1use crate::{signature::Signature, Error};
  2use ark_crypto_primitives::sponge::{
  3    poseidon::{PoseidonConfig, PoseidonSponge},
  4    Absorb, CryptographicSponge,
  5};
  6use ark_ec::{
  7    twisted_edwards::{Affine, TECurveConfig},
  8    AffineRepr,
  9};
 10use ark_ff::PrimeField;
 11use ark_serialize::{CanonicalDeserialize, CanonicalSerialize};
 12use digest::Digest;
 13use digest::OutputSizeUser;
 14use rand_core::CryptoRngCore;
 15
 16fn prune_buffer<F: PrimeField>(mut bytes: [u8; 32]) -> F {
 17    bytes[0] &= 0b1111_1000;
 18    bytes[31] &= 0b0111_1111;
 19    bytes[31] |= 0b0100_0000;
 20    F::from_le_bytes_mod_order(&bytes[..])
 21}
 22
 23#[derive(Copy, Clone, Debug)]
 24/// EdDSA secret key is 32 byte data
 25pub struct SecretKey([u8; 32]);
 26
 27impl SecretKey {
 28    fn expand<F: PrimeField, D: Digest>(&self) -> (F, [u8; 32]) {
 29        let hash = D::new().chain_update(self.0).finalize();
 30        let (buffer, hash_prefix) = hash.split_at(32);
 31        let buffer: [u8; 32] = buffer.try_into().unwrap();
 32        let hash_prefix: [u8; 32] = hash_prefix.try_into().unwrap();
 33        let x = prune_buffer(buffer);
 34        (x, hash_prefix)
 35    }
 36
 37    pub fn to_bytes(&self) -> [u8; 32] {
 38        self.0
 39    }
 40
 41    pub fn from_bytes(bytes: &[u8; 32]) -> Self {
 42        Self(bytes.clone())
 43    }
 44}
 45
 46/// `PublicKey` is EdDSA signature verification key
 47#[derive(Copy, Clone, Debug, CanonicalSerialize, CanonicalDeserialize)]
 48pub struct PublicKey<TE: TECurveConfig>(Affine<TE>);
 49
 50impl<TE: TECurveConfig> PublicKey<TE> {
 51    pub fn xy(&self) -> (&TE::BaseField, &TE::BaseField) {
 52        self.as_ref().xy().unwrap()
 53    }
 54
 55    pub fn to_bytes(&self) -> Vec<u8> {
 56        let mut bytes = Vec::new();
 57        self.serialize_compressed(&mut bytes).unwrap();
 58        bytes
 59    }
 60
 61    pub fn from_bytes(bytes: &[u8]) -> Result<Self, Box<dyn ark_std::error::Error>> {
 62        let point = Affine::<TE>::deserialize_compressed(bytes)?;
 63        Ok(Self(point))
 64    }
 65}
 66
 67impl<TE: TECurveConfig> From<Affine<TE>> for PublicKey<TE> {
 68    fn from(affine: Affine<TE>) -> Self {
 69        Self(affine)
 70    }
 71}
 72
 73impl<TE: TECurveConfig> AsRef<Affine<TE>> for PublicKey<TE> {
 74    fn as_ref(&self) -> &Affine<TE> {
 75        &self.0
 76    }
 77}
 78
 79#[derive(Copy, Clone, Debug)]
 80/// `SigningKey` produces EdDSA signatures for given message
 81pub struct SigningKey<TE: TECurveConfig> {
 82    secret_key: SecretKey,
 83    public_key: PublicKey<TE>,
 84}
 85
 86impl<TE: TECurveConfig + Clone> SigningKey<TE>
 87where
 88    TE::BaseField: PrimeField + Absorb,
 89{
 90    pub fn new<D: Digest>(secret_key: &SecretKey) -> Result<Self, Error> {
 91        (<D as OutputSizeUser>::output_size() == 64)
 92            .then_some(())
 93            .ok_or(Error::BadDigestOutput)?;
 94
 95        let (x, _) = secret_key.expand::<TE::ScalarField, D>();
 96        let public_key: Affine<TE> = (Affine::<TE>::generator() * x).into();
 97        let signing_key = Self {
 98            secret_key: *secret_key,
 99            public_key: PublicKey(public_key),
100        };
101
102        Ok(signing_key)
103    }
104
105    pub fn from_bytes<D: Digest>(bytes: &[u8; 32]) -> Result<Self, Error> {
106        let secret_key = SecretKey::from_bytes(bytes);
107        Self::new::<D>(&secret_key)
108    }
109
110    pub fn to_bytes(&self) -> [u8; 32] {
111        self.secret_key.to_bytes()
112    }
113
114    pub fn generate<D: Digest>(rng: &mut impl CryptoRngCore) -> Result<Self, Error> {
115        let mut secret_key = SecretKey([0; 32]);
116        rng.fill_bytes(&mut secret_key.0);
117        Self::new::<D>(&secret_key)
118    }
119
120    pub fn public_key(&self) -> &PublicKey<TE> {
121        &self.public_key
122    }
123
124    pub fn sign<D: Digest, E: Absorb>(
125        &self,
126        poseidon: &PoseidonConfig<TE::BaseField>,
127        message: &[E],
128    ) -> Signature<TE> {
129        let (x, prefix) = self.secret_key.expand::<TE::ScalarField, D>();
130
131        let mut h = D::new();
132        h.update(prefix);
133        message
134            .iter()
135            .for_each(|m| h.update(m.to_sponge_bytes_as_vec()));
136        let r: TE::ScalarField = crate::from_digest(h);
137        let sig_r: Affine<TE> = (Affine::<TE>::generator() * r).into();
138
139        let mut poseidon = PoseidonSponge::new(poseidon);
140
141        let (sig_r_x, sig_r_y) = sig_r.xy().unwrap();
142        poseidon.absorb(sig_r_x);
143        poseidon.absorb(sig_r_y);
144        let (pk_x, pk_y) = self.public_key.0.xy().unwrap();
145        poseidon.absorb(pk_x);
146        poseidon.absorb(pk_y);
147        message.iter().for_each(|m| poseidon.absorb(m));
148
149        let k = poseidon.squeeze_field_elements::<TE::ScalarField>(1);
150        let k = k.first().unwrap();
151
152        let sig_s = (x * k) + r;
153
154        Signature::new(sig_r, sig_s)
155    }
156}
157
158impl<TE: TECurveConfig> SigningKey<TE> {
159    pub fn shared_key<D: Digest>(&self, recipient: &PublicKey<TE>) -> [u8; 32] {
160        let (x, _) = self.secret_key.expand::<TE::ScalarField, D>();
161        let shared_key: Affine<TE> = (*recipient.as_ref() * x).into();
162        let mut data = Vec::new();
163        shared_key.serialize_compressed(&mut data).unwrap();
164        data[00..32].try_into().unwrap()
165    }
166}
167
168impl<TE: TECurveConfig + Clone> PublicKey<TE>
169where
170    TE::BaseField: PrimeField + Absorb,
171{
172    pub fn verify<E: Absorb>(
173        &self,
174        poseidon: &PoseidonConfig<TE::BaseField>,
175        message: &[E],
176        signature: &Signature<TE>,
177    ) -> Result<(), Error> {
178        let mut poseidon = PoseidonSponge::new(poseidon);
179
180        let (sig_r_x, sig_r_y) = signature.r().xy().unwrap();
181        poseidon.absorb(sig_r_x);
182        poseidon.absorb(sig_r_y);
183        let (pk_x, pk_y) = self.0.xy().unwrap();
184        poseidon.absorb(pk_x);
185        poseidon.absorb(pk_y);
186        message.iter().for_each(|m| poseidon.absorb(m));
187
188        let k = poseidon.squeeze_field_elements::<TE::ScalarField>(1);
189        let k = k.first().unwrap();
190
191        let kx_b = self.0 * k;
192        let s_b = Affine::<TE>::generator() * signature.s();
193        let r_rec: Affine<TE> = (s_b - kx_b).into();
194
195        (signature.r() == &r_rec).then_some(()).ok_or(Error::Verify)
196    }
197}