mirror of
https://github.com/trezor/trezor-firmware.git
synced 2025-07-02 04:42:33 +00:00

templates: build style: correct math in comment [260130c1] xmr: show address fix [abd27e6c] xmr: reorganize module structure [cd9e5a5d] xmr: simplify layout code [a5b56f17] xmr: monero.crypto test fix [60bc30ec] xmr: minor fixes [f82bd9c0] xmr: use trezor.utils.ensure [adf119ac] xmr: get rid of xmr.common module [3531a42f] pipenv: temporary fix attempt for travis - until pipenv bug is resolved [d172f86f] xmr: protob messages refactored [e83085ea] trezor-common version bump & messages regenerated xmr: mlsag_hasher simplified [feb5f1c6] xmr: simplify key_image_sync workflow [d4cb0084] xmr: tiny note in README and typo [62411cde] xmr: readme updates [ff15b46e] xmr: rename and order mlsag functions [3fb57dab] xmr: mlsag notes [c27ae90b] xmr: output index check added in step6 [973c457b] xmr: grouping is mandatory [684c7e19] xmr: range sig grouping check added [012ca766] xmr: small refactor in borromean range proof [1ba72b65] xmr: move range signatures to seperate file; rename mlsag2 to mlsag [a89f3ab0] xmr: fix wrong annotation in modtrezorcrypto [8303b42f] xmr: state's use_simple_rct and use_bulletproof modified to enums [276712a9] xmr: re-export most of functions in apps.monero.xmr.crypto [74165457] xmr: out_pk_masks changed to out_pk_commitments [1e186727] xmr: state comments [3c69a2e1] xmr: TrezorTxPrefixHashNotMatchingError note removed only concerns multisig [5af0feae] xmr: master merging commit xmr: step 10 review [d8e99375] xmr: step 09 review [a510150d] travis: workaround form 6a0ea22b6eb3bdc9bce62d7c88fb8841ef8fdb0c [03d27115] mocks: regenerate [bd24bb35] mocks: add support for entering the global scope [f75c1902] mocks: regenerate [bce85968] modtrezorcrypto: define mock package [7c077521] mocks: support package definition [b3f1017b] xmr: step 05 and 06 masks and range proofs review Masks are now always generated in step 5 and stored in state. Range proofs were reviewed only in a high-level manner and will be reviewed later. [67f391cd] xmr: step 08 review [673bf01f] xmr: steps 04, 05, 06 (almost) and 07 review _range_proof in step 06 is still to be reviewed [24c52517] xmr: simplify serialization, remove Archive [896cdebf] xmr: redundant exception removed [cb3813aa] xmr: serializer simplified [471213b4] xmr: serializer flake8 fix [9d4df17f] xmr: aescbc not needed [52dd8b3b] xmr: serializer - erefs kicked out [9e3be78f] xmr: sign cleanup, comments - state cleanup, comments added, unused code removed [164a7d6a] xmr: sign step 09 - fix in_memory artifact, dead branch [8fa4066d] xmr: sign step 03 - permutation length check added [55a593aa] xmr: multisig removed from protocol and functions [6470678d] xmr: black styling [02664401] xmr: step 03 review [daf7b7d6] xmr: step 02 review xmr: adding agent tests to travis [c752866f] xmr: unused imports removed [85115fd9] xmr: serializer test fixed - removed unsupported messages after serialization simplification [60874751] xmr: sign step 06 - comment on bulletproof hashing - hash_bp(bp) != hash(serialize(bp)) because hash does not contain array lengths [4abb5473] xmr: sign protocol - multisig logic removed [813cb3a0] xmr: lite protocol removed - backup left in xmr-total-full-with-lite branch [e5f5b5bd] xmr: serialization slimming - base types reduced, not needed for now - some int serialization methods not used now [fb515aaf] xmr: serialization - archive simplified - simple parameter passing, no kwargs - unused methods removed - reader/writer passing removed for archive methods [ec4c4adb] xmr: KeccakXmrArchive simplified, no archive used - getting rid of container_size. We dont use containers with fixed size so this special case can be abandoned. - KeccakXmrArchive is lighweight without need to touch main serialization [90065bd4] xmr: serialization - serialize_archive removed - custom serialization routine is not required at this moment [b98c2f89] xmr: extra serialization refactored, manual serialization - extra is serialized manually to reduce serialization overhead - extra contains simple structures now: - payment ID = already serialized manually - tx pub key = easy to serialize manually - tx additional pub keys = serialized manually with little effort, more efficient memory usage [8ce28a54] xmr: state 6 - provided tx keys removed - needed only in the multisig scenario which is pruned now [8d827f46] xmr: PreMlsagHasher pseudo out hashing fix [49e552da] xmr: redundant import removed [4199943d] xmr: KeccakXmrArchive simplified [69bbf5fa] xmr: PreMlsagHasher - KeyV import removed, comment added [9a194fa2] xmr: step7 - manual hashing of Extra [d8a09283] xmr: PreMlsagHasher state load/save removed - not needed, state not serialized anymore [d5f43fa4] xmr: serialize reimport removed - complex types are not surviving protocol boundary anymore, no need to fix hierarchy problems due to unimporting [3b045612] xmr: serialize - TupleType removed [b9a56981] xmr: serialization schemes simplified [a59dbb8d] xmr: HashWrapper removed [d0d1f05b] xmr: step 01 cleanup and comments [8f7a7782] xmr: isort, black, flake8 fixes [14265eb2] xmr: getting rid of CtKey from the state - only lightweight objects are kept in the state. CtKey is import heavy object. Each set_out call locally imports a new own version of the Ctkey which causes a memory leak. [c0cfc203] xmr: set_out minor function call fix [c11c4686] xmr: sign_tx unimport optimization to reduce fragmentation [df0a1dfc] xmr: range_sig allocation reordering, large chunks first [63cddd5f] xmr: remove misc.StdObj [8c8e3f33] xmr: proper memory usage in workflow [9be1e0ac] xmr: typos and renames [87f718b5] xmr: back to flat workflow [64751339] xmr: refactor builder to seperate steps - lot of work to be done, but the general idea will probably stay - the messages workflow works, but the signed tx was not accepted by daemon, so there is a bug somewhere - additional cleanup/refactoring is defintely needed [14b0a851] xmr: iface modified to layout [27d568e1] xmr: extmod refactoring - *_into removed, replaced by generic methods - point_add, point_sub added - code cleanup (+1 squashed commit) Squashed commits: [fbe39496] monero support added Squashed commits: xmr: hmac/enc keys removed from builder [41028dff] xmr: unused function removed [358573e3] xmr: PR comments fixes [4abf9dc9] xmr: test fixes after refactoring [192785ad] template rebuilt [57a1f25e] xmr: wrapper protocol messages removed [6f40ce17] xmr: trezor-common version bump & sync [03e71de2] xmr: check input permutation [6fc8b0ec] xmr: code cleanup, refactoring [85ecc151] xmr: crypto code cleanup [20b4113c] xmr: chunked bulletproof vectors - workaround for the heap fragmentation problems [66786f9d] tools: enable to reset class level indentation for mocks gen [dc6f84a9] xmr: extmod-monero comments added, for mocks [b1d4ab11] xmr: code cleanup [447a8625] xmr: tsx confirmation raises exception on cancellation [00dd8f6c] xmr: protocol optimizations removed, flow unified - in_memory optimization stored tx.vin parts in the memory which enabled to skip roundtrips with permutations and hash_vini. Optimizations was removed so the protocol flow is unified among inputs, independent of the tx specs - many_inputs: optimization stored spending keys for UTXO in memory, now it is offloaded in the encrypted form. [ea69c7ad] vendor: trezor-common version bump & pb sync [5d81c2a8] xmr: manual BP serialization - more memory effective as the memory is critical in the range proof section [d64bda7c] xmr: range_proof C-impl deprecated - using now partitioned implementation in Python, which is also quite fast and easier to maintain due to allocations and buffers. [18604e0f] xmr: borromean range sig generated by partitions - overcomes heap fragmentation problem [65a5116b] xmr: comments removed [ca2bd0cc] xmr: auto-generated intelliJ param comments removed [a75ef32e] xmr: code cleanup, heap fragmentations fixes Squashed commits: [d2ac2eb6] xmr: addr cleanup [7e4c1a9c] xmr: code cleanup, heap fragmentations fixes [93af8afb] xmr: refactoring, typing, comments [28df8662] xmr: comment fix [8b4f4d9c] xmr: serializer test fix (+34 squashed commits) Squashed commits: [823ee192] xmr: crypto comment cleanup [6debfb6b] xmr: ring_ct cleanup [759f52bf] xmr: tsx signer code style, hintins [0b175bc9] xmr: tsx builder external state removed [fee4a5ad] xmr: builder state fix [92736fa7] xmr: sign_tx unimport [a570ecb9] xmr: misc code cleanup [4a496bb7] xmr: hash wrapper not needed in writer [fefdb834] xmr: signer serialization improved [8fa6eec9] xmr: signer mem clean [66c53fe5] xmr: isort [6996bd90] xmr: black [59915a85] xmr: tsx input serialization refactored [326af131] xmr: msg dump with prefix [6e39801d] xmr: manual serialization of tx prefix [9e5e047a] xmr: manual serialization improvements [d07cee60] xmr: manual serialization of txout elements [8d56c80e] xmr: TxOut custom serialization optimized II [c19ba122] xmr: TxOut custom serialization optimized [ce0d9b0b] xmr: TxOut manual serialization [44e38342] xmr: sing_tx unimport [61ac61be] xmr: lite log trace rename [176b4275] xmr: de-async overhaul [89ae3bad] xmr: diag style [5ccb2fbb] xmr: wrappers cleanup [aa86fb19] xmr: py3 only inheritance [8031b1b0] xmr: builder, log_trace -> mem_trace for clarity [25bf70d7] xmr: debugging logging only in debug mode [c7c8d3c8] xmr: iface cleanup [b0373396] xmr: lite debug only [b1f6ce04] xmr: diag only in debug [de7d718b] xmr: tsx counter removed [76729beb] xmr: tsx_sign removed [c6e6ffa8] Merge commit 'ba500bf4ec1ef9cd953bdf5a47888c5226db8d0b' into xmr [ee97ef9f] xmr: minor code cleanup xmr: black xmr: minor code cleanup [bae3ecac] xmr: bp comments [5e812e6f] xmr: sign - mem_trace, pydoc [7216a8c6] xmr: pydoc removed [e87365f4] xmr: layout cleanup [8d21d82e] xmr: redundant constructors removed [9aa82bed] xmr: redundant comments removed [9b926d6c] xmr: preludes removed [bc9e77f1] xmr: readme update [cf62047a] xmr: aggregated bulletproofs + rsig offloading xmr: change idx fix xmr: iface refactoring, integrated address (+5 squashed commits) xmr: layout pagination refactoring xmr: addr - integrated address pb: sync vendor: trezor-common version bump xmr: style fixes xmr: handle sweep tsx correctly - handle dummy change address correctly xmr: integrated address generation build: fix after trezor-crypto version bump xmr: new protocol dispatch handlers xmr: slip0010 [43cf4c3c] xmr: comment fix xmr: extmod pointer aritm fix xmr: _into api unified, result is the first parameter xmr: bp cleanup xmr: scalar nullity test fix xmr: msg registration improved - lite protocol optional - diag protocol optional xmr: unused imports (+33 squashed commits) [b4d045ae] xmr: bp - noqa flake8 false positive [2c79d4be] xmr: isort [8b9d2835] xmr: code cleanup [eb7496e9] xmr: iface - shorter timeouts for faster tests [59520b63] xmr: ringct comment [6b16088e] xmr: signer - comment fixes [a08958e2] xmr: simple and bulletproof condition fix [4e0289a9] vendor: trezor-common version bump [de472e5a] xmr: black [234d2249] xmr: lightening, fixes, KeccakXmrArchive - builder keys - unload mods before memory intensive operation [abdec665] xmr: sign_tx logging [989d8687] xmr: serialize lightening [7d61f056] xmr: tsx sign refactoring, lightening - wake_up state restore - minimize import weight [3a0daa8b] xmr: serialize thinning [65ad1d2e] xmr: serialize thinning [501221d5] xmr: bp - thinning [3d980377] xmr: bp - generalization with proof_v8 [10d11d60] xmr: extended rsig - offloading protocol [a8f5caa2] xmr: crypto - rsig params fix [f5e130b8] xmr: crypto - inv8 [dbc3f9d8] xmr: rsig pb sync [5748a13e] xmr: bp - data for bp4 fix (+18 squashed commits) Squashed commits: [5bcd54e3] xmr: bp - black [e93e97dd] xmr: bp refactoring, large memory optimizations - memoryview in __getitem__ requires new memory allocation so the refactored version uses to(), read() methods that can operate directly on buffers without need to create memory views. [c30745ae] xmr: bp - black [f5c40699] xmr: bp - tests extended [8dae75de] xmr: bp - get_exponent optim [3e59ff80] xmr: bp - precomputations for 4 statements [d1d2e29c] xmr: bp - gc.collect [1bb6b5ba] xmr: bp - optimizations, streamlining [2a2b0cb7] xmr: bp - verification in log(MN) memory for 1 proof - not allocating MN vectors - sequential multiexec added for memory efficient verification - bulletproofs: maintain -z4, -z5, and -y0 to avoid subtractions [8276d25] - bulletproofs: merge multiexps as per sarang's new python code [acd64d2b] [75aa7dee] xmr: bp - memory optimization [a10d05a9] xmr: bp - deterministic mask generation init [5060d6a7] xmr: bp optimizations [dd69eb1b] xmr: bp - black [19f0f64b] xmr: bp - optimizations, power key vector [2ba63f8c] xmr: bp - minor cleanup, optimizations, scalarmultH [31c9ca2d] xmr: bp - mem clean [3fc2c793] xmr: bp - memory save [5b16c9cc] bp: black [f1040c97] xmr: crypto - memory leak fix [ff863510] xmr: iface - flake [6ebf69c2] xmr: lite - flake8, black [eee55d62] xmr: bp - memory diag [2767009b] xmr: bulletproofs upgrade, mainnet version, cleaning [be6ebbd5] xmr: lite protocol [d603e96d] xmr: pb sync [5da15da9] vendor: trezor-common fix [0373b97e] xmr: iface - output confirmation split, subaddr fix [2cf32176] xmr: monero - subaddress fixed for index (0, 0) [3bb8f08b] xmr: enc.aescbc added - for lite protocol (+1 squashed commit) Squashed commits: [011dbaab] TMP: trezor-common on master, crypto on ph4 - trezor-crypto on ph4r04 fork as it has all required stuff - Lite protocol not merged in master, thus does not work in the PR [795b34e1] xmr: get_address fix [2d39c90c] xmr: bp - import fix (squashed commit) Squashed commits: [2d5c6cee] extmod: monero - reduce32 and ge25519_norm removed (squashed commit) - not needed in trezor-core (+4 squashed commits) Squashed commits: [90e6b5c5] xmr: bp optimization [4fda0d22] xmr: redundant ge_ functions removed [68903767] xmr: crypto - sc_reduce32 not needed [c8a6c807] xmr: test for inversion added (+12 squashed commits) Squashed commits: [378928db] xmr: adapting to new trezor-crypto [8f4ff8c1] protob sync [82dff70a] vendor: trezor-common version bump [fabc67b3] extmod: monero - inversion mod curve order optimized a bit [4f29fe4c] xmr: import fix [f6f8e300] xmr: bp - code cleanup [d54b4f3b] xmr: bp - memory cleaning [1065abc3] xmr: tsx_signer - bulletproofs fixes [9f8a700f] xmr: bp key vector iterator fix [49c25977] xmr.serialize: bulletproof fix [1ee77378] xmr: monero - format [cf0a7104] xmr: bp last mask fix (+20 squashed commits) Squashed commits: [fa1c3623] xmr: black [3f3e31f3] xmr: bulletproofs added to signer [d23d9284] xmr: protocol.tsx_sign_builder - logger collects [a28eb55f] xmr: bp - memory optimizations [d2fcb23a] xmr: tests for bulletproofs added [82eef146] xmr: bp - gc (+14 squashed commits) Squashed commits: [4cf70d97] xmr: bp - gc [42877b05] xmr: bp - minor memory optimization [2c612e45] xmr: bp - use sc_inv_into [d7e9dab4] xmr: bp - KeyVEval fix [1523f400] xmr: bp - blacked [b264a65b] xmr: bp - KeyVEval - caching current element, avoid allocations [83ba7a65] xmr: bp - memory view optimized [b517906c] xmr: bp - gc() during inversion [92d37c88] xmr: bp - gc.collect() after expensive inversion [e7fad558] xmr: bp - hashing memory optimization [4c278152] xmr: bp - deterministic masks optimization, prove_s1 optim [cbf74a70] xmr: bp - detect which modular inversion is usable [8ea1ec43] xmr: better memory tracing for bulletproofs [2f4dd552] xmr: bulletproofs added [1928e2d3] xmr: crypto - sc_inv_into added (+2 squashed commits) Squashed commits: [f895fa6e] xmr: crypto - hash to existing buffer [b76c6b09] xmr: crypto - in-place crypto functions added - required for Bulletproof to minimize the heap fragmentation [cab4366e] extmod: monero - modular inversion mod curve order added (+2 squashed commits) Squashed commits: [52a6e487] extmod: monero - hash into buffer added [695a3827] extmod: monero module - muladd256_modm added - required for Bulletproof [3f4498d7] xmr: crypto tests added - basic unit tests for crypto, tests monero module and underlying trezor-crypto + basic address manipulation [820d012d] pb sync [49eeddd1] vendor: trezor-common version bump [30382440] xmr: crypto - point norm not needed [89701c41] tests: xmr - serializer tests added [bfee46db] tests: support async unit tests, assertListEqual added [55c14487] xmr: serialize - serialization logic cleaned, refactored [4b771638] xmr: simplification, do not ask to confirm change tx output - change address checked to match main address in the builder [f334d8ad] xmr: protocol: simplification - require change address to equal the main address [1a3416eb] xmr: unpack256_modm_noreduce added - 32B array to integer mod curve order, without modular reduction after conversion - required for bulletproofs [1c94b5d4] xmr: readme added [3cc9f9fa] extmod/monero: mul256_modm added, required for BP [5cf77a4c] xmr: monero support added [for review] depends on PRs: https://github.com/trezor/trezor-crypto/pull/162 https://github.com/trezor/trezor-core/pull/286
321 lines
11 KiB
Python
321 lines
11 KiB
Python
"""
|
|
Multilayer Linkable Spontaneous Anonymous Group (MLSAG)
|
|
Optimized versions with incremental hashing.
|
|
Both Simple and Full Monero tx types are supported.
|
|
|
|
See https://eprint.iacr.org/2015/1098.pdf for details.
|
|
Also explained in From Zero to Monero section 3.3 and 5.
|
|
|
|
----------
|
|
|
|
Please note, that the MLSAG code is written in a generic manner,
|
|
where it is designed for multiple public keys (aka inputs). In another
|
|
words, MLSAG should be used to sign multiple inputs, but that is currently
|
|
not the case of Monero, where the inputs are signed one by one.
|
|
So the public keys matrix has always two rows (one for public keys,
|
|
one for commitments), although the algorithm is designed for `n` rows.
|
|
|
|
This has one unfortunate effect where `rows` is always equal to 2 and
|
|
dsRows always to 1, but the algorithm is still written as the numbers
|
|
are arbitrary. That's why there are loops such as `for i in range(dsRows)`
|
|
where it is run only once currently.
|
|
|
|
----------
|
|
|
|
Also note, that the matrix of public keys is indexed by columns first.
|
|
This is because the code was ported from the official Monero client,
|
|
which is written in C++ and where it does have some memory advantages.
|
|
|
|
For ring size = 3 and one input the matrix M will look like this:
|
|
|------------------------|------------------------|------------------------|
|
|
| public key 0 | public key 1 | public key 2 |
|
|
| cmt 0 - pseudo_out cmt | cmt 1 - pseudo_out cmt | cmt 2 - pseudo_out cmt |
|
|
|
|
and `sk` is equal to:
|
|
|--------------|-----------------------------------------------------|
|
|
| private key* | input secret key's mask - pseudo_out's mask (alpha) |
|
|
|
|
* corresponding to one of the public keys (`index` denotes which one)
|
|
|
|
----------
|
|
|
|
Mostly ported from official Monero client, but also inspired by Mininero.
|
|
Author: Dusan Klinec, ph4r05, 2018
|
|
"""
|
|
from apps.monero.xmr import crypto
|
|
|
|
|
|
def generate_mlsag_full(
|
|
message, pubs, in_sk, out_sk_mask, out_pk_commitments, kLRki, index, txn_fee_key
|
|
):
|
|
cols = len(pubs)
|
|
if cols == 0:
|
|
raise ValueError("Empty pubs")
|
|
rows = len(pubs[0])
|
|
if rows == 0:
|
|
raise ValueError("Empty pub row")
|
|
for i in range(cols):
|
|
if len(pubs[i]) != rows:
|
|
raise ValueError("pub is not rectangular")
|
|
|
|
if len(in_sk) != rows:
|
|
raise ValueError("Bad inSk size")
|
|
if len(out_sk_mask) != len(out_pk_commitments):
|
|
raise ValueError("Bad outsk/putpk size")
|
|
|
|
sk = _key_vector(rows + 1)
|
|
M = _key_matrix(rows + 1, cols)
|
|
for i in range(rows + 1):
|
|
sk[i] = crypto.sc_0()
|
|
|
|
for i in range(cols):
|
|
M[i][rows] = crypto.identity()
|
|
for j in range(rows):
|
|
M[i][j] = crypto.decodepoint(pubs[i][j].dest)
|
|
M[i][rows] = crypto.point_add(
|
|
M[i][rows], crypto.decodepoint(pubs[i][j].commitment)
|
|
)
|
|
|
|
sk[rows] = crypto.sc_0()
|
|
for j in range(rows):
|
|
sk[j] = in_sk[j].dest
|
|
sk[rows] = crypto.sc_add(sk[rows], in_sk[j].mask) # add masks in last row
|
|
|
|
for i in range(cols):
|
|
for j in range(len(out_pk_commitments)):
|
|
M[i][rows] = crypto.point_sub(
|
|
M[i][rows], crypto.decodepoint(out_pk_commitments[j])
|
|
) # subtract output Ci's in last row
|
|
|
|
# Subtract txn fee output in last row
|
|
M[i][rows] = crypto.point_sub(M[i][rows], txn_fee_key)
|
|
|
|
for j in range(len(out_pk_commitments)):
|
|
sk[rows] = crypto.sc_sub(
|
|
sk[rows], out_sk_mask[j]
|
|
) # subtract output masks in last row
|
|
|
|
return generate_mlsag(message, M, sk, kLRki, index, rows)
|
|
|
|
|
|
def generate_mlsag_simple(message, pubs, in_sk, a, cout, kLRki, index):
|
|
"""
|
|
MLSAG for RctType.Simple
|
|
:param message: the full message to be signed (actually its hash)
|
|
:param pubs: vector of MoneroRctKey; this forms the ring; point values in encoded form; (dest, mask) = (P, C)
|
|
:param in_sk: CtKey; spending private key with input commitment mask (original); better_name: input_secret_key
|
|
:param a: mask from the pseudo output commitment; better name: pseudo_out_alpha
|
|
:param cout: pseudo output commitment; point, decoded; better name: pseudo_out_c
|
|
:param kLRki: used only in multisig, currently not implemented
|
|
:param index: specifies corresponding public key to the `in_sk` in the pubs array
|
|
:return: MgSig
|
|
"""
|
|
# Monero signs inputs separately, so `rows` always equals 2 (pubkey, commitment)
|
|
# and `dsRows` is always 1 (denotes where the pubkeys "end")
|
|
rows = 2
|
|
dsRows = 1
|
|
cols = len(pubs)
|
|
if cols == 0:
|
|
raise ValueError("Empty pubs")
|
|
|
|
sk = _key_vector(rows)
|
|
M = _key_matrix(rows, cols)
|
|
|
|
sk[0] = in_sk.dest
|
|
sk[1] = crypto.sc_sub(in_sk.mask, a)
|
|
|
|
for i in range(cols):
|
|
M[i][0] = crypto.decodepoint(pubs[i].dest)
|
|
M[i][1] = crypto.point_sub(crypto.decodepoint(pubs[i].commitment), cout)
|
|
|
|
return generate_mlsag(message, M, sk, kLRki, index, dsRows)
|
|
|
|
|
|
def gen_mlsag_assert(pk, xx, kLRki, index, dsRows):
|
|
"""
|
|
Conditions check
|
|
"""
|
|
cols = len(pk)
|
|
if cols <= 1:
|
|
raise ValueError("Cols == 1")
|
|
if index >= cols:
|
|
raise ValueError("Index out of range")
|
|
|
|
rows = len(pk[0])
|
|
if rows == 0:
|
|
raise ValueError("Empty pk")
|
|
|
|
for i in range(cols):
|
|
if len(pk[i]) != rows:
|
|
raise ValueError("pk is not rectangular")
|
|
if len(xx) != rows:
|
|
raise ValueError("Bad xx size")
|
|
if dsRows > rows:
|
|
raise ValueError("Bad dsRows size")
|
|
if kLRki and dsRows != 1:
|
|
raise ValueError("Multisig requires exactly 1 dsRows")
|
|
if kLRki:
|
|
raise NotImplementedError("Multisig not implemented")
|
|
return rows, cols
|
|
|
|
|
|
def generate_first_c_and_key_images(
|
|
message, rv, pk, xx, kLRki, index, dsRows, rows, cols
|
|
):
|
|
"""
|
|
MLSAG computation - the part with secret keys
|
|
:param message: the full message to be signed (actually its hash)
|
|
:param rv: MgSig
|
|
:param pk: matrix of public keys and commitments
|
|
:param xx: input secret array composed of a private key and commitment mask
|
|
:param kLRki: used only in multisig, currently not implemented
|
|
:param index: specifies corresponding public key to the `xx`'s private key in the `pk` array
|
|
:param dsRows: row number where the pubkeys "end" (and commitments follow)
|
|
:param rows: total number of rows
|
|
:param cols: size of ring
|
|
"""
|
|
Ip = _key_vector(dsRows)
|
|
rv.II = _key_vector(dsRows)
|
|
alpha = _key_vector(rows)
|
|
rv.ss = _key_matrix(rows, cols)
|
|
|
|
tmp_buff = bytearray(32)
|
|
hasher = _hasher_message(message)
|
|
|
|
for i in range(dsRows):
|
|
# this is somewhat extra as compared to the Ring Confidential Tx paper
|
|
# see footnote in From Zero to Monero section 3.3
|
|
hasher.update(crypto.encodepoint(pk[index][i]))
|
|
if kLRki:
|
|
raise NotImplementedError("Multisig not implemented")
|
|
# alpha[i] = kLRki.k
|
|
# rv.II[i] = kLRki.ki
|
|
# hash_point(hasher, kLRki.L, tmp_buff)
|
|
# hash_point(hasher, kLRki.R, tmp_buff)
|
|
|
|
else:
|
|
Hi = crypto.hash_to_point(crypto.encodepoint(pk[index][i]))
|
|
alpha[i] = crypto.random_scalar()
|
|
# L = alpha_i * G
|
|
aGi = crypto.scalarmult_base(alpha[i])
|
|
# Ri = alpha_i * H(P_i)
|
|
aHPi = crypto.scalarmult(Hi, alpha[i])
|
|
# key image
|
|
rv.II[i] = crypto.scalarmult(Hi, xx[i])
|
|
_hash_point(hasher, aGi, tmp_buff)
|
|
_hash_point(hasher, aHPi, tmp_buff)
|
|
|
|
Ip[i] = rv.II[i]
|
|
|
|
for i in range(dsRows, rows):
|
|
alpha[i] = crypto.random_scalar()
|
|
# L = alpha_i * G
|
|
aGi = crypto.scalarmult_base(alpha[i])
|
|
# for some reasons we omit calculating R here, which seems
|
|
# contrary to the paper, but it is in the Monero official client
|
|
# see https://github.com/monero-project/monero/blob/636153b2050aa0642ba86842c69ac55a5d81618d/src/ringct/rctSigs.cpp#L191
|
|
_hash_point(hasher, pk[index][i], tmp_buff)
|
|
_hash_point(hasher, aGi, tmp_buff)
|
|
|
|
# the first c
|
|
c_old = hasher.digest()
|
|
c_old = crypto.decodeint(c_old)
|
|
return c_old, Ip, alpha
|
|
|
|
|
|
def generate_mlsag(message, pk, xx, kLRki, index, dsRows):
|
|
"""
|
|
Multilayered Spontaneous Anonymous Group Signatures (MLSAG signatures)
|
|
|
|
:param message: the full message to be signed (actually its hash)
|
|
:param pk: matrix of public keys and commitments
|
|
:param xx: input secret array composed of a private key and commitment mask
|
|
:param kLRki: used only in multisig, currently not implemented
|
|
:param index: specifies corresponding public key to the `xx`'s private key in the `pk` array
|
|
:param dsRows: separates pubkeys from commitment
|
|
:return MgSig
|
|
"""
|
|
from apps.monero.xmr.serialize_messages.tx_full import MgSig
|
|
|
|
rows, cols = gen_mlsag_assert(pk, xx, kLRki, index, dsRows)
|
|
|
|
rv = MgSig()
|
|
c, L, R, Hi = 0, None, None, None
|
|
|
|
# calculates the "first" c, key images and random scalars alpha
|
|
c_old, Ip, alpha = generate_first_c_and_key_images(
|
|
message, rv, pk, xx, kLRki, index, dsRows, rows, cols
|
|
)
|
|
|
|
i = (index + 1) % cols
|
|
if i == 0:
|
|
rv.cc = c_old
|
|
|
|
tmp_buff = bytearray(32)
|
|
while i != index:
|
|
rv.ss[i] = _generate_random_vector(rows)
|
|
hasher = _hasher_message(message)
|
|
|
|
for j in range(dsRows):
|
|
# L = rv.ss[i][j] * G + c_old * pk[i][j]
|
|
L = crypto.add_keys2(rv.ss[i][j], c_old, pk[i][j])
|
|
Hi = crypto.hash_to_point(crypto.encodepoint(pk[i][j]))
|
|
# R = rv.ss[i][j] * H(pk[i][j]) + c_old * Ip[j]
|
|
R = crypto.add_keys3(rv.ss[i][j], Hi, c_old, rv.II[j])
|
|
_hash_point(hasher, pk[i][j], tmp_buff)
|
|
_hash_point(hasher, L, tmp_buff)
|
|
_hash_point(hasher, R, tmp_buff)
|
|
|
|
for j in range(dsRows, rows):
|
|
# again, omitting R here as discussed above
|
|
L = crypto.add_keys2(rv.ss[i][j], c_old, pk[i][j])
|
|
_hash_point(hasher, pk[i][j], tmp_buff)
|
|
_hash_point(hasher, L, tmp_buff)
|
|
|
|
c = crypto.decodeint(hasher.digest())
|
|
c_old = c
|
|
i = (i + 1) % cols
|
|
|
|
if i == 0:
|
|
rv.cc = c_old
|
|
|
|
for j in range(rows):
|
|
rv.ss[index][j] = crypto.sc_mulsub(c, xx[j], alpha[j])
|
|
|
|
return rv
|
|
|
|
|
|
def _key_vector(rows):
|
|
return [None] * rows
|
|
|
|
|
|
def _key_matrix(rows, cols):
|
|
"""
|
|
first index is columns (so slightly backward from math)
|
|
"""
|
|
rv = [None] * cols
|
|
for i in range(0, cols):
|
|
rv[i] = _key_vector(rows)
|
|
return rv
|
|
|
|
|
|
def _generate_random_vector(n):
|
|
"""
|
|
Generates vector of random scalars
|
|
"""
|
|
return [crypto.random_scalar() for _ in range(0, n)]
|
|
|
|
|
|
def _hasher_message(message):
|
|
"""
|
|
Returns incremental hasher for MLSAG
|
|
"""
|
|
ctx = crypto.get_keccak()
|
|
ctx.update(message)
|
|
return ctx
|
|
|
|
|
|
def _hash_point(hasher, point, tmp_buff):
|
|
crypto.encodepoint_into(tmp_buff, point)
|
|
hasher.update(tmp_buff)
|