frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modules, tests: Port bitcoin-core/secp256k1#1777 and bitcoin-core/secp256k1#1824 to zkp-specific code

Browse Source
This commit is contained in:
DarkWindman
2026-04-02 18:03:37 +03:00
parent f7e7e6bb15
commit baac08d207
28 changed files with 259 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/modules/bppp/bppp_norm_product_impl.h
View File

@@ -236,6 +236,7 @@ static int secp256k1_bppp_rangeproof_norm_product_prove(
secp256k1_scalar* c_vec,
size_t c_vec_len
) {
const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
secp256k1_scalar mu_f, rho_f = *rho;
size_t proof_idx = 0;
ecmult_x_cb_data x_cb_data;
@@ -316,8 +317,8 @@ static int secp256k1_bppp_rangeproof_norm_product_prove(
proof_idx += 65;
/* Obtain challenge gamma for the the next round */
secp256k1_sha256_write(transcript, &proof[proof_idx - 65], 65);
secp256k1_bppp_challenge_scalar(&gamma, transcript, 0);
secp256k1_sha256_write(hash_ctx, transcript, &proof[proof_idx - 65], 65);
secp256k1_bppp_challenge_scalar(hash_ctx, &gamma, transcript, 0);
if (g_len > 1) {
for (i = 0; i < g_len; i = i + 2) {
@@ -434,6 +435,7 @@ static int secp256k1_bppp_rangeproof_norm_product_verify(
size_t c_vec_len,
const secp256k1_ge* commit
) {
const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
secp256k1_scalar rho_f, mu_f, v, n, l, rho_inv, h_c;
secp256k1_scalar *gammas, *s_g, *s_h, *rho_inv_pows;
secp256k1_gej res1, res2;
@@ -487,8 +489,8 @@ static int secp256k1_bppp_rangeproof_norm_product_verify(
for (i = 0; i < n_rounds; i++) {
secp256k1_scalar gamma;
secp256k1_sha256_write(transcript, &proof[i * 65], 65);
secp256k1_bppp_challenge_scalar(&gamma, transcript, 0);
secp256k1_sha256_write(hash_ctx, transcript, &proof[i * 65], 65);
secp256k1_bppp_challenge_scalar(hash_ctx, &gamma, transcript, 0);
gammas[i] = gamma;
}
/* s_g[0] = n * \prod_{j=0}^{log_g_len - 1} rho^(2^j)

6
src/modules/bppp/bppp_transcript_impl.h
View File

@@ -22,12 +22,12 @@ static void secp256k1_bppp_sha256_tagged_commitment_init(secp256k1_sha256 *sha)
}
/* Obtain a challenge scalar from the current transcript.*/
static void secp256k1_bppp_challenge_scalar(secp256k1_scalar* ch, const secp256k1_sha256 *transcript, uint64_t idx) {
static void secp256k1_bppp_challenge_scalar(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar* ch, const secp256k1_sha256 *transcript, uint64_t idx) {
unsigned char buf[32];
secp256k1_sha256 sha = *transcript;
secp256k1_bppp_le64(buf, idx);
secp256k1_sha256_write(&sha, buf, 8);
secp256k1_sha256_finalize(&sha, buf);
secp256k1_sha256_write(hash_ctx, &sha, buf, 8);
secp256k1_sha256_finalize(hash_ctx, &sha, buf);
secp256k1_sha256_clear(&sha);
secp256k1_scalar_set_b32(ch, buf, NULL);
}

5
src/modules/bppp/main_impl.h
View File

@@ -18,6 +18,7 @@
secp256k1_bppp_generators *secp256k1_bppp_generators_create(const secp256k1_context *ctx, size_t n) {
secp256k1_bppp_generators *ret;
secp256k1_rfc6979_hmac_sha256 rng;
const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
unsigned char seed[64];
size_t i;
@@ -37,11 +38,11 @@ secp256k1_bppp_generators *secp256k1_bppp_generators_create(const secp256k1_cont
secp256k1_fe_get_b32(&seed[0], &secp256k1_ge_const_g.x);
secp256k1_fe_get_b32(&seed[32], &secp256k1_ge_const_g.y);
secp256k1_rfc6979_hmac_sha256_initialize(&rng, seed, 64);
secp256k1_rfc6979_hmac_sha256_initialize(hash_ctx, &rng, seed, 64);
for (i = 0; i < n; i++) {
secp256k1_generator gen;
unsigned char tmp[32] = { 0 };
secp256k1_rfc6979_hmac_sha256_generate(&rng, tmp, 32);
secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, tmp, 32);
CHECK(secp256k1_generator_generate(ctx, &gen, tmp));
secp256k1_generator_load(&ret->gens[i], &gen);
}

34
src/modules/bppp/tests_impl.h
View File

@@ -104,6 +104,7 @@ static void test_bppp_generators_fixed(void) {
}
static void test_bppp_tagged_hash(void) {
const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
unsigned char tag_data[] = {'B', 'u', 'l', 'l', 'e', 't', 'p', 'r', 'o', 'o', 'f', 's', '_', 'p', 'p', '/', 'v', '0', '/', 'c', 'o', 'm', 'm', 'i', 't', 'm', 'e', 'n', 't'};
secp256k1_sha256 sha;
secp256k1_sha256 sha_cached;
@@ -111,10 +112,10 @@ static void test_bppp_tagged_hash(void) {
unsigned char output_cached[32];
secp256k1_scalar s;
secp256k1_sha256_initialize_tagged(&sha, tag_data, sizeof(tag_data));
secp256k1_sha256_initialize_tagged(hash_ctx, &sha, tag_data, sizeof(tag_data));
secp256k1_bppp_sha256_tagged_commitment_init(&sha_cached);
secp256k1_sha256_finalize(&sha, output);
secp256k1_sha256_finalize(&sha_cached, output_cached);
secp256k1_sha256_finalize(hash_ctx, &sha, output);
secp256k1_sha256_finalize(hash_ctx, &sha_cached, output_cached);
CHECK(secp256k1_memcmp_var(output, output_cached, 32) == 0);
{
@@ -123,7 +124,7 @@ static void test_bppp_tagged_hash(void) {
0x8A, 0x41, 0xC6, 0x85, 0x1A, 0x79, 0x14, 0xFC,
0x48, 0x15, 0xC7, 0x2D, 0xF8, 0x63, 0x8F, 0x1B };
secp256k1_bppp_sha256_tagged_commitment_init(&sha);
secp256k1_bppp_challenge_scalar(&s, &sha, 0);
secp256k1_bppp_challenge_scalar(hash_ctx, &s, &sha, 0);
secp256k1_scalar_get_b32(output, &s);
CHECK(secp256k1_memcmp_var(output, expected, sizeof(output)) == 0);
}
@@ -134,8 +135,8 @@ static void test_bppp_tagged_hash(void) {
0x72, 0x7E, 0x3E, 0xB7, 0x10, 0x03, 0xF0, 0xE9,
0x69, 0x4D, 0xAA, 0x96, 0xCE, 0x98, 0xBB, 0x39,
0x1C, 0x2F, 0x7C, 0x2E, 0x1C, 0x17, 0x78, 0x6D };
secp256k1_sha256_write(&sha, tmp, sizeof(tmp));
secp256k1_bppp_challenge_scalar(&s, &sha, 0);
secp256k1_sha256_write(hash_ctx, &sha, tmp, sizeof(tmp));
secp256k1_bppp_challenge_scalar(hash_ctx, &s, &sha, 0);
secp256k1_scalar_get_b32(output, &s);
CHECK(secp256k1_memcmp_var(output, expected, sizeof(output)) == 0);
}
@@ -279,6 +280,7 @@ static void secp256k1_norm_arg_commit_initial_data(
const secp256k1_ge* commit
) {
/* Commit to the initial public values */
const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
unsigned char ser_commit[33], ser_scalar[32], ser_le64[8];
size_t i;
secp256k1_ge comm = *commit;
@@ -287,24 +289,24 @@ static void secp256k1_norm_arg_commit_initial_data(
secp256k1_fe_normalize(&comm.y);
CHECK(secp256k1_ge_is_infinity(&comm) == 0);
CHECK(secp256k1_bppp_serialize_pt(&ser_commit[0], &comm));
secp256k1_sha256_write(transcript, ser_commit, 33);
secp256k1_sha256_write(hash_ctx, transcript, ser_commit, 33);
secp256k1_scalar_get_b32(ser_scalar, rho);
secp256k1_sha256_write(transcript, ser_scalar, 32);
secp256k1_sha256_write(hash_ctx, transcript, ser_scalar, 32);
secp256k1_bppp_le64(ser_le64, g_len);
secp256k1_sha256_write(transcript, ser_le64, 8);
secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
secp256k1_bppp_le64(ser_le64, gens_vec->n);
secp256k1_sha256_write(transcript, ser_le64, 8);
secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
for (i = 0; i < gens_vec->n; i++) {
secp256k1_fe_normalize(&gens_vec->gens[i].x);
secp256k1_fe_normalize(&gens_vec->gens[i].y);
CHECK(secp256k1_bppp_serialize_pt(&ser_commit[0], &gens_vec->gens[i]));
secp256k1_sha256_write(transcript, ser_commit, 33);
secp256k1_sha256_write(hash_ctx, transcript, ser_commit, 33);
}
secp256k1_bppp_le64(ser_le64, c_vec_len);
secp256k1_sha256_write(transcript, ser_le64, 8);
secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
for (i = 0; i < c_vec_len; i++) {
secp256k1_scalar_get_b32(ser_scalar, &c_vec[i]);
secp256k1_sha256_write(transcript, ser_scalar, 32);
secp256k1_sha256_write(hash_ctx, transcript, ser_scalar, 32);
}
}
@@ -561,7 +563,7 @@ int norm_arg_verify_vectors_helper(secp256k1_scratch *scratch, const unsigned ch
return ret;
}
#define IDX_TO_TEST(i) (norm_arg_verify_vectors_helper(scratch, verify_vector_gens, verify_vector_##i##_proof, sizeof(verify_vector_##i##_proof), verify_vector_##i##_r32, verify_vector_##i##_n_vec_len, verify_vector_##i##_c_vec32, verify_vector_##i##_c_vec, sizeof(verify_vector_##i##_c_vec)/sizeof(secp256k1_scalar), verify_vector_##i##_commit33) == verify_vector_##i##_result)
#define IDX_TO_TEST(i) (norm_arg_verify_vectors_helper(scratch, verify_vector_gens, verify_vector_##i##_proof, sizeof(verify_vector_##i##_proof), verify_vector_##i##_r32, verify_vector_##i##_n_vec_len, verify_vector_##i##_c_vec32, verify_vector_##i##_c_vec, ARRAY_SIZE(verify_vector_##i##_c_vec), verify_vector_##i##_commit33) == verify_vector_##i##_result)
static void norm_arg_verify_vectors(void) {
secp256k1_scratch *scratch = secp256k1_scratch_space_create(CTX, 1000*1000); /* shouldn't need much */
@@ -629,9 +631,9 @@ static void norm_arg_prove_vectors_helper(secp256k1_scratch *scratch, const unsi
#define IDX_TO_TEST(i) (norm_arg_prove_vectors_helper(scratch, prove_vector_gens, prove_vector_##i##_proof, sizeof(prove_vector_##i##_proof), prove_vector_##i##_r32,\
prove_vector_##i##_n_vec32, prove_vector_##i##_n_vec, sizeof(prove_vector_##i##_n_vec)/sizeof(secp256k1_scalar),\
prove_vector_##i##_n_vec32, prove_vector_##i##_n_vec, ARRAY_SIZE(prove_vector_##i##_n_vec),\
prove_vector_##i##_l_vec32, prove_vector_##i##_l_vec,\
prove_vector_##i##_c_vec32, prove_vector_##i##_c_vec, sizeof(prove_vector_##i##_c_vec)/sizeof(secp256k1_scalar), \
prove_vector_##i##_c_vec32, prove_vector_##i##_c_vec, ARRAY_SIZE(prove_vector_##i##_c_vec), \
prove_vector_##i##_result))
static void norm_arg_prove_vectors(void) {