1// Package blindsecp256k1 implements the Blind signature scheme explained at
  2// "New Blind Signature Schemes Based on the (Elliptic Curve) Discrete
  3// Logarithm Problem", by Hamid Mala & Nafiseh Nezhadansari
  4// https://sci-hub.do/10.1109/ICCKE.2013.6682844
  5//
  6// LICENSE can be found at https://github.com/arnaucube/go-blindsecp256k1/blob/master/LICENSE
  7//
  8package blindsecp256k1
  9
 10// WARNING: WIP code
 11
 12import (
 13	"bytes"
 14	"crypto/rand"
 15	"math/big"
 16
 17	"github.com/btcsuite/btcd/btcec"
 18	"github.com/ethereum/go-ethereum/crypto"
 19)
 20
 21var (
 22	// G represents the base point of secp256k1
 23	G *Point = &Point{
 24		X: btcec.S256().Gx,
 25		Y: btcec.S256().Gy,
 26	}
 27
 28	// N represents the order of G of secp256k1
 29	N *big.Int = btcec.S256().N
 30)
 31
 32// Point represents a point on the secp256k1 curve
 33type Point struct {
 34	X *big.Int
 35	Y *big.Int
 36}
 37
 38// Add performs the Point addition
 39func (p *Point) Add(q *Point) *Point {
 40	x, y := btcec.S256().Add(p.X, p.Y, q.X, q.Y)
 41	return &Point{
 42		X: x,
 43		Y: y,
 44	}
 45}
 46
 47// Mul performs the Point scalar multiplication
 48func (p *Point) Mul(scalar *big.Int) *Point {
 49	x, y := btcec.S256().ScalarMult(p.X, p.Y, scalar.Bytes())
 50	return &Point{
 51		X: x,
 52		Y: y,
 53	}
 54}
 55
 56// WIP
 57func newRand() *big.Int {
 58	var b [32]byte
 59	_, err := rand.Read(b[:])
 60	if err != nil {
 61		panic(err)
 62	}
 63	bi := new(big.Int).SetBytes(b[:])
 64	return new(big.Int).Mod(bi, N)
 65}
 66
 67// PrivateKey represents the signer's private key
 68type PrivateKey big.Int
 69
 70// PublicKey represents the signer's public key
 71type PublicKey Point
 72
 73// NewPrivateKey returns a new random private key
 74func NewPrivateKey() *PrivateKey {
 75	k := newRand()
 76	sk := PrivateKey(*k)
 77	return &sk
 78}
 79
 80// BigInt returns a *big.Int representation of the PrivateKey
 81func (sk *PrivateKey) BigInt() *big.Int {
 82	return (*big.Int)(sk)
 83}
 84
 85// Public returns the PublicKey from the PrivateKey
 86func (sk *PrivateKey) Public() *PublicKey {
 87	Q := G.Mul(sk.BigInt())
 88	pk := PublicKey(*Q)
 89	return &pk
 90}
 91
 92// Point returns a *Point representation of the PublicKey
 93func (pk *PublicKey) Point() *Point {
 94	return (*Point)(pk)
 95}
 96
 97// SignerPrivateData contains the secret values from the Signer
 98type SignerPrivateData struct {
 99	D *PrivateKey
100	K *big.Int
101}
102
103// SignerPublicData contains the public values from the Signer (generated from
104// its SignerPrivateData)
105type SignerPublicData struct {
106	// Q is the Signer Public Key
107	Q *PublicKey // = skG
108	R *Point     // = kG
109}
110
111// NewSigner returns a new SignerPrivateData with random D & K
112func NewSigner() *SignerPrivateData {
113	sk := NewPrivateKey()
114	k := newRand()
115	return &SignerPrivateData{
116		D: sk,
117		K: k,
118	}
119}
120
121// PublicData returns the SignerPublicData from the SignerPrivateData
122func (signer *SignerPrivateData) PublicData() *SignerPublicData {
123	return &SignerPublicData{
124		Q: signer.D.Public(), // Q = dG
125		R: G.Mul(signer.K),   // R = kG
126	}
127}
128
129// BlindSign performs the blind signature on the given mBlinded using
130// SignerPrivateData values
131func (signer *SignerPrivateData) BlindSign(mBlinded *big.Int) *big.Int {
132	// TODO add pending checks
133	// s' = dm' + k
134	sBlind := new(big.Int).Add(
135		new(big.Int).Mul(signer.D.BigInt(), mBlinded),
136		signer.K)
137	return sBlind
138}
139
140// UserSecretData contains the secret values from the User (a, b, c) and the
141// public F
142type UserSecretData struct {
143	A *big.Int
144	B *big.Int
145
146	F *Point // public (in the paper is R)
147}
148
149// Blind performs the blinding operation on m using SignerPublicData parameters
150func Blind(m *big.Int, signer *SignerPublicData) (*big.Int, *UserSecretData) {
151	u := &UserSecretData{}
152	u.A = newRand()
153	u.B = newRand()
154
155	// (R) F = aR' + bG
156	aR := signer.R.Mul(u.A)
157	bG := G.Mul(u.B)
158	u.F = aR.Add(bG)
159
160	rx := new(big.Int).Mod(u.F.X, N)
161
162	// m' = a^-1 rx h(m)
163	ainv := new(big.Int).ModInverse(u.A, N)
164	ainvrx := new(big.Int).Mul(ainv, rx)
165	hBytes := crypto.Keccak256(m.Bytes())
166	h := new(big.Int).SetBytes(hBytes)
167	mBlinded := new(big.Int).Mul(ainvrx, h)
168
169	return mBlinded, u
170}
171
172// Signature contains the signature values S & F
173type Signature struct {
174	S *big.Int
175	F *Point
176}
177
178// Unblind performs the unblinding operation of the blinded signature for the
179// given message m and the UserSecretData
180func Unblind(sBlind, m *big.Int, u *UserSecretData) *Signature {
181	// s = a s' + b
182	as := new(big.Int).Mul(u.A, sBlind)
183	s := new(big.Int).Add(as, u.B)
184
185	return &Signature{
186		S: s,
187		F: u.F,
188	}
189}
190
191// Verify checks the signature of the message m for the given PublicKey
192func Verify(m *big.Int, signature *Signature, q *PublicKey) bool {
193	// TODO add pending checks
194	sG := G.Mul(signature.S) // sG
195
196	hBytes := crypto.Keccak256(m.Bytes())
197	h := new(big.Int).SetBytes(hBytes)
198
199	rx := new(big.Int).Mod(signature.F.X, N)
200	rxh := new(big.Int).Mul(rx, h)
201	// rxhG := G.Mul(rxh) // originally the paper uses G
202	rxhG := q.Point().Mul(rxh)
203
204	right := signature.F.Add(rxhG)
205
206	// check sG == R + rx h(m) G (where R in this code is F)
207	if bytes.Equal(sG.X.Bytes(), right.X.Bytes()) &&
208		bytes.Equal(sG.Y.Bytes(), right.Y.Bytes()) {
209		return true
210	}
211	return false
212}