|
| 1 | +// === AUDIT STATUS === |
| 2 | +// internal: { status: not started, auditors: [], date: YYYY-MM-DD } |
| 3 | +// external_1: { status: not started, auditors: [], date: YYYY-MM-DD } |
| 4 | +// external_2: { status: not started, auditors: [], date: YYYY-MM-DD } |
| 5 | +// ===================== |
| 6 | + |
| 7 | +#include "barretenberg/dsl/acir_format/ecdsa_constraints.hpp" |
| 8 | +#include "barretenberg/dsl/acir_format/utils.hpp" |
| 9 | +#include "barretenberg/stdlib/encryption/ecdsa/ecdsa.hpp" |
| 10 | +#include "barretenberg/stdlib/primitives/curves/secp256k1.hpp" |
| 11 | +#include "barretenberg/stdlib/primitives/curves/secp256r1.hpp" |
| 12 | + |
| 13 | +namespace acir_format { |
| 14 | + |
| 15 | +using namespace bb; |
| 16 | + |
| 17 | +/** |
| 18 | + * @brief Create constraints to verify an ECDSA signature |
| 19 | + * |
| 20 | + * @details Given and ECDSA constraint system, add to the builder constraints that verify the ECDSA signature. We |
| 21 | + * perform the following operations: |
| 22 | + * 1. Reconstruct byte arrays from builder variables (we enforce that each variable fits in one byte and stack them in |
| 23 | + * a vector) and the boolean result from the corresponding builder variable |
| 24 | + * 2. Reconstruct the public key from the byte representations (big-endian, 32-byte numbers) of the \f$x\f$ and \f$y\f$ |
| 25 | + * coordinates. |
| 26 | + * 3. Enforce uniqueness of the representation of the public key by asserting \f$x < q\f$ and \f$y < q\f$, where |
| 27 | + * \f$q\f$ is the modulus of the base field of the elliptic curve we are working with. |
| 28 | + * 4. Verify the signature against the public key and the hash of the message. We return a bool_t bearing witness to |
| 29 | + * whether the signature verification was successfull or not. |
| 30 | + * 5. Enforce that the result of the signature verification matches the expected result. |
| 31 | + * |
| 32 | + * @tparam Curve |
| 33 | + * @param builder |
| 34 | + * @param input |
| 35 | + * @param has_valid_witness_assignments |
| 36 | + */ |
| 37 | +template <typename Curve> |
| 38 | +void create_ecdsa_verify_constraints(typename Curve::Builder& builder, |
| 39 | + const EcdsaConstraint& input, |
| 40 | + bool has_valid_witness_assignments) |
| 41 | +{ |
| 42 | + using Builder = Curve::Builder; |
| 43 | + |
| 44 | + using Fq = Curve::fq_ct; |
| 45 | + using Fr = Curve::bigfr_ct; |
| 46 | + using G1 = Curve::g1_bigfr_ct; |
| 47 | + |
| 48 | + using field_ct = bb::stdlib::field_t<Builder>; |
| 49 | + using bool_ct = bb::stdlib::bool_t<Builder>; |
| 50 | + using byte_array_ct = bb::stdlib::byte_array<Builder>; |
| 51 | + |
| 52 | + // Lambda to convert std::vector<field_ct> to byte_array_ct |
| 53 | + auto fields_to_bytes = [](Builder& builder, std::vector<field_ct>& fields) -> byte_array_ct { |
| 54 | + byte_array_ct result(&builder); |
| 55 | + for (auto& field : fields) { |
| 56 | + // Construct byte array of length 1 from the field element |
| 57 | + // The constructor enforces that `field` fits in one byte |
| 58 | + byte_array_ct byte_to_append(field, /*num_bytes=*/1); |
| 59 | + // Append the new byte to the result |
| 60 | + result.write(byte_to_append); |
| 61 | + } |
| 62 | + |
| 63 | + return result; |
| 64 | + }; |
| 65 | + |
| 66 | + // Define builder variables based on the witness indices |
| 67 | + std::vector<field_ct> hashed_message_fields = fields_from_witnesses(builder, input.hashed_message); |
| 68 | + std::vector<field_ct> r_fields = fields_from_witnesses(builder, std::span(input.signature.begin(), 32)); |
| 69 | + std::vector<field_ct> s_fields = fields_from_witnesses(builder, std::span(input.signature.begin() + 32, 32)); |
| 70 | + std::vector<field_ct> pub_x_fields = fields_from_witnesses(builder, input.pub_x_indices); |
| 71 | + std::vector<field_ct> pub_y_fields = fields_from_witnesses(builder, input.pub_y_indices); |
| 72 | + field_ct result_field = field_ct::from_witness_index(&builder, input.result); |
| 73 | + |
| 74 | + if (!has_valid_witness_assignments) { |
| 75 | + // Fill builder variables in case of empty witness assignment |
| 76 | + create_dummy_ecdsa_constraint<Curve>( |
| 77 | + builder, hashed_message_fields, r_fields, s_fields, pub_x_fields, pub_y_fields, result_field); |
| 78 | + } |
| 79 | + |
| 80 | + // Step 1. |
| 81 | + // Construct inputs to signature verification from witness indices |
| 82 | + byte_array_ct hashed_message = fields_to_bytes(builder, hashed_message_fields); |
| 83 | + byte_array_ct pub_x_bytes = fields_to_bytes(builder, pub_x_fields); |
| 84 | + byte_array_ct pub_y_bytes = fields_to_bytes(builder, pub_y_fields); |
| 85 | + byte_array_ct r = fields_to_bytes(builder, r_fields); |
| 86 | + byte_array_ct s = fields_to_bytes(builder, s_fields); |
| 87 | + bool_ct result = static_cast<bool_ct>(result_field); // Constructor enforces result_field = 0 or 1 |
| 88 | + |
| 89 | + // Step 2. |
| 90 | + // Reconstruct the public key from the byte representations of its coordinates |
| 91 | + Fq pub_x(pub_x_bytes); |
| 92 | + Fq pub_y(pub_y_bytes); |
| 93 | + G1 public_key(pub_x, pub_y); |
| 94 | + |
| 95 | + // Step 3. |
| 96 | + // Ensure uniqueness of the public key by asserting each of its coordinates is smaller than the modulus of the base |
| 97 | + // field |
| 98 | + pub_x.assert_is_in_field(); |
| 99 | + pub_y.assert_is_in_field(); |
| 100 | + |
| 101 | + // Step 4. |
| 102 | + bool_ct signature_result = |
| 103 | + stdlib::ecdsa_verify_signature<Builder, Curve, Fq, Fr, G1>(hashed_message, public_key, { r, s }); |
| 104 | + |
| 105 | + // Step 5. |
| 106 | + // Assert that signature verification returned the expected result |
| 107 | + signature_result.assert_equal(result); |
| 108 | +} |
| 109 | + |
| 110 | +/** |
| 111 | + * @brief Generate dummy ECDSA constraints when the builder doesn't have witnesses |
| 112 | + * |
| 113 | + * @details To avoid firing asserts, the public key must be a point on the curve |
| 114 | + */ |
| 115 | +template <typename Curve> |
| 116 | +void create_dummy_ecdsa_constraint(typename Curve::Builder& builder, |
| 117 | + const std::vector<stdlib::field_t<typename Curve::Builder>>& hashed_message_fields, |
| 118 | + const std::vector<stdlib::field_t<typename Curve::Builder>>& r_fields, |
| 119 | + const std::vector<stdlib::field_t<typename Curve::Builder>>& s_fields, |
| 120 | + const std::vector<stdlib::field_t<typename Curve::Builder>>& pub_x_fields, |
| 121 | + const std::vector<stdlib::field_t<typename Curve::Builder>>& pub_y_fields, |
| 122 | + const stdlib::field_t<typename Curve::Builder>& result_field) |
| 123 | +{ |
| 124 | + using Builder = Curve::Builder; |
| 125 | + using FqNative = Curve::fq; |
| 126 | + using G1Native = Curve::g1; |
| 127 | + using field_ct = stdlib::field_t<Builder>; |
| 128 | + |
| 129 | + // Lambda to populate builder variables from vector of field values |
| 130 | + auto populate_fields = [&builder](const std::vector<field_ct>& fields, const std::vector<bb::fr>& values) { |
| 131 | + for (auto [field, value] : zip_view(fields, values)) { |
| 132 | + builder.set_variable(field.witness_index, value); |
| 133 | + } |
| 134 | + }; |
| 135 | + |
| 136 | + // Vector of 32 copies of bb::fr::zero() |
| 137 | + std::vector<bb::fr> mock_zeros(32, bb::fr::zero()); |
| 138 | + |
| 139 | + // Hashed message |
| 140 | + populate_fields(hashed_message_fields, mock_zeros); |
| 141 | + |
| 142 | + // Signature |
| 143 | + populate_fields(r_fields, mock_zeros); |
| 144 | + populate_fields(s_fields, mock_zeros); |
| 145 | + |
| 146 | + // Pub key |
| 147 | + std::array<uint8_t, 32> buffer_x; |
| 148 | + std::array<uint8_t, 32> buffer_y; |
| 149 | + std::vector<bb::fr> mock_pub_x; |
| 150 | + std::vector<bb::fr> mock_pub_y; |
| 151 | + FqNative::serialize_to_buffer(G1Native::one.x, &buffer_x[0]); |
| 152 | + FqNative::serialize_to_buffer(G1Native::one.y, &buffer_y[0]); |
| 153 | + for (auto [byte_x, byte_y] : zip_view(buffer_x, buffer_y)) { |
| 154 | + mock_pub_x.emplace_back(bb::fr(byte_x)); |
| 155 | + mock_pub_y.emplace_back(bb::fr(byte_y)); |
| 156 | + } |
| 157 | + populate_fields(pub_x_fields, mock_pub_x); |
| 158 | + populate_fields(pub_y_fields, mock_pub_y); |
| 159 | + |
| 160 | + // Result |
| 161 | + builder.set_variable(result_field.witness_index, bb::fr::one()); |
| 162 | +} |
| 163 | + |
| 164 | +template void create_ecdsa_verify_constraints<stdlib::secp256k1<UltraCircuitBuilder>>( |
| 165 | + UltraCircuitBuilder& builder, const EcdsaConstraint& input, bool has_valid_witness_assignments); |
| 166 | +template void create_ecdsa_verify_constraints<stdlib::secp256k1<MegaCircuitBuilder>>( |
| 167 | + MegaCircuitBuilder& builder, const EcdsaConstraint& input, bool has_valid_witness_assignments); |
| 168 | +template void create_ecdsa_verify_constraints<stdlib::secp256r1<UltraCircuitBuilder>>( |
| 169 | + UltraCircuitBuilder& builder, const EcdsaConstraint& input, bool has_valid_witness_assignments); |
| 170 | +template void create_ecdsa_verify_constraints<stdlib::secp256r1<MegaCircuitBuilder>>( |
| 171 | + MegaCircuitBuilder& builder, const EcdsaConstraint& input, bool has_valid_witness_assignments); |
| 172 | + |
| 173 | +template void create_dummy_ecdsa_constraint<stdlib::secp256k1<UltraCircuitBuilder>>( |
| 174 | + UltraCircuitBuilder&, |
| 175 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 176 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 177 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 178 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 179 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 180 | + const stdlib:: field_t<UltraCircuitBuilder>&); |
| 181 | + |
| 182 | +template void create_dummy_ecdsa_constraint<stdlib::secp256r1<UltraCircuitBuilder>>( |
| 183 | + UltraCircuitBuilder&, |
| 184 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 185 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 186 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 187 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 188 | + const std::vector<stdlib:: field_t<UltraCircuitBuilder>>&, |
| 189 | + const stdlib:: field_t<UltraCircuitBuilder>&); |
| 190 | + |
| 191 | +} // namespace acir_format |
0 commit comments