[WIP] ed25519: add verify_consensus implementing ZIP-215

Adds a new verification method implementing the ZIP-215[1] verification
criteria for Ed25519 signatures.

TODO: test vectors

[1]: https://zips.z.cash/zip-0215

Author: tarcieri

ed25519-dalek/src/verifying.rs

@@ -17,6 +17,7 @@ use curve25519_dalek::{
     edwards::{CompressedEdwardsY, EdwardsPoint},
     montgomery::MontgomeryPoint,
     scalar::Scalar,
+    traits::IsIdentity,
 };
 
 use ed25519::signature::{MultipartVerifier, Verifier};
@@ -363,10 +364,7 @@ impl VerifyingKey {
     ) -> Result<(), SignatureError> {
         let signature = InternalSignature::try_from(signature)?;
 
-        let signature_R = signature
-            .R
-            .decompress()
-            .ok_or_else(|| SignatureError::from(InternalError::Verify))?;
+        let signature_R = signature.R.decompress().ok_or(InternalError::Verify)?;
 
         // Logical OR is fine here as we're not trying to be constant time.
         if signature_R.is_small_order() || self.point.is_small_order() {
@@ -381,6 +379,45 @@ impl VerifyingKey {
         }
     }
 
+    /// Verify signature using the [ZIP-215] rules for consensus-critical contexts.
+    ///
+    /// Consensus-critical contexts require validation criteria that work consistently across
+    /// implementations. Unfortunately, these criteria were inconsistent in-the-wild, and despite
+    /// [RFC 8032] enumerating certain criteria, few implementations actually followed that
+    /// specification.
+    ///
+    /// ZIP-215 specifically amends the verification criteria in the following way:
+    ///
+    /// - [`VerifyingKey`] and the `R` component of the signature MUST be valid encodings of
+    ///   compressed Edwards y-coordinates for Curve25519, which are NOT expected to be reduced
+    /// - The `S` component of the signature MUST represent an integer ℓ (i.e. the order of
+    ///   Curve25519's prime order subgroup)
+    /// - The equation `[8][S]B = [8]R + [8][k]` MUST be satisfied, where `k` and `B` are defined
+    ///   as in [RFC 8032] encodings §5.1.7 and §5.1 respectively.
+    ///
+    /// [ZIP-215]: https://zips.z.cash/zip-0215
+    /// [RFC 8032]: https://datatracker.ietf.org/doc/html/rfc8032
+    #[allow(non_snake_case)]
+    pub fn verify_consensus(
+        &self,
+        message: &[u8],
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError> {
+        let signature = InternalSignature::try_from(signature)?;
+
+        let signature_R = signature.R.decompress().ok_or(InternalError::Verify)?;
+
+        let mut c = RCompute::<Sha512>::new(self, signature, None);
+        c.update(message);
+        let expected_R = c.finish();
+
+        if (signature_R - expected_R).mul_by_cofactor().is_identity() {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+
     /// Constructs stream verifier with candidate `signature`.
     ///
     /// Useful for cases where the whole message is not available all at once, allowing the
@@ -514,7 +551,7 @@ where
     ) -> CompressedEdwardsY {
         let mut c = Self::new(key, signature, prehash_ctx);
         message.iter().for_each(|slice| c.update(slice));
-        c.finish()
+        c.finish().compress()
     }
 
     pub(crate) fn new(
@@ -546,13 +583,14 @@ where
         self.h.update(m)
     }
 
-    pub(crate) fn finish(self) -> CompressedEdwardsY {
+    pub(crate) fn finish(self) -> EdwardsPoint {
         let k = Scalar::from_hash(self.h);
 
+        // TODO(tarcieri): cache this to avoid recomputing it?
         let minus_A: EdwardsPoint = -self.key.point;
+
         // Recall the (non-batched) verification equation: -[k]A + [s]B = R
-        EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &(minus_A), &self.signature.s)
-            .compress()
+        EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &minus_A, &self.signature.s)
     }
 }
 

ed25519-dalek/src/verifying/stream.rs

@@ -34,7 +34,7 @@ impl StreamVerifier {
     /// Finalize verifier and check against candidate signature.
     #[allow(non_snake_case)]
     pub fn finalize_and_verify(self) -> Result<(), SignatureError> {
-        let expected_R = self.cr.finish();
+        let expected_R = self.cr.finish().compress();
 
         if expected_R == self.sig_R {
             Ok(())