mirror of
https://github.com/urbit/shrub.git
synced 2024-12-21 18:01:32 +03:00
312 lines
7.6 KiB
Plaintext
312 lines
7.6 KiB
Plaintext
/- *ring
|
|
:: ring signatures over the edwards curve
|
|
::
|
|
|%
|
|
:: +oracle: deterministic random response on input
|
|
::
|
|
++ oracle
|
|
|= input=*
|
|
:: l:ed is ecc-n
|
|
(mod (shaz (jam input)) l:ed:crypto)
|
|
::
|
|
::::
|
|
::
|
|
:: +generate-public-linkage: generate public linkage information
|
|
::
|
|
++ generate-public-linkage
|
|
|= link-scope=*
|
|
^- [data=@ h=@udpoint]
|
|
::
|
|
=/ data=@ (oracle link-scope)
|
|
=/ h=@udpoint (scalarmult-base:ed:crypto data)
|
|
[data h]
|
|
|
|
:: +generate-linkage: generates linkage information from scope and private key
|
|
::
|
|
:: data: deterministically picked data point based off scope
|
|
:: h: h = [data] * g
|
|
:: y: y = [x] * h
|
|
++ generate-linkage
|
|
|= [link-scope=(unit *) my-private-key=@]
|
|
^- (unit [data=@ h=@udpoint y=@udpoint])
|
|
::
|
|
?~ link-scope
|
|
~
|
|
::
|
|
=+ [data=@ h=@udpoint]=(generate-public-linkage u.link-scope)
|
|
=/ y=@udpoint (scalarmult:ed:crypto my-private-key h)
|
|
[~ data h y]
|
|
:: +generate-challenge: generate challenge from a given message
|
|
::
|
|
:: When :link-scope is ~ (ie, we're not building a linked ring signature),
|
|
:: calculates just the hash of `[message g]`. Otherwise, weaves the linkage
|
|
:: state into the challenge.
|
|
::
|
|
++ generate-challenge
|
|
|= $: :: common to both linked and unlinked
|
|
message=*
|
|
g=@udpoint
|
|
:: high level universal state
|
|
::
|
|
link-state=(unit [data=@ h=@udpoint y=@udpoint])
|
|
:: point to include in challenge when link-state isn't ~
|
|
::
|
|
h=(unit @udpoint)
|
|
==
|
|
^- @
|
|
::
|
|
%- oracle
|
|
?~ link-state
|
|
[message g]
|
|
[data.u.link-state y.u.link-state message g (need h)]
|
|
:: +generate-challenges: generates the full list of challenges
|
|
::
|
|
++ generate-challenges
|
|
|= $: link-state=(unit [data=@ h=@udpoint y=@udpoint])
|
|
message=*
|
|
public-keys=(list @udpoint)
|
|
ss=(list @)
|
|
::
|
|
prev-k=@u
|
|
prev-s=@
|
|
prev-ch=@
|
|
challenges=(list @)
|
|
==
|
|
^- (list @)
|
|
::
|
|
=/ gs=@udpoint
|
|
%- add-scalarmult-scalarmult-base:ed:crypto :*
|
|
prev-ch
|
|
(snag prev-k public-keys)
|
|
prev-s
|
|
==
|
|
::
|
|
=/ hs=(unit @udpoint)
|
|
?~ link-state
|
|
~
|
|
::
|
|
:- ~
|
|
%- add-double-scalarmult:ed:crypto :*
|
|
prev-s
|
|
h.u.link-state
|
|
prev-ch
|
|
y.u.link-state
|
|
==
|
|
::
|
|
=/ ch=@
|
|
(generate-challenge message gs link-state hs)
|
|
::
|
|
?~ ss
|
|
[ch challenges]
|
|
::
|
|
%_ $
|
|
prev-k (mod (add prev-k 1) (lent public-keys))
|
|
prev-s i.ss
|
|
prev-ch ch
|
|
ss t.ss
|
|
challenges [ch challenges]
|
|
==
|
|
:: +scalarmult-h: maybe multiply u by h in linkage
|
|
::
|
|
:: Since linkage tags are optional, we need to be able to just do the math
|
|
:: in case :linkage is set and fall through otherwise. +scalarmult-h is used
|
|
:: to generate the (unit point) consumed by +generate-challenge.
|
|
::
|
|
++ scalarmult-h
|
|
|= [u=@ linkage=(unit [data=@ h=@udpoint y=@udpoint])]
|
|
^- (unit @udpoint)
|
|
?~ linkage
|
|
~
|
|
[~ (scalarmult:ed:crypto u h.u.linkage)]
|
|
:: +reorder: reorders a list so the ith element is first
|
|
::
|
|
++ reorder
|
|
|* [i=@ l=(list)]
|
|
%+ weld
|
|
(slag i l)
|
|
(scag i l)
|
|
--
|
|
:: Signature interface
|
|
::
|
|
|%
|
|
:: +sign: creates a ring signature on an ed25519 curve
|
|
::
|
|
:: Creates an optionally linkable ring signature on
|
|
::
|
|
++ sign
|
|
|= $: message=*
|
|
link-scope=(unit *)
|
|
::
|
|
anonymity-set=(set @udpoint)
|
|
my-public-key=@udpoint
|
|
my-private-key=@udscalar
|
|
::
|
|
eny=@uvJ
|
|
==
|
|
^- ring-signature
|
|
|^ :: k: our public-key's position in :anonymity-list
|
|
::
|
|
=/ k=@u
|
|
~| [%couldnt-find my-public-key in=anonymity-list]
|
|
(need (find [my-public-key ~] anonymity-list))
|
|
:: Generate linkage information if given
|
|
::
|
|
=/ linkage=(unit [data=@ h=@udpoint y=@udpoint])
|
|
(generate-linkage link-scope my-private-key)
|
|
:: initialize our random number generator from entropy
|
|
::
|
|
=+ rand=~(. og eny)
|
|
:: generate the random s values used in the ring
|
|
::
|
|
=^ random-s-values=(list @) rand
|
|
=| count=@
|
|
=| random-s-values=(list @)
|
|
|-
|
|
?: =(count (sub participants 1))
|
|
[random-s-values rand]
|
|
::
|
|
=^ v=@ rand (rads:rand l:ed:crypto)
|
|
$(count (add 1 count), random-s-values [v random-s-values])
|
|
::
|
|
?> ?=(^ random-s-values)
|
|
=/ sk1=@ i.random-s-values
|
|
=/ sk2-to-prev-sk=(list @) t.random-s-values
|
|
:: Pick a random :u
|
|
::
|
|
=^ u=@ rand
|
|
(rads:rand l:ed:crypto)
|
|
:: Compute challenge at k + 1
|
|
::
|
|
=/ chk1=@
|
|
%- generate-challenge :*
|
|
message
|
|
(scalarmult-base:ed:crypto u)
|
|
linkage
|
|
(scalarmult-h u linkage)
|
|
==
|
|
:: Generate challenges for [ck, ..., c1, c0, ... ck + 2, ck + 1]
|
|
::
|
|
=/ reversed-chk-to-chk1=(list @)
|
|
%- generate-challenges :*
|
|
linkage
|
|
message
|
|
anonymity-list
|
|
sk2-to-prev-sk
|
|
::
|
|
(mod (add k 1) participants)
|
|
sk1
|
|
chk1
|
|
[chk1 ~]
|
|
==
|
|
=/ chk=@ (head reversed-chk-to-chk1)
|
|
:: Compute s = u - x * c mod n
|
|
::
|
|
=/ sk=@ (~(dif fo l:ed:crypto) u (mul my-private-key chk))
|
|
::
|
|
=/ ordered-challenges=(list @)
|
|
(order-challenges k (flop reversed-chk-to-chk1))
|
|
::
|
|
=/ ordered-ss=(list @) (order-ss k [sk sk1 sk2-to-prev-sk])
|
|
=/ ch0 (head ordered-challenges)
|
|
::
|
|
[ch0 ordered-ss ?~(linkage ~ `y.u.linkage)]
|
|
::
|
|
++ anonymity-list
|
|
~(tap in anonymity-set)
|
|
::
|
|
++ participants
|
|
(lent anonymity-list)
|
|
::
|
|
++ order-challenges
|
|
|= [k=@ ch=(list @)]
|
|
(reorder (sub participants (add k 1)) ch)
|
|
::
|
|
++ order-ss
|
|
|= [k=@ sk-to-prev-sk=(list @)]
|
|
(reorder (sub participants k) sk-to-prev-sk)
|
|
--
|
|
:: +verify: verify signature
|
|
::
|
|
++ verify
|
|
|= $: message=*
|
|
link-scope=(unit *)
|
|
::
|
|
anonymity-set=(set @udpoint)
|
|
signature=ring-signature
|
|
==
|
|
^- ?
|
|
:: TODO: if our signature has a linking y, we must have a link-scope and
|
|
:: vice versa.
|
|
::
|
|
:: decompose the signature into [s0 s1 s2....]
|
|
::
|
|
?> ?=([@ @ *] s.signature)
|
|
=/ s0=@ i.s.signature
|
|
=/ s1=@ i.t.s.signature
|
|
=/ s2-to-end=(list @) t.t.s.signature
|
|
:: anonymity-list: set of public keys listified in ring order
|
|
::
|
|
=/ anonymity-list=(list @udpoint)
|
|
~(tap in anonymity-set)
|
|
:: participants: length of :anonymity-list
|
|
::
|
|
=/ participants=@u
|
|
(lent anonymity-list)
|
|
::
|
|
=/ z0p=@udpoint
|
|
%- add-scalarmult-scalarmult-base:ed:crypto :*
|
|
ch0.signature
|
|
(head anonymity-list)
|
|
s0
|
|
==
|
|
:: generate the linkage using public data, and the y point from the signature
|
|
::
|
|
=/ linkage=(unit [data=@ h=@udpoint y=@udpoint])
|
|
?~ link-scope
|
|
~
|
|
=+ [data=@ h=@udpoint]=(generate-public-linkage u.link-scope)
|
|
:- ~
|
|
[data h (need y.signature)]
|
|
::
|
|
=/ z0pp=(unit @udpoint)
|
|
?~ linkage
|
|
~
|
|
:- ~
|
|
%- add-double-scalarmult:ed:crypto :*
|
|
s0
|
|
h.u.linkage
|
|
ch0.signature
|
|
y.u.linkage
|
|
==
|
|
:: initial challenge
|
|
::
|
|
=/ ch1=@
|
|
(generate-challenge message z0p linkage z0pp)
|
|
::
|
|
=/ challenges
|
|
%- generate-challenges :*
|
|
linkage
|
|
message
|
|
anonymity-list
|
|
s2-to-end
|
|
::
|
|
(mod 1 participants)
|
|
s1
|
|
ch1
|
|
[ch1 ~]
|
|
==
|
|
::
|
|
=(ch0.signature (head challenges))
|
|
|
|
:: +public-key-for-ship:
|
|
::
|
|
:: TODO: We should go talk to Azimuth to get the ship's real public key. But
|
|
:: for now, we need to
|
|
::
|
|
++ public-key-for-ship
|
|
|= p=@p
|
|
^- @udpoint
|
|
::
|
|
(scalarmult-base:ed:crypto `@udscalar`p)
|
|
--
|