fe043323c52487a2b10b8a397897de21", ], - sig: "02dfba781e17b830229ae4ed22ebe402873683d9dfd945d01762217fb3172c2a7".to_owned() + - "1f83a8d1a3efd188c04d41cf48a716e11b8eff38607023c1f9bb0d36fe1d9f2e9", + sig: "03c41521412528dce484c35b6b9b7cc8150102ab3e4bdf858d702270c05098e6c6".to_owned() + + "cc39ffb2975df66d18521c2f3fbf08ac4f7ccafc0d4cfb4baa7cc77f082c5390", }, ); } diff --git a/crypto/frost/src/tests/promote.rs b/crypto/frost/src/tests/promote.rs index 5d184892..c4984788 100644 --- a/crypto/frost/src/tests/promote.rs +++ b/crypto/frost/src/tests/promote.rs @@ -70,16 +70,12 @@ impl Curve for AltGenerator { C::G::generator() * C::hash_to_F(b"FROST_tests", b"generator") } - fn hash_msg(msg: &[u8]) -> Vec { - C::hash_msg(msg) + fn hash_to_vec(dst: &[u8], data: &[u8]) -> Vec { + C::hash_to_vec(&[b"FROST_tests_alt", dst].concat(), data) } - fn hash_binding_factor(binding: &[u8]) -> Self::F { - C::hash_binding_factor(binding) - } - - fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F { - C::hash_to_F(dst, msg) + fn hash_to_F(dst: &[u8], data: &[u8]) -> Self::F { + C::hash_to_F(&[b"FROST_tests_alt", dst].concat(), data) } }