mirror of
https://github.com/sonr-io/crypto.git
synced 2026-08-02 15:31:38 +00:00
No commit suggestions generated
This commit is contained in:
Prad Nukala
+339
@@ -0,0 +1,339 @@
|
||||
//
|
||||
// Copyright Coinbase, Inc. All Rights Reserved.
|
||||
//
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
//
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/elliptic"
|
||||
"crypto/sha256"
|
||||
"crypto/sha512"
|
||||
"fmt"
|
||||
"hash"
|
||||
"math"
|
||||
"math/big"
|
||||
|
||||
"github.com/btcsuite/btcd/btcec/v2"
|
||||
"golang.org/x/crypto/hkdf"
|
||||
"golang.org/x/crypto/sha3"
|
||||
|
||||
"github.com/sonr-io/sonr/crypto/internal"
|
||||
)
|
||||
|
||||
type HashField struct {
|
||||
// F_p^k
|
||||
Order *big.Int // p^k
|
||||
Characteristic *big.Int // p
|
||||
ExtensionDegree *big.Int // k
|
||||
}
|
||||
|
||||
type Params struct {
|
||||
F *HashField
|
||||
SecurityParameter int
|
||||
Hash func() hash.Hash
|
||||
L int
|
||||
}
|
||||
|
||||
// Helper functions reserved for future use
|
||||
|
||||
// getCurveFromName returns the appropriate elliptic curve for a given name
|
||||
// nolint:unused,deadcode
|
||||
func getCurveFromName(name string) elliptic.Curve {
|
||||
switch name {
|
||||
case "P-256", "secp256r1":
|
||||
return elliptic.P256()
|
||||
case "P-384", "secp384r1":
|
||||
return elliptic.P384()
|
||||
case "P-521", "secp521r1":
|
||||
return elliptic.P521()
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// validateCurveParams validates curve parameters for security
|
||||
// nolint:unused,deadcode
|
||||
func validateCurveParams(curve elliptic.Curve) error {
|
||||
if curve == nil {
|
||||
return fmt.Errorf("curve is nil")
|
||||
}
|
||||
params := curve.Params()
|
||||
if params == nil {
|
||||
return fmt.Errorf("curve parameters are nil")
|
||||
}
|
||||
if params.P == nil || params.N == nil {
|
||||
return fmt.Errorf("invalid curve parameters: P or N is nil")
|
||||
}
|
||||
// Ensure the curve order is large enough for security
|
||||
if params.N.BitLen() < 224 {
|
||||
return fmt.Errorf("curve order too small for security: %d bits", params.N.BitLen())
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func getParams(curve elliptic.Curve) (*Params, error) {
|
||||
switch curve.Params().Name {
|
||||
case btcec.S256().Name, elliptic.P256().Params().Name:
|
||||
return &Params{
|
||||
F: &HashField{
|
||||
Order: curve.Params().P,
|
||||
Characteristic: curve.Params().P,
|
||||
ExtensionDegree: new(big.Int).SetInt64(1),
|
||||
},
|
||||
SecurityParameter: 128,
|
||||
Hash: sha256.New,
|
||||
L: 48,
|
||||
}, nil
|
||||
case elliptic.P384().Params().Name, "P-384", "secp384r1":
|
||||
// P-384 curve with 192-bit security level
|
||||
return &Params{
|
||||
F: &HashField{
|
||||
Order: curve.Params().P,
|
||||
Characteristic: curve.Params().P,
|
||||
ExtensionDegree: new(big.Int).SetInt64(1),
|
||||
},
|
||||
SecurityParameter: 192,
|
||||
Hash: sha3.New384, // Using SHA3-384 for P-384
|
||||
L: 72, // 192-bit security requires 72 bytes
|
||||
}, nil
|
||||
case elliptic.P521().Params().Name, "P-521", "secp521r1":
|
||||
// P-521 curve with 256-bit security level
|
||||
return &Params{
|
||||
F: &HashField{
|
||||
Order: curve.Params().P,
|
||||
Characteristic: curve.Params().P,
|
||||
ExtensionDegree: new(big.Int).SetInt64(1),
|
||||
},
|
||||
SecurityParameter: 256,
|
||||
Hash: sha512.New, // Using SHA-512 for P-521
|
||||
L: 98, // 256-bit security with P-521's 521-bit field
|
||||
}, nil
|
||||
case "Bls12381G1":
|
||||
return &Params{
|
||||
F: &HashField{
|
||||
Order: curve.Params().P,
|
||||
Characteristic: curve.Params().P,
|
||||
ExtensionDegree: new(big.Int).SetInt64(1),
|
||||
},
|
||||
SecurityParameter: 128,
|
||||
Hash: sha256.New,
|
||||
L: 48,
|
||||
}, nil
|
||||
case "ed25519":
|
||||
return &Params{
|
||||
F: &HashField{
|
||||
Order: curve.Params().P,
|
||||
Characteristic: curve.Params().P,
|
||||
ExtensionDegree: new(big.Int).SetInt64(1),
|
||||
},
|
||||
SecurityParameter: 128,
|
||||
Hash: sha256.New,
|
||||
L: 48,
|
||||
}, nil
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported curve: %s", curve.Params().Name)
|
||||
}
|
||||
}
|
||||
|
||||
func I2OSP(b, n int) []byte {
|
||||
os := new(big.Int).SetInt64(int64(b)).Bytes()
|
||||
if n > len(os) {
|
||||
var buf bytes.Buffer
|
||||
buf.Write(make([]byte, n-len(os)))
|
||||
buf.Write(os)
|
||||
return buf.Bytes()
|
||||
}
|
||||
return os[:n]
|
||||
}
|
||||
|
||||
func OS2IP(os []byte) *big.Int {
|
||||
return new(big.Int).SetBytes(os)
|
||||
}
|
||||
|
||||
func hashThis(f func() hash.Hash, this []byte) ([]byte, error) {
|
||||
h := f()
|
||||
w, err := h.Write(this)
|
||||
if w != len(this) {
|
||||
return nil, fmt.Errorf("bytes written to hash doesn't match expected")
|
||||
} else if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
v := h.Sum(nil)
|
||||
return v, nil
|
||||
}
|
||||
|
||||
func concat(xs ...[]byte) []byte {
|
||||
var result []byte
|
||||
for _, x := range xs {
|
||||
result = append(result, x...)
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func xor(b1, b2 []byte) []byte {
|
||||
// b1 and b2 must be same length
|
||||
result := make([]byte, len(b1))
|
||||
for i := range b1 {
|
||||
result[i] = b1[i] ^ b2[i]
|
||||
}
|
||||
|
||||
return result
|
||||
}
|
||||
|
||||
func ExpandMessageXmd(f func() hash.Hash, msg, DST []byte, lenInBytes int) ([]byte, error) {
|
||||
// https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-10#section-5.4.1
|
||||
|
||||
// step 1
|
||||
ell := int(math.Ceil(float64(lenInBytes) / float64(f().Size())))
|
||||
|
||||
// step 2
|
||||
if ell > 255 {
|
||||
return nil, fmt.Errorf("ell > 255")
|
||||
}
|
||||
|
||||
// step 3
|
||||
dstPrime := append(DST, I2OSP(len(DST), 1)...)
|
||||
|
||||
// step 4
|
||||
zPad := I2OSP(0, f().BlockSize())
|
||||
|
||||
// step 5 & 6
|
||||
msgPrime := concat(zPad, msg, I2OSP(lenInBytes, 2), I2OSP(0, 1), dstPrime)
|
||||
|
||||
var err error
|
||||
|
||||
b := make([][]byte, ell+1)
|
||||
|
||||
// step 7
|
||||
b[0], err = hashThis(f, msgPrime)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// step 8
|
||||
b[1], err = hashThis(f, concat(b[0], I2OSP(1, 1), dstPrime))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// step 9
|
||||
for i := 2; i <= ell; i++ {
|
||||
// step 10
|
||||
b[i], err = hashThis(f, concat(xor(b[0], b[i-1]), I2OSP(i, 1), dstPrime))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
// step 11
|
||||
uniformBytes := concat(b[1:]...)
|
||||
|
||||
// step 12
|
||||
return uniformBytes[:lenInBytes], nil
|
||||
}
|
||||
|
||||
func hashToField(msg []byte, count int, curve elliptic.Curve) ([][]*big.Int, error) {
|
||||
// https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-10#section-5.3
|
||||
|
||||
parameters, err := getParams(curve)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
f := parameters.Hash
|
||||
|
||||
DST := []byte("Coinbase_tECDSA")
|
||||
|
||||
m := int(parameters.F.ExtensionDegree.Int64())
|
||||
L := parameters.L
|
||||
|
||||
// step 1
|
||||
lenInBytes := count * m * L
|
||||
|
||||
// step 2
|
||||
uniformBytes, err := ExpandMessageXmd(f, msg, DST, lenInBytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
u := make([][]*big.Int, count)
|
||||
|
||||
// step 3
|
||||
for i := 0; i < count; i++ {
|
||||
e := make([]*big.Int, m)
|
||||
// step 4
|
||||
for j := 0; j < m; j++ {
|
||||
// step 5
|
||||
elmOffset := L * (j + i*m)
|
||||
// step 6
|
||||
tv := uniformBytes[elmOffset : elmOffset+L]
|
||||
// step 7
|
||||
e[j] = new(big.Int).Mod(OS2IP(tv), parameters.F.Characteristic)
|
||||
|
||||
}
|
||||
// step 8
|
||||
u[i] = e
|
||||
}
|
||||
// step 9
|
||||
return u, nil
|
||||
}
|
||||
|
||||
func Hash(msg []byte, curve elliptic.Curve) (*big.Int, error) {
|
||||
u, err := hashToField(msg, 1, curve)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return u[0][0], nil
|
||||
}
|
||||
|
||||
// fiatShamir computes the HKDF over many values
|
||||
// iteratively such that each value is hashed separately
|
||||
// and based on preceding values
|
||||
//
|
||||
// The first value is computed as okm_0 = KDF(f || value) where
|
||||
// f is a byte slice of 32 0xFF
|
||||
// salt is zero-filled byte slice with length equal to the hash output length
|
||||
// info is the protocol name
|
||||
// okm is the 32 byte output
|
||||
//
|
||||
// The each subsequent iteration is computed by as okm_i = KDF(f_i || value || okm_{i-1})
|
||||
// where f_i = 2^b - 1 - i such that there are 0xFF bytes prior to the value.
|
||||
// f_1 changes the first byte to 0xFE, f_2 to 0xFD. The previous okm is appended to the value
|
||||
// to provide cryptographic domain separation.
|
||||
// See https://signal.org/docs/specifications/x3dh/#cryptographic-notation
|
||||
// and https://signal.org/docs/specifications/xeddsa/#hash-functions
|
||||
// for more details.
|
||||
// This uses the KDF function similar to X3DH for each `value`
|
||||
// But changes the key just like XEdDSA where the prefix bytes change by a single bit
|
||||
func FiatShamir(values ...*big.Int) ([]byte, error) {
|
||||
// Don't accept any nil arguments
|
||||
if AnyNil(values...) {
|
||||
return nil, internal.ErrNilArguments
|
||||
}
|
||||
|
||||
info := []byte("Coinbase tECDSA 1.0")
|
||||
salt := make([]byte, 32)
|
||||
okm := make([]byte, 32)
|
||||
f := bytes.Repeat([]byte{0xFF}, 32)
|
||||
|
||||
for _, b := range values {
|
||||
ikm := append(f, b.Bytes()...)
|
||||
ikm = append(ikm, okm...)
|
||||
kdf := hkdf.New(sha256.New, ikm, salt, info)
|
||||
n, err := kdf.Read(okm)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if n != len(okm) {
|
||||
return nil, fmt.Errorf(
|
||||
"unable to read expected number of bytes want=%v got=%v",
|
||||
len(okm),
|
||||
n,
|
||||
)
|
||||
}
|
||||
internal.ByteSub(f)
|
||||
}
|
||||
return okm, nil
|
||||
}
|
||||
Reference in New Issue
Block a user