// Copyright (c) 2021, The Monero Project
//
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are
// permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice, this list
// of conditions and the following disclaimer in the documentation and/or other
// materials provided with the distribution.
//
// 3. Neither the name of the copyright holder nor the names of its contributors may be
// used to endorse or promote products derived from this software without specific
// prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
////
// References
// - CLSAG (base signature scheme): https://eprint.iacr.org/2019/654
// - MuSig2 (style for multisig signing): https://eprint.iacr.org/2020/1261
///
#pragma once
#include "ringct/rctTypes.h"
#include <vector>
namespace multisig {
namespace signing {
class CLSAG_context_t final {
private:
// is the CLSAG context initialized?
bool initialized;
// challenge components: c = H(domain-separator, {P}, {C}, C_offset, message, L, R)
rct::keyV c_params;
// indices in c_params where L and R will be
std::size_t c_params_L_offset;
std::size_t c_params_R_offset;
// musig2-style nonce combination factor components for multisig signing
// b = H(domain-separator, {P}, {C}, C_offset, message, {L_combined_alphas}, {R_combined_alphas}, I, D, {s_non_l}, l, k, n)
// - {P} = ring of one-time addresses
// - {C} = ring of amount commitments (1:1 with one-time addresses)
// - C_offset = pseudo-output commitment to offset all amount commitments with
// - message = message the CLSAG will sign
// - {L_combined_alphas} = set of summed-together public nonces from all multisig signers for this CLSAG's L component
// - {R_combined_alphas} = set of summed-together public nonces from all multisig signers for this CLSAG's R component
// - I = key image for one-time address at {P}[l]
// - D = auxiliary key image for the offsetted amount commitment '{C}[l] - C_offset'
// - {s_non_l} = fake responses for this proof
// - l = real signing index in {P} and '{C} - C_offset'
// - k = number of parallel nonces that each participant provides
// - n = number of ring members
rct::keyV b_params;
// indices in b_params where L and R 'alpha' components will be
std::size_t b_params_L_offset;
std::size_t b_params_R_offset;
// CLSAG 'concise' coefficients for {P} and '{C} - C_offset'
// mu_x = H(domain-separator, {P}, {C}, I, (1/8)*D, C_offset)
// - note: 'D' is stored in the form '(1/8)*D' in transaction data
rct::key mu_P;
rct::key mu_C;
// ring size
std::size_t n;
// aggregate key image: mu_P*I + mu_C*D
rct::geDsmp wH_l_precomp;
// aggregate ring members: mu_P*P_i + mu_C*(C_i - C_offset)
std::vector<rct::geDsmp> W_precomp;
// key image component base keys: H_p(P_i)
std::vector<rct::geDsmp> H_precomp;
// cache for later: generator 'G' in 'precomp' representation
rct::geDsmp G_precomp;
// real signing index in this CLSAG
std::size_t l;
// signature responses
rct::keyV s;
// number of signing nonces expected per signer
std::size_t num_alpha_components;
public:
CLSAG_context_t() : initialized{false} {}
// prepare CLSAG challenge context
bool init(
const rct::keyV& P,
const rct::keyV& C_nonzero,
const rct::key& C_offset,
const rct::key& message,
const rct::key& I,
const rct::key& D,
const unsigned int l,
const rct::keyV& s,
const std::size_t num_alpha_components
);
// get the local signer's combined musig2-style private nonce and compute the CLSAG challenge
bool combine_alpha_and_compute_challenge(
// set of summed-together musig2-style public nonces from all multisig signers for this CLSAG's L component
const rct::keyV& total_alpha_G,
// set of summed-together musig2-style public nonces from all multisig signers for this CLSAG's R component
const rct::keyV& total_alpha_H,
// local signer's private musig2-style nonces
const rct::keyV& alpha,
// local signer's final private nonce, using musig2-style combination with factor 'b'
// alpha_combined = sum_i(b^i * alpha[i])
rct::key& alpha_combined,
// CLSAG challenge to store in the proof
rct::key& c_0,
// final CLSAG challenge to respond to (need this to make multisig partial signatures)
rct::key& c
);
// getter for CLSAG 'concise' coefficients
bool get_mu(
rct::key& mu_P,
rct::key& mu_C
) const;
};
} //namespace signing
} //namespace multisig
