|
| 1 | +use openvm_algebra_guest::{IntMod, Reduce}; |
| 2 | +use openvm_sha2::sha256; |
| 3 | + |
| 4 | +use crate::{edwards::TwistedEdwardsPoint, CyclicGroup, FromCompressed, IntrinsicCurve}; |
| 5 | + |
| 6 | +extern crate alloc; |
| 7 | +use alloc::vec::Vec; |
| 8 | + |
| 9 | +type Coordinate<C> = <<C as IntrinsicCurve>::Point as TwistedEdwardsPoint>::Coordinate; |
| 10 | +type Scalar<C> = <C as IntrinsicCurve>::Scalar; |
| 11 | +type Point<C> = <C as IntrinsicCurve>::Point; |
| 12 | + |
| 13 | +#[repr(C)] |
| 14 | +#[derive(Clone)] |
| 15 | +pub struct VerifyingKey<C: IntrinsicCurve> { |
| 16 | + /// Affine point |
| 17 | + point: Point<C>, |
| 18 | +} |
| 19 | + |
| 20 | +impl<C: IntrinsicCurve> VerifyingKey<C> |
| 21 | +where |
| 22 | + Point<C>: TwistedEdwardsPoint + FromCompressed<Coordinate<C>> + CyclicGroup, |
| 23 | + Coordinate<C>: IntMod, |
| 24 | + C::Scalar: IntMod + Reduce, |
| 25 | +{ |
| 26 | + /// Assumes the point is encoded as in https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.2 |
| 27 | + pub fn from_bytes(bytes: &[u8]) -> Option<Self> { |
| 28 | + if bytes.len() != Coordinate::<C>::NUM_LIMBS { |
| 29 | + return None; |
| 30 | + } |
| 31 | + Some(Self { |
| 32 | + point: decode_point::<C>(bytes)?, |
| 33 | + }) |
| 34 | + } |
| 35 | + |
| 36 | + pub fn verify(&self, message: &[u8], sig: &[u8]) -> bool { |
| 37 | + let Some(sig) = Signature::<C>::from_bytes(sig) else { |
| 38 | + return false; |
| 39 | + }; |
| 40 | + |
| 41 | + // TODO: replace with sha512 |
| 42 | + let prehash = sha256(message); |
| 43 | + |
| 44 | + // h = SHA512(dom2(F, C) || R || A || PH(M)) |
| 45 | + // RFC reference: https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.7 |
| 46 | + let mut sha_input = Vec::new(); |
| 47 | + |
| 48 | + // dom2(F, C) domain separator |
| 49 | + // RFC reference: https://datatracker.ietf.org/doc/html/rfc8032#section-2 |
| 50 | + // See definition of dom2 in the RFC. Note that the RFC refers to the prehash |
| 51 | + // version of Ed25519 as Ed25519ph, and the non-prehash version as Ed25519. |
| 52 | + sha_input.extend_from_slice(b"SigEd25519 no Ed25519 collisions"); |
| 53 | + sha_input.extend_from_slice(&[1]); // phflag = 1 |
| 54 | + |
| 55 | + // The RFC specifies optional "context" bytes that are shared between a signer and verifier. |
| 56 | + // We don't use any context bytes. |
| 57 | + // See: https://datatracker.ietf.org/doc/html/rfc8032#section-5.1 |
| 58 | + sha_input.extend_from_slice(&[0]); // context len = 0 |
| 59 | + |
| 60 | + sha_input.extend_from_slice(&encode_point::<C>(&sig.r)); |
| 61 | + sha_input.extend_from_slice(&encode_point::<C>(&self.point)); |
| 62 | + sha_input.extend_from_slice(&prehash); |
| 63 | + |
| 64 | + // TOOD: replace with sha512 |
| 65 | + let h = sha256(&sha_input); |
| 66 | + |
| 67 | + let h = C::Scalar::reduce_le_bytes(&h); |
| 68 | + |
| 69 | + // assert s * B = R + h * A |
| 70 | + // <=> R + h * A - s * B = 0 |
| 71 | + // <=> [1, h, s] * [R, A, -B] = 0 |
| 72 | + let res = C::msm( |
| 73 | + &[C::Scalar::ONE, h, sig.s], |
| 74 | + &[ |
| 75 | + sig.r, |
| 76 | + self.point.clone(), |
| 77 | + <Point<C> as CyclicGroup>::NEG_GENERATOR, |
| 78 | + ], |
| 79 | + ); |
| 80 | + res == <Point<C> as TwistedEdwardsPoint>::IDENTITY |
| 81 | + } |
| 82 | +} |
| 83 | + |
| 84 | +// Internal struct used for decoding the signature from bytes |
| 85 | +struct Signature<C: IntrinsicCurve> { |
| 86 | + r: C::Point, |
| 87 | + s: C::Scalar, |
| 88 | +} |
| 89 | + |
| 90 | +impl<C: IntrinsicCurve> Signature<C> |
| 91 | +where |
| 92 | + C::Point: TwistedEdwardsPoint + FromCompressed<Coordinate<C>>, |
| 93 | + Coordinate<C>: IntMod, |
| 94 | + C::Scalar: IntMod, |
| 95 | +{ |
| 96 | + pub fn from_bytes(bytes: &[u8]) -> Option<Self> { |
| 97 | + if bytes.len() != Coordinate::<C>::NUM_LIMBS + Scalar::<C>::NUM_LIMBS { |
| 98 | + return None; |
| 99 | + } |
| 100 | + // from_le_bytes checks that s is reduced |
| 101 | + let s = Scalar::<C>::from_le_bytes(&bytes[Coordinate::<C>::NUM_LIMBS..])?; |
| 102 | + Some(Self { |
| 103 | + r: decode_point::<C>(&bytes[..Coordinate::<C>::NUM_LIMBS])?, |
| 104 | + s, |
| 105 | + }) |
| 106 | + } |
| 107 | +} |
| 108 | + |
| 109 | +/// RFC reference: https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.3 |
| 110 | +/// We require that the most significant bit in the little-endian encoding of |
| 111 | +/// elements of the coordinate field is always 0, because we pack the parity |
| 112 | +/// of the x-coordinate there. |
| 113 | +fn decode_point<C: IntrinsicCurve>(bytes: &[u8]) -> Option<Point<C>> |
| 114 | +where |
| 115 | + Point<C>: TwistedEdwardsPoint + FromCompressed<Coordinate<C>>, |
| 116 | + Coordinate<C>: IntMod, |
| 117 | +{ |
| 118 | + if bytes.len() != Coordinate::<C>::NUM_LIMBS { |
| 119 | + return None; |
| 120 | + } |
| 121 | + let mut y_bytes = bytes.to_vec(); |
| 122 | + // most significant bit stores the parity of the x-coordinate |
| 123 | + let rec_id = y_bytes[Coordinate::<C>::NUM_LIMBS - 1] & 0b10000000; |
| 124 | + y_bytes[Coordinate::<C>::NUM_LIMBS - 1] &= 0b01111111; |
| 125 | + // from_le_bytes checks that y is reduced |
| 126 | + let y = Coordinate::<C>::from_le_bytes(&y_bytes)?; |
| 127 | + Point::<C>::decompress(y, &rec_id) |
| 128 | +} |
| 129 | + |
| 130 | +/// RFC reference: https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.2 |
| 131 | +/// We require that the most significant bit in the little-endian encoding of |
| 132 | +/// elements of the coordinate field is always 0, because we pack the parity |
| 133 | +/// of the x-coordinate there. |
| 134 | +fn encode_point<C: IntrinsicCurve>(p: &Point<C>) -> Vec<u8> |
| 135 | +where |
| 136 | + Point<C>: TwistedEdwardsPoint, |
| 137 | + Coordinate<C>: IntMod, |
| 138 | +{ |
| 139 | + let mut y_bytes = p.y().as_le_bytes().to_vec(); |
| 140 | + if p.x().as_le_bytes()[0] & 1u8 == 1 { |
| 141 | + y_bytes[Coordinate::<C>::NUM_LIMBS - 1] |= 0b10000000; |
| 142 | + } |
| 143 | + y_bytes |
| 144 | +} |
0 commit comments