1use crate::{signature::Signature, Error};
  2use ark_crypto_primitives::sponge::{
  3    poseidon::{PoseidonConfig, PoseidonSponge},
  4    Absorb, CryptographicSponge,
  5};
  6use ark_ec::{twisted_edwards::TECurveConfig, AffineRepr, CurveGroup};
  7use ark_ff::PrimeField;
  8use digest::Digest;
  9use digest::OutputSizeUser;
 10use rand_core::CryptoRngCore;
 11
 12fn prune_buffer<F: PrimeField>(mut bytes: [u8; 32]) -> F {
 13    bytes[0] &= 0b1111_1000;
 14    bytes[31] &= 0b0111_1111;
 15    bytes[31] |= 0b0100_0000;
 16    F::from_le_bytes_mod_order(&bytes[..])
 17}
 18
 19#[derive(Copy, Clone, Debug)]
 20/// EdDSA secret key is 32 byte data
 21pub struct SecretKey([u8; 32]);
 22
 23impl SecretKey {
 24    fn expand<F: PrimeField, D: Digest>(&self) -> (F, [u8; 32]) {
 25        let hash = D::new().chain_update(self.0).finalize();
 26        let (buffer, hash_prefix) = hash.split_at(32);
 27        let buffer: [u8; 32] = buffer.try_into().unwrap();
 28        let hash_prefix: [u8; 32] = hash_prefix.try_into().unwrap();
 29        let x = prune_buffer(buffer);
 30        (x, hash_prefix)
 31    }
 32}
 33
 34#[derive(Copy, Clone, Debug)]
 35/// `PublicKey` is EdDSA signature verification key
 36pub struct PublicKey<A: AffineRepr>(A)
 37where
 38    A::Config: TECurveConfig;
 39
 40#[derive(Copy, Clone, Debug)]
 41/// `SigningKey` produces EdDSA signatures for given message
 42pub struct SigningKey<A: AffineRepr>
 43where
 44    A::Config: TECurveConfig,
 45{
 46    secret_key: SecretKey,
 47    public_key: PublicKey<A>,
 48}
 49
 50impl<A: AffineRepr> SigningKey<A>
 51where
 52    A::Config: TECurveConfig,
 53    A::BaseField: PrimeField + Absorb,
 54{
 55    pub fn new<D: Digest>(secret_key: &SecretKey) -> Result<Self, Error> {
 56        (<D as OutputSizeUser>::output_size() == 64)
 57            .then_some(())
 58            .ok_or(Error::BadOutputSize)?;
 59
 60        let (x, _) = secret_key.expand::<A::ScalarField, D>();
 61        let public_key: A = (A::generator() * x).into_affine();
 62        let signing_key = Self {
 63            secret_key: *secret_key,
 64            public_key: PublicKey(public_key),
 65        };
 66
 67        Ok(signing_key)
 68    }
 69
 70    pub fn generate<D: Digest>(rng: &mut impl CryptoRngCore) -> Result<Self, Error> {
 71        let mut secret_key = SecretKey([0; 32]);
 72        rng.fill_bytes(&mut secret_key.0);
 73        Self::new::<D>(&secret_key)
 74    }
 75
 76    pub fn public_key(&self) -> PublicKey<A> {
 77        self.public_key
 78    }
 79
 80    pub fn sign<D: Digest, E: Absorb>(
 81        &self,
 82        poseidon: &PoseidonConfig<A::BaseField>,
 83        message: &[E],
 84    ) -> Signature<A> {
 85        let (x, prefix) = self.secret_key.expand::<A::ScalarField, D>();
 86
 87        let mut h = D::new();
 88        h.update(prefix);
 89        message
 90            .iter()
 91            .for_each(|m| h.update(m.to_sponge_bytes_as_vec()));
 92        let r: A::ScalarField = crate::from_digest(h);
 93        let sig_r = (A::generator() * r).into_affine();
 94
 95        let mut poseidon = PoseidonSponge::new(poseidon);
 96        let (sig_r_x, sig_r_y) = sig_r.xy().unwrap();
 97        poseidon.absorb(sig_r_x);
 98        poseidon.absorb(sig_r_y);
 99        let (vk_x, vk_y) = self.public_key.0.xy().unwrap();
100        poseidon.absorb(vk_x);
101        poseidon.absorb(vk_y);
102        message.iter().for_each(|m| poseidon.absorb(m));
103
104        let k = poseidon.squeeze_field_elements::<A::ScalarField>(1);
105        let k = k.first().unwrap();
106
107        let sig_s = (x * k) + r;
108
109        Signature::new(sig_r, sig_s)
110    }
111}
112
113impl<A: AffineRepr> PublicKey<A>
114where
115    A::Config: TECurveConfig,
116    A::BaseField: PrimeField + Absorb,
117{
118    pub fn verify<E: Absorb>(
119        &self,
120        poseidon: &PoseidonConfig<A::BaseField>,
121        message: &[E],
122        signature: &Signature<A>,
123    ) -> Result<(), Error> {
124        let mut poseidon = PoseidonSponge::new(poseidon);
125
126        let (sig_r_x, sig_r_y) = signature.r().xy().unwrap();
127        poseidon.absorb(sig_r_x);
128        poseidon.absorb(sig_r_y);
129        let (vk_x, vk_y) = self.0.xy().unwrap();
130        poseidon.absorb(vk_x);
131        poseidon.absorb(vk_y);
132        message.iter().for_each(|m| poseidon.absorb(m));
133
134        let k = poseidon.squeeze_field_elements::<A::ScalarField>(1);
135        let k = k.first().unwrap();
136
137        let kx_b = self.0 * k;
138        let s_b = A::generator() * signature.s();
139        let r_rec: A = (s_b - kx_b).into();
140
141        (signature.r() == &r_rec).then_some(()).ok_or(Error::Verify)
142    }
143}