poseidon consistent use of T

Test that babyjub pk is always < Q

babyjub/babyjub.go

@@ -203,7 +203,10 @@ func (p *Point) Decompress(leBuf [32]byte) (*Point, error) {
 	xb.ModInverse(xb, constants.Q)
 	p.X.Mul(xa, xb) // xa / xb
 	p.X.Mod(p.X, constants.Q)
-	p.X.ModSqrt(p.X, constants.Q)
+	noSqrt := p.X.ModSqrt(p.X, constants.Q)
+	if noSqrt == nil {
+		return nil, fmt.Errorf("x is not a square mod q")
+	}
 	if (sign && !PointCoordSign(p.X)) || (!sign && PointCoordSign(p.X)) {
 		p.X.Mul(p.X, constants.MinusOne)
 	}

babyjub/babyjub_test.go

@@ -3,8 +3,10 @@ package babyjub
 import (
 	"encoding/hex"
 	"math/big"
+	"math/rand"
 	"testing"
 
+	"github.com/iden3/go-iden3-crypto/constants"
 	"github.com/iden3/go-iden3-crypto/utils"
 	"github.com/stretchr/testify/assert"
 )
@@ -231,3 +233,74 @@ func TestCompressDecompressRnd(t *testing.T) {
 		assert.Equal(t, p1, p2)
 	}
 }
+
+func BenchmarkBabyjub(b *testing.B) {
+	const n = 256
+
+	rnd := rand.New(rand.NewSource(42))
+
+	var badpoints [n]*Point
+	for i := 0; i < n; i++ {
+		x := new(big.Int).Rand(rnd, constants.Q)
+		y := new(big.Int).Rand(rnd, constants.Q)
+		badpoints[i] = &Point{X: x, Y: y}
+	}
+
+	var points [n]*Point
+	baseX := utils.NewIntFromString(
+		"17777552123799933955779906779655732241715742912184938656739573121738514868268")
+	baseY := utils.NewIntFromString(
+		"2626589144620713026669568689430873010625803728049924121243784502389097019475")
+	base := &Point{X: baseX, Y: baseY}
+	for i := 0; i < n; i++ {
+		s := new(big.Int).Rand(rnd, constants.Q)
+		points[i] = NewPoint().Mul(s, base)
+	}
+
+	var scalars [n]*big.Int
+	for i := 0; i < n; i++ {
+		scalars[i] = new(big.Int).Rand(rnd, constants.Q)
+	}
+
+	b.Run("AddConst", func(b *testing.B) {
+		p0 := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+		p1 := &Point{X: big.NewInt(0), Y: big.NewInt(1)}
+
+		p2 := NewPoint()
+		for i := 0; i < b.N; i++ {
+			p2.Add(p0, p1)
+		}
+	})
+
+	b.Run("AddRnd", func(b *testing.B) {
+		res := NewPoint()
+		for i := 0; i < b.N; i++ {
+			res.Add(points[i%(n/2)], points[i%(n/2)+1])
+		}
+	})
+
+	b.Run("MulRnd", func(b *testing.B) {
+		res := NewPoint()
+		for i := 0; i < b.N; i++ {
+			res.Mul(scalars[i%n], points[i%n])
+		}
+	})
+
+	b.Run("Compress", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			points[i%n].Compress()
+		}
+	})
+
+	b.Run("InCurve", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			badpoints[i%n].InCurve()
+		}
+	})
+
+	b.Run("InSubGroup", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			points[i%n].InCurve()
+		}
+	})
+}

babyjub/eddsa_test.go

@@ -25,6 +25,16 @@ func genInputs() (*PrivateKey, *big.Int) {
 	return &k, msg
 }
 
+func TestPublicKey(t *testing.T) {
+	var k PrivateKey
+	for i := 0; i < 256; i++ {
+		hex.Decode(k[:], []byte{byte(i)})
+	}
+	pk := k.Public()
+	assert.True(t, pk.X.Cmp(constants.Q) == -1)
+	assert.True(t, pk.Y.Cmp(constants.Q) == -1)
+}
+
 func TestSignVerifyMimc7(t *testing.T) {
 	var k PrivateKey
 	hex.Decode(k[:], []byte("0001020304050607080900010203040506070809000102030405060708090001"))
@@ -131,3 +141,54 @@ func TestCompressDecompress(t *testing.T) {
 		assert.Equal(t, true, ok)
 	}
 }
+
+func BenchmarkBabyjubEddsa(b *testing.B) {
+	var k PrivateKey
+	hex.Decode(k[:], []byte("0001020304050607080900010203040506070809000102030405060708090001"))
+	pk := k.Public()
+
+	const n = 256
+
+	msgBuf, err := hex.DecodeString("00010203040506070809")
+	if err != nil {
+		panic(err)
+	}
+	msg := utils.SetBigIntFromLEBytes(new(big.Int), msgBuf)
+	var msgs [n]*big.Int
+	for i := 0; i < n; i++ {
+		msgs[i] = new(big.Int).Add(msg, big.NewInt(int64(i)))
+	}
+	var sigs [n]*Signature
+
+	b.Run("SignMimc7", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			k.SignMimc7(msgs[i%n])
+		}
+	})
+
+	for i := 0; i < n; i++ {
+		sigs[i%n] = k.SignMimc7(msgs[i%n])
+	}
+
+	b.Run("VerifyMimc7", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			pk.VerifyMimc7(msgs[i%n], sigs[i%n])
+		}
+	})
+
+	b.Run("SignPoseidon", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			k.SignPoseidon(msgs[i%n])
+		}
+	})
+
+	for i := 0; i < n; i++ {
+		sigs[i%n] = k.SignPoseidon(msgs[i%n])
+	}
+
+	b.Run("VerifyPoseidon", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			pk.VerifyPoseidon(msgs[i%n], sigs[i%n])
+		}
+	})
+}

mimc7/mimc7.go

@@ -127,3 +127,21 @@ func Hash(arr []*big.Int, key *big.Int) (*big.Int, error) {
 	}
 	return r, nil
 }
+
+// HashBytes hashes a msg byte slice by blocks of 31 bytes encoded as
+// little-endian
+func HashBytes(b []byte) (*big.Int, error) {
+	n := 31
+	bElems := make([]*big.Int, 0, len(b)/n+1)
+	for i := 0; i < len(b)/n; i++ {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, b[n*i:n*(i+1)])
+		bElems = append(bElems, v)
+	}
+	if len(b)%n != 0 {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, b[(len(b)/n)*n:])
+		bElems = append(bElems, v)
+	}
+	return Hash(bElems, nil)
+}

mimc7/mimc7_test.go

@@ -77,6 +77,11 @@ func TestMIMC7(t *testing.T) {
 	assert.Nil(t, err)
 	// same hash value than the iden3js and circomlib tests:
 	assert.Equal(t, "0x"+hex.EncodeToString((*big.Int)(h4).Bytes()), "0x284bc1f34f335933a23a433b6ff3ee179d682cd5e5e2fcdd2d964afa85104beb")
+
+	msg := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.")
+	hmsg, err := HashBytes(msg)
+	assert.Nil(t, err)
+	assert.Equal(t, "16855787120419064316734350414336285711017110414939748784029922801367685456065", hmsg.String())
 }
 
 func BenchmarkMIMC7(b *testing.B) {
@@ -86,9 +91,7 @@ func BenchmarkMIMC7(b *testing.B) {
 	b41 := big.NewInt(int64(41))
 	bigArray4 := []*big.Int{b12, b45, b78, b41}
 
-	var h4 *big.Int
 	for i := 0; i < b.N; i++ {
-		h4, _ = Hash(bigArray4, nil)
+		Hash(bigArray4, nil)
 	}
-	println(h4)
 }

poseidon/poseidon.go

@@ -101,18 +101,19 @@ func checkAllDifferent(v []*big.Int) bool {
 
 // ark computes Add-Round Key, from the paper https://eprint.iacr.org/2019/458.pdf
 func ark(state []*big.Int, c *big.Int) []*big.Int {
-	for i := 0; i < len(state); i++ {
+	for i := 0; i < T; i++ {
 		state[i] = constants.fqR.Add(state[i], c)
 	}
 	return state
 }
 
-// cubic performs x^3 mod p
+// cubic performs x^5 mod p
+// https://eprint.iacr.org/2019/458.pdf page 8
 func cubic(a *big.Int) *big.Int {
 	return constants.fqR.Mul(a, constants.fqR.Square(constants.fqR.Square(a)))
 }
 
-// sbox https://eprint.iacr.org/2019/458.pdf pag.6
+// sbox https://eprint.iacr.org/2019/458.pdf page 6
 func sbox(state []*big.Int, i int) []*big.Int {
 	if (i < NROUNDSF/2) || (i >= NROUNDSF/2+NROUNDSP) {
 		for j := 0; j < T; j++ {
@@ -133,25 +134,18 @@ func mix(state []*big.Int, m [][]*big.Int) []*big.Int {
 			newState[i] = constants.fqR.Add(newState[i], constants.fqR.Mul(m[i][j], state[j]))
 		}
 	}
-	for i := 0; i < len(state); i++ {
+	return newState
-		state[i] = newState[i]
-	}
-	return state
 }
 
-// Hash computes the Poseidon hash for the given inputs
+// PoseidonHash computes the Poseidon hash for the given inputs
-func Hash(inp []*big.Int) (*big.Int, error) {
+func PoseidonHash(inp []*big.Int) (*big.Int, error) {
-	var state []*big.Int
 	if len(inp) == 0 || len(inp) > T {
 		return nil, errors.New("wrong inputs length")
 	}
 	if !utils.CheckBigIntArrayInField(inp, constants.fqR.Q) {
 		return nil, errors.New("inputs values not inside Finite Field")
 	}
-
+	state := inp
-	for i := 0; i < len(inp); i++ {
-		state = append(state, inp[i])
-	}
 	for i := len(inp); i < T; i++ {
 		state = append(state, constants.fqR.Zero())
 	}
@@ -164,3 +158,51 @@ func Hash(inp []*big.Int) (*big.Int, error) {
 	}
 	return state[0], nil
 }
+
+// Hash performs the Poseidon hash over a *big.Int array
+// in chunks of 5 elements
+func Hash(arr []*big.Int) (*big.Int, error) {
+	if !utils.CheckBigIntArrayInField(arr, constants.fqR.Q) {
+		return nil, errors.New("inputs values not inside Finite Field")
+	}
+
+	r := constants.fqR.Zero()
+	for i := 0; i < len(arr); i = i + T - 1 {
+		var toHash [T]*big.Int
+		for j := 0; j < T-1; j++ {
+			if i+j < len(arr) {
+				toHash[j] = arr[i+j]
+			} else {
+				toHash[j] = _constants.Zero
+			}
+		}
+		toHash[T-1] = r
+		ph, err := PoseidonHash(toHash[:])
+		if err != nil {
+			return nil, err
+		}
+		r = constants.fqR.Add(
+			r,
+			ph)
+	}
+
+	return r, nil
+}
+
+// HashBytes hashes a msg byte slice by blocks of 31 bytes encoded as
+// little-endian
+func HashBytes(b []byte) (*big.Int, error) {
+	n := 31
+	bElems := make([]*big.Int, 0, len(b)/n+1)
+	for i := 0; i < len(b)/n; i++ {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, b[n*i:n*(i+1)])
+		bElems = append(bElems, v)
+	}
+	if len(b)%n != 0 {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, b[(len(b)/n)*n:])
+		bElems = append(bElems, v)
+	}
+	return Hash(bElems)
+}

poseidon/poseidon_test.go

@@ -5,6 +5,7 @@ import (
 	"math/big"
 	"testing"
 
+	"github.com/iden3/go-iden3-crypto/utils"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/crypto/blake2b"
 )
@@ -26,4 +27,71 @@ func TestPoseidon(t *testing.T) {
 	h, err = Hash([]*big.Int{b3, b4})
 	assert.Nil(t, err)
 	assert.Equal(t, "17185195740979599334254027721507328033796809509313949281114643312710535000993", h.String())
+
+	msg := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.")
+	n := 31
+	msgElems := make([]*big.Int, 0, len(msg)/n+1)
+	for i := 0; i < len(msg)/n; i++ {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, msg[n*i:n*(i+1)])
+		msgElems = append(msgElems, v)
+	}
+	if len(msg)%n != 0 {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, msg[(len(msg)/n)*n:])
+		msgElems = append(msgElems, v)
+	}
+	hmsg, err := Hash(msgElems)
+	assert.Nil(t, err)
+	assert.Equal(t, "19204466598658860237115179437116112945222240370078952939676636700594938553268", hmsg.String())
+
+	msg2 := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet.")
+	msg2Elems := make([]*big.Int, 0, len(msg2)/n+1)
+	for i := 0; i < len(msg2)/n; i++ {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, msg2[n*i:n*(i+1)])
+		msg2Elems = append(msg2Elems, v)
+	}
+	if len(msg2)%n != 0 {
+		v := new(big.Int)
+		utils.SetBigIntFromLEBytes(v, msg2[(len(msg2)/n)*n:])
+		msg2Elems = append(msg2Elems, v)
+	}
+	hmsg2, err := Hash(msg2Elems)
+	assert.Nil(t, err)
+	assert.Equal(t, "11846976426841208067103690249139614816718727366915557488657094868020932500524", hmsg2.String())
+
+	hmsg2, err = HashBytes(msg2)
+	assert.Nil(t, err)
+	assert.Equal(t, "11846976426841208067103690249139614816718727366915557488657094868020932500524", hmsg2.String())
+}
+
+func TestPoseidonBrokenChunks(t *testing.T) {
+	h1, err := Hash([]*big.Int{big.NewInt(0), big.NewInt(1), big.NewInt(2), big.NewInt(3), big.NewInt(4),
+		big.NewInt(5), big.NewInt(6), big.NewInt(7), big.NewInt(8), big.NewInt(9)})
+	assert.Nil(t, err)
+	h2, err := Hash([]*big.Int{big.NewInt(5), big.NewInt(6), big.NewInt(7), big.NewInt(8), big.NewInt(9),
+		big.NewInt(0), big.NewInt(1), big.NewInt(2), big.NewInt(3), big.NewInt(4)})
+	assert.Nil(t, err)
+	assert.NotEqual(t, h1, h2)
+}
+
+func TestPoseidonBrokenPadding(t *testing.T) {
+	h1, err := Hash([]*big.Int{big.NewInt(1)})
+	assert.Nil(t, err)
+	h2, err := Hash([]*big.Int{big.NewInt(1), big.NewInt(0)})
+	assert.Nil(t, err)
+	assert.NotEqual(t, h1, h2)
+}
+
+func BenchmarkPoseidon(b *testing.B) {
+	b12 := big.NewInt(int64(12))
+	b45 := big.NewInt(int64(45))
+	b78 := big.NewInt(int64(78))
+	b41 := big.NewInt(int64(41))
+	bigArray4 := []*big.Int{b12, b45, b78, b41}
+
+	for i := 0; i < b.N; i++ {
+		Hash(bigArray4)
+	}
 }