From d7250503aca9d0cfc0c2df12d3f98c02945bcf33 Mon Sep 17 00:00:00 2001 From: Sebastian Falbesoner Date: Fri, 22 Dec 2023 13:40:09 +0100 Subject: [PATCH] silentpayments: add private tweak data creation routine --- include/secp256k1_silentpayments.h | 36 +++++++++- src/modules/silentpayments/main_impl.h | 93 +++++++++++++++++++++++++- 2 files changed, 127 insertions(+), 2 deletions(-) diff --git a/include/secp256k1_silentpayments.h b/include/secp256k1_silentpayments.h index a79fc516e5..252b2863af 100644 --- a/include/secp256k1_silentpayments.h +++ b/include/secp256k1_silentpayments.h @@ -28,7 +28,41 @@ extern "C" { * operations. */ -/* TODO: add function API for sender side. */ +/** Create Silent Payment tweak data from input private keys. + * + * Given a list of n private keys a_1...a_n (one for each silent payment + * eligible input to spend) and a serialized outpoint_smallest, compute + * the corresponding input private keys tweak data: + * + * a_tweaked = (a_1 + a_2 + ... + a_n) * hash(outpoint_smallest || A) + * + * (where A = A_1 + A_2 + ... + A_n) + * + * If necessary, the private keys are negated to enforce the right y-parity. + * For that reason, the private keys have to be passed in via two different parameter + * pairs, depending on whether they were used for creating taproot outputs or not. + * The resulting data is needed to create a shared secret for the sender side. + * + * Returns: 1 if shared secret creation was successful. 0 if an error occured. + * Args: ctx: pointer to a context object + * Out: private_tweak_data32: pointer to the resulting 32-byte private tweak data + * In: plain_seckeys: pointer to an array of 32-byte private keys of non-taproot inputs + * (can be NULL if no private keys of non-taproot inputs are used) + * n_plain_seckeys: the number of sender's non-taproot input private keys + * taproot_seckeys: pointer to an array of 32-byte private keys of taproot inputs + * (can be NULL if no private keys of taproot inputs are used) + * n_taproot_seckeys: the number of sender's taproot input private keys + * outpoint_smallest36: serialized smallest outpoint + */ +SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_silentpayments_create_private_tweak_data( + const secp256k1_context *ctx, + unsigned char *private_tweak_data32, + const unsigned char *plain_seckeys, + size_t n_plain_seckeys, + const unsigned char *taproot_seckeys, + size_t n_taproot_seckeys, + const unsigned char *outpoint_smallest36 +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(7); /* TODO: add function API for receiver side. */ diff --git a/src/modules/silentpayments/main_impl.h b/src/modules/silentpayments/main_impl.h index f8ccdd7baa..a18e256d7f 100644 --- a/src/modules/silentpayments/main_impl.h +++ b/src/modules/silentpayments/main_impl.h @@ -9,7 +9,98 @@ #include "../../../include/secp256k1.h" #include "../../../include/secp256k1_silentpayments.h" -/* TODO: implement functions for sender side. */ +/** Set hash state to the BIP340 tagged hash midstate for "BIP0352/Inputs". */ +static void secp256k1_silentpayments_sha256_init_inputs(secp256k1_sha256* hash) { + secp256k1_sha256_initialize(hash); + hash->s[0] = 0xd4143ffcul; + hash->s[1] = 0x012ea4b5ul; + hash->s[2] = 0x36e21c8ful; + hash->s[3] = 0xf7ec7b54ul; + hash->s[4] = 0x4dd4e2acul; + hash->s[5] = 0x9bcaa0a4ul; + hash->s[6] = 0xe244899bul; + hash->s[7] = 0xcd06903eul; + + hash->bytes = 64; +} + +static void secp256k1_silentpayments_calculate_input_hash(secp256k1_scalar *input_hash_scalar, const unsigned char *outpoint_smallest36, secp256k1_ge *pubkey_sum) { + secp256k1_sha256 hash; + unsigned char hash_ser[32]; + unsigned char pubkey_sum_ser[33]; + size_t ser_size; + int ser_ret; + + secp256k1_silentpayments_sha256_init_inputs(&hash); + secp256k1_sha256_write(&hash, outpoint_smallest36, 36); + ser_ret = secp256k1_eckey_pubkey_serialize(pubkey_sum, pubkey_sum_ser, &ser_size, 1); + VERIFY_CHECK(ser_ret && ser_size == sizeof(pubkey_sum_ser)); + (void)ser_ret; + secp256k1_sha256_write(&hash, pubkey_sum_ser, sizeof(pubkey_sum_ser)); + secp256k1_sha256_finalize(&hash, hash_ser); + secp256k1_scalar_set_b32(input_hash_scalar, hash_ser, NULL); +} + +int secp256k1_silentpayments_create_private_tweak_data(const secp256k1_context *ctx, unsigned char *private_tweak_data32, const unsigned char *plain_seckeys, size_t n_plain_seckeys, const unsigned char *taproot_seckeys, size_t n_taproot_seckeys, const unsigned char *outpoint_smallest36) { + size_t i; + secp256k1_scalar a_sum, addend; + secp256k1_ge A_sum_ge; + secp256k1_gej A_sum_gej; + secp256k1_scalar input_hash_scalar; + + /* Sanity check inputs. */ + VERIFY_CHECK(ctx != NULL); + ARG_CHECK(private_tweak_data32 != NULL); + memset(private_tweak_data32, 0, 32); + ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); + ARG_CHECK(plain_seckeys == NULL || n_plain_seckeys >= 1); + ARG_CHECK(taproot_seckeys == NULL || n_taproot_seckeys >= 1); + ARG_CHECK((plain_seckeys != NULL) || (taproot_seckeys != NULL)); + ARG_CHECK((n_plain_seckeys + n_taproot_seckeys) >= 1); + ARG_CHECK(outpoint_smallest36 != NULL); + + /* Compute input private keys sum: a_sum = a_1 + a_2 + ... + a_n */ + a_sum = secp256k1_scalar_zero; + for (i = 0; i < n_plain_seckeys; i++) { + int ret = secp256k1_scalar_set_b32_seckey(&addend, &plain_seckeys[i*32]); + VERIFY_CHECK(ret); + (void)ret; + + secp256k1_scalar_add(&a_sum, &a_sum, &addend); + VERIFY_CHECK(!secp256k1_scalar_is_zero(&a_sum)); + } + /* private keys used for taproot outputs have to be negated if they resulted in an odd point */ + for (i = 0; i < n_taproot_seckeys; i++) { + secp256k1_ge addend_point; + int ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &addend, &addend_point, &taproot_seckeys[i*32]); + VERIFY_CHECK(ret); + (void)ret; + /* declassify addend_point to allow using it as a branch point (this is fine because addend_point is not a secret) */ + secp256k1_declassify(ctx, &addend_point, sizeof(addend_point)); + secp256k1_fe_normalize_var(&addend_point.y); + if (secp256k1_fe_is_odd(&addend_point.y)) { + secp256k1_scalar_negate(&addend, &addend); + } + + secp256k1_scalar_add(&a_sum, &a_sum, &addend); + VERIFY_CHECK(!secp256k1_scalar_is_zero(&a_sum)); + } + if (secp256k1_scalar_is_zero(&a_sum)) { + /* TODO: do we need a special error return code for this case? */ + return 0; + } + + /* Compute input_hash = hash(outpoint_L || A_sum) */ + secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &A_sum_gej, &a_sum); + secp256k1_ge_set_gej(&A_sum_ge, &A_sum_gej); + secp256k1_silentpayments_calculate_input_hash(&input_hash_scalar, outpoint_smallest36, &A_sum_ge); + + /* Compute a_tweaked = a_sum * input_hash */ + secp256k1_scalar_mul(&a_sum, &a_sum, &input_hash_scalar); + secp256k1_scalar_get_b32(private_tweak_data32, &a_sum); + + return 1; +} /* TODO: implement functions for receiver side. */