frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
secp256k1-zkp/Makefile.am

200 lines
6.0 KiB
Makefile
Raw Normal View History

Use same build template as bitcoin. Add bitcoin_secp.m4.
2014-11-07 01:55:27 +13:00
ACLOCAL_AMFLAGS = -I build-aux/m4
Remove INCLUDES. Obsolete, appears unused anyway.
2014-11-06 22:35:41 +13:00
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
lib_LTLIBRARIES = libsecp256k1.la
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
if USE_JNI
JNI_LIB = libsecp256k1_jni.la
noinst_LTLIBRARIES = $(JNI_LIB)
else
JNI_LIB =
endif
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
include_HEADERS = include/secp256k1.h
noinst_HEADERS =
Introduce secp256k1_scalar_t for future constant-time mod order operations
2014-10-28 04:08:15 -07:00
noinst_HEADERS += src/scalar.h
Implementations for scalar without data-dependent branches.
2014-10-29 00:35:49 -07:00
noinst_HEADERS += src/scalar_4x64.h
noinst_HEADERS += src/scalar_8x32.h
Add exhaustive tests for group arithmetic, signing, and ecmult on a small group If you compile without ./configure --enable-exhaustive-tests=no, this will create a binary ./exhaustive_tests which will execute every function possible on a group of small order obtained by moving to a twist of our curve and locating a generator of small order. Currently defaults to order 13, though by changing some #ifdefs you can get a couple other ones. (Currently 199, which will take forever to run, and 14, which won't work because it's composite.) TODO exhaustive tests for the various modules
2016-07-07 10:11:30 +00:00
noinst_HEADERS += src/scalar_low.h
Introduce secp256k1_scalar_t for future constant-time mod order operations
2014-10-28 04:08:15 -07:00
noinst_HEADERS += src/scalar_impl.h
Implementations for scalar without data-dependent branches.
2014-10-29 00:35:49 -07:00
noinst_HEADERS += src/scalar_4x64_impl.h
noinst_HEADERS += src/scalar_8x32_impl.h
Add exhaustive tests for group arithmetic, signing, and ecmult on a small group If you compile without ./configure --enable-exhaustive-tests=no, this will create a binary ./exhaustive_tests which will execute every function possible on a group of small order obtained by moving to a twist of our curve and locating a generator of small order. Currently defaults to order 13, though by changing some #ifdefs you can get a couple other ones. (Currently 199, which will take forever to run, and 14, which won't work because it's composite.) TODO exhaustive tests for the various modules
2016-07-07 10:11:30 +00:00
noinst_HEADERS += src/scalar_low_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/group.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/group_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/num_gmp.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/num_gmp_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/ecdsa.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/ecdsa_impl.h
Move non-ECDSA operations from ecdsa to eckey
2014-10-27 02:57:27 -07:00
noinst_HEADERS += src/eckey.h
noinst_HEADERS += src/eckey_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/ecmult.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/ecmult_impl.h
Add constant-time multiply `secp256k1_ecmult_const` for ECDH Designed with clear separation of the wNAF conversion, precomputation and exponentiation (since the precomp at least we will probably want to separate in the API for users who reuse points a lot. Future work: - actually separate precomp in the API - do multiexp rather than single exponentiation
2015-05-13 17:31:47 -05:00
noinst_HEADERS += src/ecmult_const.h
noinst_HEADERS += src/ecmult_const_impl.h
Split up ecmult and ecmult_gen entirely
2014-10-26 03:42:24 -07:00
noinst_HEADERS += src/ecmult_gen.h
noinst_HEADERS += src/ecmult_gen_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/num.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/num_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/field_10x26.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/field_10x26_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/field_5x52.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/field_5x52_impl.h
noinst_HEADERS += src/field_5x52_int128_impl.h
noinst_HEADERS += src/field_5x52_asm_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/java/org_bitcoin_NativeSecp256k1.h
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
noinst_HEADERS += src/java/org_bitcoin_Secp256k1Context.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/util.h
add resizeable scratch space API Alignment support by Pieter Wuille.
2017-07-22 18:03:17 +00:00
noinst_HEADERS += src/scratch.h
noinst_HEADERS += src/scratch_impl.h
field_gmp's negate doesn't need to use the magnitude argument.
2014-11-12 15:59:26 -08:00
noinst_HEADERS += src/testrand.h
noinst_HEADERS += src/testrand_impl.h
Use rfc6979 as default nonce generation function
2014-12-13 18:06:33 +01:00
noinst_HEADERS += src/hash.h
noinst_HEADERS += src/hash_impl.h
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_HEADERS += src/field.h
Move implementations from impl/*.h to *_impl.h
2014-03-07 01:11:01 +01:00
noinst_HEADERS += src/field_impl.h
Make the benchmarks print out stats
2014-12-04 20:26:54 +01:00
noinst_HEADERS += src/bench.h
Add contrib/lax_der_parsing.h This shows a snippet of code to do lax DER parsing, without obeying to any particular standard.
2015-10-14 17:43:20 +02:00
noinst_HEADERS += contrib/lax_der_parsing.h
Change contrib/laxder from headers-only to files compilable as standalone C Verified that both programs compile with gcc -I. -I../include -lsecp256k1 -c -W -Wextra -Wall -Werror -ansi -pedantic lax_der_privatekey_parsing.c gcc -I. -I../include -lsecp256k1 -c -W -Wextra -Wall -Werror -ansi -pedantic lax_der_parsing.c
2015-10-26 15:21:53 -05:00
noinst_HEADERS += contrib/lax_der_parsing.c
Move secp256k1_ec_privkey_import/export to contrib. These functions are intended for compatibility with legacy software, and are not normally needed in new secp256k1 applications. They also do not obeying any particular standard (and likely cannot without without undermining their compatibility), and so are a better fit for contrib.
2015-10-21 04:02:30 +00:00
noinst_HEADERS += contrib/lax_der_privatekey_parsing.h
Change contrib/laxder from headers-only to files compilable as standalone C Verified that both programs compile with gcc -I. -I../include -lsecp256k1 -c -W -Wextra -Wall -Werror -ansi -pedantic lax_der_privatekey_parsing.c gcc -I. -I../include -lsecp256k1 -c -W -Wextra -Wall -Werror -ansi -pedantic lax_der_parsing.c
2015-10-26 15:21:53 -05:00
noinst_HEADERS += contrib/lax_der_privatekey_parsing.c
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
if USE_EXTERNAL_ASM
COMMON_LIB = libsecp256k1_common.la
noinst_LTLIBRARIES = $(COMMON_LIB)
else
COMMON_LIB =
endif
packaging: remove the --with-pkgconfigdir option It was not necessary and would only confuse packagers.
2014-05-20 20:59:11 -04:00
pkgconfigdir = $(libdir)/pkgconfig
add pkg-config support
2014-05-07 06:10:08 +00:00
pkgconfig_DATA = libsecp256k1.pc
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
if USE_EXTERNAL_ASM
if USE_ASM_ARM
libsecp256k1_common_la_SOURCES = src/asm/field_10x26_arm.s
endif
endif
Make tests and bench just use asm directly instead of library Thanks to Cory Fields for the suggestion.
2014-08-19 13:39:58 +02:00
libsecp256k1_la_SOURCES = src/secp256k1.c
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
libsecp256k1_la_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/include -I$(top_srcdir)/src $(SECP_INCLUDES)
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
libsecp256k1_la_LIBADD = $(JNI_LIB) $(SECP_LIBS) $(COMMON_LIB)
Fix build for 64bit field under OSX - caused by https://github.com/bitcoin/secp256k1/commit/8881212ebc43e67052ec06dec8beb459769fbab7 - OSX's ar tool doesn't work for empty archives ("ar: no archive members specified") - introduce COMMON_LIB variable; leave empty when not using asm
2014-10-26 09:40:55 +07:00
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
libsecp256k1_jni_la_SOURCES = src/java/org_bitcoin_NativeSecp256k1.c src/java/org_bitcoin_Secp256k1Context.c
libsecp256k1_jni_la_CPPFLAGS = -DSECP256K1_BUILD $(JNI_INCLUDES)
Make tests and bench just use asm directly instead of library Thanks to Cory Fields for the suggestion.
2014-08-19 13:39:58 +02:00
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
noinst_PROGRAMS =
if USE_BENCHMARK
Add bench_ecmult
2017-09-12 20:05:39 -07:00
noinst_PROGRAMS += bench_verify bench_sign bench_internal bench_ecmult
Rename bench to bench_verify
2014-10-31 03:17:44 -07:00
bench_verify_SOURCES = src/bench_verify.c
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
bench_verify_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
Add bench_sign tool
2014-10-31 08:23:34 -07:00
bench_sign_SOURCES = src/bench_sign.c
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
bench_sign_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
Benchmarks for all internal operations
2015-01-31 16:12:10 -04:00
bench_internal_SOURCES = src/bench_internal.c
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
bench_internal_LDADD = $(SECP_LIBS) $(COMMON_LIB)
build: add -DSECP256K1_BUILD to benchmark_internal build flags gcc 6 will warn about our non-null checks when SECP256K1_BUILD our NONNULL marker is nontrivial. This occurs unless SECP256K1_BUILD is set, which we had forgotten to do for the internal benchmarks, which compile directly against the library instead of linking.
2016-06-06 18:32:29 +00:00
bench_internal_CPPFLAGS = -DSECP256K1_BUILD $(SECP_INCLUDES)
Add bench_ecmult
2017-09-12 20:05:39 -07:00
bench_ecmult_SOURCES = src/bench_ecmult.c
bench_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB)
bench_ecmult_CPPFLAGS = -DSECP256K1_BUILD $(SECP_INCLUDES)
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
endif
Add exhaustive test for group functions on a low-order subgroup We observe that when changing the b-value in the elliptic curve formula `y^2 = x^3 + ax + b`, the group law is unchanged. Therefore our functions for secp256k1 will be correct if and only if they are correct when applied to the curve defined by `y^2 = x^3 + 4` defined over the same field. This curve has a point P of order 199. This commit adds a test which computes the subgroup generated by P and exhaustively checks that addition of every pair of points gives the correct result. Unfortunately we cannot test const-time scalar multiplication by the same mechanism. The reason is that these ecmult functions both compute a wNAF representation of the scalar, and this representation is tied to the order of the group. Testing with the incomplete version of gej_add_ge (found in 5de4c5dff^) shows that this detects the incompleteness when adding P - 106P, which is exactly what we expected since 106 is a cube root of 1 mod 199.
2015-09-17 18:54:52 -05:00
TESTS =
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
if USE_TESTS
noinst_PROGRAMS += tests
tests_SOURCES = src/tests.c
configure: add --enable-coverage to set options for coverage analysis
2016-11-26 20:34:15 +00:00
tests_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/src -I$(top_srcdir)/include $(SECP_INCLUDES) $(SECP_TEST_INCLUDES)
if !ENABLE_COVERAGE
tests_CPPFLAGS += -DVERIFY
endif
ARM assembly implementation of field_10x26 inner Rebased-by: Pieter Wuille <pieter.wuille@gmail.com>
2014-12-24 12:12:37 +01:00
tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
tests_LDFLAGS = -static
Add exhaustive test for group functions on a low-order subgroup We observe that when changing the b-value in the elliptic curve formula `y^2 = x^3 + ax + b`, the group law is unchanged. Therefore our functions for secp256k1 will be correct if and only if they are correct when applied to the curve defined by `y^2 = x^3 + 4` defined over the same field. This curve has a point P of order 199. This commit adds a test which computes the subgroup generated by P and exhaustively checks that addition of every pair of points gives the correct result. Unfortunately we cannot test const-time scalar multiplication by the same mechanism. The reason is that these ecmult functions both compute a wNAF representation of the scalar, and this representation is tied to the order of the group. Testing with the incomplete version of gej_add_ge (found in 5de4c5dff^) shows that this detects the incompleteness when adding P - 106P, which is exactly what we expected since 106 is a cube root of 1 mod 199.
2015-09-17 18:54:52 -05:00
TESTS += tests
endif
if USE_EXHAUSTIVE_TESTS
noinst_PROGRAMS += exhaustive_tests
exhaustive_tests_SOURCES = src/tests_exhaustive.c
configure: add --enable-coverage to set options for coverage analysis
2016-11-26 20:34:15 +00:00
exhaustive_tests_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/src $(SECP_INCLUDES)
if !ENABLE_COVERAGE
exhaustive_tests_CPPFLAGS += -DVERIFY
endif
Add exhaustive test for group functions on a low-order subgroup We observe that when changing the b-value in the elliptic curve formula `y^2 = x^3 + ax + b`, the group law is unchanged. Therefore our functions for secp256k1 will be correct if and only if they are correct when applied to the curve defined by `y^2 = x^3 + 4` defined over the same field. This curve has a point P of order 199. This commit adds a test which computes the subgroup generated by P and exhaustively checks that addition of every pair of points gives the correct result. Unfortunately we cannot test const-time scalar multiplication by the same mechanism. The reason is that these ecmult functions both compute a wNAF representation of the scalar, and this representation is tied to the order of the group. Testing with the incomplete version of gej_add_ge (found in 5de4c5dff^) shows that this detects the incompleteness when adding P - 106P, which is exactly what we expected since 106 is a cube root of 1 mod 199.
2015-09-17 18:54:52 -05:00
exhaustive_tests_LDADD = $(SECP_LIBS)
exhaustive_tests_LDFLAGS = -static
TESTS += exhaustive_tests
autotools: autotools'ify libsecp256k1
2014-01-17 22:52:33 -05:00
endif
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
JAVAROOT=src/java
JAVAORG=org/bitcoin
JAVA_GUAVA=$(srcdir)/$(JAVAROOT)/guava/guava-18.0.jar
CLASSPATH_ENV=CLASSPATH=$(JAVA_GUAVA)
JAVA_FILES= \
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1.java \
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1Test.java \
$(JAVAROOT)/$(JAVAORG)/NativeSecp256k1Util.java \
$(JAVAROOT)/$(JAVAORG)/Secp256k1Context.java
if USE_JNI
$(JAVA_GUAVA):
@echo Guava is missing. Fetch it via: \
wget https://search.maven.org/remotecontent?filepath=com/google/guava/guava/18.0/guava-18.0.jar -O $(@)
@false
.stamp-java: $(JAVA_FILES)
@echo Compiling $^
$(AM_V_at)$(CLASSPATH_ENV) javac $^
@touch $@
if USE_TESTS
check-java: libsecp256k1.la $(JAVA_GUAVA) .stamp-java
$(AM_V_at)java -Djava.library.path="./:./src:./src/.libs:.libs/" -cp "$(JAVA_GUAVA):$(JAVAROOT)" $(JAVAORG)/NativeSecp256k1Test
endif
endif
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
if USE_ECMULT_STATIC_PRECOMPUTATION
Fix for Windows compile issue Change CPPFLAGS_FOR_BUILD path (by paveljanik)
2015-11-16 16:40:12 -08:00
CPPFLAGS_FOR_BUILD +=-I$(top_srcdir)
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
CFLAGS_FOR_BUILD += -Wall -Wextra -Wno-unused-function
gen_context_OBJECTS = gen_context.o
build: fix hard-coded usage of "gen_context" The binary needs an extension on some platforms.
2015-07-31 13:33:58 -04:00
gen_context_BIN = gen_context$(BUILD_EXEEXT)
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
gen_%.o: src/gen_%.c
$(CC_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c $< -o $@
build: fix hard-coded usage of "gen_context" The binary needs an extension on some platforms.
2015-07-31 13:33:58 -04:00
$(gen_context_BIN): $(gen_context_OBJECTS)
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
$(CC_FOR_BUILD) $^ -o $@
build: don't use BUILT_SOURCES for the static context header BUILT_SOURCES simply forces the header to be built first. Use real dependencies instead. This fixes builds with dependency tracking disabled where a real target is specified. As a bonus, this also fixes the issue of gen_context and the header not being rebuilt when gen_context.c is touched.
2015-07-31 13:24:39 -04:00
$(libsecp256k1_la_OBJECTS): src/ecmult_static_context.h
$(tests_OBJECTS): src/ecmult_static_context.h
build: fix parallel build
2015-08-31 22:36:31 -04:00
$(bench_internal_OBJECTS): src/ecmult_static_context.h
Add bench_ecmult
2017-09-12 20:05:39 -07:00
$(bench_ecmult_OBJECTS): src/ecmult_static_context.h
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
build: fix hard-coded usage of "gen_context" The binary needs an extension on some platforms.
2015-07-31 13:33:58 -04:00
src/ecmult_static_context.h: $(gen_context_BIN)
./$(gen_context_BIN)
Add gen_context src/ecmult_static_context.h to CLEANFILES to fix distclean.
2015-07-16 00:05:32 +00:00
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
CLEANFILES = $(gen_context_BIN) src/ecmult_static_context.h $(JAVAROOT)/$(JAVAORG)/*.class .stamp-java
Add ability to use a statically generated ecmult context. This vastly shrinks the size of the context required for signing on devices with memory-mapped Flash. Tables are generated by the new gen_context tool into a header.
2015-05-19 17:32:35 -07:00
endif
JNI library Squashed and rebased. Thanks to @theuni and @faizkhan00 for doing the majority of work here! Also thanks to @btchip for help with debugging and review.
2014-12-16 22:23:17 -05:00
EXTRA_DIST = autogen.sh src/gen_context.c src/basic-config.h $(JAVA_FILES)
Add ECDH module which works by hashing the output of ecmult_const
2015-06-29 15:06:28 -05:00
if ENABLE_MODULE_ECDH
include src/modules/ecdh/Makefile.am.include
endif
Add support for custom EC-Schnorr-SHA256 signatures
2015-07-24 15:44:49 +02:00
Move pubkey recovery code to separate module
2015-08-27 03:42:57 +02:00
if ENABLE_MODULE_RECOVERY
include src/modules/recovery/Makefile.am.include
endif
Pedersen commitments, borromean ring signatures, and ZK range proofs. This commit adds three new cryptosystems to libsecp256k1: Pedersen commitments are a system for making blinded commitments to a value. Functionally they work like: commit_b,v = H(blind_b || value_v), except they are additively homorphic, e.g. C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and C(b1, v1) - C(b1, v1) = 0, etc. The commitments themselves are EC points, serialized as 33 bytes. In addition to the commit function this implementation includes utility functions for verifying that a set of commitments sums to zero, and for picking blinding factors that sum to zero. If the blinding factors are uniformly random, pedersen commitments have information theoretic privacy. Borromean ring signatures are a novel efficient ring signature construction for AND/OR admissions policies (the code here implements an AND of ORs, each of any size). This construction requires 32 bytes of signature per pubkey used plus 32 bytes of constant overhead. With these you can construct signatures like "Given pubkeys A B C D E F G, the signer knows the discrete logs satisifying (A || B) & (C || D || E) & (F || G)". ZK range proofs allow someone to prove a pedersen commitment is in a particular range (e.g. [0..2^64)) without revealing the specific value. The construction here is based on the above borromean ring signature and uses a radix-4 encoding and other optimizations to maximize efficiency. It also supports encoding proofs with a non-private base-10 exponent and minimum-value to allow trading off secrecy for size and speed (or just avoiding wasting space keeping data private that was already public due to external constraints). A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of this can be used to communicate a private message to a receiver who shares a secret random seed with the prover.
2015-08-05 19:04:14 +02:00
Constant-time generator module
2016-07-07 00:47:41 +02:00
if ENABLE_MODULE_GENERATOR
include src/modules/generator/Makefile.am.include
endif
Pedersen commitments, borromean ring signatures, and ZK range proofs. This commit adds three new cryptosystems to libsecp256k1: Pedersen commitments are a system for making blinded commitments to a value. Functionally they work like: commit_b,v = H(blind_b || value_v), except they are additively homorphic, e.g. C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and C(b1, v1) - C(b1, v1) = 0, etc. The commitments themselves are EC points, serialized as 33 bytes. In addition to the commit function this implementation includes utility functions for verifying that a set of commitments sums to zero, and for picking blinding factors that sum to zero. If the blinding factors are uniformly random, pedersen commitments have information theoretic privacy. Borromean ring signatures are a novel efficient ring signature construction for AND/OR admissions policies (the code here implements an AND of ORs, each of any size). This construction requires 32 bytes of signature per pubkey used plus 32 bytes of constant overhead. With these you can construct signatures like "Given pubkeys A B C D E F G, the signer knows the discrete logs satisifying (A || B) & (C || D || E) & (F || G)". ZK range proofs allow someone to prove a pedersen commitment is in a particular range (e.g. [0..2^64)) without revealing the specific value. The construction here is based on the above borromean ring signature and uses a radix-4 encoding and other optimizations to maximize efficiency. It also supports encoding proofs with a non-private base-10 exponent and minimum-value to allow trading off secrecy for size and speed (or just avoiding wasting space keeping data private that was already public due to external constraints). A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of this can be used to communicate a private message to a receiver who shares a secret random seed with the prover.
2015-08-05 19:04:14 +02:00
if ENABLE_MODULE_RANGEPROOF
include src/modules/rangeproof/Makefile.am.include
endif
Implement ring-signature based whitelist delegation scheme
2016-04-21 22:22:39 +00:00
if ENABLE_MODULE_WHITELIST
include src/modules/whitelist/Makefile.am.include
endif
add surjection proof module Includes fix and tests by Jonas Nick.
2016-07-01 15:51:07 +00:00
if ENABLE_MODULE_SURJECTIONPROOF
include src/modules/surjection/Makefile.am.include
endif
Reference in New Issue Copy Permalink