Skip to content

Commit 08dfa68

Browse files
apoelstraapoelstra
committed
rangeproof: add verify_value function to create single-value proofs
1 parent 593686c commit 08dfa68

File tree

3 files changed

+178
-7
lines changed

3 files changed

+178
-7
lines changed

‎include/secp256k1_rangeproof.h

+26-4
Original file line numberDiff line numberDiff line change
@@ -287,10 +287,10 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_rangeproof_info(
287287
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
288288

289289
/** Verify a rangeproof with a single-value range. Useful as a "proof of value"
290-
* of a Pedersen commitment. Such proofs can be created with `secp256k1_rangeproof_sign`
291-
* by passing an `exp` parameter of -1 and the target value as both `value` and `min_value`.
292-
* (In this case `min_bits` is ignored and may take any value, but for clarity it's best
293-
* to pass zero.)
290+
* of a Pedersen commitment. Such proofs can be created with `secp256k1_rangeproof_create_value`,
291+
* or with `secp256k1_rangeproof_sign` by passing an `exp` parameter of -1 and the
292+
* target value as both `value` and `min_value`. (In this case `min_bits` is ignored
293+
* and may take any value, but for clarity it's best to pass zero.)
294294
* Returns 1: Proof was valid and proved the given value
295295
* 0: Otherwise
296296
* In: ctx: pointer to a context object
@@ -309,6 +309,28 @@ SECP256K1_API int secp256k1_rangeproof_verify_value(
309309
const secp256k1_generator* gen
310310
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);
311311

312+
/** Create a rangeproof with a single-value range.
313+
* Returns 1: Proof was successfully generated
314+
* 0: Otherwise. The contents of `proof` are unspecified in this case.
315+
* Args: ctx: pointer to a context object
316+
* Out: proof: pointer to character array to populate the proof with. Must be at least 73
317+
* bytes unless `value` is 0, in which case it must be at least 65 bytes
318+
* In/Out: plen: length of the `proof` buffer; will be overwritten with the actual length
319+
* In: value: value being claimed for the Pedersen commitment
320+
* blind: the blinding factor for the Pedersen commitment `commit`
321+
* commit: the Pedersen commitment whose value is being proven
322+
* gen: additional generator 'h'
323+
*/
324+
SECP256K1_API int secp256k1_rangeproof_create_value(
325+
const secp256k1_context* ctx,
326+
unsigned char* proof,
327+
size_t* plen,
328+
uint64_t value,
329+
const unsigned char* blind,
330+
const secp256k1_pedersen_commitment* commit,
331+
const secp256k1_generator* gen
332+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7);
333+
312334
# ifdef __cplusplus
313335
}
314336
# endif

‎src/modules/rangeproof/main_impl.h

+104-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
#define SECP256K1_MODULE_RANGEPROOF_MAIN
99

1010
#include "group.h"
11+
#include "print.h"
1112

1213
#include "modules/rangeproof/pedersen_impl.h"
1314
#include "modules/rangeproof/borromean_impl.h"
@@ -359,7 +360,7 @@ int secp256k1_rangeproof_verify_value(const secp256k1_context* ctx, const unsign
359360
/* Now we just have a Schnorr signature in (e, s) form. The verification
360361
* equation is e == H(sG - eX || proof params) */
361362

362-
/* 1. Compute slow/overwrought commitment to proof params */
363+
/* 0. Compute slow/overwrought commitment to proof params */
363364
secp256k1_sha256_initialize(&sha2);
364365
secp256k1_rangeproof_serialize_point(tmpch, &commitp);
365366
secp256k1_sha256_write(&sha2, tmpch, 33);
@@ -375,7 +376,7 @@ int secp256k1_rangeproof_verify_value(const secp256k1_context* ctx, const unsign
375376
return 0;
376377
}
377378

378-
/* 1. Compute R = sG - eX */
379+
/* 1. Compute R = sG + eX */
379380
secp256k1_scalar_set_b32(&ss, &proof[offset + 32], &overflow);
380381
if (overflow || secp256k1_scalar_is_zero(&ss)) {
381382
return 0;
@@ -397,4 +398,105 @@ int secp256k1_rangeproof_verify_value(const secp256k1_context* ctx, const unsign
397398
return !memcmp(tmpch, &proof[offset], 32);
398399
}
399400

401+
int secp256k1_rangeproof_create_value(const secp256k1_context* ctx, unsigned char* proof, size_t* plen, uint64_t value, const unsigned char* blind, const secp256k1_pedersen_commitment* commit, const secp256k1_generator* gen) {
402+
secp256k1_ge commitp;
403+
secp256k1_ge genp;
404+
secp256k1_gej tmpj;
405+
secp256k1_scalar es;
406+
secp256k1_scalar tmps;
407+
secp256k1_sha256 sha2;
408+
unsigned char tmpch[33];
409+
unsigned char pp_comm[32];
410+
size_t offset;
411+
size_t sz;
412+
int overflow;
413+
414+
VERIFY_CHECK(ctx != NULL);
415+
ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
416+
ARG_CHECK(proof != NULL);
417+
ARG_CHECK(plen != NULL);
418+
ARG_CHECK(blind != NULL);
419+
ARG_CHECK(commit != NULL);
420+
ARG_CHECK(gen != NULL);
421+
422+
if (*plen < 73 || (value == 0 && *plen < 65)) {
423+
return 0;
424+
}
425+
426+
secp256k1_pedersen_commitment_load(&commitp, commit);
427+
secp256k1_generator_load(&genp, gen);
428+
429+
/* Encode header */
430+
if (value > 0) {
431+
proof[0] = 0x20;
432+
proof[1] = value >> 56;
433+
proof[2] = value >> 48;
434+
proof[3] = value >> 40;
435+
proof[4] = value >> 32;
436+
proof[5] = value >> 24;
437+
proof[6] = value >> 16;
438+
proof[7] = value >> 8;
439+
proof[8] = value;
440+
offset = 9;
441+
} else {
442+
proof[0] = 0x00;
443+
offset = 1;
444+
}
445+
446+
/* Now we have to make a Schnorr signature in (e, s) form. */
447+
448+
/* 1. Compute slow/overwrought commitment to proof params */
449+
secp256k1_sha256_initialize(&sha2);
450+
secp256k1_rangeproof_serialize_point(tmpch, &commitp);
451+
secp256k1_sha256_write(&sha2, tmpch, 33);
452+
secp256k1_rangeproof_serialize_point(tmpch, &genp);
453+
secp256k1_sha256_write(&sha2, tmpch, 33);
454+
secp256k1_sha256_write(&sha2, proof, offset); /* lol we commit to one extra byte here */
455+
secp256k1_sha256_finalize(&sha2, pp_comm);
456+
457+
/* ... feed this into our hash e */
458+
secp256k1_borromean_hash(tmpch, pp_comm, 32, &proof[offset], 32, 0, 0);
459+
secp256k1_scalar_set_b32(&es, tmpch, &overflow);
460+
if (overflow || secp256k1_scalar_is_zero(&es)) {
461+
return 0;
462+
}
463+
464+
/* ... and compute -ex from this */
465+
secp256k1_scalar_set_b32(&tmps, blind, &overflow);
466+
if (overflow || secp256k1_scalar_is_zero(&tmps)) {
467+
secp256k1_scalar_clear(&tmps);
468+
secp256k1_scalar_clear(&es);
469+
return 0;
470+
}
471+
secp256k1_scalar_mul(&es, &es, &tmps);
472+
secp256k1_scalar_negate(&es, &es);
473+
474+
/* 2. Compute random k and set `es` to k - ex */
475+
secp256k1_sha256_initialize(&sha2);
476+
secp256k1_sha256_write(&sha2, blind, 32);
477+
secp256k1_sha256_write(&sha2, pp_comm, 32);
478+
secp256k1_sha256_finalize(&sha2, tmpch);
479+
secp256k1_scalar_set_b32(&tmps, tmpch, &overflow);
480+
if (overflow || secp256k1_scalar_is_zero(&tmps)) {
481+
secp256k1_scalar_clear(&es);
482+
return 0;
483+
}
484+
secp256k1_scalar_add(&es, &es, &tmps);
485+
secp256k1_scalar_get_b32(&proof[offset + 32], &es);
486+
487+
/* Compute R = kG and serialize it*/
488+
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &tmpj, &tmps);
489+
secp256k1_scalar_clear(&tmps);
490+
secp256k1_ge_set_gej(&genp, &tmpj); /* Reuse genp which is no longer used */
491+
secp256k1_eckey_pubkey_serialize(&genp, tmpch, &sz, 1);
492+
493+
/* 3. Compute e0 = H(R || proof params) and serialize it */
494+
secp256k1_sha256_initialize(&sha2);
495+
secp256k1_sha256_write(&sha2, tmpch, sz);
496+
secp256k1_sha256_write(&sha2, pp_comm, sizeof(pp_comm));
497+
secp256k1_sha256_finalize(&sha2, &proof[offset]);
498+
499+
return 1;
500+
}
501+
400502
#endif

‎src/modules/rangeproof/tests_impl.h

+48-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ static void test_pedersen_api(const secp256k1_context *none, const secp256k1_con
7676
CHECK(*ecount == 14);
7777
}
7878

79-
static void test_rangeproof_api(const secp256k1_context *none, const secp256k1_context *sign, const secp256k1_context *vrfy, const secp256k1_context *both, const secp256k1_context *sttc, const int32_t *ecount) {
79+
static void test_rangeproof_api(const secp256k1_context *none, const secp256k1_context *sign, const secp256k1_context *vrfy, const secp256k1_context *both, const secp256k1_context *sttc, int32_t *ecount) {
8080
unsigned char proof[5134];
8181
unsigned char blind[32];
8282
secp256k1_pedersen_commitment commit;
@@ -225,6 +225,53 @@ static void test_rangeproof_api(const secp256k1_context *none, const secp256k1_c
225225
CHECK(secp256k1_rangeproof_rewind(both, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, 0, NULL) == 0);
226226
CHECK(*ecount == 29);
227227
}
228+
229+
{
230+
*ecount = 0;
231+
len = sizeof(proof);
232+
CHECK(secp256k1_rangeproof_create_value(none, proof, &len, val, blind, &commit, secp256k1_generator_h) == 1);
233+
CHECK(secp256k1_rangeproof_create_value(vrfy, proof, &len, val, blind, &commit, secp256k1_generator_h) == 1);
234+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, val, blind, &commit, secp256k1_generator_h) == 1);
235+
CHECK(secp256k1_rangeproof_create_value(sign, NULL, &len, val, blind, &commit, secp256k1_generator_h) == 0);
236+
CHECK(*ecount == 1);
237+
CHECK(secp256k1_rangeproof_create_value(sign, proof, NULL, val, blind, &commit, secp256k1_generator_h) == 0);
238+
CHECK(*ecount == 2);
239+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, val, NULL, &commit, secp256k1_generator_h) == 0);
240+
CHECK(*ecount == 3);
241+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, val, blind, NULL, secp256k1_generator_h) == 0);
242+
CHECK(*ecount == 4);
243+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, val, blind, &commit, NULL) == 0);
244+
CHECK(*ecount == 5);
245+
len = 0;
246+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, 0, blind, &commit, secp256k1_generator_h) == 0);
247+
len = 64;
248+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, 0, blind, &commit, secp256k1_generator_h) == 0);
249+
len = 65;
250+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, 0, blind, &commit, secp256k1_generator_h) == 0);
251+
len = 65;
252+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, 1, blind, &commit, secp256k1_generator_h) == 0);
253+
len = 72;
254+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, 1, blind, &commit, secp256k1_generator_h) == 0);
255+
len = 73;
256+
CHECK(secp256k1_rangeproof_create_value(sign, proof, &len, val, blind, &commit, secp256k1_generator_h) == 1);
257+
CHECK(*ecount == 5);
258+
259+
*ecount = 0;
260+
CHECK(secp256k1_rangeproof_verify_value(none, proof, len, val, &commit, secp256k1_generator_h) == 1);
261+
CHECK(secp256k1_rangeproof_verify_value(sign, proof, len, val, &commit, secp256k1_generator_h) == 1);
262+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, len, val, &commit, secp256k1_generator_h) == 1);
263+
CHECK(*ecount == 0);
264+
CHECK(secp256k1_rangeproof_verify_value(vrfy, NULL, len, val, &commit, secp256k1_generator_h) == 0);
265+
CHECK(*ecount == 1);
266+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, len, val, NULL, secp256k1_generator_h) == 0);
267+
CHECK(*ecount == 2);
268+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, len, val, &commit, NULL) == 0);
269+
CHECK(*ecount == 3);
270+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, 0, val, &commit, secp256k1_generator_h) == 0);
271+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, len - 1, val, &commit, secp256k1_generator_h) == 0);
272+
CHECK(secp256k1_rangeproof_verify_value(vrfy, proof, len, val ^ 1, &commit, secp256k1_generator_h) == 0);
273+
CHECK(*ecount == 3);
274+
}
228275
}
229276

230277
static void test_api(void) {

0 commit comments

Comments
 (0)