#![allow(non_snake_case)] use std_shims::{ vec::Vec, io::{self, Read, Write}, }; use rand_core::{RngCore, CryptoRng}; use zeroize::{Zeroize, Zeroizing}; use curve25519_dalek::edwards::EdwardsPoint; use multiexp::BatchVerifier; use crate::{Commitment, wallet::TransactionError, serialize::*}; pub(crate) mod scalar_vector; pub(crate) mod core; use self::core::LOG_N; pub(crate) mod original; use self::original::OriginalStruct; pub(crate) mod plus; use self::plus::*; pub(crate) const MAX_OUTPUTS: usize = self::core::MAX_M; /// Bulletproofs enum, supporting the original and plus formulations. #[allow(clippy::large_enum_variant)] #[derive(Clone, PartialEq, Eq, Debug)] pub enum Bulletproofs { Original(OriginalStruct), Plus(AggregateRangeProof), } impl Bulletproofs { fn bp_fields(plus: bool) -> usize { if plus { 6 } else { 9 } } // https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/ // src/cryptonote_basic/cryptonote_format_utils.cpp#L106-L124 pub(crate) fn calculate_bp_clawback(plus: bool, n_outputs: usize) -> (usize, usize) { #[allow(non_snake_case)] let mut LR_len = 0; let mut n_padded_outputs = 1; while n_padded_outputs < n_outputs { LR_len += 1; n_padded_outputs = 1 << LR_len; } LR_len += LOG_N; let mut bp_clawback = 0; if n_padded_outputs > 2 { let fields = Bulletproofs::bp_fields(plus); let base = ((fields + (2 * (LOG_N + 1))) * 32) / 2; let size = (fields + (2 * LR_len)) * 32; bp_clawback = ((base * n_padded_outputs) - size) * 4 / 5; } (bp_clawback, LR_len) } pub(crate) fn fee_weight(plus: bool, outputs: usize) -> usize { #[allow(non_snake_case)] let (bp_clawback, LR_len) = Bulletproofs::calculate_bp_clawback(plus, outputs); 32 * (Bulletproofs::bp_fields(plus) + (2 * LR_len)) + 2 + bp_clawback } /// Prove the list of commitments are within [0 .. 2^64). pub fn prove( rng: &mut R, outputs: &[Commitment], plus: bool, ) -> Result { if outputs.is_empty() { Err(TransactionError::NoOutputs)?; } if outputs.len() > MAX_OUTPUTS { Err(TransactionError::TooManyOutputs)?; } Ok(if !plus { Bulletproofs::Original(OriginalStruct::prove(rng, outputs)) } else { use dalek_ff_group::EdwardsPoint as DfgPoint; Bulletproofs::Plus( AggregateRangeStatement::new(outputs.iter().map(|com| DfgPoint(com.calculate())).collect()) .unwrap() .prove(rng, &Zeroizing::new(AggregateRangeWitness::new(outputs).unwrap())) .unwrap(), ) }) } /// Verify the given Bulletproofs. #[must_use] pub fn verify(&self, rng: &mut R, commitments: &[EdwardsPoint]) -> bool { match self { Bulletproofs::Original(bp) => bp.verify(rng, commitments), Bulletproofs::Plus(bp) => { let mut verifier = BatchVerifier::new(1); // If this commitment is torsioned (which is allowed), this won't be a well-formed // dfg::EdwardsPoint (expected to be of prime-order) // The actual BP+ impl will perform a torsion clear though, making this safe // TODO: Have AggregateRangeStatement take in dalek EdwardsPoint for clarity on this let Some(statement) = AggregateRangeStatement::new( commitments.iter().map(|c| dalek_ff_group::EdwardsPoint(*c)).collect(), ) else { return false; }; if !statement.verify(rng, &mut verifier, (), bp.clone()) { return false; } verifier.verify_vartime() } } } /// Accumulate the verification for the given Bulletproofs into the specified BatchVerifier. /// Returns false if the Bulletproofs aren't sane, without mutating the BatchVerifier. /// Returns true if the Bulletproofs are sane, regardless of their validity. #[must_use] pub fn batch_verify( &self, rng: &mut R, verifier: &mut BatchVerifier, id: ID, commitments: &[EdwardsPoint], ) -> bool { match self { Bulletproofs::Original(bp) => bp.batch_verify(rng, verifier, id, commitments), Bulletproofs::Plus(bp) => { let Some(statement) = AggregateRangeStatement::new( commitments.iter().map(|c| dalek_ff_group::EdwardsPoint(*c)).collect(), ) else { return false; }; statement.verify(rng, verifier, id, bp.clone()) } } } fn write_core io::Result<()>>( &self, w: &mut W, specific_write_vec: F, ) -> io::Result<()> { match self { Bulletproofs::Original(bp) => { write_point(&bp.A, w)?; write_point(&bp.S, w)?; write_point(&bp.T1, w)?; write_point(&bp.T2, w)?; write_scalar(&bp.taux, w)?; write_scalar(&bp.mu, w)?; specific_write_vec(&bp.L, w)?; specific_write_vec(&bp.R, w)?; write_scalar(&bp.a, w)?; write_scalar(&bp.b, w)?; write_scalar(&bp.t, w) } Bulletproofs::Plus(bp) => { write_point(&bp.A.0, w)?; write_point(&bp.wip.A.0, w)?; write_point(&bp.wip.B.0, w)?; write_scalar(&bp.wip.r_answer.0, w)?; write_scalar(&bp.wip.s_answer.0, w)?; write_scalar(&bp.wip.delta_answer.0, w)?; specific_write_vec(&bp.wip.L.iter().copied().map(|L| L.0).collect::>(), w)?; specific_write_vec(&bp.wip.R.iter().copied().map(|R| R.0).collect::>(), w) } } } pub(crate) fn signature_write(&self, w: &mut W) -> io::Result<()> { self.write_core(w, |points, w| write_raw_vec(write_point, points, w)) } pub fn write(&self, w: &mut W) -> io::Result<()> { self.write_core(w, |points, w| write_vec(write_point, points, w)) } pub fn serialize(&self) -> Vec { let mut serialized = vec![]; self.write(&mut serialized).unwrap(); serialized } /// Read Bulletproofs. pub fn read(r: &mut R) -> io::Result { Ok(Bulletproofs::Original(OriginalStruct { A: read_point(r)?, S: read_point(r)?, T1: read_point(r)?, T2: read_point(r)?, taux: read_scalar(r)?, mu: read_scalar(r)?, L: read_vec(read_point, r)?, R: read_vec(read_point, r)?, a: read_scalar(r)?, b: read_scalar(r)?, t: read_scalar(r)?, })) } /// Read Bulletproofs+. pub fn read_plus(r: &mut R) -> io::Result { use dalek_ff_group::{Scalar as DfgScalar, EdwardsPoint as DfgPoint}; Ok(Bulletproofs::Plus(AggregateRangeProof { A: DfgPoint(read_point(r)?), wip: WipProof { A: DfgPoint(read_point(r)?), B: DfgPoint(read_point(r)?), r_answer: DfgScalar(read_scalar(r)?), s_answer: DfgScalar(read_scalar(r)?), delta_answer: DfgScalar(read_scalar(r)?), L: read_vec(read_point, r)?.into_iter().map(DfgPoint).collect(), R: read_vec(read_point, r)?.into_iter().map(DfgPoint).collect(), }, })) } }