mirror of
				https://source.quilibrium.com/quilibrium/ceremonyclient.git
				synced 2025-11-04 11:37:27 +00:00 
			
		
		
		
	
		
			
				
	
	
		
			273 lines
		
	
	
		
			6.1 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			273 lines
		
	
	
		
			6.1 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
//
 | 
						|
// Copyright Coinbase, Inc. All Rights Reserved.
 | 
						|
//
 | 
						|
// SPDX-License-Identifier: Apache-2.0
 | 
						|
//
 | 
						|
 | 
						|
package core
 | 
						|
 | 
						|
import (
 | 
						|
	"bytes"
 | 
						|
	"crypto/elliptic"
 | 
						|
	"crypto/sha256"
 | 
						|
	"fmt"
 | 
						|
	"hash"
 | 
						|
	"math"
 | 
						|
	"math/big"
 | 
						|
 | 
						|
	"github.com/btcsuite/btcd/btcec"
 | 
						|
	"golang.org/x/crypto/hkdf"
 | 
						|
 | 
						|
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/internal"
 | 
						|
)
 | 
						|
 | 
						|
type HashField struct {
 | 
						|
	// F_p^k
 | 
						|
	Order           *big.Int // p^k
 | 
						|
	Characteristic  *big.Int // p
 | 
						|
	ExtensionDegree *big.Int // k
 | 
						|
}
 | 
						|
 | 
						|
type Params struct {
 | 
						|
	F                 *HashField
 | 
						|
	SecurityParameter int
 | 
						|
	Hash              func() hash.Hash
 | 
						|
	L                 int
 | 
						|
}
 | 
						|
 | 
						|
func getParams(curve elliptic.Curve) (*Params, error) {
 | 
						|
	switch curve.Params().Name {
 | 
						|
	case btcec.S256().Name, elliptic.P256().Params().Name:
 | 
						|
		return &Params{
 | 
						|
			F: &HashField{
 | 
						|
				Order:           curve.Params().P,
 | 
						|
				Characteristic:  curve.Params().P,
 | 
						|
				ExtensionDegree: new(big.Int).SetInt64(1),
 | 
						|
			},
 | 
						|
			SecurityParameter: 128,
 | 
						|
			Hash:              sha256.New,
 | 
						|
			L:                 48,
 | 
						|
		}, nil
 | 
						|
	case "Bls12381G1":
 | 
						|
		return &Params{
 | 
						|
			F: &HashField{
 | 
						|
				Order:           curve.Params().P,
 | 
						|
				Characteristic:  curve.Params().P,
 | 
						|
				ExtensionDegree: new(big.Int).SetInt64(1),
 | 
						|
			},
 | 
						|
			SecurityParameter: 128,
 | 
						|
			Hash:              sha256.New,
 | 
						|
			L:                 48,
 | 
						|
		}, nil
 | 
						|
	case "ed25519":
 | 
						|
		return &Params{
 | 
						|
			F: &HashField{
 | 
						|
				Order:           curve.Params().P,
 | 
						|
				Characteristic:  curve.Params().P,
 | 
						|
				ExtensionDegree: new(big.Int).SetInt64(1),
 | 
						|
			},
 | 
						|
			SecurityParameter: 128,
 | 
						|
			Hash:              sha256.New,
 | 
						|
			L:                 48,
 | 
						|
		}, nil
 | 
						|
	default:
 | 
						|
		return nil, fmt.Errorf("Not implemented: %s", curve.Params().Name)
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
func I2OSP(b, n int) []byte {
 | 
						|
	os := new(big.Int).SetInt64(int64(b)).Bytes()
 | 
						|
	if n > len(os) {
 | 
						|
		var buf bytes.Buffer
 | 
						|
		buf.Write(make([]byte, n-len(os)))
 | 
						|
		buf.Write(os)
 | 
						|
		return buf.Bytes()
 | 
						|
	}
 | 
						|
	return os[:n]
 | 
						|
}
 | 
						|
 | 
						|
func OS2IP(os []byte) *big.Int {
 | 
						|
	return new(big.Int).SetBytes(os)
 | 
						|
}
 | 
						|
 | 
						|
func hashThis(f func() hash.Hash, this []byte) ([]byte, error) {
 | 
						|
	h := f()
 | 
						|
	w, err := h.Write(this)
 | 
						|
	if w != len(this) {
 | 
						|
		return nil, fmt.Errorf("bytes written to hash doesn't match expected")
 | 
						|
	} else if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
	v := h.Sum(nil)
 | 
						|
	return v, nil
 | 
						|
}
 | 
						|
 | 
						|
func concat(xs ...[]byte) []byte {
 | 
						|
	var result []byte
 | 
						|
	for _, x := range xs {
 | 
						|
		result = append(result, x...)
 | 
						|
	}
 | 
						|
	return result
 | 
						|
}
 | 
						|
 | 
						|
func xor(b1, b2 []byte) []byte {
 | 
						|
	// b1 and b2 must be same length
 | 
						|
	result := make([]byte, len(b1))
 | 
						|
	for i := range b1 {
 | 
						|
		result[i] = b1[i] ^ b2[i]
 | 
						|
	}
 | 
						|
 | 
						|
	return result
 | 
						|
}
 | 
						|
 | 
						|
func ExpandMessageXmd(f func() hash.Hash, msg, DST []byte, lenInBytes int) ([]byte, error) {
 | 
						|
	// https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-10#section-5.4.1
 | 
						|
 | 
						|
	// step 1
 | 
						|
	ell := int(math.Ceil(float64(lenInBytes) / float64(f().Size())))
 | 
						|
 | 
						|
	//step 2
 | 
						|
	if ell > 255 {
 | 
						|
		return nil, fmt.Errorf("ell > 255")
 | 
						|
	}
 | 
						|
 | 
						|
	// step 3
 | 
						|
	dstPrime := append(DST, I2OSP(len(DST), 1)...)
 | 
						|
 | 
						|
	// step 4
 | 
						|
	zPad := I2OSP(0, f().BlockSize())
 | 
						|
 | 
						|
	// step 5 & 6
 | 
						|
	msgPrime := concat(zPad, msg, I2OSP(lenInBytes, 2), I2OSP(0, 1), dstPrime)
 | 
						|
 | 
						|
	var err error
 | 
						|
 | 
						|
	b := make([][]byte, ell+1)
 | 
						|
 | 
						|
	// step 7
 | 
						|
	b[0], err = hashThis(f, msgPrime)
 | 
						|
	if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
 | 
						|
	// step 8
 | 
						|
	b[1], err = hashThis(f, concat(b[0], I2OSP(1, 1), dstPrime))
 | 
						|
	if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
 | 
						|
	// step 9
 | 
						|
	for i := 2; i <= ell; i++ {
 | 
						|
		// step 10
 | 
						|
		b[i], err = hashThis(f, concat(xor(b[0], b[i-1]), I2OSP(i, 1), dstPrime))
 | 
						|
		if err != nil {
 | 
						|
			return nil, err
 | 
						|
		}
 | 
						|
	}
 | 
						|
	// step 11
 | 
						|
	uniformBytes := concat(b[1:]...)
 | 
						|
 | 
						|
	// step 12
 | 
						|
	return uniformBytes[:lenInBytes], nil
 | 
						|
}
 | 
						|
 | 
						|
func hashToField(msg []byte, count int, curve elliptic.Curve) ([][]*big.Int, error) {
 | 
						|
	// https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-10#section-5.3
 | 
						|
 | 
						|
	parameters, err := getParams(curve)
 | 
						|
	if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
 | 
						|
	f := parameters.Hash
 | 
						|
 | 
						|
	DST := []byte("Coinbase_tECDSA")
 | 
						|
 | 
						|
	m := int(parameters.F.ExtensionDegree.Int64())
 | 
						|
	L := parameters.L
 | 
						|
 | 
						|
	// step 1
 | 
						|
	lenInBytes := count * m * L
 | 
						|
 | 
						|
	// step 2
 | 
						|
	uniformBytes, err := ExpandMessageXmd(f, msg, DST, lenInBytes)
 | 
						|
	if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
 | 
						|
	u := make([][]*big.Int, count)
 | 
						|
 | 
						|
	// step 3
 | 
						|
	for i := 0; i < count; i++ {
 | 
						|
		e := make([]*big.Int, m)
 | 
						|
		// step 4
 | 
						|
		for j := 0; j < m; j++ {
 | 
						|
			// step 5
 | 
						|
			elmOffset := L * (j + i*m)
 | 
						|
			// step 6
 | 
						|
			tv := uniformBytes[elmOffset : elmOffset+L]
 | 
						|
			// step 7
 | 
						|
			e[j] = new(big.Int).Mod(OS2IP(tv), parameters.F.Characteristic)
 | 
						|
 | 
						|
		}
 | 
						|
		// step 8
 | 
						|
		u[i] = e
 | 
						|
	}
 | 
						|
	// step 9
 | 
						|
	return u, nil
 | 
						|
}
 | 
						|
 | 
						|
func Hash(msg []byte, curve elliptic.Curve) (*big.Int, error) {
 | 
						|
	u, err := hashToField(msg, 1, curve)
 | 
						|
	if err != nil {
 | 
						|
		return nil, err
 | 
						|
	}
 | 
						|
	return u[0][0], nil
 | 
						|
}
 | 
						|
 | 
						|
// fiatShamir computes the HKDF over many values
 | 
						|
// iteratively such that each value is hashed separately
 | 
						|
// and based on preceding values
 | 
						|
//
 | 
						|
// The first value is computed as okm_0 = KDF(f || value) where
 | 
						|
// f is a byte slice of 32 0xFF
 | 
						|
// salt is zero-filled byte slice with length equal to the hash output length
 | 
						|
// info is the protocol name
 | 
						|
// okm is the 32 byte output
 | 
						|
//
 | 
						|
// The each subsequent iteration is computed by as okm_i = KDF(f_i || value || okm_{i-1})
 | 
						|
// where f_i = 2^b - 1 - i such that there are 0xFF bytes prior to the value.
 | 
						|
// f_1 changes the first byte to 0xFE, f_2 to 0xFD. The previous okm is appended to the value
 | 
						|
// to provide cryptographic domain separation.
 | 
						|
// See https://signal.org/docs/specifications/x3dh/#cryptographic-notation
 | 
						|
// and https://signal.org/docs/specifications/xeddsa/#hash-functions
 | 
						|
// for more details.
 | 
						|
// This uses the KDF function similar to X3DH for each `value`
 | 
						|
// But changes the key just like XEdDSA where the prefix bytes change by a single bit
 | 
						|
func FiatShamir(values ...*big.Int) ([]byte, error) {
 | 
						|
	// Don't accept any nil arguments
 | 
						|
	if AnyNil(values...) {
 | 
						|
		return nil, internal.ErrNilArguments
 | 
						|
	}
 | 
						|
 | 
						|
	info := []byte("Coinbase tECDSA 1.0")
 | 
						|
	salt := make([]byte, 32)
 | 
						|
	okm := make([]byte, 32)
 | 
						|
	f := bytes.Repeat([]byte{0xFF}, 32)
 | 
						|
 | 
						|
	for _, b := range values {
 | 
						|
		ikm := append(f, b.Bytes()...)
 | 
						|
		ikm = append(ikm, okm...)
 | 
						|
		kdf := hkdf.New(sha256.New, ikm, salt, info)
 | 
						|
		n, err := kdf.Read(okm)
 | 
						|
		if err != nil {
 | 
						|
			return nil, err
 | 
						|
		}
 | 
						|
		if n != len(okm) {
 | 
						|
			return nil, fmt.Errorf("unable to read expected number of bytes want=%v got=%v", len(okm), n)
 | 
						|
		}
 | 
						|
		internal.ByteSub(f)
 | 
						|
	}
 | 
						|
	return okm, nil
 | 
						|
}
 |