-
Notifications
You must be signed in to change notification settings - Fork 1.1k
ecdsa sign-to-contract module, with anti nonce covert chan util functions #637
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
0929853
Add ec_commitments which are essentially the pay-to-contract-style tw…
jonasnick bfbf416
Add and expose sign-to-contract opening with parse and serialize func…
jonasnick 962ce23
modules: add ecdsa_sign_to_contract
benma 18cb435
ecdsa_sign_to_contract: add Anti Nonce Covert Channel util functions
benma File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| #ifndef SECP256K1_ECDSA_SIGN_TO_CONTRACT_H | ||
| #define SECP256K1_ECDSA_SIGN_TO_CONTRACT_H | ||
|
|
||
| #include "secp256k1.h" | ||
|
|
||
| #ifdef __cplusplus | ||
| extern "C" { | ||
| #endif | ||
|
|
||
| /** Same as secp256k1_ecdsa_sign, but s2c_data32 is committed to by adding `hash(R1, s2c_data32)` to | ||
| * the nonce generated by noncefp, with `ndata=hash(s2c_data32, ndata)`. | ||
| * Returns: 1: signature created | ||
| * 0: the nonce generation function failed, or the private key was invalid. | ||
| * Args: ctx: pointer to a context object, initialized for signing (cannot be NULL) | ||
| * Out: sig: pointer to an array where the signature will be placed (cannot be NULL) | ||
| * s2c_opening: pointer to an secp256k1_s2c_opening structure which can be | ||
| * NULL but is required to be not NULL if this signature creates | ||
| * a sign-to-contract commitment (i.e. the `s2c_data` argument | ||
| * is not NULL). | ||
| * In: | ||
| * msg32: the 32-byte message hash being signed (cannot be NULL) | ||
| * seckey: pointer to a 32-byte secret key (cannot be NULL) | ||
| * s2c_data32: pointer to a 32-byte data to create an optional | ||
| * sign-to-contract commitment to if not NULL (can be NULL). | ||
| * noncefp: pointer to a nonce generation function. | ||
| * If NULL, secp256k1_nonce_function_default is used. | ||
| * Must be the default if s2c_data32 is not NULL. | ||
| * ndata: pointer to arbitrary data used by the nonce generation function (can be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_sign( | ||
| const secp256k1_context* ctx, | ||
| secp256k1_ecdsa_signature *sig, | ||
| secp256k1_s2c_opening *s2c_opening, | ||
| const unsigned char *msg32, | ||
| const unsigned char *seckey, | ||
| const unsigned char* s2c_data32, | ||
| secp256k1_nonce_function noncefp, | ||
| const void *ndata | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| /** Verify a sign-to-contract commitment. | ||
| * | ||
| * Returns: 1: the signature contains a commitment to data32 | ||
| * 0: incorrect opening | ||
| * Args: ctx: a secp256k1 context object, initialized for verification. | ||
| * In: sig: the signature containing the sign-to-contract commitment (cannot be NULL) | ||
| * data32: the 32-byte data that was committed to (cannot be NULL) | ||
| * opening: pointer to the opening created during signing (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_verify_commit( | ||
| const secp256k1_context* ctx, | ||
| const secp256k1_ecdsa_signature *sig, | ||
| const unsigned char *data32, | ||
| const secp256k1_s2c_opening *opening | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); | ||
|
|
||
| /** Compute commitment on the client as part of the ECDSA Anti Nonce Covert Channel Protocol. | ||
| * | ||
| * ECDSA Anti Nonce Covert Channel Protocol: | ||
| * 1. The host draws randomness `k2`, commits to it with sha256 and sends the commitment to the client. | ||
| * 2. The client commits to its original nonce `k1` using the host commitment by calling | ||
| * `secp256k1_ecdsa_anti_covert_channel_client_commit`. The client sends the resulting commitment | ||
| * `R1` to the host. | ||
| * 3. The host replies with `k2` generated in step 1. | ||
| * 4. The client signs with `secp256k1_ecdsa_s2c_sign`, using the `k2` as `s2c_data` and | ||
| * sends the signature and opening to the host. | ||
| * 5. The host verifies that `R_x = (R1 + H(R1, k2)*G)_x`, where R_x is the `r` part of the signature by using | ||
| * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify` with the client's | ||
| * commitment from step 2 and the signature and opening received in step 4. If verification does | ||
| * not succeed, the protocol failed and can be restarted. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * Out: client_commit: pointer to a pubkey where the clients public nonce will be | ||
| * placed. (cannot be NULL) | ||
| * In: msg32: the 32-byte message hash to be signed (cannot be NULL) | ||
| * seckey32: the 32-byte secret key used for signing (cannot be NULL) | ||
| * noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used | ||
| * rand_commitment32: the 32-byte randomness commitment from the host (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit( | ||
| const secp256k1_context* ctx, | ||
| secp256k1_pubkey *client_commit, | ||
| const unsigned char *msg32, | ||
| const unsigned char *seckey32, | ||
| unsigned char *rand_commitment32 | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| /** Create a randomness commitment on the host as part of the ECDSA Anti Nonce Covert Channel Protocol. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * Out: rand_commitment32: pointer to 32-byte array to store the returned commitment (cannot be NULL) | ||
| * In: rand32: the 32-byte randomness to commit to (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_commit( | ||
| secp256k1_context *ctx, | ||
| unsigned char *rand_commitment32, | ||
| const unsigned char *rand32 | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); | ||
|
|
||
| /** Verify that a clients signature contains the hosts randomness as part of the Anti | ||
| * Nonce Covert Channel Protocol. Does not verify the signature itself. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * In: sig: pointer to the signature whose randomness should be verified | ||
| * (cannot be NULL) | ||
| * rand32: pointer to the 32-byte randomness from the host which should | ||
| * be included by the signature (cannot be NULL) | ||
| * opening: pointer to the opening produced by the client when signing | ||
| * with `rand32` as `s2c_data` (cannot be NULL) | ||
| * client_commit: pointer to the client's commitment created in | ||
| * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit` | ||
| * (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify( | ||
| secp256k1_context *ctx, | ||
| const secp256k1_ecdsa_signature *sig, | ||
| const unsigned char *rand32, | ||
| const secp256k1_s2c_opening *opening, | ||
| const secp256k1_pubkey *client_commit | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| #ifdef __cplusplus | ||
| } | ||
| #endif | ||
|
|
||
| #endif /* SECP256K1_ECDSA_SIGN_TO_CONTRACT_H */ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| include_HEADERS += include/secp256k1_ecdsa_sign_to_contract.h | ||
| noinst_HEADERS += src/modules/ecdsa_sign_to_contract/main_impl.h | ||
| noinst_HEADERS += src/modules/ecdsa_sign_to_contract/tests_impl.h |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: The
with [...]part is a bit difficult to understand. Also noncefp is alwayssecp256k1_nonce_function_default. Perhaps for this function we can remove thenoncefpandndataargument because they don't have a purpose anyway.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are we sure that there is no use case for
ndatawhen you could also provides2c_data? I am not familiar with uses ofndatain general, but ifs2c_dataalone is enough for all cases, thenndatacould also be removed fromsecp256k1_schnorrsig_sign?I can remove
noncefp, but we could also keep it so other functions could be allowed in the future without breaking API compatibility.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ndatais for giving additional information to the nonce function. Since it is hashed withs2c_dataI don't see how you'd transmit usable information to the nonce function in that way.ndatashouldn't be removed fromschnorrsig_signbecauseschnorrsig_signcan be used with other nonce functions than just the default. Imo, simpler is better than optimizing for some unknown future usecase.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Dropped the
noncefpandndataparams from the function in the alternative here. Can also do it for this version if we choose this alternative over the other.