Implement view tags

coins/monero/src/wallet/mod.rs

@@ -35,22 +35,29 @@ pub(crate) fn uniqueness(inputs: &[Input]) -> [u8; 32] {
   hash(&u)
 }
 
-// Hs(8Ra || o) with https://github.com/monero-project/research-lab/issues/103 as an option
+// Hs("view_tag" || 8Ra || o) and Hs(8Ra || o) with uniqueness inclusion as an option
 #[allow(non_snake_case)]
 pub(crate) fn shared_key(
   uniqueness: Option<[u8; 32]>,
   s: Scalar,
   P: &EdwardsPoint,
   o: usize,
-) -> Scalar {
-  // uniqueness
-  let mut shared = uniqueness.map_or(vec![], |uniqueness| uniqueness.to_vec());
-  // || 8Ra
-  shared.extend((s * P).mul_by_cofactor().compress().to_bytes().to_vec());
+) -> (u8, Scalar) {
+  // 8Ra
+  let mut output_derivation = (s * P).mul_by_cofactor().compress().to_bytes().to_vec();
   // || o
-  write_varint(&o.try_into().unwrap(), &mut shared).unwrap();
-  // Hs()
-  hash_to_scalar(&shared)
+  write_varint(&o.try_into().unwrap(), &mut output_derivation).unwrap();
+
+  let view_tag = hash(&[b"view_tag".as_ref(), &output_derivation].concat())[0];
+
+  // uniqueness ||
+  let shared_key = if let Some(uniqueness) = uniqueness {
+    [uniqueness.as_ref(), &output_derivation].concat().to_vec()
+  } else {
+    output_derivation
+  };
+
+  (view_tag, hash_to_scalar(&shared_key))
 }
 
 pub(crate) fn amount_encryption(amount: u64, key: Scalar) -> [u8; 8] {

coins/monero/src/wallet/scan.rs

@@ -101,12 +101,19 @@ impl Transaction {
     for (o, output) in self.prefix.outputs.iter().enumerate() {
       // TODO: This may be replaceable by pubkeys[o]
       for pubkey in &pubkeys {
-        let key_offset = shared_key(
+        let (view_tag, key_offset) = shared_key(
           Some(uniqueness(&self.prefix.inputs)).filter(|_| guaranteed),
           view.view,
           pubkey,
           o,
         );
+
+        if let Some(actual_view_tag) = output.view_tag {
+          if actual_view_tag != view_tag {
+            continue;
+          }
+        }
+
         // P - shared == spend
         if (output.key - (&key_offset * &ED25519_BASEPOINT_TABLE)) != view.spend {
           continue;

coins/monero/src/wallet/send/mod.rs

@@ -38,6 +38,7 @@ pub use multisig::TransactionMachine;
 #[derive(Clone, PartialEq, Eq, Debug)]
 struct SendOutput {
   R: EdwardsPoint,
+  view_tag: u8,
   dest: EdwardsPoint,
   commitment: Commitment,
   amount: [u8; 8],
@@ -51,7 +52,7 @@ impl SendOutput {
     o: usize,
   ) -> SendOutput {
     let r = random_scalar(rng);
-    let shared_key =
+    let (view_tag, shared_key) =
       shared_key(Some(unique).filter(|_| output.0.meta.guaranteed), r, &output.0.view, o);
 
     let spend = output.0.spend;
@@ -63,6 +64,7 @@ impl SendOutput {
         }
         AddressType::Subaddress => r * spend,
       },
+      view_tag,
       dest: ((&shared_key * &ED25519_BASEPOINT_TABLE) + spend),
       commitment: Commitment::new(commitment_mask(shared_key), output.1),
       amount: amount_encryption(output.1, shared_key),
@@ -297,7 +299,7 @@ impl SignableTransaction {
       tx_outputs.push(Output {
         amount: 0,
         key: self.outputs[o].dest,
-        tag: Some(0).filter(|_| matches!(self.protocol, Protocol::v16)),
+        view_tag: Some(self.outputs[o].view_tag).filter(|_| matches!(self.protocol, Protocol::v16)),
       });
       ecdh_info.push(self.outputs[o].amount);
     }