Add verRct/Range/RctMG

Author: HenryNguyen5

cryptonote_utils/cryptonote_utils.js

@@ -95,6 +95,8 @@ var cnUtil = function(currencyConfig) {
 	};
 
 	var Z = "0000000000000000000000000000000000000000000000000000000000000000"; //zero scalar
+	this.Z = Z;
+
 	//H2 object to speed up some operations
 	var H2 = [
 		"8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94",
@@ -1364,7 +1366,7 @@ var cnUtil = function(currencyConfig) {
 		}
 		const eeComputed = this.array_hash_to_scalar(Lv1);
 		const equalKeys = eeComputed === bb.ee;
-		console.log(`Keys equal? ${equalKeys}
+		console.log(`[verifyBorromean] Keys equal? ${equalKeys}
 		${eeComputed}
 		${bb.ee}`);
 
@@ -1444,6 +1446,41 @@ var cnUtil = function(currencyConfig) {
 		return sig;
 	};
 
+	//proveRange and verRange
+	//proveRange gives C, and mask such that \sumCi = C
+	//   c.f. http://eprint.iacr.org/2015/1098 section 5.1
+	//   and Ci is a commitment to either 0 or 2^i, i=0,...,63
+	//   thus this proves that "amount" is in [0, 2^64]
+	//   mask is a such that C = aG + bH, and b = amount
+	//verRange verifies that \sum Ci = C and that each Ci is a commitment to 0 or 2^i
+
+	this.verRange = function(C, as, nrings = 64) {
+		try {
+			let CiH = []; // len 64
+			let asCi = []; // len 64
+			let Ctmp;
+			for (let i = 0; i < nrings; i++) {
+				CiH[i] = this.ge_sub(as.Ci[i], this.H2[i]);
+				Ctmp = this.ge_add(Ctmp, as.Ci[i]);
+			}
+			const equalKeys = Ctmp === C;
+			console.log(`[verRange] Equal keys? ${equalKeys} 
+			C: ${c}
+			Ctmp: $${Ctmp}`);
+			if (!equalKeys) {
+				return false;
+			}
+
+			if (!this.verifyBorromean(as.asig, asCi, CiH)) {
+				return false;
+			}
+
+			return true;
+		} catch (e) {
+			return false;
+		}
+	};
+
 	function array_hash_to_scalar(array) {
 		var buf = "";
 		for (var i = 0; i < array.length; i++) {
@@ -1597,7 +1634,14 @@ var cnUtil = function(currencyConfig) {
 		return c;
 	};
 
-	//prepares for MLSAG_Gen
+	//Ring-ct MG sigs
+	//Prove:
+	//   c.f. http://eprint.iacr.org/2015/1098 section 4. definition 10.
+	//   This does the MG sig on the "dest" part of the given key matrix, and
+	//   the last row is the sum of input commitments from that column - sum output commitments
+	//   this shows that sum inputs = sum outputs
+	//Ver:
+	//   verifies the above sig is created corretly
 	this.proveRctMG = function(message, pubs, inSk, kimg, mask, Cout, index) {
 		var cols = pubs.length;
 		if (cols < 3) {
@@ -1616,6 +1660,64 @@ var cnUtil = function(currencyConfig) {
 		return this.MLSAG_Gen(message, PK, xx, kimg, index);
 	};
 
+	//Ring-ct MG sigs
+	//Prove:
+	//   c.f. http://eprint.iacr.org/2015/1098 section 4. definition 10.
+	//   This does the MG sig on the "dest" part of the given key matrix, and
+	//   the last row is the sum of input commitments from that column - sum output commitments
+	//   this shows that sum inputs = sum outputs
+	//Ver:
+	//   verifies the above sig is created corretly
+	// simple version, assuming only post Rct
+	this.verRctMG = function(mg, pubs, outPk, txnFeeKey, message, kimg) {
+		const cols = pubs.length;
+		if (cols < 1) {
+			throw Error("Empty pubs");
+		}
+		const rows = pubs[0].length;
+		if (rows < 1) {
+			throw Error("Empty pubs");
+		}
+		for (let i = 0; i < cols.length; ++i) {
+			if (pubs[i].length !== rows) {
+				throw Error("Pubs is not rectangular");
+			}
+		}
+		// key vector of rows + 1 len
+		const tmp = [];
+		for (let i = 0; i < rows + 1; i++) {
+			tmp[i] = this.identity();
+		}
+
+		// key matrix of (cols, tmp)
+		let M = [];
+
+		//create the matrix to mg sig
+		for (let j = 0; j < rows; j++) {
+			for (let i = 0; i < cols; i++) {
+				// add dimension
+				M[i].push([]);
+				M[i][j] = pubs[i][j].dest;
+				M[i][rows] = this.ge_add(M[i][rows], outPk[j].C); //add Ci in last row
+			}
+		}
+
+		for (let i = 0; i < cols; i++) {
+			for (let j = 0; j < outPk.length; j++) {
+				M[i][rows] = this.ge_sub(M[i][rows], outPk[J].C); //subtract output Ci's in last row
+			}
+
+			//subtract txn fee output in last row
+			M[i][rows] = this.ge_sub(M[i][rows], txnFeeKey);
+		}
+
+		return this.MLSAG_ver(message, M, mg, kimg);
+	};
+
+	this.verBulletProof = function() {
+		throw Error("verBulletProof is not implemented");
+	};
+
 	this.get_pre_mlsag_hash = function(rv) {
 		var hashes = "";
 		hashes += rv.message;
@@ -1768,6 +1870,77 @@ var cnUtil = function(currencyConfig) {
 		return rv;
 	};
 
+	this.verRct = function(rv, semantics) {
+		if (rv.type === 0x03) {
+			throw Error("Bulletproof validation not implemented");
+		}
+
+		// where RCTTypeFull is 0x01 and  RCTTypeFullBulletproof is 0x03
+		if (rv.type !== 0x01 && rv.type !== 0x03) {
+			throw Error("verRct called on non-full rctSig");
+		}
+		if (semantics) {
+			//RCTTypeFullBulletproof checks not implemented
+			// RCTTypeFull checks
+			if (rv.outPk.length !== rv.p.rangeSigs.length) {
+				throw Error("Mismatched sizes of outPk and rv.p.rangeSigs");
+			}
+			if (rv.outPk.length !== rv.ecdhInfo.length) {
+				throw Error("Mismatched sizes of outPk and rv.ecdhInfo");
+			}
+			if (rv.p.MGs.length !== 1) {
+				throw Error("full rctSig has not one MG");
+			}
+		} else {
+			// semantics check is early, we don't have the MGs resolved yet
+		}
+		try {
+			if (semantics) {
+				const results = [];
+				for (let i = 0; i < rv.outPk.length; i++) {
+					// might want to parallelize this like its done in the c++ codebase
+					// via some abstraction library to support browser + node
+					if (rv.p.rangeSigs.length === 0) {
+						results[i] = verBulletproof(rv.p.bulletproofs[i]);
+					} else {
+						// mask -> C if public
+						results[i] = verRange(rv.outPk[i].C, rv.p.rangeSigs[i]);
+					}
+				}
+
+				for (let i = 0; i < rv.outPk.length; i++) {
+					if (!results[i]) {
+						console.error(
+							"Range proof verification failed for output",
+							i,
+						);
+						return false;
+					}
+				}
+			} else {
+				// compute txn fee
+				const txnFeeKey = this.ge_scalarmult(H, this.d2s(rv.txnFee));
+				const mgVerd = verRctMg(
+					rv.p.MGs[0],
+					rv.mixRing,
+					rv.outPk,
+					txnFeeKey,
+					this.get_pre_mlsag_hash(rv),
+				);
+				console.log("mg sig verified?", mgVerd);
+				if (!mgVerd) {
+					console.error("MG Signature verification failed");
+					return false;
+				}
+			}
+		} catch (e) {
+			console.error("Error in vetRCt: ", e);
+		}
+	};
+
+	this.verBulletProof = function() {
+		throw Error("verBulletProof is not implemented");
+	};
 	//end RCT functions
 
 	this.add_pub_key_to_extra = function(extra, pubkey) {