frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commits 'b314cf28 1f1bb78b 40f50d0f c891c5c2 ea47c82e e7210393 c1b49664 5814d848 07687e81 10e6d29b d3e29db8 e2c9888e 4197d667 5e9a4d7a 77af1da9 1a81df82 1ad5185c efe85c70 79e09451 d373bf6d 74b7c3b5 a9db9f2d 44378867 3bf4d68f e4af41c6 ' into temp-merge-1249

Browse Source
This commit is contained in:
Tim Ruffing
2024-01-18 10:25:34 +01:00
parent 0ffca6f794 e4af41c61b
commit e626f00d1e
53 changed files with 1550 additions and 1583 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/modules/bppp/bppp_norm_product_impl.h
View File

@@ -118,7 +118,11 @@ static int secp256k1_bppp_commit(
secp256k1_scalar v, l_c;
/* First n_vec_len generators are Gs, rest are Hs*/
VERIFY_CHECK(g_vec->n == (n_vec_len + l_vec_len));
#ifdef VERIFY
VERIFY_CHECK(l_vec_len == c_vec_len);
#else
(void)c_vec_len;
#endif
/* It is possible to extend to support n_vec and c_vec to not be power of
two. For the initial iterations of the code, we stick to powers of two for simplicity.*/
@@ -238,17 +242,23 @@ static int secp256k1_bppp_rangeproof_norm_product_prove(
ecmult_r_cb_data r_cb_data;
size_t g_len = n_vec_len, h_len = l_vec_len;
const size_t G_GENS_LEN = g_len;
size_t log_g_len, log_h_len;
size_t num_rounds;
VERIFY_CHECK(g_len > 0 && h_len > 0);
log_g_len = secp256k1_bppp_log2(g_len);
log_h_len = secp256k1_bppp_log2(h_len);
num_rounds = log_g_len > log_h_len ? log_g_len : log_h_len;
/* Check proof sizes.*/
VERIFY_CHECK(*proof_len >= 65 * num_rounds + 64);
VERIFY_CHECK(g_vec_len == (n_vec_len + l_vec_len) && l_vec_len == c_vec_len);
VERIFY_CHECK(secp256k1_is_power_of_two(n_vec_len) && secp256k1_is_power_of_two(c_vec_len));
#ifdef VERIFY
{
size_t log_g_len_ver, log_h_len_ver, num_rounds_ver;
VERIFY_CHECK(g_len > 0 && h_len > 0); /* Precondition for secp256k1_bppp_log2() */
log_g_len_ver = secp256k1_bppp_log2(g_len);
log_h_len_ver = secp256k1_bppp_log2(h_len);
num_rounds_ver = log_g_len_ver > log_h_len_ver ? log_g_len_ver : log_h_len_ver;
/* Check proof sizes.*/
VERIFY_CHECK(*proof_len >= 65 * num_rounds_ver + 64);
VERIFY_CHECK(g_vec_len == (n_vec_len + l_vec_len) && l_vec_len == c_vec_len);
VERIFY_CHECK(secp256k1_is_power_of_two(n_vec_len) && secp256k1_is_power_of_two(c_vec_len));
}
#else
(void)g_vec_len;
(void)c_vec_len;
#endif
x_cb_data.n = n_vec;
x_cb_data.g = g_vec;
@@ -536,9 +546,6 @@ static int secp256k1_bppp_rangeproof_norm_product_verify(
secp256k1_scratch_apply_checkpoint(&ctx->error_callback, scratch, scratch_checkpoint);
/* res1 and res2 should be equal. Could not find a simpler way to compare them */
secp256k1_gej_neg(&res1, &res1);
secp256k1_gej_add_var(&res1, &res1, &res2, NULL);
return secp256k1_gej_is_infinity(&res1);
return secp256k1_gej_eq_var(&res1, &res2);
}
#endif

6
src/modules/bppp/tests_impl.h
View File

@@ -60,7 +60,7 @@ static void test_bppp_generators_api(void) {
/* Check that round-trip succeeded */
CHECK(gens->n == gens_orig->n);
for (len = 0; len < gens->n; len++) {
ge_equals_ge(&gens->gens[len], &gens_orig->gens[len]);
secp256k1_ge_eq_var(&gens->gens[len], &gens_orig->gens[len]);
}
/* Destroy (we allow destroying a NULL context, it's just a noop. like free().) */
@@ -199,8 +199,8 @@ static void test_serialize_two_points_roundtrip(secp256k1_ge *X, secp256k1_ge *R
secp256k1_bppp_serialize_points(buf, X, R);
CHECK(secp256k1_bppp_parse_one_of_points(&X_tmp, buf, 0));
CHECK(secp256k1_bppp_parse_one_of_points(&R_tmp, buf, 1));
ge_equals_ge(X, &X_tmp);
ge_equals_ge(R, &R_tmp);
secp256k1_ge_eq_var(X, &X_tmp);
secp256k1_ge_eq_var(R, &R_tmp);
}
static void test_serialize_two_points(void) {

21
src/modules/ellswift/main_impl.h
View File

@@ -126,9 +126,8 @@ static void secp256k1_ellswift_xswiftec_frac_var(secp256k1_fe *xn, secp256k1_fe
secp256k1_fe_mul(&l, &p, &u1); /* l = u*(g+s) */
secp256k1_fe_add(&n, &l); /* n = u*(c1*s+c2*g)+u*(g+s) */
secp256k1_fe_negate(xn, &n, 2); /* n = -u*(c1*s+c2*g)-u*(g+s) */
#ifdef VERIFY
VERIFY_CHECK(secp256k1_ge_x_frac_on_curve_var(xn, &p));
#endif
/* Return x3 = n/p = -(u*(c1*s+c2*g)/(g+s)+u) */
}
@@ -193,10 +192,8 @@ static int secp256k1_ellswift_xswiftec_inv_var(secp256k1_fe *t, const secp256k1_
secp256k1_fe_normalize_weak(&x);
secp256k1_fe_normalize_weak(&u);
#ifdef VERIFY
VERIFY_CHECK(c >= 0 && c < 8);
VERIFY_CHECK(secp256k1_ge_x_on_curve_var(&x));
#endif
if (!(c & 2)) {
/* c is in {0, 1, 4, 5}. In this case we look for an inverse under the x1 (if c=0 or
@@ -230,9 +227,7 @@ static int secp256k1_ellswift_xswiftec_inv_var(secp256k1_fe *t, const secp256k1_
* that (-u-x)^3 + B is not square (the secp256k1_ge_x_on_curve_var(&m)
* test above would have failed). This is a contradiction, and thus the
* assumption s=0 is false. */
#ifdef VERIFY
VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(&s));
#endif
/* If s is not square, fail. We have not fully computed s yet, but s is square iff
* -(u^3+7)*(u^2+u*x+x^2) is square (because a/b is square iff a*b is square and b is
@@ -272,7 +267,11 @@ static int secp256k1_ellswift_xswiftec_inv_var(secp256k1_fe *t, const secp256k1_
secp256k1_fe_negate(&q, &q, 1); /* q = -s*(4*(u^3+7)+3*u^2*s) */
if (!secp256k1_fe_is_square_var(&q)) return 0;
ret = secp256k1_fe_sqrt(&r, &q); /* r = sqrt(-s*(4*(u^3+7)+3*u^2*s)) */
#ifdef VERIFY
VERIFY_CHECK(ret);
#else
(void)ret;
#endif
/* If (c & 1) = 1 and r = 0, fail. */
if (EXPECT((c & 1) && secp256k1_fe_normalizes_to_zero_var(&r), 0)) return 0;
@@ -320,10 +319,9 @@ static void secp256k1_ellswift_prng(unsigned char* out32, const secp256k1_sha256
buf4[3] = cnt >> 24;
secp256k1_sha256_write(&hash, buf4, 4);
secp256k1_sha256_finalize(&hash, out32);
#ifdef VERIFY
/* Writing and finalizing together should trigger exactly one SHA256 compression. */
VERIFY_CHECK(((hash.bytes) >> 6) == (blocks + 1));
#endif
}
/** Find an ElligatorSwift encoding (u, t) for X coordinate x, and random Y coordinate.
@@ -361,9 +359,8 @@ static void secp256k1_ellswift_xelligatorswift_var(unsigned char *u32, secp256k1
/* Since u is the output of a hash, it should practically never be 0. We could apply the
* u=0 to u=1 correction here too to deal with that case still, but it's such a low
* probability event that we do not bother. */
#ifdef VERIFY
VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(&u));
#endif
/* Find a remainder t, and return it if found. */
if (EXPECT(secp256k1_ellswift_xswiftec_inv_var(t, x, &u, branch), 0)) break;
}
@@ -417,7 +414,11 @@ int secp256k1_ellswift_encode(const secp256k1_context *ctx, unsigned char *ell64
* BIP340 tagged hash with tag "secp256k1_ellswift_encode". */
secp256k1_ellswift_sha256_init_encode(&hash);
ser_ret = secp256k1_eckey_pubkey_serialize(&p, p64, &ser_size, 1);
#ifdef VERIFY
VERIFY_CHECK(ser_ret && ser_size == 33);
#else
(void)ser_ret;
#endif
secp256k1_sha256_write(&hash, p64, sizeof(p64));
secp256k1_sha256_write(&hash, rnd32, 32);

2
src/modules/ellswift/tests_exhaustive_impl.h
View File

@@ -32,7 +32,7 @@ static void test_exhaustive_ellswift(const secp256k1_context *ctx, const secp256
/* Decode ellswift pubkey and check that it matches the precomputed group element. */
secp256k1_ellswift_decode(ctx, &pub_decoded, ell64);
secp256k1_pubkey_load(ctx, &ge_decoded, &pub_decoded);
ge_equals_ge(&ge_decoded, &group[i]);
CHECK(secp256k1_ge_eq_var(&ge_decoded, &group[i]));
}
}

6
src/modules/ellswift/tests_impl.h
View File

@@ -237,7 +237,7 @@ void run_ellswift_tests(void) {
secp256k1_ellswift_decode(CTX, &pubkey2, ell64);
secp256k1_pubkey_load(CTX, &g2, &pubkey2);
/* Compare with original. */
ge_equals_ge(&g, &g2);
CHECK(secp256k1_ge_eq_var(&g, &g2));
}
/* Verify the behavior of secp256k1_ellswift_create */
for (i = 0; i < 400 * COUNT; i++) {
@@ -259,7 +259,7 @@ void run_ellswift_tests(void) {
secp256k1_ellswift_decode(CTX, &pub, ell64);
secp256k1_pubkey_load(CTX, &dec, &pub);
secp256k1_ecmult(&res, NULL, &secp256k1_scalar_zero, &sec);
ge_equals_gej(&dec, &res);
CHECK(secp256k1_gej_eq_ge_var(&res, &dec));
}
/* Verify that secp256k1_ellswift_xdh computes the right shared X coordinate. */
for (i = 0; i < 800 * COUNT; i++) {
@@ -285,7 +285,7 @@ void run_ellswift_tests(void) {
ret = secp256k1_ellswift_xdh(CTX, share32, ell64, ell64, sec32, i & 1, &ellswift_xdh_hash_x32, NULL);
CHECK(ret);
(void)secp256k1_fe_set_b32_limit(&share_x, share32); /* no overflow is possible */
secp256k1_fe_verify(&share_x);
SECP256K1_FE_VERIFY(&share_x);
/* Compute seckey*pubkey directly. */
secp256k1_ecmult(&resj, &decj, &sec, NULL);
secp256k1_ge_set_gej(&res, &resj);

2
src/modules/musig/keyagg_impl.h
View File

@@ -169,10 +169,8 @@ static void secp256k1_musig_keyaggcoef_internal(secp256k1_scalar *r, const unsig
secp256k1_sha256 sha;
VERIFY_CHECK(!secp256k1_ge_is_infinity(pk));
#ifdef VERIFY
VERIFY_CHECK(pk->x.normalized && pk->y.normalized);
VERIFY_CHECK(secp256k1_ge_is_infinity(second_pk) || (second_pk->x.normalized && second_pk->y.normalized));
#endif
if (!secp256k1_ge_is_infinity(second_pk)
&& secp256k1_fe_equal(&pk->x, &second_pk->x)

4
src/modules/surjection/surjection_impl.h
View File

@@ -82,8 +82,12 @@ SECP256K1_INLINE static int secp256k1_surjection_compute_public_keys(secp256k1_g
j++;
}
}
#ifdef VERIFY
/* Caller needs to ensure that the number of set bits in used_tags (which we counted in j) equals n_pubkeys. */
VERIFY_CHECK(j == n_pubkeys);
#else
(void)n_pubkeys;
#endif
return 1;
}