|
| 1 | +#ifndef SECP256K1_ECDSA_ANTI_COVERT_CHANNEL_H |
| 2 | +#define SECP256K1_ECDSA_ANTI_COVERT_CHANNEL_H |
| 3 | + |
| 4 | +#include "secp256k1.h" |
| 5 | + |
| 6 | +#ifdef __cplusplus |
| 7 | +extern "C" { |
| 8 | +#endif |
| 9 | + |
| 10 | +/** Same as secp256k1_ecdsa_sign, but s2c_data32 is committed to by adding `hash(R1, s2c_data32)` to |
| 11 | + * the nonce generated by noncefp, with `ndata=hash(s2c_data32, ndata)`. |
| 12 | + * Returns: 1: signature created |
| 13 | + * 0: the nonce generation function failed, or the private key was invalid. |
| 14 | + * Args: ctx: pointer to a context object, initialized for signing (cannot be NULL) |
| 15 | + * Out: sig: pointer to an array where the signature will be placed (cannot be NULL) |
| 16 | + * s2c_opening: pointer to an secp256k1_s2c_opening structure which can be |
| 17 | + * NULL but is required to be not NULL if this signature creates |
| 18 | + * a sign-to-contract commitment (i.e. the `s2c_data` argument |
| 19 | + * is not NULL). nonce_is_negated is always 0 for ecdsa. |
| 20 | + * In: |
| 21 | + * msg32: the 32-byte message hash being signed (cannot be NULL) |
| 22 | + * seckey: pointer to a 32-byte secret key (cannot be NULL) |
| 23 | + * s2c_data32: pointer to a 32-byte data to create an optional |
| 24 | + * sign-to-contract commitment to if not NULL (can be NULL). |
| 25 | + * noncefp: pointer to a nonce generation function. |
| 26 | + * If NULL, secp256k1_nonce_function_default is used. |
| 27 | + * Must be the default if s2c_data32 is not NULL. |
| 28 | + * ndata: pointer to arbitrary data used by the nonce generation function (can be NULL) |
| 29 | + */ |
| 30 | +SECP256K1_API int secp256k1_ecdsa_s2c_sign( |
| 31 | + const secp256k1_context* ctx, |
| 32 | + secp256k1_ecdsa_signature *sig, |
| 33 | + secp256k1_s2c_opening *s2c_opening, |
| 34 | + const unsigned char *msg32, |
| 35 | + const unsigned char *seckey, |
| 36 | + const unsigned char* s2c_data32, |
| 37 | + secp256k1_nonce_function noncefp, |
| 38 | + const void *ndata |
| 39 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); |
| 40 | + |
| 41 | +/** Verify a sign-to-contract commitment. |
| 42 | + * |
| 43 | + * Returns: 1: the signature contains a commitment to data32 |
| 44 | + * 0: incorrect opening |
| 45 | + * Args: ctx: a secp256k1 context object, initialized for verification. |
| 46 | + * In: sig: the signature containing the sign-to-contract commitment (cannot be NULL) |
| 47 | + * data32: the 32-byte data that was committed to (cannot be NULL) |
| 48 | + * opening: pointer to the opening created during signing (cannot be NULL) |
| 49 | + */ |
| 50 | +SECP256K1_API int secp256k1_ecdsa_s2c_verify_commit( |
| 51 | + const secp256k1_context* ctx, |
| 52 | + const secp256k1_ecdsa_signature *sig, |
| 53 | + const unsigned char *data32, |
| 54 | + const secp256k1_s2c_opening *opening |
| 55 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); |
| 56 | + |
| 57 | +/** Compute commitment on the client as part of the ECDSA Anti Nonce Covert Channel Protocol. |
| 58 | + * |
| 59 | + * ECDSA Anti Nonce Covert Channel Protocol: |
| 60 | + * 1. The host draws randomness `k2`, commits to it with sha256 and sends the commitment to the client. |
| 61 | + * 2. The client commits to its original nonce `k1` using the host commitment by calling |
| 62 | + * `secp256k1_ecdsa_anti_covert_channel_client_commit`. The client sends the resulting commitment |
| 63 | + * `R1` to the host. |
| 64 | + * 3. The host replies with `k2` generated in step 1. |
| 65 | + * 4. The client signs with `secp256k1_ecdsa_s2c_sign`, using the `k2` as `s2c_data` and |
| 66 | + * sends the signature and opening to the host. |
| 67 | + * 5. The host verifies that `R_x = (R1 + H(R1, k2)*G)_x`, where R_x is the `r` part of the signature by using |
| 68 | + * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify` with the client's |
| 69 | + * commitment from step 2 and the signature and opening received in step 4. If verification does |
| 70 | + * not succeed, the protocol failed and can be restarted. |
| 71 | + * |
| 72 | + * Returns 1 on success, 0 on failure. |
| 73 | + * Args: ctx: pointer to a context object (cannot be NULL) |
| 74 | + * Out: client_commit: pointer to a pubkey where the clients public nonce will be |
| 75 | + * placed. (cannot be NULL) |
| 76 | + * In: msg32: the 32-byte message hash to be signed (cannot be NULL) |
| 77 | + * seckey32: the 32-byte secret key used for signing (cannot be NULL) |
| 78 | + * noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used |
| 79 | + * rand_commitment32: the 32-byte randomness commitment from the host (cannot be NULL) |
| 80 | + */ |
| 81 | +SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit( |
| 82 | + const secp256k1_context* ctx, |
| 83 | + secp256k1_pubkey *client_commit, |
| 84 | + const unsigned char *msg32, |
| 85 | + const unsigned char *seckey32, |
| 86 | + unsigned char *rand_commitment32 |
| 87 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); |
| 88 | + |
| 89 | +/** Create a randomness commitment on the host as part of the ECDSA Anti Nonce Covert Channel Protocol. |
| 90 | + * |
| 91 | + * Returns 1 on success, 0 on failure. |
| 92 | + * Args: ctx: pointer to a context object (cannot be NULL) |
| 93 | + * Out: rand_commitment32: pointer to 32-byte array to store the returned commitment (cannot be NULL) |
| 94 | + * In: rand32: the 32-byte randomness to commit to (cannot be NULL) |
| 95 | + */ |
| 96 | +SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_commit( |
| 97 | + secp256k1_context *ctx, |
| 98 | + unsigned char *rand_commitment32, |
| 99 | + const unsigned char *rand32 |
| 100 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); |
| 101 | + |
| 102 | +/** Verify that a clients signature contains the hosts randomness as part of the Anti |
| 103 | + * Nonce Covert Channel Protocol. Does not verify the signature itself. |
| 104 | + * |
| 105 | + * Returns 1 on success, 0 on failure. |
| 106 | + * Args: ctx: pointer to a context object (cannot be NULL) |
| 107 | + * In: sig: pointer to the signature whose randomness should be verified |
| 108 | + * (cannot be NULL) |
| 109 | + * rand32: pointer to the 32-byte randomness from the host which should |
| 110 | + * be included by the signature (cannot be NULL) |
| 111 | + * opening: pointer to the opening produced by the client when signing |
| 112 | + * with `rand32` as `s2c_data` (cannot be NULL) |
| 113 | + * client_commit: pointer to the client's commitment created in |
| 114 | + * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit` |
| 115 | + * (cannot be NULL) |
| 116 | + */ |
| 117 | +SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify( |
| 118 | + secp256k1_context *ctx, |
| 119 | + const secp256k1_ecdsa_signature *sig, |
| 120 | + const unsigned char *rand32, |
| 121 | + const secp256k1_s2c_opening *opening, |
| 122 | + const secp256k1_pubkey *client_commit |
| 123 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); |
| 124 | + |
| 125 | +#ifdef __cplusplus |
| 126 | +} |
| 127 | +#endif |
| 128 | + |
| 129 | +#endif /* SECP256K1_RECOVERY_H */ |
0 commit comments