Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support new Bulletproof rewind scheme #50

Merged
merged 7 commits into from
Jun 10, 2019
Merged

Support new Bulletproof rewind scheme #50

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
55bb29f
Bulletproofs: change message to 20 bytes, allow 2 nonces in generation
jaspervdm May 26, 2019
b90d6f8
Updated syntax of rewind function
jaspervdm May 27, 2019
88b917b
Update to latest libsecp
jaspervdm Jun 3, 2019
3c4a6c4
Update tests
jaspervdm Jun 3, 2019
bb63a73
Merge master
jaspervdm Jun 3, 2019
db60232
Fix borrow after move
jaspervdm Jun 3, 2019
12ee00a
Update tests
jaspervdm Jun 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion depend/secp256k1-zkp
Open in desktop
Submodule secp256k1-zkp updated 5 files
+3 −5 include/secp256k1_bulletproofs.h
+3 −3 src/bench_bulletproof.c
+3 −4 src/modules/bulletproofs/main_impl.h
+9 −14 src/modules/bulletproofs/rangeproof_impl.h
+18 −20 src/modules/bulletproofs/tests_impl.h
2 changes: 1 addition & 1 deletion src/constants.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ pub const PROOF_MSG_SIZE: usize = 2048;
pub const PROOF_MSG_SIZE: usize = 2048;

/// The maximum size of an optional message embedded in a bullet proof
pub const BULLET_PROOF_MSG_SIZE: usize = 16;
pub const BULLET_PROOF_MSG_SIZE: usize = 20;

/// The order of the secp256k1 curve
pub const CURVE_ORDER: [u8; 32] = [
Expand Down
1 change: 0 additions & 1 deletion src/ffi.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -589,7 +589,6 @@ extern "C" {

pub fn secp256k1_bulletproof_rangeproof_rewind(
ctx: *const Context,
gens: *const BulletproofGenerators,
value: *mut uint64_t,
blind: *mut c_uchar,
proof: *const c_uchar,
Expand Down
54 changes: 29 additions & 25 deletions src/pedersen.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -745,7 +745,8 @@ impl Secp256k1 {
&self,
value: u64,
blind: SecretKey,
nonce: SecretKey,
rewind_nonce: SecretKey,
private_nonce: SecretKey,
extra_data_in: Option<Vec<u8>>,
message: Option<ProofMessage>,
) -> RangeProof {
Expand Down Expand Up @@ -773,12 +774,11 @@ impl Secp256k1 {
None => ptr::null(),
};

// This api is not for multi-party range proof, so all null for these 5 parameters.
// This api is not for multi-party range proof, so all null for these 4 parameters.
let tau_x = ptr::null_mut();
let t_one = ptr::null_mut();
let t_two = ptr::null_mut();
let commits = ptr::null_mut();
let private_nonce = ptr::null();

let _success = unsafe {
let scratch = ffi::secp256k1_scratch_space_create(self.ctx, SCRATCH_SPACE_SIZE);
Expand All @@ -798,8 +798,8 @@ impl Secp256k1 {
1,
constants::GENERATOR_H.as_ptr(),
n_bits as size_t,
nonce.as_ptr(),
private_nonce,
rewind_nonce.as_ptr(),
private_nonce.as_ptr(),
extra_data,
extra_data_len as size_t,
message_ptr,
Expand Down Expand Up @@ -1085,14 +1085,13 @@ impl Secp256k1 {

let mut blind_out = [0u8; constants::SECRET_KEY_SIZE];
let mut value_out = 0;
let mut message_out = [0u8; 16];
let mut message_out = [0u8; 20];
let commit = self.commit_parse(commit.0)?;

let success = unsafe {
let scratch = ffi::secp256k1_scratch_space_create(self.ctx, SCRATCH_SPACE_SIZE);
let result = ffi::secp256k1_bulletproof_rangeproof_rewind(
self.ctx,
shared_generators(self.ctx),
&mut value_out,
blind_out.as_mut_ptr(),
proof.proof.as_ptr(),
Expand Down Expand Up @@ -1393,7 +1392,7 @@ mod tests {
let blinding = SecretKey::new(&secp, &mut thread_rng());
let value = 12345678;
let commit = secp.commit(value, blinding.clone()).unwrap();
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), None, None);
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), blinding.clone(), None, None);

// correct verification
println!("Bullet proof len: {}", bullet_proof.plen);
Expand All @@ -1405,7 +1404,7 @@ mod tests {
// wrong value committed to
let value = 12345678;
let wrong_commit = secp.commit(87654321, blinding.clone()).unwrap();
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), None, None);
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), blinding.clone(), None, None);
if !secp
.verify_bullet_proof(wrong_commit, bullet_proof, None)
.is_err()
Expand All @@ -1417,7 +1416,7 @@ mod tests {
let value = 12345678;
let commit = secp.commit(value, blinding).unwrap();
let blinding = SecretKey::new(&secp, &mut thread_rng());
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), None, None);
let bullet_proof = secp.bullet_proof(value, blinding.clone(), blinding.clone(), blinding.clone(), None, None);
if !secp
.verify_bullet_proof(commit, bullet_proof, None)
.is_err()
Expand All @@ -1431,7 +1430,7 @@ mod tests {
let value = 12345678;
let commit = secp.commit(value, blinding.clone()).unwrap();
let bullet_proof =
secp.bullet_proof(value, blinding.clone(), blinding.clone(), Some(extra_data.clone()), None);
secp.bullet_proof(value, blinding.clone(), blinding.clone(), blinding.clone(), Some(extra_data.clone()), None);
if secp
.verify_bullet_proof(commit, bullet_proof, Some(extra_data.clone()))
.is_err()
Expand All @@ -1453,15 +1452,16 @@ mod tests {
// Ensure rewinding works

let blinding = SecretKey::new(&secp, &mut thread_rng());
let nonce = SecretKey::new(&secp, &mut thread_rng());
let rewind_nonce = SecretKey::new(&secp, &mut thread_rng());
let private_nonce = SecretKey::new(&secp, &mut thread_rng());
let value = 12345678;
let commit = secp.commit(value, blinding.clone()).unwrap();

let bullet_proof =
secp.bullet_proof(value, blinding.clone(), nonce.clone(), Some(extra_data.clone()), None);
secp.bullet_proof(value, blinding.clone(), private_nonce.clone(), private_nonce.clone(), Some(extra_data.clone()), None);
jaspervdm marked this conversation as resolved.
Show resolved Hide resolved
// Unwind message with same blinding factor
let proof_info = secp
.rewind_bullet_proof(commit, nonce.clone(), Some(extra_data.clone()), bullet_proof)
.rewind_bullet_proof(commit, private_nonce.clone(), Some(extra_data.clone()), bullet_proof)
jaspervdm marked this conversation as resolved.
Show resolved Hide resolved
.unwrap();
assert_eq!(proof_info.value, value);
assert_eq!(blinding, proof_info.blinding);
Expand All @@ -1478,26 +1478,28 @@ mod tests {
}

// unwinding with wrong extra data should puke
let proof_info = secp.rewind_bullet_proof(commit, nonce.clone(), None, bullet_proof);
let proof_info = secp.rewind_bullet_proof(commit, private_nonce.clone(), None, bullet_proof);
jaspervdm marked this conversation as resolved.
Show resolved Hide resolved
if !proof_info.is_err() {
panic!("Bullet proof verify with message should have errored.");
}

// Ensure including a message also works
let message_bytes: [u8; 16] = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16];
let message_bytes: [u8; 20] = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20];
let message = ProofMessage::from_bytes(&message_bytes);

let bullet_proof = secp.bullet_proof(
value,
blinding.clone(),
nonce.clone(),
rewind_nonce.clone(),
private_nonce.clone(),
Some(extra_data.clone()),
Some(message.clone()),
);
// Unwind message with same blinding factor
let proof_info = secp
.rewind_bullet_proof(commit, nonce, Some(extra_data.clone()), bullet_proof)
.rewind_bullet_proof(commit, rewind_nonce, Some(extra_data.clone()), bullet_proof)
.unwrap();
assert_eq!(proof_info.value, value);
assert_eq!(proof_info.message, message);
}

Expand Down Expand Up @@ -1791,7 +1793,7 @@ mod tests {
let commit = secp.commit(value, blinding.clone()).unwrap();

let mut pm = ProofMessage::from_bytes(&[0u8;32]);
let bullet_proof = secp.bullet_proof(value, blinding.clone(), nonce.clone(), None, Some(pm.clone()));
let bullet_proof = secp.bullet_proof(value, blinding.clone(), nonce.clone(), nonce.clone(), None, Some(pm.clone()));
// Unwind message with same blinding factor
let proof_info = secp
.rewind_bullet_proof(commit, nonce, None, bullet_proof)
Expand All @@ -1810,7 +1812,7 @@ mod tests {
let value = <u64>::max_value() - 1;
let commit = secp.commit(value, blinding.clone()).unwrap();

let bullet_proof = secp.bullet_proof(value, blinding.clone(), nonce.clone(), None, None);
let bullet_proof = secp.bullet_proof(value, blinding.clone(), nonce.clone(), nonce.clone(), None, None);
jaspervdm marked this conversation as resolved.
Show resolved Hide resolved
// Unwind message with same blinding factor
let proof_info = secp
.rewind_bullet_proof(commit, nonce, None, bullet_proof)
Expand All @@ -1835,7 +1837,7 @@ mod tests {
let mut proofs: Vec<RangeProof> = vec![];
for i in 0..v {
commits.push(secp.commit(value + i as u64, blinding.clone()).unwrap());
proofs.push(secp.bullet_proof(value + i as u64, blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value + i as u64, blinding.clone(), blinding.clone(), blinding.clone(), None, None));
}
println!("--------");
println!("Comparing {} Proofs", v);
Expand Down Expand Up @@ -1872,7 +1874,7 @@ mod tests {
let wrong_commit = secp.commit(value, wrong_blinding).unwrap();

commits.push(secp.commit(value, blinding.clone()).unwrap());
proofs.push(secp.bullet_proof(value, blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value, blinding.clone(), blinding.clone(), blinding.clone(), None, None));
let proof_range = secp
.verify_bullet_proof(commits[0].clone(), proofs[0].clone(), None)
.unwrap();
Expand All @@ -1898,8 +1900,8 @@ mod tests {
proofs = vec![];
commits.push(secp.commit(value + 1, blinding.clone()).unwrap());
commits.push(secp.commit(value - 1, blinding.clone()).unwrap());
proofs.push(secp.bullet_proof(value + 1, blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value - 1, blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value + 1, blinding.clone(), blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value - 1, blinding.clone(), blinding.clone(), blinding.clone(), None, None));
let proof_range = secp
.verify_bullet_proof_multi(commits.clone(), proofs.clone(), None)
.unwrap();
Expand All @@ -1916,13 +1918,15 @@ mod tests {
value + 1,
blinding.clone(),
blinding.clone(),
blinding.clone(),
Some(extra_data1.clone()),
None,
));
proofs.push(secp.bullet_proof(
value - 1,
blinding.clone(),
blinding.clone(),
blinding.clone(),
Some(extra_data2.clone()),
None,
));
Expand Down Expand Up @@ -1954,7 +1958,7 @@ mod tests {
for i in 1..100 {
print!("\r\r\r{}", i);
commits.push(secp.commit(value + i as u64, blinding.clone()).unwrap());
proofs.push(secp.bullet_proof(value + i as u64, blinding.clone(), blinding.clone(), None, None));
proofs.push(secp.bullet_proof(value + i as u64, blinding.clone(), blinding.clone(), blinding.clone(), None, None));
jaspervdm marked this conversation as resolved.
Show resolved Hide resolved
let proof_range = secp.verify_bullet_proof_multi(commits.clone(), proofs.clone(), None); //.unwrap();
if proof_range.is_err() {
println!(" proofs batch verify failed");
Expand Down