path: root/src/multisig/multisig_clsag_context.cpp

// Copyright (c) 2021, The Monero Project
// 
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are
// permitted provided that the following conditions are met:
// 
// 1. Redistributions of source code must retain the above copyright notice, this list of
//    conditions and the following disclaimer.
// 
// 2. Redistributions in binary form must reproduce the above copyright notice, this list
//    of conditions and the following disclaimer in the documentation and/or other
//    materials provided with the distribution.
// 
// 3. Neither the name of the copyright holder nor the names of its contributors may be
//    used to endorse or promote products derived from this software without specific
//    prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "multisig_clsag_context.h"

#include "int-util.h"

#include "crypto/crypto.h"
#include "cryptonote_config.h"
#include "ringct/rctOps.h"
#include "ringct/rctTypes.h"

#include <cstring>
#include <string>
#include <vector>

#undef MONERO_DEFAULT_LOG_CATEGORY
#define MONERO_DEFAULT_LOG_CATEGORY "multisig"

namespace multisig {

namespace signing {
//----------------------------------------------------------------------------------------------------------------------
//----------------------------------------------------------------------------------------------------------------------
template<std::size_t N>
static rct::key string_to_key(const unsigned char (&str)[N]) {
  rct::key tmp{};
  static_assert(sizeof(tmp.bytes) >= N, "");
  std::memcpy(tmp.bytes, str, N);
  return tmp;
}
//----------------------------------------------------------------------------------------------------------------------
//----------------------------------------------------------------------------------------------------------------------
static void encode_int_to_key_le(const unsigned int i, rct::key &k_out)
{
  static_assert(sizeof(unsigned int) <= sizeof(std::uint64_t), "unsigned int max too large");
  static_assert(sizeof(std::uint64_t) <= sizeof(rct::key), "");
  std::uint64_t temp_i{SWAP64LE(i)};
  std::memcpy(k_out.bytes, &temp_i, sizeof(temp_i));
}
//----------------------------------------------------------------------------------------------------------------------
//----------------------------------------------------------------------------------------------------------------------
bool CLSAG_context_t::init(
  const rct::keyV& P,
  const rct::keyV& C_nonzero,
  const rct::key& C_offset,
  const rct::key& message,
  const rct::key& I,
  const rct::key& D,
  const unsigned int l,
  const rct::keyV& s,
  const std::size_t num_alpha_components
)
{
  initialized = false;

  n = P.size();
  if (n <= 0)
    return false;
  if (C_nonzero.size() != n)
    return false;
  if (s.size() != n)
    return false;
  if (l >= n)
    return false;

  c_params.clear();
  c_params.reserve(n * 2 + 5);
  b_params.clear();
  b_params.reserve(n * 3 + 2 * num_alpha_components + 7);

  c_params.push_back(string_to_key(config::HASH_KEY_CLSAG_ROUND));
  b_params.push_back(string_to_key(config::HASH_KEY_CLSAG_ROUND_MULTISIG));
  c_params.insert(c_params.end(), P.begin(), P.end());
  b_params.insert(b_params.end(), P.begin(), P.end());
  c_params.insert(c_params.end(), C_nonzero.begin(), C_nonzero.end());
  b_params.insert(b_params.end(), C_nonzero.begin(), C_nonzero.end());
  c_params.emplace_back(C_offset);
  b_params.emplace_back(C_offset);
  c_params.emplace_back(message);
  b_params.emplace_back(message);
  c_params_L_offset = c_params.size();
  b_params_L_offset = b_params.size();
  c_params.resize(c_params.size() + 1);  //this is where L will be inserted later
  b_params.resize(b_params.size() + num_alpha_components);  //multisig aggregate public nonces for L will be inserted here later
  c_params_R_offset = c_params.size();
  b_params_R_offset = b_params.size();
  c_params.resize(c_params.size() + 1);  //this is where R will be inserted later
  b_params.resize(b_params.size() + num_alpha_components);  //multisig aggregate public nonces for R will be inserted here later
  b_params.emplace_back(I);
  b_params.emplace_back(D);
  b_params.insert(b_params.end(), s.begin(), s.begin() + l);    //fake responses before 'l'
  b_params.insert(b_params.end(), s.begin() + l + 1, s.end());  //fake responses after 'l'
  b_params.emplace_back();
  encode_int_to_key_le(l, b_params.back());  //real signing index 'l'
  b_params.emplace_back();
  encode_int_to_key_le(num_alpha_components, b_params.back());  //number of parallel nonces
  b_params.emplace_back();
  encode_int_to_key_le(n, b_params.back());  //number of ring members

  rct::keyV mu_P_params;
  rct::keyV mu_C_params;
  mu_P_params.reserve(n * 2 + 4);
  mu_C_params.reserve(n * 2 + 4);

  mu_P_params.push_back(string_to_key(config::HASH_KEY_CLSAG_AGG_0));
  mu_C_params.push_back(string_to_key(config::HASH_KEY_CLSAG_AGG_1));
  mu_P_params.insert(mu_P_params.end(), P.begin(), P.end());
  mu_C_params.insert(mu_C_params.end(), P.begin(), P.end());
  mu_P_params.insert(mu_P_params.end(), C_nonzero.begin(), C_nonzero.end());
  mu_C_params.insert(mu_C_params.end(), C_nonzero.begin(), C_nonzero.end());
  mu_P_params.emplace_back(I);
  mu_C_params.emplace_back(I);
  mu_P_params.emplace_back(scalarmultKey(D, rct::INV_EIGHT));
  mu_C_params.emplace_back(mu_P_params.back());
  mu_P_params.emplace_back(C_offset);
  mu_C_params.emplace_back(C_offset);
  mu_P = hash_to_scalar(mu_P_params);
  mu_C = hash_to_scalar(mu_C_params);

  rct::geDsmp I_precomp;
  rct::geDsmp D_precomp;
  rct::precomp(I_precomp.k, I);
  rct::precomp(D_precomp.k, D);
  rct::key wH_l;
  rct::addKeys3(wH_l, mu_P, I_precomp.k, mu_C, D_precomp.k);
  rct::precomp(wH_l_precomp.k, wH_l);
  W_precomp.resize(n);
  H_precomp.resize(n);
  for (std::size_t i = 0; i < n; ++i) {
    rct::geDsmp P_precomp;
    rct::geDsmp C_precomp;
    rct::key C;
    rct::subKeys(C, C_nonzero[i], C_offset);
    rct::precomp(P_precomp.k, P[i]);
    rct::precomp(C_precomp.k, C);
    rct::key W;
    rct::addKeys3(W, mu_P, P_precomp.k, mu_C, C_precomp.k);
    rct::precomp(W_precomp[i].k, W);
    ge_p3 Hi_p3;
    rct::hash_to_p3(Hi_p3, P[i]);
    ge_dsm_precomp(H_precomp[i].k, &Hi_p3);
  }
  rct::precomp(G_precomp.k, rct::G);
  this->l = l;
  this->s = s;
  this->num_alpha_components = num_alpha_components;

  initialized = true;
  return true;
}
//----------------------------------------------------------------------------------------------------------------------
bool CLSAG_context_t::combine_alpha_and_compute_challenge(
  const rct::keyV& total_alpha_G,
  const rct::keyV& total_alpha_H,
  const rct::keyV& alpha,
  rct::key& alpha_combined,
  rct::key& c_0,
  rct::key& c
)
{
  if (not initialized)
    return false;

  if (num_alpha_components != total_alpha_G.size())
    return false;
  if (num_alpha_components != total_alpha_H.size())
    return false;
  if (num_alpha_components != alpha.size())
    return false;

  // insert aggregate public nonces for L and R components
  for (std::size_t i = 0; i < num_alpha_components; ++i) {
    b_params[b_params_L_offset + i] = total_alpha_G[i];
    b_params[b_params_R_offset + i] = total_alpha_H[i];
  }

  // musig2-style combination factor 'b'
  const rct::key b = rct::hash_to_scalar(b_params);

  // 1) store combined public nonces in the 'L' and 'R' slots for computing the initial challenge
  //    - L = sum_i(b^i total_alpha_G[i])
  //    - R = sum_i(b^i total_alpha_H[i])
  // 2) compute the local signer's combined private nonce
  //    - alpha_combined = sum_i(b^i * alpha[i])
  rct::key& L_l = c_params[c_params_L_offset];
  rct::key& R_l = c_params[c_params_R_offset];
  rct::key b_i = rct::identity();
  L_l = rct::identity();
  R_l = rct::identity();
  alpha_combined = rct::zero();
  for (std::size_t i = 0; i < num_alpha_components; ++i) {
    rct::addKeys(L_l, L_l, rct::scalarmultKey(total_alpha_G[i], b_i));
    rct::addKeys(R_l, R_l, rct::scalarmultKey(total_alpha_H[i], b_i));
    sc_muladd(alpha_combined.bytes, alpha[i].bytes, b_i.bytes, alpha_combined.bytes);
    sc_mul(b_i.bytes, b_i.bytes, b.bytes);
  }

  // compute initial challenge from real spend components
  c = rct::hash_to_scalar(c_params);

  // 1) c_0: find the CLSAG's challenge for index '0', which will be stored in the proof
  // note: in the CLSAG implementation in ringct/rctSigs, c_0 is denoted 'c1' (a notation error)
  // 2) c:   find the final challenge for the multisig signers to respond to
  for (std::size_t i = (l + 1) % n; i != l; i = (i + 1) % n) {
    if (i == 0)
      c_0 = c;
    rct::addKeys3(c_params[c_params_L_offset], s[i], G_precomp.k, c, W_precomp[i].k);
    rct::addKeys3(c_params[c_params_R_offset], s[i], H_precomp[i].k, c, wH_l_precomp.k);
    c = rct::hash_to_scalar(c_params);
  }
  if (l == 0)
    c_0 = c;

  return true;
}
//----------------------------------------------------------------------------------------------------------------------
bool CLSAG_context_t::get_mu(
  rct::key& mu_P,
  rct::key& mu_C
) const
{
  if (not initialized)
    return false;
  mu_P = this->mu_P;
  mu_C = this->mu_C;
  return true;
}
//----------------------------------------------------------------------------------------------------------------------
} //namespace signing

} //namespace multisig