Mina-signer: in-SNARK verifiable Signatures

CHANGELOG.md

@@ -21,6 +21,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `Transaction.fromJSON` to recover transaction object from JSON https://github.com/o1-labs/snarkyjs/pull/705
 
+### Changed
+
+- BREAKING CHANGE: Modify signature algorithm used by `Signature.{create,verify}` to be compatible with mina-signer https://github.com/o1-labs/snarkyjs/pull/710
+  - Signatures created with mina-signer's `client.signFields()` can now be verified inside a SNARK!
+  - Breaks existing deployed smart contracts which use `Signature.verify()`
+
 ## [0.8.0](https://github.com/o1-labs/snarkyjs/compare/d880bd6e...c5a36207)
 
 ### Added

src/lib/account_update.ts

@@ -1877,7 +1877,11 @@ function signJsonTransaction(
       accountUpdate.authorization.proof === null
     ) {
       zkappCommand = JSON.parse(
-        Ledger.signAccountUpdate(JSON.stringify(zkappCommand), privateKey, i)
+        Ledger.signOtherAccountUpdate(
+          JSON.stringify(zkappCommand),
+          privateKey,
+          i
+        )
       );
     }
   }

src/lib/core.ts

@@ -2,6 +2,8 @@ import { bytesToBigInt } from '../js_crypto/bigint-helpers.js';
 import { defineBinable } from '../provable/binable.js';
 import { sizeInBits } from '../provable/field-bigint.js';
 import { Bool, Field, Scalar, Group } from '../snarky.js';
+import { Scalar as ScalarBigint } from '../provable/curve-bigint.js';
+import { mod } from '../js_crypto/finite_field.js';
 
 export { Field, Bool, Scalar, Group };
 
@@ -72,3 +74,8 @@ That means it can't be called in a @method or similar environment, and there's n
     highBit: Bool(x >> lowBitSize === 1n),
   };
 };
+
+Scalar.fromBigInt = function (scalar: bigint) {
+  scalar = mod(scalar, ScalarBigint.modulus);
+  return Scalar.fromJSON(scalar.toString());
+};

src/lib/signature.ts

@@ -1,6 +1,12 @@
-import { Group, Field, Bool, Scalar, Ledger, Circuit } from '../snarky.js';
+import { Group, Field, Bool, Scalar, Ledger } from '../snarky.js';
 import { prop, CircuitValue, AnyConstructor } from './circuit_value.js';
-import { Poseidon } from './hash.js';
+import { hashWithPrefix } from './hash.js';
+import {
+  deriveNonce,
+  Signature as SignatureBigint,
+} from '../mina-signer/src/signature.js';
+import { Scalar as ScalarBigint } from '../provable/curve-bigint.js';
+import { prefixes } from '../js_crypto/constants.js';
 
 // external API
 export { PrivateKey, PublicKey, Signature };
@@ -192,12 +198,23 @@ class Signature extends CircuitValue {
   static create(privKey: PrivateKey, msg: Field[]): Signature {
     const publicKey = PublicKey.fromPrivateKey(privKey).toGroup();
     const d = privKey.s;
-    const kPrime = Scalar.random();
+    const kPrime = Scalar.fromBigInt(
+      deriveNonce(
+        { fields: msg.map((f) => f.toBigInt()) },
+        { x: publicKey.x.toBigInt(), y: publicKey.y.toBigInt() },
+        BigInt(d.toJSON()),
+        'testnet'
+      )
+    );
     let { x: r, y: ry } = Group.generator.scale(kPrime);
     const k = ry.toBits()[0].toBoolean() ? kPrime.neg() : kPrime;
-    const e = Scalar.fromBits(
-      Poseidon.hash(msg.concat([publicKey.x, publicKey.y, r])).toBits()
+    let h = hashWithPrefix(
+      prefixes.signatureTestnet,
+      msg.concat([publicKey.x, publicKey.y, r])
     );
+    // TODO: Scalar.fromBits interprets the input as a "shifted scalar"
+    // therefore we have to unshift e before using it
+    let e = unshift(Scalar.fromBits(h.toBits()));
     const s = e.mul(d).add(k);
     return new Signature(r, s);
   }
@@ -208,10 +225,51 @@ class Signature extends CircuitValue {
    */
   verify(publicKey: PublicKey, msg: Field[]): Bool {
     const point = publicKey.toGroup();
-    let e = Scalar.fromBits(
-      Poseidon.hash(msg.concat([point.x, point.y, this.r])).toBits()
+    let h = hashWithPrefix(
+      prefixes.signatureTestnet,
+      msg.concat([point.x, point.y, this.r])
     );
-    let r = point.scale(e).neg().add(Group.generator.scale(this.s));
+    // TODO: Scalar.fromBits interprets the input as a "shifted scalar"
+    // therefore we have to use scaleShifted which is very inefficient
+    let e = Scalar.fromBits(h.toBits());
+    let r = scaleShifted(point, e).neg().add(Group.generator.scale(this.s));
     return Bool.and(r.x.equals(this.r), r.y.toBits()[0].equals(false));
   }
+
+  /**
+   * Decodes a base58 encoded signature into a {@link Signature}.
+   */
+  static fromBase58(signatureBase58: string) {
+    let { r, s } = SignatureBigint.fromBase58(signatureBase58);
+    return Signature.fromObject({
+      r: Field(r),
+      s: Scalar.fromJSON(s.toString()),
+    });
+  }
+  /**
+   * Encodes a {@link Signature} in base58 format.
+   */
+  toBase58() {
+    let r = this.r.toBigInt();
+    let s = BigInt(this.s.toJSON());
+    return SignatureBigint.toBase58({ r, s });
+  }
+}
+
+// performs scalar multiplication s*G assuming that instead of s, we got s' = 2s + 1 + 2^255
+// cost: 2x scale by constant, 1x scale by variable
+function scaleShifted(point: Group, shiftedScalar: Scalar) {
+  let oneHalfGroup = point.scale(Scalar.fromBigInt(oneHalf));
+  let shiftGroup = oneHalfGroup.scale(Scalar.fromBigInt(shift));
+  return oneHalfGroup.scale(shiftedScalar).sub(shiftGroup);
+}
+// returns s, assuming that instead of s, we got s' = 2s + 1 + 2^255
+// (only works out of snark)
+function unshift(shiftedScalar: Scalar) {
+  return shiftedScalar
+    .sub(Scalar.fromBigInt(shift))
+    .mul(Scalar.fromBigInt(oneHalf));
 }
+
+let shift = ScalarBigint(1n + 2n ** 255n);
+let oneHalf = ScalarBigint.inverse(2n)!;

src/mina-signer/MinaSigner.ts

@@ -23,6 +23,7 @@ import {
   publicKeyToHex,
   rosettaTransactionToSignedCommand,
 } from './src/rosetta.js';
+import { sign, Signature, verify } from './src/signature.js';
 
 export { Client as default };
 
@@ -96,6 +97,48 @@ class Client {
     return PublicKey.toBase58(publicKey);
   }
 
+  /**
+   * Signs an arbitrary list of field elements in a SNARK-compatible way.
+   * The resulting signature can be verified in SnarkyJS as follows:
+   * ```ts
+   * // sign field elements with mina-signer
+   * let signed = client.signFieldElements(fields, privateKey);
+   *
+   * // read signature in snarkyjs and verify
+   * let signature = Signature.fromBase58(signed.signature);
+   * let isValid: Bool = signature.verify(publicKey, fields.map(Field));
+   * ```
+   *
+   * @param fields An arbitrary list of field elements
+   * @param privateKey The private key used for signing
+   * @returns The signed field elements
+   */
+  signFields(fields: bigint[], privateKey: Json.PrivateKey): Signed<bigint[]> {
+    let privateKey_ = PrivateKey.fromBase58(privateKey);
+    let signature = sign({ fields }, privateKey_, 'testnet');
+    return {
+      signature: Signature.toBase58(signature),
+      publicKey: PublicKey.toBase58(PrivateKey.toPublicKey(privateKey_)),
+      data: fields,
+    };
+  }
+
+  /**
+   * Verifies a signature created by {@link signFields}.
+   *
+   * @param signedFields The signed field elements
+   * @returns True if the `signedFields` contains a valid signature matching
+   * the fields and publicKey.
+   */
+  verifyFields({ data, signature, publicKey }: Signed<bigint[]>) {
+    return verify(
+      Signature.fromBase58(signature),
+      { fields: data },
+      PublicKey.fromBase58(publicKey),
+      'testnet'
+    );
+  }
+
   /**
    * Signs an arbitrary message
    *
@@ -114,7 +157,7 @@ class Client {
   }
 
   /**
-   * Verifies that a signature matches a message.
+   * Verifies a signature created by {@link signMessage}.
    *
    * @param signedMessage A signed message
    * @returns True if the `signedMessage` contains a valid signature matching

src/mina-signer/src/signature.ts

@@ -37,6 +37,7 @@ export {
   NetworkId,
   signLegacy,
   verifyLegacy,
+  deriveNonce,
 };
 
 const networkIdMainnet = 0x01n;

src/mina-signer/tests/verify-in-snark.unit-test.ts

@@ -0,0 +1,49 @@
+import { Field, isReady, shutdown } from '../../snarky.js';
+import { ZkProgram } from '../../lib/proof_system.js';
+import Client from '../MinaSigner.js';
+import { PrivateKey, Signature } from '../../lib/signature.js';
+import { provablePure } from '../../lib/circuit_value.js';
+import { expect } from 'expect';
+
+let fields = [10n, 20n, 30n, 340817401n, 2091283n, 1n, 0n];
+let privateKey = 'EKENaWFuAiqktsnWmxq8zaoR8bSgVdscsghJE5tV6hPoNm8qBKWM';
+
+// sign with mina-signer
+let client = new Client({ network: 'mainnet' });
+let signed = client.signFields(fields, privateKey);
+
+// verify with mina-signer
+let ok = client.verifyFields(signed);
+expect(ok).toEqual(true);
+
+// sign with snarkyjs and check that we get the same signature
+await isReady;
+let fieldsSnarky = fields.map(Field);
+let privateKeySnarky = PrivateKey.fromBase58(privateKey);
+let signatureSnarky = Signature.create(privateKeySnarky, fieldsSnarky);
+expect(signatureSnarky.toBase58()).toEqual(signed.signature);
+
+// verify out-of-snark with snarkyjs
+let publicKey = privateKeySnarky.toPublicKey();
+let signature = Signature.fromBase58(signed.signature);
+signature.verify(publicKey, fieldsSnarky).assertTrue();
+
+// verify in-snark with snarkyjs
+const MyProgram = ZkProgram({
+  publicInput: provablePure(null),
+  methods: {
+    verifySignature: {
+      privateInputs: [Signature],
+      method(_: null, signature: Signature) {
+        signature.verify(publicKey, fieldsSnarky).assertTrue();
+      },
+    },
+  },
+});
+
+await MyProgram.compile();
+let proof = await MyProgram.verifySignature(null, signature);
+ok = await MyProgram.verify(proof);
+expect(ok).toEqual(true);
+
+shutdown();

src/snarky.d.ts

@@ -990,6 +990,11 @@ declare class Scalar {
    * This operation does NOT affect the circuit and can't be used to prove anything about the string representation of the Scalar.
    */
   static fromJSON(x: string | number | boolean): Scalar;
+  /**
+   * Create a constant {@link Scalar} from a bigint.
+   * If the bigint is too large, it is reduced modulo the scalar field order.
+   */
+  static fromBigInt(s: bigint): Scalar;
   static check(x: Scalar): void;
 }
 
@@ -1274,7 +1279,7 @@ declare class Ledger {
   /**
    * Signs an account update.
    */
-  static signAccountUpdate(
+  static signOtherAccountUpdate(
     txJson: string,
     privateKey: { s: Scalar },
     i: number