You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
262 lines
8.8 KiB
262 lines
8.8 KiB
# Copyright (c) 2014-2022, The Monero Project
|
|
#
|
|
# All rights reserved.
|
|
#
|
|
# Redistribution and use in source and binary forms, with or without modification, are
|
|
# permitted provided that the following conditions are met:
|
|
#
|
|
# 1. Redistributions of source code must retain the above copyright notice, this list of
|
|
# conditions and the following disclaimer.
|
|
#
|
|
# 2. Redistributions in binary form must reproduce the above copyright notice, this list
|
|
# of conditions and the following disclaimer in the documentation and/or other
|
|
# materials provided with the distribution.
|
|
#
|
|
# 3. Neither the name of the copyright holder nor the names of its contributors may be
|
|
# used to endorse or promote products derived from this software without specific
|
|
# prior written permission.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
|
|
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
|
|
# THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
|
|
# THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
#
|
|
# Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers
|
|
|
|
use Math::BigInt only => 'GMP';
|
|
use Digest::Keccak qw(keccak_256);
|
|
|
|
my $p = Math::BigInt->new(2)->bpow(255)->bsub(19); #F_p
|
|
my $l = Math::BigInt->new(2)->bpow(252)->badd('27742317777372353535851937790883648493');
|
|
#my $d = Math::BigInt->new(486662); #motgomery: y^2 = x^3 + 486662x^2 + x
|
|
my $d = Math::BigInt->new(-121665)->bmul(minv(121666))->bmod($p); #twisted edwards: -x^2 +y^2 = 1 + d*x^2*y^2
|
|
my $x0 = Math::BigInt->new('15112221349535400772501151409588531511454012693041857206046113283949847762202');
|
|
my $y0 = Math::BigInt->new('46316835694926478169428394003475163141307993866256225615783033603165251855960'); #y0 = 4/5
|
|
my $m = Math::BigInt->new('7237005577332262213973186563042994240829374041602535252466099000494570602493'); #p = 8m+5
|
|
my $ps = $p->copy()->bdec->bdiv(4);
|
|
my $pl = $p->copy()->bdec->bdiv(2);
|
|
my $ii = Math::BigInt->new(2)->bmodpow($ps,$p); #sqrt(-1)
|
|
|
|
sub ec_rec {
|
|
my $y = Math::BigInt->new($_[0]);
|
|
my $xx = $y->copy()->bpow(2)->bdec()->bmul(minv($y->copy()->bpow(2)->bmul($d)->binc))->bmod($p);
|
|
return 0 if !($xx->copy()->bmodpow($pl,$p)->binc->bmod($p));
|
|
my $p2 = $p->copy()->badd(3)->bdiv(8);
|
|
my $x = $xx->copy()->bmodpow($p2, $p);
|
|
if ($x->copy()->bpow(2)->bsub($xx)->bmod($p)) {$x->bmul($ii)->bmod($p)}
|
|
if ($x->is_odd) {$x = $p->copy()->bsub($x)};
|
|
return $x;
|
|
}
|
|
|
|
sub h2i {
|
|
return Math::BigInt->new('0x'.(unpack 'H*', (reverse pack 'H*', shift)));;
|
|
}
|
|
|
|
sub i2h {
|
|
my $t = substr(Math::BigInt->new(shift)->as_hex(),2,64);
|
|
if (length($t)%2 == 1) {$t = '0'.$t}
|
|
return unpack 'H*', (reverse pack 'H*', $t);
|
|
}
|
|
|
|
|
|
sub random {
|
|
return keccak_256(rand(2**20));
|
|
#return keccak_256(3); #I swear that's random!
|
|
}
|
|
|
|
sub ec_pack {
|
|
my $x = Math::BigInt->new($_[0]);
|
|
my $y = Math::BigInt->new($_[1]);
|
|
my $or = Math::BigInt->new(2)->bpow(255);
|
|
$y |= $or if ($x->is_odd());
|
|
return unpack 'H*', (reverse pack 'H*', substr($y->as_hex(),2,64));
|
|
}
|
|
|
|
sub ec_unpack {
|
|
my $y = Math::BigInt->new(h2i(shift));
|
|
my $b = $y >> 255;
|
|
my $and = Math::BigInt->new(2)->bpow(255)->bdec();
|
|
$y &= $and;
|
|
my $x = ec_rec($y);
|
|
return (0,0) if $x==0;
|
|
($b==0) || ($x = $p->copy()->bsub($x));
|
|
return ($x,$y);
|
|
}
|
|
|
|
|
|
sub minv {
|
|
my $x = Math::BigInt->new(shift);
|
|
$x->bmodpow($p-2,$p);
|
|
return $x;
|
|
}
|
|
|
|
|
|
sub ec_doub {
|
|
my $x = Math::BigInt->new($_[0]);
|
|
my $y = Math::BigInt->new($_[1]);
|
|
|
|
#$t = $x->copy()->bpow(2)->bmul(3)->badd($x->copy()->bmul($d)->bmul(2))->binc()->bmul(minv($y->copy()->bmul(2))); #montgomery
|
|
#$x2 = $t->copy()->bpow(2)->bsub($d)->bsub($x)->bsub($x)->bmod($p); #montgomery
|
|
#$y2 = $x->copy()->bmul(2)->badd($x)->badd($d)->bmul($t)->bsub($t->copy()->bpow(3))->bsub($y)->bmod($p); #montgomery
|
|
$t = $x->copy()->bmul($x)->bmul($y)->bmul($y)->bmul($d)->bmod($p);
|
|
$x3 = $x->copy()->bmul($y)->bmul(2)->bmul(minv($t+1))->bmod($p);
|
|
$y3 = $y->copy()->bpow(2)->badd($x->copy()->bpow(2))->bmul(minv(1-$t))->bmod($p);
|
|
return ($x3,$y3);
|
|
}
|
|
sub ec_add {
|
|
my $x1 = Math::BigInt->new($_[0]);
|
|
my $y1 = Math::BigInt->new($_[1]);
|
|
my $x2 = Math::BigInt->new($_[2]);
|
|
my $y2 = Math::BigInt->new($_[3]);
|
|
|
|
#$t = $y2->copy()->bsub($y1)->bmul(minv($x2->copy()->bsub($x1)));
|
|
#$x3 = $t->copy()->bpow(2)->bsub($d)->bsub($x1)->bsub($x2)->bmod($p);
|
|
#$y3 = $x1->copy()->bmul(2)->badd($x2)->badd($d)->bmul($t)->bsub($t->copy()->bpow(3))->bsub($y1)->bmod($p);
|
|
$t = $x1->copy->bmul($x2)->bmul($y1)->bmul($y2)->bmul($d)->bmod($p);
|
|
$x3 = $x1->copy()->bmul($y2)->badd($y1->copy()->bmul($x2))->bmul(minv($t+1))->bmod($p);
|
|
$y3 = $y1->copy()->bmul($y2)->badd($x1->copy()->bmul($x2))->bmul(minv(1-$t))->bmod($p);
|
|
|
|
|
|
return ($x3,$y3);
|
|
}
|
|
|
|
sub ec_mul {
|
|
my $n = Math::BigInt->new($_[0]);
|
|
my $x = Math::BigInt->new($_[1]);
|
|
my $y = Math::BigInt->new($_[2]);
|
|
|
|
if ($n->is_one()) {
|
|
return ($x,$y);
|
|
last;
|
|
}
|
|
elsif ($n->is_even()) {
|
|
$n->bdiv(2);
|
|
return ec_mul($n,&ec_doub($x,$y));
|
|
}
|
|
else {
|
|
$n->bdec()->bdiv(2);
|
|
return ec_add($x,$y,ec_mul($n,&ec_doub($x,$y)));
|
|
}
|
|
}
|
|
|
|
sub pkeygen {
|
|
my $key = Math::BigInt->new(h2i(shift))->bmod($l);
|
|
return ec_pack(ec_mul($key,$x0,$y0));
|
|
}
|
|
|
|
sub ec_hash {
|
|
my $h = pack 'H*', shift;
|
|
my $h = Math::BigInt->new('0x'.(unpack 'H*', reverse keccak_256($h)));
|
|
my ($x,$y) = (0,0);
|
|
while ($x == 0) {
|
|
($x,$y) = ec_unpack(i2h($h));
|
|
$h->binc();
|
|
}
|
|
return ec_mul(8,$x,$y);
|
|
}
|
|
|
|
sub im_gen {
|
|
my ($x,$y) = ec_hash(shift);
|
|
my $k = Math::BigInt->new(h2i(shift))->bmod($l);
|
|
return ec_pack(ec_mul($k,$x,$y));
|
|
}
|
|
|
|
|
|
sub sign {
|
|
my ($m,$sec_key) = @_;
|
|
my $sec_key = Math::BigInt->new(h2i($sec_key));
|
|
my ($x,$y) = ec_mul($sec_key,$x0,$y0);
|
|
my $k = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
|
|
#my $k = Math::BigInt->new('5267557024171956683337957876581522196748200715787296882078421399301151717969');
|
|
my $e = unpack 'H*', keccak_256($m.(pack 'H*', ec_pack(ec_mul($k,$x0,$y0))));
|
|
my $s = i2h(Math::BigInt->new(h2i($e))->bmul($sec_key)->bneg()->badd($k)->bmod($l));
|
|
$e = i2h(Math::BigInt->new(h2i($e))->bmod($l));
|
|
return ($s,$e);
|
|
}
|
|
|
|
sub check_s {
|
|
my ($m,$pt,$s1,$e1) = @_;
|
|
my ($x,$y) = ec_unpack($pt);
|
|
my $s = Math::BigInt->new(h2i($s1))->bmod($l);
|
|
my $e = Math::BigInt->new(h2i($e1))->bmod($l);
|
|
my ($x1,$y1) = ec_add(ec_mul($s,$x0,$y0),ec_mul($e,$x,$y));
|
|
$m = $m.(pack 'H*', ec_pack($x1,$y1));
|
|
my $ev = Math::BigInt->new(h2i(unpack 'H*', keccak_256($m)))->bmod($l);
|
|
|
|
return !$ev->bcmp($e);
|
|
}
|
|
|
|
sub r_sign {
|
|
my ($m,$image,$sec_key,$index,@pkeys) = @_;
|
|
my ($ix,$iy) = ec_unpack($image);
|
|
my $n = @pkeys;
|
|
my $data = $m;
|
|
my $w = $a = $b = $hx = $hy = $px = $py = 0;
|
|
my @zc = ();
|
|
my $sum = Math::BigInt->new();
|
|
#print "begin signing ($n keys)\n";
|
|
for $i (0..$n-1) {
|
|
($hx, $hy) = ec_hash(@pkeys[$i]);
|
|
($px,$py) = ec_unpack(@pkeys[$i]);
|
|
if ($i == $index) {
|
|
$w = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
|
|
$a = pack 'H*', ec_pack(ec_mul($w,$x0,$y0));
|
|
$b = pack 'H*', ec_pack(ec_mul($w,$hx,$hy));
|
|
push @zc,0,0;
|
|
}
|
|
else {
|
|
$z = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
|
|
$c = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
|
|
$sum->badd($c);
|
|
$a = pack 'H*', ec_pack(ec_add(ec_mul($z,$x0,$y0),ec_mul($c,$px,$py)));
|
|
$b = pack 'H*', ec_pack(ec_add(ec_mul($z,$hx,$hy),ec_mul($c,$ix,$iy)));
|
|
push @zc,i2h($z),i2h($c);
|
|
}
|
|
$data = $data.$a.$b;
|
|
#print "key number $i done\n";
|
|
}
|
|
#print "generating ringsig..\n";
|
|
my $h = unpack 'H*', keccak_256($data);
|
|
my $cy = Math::BigInt->new(h2i($h))->bsub($sum)->bmod($l);
|
|
my $zy = $cy->copy()->bmul(h2i($sec_key))->bneg()->badd($w)->bmod($l);
|
|
@zc[2*$index] = i2h($zy);
|
|
@zc[2*$index+1] = i2h($cy);
|
|
return @zc;
|
|
}
|
|
|
|
sub r_check_s {
|
|
my ($m,$image,@zc) = @_;
|
|
my $n = @zc/3;
|
|
for $j (0..$n-1) {
|
|
@pkeys[$j] = shift @zc;
|
|
}
|
|
my $data = $m;
|
|
my ($ix,$iy) = ec_unpack($image);
|
|
my $a = $b = $hx = $hy = $px = $py = $z = $c = 0;
|
|
my $sum = Math::BigInt->new();
|
|
#print "\nBegin checking ($n keys)\n";
|
|
for $i (0..$n-1) {
|
|
$z = Math::BigInt->new(h2i(shift @zc))->bmod($l);
|
|
$c = Math::BigInt->new(h2i(shift @zc))->bmod($l);
|
|
$sum->badd($c)->bmod($l);
|
|
($px,$py) = ec_unpack(@pkeys[$i]);
|
|
$a = pack 'H*', ec_pack(ec_add(ec_mul($z,$x0,$y0),ec_mul($c,$px,$py)));
|
|
($hx, $hy) = ec_hash(@pkeys[$i]);
|
|
$b = pack 'H*', ec_pack(ec_add(ec_mul($z,$hx,$hy),ec_mul($c,$ix,$iy)));
|
|
$data = $data.$a.$b;
|
|
#print "key number $i done\n";
|
|
}
|
|
my $h = Math::BigInt->new(h2i(unpack 'H*', keccak_256($data)))->bmod($l);
|
|
|
|
return !$h->bcmp($sum);
|
|
}
|
|
|
|
|
|
|
|
|