Signature proving payment to destination by only revealing key derivation, not the actual tx secret key

2 files changed, 139 insertions, 0 deletions

diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
index 98da466cc..6ae7e5f24 100644
--- a/src/crypto/crypto.cpp
+++ b/src/crypto/crypto.cpp
@@ -197,6 +197,13 @@ namespace crypto {
     ec_point comm;
   };
 
+  struct s_comm_2 {
+    hash msg;
+    ec_point D;
+    ec_point X;
+    ec_point Y;
+  };
+
   void crypto_ops::generate_signature(const hash &prefix_hash, const public_key &pub, const secret_key &sec, signature &sig) {
     boost::lock_guard<boost::mutex> lock(random_lock);
     ge_p3 tmp3;
@@ -242,6 +249,124 @@ namespace crypto {
     return sc_isnonzero(&c) == 0;
   }
 
+  void crypto_ops::generate_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const public_key &D, const secret_key &r, signature &sig) {
+    // sanity check
+    ge_p3 R_p3;
+    ge_p3 A_p3;
+    ge_p3 D_p3;
+    if (ge_frombytes_vartime(&R_p3, &R) != 0) throw std::runtime_error("tx pubkey is invalid");
+    if (ge_frombytes_vartime(&A_p3, &A) != 0) throw std::runtime_error("recipient view pubkey is invalid");
+    if (ge_frombytes_vartime(&D_p3, &D) != 0) throw std::runtime_error("key derivation is invalid");
+#if !defined(NDEBUG)
+    {
+      assert(sc_check(&r) == 0);
+      // check R == r*G
+      ge_p3 dbg_R_p3;
+      ge_scalarmult_base(&dbg_R_p3, &r);
+      public_key dbg_R;
+      ge_p3_tobytes(&dbg_R, &dbg_R_p3);
+      assert(R == dbg_R);
+      // check D == r*A
+      ge_p2 dbg_D_p2;
+      ge_scalarmult(&dbg_D_p2, &r, &A_p3);
+      public_key dbg_D;
+      ge_tobytes(&dbg_D, &dbg_D_p2);
+      assert(D == dbg_D);
+    }
+#endif
+
+    // pick random k
+    ec_scalar k;
+    random_scalar(k);
+    
+    // compute X = k*G
+    ge_p3 X_p3;
+    ge_scalarmult_base(&X_p3, &k);
+    
+    // compute Y = k*A
+    ge_p2 Y_p2;
+    ge_scalarmult(&Y_p2, &k, &A_p3);
+
+    // sig.c = Hs(Msg || D || X || Y)
+    s_comm_2 buf;
+    buf.msg = prefix_hash;
+    buf.D = D;
+    ge_p3_tobytes(&buf.X, &X_p3);
+    ge_tobytes(&buf.Y, &Y_p2);
+    hash_to_scalar(&buf, sizeof(s_comm_2), sig.c);
+
+    // sig.r = k - sig.c*r
+    sc_mulsub(&sig.r, &sig.c, &r, &k);
+  }
+
+  bool crypto_ops::check_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const public_key &D, const signature &sig) {
+    // sanity check
+    ge_p3 R_p3;
+    ge_p3 A_p3;
+    ge_p3 D_p3;
+    if (ge_frombytes_vartime(&R_p3, &R) != 0) return false;
+    if (ge_frombytes_vartime(&A_p3, &A) != 0) return false;
+    if (ge_frombytes_vartime(&D_p3, &D) != 0) return false;
+    if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0) return false;
+
+    // compute sig.c*R
+    ge_p2 cR_p2;
+    ge_scalarmult(&cR_p2, &sig.c, &R_p3);
+
+    // compute sig.r*G
+    ge_p3 rG_p3;
+    ge_scalarmult_base(&rG_p3, &sig.r);
+
+    // compute sig.c*D
+    ge_p2 cD_p2;
+    ge_scalarmult(&cD_p2, &sig.c, &D_p3);
+
+    // compute sig.r*A
+    ge_p2 rA_p2;
+    ge_scalarmult(&rA_p2, &sig.r, &A_p3);
+
+    // compute X = sig.c*R + sig.r*G
+    public_key cR;
+    ge_tobytes(&cR, &cR_p2);
+    ge_p3 cR_p3;
+    if (ge_frombytes_vartime(&cR_p3, &cR) != 0) return false;
+    ge_cached rG_cached;
+    ge_p3_to_cached(&rG_cached, &rG_p3);
+    ge_p1p1 X_p1p1;
+    ge_add(&X_p1p1, &cR_p3, &rG_cached);
+    ge_p2 X_p2;
+    ge_p1p1_to_p2(&X_p2, &X_p1p1);
+
+    // compute Y = sig.c*D + sig.r*A
+    public_key cD;
+    public_key rA;
+    ge_tobytes(&cD, &cD_p2);
+    ge_tobytes(&rA, &rA_p2);
+    ge_p3 cD_p3;
+    ge_p3 rA_p3;
+    if (ge_frombytes_vartime(&cD_p3, &cD) != 0) return false;
+    if (ge_frombytes_vartime(&rA_p3, &rA) != 0) return false;
+    ge_cached rA_cached;
+    ge_p3_to_cached(&rA_cached, &rA_p3);
+    ge_p1p1 Y_p1p1;
+    ge_add(&Y_p1p1, &cD_p3, &rA_cached);
+    ge_p2 Y_p2;
+    ge_p1p1_to_p2(&Y_p2, &Y_p1p1);
+
+    // compute c2 = Hs(Msg || D || X || Y)
+    s_comm_2 buf;
+    buf.msg = prefix_hash;
+    buf.D = D;
+    ge_tobytes(&buf.X, &X_p2);
+    ge_tobytes(&buf.Y, &Y_p2);
+    ec_scalar c2;
+    hash_to_scalar(&buf, sizeof(s_comm_2), c2);
+
+    // test if c2 == sig.c
+    sc_sub(&c2, &c2, &sig.c);
+    return sc_isnonzero(&c2) == 0;
+  }
+
   static void hash_to_ec(const public_key &key, ge_p3 &res) {
     hash h;
     ge_p2 point;
diff --git a/src/crypto/crypto.h b/src/crypto/crypto.h
index 3b8c7996b..e99b6651f 100644
--- a/src/crypto/crypto.h
+++ b/src/crypto/crypto.h
@@ -123,6 +123,10 @@ namespace crypto {
     friend void generate_signature(const hash &, const public_key &, const secret_key &, signature &);
     static bool check_signature(const hash &, const public_key &, const signature &);
     friend bool check_signature(const hash &, const public_key &, const signature &);
+    static void generate_tx_proof(const hash &, const public_key &, const public_key &, const public_key &, const secret_key &, signature &);
+    friend void generate_tx_proof(const hash &, const public_key &, const public_key &, const public_key &, const secret_key &, signature &);
+    static bool check_tx_proof(const hash &, const public_key &, const public_key &, const public_key &, const signature &);
+    friend bool check_tx_proof(const hash &, const public_key &, const public_key &, const public_key &, const signature &);
     static void generate_key_image(const public_key &, const secret_key &, key_image &);
     friend void generate_key_image(const public_key &, const secret_key &, key_image &);
     static void generate_ring_signature(const hash &, const key_image &,
@@ -200,6 +204,16 @@ namespace crypto {
     return crypto_ops::check_signature(prefix_hash, pub, sig);
   }
 
+  /* Generation and checking of a tx proof; given a tx pubkey R, the recipient's view pubkey A, and the key 
+   * derivation D, the signature proves the knowledge of the tx secret key r such that R=r*G and D=r*A
+   */
+  inline void generate_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const public_key &D, const secret_key &r, signature &sig) {
+    crypto_ops::generate_tx_proof(prefix_hash, R, A, D, r, sig);
+  }
+  inline bool check_tx_proof(const hash &prefix_hash, const public_key &R, const public_key &A, const public_key &D, const signature &sig) {
+    return crypto_ops::check_tx_proof(prefix_hash, R, A, D, sig);
+  }
+
   /* To send money to a key:
    * * The sender generates an ephemeral key and includes it in transaction output.
    * * To spend the money, the receiver generates a key image from it.