1// Package blindsecp256k1 implements the Blind signature scheme explained at
  2// http://www.isecure-journal.com/article_39171_47f9ec605dd3918c2793565ec21fcd7a.pdf
  3package blindsecp256k1
  4
  5// WARNING: WIP code
  6
  7import (
  8	"bytes"
  9	"crypto/rand"
 10	"math/big"
 11
 12	"github.com/ethereum/go-ethereum/crypto/secp256k1"
 13)
 14
 15type Point struct {
 16	X *big.Int
 17	Y *big.Int
 18}
 19
 20var (
 21	G *Point = &Point{
 22		X: secp256k1.S256().Gx,
 23		Y: secp256k1.S256().Gy,
 24	}
 25
 26	N *big.Int = secp256k1.S256().N
 27)
 28
 29func (p *Point) Add(q *Point) *Point {
 30	x, y := secp256k1.S256().Add(p.X, p.Y, q.X, q.Y)
 31	return &Point{
 32		X: x,
 33		Y: y,
 34	}
 35}
 36
 37func (p *Point) Mul(scalar *big.Int) *Point {
 38	x, y := secp256k1.S256().ScalarMult(p.X, p.Y, scalar.Bytes())
 39	return &Point{
 40		X: x,
 41		Y: y,
 42	}
 43}
 44
 45func newRand() *big.Int {
 46	var b [32]byte
 47	_, err := rand.Read(b[:])
 48	if err != nil {
 49		panic(err)
 50	}
 51	bi := new(big.Int).SetBytes(b[:])
 52	return new(big.Int).Mod(bi, N)
 53}
 54
 55type PrivateKey big.Int
 56type PublicKey Point
 57
 58func NewPrivateKey() *PrivateKey {
 59	k := newRand()
 60	sk := PrivateKey(*k)
 61	return &sk
 62}
 63
 64func (sk *PrivateKey) BigInt() *big.Int {
 65	return (*big.Int)(sk)
 66}
 67
 68func (sk *PrivateKey) Public() *PublicKey {
 69	Q := G.Mul(sk.BigInt())
 70	pk := PublicKey(*Q)
 71	return &pk
 72}
 73
 74func (pk *PublicKey) Point() *Point {
 75	return (*Point)(pk)
 76}
 77
 78type SignerPrivateData struct {
 79	d *PrivateKey
 80	k *big.Int
 81}
 82type SignerPublicData struct {
 83	// Q is the Signer Public Key
 84	Q *PublicKey // = skG
 85	R *Point     // = kG
 86}
 87
 88func NewSigner() *SignerPrivateData {
 89	sk := NewPrivateKey()
 90	k := newRand()
 91	return &SignerPrivateData{
 92		d: sk,
 93		k: k,
 94	}
 95}
 96
 97func (signer *SignerPrivateData) PublicData() *SignerPublicData {
 98	return &SignerPublicData{
 99		Q: signer.d.Public(), // Q = dG
100		R: G.Mul(signer.k),   // R = kG
101	}
102}
103
104func (signer *SignerPrivateData) BlindSign(mBlinded *big.Int) *big.Int {
105	// TODO add pending checks
106	// s' = d(m') + k
107	sBlind := new(big.Int).Add(
108		new(big.Int).Mul(signer.d.BigInt(), mBlinded),
109		signer.k)
110	return sBlind
111}
112
113type UserSecretData struct {
114	a *big.Int
115	b *big.Int
116	c *big.Int
117
118	F *Point // public
119}
120
121func Blind(m *big.Int, signer *SignerPublicData) (*big.Int, *UserSecretData) {
122	u := &UserSecretData{}
123	u.a = newRand()
124	u.b = newRand()
125	u.c = newRand()
126	binv := new(big.Int).ModInverse(u.b, N)
127
128	// F = b^-1 R + a b^-1 Q + c G
129	bR := signer.R.Mul(binv)
130	abinv := new(big.Int).Mul(u.a, binv)
131	abinv = new(big.Int).Mod(abinv, N)
132	abQ := signer.Q.Point().Mul(abinv)
133	cG := G.Mul(u.c)
134	u.F = bR.Add(abQ).Add(cG)
135	// TODO check F==O
136
137	r := new(big.Int).Mod(u.F.X, N)
138
139	// m' = br(m)+a
140	br := new(big.Int).Mul(u.b, r)
141	brm := new(big.Int).Mul(br, m)
142	mBlinded := new(big.Int).Add(brm, u.a)
143	mBlinded = new(big.Int).Mod(mBlinded, N)
144	return mBlinded, u
145}
146
147type Signature struct {
148	S *big.Int
149	F *Point
150}
151
152func Unblind(sBlind, m *big.Int, u *UserSecretData) *Signature {
153	// s = b^-1 s' + c
154	binv := new(big.Int).ModInverse(u.b, N)
155	bs := new(big.Int).Mul(binv, sBlind)
156	s := new(big.Int).Add(bs, u.c)
157	s = new(big.Int).Mod(s, N)
158
159	return &Signature{
160		S: s,
161		F: u.F,
162	}
163}
164
165func Verify(m *big.Int, signature *Signature, q *PublicKey) bool {
166	// TODO add pending checks
167	sG := G.Mul(signature.S) // sG
168
169	r := new(big.Int).Mod(signature.F.X, N) // r = Fx mod N
170	rm := new(big.Int).Mul(r, m)
171	rm = new(big.Int).Mod(rm, N)
172	rmQ := q.Point().Mul(rm)
173	rmQF := rmQ.Add(signature.F) // rmQ + F
174
175	// check sG == rmQ + F
176	if bytes.Equal(sG.X.Bytes(), rmQF.X.Bytes()) &&
177		bytes.Equal(sG.Y.Bytes(), rmQF.Y.Bytes()) {
178		return true
179	}
180	return false
181}