Keystone preparations

CHANGELOG.md

@@ -10,6 +10,9 @@ and this project adheres to Rust's notion of
 ### Added
 - Support for Partially-Created Zcash Transactions:
   - `orchard::builder::Builder::build_for_pczt`
+  - `orchard::note_encryption`:
+    - `OrchardDomain::for_pczt_action`
+    - `impl ShieldedOutput<OrchardDomain, ENC_CIPHERTEXT_SIZE> for orchard::pczt::Action`
   - `orchard::pczt` module.
 - `orchard::bundle::EffectsOnly`
 - `orchard::tree::MerklePath::{position, auth_path}`

Cargo.toml

@@ -24,27 +24,27 @@ rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 
 [dependencies]
 aes = "0.8"
-bitvec = "1"
-blake2b_simd = "1"
-ff = "0.13"
-fpe = "0.6"
-group = { version = "0.13", features = ["wnaf-memuse"] }
-hex = "0.4"
+bitvec = { version = "1", default-features = false }
+blake2b_simd = { version = "1", default-features = false }
+ff = { version = "0.13", default-features = false }
+fpe = { version = "0.6", default-features = false, features = ["alloc"] }
+group = "0.13"
+hex = { version = "0.4", default-features = false, features = ["alloc"] }
 lazy_static = "1"
-memuse = { version = "0.2.1", features = ["nonempty"] }
+memuse = { version = "0.2.2", default-features = false }
 pasta_curves = "0.5"
 proptest = { version = "1.0.0", optional = true }
-rand = "0.8"
-reddsa = "0.5"
+rand = { version = "0.8", default-features = false }
+reddsa = { version = "0.5", default-features = false }
 nonempty = "0.7"
 poseidon = { package = "halo2_poseidon", version = "0.1" }
-serde = { version = "1.0", features = ["derive"] }
+serde = { version = "1.0", default-features = false, features = ["derive"] }
 sinsemilla = "0.1"
-subtle = "2.3"
+subtle = { version = "2.3", default-features = false }
 zcash_note_encryption = "0.4"
-incrementalmerkletree = "0.7"
+incrementalmerkletree = { version = "0.7", default-features = false }
 zcash_spec = "0.1"
-zip32 = "0.1"
+zip32 = { version = "0.1", default-features = false }
 visibility = "0.1.1"
 
 # Circuit
@@ -55,7 +55,10 @@ halo2_proofs = { version = "0.3", optional = true, default-features = false, fea
 getset = "0.1"
 
 # Logging
-tracing = "0.1"
+tracing = { version = "0.1", default-features = false }
+
+# No-std support
+core2 = { version = "0.3", default-features = false, features = ["alloc"] }
 
 # Developer tooling dependencies
 image = { version = "0.24", optional = true }
@@ -79,7 +82,7 @@ bench = false
 
 [features]
 default = ["circuit", "multicore"]
-circuit = ["dep:halo2_gadgets", "dep:halo2_proofs"]
+circuit = ["dep:halo2_gadgets", "dep:halo2_proofs", "core2/std", "group/wnaf-memuse", "reddsa/std"]
 unstable-frost = []
 multicore = ["halo2_proofs?/multicore"]
 dev-graph = ["halo2_proofs?/dev-graph", "image", "plotters"]

src/builder.rs

@@ -1,9 +1,9 @@
 //! Logic for building Orchard components of transactions.
 
+use alloc::collections::BTreeMap;
+use alloc::vec::Vec;
 use core::fmt;
 use core::iter;
-use std::collections::BTreeMap;
-use std::fmt::Display;
 
 use ff::Field;
 use pasta_curves::pallas;
@@ -141,7 +141,7 @@ pub enum BuildError {
     BundleTypeNotSatisfiable,
 }
 
-impl Display for BuildError {
+impl fmt::Display for BuildError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         use BuildError::*;
         match self {
@@ -189,7 +189,7 @@ pub enum SpendError {
     FvkMismatch,
 }
 
-impl Display for SpendError {
+impl fmt::Display for SpendError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         use SpendError::*;
         f.write_str(match self {
@@ -206,7 +206,7 @@ impl std::error::Error for SpendError {}
 #[derive(Debug, PartialEq, Eq)]
 pub struct OutputError;
 
-impl Display for OutputError {
+impl fmt::Display for OutputError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.write_str("Outputs are not enabled for this builder")
     }
@@ -1137,7 +1137,9 @@ impl OutputView for OutputInfo {
 #[cfg(any(test, feature = "test-dependencies"))]
 #[cfg_attr(docsrs, doc(cfg(feature = "test-dependencies")))]
 pub mod testing {
+    use alloc::vec::Vec;
     use core::fmt::Debug;
+
     use incrementalmerkletree::{frontier::Frontier, Hashable};
     use rand::{rngs::StdRng, CryptoRng, SeedableRng};
 

src/bundle.rs

@@ -1,5 +1,7 @@
 //! Structs related to bundles of Orchard actions.
 
+use alloc::vec::Vec;
+
 pub mod commitments;
 
 #[cfg(feature = "circuit")]
@@ -474,14 +476,14 @@ impl<V> Bundle<Authorized, V> {
 
 impl<V: DynamicUsage> DynamicUsage for Bundle<Authorized, V> {
     fn dynamic_usage(&self) -> usize {
-        self.actions.dynamic_usage()
+        self.actions.tail.dynamic_usage()
             + self.value_balance.dynamic_usage()
             + self.authorization.proof.dynamic_usage()
     }
 
     fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
         let bounds = (
-            self.actions.dynamic_usage_bounds(),
+            self.actions.tail.dynamic_usage_bounds(),
             self.value_balance.dynamic_usage_bounds(),
             self.authorization.proof.dynamic_usage_bounds(),
         );
@@ -519,6 +521,8 @@ pub struct BundleAuthorizingCommitment(pub Blake2bHash);
 #[cfg(any(test, feature = "test-dependencies"))]
 #[cfg_attr(docsrs, doc(cfg(feature = "test-dependencies")))]
 pub mod testing {
+    use alloc::vec::Vec;
+
     use group::ff::FromUniformBytes;
     use nonempty::NonEmpty;
     use pasta_curves::pallas;

src/bundle/batch.rs

@@ -1,3 +1,5 @@
+use alloc::vec::Vec;
+
 use halo2_proofs::plonk;
 use pasta_curves::vesta;
 use rand::{CryptoRng, RngCore};

src/circuit.rs

@@ -1,5 +1,7 @@
 //! The Orchard Action circuit implementation.
 
+use alloc::vec::Vec;
+
 use group::{Curve, GroupEncoding};
 use halo2_proofs::{
     circuit::{floor_planner, Layouter, Value},
@@ -919,6 +921,7 @@ impl Proof {
 
 #[cfg(test)]
 mod tests {
+    use alloc::vec::Vec;
     use core::iter;
 
     use ff::Field;

src/constants/fixed_bases.rs

@@ -1,4 +1,8 @@
 //! Orchard fixed bases.
+
+#[cfg(feature = "circuit")]
+use alloc::vec::Vec;
+
 use super::{L_ORCHARD_SCALAR, L_VALUE};
 
 #[cfg(feature = "circuit")]

src/keys.rs

@@ -1,6 +1,7 @@
 //! Key structures for Orchard.
 
-use std::io::{self, Read, Write};
+use alloc::vec::Vec;
+use core2::io::{self, Read, Write};
 
 use ::zip32::{AccountId, ChildIndex};
 use aes::Aes256;
@@ -405,7 +406,7 @@ impl FullViewingKey {
         Self::from_bytes(&data).ok_or_else(|| {
             io::Error::new(
                 io::ErrorKind::InvalidInput,
-                "Unable to deserialize a valid Orchard FullViewingKey from bytes".to_owned(),
+                "Unable to deserialize a valid Orchard FullViewingKey from bytes",
             )
         })
     }
@@ -681,6 +682,7 @@ impl IncomingViewingKey {
 #[derive(Clone, Debug)]
 pub struct PreparedIncomingViewingKey(PreparedNonZeroScalar);
 
+#[cfg(feature = "circuit")]
 impl memuse::DynamicUsage for PreparedIncomingViewingKey {
     fn dynamic_usage(&self) -> usize {
         self.0.dynamic_usage()

src/lib.rs

@@ -7,6 +7,7 @@
 //! implicitly mean it is an Orchard payment address (as opposed to e.g. a Sapling payment
 //! address, which is also shielded).
 
+#![no_std]
 #![cfg_attr(docsrs, feature(doc_cfg))]
 // Temporary until we have more of the crate implemented.
 #![allow(dead_code)]
@@ -15,72 +16,79 @@
 #![deny(missing_debug_implementations)]
 #![deny(missing_docs)]
 #![deny(unsafe_code)]
 
+#[macro_use]
+extern crate alloc;
+
+extern crate std;
+
+use alloc::vec::Vec;
+
 mod action;
 mod address;
 pub mod builder;
 pub mod bundle;
 #[cfg(feature = "circuit")]
 pub mod circuit;
 mod constants;
 pub mod keys;
 pub mod note;
 pub mod note_encryption;
 pub mod pczt;
 pub mod primitives;
 mod spec;
 pub mod tree;
 pub mod value;
 pub mod zip32;
 
 #[cfg(test)]
 mod test_vectors;
 
 pub use action::Action;
 pub use address::Address;
 pub use bundle::Bundle;
 pub use constants::MERKLE_DEPTH_ORCHARD as NOTE_COMMITMENT_TREE_DEPTH;
 pub use note::Note;
 pub use tree::Anchor;
 
 /// A proof of the validity of an Orchard [`Bundle`].
 ///
 /// [`Bundle`]: crate::bundle::Bundle
 #[derive(Clone)]
 pub struct Proof(Vec<u8>);
 
 impl core::fmt::Debug for Proof {
     fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         if f.alternate() {
             f.debug_tuple("Proof").field(&self.0).finish()
         } else {
             // By default, only show the proof length, not its contents.
             f.debug_tuple("Proof")
                 .field(&format_args!("{} bytes", self.0.len()))
                 .finish()
         }
     }
 }
 
 impl AsRef<[u8]> for Proof {
     fn as_ref(&self) -> &[u8] {
         &self.0
     }
 }
 
 impl memuse::DynamicUsage for Proof {
     fn dynamic_usage(&self) -> usize {
         self.0.dynamic_usage()
     }
 
     fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
         self.0.dynamic_usage_bounds()
     }
 }
 
 impl Proof {
     /// Constructs a new Proof value.
     pub fn new(bytes: Vec<u8>) -> Self {
         Proof(bytes)
     }
 }

src/note_encryption.rs

@@ -1,5 +1,6 @@
 //! In-band secret distribution for Orchard bundles.
 
+use alloc::vec::Vec;
 use core::fmt;
 
 use blake2b_simd::{Hash, Params};
@@ -100,6 +101,13 @@ impl OrchardDomain {
         Self { rho: act.rho() }
     }
 
+    /// Constructs a domain that can be used to trial-decrypt a PCZT action's output note.
+    pub fn for_pczt_action(act: &crate::pczt::Action) -> Self {
+        Self {
+            rho: Rho::from_nf_old(act.spend().nullifier),
+        }
+    }
+
     /// Constructs a domain that can be used to trial-decrypt this action's output note.
     pub fn for_compact_action(act: &CompactAction) -> Self {
         Self { rho: act.rho() }
@@ -266,6 +274,20 @@ impl<T> ShieldedOutput<OrchardDomain, ENC_CIPHERTEXT_SIZE> for Action<T> {
     }
 }
 
+impl ShieldedOutput<OrchardDomain, ENC_CIPHERTEXT_SIZE> for crate::pczt::Action {
+    fn ephemeral_key(&self) -> EphemeralKeyBytes {
+        EphemeralKeyBytes(self.output().encrypted_note().epk_bytes)
+    }
+
+    fn cmstar_bytes(&self) -> [u8; 32] {
+        self.output().cmx().to_bytes()
+    }
+
+    fn enc_ciphertext(&self) -> &[u8; ENC_CIPHERTEXT_SIZE] {
+        &self.output().encrypted_note().enc_ciphertext
+    }
+}
+
 /// A compact Action for light clients.
 #[derive(Clone)]
 pub struct CompactAction {

src/pczt.rs

@@ -1,7 +1,9 @@
 //! PCZT support for Orchard.
 
-use std::collections::BTreeMap;
-use std::fmt;
+use alloc::collections::BTreeMap;
+use alloc::string::String;
+use alloc::vec::Vec;
+use core::fmt;
 
 use getset::Getters;
 use pasta_curves::pallas;

src/pczt/io_finalizer.rs

@@ -1,3 +1,5 @@
+use alloc::vec::Vec;
+
 use rand::{CryptoRng, RngCore};
 
 use crate::{

src/pczt/parse.rs

@@ -1,4 +1,6 @@
-use std::collections::BTreeMap;
+use alloc::collections::BTreeMap;
+use alloc::string::String;
+use alloc::vec::Vec;
 
 use ff::PrimeField;
 use incrementalmerkletree::Hashable;

src/pczt/prover.rs

@@ -1,3 +1,5 @@
+use alloc::vec::Vec;
+
 use halo2_proofs::plonk;
 use rand::{CryptoRng, RngCore};
 

src/pczt/updater.rs

@@ -1,3 +1,6 @@
+use alloc::string::String;
+use alloc::vec::Vec;
+
 use super::{Action, Bundle, Zip32Derivation};
 
 impl Bundle {

src/primitives/redpallas.rs

@@ -5,6 +5,7 @@ use core::cmp::{Ord, Ordering, PartialOrd};
 use pasta_curves::pallas;
 use rand::{CryptoRng, RngCore};
 
+#[cfg(feature = "circuit")]
 pub use reddsa::batch;
 
 #[cfg(test)]
@@ -126,6 +127,7 @@ impl VerificationKey<SpendAuth> {
     }
 
     /// Creates a batch validation item from a `SpendAuth` signature.
+    #[cfg(feature = "circuit")]
     pub fn create_batch_item<M: AsRef<[u8]>>(
         &self,
         sig: Signature<SpendAuth>,
@@ -135,6 +137,7 @@ impl VerificationKey<SpendAuth> {
     }
 }
 
+#[cfg(feature = "circuit")]
 impl VerificationKey<Binding> {
     /// Creates a batch validation item from a `Binding` signature.
     pub fn create_batch_item<M: AsRef<[u8]>>(