feat(crypto): Phase 2a scaffold — vendored C++ and CMake build
Extract CryptoNote crypto sources from upstream (fa1608cf). Build as static libcryptonote.a via CMake with compat stubs for external dependencies (warnings, logging, varint, profiling). 37 upstream files, 10 compat stubs, 680KB static library. Co-Authored-By: Charon <charon@lethean.io>
This commit is contained in:
Claude
parent
65080123bc
commit
1416a6714a
56 changed files with 17308 additions and 0 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
crypto/build/
|
||||
71
crypto/CMakeLists.txt
Normal file
71
crypto/CMakeLists.txt
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
# SPDX-Licence-Identifier: EUPL-1.2
|
||||
#
|
||||
# Builds libcryptonote.a from vendored upstream C/C++ sources.
|
||||
# This is the build-system half of the CGo bridge.
|
||||
#
|
||||
cmake_minimum_required(VERSION 3.20)
|
||||
project(cryptonote C CXX)
|
||||
|
||||
set(CMAKE_C_STANDARD 11)
|
||||
set(CMAKE_CXX_STANDARD 17)
|
||||
set(CMAKE_CXX_STANDARD_REQUIRED ON)
|
||||
set(CMAKE_POSITION_INDEPENDENT_CODE ON)
|
||||
|
||||
# Include paths: upstream sources + compat stubs
|
||||
include_directories(
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/upstream
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/compat
|
||||
)
|
||||
|
||||
# --- Pure C sources (no dependencies beyond themselves) ---
|
||||
set(C_SOURCES
|
||||
upstream/crypto-ops.c
|
||||
upstream/crypto-ops-data.c
|
||||
upstream/keccak.c
|
||||
upstream/hash.c
|
||||
upstream/random.c
|
||||
upstream/blake2b-ref.c
|
||||
upstream/RIPEMD160.c
|
||||
)
|
||||
|
||||
# --- C++ sources (depend on compat layer + Boost headers) ---
|
||||
# eth_signature.cpp excluded — needs bitcoin-secp256k1, not required for consensus crypto.
|
||||
# The header (eth_signature.h) is still included for type definitions via crypto-sugar.h.
|
||||
set(CXX_SOURCES
|
||||
upstream/crypto.cpp
|
||||
upstream/crypto-sugar.cpp
|
||||
upstream/clsag.cpp
|
||||
upstream/zarcanum.cpp
|
||||
upstream/range_proofs.cpp
|
||||
upstream/one_out_of_many_proofs.cpp
|
||||
upstream/msm.cpp
|
||||
upstream/RIPEMD160_helper.cpp
|
||||
bridge.cpp
|
||||
)
|
||||
|
||||
# --- Find system dependencies ---
|
||||
find_package(OpenSSL REQUIRED)
|
||||
find_package(Boost REQUIRED)
|
||||
|
||||
# --- Static library ---
|
||||
add_library(cryptonote STATIC ${C_SOURCES} ${CXX_SOURCES})
|
||||
|
||||
target_include_directories(cryptonote PRIVATE
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/upstream
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/compat
|
||||
${OPENSSL_INCLUDE_DIR}
|
||||
${Boost_INCLUDE_DIRS}
|
||||
)
|
||||
|
||||
target_link_libraries(cryptonote PRIVATE
|
||||
OpenSSL::Crypto
|
||||
)
|
||||
|
||||
# Suppress warnings from upstream code (we don't modify it)
|
||||
target_compile_options(cryptonote PRIVATE
|
||||
-Wno-unused-variable
|
||||
-Wno-unused-function
|
||||
-Wno-sign-compare
|
||||
-Wno-unused-parameter
|
||||
-Wno-deprecated-declarations
|
||||
)
|
||||
66
crypto/PROVENANCE.md
Normal file
66
crypto/PROVENANCE.md
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
# Provenance
|
||||
|
||||
Vendored from `~/Code/LetheanNetwork/blockchain/` at commit `fa1608cf`.
|
||||
|
||||
## Upstream Files (unmodified copies)
|
||||
|
||||
| Local Path | Upstream Path | Modified |
|
||||
|-----------|---------------|----------|
|
||||
| upstream/crypto-ops.c | src/crypto/crypto-ops.c | no |
|
||||
| upstream/crypto-ops-data.c | src/crypto/crypto-ops-data.c | no |
|
||||
| upstream/crypto-ops.h | src/crypto/crypto-ops.h | no |
|
||||
| upstream/crypto.cpp | src/crypto/crypto.cpp | no |
|
||||
| upstream/crypto.h | src/crypto/crypto.h | no |
|
||||
| upstream/crypto-sugar.h | src/crypto/crypto-sugar.h | no |
|
||||
| upstream/crypto-sugar.cpp | src/crypto/crypto-sugar.cpp | no |
|
||||
| upstream/clsag.h | src/crypto/clsag.h | no |
|
||||
| upstream/clsag.cpp | src/crypto/clsag.cpp | no |
|
||||
| upstream/zarcanum.h | src/crypto/zarcanum.h | no |
|
||||
| upstream/zarcanum.cpp | src/crypto/zarcanum.cpp | no |
|
||||
| upstream/range_proofs.h | src/crypto/range_proofs.h | no |
|
||||
| upstream/range_proofs.cpp | src/crypto/range_proofs.cpp | no |
|
||||
| upstream/range_proof_bppe.h | src/crypto/range_proof_bppe.h | no |
|
||||
| upstream/range_proof_bpp.h | src/crypto/range_proof_bpp.h | no |
|
||||
| upstream/one_out_of_many_proofs.h | src/crypto/one_out_of_many_proofs.h | no |
|
||||
| upstream/one_out_of_many_proofs.cpp | src/crypto/one_out_of_many_proofs.cpp | no |
|
||||
| upstream/msm.h | src/crypto/msm.h | no |
|
||||
| upstream/msm.cpp | src/crypto/msm.cpp | no |
|
||||
| upstream/keccak.c | src/crypto/keccak.c | no |
|
||||
| upstream/keccak.h | src/crypto/keccak.h | no |
|
||||
| upstream/hash.c | src/crypto/hash.c | no |
|
||||
| upstream/hash.h | src/crypto/hash.h | no |
|
||||
| upstream/hash-ops.h | src/crypto/hash-ops.h | no |
|
||||
| upstream/random.c | src/crypto/random.c | no |
|
||||
| upstream/random.h | src/crypto/random.h | no |
|
||||
| upstream/blake2.h | src/crypto/blake2.h | no |
|
||||
| upstream/blake2-impl.h | src/crypto/blake2-impl.h | no |
|
||||
| upstream/blake2b-ref.c | src/crypto/blake2b-ref.c | no |
|
||||
| upstream/generic-ops.h | src/crypto/generic-ops.h | no |
|
||||
| upstream/eth_signature.h | src/crypto/eth_signature.h | no |
|
||||
| upstream/eth_signature.cpp | src/crypto/eth_signature.cpp | no |
|
||||
| upstream/RIPEMD160.c | src/crypto/RIPEMD160.c | no |
|
||||
| upstream/RIPEMD160.h | src/crypto/RIPEMD160.h | no |
|
||||
| upstream/RIPEMD160_helper.h | src/crypto/RIPEMD160_helper.h | no |
|
||||
| upstream/RIPEMD160_helper.cpp | src/crypto/RIPEMD160_helper.cpp | no |
|
||||
| upstream/initializer.h | src/crypto/initializer.h | no |
|
||||
|
||||
## Compat Files (extracted subsets or stubs)
|
||||
|
||||
| Local Path | Origin | Notes |
|
||||
|-----------|--------|-------|
|
||||
| compat/currency_core/crypto_config.h | src/currency_core/crypto_config.h | unmodified copy |
|
||||
| compat/common/pod-class.h | src/common/pod-class.h | unmodified copy |
|
||||
| compat/common/varint.h | src/common/varint.h | unmodified copy |
|
||||
| compat/warnings.h | N/A | stub — no-op macros |
|
||||
| compat/epee/include/misc_log_ex.h | N/A | stub — no-op logging macros |
|
||||
| compat/common/crypto_stream_operators.h | N/A | stub — empty |
|
||||
| compat/include_base_utils.h | N/A | stub — empty |
|
||||
|
||||
## Update Workflow
|
||||
|
||||
1. Note the current provenance commit (`fa1608cf`)
|
||||
2. In the upstream repo, `git diff fa1608cf..HEAD -- src/crypto/`
|
||||
3. Copy changed files into `upstream/`
|
||||
4. Rebuild: `cmake --build crypto/build --parallel`
|
||||
5. Run tests: `go test -race ./crypto/...`
|
||||
6. Update this file with new commit hash
|
||||
17
crypto/bridge.cpp
Normal file
17
crypto/bridge.cpp
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Thin C wrappers around CryptoNote C++ crypto library.
|
||||
// This is the implementation of bridge.h.
|
||||
|
||||
#include "bridge.h"
|
||||
|
||||
#include <cstring>
|
||||
#include "crypto.h"
|
||||
#include "hash-ops.h"
|
||||
|
||||
extern "C" {
|
||||
|
||||
void bridge_fast_hash(const uint8_t *data, size_t len, uint8_t hash[32]) {
|
||||
crypto::cn_fast_hash(data, len, reinterpret_cast<char*>(hash));
|
||||
}
|
||||
|
||||
} // extern "C"
|
||||
20
crypto/bridge.h
Normal file
20
crypto/bridge.h
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Stable C API for go-blockchain CGo bindings.
|
||||
// Go code calls ONLY these functions — no C++ types cross this boundary.
|
||||
#ifndef CRYPTONOTE_BRIDGE_H
|
||||
#define CRYPTONOTE_BRIDGE_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
// ── Hashing ───────────────────────────────────────────────
|
||||
void bridge_fast_hash(const uint8_t *data, size_t len, uint8_t hash[32]);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif // CRYPTONOTE_BRIDGE_H
|
||||
1
crypto/common/crypto_stream_operators.h
Symbolic link
1
crypto/common/crypto_stream_operators.h
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../compat/common/crypto_stream_operators.h
|
||||
7
crypto/compat/auto_val_init.h
Normal file
7
crypto/compat/auto_val_init.h
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub for auto_val_init.h — replaces boost::value_initialized with
|
||||
// aggregate zero-initialisation which is equivalent for POD types.
|
||||
#pragma once
|
||||
|
||||
#define AUTO_VAL_INIT(v) decltype(v){}
|
||||
#define AUTO_VAL_INIT_T(t) t{}
|
||||
3
crypto/compat/common/crypto_stream_operators.h
Normal file
3
crypto/compat/common/crypto_stream_operators.h
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub — stream operators not needed for CGo bridge.
|
||||
#pragma once
|
||||
258
crypto/compat/common/int-util.h
Executable file
258
crypto/compat/common/int-util.h
Executable file
|
|
@ -0,0 +1,258 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#include <intrin.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#if !defined(__ORDER_LITTLE_ENDIAN__)
|
||||
#define __ORDER_LITTLE_ENDIAN__ 1011012001
|
||||
#endif
|
||||
|
||||
#if !defined(__BYTE_ORDER__)
|
||||
#define __BYTE_ORDER__ __ORDER_LITTLE_ENDIAN__
|
||||
#endif
|
||||
|
||||
#if !defined(__ORDER_BIG_ENDIAN__)
|
||||
#define __ORDER_BIG_ENDIAN__ 0
|
||||
#endif
|
||||
|
||||
static inline uint32_t rol32(uint32_t x, int r) {
|
||||
static_assert(sizeof(uint32_t) == sizeof(unsigned int), "this code assumes 32-bit integers");
|
||||
return _rotl(x, r);
|
||||
}
|
||||
|
||||
static inline uint64_t rol64(uint64_t x, int r) {
|
||||
return _rotl64(x, r);
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
static inline uint32_t rol32(uint32_t x, int r) {
|
||||
return (x << (r & 31)) | (x >> (-r & 31));
|
||||
}
|
||||
|
||||
static inline uint64_t rol64(uint64_t x, int r) {
|
||||
return (x << (r & 63)) | (x >> (-r & 63));
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static inline uint64_t hi_dword(uint64_t val) {
|
||||
return val >> 32;
|
||||
}
|
||||
|
||||
static inline uint64_t lo_dword(uint64_t val) {
|
||||
return val & 0xFFFFFFFF;
|
||||
}
|
||||
|
||||
static inline uint64_t mul128_manually(uint64_t multiplier, uint64_t multiplicand, uint64_t* product_hi) {
|
||||
// multiplier = ab = a * 2^32 + b
|
||||
// multiplicand = cd = c * 2^32 + d
|
||||
// ab * cd = a * c * 2^64 + (a * d + b * c) * 2^32 + b * d
|
||||
uint64_t a = hi_dword(multiplier);
|
||||
uint64_t b = lo_dword(multiplier);
|
||||
uint64_t c = hi_dword(multiplicand);
|
||||
uint64_t d = lo_dword(multiplicand);
|
||||
|
||||
uint64_t ac = a * c;
|
||||
uint64_t ad = a * d;
|
||||
uint64_t bc = b * c;
|
||||
uint64_t bd = b * d;
|
||||
|
||||
uint64_t adbc = ad + bc;
|
||||
uint64_t adbc_carry = adbc < ad ? 1 : 0;
|
||||
|
||||
// multiplier * multiplicand = product_hi * 2^64 + product_lo
|
||||
uint64_t product_lo = bd + (adbc << 32);
|
||||
uint64_t product_lo_carry = product_lo < bd ? 1 : 0;
|
||||
*product_hi = ac + (adbc >> 32) + (adbc_carry << 32) + product_lo_carry;
|
||||
assert(ac <= *product_hi);
|
||||
|
||||
return product_lo;
|
||||
}
|
||||
|
||||
static inline uint64_t div_with_reminder(uint64_t dividend, uint32_t divisor, uint32_t* remainder) {
|
||||
dividend |= ((uint64_t)*remainder) << 32;
|
||||
*remainder = dividend % divisor;
|
||||
return dividend / divisor;
|
||||
}
|
||||
|
||||
// Long division with 2^32 base
|
||||
static inline uint32_t div128_32_manually(uint64_t dividend_hi, uint64_t dividend_lo, uint32_t divisor, uint64_t* quotient_hi, uint64_t* quotient_lo) {
|
||||
uint64_t dividend_dwords[4];
|
||||
uint32_t remainder = 0;
|
||||
|
||||
dividend_dwords[3] = hi_dword(dividend_hi);
|
||||
dividend_dwords[2] = lo_dword(dividend_hi);
|
||||
dividend_dwords[1] = hi_dword(dividend_lo);
|
||||
dividend_dwords[0] = lo_dword(dividend_lo);
|
||||
|
||||
*quotient_hi = div_with_reminder(dividend_dwords[3], divisor, &remainder) << 32;
|
||||
*quotient_hi |= div_with_reminder(dividend_dwords[2], divisor, &remainder);
|
||||
*quotient_lo = div_with_reminder(dividend_dwords[1], divisor, &remainder) << 32;
|
||||
*quotient_lo |= div_with_reminder(dividend_dwords[0], divisor, &remainder);
|
||||
|
||||
return remainder;
|
||||
}
|
||||
|
||||
static inline uint64_t mul128(uint64_t multiplier, uint64_t multiplicand, uint64_t* product_hi)
|
||||
{
|
||||
// #if defined(_MSC_VER)
|
||||
// return _umul128(multiplier, multiplicand, product_hi);
|
||||
// #elif defined(__GNUC__)
|
||||
// __uint128_t product = ((__uint128_t)multiplier) * multiplicand;
|
||||
// *product_hi = (uint64_t)(product >> 64);
|
||||
// return ((uint64_t)product) & ~(UINT64_C(0));
|
||||
// #else
|
||||
return mul128_manually(multiplier, multiplicand, product_hi);
|
||||
//#endif*/
|
||||
}
|
||||
//*/
|
||||
|
||||
static inline uint32_t div128_32(uint64_t dividend_hi, uint64_t dividend_lo, uint32_t divisor, uint64_t* quotient_hi, uint64_t* quotient_lo)
|
||||
{
|
||||
// #if defined(__GNUC__)
|
||||
// __uint128_t dividend = (((__uint128_t)dividend_hi) << 64) | dividend_lo;
|
||||
// __uint128_t quotient = dividend / divisor;
|
||||
// __uint128_t reminder = dividend % divisor;
|
||||
// *quotient_hi = (uint64_t)(quotient >> 64);
|
||||
// *quotient_lo = ((uint64_t)quotient) & ~(UINT64_C(0));
|
||||
// return (uint32_t)reminder;
|
||||
// #else
|
||||
return div128_32_manually(dividend_hi, dividend_lo, divisor, quotient_hi, quotient_lo);
|
||||
//#endif
|
||||
}
|
||||
//*/
|
||||
#define IDENT32(x) ((uint32_t) (x))
|
||||
#define IDENT64(x) ((uint64_t) (x))
|
||||
|
||||
#define SWAP32(x) ((((uint32_t) (x) & 0x000000ff) << 24) | \
|
||||
(((uint32_t) (x) & 0x0000ff00) << 8) | \
|
||||
(((uint32_t) (x) & 0x00ff0000) >> 8) | \
|
||||
(((uint32_t) (x) & 0xff000000) >> 24))
|
||||
#define SWAP64(x) ((((uint64_t) (x) & 0x00000000000000ff) << 56) | \
|
||||
(((uint64_t) (x) & 0x000000000000ff00) << 40) | \
|
||||
(((uint64_t) (x) & 0x0000000000ff0000) << 24) | \
|
||||
(((uint64_t) (x) & 0x00000000ff000000) << 8) | \
|
||||
(((uint64_t) (x) & 0x000000ff00000000) >> 8) | \
|
||||
(((uint64_t) (x) & 0x0000ff0000000000) >> 24) | \
|
||||
(((uint64_t) (x) & 0x00ff000000000000) >> 40) | \
|
||||
(((uint64_t) (x) & 0xff00000000000000) >> 56))
|
||||
|
||||
static inline uint32_t ident32(uint32_t x) { return x; }
|
||||
static inline uint64_t ident64(uint64_t x) { return x; }
|
||||
|
||||
static inline uint32_t swap32(uint32_t x) {
|
||||
x = ((x & 0x00ff00ff) << 8) | ((x & 0xff00ff00) >> 8);
|
||||
return (x << 16) | (x >> 16);
|
||||
}
|
||||
static inline uint64_t swap64(uint64_t x) {
|
||||
x = ((x & 0x00ff00ff00ff00ff) << 8) | ((x & 0xff00ff00ff00ff00) >> 8);
|
||||
x = ((x & 0x0000ffff0000ffff) << 16) | ((x & 0xffff0000ffff0000) >> 16);
|
||||
return (x << 32) | (x >> 32);
|
||||
}
|
||||
|
||||
#if defined(__GNUC__)
|
||||
#define UNUSED __attribute__((unused))
|
||||
#else
|
||||
#define UNUSED
|
||||
#endif
|
||||
static inline void mem_inplace_ident(void *mem UNUSED, size_t n UNUSED) { }
|
||||
#undef UNUSED
|
||||
|
||||
static inline void mem_inplace_swap32(void *mem, size_t n) {
|
||||
size_t i;
|
||||
for (i = 0; i < n; i++) {
|
||||
((uint32_t *) mem)[i] = swap32(((const uint32_t *) mem)[i]);
|
||||
}
|
||||
}
|
||||
static inline void mem_inplace_swap64(void *mem, size_t n) {
|
||||
size_t i;
|
||||
for (i = 0; i < n; i++) {
|
||||
((uint64_t *) mem)[i] = swap64(((const uint64_t *) mem)[i]);
|
||||
}
|
||||
}
|
||||
|
||||
static inline void memcpy_ident32(void *dst, const void *src, size_t n) {
|
||||
memcpy(dst, src, 4 * n);
|
||||
}
|
||||
static inline void memcpy_ident64(void *dst, const void *src, size_t n) {
|
||||
memcpy(dst, src, 8 * n);
|
||||
}
|
||||
|
||||
static inline void memcpy_swap32(void *dst, const void *src, size_t n) {
|
||||
size_t i;
|
||||
for (i = 0; i < n; i++) {
|
||||
((uint32_t *) dst)[i] = swap32(((const uint32_t *) src)[i]);
|
||||
}
|
||||
}
|
||||
static inline void memcpy_swap64(void *dst, const void *src, size_t n) {
|
||||
size_t i;
|
||||
for (i = 0; i < n; i++) {
|
||||
((uint64_t *) dst)[i] = swap64(((const uint64_t *) src)[i]);
|
||||
}
|
||||
}
|
||||
|
||||
#if !defined(__BYTE_ORDER__) || !defined(__ORDER_LITTLE_ENDIAN__) || !defined(__ORDER_BIG_ENDIAN__)
|
||||
static_assert(false, "BYTE_ORDER is undefined. Perhaps, GNU extensions are not enabled");
|
||||
#endif
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
|
||||
#define SWAP32LE IDENT32
|
||||
#define SWAP32BE SWAP32
|
||||
#define swap32le ident32
|
||||
#define swap32be swap32
|
||||
#define mem_inplace_swap32le mem_inplace_ident
|
||||
#define mem_inplace_swap32be mem_inplace_swap32
|
||||
#define memcpy_swap32le memcpy_ident32
|
||||
#define memcpy_swap32be memcpy_swap32
|
||||
#define SWAP64LE IDENT64
|
||||
#define SWAP64BE SWAP64
|
||||
#define swap64le ident64
|
||||
#define swap64be swap64
|
||||
#define mem_inplace_swap64le mem_inplace_ident
|
||||
#define mem_inplace_swap64be mem_inplace_swap64
|
||||
#define memcpy_swap64le memcpy_ident64
|
||||
#define memcpy_swap64be memcpy_swap64
|
||||
#endif
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define SWAP32BE IDENT32
|
||||
#define SWAP32LE SWAP32
|
||||
#define swap32be ident32
|
||||
#define swap32le swap32
|
||||
#define mem_inplace_swap32be mem_inplace_ident
|
||||
#define mem_inplace_swap32le mem_inplace_swap32
|
||||
#define memcpy_swap32be memcpy_ident32
|
||||
#define memcpy_swap32le memcpy_swap32
|
||||
#define SWAP64BE IDENT64
|
||||
#define SWAP64LE SWAP64
|
||||
#define swap64be ident64
|
||||
#define swap64le swap64
|
||||
#define mem_inplace_swap64be mem_inplace_ident
|
||||
#define mem_inplace_swap64le mem_inplace_swap64
|
||||
#define memcpy_swap64be memcpy_ident64
|
||||
#define memcpy_swap64le memcpy_swap64
|
||||
#endif
|
||||
22
crypto/compat/common/pod-class.h
Executable file
22
crypto/compat/common/pod-class.h
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
// in C++ no difference 'class' vs 'struct' except the default members access.
|
||||
// maybe be better to erase the 'POD_CLASS' macro completely?
|
||||
#define POD_CLASS struct
|
||||
97
crypto/compat/common/varint.h
Executable file
97
crypto/compat/common/varint.h
Executable file
|
|
@ -0,0 +1,97 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <limits>
|
||||
#include <type_traits>
|
||||
#include <utility>
|
||||
#include <sstream>
|
||||
#include <string>
|
||||
|
||||
namespace tools {
|
||||
|
||||
|
||||
//---------------------------------------------------------------
|
||||
template<typename T>
|
||||
size_t get_varint_packed_size(T v)
|
||||
{
|
||||
if(v <= 127)
|
||||
return 1;
|
||||
else if(v <= 16383)
|
||||
return 2;
|
||||
else if(v <= 2097151)
|
||||
return 3;
|
||||
else if(v <= 268435455)
|
||||
return 4;
|
||||
else if(v <= 34359738367)
|
||||
return 5;
|
||||
else if(v <= 4398046511103)
|
||||
return 6;
|
||||
else if(v <= 562949953421311)
|
||||
return 7;
|
||||
else
|
||||
return 8;
|
||||
}
|
||||
template<typename OutputIt, typename T>
|
||||
typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value, void>::type
|
||||
write_varint(OutputIt &&dest, T i) {
|
||||
while (i >= 0x80) {
|
||||
*dest++ = (static_cast<char>(i) & 0x7f) | 0x80;
|
||||
i >>= 7;
|
||||
}
|
||||
*dest++ = static_cast<char>(i);
|
||||
}
|
||||
|
||||
template<typename t_type>
|
||||
std::string get_varint_data(const t_type& v)
|
||||
{
|
||||
std::stringstream ss;
|
||||
write_varint(std::ostreambuf_iterator<char>(ss), v);
|
||||
return ss.str();
|
||||
}
|
||||
|
||||
template<int bits, typename InputIt, typename T>
|
||||
typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value && 0 <= bits && bits <= std::numeric_limits<T>::digits, int>::type
|
||||
read_varint(InputIt &&first, InputIt &&last, T &i) {
|
||||
int read = 0;
|
||||
i = 0;
|
||||
for (int shift = 0;; shift += 7) {
|
||||
if (first == last) {
|
||||
return read; // End of input.
|
||||
}
|
||||
unsigned char byte = *first++;
|
||||
++read;
|
||||
if (shift + 7 >= bits && byte >= 1 << (bits - shift)) {
|
||||
return -1; // Overflow.
|
||||
}
|
||||
if (byte == 0 && shift != 0) {
|
||||
return -2; // Non-canonical representation.
|
||||
}
|
||||
i |= static_cast<T>(byte & 0x7f) << shift;
|
||||
if ((byte & 0x80) == 0) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
return read;
|
||||
}
|
||||
|
||||
template<typename InputIt, typename T>
|
||||
int read_varint(InputIt &&first, InputIt &&last, T &i) {
|
||||
return read_varint<std::numeric_limits<T>::digits, InputIt, T>(std::move(first), std::move(last), i);
|
||||
}
|
||||
}
|
||||
5
crypto/compat/config/currency_config.h
Normal file
5
crypto/compat/config/currency_config.h
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub — minimal subset of generated currency_config.h.
|
||||
#pragma once
|
||||
|
||||
#define CURRENCY_TX_MAX_ALLOWED_INPUTS 256
|
||||
55
crypto/compat/currency_core/crypto_config.h
Executable file
55
crypto/compat/currency_core/crypto_config.h
Executable file
|
|
@ -0,0 +1,55 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
|
||||
// hash domain separation strings, 32 bytes long (31 chars + \0)
|
||||
//
|
||||
|
||||
#define CRYPTO_HDS_OUT_AMOUNT_MASK "ZANO_HDS_OUT_AMOUNT_MASK_______"
|
||||
#define CRYPTO_HDS_OUT_AMOUNT_BLINDING_MASK "ZANO_HDS_OUT_AMOUNT_BLIND_MASK_"
|
||||
#define CRYPTO_HDS_OUT_ASSET_BLINDING_MASK "ZANO_HDS_OUT_ASSET_BLIND_MASK__"
|
||||
#define CRYPTO_HDS_OUT_CONCEALING_POINT "ZANO_HDS_OUT_CONCEALING_POINT__"
|
||||
|
||||
#define CRYPTO_HDS_CLSAG_GG_LAYER_0 "ZANO_HDS_CLSAG_GG_LAYER_ZERO___"
|
||||
#define CRYPTO_HDS_CLSAG_GG_LAYER_1 "ZANO_HDS_CLSAG_GG_LAYER_ONE____"
|
||||
#define CRYPTO_HDS_CLSAG_GG_CHALLENGE "ZANO_HDS_CLSAG_GG_CHALLENGE____"
|
||||
|
||||
#define CRYPTO_HDS_CLSAG_GGX_LAYER_0 "ZANO_HDS_CLSAG_GGX_LAYER_ZERO__"
|
||||
#define CRYPTO_HDS_CLSAG_GGX_LAYER_1 "ZANO_HDS_CLSAG_GGX_LAYER_ONE___"
|
||||
#define CRYPTO_HDS_CLSAG_GGX_LAYER_2 "ZANO_HDS_CLSAG_GGX_LAYER_TWO___"
|
||||
#define CRYPTO_HDS_CLSAG_GGX_CHALLENGE "ZANO_HDS_CLSAG_GGX_CHALLENGE___"
|
||||
|
||||
#define CRYPTO_HDS_CLSAG_GGXG_LAYER_0 "ZANO_HDS_CLSAG_GGXG_LAYER_ZERO_"
|
||||
#define CRYPTO_HDS_CLSAG_GGXG_LAYER_1 "ZANO_HDS_CLSAG_GGXG_LAYER_ONE__"
|
||||
#define CRYPTO_HDS_CLSAG_GGXG_LAYER_2 "ZANO_HDS_CLSAG_GGXG_LAYER_TWO__"
|
||||
#define CRYPTO_HDS_CLSAG_GGXG_LAYER_3 "ZANO_HDS_CLSAG_GGXG_LAYER_THREE"
|
||||
#define CRYPTO_HDS_CLSAG_GGXG_CHALLENGE "ZANO_HDS_CLSAG_GGXG_CHALLENGE__"
|
||||
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_LAYER_0 "ZANO_HDS_CLSAG_GGXXG_LAYER_ZERO"
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_LAYER_1 "ZANO_HDS_CLSAG_GGXXG_LAYER_ONE_"
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_LAYER_2 "ZANO_HDS_CLSAG_GGXXG_LAYER_TWO_"
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_LAYER_3 "ZANO_HDS_CLSAG_GGXXG_LAYER_3___"
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_LAYER_4 "ZANO_HDS_CLSAG_GGXXG_LAYER_FOUR"
|
||||
#define CRYPTO_HDS_CLSAG_GGXXG_CHALLENGE "ZANO_HDS_CLSAG_GGXXG_CHALLENGE_"
|
||||
|
||||
#define CRYPTO_HDS_ZARCANUM_LAST_POW_HASH "ZANO_HDS_ZARCANUM_LAST_POW_HASH"
|
||||
#define CRYPTO_HDS_ZARCANUM_PROOF_HASH "ZANO_HDS_ZARCANUM_PROOF_HASH___"
|
||||
|
||||
#define CRYPTO_HDS_ASSET_CONTROL_KEY "ZANO_HDS_ASSET_CONTROL_KEY_____"
|
||||
#define CRYPTO_HDS_ASSET_CONTROL_ABM "ZANO_HDS_ASSET_CONTROL_ABM_____"
|
||||
#define CRYPTO_HDS_ASSET_ID "ZANO_HDS_ASSET_ID______________"
|
||||
#define CRYPTO_HDS_DETERMINISTIC_TX_KEY "ZANO_HDS_DETERMINISTIC_TX_KEY__"
|
||||
39
crypto/compat/epee/include/misc_log_ex.h
Normal file
39
crypto/compat/epee/include/misc_log_ex.h
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub for epee logging, exception handling, and misc macros.
|
||||
#pragma once
|
||||
|
||||
#include <cassert>
|
||||
#include <iostream>
|
||||
|
||||
#define ENDL std::endl
|
||||
|
||||
#define LOG_PRINT_RED(msg, level) ((void)0)
|
||||
#define LOG_PRINT_L0(msg) ((void)0)
|
||||
#define LOG_PRINT_L1(msg) ((void)0)
|
||||
#define LOG_PRINT_L2(msg) ((void)0)
|
||||
#define LOG_PRINT_L3(msg) ((void)0)
|
||||
#define LOG_PRINT_L4(msg) ((void)0)
|
||||
#define LOG_ERROR(msg) ((void)0)
|
||||
|
||||
#define CHECK_AND_ASSERT_MES(cond, ret, msg) \
|
||||
do { if (!(cond)) { return (ret); } } while(0)
|
||||
|
||||
#define CHECK_AND_ASSERT_MES_NO_RET(cond, msg) \
|
||||
do { if (!(cond)) { return; } } while(0)
|
||||
|
||||
#define CHECK_AND_NO_ASSERT_MES(cond, ret, msg) \
|
||||
do { if (!(cond)) { return (ret); } } while(0)
|
||||
|
||||
#define ASSERT_MES_AND_THROW(msg) do { assert(false && (msg)); } while(0)
|
||||
|
||||
// Exception handling macros (from misc_helpers.h)
|
||||
#define TRY_ENTRY() try {
|
||||
#define CATCH_ENTRY(location, return_val) } catch(...) { return (return_val); }
|
||||
#define CATCH_ENTRY2(return_val) } catch(...) { return (return_val); }
|
||||
#define CATCH_ENTRY_CUSTOM(location, custom_code, return_val) } catch(...) { custom_code; return (return_val); }
|
||||
#define CATCH_ENTRY_CUSTOM2(custom_code, return_val) } catch(...) { custom_code; return (return_val); }
|
||||
#define CATCH_ENTRY_L0(location, return_val) CATCH_ENTRY(location, return_val)
|
||||
#define CATCH_ENTRY_L1(location, return_val) CATCH_ENTRY(location, return_val)
|
||||
|
||||
// Location string helper
|
||||
#define LOCATION_SS ""
|
||||
7
crypto/compat/epee/include/profile_tools.h
Normal file
7
crypto/compat/epee/include/profile_tools.h
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub for epee profiling macros.
|
||||
#pragma once
|
||||
|
||||
#define TIME_MEASURE_START(x) ((void)0)
|
||||
#define TIME_MEASURE_FINISH(x) ((void)0)
|
||||
#define PROFILE_FUNC(x) ((void)0)
|
||||
3
crypto/compat/include_base_utils.h
Normal file
3
crypto/compat/include_base_utils.h
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub for include_base_utils.h
|
||||
#pragma once
|
||||
39
crypto/compat/warnings.h
Normal file
39
crypto/compat/warnings.h
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
// SPDX-Licence-Identifier: EUPL-1.2
|
||||
// Compat stub for CryptoNote warning macros.
|
||||
// Replaces contrib/epee/include/warnings.h without Boost dependency.
|
||||
// Uses a double-stringify trick to replicate BOOST_PP_STRINGIZE.
|
||||
#pragma once
|
||||
|
||||
#define _CN_STRINGIFY_INNER(x) #x
|
||||
#define _CN_STRINGIFY(x) _CN_STRINGIFY_INNER(x)
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#define PUSH_VS_WARNINGS __pragma(warning(push))
|
||||
#define POP_VS_WARNINGS __pragma(warning(pop))
|
||||
#define DISABLE_VS_WARNINGS(w) __pragma(warning(disable: w))
|
||||
#define PUSH_GCC_WARNINGS
|
||||
#define POP_GCC_WARNINGS
|
||||
#define DISABLE_GCC_WARNING(w)
|
||||
#define DISABLE_CLANG_WARNING(w)
|
||||
#define DISABLE_GCC_AND_CLANG_WARNING(w)
|
||||
#define ATTRIBUTE_UNUSED
|
||||
#else
|
||||
#define PUSH_VS_WARNINGS
|
||||
#define POP_VS_WARNINGS
|
||||
#define DISABLE_VS_WARNINGS(w)
|
||||
#define PUSH_GCC_WARNINGS _Pragma("GCC diagnostic push")
|
||||
#define POP_GCC_WARNINGS _Pragma("GCC diagnostic pop")
|
||||
#define ATTRIBUTE_UNUSED __attribute__((unused))
|
||||
|
||||
#define DISABLE_GCC_AND_CLANG_WARNING(w) \
|
||||
_Pragma(_CN_STRINGIFY(GCC diagnostic ignored _CN_STRINGIFY(-W##w)))
|
||||
|
||||
#if defined(__clang__)
|
||||
#define DISABLE_GCC_WARNING(w)
|
||||
#define DISABLE_CLANG_WARNING DISABLE_GCC_AND_CLANG_WARNING
|
||||
#else
|
||||
#define DISABLE_GCC_WARNING DISABLE_GCC_AND_CLANG_WARNING
|
||||
#define DISABLE_CLANG_WARNING(w)
|
||||
#endif
|
||||
|
||||
#endif
|
||||
1
crypto/currency_core/crypto_config.h
Symbolic link
1
crypto/currency_core/crypto_config.h
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../compat/currency_core/crypto_config.h
|
||||
269
crypto/upstream/RIPEMD160.c
Executable file
269
crypto/upstream/RIPEMD160.c
Executable file
|
|
@ -0,0 +1,269 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
/* header files */
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "RIPEMD160.h"
|
||||
|
||||
/********************************************************************/
|
||||
|
||||
void MDinit(dword *MDbuf)
|
||||
{
|
||||
MDbuf[0] = 0x67452301UL;
|
||||
MDbuf[1] = 0xefcdab89UL;
|
||||
MDbuf[2] = 0x98badcfeUL;
|
||||
MDbuf[3] = 0x10325476UL;
|
||||
MDbuf[4] = 0xc3d2e1f0UL;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/********************************************************************/
|
||||
|
||||
void compress(dword *MDbuf, dword *X)
|
||||
{
|
||||
dword aa = MDbuf[0], bb = MDbuf[1], cc = MDbuf[2],
|
||||
dd = MDbuf[3], ee = MDbuf[4];
|
||||
dword aaa = MDbuf[0], bbb = MDbuf[1], ccc = MDbuf[2],
|
||||
ddd = MDbuf[3], eee = MDbuf[4];
|
||||
|
||||
/* round 1 */
|
||||
FF(aa, bb, cc, dd, ee, X[0], 11);
|
||||
FF(ee, aa, bb, cc, dd, X[1], 14);
|
||||
FF(dd, ee, aa, bb, cc, X[2], 15);
|
||||
FF(cc, dd, ee, aa, bb, X[3], 12);
|
||||
FF(bb, cc, dd, ee, aa, X[4], 5);
|
||||
FF(aa, bb, cc, dd, ee, X[5], 8);
|
||||
FF(ee, aa, bb, cc, dd, X[6], 7);
|
||||
FF(dd, ee, aa, bb, cc, X[7], 9);
|
||||
FF(cc, dd, ee, aa, bb, X[8], 11);
|
||||
FF(bb, cc, dd, ee, aa, X[9], 13);
|
||||
FF(aa, bb, cc, dd, ee, X[10], 14);
|
||||
FF(ee, aa, bb, cc, dd, X[11], 15);
|
||||
FF(dd, ee, aa, bb, cc, X[12], 6);
|
||||
FF(cc, dd, ee, aa, bb, X[13], 7);
|
||||
FF(bb, cc, dd, ee, aa, X[14], 9);
|
||||
FF(aa, bb, cc, dd, ee, X[15], 8);
|
||||
|
||||
/* round 2 */
|
||||
GG(ee, aa, bb, cc, dd, X[7], 7);
|
||||
GG(dd, ee, aa, bb, cc, X[4], 6);
|
||||
GG(cc, dd, ee, aa, bb, X[13], 8);
|
||||
GG(bb, cc, dd, ee, aa, X[1], 13);
|
||||
GG(aa, bb, cc, dd, ee, X[10], 11);
|
||||
GG(ee, aa, bb, cc, dd, X[6], 9);
|
||||
GG(dd, ee, aa, bb, cc, X[15], 7);
|
||||
GG(cc, dd, ee, aa, bb, X[3], 15);
|
||||
GG(bb, cc, dd, ee, aa, X[12], 7);
|
||||
GG(aa, bb, cc, dd, ee, X[0], 12);
|
||||
GG(ee, aa, bb, cc, dd, X[9], 15);
|
||||
GG(dd, ee, aa, bb, cc, X[5], 9);
|
||||
GG(cc, dd, ee, aa, bb, X[2], 11);
|
||||
GG(bb, cc, dd, ee, aa, X[14], 7);
|
||||
GG(aa, bb, cc, dd, ee, X[11], 13);
|
||||
GG(ee, aa, bb, cc, dd, X[8], 12);
|
||||
|
||||
/* round 3 */
|
||||
HH(dd, ee, aa, bb, cc, X[3], 11);
|
||||
HH(cc, dd, ee, aa, bb, X[10], 13);
|
||||
HH(bb, cc, dd, ee, aa, X[14], 6);
|
||||
HH(aa, bb, cc, dd, ee, X[4], 7);
|
||||
HH(ee, aa, bb, cc, dd, X[9], 14);
|
||||
HH(dd, ee, aa, bb, cc, X[15], 9);
|
||||
HH(cc, dd, ee, aa, bb, X[8], 13);
|
||||
HH(bb, cc, dd, ee, aa, X[1], 15);
|
||||
HH(aa, bb, cc, dd, ee, X[2], 14);
|
||||
HH(ee, aa, bb, cc, dd, X[7], 8);
|
||||
HH(dd, ee, aa, bb, cc, X[0], 13);
|
||||
HH(cc, dd, ee, aa, bb, X[6], 6);
|
||||
HH(bb, cc, dd, ee, aa, X[13], 5);
|
||||
HH(aa, bb, cc, dd, ee, X[11], 12);
|
||||
HH(ee, aa, bb, cc, dd, X[5], 7);
|
||||
HH(dd, ee, aa, bb, cc, X[12], 5);
|
||||
|
||||
/* round 4 */
|
||||
II(cc, dd, ee, aa, bb, X[1], 11);
|
||||
II(bb, cc, dd, ee, aa, X[9], 12);
|
||||
II(aa, bb, cc, dd, ee, X[11], 14);
|
||||
II(ee, aa, bb, cc, dd, X[10], 15);
|
||||
II(dd, ee, aa, bb, cc, X[0], 14);
|
||||
II(cc, dd, ee, aa, bb, X[8], 15);
|
||||
II(bb, cc, dd, ee, aa, X[12], 9);
|
||||
II(aa, bb, cc, dd, ee, X[4], 8);
|
||||
II(ee, aa, bb, cc, dd, X[13], 9);
|
||||
II(dd, ee, aa, bb, cc, X[3], 14);
|
||||
II(cc, dd, ee, aa, bb, X[7], 5);
|
||||
II(bb, cc, dd, ee, aa, X[15], 6);
|
||||
II(aa, bb, cc, dd, ee, X[14], 8);
|
||||
II(ee, aa, bb, cc, dd, X[5], 6);
|
||||
II(dd, ee, aa, bb, cc, X[6], 5);
|
||||
II(cc, dd, ee, aa, bb, X[2], 12);
|
||||
|
||||
/* round 5 */
|
||||
JJ(bb, cc, dd, ee, aa, X[4], 9);
|
||||
JJ(aa, bb, cc, dd, ee, X[0], 15);
|
||||
JJ(ee, aa, bb, cc, dd, X[5], 5);
|
||||
JJ(dd, ee, aa, bb, cc, X[9], 11);
|
||||
JJ(cc, dd, ee, aa, bb, X[7], 6);
|
||||
JJ(bb, cc, dd, ee, aa, X[12], 8);
|
||||
JJ(aa, bb, cc, dd, ee, X[2], 13);
|
||||
JJ(ee, aa, bb, cc, dd, X[10], 12);
|
||||
JJ(dd, ee, aa, bb, cc, X[14], 5);
|
||||
JJ(cc, dd, ee, aa, bb, X[1], 12);
|
||||
JJ(bb, cc, dd, ee, aa, X[3], 13);
|
||||
JJ(aa, bb, cc, dd, ee, X[8], 14);
|
||||
JJ(ee, aa, bb, cc, dd, X[11], 11);
|
||||
JJ(dd, ee, aa, bb, cc, X[6], 8);
|
||||
JJ(cc, dd, ee, aa, bb, X[15], 5);
|
||||
JJ(bb, cc, dd, ee, aa, X[13], 6);
|
||||
|
||||
/* parallel round 1 */
|
||||
JJJ(aaa, bbb, ccc, ddd, eee, X[5], 8);
|
||||
JJJ(eee, aaa, bbb, ccc, ddd, X[14], 9);
|
||||
JJJ(ddd, eee, aaa, bbb, ccc, X[7], 9);
|
||||
JJJ(ccc, ddd, eee, aaa, bbb, X[0], 11);
|
||||
JJJ(bbb, ccc, ddd, eee, aaa, X[9], 13);
|
||||
JJJ(aaa, bbb, ccc, ddd, eee, X[2], 15);
|
||||
JJJ(eee, aaa, bbb, ccc, ddd, X[11], 15);
|
||||
JJJ(ddd, eee, aaa, bbb, ccc, X[4], 5);
|
||||
JJJ(ccc, ddd, eee, aaa, bbb, X[13], 7);
|
||||
JJJ(bbb, ccc, ddd, eee, aaa, X[6], 7);
|
||||
JJJ(aaa, bbb, ccc, ddd, eee, X[15], 8);
|
||||
JJJ(eee, aaa, bbb, ccc, ddd, X[8], 11);
|
||||
JJJ(ddd, eee, aaa, bbb, ccc, X[1], 14);
|
||||
JJJ(ccc, ddd, eee, aaa, bbb, X[10], 14);
|
||||
JJJ(bbb, ccc, ddd, eee, aaa, X[3], 12);
|
||||
JJJ(aaa, bbb, ccc, ddd, eee, X[12], 6);
|
||||
|
||||
/* parallel round 2 */
|
||||
III(eee, aaa, bbb, ccc, ddd, X[6], 9);
|
||||
III(ddd, eee, aaa, bbb, ccc, X[11], 13);
|
||||
III(ccc, ddd, eee, aaa, bbb, X[3], 15);
|
||||
III(bbb, ccc, ddd, eee, aaa, X[7], 7);
|
||||
III(aaa, bbb, ccc, ddd, eee, X[0], 12);
|
||||
III(eee, aaa, bbb, ccc, ddd, X[13], 8);
|
||||
III(ddd, eee, aaa, bbb, ccc, X[5], 9);
|
||||
III(ccc, ddd, eee, aaa, bbb, X[10], 11);
|
||||
III(bbb, ccc, ddd, eee, aaa, X[14], 7);
|
||||
III(aaa, bbb, ccc, ddd, eee, X[15], 7);
|
||||
III(eee, aaa, bbb, ccc, ddd, X[8], 12);
|
||||
III(ddd, eee, aaa, bbb, ccc, X[12], 7);
|
||||
III(ccc, ddd, eee, aaa, bbb, X[4], 6);
|
||||
III(bbb, ccc, ddd, eee, aaa, X[9], 15);
|
||||
III(aaa, bbb, ccc, ddd, eee, X[1], 13);
|
||||
III(eee, aaa, bbb, ccc, ddd, X[2], 11);
|
||||
|
||||
/* parallel round 3 */
|
||||
HHH(ddd, eee, aaa, bbb, ccc, X[15], 9);
|
||||
HHH(ccc, ddd, eee, aaa, bbb, X[5], 7);
|
||||
HHH(bbb, ccc, ddd, eee, aaa, X[1], 15);
|
||||
HHH(aaa, bbb, ccc, ddd, eee, X[3], 11);
|
||||
HHH(eee, aaa, bbb, ccc, ddd, X[7], 8);
|
||||
HHH(ddd, eee, aaa, bbb, ccc, X[14], 6);
|
||||
HHH(ccc, ddd, eee, aaa, bbb, X[6], 6);
|
||||
HHH(bbb, ccc, ddd, eee, aaa, X[9], 14);
|
||||
HHH(aaa, bbb, ccc, ddd, eee, X[11], 12);
|
||||
HHH(eee, aaa, bbb, ccc, ddd, X[8], 13);
|
||||
HHH(ddd, eee, aaa, bbb, ccc, X[12], 5);
|
||||
HHH(ccc, ddd, eee, aaa, bbb, X[2], 14);
|
||||
HHH(bbb, ccc, ddd, eee, aaa, X[10], 13);
|
||||
HHH(aaa, bbb, ccc, ddd, eee, X[0], 13);
|
||||
HHH(eee, aaa, bbb, ccc, ddd, X[4], 7);
|
||||
HHH(ddd, eee, aaa, bbb, ccc, X[13], 5);
|
||||
|
||||
/* parallel round 4 */
|
||||
GGG(ccc, ddd, eee, aaa, bbb, X[8], 15);
|
||||
GGG(bbb, ccc, ddd, eee, aaa, X[6], 5);
|
||||
GGG(aaa, bbb, ccc, ddd, eee, X[4], 8);
|
||||
GGG(eee, aaa, bbb, ccc, ddd, X[1], 11);
|
||||
GGG(ddd, eee, aaa, bbb, ccc, X[3], 14);
|
||||
GGG(ccc, ddd, eee, aaa, bbb, X[11], 14);
|
||||
GGG(bbb, ccc, ddd, eee, aaa, X[15], 6);
|
||||
GGG(aaa, bbb, ccc, ddd, eee, X[0], 14);
|
||||
GGG(eee, aaa, bbb, ccc, ddd, X[5], 6);
|
||||
GGG(ddd, eee, aaa, bbb, ccc, X[12], 9);
|
||||
GGG(ccc, ddd, eee, aaa, bbb, X[2], 12);
|
||||
GGG(bbb, ccc, ddd, eee, aaa, X[13], 9);
|
||||
GGG(aaa, bbb, ccc, ddd, eee, X[9], 12);
|
||||
GGG(eee, aaa, bbb, ccc, ddd, X[7], 5);
|
||||
GGG(ddd, eee, aaa, bbb, ccc, X[10], 15);
|
||||
GGG(ccc, ddd, eee, aaa, bbb, X[14], 8);
|
||||
|
||||
/* parallel round 5 */
|
||||
FFF(bbb, ccc, ddd, eee, aaa, X[12], 8);
|
||||
FFF(aaa, bbb, ccc, ddd, eee, X[15], 5);
|
||||
FFF(eee, aaa, bbb, ccc, ddd, X[10], 12);
|
||||
FFF(ddd, eee, aaa, bbb, ccc, X[4], 9);
|
||||
FFF(ccc, ddd, eee, aaa, bbb, X[1], 12);
|
||||
FFF(bbb, ccc, ddd, eee, aaa, X[5], 5);
|
||||
FFF(aaa, bbb, ccc, ddd, eee, X[8], 14);
|
||||
FFF(eee, aaa, bbb, ccc, ddd, X[7], 6);
|
||||
FFF(ddd, eee, aaa, bbb, ccc, X[6], 8);
|
||||
FFF(ccc, ddd, eee, aaa, bbb, X[2], 13);
|
||||
FFF(bbb, ccc, ddd, eee, aaa, X[13], 6);
|
||||
FFF(aaa, bbb, ccc, ddd, eee, X[14], 5);
|
||||
FFF(eee, aaa, bbb, ccc, ddd, X[0], 15);
|
||||
FFF(ddd, eee, aaa, bbb, ccc, X[3], 13);
|
||||
FFF(ccc, ddd, eee, aaa, bbb, X[9], 11);
|
||||
FFF(bbb, ccc, ddd, eee, aaa, X[11], 11);
|
||||
|
||||
/* combine results */
|
||||
ddd += cc + MDbuf[1]; /* final result for MDbuf[0] */
|
||||
MDbuf[1] = MDbuf[2] + dd + eee;
|
||||
MDbuf[2] = MDbuf[3] + ee + aaa;
|
||||
MDbuf[3] = MDbuf[4] + aa + bbb;
|
||||
MDbuf[4] = MDbuf[0] + bb + ccc;
|
||||
MDbuf[0] = ddd;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/********************************************************************/
|
||||
|
||||
void MDfinish(dword *MDbuf, byte *strptr, dword lswlen, dword mswlen)
|
||||
{
|
||||
unsigned int i; /* counter */
|
||||
dword X[16]; /* message words */
|
||||
|
||||
memset(X, 0, 16 * sizeof(dword));
|
||||
|
||||
/* put bytes from strptr into X */
|
||||
for (i = 0; i<(lswlen & 63); i++) {
|
||||
/* byte i goes into word X[i div 4] at pos. 8*(i mod 4) */
|
||||
X[i >> 2] ^= (dword)*strptr++ << (8 * (i & 3));
|
||||
}
|
||||
|
||||
/* append the bit m_n == 1 */
|
||||
X[(lswlen >> 2) & 15] ^= (dword)1 << (8 * (lswlen & 3) + 7);
|
||||
|
||||
if ((lswlen & 63) > 55) {
|
||||
/* length goes to next block */
|
||||
compress(MDbuf, X);
|
||||
memset(X, 0, 16 * sizeof(dword));
|
||||
}
|
||||
|
||||
/* append length in bits*/
|
||||
X[14] = lswlen << 3;
|
||||
X[15] = (lswlen >> 29) | (mswlen << 3);
|
||||
compress(MDbuf, X);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/************************ end of file rmd160.c **********************/
|
||||
132
crypto/upstream/RIPEMD160.h
Executable file
132
crypto/upstream/RIPEMD160.h
Executable file
|
|
@ -0,0 +1,132 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#ifndef RMD160H /* make sure this file is read only once */
|
||||
#define RMD160H
|
||||
|
||||
/********************************************************************/
|
||||
#include <stdint.h>
|
||||
/* typedef 8 and 32 bit types, resp. */
|
||||
/* adapt these, if necessary,
|
||||
for your operating system and compiler */
|
||||
typedef unsigned char byte;
|
||||
typedef uint32_t dword;
|
||||
|
||||
/* if this line causes a compiler error,
|
||||
adapt the defintion of dword above */
|
||||
typedef int the_correct_size_was_chosen[sizeof(dword) == 4 ? 1 : -1];
|
||||
|
||||
/********************************************************************/
|
||||
|
||||
/* macro definitions */
|
||||
|
||||
/* collect four bytes into one word: */
|
||||
#define BYTES_TO_DWORD(strptr) \
|
||||
(((dword) *((strptr)+3) << 24) | \
|
||||
((dword) *((strptr)+2) << 16) | \
|
||||
((dword) *((strptr)+1) << 8) | \
|
||||
((dword) *(strptr)))
|
||||
|
||||
/* ROL(x, n) cyclically rotates x over n bits to the left */
|
||||
/* x must be of an unsigned 32 bits type and 0 <= n < 32. */
|
||||
#define ROL(x, n) (((x) << (n)) | ((x) >> (32-(n))))
|
||||
|
||||
/* the five basic functions F(), G() and H() */
|
||||
#define F(x, y, z) ((x) ^ (y) ^ (z))
|
||||
#define G(x, y, z) (((x) & (y)) | (~(x) & (z)))
|
||||
#define H(x, y, z) (((x) | ~(y)) ^ (z))
|
||||
#define I(x, y, z) (((x) & (z)) | ((y) & ~(z)))
|
||||
#define J(x, y, z) ((x) ^ ((y) | ~(z)))
|
||||
|
||||
/* the ten basic operations FF() through III() */
|
||||
#define FF(a, b, c, d, e, x, s) {\
|
||||
(a) += F((b), (c), (d)) + (x);\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define GG(a, b, c, d, e, x, s) {\
|
||||
(a) += G((b), (c), (d)) + (x) + 0x5a827999UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define HH(a, b, c, d, e, x, s) {\
|
||||
(a) += H((b), (c), (d)) + (x) + 0x6ed9eba1UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define II(a, b, c, d, e, x, s) {\
|
||||
(a) += I((b), (c), (d)) + (x) + 0x8f1bbcdcUL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define JJ(a, b, c, d, e, x, s) {\
|
||||
(a) += J((b), (c), (d)) + (x) + 0xa953fd4eUL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define FFF(a, b, c, d, e, x, s) {\
|
||||
(a) += F((b), (c), (d)) + (x);\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define GGG(a, b, c, d, e, x, s) {\
|
||||
(a) += G((b), (c), (d)) + (x) + 0x7a6d76e9UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define HHH(a, b, c, d, e, x, s) {\
|
||||
(a) += H((b), (c), (d)) + (x) + 0x6d703ef3UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define III(a, b, c, d, e, x, s) {\
|
||||
(a) += I((b), (c), (d)) + (x) + 0x5c4dd124UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
#define JJJ(a, b, c, d, e, x, s) {\
|
||||
(a) += J((b), (c), (d)) + (x) + 0x50a28be6UL;\
|
||||
(a) = ROL((a), (s)) + (e);\
|
||||
(c) = ROL((c), 10);\
|
||||
}
|
||||
|
||||
/********************************************************************/
|
||||
|
||||
/* function prototypes */
|
||||
|
||||
void MDinit(dword *MDbuf);
|
||||
/*
|
||||
* initializes MDbuffer to "magic constants"
|
||||
*/
|
||||
|
||||
void compress(dword *MDbuf, dword *X);
|
||||
/*
|
||||
* the compression function.
|
||||
* transforms MDbuf using message bytes X[0] through X[15]
|
||||
*/
|
||||
|
||||
void MDfinish(dword *MDbuf, byte *strptr, dword lswlen, dword mswlen);
|
||||
/*
|
||||
* puts bytes from strptr into X and pad out; appends length
|
||||
* and finally, compresses the last block(s)
|
||||
* note: length in bits == 8 * (lswlen + 2^32 mswlen).
|
||||
* note: there are (lswlen mod 64) bytes left in strptr.
|
||||
*/
|
||||
|
||||
#endif /* RMD160H */
|
||||
|
||||
/*********************** end of file rmd160.h ***********************/
|
||||
77
crypto/upstream/RIPEMD160_helper.cpp
Executable file
77
crypto/upstream/RIPEMD160_helper.cpp
Executable file
|
|
@ -0,0 +1,77 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "RIPEMD160_helper.h"
|
||||
#include "auto_val_init.h"
|
||||
extern "C" {
|
||||
#include "RIPEMD160.h"
|
||||
}
|
||||
|
||||
#define RMDsize 160
|
||||
|
||||
namespace crypto {
|
||||
|
||||
void RIPEMD160_hash(const void *data, size_t length_size_t, hash160 &h)
|
||||
{
|
||||
|
||||
dword MDbuf[RMDsize / 32] = {0}; /* contains (A, B, C, D(, E)) */
|
||||
byte* hashcode = (byte*)&h; /* hashcode[RMDsize / 8]; for final hash-value */
|
||||
dword X[16] = {0}; /* current 16-word chunk */
|
||||
unsigned int i = 0; /* counter */
|
||||
dword length = static_cast<dword>(length_size_t); /* length in bytes of message */
|
||||
dword nbytes = 0; /* # of bytes not yet processed */
|
||||
byte* message = (byte*)data;
|
||||
|
||||
/* initialize */
|
||||
MDinit(MDbuf);
|
||||
//length = (dword)strlen((char *)message);
|
||||
|
||||
/* process message in 16-word chunks */
|
||||
for (nbytes = length; nbytes > 63; nbytes -= 64) {
|
||||
for (i = 0; i < 16; i++) {
|
||||
X[i] = BYTES_TO_DWORD(message);
|
||||
message += 4;
|
||||
}
|
||||
compress(MDbuf, X);
|
||||
}/* length mod 64 bytes left */
|
||||
|
||||
/* finish: */
|
||||
MDfinish(MDbuf, message, length, 0);
|
||||
|
||||
for (i = 0; i < RMDsize / 8; i += 4) {
|
||||
hashcode[i] = (byte)MDbuf[i >> 2]; /* implicit cast to byte */
|
||||
hashcode[i + 1] = (byte)(MDbuf[i >> 2] >> 8); /* extracts the 8 least */
|
||||
hashcode[i + 2] = (byte)(MDbuf[i >> 2] >> 16); /* significant bits. */
|
||||
hashcode[i + 3] = (byte)(MDbuf[i >> 2] >> 24);
|
||||
}
|
||||
}
|
||||
|
||||
hash160 RIPEMD160_hash(const void *data, size_t length)
|
||||
{
|
||||
hash160 h = AUTO_VAL_INIT(h);
|
||||
RIPEMD160_hash(data, length, h);
|
||||
return h;
|
||||
}
|
||||
|
||||
hash RIPEMD160_hash_256(const void *data, size_t length)
|
||||
{
|
||||
hash160 h = RIPEMD160_hash(data, length);
|
||||
hash h256 = AUTO_VAL_INIT(h256);
|
||||
memcpy(&h256, &h, sizeof(h));
|
||||
return h256;
|
||||
}
|
||||
|
||||
}
|
||||
40
crypto/upstream/RIPEMD160_helper.h
Executable file
40
crypto/upstream/RIPEMD160_helper.h
Executable file
|
|
@ -0,0 +1,40 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "hash.h"
|
||||
|
||||
|
||||
namespace crypto {
|
||||
|
||||
#pragma pack(push, 1)
|
||||
POD_CLASS hash160{
|
||||
char data[20];
|
||||
};
|
||||
#pragma pack(pop)
|
||||
|
||||
void RIPEMD160_hash(const void *data, size_t length, hash160 &h);
|
||||
hash160 RIPEMD160_hash(const void *data, size_t length);
|
||||
hash RIPEMD160_hash_256(const void *data, size_t length);
|
||||
|
||||
}
|
||||
|
||||
POD_MAKE_HASHABLE(crypto, hash160)
|
||||
|
||||
|
||||
|
||||
162
crypto/upstream/blake2-impl.h
Executable file
162
crypto/upstream/blake2-impl.h
Executable file
|
|
@ -0,0 +1,162 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#ifndef BLAKE2_IMPL_H
|
||||
#define BLAKE2_IMPL_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#if !defined(__cplusplus) && (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L)
|
||||
#if defined(_MSC_VER)
|
||||
#define BLAKE2_INLINE __inline
|
||||
#elif defined(__GNUC__)
|
||||
#define BLAKE2_INLINE __inline__
|
||||
#else
|
||||
#define BLAKE2_INLINE
|
||||
#endif
|
||||
#else
|
||||
#define BLAKE2_INLINE inline
|
||||
#endif
|
||||
|
||||
static BLAKE2_INLINE uint32_t load32( const void *src )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
uint32_t w;
|
||||
memcpy(&w, src, sizeof w);
|
||||
return w;
|
||||
#else
|
||||
const uint8_t *p = ( const uint8_t * )src;
|
||||
return (( uint32_t )( p[0] ) << 0) |
|
||||
(( uint32_t )( p[1] ) << 8) |
|
||||
(( uint32_t )( p[2] ) << 16) |
|
||||
(( uint32_t )( p[3] ) << 24) ;
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE uint64_t load64( const void *src )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
uint64_t w;
|
||||
memcpy(&w, src, sizeof w);
|
||||
return w;
|
||||
#else
|
||||
const uint8_t *p = ( const uint8_t * )src;
|
||||
return (( uint64_t )( p[0] ) << 0) |
|
||||
(( uint64_t )( p[1] ) << 8) |
|
||||
(( uint64_t )( p[2] ) << 16) |
|
||||
(( uint64_t )( p[3] ) << 24) |
|
||||
(( uint64_t )( p[4] ) << 32) |
|
||||
(( uint64_t )( p[5] ) << 40) |
|
||||
(( uint64_t )( p[6] ) << 48) |
|
||||
(( uint64_t )( p[7] ) << 56) ;
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE uint16_t load16( const void *src )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
uint16_t w;
|
||||
memcpy(&w, src, sizeof w);
|
||||
return w;
|
||||
#else
|
||||
const uint8_t *p = ( const uint8_t * )src;
|
||||
return ( uint16_t )((( uint32_t )( p[0] ) << 0) |
|
||||
(( uint32_t )( p[1] ) << 8));
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE void store16( void *dst, uint16_t w )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
memcpy(dst, &w, sizeof w);
|
||||
#else
|
||||
uint8_t *p = ( uint8_t * )dst;
|
||||
*p++ = ( uint8_t )w; w >>= 8;
|
||||
*p++ = ( uint8_t )w;
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE void store32( void *dst, uint32_t w )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
memcpy(dst, &w, sizeof w);
|
||||
#else
|
||||
uint8_t *p = ( uint8_t * )dst;
|
||||
p[0] = (uint8_t)(w >> 0);
|
||||
p[1] = (uint8_t)(w >> 8);
|
||||
p[2] = (uint8_t)(w >> 16);
|
||||
p[3] = (uint8_t)(w >> 24);
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE void store64( void *dst, uint64_t w )
|
||||
{
|
||||
#if defined(NATIVE_LITTLE_ENDIAN)
|
||||
memcpy(dst, &w, sizeof w);
|
||||
#else
|
||||
uint8_t *p = ( uint8_t * )dst;
|
||||
p[0] = (uint8_t)(w >> 0);
|
||||
p[1] = (uint8_t)(w >> 8);
|
||||
p[2] = (uint8_t)(w >> 16);
|
||||
p[3] = (uint8_t)(w >> 24);
|
||||
p[4] = (uint8_t)(w >> 32);
|
||||
p[5] = (uint8_t)(w >> 40);
|
||||
p[6] = (uint8_t)(w >> 48);
|
||||
p[7] = (uint8_t)(w >> 56);
|
||||
#endif
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE uint64_t load48( const void *src )
|
||||
{
|
||||
const uint8_t *p = ( const uint8_t * )src;
|
||||
return (( uint64_t )( p[0] ) << 0) |
|
||||
(( uint64_t )( p[1] ) << 8) |
|
||||
(( uint64_t )( p[2] ) << 16) |
|
||||
(( uint64_t )( p[3] ) << 24) |
|
||||
(( uint64_t )( p[4] ) << 32) |
|
||||
(( uint64_t )( p[5] ) << 40) ;
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE void store48( void *dst, uint64_t w )
|
||||
{
|
||||
uint8_t *p = ( uint8_t * )dst;
|
||||
p[0] = (uint8_t)(w >> 0);
|
||||
p[1] = (uint8_t)(w >> 8);
|
||||
p[2] = (uint8_t)(w >> 16);
|
||||
p[3] = (uint8_t)(w >> 24);
|
||||
p[4] = (uint8_t)(w >> 32);
|
||||
p[5] = (uint8_t)(w >> 40);
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE uint32_t rotr32( const uint32_t w, const unsigned c )
|
||||
{
|
||||
return ( w >> c ) | ( w << ( 32 - c ) );
|
||||
}
|
||||
|
||||
static BLAKE2_INLINE uint64_t rotr64( const uint64_t w, const unsigned c )
|
||||
{
|
||||
return ( w >> c ) | ( w << ( 64 - c ) );
|
||||
}
|
||||
|
||||
/* prevents compiler optimizing out memset() */
|
||||
static BLAKE2_INLINE void secure_zero_memory(void *v, size_t n)
|
||||
{
|
||||
static void *(*const volatile memset_v)(void *, int, size_t) = &memset;
|
||||
memset_v(v, 0, n);
|
||||
}
|
||||
|
||||
#endif
|
||||
202
crypto/upstream/blake2.h
Executable file
202
crypto/upstream/blake2.h
Executable file
|
|
@ -0,0 +1,202 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#ifndef BLAKE2_H
|
||||
#define BLAKE2_H
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#if defined(_MSC_VER)
|
||||
#define BLAKE2_PACKED(x) __pragma(pack(push, 1)) x __pragma(pack(pop))
|
||||
#else
|
||||
#define BLAKE2_PACKED(x) x __attribute__((packed))
|
||||
#endif
|
||||
|
||||
#if defined(__cplusplus)
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
enum blake2s_constant
|
||||
{
|
||||
BLAKE2S_BLOCKBYTES = 64,
|
||||
BLAKE2S_OUTBYTES = 32,
|
||||
BLAKE2S_KEYBYTES = 32,
|
||||
BLAKE2S_SALTBYTES = 8,
|
||||
BLAKE2S_PERSONALBYTES = 8
|
||||
};
|
||||
|
||||
enum blake2b_constant
|
||||
{
|
||||
BLAKE2B_BLOCKBYTES = 128,
|
||||
BLAKE2B_OUTBYTES = 64,
|
||||
BLAKE2B_KEYBYTES = 64,
|
||||
BLAKE2B_SALTBYTES = 16,
|
||||
BLAKE2B_PERSONALBYTES = 16
|
||||
};
|
||||
|
||||
typedef struct blake2s_state__
|
||||
{
|
||||
uint32_t h[8];
|
||||
uint32_t t[2];
|
||||
uint32_t f[2];
|
||||
uint8_t buf[BLAKE2S_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
uint8_t last_node;
|
||||
} blake2s_state;
|
||||
|
||||
typedef struct blake2b_state__
|
||||
{
|
||||
uint64_t h[8];
|
||||
uint64_t t[2];
|
||||
uint64_t f[2];
|
||||
uint8_t buf[BLAKE2B_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
uint8_t last_node;
|
||||
} blake2b_state;
|
||||
|
||||
typedef struct blake2sp_state__
|
||||
{
|
||||
blake2s_state S[8][1];
|
||||
blake2s_state R[1];
|
||||
uint8_t buf[8 * BLAKE2S_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
} blake2sp_state;
|
||||
|
||||
typedef struct blake2bp_state__
|
||||
{
|
||||
blake2b_state S[4][1];
|
||||
blake2b_state R[1];
|
||||
uint8_t buf[4 * BLAKE2B_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
} blake2bp_state;
|
||||
|
||||
|
||||
BLAKE2_PACKED(struct blake2s_param__
|
||||
{
|
||||
uint8_t digest_length; /* 1 */
|
||||
uint8_t key_length; /* 2 */
|
||||
uint8_t fanout; /* 3 */
|
||||
uint8_t depth; /* 4 */
|
||||
uint32_t leaf_length; /* 8 */
|
||||
uint32_t node_offset; /* 12 */
|
||||
uint16_t xof_length; /* 14 */
|
||||
uint8_t node_depth; /* 15 */
|
||||
uint8_t inner_length; /* 16 */
|
||||
/* uint8_t reserved[0]; */
|
||||
uint8_t salt[BLAKE2S_SALTBYTES]; /* 24 */
|
||||
uint8_t personal[BLAKE2S_PERSONALBYTES]; /* 32 */
|
||||
});
|
||||
|
||||
typedef struct blake2s_param__ blake2s_param;
|
||||
|
||||
BLAKE2_PACKED(struct blake2b_param__
|
||||
{
|
||||
uint8_t digest_length; /* 1 */
|
||||
uint8_t key_length; /* 2 */
|
||||
uint8_t fanout; /* 3 */
|
||||
uint8_t depth; /* 4 */
|
||||
uint32_t leaf_length; /* 8 */
|
||||
uint32_t node_offset; /* 12 */
|
||||
uint32_t xof_length; /* 16 */
|
||||
uint8_t node_depth; /* 17 */
|
||||
uint8_t inner_length; /* 18 */
|
||||
uint8_t reserved[14]; /* 32 */
|
||||
uint8_t salt[BLAKE2B_SALTBYTES]; /* 48 */
|
||||
uint8_t personal[BLAKE2B_PERSONALBYTES]; /* 64 */
|
||||
});
|
||||
|
||||
typedef struct blake2b_param__ blake2b_param;
|
||||
|
||||
typedef struct blake2xs_state__
|
||||
{
|
||||
blake2s_state S[1];
|
||||
blake2s_param P[1];
|
||||
} blake2xs_state;
|
||||
|
||||
typedef struct blake2xb_state__
|
||||
{
|
||||
blake2b_state S[1];
|
||||
blake2b_param P[1];
|
||||
} blake2xb_state;
|
||||
|
||||
|
||||
/* Padded structs result in a compile-time error */
|
||||
|
||||
enum {
|
||||
BLAKE2_DUMMY_1 = 1/(sizeof(blake2s_param) == BLAKE2S_OUTBYTES),
|
||||
BLAKE2_DUMMY_2 = 1/(sizeof(blake2b_param) == BLAKE2B_OUTBYTES)
|
||||
};
|
||||
// static_assert(sizeof(blake2s_param) == BLAKE2S_OUTBYTES, "Wrong size of blake2s_param");
|
||||
// static_assert(sizeof(blake2b_param) == BLAKE2B_OUTBYTES, "Wrong size of blake2b_param");
|
||||
|
||||
|
||||
/* Streaming API */
|
||||
int blake2s_init( blake2s_state *S, size_t outlen );
|
||||
int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
|
||||
int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
|
||||
int blake2s_update( blake2s_state *S, const void *in, size_t inlen );
|
||||
int blake2s_final( blake2s_state *S, void *out, size_t outlen );
|
||||
|
||||
int blake2b_init( blake2b_state *S, size_t outlen );
|
||||
int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
|
||||
int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
|
||||
int blake2b_update( blake2b_state *S, const void *in, size_t inlen );
|
||||
int blake2b_final( blake2b_state *S, void *out, size_t outlen );
|
||||
|
||||
int blake2sp_init( blake2sp_state *S, size_t outlen );
|
||||
int blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
|
||||
int blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );
|
||||
int blake2sp_final( blake2sp_state *S, void *out, size_t outlen );
|
||||
|
||||
int blake2bp_init( blake2bp_state *S, size_t outlen );
|
||||
int blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );
|
||||
int blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );
|
||||
int blake2bp_final( blake2bp_state *S, void *out, size_t outlen );
|
||||
|
||||
/* Variable output length API */
|
||||
int blake2xs_init( blake2xs_state *S, const size_t outlen );
|
||||
int blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );
|
||||
int blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );
|
||||
int blake2xs_final(blake2xs_state *S, void *out, size_t outlen);
|
||||
|
||||
int blake2xb_init( blake2xb_state *S, const size_t outlen );
|
||||
int blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );
|
||||
int blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );
|
||||
int blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
|
||||
|
||||
/* Simple API */
|
||||
int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
|
||||
int blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
int blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
|
||||
int blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
int blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
|
||||
/* This is simply an alias for blake2b */
|
||||
int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
|
||||
|
||||
#if defined(__cplusplus)
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
381
crypto/upstream/blake2b-ref.c
Executable file
381
crypto/upstream/blake2b-ref.c
Executable file
|
|
@ -0,0 +1,381 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#include "blake2.h"
|
||||
#include "blake2-impl.h"
|
||||
|
||||
static const uint64_t blake2b_IV[8] =
|
||||
{
|
||||
0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL,
|
||||
0x3c6ef372fe94f82bULL, 0xa54ff53a5f1d36f1ULL,
|
||||
0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
|
||||
0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
|
||||
};
|
||||
|
||||
static const uint8_t blake2b_sigma[12][16] =
|
||||
{
|
||||
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
|
||||
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
|
||||
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
|
||||
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
|
||||
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
|
||||
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
|
||||
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
|
||||
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
|
||||
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
|
||||
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
|
||||
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
|
||||
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
|
||||
};
|
||||
|
||||
|
||||
static void blake2b_set_lastnode( blake2b_state *S )
|
||||
{
|
||||
S->f[1] = (uint64_t)-1;
|
||||
}
|
||||
|
||||
/* Some helper functions, not necessarily useful */
|
||||
static int blake2b_is_lastblock( const blake2b_state *S )
|
||||
{
|
||||
return S->f[0] != 0;
|
||||
}
|
||||
|
||||
static void blake2b_set_lastblock( blake2b_state *S )
|
||||
{
|
||||
if( S->last_node ) blake2b_set_lastnode( S );
|
||||
|
||||
S->f[0] = (uint64_t)-1;
|
||||
}
|
||||
|
||||
static void blake2b_increment_counter( blake2b_state *S, const uint64_t inc )
|
||||
{
|
||||
S->t[0] += inc;
|
||||
S->t[1] += ( S->t[0] < inc );
|
||||
}
|
||||
|
||||
static void blake2b_init0( blake2b_state *S )
|
||||
{
|
||||
size_t i;
|
||||
memset( S, 0, sizeof( blake2b_state ) );
|
||||
|
||||
for( i = 0; i < 8; ++i ) S->h[i] = blake2b_IV[i];
|
||||
}
|
||||
|
||||
/* init xors IV with input parameter block */
|
||||
int blake2b_init_param( blake2b_state *S, const blake2b_param *P )
|
||||
{
|
||||
const uint8_t *p = ( const uint8_t * )( P );
|
||||
size_t i;
|
||||
|
||||
blake2b_init0( S );
|
||||
|
||||
/* IV XOR ParamBlock */
|
||||
for( i = 0; i < 8; ++i )
|
||||
S->h[i] ^= load64( p + sizeof( S->h[i] ) * i );
|
||||
|
||||
S->outlen = P->digest_length;
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
int blake2b_init( blake2b_state *S, size_t outlen )
|
||||
{
|
||||
blake2b_param P[1];
|
||||
|
||||
if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1;
|
||||
|
||||
P->digest_length = (uint8_t)outlen;
|
||||
P->key_length = 0;
|
||||
P->fanout = 1;
|
||||
P->depth = 1;
|
||||
store32( &P->leaf_length, 0 );
|
||||
store32( &P->node_offset, 0 );
|
||||
store32( &P->xof_length, 0 );
|
||||
P->node_depth = 0;
|
||||
P->inner_length = 0;
|
||||
memset( P->reserved, 0, sizeof( P->reserved ) );
|
||||
memset( P->salt, 0, sizeof( P->salt ) );
|
||||
memset( P->personal, 0, sizeof( P->personal ) );
|
||||
return blake2b_init_param( S, P );
|
||||
}
|
||||
|
||||
|
||||
int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )
|
||||
{
|
||||
blake2b_param P[1];
|
||||
|
||||
if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1;
|
||||
|
||||
if ( !key || !keylen || keylen > BLAKE2B_KEYBYTES ) return -1;
|
||||
|
||||
P->digest_length = (uint8_t)outlen;
|
||||
P->key_length = (uint8_t)keylen;
|
||||
P->fanout = 1;
|
||||
P->depth = 1;
|
||||
store32( &P->leaf_length, 0 );
|
||||
store32( &P->node_offset, 0 );
|
||||
store32( &P->xof_length, 0 );
|
||||
P->node_depth = 0;
|
||||
P->inner_length = 0;
|
||||
memset( P->reserved, 0, sizeof( P->reserved ) );
|
||||
memset( P->salt, 0, sizeof( P->salt ) );
|
||||
memset( P->personal, 0, sizeof( P->personal ) );
|
||||
|
||||
if( blake2b_init_param( S, P ) < 0 ) return -1;
|
||||
|
||||
{
|
||||
uint8_t block[BLAKE2B_BLOCKBYTES];
|
||||
memset( block, 0, BLAKE2B_BLOCKBYTES );
|
||||
memcpy( block, key, keylen );
|
||||
blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
|
||||
secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
#define G(r,i,a,b,c,d) \
|
||||
do { \
|
||||
a = a + b + m[blake2b_sigma[r][2*i+0]]; \
|
||||
d = rotr64(d ^ a, 32); \
|
||||
c = c + d; \
|
||||
b = rotr64(b ^ c, 24); \
|
||||
a = a + b + m[blake2b_sigma[r][2*i+1]]; \
|
||||
d = rotr64(d ^ a, 16); \
|
||||
c = c + d; \
|
||||
b = rotr64(b ^ c, 63); \
|
||||
} while(0)
|
||||
|
||||
#define ROUND(r) \
|
||||
do { \
|
||||
G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
|
||||
G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
|
||||
G(r,2,v[ 2],v[ 6],v[10],v[14]); \
|
||||
G(r,3,v[ 3],v[ 7],v[11],v[15]); \
|
||||
G(r,4,v[ 0],v[ 5],v[10],v[15]); \
|
||||
G(r,5,v[ 1],v[ 6],v[11],v[12]); \
|
||||
G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
|
||||
G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
|
||||
} while(0)
|
||||
|
||||
static void blake2b_compress( blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES] )
|
||||
{
|
||||
uint64_t m[16];
|
||||
uint64_t v[16];
|
||||
size_t i;
|
||||
|
||||
for( i = 0; i < 16; ++i ) {
|
||||
m[i] = load64( block + i * sizeof( m[i] ) );
|
||||
}
|
||||
|
||||
for( i = 0; i < 8; ++i ) {
|
||||
v[i] = S->h[i];
|
||||
}
|
||||
|
||||
v[ 8] = blake2b_IV[0];
|
||||
v[ 9] = blake2b_IV[1];
|
||||
v[10] = blake2b_IV[2];
|
||||
v[11] = blake2b_IV[3];
|
||||
v[12] = blake2b_IV[4] ^ S->t[0];
|
||||
v[13] = blake2b_IV[5] ^ S->t[1];
|
||||
v[14] = blake2b_IV[6] ^ S->f[0];
|
||||
v[15] = blake2b_IV[7] ^ S->f[1];
|
||||
|
||||
ROUND( 0 );
|
||||
ROUND( 1 );
|
||||
ROUND( 2 );
|
||||
ROUND( 3 );
|
||||
ROUND( 4 );
|
||||
ROUND( 5 );
|
||||
ROUND( 6 );
|
||||
ROUND( 7 );
|
||||
ROUND( 8 );
|
||||
ROUND( 9 );
|
||||
ROUND( 10 );
|
||||
ROUND( 11 );
|
||||
|
||||
for( i = 0; i < 8; ++i ) {
|
||||
S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
|
||||
}
|
||||
}
|
||||
|
||||
#undef G
|
||||
#undef ROUND
|
||||
|
||||
int blake2b_update( blake2b_state *S, const void *pin, size_t inlen )
|
||||
{
|
||||
const unsigned char * in = (const unsigned char *)pin;
|
||||
if( inlen > 0 )
|
||||
{
|
||||
size_t left = S->buflen;
|
||||
size_t fill = BLAKE2B_BLOCKBYTES - left;
|
||||
if( inlen > fill )
|
||||
{
|
||||
S->buflen = 0;
|
||||
memcpy( S->buf + left, in, fill ); /* Fill buffer */
|
||||
blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
|
||||
blake2b_compress( S, S->buf ); /* Compress */
|
||||
in += fill; inlen -= fill;
|
||||
while(inlen > BLAKE2B_BLOCKBYTES) {
|
||||
blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES);
|
||||
blake2b_compress( S, in );
|
||||
in += BLAKE2B_BLOCKBYTES;
|
||||
inlen -= BLAKE2B_BLOCKBYTES;
|
||||
}
|
||||
}
|
||||
memcpy( S->buf + S->buflen, in, inlen );
|
||||
S->buflen += inlen;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int blake2b_final( blake2b_state *S, void *out, size_t outlen )
|
||||
{
|
||||
uint8_t buffer[BLAKE2B_OUTBYTES] = {0};
|
||||
size_t i;
|
||||
|
||||
if( out == NULL || outlen < S->outlen )
|
||||
return -1;
|
||||
|
||||
if( blake2b_is_lastblock( S ) )
|
||||
return -1;
|
||||
|
||||
blake2b_increment_counter( S, S->buflen );
|
||||
blake2b_set_lastblock( S );
|
||||
memset( S->buf + S->buflen, 0, BLAKE2B_BLOCKBYTES - S->buflen ); /* Padding */
|
||||
blake2b_compress( S, S->buf );
|
||||
|
||||
for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
|
||||
store64( buffer + sizeof( S->h[i] ) * i, S->h[i] );
|
||||
|
||||
memcpy( out, buffer, S->outlen );
|
||||
secure_zero_memory(buffer, sizeof(buffer));
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* inlen, at least, should be uint64_t. Others can be size_t. */
|
||||
int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
|
||||
{
|
||||
blake2b_state S[1];
|
||||
|
||||
/* Verify parameters */
|
||||
if ( NULL == in && inlen > 0 ) return -1;
|
||||
|
||||
if ( NULL == out ) return -1;
|
||||
|
||||
if( NULL == key && keylen > 0 ) return -1;
|
||||
|
||||
if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1;
|
||||
|
||||
if( keylen > BLAKE2B_KEYBYTES ) return -1;
|
||||
|
||||
if( keylen > 0 )
|
||||
{
|
||||
if( blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
|
||||
}
|
||||
else
|
||||
{
|
||||
if( blake2b_init( S, outlen ) < 0 ) return -1;
|
||||
}
|
||||
|
||||
blake2b_update( S, ( const uint8_t * )in, inlen );
|
||||
blake2b_final( S, out, outlen );
|
||||
return 0;
|
||||
}
|
||||
|
||||
int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {
|
||||
return blake2b(out, outlen, in, inlen, key, keylen);
|
||||
}
|
||||
|
||||
#if defined(SUPERCOP)
|
||||
int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
|
||||
{
|
||||
return blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(BLAKE2B_SELFTEST)
|
||||
#include <string.h>
|
||||
#include "blake2-kat.h"
|
||||
int main( void )
|
||||
{
|
||||
uint8_t key[BLAKE2B_KEYBYTES];
|
||||
uint8_t buf[BLAKE2_KAT_LENGTH];
|
||||
size_t i, step;
|
||||
|
||||
for( i = 0; i < BLAKE2B_KEYBYTES; ++i )
|
||||
key[i] = ( uint8_t )i;
|
||||
|
||||
for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
|
||||
buf[i] = ( uint8_t )i;
|
||||
|
||||
/* Test simple API */
|
||||
for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
|
||||
{
|
||||
uint8_t hash[BLAKE2B_OUTBYTES];
|
||||
blake2b( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );
|
||||
|
||||
if( 0 != memcmp( hash, blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )
|
||||
{
|
||||
goto fail;
|
||||
}
|
||||
}
|
||||
|
||||
/* Test streaming API */
|
||||
for(step = 1; step < BLAKE2B_BLOCKBYTES; ++step) {
|
||||
for (i = 0; i < BLAKE2_KAT_LENGTH; ++i) {
|
||||
uint8_t hash[BLAKE2B_OUTBYTES];
|
||||
blake2b_state S;
|
||||
uint8_t * p = buf;
|
||||
size_t mlen = i;
|
||||
int err = 0;
|
||||
|
||||
if( (err = blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
|
||||
goto fail;
|
||||
}
|
||||
|
||||
while (mlen >= step) {
|
||||
if ( (err = blake2b_update(&S, p, step)) < 0 ) {
|
||||
goto fail;
|
||||
}
|
||||
mlen -= step;
|
||||
p += step;
|
||||
}
|
||||
if ( (err = blake2b_update(&S, p, mlen)) < 0) {
|
||||
goto fail;
|
||||
}
|
||||
if ( (err = blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
|
||||
goto fail;
|
||||
}
|
||||
|
||||
if (0 != memcmp(hash, blake2b_keyed_kat[i], BLAKE2B_OUTBYTES)) {
|
||||
goto fail;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
puts( "ok" );
|
||||
return 0;
|
||||
fail:
|
||||
puts("error");
|
||||
return -1;
|
||||
}
|
||||
#endif
|
||||
1140
crypto/upstream/clsag.cpp
Executable file
1140
crypto/upstream/clsag.cpp
Executable file
File diff suppressed because it is too large
Load diff
187
crypto/upstream/clsag.h
Executable file
187
crypto/upstream/clsag.h
Executable file
|
|
@ -0,0 +1,187 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
#include "crypto-sugar.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
// 2-CLSAG signature where both dimensions are with respect to the group element G (that's why 'GG')
|
||||
struct CLSAG_GG_signature
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_vec_t r; // size = size of the ring
|
||||
public_key K1; // auxiliary key image for layer 1
|
||||
};
|
||||
|
||||
|
||||
inline bool operator==(const CLSAG_GG_signature& lhs, const CLSAG_GG_signature& rhs)
|
||||
{
|
||||
return
|
||||
lhs.c == rhs.c &&
|
||||
lhs.r == rhs.r &&
|
||||
lhs.K1 == rhs.K1;
|
||||
}
|
||||
|
||||
inline bool operator!=(const CLSAG_GG_signature& lhs, const CLSAG_GG_signature& rhs) { return !(lhs == rhs); }
|
||||
|
||||
struct CLSAG_GG_input_ref_t
|
||||
{
|
||||
CLSAG_GG_input_ref_t(const public_key& stealth_address, const public_key& amount_commitment)
|
||||
: stealth_address(stealth_address), amount_commitment(amount_commitment)
|
||||
{}
|
||||
|
||||
const public_key& stealth_address; // P, not premultiplied by 1/8, TODO @#@#: make sure it's okay
|
||||
const public_key& amount_commitment; // A, premultiplied by 1/8
|
||||
};
|
||||
|
||||
// pseudo_out_amount_commitment -- not premultiplied by 1/8
|
||||
bool generate_CLSAG_GG(const hash& m, const std::vector<CLSAG_GG_input_ref_t>& ring, const point_t& pseudo_out_amount_commitment, const key_image& ki,
|
||||
const scalar_t& secret_x, const scalar_t& secret_f, uint64_t secret_index, CLSAG_GG_signature& sig);
|
||||
|
||||
// pseudo_out_amount_commitment -- premultiplied by 1/8
|
||||
bool verify_CLSAG_GG(const hash& m, const std::vector<CLSAG_GG_input_ref_t>& ring, const public_key& pseudo_out_amount_commitment, const key_image& ki,
|
||||
const CLSAG_GG_signature& sig);
|
||||
|
||||
|
||||
//
|
||||
// d/v-CLSAG implementation
|
||||
// See the whitepaper: https://hyle-team.github.io/docs/zano/dv-CLSAG-extension/dv-CLSAG-extension.pdf
|
||||
// Review by Cypher Stack: https://github.com/cypherstack/zano-clsag-review
|
||||
// -- sowle
|
||||
//
|
||||
|
||||
|
||||
|
||||
//
|
||||
// 3/2-CLSAG
|
||||
//
|
||||
|
||||
|
||||
// 3/2-CLSAG signature (with respect to the group element G, G, X -- that's why 'GGX')
|
||||
struct CLSAG_GGX_signature
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_vec_t r_g; // for G-components (layers 0, 1), size = size of the ring
|
||||
scalar_vec_t r_x; // for X-component (layer 2), size = size of the ring
|
||||
public_key K1; // auxiliary key image for layer 1 (G)
|
||||
public_key K2; // auxiliary key image for layer 2 (X)
|
||||
};
|
||||
|
||||
struct CLSAG_GGX_input_ref_t : public CLSAG_GG_input_ref_t
|
||||
{
|
||||
CLSAG_GGX_input_ref_t(const public_key& stealth_address, const public_key& amount_commitment, const public_key& blinded_asset_id)
|
||||
: CLSAG_GG_input_ref_t(stealth_address, amount_commitment)
|
||||
, blinded_asset_id(blinded_asset_id)
|
||||
{}
|
||||
|
||||
const public_key& blinded_asset_id; // T, premultiplied by 1/8
|
||||
};
|
||||
|
||||
// pseudo_out_amount_commitment -- not premultiplied by 1/8
|
||||
// pseudo_out_asset_id -- not premultiplied by 1/8
|
||||
bool generate_CLSAG_GGX(const hash& m, const std::vector<CLSAG_GGX_input_ref_t>& ring, const point_t& pseudo_out_amount_commitment, const point_t& pseudo_out_asset_id, const key_image& ki,
|
||||
const scalar_t& secret_0_xp, const scalar_t& secret_1_f, const scalar_t& secret_2_t, uint64_t secret_index, CLSAG_GGX_signature& sig);
|
||||
|
||||
// pseudo_out_amount_commitment -- premultiplied by 1/8
|
||||
// pseudo_out_asset_id -- premultiplied by 1/8
|
||||
// may throw an exception TODO @#@# make sure it's okay
|
||||
bool verify_CLSAG_GGX(const hash& m, const std::vector<CLSAG_GGX_input_ref_t>& ring, const public_key& pseudo_out_amount_commitment,
|
||||
const public_key& pseudo_out_asset_id, const key_image& ki, const CLSAG_GGX_signature& sig);
|
||||
|
||||
|
||||
/*
|
||||
//
|
||||
// 4/2-CLSAG (eventually, it's not used in Zano)
|
||||
//
|
||||
|
||||
|
||||
// 4/2-CLSAG signature (with respect to the group element G, G, X, G -- that's why 'GGXG')
|
||||
struct CLSAG_GGXG_signature
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_vec_t r_g; // for G-components (layers 0, 1, 3), size = size of the ring
|
||||
scalar_vec_t r_x; // for X-component (layer 2), size = size of the ring
|
||||
public_key K1; // auxiliary key image for layer 1 (G)
|
||||
public_key K2; // auxiliary key image for layer 2 (X)
|
||||
public_key K3; // auxiliary key image for layer 3 (G)
|
||||
};
|
||||
|
||||
struct CLSAG_GGXG_input_ref_t : public CLSAG_GG_input_ref_t
|
||||
{
|
||||
CLSAG_GGXG_input_ref_t(const public_key& stealth_address, const public_key& amount_commitment, const public_key& concealing_point)
|
||||
: CLSAG_GG_input_ref_t(stealth_address, amount_commitment)
|
||||
, concealing_point(concealing_point)
|
||||
{}
|
||||
|
||||
const public_key& concealing_point; // Q, premultiplied by 1/8
|
||||
};
|
||||
|
||||
// pseudo_out_amount_commitment -- not premultiplied by 1/8
|
||||
// extended_amount_commitment -- not premultiplied by 1/8
|
||||
bool generate_CLSAG_GGXG(const hash& m, const std::vector<CLSAG_GGXG_input_ref_t>& ring, const point_t& pseudo_out_amount_commitment, const point_t& extended_amount_commitment, const key_image& ki,
|
||||
const scalar_t& secret_0_xp, const scalar_t& secret_1_f, const scalar_t& secret_2_x, const scalar_t& secret_3_q, uint64_t secret_index, CLSAG_GGXG_signature& sig);
|
||||
|
||||
// pseudo_out_amount_commitment -- premultiplied by 1/8
|
||||
// extended_amount_commitment -- premultiplied by 1/8
|
||||
// may throw an exception TODO @#@# make sure it's okay
|
||||
bool verify_CLSAG_GGXG(const hash& m, const std::vector<CLSAG_GGXG_input_ref_t>& ring, const public_key& pseudo_out_amount_commitment,
|
||||
const public_key& extended_amount_commitment, const key_image& ki, const CLSAG_GGXG_signature& sig);
|
||||
|
||||
*/
|
||||
|
||||
//
|
||||
// 5/2-CLSAG
|
||||
//
|
||||
|
||||
|
||||
// 5/2-CLSAG signature (with respect to the group element G, G, X, X, G -- that's why 'GGXXG')
|
||||
struct CLSAG_GGXXG_signature
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_vec_t r_g; // for G-components (layers 0, 1, 4), size = size of the ring
|
||||
scalar_vec_t r_x; // for X-component (layers 2, 3), size = size of the ring
|
||||
public_key K1; // auxiliary key image for layer 1 (G)
|
||||
public_key K2; // auxiliary key image for layer 2 (X)
|
||||
public_key K3; // auxiliary key image for layer 2 (X)
|
||||
public_key K4; // auxiliary key image for layer 3 (G)
|
||||
};
|
||||
|
||||
struct CLSAG_GGXXG_input_ref_t : public CLSAG_GGX_input_ref_t
|
||||
{
|
||||
CLSAG_GGXXG_input_ref_t(const public_key& stealth_address, const public_key& amount_commitment, const public_key& blinded_asset_id, const public_key& concealing_point)
|
||||
: CLSAG_GGX_input_ref_t(stealth_address, amount_commitment, blinded_asset_id)
|
||||
, concealing_point(concealing_point)
|
||||
{}
|
||||
|
||||
const public_key& concealing_point; // Q, premultiplied by 1/8
|
||||
};
|
||||
|
||||
// pseudo_out_amount_commitment -- not premultiplied by 1/8
|
||||
// pseudo_out_asset_id -- not premultiplied by 1/8
|
||||
// extended_amount_commitment -- not premultiplied by 1/8
|
||||
bool generate_CLSAG_GGXXG(const hash& m, const std::vector<CLSAG_GGXXG_input_ref_t>& ring, const point_t& pseudo_out_amount_commitment, const point_t& pseudo_out_blinded_asset_id, const point_t& extended_amount_commitment, const key_image& ki,
|
||||
const scalar_t& secret_0_xp, const scalar_t& secret_1_f, const scalar_t& secret_2_r, const scalar_t& secret_3_x, const scalar_t& secret_4_q, uint64_t secret_index, CLSAG_GGXXG_signature& sig);
|
||||
|
||||
// pseudo_out_amount_commitment -- premultiplied by 1/8
|
||||
// pseudo_out_asset_id -- premultiplied by 1/8
|
||||
// extended_amount_commitment -- premultiplied by 1/8
|
||||
// may throw an exception TODO @#@# make sure it's okay
|
||||
bool verify_CLSAG_GGXXG(const hash& m, const std::vector<CLSAG_GGXXG_input_ref_t>& ring, const public_key& pseudo_out_amount_commitment, const public_key& pseudo_out_blinded_asset_id, const public_key& extended_amount_commitment, const key_image& ki,
|
||||
const CLSAG_GGXXG_signature& sig);
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
859
crypto/upstream/crypto-ops-data.c
Executable file
859
crypto/upstream/crypto-ops-data.c
Executable file
|
|
@ -0,0 +1,859 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#include "crypto-ops.h"
|
||||
|
||||
/* sqrt(x) is such an integer y that 0 <= y <= p - 1, y % 2 = 0, and y^2 = x (mod p). */
|
||||
/* d = -121665 / 121666 */
|
||||
const fe fe_d = {-10913610, 13857413, -15372611, 6949391, 114729, -8787816, -6275908, -3247719, -18696448, -12055116}; /* d */
|
||||
const fe fe_sqrtm1 = {-32595792, -7943725, 9377950, 3500415, 12389472, -272473, -25146209, -2005654, 326686, 11406482}; /* sqrt(-1) */
|
||||
const fe fe_d2 = {-21827239, -5839606, -30745221, 13898782, 229458, 15978800, -12551817, -6495438, 29715968, 9444199}; /* 2 * d */
|
||||
|
||||
/* base[i][j] = (j+1)*256^i*B */
|
||||
const ge_precomp ge_base[32][8] = {
|
||||
{
|
||||
{{25967493, -14356035, 29566456, 3660896, -12694345, 4014787, 27544626, -11754271, -6079156, 2047605},
|
||||
{-12545711, 934262, -2722910, 3049990, -727428, 9406986, 12720692, 5043384, 19500929, -15469378},
|
||||
{-8738181, 4489570, 9688441, -14785194, 10184609, -12363380, 29287919, 11864899, -24514362, -4438546}},
|
||||
{{-12815894, -12976347, -21581243, 11784320, -25355658, -2750717, -11717903, -3814571, -358445, -10211303},
|
||||
{-21703237, 6903825, 27185491, 6451973, -29577724, -9554005, -15616551, 11189268, -26829678, -5319081},
|
||||
{26966642, 11152617, 32442495, 15396054, 14353839, -12752335, -3128826, -9541118, -15472047, -4166697}},
|
||||
{{15636291, -9688557, 24204773, -7912398, 616977, -16685262, 27787600, -14772189, 28944400, -1550024},
|
||||
{16568933, 4717097, -11556148, -1102322, 15682896, -11807043, 16354577, -11775962, 7689662, 11199574},
|
||||
{30464156, -5976125, -11779434, -15670865, 23220365, 15915852, 7512774, 10017326, -17749093, -9920357}},
|
||||
{{-17036878, 13921892, 10945806, -6033431, 27105052, -16084379, -28926210, 15006023, 3284568, -6276540},
|
||||
{23599295, -8306047, -11193664, -7687416, 13236774, 10506355, 7464579, 9656445, 13059162, 10374397},
|
||||
{7798556, 16710257, 3033922, 2874086, 28997861, 2835604, 32406664, -3839045, -641708, -101325}},
|
||||
{{10861363, 11473154, 27284546, 1981175, -30064349, 12577861, 32867885, 14515107, -15438304, 10819380},
|
||||
{4708026, 6336745, 20377586, 9066809, -11272109, 6594696, -25653668, 12483688, -12668491, 5581306},
|
||||
{19563160, 16186464, -29386857, 4097519, 10237984, -4348115, 28542350, 13850243, -23678021, -15815942}},
|
||||
{{-15371964, -12862754, 32573250, 4720197, -26436522, 5875511, -19188627, -15224819, -9818940, -12085777},
|
||||
{-8549212, 109983, 15149363, 2178705, 22900618, 4543417, 3044240, -15689887, 1762328, 14866737},
|
||||
{-18199695, -15951423, -10473290, 1707278, -17185920, 3916101, -28236412, 3959421, 27914454, 4383652}},
|
||||
{{5153746, 9909285, 1723747, -2777874, 30523605, 5516873, 19480852, 5230134, -23952439, -15175766},
|
||||
{-30269007, -3463509, 7665486, 10083793, 28475525, 1649722, 20654025, 16520125, 30598449, 7715701},
|
||||
{28881845, 14381568, 9657904, 3680757, -20181635, 7843316, -31400660, 1370708, 29794553, -1409300}},
|
||||
{{14499471, -2729599, -33191113, -4254652, 28494862, 14271267, 30290735, 10876454, -33154098, 2381726},
|
||||
{-7195431, -2655363, -14730155, 462251, -27724326, 3941372, -6236617, 3696005, -32300832, 15351955},
|
||||
{27431194, 8222322, 16448760, -3907995, -18707002, 11938355, -32961401, -2970515, 29551813, 10109425}}
|
||||
}, {
|
||||
{{-13657040, -13155431, -31283750, 11777098, 21447386, 6519384, -2378284, -1627556, 10092783, -4764171},
|
||||
{27939166, 14210322, 4677035, 16277044, -22964462, -12398139, -32508754, 12005538, -17810127, 12803510},
|
||||
{17228999, -15661624, -1233527, 300140, -1224870, -11714777, 30364213, -9038194, 18016357, 4397660}},
|
||||
{{-10958843, -7690207, 4776341, -14954238, 27850028, -15602212, -26619106, 14544525, -17477504, 982639},
|
||||
{29253598, 15796703, -2863982, -9908884, 10057023, 3163536, 7332899, -4120128, -21047696, 9934963},
|
||||
{5793303, 16271923, -24131614, -10116404, 29188560, 1206517, -14747930, 4559895, -30123922, -10897950}},
|
||||
{{-27643952, -11493006, 16282657, -11036493, 28414021, -15012264, 24191034, 4541697, -13338309, 5500568},
|
||||
{12650548, -1497113, 9052871, 11355358, -17680037, -8400164, -17430592, 12264343, 10874051, 13524335},
|
||||
{25556948, -3045990, 714651, 2510400, 23394682, -10415330, 33119038, 5080568, -22528059, 5376628}},
|
||||
{{-26088264, -4011052, -17013699, -3537628, -6726793, 1920897, -22321305, -9447443, 4535768, 1569007},
|
||||
{-2255422, 14606630, -21692440, -8039818, 28430649, 8775819, -30494562, 3044290, 31848280, 12543772},
|
||||
{-22028579, 2943893, -31857513, 6777306, 13784462, -4292203, -27377195, -2062731, 7718482, 14474653}},
|
||||
{{2385315, 2454213, -22631320, 46603, -4437935, -15680415, 656965, -7236665, 24316168, -5253567},
|
||||
{13741529, 10911568, -33233417, -8603737, -20177830, -1033297, 33040651, -13424532, -20729456, 8321686},
|
||||
{21060490, -2212744, 15712757, -4336099, 1639040, 10656336, 23845965, -11874838, -9984458, 608372}},
|
||||
{{-13672732, -15087586, -10889693, -7557059, -6036909, 11305547, 1123968, -6780577, 27229399, 23887},
|
||||
{-23244140, -294205, -11744728, 14712571, -29465699, -2029617, 12797024, -6440308, -1633405, 16678954},
|
||||
{-29500620, 4770662, -16054387, 14001338, 7830047, 9564805, -1508144, -4795045, -17169265, 4904953}},
|
||||
{{24059557, 14617003, 19037157, -15039908, 19766093, -14906429, 5169211, 16191880, 2128236, -4326833},
|
||||
{-16981152, 4124966, -8540610, -10653797, 30336522, -14105247, -29806336, 916033, -6882542, -2986532},
|
||||
{-22630907, 12419372, -7134229, -7473371, -16478904, 16739175, 285431, 2763829, 15736322, 4143876}},
|
||||
{{2379352, 11839345, -4110402, -5988665, 11274298, 794957, 212801, -14594663, 23527084, -16458268},
|
||||
{33431127, -11130478, -17838966, -15626900, 8909499, 8376530, -32625340, 4087881, -15188911, -14416214},
|
||||
{1767683, 7197987, -13205226, -2022635, -13091350, 448826, 5799055, 4357868, -4774191, -16323038}}
|
||||
}, {
|
||||
{{6721966, 13833823, -23523388, -1551314, 26354293, -11863321, 23365147, -3949732, 7390890, 2759800},
|
||||
{4409041, 2052381, 23373853, 10530217, 7676779, -12885954, 21302353, -4264057, 1244380, -12919645},
|
||||
{-4421239, 7169619, 4982368, -2957590, 30256825, -2777540, 14086413, 9208236, 15886429, 16489664}},
|
||||
{{1996075, 10375649, 14346367, 13311202, -6874135, -16438411, -13693198, 398369, -30606455, -712933},
|
||||
{-25307465, 9795880, -2777414, 14878809, -33531835, 14780363, 13348553, 12076947, -30836462, 5113182},
|
||||
{-17770784, 11797796, 31950843, 13929123, -25888302, 12288344, -30341101, -7336386, 13847711, 5387222}},
|
||||
{{-18582163, -3416217, 17824843, -2340966, 22744343, -10442611, 8763061, 3617786, -19600662, 10370991},
|
||||
{20246567, -14369378, 22358229, -543712, 18507283, -10413996, 14554437, -8746092, 32232924, 16763880},
|
||||
{9648505, 10094563, 26416693, 14745928, -30374318, -6472621, 11094161, 15689506, 3140038, -16510092}},
|
||||
{{-16160072, 5472695, 31895588, 4744994, 8823515, 10365685, -27224800, 9448613, -28774454, 366295},
|
||||
{19153450, 11523972, -11096490, -6503142, -24647631, 5420647, 28344573, 8041113, 719605, 11671788},
|
||||
{8678025, 2694440, -6808014, 2517372, 4964326, 11152271, -15432916, -15266516, 27000813, -10195553}},
|
||||
{{-15157904, 7134312, 8639287, -2814877, -7235688, 10421742, 564065, 5336097, 6750977, -14521026},
|
||||
{11836410, -3979488, 26297894, 16080799, 23455045, 15735944, 1695823, -8819122, 8169720, 16220347},
|
||||
{-18115838, 8653647, 17578566, -6092619, -8025777, -16012763, -11144307, -2627664, -5990708, -14166033}},
|
||||
{{-23308498, -10968312, 15213228, -10081214, -30853605, -11050004, 27884329, 2847284, 2655861, 1738395},
|
||||
{-27537433, -14253021, -25336301, -8002780, -9370762, 8129821, 21651608, -3239336, -19087449, -11005278},
|
||||
{1533110, 3437855, 23735889, 459276, 29970501, 11335377, 26030092, 5821408, 10478196, 8544890}},
|
||||
{{32173121, -16129311, 24896207, 3921497, 22579056, -3410854, 19270449, 12217473, 17789017, -3395995},
|
||||
{-30552961, -2228401, -15578829, -10147201, 13243889, 517024, 15479401, -3853233, 30460520, 1052596},
|
||||
{-11614875, 13323618, 32618793, 8175907, -15230173, 12596687, 27491595, -4612359, 3179268, -9478891}},
|
||||
{{31947069, -14366651, -4640583, -15339921, -15125977, -6039709, -14756777, -16411740, 19072640, -9511060},
|
||||
{11685058, 11822410, 3158003, -13952594, 33402194, -4165066, 5977896, -5215017, 473099, 5040608},
|
||||
{-20290863, 8198642, -27410132, 11602123, 1290375, -2799760, 28326862, 1721092, -19558642, -3131606}}
|
||||
}, {
|
||||
{{7881532, 10687937, 7578723, 7738378, -18951012, -2553952, 21820786, 8076149, -27868496, 11538389},
|
||||
{-19935666, 3899861, 18283497, -6801568, -15728660, -11249211, 8754525, 7446702, -5676054, 5797016},
|
||||
{-11295600, -3793569, -15782110, -7964573, 12708869, -8456199, 2014099, -9050574, -2369172, -5877341}},
|
||||
{{-22472376, -11568741, -27682020, 1146375, 18956691, 16640559, 1192730, -3714199, 15123619, 10811505},
|
||||
{14352098, -3419715, -18942044, 10822655, 32750596, 4699007, -70363, 15776356, -28886779, -11974553},
|
||||
{-28241164, -8072475, -4978962, -5315317, 29416931, 1847569, -20654173, -16484855, 4714547, -9600655}},
|
||||
{{15200332, 8368572, 19679101, 15970074, -31872674, 1959451, 24611599, -4543832, -11745876, 12340220},
|
||||
{12876937, -10480056, 33134381, 6590940, -6307776, 14872440, 9613953, 8241152, 15370987, 9608631},
|
||||
{-4143277, -12014408, 8446281, -391603, 4407738, 13629032, -7724868, 15866074, -28210621, -8814099}},
|
||||
{{26660628, -15677655, 8393734, 358047, -7401291, 992988, -23904233, 858697, 20571223, 8420556},
|
||||
{14620715, 13067227, -15447274, 8264467, 14106269, 15080814, 33531827, 12516406, -21574435, -12476749},
|
||||
{236881, 10476226, 57258, -14677024, 6472998, 2466984, 17258519, 7256740, 8791136, 15069930}},
|
||||
{{1276410, -9371918, 22949635, -16322807, -23493039, -5702186, 14711875, 4874229, -30663140, -2331391},
|
||||
{5855666, 4990204, -13711848, 7294284, -7804282, 1924647, -1423175, -7912378, -33069337, 9234253},
|
||||
{20590503, -9018988, 31529744, -7352666, -2706834, 10650548, 31559055, -11609587, 18979186, 13396066}},
|
||||
{{24474287, 4968103, 22267082, 4407354, 24063882, -8325180, -18816887, 13594782, 33514650, 7021958},
|
||||
{-11566906, -6565505, -21365085, 15928892, -26158305, 4315421, -25948728, -3916677, -21480480, 12868082},
|
||||
{-28635013, 13504661, 19988037, -2132761, 21078225, 6443208, -21446107, 2244500, -12455797, -8089383}},
|
||||
{{-30595528, 13793479, -5852820, 319136, -25723172, -6263899, 33086546, 8957937, -15233648, 5540521},
|
||||
{-11630176, -11503902, -8119500, -7643073, 2620056, 1022908, -23710744, -1568984, -16128528, -14962807},
|
||||
{23152971, 775386, 27395463, 14006635, -9701118, 4649512, 1689819, 892185, -11513277, -15205948}},
|
||||
{{9770129, 9586738, 26496094, 4324120, 1556511, -3550024, 27453819, 4763127, -19179614, 5867134},
|
||||
{-32765025, 1927590, 31726409, -4753295, 23962434, -16019500, 27846559, 5931263, -29749703, -16108455},
|
||||
{27461885, -2977536, 22380810, 1815854, -23033753, -3031938, 7283490, -15148073, -19526700, 7734629}}
|
||||
}, {
|
||||
{{-8010264, -9590817, -11120403, 6196038, 29344158, -13430885, 7585295, -3176626, 18549497, 15302069},
|
||||
{-32658337, -6171222, -7672793, -11051681, 6258878, 13504381, 10458790, -6418461, -8872242, 8424746},
|
||||
{24687205, 8613276, -30667046, -3233545, 1863892, -1830544, 19206234, 7134917, -11284482, -828919}},
|
||||
{{11334899, -9218022, 8025293, 12707519, 17523892, -10476071, 10243738, -14685461, -5066034, 16498837},
|
||||
{8911542, 6887158, -9584260, -6958590, 11145641, -9543680, 17303925, -14124238, 6536641, 10543906},
|
||||
{-28946384, 15479763, -17466835, 568876, -1497683, 11223454, -2669190, -16625574, -27235709, 8876771}},
|
||||
{{-25742899, -12566864, -15649966, -846607, -33026686, -796288, -33481822, 15824474, -604426, -9039817},
|
||||
{10330056, 70051, 7957388, -9002667, 9764902, 15609756, 27698697, -4890037, 1657394, 3084098},
|
||||
{10477963, -7470260, 12119566, -13250805, 29016247, -5365589, 31280319, 14396151, -30233575, 15272409}},
|
||||
{{-12288309, 3169463, 28813183, 16658753, 25116432, -5630466, -25173957, -12636138, -25014757, 1950504},
|
||||
{-26180358, 9489187, 11053416, -14746161, -31053720, 5825630, -8384306, -8767532, 15341279, 8373727},
|
||||
{28685821, 7759505, -14378516, -12002860, -31971820, 4079242, 298136, -10232602, -2878207, 15190420}},
|
||||
{{-32932876, 13806336, -14337485, -15794431, -24004620, 10940928, 8669718, 2742393, -26033313, -6875003},
|
||||
{-1580388, -11729417, -25979658, -11445023, -17411874, -10912854, 9291594, -16247779, -12154742, 6048605},
|
||||
{-30305315, 14843444, 1539301, 11864366, 20201677, 1900163, 13934231, 5128323, 11213262, 9168384}},
|
||||
{{-26280513, 11007847, 19408960, -940758, -18592965, -4328580, -5088060, -11105150, 20470157, -16398701},
|
||||
{-23136053, 9282192, 14855179, -15390078, -7362815, -14408560, -22783952, 14461608, 14042978, 5230683},
|
||||
{29969567, -2741594, -16711867, -8552442, 9175486, -2468974, 21556951, 3506042, -5933891, -12449708}},
|
||||
{{-3144746, 8744661, 19704003, 4581278, -20430686, 6830683, -21284170, 8971513, -28539189, 15326563},
|
||||
{-19464629, 10110288, -17262528, -3503892, -23500387, 1355669, -15523050, 15300988, -20514118, 9168260},
|
||||
{-5353335, 4488613, -23803248, 16314347, 7780487, -15638939, -28948358, 9601605, 33087103, -9011387}},
|
||||
{{-19443170, -15512900, -20797467, -12445323, -29824447, 10229461, -27444329, -15000531, -5996870, 15664672},
|
||||
{23294591, -16632613, -22650781, -8470978, 27844204, 11461195, 13099750, -2460356, 18151676, 13417686},
|
||||
{-24722913, -4176517, -31150679, 5988919, -26858785, 6685065, 1661597, -12551441, 15271676, -15452665}}
|
||||
}, {
|
||||
{{11433042, -13228665, 8239631, -5279517, -1985436, -725718, -18698764, 2167544, -6921301, -13440182},
|
||||
{-31436171, 15575146, 30436815, 12192228, -22463353, 9395379, -9917708, -8638997, 12215110, 12028277},
|
||||
{14098400, 6555944, 23007258, 5757252, -15427832, -12950502, 30123440, 4617780, -16900089, -655628}},
|
||||
{{-4026201, -15240835, 11893168, 13718664, -14809462, 1847385, -15819999, 10154009, 23973261, -12684474},
|
||||
{-26531820, -3695990, -1908898, 2534301, -31870557, -16550355, 18341390, -11419951, 32013174, -10103539},
|
||||
{-25479301, 10876443, -11771086, -14625140, -12369567, 1838104, 21911214, 6354752, 4425632, -837822}},
|
||||
{{-10433389, -14612966, 22229858, -3091047, -13191166, 776729, -17415375, -12020462, 4725005, 14044970},
|
||||
{19268650, -7304421, 1555349, 8692754, -21474059, -9910664, 6347390, -1411784, -19522291, -16109756},
|
||||
{-24864089, 12986008, -10898878, -5558584, -11312371, -148526, 19541418, 8180106, 9282262, 10282508}},
|
||||
{{-26205082, 4428547, -8661196, -13194263, 4098402, -14165257, 15522535, 8372215, 5542595, -10702683},
|
||||
{-10562541, 14895633, 26814552, -16673850, -17480754, -2489360, -2781891, 6993761, -18093885, 10114655},
|
||||
{-20107055, -929418, 31422704, 10427861, -7110749, 6150669, -29091755, -11529146, 25953725, -106158}},
|
||||
{{-4234397, -8039292, -9119125, 3046000, 2101609, -12607294, 19390020, 6094296, -3315279, 12831125},
|
||||
{-15998678, 7578152, 5310217, 14408357, -33548620, -224739, 31575954, 6326196, 7381791, -2421839},
|
||||
{-20902779, 3296811, 24736065, -16328389, 18374254, 7318640, 6295303, 8082724, -15362489, 12339664}},
|
||||
{{27724736, 2291157, 6088201, -14184798, 1792727, 5857634, 13848414, 15768922, 25091167, 14856294},
|
||||
{-18866652, 8331043, 24373479, 8541013, -701998, -9269457, 12927300, -12695493, -22182473, -9012899},
|
||||
{-11423429, -5421590, 11632845, 3405020, 30536730, -11674039, -27260765, 13866390, 30146206, 9142070}},
|
||||
{{3924129, -15307516, -13817122, -10054960, 12291820, -668366, -27702774, 9326384, -8237858, 4171294},
|
||||
{-15921940, 16037937, 6713787, 16606682, -21612135, 2790944, 26396185, 3731949, 345228, -5462949},
|
||||
{-21327538, 13448259, 25284571, 1143661, 20614966, -8849387, 2031539, -12391231, -16253183, -13582083}},
|
||||
{{31016211, -16722429, 26371392, -14451233, -5027349, 14854137, 17477601, 3842657, 28012650, -16405420},
|
||||
{-5075835, 9368966, -8562079, -4600902, -15249953, 6970560, -9189873, 16292057, -8867157, 3507940},
|
||||
{29439664, 3537914, 23333589, 6997794, -17555561, -11018068, -15209202, -15051267, -9164929, 6580396}}
|
||||
}, {
|
||||
{{-12185861, -7679788, 16438269, 10826160, -8696817, -6235611, 17860444, -9273846, -2095802, 9304567},
|
||||
{20714564, -4336911, 29088195, 7406487, 11426967, -5095705, 14792667, -14608617, 5289421, -477127},
|
||||
{-16665533, -10650790, -6160345, -13305760, 9192020, -1802462, 17271490, 12349094, 26939669, -3752294}},
|
||||
{{-12889898, 9373458, 31595848, 16374215, 21471720, 13221525, -27283495, -12348559, -3698806, 117887},
|
||||
{22263325, -6560050, 3984570, -11174646, -15114008, -566785, 28311253, 5358056, -23319780, 541964},
|
||||
{16259219, 3261970, 2309254, -15534474, -16885711, -4581916, 24134070, -16705829, -13337066, -13552195}},
|
||||
{{9378160, -13140186, -22845982, -12745264, 28198281, -7244098, -2399684, -717351, 690426, 14876244},
|
||||
{24977353, -314384, -8223969, -13465086, 28432343, -1176353, -13068804, -12297348, -22380984, 6618999},
|
||||
{-1538174, 11685646, 12944378, 13682314, -24389511, -14413193, 8044829, -13817328, 32239829, -5652762}},
|
||||
{{-18603066, 4762990, -926250, 8885304, -28412480, -3187315, 9781647, -10350059, 32779359, 5095274},
|
||||
{-33008130, -5214506, -32264887, -3685216, 9460461, -9327423, -24601656, 14506724, 21639561, -2630236},
|
||||
{-16400943, -13112215, 25239338, 15531969, 3987758, -4499318, -1289502, -6863535, 17874574, 558605}},
|
||||
{{-13600129, 10240081, 9171883, 16131053, -20869254, 9599700, 33499487, 5080151, 2085892, 5119761},
|
||||
{-22205145, -2519528, -16381601, 414691, -25019550, 2170430, 30634760, -8363614, -31999993, -5759884},
|
||||
{-6845704, 15791202, 8550074, -1312654, 29928809, -12092256, 27534430, -7192145, -22351378, 12961482}},
|
||||
{{-24492060, -9570771, 10368194, 11582341, -23397293, -2245287, 16533930, 8206996, -30194652, -5159638},
|
||||
{-11121496, -3382234, 2307366, 6362031, -135455, 8868177, -16835630, 7031275, 7589640, 8945490},
|
||||
{-32152748, 8917967, 6661220, -11677616, -1192060, -15793393, 7251489, -11182180, 24099109, -14456170}},
|
||||
{{5019558, -7907470, 4244127, -14714356, -26933272, 6453165, -19118182, -13289025, -6231896, -10280736},
|
||||
{10853594, 10721687, 26480089, 5861829, -22995819, 1972175, -1866647, -10557898, -3363451, -6441124},
|
||||
{-17002408, 5906790, 221599, -6563147, 7828208, -13248918, 24362661, -2008168, -13866408, 7421392}},
|
||||
{{8139927, -6546497, 32257646, -5890546, 30375719, 1886181, -21175108, 15441252, 28826358, -4123029},
|
||||
{6267086, 9695052, 7709135, -16603597, -32869068, -1886135, 14795160, -7840124, 13746021, -1742048},
|
||||
{28584902, 7787108, -6732942, -15050729, 22846041, -7571236, -3181936, -363524, 4771362, -8419958}}
|
||||
}, {
|
||||
{{24949256, 6376279, -27466481, -8174608, -18646154, -9930606, 33543569, -12141695, 3569627, 11342593},
|
||||
{26514989, 4740088, 27912651, 3697550, 19331575, -11472339, 6809886, 4608608, 7325975, -14801071},
|
||||
{-11618399, -14554430, -24321212, 7655128, -1369274, 5214312, -27400540, 10258390, -17646694, -8186692}},
|
||||
{{11431204, 15823007, 26570245, 14329124, 18029990, 4796082, -31446179, 15580664, 9280358, -3973687},
|
||||
{-160783, -10326257, -22855316, -4304997, -20861367, -13621002, -32810901, -11181622, -15545091, 4387441},
|
||||
{-20799378, 12194512, 3937617, -5805892, -27154820, 9340370, -24513992, 8548137, 20617071, -7482001}},
|
||||
{{-938825, -3930586, -8714311, 16124718, 24603125, -6225393, -13775352, -11875822, 24345683, 10325460},
|
||||
{-19855277, -1568885, -22202708, 8714034, 14007766, 6928528, 16318175, -1010689, 4766743, 3552007},
|
||||
{-21751364, -16730916, 1351763, -803421, -4009670, 3950935, 3217514, 14481909, 10988822, -3994762}},
|
||||
{{15564307, -14311570, 3101243, 5684148, 30446780, -8051356, 12677127, -6505343, -8295852, 13296005},
|
||||
{-9442290, 6624296, -30298964, -11913677, -4670981, -2057379, 31521204, 9614054, -30000824, 12074674},
|
||||
{4771191, -135239, 14290749, -13089852, 27992298, 14998318, -1413936, -1556716, 29832613, -16391035}},
|
||||
{{7064884, -7541174, -19161962, -5067537, -18891269, -2912736, 25825242, 5293297, -27122660, 13101590},
|
||||
{-2298563, 2439670, -7466610, 1719965, -27267541, -16328445, 32512469, -5317593, -30356070, -4190957},
|
||||
{-30006540, 10162316, -33180176, 3981723, -16482138, -13070044, 14413974, 9515896, 19568978, 9628812}},
|
||||
{{33053803, 199357, 15894591, 1583059, 27380243, -4580435, -17838894, -6106839, -6291786, 3437740},
|
||||
{-18978877, 3884493, 19469877, 12726490, 15913552, 13614290, -22961733, 70104, 7463304, 4176122},
|
||||
{-27124001, 10659917, 11482427, -16070381, 12771467, -6635117, -32719404, -5322751, 24216882, 5944158}},
|
||||
{{8894125, 7450974, -2664149, -9765752, -28080517, -12389115, 19345746, 14680796, 11632993, 5847885},
|
||||
{26942781, -2315317, 9129564, -4906607, 26024105, 11769399, -11518837, 6367194, -9727230, 4782140},
|
||||
{19916461, -4828410, -22910704, -11414391, 25606324, -5972441, 33253853, 8220911, 6358847, -1873857}},
|
||||
{{801428, -2081702, 16569428, 11065167, 29875704, 96627, 7908388, -4480480, -13538503, 1387155},
|
||||
{19646058, 5720633, -11416706, 12814209, 11607948, 12749789, 14147075, 15156355, -21866831, 11835260},
|
||||
{19299512, 1155910, 28703737, 14890794, 2925026, 7269399, 26121523, 15467869, -26560550, 5052483}}
|
||||
}, {
|
||||
{{-3017432, 10058206, 1980837, 3964243, 22160966, 12322533, -6431123, -12618185, 12228557, -7003677},
|
||||
{32944382, 14922211, -22844894, 5188528, 21913450, -8719943, 4001465, 13238564, -6114803, 8653815},
|
||||
{22865569, -4652735, 27603668, -12545395, 14348958, 8234005, 24808405, 5719875, 28483275, 2841751}},
|
||||
{{-16420968, -1113305, -327719, -12107856, 21886282, -15552774, -1887966, -315658, 19932058, -12739203},
|
||||
{-11656086, 10087521, -8864888, -5536143, -19278573, -3055912, 3999228, 13239134, -4777469, -13910208},
|
||||
{1382174, -11694719, 17266790, 9194690, -13324356, 9720081, 20403944, 11284705, -14013818, 3093230}},
|
||||
{{16650921, -11037932, -1064178, 1570629, -8329746, 7352753, -302424, 16271225, -24049421, -6691850},
|
||||
{-21911077, -5927941, -4611316, -5560156, -31744103, -10785293, 24123614, 15193618, -21652117, -16739389},
|
||||
{-9935934, -4289447, -25279823, 4372842, 2087473, 10399484, 31870908, 14690798, 17361620, 11864968}},
|
||||
{{-11307610, 6210372, 13206574, 5806320, -29017692, -13967200, -12331205, -7486601, -25578460, -16240689},
|
||||
{14668462, -12270235, 26039039, 15305210, 25515617, 4542480, 10453892, 6577524, 9145645, -6443880},
|
||||
{5974874, 3053895, -9433049, -10385191, -31865124, 3225009, -7972642, 3936128, -5652273, -3050304}},
|
||||
{{30625386, -4729400, -25555961, -12792866, -20484575, 7695099, 17097188, -16303496, -27999779, 1803632},
|
||||
{-3553091, 9865099, -5228566, 4272701, -5673832, -16689700, 14911344, 12196514, -21405489, 7047412},
|
||||
{20093277, 9920966, -11138194, -5343857, 13161587, 12044805, -32856851, 4124601, -32343828, -10257566}},
|
||||
{{-20788824, 14084654, -13531713, 7842147, 19119038, -13822605, 4752377, -8714640, -21679658, 2288038},
|
||||
{-26819236, -3283715, 29965059, 3039786, -14473765, 2540457, 29457502, 14625692, -24819617, 12570232},
|
||||
{-1063558, -11551823, 16920318, 12494842, 1278292, -5869109, -21159943, -3498680, -11974704, 4724943}},
|
||||
{{17960970, -11775534, -4140968, -9702530, -8876562, -1410617, -12907383, -8659932, -29576300, 1903856},
|
||||
{23134274, -14279132, -10681997, -1611936, 20684485, 15770816, -12989750, 3190296, 26955097, 14109738},
|
||||
{15308788, 5320727, -30113809, -14318877, 22902008, 7767164, 29425325, -11277562, 31960942, 11934971}},
|
||||
{{-27395711, 8435796, 4109644, 12222639, -24627868, 14818669, 20638173, 4875028, 10491392, 1379718},
|
||||
{-13159415, 9197841, 3875503, -8936108, -1383712, -5879801, 33518459, 16176658, 21432314, 12180697},
|
||||
{-11787308, 11500838, 13787581, -13832590, -22430679, 10140205, 1465425, 12689540, -10301319, -13872883}}
|
||||
}, {
|
||||
{{5414091, -15386041, -21007664, 9643570, 12834970, 1186149, -2622916, -1342231, 26128231, 6032912},
|
||||
{-26337395, -13766162, 32496025, -13653919, 17847801, -12669156, 3604025, 8316894, -25875034, -10437358},
|
||||
{3296484, 6223048, 24680646, -12246460, -23052020, 5903205, -8862297, -4639164, 12376617, 3188849}},
|
||||
{{29190488, -14659046, 27549113, -1183516, 3520066, -10697301, 32049515, -7309113, -16109234, -9852307},
|
||||
{-14744486, -9309156, 735818, -598978, -20407687, -5057904, 25246078, -15795669, 18640741, -960977},
|
||||
{-6928835, -16430795, 10361374, 5642961, 4910474, 12345252, -31638386, -494430, 10530747, 1053335}},
|
||||
{{-29265967, -14186805, -13538216, -12117373, -19457059, -10655384, -31462369, -2948985, 24018831, 15026644},
|
||||
{-22592535, -3145277, -2289276, 5953843, -13440189, 9425631, 25310643, 13003497, -2314791, -15145616},
|
||||
{-27419985, -603321, -8043984, -1669117, -26092265, 13987819, -27297622, 187899, -23166419, -2531735}},
|
||||
{{-21744398, -13810475, 1844840, 5021428, -10434399, -15911473, 9716667, 16266922, -5070217, 726099},
|
||||
{29370922, -6053998, 7334071, -15342259, 9385287, 2247707, -13661962, -4839461, 30007388, -15823341},
|
||||
{-936379, 16086691, 23751945, -543318, -1167538, -5189036, 9137109, 730663, 9835848, 4555336}},
|
||||
{{-23376435, 1410446, -22253753, -12899614, 30867635, 15826977, 17693930, 544696, -11985298, 12422646},
|
||||
{31117226, -12215734, -13502838, 6561947, -9876867, -12757670, -5118685, -4096706, 29120153, 13924425},
|
||||
{-17400879, -14233209, 19675799, -2734756, -11006962, -5858820, -9383939, -11317700, 7240931, -237388}},
|
||||
{{-31361739, -11346780, -15007447, -5856218, -22453340, -12152771, 1222336, 4389483, 3293637, -15551743},
|
||||
{-16684801, -14444245, 11038544, 11054958, -13801175, -3338533, -24319580, 7733547, 12796905, -6335822},
|
||||
{-8759414, -10817836, -25418864, 10783769, -30615557, -9746811, -28253339, 3647836, 3222231, -11160462}},
|
||||
{{18606113, 1693100, -25448386, -15170272, 4112353, 10045021, 23603893, -2048234, -7550776, 2484985},
|
||||
{9255317, -3131197, -12156162, -1004256, 13098013, -9214866, 16377220, -2102812, -19802075, -3034702},
|
||||
{-22729289, 7496160, -5742199, 11329249, 19991973, -3347502, -31718148, 9936966, -30097688, -10618797}},
|
||||
{{21878590, -5001297, 4338336, 13643897, -3036865, 13160960, 19708896, 5415497, -7360503, -4109293},
|
||||
{27736861, 10103576, 12500508, 8502413, -3413016, -9633558, 10436918, -1550276, -23659143, -8132100},
|
||||
{19492550, -12104365, -29681976, -852630, -3208171, 12403437, 30066266, 8367329, 13243957, 8709688}}
|
||||
}, {
|
||||
{{12015105, 2801261, 28198131, 10151021, 24818120, -4743133, -11194191, -5645734, 5150968, 7274186},
|
||||
{2831366, -12492146, 1478975, 6122054, 23825128, -12733586, 31097299, 6083058, 31021603, -9793610},
|
||||
{-2529932, -2229646, 445613, 10720828, -13849527, -11505937, -23507731, 16354465, 15067285, -14147707}},
|
||||
{{7840942, 14037873, -33364863, 15934016, -728213, -3642706, 21403988, 1057586, -19379462, -12403220},
|
||||
{915865, -16469274, 15608285, -8789130, -24357026, 6060030, -17371319, 8410997, -7220461, 16527025},
|
||||
{32922597, -556987, 20336074, -16184568, 10903705, -5384487, 16957574, 52992, 23834301, 6588044}},
|
||||
{{32752030, 11232950, 3381995, -8714866, 22652988, -10744103, 17159699, 16689107, -20314580, -1305992},
|
||||
{-4689649, 9166776, -25710296, -10847306, 11576752, 12733943, 7924251, -2752281, 1976123, -7249027},
|
||||
{21251222, 16309901, -2983015, -6783122, 30810597, 12967303, 156041, -3371252, 12331345, -8237197}},
|
||||
{{8651614, -4477032, -16085636, -4996994, 13002507, 2950805, 29054427, -5106970, 10008136, -4667901},
|
||||
{31486080, 15114593, -14261250, 12951354, 14369431, -7387845, 16347321, -13662089, 8684155, -10532952},
|
||||
{19443825, 11385320, 24468943, -9659068, -23919258, 2187569, -26263207, -6086921, 31316348, 14219878}},
|
||||
{{-28594490, 1193785, 32245219, 11392485, 31092169, 15722801, 27146014, 6992409, 29126555, 9207390},
|
||||
{32382935, 1110093, 18477781, 11028262, -27411763, -7548111, -4980517, 10843782, -7957600, -14435730},
|
||||
{2814918, 7836403, 27519878, -7868156, -20894015, -11553689, -21494559, 8550130, 28346258, 1994730}},
|
||||
{{-19578299, 8085545, -14000519, -3948622, 2785838, -16231307, -19516951, 7174894, 22628102, 8115180},
|
||||
{-30405132, 955511, -11133838, -15078069, -32447087, -13278079, -25651578, 3317160, -9943017, 930272},
|
||||
{-15303681, -6833769, 28856490, 1357446, 23421993, 1057177, 24091212, -1388970, -22765376, -10650715}},
|
||||
{{-22751231, -5303997, -12907607, -12768866, -15811511, -7797053, -14839018, -16554220, -1867018, 8398970},
|
||||
{-31969310, 2106403, -4736360, 1362501, 12813763, 16200670, 22981545, -6291273, 18009408, -15772772},
|
||||
{-17220923, -9545221, -27784654, 14166835, 29815394, 7444469, 29551787, -3727419, 19288549, 1325865}},
|
||||
{{15100157, -15835752, -23923978, -1005098, -26450192, 15509408, 12376730, -3479146, 33166107, -8042750},
|
||||
{20909231, 13023121, -9209752, 16251778, -5778415, -8094914, 12412151, 10018715, 2213263, -13878373},
|
||||
{32529814, -11074689, 30361439, -16689753, -9135940, 1513226, 22922121, 6382134, -5766928, 8371348}}
|
||||
}, {
|
||||
{{9923462, 11271500, 12616794, 3544722, -29998368, -1721626, 12891687, -8193132, -26442943, 10486144},
|
||||
{-22597207, -7012665, 8587003, -8257861, 4084309, -12970062, 361726, 2610596, -23921530, -11455195},
|
||||
{5408411, -1136691, -4969122, 10561668, 24145918, 14240566, 31319731, -4235541, 19985175, -3436086}},
|
||||
{{-13994457, 16616821, 14549246, 3341099, 32155958, 13648976, -17577068, 8849297, 65030, 8370684},
|
||||
{-8320926, -12049626, 31204563, 5839400, -20627288, -1057277, -19442942, 6922164, 12743482, -9800518},
|
||||
{-2361371, 12678785, 28815050, 4759974, -23893047, 4884717, 23783145, 11038569, 18800704, 255233}},
|
||||
{{-5269658, -1773886, 13957886, 7990715, 23132995, 728773, 13393847, 9066957, 19258688, -14753793},
|
||||
{-2936654, -10827535, -10432089, 14516793, -3640786, 4372541, -31934921, 2209390, -1524053, 2055794},
|
||||
{580882, 16705327, 5468415, -2683018, -30926419, -14696000, -7203346, -8994389, -30021019, 7394435}},
|
||||
{{23838809, 1822728, -15738443, 15242727, 8318092, -3733104, -21672180, -3492205, -4821741, 14799921},
|
||||
{13345610, 9759151, 3371034, -16137791, 16353039, 8577942, 31129804, 13496856, -9056018, 7402518},
|
||||
{2286874, -4435931, -20042458, -2008336, -13696227, 5038122, 11006906, -15760352, 8205061, 1607563}},
|
||||
{{14414086, -8002132, 3331830, -3208217, 22249151, -5594188, 18364661, -2906958, 30019587, -9029278},
|
||||
{-27688051, 1585953, -10775053, 931069, -29120221, -11002319, -14410829, 12029093, 9944378, 8024},
|
||||
{4368715, -3709630, 29874200, -15022983, -20230386, -11410704, -16114594, -999085, -8142388, 5640030}},
|
||||
{{10299610, 13746483, 11661824, 16234854, 7630238, 5998374, 9809887, -16694564, 15219798, -14327783},
|
||||
{27425505, -5719081, 3055006, 10660664, 23458024, 595578, -15398605, -1173195, -18342183, 9742717},
|
||||
{6744077, 2427284, 26042789, 2720740, -847906, 1118974, 32324614, 7406442, 12420155, 1994844}},
|
||||
{{14012521, -5024720, -18384453, -9578469, -26485342, -3936439, -13033478, -10909803, 24319929, -6446333},
|
||||
{16412690, -4507367, 10772641, 15929391, -17068788, -4658621, 10555945, -10484049, -30102368, -4739048},
|
||||
{22397382, -7767684, -9293161, -12792868, 17166287, -9755136, -27333065, 6199366, 21880021, -12250760}},
|
||||
{{-4283307, 5368523, -31117018, 8163389, -30323063, 3209128, 16557151, 8890729, 8840445, 4957760},
|
||||
{-15447727, 709327, -6919446, -10870178, -29777922, 6522332, -21720181, 12130072, -14796503, 5005757},
|
||||
{-2114751, -14308128, 23019042, 15765735, -25269683, 6002752, 10183197, -13239326, -16395286, -2176112}}
|
||||
}, {
|
||||
{{-19025756, 1632005, 13466291, -7995100, -23640451, 16573537, -32013908, -3057104, 22208662, 2000468},
|
||||
{3065073, -1412761, -25598674, -361432, -17683065, -5703415, -8164212, 11248527, -3691214, -7414184},
|
||||
{10379208, -6045554, 8877319, 1473647, -29291284, -12507580, 16690915, 2553332, -3132688, 16400289}},
|
||||
{{15716668, 1254266, -18472690, 7446274, -8448918, 6344164, -22097271, -7285580, 26894937, 9132066},
|
||||
{24158887, 12938817, 11085297, -8177598, -28063478, -4457083, -30576463, 64452, -6817084, -2692882},
|
||||
{13488534, 7794716, 22236231, 5989356, 25426474, -12578208, 2350710, -3418511, -4688006, 2364226}},
|
||||
{{16335052, 9132434, 25640582, 6678888, 1725628, 8517937, -11807024, -11697457, 15445875, -7798101},
|
||||
{29004207, -7867081, 28661402, -640412, -12794003, -7943086, 31863255, -4135540, -278050, -15759279},
|
||||
{-6122061, -14866665, -28614905, 14569919, -10857999, -3591829, 10343412, -6976290, -29828287, -10815811}},
|
||||
{{27081650, 3463984, 14099042, -4517604, 1616303, -6205604, 29542636, 15372179, 17293797, 960709},
|
||||
{20263915, 11434237, -5765435, 11236810, 13505955, -10857102, -16111345, 6493122, -19384511, 7639714},
|
||||
{-2830798, -14839232, 25403038, -8215196, -8317012, -16173699, 18006287, -16043750, 29994677, -15808121}},
|
||||
{{9769828, 5202651, -24157398, -13631392, -28051003, -11561624, -24613141, -13860782, -31184575, 709464},
|
||||
{12286395, 13076066, -21775189, -1176622, -25003198, 4057652, -32018128, -8890874, 16102007, 13205847},
|
||||
{13733362, 5599946, 10557076, 3195751, -5557991, 8536970, -25540170, 8525972, 10151379, 10394400}},
|
||||
{{4024660, -16137551, 22436262, 12276534, -9099015, -2686099, 19698229, 11743039, -33302334, 8934414},
|
||||
{-15879800, -4525240, -8580747, -2934061, 14634845, -698278, -9449077, 3137094, -11536886, 11721158},
|
||||
{17555939, -5013938, 8268606, 2331751, -22738815, 9761013, 9319229, 8835153, -9205489, -1280045}},
|
||||
{{-461409, -7830014, 20614118, 16688288, -7514766, -4807119, 22300304, 505429, 6108462, -6183415},
|
||||
{-5070281, 12367917, -30663534, 3234473, 32617080, -8422642, 29880583, -13483331, -26898490, -7867459},
|
||||
{-31975283, 5726539, 26934134, 10237677, -3173717, -605053, 24199304, 3795095, 7592688, -14992079}},
|
||||
{{21594432, -14964228, 17466408, -4077222, 32537084, 2739898, 6407723, 12018833, -28256052, 4298412},
|
||||
{-20650503, -11961496, -27236275, 570498, 3767144, -1717540, 13891942, -1569194, 13717174, 10805743},
|
||||
{-14676630, -15644296, 15287174, 11927123, 24177847, -8175568, -796431, 14860609, -26938930, -5863836}}
|
||||
}, {
|
||||
{{12962541, 5311799, -10060768, 11658280, 18855286, -7954201, 13286263, -12808704, -4381056, 9882022},
|
||||
{18512079, 11319350, -20123124, 15090309, 18818594, 5271736, -22727904, 3666879, -23967430, -3299429},
|
||||
{-6789020, -3146043, 16192429, 13241070, 15898607, -14206114, -10084880, -6661110, -2403099, 5276065}},
|
||||
{{30169808, -5317648, 26306206, -11750859, 27814964, 7069267, 7152851, 3684982, 1449224, 13082861},
|
||||
{10342826, 3098505, 2119311, 193222, 25702612, 12233820, 23697382, 15056736, -21016438, -8202000},
|
||||
{-33150110, 3261608, 22745853, 7948688, 19370557, -15177665, -26171976, 6482814, -10300080, -11060101}},
|
||||
{{32869458, -5408545, 25609743, 15678670, -10687769, -15471071, 26112421, 2521008, -22664288, 6904815},
|
||||
{29506923, 4457497, 3377935, -9796444, -30510046, 12935080, 1561737, 3841096, -29003639, -6657642},
|
||||
{10340844, -6630377, -18656632, -2278430, 12621151, -13339055, 30878497, -11824370, -25584551, 5181966}},
|
||||
{{25940115, -12658025, 17324188, -10307374, -8671468, 15029094, 24396252, -16450922, -2322852, -12388574},
|
||||
{-21765684, 9916823, -1300409, 4079498, -1028346, 11909559, 1782390, 12641087, 20603771, -6561742},
|
||||
{-18882287, -11673380, 24849422, 11501709, 13161720, -4768874, 1925523, 11914390, 4662781, 7820689}},
|
||||
{{12241050, -425982, 8132691, 9393934, 32846760, -1599620, 29749456, 12172924, 16136752, 15264020},
|
||||
{-10349955, -14680563, -8211979, 2330220, -17662549, -14545780, 10658213, 6671822, 19012087, 3772772},
|
||||
{3753511, -3421066, 10617074, 2028709, 14841030, -6721664, 28718732, -15762884, 20527771, 12988982}},
|
||||
{{-14822485, -5797269, -3707987, 12689773, -898983, -10914866, -24183046, -10564943, 3299665, -12424953},
|
||||
{-16777703, -15253301, -9642417, 4978983, 3308785, 8755439, 6943197, 6461331, -25583147, 8991218},
|
||||
{-17226263, 1816362, -1673288, -6086439, 31783888, -8175991, -32948145, 7417950, -30242287, 1507265}},
|
||||
{{29692663, 6829891, -10498800, 4334896, 20945975, -11906496, -28887608, 8209391, 14606362, -10647073},
|
||||
{-3481570, 8707081, 32188102, 5672294, 22096700, 1711240, -33020695, 9761487, 4170404, -2085325},
|
||||
{-11587470, 14855945, -4127778, -1531857, -26649089, 15084046, 22186522, 16002000, -14276837, -8400798}},
|
||||
{{-4811456, 13761029, -31703877, -2483919, -3312471, 7869047, -7113572, -9620092, 13240845, 10965870},
|
||||
{-7742563, -8256762, -14768334, -13656260, -23232383, 12387166, 4498947, 14147411, 29514390, 4302863},
|
||||
{-13413405, -12407859, 20757302, -13801832, 14785143, 8976368, -5061276, -2144373, 17846988, -13971927}}
|
||||
}, {
|
||||
{{-2244452, -754728, -4597030, -1066309, -6247172, 1455299, -21647728, -9214789, -5222701, 12650267},
|
||||
{-9906797, -16070310, 21134160, 12198166, -27064575, 708126, 387813, 13770293, -19134326, 10958663},
|
||||
{22470984, 12369526, 23446014, -5441109, -21520802, -9698723, -11772496, -11574455, -25083830, 4271862}},
|
||||
{{-25169565, -10053642, -19909332, 15361595, -5984358, 2159192, 75375, -4278529, -32526221, 8469673},
|
||||
{15854970, 4148314, -8893890, 7259002, 11666551, 13824734, -30531198, 2697372, 24154791, -9460943},
|
||||
{15446137, -15806644, 29759747, 14019369, 30811221, -9610191, -31582008, 12840104, 24913809, 9815020}},
|
||||
{{-4709286, -5614269, -31841498, -12288893, -14443537, 10799414, -9103676, 13438769, 18735128, 9466238},
|
||||
{11933045, 9281483, 5081055, -5183824, -2628162, -4905629, -7727821, -10896103, -22728655, 16199064},
|
||||
{14576810, 379472, -26786533, -8317236, -29426508, -10812974, -102766, 1876699, 30801119, 2164795}},
|
||||
{{15995086, 3199873, 13672555, 13712240, -19378835, -4647646, -13081610, -15496269, -13492807, 1268052},
|
||||
{-10290614, -3659039, -3286592, 10948818, 23037027, 3794475, -3470338, -12600221, -17055369, 3565904},
|
||||
{29210088, -9419337, -5919792, -4952785, 10834811, -13327726, -16512102, -10820713, -27162222, -14030531}},
|
||||
{{-13161890, 15508588, 16663704, -8156150, -28349942, 9019123, -29183421, -3769423, 2244111, -14001979},
|
||||
{-5152875, -3800936, -9306475, -6071583, 16243069, 14684434, -25673088, -16180800, 13491506, 4641841},
|
||||
{10813417, 643330, -19188515, -728916, 30292062, -16600078, 27548447, -7721242, 14476989, -12767431}},
|
||||
{{10292079, 9984945, 6481436, 8279905, -7251514, 7032743, 27282937, -1644259, -27912810, 12651324},
|
||||
{-31185513, -813383, 22271204, 11835308, 10201545, 15351028, 17099662, 3988035, 21721536, -3148940},
|
||||
{10202177, -6545839, -31373232, -9574638, -32150642, -8119683, -12906320, 3852694, 13216206, 14842320}},
|
||||
{{-15815640, -10601066, -6538952, -7258995, -6984659, -6581778, -31500847, 13765824, -27434397, 9900184},
|
||||
{14465505, -13833331, -32133984, -14738873, -27443187, 12990492, 33046193, 15796406, -7051866, -8040114},
|
||||
{30924417, -8279620, 6359016, -12816335, 16508377, 9071735, -25488601, 15413635, 9524356, -7018878}},
|
||||
{{12274201, -13175547, 32627641, -1785326, 6736625, 13267305, 5237659, -5109483, 15663516, 4035784},
|
||||
{-2951309, 8903985, 17349946, 601635, -16432815, -4612556, -13732739, -15889334, -22258478, 4659091},
|
||||
{-16916263, -4952973, -30393711, -15158821, 20774812, 15897498, 5736189, 15026997, -2178256, -13455585}}
|
||||
}, {
|
||||
{{-8858980, -2219056, 28571666, -10155518, -474467, -10105698, -3801496, 278095, 23440562, -290208},
|
||||
{10226241, -5928702, 15139956, 120818, -14867693, 5218603, 32937275, 11551483, -16571960, -7442864},
|
||||
{17932739, -12437276, -24039557, 10749060, 11316803, 7535897, 22503767, 5561594, -3646624, 3898661}},
|
||||
{{7749907, -969567, -16339731, -16464, -25018111, 15122143, -1573531, 7152530, 21831162, 1245233},
|
||||
{26958459, -14658026, 4314586, 8346991, -5677764, 11960072, -32589295, -620035, -30402091, -16716212},
|
||||
{-12165896, 9166947, 33491384, 13673479, 29787085, 13096535, 6280834, 14587357, -22338025, 13987525}},
|
||||
{{-24349909, 7778775, 21116000, 15572597, -4833266, -5357778, -4300898, -5124639, -7469781, -2858068},
|
||||
{9681908, -6737123, -31951644, 13591838, -6883821, 386950, 31622781, 6439245, -14581012, 4091397},
|
||||
{-8426427, 1470727, -28109679, -1596990, 3978627, -5123623, -19622683, 12092163, 29077877, -14741988}},
|
||||
{{5269168, -6859726, -13230211, -8020715, 25932563, 1763552, -5606110, -5505881, -20017847, 2357889},
|
||||
{32264008, -15407652, -5387735, -1160093, -2091322, -3946900, 23104804, -12869908, 5727338, 189038},
|
||||
{14609123, -8954470, -6000566, -16622781, -14577387, -7743898, -26745169, 10942115, -25888931, -14884697}},
|
||||
{{20513500, 5557931, -15604613, 7829531, 26413943, -2019404, -21378968, 7471781, 13913677, -5137875},
|
||||
{-25574376, 11967826, 29233242, 12948236, -6754465, 4713227, -8940970, 14059180, 12878652, 8511905},
|
||||
{-25656801, 3393631, -2955415, -7075526, -2250709, 9366908, -30223418, 6812974, 5568676, -3127656}},
|
||||
{{11630004, 12144454, 2116339, 13606037, 27378885, 15676917, -17408753, -13504373, -14395196, 8070818},
|
||||
{27117696, -10007378, -31282771, -5570088, 1127282, 12772488, -29845906, 10483306, -11552749, -1028714},
|
||||
{10637467, -5688064, 5674781, 1072708, -26343588, -6982302, -1683975, 9177853, -27493162, 15431203}},
|
||||
{{20525145, 10892566, -12742472, 12779443, -29493034, 16150075, -28240519, 14943142, -15056790, -7935931},
|
||||
{-30024462, 5626926, -551567, -9981087, 753598, 11981191, 25244767, -3239766, -3356550, 9594024},
|
||||
{-23752644, 2636870, -5163910, -10103818, 585134, 7877383, 11345683, -6492290, 13352335, -10977084}},
|
||||
{{-1931799, -5407458, 3304649, -12884869, 17015806, -4877091, -29783850, -7752482, -13215537, -319204},
|
||||
{20239939, 6607058, 6203985, 3483793, -18386976, -779229, -20723742, 15077870, -22750759, 14523817},
|
||||
{27406042, -6041657, 27423596, -4497394, 4996214, 10002360, -28842031, -4545494, -30172742, -4805667}}
|
||||
}, {
|
||||
{{11374242, 12660715, 17861383, -12540833, 10935568, 1099227, -13886076, -9091740, -27727044, 11358504},
|
||||
{-12730809, 10311867, 1510375, 10778093, -2119455, -9145702, 32676003, 11149336, -26123651, 4985768},
|
||||
{-19096303, 341147, -6197485, -239033, 15756973, -8796662, -983043, 13794114, -19414307, -15621255}},
|
||||
{{6490081, 11940286, 25495923, -7726360, 8668373, -8751316, 3367603, 6970005, -1691065, -9004790},
|
||||
{1656497, 13457317, 15370807, 6364910, 13605745, 8362338, -19174622, -5475723, -16796596, -5031438},
|
||||
{-22273315, -13524424, -64685, -4334223, -18605636, -10921968, -20571065, -7007978, -99853, -10237333}},
|
||||
{{17747465, 10039260, 19368299, -4050591, -20630635, -16041286, 31992683, -15857976, -29260363, -5511971},
|
||||
{31932027, -4986141, -19612382, 16366580, 22023614, 88450, 11371999, -3744247, 4882242, -10626905},
|
||||
{29796507, 37186, 19818052, 10115756, -11829032, 3352736, 18551198, 3272828, -5190932, -4162409}},
|
||||
{{12501286, 4044383, -8612957, -13392385, -32430052, 5136599, -19230378, -3529697, 330070, -3659409},
|
||||
{6384877, 2899513, 17807477, 7663917, -2358888, 12363165, 25366522, -8573892, -271295, 12071499},
|
||||
{-8365515, -4042521, 25133448, -4517355, -6211027, 2265927, -32769618, 1936675, -5159697, 3829363}},
|
||||
{{28425966, -5835433, -577090, -4697198, -14217555, 6870930, 7921550, -6567787, 26333140, 14267664},
|
||||
{-11067219, 11871231, 27385719, -10559544, -4585914, -11189312, 10004786, -8709488, -21761224, 8930324},
|
||||
{-21197785, -16396035, 25654216, -1725397, 12282012, 11008919, 1541940, 4757911, -26491501, -16408940}},
|
||||
{{13537262, -7759490, -20604840, 10961927, -5922820, -13218065, -13156584, 6217254, -15943699, 13814990},
|
||||
{-17422573, 15157790, 18705543, 29619, 24409717, -260476, 27361681, 9257833, -1956526, -1776914},
|
||||
{-25045300, -10191966, 15366585, 15166509, -13105086, 8423556, -29171540, 12361135, -18685978, 4578290}},
|
||||
{{24579768, 3711570, 1342322, -11180126, -27005135, 14124956, -22544529, 14074919, 21964432, 8235257},
|
||||
{-6528613, -2411497, 9442966, -5925588, 12025640, -1487420, -2981514, -1669206, 13006806, 2355433},
|
||||
{-16304899, -13605259, -6632427, -5142349, 16974359, -10911083, 27202044, 1719366, 1141648, -12796236}},
|
||||
{{-12863944, -13219986, -8318266, -11018091, -6810145, -4843894, 13475066, -3133972, 32674895, 13715045},
|
||||
{11423335, -5468059, 32344216, 8962751, 24989809, 9241752, -13265253, 16086212, -28740881, -15642093},
|
||||
{-1409668, 12530728, -6368726, 10847387, 19531186, -14132160, -11709148, 7791794, -27245943, 4383347}}
|
||||
}, {
|
||||
{{-28970898, 5271447, -1266009, -9736989, -12455236, 16732599, -4862407, -4906449, 27193557, 6245191},
|
||||
{-15193956, 5362278, -1783893, 2695834, 4960227, 12840725, 23061898, 3260492, 22510453, 8577507},
|
||||
{-12632451, 11257346, -32692994, 13548177, -721004, 10879011, 31168030, 13952092, -29571492, -3635906}},
|
||||
{{3877321, -9572739, 32416692, 5405324, -11004407, -13656635, 3759769, 11935320, 5611860, 8164018},
|
||||
{-16275802, 14667797, 15906460, 12155291, -22111149, -9039718, 32003002, -8832289, 5773085, -8422109},
|
||||
{-23788118, -8254300, 1950875, 8937633, 18686727, 16459170, -905725, 12376320, 31632953, 190926}},
|
||||
{{-24593607, -16138885, -8423991, 13378746, 14162407, 6901328, -8288749, 4508564, -25341555, -3627528},
|
||||
{8884438, -5884009, 6023974, 10104341, -6881569, -4941533, 18722941, -14786005, -1672488, 827625},
|
||||
{-32720583, -16289296, -32503547, 7101210, 13354605, 2659080, -1800575, -14108036, -24878478, 1541286}},
|
||||
{{2901347, -1117687, 3880376, -10059388, -17620940, -3612781, -21802117, -3567481, 20456845, -1885033},
|
||||
{27019610, 12299467, -13658288, -1603234, -12861660, -4861471, -19540150, -5016058, 29439641, 15138866},
|
||||
{21536104, -6626420, -32447818, -10690208, -22408077, 5175814, -5420040, -16361163, 7779328, 109896}},
|
||||
{{30279744, 14648750, -8044871, 6425558, 13639621, -743509, 28698390, 12180118, 23177719, -554075},
|
||||
{26572847, 3405927, -31701700, 12890905, -19265668, 5335866, -6493768, 2378492, 4439158, -13279347},
|
||||
{-22716706, 3489070, -9225266, -332753, 18875722, -1140095, 14819434, -12731527, -17717757, -5461437}},
|
||||
{{-5056483, 16566551, 15953661, 3767752, -10436499, 15627060, -820954, 2177225, 8550082, -15114165},
|
||||
{-18473302, 16596775, -381660, 15663611, 22860960, 15585581, -27844109, -3582739, -23260460, -8428588},
|
||||
{-32480551, 15707275, -8205912, -5652081, 29464558, 2713815, -22725137, 15860482, -21902570, 1494193}},
|
||||
{{-19562091, -14087393, -25583872, -9299552, 13127842, 759709, 21923482, 16529112, 8742704, 12967017},
|
||||
{-28464899, 1553205, 32536856, -10473729, -24691605, -406174, -8914625, -2933896, -29903758, 15553883},
|
||||
{21877909, 3230008, 9881174, 10539357, -4797115, 2841332, 11543572, 14513274, 19375923, -12647961}},
|
||||
{{8832269, -14495485, 13253511, 5137575, 5037871, 4078777, 24880818, -6222716, 2862653, 9455043},
|
||||
{29306751, 5123106, 20245049, -14149889, 9592566, 8447059, -2077124, -2990080, 15511449, 4789663},
|
||||
{-20679756, 7004547, 8824831, -9434977, -4045704, -3750736, -5754762, 108893, 23513200, 16652362}}
|
||||
}, {
|
||||
{{-33256173, 4144782, -4476029, -6579123, 10770039, -7155542, -6650416, -12936300, -18319198, 10212860},
|
||||
{2756081, 8598110, 7383731, -6859892, 22312759, -1105012, 21179801, 2600940, -9988298, -12506466},
|
||||
{-24645692, 13317462, -30449259, -15653928, 21365574, -10869657, 11344424, 864440, -2499677, -16710063}},
|
||||
{{-26432803, 6148329, -17184412, -14474154, 18782929, -275997, -22561534, 211300, 2719757, 4940997},
|
||||
{-1323882, 3911313, -6948744, 14759765, -30027150, 7851207, 21690126, 8518463, 26699843, 5276295},
|
||||
{-13149873, -6429067, 9396249, 365013, 24703301, -10488939, 1321586, 149635, -15452774, 7159369}},
|
||||
{{9987780, -3404759, 17507962, 9505530, 9731535, -2165514, 22356009, 8312176, 22477218, -8403385},
|
||||
{18155857, -16504990, 19744716, 9006923, 15154154, -10538976, 24256460, -4864995, -22548173, 9334109},
|
||||
{2986088, -4911893, 10776628, -3473844, 10620590, -7083203, -21413845, 14253545, -22587149, 536906}},
|
||||
{{4377756, 8115836, 24567078, 15495314, 11625074, 13064599, 7390551, 10589625, 10838060, -15420424},
|
||||
{-19342404, 867880, 9277171, -3218459, -14431572, -1986443, 19295826, -15796950, 6378260, 699185},
|
||||
{7895026, 4057113, -7081772, -13077756, -17886831, -323126, -716039, 15693155, -5045064, -13373962}},
|
||||
{{-7737563, -5869402, -14566319, -7406919, 11385654, 13201616, 31730678, -10962840, -3918636, -9669325},
|
||||
{10188286, -15770834, -7336361, 13427543, 22223443, 14896287, 30743455, 7116568, -21786507, 5427593},
|
||||
{696102, 13206899, 27047647, -10632082, 15285305, -9853179, 10798490, -4578720, 19236243, 12477404}},
|
||||
{{-11229439, 11243796, -17054270, -8040865, -788228, -8167967, -3897669, 11180504, -23169516, 7733644},
|
||||
{17800790, -14036179, -27000429, -11766671, 23887827, 3149671, 23466177, -10538171, 10322027, 15313801},
|
||||
{26246234, 11968874, 32263343, -5468728, 6830755, -13323031, -15794704, -101982, -24449242, 10890804}},
|
||||
{{-31365647, 10271363, -12660625, -6267268, 16690207, -13062544, -14982212, 16484931, 25180797, -5334884},
|
||||
{-586574, 10376444, -32586414, -11286356, 19801893, 10997610, 2276632, 9482883, 316878, 13820577},
|
||||
{-9882808, -4510367, -2115506, 16457136, -11100081, 11674996, 30756178, -7515054, 30696930, -3712849}},
|
||||
{{32988917, -9603412, 12499366, 7910787, -10617257, -11931514, -7342816, -9985397, -32349517, 7392473},
|
||||
{-8855661, 15927861, 9866406, -3649411, -2396914, -16655781, -30409476, -9134995, 25112947, -2926644},
|
||||
{-2504044, -436966, 25621774, -5678772, 15085042, -5479877, -24884878, -13526194, 5537438, -13914319}}
|
||||
}, {
|
||||
{{-11225584, 2320285, -9584280, 10149187, -33444663, 5808648, -14876251, -1729667, 31234590, 6090599},
|
||||
{-9633316, 116426, 26083934, 2897444, -6364437, -2688086, 609721, 15878753, -6970405, -9034768},
|
||||
{-27757857, 247744, -15194774, -9002551, 23288161, -10011936, -23869595, 6503646, 20650474, 1804084}},
|
||||
{{-27589786, 15456424, 8972517, 8469608, 15640622, 4439847, 3121995, -10329713, 27842616, -202328},
|
||||
{-15306973, 2839644, 22530074, 10026331, 4602058, 5048462, 28248656, 5031932, -11375082, 12714369},
|
||||
{20807691, -7270825, 29286141, 11421711, -27876523, -13868230, -21227475, 1035546, -19733229, 12796920}},
|
||||
{{12076899, -14301286, -8785001, -11848922, -25012791, 16400684, -17591495, -12899438, 3480665, -15182815},
|
||||
{-32361549, 5457597, 28548107, 7833186, 7303070, -11953545, -24363064, -15921875, -33374054, 2771025},
|
||||
{-21389266, 421932, 26597266, 6860826, 22486084, -6737172, -17137485, -4210226, -24552282, 15673397}},
|
||||
{{-20184622, 2338216, 19788685, -9620956, -4001265, -8740893, -20271184, 4733254, 3727144, -12934448},
|
||||
{6120119, 814863, -11794402, -622716, 6812205, -15747771, 2019594, 7975683, 31123697, -10958981},
|
||||
{30069250, -11435332, 30434654, 2958439, 18399564, -976289, 12296869, 9204260, -16432438, 9648165}},
|
||||
{{32705432, -1550977, 30705658, 7451065, -11805606, 9631813, 3305266, 5248604, -26008332, -11377501},
|
||||
{17219865, 2375039, -31570947, -5575615, -19459679, 9219903, 294711, 15298639, 2662509, -16297073},
|
||||
{-1172927, -7558695, -4366770, -4287744, -21346413, -8434326, 32087529, -1222777, 32247248, -14389861}},
|
||||
{{14312628, 1221556, 17395390, -8700143, -4945741, -8684635, -28197744, -9637817, -16027623, -13378845},
|
||||
{-1428825, -9678990, -9235681, 6549687, -7383069, -468664, 23046502, 9803137, 17597934, 2346211},
|
||||
{18510800, 15337574, 26171504, 981392, -22241552, 7827556, -23491134, -11323352, 3059833, -11782870}},
|
||||
{{10141598, 6082907, 17829293, -1947643, 9830092, 13613136, -25556636, -5544586, -33502212, 3592096},
|
||||
{33114168, -15889352, -26525686, -13343397, 33076705, 8716171, 1151462, 1521897, -982665, -6837803},
|
||||
{-32939165, -4255815, 23947181, -324178, -33072974, -12305637, -16637686, 3891704, 26353178, 693168}},
|
||||
{{30374239, 1595580, -16884039, 13186931, 4600344, 406904, 9585294, -400668, 31375464, 14369965},
|
||||
{-14370654, -7772529, 1510301, 6434173, -18784789, -6262728, 32732230, -13108839, 17901441, 16011505},
|
||||
{18171223, -11934626, -12500402, 15197122, -11038147, -15230035, -19172240, -16046376, 8764035, 12309598}}
|
||||
}, {
|
||||
{{5975908, -5243188, -19459362, -9681747, -11541277, 14015782, -23665757, 1228319, 17544096, -10593782},
|
||||
{5811932, -1715293, 3442887, -2269310, -18367348, -8359541, -18044043, -15410127, -5565381, 12348900},
|
||||
{-31399660, 11407555, 25755363, 6891399, -3256938, 14872274, -24849353, 8141295, -10632534, -585479}},
|
||||
{{-12675304, 694026, -5076145, 13300344, 14015258, -14451394, -9698672, -11329050, 30944593, 1130208},
|
||||
{8247766, -6710942, -26562381, -7709309, -14401939, -14648910, 4652152, 2488540, 23550156, -271232},
|
||||
{17294316, -3788438, 7026748, 15626851, 22990044, 113481, 2267737, -5908146, -408818, -137719}},
|
||||
{{16091085, -16253926, 18599252, 7340678, 2137637, -1221657, -3364161, 14550936, 3260525, -7166271},
|
||||
{-4910104, -13332887, 18550887, 10864893, -16459325, -7291596, -23028869, -13204905, -12748722, 2701326},
|
||||
{-8574695, 16099415, 4629974, -16340524, -20786213, -6005432, -10018363, 9276971, 11329923, 1862132}},
|
||||
{{14763076, -15903608, -30918270, 3689867, 3511892, 10313526, -21951088, 12219231, -9037963, -940300},
|
||||
{8894987, -3446094, 6150753, 3013931, 301220, 15693451, -31981216, -2909717, -15438168, 11595570},
|
||||
{15214962, 3537601, -26238722, -14058872, 4418657, -15230761, 13947276, 10730794, -13489462, -4363670}},
|
||||
{{-2538306, 7682793, 32759013, 263109, -29984731, -7955452, -22332124, -10188635, 977108, 699994},
|
||||
{-12466472, 4195084, -9211532, 550904, -15565337, 12917920, 19118110, -439841, -30534533, -14337913},
|
||||
{31788461, -14507657, 4799989, 7372237, 8808585, -14747943, 9408237, -10051775, 12493932, -5409317}},
|
||||
{{-25680606, 5260744, -19235809, -6284470, -3695942, 16566087, 27218280, 2607121, 29375955, 6024730},
|
||||
{842132, -2794693, -4763381, -8722815, 26332018, -12405641, 11831880, 6985184, -9940361, 2854096},
|
||||
{-4847262, -7969331, 2516242, -5847713, 9695691, -7221186, 16512645, 960770, 12121869, 16648078}},
|
||||
{{-15218652, 14667096, -13336229, 2013717, 30598287, -464137, -31504922, -7882064, 20237806, 2838411},
|
||||
{-19288047, 4453152, 15298546, -16178388, 22115043, -15972604, 12544294, -13470457, 1068881, -12499905},
|
||||
{-9558883, -16518835, 33238498, 13506958, 30505848, -1114596, -8486907, -2630053, 12521378, 4845654}},
|
||||
{{-28198521, 10744108, -2958380, 10199664, 7759311, -13088600, 3409348, -873400, -6482306, -12885870},
|
||||
{-23561822, 6230156, -20382013, 10655314, -24040585, -11621172, 10477734, -1240216, -3113227, 13974498},
|
||||
{12966261, 15550616, -32038948, -1615346, 21025980, -629444, 5642325, 7188737, 18895762, 12629579}}
|
||||
}, {
|
||||
{{14741879, -14946887, 22177208, -11721237, 1279741, 8058600, 11758140, 789443, 32195181, 3895677},
|
||||
{10758205, 15755439, -4509950, 9243698, -4879422, 6879879, -2204575, -3566119, -8982069, 4429647},
|
||||
{-2453894, 15725973, -20436342, -10410672, -5803908, -11040220, -7135870, -11642895, 18047436, -15281743}},
|
||||
{{-25173001, -11307165, 29759956, 11776784, -22262383, -15820455, 10993114, -12850837, -17620701, -9408468},
|
||||
{21987233, 700364, -24505048, 14972008, -7774265, -5718395, 32155026, 2581431, -29958985, 8773375},
|
||||
{-25568350, 454463, -13211935, 16126715, 25240068, 8594567, 20656846, 12017935, -7874389, -13920155}},
|
||||
{{6028182, 6263078, -31011806, -11301710, -818919, 2461772, -31841174, -5468042, -1721788, -2776725},
|
||||
{-12278994, 16624277, 987579, -5922598, 32908203, 1248608, 7719845, -4166698, 28408820, 6816612},
|
||||
{-10358094, -8237829, 19549651, -12169222, 22082623, 16147817, 20613181, 13982702, -10339570, 5067943}},
|
||||
{{-30505967, -3821767, 12074681, 13582412, -19877972, 2443951, -19719286, 12746132, 5331210, -10105944},
|
||||
{30528811, 3601899, -1957090, 4619785, -27361822, -15436388, 24180793, -12570394, 27679908, -1648928},
|
||||
{9402404, -13957065, 32834043, 10838634, -26580150, -13237195, 26653274, -8685565, 22611444, -12715406}},
|
||||
{{22190590, 1118029, 22736441, 15130463, -30460692, -5991321, 19189625, -4648942, 4854859, 6622139},
|
||||
{-8310738, -2953450, -8262579, -3388049, -10401731, -271929, 13424426, -3567227, 26404409, 13001963},
|
||||
{-31241838, -15415700, -2994250, 8939346, 11562230, -12840670, -26064365, -11621720, -15405155, 11020693}},
|
||||
{{1866042, -7949489, -7898649, -10301010, 12483315, 13477547, 3175636, -12424163, 28761762, 1406734},
|
||||
{-448555, -1777666, 13018551, 3194501, -9580420, -11161737, 24760585, -4347088, 25577411, -13378680},
|
||||
{-24290378, 4759345, -690653, -1852816, 2066747, 10693769, -29595790, 9884936, -9368926, 4745410}},
|
||||
{{-9141284, 6049714, -19531061, -4341411, -31260798, 9944276, -15462008, -11311852, 10931924, -11931931},
|
||||
{-16561513, 14112680, -8012645, 4817318, -8040464, -11414606, -22853429, 10856641, -20470770, 13434654},
|
||||
{22759489, -10073434, -16766264, -1871422, 13637442, -10168091, 1765144, -12654326, 28445307, -5364710}},
|
||||
{{29875063, 12493613, 2795536, -3786330, 1710620, 15181182, -10195717, -8788675, 9074234, 1167180},
|
||||
{-26205683, 11014233, -9842651, -2635485, -26908120, 7532294, -18716888, -9535498, 3843903, 9367684},
|
||||
{-10969595, -6403711, 9591134, 9582310, 11349256, 108879, 16235123, 8601684, -139197, 4242895}}
|
||||
}, {
|
||||
{{22092954, -13191123, -2042793, -11968512, 32186753, -11517388, -6574341, 2470660, -27417366, 16625501},
|
||||
{-11057722, 3042016, 13770083, -9257922, 584236, -544855, -7770857, 2602725, -27351616, 14247413},
|
||||
{6314175, -10264892, -32772502, 15957557, -10157730, 168750, -8618807, 14290061, 27108877, -1180880}},
|
||||
{{-8586597, -7170966, 13241782, 10960156, -32991015, -13794596, 33547976, -11058889, -27148451, 981874},
|
||||
{22833440, 9293594, -32649448, -13618667, -9136966, 14756819, -22928859, -13970780, -10479804, -16197962},
|
||||
{-7768587, 3326786, -28111797, 10783824, 19178761, 14905060, 22680049, 13906969, -15933690, 3797899}},
|
||||
{{21721356, -4212746, -12206123, 9310182, -3882239, -13653110, 23740224, -2709232, 20491983, -8042152},
|
||||
{9209270, -15135055, -13256557, -6167798, -731016, 15289673, 25947805, 15286587, 30997318, -6703063},
|
||||
{7392032, 16618386, 23946583, -8039892, -13265164, -1533858, -14197445, -2321576, 17649998, -250080}},
|
||||
{{-9301088, -14193827, 30609526, -3049543, -25175069, -1283752, -15241566, -9525724, -2233253, 7662146},
|
||||
{-17558673, 1763594, -33114336, 15908610, -30040870, -12174295, 7335080, -8472199, -3174674, 3440183},
|
||||
{-19889700, -5977008, -24111293, -9688870, 10799743, -16571957, 40450, -4431835, 4862400, 1133}},
|
||||
{{-32856209, -7873957, -5422389, 14860950, -16319031, 7956142, 7258061, 311861, -30594991, -7379421},
|
||||
{-3773428, -1565936, 28985340, 7499440, 24445838, 9325937, 29727763, 16527196, 18278453, 15405622},
|
||||
{-4381906, 8508652, -19898366, -3674424, -5984453, 15149970, -13313598, 843523, -21875062, 13626197}},
|
||||
{{2281448, -13487055, -10915418, -2609910, 1879358, 16164207, -10783882, 3953792, 13340839, 15928663},
|
||||
{31727126, -7179855, -18437503, -8283652, 2875793, -16390330, -25269894, -7014826, -23452306, 5964753},
|
||||
{4100420, -5959452, -17179337, 6017714, -18705837, 12227141, -26684835, 11344144, 2538215, -7570755}},
|
||||
{{-9433605, 6123113, 11159803, -2156608, 30016280, 14966241, -20474983, 1485421, -629256, -15958862},
|
||||
{-26804558, 4260919, 11851389, 9658551, -32017107, 16367492, -20205425, -13191288, 11659922, -11115118},
|
||||
{26180396, 10015009, -30844224, -8581293, 5418197, 9480663, 2231568, -10170080, 33100372, -1306171}},
|
||||
{{15121113, -5201871, -10389905, 15427821, -27509937, -15992507, 21670947, 4486675, -5931810, -14466380},
|
||||
{16166486, -9483733, -11104130, 6023908, -31926798, -1364923, 2340060, -16254968, -10735770, -10039824},
|
||||
{28042865, -3557089, -12126526, 12259706, -3717498, -6945899, 6766453, -8689599, 18036436, 5803270}}
|
||||
}, {
|
||||
{{-817581, 6763912, 11803561, 1585585, 10958447, -2671165, 23855391, 4598332, -6159431, -14117438},
|
||||
{-31031306, -14256194, 17332029, -2383520, 31312682, -5967183, 696309, 50292, -20095739, 11763584},
|
||||
{-594563, -2514283, -32234153, 12643980, 12650761, 14811489, 665117, -12613632, -19773211, -10713562}},
|
||||
{{30464590, -11262872, -4127476, -12734478, 19835327, -7105613, -24396175, 2075773, -17020157, 992471},
|
||||
{18357185, -6994433, 7766382, 16342475, -29324918, 411174, 14578841, 8080033, -11574335, -10601610},
|
||||
{19598397, 10334610, 12555054, 2555664, 18821899, -10339780, 21873263, 16014234, 26224780, 16452269}},
|
||||
{{-30223925, 5145196, 5944548, 16385966, 3976735, 2009897, -11377804, -7618186, -20533829, 3698650},
|
||||
{14187449, 3448569, -10636236, -10810935, -22663880, -3433596, 7268410, -10890444, 27394301, 12015369},
|
||||
{19695761, 16087646, 28032085, 12999827, 6817792, 11427614, 20244189, -1312777, -13259127, -3402461}},
|
||||
{{30860103, 12735208, -1888245, -4699734, -16974906, 2256940, -8166013, 12298312, -8550524, -10393462},
|
||||
{-5719826, -11245325, -1910649, 15569035, 26642876, -7587760, -5789354, -15118654, -4976164, 12651793},
|
||||
{-2848395, 9953421, 11531313, -5282879, 26895123, -12697089, -13118820, -16517902, 9768698, -2533218}},
|
||||
{{-24719459, 1894651, -287698, -4704085, 15348719, -8156530, 32767513, 12765450, 4940095, 10678226},
|
||||
{18860224, 15980149, -18987240, -1562570, -26233012, -11071856, -7843882, 13944024, -24372348, 16582019},
|
||||
{-15504260, 4970268, -29893044, 4175593, -20993212, -2199756, -11704054, 15444560, -11003761, 7989037}},
|
||||
{{31490452, 5568061, -2412803, 2182383, -32336847, 4531686, -32078269, 6200206, -19686113, -14800171},
|
||||
{-17308668, -15879940, -31522777, -2831, -32887382, 16375549, 8680158, -16371713, 28550068, -6857132},
|
||||
{-28126887, -5688091, 16837845, -1820458, -6850681, 12700016, -30039981, 4364038, 1155602, 5988841}},
|
||||
{{21890435, -13272907, -12624011, 12154349, -7831873, 15300496, 23148983, -4470481, 24618407, 8283181},
|
||||
{-33136107, -10512751, 9975416, 6841041, -31559793, 16356536, 3070187, -7025928, 1466169, 10740210},
|
||||
{-1509399, -15488185, -13503385, -10655916, 32799044, 909394, -13938903, -5779719, -32164649, -15327040}},
|
||||
{{3960823, -14267803, -28026090, -15918051, -19404858, 13146868, 15567327, 951507, -3260321, -573935},
|
||||
{24740841, 5052253, -30094131, 8961361, 25877428, 6165135, -24368180, 14397372, -7380369, -6144105},
|
||||
{-28888365, 3510803, -28103278, -1158478, -11238128, -10631454, -15441463, -14453128, -1625486, -6494814}}
|
||||
}, {
|
||||
{{793299, -9230478, 8836302, -6235707, -27360908, -2369593, 33152843, -4885251, -9906200, -621852},
|
||||
{5666233, 525582, 20782575, -8038419, -24538499, 14657740, 16099374, 1468826, -6171428, -15186581},
|
||||
{-4859255, -3779343, -2917758, -6748019, 7778750, 11688288, -30404353, -9871238, -1558923, -9863646}},
|
||||
{{10896332, -7719704, 824275, 472601, -19460308, 3009587, 25248958, 14783338, -30581476, -15757844},
|
||||
{10566929, 12612572, -31944212, 11118703, -12633376, 12362879, 21752402, 8822496, 24003793, 14264025},
|
||||
{27713862, -7355973, -11008240, 9227530, 27050101, 2504721, 23886875, -13117525, 13958495, -5732453}},
|
||||
{{-23481610, 4867226, -27247128, 3900521, 29838369, -8212291, -31889399, -10041781, 7340521, -15410068},
|
||||
{4646514, -8011124, -22766023, -11532654, 23184553, 8566613, 31366726, -1381061, -15066784, -10375192},
|
||||
{-17270517, 12723032, -16993061, 14878794, 21619651, -6197576, 27584817, 3093888, -8843694, 3849921}},
|
||||
{{-9064912, 2103172, 25561640, -15125738, -5239824, 9582958, 32477045, -9017955, 5002294, -15550259},
|
||||
{-12057553, -11177906, 21115585, -13365155, 8808712, -12030708, 16489530, 13378448, -25845716, 12741426},
|
||||
{-5946367, 10645103, -30911586, 15390284, -3286982, -7118677, 24306472, 15852464, 28834118, -7646072}},
|
||||
{{-17335748, -9107057, -24531279, 9434953, -8472084, -583362, -13090771, 455841, 20461858, 5491305},
|
||||
{13669248, -16095482, -12481974, -10203039, -14569770, -11893198, -24995986, 11293807, -28588204, -9421832},
|
||||
{28497928, 6272777, -33022994, 14470570, 8906179, -1225630, 18504674, -14165166, 29867745, -8795943}},
|
||||
{{-16207023, 13517196, -27799630, -13697798, 24009064, -6373891, -6367600, -13175392, 22853429, -4012011},
|
||||
{24191378, 16712145, -13931797, 15217831, 14542237, 1646131, 18603514, -11037887, 12876623, -2112447},
|
||||
{17902668, 4518229, -411702, -2829247, 26878217, 5258055, -12860753, 608397, 16031844, 3723494}},
|
||||
{{-28632773, 12763728, -20446446, 7577504, 33001348, -13017745, 17558842, -7872890, 23896954, -4314245},
|
||||
{-20005381, -12011952, 31520464, 605201, 2543521, 5991821, -2945064, 7229064, -9919646, -8826859},
|
||||
{28816045, 298879, -28165016, -15920938, 19000928, -1665890, -12680833, -2949325, -18051778, -2082915}},
|
||||
{{16000882, -344896, 3493092, -11447198, -29504595, -13159789, 12577740, 16041268, -19715240, 7847707},
|
||||
{10151868, 10572098, 27312476, 7922682, 14825339, 4723128, -32855931, -6519018, -10020567, 3852848},
|
||||
{-11430470, 15697596, -21121557, -4420647, 5386314, 15063598, 16514493, -15932110, 29330899, -15076224}}
|
||||
}, {
|
||||
{{-25499735, -4378794, -15222908, -6901211, 16615731, 2051784, 3303702, 15490, -27548796, 12314391},
|
||||
{15683520, -6003043, 18109120, -9980648, 15337968, -5997823, -16717435, 15921866, 16103996, -3731215},
|
||||
{-23169824, -10781249, 13588192, -1628807, -3798557, -1074929, -19273607, 5402699, -29815713, -9841101}},
|
||||
{{23190676, 2384583, -32714340, 3462154, -29903655, -1529132, -11266856, 8911517, -25205859, 2739713},
|
||||
{21374101, -3554250, -33524649, 9874411, 15377179, 11831242, -33529904, 6134907, 4931255, 11987849},
|
||||
{-7732, -2978858, -16223486, 7277597, 105524, -322051, -31480539, 13861388, -30076310, 10117930}},
|
||||
{{-29501170, -10744872, -26163768, 13051539, -25625564, 5089643, -6325503, 6704079, 12890019, 15728940},
|
||||
{-21972360, -11771379, -951059, -4418840, 14704840, 2695116, 903376, -10428139, 12885167, 8311031},
|
||||
{-17516482, 5352194, 10384213, -13811658, 7506451, 13453191, 26423267, 4384730, 1888765, -5435404}},
|
||||
{{-25817338, -3107312, -13494599, -3182506, 30896459, -13921729, -32251644, -12707869, -19464434, -3340243},
|
||||
{-23607977, -2665774, -526091, 4651136, 5765089, 4618330, 6092245, 14845197, 17151279, -9854116},
|
||||
{-24830458, -12733720, -15165978, 10367250, -29530908, -265356, 22825805, -7087279, -16866484, 16176525}},
|
||||
{{-23583256, 6564961, 20063689, 3798228, -4740178, 7359225, 2006182, -10363426, -28746253, -10197509},
|
||||
{-10626600, -4486402, -13320562, -5125317, 3432136, -6393229, 23632037, -1940610, 32808310, 1099883},
|
||||
{15030977, 5768825, -27451236, -2887299, -6427378, -15361371, -15277896, -6809350, 2051441, -15225865}},
|
||||
{{-3362323, -7239372, 7517890, 9824992, 23555850, 295369, 5148398, -14154188, -22686354, 16633660},
|
||||
{4577086, -16752288, 13249841, -15304328, 19958763, -14537274, 18559670, -10759549, 8402478, -9864273},
|
||||
{-28406330, -1051581, -26790155, -907698, -17212414, -11030789, 9453451, -14980072, 17983010, 9967138}},
|
||||
{{-25762494, 6524722, 26585488, 9969270, 24709298, 1220360, -1677990, 7806337, 17507396, 3651560},
|
||||
{-10420457, -4118111, 14584639, 15971087, -15768321, 8861010, 26556809, -5574557, -18553322, -11357135},
|
||||
{2839101, 14284142, 4029895, 3472686, 14402957, 12689363, -26642121, 8459447, -5605463, -7621941}},
|
||||
{{-4839289, -3535444, 9744961, 2871048, 25113978, 3187018, -25110813, -849066, 17258084, -7977739},
|
||||
{18164541, -10595176, -17154882, -1542417, 19237078, -9745295, 23357533, -15217008, 26908270, 12150756},
|
||||
{-30264870, -7647865, 5112249, -7036672, -1499807, -6974257, 43168, -5537701, -32302074, 16215819}}
|
||||
}, {
|
||||
{{-6898905, 9824394, -12304779, -4401089, -31397141, -6276835, 32574489, 12532905, -7503072, -8675347},
|
||||
{-27343522, -16515468, -27151524, -10722951, 946346, 16291093, 254968, 7168080, 21676107, -1943028},
|
||||
{21260961, -8424752, -16831886, -11920822, -23677961, 3968121, -3651949, -6215466, -3556191, -7913075}},
|
||||
{{16544754, 13250366, -16804428, 15546242, -4583003, 12757258, -2462308, -8680336, -18907032, -9662799},
|
||||
{-2415239, -15577728, 18312303, 4964443, -15272530, -12653564, 26820651, 16690659, 25459437, -4564609},
|
||||
{-25144690, 11425020, 28423002, -11020557, -6144921, -15826224, 9142795, -2391602, -6432418, -1644817}},
|
||||
{{-23104652, 6253476, 16964147, -3768872, -25113972, -12296437, -27457225, -16344658, 6335692, 7249989},
|
||||
{-30333227, 13979675, 7503222, -12368314, -11956721, -4621693, -30272269, 2682242, 25993170, -12478523},
|
||||
{4364628, 5930691, 32304656, -10044554, -8054781, 15091131, 22857016, -10598955, 31820368, 15075278}},
|
||||
{{31879134, -8918693, 17258761, 90626, -8041836, -4917709, 24162788, -9650886, -17970238, 12833045},
|
||||
{19073683, 14851414, -24403169, -11860168, 7625278, 11091125, -19619190, 2074449, -9413939, 14905377},
|
||||
{24483667, -11935567, -2518866, -11547418, -1553130, 15355506, -25282080, 9253129, 27628530, -7555480}},
|
||||
{{17597607, 8340603, 19355617, 552187, 26198470, -3176583, 4593324, -9157582, -14110875, 15297016},
|
||||
{510886, 14337390, -31785257, 16638632, 6328095, 2713355, -20217417, -11864220, 8683221, 2921426},
|
||||
{18606791, 11874196, 27155355, -5281482, -24031742, 6265446, -25178240, -1278924, 4674690, 13890525}},
|
||||
{{13609624, 13069022, -27372361, -13055908, 24360586, 9592974, 14977157, 9835105, 4389687, 288396},
|
||||
{9922506, -519394, 13613107, 5883594, -18758345, -434263, -12304062, 8317628, 23388070, 16052080},
|
||||
{12720016, 11937594, -31970060, -5028689, 26900120, 8561328, -20155687, -11632979, -14754271, -10812892}},
|
||||
{{15961858, 14150409, 26716931, -665832, -22794328, 13603569, 11829573, 7467844, -28822128, 929275},
|
||||
{11038231, -11582396, -27310482, -7316562, -10498527, -16307831, -23479533, -9371869, -21393143, 2465074},
|
||||
{20017163, -4323226, 27915242, 1529148, 12396362, 15675764, 13817261, -9658066, 2463391, -4622140}},
|
||||
{{-16358878, -12663911, -12065183, 4996454, -1256422, 1073572, 9583558, 12851107, 4003896, 12673717},
|
||||
{-1731589, -15155870, -3262930, 16143082, 19294135, 13385325, 14741514, -9103726, 7903886, 2348101},
|
||||
{24536016, -16515207, 12715592, -3862155, 1511293, 10047386, -3842346, -7129159, -28377538, 10048127}}
|
||||
}, {
|
||||
{{-12622226, -6204820, 30718825, 2591312, -10617028, 12192840, 18873298, -7297090, -32297756, 15221632},
|
||||
{-26478122, -11103864, 11546244, -1852483, 9180880, 7656409, -21343950, 2095755, 29769758, 6593415},
|
||||
{-31994208, -2907461, 4176912, 3264766, 12538965, -868111, 26312345, -6118678, 30958054, 8292160}},
|
||||
{{31429822, -13959116, 29173532, 15632448, 12174511, -2760094, 32808831, 3977186, 26143136, -3148876},
|
||||
{22648901, 1402143, -22799984, 13746059, 7936347, 365344, -8668633, -1674433, -3758243, -2304625},
|
||||
{-15491917, 8012313, -2514730, -12702462, -23965846, -10254029, -1612713, -1535569, -16664475, 8194478}},
|
||||
{{27338066, -7507420, -7414224, 10140405, -19026427, -6589889, 27277191, 8855376, 28572286, 3005164},
|
||||
{26287124, 4821776, 25476601, -4145903, -3764513, -15788984, -18008582, 1182479, -26094821, -13079595},
|
||||
{-7171154, 3178080, 23970071, 6201893, -17195577, -4489192, -21876275, -13982627, 32208683, -1198248}},
|
||||
{{-16657702, 2817643, -10286362, 14811298, 6024667, 13349505, -27315504, -10497842, -27672585, -11539858},
|
||||
{15941029, -9405932, -21367050, 8062055, 31876073, -238629, -15278393, -1444429, 15397331, -4130193},
|
||||
{8934485, -13485467, -23286397, -13423241, -32446090, 14047986, 31170398, -1441021, -27505566, 15087184}},
|
||||
{{-18357243, -2156491, 24524913, -16677868, 15520427, -6360776, -15502406, 11461896, 16788528, -5868942},
|
||||
{-1947386, 16013773, 21750665, 3714552, -17401782, -16055433, -3770287, -10323320, 31322514, -11615635},
|
||||
{21426655, -5650218, -13648287, -5347537, -28812189, -4920970, -18275391, -14621414, 13040862, -12112948}},
|
||||
{{11293895, 12478086, -27136401, 15083750, -29307421, 14748872, 14555558, -13417103, 1613711, 4896935},
|
||||
{-25894883, 15323294, -8489791, -8057900, 25967126, -13425460, 2825960, -4897045, -23971776, -11267415},
|
||||
{-15924766, -5229880, -17443532, 6410664, 3622847, 10243618, 20615400, 12405433, -23753030, -8436416}},
|
||||
{{-7091295, 12556208, -20191352, 9025187, -17072479, 4333801, 4378436, 2432030, 23097949, -566018},
|
||||
{4565804, -16025654, 20084412, -7842817, 1724999, 189254, 24767264, 10103221, -18512313, 2424778},
|
||||
{366633, -11976806, 8173090, -6890119, 30788634, 5745705, -7168678, 1344109, -3642553, 12412659}},
|
||||
{{-24001791, 7690286, 14929416, -168257, -32210835, -13412986, 24162697, -15326504, -3141501, 11179385},
|
||||
{18289522, -14724954, 8056945, 16430056, -21729724, 7842514, -6001441, -1486897, -18684645, -11443503},
|
||||
{476239, 6601091, -6152790, -9723375, 17503545, -4863900, 27672959, 13403813, 11052904, 5219329}}
|
||||
}, {
|
||||
{{20678546, -8375738, -32671898, 8849123, -5009758, 14574752, 31186971, -3973730, 9014762, -8579056},
|
||||
{-13644050, -10350239, -15962508, 5075808, -1514661, -11534600, -33102500, 9160280, 8473550, -3256838},
|
||||
{24900749, 14435722, 17209120, -15292541, -22592275, 9878983, -7689309, -16335821, -24568481, 11788948}},
|
||||
{{-3118155, -11395194, -13802089, 14797441, 9652448, -6845904, -20037437, 10410733, -24568470, -1458691},
|
||||
{-15659161, 16736706, -22467150, 10215878, -9097177, 7563911, 11871841, -12505194, -18513325, 8464118},
|
||||
{-23400612, 8348507, -14585951, -861714, -3950205, -6373419, 14325289, 8628612, 33313881, -8370517}},
|
||||
{{-20186973, -4967935, 22367356, 5271547, -1097117, -4788838, -24805667, -10236854, -8940735, -5818269},
|
||||
{-6948785, -1795212, -32625683, -16021179, 32635414, -7374245, 15989197, -12838188, 28358192, -4253904},
|
||||
{-23561781, -2799059, -32351682, -1661963, -9147719, 10429267, -16637684, 4072016, -5351664, 5596589}},
|
||||
{{-28236598, -3390048, 12312896, 6213178, 3117142, 16078565, 29266239, 2557221, 1768301, 15373193},
|
||||
{-7243358, -3246960, -4593467, -7553353, -127927, -912245, -1090902, -4504991, -24660491, 3442910},
|
||||
{-30210571, 5124043, 14181784, 8197961, 18964734, -11939093, 22597931, 7176455, -18585478, 13365930}},
|
||||
{{-7877390, -1499958, 8324673, 4690079, 6261860, 890446, 24538107, -8570186, -9689599, -3031667},
|
||||
{25008904, -10771599, -4305031, -9638010, 16265036, 15721635, 683793, -11823784, 15723479, -15163481},
|
||||
{-9660625, 12374379, -27006999, -7026148, -7724114, -12314514, 11879682, 5400171, 519526, -1235876}},
|
||||
{{22258397, -16332233, -7869817, 14613016, -22520255, -2950923, -20353881, 7315967, 16648397, 7605640},
|
||||
{-8081308, -8464597, -8223311, 9719710, 19259459, -15348212, 23994942, -5281555, -9468848, 4763278},
|
||||
{-21699244, 9220969, -15730624, 1084137, -25476107, -2852390, 31088447, -7764523, -11356529, 728112}},
|
||||
{{26047220, -11751471, -6900323, -16521798, 24092068, 9158119, -4273545, -12555558, -29365436, -5498272},
|
||||
{17510331, -322857, 5854289, 8403524, 17133918, -3112612, -28111007, 12327945, 10750447, 10014012},
|
||||
{-10312768, 3936952, 9156313, -8897683, 16498692, -994647, -27481051, -666732, 3424691, 7540221}},
|
||||
{{30322361, -6964110, 11361005, -4143317, 7433304, 4989748, -7071422, -16317219, -9244265, 15258046},
|
||||
{13054562, -2779497, 19155474, 469045, -12482797, 4566042, 5631406, 2711395, 1062915, -5136345},
|
||||
{-19240248, -11254599, -29509029, -7499965, -5835763, 13005411, -6066489, 12194497, 32960380, 1459310}}
|
||||
}, {
|
||||
{{19852034, 7027924, 23669353, 10020366, 8586503, -6657907, 394197, -6101885, 18638003, -11174937},
|
||||
{31395534, 15098109, 26581030, 8030562, -16527914, -5007134, 9012486, -7584354, -6643087, -5442636},
|
||||
{-9192165, -2347377, -1997099, 4529534, 25766844, 607986, -13222, 9677543, -32294889, -6456008}},
|
||||
{{-2444496, -149937, 29348902, 8186665, 1873760, 12489863, -30934579, -7839692, -7852844, -8138429},
|
||||
{-15236356, -15433509, 7766470, 746860, 26346930, -10221762, -27333451, 10754588, -9431476, 5203576},
|
||||
{31834314, 14135496, -770007, 5159118, 20917671, -16768096, -7467973, -7337524, 31809243, 7347066}},
|
||||
{{-9606723, -11874240, 20414459, 13033986, 13716524, -11691881, 19797970, -12211255, 15192876, -2087490},
|
||||
{-12663563, -2181719, 1168162, -3804809, 26747877, -14138091, 10609330, 12694420, 33473243, -13382104},
|
||||
{33184999, 11180355, 15832085, -11385430, -1633671, 225884, 15089336, -11023903, -6135662, 14480053}},
|
||||
{{31308717, -5619998, 31030840, -1897099, 15674547, -6582883, 5496208, 13685227, 27595050, 8737275},
|
||||
{-20318852, -15150239, 10933843, -16178022, 8335352, -7546022, -31008351, -12610604, 26498114, 66511},
|
||||
{22644454, -8761729, -16671776, 4884562, -3105614, -13559366, 30540766, -4286747, -13327787, -7515095}},
|
||||
{{-28017847, 9834845, 18617207, -2681312, -3401956, -13307506, 8205540, 13585437, -17127465, 15115439},
|
||||
{23711543, -672915, 31206561, -8362711, 6164647, -9709987, -33535882, -1426096, 8236921, 16492939},
|
||||
{-23910559, -13515526, -26299483, -4503841, 25005590, -7687270, 19574902, 10071562, 6708380, -6222424}},
|
||||
{{2101391, -4930054, 19702731, 2367575, -15427167, 1047675, 5301017, 9328700, 29955601, -11678310},
|
||||
{3096359, 9271816, -21620864, -15521844, -14847996, -7592937, -25892142, -12635595, -9917575, 6216608},
|
||||
{-32615849, 338663, -25195611, 2510422, -29213566, -13820213, 24822830, -6146567, -26767480, 7525079}},
|
||||
{{-23066649, -13985623, 16133487, -7896178, -3389565, 778788, -910336, -2782495, -19386633, 11994101},
|
||||
{21691500, -13624626, -641331, -14367021, 3285881, -3483596, -25064666, 9718258, -7477437, 13381418},
|
||||
{18445390, -4202236, 14979846, 11622458, -1727110, -3582980, 23111648, -6375247, 28535282, 15779576}},
|
||||
{{30098053, 3089662, -9234387, 16662135, -21306940, 11308411, -14068454, 12021730, 9955285, -16303356},
|
||||
{9734894, -14576830, -7473633, -9138735, 2060392, 11313496, -18426029, 9924399, 20194861, 13380996},
|
||||
{-26378102, -7965207, -22167821, 15789297, -18055342, -6168792, -1984914, 15707771, 26342023, 10146099}}
|
||||
}, {
|
||||
{{-26016874, -219943, 21339191, -41388, 19745256, -2878700, -29637280, 2227040, 21612326, -545728},
|
||||
{-13077387, 1184228, 23562814, -5970442, -20351244, -6348714, 25764461, 12243797, -20856566, 11649658},
|
||||
{-10031494, 11262626, 27384172, 2271902, 26947504, -15997771, 39944, 6114064, 33514190, 2333242}},
|
||||
{{-21433588, -12421821, 8119782, 7219913, -21830522, -9016134, -6679750, -12670638, 24350578, -13450001},
|
||||
{-4116307, -11271533, -23886186, 4843615, -30088339, 690623, -31536088, -10406836, 8317860, 12352766},
|
||||
{18200138, -14475911, -33087759, -2696619, -23702521, -9102511, -23552096, -2287550, 20712163, 6719373}},
|
||||
{{26656208, 6075253, -7858556, 1886072, -28344043, 4262326, 11117530, -3763210, 26224235, -3297458},
|
||||
{-17168938, -14854097, -3395676, -16369877, -19954045, 14050420, 21728352, 9493610, 18620611, -16428628},
|
||||
{-13323321, 13325349, 11432106, 5964811, 18609221, 6062965, -5269471, -9725556, -30701573, -16479657}},
|
||||
{{-23860538, -11233159, 26961357, 1640861, -32413112, -16737940, 12248509, -5240639, 13735342, 1934062},
|
||||
{25089769, 6742589, 17081145, -13406266, 21909293, -16067981, -15136294, -3765346, -21277997, 5473616},
|
||||
{31883677, -7961101, 1083432, -11572403, 22828471, 13290673, -7125085, 12469656, 29111212, -5451014}},
|
||||
{{24244947, -15050407, -26262976, 2791540, -14997599, 16666678, 24367466, 6388839, -10295587, 452383},
|
||||
{-25640782, -3417841, 5217916, 16224624, 19987036, -4082269, -24236251, -5915248, 15766062, 8407814},
|
||||
{-20406999, 13990231, 15495425, 16395525, 5377168, 15166495, -8917023, -4388953, -8067909, 2276718}},
|
||||
{{30157918, 12924066, -17712050, 9245753, 19895028, 3368142, -23827587, 5096219, 22740376, -7303417},
|
||||
{2041139, -14256350, 7783687, 13876377, -25946985, -13352459, 24051124, 13742383, -15637599, 13295222},
|
||||
{33338237, -8505733, 12532113, 7977527, 9106186, -1715251, -17720195, -4612972, -4451357, -14669444}},
|
||||
{{-20045281, 5454097, -14346548, 6447146, 28862071, 1883651, -2469266, -4141880, 7770569, 9620597},
|
||||
{23208068, 7979712, 33071466, 8149229, 1758231, -10834995, 30945528, -1694323, -33502340, -14767970},
|
||||
{1439958, -16270480, -1079989, -793782, 4625402, 10647766, -5043801, 1220118, 30494170, -11440799}},
|
||||
{{-5037580, -13028295, -2970559, -3061767, 15640974, -6701666, -26739026, 926050, -1684339, -13333647},
|
||||
{13908495, -3549272, 30919928, -6273825, -21521863, 7989039, 9021034, 9078865, 3353509, 4033511},
|
||||
{-29663431, -15113610, 32259991, -344482, 24295849, -12912123, 23161163, 8839127, 27485041, 7356032}}
|
||||
}, {
|
||||
{{9661027, 705443, 11980065, -5370154, -1628543, 14661173, -6346142, 2625015, 28431036, -16771834},
|
||||
{-23839233, -8311415, -25945511, 7480958, -17681669, -8354183, -22545972, 14150565, 15970762, 4099461},
|
||||
{29262576, 16756590, 26350592, -8793563, 8529671, -11208050, 13617293, -9937143, 11465739, 8317062}},
|
||||
{{-25493081, -6962928, 32500200, -9419051, -23038724, -2302222, 14898637, 3848455, 20969334, -5157516},
|
||||
{-20384450, -14347713, -18336405, 13884722, -33039454, 2842114, -21610826, -3649888, 11177095, 14989547},
|
||||
{-24496721, -11716016, 16959896, 2278463, 12066309, 10137771, 13515641, 2581286, -28487508, 9930240}},
|
||||
{{-17751622, -2097826, 16544300, -13009300, -15914807, -14949081, 18345767, -13403753, 16291481, -5314038},
|
||||
{-33229194, 2553288, 32678213, 9875984, 8534129, 6889387, -9676774, 6957617, 4368891, 9788741},
|
||||
{16660756, 7281060, -10830758, 12911820, 20108584, -8101676, -21722536, -8613148, 16250552, -11111103}},
|
||||
{{-19765507, 2390526, -16551031, 14161980, 1905286, 6414907, 4689584, 10604807, -30190403, 4782747},
|
||||
{-1354539, 14736941, -7367442, -13292886, 7710542, -14155590, -9981571, 4383045, 22546403, 437323},
|
||||
{31665577, -12180464, -16186830, 1491339, -18368625, 3294682, 27343084, 2786261, -30633590, -14097016}},
|
||||
{{-14467279, -683715, -33374107, 7448552, 19294360, 14334329, -19690631, 2355319, -19284671, -6114373},
|
||||
{15121312, -15796162, 6377020, -6031361, -10798111, -12957845, 18952177, 15496498, -29380133, 11754228},
|
||||
{-2637277, -13483075, 8488727, -14303896, 12728761, -1622493, 7141596, 11724556, 22761615, -10134141}},
|
||||
{{16918416, 11729663, -18083579, 3022987, -31015732, -13339659, -28741185, -12227393, 32851222, 11717399},
|
||||
{11166634, 7338049, -6722523, 4531520, -29468672, -7302055, 31474879, 3483633, -1193175, -4030831},
|
||||
{-185635, 9921305, 31456609, -13536438, -12013818, 13348923, 33142652, 6546660, -19985279, -3948376}},
|
||||
{{-32460596, 11266712, -11197107, -7899103, 31703694, 3855903, -8537131, -12833048, -30772034, -15486313},
|
||||
{-18006477, 12709068, 3991746, -6479188, -21491523, -10550425, -31135347, -16049879, 10928917, 3011958},
|
||||
{-6957757, -15594337, 31696059, 334240, 29576716, 14796075, -30831056, -12805180, 18008031, 10258577}},
|
||||
{{-22448644, 15655569, 7018479, -4410003, -30314266, -1201591, -1853465, 1367120, 25127874, 6671743},
|
||||
{29701166, -14373934, -10878120, 9279288, -17568, 13127210, 21382910, 11042292, 25838796, 4642684},
|
||||
{-20430234, 14955537, -24126347, 8124619, -5369288, -5990470, 30468147, -13900640, 18423289, 4177476}}
|
||||
}
|
||||
};
|
||||
|
||||
const ge_precomp ge_Bi[8] = {
|
||||
{{25967493, -14356035, 29566456, 3660896, -12694345, 4014787, 27544626, -11754271, -6079156, 2047605},
|
||||
{-12545711, 934262, -2722910, 3049990, -727428, 9406986, 12720692, 5043384, 19500929, -15469378},
|
||||
{-8738181, 4489570, 9688441, -14785194, 10184609, -12363380, 29287919, 11864899, -24514362, -4438546}}, {{15636291, -9688557, 24204773, -7912398, 616977, -16685262, 27787600, -14772189, 28944400, -1550024},
|
||||
{16568933, 4717097, -11556148, -1102322, 15682896, -11807043, 16354577, -11775962, 7689662, 11199574},
|
||||
{30464156, -5976125, -11779434, -15670865, 23220365, 15915852, 7512774, 10017326, -17749093, -9920357}}, {{10861363, 11473154, 27284546, 1981175, -30064349, 12577861, 32867885, 14515107, -15438304, 10819380},
|
||||
{4708026, 6336745, 20377586, 9066809, -11272109, 6594696, -25653668, 12483688, -12668491, 5581306},
|
||||
{19563160, 16186464, -29386857, 4097519, 10237984, -4348115, 28542350, 13850243, -23678021, -15815942}}, {{5153746, 9909285, 1723747, -2777874, 30523605, 5516873, 19480852, 5230134, -23952439, -15175766},
|
||||
{-30269007, -3463509, 7665486, 10083793, 28475525, 1649722, 20654025, 16520125, 30598449, 7715701},
|
||||
{28881845, 14381568, 9657904, 3680757, -20181635, 7843316, -31400660, 1370708, 29794553, -1409300}}, {{-22518993, -6692182, 14201702, -8745502, -23510406, 8844726, 18474211, -1361450, -13062696, 13821877},
|
||||
{-6455177, -7839871, 3374702, -4740862, -27098617, -10571707, 31655028, -7212327, 18853322, -14220951},
|
||||
{4566830, -12963868, -28974889, -12240689, -7602672, -2830569, -8514358, -10431137, 2207753, -3209784}}, {{-25154831, -4185821, 29681144, 7868801, -6854661, -9423865, -12437364, -663000, -31111463, -16132436},
|
||||
{25576264, -2703214, 7349804, -11814844, 16472782, 9300885, 3844789, 15725684, 171356, 6466918},
|
||||
{23103977, 13316479, 9739013, -16149481, 817875, -15038942, 8965339, -14088058, -30714912, 16193877}}, {{-33521811, 3180713, -2394130, 14003687, -16903474, -16270840, 17238398, 4729455, -18074513, 9256800},
|
||||
{-25182317, -4174131, 32336398, 5036987, -21236817, 11360617, 22616405, 9761698, -19827198, 630305},
|
||||
{-13720693, 2639453, -24237460, -7406481, 9494427, -5774029, -6554551, -15960994, -2449256, -14291300}}, {{-3151181, -5046075, 9282714, 6866145, -31907062, -863023, -18940575, 15033784, 25105118, -7894876},
|
||||
{-24326370, 15950226, -31801215, -14592823, -11662737, -5090925, 1573892, -2625887, 2198790, -15804619},
|
||||
{-3099351, 10324967, -2241613, 7453183, -5446979, -2735503, -13812022, -16236442, -32461234, -12290683}}
|
||||
};
|
||||
|
||||
/* A = 2 * (1 - d) / (1 + d) = 486662 */
|
||||
const fe fe_ma2 = {-12721188, -3529, 0, 0, 0, 0, 0, 0, 0, 0}; /* -A^2 */
|
||||
const fe fe_ma = {-486662, 0, 0, 0, 0, 0, 0, 0, 0, 0}; /* -A */
|
||||
const fe fe_fffb1 = {-31702527, -2466483, -26106795, -12203692, -12169197, -321052, 14850977, -10296299, -16929438, -407568}; /* sqrt(-2 * A * (A + 2)) */
|
||||
const fe fe_fffb2 = {8166131, -6741800, -17040804, 3154616, 21461005, 1466302, -30876704, -6368709, 10503587, -13363080}; /* sqrt(2 * A * (A + 2)) */
|
||||
const fe fe_fffb3 = {-13620103, 14639558, 4532995, 7679154, 16815101, -15883539, -22863840, -14813421, 13716513, -6477756}; /* sqrt(-sqrt(-1) * A * (A + 2)) */
|
||||
const fe fe_fffb4 = {-21786234, -12173074, 21573800, 4524538, -4645904, 16204591, 8012863, -8444712, 3212926, 6885324}; /* sqrt(sqrt(-1) * A * (A + 2)) */
|
||||
4473
crypto/upstream/crypto-ops.c
Executable file
4473
crypto/upstream/crypto-ops.c
Executable file
File diff suppressed because it is too large
Load diff
168
crypto/upstream/crypto-ops.h
Executable file
168
crypto/upstream/crypto-ops.h
Executable file
|
|
@ -0,0 +1,168 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
#include <stddef.h> // size_t
|
||||
|
||||
/* From fe.h */
|
||||
|
||||
typedef int32_t fe[10];
|
||||
|
||||
/* From ge.h */
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
} ge_p2;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p3;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p1p1;
|
||||
|
||||
typedef struct {
|
||||
fe yplusx;
|
||||
fe yminusx;
|
||||
fe xy2d;
|
||||
} ge_precomp;
|
||||
|
||||
typedef struct {
|
||||
fe YplusX;
|
||||
fe YminusX;
|
||||
fe Z;
|
||||
fe T2d;
|
||||
} ge_cached;
|
||||
|
||||
/* From ge_add.c */
|
||||
|
||||
void ge_add(ge_p1p1 *, const ge_p3 *, const ge_cached *);
|
||||
|
||||
/* From ge_double_scalarmult.c, modified */
|
||||
|
||||
typedef ge_cached ge_dsmp[8];
|
||||
extern const ge_precomp ge_Bi[8];
|
||||
void ge_dsm_precomp(ge_dsmp r, const ge_p3 *s);
|
||||
void ge_double_scalarmult_base_vartime(ge_p2 *, const unsigned char *, const ge_p3 *, const unsigned char *);
|
||||
|
||||
/* From ge_frombytes.c, modified */
|
||||
|
||||
extern const fe fe_sqrtm1;
|
||||
extern const fe fe_d;
|
||||
extern const fe fe_d2;
|
||||
int ge_frombytes_vartime(ge_p3 *, const unsigned char *);
|
||||
|
||||
/* From ge_p1p1_to_p2.c */
|
||||
|
||||
void ge_p1p1_to_p2(ge_p2 *, const ge_p1p1 *);
|
||||
|
||||
/* From ge_p1p1_to_p3.c */
|
||||
|
||||
void ge_p1p1_to_p3(ge_p3 *, const ge_p1p1 *);
|
||||
|
||||
/* From ge_p2_dbl.c */
|
||||
|
||||
void ge_p2_dbl(ge_p1p1 *, const ge_p2 *);
|
||||
|
||||
/* From ge_p3_to_cached.c */
|
||||
|
||||
extern const fe fe_d2;
|
||||
void ge_p3_to_cached(ge_cached *, const ge_p3 *);
|
||||
|
||||
/* From ge_p3_to_p2.c */
|
||||
|
||||
void ge_p3_to_p2(ge_p2 *, const ge_p3 *);
|
||||
|
||||
/* From ge_p3_tobytes.c */
|
||||
|
||||
void ge_p3_tobytes(unsigned char *, const ge_p3 *);
|
||||
|
||||
/* From ge_scalarmult_base.c */
|
||||
|
||||
extern const ge_precomp ge_base[32][8];
|
||||
void ge_scalarmult_base(ge_p3 *, const unsigned char *);
|
||||
|
||||
/* From ge_tobytes.c */
|
||||
|
||||
void ge_tobytes(unsigned char *, const ge_p2 *);
|
||||
|
||||
/* From sc_reduce.c */
|
||||
|
||||
void sc_reduce(unsigned char *);
|
||||
|
||||
/* New code */
|
||||
|
||||
void ge_scalarmult(ge_p2 *, const unsigned char *, const ge_p3 *);
|
||||
void ge_scalarmult_p3(ge_p3 *, const unsigned char *, const ge_p3 *);
|
||||
void ge_double_scalarmult_precomp_vartime(ge_p2 *, const unsigned char *, const ge_p3 *, const unsigned char *, const ge_dsmp);
|
||||
void ge_mul8(ge_p1p1 *, const ge_p2 *);
|
||||
void ge_mul8_p3(ge_p3 *, const ge_p3 *);
|
||||
void ge_fromfe_frombytes_vartime(ge_p2 *, const unsigned char *);
|
||||
void ge_p2_to_p3(ge_p3 *r, const ge_p2 *t);
|
||||
void ge_bytes_hash_to_ec(ge_p3 *, const void *, size_t);
|
||||
void ge_bytes_hash_to_ec_32(ge_p3 *, const unsigned char *);
|
||||
void ge_cached_to_p2(ge_p2 *r, const ge_cached *c);
|
||||
void ge_madd(ge_p1p1 *r, const ge_p3 *p, const ge_precomp *q);
|
||||
|
||||
void ge_p3_0(ge_p3 *h);
|
||||
void ge_sub(ge_p1p1 *, const ge_p3 *, const ge_cached *);
|
||||
void ge_double_scalarmult_base_vartime_p3(ge_p3 *r, const unsigned char *a, const ge_p3 *A, const unsigned char *b);
|
||||
void ge_scalarmult_vartime_p3(ge_p3 *r, const unsigned char *a, const ge_p3 *A);
|
||||
void ge_scalarmult_vartime_p3_v2(ge_p3 *r, const unsigned char *a, const ge_p3 *A);
|
||||
void ge_scalarmult_base_vartime(ge_p3 *h, const unsigned char *a);
|
||||
|
||||
/* precomp_data[i][j] = (j + 1) * 256^i * G */
|
||||
typedef ge_precomp (precomp_data_t)[32][8];
|
||||
void ge_scalarmult_precomp_vartime(ge_p3 *h, const precomp_data_t base_precomp, const unsigned char *a);
|
||||
void ge_p3_to_precomp(ge_precomp *r, const ge_p3* p);
|
||||
|
||||
extern const fe fe_ma2;
|
||||
extern const fe fe_ma;
|
||||
extern const fe fe_fffb1;
|
||||
extern const fe fe_fffb2;
|
||||
extern const fe fe_fffb3;
|
||||
extern const fe fe_fffb4;
|
||||
|
||||
void sc_0(unsigned char *);
|
||||
void sc_reduce32(unsigned char *);
|
||||
void sc_add(unsigned char *, const unsigned char *, const unsigned char *);
|
||||
void sc_sub(unsigned char *, const unsigned char *, const unsigned char *);
|
||||
void sc_mulsub(unsigned char *, const unsigned char *, const unsigned char *, const unsigned char *);
|
||||
void sc_mul(unsigned char *, const unsigned char *, const unsigned char *);
|
||||
void sc_muladd(unsigned char* s, const unsigned char* a, const unsigned char* b, const unsigned char* c);
|
||||
int sc_check(const unsigned char *);
|
||||
int sc_isnonzero(const unsigned char *); /* Doesn't normalize */
|
||||
void sc_invert(unsigned char*, const unsigned char*);
|
||||
|
||||
void fe_sq(fe h, const fe f);
|
||||
int fe_isnonzero(const fe f);
|
||||
void fe_add(fe h, const fe f, const fe g);
|
||||
void fe_sub(fe h, const fe f, const fe g);
|
||||
void fe_mul(fe, const fe, const fe);
|
||||
void fe_frombytes(fe h, const unsigned char *s);
|
||||
void fe_invert(fe out, const fe z);
|
||||
void fe_tobytes(unsigned char *s, const fe h);
|
||||
int fe_isnegative(const fe f);
|
||||
1987
crypto/upstream/crypto-sugar.cpp
Executable file
1987
crypto/upstream/crypto-sugar.cpp
Executable file
File diff suppressed because it is too large
Load diff
1452
crypto/upstream/crypto-sugar.h
Executable file
1452
crypto/upstream/crypto-sugar.h
Executable file
File diff suppressed because it is too large
Load diff
431
crypto/upstream/crypto.cpp
Executable file
431
crypto/upstream/crypto.cpp
Executable file
|
|
@ -0,0 +1,431 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#include <alloca.h>
|
||||
#include <cassert>
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
#include <cstdlib>
|
||||
#include <cstring>
|
||||
#include <memory>
|
||||
#include <mutex>
|
||||
|
||||
#include "common/varint.h"
|
||||
#include "warnings.h"
|
||||
#include "crypto.h"
|
||||
#include "hash.h"
|
||||
|
||||
#if !defined(NDEBUG)
|
||||
# define crypto_assert(expression) assert(expression); CRYPTO_CHECK_AND_THROW_MES(expression, #expression)
|
||||
#else
|
||||
# define crypto_assert(expression) CRYPTO_CHECK_AND_THROW_MES(expression, #expression)
|
||||
#endif
|
||||
|
||||
namespace crypto {
|
||||
|
||||
DISABLE_GCC_AND_CLANG_WARNING(strict-aliasing)
|
||||
const unsigned char Z_[32] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
const unsigned char I_[32] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
const unsigned char L_[32] = { 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 };
|
||||
|
||||
const key_image Z = *reinterpret_cast<const key_image*>(&Z_);
|
||||
const key_image I = *reinterpret_cast<const key_image*>(&I_);
|
||||
const key_image L = *reinterpret_cast<const key_image*>(&L_);
|
||||
|
||||
extern "C" {
|
||||
#include "crypto-ops.h"
|
||||
#include "random.h"
|
||||
}
|
||||
|
||||
|
||||
std::mutex& random_lock_accessor() noexcept
|
||||
{
|
||||
// this is a thread-safe approach
|
||||
// note section 6.7: "If control enters the declaration concurrently while the variable is being initialized, the concurrent execution shall wait for completion of the initialization."
|
||||
static std::mutex random_lock;
|
||||
return random_lock;
|
||||
}
|
||||
|
||||
|
||||
static inline unsigned char *operator &(ec_point &point) {
|
||||
return &reinterpret_cast<unsigned char &>(point);
|
||||
}
|
||||
|
||||
static inline const unsigned char *operator &(const ec_point &point) {
|
||||
return &reinterpret_cast<const unsigned char &>(point);
|
||||
}
|
||||
|
||||
static inline unsigned char *operator &(ec_scalar &scalar) {
|
||||
return &reinterpret_cast<unsigned char &>(scalar);
|
||||
}
|
||||
|
||||
static inline const unsigned char *operator &(const ec_scalar &scalar) {
|
||||
return &reinterpret_cast<const unsigned char &>(scalar);
|
||||
}
|
||||
|
||||
static inline void random_scalar_no_lock(ec_scalar &res)
|
||||
{
|
||||
unsigned char tmp[64];
|
||||
generate_random_bytes_no_lock(64, tmp);
|
||||
sc_reduce(tmp);
|
||||
memcpy(&res, tmp, 32);
|
||||
}
|
||||
|
||||
void crypto_ops::keys_from_default(const unsigned char* a_part, public_key &pub, secret_key &sec, size_t keys_seed_binary_size)
|
||||
{
|
||||
unsigned char tmp[64] = { 0 };
|
||||
|
||||
if (!(sizeof(tmp) >= keys_seed_binary_size))
|
||||
{
|
||||
throw std::runtime_error("size mismatch");
|
||||
}
|
||||
|
||||
memcpy(tmp, a_part, keys_seed_binary_size);
|
||||
|
||||
cn_fast_hash(tmp, 32, (char*)&tmp[32]);
|
||||
|
||||
sc_reduce(tmp);
|
||||
memcpy(&sec, tmp, 32);
|
||||
ge_p3 point;
|
||||
ge_scalarmult_base(&point, &sec);
|
||||
ge_p3_tobytes(&pub, &point);
|
||||
}
|
||||
|
||||
void crypto_ops::generate_seed_keys(public_key &pub, secret_key &sec, std::vector<unsigned char>& keys_seed_binary, size_t keys_seed_binary_size)
|
||||
{
|
||||
keys_seed_binary.resize(keys_seed_binary_size, 0);
|
||||
generate_random_bytes(keys_seed_binary_size, keys_seed_binary.data());
|
||||
keys_from_default(keys_seed_binary.data(), pub, sec, keys_seed_binary_size);
|
||||
}
|
||||
|
||||
static inline void hash_to_scalar(const void *data, size_t length, ec_scalar &res)
|
||||
{
|
||||
cn_fast_hash(data, length, reinterpret_cast<hash &>(res));
|
||||
sc_reduce32(&res);
|
||||
}
|
||||
|
||||
void crypto_ops::generate_keys(public_key &pub, secret_key &sec)
|
||||
{
|
||||
std::lock_guard<std::mutex> lock(random_lock_accessor());
|
||||
ge_p3 point;
|
||||
random_scalar_no_lock(sec);
|
||||
ge_scalarmult_base(&point, &sec);
|
||||
ge_p3_tobytes(&pub, &point);
|
||||
}
|
||||
|
||||
void crypto_ops::dependent_key(const secret_key& first, secret_key& second)
|
||||
{
|
||||
hash_to_scalar(&first, 32, second);
|
||||
if (sc_check((unsigned char*)&second) != 0)
|
||||
throw std::runtime_error("Failed to derive key");
|
||||
}
|
||||
|
||||
|
||||
bool crypto_ops::check_key(const public_key &key) {
|
||||
ge_p3 point;
|
||||
return ge_frombytes_vartime(&point, &key) == 0;
|
||||
}
|
||||
|
||||
/*
|
||||
Fix discovered by Monero Lab and suggested by "fluffypony" (bitcointalk.org)
|
||||
*/
|
||||
key_image scalarmult_key(const key_image & P, const key_image & a)
|
||||
{
|
||||
ge_p3 A = ge_p3();
|
||||
ge_p2 R = ge_p2();
|
||||
if (ge_frombytes_vartime(&A, reinterpret_cast<const unsigned char*>(&P)) != 0)
|
||||
return Z;
|
||||
ge_scalarmult(&R, reinterpret_cast<const unsigned char*>(&a), &A);
|
||||
key_image a_p = key_image();
|
||||
ge_tobytes(reinterpret_cast<unsigned char*>(&a_p), &R);
|
||||
return a_p;
|
||||
}
|
||||
|
||||
bool crypto_ops::validate_key_image(const key_image& ki)
|
||||
{
|
||||
if (!(scalarmult_key(ki, L) == I))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool crypto_ops::secret_key_to_public_key(const secret_key &sec, public_key &pub) {
|
||||
ge_p3 point;
|
||||
if (sc_check(&sec) != 0) {
|
||||
return false;
|
||||
}
|
||||
ge_scalarmult_base(&point, &sec);
|
||||
ge_p3_tobytes(&pub, &point);
|
||||
return true;
|
||||
}
|
||||
|
||||
bool crypto_ops::generate_key_derivation(const public_key &key1, const secret_key &key2, key_derivation &derivation) {
|
||||
ge_p3 point;
|
||||
ge_p2 point2;
|
||||
ge_p1p1 point3;
|
||||
crypto_assert(sc_check(&key2) == 0);
|
||||
if (ge_frombytes_vartime(&point, &key1) != 0) {
|
||||
return false;
|
||||
}
|
||||
ge_scalarmult(&point2, &key2, &point);
|
||||
ge_mul8(&point3, &point2);
|
||||
ge_p1p1_to_p2(&point2, &point3);
|
||||
ge_tobytes(&derivation, &point2);
|
||||
return true;
|
||||
}
|
||||
|
||||
void crypto_ops::derivation_to_scalar(const key_derivation &derivation, size_t output_index, ec_scalar &res)
|
||||
{
|
||||
struct {
|
||||
key_derivation derivation;
|
||||
char output_index[(sizeof(size_t) * 8 + 6) / 7];
|
||||
} buf;
|
||||
char *end = buf.output_index;
|
||||
buf.derivation = derivation;
|
||||
tools::write_varint(end, output_index);
|
||||
if (!(end <= buf.output_index + sizeof buf.output_index))
|
||||
{
|
||||
crypto_assert(false);
|
||||
return;
|
||||
}
|
||||
hash_to_scalar(&buf, end - reinterpret_cast<char *>(&buf), res);
|
||||
}
|
||||
|
||||
bool crypto_ops::derive_public_key(const key_derivation &derivation, size_t output_index,
|
||||
const public_key &base, public_key &derived_key) {
|
||||
ec_scalar scalar;
|
||||
ge_p3 point1;
|
||||
ge_p3 point2;
|
||||
ge_cached point3;
|
||||
ge_p1p1 point4;
|
||||
ge_p2 point5;
|
||||
if (ge_frombytes_vartime(&point1, &base) != 0) {
|
||||
return false;
|
||||
}
|
||||
derivation_to_scalar(derivation, output_index, scalar);
|
||||
ge_scalarmult_base(&point2, &scalar);
|
||||
ge_p3_to_cached(&point3, &point2);
|
||||
ge_add(&point4, &point1, &point3);
|
||||
ge_p1p1_to_p2(&point5, &point4);
|
||||
ge_tobytes(&derived_key, &point5);
|
||||
return true;
|
||||
}
|
||||
|
||||
void crypto_ops::derive_secret_key(const key_derivation &derivation, size_t output_index,
|
||||
const secret_key &base, secret_key &derived_key) {
|
||||
ec_scalar scalar;
|
||||
crypto_assert(sc_check(&base) == 0);
|
||||
derivation_to_scalar(derivation, output_index, scalar);
|
||||
sc_add(&derived_key, &base, &scalar);
|
||||
}
|
||||
|
||||
struct s_comm {
|
||||
hash h;
|
||||
ec_point key;
|
||||
ec_point comm;
|
||||
};
|
||||
|
||||
void crypto_ops::generate_signature(const hash &prefix_hash, const public_key &pub, const secret_key &sec, signature &sig) {
|
||||
std::lock_guard<std::mutex> lock(random_lock_accessor());
|
||||
ge_p3 tmp3;
|
||||
ec_scalar k;
|
||||
s_comm buf;
|
||||
#if !defined(NDEBUG)
|
||||
{
|
||||
ge_p3 t;
|
||||
public_key t2;
|
||||
crypto_assert(sc_check(&sec) == 0);
|
||||
ge_scalarmult_base(&t, &sec);
|
||||
ge_p3_tobytes(&t2, &t);
|
||||
crypto_assert(pub == t2);
|
||||
}
|
||||
#endif
|
||||
buf.h = prefix_hash;
|
||||
buf.key = pub;
|
||||
random_scalar_no_lock(k);
|
||||
ge_scalarmult_base(&tmp3, &k);
|
||||
ge_p3_tobytes(&buf.comm, &tmp3);
|
||||
hash_to_scalar(&buf, sizeof(s_comm), sig.c);
|
||||
sc_mulsub(&sig.r, &sig.c, &sec, &k);
|
||||
}
|
||||
|
||||
bool crypto_ops::check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) {
|
||||
ge_p2 tmp2;
|
||||
ge_p3 tmp3;
|
||||
ec_scalar c;
|
||||
s_comm buf;
|
||||
crypto_assert(check_key(pub));
|
||||
buf.h = prefix_hash;
|
||||
buf.key = pub;
|
||||
if (ge_frombytes_vartime(&tmp3, &pub) != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0) {
|
||||
return false;
|
||||
}
|
||||
ge_double_scalarmult_base_vartime(&tmp2, &sig.c, &tmp3, &sig.r);
|
||||
ge_tobytes(&buf.comm, &tmp2);
|
||||
hash_to_scalar(&buf, sizeof(s_comm), c);
|
||||
sc_sub(&c, &c, &sig.c);
|
||||
return sc_isnonzero(&c) == 0;
|
||||
}
|
||||
|
||||
static void hash_to_ec(const public_key &key, ge_p3 &res) {
|
||||
hash h;
|
||||
ge_p2 point;
|
||||
ge_p1p1 point2;
|
||||
cn_fast_hash(std::addressof(key), sizeof(public_key), h);
|
||||
ge_fromfe_frombytes_vartime(&point, reinterpret_cast<const unsigned char *>(&h));
|
||||
ge_mul8(&point2, &point);
|
||||
ge_p1p1_to_p3(&res, &point2);
|
||||
}
|
||||
|
||||
void crypto_ops::generate_key_image(const public_key &pub, const secret_key &sec, key_image &image) {
|
||||
// image = sec * 8 * ge_fromfe_frombytes_vartime(cn_fast_hash(pub)) = sec * Hp( pub )
|
||||
ge_p3 point;
|
||||
ge_p2 point2;
|
||||
crypto_assert(sc_check(&sec) == 0);
|
||||
hash_to_ec(pub, point);
|
||||
ge_scalarmult(&point2, &sec, &point);
|
||||
ge_tobytes(&image, &point2);
|
||||
}
|
||||
|
||||
PUSH_VS_WARNINGS
|
||||
DISABLE_VS_WARNINGS(4200)
|
||||
struct rs_comm_entry
|
||||
{
|
||||
ec_point a, b;
|
||||
};
|
||||
|
||||
struct rs_comm
|
||||
{
|
||||
hash h;
|
||||
struct rs_comm_entry ab[];
|
||||
};
|
||||
POP_VS_WARNINGS
|
||||
|
||||
static inline size_t rs_comm_size(size_t pubs_count) {
|
||||
return sizeof(rs_comm)+pubs_count * sizeof(rs_comm_entry);
|
||||
}
|
||||
|
||||
void crypto_ops::generate_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const public_key *const *pubs, size_t pubs_count,
|
||||
const secret_key &sec, size_t sec_index,
|
||||
signature *sig) {
|
||||
std::lock_guard<std::mutex> lock(random_lock_accessor());
|
||||
size_t i;
|
||||
ge_p3 image_unp;
|
||||
ge_dsmp image_pre;
|
||||
ec_scalar sum, k, h;
|
||||
rs_comm *const buf = reinterpret_cast<rs_comm *>(alloca(rs_comm_size(pubs_count)));
|
||||
if (!(sec_index < pubs_count))
|
||||
{
|
||||
crypto_assert(false);
|
||||
return;
|
||||
}
|
||||
#if !defined(NDEBUG)
|
||||
{
|
||||
ge_p3 t;
|
||||
public_key t2;
|
||||
key_image t3;
|
||||
crypto_assert(sc_check(&sec) == 0);
|
||||
ge_scalarmult_base(&t, &sec);
|
||||
ge_p3_tobytes(&t2, &t);
|
||||
crypto_assert(*pubs[sec_index] == t2);
|
||||
generate_key_image(*pubs[sec_index], sec, t3);
|
||||
crypto_assert(image == t3);
|
||||
for (i = 0; i < pubs_count; i++) {
|
||||
crypto_assert(check_key(*pubs[i]));
|
||||
}
|
||||
}
|
||||
#endif
|
||||
if (ge_frombytes_vartime(&image_unp, &image) != 0) {
|
||||
abort();
|
||||
}
|
||||
ge_dsm_precomp(image_pre, &image_unp);
|
||||
sc_0(&sum);
|
||||
buf->h = prefix_hash;
|
||||
for (i = 0; i < pubs_count; i++) {
|
||||
ge_p2 tmp2;
|
||||
ge_p3 tmp3;
|
||||
if (i == sec_index) {
|
||||
random_scalar_no_lock(k);
|
||||
ge_scalarmult_base(&tmp3, &k);
|
||||
ge_p3_tobytes(&buf->ab[i].a, &tmp3);
|
||||
hash_to_ec(*pubs[i], tmp3);
|
||||
ge_scalarmult(&tmp2, &k, &tmp3);
|
||||
ge_tobytes(&buf->ab[i].b, &tmp2);
|
||||
} else {
|
||||
random_scalar_no_lock(sig[i].c);
|
||||
random_scalar_no_lock(sig[i].r);
|
||||
if (ge_frombytes_vartime(&tmp3, &*pubs[i]) != 0) {
|
||||
abort();
|
||||
}
|
||||
ge_double_scalarmult_base_vartime(&tmp2, &sig[i].c, &tmp3, &sig[i].r);
|
||||
ge_tobytes(&buf->ab[i].a, &tmp2);
|
||||
hash_to_ec(*pubs[i], tmp3);
|
||||
ge_double_scalarmult_precomp_vartime(&tmp2, &sig[i].r, &tmp3, &sig[i].c, image_pre);
|
||||
ge_tobytes(&buf->ab[i].b, &tmp2);
|
||||
sc_add(&sum, &sum, &sig[i].c);
|
||||
}
|
||||
}
|
||||
hash_to_scalar(buf, rs_comm_size(pubs_count), h);
|
||||
sc_sub(&sig[sec_index].c, &h, &sum);
|
||||
sc_mulsub(&sig[sec_index].r, &sig[sec_index].c, &sec, &k);
|
||||
}
|
||||
|
||||
bool crypto_ops::check_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const public_key *const *pubs, size_t pubs_count,
|
||||
const signature *sig) {
|
||||
size_t i;
|
||||
ge_p3 image_unp;
|
||||
ge_dsmp image_pre;
|
||||
ec_scalar sum, h;
|
||||
rs_comm *const buf = reinterpret_cast<rs_comm *>(alloca(rs_comm_size(pubs_count)));
|
||||
#if !defined(NDEBUG)
|
||||
for (i = 0; i < pubs_count; i++) {
|
||||
crypto_assert(check_key(*pubs[i]));
|
||||
}
|
||||
#endif
|
||||
if (ge_frombytes_vartime(&image_unp, &image) != 0) {
|
||||
return false;
|
||||
}
|
||||
ge_dsm_precomp(image_pre, &image_unp);
|
||||
sc_0(&sum);
|
||||
buf->h = prefix_hash;
|
||||
for (i = 0; i < pubs_count; i++) {
|
||||
ge_p2 tmp2;
|
||||
ge_p3 tmp3;
|
||||
if (sc_check(&sig[i].c) != 0 || sc_check(&sig[i].r) != 0) {
|
||||
return false;
|
||||
}
|
||||
if (ge_frombytes_vartime(&tmp3, &*pubs[i]) != 0) {
|
||||
return false;
|
||||
}
|
||||
ge_double_scalarmult_base_vartime(&tmp2, &sig[i].c, &tmp3, &sig[i].r); // L_i = r_i * G + c_i * P_i
|
||||
ge_tobytes(&buf->ab[i].a, &tmp2);
|
||||
hash_to_ec(*pubs[i], tmp3);
|
||||
ge_double_scalarmult_precomp_vartime(&tmp2, &sig[i].r, &tmp3, &sig[i].c, image_pre); // R_i = r_i * Hp(P_i) + c_i * I
|
||||
ge_tobytes(&buf->ab[i].b, &tmp2);
|
||||
sc_add(&sum, &sum, &sig[i].c);
|
||||
}
|
||||
hash_to_scalar(buf, rs_comm_size(pubs_count), h);
|
||||
sc_sub(&h, &h, &sum);
|
||||
return sc_isnonzero(&h) == 0;
|
||||
}
|
||||
|
||||
} // namespace crypto
|
||||
333
crypto/upstream/crypto.h
Executable file
333
crypto/upstream/crypto.h
Executable file
|
|
@ -0,0 +1,333 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <cstddef>
|
||||
#include <mutex>
|
||||
#include <vector>
|
||||
#include <string>
|
||||
#include <algorithm>
|
||||
|
||||
#include "common/pod-class.h"
|
||||
#include "generic-ops.h"
|
||||
#include "hash.h"
|
||||
#include "warnings.h"
|
||||
|
||||
#define CRYPTO_STR_(X) #X
|
||||
#define CRYPTO_STR(X) CRYPTO_STR_(X)
|
||||
#define CRYPTO_CHECK_AND_THROW_MES(cond, msg) if (!(cond)) { throw std::runtime_error(msg " @ " __FILE__ ":" CRYPTO_STR(__LINE__)); }
|
||||
|
||||
PUSH_GCC_WARNINGS
|
||||
DISABLE_CLANG_WARNING(unused-private-field)
|
||||
|
||||
|
||||
namespace crypto {
|
||||
|
||||
extern "C" {
|
||||
#include "random.h"
|
||||
}
|
||||
|
||||
std::mutex& random_lock_accessor() noexcept;
|
||||
|
||||
#pragma pack(push, 1)
|
||||
POD_CLASS ec_point {
|
||||
char data[32];
|
||||
};
|
||||
|
||||
POD_CLASS ec_scalar {
|
||||
char data[32];
|
||||
};
|
||||
|
||||
POD_CLASS public_key: ec_point {
|
||||
friend class crypto_ops;
|
||||
};
|
||||
|
||||
POD_CLASS secret_key: ec_scalar {
|
||||
friend class crypto_ops;
|
||||
};
|
||||
|
||||
POD_CLASS key_derivation: ec_point {
|
||||
friend class crypto_ops;
|
||||
};
|
||||
|
||||
POD_CLASS key_image: public ec_point {
|
||||
friend class crypto_ops;
|
||||
};
|
||||
|
||||
POD_CLASS signature {
|
||||
ec_scalar c, r;
|
||||
friend class crypto_ops;
|
||||
};
|
||||
#pragma pack(pop)
|
||||
|
||||
static_assert(sizeof(ec_point) == 32 && sizeof(ec_scalar) == 32 &&
|
||||
sizeof(public_key) == 32 && sizeof(secret_key) == 32 &&
|
||||
sizeof(key_derivation) == 32 && sizeof(key_image) == 32 &&
|
||||
sizeof(signature) == 64, "Invalid structure size");
|
||||
|
||||
class crypto_ops {
|
||||
crypto_ops();
|
||||
crypto_ops(const crypto_ops &);
|
||||
void operator=(const crypto_ops &);
|
||||
~crypto_ops();
|
||||
|
||||
static void generate_keys(public_key &, secret_key &);
|
||||
friend void generate_keys(public_key &, secret_key &);
|
||||
static void generate_seed_keys(public_key &pub, secret_key &sec, std::vector<unsigned char>& keys_seed_binary, size_t keys_seed_binary_size);
|
||||
friend void generate_seed_keys(public_key &pub, secret_key &sec, std::vector<unsigned char>& keys_seed_binary, size_t keys_seed_binary_size);
|
||||
static void keys_from_default(const unsigned char* a_part, public_key &pub, secret_key &sec, size_t keys_seed_binary_size);
|
||||
friend void keys_from_default(const unsigned char* a_part, public_key &pub, secret_key &sec, size_t keys_seed_binary_size);
|
||||
static void dependent_key(const secret_key& first, secret_key& second);
|
||||
friend void dependent_key(const secret_key& first, secret_key& second);
|
||||
static bool check_key(const public_key &);
|
||||
friend bool check_key(const public_key &);
|
||||
static bool secret_key_to_public_key(const secret_key &, public_key &);
|
||||
friend bool secret_key_to_public_key(const secret_key &, public_key &);
|
||||
static bool generate_key_derivation(const public_key &, const secret_key &, key_derivation &);
|
||||
friend bool generate_key_derivation(const public_key &, const secret_key &, key_derivation &);
|
||||
static void derivation_to_scalar(const key_derivation &, size_t, ec_scalar &);
|
||||
friend void derivation_to_scalar(const key_derivation &, size_t, ec_scalar &);
|
||||
static bool derive_public_key(const key_derivation &, std::size_t, const public_key &, public_key &);
|
||||
friend bool derive_public_key(const key_derivation &, std::size_t, const public_key &, public_key &);
|
||||
static void derive_secret_key(const key_derivation &, std::size_t, const secret_key &, secret_key &);
|
||||
friend void derive_secret_key(const key_derivation &, std::size_t, const secret_key &, secret_key &);
|
||||
static void generate_signature(const hash &, const public_key &, const secret_key &, signature &);
|
||||
friend void generate_signature(const hash &, const public_key &, const secret_key &, signature &);
|
||||
static bool check_signature(const hash &, const public_key &, const signature &);
|
||||
friend bool check_signature(const hash &, const public_key &, const signature &);
|
||||
static void generate_key_image(const public_key &, const secret_key &, key_image &);
|
||||
friend void generate_key_image(const public_key &, const secret_key &, key_image &);
|
||||
static void generate_ring_signature(const hash &, const key_image &,
|
||||
const public_key *const *, std::size_t, const secret_key &, std::size_t, signature *);
|
||||
friend void generate_ring_signature(const hash &, const key_image &,
|
||||
const public_key *const *, std::size_t, const secret_key &, std::size_t, signature *);
|
||||
static bool check_ring_signature(const hash &, const key_image &,
|
||||
const public_key *const *, std::size_t, const signature *);
|
||||
friend bool check_ring_signature(const hash &, const key_image &,
|
||||
const public_key *const *, std::size_t, const signature *);
|
||||
friend bool validate_key_image(const key_image& ki);
|
||||
static bool validate_key_image(const key_image& ki);
|
||||
|
||||
};
|
||||
|
||||
// thread-safe version
|
||||
inline void generate_random_bytes(size_t size, void* p_data)
|
||||
{
|
||||
std::lock_guard<std::mutex> lock(random_lock_accessor());
|
||||
generate_random_bytes_no_lock(size, p_data);
|
||||
}
|
||||
|
||||
|
||||
/* Generate a value filled with random bytes.
|
||||
*/
|
||||
template<typename T>
|
||||
typename std::enable_if<std::is_pod<T>::value, T>::type rand()
|
||||
{
|
||||
typename std::remove_cv<T>::type res;
|
||||
std::lock_guard<std::mutex> lock(random_lock_accessor());
|
||||
generate_random_bytes_no_lock(sizeof(T), &res);
|
||||
return res;
|
||||
}
|
||||
|
||||
/* An adapter, to be used with std::shuffle, etc.
|
||||
* Uses thread-safe crypto::rand<>().
|
||||
*/
|
||||
struct uniform_random_bit_generator
|
||||
{
|
||||
typedef uint64_t result_type;
|
||||
static CONSTEXPR uint64_t min() { return 0; }
|
||||
static CONSTEXPR uint64_t max() { return UINT64_MAX; }
|
||||
uint64_t operator()() { return rand<uint64_t>(); }
|
||||
};
|
||||
|
||||
|
||||
/* Generate a new key pair
|
||||
*/
|
||||
inline void generate_keys(public_key &pub, secret_key &sec) {
|
||||
crypto_ops::generate_keys(pub, sec);
|
||||
}
|
||||
|
||||
inline void generate_seed_keys(public_key &pub, secret_key &sec, std::vector<unsigned char>& keys_seed_binary, size_t keys_seed_binary_size)
|
||||
{
|
||||
crypto_ops::generate_seed_keys(pub, sec, keys_seed_binary, keys_seed_binary_size);
|
||||
}
|
||||
|
||||
inline void keys_from_default(const unsigned char* a_part, public_key &pub, secret_key &sec, size_t keys_seed_binary_size)
|
||||
{
|
||||
crypto_ops::keys_from_default(a_part, pub, sec, keys_seed_binary_size);
|
||||
}
|
||||
|
||||
inline void dependent_key(const secret_key& first, secret_key& second){
|
||||
return crypto_ops::dependent_key(first, second);
|
||||
}
|
||||
|
||||
/* Check a public key. Returns true if it is valid, false otherwise.
|
||||
*/
|
||||
inline bool check_key(const public_key &key) {
|
||||
return crypto_ops::check_key(key);
|
||||
}
|
||||
|
||||
inline bool validate_key_image(const key_image& ki){
|
||||
return crypto_ops::validate_key_image(ki);
|
||||
}
|
||||
/* Checks a private key and computes the corresponding public key.
|
||||
*/
|
||||
inline bool secret_key_to_public_key(const secret_key &sec, public_key &pub) {
|
||||
return crypto_ops::secret_key_to_public_key(sec, pub);
|
||||
}
|
||||
|
||||
/* To generate an ephemeral key used to send money to:
|
||||
* * The sender generates a new key pair, which becomes the transaction key. The public transaction key is included in "extra" field.
|
||||
* * Both the sender and the receiver generate key derivation from the transaction key, the receivers' "view" key and the output index.
|
||||
* * The sender uses key derivation and the receivers' "spend" key to derive an ephemeral public key.
|
||||
* * The receiver can either derive the public key (to check that the transaction is addressed to him) or the private key (to spend the money).
|
||||
*/
|
||||
inline bool generate_key_derivation(const public_key &key1, const secret_key &key2, key_derivation &derivation) {
|
||||
return crypto_ops::generate_key_derivation(key1, key2, derivation);
|
||||
}
|
||||
inline void derivation_to_scalar(const key_derivation &derivation, size_t output_index, ec_scalar &result) {
|
||||
crypto::crypto_ops::derivation_to_scalar(derivation, output_index, result);
|
||||
}
|
||||
|
||||
inline bool derive_public_key(const key_derivation &derivation, std::size_t output_index,
|
||||
const public_key &base, public_key &derived_key) {
|
||||
return crypto_ops::derive_public_key(derivation, output_index, base, derived_key);
|
||||
}
|
||||
inline void derive_secret_key(const key_derivation &derivation, std::size_t output_index,
|
||||
const secret_key &base, secret_key &derived_key) {
|
||||
crypto_ops::derive_secret_key(derivation, output_index, base, derived_key);
|
||||
}
|
||||
|
||||
/* Generation and checking of a standard signature.
|
||||
*/
|
||||
inline void generate_signature(const hash &prefix_hash, const public_key &pub, const secret_key &sec, signature &sig) {
|
||||
crypto_ops::generate_signature(prefix_hash, pub, sec, sig);
|
||||
}
|
||||
inline bool check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) {
|
||||
return crypto_ops::check_signature(prefix_hash, pub, sig);
|
||||
}
|
||||
|
||||
/* To send money to a key:
|
||||
* * The sender generates an ephemeral key and includes it in transaction output.
|
||||
* * To spend the money, the receiver generates a key image from it.
|
||||
* * Then he selects a bunch of outputs, including the one he spends, and uses them to generate a ring signature.
|
||||
* To check the signature, it is necessary to collect all the keys that were used to generate it. To detect double spends, it is necessary to check that each key image is used at most once.
|
||||
*/
|
||||
inline void generate_key_image(const public_key &pub, const secret_key &sec, key_image &image) {
|
||||
crypto_ops::generate_key_image(pub, sec, image);
|
||||
}
|
||||
inline void generate_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const public_key *const *pubs, std::size_t pubs_count,
|
||||
const secret_key &sec, std::size_t sec_index,
|
||||
signature *sig) {
|
||||
crypto_ops::generate_ring_signature(prefix_hash, image, pubs, pubs_count, sec, sec_index, sig);
|
||||
}
|
||||
inline bool check_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const public_key *const *pubs, std::size_t pubs_count,
|
||||
const signature *sig) {
|
||||
return crypto_ops::check_ring_signature(prefix_hash, image, pubs, pubs_count, sig);
|
||||
}
|
||||
|
||||
/* Variants with vector<const public_key *> parameters.
|
||||
*/
|
||||
inline void generate_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const std::vector<const public_key *> &pubs,
|
||||
const secret_key &sec, std::size_t sec_index,
|
||||
signature *sig) {
|
||||
generate_ring_signature(prefix_hash, image, pubs.data(), pubs.size(), sec, sec_index, sig);
|
||||
}
|
||||
inline bool check_ring_signature(const hash &prefix_hash, const key_image &image,
|
||||
const std::vector<const public_key *> &pubs,
|
||||
const signature *sig) {
|
||||
return check_ring_signature(prefix_hash, image, pubs.data(), pubs.size(), sig);
|
||||
}
|
||||
|
||||
class stream_cn_hash
|
||||
{
|
||||
public:
|
||||
static constexpr size_t DATA_BLOCK_SIZE = 1024 * 1024;
|
||||
|
||||
stream_cn_hash()
|
||||
: m_buffer(HASH_SIZE + DATA_BLOCK_SIZE, '\0')
|
||||
, m_p_hash(const_cast<hash*>(reinterpret_cast<const hash*>(m_buffer.data())))
|
||||
, m_p_data(const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(m_buffer.data())) + HASH_SIZE)
|
||||
, m_ready(false)
|
||||
, m_data_used(0)
|
||||
{
|
||||
m_ready = true;
|
||||
}
|
||||
|
||||
bool update(const void* data, size_t size)
|
||||
{
|
||||
if (!m_ready)
|
||||
return false;
|
||||
|
||||
const uint8_t* p_source_data = reinterpret_cast<const uint8_t*>(data);
|
||||
|
||||
while(size > 0)
|
||||
{
|
||||
// fill the buffer up
|
||||
size_t bytes_to_copy = std::min(size, DATA_BLOCK_SIZE - m_data_used);
|
||||
memcpy(m_p_data + m_data_used, p_source_data, bytes_to_copy);
|
||||
m_data_used += bytes_to_copy;
|
||||
p_source_data += bytes_to_copy;
|
||||
size -= bytes_to_copy;
|
||||
|
||||
if (m_data_used == DATA_BLOCK_SIZE)
|
||||
{
|
||||
// calc imtermediate hash of the whole buffer and put the result into the beginning of the buffer
|
||||
*m_p_hash = cn_fast_hash(m_buffer.data(), HASH_SIZE + m_data_used);
|
||||
// clear data buffer for new bytes
|
||||
memset(m_p_data, 0, DATA_BLOCK_SIZE);
|
||||
m_data_used = 0;
|
||||
}
|
||||
|
||||
// repeat if there are source bytes left
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
hash calculate_hash()
|
||||
{
|
||||
if (m_data_used == 0)
|
||||
return *m_p_hash;
|
||||
|
||||
m_ready = false;
|
||||
return cn_fast_hash(m_buffer.data(), HASH_SIZE + m_data_used);
|
||||
}
|
||||
|
||||
private:
|
||||
const std::string m_buffer;
|
||||
hash* const m_p_hash;
|
||||
uint8_t* const m_p_data;
|
||||
size_t m_data_used;
|
||||
bool m_ready;
|
||||
}; // class stream_cn_hash
|
||||
|
||||
} // namespace crypto
|
||||
|
||||
POD_MAKE_HASHABLE(crypto, public_key)
|
||||
POD_MAKE_LESS_OPERATOR(crypto, public_key)
|
||||
POD_MAKE_COMPARABLE(crypto, secret_key)
|
||||
POD_MAKE_HASHABLE(crypto, key_image)
|
||||
POD_MAKE_COMPARABLE(crypto, signature)
|
||||
POD_MAKE_COMPARABLE(crypto, key_derivation)
|
||||
POD_MAKE_LESS_OPERATOR(crypto, hash)
|
||||
POD_MAKE_LESS_OPERATOR(crypto, key_image)
|
||||
POP_GCC_WARNINGS
|
||||
1
crypto/upstream/crypto/crypto-ops.h
Symbolic link
1
crypto/upstream/crypto/crypto-ops.h
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../crypto-ops.h
|
||||
417
crypto/upstream/eth_signature.cpp
Executable file
417
crypto/upstream/eth_signature.cpp
Executable file
|
|
@ -0,0 +1,417 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "eth_signature.h"
|
||||
#include "crypto.h"
|
||||
#ifndef USE_OPEN_SSL_FOR_ECDSA
|
||||
#include "bitcoin-secp256k1/include/secp256k1.h"
|
||||
#endif
|
||||
#include "random.h"
|
||||
#include "misc_language.h"
|
||||
#include <string_tools.h>
|
||||
|
||||
|
||||
#ifdef USE_OPEN_SSL_FOR_ECDSA
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/ecdsa.h>
|
||||
#include <openssl/obj_mac.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/rand.h>
|
||||
#endif
|
||||
|
||||
|
||||
// Function to create EC_KEY from raw 32 - byte private key
|
||||
EC_KEY * create_ec_key_from_private_key(const unsigned char* private_key) {
|
||||
EC_KEY* key = EC_KEY_new_by_curve_name(NID_secp256k1);
|
||||
if (!key) {
|
||||
std::cerr << "Failed to create new EC Key" << std::endl;
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
BIGNUM* priv_key_bn = BN_bin2bn(private_key, 32, nullptr);
|
||||
if (!priv_key_bn) {
|
||||
std::cerr << "Failed to convert private key to BIGNUM" << std::endl;
|
||||
EC_KEY_free(key);
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
if (!EC_KEY_set_private_key(key, priv_key_bn)) {
|
||||
std::cerr << "Failed to set private key" << std::endl;
|
||||
EC_KEY_free(key);
|
||||
BN_free(priv_key_bn);
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
BN_free(priv_key_bn);
|
||||
return key;
|
||||
}
|
||||
|
||||
|
||||
void ensure_canonical_s(BIGNUM* s, const EC_GROUP* group) {
|
||||
// Get the order of the curve
|
||||
BIGNUM* order = BN_new();
|
||||
EC_GROUP_get_order(group, order, nullptr);
|
||||
|
||||
// Compute half of the order: `n / 2`
|
||||
BIGNUM* half_order = BN_new();
|
||||
BN_rshift1(half_order, order);
|
||||
|
||||
// If `s` is greater than `n / 2`, replace `s` with `n - s`
|
||||
if (BN_cmp(s, half_order) > 0) {
|
||||
BN_sub(s, order, s);
|
||||
}
|
||||
|
||||
BN_free(order);
|
||||
BN_free(half_order);
|
||||
}
|
||||
|
||||
// Update the function to ensure canonical `s`
|
||||
bool generate_ethereum_signature(const unsigned char* hash, const unsigned char* private_key, crypto::eth_signature& sig_res) {
|
||||
EC_KEY* ec_key = create_ec_key_from_private_key(private_key);
|
||||
if (!ec_key) {
|
||||
throw std::runtime_error("Failed to create EC key from private key");
|
||||
}
|
||||
|
||||
// Sign the hash
|
||||
unsigned int sig_len = ECDSA_size(ec_key);
|
||||
std::vector<unsigned char> signature(sig_len);
|
||||
if (ECDSA_sign(0, hash, 32, signature.data(), &sig_len, ec_key) == 0) {
|
||||
EC_KEY_free(ec_key);
|
||||
throw std::runtime_error("Failed to create signature");
|
||||
}
|
||||
signature.resize(sig_len);
|
||||
|
||||
|
||||
// The OpenSSL ECDSA signature output is DER encoded, Ethereum expects (r, s, v)
|
||||
const unsigned char* p = signature.data();
|
||||
ECDSA_SIG* sig = d2i_ECDSA_SIG(nullptr, &p, sig_len);
|
||||
if (!sig) {
|
||||
EC_KEY_free(ec_key);
|
||||
throw std::runtime_error("Failed to parse ECDSA signature");
|
||||
}
|
||||
|
||||
const BIGNUM* r = nullptr;
|
||||
const BIGNUM* s = nullptr;
|
||||
ECDSA_SIG_get0(sig, &r, &s);
|
||||
|
||||
// Ensure canonical `s`
|
||||
BIGNUM* s_canonical = BN_dup(s);
|
||||
ensure_canonical_s(s_canonical, EC_KEY_get0_group(ec_key));
|
||||
|
||||
BN_bn2binpad(r, (unsigned char* )&sig_res.data[0], 32);
|
||||
BN_bn2binpad(s_canonical, (unsigned char*)&sig_res.data[32], 32);
|
||||
|
||||
|
||||
ECDSA_SIG_free(sig);
|
||||
BN_free(s_canonical);
|
||||
EC_KEY_free(ec_key);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Convert raw 33-byte compressed public key to EC_KEY object
|
||||
EC_KEY* create_ec_key_from_compressed_public_key(const unsigned char* compressed_pub_key) {
|
||||
EC_KEY* key = EC_KEY_new_by_curve_name(NID_secp256k1);
|
||||
if (!key) {
|
||||
std::cerr << "Failed to create EC_KEY object" << std::endl;
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
EC_POINT* pub_point = EC_POINT_new(EC_KEY_get0_group(key));
|
||||
if (!EC_POINT_oct2point(EC_KEY_get0_group(key), pub_point, compressed_pub_key, 33, nullptr)) {
|
||||
std::cerr << "Failed to convert compressed public key" << std::endl;
|
||||
EC_POINT_free(pub_point);
|
||||
EC_KEY_free(key);
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
if (!EC_KEY_set_public_key(key, pub_point)) {
|
||||
std::cerr << "Failed to set public key" << std::endl;
|
||||
EC_POINT_free(pub_point);
|
||||
EC_KEY_free(key);
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
EC_POINT_free(pub_point);
|
||||
return key;
|
||||
}
|
||||
|
||||
// Function to verify Ethereum-compatible signature
|
||||
bool verify_ethereum_signature(const crypto::hash& m, const crypto::eth_signature& sig_res, const crypto::eth_public_key& compressed_pub_key) {
|
||||
EC_KEY* ec_key = create_ec_key_from_compressed_public_key((const unsigned char*)&compressed_pub_key.data[0]);
|
||||
if (!ec_key) {
|
||||
throw std::runtime_error("Failed to create EC key from compressed public key");
|
||||
}
|
||||
const unsigned char* r = (unsigned char*)&sig_res.data[0];
|
||||
const unsigned char* s = (unsigned char*)&sig_res.data[32];
|
||||
const unsigned char* hash = (unsigned char*)&m;
|
||||
|
||||
// Create ECDSA_SIG from r and s
|
||||
BIGNUM* bn_r = BN_bin2bn(r, 32, nullptr);
|
||||
BIGNUM* bn_s = BN_bin2bn(s, 32, nullptr);
|
||||
if (!bn_r || !bn_s) {
|
||||
EC_KEY_free(ec_key);
|
||||
BN_free(bn_r);
|
||||
BN_free(bn_s);
|
||||
throw std::runtime_error("Failed to convert r or s to BIGNUM");
|
||||
}
|
||||
|
||||
ECDSA_SIG* sig = ECDSA_SIG_new();
|
||||
if (!sig) {
|
||||
EC_KEY_free(ec_key);
|
||||
BN_free(bn_r);
|
||||
BN_free(bn_s);
|
||||
throw std::runtime_error("Failed to create ECDSA_SIG object");
|
||||
}
|
||||
|
||||
if (!ECDSA_SIG_set0(sig, bn_r, bn_s)) {
|
||||
EC_KEY_free(ec_key);
|
||||
ECDSA_SIG_free(sig);
|
||||
BN_free(bn_r);
|
||||
BN_free(bn_s);
|
||||
throw std::runtime_error("Failed to set r and s in ECDSA_SIG");
|
||||
}
|
||||
|
||||
// Verify the signature
|
||||
int verification_result = ECDSA_do_verify(hash, 32, sig, ec_key);
|
||||
|
||||
ECDSA_SIG_free(sig);
|
||||
EC_KEY_free(ec_key);
|
||||
|
||||
|
||||
return verification_result == 1;
|
||||
}
|
||||
|
||||
|
||||
//
|
||||
// struct KeyPair {
|
||||
// std::vector<unsigned char> private_key; // 32 bytes
|
||||
// std::vector<unsigned char> public_key; // 33 bytes (compressed format)
|
||||
// };
|
||||
|
||||
// Function to generate an Ethereum-compatible key pair
|
||||
bool generate_ethereum_key_pair(crypto::eth_secret_key& sec_key, crypto::eth_public_key& pub_key) {
|
||||
/*KeyPair keypair;*/
|
||||
|
||||
// Create a new EC_KEY object with the secp256k1 curve
|
||||
EC_KEY* key = EC_KEY_new_by_curve_name(NID_secp256k1);
|
||||
if (!key) {
|
||||
throw std::runtime_error("Failed to create new EC_KEY object");
|
||||
}
|
||||
|
||||
// Generate the key pair
|
||||
if (EC_KEY_generate_key(key) == 0) {
|
||||
EC_KEY_free(key);
|
||||
throw std::runtime_error("Failed to generate key pair");
|
||||
}
|
||||
|
||||
// Extract the private key
|
||||
const BIGNUM* priv_bn = EC_KEY_get0_private_key(key);
|
||||
if (!priv_bn) {
|
||||
EC_KEY_free(key);
|
||||
throw std::runtime_error("Failed to get private key");
|
||||
}
|
||||
|
||||
BN_bn2binpad(priv_bn, (unsigned char*)&sec_key.data[0], 32);
|
||||
|
||||
// Extract the public key in compressed format
|
||||
const EC_POINT* pub_point = EC_KEY_get0_public_key(key);
|
||||
if (!pub_point) {
|
||||
EC_KEY_free(key);
|
||||
throw std::runtime_error("Failed to get public key");
|
||||
}
|
||||
|
||||
//keypair.public_key.resize(33); // Compressed format
|
||||
if (EC_POINT_point2oct(EC_KEY_get0_group(key), pub_point, POINT_CONVERSION_COMPRESSED,
|
||||
(unsigned char*)&pub_key.data[0], sizeof(pub_key.data), nullptr) == 0) {
|
||||
EC_KEY_free(key);
|
||||
throw std::runtime_error("Failed to convert public key to compressed format");
|
||||
}
|
||||
|
||||
EC_KEY_free(key);
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
bool generate_eth_key_pair(eth_secret_key& sec_key, eth_public_key& pub_key) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
#ifndef USE_OPEN_SSL_FOR_ECDSA
|
||||
secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
|
||||
auto slh = epee::misc_utils::create_scope_leave_handler([&ctx](){
|
||||
secp256k1_context_destroy(ctx);
|
||||
ctx = nullptr;
|
||||
});
|
||||
|
||||
uint8_t randomness[32];
|
||||
crypto::generate_random_bytes(sizeof randomness, randomness);
|
||||
if (!secp256k1_context_randomize(ctx, randomness))
|
||||
return false;
|
||||
|
||||
for(size_t i = 1024; i != 0; --i)
|
||||
{
|
||||
crypto::generate_random_bytes(sizeof sec_key, sec_key.data);
|
||||
if (secp256k1_ec_seckey_verify(ctx, sec_key.data))
|
||||
break;
|
||||
if (i == 1)
|
||||
return false;
|
||||
}
|
||||
|
||||
secp256k1_pubkey uncompressed_pub_key{};
|
||||
if (!secp256k1_ec_pubkey_create(ctx, &uncompressed_pub_key, sec_key.data))
|
||||
return false;
|
||||
|
||||
size_t output_len = sizeof pub_key;
|
||||
if (!secp256k1_ec_pubkey_serialize(ctx, pub_key.data, &output_len, &uncompressed_pub_key, SECP256K1_EC_COMPRESSED))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
#else
|
||||
return generate_ethereum_key_pair(sec_key, pub_key);
|
||||
#endif
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
#ifndef USE_OPEN_SSL_FOR_ECDSA
|
||||
bool eth_secret_key_to_public_key(const eth_secret_key& sec_key, eth_public_key& pub_key) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
// TODO: do we need this? consider using static context
|
||||
secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
|
||||
auto slh = epee::misc_utils::create_scope_leave_handler([&ctx](){
|
||||
secp256k1_context_destroy(ctx);
|
||||
ctx = nullptr;
|
||||
});
|
||||
|
||||
secp256k1_pubkey uncompressed_pub_key{};
|
||||
if (!secp256k1_ec_pubkey_create(ctx, &uncompressed_pub_key, sec_key.data))
|
||||
return false;
|
||||
|
||||
size_t output_len = sizeof pub_key;
|
||||
if (!secp256k1_ec_pubkey_serialize(ctx, pub_key.data, &output_len, &uncompressed_pub_key, SECP256K1_EC_COMPRESSED))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
// generates secp256k1 ECDSA signature
|
||||
bool generate_eth_signature(const hash& m, const eth_secret_key& sec_key, eth_signature& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
#ifndef USE_OPEN_SSL_FOR_ECDSA
|
||||
secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
|
||||
auto slh = epee::misc_utils::create_scope_leave_handler([&ctx](){
|
||||
secp256k1_context_destroy(ctx);
|
||||
ctx = nullptr;
|
||||
});
|
||||
|
||||
uint8_t randomness[32];
|
||||
crypto::generate_random_bytes(sizeof randomness, randomness);
|
||||
if (!secp256k1_context_randomize(ctx, randomness))
|
||||
return false;
|
||||
|
||||
secp256k1_ecdsa_signature secp256k1_ecdsa_sig{};
|
||||
if (!secp256k1_ecdsa_sign(ctx, &secp256k1_ecdsa_sig, (const unsigned char*)m.data, sec_key.data, NULL, NULL))
|
||||
return false;
|
||||
|
||||
if (!secp256k1_ecdsa_signature_serialize_compact(ctx, sig.data, &secp256k1_ecdsa_sig))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
#else
|
||||
return generate_ethereum_signature((const unsigned char*)&m.data, (unsigned char*)&sec_key.data, sig);
|
||||
#endif
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// verifies secp256k1 ECDSA signature
|
||||
bool verify_eth_signature(const hash& m, const eth_public_key& pub_key, const eth_signature& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
// TODO (performance) consider using secp256k1_context_static for verification -- sowle
|
||||
#ifndef USE_OPEN_SSL_FOR_ECDSA
|
||||
secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
|
||||
auto slh = epee::misc_utils::create_scope_leave_handler([&ctx](){
|
||||
secp256k1_context_destroy(ctx);
|
||||
ctx = nullptr;
|
||||
});
|
||||
|
||||
uint8_t randomness[32];
|
||||
crypto::generate_random_bytes(sizeof randomness, randomness);
|
||||
if (!secp256k1_context_randomize(ctx, randomness))
|
||||
return false;
|
||||
|
||||
secp256k1_ecdsa_signature secp256k1_ecdsa_sig{};
|
||||
secp256k1_pubkey uncompressed_pub_key{};
|
||||
|
||||
if (!secp256k1_ecdsa_signature_parse_compact(ctx, &secp256k1_ecdsa_sig, sig.data))
|
||||
return false;
|
||||
|
||||
if (!secp256k1_ec_pubkey_parse(ctx, &uncompressed_pub_key, pub_key.data, sizeof pub_key))
|
||||
return false;
|
||||
|
||||
// verify a signature
|
||||
if (!secp256k1_ecdsa_verify(ctx, &secp256k1_ecdsa_sig, (const unsigned char*)m.data, &uncompressed_pub_key))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
#else
|
||||
return verify_ethereum_signature(m, sig, pub_key);
|
||||
#endif
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& o, const eth_secret_key& v)
|
||||
{
|
||||
return o << epee::string_tools::pod_to_hex(v);
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& o, const eth_public_key& v)
|
||||
{
|
||||
return o << epee::string_tools::pod_to_hex(v);
|
||||
}
|
||||
std::ostream& operator<<(std::ostream& o, const eth_signature& v)
|
||||
{
|
||||
return o << epee::string_tools::pod_to_hex(v);
|
||||
}
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
80
crypto/upstream/eth_signature.h
Executable file
80
crypto/upstream/eth_signature.h
Executable file
|
|
@ -0,0 +1,80 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
#include <cstdint>
|
||||
#include <iosfwd>
|
||||
#include "hash.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
|
||||
// secp256k1 public key in serialized (compressed) form that is used in Etherium
|
||||
struct eth_public_key
|
||||
{
|
||||
uint8_t data[33];
|
||||
};
|
||||
|
||||
// secp256k1 secret key
|
||||
struct eth_secret_key
|
||||
{
|
||||
uint8_t data[32];
|
||||
};
|
||||
|
||||
// secp256k1 ECDSA signature is serialized (compressed) form that is used in Etherium
|
||||
struct eth_signature
|
||||
{
|
||||
uint8_t data[64];
|
||||
};
|
||||
|
||||
// generates secp256k1 keypair
|
||||
bool generate_eth_key_pair(eth_secret_key& sec_key, eth_public_key& pub_key) noexcept;
|
||||
|
||||
// converts eth_secret_key to eth_public_key
|
||||
//bool _eth_secret_key_to_public_key(const eth_secret_key& sec_key, eth_public_key& pub_key) noexcept;
|
||||
|
||||
// generates secp256k1 ECDSA signature
|
||||
bool generate_eth_signature(const hash& m, const eth_secret_key& sec_key, eth_signature& sig) noexcept;
|
||||
|
||||
// verifies secp256k1 ECDSA signature
|
||||
bool verify_eth_signature(const hash& m, const eth_public_key& pub_key, const eth_signature& sig) noexcept;
|
||||
|
||||
|
||||
inline bool operator==(const eth_public_key& lhs, const eth_public_key& rhs)
|
||||
{
|
||||
return memcmp(lhs.data, rhs.data, sizeof lhs.data) == 0;
|
||||
}
|
||||
|
||||
inline bool operator!=(const eth_public_key& lhs, const eth_public_key& rhs)
|
||||
{
|
||||
return !(lhs == rhs);
|
||||
}
|
||||
|
||||
inline bool operator==(const eth_secret_key& lhs, const eth_secret_key& rhs)
|
||||
{
|
||||
return memcmp(lhs.data, rhs.data, sizeof lhs.data) == 0;
|
||||
}
|
||||
|
||||
inline bool operator!=(const eth_secret_key& lhs, const eth_secret_key& rhs)
|
||||
{
|
||||
return !(lhs == rhs);
|
||||
}
|
||||
|
||||
std::ostream& operator<<(std::ostream& o, const eth_secret_key& v);
|
||||
std::ostream& operator<<(std::ostream& o, const eth_public_key& v);
|
||||
std::ostream& operator<<(std::ostream& o, const eth_signature& v);
|
||||
|
||||
} // namespace crypto
|
||||
71
crypto/upstream/generic-ops.h
Executable file
71
crypto/upstream/generic-ops.h
Executable file
|
|
@ -0,0 +1,71 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <cstddef>
|
||||
#include <cstring>
|
||||
#include <functional>
|
||||
|
||||
#define POD_MAKE_COMPARABLE(space, type) \
|
||||
namespace space { \
|
||||
inline bool operator==(const type &_v1, const type &_v2) { \
|
||||
return std::memcmp(&_v1, &_v2, sizeof(type)) == 0; \
|
||||
} \
|
||||
inline bool operator!=(const type &_v1, const type &_v2) { \
|
||||
return std::memcmp(&_v1, &_v2, sizeof(type)) != 0; \
|
||||
} \
|
||||
}
|
||||
|
||||
#define POD_MAKE_LESS_OPERATOR(space, type) \
|
||||
namespace space { \
|
||||
inline bool operator<(const type &_v1, const type &_v2) { \
|
||||
return std::memcmp(&_v1, &_v2, sizeof(type)) < 0; \
|
||||
} \
|
||||
}
|
||||
|
||||
#define POD_MAKE_HASHABLE(space, type) \
|
||||
POD_MAKE_COMPARABLE(space, type) \
|
||||
namespace space { \
|
||||
static_assert(sizeof(std::size_t) <= sizeof(type), "Size of " #type " must be at least that of size_t"); \
|
||||
inline std::size_t hash_value(const type &_v) { \
|
||||
return reinterpret_cast<const std::size_t &>(_v); \
|
||||
} \
|
||||
} \
|
||||
namespace std { \
|
||||
template<> \
|
||||
struct hash<space::type> { \
|
||||
std::size_t operator()(const space::type &_v) const { \
|
||||
return reinterpret_cast<const std::size_t &>(_v); \
|
||||
} \
|
||||
}; \
|
||||
}
|
||||
|
||||
//
|
||||
// CONSTEXPR
|
||||
//
|
||||
#if ( defined(_MSC_VER) && (_MSC_VER < 1800) )
|
||||
#error MS compilers prior to v 18.00 (MSVC 2013) are not supported
|
||||
#endif
|
||||
|
||||
// compilation workaround for MSVC 2013 Update 5 wich does not support constexpr
|
||||
#if ( defined(_MSC_VER) && (1800 <= _MSC_VER) && (_MSC_VER < 1900) )
|
||||
#define CONSTEXPR
|
||||
#else // all other platforms or MSVC 2015 and later
|
||||
#define CONSTEXPR constexpr
|
||||
#endif
|
||||
|
||||
76
crypto/upstream/hash-ops.h
Executable file
76
crypto/upstream/hash-ops.h
Executable file
|
|
@ -0,0 +1,76 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#if !defined(__cplusplus)
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdbool.h>
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "common/int-util.h"
|
||||
#include "warnings.h"
|
||||
|
||||
static inline void *padd(void *p, size_t i) {
|
||||
return (char *) p + i;
|
||||
}
|
||||
|
||||
static inline const void *cpadd(const void *p, size_t i) {
|
||||
return (const char *) p + i;
|
||||
}
|
||||
|
||||
PUSH_VS_WARNINGS
|
||||
DISABLE_VS_WARNINGS(4267)
|
||||
static_assert(sizeof(size_t) == 4 || sizeof(size_t) == 8, "size_t must be 4 or 8 bytes long");
|
||||
static inline void place_length(uint8_t *buffer, size_t bufsize, size_t length) {
|
||||
if (sizeof(size_t) == 4) {
|
||||
*(uint32_t *) padd(buffer, bufsize - 4) = swap32be(length);
|
||||
} else {
|
||||
*(uint64_t *) padd(buffer, bufsize - 8) = swap64be(length);
|
||||
}
|
||||
}
|
||||
POP_VS_WARNINGS
|
||||
|
||||
#pragma pack(push, 1)
|
||||
union hash_state {
|
||||
uint8_t b[200];
|
||||
uint64_t w[25];
|
||||
};
|
||||
#pragma pack(pop)
|
||||
static_assert(sizeof(union hash_state) == 200, "Invalid structure size");
|
||||
|
||||
void hash_permutation(union hash_state *state);
|
||||
void hash_process(union hash_state *state, const uint8_t *buf, size_t count);
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
#define HASH_SIZE 32
|
||||
#define HASH_DATA_AREA 136
|
||||
|
||||
|
||||
void cn_fast_hash_old(const void *data, size_t length, char *hash);
|
||||
void cn_fast_hash(const void *data, size_t length, char *hash);
|
||||
|
||||
void hash_extra_blake(const void *data, size_t length, char *hash);
|
||||
void hash_extra_groestl(const void *data, size_t length, char *hash);
|
||||
void hash_extra_jh(const void *data, size_t length, char *hash);
|
||||
void hash_extra_skein(const void *data, size_t length, char *hash);
|
||||
|
||||
void tree_hash(const char (*hashes)[HASH_SIZE], size_t count, char *root_hash);
|
||||
43
crypto/upstream/hash.c
Executable file
43
crypto/upstream/hash.c
Executable file
|
|
@ -0,0 +1,43 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "hash-ops.h"
|
||||
#include "keccak.h"
|
||||
|
||||
void hash_permutation(union hash_state *state) {
|
||||
keccakf((uint64_t*)state, 24);
|
||||
}
|
||||
|
||||
void hash_process(union hash_state *state, const uint8_t *buf, size_t count) {
|
||||
keccak1600(buf, (int)count, (uint8_t*)state);
|
||||
}
|
||||
|
||||
void cn_fast_hash_old(const void *data, size_t length, char *hash)
|
||||
{
|
||||
union hash_state state;
|
||||
hash_process(&state, data, length);
|
||||
memcpy(hash, &state, HASH_SIZE);
|
||||
}
|
||||
|
||||
void cn_fast_hash(const void *data, size_t length, char *hash)
|
||||
{
|
||||
keccak(data, (int)length, (uint8_t*)hash, HASH_SIZE);
|
||||
}
|
||||
69
crypto/upstream/hash.h
Executable file
69
crypto/upstream/hash.h
Executable file
|
|
@ -0,0 +1,69 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#include "common/pod-class.h"
|
||||
#include "generic-ops.h"
|
||||
#include "warnings.h"
|
||||
PUSH_VS_WARNINGS
|
||||
DISABLE_VS_WARNINGS(4804)
|
||||
#include "blake2.h"
|
||||
POP_VS_WARNINGS
|
||||
namespace crypto {
|
||||
|
||||
extern "C" {
|
||||
#include "hash-ops.h"
|
||||
}
|
||||
|
||||
#pragma pack(push, 1)
|
||||
POD_CLASS hash {
|
||||
char data[HASH_SIZE];
|
||||
};
|
||||
#pragma pack(pop)
|
||||
|
||||
static_assert(sizeof(hash) == HASH_SIZE, "Invalid structure size");
|
||||
|
||||
/*
|
||||
Cryptonight hash functions
|
||||
*/
|
||||
|
||||
inline void cn_fast_hash(const void *data, std::size_t length, hash &hash) {
|
||||
cn_fast_hash(data, length, reinterpret_cast<char *>(&hash));
|
||||
}
|
||||
|
||||
inline hash cn_fast_hash(const void *data, std::size_t length) {
|
||||
hash h;
|
||||
cn_fast_hash(data, length, reinterpret_cast<char *>(&h));
|
||||
return h;
|
||||
}
|
||||
|
||||
inline void tree_hash(const hash *hashes, std::size_t count, hash &root_hash) {
|
||||
tree_hash(reinterpret_cast<const char (*)[HASH_SIZE]>(hashes), count, reinterpret_cast<char *>(&root_hash));
|
||||
}
|
||||
|
||||
inline hash blake2_hash(const void *data, std::size_t length) {
|
||||
hash h;
|
||||
blake2(&h, sizeof(h), data, length, nullptr, 0);
|
||||
return h;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
POD_MAKE_HASHABLE(crypto, hash)
|
||||
45
crypto/upstream/initializer.h
Executable file
45
crypto/upstream/initializer.h
Executable file
|
|
@ -0,0 +1,45 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#if defined(__GNUC__)
|
||||
#define INITIALIZER(name) __attribute__((constructor(101))) static void name(void)
|
||||
#define FINALIZER(name) __attribute__((destructor(101))) static void name(void)
|
||||
#define REGISTER_FINALIZER(name) ((void) 0)
|
||||
|
||||
#elif defined(_MSC_VER)
|
||||
#include <assert.h>
|
||||
#include <stdlib.h>
|
||||
// http://stackoverflow.com/questions/1113409/attribute-constructor-equivalent-in-vc
|
||||
// http://msdn.microsoft.com/en-us/library/bb918180.aspx
|
||||
#pragma section(".CRT$XCT", read)
|
||||
#define INITIALIZER(name) \
|
||||
static void __cdecl name(void); \
|
||||
__declspec(allocate(".CRT$XCT")) void (__cdecl *const _##name)(void) = &name; \
|
||||
static void __cdecl name(void)
|
||||
#define FINALIZER(name) \
|
||||
static void __cdecl name(void)
|
||||
#define REGISTER_FINALIZER(name) \
|
||||
do { \
|
||||
int _res = atexit(name); \
|
||||
assert(_res == 0); \
|
||||
} while (0);
|
||||
|
||||
#else
|
||||
#error Unsupported compiler
|
||||
#endif
|
||||
129
crypto/upstream/keccak.c
Executable file
129
crypto/upstream/keccak.c
Executable file
|
|
@ -0,0 +1,129 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
// keccak.c
|
||||
// 19-Nov-11 Markku-Juhani O. Saarinen <mjos@iki.fi>
|
||||
// A baseline Keccak (3rd round) implementation.
|
||||
|
||||
#include "hash-ops.h"
|
||||
#include "keccak.h"
|
||||
|
||||
const uint64_t keccakf_rndc[24] =
|
||||
{
|
||||
0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
|
||||
0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
|
||||
0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
|
||||
0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
|
||||
0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
|
||||
0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
|
||||
0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
|
||||
0x8000000000008080, 0x0000000080000001, 0x8000000080008008
|
||||
};
|
||||
|
||||
const int keccakf_rotc[24] =
|
||||
{
|
||||
1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
|
||||
27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
|
||||
};
|
||||
|
||||
const int keccakf_piln[24] =
|
||||
{
|
||||
10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
|
||||
15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
|
||||
};
|
||||
|
||||
// update the state with given number of rounds
|
||||
|
||||
void keccakf(uint64_t st[25], int rounds)
|
||||
{
|
||||
int i, j, round;
|
||||
uint64_t t, bc[5];
|
||||
|
||||
for (round = 0; round < rounds; round++) {
|
||||
|
||||
// Theta
|
||||
for (i = 0; i < 5; i++)
|
||||
bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
|
||||
|
||||
for (i = 0; i < 5; i++) {
|
||||
t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
|
||||
for (j = 0; j < 25; j += 5)
|
||||
st[j + i] ^= t;
|
||||
}
|
||||
|
||||
// Rho Pi
|
||||
t = st[1];
|
||||
for (i = 0; i < 24; i++) {
|
||||
j = keccakf_piln[i];
|
||||
bc[0] = st[j];
|
||||
st[j] = ROTL64(t, keccakf_rotc[i]);
|
||||
t = bc[0];
|
||||
}
|
||||
|
||||
// Chi
|
||||
for (j = 0; j < 25; j += 5) {
|
||||
for (i = 0; i < 5; i++)
|
||||
bc[i] = st[j + i];
|
||||
for (i = 0; i < 5; i++)
|
||||
st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
|
||||
}
|
||||
|
||||
// Iota
|
||||
st[0] ^= keccakf_rndc[round];
|
||||
}
|
||||
}
|
||||
|
||||
// compute a keccak hash (md) of given byte length from "in"
|
||||
typedef uint64_t state_t[25];
|
||||
|
||||
int keccak(const uint8_t *in, int inlen, uint8_t *md, int mdlen)
|
||||
{
|
||||
state_t st;
|
||||
uint8_t temp[144];
|
||||
int i, rsiz, rsizw;
|
||||
|
||||
rsiz = sizeof(state_t) == mdlen ? HASH_DATA_AREA : 200 - 2 * mdlen;
|
||||
rsizw = rsiz / 8;
|
||||
|
||||
memset(st, 0, sizeof(st));
|
||||
|
||||
for ( ; inlen >= rsiz; inlen -= rsiz, in += rsiz) {
|
||||
for (i = 0; i < rsizw; i++)
|
||||
st[i] ^= ((uint64_t *) in)[i];
|
||||
keccakf(st, KECCAK_ROUNDS);
|
||||
}
|
||||
|
||||
// last block and padding
|
||||
memcpy(temp, in, inlen);
|
||||
temp[inlen++] = 1;
|
||||
memset(temp + inlen, 0, rsiz - inlen);
|
||||
temp[rsiz - 1] |= 0x80;
|
||||
|
||||
for (i = 0; i < rsizw; i++)
|
||||
st[i] ^= ((uint64_t *) temp)[i];
|
||||
|
||||
keccakf(st, KECCAK_ROUNDS);
|
||||
|
||||
memcpy(md, st, mdlen);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void keccak1600(const uint8_t *in, int inlen, uint8_t *md)
|
||||
{
|
||||
keccak(in, inlen, md, sizeof(state_t));
|
||||
}
|
||||
43
crypto/upstream/keccak.h
Executable file
43
crypto/upstream/keccak.h
Executable file
|
|
@ -0,0 +1,43 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
// keccak.h
|
||||
// 19-Nov-11 Markku-Juhani O. Saarinen <mjos@iki.fi>
|
||||
|
||||
#ifndef KECCAK_H
|
||||
#define KECCAK_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#ifndef KECCAK_ROUNDS
|
||||
#define KECCAK_ROUNDS 24
|
||||
#endif
|
||||
|
||||
#ifndef ROTL64
|
||||
#define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
|
||||
#endif
|
||||
|
||||
// compute a keccak hash (md) of given byte length from "in"
|
||||
int keccak(const uint8_t *in, int inlen, uint8_t *md, int mdlen);
|
||||
|
||||
// update the state
|
||||
void keccakf(uint64_t st[25], int norounds);
|
||||
|
||||
void keccak1600(const uint8_t *in, int inlen, uint8_t *md);
|
||||
|
||||
#endif
|
||||
36
crypto/upstream/msm.cpp
Executable file
36
crypto/upstream/msm.cpp
Executable file
|
|
@ -0,0 +1,36 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "epee/include/misc_log_ex.h"
|
||||
//#include "zarcanum.h"
|
||||
#include "msm.h"
|
||||
//#include "../currency_core/crypto_config.h" // TODO: move it to the crypto
|
||||
//#include "../common/crypto_stream_operators.h" // TODO: move it to the crypto
|
||||
|
||||
#if 0
|
||||
# define DBG_VAL_PRINT(x) std::cout << std::setw(30) << std::left << #x ": " << x << std::endl
|
||||
# define DBG_PRINT(x) std::cout << x << std::endl
|
||||
#else
|
||||
# define DBG_VAL_PRINT(x) (void(0))
|
||||
# define DBG_PRINT(x) (void(0))
|
||||
#endif
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
185
crypto/upstream/msm.h
Executable file
185
crypto/upstream/msm.h
Executable file
|
|
@ -0,0 +1,185 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
|
||||
// This file contains Multi-Scalar Multiplication routines
|
||||
|
||||
#include "epee/include/misc_log_ex.h"
|
||||
#include "crypto-sugar.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
|
||||
template<typename CT>
|
||||
bool msm_and_check_zero_naive(const scalar_vec_t& g_scalars, const scalar_vec_t& h_scalars, const point_t& summand)
|
||||
{
|
||||
CHECK_AND_ASSERT_MES(g_scalars.size() <= CT::c_bpp_mn_max, false, "g_scalars oversized");
|
||||
CHECK_AND_ASSERT_MES(h_scalars.size() <= CT::c_bpp_mn_max, false, "h_scalars oversized");
|
||||
|
||||
point_t result = summand;
|
||||
|
||||
for (size_t i = 0; i < g_scalars.size(); ++i)
|
||||
result += g_scalars[i] * CT::get_generator(false, i);
|
||||
|
||||
for (size_t i = 0; i < h_scalars.size(); ++i)
|
||||
result += h_scalars[i] * CT::get_generator(true, i);
|
||||
|
||||
if (!result.is_zero())
|
||||
{
|
||||
LOG_PRINT_L0("msm result is non zero: " << result);
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
// https://eprint.iacr.org/2022/999.pdf
|
||||
// "Pippenger algorithm [1], and its variant that is widely used in the ZK space is called the bucket method"
|
||||
template<typename CT>
|
||||
bool msm_and_check_zero_pippenger_v3(const scalar_vec_t& g_scalars, const scalar_vec_t& h_scalars, const point_t& summand, uint8_t c)
|
||||
{
|
||||
// TODO: with c = 8 and with direct access got much worse result than with c = 7 and get_bits() for N = 128..256, consider checking again for bigger datasets (N>256)
|
||||
// TODO: consider preparing a cached generators' points
|
||||
|
||||
CHECK_AND_ASSERT_MES(g_scalars.size() <= CT::c_bpp_mn_max, false, "g_scalars oversized");
|
||||
CHECK_AND_ASSERT_MES(h_scalars.size() <= CT::c_bpp_mn_max, false, "h_scalars oversized");
|
||||
CHECK_AND_ASSERT_MES(c < 10, false, "c is too big");
|
||||
|
||||
size_t C = 1ull << c;
|
||||
|
||||
// k_max * c + (c-1) >= max_bit_idx
|
||||
//
|
||||
// max_bit_idx - (c - 1) max_bit_idx - (c - 1) + (c - 1) max_bit_idx
|
||||
// k_max = ceil ( --------------------- ) = floor ( ------------------------------ ) = floor ( ----------- )
|
||||
// c c c
|
||||
const size_t b = 253; // the maximum number of bits in x https://eprint.iacr.org/2022/999.pdf TODO: we may also scan for maximum bit used in all the scalars if all the scalars are small
|
||||
const size_t max_bit_idx = b - 1;
|
||||
const size_t k_max = max_bit_idx / c;
|
||||
const size_t K = k_max + 1;
|
||||
|
||||
std::vector<point_t> buckets(C * K);
|
||||
std::vector<bool> buckets_inited(C * K);
|
||||
std::vector<point_t> Sk(K);
|
||||
std::vector<bool> Sk_inited(K);
|
||||
std::vector<point_t> Gk(K);
|
||||
std::vector<bool> Gk_inited(K);
|
||||
|
||||
// first loop, calculate partial bucket sums
|
||||
for (size_t n = 0; n < g_scalars.size(); ++n)
|
||||
{
|
||||
for (size_t k = 0; k < K; ++k)
|
||||
{
|
||||
uint64_t l = g_scalars[n].get_bits((uint8_t)(k * c), c); // l in [0; 2^c-1]
|
||||
if (l != 0)
|
||||
{
|
||||
size_t bucket_id = l * K + k;
|
||||
if (buckets_inited[bucket_id])
|
||||
buckets[bucket_id] += CT::get_generator(false, n);
|
||||
else
|
||||
{
|
||||
buckets[bucket_id] = CT::get_generator(false, n);
|
||||
buckets_inited[bucket_id] = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// still the first loop (continued)
|
||||
for (size_t n = 0; n < h_scalars.size(); ++n)
|
||||
{
|
||||
for (size_t k = 0; k < K; ++k)
|
||||
{
|
||||
uint64_t l = h_scalars[n].get_bits((uint8_t)(k * c), c); // l in [0; 2^c-1]
|
||||
if (l != 0)
|
||||
{
|
||||
size_t bucket_id = l * K + k;
|
||||
if (buckets_inited[bucket_id])
|
||||
buckets[bucket_id] += CT::get_generator(true, n);
|
||||
else
|
||||
{
|
||||
buckets[bucket_id] = CT::get_generator(true, n);
|
||||
buckets_inited[bucket_id] = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// the second loop
|
||||
for (size_t l = C - 1; l > 0; --l)
|
||||
{
|
||||
for (size_t k = 0; k < K; ++k)
|
||||
{
|
||||
size_t bucket_id = l * K + k;
|
||||
if (buckets_inited[bucket_id])
|
||||
{
|
||||
if (Sk_inited[k])
|
||||
Sk[k] += buckets[bucket_id];
|
||||
else
|
||||
{
|
||||
Sk[k] = buckets[bucket_id];
|
||||
Sk_inited[k] = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (Sk_inited[k])
|
||||
{
|
||||
if (Gk_inited[k])
|
||||
Gk[k] += Sk[k];
|
||||
else
|
||||
{
|
||||
Gk[k] = Sk[k];
|
||||
Gk_inited[k] = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// the third loop: Horner’s rule
|
||||
point_t result = Gk_inited[K - 1] ? Gk[K - 1] : c_point_0;
|
||||
for (size_t k = K - 2; k != SIZE_MAX; --k)
|
||||
{
|
||||
result.modify_mul_pow_2(c);
|
||||
if (Gk_inited[k])
|
||||
result += Gk[k];
|
||||
}
|
||||
|
||||
result += summand;
|
||||
|
||||
if (!result.is_zero())
|
||||
{
|
||||
LOG_PRINT_L0("multiexp result is non zero: " << result);
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// Just switcher
|
||||
|
||||
template<typename CT>
|
||||
bool msm_and_check_zero(const scalar_vec_t& g_scalars, const scalar_vec_t& h_scalars, const point_t& summand)
|
||||
{
|
||||
//return msm_and_check_zero_naive<CT>(g_scalars, h_scalars, summand);
|
||||
return msm_and_check_zero_pippenger_v3<CT>(g_scalars, h_scalars, summand, 7);
|
||||
}
|
||||
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
336
crypto/upstream/one_out_of_many_proofs.cpp
Executable file
336
crypto/upstream/one_out_of_many_proofs.cpp
Executable file
|
|
@ -0,0 +1,336 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "one_out_of_many_proofs.h"
|
||||
#include "../currency_core/crypto_config.h"
|
||||
#include "config/currency_config.h" // for static asset checks
|
||||
#include "epee/include/misc_log_ex.h"
|
||||
|
||||
//DISABLE_GCC_AND_CLANG_WARNING(unused-function)
|
||||
|
||||
#if 0
|
||||
# define DBG_VAL_PRINT(x) std::cout << std::setw(30) << std::left << #x ": " << x << std::endl
|
||||
# define DBG_PRINT(x) std::cout << x << std::endl
|
||||
#else
|
||||
# define DBG_VAL_PRINT(x) (void(0))
|
||||
# define DBG_PRINT(x) (void(0))
|
||||
#endif
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
static const size_t N_max = 256;
|
||||
static const size_t mn_max = 16;
|
||||
|
||||
static_assert(CURRENCY_TX_MAX_ALLOWED_INPUTS <= N_max, "CURRENCY_TX_MAX_ALLOWED_INPUTS is inconsistent with one-out-of-many proof limits"); // TODO: consider moving this check out -- sowle
|
||||
|
||||
const point_t& get_BGE_generator(size_t index, bool& ok)
|
||||
{
|
||||
static std::vector<point_t> precalculated_generators;
|
||||
if (precalculated_generators.empty())
|
||||
{
|
||||
precalculated_generators.resize(mn_max * 2);
|
||||
|
||||
scalar_t hash_buf[2] = { hash_helper_t::hs("Lethean BGE generator"), 0 };
|
||||
|
||||
for(size_t i = 0; i < precalculated_generators.size(); ++i)
|
||||
{
|
||||
hash_buf[1].m_u64[0] = i;
|
||||
precalculated_generators[i] = hash_helper_t::hp(&hash_buf, sizeof hash_buf);
|
||||
}
|
||||
}
|
||||
|
||||
if (index >= mn_max * 2)
|
||||
{
|
||||
ok = false;
|
||||
return c_point_0;
|
||||
}
|
||||
|
||||
ok = true;
|
||||
return precalculated_generators[index];
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("generate_BGE_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool generate_BGE_proof(const hash& context_hash, const std::vector<point_t>& ring, const scalar_t& secret, const size_t secret_index, BGE_proof& result, uint8_t* p_err /* = nullptr */)
|
||||
{
|
||||
static constexpr size_t n = 4; // TODO: @#@# move it out
|
||||
|
||||
DBG_PRINT(" - - - generate_BGE_proof - - -");
|
||||
size_t ring_size = ring.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(ring_size > 0, 0);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(secret_index < ring_size, 1);
|
||||
|
||||
#ifndef NDEBUG
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(ring[secret_index] == secret * crypto::c_point_X, 2);
|
||||
#endif
|
||||
|
||||
|
||||
const size_t m = std::max(static_cast<uint64_t>(1), constexpr_ceil_log_n(ring_size, n));
|
||||
const size_t N = constexpr_pow(m, n);
|
||||
const size_t mn = m * n;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(N <= N_max, 3);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(mn <= mn_max, 4);
|
||||
|
||||
scalar_mat_t<n> a_mat(mn); // m x n matrix
|
||||
a_mat.zero();
|
||||
std::vector<size_t> l_digits(m); // l => n-ary gidits
|
||||
size_t l = secret_index;
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
for(size_t i = n - 1; i != 0; --i) // [n - 1; 1]
|
||||
{
|
||||
a_mat(j, i).make_random();
|
||||
a_mat(j, 0) -= a_mat(j, i); // a[j; 0] = -sum( a[j; i] ), i in [1; n-1]
|
||||
}
|
||||
|
||||
size_t digit = l % n; // j-th digit of secret_index
|
||||
l_digits[j] = digit;
|
||||
l = l / n;
|
||||
}
|
||||
|
||||
#ifndef NDEBUG
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
scalar_t a_sum{};
|
||||
for(size_t i = 0; i != n; ++i)
|
||||
a_sum += a_mat(j, i);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(a_sum.is_zero(), 230);
|
||||
}
|
||||
#endif
|
||||
|
||||
//
|
||||
// coeffs calculation (naive implementation, consider optimization in future)
|
||||
//
|
||||
scalar_vec_t coeffs(N * m); // m x N matrix
|
||||
coeffs.zero();
|
||||
for(size_t i = 0; i < N; ++i)
|
||||
{
|
||||
coeffs[i] = c_scalar_1; // first row is (1, ..., 1)
|
||||
size_t i_tmp = i;
|
||||
size_t m_bound = 1;
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
size_t i_j = i_tmp % n; // j-th digit of i
|
||||
i_tmp /= n;
|
||||
|
||||
if (i_j == l_digits[j]) // true if j-th digits of i and l matches
|
||||
{
|
||||
scalar_t carry{};
|
||||
for(size_t k = 0; k < m_bound; ++k)
|
||||
{
|
||||
scalar_t old = coeffs[k * N + i];
|
||||
coeffs[k * N + i] *= a_mat(j, i_j);
|
||||
coeffs[k * N + i] += carry;
|
||||
carry = old;
|
||||
}
|
||||
if (m_bound < m)
|
||||
coeffs[m_bound * N + i] += carry;
|
||||
++m_bound;
|
||||
}
|
||||
else
|
||||
{
|
||||
for(size_t k = 0; k < m_bound; ++k)
|
||||
coeffs[k * N + i] *= a_mat(j, i_j);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
scalar_t r_A = scalar_t::random();
|
||||
scalar_t r_B = scalar_t::random();
|
||||
scalar_vec_t ro(m);
|
||||
ro.make_random();
|
||||
|
||||
point_t A = c_point_0;
|
||||
point_t B = c_point_0;
|
||||
|
||||
result.Pk.clear();
|
||||
|
||||
bool r = false, r2 = false;
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
for(size_t i = 0; i < n; ++i)
|
||||
{
|
||||
const point_t& gen_1 = get_BGE_generator((j * n + i) * 2 + 0, r);
|
||||
const point_t& gen_2 = get_BGE_generator((j * n + i) * 2 + 1, r2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(r && r2, 5);
|
||||
const scalar_t& a = a_mat(j, i);
|
||||
A += a * gen_1 - a * a * gen_2;
|
||||
if (l_digits[j] == i)
|
||||
B += gen_1 - a * gen_2;
|
||||
else
|
||||
B += a * gen_2;
|
||||
}
|
||||
|
||||
point_t Pk = c_point_0;
|
||||
for(size_t i = 0; i < ring_size; ++i)
|
||||
Pk += coeffs[j * N + i] * ring[i];
|
||||
for(size_t i = ring_size; i < N; ++i)
|
||||
Pk += coeffs[j * N + i] * ring[ring_size - 1];
|
||||
|
||||
Pk += ro[j] * c_point_X;
|
||||
result.Pk.emplace_back(std::move((c_scalar_1div8 * Pk).to_public_key()));
|
||||
}
|
||||
|
||||
A += r_A * c_point_X;
|
||||
result.A = (c_scalar_1div8 * A).to_public_key();
|
||||
B += r_B * c_point_X;
|
||||
result.B = (c_scalar_1div8 * B).to_public_key();
|
||||
|
||||
hash_helper_t::hs_t hsc(1 + ring_size + 2 + m);
|
||||
hsc.add_hash(context_hash);
|
||||
for(auto& ring_el : ring)
|
||||
hsc.add_point(c_scalar_1div8 * ring_el);
|
||||
hsc.add_pub_key(result.A);
|
||||
hsc.add_pub_key(result.B);
|
||||
hsc.add_pub_keys_array(result.Pk);
|
||||
scalar_t x = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(x);
|
||||
|
||||
result.f.resize(m * (n - 1));
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
for(size_t i = 1; i < n; ++i)
|
||||
{
|
||||
result.f[j * (n - 1) + i - 1] = a_mat(j, i);
|
||||
if (l_digits[j] == i)
|
||||
result.f[j * (n - 1) + i - 1] += x;
|
||||
}
|
||||
}
|
||||
|
||||
result.y = r_A + x * r_B;
|
||||
|
||||
result.z = 0;
|
||||
scalar_t x_power = c_scalar_1;
|
||||
for(size_t k = 0; k < m; ++k)
|
||||
{
|
||||
result.z -= x_power * ro[k];
|
||||
x_power *= x;
|
||||
}
|
||||
result.z += secret * x_power;
|
||||
|
||||
return true;
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
//---------------------------------------------------------------
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("generate_BGE_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool verify_BGE_proof(const hash& context_hash, const std::vector<const public_key*>& ring, const BGE_proof& sig, uint8_t* p_err /* = nullptr */)
|
||||
{
|
||||
static constexpr size_t n = 4; // TODO: @#@# move it out
|
||||
|
||||
DBG_PRINT(" - - - verify_BGE_proof - - -");
|
||||
size_t ring_size = ring.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(ring_size > 0, 0);
|
||||
|
||||
const size_t m = std::max(static_cast<uint64_t>(1), constexpr_ceil_log_n(ring_size, n));
|
||||
const size_t N = constexpr_pow(m, n);
|
||||
//const size_t mn = m * n;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.Pk.size() == m, 1);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.f.size() == m * (n - 1), 2);
|
||||
|
||||
hash_helper_t::hs_t hsc(1 + ring_size + 2 + m);
|
||||
hsc.add_hash(context_hash);
|
||||
for(const public_key* ppk : ring)
|
||||
hsc.add_pub_key(*ppk);
|
||||
hsc.add_pub_key(sig.A);
|
||||
hsc.add_pub_key(sig.B);
|
||||
hsc.add_pub_keys_array(sig.Pk);
|
||||
scalar_t x = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(x);
|
||||
|
||||
scalar_vec_t f0(m); // the first column f_{i,0} = x - sum{j=1}{n-1}( f_{i,j} )
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
f0[j] = x;
|
||||
for(size_t i = 1; i < n; ++i)
|
||||
f0[j] -= sig.f[j * (n - 1) + i - 1];
|
||||
}
|
||||
|
||||
//
|
||||
// 1
|
||||
//
|
||||
point_t A = point_t(sig.A).modify_mul8();
|
||||
point_t B = point_t(sig.B).modify_mul8();
|
||||
|
||||
point_t Z = A + x * B;
|
||||
|
||||
bool r = false, r2 = false;
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
for(size_t i = 0; i < n; ++i)
|
||||
{
|
||||
const point_t& gen_1 = get_BGE_generator((j * n + i) * 2 + 0, r);
|
||||
const point_t& gen_2 = get_BGE_generator((j * n + i) * 2 + 1, r2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(r && r2, 5);
|
||||
const scalar_t& f_ji = (i == 0) ? f0[j] : sig.f[j * (n - 1) + i - 1];
|
||||
|
||||
Z -= f_ji * gen_1 + f_ji * (x - f_ji) * gen_2;
|
||||
}
|
||||
}
|
||||
Z -= sig.y * c_point_X;
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(Z.is_zero(), 100);
|
||||
|
||||
//
|
||||
// 2
|
||||
//
|
||||
scalar_vec_t p_vec(N);
|
||||
for(size_t i = 0; i < N; ++i)
|
||||
{
|
||||
p_vec[i] = c_scalar_1;
|
||||
size_t i_tmp = i;
|
||||
for(size_t j = 0; j < m; ++j)
|
||||
{
|
||||
size_t i_j = i_tmp % n; // j-th digit of i
|
||||
i_tmp /= n;
|
||||
const scalar_t& f_jij = (i_j == 0) ? f0[j] : sig.f[j * (n - 1) + i_j - 1];
|
||||
p_vec[i] *= f_jij;
|
||||
}
|
||||
}
|
||||
|
||||
for(size_t i = 0; i < ring_size; ++i)
|
||||
Z += p_vec[i] * point_t(*ring[i]).modify_mul8();
|
||||
for(size_t i = ring_size; i < N; ++i)
|
||||
Z += p_vec[i] * point_t(*ring[ring_size - 1]).modify_mul8();
|
||||
|
||||
scalar_t x_power = c_scalar_1;
|
||||
for(size_t k = 0; k < m; ++k)
|
||||
{
|
||||
Z -= x_power * point_t(sig.Pk[k]).modify_mul8();
|
||||
x_power *= x;
|
||||
}
|
||||
|
||||
Z -= sig.z * c_point_X;
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(Z.is_zero(), 101);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
58
crypto/upstream/one_out_of_many_proofs.h
Executable file
58
crypto/upstream/one_out_of_many_proofs.h
Executable file
|
|
@ -0,0 +1,58 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
#include "crypto-sugar.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
//
|
||||
// BGE stands for Bootle, Groth, Esgin
|
||||
//
|
||||
// This is a proof-of-concept implementation of a log-size one-out-of-many proof based on ideas and approaches by Bootle et al, Groth et al and Esgin et al
|
||||
//
|
||||
// https://eprint.iacr.org/2014/764
|
||||
// https://eprint.iacr.org/2015/643
|
||||
// https://eprint.iacr.org/2019/1287
|
||||
//
|
||||
// Disclaimer: shouldn't be used in production code until the security proofs and the code are peer-reviewed.
|
||||
//
|
||||
|
||||
// m+2 group elements, m(n-1)+2 field elements.
|
||||
// Assuming fixed n=4, m = log4(ring_sz) the size is (log4(ring_sz) + 2) group elements and (3*log4(ring_sz) + 2) or, in total, (4*log4(ring_sz) + 4) 32-bytes words
|
||||
|
||||
// ring_sz = m (inputs number)
|
||||
// sig_count = k (outputs number)
|
||||
// thus:
|
||||
// k * (log4(m) + 2) group elements and k * (3*log4(m) + 2) field elements
|
||||
|
||||
struct BGE_proof
|
||||
{
|
||||
public_key A; // premultiplied by 1/8
|
||||
public_key B; // premultiplied by 1/8
|
||||
std::vector<public_key> Pk; // premultiplied by 1/8, size = m
|
||||
scalar_vec_t f; // size = m * (n - 1)
|
||||
scalar_t y;
|
||||
scalar_t z;
|
||||
};
|
||||
|
||||
bool generate_BGE_proof(const hash& context_hash, const std::vector<point_t>& ring, const scalar_t& secret, const size_t secret_index, BGE_proof& result, uint8_t* p_err = nullptr);
|
||||
|
||||
|
||||
bool verify_BGE_proof(const hash& context_hash, const std::vector<const public_key*>& ring, const BGE_proof& sig, uint8_t* p_err = nullptr);
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
234
crypto/upstream/random.c
Executable file
234
crypto/upstream/random.c
Executable file
|
|
@ -0,0 +1,234 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#include <assert.h>
|
||||
#include <stddef.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include "hash-ops.h"
|
||||
#include "random.h"
|
||||
|
||||
static_assert(RANDOM_STATE_SIZE >= HASH_DATA_AREA, "Invalid RANDOM_STATE_SIZE");
|
||||
|
||||
#if defined(_WIN32)
|
||||
|
||||
#include <windows.h>
|
||||
#include <bcrypt.h>
|
||||
|
||||
// thread-safe version
|
||||
bool generate_system_random_bytes(size_t n, void *result)
|
||||
{
|
||||
if (n == 0)
|
||||
return true;
|
||||
|
||||
if (result == NULL)
|
||||
return false;
|
||||
|
||||
NTSTATUS status = BCryptGenRandom(NULL, (PUCHAR)result, (ULONG)n, BCRYPT_USE_SYSTEM_PREFERRED_RNG);
|
||||
return BCRYPT_SUCCESS(status);
|
||||
}
|
||||
|
||||
void generate_system_random_bytes_or_die(size_t n, void *result)
|
||||
{
|
||||
if (!generate_system_random_bytes(n, result))
|
||||
{
|
||||
fprintf(stderr, "Error: generate_system_random_bytes failed and this is fatal\n\n");
|
||||
fflush(stderr);
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
#include <err.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <stdlib.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
bool generate_system_random_bytes(size_t n, void *result)
|
||||
{
|
||||
int fd;
|
||||
|
||||
fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
return false;
|
||||
|
||||
size_t bytes_read = 0;
|
||||
while (bytes_read < n)
|
||||
{
|
||||
ssize_t res = read(fd, (char*)result + bytes_read, n - bytes_read);
|
||||
if (res < 0)
|
||||
{
|
||||
if (errno != EINTR)
|
||||
{
|
||||
close(fd);
|
||||
return false;
|
||||
}
|
||||
// EINTR - interrupted by signal, continue reading
|
||||
}
|
||||
else if (res == 0)
|
||||
{
|
||||
// EOF - should not happen with /dev/urandom
|
||||
close(fd);
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
bytes_read += res;
|
||||
}
|
||||
}
|
||||
|
||||
close(fd); // don't check, 'cuz failing to close /dev/urandom is not truly fatal, the OS will clean up
|
||||
return true;
|
||||
}
|
||||
|
||||
void generate_system_random_bytes_or_die(size_t n, void *result)
|
||||
{
|
||||
if (!generate_system_random_bytes(n, result))
|
||||
{
|
||||
fprintf(stderr, "FATAL: Failed to generate %zu random bytes: %s\n\n", n, strerror(errno));
|
||||
fflush(stderr);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static union hash_state state;
|
||||
|
||||
static_assert(sizeof(union hash_state) == RANDOM_STATE_SIZE, "RANDOM_STATE_SIZE and hash_state size missmatch");
|
||||
|
||||
#if !defined(NDEBUG)
|
||||
static volatile int curstate; /* To catch thread safety problems. */
|
||||
#endif
|
||||
/*
|
||||
FINALIZER(deinit_random) {
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 1);
|
||||
curstate = 0;
|
||||
#endif
|
||||
memset(&state, 0, sizeof(union hash_state));
|
||||
}
|
||||
*/
|
||||
|
||||
void init_random(void)
|
||||
{
|
||||
generate_system_random_bytes_or_die(HASH_DATA_AREA, &state);
|
||||
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 0);
|
||||
curstate = 1;
|
||||
#endif
|
||||
}
|
||||
|
||||
|
||||
void grant_random_initialize_no_lock(void)
|
||||
{
|
||||
static bool initalized = false;
|
||||
if(!initalized)
|
||||
{
|
||||
init_random();
|
||||
initalized = true;
|
||||
}
|
||||
}
|
||||
|
||||
void random_prng_initialize_with_seed_no_lock(uint64_t seed)
|
||||
{
|
||||
grant_random_initialize_no_lock();
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 1);
|
||||
curstate = 3;
|
||||
#endif
|
||||
memset(&state, 0, sizeof state);
|
||||
memcpy(&state, &seed, sizeof seed);
|
||||
for(size_t i = 0, count = seed & 31; i < count; ++i)
|
||||
hash_permutation(&state);
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 3);
|
||||
curstate = 1;
|
||||
#endif
|
||||
}
|
||||
|
||||
void random_prng_get_state_no_lock(void *state_buffer, const size_t buffer_size)
|
||||
{
|
||||
grant_random_initialize_no_lock();
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 1);
|
||||
curstate = 4;
|
||||
#endif
|
||||
|
||||
assert(sizeof state == buffer_size);
|
||||
memcpy(state_buffer, &state, buffer_size);
|
||||
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 4);
|
||||
curstate = 1;
|
||||
#endif
|
||||
}
|
||||
|
||||
void random_prng_set_state_no_lock(const void *state_buffer, const size_t buffer_size)
|
||||
{
|
||||
grant_random_initialize_no_lock();
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 1);
|
||||
curstate = 5;
|
||||
#endif
|
||||
|
||||
assert(sizeof state == buffer_size);
|
||||
memcpy(&state, state_buffer, buffer_size);
|
||||
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 5);
|
||||
curstate = 1;
|
||||
#endif
|
||||
}
|
||||
|
||||
void generate_random_bytes_no_lock(size_t n, void *result)
|
||||
{
|
||||
grant_random_initialize_no_lock();
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 1);
|
||||
curstate = 2;
|
||||
#endif
|
||||
if (n == 0) {
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 2);
|
||||
curstate = 1;
|
||||
#endif
|
||||
return;
|
||||
}
|
||||
for (;;) {
|
||||
hash_permutation(&state);
|
||||
if (n <= HASH_DATA_AREA) {
|
||||
memcpy(result, &state, n);
|
||||
#if !defined(NDEBUG)
|
||||
assert(curstate == 2);
|
||||
curstate = 1;
|
||||
#endif
|
||||
return;
|
||||
} else {
|
||||
memcpy(result, &state, HASH_DATA_AREA);
|
||||
result = padd(result, HASH_DATA_AREA);
|
||||
n -= HASH_DATA_AREA;
|
||||
}
|
||||
}
|
||||
}
|
||||
43
crypto/upstream/random.h
Executable file
43
crypto/upstream/random.h
Executable file
|
|
@ -0,0 +1,43 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
// NOT thread-safe, use with caution
|
||||
void generate_random_bytes_no_lock(size_t n, void *result);
|
||||
|
||||
#define RANDOM_STATE_SIZE 200
|
||||
|
||||
// explicitly define USE_INSECURE_RANDOM_RPNG_ROUTINES for using random_initialize_with_seed
|
||||
#ifdef USE_INSECURE_RANDOM_RPNG_ROUTINES
|
||||
// reinitializes PRNG with the given seed
|
||||
// !!!ATTENTION!!!! Improper use of this routine may lead to SECURITY BREACH!
|
||||
// Use with care and ONLY for tests or debug purposes!
|
||||
void random_prng_initialize_with_seed_no_lock(uint64_t seed);
|
||||
|
||||
// gets internal RPNG state (state_buffer should be 200 bytes long)
|
||||
void random_prng_get_state_no_lock(void *state_buffer, const size_t buffer_size);
|
||||
|
||||
// sets internal RPNG state (state_buffer should be 200 bytes long)
|
||||
// !!!ATTENTION!!!! Improper use of this routine may lead to SECURITY BREACH!
|
||||
// Use with care and ONLY for tests or debug purposes!
|
||||
void random_prng_set_state_no_lock(const void *state_buffer, const size_t buffer_size);
|
||||
|
||||
#endif // #ifdef USE_INSECURE_RANDOM_RPNG_ROUTINES
|
||||
741
crypto/upstream/range_proof_bpp.h
Executable file
741
crypto/upstream/range_proof_bpp.h
Executable file
|
|
@ -0,0 +1,741 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
|
||||
//
|
||||
// This file contains the implementation of range proof protocol.
|
||||
// Namely, Bulletproofs+ https://eprint.iacr.org/2020/735
|
||||
//
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
struct bpp_signature
|
||||
{
|
||||
std::vector<public_key> L; // size = ceil( log_2(m * n) )
|
||||
std::vector<public_key> R;
|
||||
public_key A0;
|
||||
public_key A;
|
||||
public_key B;
|
||||
scalar_t r;
|
||||
scalar_t s;
|
||||
scalar_t delta;
|
||||
};
|
||||
|
||||
#if 0
|
||||
# define DBG_VAL_PRINT(x) std::cout << std::setw(30) << std::left << #x ": " << x << std::endl
|
||||
# define DBG_PRINT(x) std::cout << x << std::endl
|
||||
#else
|
||||
# define DBG_VAL_PRINT(x) (void(0))
|
||||
# define DBG_PRINT(x) (void(0))
|
||||
#endif
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("bpp_gen: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
|
||||
template<typename CT>
|
||||
bool bpp_gen(const scalar_vec_t& values, const scalar_vec_t& masks, const std::vector<const crypto::public_key*>& commitments_1div8, bpp_signature& sig, uint8_t* p_err = nullptr)
|
||||
{
|
||||
// Note: commitments_1div8 are supposed to be already calculated
|
||||
static_assert(CT::c_bpp_n <= 255, "too big N");
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(values.size() > 0 && values.size() <= CT::c_bpp_values_max && values.size() == masks.size() && values.size() == commitments_1div8.size(), 1);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(masks.is_reduced(), 3);
|
||||
|
||||
const size_t c_bpp_log2_m = constexpr_ceil_log2(values.size());
|
||||
const size_t c_bpp_m = 1ull << c_bpp_log2_m;
|
||||
const size_t c_bpp_mn = c_bpp_m * CT::c_bpp_n;
|
||||
const size_t c_bpp_log2_mn = c_bpp_log2_m + CT::c_bpp_log2_n;
|
||||
|
||||
#ifndef NDEBUG
|
||||
for(size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
point_t V{};
|
||||
CT::calc_pedersen_commitment(values[i], masks[i], V);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(point_t(*commitments_1div8[i]).modify_mul8() == V, 4);
|
||||
}
|
||||
#endif
|
||||
|
||||
// s.a. BP+ paper, page 15, eq. 11
|
||||
// decompose v into aL and aR:
|
||||
// v = aL o (1, 2, 2^2, ..., 2^n-1), o - component-wise product aka Hadamard product
|
||||
// aR = aL - (1, 1, ... 1)
|
||||
// aR o aL = 0
|
||||
|
||||
// aLs = (aL_0, aL_1, ..., aL_m-1) -- `bit` matrix of c_bpp_m x c_bpp_n, each element is a scalar
|
||||
|
||||
scalar_mat_t<CT::c_bpp_n> aLs(c_bpp_mn), aRs(c_bpp_mn);
|
||||
aLs.zero();
|
||||
aRs.zero();
|
||||
// m >= values.size, first set up [0..values.size-1], then -- [values.size..m-1] (padding area)
|
||||
for (size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
const scalar_t& v = values[i];
|
||||
for (uint8_t j = 0; j < CT::c_bpp_n; ++j)
|
||||
{
|
||||
if (v.get_bit(j))
|
||||
aLs(i, j) = c_scalar_1; // aL = 1, aR = 0
|
||||
else
|
||||
aRs(i, j) = c_scalar_Lm1; // aL = 0, aR = -1
|
||||
}
|
||||
}
|
||||
|
||||
for (size_t i = values.size(); i < c_bpp_m; ++i)
|
||||
for (size_t j = 0; j < CT::c_bpp_n; ++j)
|
||||
aRs(i, j) = c_scalar_Lm1; // aL = 0, aR = -1
|
||||
|
||||
|
||||
// using e as Fiat-Shamir transcript
|
||||
scalar_t e = CT::get_initial_transcript();
|
||||
DBG_PRINT("initial transcript: " << e);
|
||||
|
||||
hash_helper_t::hs_t hsc;
|
||||
CT::update_transcript(hsc, e, commitments_1div8);
|
||||
|
||||
// BP+ paper, page 15: The prover begins with sending A = g^aL h^aR h^alpha (group element)
|
||||
// so we calculate A0 = alpha * H + SUM(aL_i * G_i) + SUM(aR_i * H_i)
|
||||
|
||||
scalar_t alpha = scalar_t::random();
|
||||
point_t A0 = alpha * CT::bpp_H;
|
||||
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
A0 += aLs[i] * CT::get_generator(false, i) + aRs[i] * CT::get_generator(true, i);
|
||||
|
||||
// pre-multiply all output points by c_scalar_1div8
|
||||
// in order to enforce these points to be in the prime-order subgroup (after mul by 8 in bpp_verify())
|
||||
A0 *= c_scalar_1div8;
|
||||
A0.to_public_key(sig.A0);
|
||||
|
||||
DBG_VAL_PRINT(alpha);
|
||||
DBG_VAL_PRINT(A0);
|
||||
|
||||
// calculate scalar challenges y and z
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A0);
|
||||
scalar_t y = hsc.calc_hash();
|
||||
scalar_t z = hash_helper_t::hs(y);
|
||||
e = z; // transcript for further steps
|
||||
DBG_VAL_PRINT(y);
|
||||
DBG_VAL_PRINT(z);
|
||||
|
||||
// Computing vector d for aggregated version of the protocol (BP+ paper, page 17)
|
||||
// (note: elements are stored column-by-column in memory)
|
||||
// d = | 1 * z^(2*1), 1 * z^(2*2), 1 * z^(2*3), ..., 1 * z^(2*m) |
|
||||
// | 2 * z^(2*1), 2 * z^(2*2), 2 * z^(2*3), ..., 2 * z^(2*m) |
|
||||
// | 4 * z^(2*1), 4 * z^(2*2), 4 * z^(2*3), ..., 4 * z^(2*m) |
|
||||
// | ....................................................................................... |
|
||||
// | 2^(n-1) * z^(2*1), 2^(n-1) * z^(2*2), 2^(n-1) * z^(2*3), ..., 2^(n-1) * z^(2*m)) |
|
||||
// Note: sum(d_i) = (2^n - 1) * ((z^2)^1 + (z^2)^2 + ... (z^2)^m)) = (2^n-1) * sum_of_powers(x^2, log(m))
|
||||
|
||||
scalar_t z_sq = z * z;
|
||||
scalar_mat_t<CT::c_bpp_n> d(c_bpp_mn);
|
||||
d(0, 0) = z_sq;
|
||||
// first row
|
||||
for (size_t i = 1; i < c_bpp_m; ++i)
|
||||
d(i, 0) = d(i - 1, 0) * z_sq;
|
||||
// all rows
|
||||
for (size_t j = 1; j < CT::c_bpp_n; ++j)
|
||||
for (size_t i = 0; i < c_bpp_m; ++i)
|
||||
d(i, j) = d(i, j - 1) + d(i, j - 1);
|
||||
|
||||
DBG_PRINT("Hs(d): " << d.calc_hs());
|
||||
|
||||
// calculate extended Vandermonde vector y = (1, y, y^2, ..., y^(mn+1)) (BP+ paper, page 18, Fig. 3)
|
||||
// (calculate two more elements (1 and y^(mn+1)) for convenience)
|
||||
scalar_vec_t y_powers(c_bpp_mn + 2);
|
||||
y_powers[0] = 1;
|
||||
for (size_t i = 1; i <= c_bpp_mn + 1; ++i)
|
||||
y_powers[i] = y_powers[i - 1] * y;
|
||||
|
||||
const scalar_t& y_mn_p1 = y_powers[c_bpp_mn + 1];
|
||||
|
||||
DBG_PRINT("Hs(y_powers): " << y_powers.calc_hs());
|
||||
|
||||
// aL_hat = aL - 1*z
|
||||
scalar_vec_t aLs_hat = aLs - z;
|
||||
// aR_hat = aR + d o y^leftarr + 1*z where y^leftarr = (y^n, y^(n-1), ..., y) (BP+ paper, page 18, Fig. 3)
|
||||
scalar_vec_t aRs_hat = aRs + z;
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
aRs_hat[i] += d[i] * y_powers[c_bpp_mn - i];
|
||||
|
||||
DBG_PRINT("Hs(aLs_hat): " << aLs_hat.calc_hs());
|
||||
DBG_PRINT("Hs(aRs_hat): " << aRs_hat.calc_hs());
|
||||
|
||||
// calculate alpha_hat
|
||||
// alpha_hat = alpha + SUM(z^(2j) * gamma_j * y^(mn+1)) for j = 1..m
|
||||
// i.e. \hat{\alpha} = \alpha + y^{m n+1} \sum_{j = 1}^{m} z^{2j} \gamma_j
|
||||
scalar_t alpha_hat = 0;
|
||||
for (size_t i = 0; i < masks.size(); ++i)
|
||||
alpha_hat += d(i, 0) * masks[i];
|
||||
alpha_hat = alpha + y_mn_p1 * alpha_hat;
|
||||
|
||||
DBG_VAL_PRINT(alpha_hat);
|
||||
|
||||
// calculate 1, y^-1, y^-2, ...
|
||||
const scalar_t y_inverse = y.reciprocal();
|
||||
scalar_vec_t y_inverse_powers(c_bpp_mn / 2 + 1); // the greatest power we need is c_bpp_mn/2 (at the first reduction round)
|
||||
y_inverse_powers[0] = 1;
|
||||
for (size_t i = 1, size = y_inverse_powers.size(); i < size; ++i)
|
||||
y_inverse_powers[i] = y_inverse_powers[i - 1] * y_inverse;
|
||||
|
||||
// prepare generator's vector
|
||||
std::vector<point_t> g(c_bpp_mn), h(c_bpp_mn);
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
{
|
||||
g[i] = CT::get_generator(false, i);
|
||||
h[i] = CT::get_generator(true, i);
|
||||
}
|
||||
|
||||
// WIP zk-argument called with zk-WIP(g, h, G, H, A_hat, aL_hat, aR_hat, alpha_hat)
|
||||
|
||||
scalar_vec_t& a = aLs_hat;
|
||||
scalar_vec_t& b = aRs_hat;
|
||||
|
||||
sig.L.resize(c_bpp_log2_mn);
|
||||
sig.R.resize(c_bpp_log2_mn);
|
||||
|
||||
// zk-WIP reduction rounds (s.a. the preprint page 13 Fig. 1)
|
||||
for (size_t n = c_bpp_mn / 2, ni = 0; n >= 1; n /= 2, ++ni)
|
||||
{
|
||||
DBG_PRINT(ENDL << "#" << ni);
|
||||
|
||||
// zk-WIP(g, h, G, H, P, a, b, alpha)
|
||||
|
||||
scalar_t dL = scalar_t::random();
|
||||
DBG_VAL_PRINT(dL);
|
||||
scalar_t dR = scalar_t::random();
|
||||
DBG_VAL_PRINT(dR);
|
||||
|
||||
// a = (a1, a2), b = (b1, b2) -- vectors of scalars
|
||||
// cL = <a1, ((y, y^2, ...) o b2)> -- scalar
|
||||
scalar_t cL = 0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
cL += a[i] * y_powers[i + 1] * b[n + i];
|
||||
|
||||
DBG_VAL_PRINT(cL);
|
||||
|
||||
// cR = <a2, ((y, y^2, ...) o b1)> * y^n -- scalar
|
||||
scalar_t cR = 0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
cR += a[n + i] * y_powers[i + 1] * b[i];
|
||||
cR *= y_powers[n];
|
||||
|
||||
DBG_VAL_PRINT(cR);
|
||||
|
||||
// L = y^-n * a1 * g2 + b2 * h1 + cL * G + dL * H -- point
|
||||
point_t sum = c_point_0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
sum += a[i] * g[n + i];
|
||||
point_t L;
|
||||
CT::calc_pedersen_commitment(cL, dL, L);
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
L += b[n + i] * h[i];
|
||||
L += y_inverse_powers[n] * sum;
|
||||
L *= c_scalar_1div8;
|
||||
DBG_VAL_PRINT(L);
|
||||
|
||||
// R = y^n * a2 * g1 + b1 * h2 + cR * G + dR * H -- point
|
||||
sum.zero();
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
sum += a[n + i] * g[i];
|
||||
point_t R;
|
||||
CT::calc_pedersen_commitment(cR, dR, R);
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
R += b[i] * h[n + i];
|
||||
R += y_powers[n] * sum;
|
||||
R *= c_scalar_1div8;
|
||||
DBG_VAL_PRINT(R);
|
||||
|
||||
// put L, R to the sig
|
||||
L.to_public_key(sig.L[ni]);
|
||||
R.to_public_key(sig.R[ni]);
|
||||
|
||||
// update the transcript
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.L[ni]);
|
||||
hsc.add_pub_key(sig.R[ni]);
|
||||
e = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(e);
|
||||
|
||||
// recalculate arguments for the next round
|
||||
scalar_t e_squared = e * e;
|
||||
scalar_t e_inverse = e.reciprocal();
|
||||
scalar_t e_inverse_squared = e_inverse * e_inverse;
|
||||
scalar_t e_y_inv_n = e * y_inverse_powers[n];
|
||||
scalar_t e_inv_y_n = e_inverse * y_powers[n];
|
||||
|
||||
// g_hat = e^-1 * g1 + (e * y^-n) * g2 -- vector of points
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
g[i] = e_inverse * g[i] + e_y_inv_n * g[n + i];
|
||||
|
||||
// h_hat = e * h1 + e^-1 * h2 -- vector of points
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
h[i] = e * h[i] + e_inverse * h[n + i];
|
||||
|
||||
// P_hat = e^2 * L + P + e^-2 * R -- point
|
||||
|
||||
// a_hat = e * a1 + e^-1 * y^n * a2 -- vector of scalars
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
a[i] = e * a[i] + e_inv_y_n * a[n + i];
|
||||
|
||||
// b_hat = e^-1 * b1 + e * b2 -- vector of scalars
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
b[i] = e_inverse * b[i] + e * b[n + i];
|
||||
|
||||
// alpha_hat = e^2 * dL + alpha + e^-2 * dR -- scalar
|
||||
alpha_hat += e_squared * dL + e_inverse_squared * dR;
|
||||
|
||||
// run next iteraton zk-WIP(g_hat, h_hat, G, H, P_hat, a_hat, b_hat, alpha_hat)
|
||||
}
|
||||
DBG_PRINT("");
|
||||
|
||||
// zk-WIP last round
|
||||
scalar_t r = scalar_t::random();
|
||||
scalar_t s = scalar_t::random();
|
||||
scalar_t delta = scalar_t::random();
|
||||
scalar_t eta = scalar_t::random();
|
||||
DBG_VAL_PRINT(r);
|
||||
DBG_VAL_PRINT(s);
|
||||
DBG_VAL_PRINT(delta);
|
||||
DBG_VAL_PRINT(eta);
|
||||
|
||||
// A = r * g + s * h + (r y b + s y a) * G + delta * H -- point
|
||||
point_t A = c_point_0;
|
||||
CT::calc_pedersen_commitment(y * (r * b[0] + s * a[0]), delta, A);
|
||||
A += r * g[0] + s * h[0];
|
||||
A *= c_scalar_1div8;
|
||||
A.to_public_key(sig.A);
|
||||
DBG_VAL_PRINT(A);
|
||||
|
||||
// B = (r * y * s) * G + eta * H
|
||||
point_t B = c_point_0;
|
||||
CT::calc_pedersen_commitment(r * y * s, eta, B);
|
||||
B *= c_scalar_1div8;
|
||||
B.to_public_key(sig.B);
|
||||
DBG_VAL_PRINT(B);
|
||||
|
||||
// update the transcript
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A);
|
||||
hsc.add_pub_key(sig.B);
|
||||
e = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(e);
|
||||
|
||||
// finalize the signature
|
||||
sig.r = r + e * a[0];
|
||||
sig.s = s + e * b[0];
|
||||
sig.delta = eta + e * delta + e * e * alpha_hat;
|
||||
DBG_VAL_PRINT(sig.r);
|
||||
DBG_VAL_PRINT(sig.s);
|
||||
DBG_VAL_PRINT(sig.delta);
|
||||
|
||||
return true;
|
||||
} // bpp_gen()
|
||||
|
||||
|
||||
// convenient overload for tests
|
||||
template<typename CT>
|
||||
bool bpp_gen(const scalar_vec_t& values, const scalar_vec_t& masks, bpp_signature& sig, std::vector<point_t>& commitments_1div8_to_be_generated, uint8_t* p_err = nullptr)
|
||||
{
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(values.size() == masks.size(), 91);
|
||||
commitments_1div8_to_be_generated.resize(values.size());
|
||||
std::vector<crypto::public_key> commitments_1div8(values.size());
|
||||
std::vector<const crypto::public_key*> commitments_1div8_pointers(values.size());
|
||||
for(size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
CT::calc_pedersen_commitment(c_scalar_1div8 * values[i], c_scalar_1div8 * masks[i], commitments_1div8_to_be_generated[i]);
|
||||
commitments_1div8[i] = (commitments_1div8_to_be_generated[i]).to_public_key();
|
||||
commitments_1div8_pointers[i] = &commitments_1div8[i];
|
||||
}
|
||||
return bpp_gen<CT>(values, masks, commitments_1div8_pointers, sig, p_err);
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
struct bpp_sig_commit_ref_t
|
||||
{
|
||||
bpp_sig_commit_ref_t(const bpp_signature& sig, const std::vector<point_t>& commitments)
|
||||
: sig(sig)
|
||||
, commitments(commitments)
|
||||
{}
|
||||
const bpp_signature& sig;
|
||||
const std::vector<point_t>& commitments; // assumed to be premultiplied by 1/8
|
||||
};
|
||||
|
||||
|
||||
template<typename CT>
|
||||
bool bpp_verify(const std::vector<bpp_sig_commit_ref_t>& sigs, uint8_t* p_err = nullptr)
|
||||
{
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("bpp_verify: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
DBG_PRINT(ENDL << " . . . . bpp_verify() . . . . ");
|
||||
|
||||
static_assert(CT::c_bpp_n <= 255, "too big N");
|
||||
const size_t kn = sigs.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(kn > 0, 1);
|
||||
|
||||
struct intermediate_element_t
|
||||
{
|
||||
scalar_t y;
|
||||
scalar_t z;
|
||||
scalar_t z_sq;
|
||||
scalar_vec_t e;
|
||||
scalar_vec_t e_sq;
|
||||
scalar_t e_final;
|
||||
scalar_t e_final_sq;
|
||||
size_t inv_e_offset; // offset in batch_for_inverse
|
||||
size_t inv_y_offset; // offset in batch_for_inverse
|
||||
size_t c_bpp_log2_m;
|
||||
size_t c_bpp_m;
|
||||
size_t c_bpp_mn;
|
||||
point_t A;
|
||||
point_t A0;
|
||||
point_t B;
|
||||
std::vector<point_t> L;
|
||||
std::vector<point_t> R;
|
||||
};
|
||||
std::vector<intermediate_element_t> interms(kn);
|
||||
|
||||
size_t c_bpp_log2_m_max = 0;
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
const bpp_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bpp_signature& sig = bsc.sig;
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(bsc.commitments.size() > 0, 2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.L.size() > 0 && sig.L.size() == sig.R.size(), 3);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.r.is_reduced() && sig.s.is_reduced() && sig.delta.is_reduced(), 4);
|
||||
|
||||
intermediate_element_t& interm = interms[k];
|
||||
interm.c_bpp_log2_m = constexpr_ceil_log2(bsc.commitments.size());
|
||||
if (c_bpp_log2_m_max < interm.c_bpp_log2_m)
|
||||
c_bpp_log2_m_max = interm.c_bpp_log2_m;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.L.size() == interm.c_bpp_log2_m + CT::c_bpp_log2_n, 5);
|
||||
|
||||
interm.c_bpp_m = 1ull << interm.c_bpp_log2_m;
|
||||
interm.c_bpp_mn = interm.c_bpp_m * CT::c_bpp_n;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.A0.from_public_key(sig.A0), 6);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.A.from_public_key(sig.A), 7);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.B.from_public_key(sig.B), 8);
|
||||
interm.L.resize(sig.L.size());
|
||||
interm.R.resize(sig.R.size());
|
||||
for (size_t i = 0; i < interm.L.size(); ++i)
|
||||
{
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.L[i].from_public_key(sig.L[i]), 9);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.R[i].from_public_key(sig.R[i]), 10);
|
||||
}
|
||||
}
|
||||
const size_t c_bpp_m_max = 1ull << c_bpp_log2_m_max;
|
||||
const size_t c_bpp_mn_max = c_bpp_m_max * CT::c_bpp_n;
|
||||
const size_t c_bpp_LR_size_max = c_bpp_log2_m_max + CT::c_bpp_log2_n;
|
||||
|
||||
|
||||
//
|
||||
// prepare stuff
|
||||
//
|
||||
/*
|
||||
std::vector<point_t> g(c_bpp_mn_max), h(c_bpp_mn_max);
|
||||
for (size_t i = 0; i < c_bpp_mn_max; ++i)
|
||||
{
|
||||
g[i] = CT::get_generator(false, i);
|
||||
h[i] = CT::get_generator(true, i);
|
||||
}
|
||||
*/
|
||||
|
||||
scalar_vec_t batch_for_inverse;
|
||||
batch_for_inverse.reserve(kn + kn * c_bpp_LR_size_max);
|
||||
|
||||
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
DBG_PRINT(ENDL << "SIG #" << k);
|
||||
const bpp_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bpp_signature& sig = bsc.sig;
|
||||
intermediate_element_t& interm = interms[k];
|
||||
|
||||
// restore y and z
|
||||
// using e as Fiat-Shamir transcript
|
||||
scalar_t e = CT::get_initial_transcript();
|
||||
DBG_PRINT("initial transcript: " << e);
|
||||
hash_helper_t::hs_t hsc;
|
||||
CT::update_transcript(hsc, e, bsc.commitments);
|
||||
// calculate scalar challenges y and z
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A0);
|
||||
hsc.assign_calc_hash(interm.y);
|
||||
interm.z = hash_helper_t::hs(interm.y);
|
||||
interm.z_sq = interm.z * interm.z;
|
||||
DBG_VAL_PRINT(interm.y);
|
||||
DBG_VAL_PRINT(interm.z);
|
||||
e = interm.z; // transcript for further steps
|
||||
|
||||
interm.inv_y_offset = batch_for_inverse.size();
|
||||
batch_for_inverse.push_back(interm.y);
|
||||
interm.inv_e_offset = batch_for_inverse.size();
|
||||
|
||||
interm.e.resize(sig.L.size());
|
||||
interm.e_sq.resize(sig.L.size());
|
||||
|
||||
for (size_t i = 0; i < sig.L.size(); ++i)
|
||||
{
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.L[i]);
|
||||
hsc.add_pub_key(sig.R[i]);
|
||||
hsc.assign_calc_hash(e);
|
||||
interm.e[i] = e;
|
||||
interm.e_sq[i] = e * e;
|
||||
DBG_PRINT("e[" << i << "]: " << e);
|
||||
batch_for_inverse.push_back(e);
|
||||
}
|
||||
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A);
|
||||
hsc.add_pub_key(sig.B);
|
||||
hsc.assign_calc_hash(interm.e_final);
|
||||
interm.e_final_sq = interm.e_final * interm.e_final;
|
||||
DBG_VAL_PRINT(interm.e_final);
|
||||
}
|
||||
|
||||
batch_for_inverse.invert();
|
||||
|
||||
// Notation:
|
||||
// 1_vec ^ n = (1, 1, 1, ..., 1)
|
||||
// 2_vec ^ n = (2^0, 2^1, 2^2, ..., 2^(n-1))
|
||||
// -1_vec ^ n = ((-1)^0, (-1)^1, (-1)^2, ... (-1)^(n-1)) = (1, -1, 1, -1, ...)
|
||||
// y<^n = (y^n, y^(n-1), ..., y^1)
|
||||
// y>^n = (y^1, y^2, ..., y^n)
|
||||
|
||||
// from page 13, Fig 1:
|
||||
// Verifier outputs Accept IFF the following equality holds (single proof):
|
||||
// P^e^2 * A^e * B == g ^ (r' e) * h ^ (s' e) * G ^ (r' y s') * H ^ delta'
|
||||
// (where g and h are calculated in each round)
|
||||
// The same equation in additive notation:
|
||||
// e^2 * P + e * A + B == (r' * e) * g + (s' * e) * h + (r' y s') * G + delta' * H
|
||||
// <=>
|
||||
// (r' * e) * g + (s' * e) * h + (r' y s') * G + delta' * H - e^2 * P - e * A - B == 0 (*)
|
||||
// where A, B, r', s', delta' is taken from the signature
|
||||
// and P_{k+1} = e^2 * L_k + P_k + e^-2 * R_k for all rounds
|
||||
//
|
||||
// from page 18, Fig 3:
|
||||
// P and V computes:
|
||||
// A_hat = A0 + (- 1^(mn) * z) * g + (d o y<^(mn) + 1^(mn) * z) * h +
|
||||
// + y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j) +
|
||||
// + (z*SUM(y^>mn) - z*y^(mn+1)*SUM(d) - z^2 * SUM(y^>mn)) * G
|
||||
// (calculated once)
|
||||
//
|
||||
// As suggested in Section 6.1 "Practical Optimizations":
|
||||
// 1) g and h exponentianions can be optimized in order not to be calculated at each round as the following (page 20):
|
||||
//
|
||||
// (r' * e * s_vec) * g + (s' * e * s'_vec) * h + (r' y s') * G + delta' * H -
|
||||
// - e^2 * A_hat
|
||||
// - SUM{j=1..log(n)}(e_final^2 * e_j^2 * L_j + e_final^2 * e_j^-2 * R_j)
|
||||
// - e * A - B = 0 (**)
|
||||
//
|
||||
// where:
|
||||
// g, h - vector of fixed generators
|
||||
// s_vec_i = y^(1-i) * PROD{j=1..log(n)}(e_j ^ b(i,j))
|
||||
// s'_vec_i = PROD{j=1..log(n)}(e_j ^ -b(i,j))
|
||||
// b(i, j) = { 2 * ((1<<(j-1)) & (i-1)) - 1) (counting both from 1) (page 20)
|
||||
// b(i, j) = { 2 * ((1<<j) & i) - 1) (counting both from 0)
|
||||
//
|
||||
// 2) we gonna aggregate all (**) for each round by multiplying them to a random weights and then sum up
|
||||
// insert A_hat into (**) =>
|
||||
|
||||
// (r' * e * s_vec) * g + (s' * e * s'_vec) * h + (r' y s') * G + delta' * H -
|
||||
// - e^2 * (A0 + (- 1^(mn) * z) * g + (d o y<^(mn) + 1^(mn) * z) * h +
|
||||
// + y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j) +
|
||||
// + (z*SUM(y^>mn) - z*y^(mn+1)*SUM(d) - z^2 * SUM(y^>mn)) * G
|
||||
// )
|
||||
// - SUM{j=1..log(n)}(e_final^2 * e_j^2 * L_j + e_final^2 * e_j^-2 * R_j)
|
||||
// - e * A - B = 0
|
||||
|
||||
// =>
|
||||
|
||||
// (for single signature)
|
||||
//
|
||||
// (r' * e * s_vec - e^2 * (- 1_vec^(mn) * z)) * g | these are
|
||||
// + (s' * e * s'_vec - e^2 * (d o y<^(mn) + 1_vec^(mn) * z)) * h | fixed generators
|
||||
// + (r' y s' - e^2 * ((z - z^2)*SUM(y^>mn) - z*y^(mn+1)*SUM(d)) * G | across all
|
||||
// + delta' * H | the signatures
|
||||
//
|
||||
// - e^2 * A0
|
||||
// - e^2 * y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j))
|
||||
// - e^2 * SUM{j=1..log(n)}(e_j^2 * L_j + e_j^-2 * R_j)
|
||||
// - e * A - B = 0 (***)
|
||||
//
|
||||
// All (***) will be muptiplied by random weightning factor and then summed up.
|
||||
|
||||
// Calculate cummulative sclalar multiplicand for fixed generators across all the sigs.
|
||||
scalar_vec_t g_scalars;
|
||||
g_scalars.resize(c_bpp_mn_max, 0);
|
||||
scalar_vec_t h_scalars;
|
||||
h_scalars.resize(c_bpp_mn_max, 0);
|
||||
scalar_t G_scalar = 0;
|
||||
scalar_t H_scalar = 0;
|
||||
point_t summand = c_point_0;
|
||||
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
DBG_PRINT(ENDL << "SIG #" << k);
|
||||
const bpp_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bpp_signature& sig = bsc.sig;
|
||||
intermediate_element_t& interm = interms[k];
|
||||
|
||||
// random weightning factor for speed-optimized batch verification (preprint page 20)
|
||||
const scalar_t rwf = scalar_t::random();
|
||||
DBG_PRINT("rwf: " << rwf);
|
||||
|
||||
// prepare d vector (see also d structure description in proof function)
|
||||
scalar_mat_t<CT::c_bpp_n> d(interm.c_bpp_mn);
|
||||
d(0, 0) = interm.z_sq;
|
||||
// first row
|
||||
for (size_t i = 1; i < interm.c_bpp_m; ++i)
|
||||
d(i, 0) = d(i - 1, 0) * interm.z_sq;
|
||||
// all rows
|
||||
for (size_t j = 1; j < CT::c_bpp_n; ++j)
|
||||
for (size_t i = 0; i < interm.c_bpp_m; ++i)
|
||||
d(i, j) = d(i, j - 1) + d(i, j - 1);
|
||||
// sum(d) (see also note in proof function for this)
|
||||
const scalar_t sum_d = CT::get_2_to_the_power_of_N_minus_1() * sum_of_powers(interm.z_sq, interm.c_bpp_log2_m);
|
||||
|
||||
DBG_PRINT("Hs(d): " << d.calc_hs());
|
||||
DBG_PRINT("sum(d): " << sum_d);
|
||||
|
||||
const scalar_t& y_inv = batch_for_inverse[interm.inv_y_offset];
|
||||
auto get_e_inv = [&](size_t i) { return batch_for_inverse[interm.inv_e_offset + i]; }; // i belongs to [0; L.size()-1]
|
||||
|
||||
// prepare s_vec (unlike the paper here we moved y-component out of s_vec for convenience, so s_vec'[x] = s_vec[~x & (MN-1)])
|
||||
// complexity (sc_mul's): MN+2*log2(MN)-2
|
||||
// the idea is the following:
|
||||
// s_vec[00000b] = ... * (e_4)^-1 * (e_3)^-1 * (e_2)^-1 * (e_1)^-1 * (e_0)^-1
|
||||
// s_vec[00101b] = ... * (e_4)^-1 * (e_3)^-1 * (e_2)^+1 * (e_1)^-1 * (e_0)^+1
|
||||
const size_t log2_mn = sig.L.size(); // at the beginning we made sure that sig.L.size() == c_bpp_log2_m + c_bpp_log2_n
|
||||
scalar_vec_t s_vec(interm.c_bpp_mn);
|
||||
s_vec[0] = get_e_inv(0);
|
||||
for (size_t i = 1; i < log2_mn; ++i)
|
||||
s_vec[0] *= get_e_inv(i); // s_vec[0] = (e_0)^-1 * (e_1)^-1 * .. (e_{log2_mn-1})^-1
|
||||
DBG_PRINT("[0] " << s_vec[0]);
|
||||
for (size_t i = 1; i < interm.c_bpp_mn; ++i)
|
||||
{
|
||||
size_t base_el_index = i & (i - 1); // base element index: 0, 0, 2, 0, 4, 4, 6, 0, 8, 8, 10... base element differs in one bit (0) from the current one (1)
|
||||
size_t bit_index = log2_mn - calc_lsb_32((uint32_t)i) - 1; // the bit index where current element has the difference with the base
|
||||
s_vec[i] = s_vec[base_el_index] * interm.e_sq[bit_index]; // (e_j)^-1 * (e_j)^2 = (e_j)^+1
|
||||
DBG_PRINT("[" << i << "] " << " " << base_el_index << ", " << bit_index << " : " << s_vec[i]);
|
||||
}
|
||||
|
||||
// prepare y_inv vector
|
||||
scalar_vec_t y_inverse_powers(interm.c_bpp_mn);
|
||||
y_inverse_powers[0] = 1;
|
||||
for (size_t i = 1; i < interm.c_bpp_mn; ++i)
|
||||
y_inverse_powers[i] = y_inverse_powers[i - 1] * y_inv;
|
||||
|
||||
// y^(mn+1)
|
||||
scalar_t y_power_mnp1 = interm.y;
|
||||
for (size_t i = 0; i < log2_mn; ++i)
|
||||
y_power_mnp1 *= y_power_mnp1;
|
||||
y_power_mnp1 *= interm.y;
|
||||
DBG_VAL_PRINT(y_power_mnp1);
|
||||
|
||||
// now calculate all multiplicands for common generators
|
||||
|
||||
// g vector multiplicands:
|
||||
// rwf * (r' * e * (1, y^-1, y^-2, ...) o s_vec + e^2 * z) =
|
||||
// rwf * r' * e * ((1, y^-1, ...) o s_vec) + rwf * e^2 * z * (1, 1, ...)
|
||||
scalar_t rwf_e_sq_z = rwf * interm.e_final_sq * interm.z;
|
||||
scalar_t rwf_r_e = rwf * interm.e_final * sig.r;
|
||||
for (size_t i = 0; i < interm.c_bpp_mn; ++i)
|
||||
g_scalars[i] += rwf_r_e * y_inverse_powers[i] * s_vec[i] + rwf_e_sq_z;
|
||||
|
||||
DBG_PRINT("Hs(g_scalars): " << g_scalars.calc_hs());
|
||||
|
||||
// h vector multiplicands:
|
||||
// rwf * (s' * e * s'_vec - e^2 * (d o y<^(mn) + 1_vec^(mn) * z))
|
||||
// rwf * s' * e * s'_vec - rwf * e^2 * z * (1, 1...) - rwf * e^2 * (d o y<^(mn))
|
||||
//scalar_t rwf_e_sq_z = rwf * interm.e_final_sq * interm.z;
|
||||
scalar_t rwf_s_e = rwf * sig.s * interm.e_final;
|
||||
scalar_t rwf_e_sq_y = rwf * interm.e_final_sq * interm.y;
|
||||
for (size_t i = interm.c_bpp_mn - 1; i != SIZE_MAX; --i)
|
||||
{
|
||||
h_scalars[i] += rwf_s_e * s_vec[interm.c_bpp_mn - 1 - i] - rwf_e_sq_z - rwf_e_sq_y * d[i];
|
||||
rwf_e_sq_y *= interm.y;
|
||||
}
|
||||
|
||||
DBG_PRINT("Hs(h_scalars): " << h_scalars.calc_hs());
|
||||
|
||||
// G point multiplicands:
|
||||
// rwf * (r' y s' - e ^ 2 * ((z - z ^ 2)*SUM(y^>mn) - z * y^(mn+1) * SUM(d)) =
|
||||
// = rwf * r' y s' - rwf * e^2 * (z - z ^ 2)*SUM(y^>mn) + rwf * e^2 * z * y^(mn+1) * SUM(d)
|
||||
G_scalar += rwf * sig.r * interm.y * sig.s + rwf_e_sq_y * sum_d * interm.z;
|
||||
G_scalar -= rwf * interm.e_final_sq * (interm.z - interm.z_sq) * sum_of_powers(interm.y, log2_mn);
|
||||
DBG_PRINT("sum_y: " << sum_of_powers(interm.y, log2_mn));
|
||||
DBG_PRINT("G_scalar: " << G_scalar);
|
||||
|
||||
// H point multiplicands:
|
||||
// rwf * delta
|
||||
H_scalar += rwf * sig.delta;
|
||||
DBG_PRINT("H_scalar: " << H_scalar);
|
||||
|
||||
// uncommon generators' multiplicands
|
||||
point_t summand_8 = c_point_0; // this summand to be multiplied by 8 before adding to the main summand
|
||||
// - rwf * e^2 * A0
|
||||
summand_8 -= rwf * interm.e_final_sq * interm.A0;
|
||||
DBG_PRINT("A0_scalar: " << c_scalar_Lm1 * interm.e_final_sq * rwf);
|
||||
|
||||
// - rwf * e^2 * y^(mn+1) * (SUM{j=1..m} (z^2)^j * V_j))
|
||||
scalar_t e_sq_y_mn1_z_sq_power = rwf * interm.e_final_sq * y_power_mnp1;
|
||||
for (size_t j = 0; j < bsc.commitments.size(); ++j)
|
||||
{
|
||||
e_sq_y_mn1_z_sq_power *= interm.z_sq;
|
||||
summand_8 -= e_sq_y_mn1_z_sq_power * bsc.commitments[j];
|
||||
DBG_PRINT("V_scalar[" << j << "]: " << c_scalar_Lm1 * e_sq_y_mn1_z_sq_power);
|
||||
}
|
||||
|
||||
// - rwf * e^2 * SUM{j=1..log(n)}(e_j^2 * L_j + e_j^-2 * R_j)
|
||||
scalar_t rwf_e_sq = rwf * interm.e_final_sq;
|
||||
for (size_t j = 0; j < log2_mn; ++j)
|
||||
{
|
||||
summand_8 -= rwf_e_sq * (interm.e_sq[j] * interm.L[j] + get_e_inv(j) * get_e_inv(j) * interm.R[j]);
|
||||
DBG_PRINT("L_scalar[" << j << "]: " << c_scalar_Lm1 * rwf_e_sq * interm.e_sq[j]);
|
||||
DBG_PRINT("R_scalar[" << j << "]: " << c_scalar_Lm1 * rwf_e_sq * get_e_inv(j) * get_e_inv(j));
|
||||
}
|
||||
|
||||
// - rwf * e * A - rwf * B = 0
|
||||
summand_8 -= rwf * interm.e_final * interm.A + rwf * interm.B;
|
||||
DBG_PRINT("A_scalar: " << c_scalar_Lm1 * rwf * interm.e_final);
|
||||
DBG_PRINT("B_scalar: " << c_scalar_Lm1 * rwf);
|
||||
|
||||
summand_8.modify_mul8();
|
||||
summand += summand_8;
|
||||
}
|
||||
|
||||
point_t GH_exponents = c_point_0;
|
||||
CT::calc_pedersen_commitment(G_scalar, H_scalar, GH_exponents);
|
||||
bool result = msm_and_check_zero<CT>(g_scalars, h_scalars, summand + GH_exponents);
|
||||
if (result)
|
||||
DBG_PRINT(ENDL << " . . . . bpp_verify() -- SUCCEEDED!!!" << ENDL);
|
||||
return result;
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
}
|
||||
|
||||
#undef DBG_VAL_PRINT
|
||||
#undef DBG_PRINT
|
||||
|
||||
} // namespace crypto
|
||||
759
crypto/upstream/range_proof_bppe.h
Executable file
759
crypto/upstream/range_proof_bppe.h
Executable file
|
|
@ -0,0 +1,759 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
|
||||
//
|
||||
// This file contains the implementation of range proof protocol.
|
||||
// Namely, Bulletproofs+ https://eprint.iacr.org/2020/735
|
||||
// Double-blinded commitments extension implemented as in Appendix D in the Zarcanum whitepaper: https://eprint.iacr.org/2021/1478
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
struct bppe_signature
|
||||
{
|
||||
std::vector<public_key> L; // size = log_2(m * n)
|
||||
std::vector<public_key> R;
|
||||
public_key A0;
|
||||
public_key A;
|
||||
public_key B;
|
||||
scalar_t r;
|
||||
scalar_t s;
|
||||
scalar_t delta_1;
|
||||
scalar_t delta_2;
|
||||
};
|
||||
|
||||
#if 0
|
||||
# define DBG_VAL_PRINT(x) std::cout << std::setw(30) << std::left << #x ": " << x << std::endl
|
||||
# define DBG_PRINT(x) std::cout << x << std::endl
|
||||
#else
|
||||
# define DBG_VAL_PRINT(x) (void(0))
|
||||
# define DBG_PRINT(x) (void(0))
|
||||
#endif
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("bppe_gen: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
|
||||
template<typename CT>
|
||||
bool bppe_gen(const scalar_vec_t& values, const scalar_vec_t& masks, const scalar_vec_t& masks2, const std::vector<const crypto::public_key*>& commitments_1div8, bppe_signature& sig, uint8_t* p_err = nullptr)
|
||||
{
|
||||
// Note: commitments_1div8 are supposed to be already calculated
|
||||
static_assert(CT::c_bpp_n <= 255, "too big N");
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(values.size() > 0 && values.size() <= CT::c_bpp_values_max && values.size() == masks.size() && masks.size() == masks2.size() && values.size() == commitments_1div8.size(), 1);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(masks.is_reduced() && masks2.is_reduced(), 3);
|
||||
|
||||
const size_t c_bpp_log2_m = constexpr_ceil_log2(values.size());
|
||||
const size_t c_bpp_m = 1ull << c_bpp_log2_m;
|
||||
const size_t c_bpp_mn = c_bpp_m * CT::c_bpp_n;
|
||||
const size_t c_bpp_log2_mn = c_bpp_log2_m + CT::c_bpp_log2_n;
|
||||
|
||||
#ifndef NDEBUG
|
||||
for(size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
point_t V{};
|
||||
CT::calc_pedersen_commitment_2(values[i], masks[i], masks2[i], V);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(point_t(*commitments_1div8[i]).modify_mul8() == V, 4);
|
||||
}
|
||||
#endif
|
||||
|
||||
// s.a. BP+ paper, page 15, eq. 11
|
||||
// decompose v into aL and aR:
|
||||
// v = aL o (1, 2, 2^2, ..., 2^n-1), o - component-wise product aka Hadamard product
|
||||
// aR = aL - (1, 1, ... 1)
|
||||
// aR o aL = 0
|
||||
|
||||
// aLs = (aL_0, aL_1, ..., aL_m-1) -- `bit` matrix of c_bpp_m x c_bpp_n, each element is a scalar
|
||||
|
||||
scalar_mat_t<CT::c_bpp_n> aLs(c_bpp_mn), aRs(c_bpp_mn);
|
||||
aLs.zero();
|
||||
aRs.zero();
|
||||
// m >= values.size, first set up [0..values.size-1], then -- [values.size..m-1] (padding area)
|
||||
for (size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
const scalar_t& v = values[i];
|
||||
for (uint8_t j = 0; j < CT::c_bpp_n; ++j)
|
||||
{
|
||||
if (v.get_bit(j))
|
||||
aLs(i, j) = c_scalar_1; // aL = 1, aR = 0
|
||||
else
|
||||
aRs(i, j) = c_scalar_Lm1; // aL = 0, aR = -1
|
||||
}
|
||||
}
|
||||
|
||||
for (size_t i = values.size(); i < c_bpp_m; ++i)
|
||||
for (size_t j = 0; j < CT::c_bpp_n; ++j)
|
||||
aRs(i, j) = c_scalar_Lm1; // aL = 0, aR = -1
|
||||
|
||||
|
||||
// using e as Fiat-Shamir transcript
|
||||
scalar_t e = CT::get_initial_transcript();
|
||||
DBG_PRINT("initial transcript: " << e);
|
||||
|
||||
hash_helper_t::hs_t hsc;
|
||||
CT::update_transcript(hsc, e, commitments_1div8);
|
||||
|
||||
// Zarcanum paper, page 33, Fig. D.3: The prover chooses alpha_1, alpha_2 and computes A = g^aL h^aR h_1^alpha_1 h_2^alpha_2
|
||||
// so we calculate A0 = alpha_1 * H + alpha_2 * H_2 + SUM(aL_i * G_i) + SUM(aR_i * H_i)
|
||||
|
||||
scalar_t alpha_1 = scalar_t::random(), alpha_2 = scalar_t::random();
|
||||
point_t A0 = alpha_1 * CT::bpp_H + alpha_2 * CT::bpp_H2;
|
||||
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
A0 += aLs[i] * CT::get_generator(false, i) + aRs[i] * CT::get_generator(true, i);
|
||||
|
||||
// part of 1/8 defense scheme
|
||||
A0 *= c_scalar_1div8;
|
||||
A0.to_public_key(sig.A0);
|
||||
|
||||
DBG_VAL_PRINT(alpha_1);
|
||||
DBG_VAL_PRINT(alpha_2);
|
||||
DBG_VAL_PRINT(A0);
|
||||
|
||||
// calculate scalar challenges y and z
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A0);
|
||||
scalar_t y = hsc.calc_hash();
|
||||
scalar_t z = hash_helper_t::hs(y);
|
||||
e = z; // transcript for further steps
|
||||
DBG_VAL_PRINT(y);
|
||||
DBG_VAL_PRINT(z);
|
||||
|
||||
// Computing vector d for aggregated version of the protocol (BP+ paper, page 17)
|
||||
// (note: elements are stored column-by-column in memory)
|
||||
// d = | 1 * z^(2*1), 1 * z^(2*2), 1 * z^(2*3), ..., 1 * z^(2*m) |
|
||||
// | 2 * z^(2*1), 2 * z^(2*2), 2 * z^(2*3), ..., 2 * z^(2*m) |
|
||||
// | 4 * z^(2*1), 4 * z^(2*2), 4 * z^(2*3), ..., 4 * z^(2*m) |
|
||||
// | ....................................................................................... |
|
||||
// | 2^(n-1) * z^(2*1), 2^(n-1) * z^(2*2), 2^(n-1) * z^(2*3), ..., 2^(n-1) * z^(2*m)) |
|
||||
// Note: sum(d_i) = (2^n - 1) * ((z^2)^1 + (z^2)^2 + ... (z^2)^m)) = (2^n-1) * sum_of_powers(x^2, log(m))
|
||||
|
||||
scalar_t z_sq = z * z;
|
||||
scalar_mat_t<CT::c_bpp_n> d(c_bpp_mn);
|
||||
d(0, 0) = z_sq;
|
||||
// first row
|
||||
for (size_t i = 1; i < c_bpp_m; ++i)
|
||||
d(i, 0) = d(i - 1, 0) * z_sq;
|
||||
// all rows
|
||||
for (size_t j = 1; j < CT::c_bpp_n; ++j)
|
||||
for (size_t i = 0; i < c_bpp_m; ++i)
|
||||
d(i, j) = d(i, j - 1) + d(i, j - 1);
|
||||
|
||||
DBG_PRINT("Hs(d): " << d.calc_hs());
|
||||
|
||||
// calculate extended Vandermonde vector y = (1, y, y^2, ..., y^(mn+1)) (BP+ paper, page 18, Fig. 3)
|
||||
// (calculate two more elements (1 and y^(mn+1)) for convenience)
|
||||
scalar_vec_t y_powers(c_bpp_mn + 2);
|
||||
y_powers[0] = 1;
|
||||
for (size_t i = 1; i <= c_bpp_mn + 1; ++i)
|
||||
y_powers[i] = y_powers[i - 1] * y;
|
||||
|
||||
const scalar_t& y_mn_p1 = y_powers[c_bpp_mn + 1];
|
||||
|
||||
DBG_PRINT("Hs(y_powers): " << y_powers.calc_hs());
|
||||
|
||||
// aL_hat = aL - 1*z
|
||||
scalar_vec_t aLs_hat = aLs - z;
|
||||
// aR_hat = aR + d o y^leftarr + 1*z where y^leftarr = (y^n, y^(n-1), ..., y) (BP+ paper, page 18, Fig. 3)
|
||||
scalar_vec_t aRs_hat = aRs + z;
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
aRs_hat[i] += d[i] * y_powers[c_bpp_mn - i];
|
||||
|
||||
DBG_PRINT("Hs(aLs_hat): " << aLs_hat.calc_hs());
|
||||
DBG_PRINT("Hs(aRs_hat): " << aRs_hat.calc_hs());
|
||||
|
||||
// calculate alpha_hat
|
||||
// alpha_hat_1 = alpha_1 + SUM(z^(2j) * gamma_1,j * y^(mn+1)) for j = 1..m
|
||||
// alpha_hat_2 = alpha_2 + SUM(z^(2j) * gamma_2,j * y^(mn+1)) for j = 1..m
|
||||
// i.e. \hat{\alpha} = \alpha + y^{m n+1} \sum_{j = 1}^{m} z^{2j} \gamma_j
|
||||
scalar_t alpha_hat_1 = 0, alpha_hat_2 = 0;
|
||||
for (size_t i = 0; i < masks.size(); ++i)
|
||||
{
|
||||
alpha_hat_1 += d(i, 0) * masks[i];
|
||||
alpha_hat_2 += d(i, 0) * masks2[i];
|
||||
}
|
||||
alpha_hat_1 = alpha_1 + y_mn_p1 * alpha_hat_1;
|
||||
alpha_hat_2 = alpha_2 + y_mn_p1 * alpha_hat_2;
|
||||
|
||||
DBG_VAL_PRINT(alpha_hat_1);
|
||||
DBG_VAL_PRINT(alpha_hat_2);
|
||||
|
||||
// calculate 1, y^-1, y^-2, ...
|
||||
const scalar_t y_inverse = y.reciprocal();
|
||||
scalar_vec_t y_inverse_powers(c_bpp_mn / 2 + 1); // the greatest power we need is c_bpp_mn/2 (at the first reduction round)
|
||||
y_inverse_powers[0] = 1;
|
||||
for (size_t i = 1, size = y_inverse_powers.size(); i < size; ++i)
|
||||
y_inverse_powers[i] = y_inverse_powers[i - 1] * y_inverse;
|
||||
|
||||
// prepare generator's vector
|
||||
std::vector<point_t> g(c_bpp_mn), h(c_bpp_mn);
|
||||
for (size_t i = 0; i < c_bpp_mn; ++i)
|
||||
{
|
||||
g[i] = CT::get_generator(false, i);
|
||||
h[i] = CT::get_generator(true, i);
|
||||
}
|
||||
|
||||
// WIP zk-argument called with zk-WIP(g, h, G, H, H2, A_hat, aL_hat, aR_hat, alpha_hat_1, alpha_hat_2)
|
||||
|
||||
scalar_vec_t& a = aLs_hat;
|
||||
scalar_vec_t& b = aRs_hat;
|
||||
|
||||
sig.L.resize(c_bpp_log2_mn);
|
||||
sig.R.resize(c_bpp_log2_mn);
|
||||
|
||||
// zk-WIP reduction rounds (s.a. Zarcanum preprint page 24 Fig. D.1)
|
||||
for (size_t n = c_bpp_mn / 2, ni = 0; n >= 1; n /= 2, ++ni)
|
||||
{
|
||||
DBG_PRINT(ENDL << "#" << ni);
|
||||
|
||||
// zk-WIP(g, h, G, H, H2, P, a, b, alpha_1, alpha_2)
|
||||
|
||||
scalar_t dL = scalar_t::random(), dL2 = scalar_t::random();
|
||||
DBG_VAL_PRINT(dL); DBG_VAL_PRINT(dL2);
|
||||
scalar_t dR = scalar_t::random(), dR2 = scalar_t::random();
|
||||
DBG_VAL_PRINT(dR); DBG_VAL_PRINT(dR2);
|
||||
|
||||
// a = (a1, a2), b = (b1, b2) -- vectors of scalars
|
||||
// cL = <a1, ((y, y^2, ...) o b2)> -- scalar
|
||||
scalar_t cL = 0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
cL += a[i] * y_powers[i + 1] * b[n + i];
|
||||
|
||||
DBG_VAL_PRINT(cL);
|
||||
|
||||
// cR = <a2, ((y, y^2, ...) o b1)> * y^n -- scalar
|
||||
scalar_t cR = 0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
cR += a[n + i] * y_powers[i + 1] * b[i];
|
||||
cR *= y_powers[n];
|
||||
|
||||
DBG_VAL_PRINT(cR);
|
||||
|
||||
// L = y^-n * a1 * g2 + b2 * h1 + cL * G + dL * H + dL2 * H2 -- point
|
||||
point_t sum = c_point_0;
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
sum += a[i] * g[n + i];
|
||||
point_t L;
|
||||
CT::calc_pedersen_commitment_2(cL, dL, dL2, L);
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
L += b[n + i] * h[i];
|
||||
L += y_inverse_powers[n] * sum;
|
||||
L *= c_scalar_1div8;
|
||||
DBG_VAL_PRINT(L);
|
||||
|
||||
// R = y^n * a2 * g1 + b1 * h2 + cR * G + dR * H + dR2 * H2 -- point
|
||||
sum.zero();
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
sum += a[n + i] * g[i];
|
||||
point_t R;
|
||||
CT::calc_pedersen_commitment_2(cR, dR, dR2, R);
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
R += b[i] * h[n + i];
|
||||
R += y_powers[n] * sum;
|
||||
R *= c_scalar_1div8;
|
||||
DBG_VAL_PRINT(R);
|
||||
|
||||
// put L, R to the sig
|
||||
L.to_public_key(sig.L[ni]);
|
||||
R.to_public_key(sig.R[ni]);
|
||||
|
||||
// update the transcript
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.L[ni]);
|
||||
hsc.add_pub_key(sig.R[ni]);
|
||||
e = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(e);
|
||||
|
||||
// recalculate arguments for the next round
|
||||
scalar_t e_squared = e * e;
|
||||
scalar_t e_inverse = e.reciprocal();
|
||||
scalar_t e_inverse_squared = e_inverse * e_inverse;
|
||||
scalar_t e_y_inv_n = e * y_inverse_powers[n];
|
||||
scalar_t e_inv_y_n = e_inverse * y_powers[n];
|
||||
|
||||
// g_hat = e^-1 * g1 + (e * y^-n) * g2 -- vector of points
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
g[i] = e_inverse * g[i] + e_y_inv_n * g[n + i];
|
||||
|
||||
// h_hat = e * h1 + e^-1 * h2 -- vector of points
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
h[i] = e * h[i] + e_inverse * h[n + i];
|
||||
|
||||
// P_hat = e^2 * L + P + e^-2 * R -- point
|
||||
|
||||
// a_hat = e * a1 + e^-1 * y^n * a2 -- vector of scalars
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
a[i] = e * a[i] + e_inv_y_n * a[n + i];
|
||||
|
||||
// b_hat = e^-1 * b1 + e * b2 -- vector of scalars
|
||||
for (size_t i = 0; i < n; ++i)
|
||||
b[i] = e_inverse * b[i] + e * b[n + i];
|
||||
|
||||
// alpha_hat_1 = e^2 * dL + alpha_1 + e^-2 * dR -- scalar
|
||||
// alpha_hat_2 = e^2 * dL2 + alpha_2 + e^-2 * dR2 -- scalar
|
||||
alpha_hat_1 += e_squared * dL + e_inverse_squared * dR;
|
||||
alpha_hat_2 += e_squared * dL2 + e_inverse_squared * dR2;
|
||||
|
||||
// run next iteraton zk-WIP(g_hat, h_hat, G, H, H2, P_hat, a_hat, b_hat, alpha_hat_1, alpha_hat_2)
|
||||
}
|
||||
DBG_PRINT("");
|
||||
|
||||
// zk-WIP last round
|
||||
scalar_t r = scalar_t::random();
|
||||
scalar_t s = scalar_t::random();
|
||||
scalar_t delta_1 = scalar_t::random(), delta_2 = scalar_t::random();
|
||||
scalar_t eta_1 = scalar_t::random(), eta_2 = scalar_t::random();
|
||||
DBG_VAL_PRINT(r);
|
||||
DBG_VAL_PRINT(s);
|
||||
DBG_VAL_PRINT(delta_1); DBG_VAL_PRINT(delta_2);
|
||||
DBG_VAL_PRINT(eta_1); DBG_VAL_PRINT(eta_2);
|
||||
|
||||
// A = r * g + s * h + (r y b + s y a) * G + delta_1 * H + delta_2 * H2 -- point
|
||||
point_t A = c_point_0;
|
||||
CT::calc_pedersen_commitment_2(y * (r * b[0] + s * a[0]), delta_1, delta_2, A);
|
||||
A += r * g[0] + s * h[0];
|
||||
A *= c_scalar_1div8;
|
||||
A.to_public_key(sig.A);
|
||||
DBG_VAL_PRINT(A);
|
||||
|
||||
// B = (r * y * s) * G + eta_1 * H + eta_2 * H2
|
||||
point_t B = c_point_0;
|
||||
CT::calc_pedersen_commitment_2(r * y * s, eta_1, eta_2, B);
|
||||
B *= c_scalar_1div8;
|
||||
B.to_public_key(sig.B);
|
||||
DBG_VAL_PRINT(B);
|
||||
|
||||
// update the transcript
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A);
|
||||
hsc.add_pub_key(sig.B);
|
||||
e = hsc.calc_hash();
|
||||
DBG_VAL_PRINT(e);
|
||||
|
||||
// finalize the signature
|
||||
sig.r = r + e * a[0];
|
||||
sig.s = s + e * b[0];
|
||||
sig.delta_1 = eta_1 + e * delta_1 + e * e * alpha_hat_1;
|
||||
sig.delta_2 = eta_2 + e * delta_2 + e * e * alpha_hat_2;
|
||||
DBG_VAL_PRINT(sig.r);
|
||||
DBG_VAL_PRINT(sig.s);
|
||||
DBG_VAL_PRINT(sig.delta_1);
|
||||
DBG_VAL_PRINT(sig.delta_2);
|
||||
|
||||
return true;
|
||||
} // bppe_gen()
|
||||
|
||||
|
||||
// convenient overload for tests
|
||||
template<typename CT>
|
||||
bool bppe_gen(const scalar_vec_t& values, const scalar_vec_t& masks, const scalar_vec_t& masks2, bppe_signature& sig, std::vector<point_t>& commitments_1div8_to_be_generated, uint8_t* p_err = nullptr)
|
||||
{
|
||||
// calc commitments vector as commitments[i] = 1/8 * values[i] * G + 1/8 * masks[i] * H + 1/8 * masks2[i] * H2
|
||||
commitments_1div8_to_be_generated.resize(values.size());
|
||||
std::vector<crypto::public_key> commitments_1div8(values.size());
|
||||
std::vector<const crypto::public_key*> commitments_1div8_pointers(values.size());
|
||||
for (size_t i = 0; i < values.size(); ++i)
|
||||
{
|
||||
CT::calc_pedersen_commitment_2(values[i] * c_scalar_1div8, masks[i] * c_scalar_1div8, masks2[i] * c_scalar_1div8, commitments_1div8_to_be_generated[i]);
|
||||
commitments_1div8[i] = (commitments_1div8_to_be_generated[i]).to_public_key();
|
||||
commitments_1div8_pointers[i] = &commitments_1div8[i];
|
||||
}
|
||||
return bppe_gen<CT>(values, masks, masks2, commitments_1div8_pointers, sig, p_err);
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
struct bppe_sig_commit_ref_t
|
||||
{
|
||||
bppe_sig_commit_ref_t(const bppe_signature& sig, const std::vector<point_t>& commitments)
|
||||
: sig(sig)
|
||||
, commitments(commitments)
|
||||
{}
|
||||
const bppe_signature& sig;
|
||||
const std::vector<point_t>& commitments; // assumed to be premultiplied by 1/8
|
||||
};
|
||||
|
||||
|
||||
template<typename CT>
|
||||
bool bppe_verify(const std::vector<bppe_sig_commit_ref_t>& sigs, uint8_t* p_err = nullptr)
|
||||
{
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("bppe_verify: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
DBG_PRINT(ENDL << " . . . . bppe_verify() . . . . ");
|
||||
|
||||
static_assert(CT::c_bpp_n <= 255, "too big N");
|
||||
const size_t kn = sigs.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(kn > 0, 1);
|
||||
|
||||
struct intermediate_element_t
|
||||
{
|
||||
scalar_t y;
|
||||
scalar_t z;
|
||||
scalar_t z_sq;
|
||||
scalar_vec_t e;
|
||||
scalar_vec_t e_sq;
|
||||
scalar_t e_final;
|
||||
scalar_t e_final_sq;
|
||||
size_t inv_e_offset; // offset in batch_for_inverse
|
||||
size_t inv_y_offset; // offset in batch_for_inverse
|
||||
size_t c_bpp_log2_m;
|
||||
size_t c_bpp_m;
|
||||
size_t c_bpp_mn;
|
||||
point_t A;
|
||||
point_t A0;
|
||||
point_t B;
|
||||
std::vector<point_t> L;
|
||||
std::vector<point_t> R;
|
||||
};
|
||||
std::vector<intermediate_element_t> interms(kn);
|
||||
|
||||
size_t c_bpp_log2_m_max = 0;
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
const bppe_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bppe_signature& sig = bsc.sig;
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(bsc.commitments.size() > 0, 2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.L.size() > 0 && sig.L.size() == sig.R.size(), 3);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.r.is_reduced() && sig.s.is_reduced() && sig.delta_1.is_reduced() && sig.delta_2.is_reduced(), 4);
|
||||
|
||||
intermediate_element_t& interm = interms[k];
|
||||
interm.c_bpp_log2_m = constexpr_ceil_log2(bsc.commitments.size());
|
||||
if (c_bpp_log2_m_max < interm.c_bpp_log2_m)
|
||||
c_bpp_log2_m_max = interm.c_bpp_log2_m;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.L.size() == interm.c_bpp_log2_m + CT::c_bpp_log2_n, 5);
|
||||
|
||||
interm.c_bpp_m = 1ull << interm.c_bpp_log2_m;
|
||||
interm.c_bpp_mn = interm.c_bpp_m * CT::c_bpp_n;
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.A0.from_public_key(sig.A0), 6);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.A.from_public_key(sig.A), 7);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.B.from_public_key(sig.B), 8);
|
||||
interm.L.resize(sig.L.size());
|
||||
interm.R.resize(sig.R.size());
|
||||
for (size_t i = 0; i < interm.L.size(); ++i)
|
||||
{
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.L[i].from_public_key(sig.L[i]), 9);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(interm.R[i].from_public_key(sig.R[i]), 10);
|
||||
}
|
||||
}
|
||||
const size_t c_bpp_m_max = 1ull << c_bpp_log2_m_max;
|
||||
const size_t c_bpp_mn_max = c_bpp_m_max * CT::c_bpp_n;
|
||||
const size_t c_bpp_LR_size_max = c_bpp_log2_m_max + CT::c_bpp_log2_n;
|
||||
|
||||
|
||||
//
|
||||
// prepare stuff
|
||||
//
|
||||
/*
|
||||
std::vector<point_t> g(c_bpp_mn_max), h(c_bpp_mn_max);
|
||||
for (size_t i = 0; i < c_bpp_mn_max; ++i)
|
||||
{
|
||||
g[i] = CT::get_generator(false, i);
|
||||
h[i] = CT::get_generator(true, i);
|
||||
}
|
||||
*/
|
||||
|
||||
scalar_vec_t batch_for_inverse;
|
||||
batch_for_inverse.reserve(kn + kn * c_bpp_LR_size_max);
|
||||
|
||||
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
DBG_PRINT(ENDL << "SIG #" << k);
|
||||
const bppe_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bppe_signature& sig = bsc.sig;
|
||||
intermediate_element_t& interm = interms[k];
|
||||
|
||||
// restore y and z
|
||||
// using e as Fiat-Shamir transcript
|
||||
scalar_t e = CT::get_initial_transcript();
|
||||
DBG_PRINT("initial transcript: " << e);
|
||||
hash_helper_t::hs_t hsc;
|
||||
CT::update_transcript(hsc, e, bsc.commitments);
|
||||
// calculate scalar challenges y and z
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A0);
|
||||
hsc.assign_calc_hash(interm.y);
|
||||
interm.z = hash_helper_t::hs(interm.y);
|
||||
interm.z_sq = interm.z * interm.z;
|
||||
DBG_VAL_PRINT(interm.y);
|
||||
DBG_VAL_PRINT(interm.z);
|
||||
e = interm.z; // transcript for further steps
|
||||
|
||||
interm.inv_y_offset = batch_for_inverse.size();
|
||||
batch_for_inverse.push_back(interm.y);
|
||||
interm.inv_e_offset = batch_for_inverse.size();
|
||||
|
||||
interm.e.resize(sig.L.size());
|
||||
interm.e_sq.resize(sig.L.size());
|
||||
|
||||
for (size_t i = 0; i < sig.L.size(); ++i)
|
||||
{
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.L[i]);
|
||||
hsc.add_pub_key(sig.R[i]);
|
||||
hsc.assign_calc_hash(e);
|
||||
interm.e[i] = e;
|
||||
interm.e_sq[i] = e * e;
|
||||
DBG_PRINT("e[" << i << "]: " << e);
|
||||
batch_for_inverse.push_back(e);
|
||||
}
|
||||
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_pub_key(sig.A);
|
||||
hsc.add_pub_key(sig.B);
|
||||
hsc.assign_calc_hash(interm.e_final);
|
||||
interm.e_final_sq = interm.e_final * interm.e_final;
|
||||
DBG_VAL_PRINT(interm.e_final);
|
||||
}
|
||||
|
||||
batch_for_inverse.invert();
|
||||
|
||||
// Notation:
|
||||
// 1_vec ^ n = (1, 1, 1, ..., 1)
|
||||
// 2_vec ^ n = (2^0, 2^1, 2^2, ..., 2^(n-1))
|
||||
// -1_vec ^ n = ((-1)^0, (-1)^1, (-1)^2, ... (-1)^(n-1)) = (1, -1, 1, -1, ...)
|
||||
// y<^n = (y^n, y^(n-1), ..., y^1)
|
||||
// y>^n = (y^1, y^2, ..., y^n)
|
||||
|
||||
// from Zarcanum page 24, Fig D.1:
|
||||
// Verifier outputs Accept IFF the following holds:
|
||||
// P^e^2 * A^e * B == g ^ (r' e) * h ^ (s' e) * G ^ (r' y s') * H ^ delta'_1 * H2 ^ delta'_2
|
||||
// (where g and h are calculated in each round)
|
||||
// The same equation in additive notation:
|
||||
// e^2 * P + e * A + B == (r' * e) * g + (s' * e) * h + (r' y s') * G + delta'_1 * H + delta'_2 * H2
|
||||
// <=>
|
||||
// (r' * e) * g + (s' * e) * h + (r' y s') * G + delta'_1 * H + delta'_2 * H2 - e^2 * P - e * A - B == 0 (*)
|
||||
// where A, B, r', s', delta'_1, delta'_2 is taken from the signature
|
||||
// and P_{k+1} = e^2 * L_k + P_k + e^-2 * R_k for all rounds
|
||||
//
|
||||
// from Zarcanum preprint page 33, Fig D.3:
|
||||
// P and V computes:
|
||||
// A_hat = A0 + (- 1^(mn) * z) * g + (d o y<^(mn) + 1^(mn) * z) * h +
|
||||
// + y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j) +
|
||||
// + (z*SUM(y^>mn) - z*y^(mn+1)*SUM(d) - z^2 * SUM(y^>mn)) * G
|
||||
// (calculated once)
|
||||
//
|
||||
// As suggested in BPP preprint Section 6.1 "Practical Optimizations":
|
||||
// 1) g and h exponentianions can be optimized in order not to be calculated at each round
|
||||
// as the following (page 20, with delta'_2 and H2 added):
|
||||
//
|
||||
// (r' * e * s_vec) * g + (s' * e * s'_vec) * h + (r' y s') * G + delta'_1 * H + delta'_2 * H2 -
|
||||
// - e^2 * A_hat
|
||||
// - SUM{j=1..log(n)}(e_final^2 * e_j^2 * L_j + e_final^2 * e_j^-2 * R_j)
|
||||
// - e * A - B = 0 (**)
|
||||
//
|
||||
// where:
|
||||
// g, h - vector of fixed generators
|
||||
// s_vec_i = y^(1-i) * PROD{j=1..log(n)}(e_j ^ b(i,j))
|
||||
// s'_vec_i = PROD{j=1..log(n)}(e_j ^ -b(i,j))
|
||||
// b(i, j) = { 2 * ((1<<(j-1)) & (i-1)) - 1) (counting both from 1) (page 20)
|
||||
// b(i, j) = { 2 * ((1<<j) & i) - 1) (counting both from 0)
|
||||
//
|
||||
// 2) we gonna aggregate all (**) for each round by multiplying them to a random weights and then sum up
|
||||
// insert A_hat into (**) =>
|
||||
|
||||
// (r' * e * s_vec) * g + (s' * e * s'_vec) * h + (r' y s') * G + delta'_1 * H + delta'_2 * H2 -
|
||||
// - e^2 * (A0 + (- 1^(mn) * z) * g + (d o y<^(mn) + 1^(mn) * z) * h +
|
||||
// + y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j) +
|
||||
// + (z*SUM(y^>mn) - z*y^(mn+1)*SUM(d) - z^2 * SUM(y^>mn)) * G
|
||||
// )
|
||||
// - SUM{j=1..log(n)}(e_final^2 * e_j^2 * L_j + e_final^2 * e_j^-2 * R_j)
|
||||
// - e * A - B = 0
|
||||
|
||||
// =>
|
||||
|
||||
// (for single signature)
|
||||
//
|
||||
// (r' * e * s_vec - e^2 * (- 1_vec^(mn) * z)) * g | these are
|
||||
// + (s' * e * s'_vec - e^2 * (d o y<^(mn) + 1_vec^(mn) * z)) * h | fixed generators
|
||||
// + (r' y s' - e^2 * ((z - z^2)*SUM(y^>mn) - z*y^(mn+1)*SUM(d)) * G | across all
|
||||
// + delta'_1 * H | the signatures
|
||||
// + delta'_2 * H2 | the signatures
|
||||
//
|
||||
// - e^2 * A0
|
||||
// - e^2 * y^(mn+1) * (SUM{j=1..m} z^(2j) * V_j))
|
||||
// - e^2 * SUM{j=1..log(n)}(e_j^2 * L_j + e_j^-2 * R_j)
|
||||
// - e * A - B = 0 (***)
|
||||
//
|
||||
// All (***) will be muptiplied by random weightning factor and then summed up.
|
||||
|
||||
// Calculate cummulative sclalar multiplicand for fixed generators across all the sigs.
|
||||
scalar_vec_t g_scalars;
|
||||
g_scalars.resize(c_bpp_mn_max, 0);
|
||||
scalar_vec_t h_scalars;
|
||||
h_scalars.resize(c_bpp_mn_max, 0);
|
||||
scalar_t G_scalar = 0;
|
||||
scalar_t H_scalar = 0;
|
||||
scalar_t H2_scalar = 0;
|
||||
point_t summand = c_point_0;
|
||||
|
||||
for (size_t k = 0; k < kn; ++k)
|
||||
{
|
||||
DBG_PRINT(ENDL << "SIG #" << k);
|
||||
const bppe_sig_commit_ref_t& bsc = sigs[k];
|
||||
const bppe_signature& sig = bsc.sig;
|
||||
intermediate_element_t& interm = interms[k];
|
||||
|
||||
// random weightning factor for speed-optimized batch verification (preprint page 20)
|
||||
const scalar_t rwf = scalar_t::random();
|
||||
DBG_PRINT("rwf: " << rwf);
|
||||
|
||||
// prepare d vector (see also d structure description in proof function)
|
||||
scalar_mat_t<CT::c_bpp_n> d(interm.c_bpp_mn);
|
||||
d(0, 0) = interm.z_sq;
|
||||
// first row
|
||||
for (size_t i = 1; i < interm.c_bpp_m; ++i)
|
||||
d(i, 0) = d(i - 1, 0) * interm.z_sq;
|
||||
// all rows
|
||||
for (size_t j = 1; j < CT::c_bpp_n; ++j)
|
||||
for (size_t i = 0; i < interm.c_bpp_m; ++i)
|
||||
d(i, j) = d(i, j - 1) + d(i, j - 1);
|
||||
// sum(d) (see also note in proof function for this)
|
||||
const scalar_t sum_d = CT::get_2_to_the_power_of_N_minus_1() * sum_of_powers(interm.z_sq, interm.c_bpp_log2_m);
|
||||
|
||||
DBG_PRINT("Hs(d): " << d.calc_hs());
|
||||
DBG_PRINT("sum(d): " << sum_d);
|
||||
|
||||
const scalar_t& y_inv = batch_for_inverse[interm.inv_y_offset];
|
||||
auto get_e_inv = [&](size_t i) { return batch_for_inverse[interm.inv_e_offset + i]; }; // i belongs to [0; L.size()-1]
|
||||
|
||||
// prepare s_vec (unlike the paper here we moved y-component out of s_vec for convenience, so s_vec'[x] = s_vec[~x & (MN-1)])
|
||||
// complexity (sc_mul's): MN+2*log2(MN)-2
|
||||
// the idea is the following:
|
||||
// s_vec[00000b] = ... * (e_4)^-1 * (e_3)^-1 * (e_2)^-1 * (e_1)^-1 * (e_0)^-1
|
||||
// s_vec[00101b] = ... * (e_4)^-1 * (e_3)^-1 * (e_2)^+1 * (e_1)^-1 * (e_0)^+1
|
||||
const size_t log2_mn = sig.L.size(); // at the beginning we made sure that sig.L.size() == c_bpp_log2_m + c_bpp_log2_n
|
||||
scalar_vec_t s_vec(interm.c_bpp_mn);
|
||||
s_vec[0] = get_e_inv(0);
|
||||
for (size_t i = 1; i < log2_mn; ++i)
|
||||
s_vec[0] *= get_e_inv(i); // s_vec[0] = (e_0)^-1 * (e_1)^-1 * .. (e_{log2_mn-1})^-1
|
||||
DBG_PRINT("[0] " << s_vec[0]);
|
||||
for (size_t i = 1; i < interm.c_bpp_mn; ++i)
|
||||
{
|
||||
size_t base_el_index = i & (i - 1); // base element index: 0, 0, 2, 0, 4, 4, 6, 0, 8, 8, 10... base element differs in one bit (0) from the current one (1)
|
||||
size_t bit_index = log2_mn - calc_lsb_32((uint32_t)i) - 1; // the bit index where current element has the difference with the base
|
||||
s_vec[i] = s_vec[base_el_index] * interm.e_sq[bit_index]; // (e_j)^-1 * (e_j)^2 = (e_j)^+1
|
||||
DBG_PRINT("[" << i << "] " << " " << base_el_index << ", " << bit_index << " : " << s_vec[i]);
|
||||
}
|
||||
|
||||
// prepare y_inv vector
|
||||
scalar_vec_t y_inverse_powers(interm.c_bpp_mn);
|
||||
y_inverse_powers[0] = 1;
|
||||
for (size_t i = 1; i < interm.c_bpp_mn; ++i)
|
||||
y_inverse_powers[i] = y_inverse_powers[i - 1] * y_inv;
|
||||
|
||||
// y^(mn+1)
|
||||
scalar_t y_power_mnp1 = interm.y;
|
||||
for (size_t i = 0; i < log2_mn; ++i)
|
||||
y_power_mnp1 *= y_power_mnp1;
|
||||
y_power_mnp1 *= interm.y;
|
||||
DBG_VAL_PRINT(y_power_mnp1);
|
||||
|
||||
// now calculate all multiplicands for common generators
|
||||
|
||||
// g vector multiplicands:
|
||||
// rwf * (r' * e * (1, y^-1, y^-2, ...) o s_vec + e^2 * z) =
|
||||
// rwf * r' * e * ((1, y^-1, ...) o s_vec) + rwf * e^2 * z * (1, 1, ...)
|
||||
scalar_t rwf_e_sq_z = rwf * interm.e_final_sq * interm.z;
|
||||
scalar_t rwf_r_e = rwf * interm.e_final * sig.r;
|
||||
for (size_t i = 0; i < interm.c_bpp_mn; ++i)
|
||||
g_scalars[i] += rwf_r_e * y_inverse_powers[i] * s_vec[i] + rwf_e_sq_z;
|
||||
|
||||
DBG_PRINT("Hs(g_scalars): " << g_scalars.calc_hs());
|
||||
|
||||
// h vector multiplicands:
|
||||
// rwf * (s' * e * s'_vec - e^2 * (d o y<^(mn) + 1_vec^(mn) * z))
|
||||
// rwf * s' * e * s'_vec - rwf * e^2 * z * (1, 1...) - rwf * e^2 * (d o y<^(mn))
|
||||
//scalar_t rwf_e_sq_z = rwf * interm.e_final_sq * interm.z;
|
||||
scalar_t rwf_s_e = rwf * sig.s * interm.e_final;
|
||||
scalar_t rwf_e_sq_y = rwf * interm.e_final_sq * interm.y;
|
||||
for (size_t i = interm.c_bpp_mn - 1; i != SIZE_MAX; --i)
|
||||
{
|
||||
h_scalars[i] += rwf_s_e * s_vec[interm.c_bpp_mn - 1 - i] - rwf_e_sq_z - rwf_e_sq_y * d[i];
|
||||
rwf_e_sq_y *= interm.y;
|
||||
}
|
||||
|
||||
DBG_PRINT("Hs(h_scalars): " << h_scalars.calc_hs());
|
||||
|
||||
// G point multiplicands:
|
||||
// rwf * (r' y s' - e ^ 2 * ((z - z ^ 2)*SUM(y^>mn) - z * y^(mn+1) * SUM(d)) =
|
||||
// = rwf * r' y s' - rwf * e^2 * (z - z ^ 2)*SUM(y^>mn) + rwf * e^2 * z * y^(mn+1) * SUM(d)
|
||||
G_scalar += rwf * sig.r * interm.y * sig.s + rwf_e_sq_y * sum_d * interm.z;
|
||||
G_scalar -= rwf * interm.e_final_sq * (interm.z - interm.z_sq) * sum_of_powers(interm.y, log2_mn);
|
||||
DBG_PRINT("sum_y: " << sum_of_powers(interm.y, log2_mn));
|
||||
DBG_PRINT("G_scalar: " << G_scalar);
|
||||
|
||||
// H point multiplicands:
|
||||
// rwf * delta_1
|
||||
H_scalar += rwf * sig.delta_1;
|
||||
DBG_PRINT("H_scalar: " << H_scalar);
|
||||
|
||||
// H2 point multiplicands:
|
||||
// rwf * delta_2
|
||||
H2_scalar += rwf * sig.delta_2;
|
||||
DBG_PRINT("H2_scalar: " << H2_scalar);
|
||||
|
||||
// uncommon generators' multiplicands
|
||||
point_t summand_8 = c_point_0; // this summand to be multiplied by 8 before adding to the main summand
|
||||
// - rwf * e^2 * A0
|
||||
summand_8 -= rwf * interm.e_final_sq * interm.A0;
|
||||
DBG_PRINT("A0_scalar: " << c_scalar_Lm1 * interm.e_final_sq * rwf);
|
||||
|
||||
// - rwf * e^2 * y^(mn+1) * (SUM{j=1..m} (z^2)^j * V_j))
|
||||
scalar_t e_sq_y_mn1_z_sq_power = rwf * interm.e_final_sq * y_power_mnp1;
|
||||
for (size_t j = 0; j < bsc.commitments.size(); ++j)
|
||||
{
|
||||
e_sq_y_mn1_z_sq_power *= interm.z_sq;
|
||||
summand_8 -= e_sq_y_mn1_z_sq_power * bsc.commitments[j];
|
||||
DBG_PRINT("V_scalar[" << j << "]: " << c_scalar_Lm1 * e_sq_y_mn1_z_sq_power);
|
||||
}
|
||||
|
||||
// - rwf * e^2 * SUM{j=1..log(n)}(e_j^2 * L_j + e_j^-2 * R_j)
|
||||
scalar_t rwf_e_sq = rwf * interm.e_final_sq;
|
||||
for (size_t j = 0; j < log2_mn; ++j)
|
||||
{
|
||||
summand_8 -= rwf_e_sq * (interm.e_sq[j] * interm.L[j] + get_e_inv(j) * get_e_inv(j) * interm.R[j]);
|
||||
DBG_PRINT("L_scalar[" << j << "]: " << c_scalar_Lm1 * rwf_e_sq * interm.e_sq[j]);
|
||||
DBG_PRINT("R_scalar[" << j << "]: " << c_scalar_Lm1 * rwf_e_sq * get_e_inv(j) * get_e_inv(j));
|
||||
}
|
||||
|
||||
// - rwf * e * A - rwf * B = 0
|
||||
summand_8 -= rwf * interm.e_final * interm.A + rwf * interm.B;
|
||||
DBG_PRINT("A_scalar: " << c_scalar_Lm1 * rwf * interm.e_final);
|
||||
DBG_PRINT("B_scalar: " << c_scalar_Lm1 * rwf);
|
||||
|
||||
summand_8.modify_mul8();
|
||||
summand += summand_8;
|
||||
}
|
||||
|
||||
point_t GH_exponents = c_point_0;
|
||||
CT::calc_pedersen_commitment_2(G_scalar, H_scalar, H2_scalar, GH_exponents);
|
||||
bool result = msm_and_check_zero<CT>(g_scalars, h_scalars, summand + GH_exponents);
|
||||
if (result)
|
||||
DBG_PRINT(ENDL << " . . . . bppe_verify() -- SUCCEEDED!!!" << ENDL);
|
||||
return result;
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
}
|
||||
|
||||
#undef DBG_VAL_PRINT
|
||||
#undef DBG_PRINT
|
||||
|
||||
} // namespace crypto
|
||||
29
crypto/upstream/range_proofs.cpp
Executable file
29
crypto/upstream/range_proofs.cpp
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "range_proofs.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
// TODO @#@# redesign needed, consider changing to inline constexpr
|
||||
const point_t& bpp_ct_generators_HGX::bpp_G = c_point_H;
|
||||
const point_t& bpp_ct_generators_HGX::bpp_H = c_point_G;
|
||||
const point_t& bpp_ct_generators_HGX::bpp_H2 = c_point_X;
|
||||
|
||||
const point_t& bpp_ct_generators_UGX::bpp_G = c_point_U;
|
||||
const point_t& bpp_ct_generators_UGX::bpp_H = c_point_G;
|
||||
const point_t& bpp_ct_generators_UGX::bpp_H2 = c_point_X;
|
||||
}
|
||||
159
crypto/upstream/range_proofs.h
Executable file
159
crypto/upstream/range_proofs.h
Executable file
|
|
@ -0,0 +1,159 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
|
||||
#include "epee/include/misc_log_ex.h"
|
||||
#include "crypto-sugar.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
|
||||
// returns x + x^2 + x^3 + ... + x^(2^f)
|
||||
// == x * (x + 1) * (x^2 + 1) * (x^4 + 1) * ...(x^(f+1) + 1)
|
||||
inline scalar_t sum_of_powers(scalar_t x, size_t f)
|
||||
{
|
||||
scalar_t result = x;
|
||||
for (size_t i = 0; i < f; ++i)
|
||||
{
|
||||
result.assign_muladd(result, x, result);
|
||||
x *= x;
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
// returns least significant bit uing de Bruijn sequence
|
||||
// http://graphics.stanford.edu/~seander/bithacks.html
|
||||
inline uint8_t calc_lsb_32(uint32_t v)
|
||||
{
|
||||
static const uint8_t multiply_de_bruijn_bit_position[32] =
|
||||
{
|
||||
0, 1, 28, 2, 29, 14, 24, 3, 30, 22, 20, 15, 25, 17, 4, 8,
|
||||
31, 27, 13, 23, 21, 19, 16, 7, 26, 12, 18, 6, 11, 5, 10, 9
|
||||
};
|
||||
return multiply_de_bruijn_bit_position[((uint32_t)((v & -(int32_t)v) * 0x077CB531U)) >> 27];
|
||||
}
|
||||
|
||||
|
||||
////////////////////////////////////////
|
||||
// crypto trait for Zano
|
||||
////////////////////////////////////////
|
||||
struct bpp_ct_generators_HGX
|
||||
{
|
||||
// NOTE! This notation follows the original BP+ whitepaper, see mapping to Zano's generators in range_proofs.cpp
|
||||
static const point_t& bpp_G;
|
||||
static const point_t& bpp_H;
|
||||
static const point_t& bpp_H2;
|
||||
};
|
||||
|
||||
struct bpp_ct_generators_UGX
|
||||
{
|
||||
// NOTE! This notation follows the original BP+ whitepaper, see mapping to Zano's generators in range_proofs.cpp
|
||||
static const point_t& bpp_G;
|
||||
static const point_t& bpp_H;
|
||||
static const point_t& bpp_H2;
|
||||
};
|
||||
|
||||
|
||||
template<typename gen_trait_t, size_t N = 64, size_t values_max = 32>
|
||||
struct bpp_crypto_trait_zano : gen_trait_t
|
||||
{
|
||||
static constexpr size_t c_bpp_n = N; // the upper bound for the witness's range
|
||||
static constexpr size_t c_bpp_values_max = values_max; // maximum number of elements in BP+ proof, i.e. max allowed BP+ outputs
|
||||
static constexpr size_t c_bpp_log2_n = constexpr_ceil_log2(c_bpp_n);
|
||||
static constexpr size_t c_bpp_mn_max = c_bpp_n * c_bpp_values_max;
|
||||
|
||||
static void calc_pedersen_commitment(const scalar_t& value, const scalar_t& mask, point_t& commitment)
|
||||
{
|
||||
// commitment = value * bpp_G + mask * bpp_H
|
||||
commitment = operator*(value, bpp_G) + mask * bpp_H;
|
||||
}
|
||||
|
||||
static void calc_pedersen_commitment_2(const scalar_t& value, const scalar_t& mask1, const scalar_t& mask2, point_t& commitment)
|
||||
{
|
||||
// commitment = value * bpp_G + mask1 * bpp_H * mask2 * bpp_H2
|
||||
commitment = operator*(value, bpp_G) + mask1 * bpp_H + mask2 * bpp_H2;
|
||||
}
|
||||
|
||||
static const scalar_t& get_initial_transcript()
|
||||
{
|
||||
static scalar_t value = hash_helper_t::hs("Lethean BP+ initial transcript");
|
||||
return value;
|
||||
}
|
||||
|
||||
// assumes hsc is cleared
|
||||
static void update_transcript(hash_helper_t::hs_t& hsc, scalar_t& e, const std::vector<point_t>& points)
|
||||
{
|
||||
hsc.add_scalar(e);
|
||||
hsc.add_points_array(points);
|
||||
e = hsc.calc_hash();
|
||||
}
|
||||
|
||||
// assumes hsc is cleared
|
||||
static void update_transcript(hash_helper_t::hs_t& hsc, scalar_t& e, const std::vector<const public_key*>& pub_keys)
|
||||
{
|
||||
hsc.add_scalar(e);
|
||||
for(auto p : pub_keys)
|
||||
hsc.add_pub_key(*p);
|
||||
e = hsc.calc_hash();
|
||||
}
|
||||
|
||||
// TODO: refactor with proper OOB handling
|
||||
static const point_t& get_generator(bool select_H, size_t index)
|
||||
{
|
||||
if (index >= c_bpp_mn_max)
|
||||
return c_point_0; // out of bound
|
||||
|
||||
static std::vector<point_t> generators(2 * c_bpp_mn_max);
|
||||
static bool calculated = false;
|
||||
if (!calculated)
|
||||
{
|
||||
scalar_t hash_buf[2] = { hash_helper_t::hs("Lethean BP+ generator"), 0 };
|
||||
for (size_t i = 0; i < 2 * c_bpp_mn_max; ++i)
|
||||
{
|
||||
hash_buf[1].m_u64[0] = i;
|
||||
ge_bytes_hash_to_ec(&generators[i].m_p3, &hash_buf, sizeof hash_buf);
|
||||
}
|
||||
calculated = true;
|
||||
}
|
||||
|
||||
return generators[2 * index + (select_H ? 1 : 0)];
|
||||
}
|
||||
|
||||
static const scalar_t& get_2_to_the_power_of_N_minus_1()
|
||||
{
|
||||
static scalar_t result = scalar_t::power_of_2(c_bpp_n) - 1;
|
||||
return result;
|
||||
}
|
||||
|
||||
using gen_trait_t::bpp_G;
|
||||
using gen_trait_t::bpp_H;
|
||||
using gen_trait_t::bpp_H2;
|
||||
}; // struct bpp_crypto_trait_zano
|
||||
|
||||
|
||||
typedef bpp_crypto_trait_zano<bpp_ct_generators_UGX, 64, 32> bpp_crypto_trait_ZC_out;
|
||||
|
||||
typedef bpp_crypto_trait_zano<bpp_ct_generators_HGX, 128, 16> bpp_crypto_trait_Zarcanum;
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
|
||||
#include "epee/include/profile_tools.h" // <- remove this, sowle
|
||||
|
||||
#include "msm.h"
|
||||
#include "range_proof_bpp.h"
|
||||
#include "range_proof_bppe.h"
|
||||
435
crypto/upstream/zarcanum.cpp
Executable file
435
crypto/upstream/zarcanum.cpp
Executable file
|
|
@ -0,0 +1,435 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#include "epee/include/misc_log_ex.h"
|
||||
#include "zarcanum.h"
|
||||
#include "range_proofs.h"
|
||||
#include "../currency_core/crypto_config.h" // TODO: move it to the crypto
|
||||
#include "../common/crypto_stream_operators.h" // TODO: move it to the crypto
|
||||
|
||||
#if 0
|
||||
# define DBG_VAL_PRINT(x) std::cout << std::setw(30) << std::left << #x ": " << x << std::endl
|
||||
# define DBG_PRINT(x) std::cout << x << std::endl
|
||||
#else
|
||||
# define DBG_VAL_PRINT(x) (void(0))
|
||||
# define DBG_PRINT(x) (void(0))
|
||||
#endif
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
const scalar_t c_zarcanum_z_coeff_s = { 0, 1, 0, 0 }; // c_scalar_2p64
|
||||
const mp::uint256_t c_zarcanum_z_coeff_mp = c_zarcanum_z_coeff_s.as_boost_mp_type<mp::uint256_t>();
|
||||
|
||||
template<typename T>
|
||||
inline std::ostream &operator <<(std::ostream &o, const std::vector<T> &v)
|
||||
{
|
||||
for(size_t i = 0, n = v.size(); i < n; ++i)
|
||||
o << ENDL << " [" << std::setw(2) << i << "]: " << v[i];
|
||||
return o;
|
||||
}
|
||||
|
||||
mp::uint256_t zarcanum_precalculate_l_div_z_D(const mp::uint128_t& pos_difficulty)
|
||||
{
|
||||
//LOG_PRINT_GREEN_L0(ENDL << "floor( l / (z * D) ) = " << c_scalar_L.as_boost_mp_type<mp::uint256_t>() / (c_zarcanum_z_coeff_mp * pos_difficulty));
|
||||
return c_scalar_L.as_boost_mp_type<mp::uint256_t>() / (c_zarcanum_z_coeff_mp * pos_difficulty); // == floor( l / (z * D) )
|
||||
}
|
||||
|
||||
mp::uint256_t zarcanum_precalculate_z_l_div_z_D(const mp::uint128_t& pos_difficulty)
|
||||
{
|
||||
//LOG_PRINT_GREEN_L0(ENDL << "z * floor( l / (z * D) ) = " << c_zarcanum_z_coeff_mp * (c_scalar_L.as_boost_mp_type<mp::uint256_t>() / (c_zarcanum_z_coeff_mp * pos_difficulty)));
|
||||
return c_zarcanum_z_coeff_mp * (c_scalar_L.as_boost_mp_type<mp::uint256_t>() / (c_zarcanum_z_coeff_mp * pos_difficulty)); // == z * floor( l / (z * D) )
|
||||
}
|
||||
|
||||
bool zarcanum_check_main_pos_inequality(const hash& kernel_hash, const scalar_t& blinding_mask, const scalar_t& secret_q,
|
||||
const scalar_t& last_pow_block_id_hashed, const mp::uint256_t& z_l_div_z_D, uint64_t stake_amount, mp::uint256_t& lhs, mp::uint512_t& rhs)
|
||||
{
|
||||
scalar_t lhs_s = scalar_t(kernel_hash) * (blinding_mask + secret_q + last_pow_block_id_hashed); // == h * (f + q + f') mod l
|
||||
lhs = lhs_s.as_boost_mp_type<mp::uint256_t>();
|
||||
rhs = static_cast<mp::uint512_t>(z_l_div_z_D) * stake_amount; // == floor( l / (z * D) ) * z * a
|
||||
|
||||
//LOG_PRINT_GREEN_L0(ENDL <<
|
||||
// "z_l_div_z_D = " << z_l_div_z_D << ENDL <<
|
||||
// "stake_amount = " << stake_amount << ENDL <<
|
||||
// "lhs = " << lhs << ENDL <<
|
||||
// "rhs = " << rhs);
|
||||
|
||||
return lhs < rhs; // h * (f + q + f') mod l < floor( l / (z * D) ) * z * a
|
||||
}
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("zarcanum_generate_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool zarcanum_generate_proof(const hash& m, const hash& kernel_hash, const std::vector<CLSAG_GGXXG_input_ref_t>& ring,
|
||||
const scalar_t& last_pow_block_id_hashed, const key_image& stake_ki,
|
||||
const scalar_t& secret_x, const scalar_t& secret_q, uint64_t secret_index, uint64_t stake_amount,
|
||||
const scalar_t& stake_out_asset_id_blinding_mask, const scalar_t& stake_out_amount_blinding_mask, const scalar_t& pseudo_out_amount_blinding_mask,
|
||||
zarcanum_proof& result, uint8_t* p_err /* = nullptr */)
|
||||
{
|
||||
DBG_PRINT("zarcanum_generate_proof");
|
||||
const scalar_t a = stake_amount;
|
||||
const scalar_t h = scalar_t(kernel_hash);
|
||||
const scalar_t f_plus_q = stake_out_amount_blinding_mask + secret_q;
|
||||
const scalar_t f_plus_q_plus_fp = f_plus_q + last_pow_block_id_hashed;
|
||||
const scalar_t lhs = h * f_plus_q_plus_fp; // == h * (f + q + f') mod l
|
||||
const mp::uint256_t d_mp = lhs.as_boost_mp_type<mp::uint256_t>() / (c_zarcanum_z_coeff_mp * stake_amount) + 1;
|
||||
result.d = scalar_t(d_mp);
|
||||
|
||||
const scalar_t dz = result.d * c_zarcanum_z_coeff_s;
|
||||
|
||||
const scalar_t ba = dz * a - lhs; // b_a = dza - h(f + q + f')
|
||||
|
||||
const scalar_t bf = dz * f_plus_q - h * a; // b_f = dz(f + q) - ha
|
||||
|
||||
const scalar_t x0 = scalar_t::random(), x1 = scalar_t::random(), x2 = scalar_t::random();
|
||||
|
||||
const scalar_t bx = x2 - h * x1 + dz * x0; // b_x = x'' - hx' + dzx
|
||||
|
||||
point_t C = x0 * c_point_X + a * c_point_H + f_plus_q * c_point_G;
|
||||
point_t C_prime = x1 * c_point_X + f_plus_q * c_point_H + a * c_point_G;
|
||||
point_t E = bx * c_point_X + ba * c_point_H + bf * c_point_G;
|
||||
|
||||
result.C = (c_scalar_1div8 * C).to_public_key();
|
||||
result.C_prime = (c_scalar_1div8 * C_prime).to_public_key();
|
||||
result.E = (c_scalar_1div8 * E).to_public_key();
|
||||
|
||||
// three proofs with a shared Fiat-Shamir challenge c
|
||||
// 1) linear composition proof for the fact, that C + C' = lin(X, H + G) = (x + x') X + (a + f + q) (H + G)
|
||||
// 2) linear composition proof for the fact, that C - C' = lin(X, H - G) = (x - x') X + (a - f - q) (H - G)
|
||||
// 3) Schnorr proof for the fact, that hC' - dzC + E + f'hH = lin(X) = x'' X
|
||||
|
||||
point_t F = h * C_prime - dz * C + E + last_pow_block_id_hashed * h * c_point_H;
|
||||
|
||||
DBG_VAL_PRINT(h); DBG_VAL_PRINT(last_pow_block_id_hashed); DBG_VAL_PRINT(dz);
|
||||
DBG_VAL_PRINT(C); DBG_VAL_PRINT(C_prime); DBG_VAL_PRINT(E); DBG_VAL_PRINT(F);
|
||||
|
||||
scalar_t r0 = scalar_t::random();
|
||||
scalar_t r1 = scalar_t::random();
|
||||
scalar_t r2 = scalar_t::random();
|
||||
scalar_t r3 = scalar_t::random();
|
||||
scalar_t r4 = scalar_t::random();
|
||||
|
||||
point_t R_01 = r0 * c_point_X + r1 * c_point_H_plus_G;
|
||||
point_t R_23 = r2 * c_point_X + r3 * c_point_H_minus_G;
|
||||
point_t R_4 = r4 * c_point_X;
|
||||
|
||||
hash_helper_t::hs_t hash_calc(7);
|
||||
hash_calc.add_32_chars(CRYPTO_HDS_ZARCANUM_PROOF_HASH);
|
||||
hash_calc.add_point(R_01);
|
||||
hash_calc.add_point(R_23);
|
||||
hash_calc.add_point(R_4);
|
||||
hash_calc.add_point(C + C_prime);
|
||||
hash_calc.add_point(C - C_prime);
|
||||
hash_calc.add_point(F);
|
||||
result.c = hash_calc.calc_hash();
|
||||
|
||||
result.y0 = r0 + result.c * (x0 + x1); // y_0 = r_0 + c (x + x')
|
||||
result.y1 = r1 + result.c * (a + f_plus_q); // y_1 = r_1 + c (a + f + q)
|
||||
result.y2 = r2 + result.c * (x0 - x1); // y_2 = r_2 + c (x - x')
|
||||
result.y3 = r3 + result.c * (a - f_plus_q); // y_3 = r_3 + c (a - f - q)
|
||||
result.y4 = r4 + result.c * x2; // y_4 = r_4 + c x''
|
||||
|
||||
// range proof for E
|
||||
const scalar_vec_t values = { ba }; // H component
|
||||
const scalar_vec_t masks = { bf }; // G component
|
||||
const scalar_vec_t masks2 = { bx }; // X component
|
||||
const std::vector<const public_key*> E_1div8_vec_ptr = { &result.E };
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(bppe_gen<bpp_crypto_trait_Zarcanum>(values, masks, masks2, E_1div8_vec_ptr, result.E_range_proof), 10);
|
||||
|
||||
// = five-layers ring signature data outline =
|
||||
// (j in [0, ring_size-1])
|
||||
// layer 0 ring
|
||||
// A[j] ( = ring[j].stealth_address)
|
||||
// layer 0 secret (with respect to G)
|
||||
// secret_x
|
||||
// layer 0 linkability
|
||||
// stake_ki
|
||||
//
|
||||
// layer 1 ring
|
||||
// ring[j].amount_commitment - pseudo_out_amount_commitment
|
||||
// layer 1 secret (with respect to G)
|
||||
// stake_out_amount_blinding_mask - pseudo_out_amount_blinding_mask ( = f_i - f'_i )
|
||||
//
|
||||
// additional layer for confidential assets:
|
||||
//
|
||||
// layer 2 ring
|
||||
// ring[j].blinded_asset_id - pseudo_out_blinded_asset_id
|
||||
// layer 2 secret (with respect to X)
|
||||
// -pseudo_out_asset_id_blinding_mask ( = -r'_i )
|
||||
//
|
||||
// additional layers for Zarcanum:
|
||||
//
|
||||
// layer 3 ring
|
||||
// C - A[j] - Q[j]
|
||||
// layer 3 secret (with respect to X)
|
||||
// x0 - a * stake_out_asset_id_blinding_mask ( = x - a * r_i )
|
||||
//
|
||||
// layer 4 ring
|
||||
// Q[j]
|
||||
// layer 4 secret (with respect to G)
|
||||
// secret_q
|
||||
|
||||
// such pseudo_out_asset_id_blinding_mask effectively makes pseudo_out_blinded_asset_id == currency::native_coin_asset_id_pt == point_H
|
||||
scalar_t pseudo_out_asset_id_blinding_mask = -stake_out_asset_id_blinding_mask; // T^p_i = T_i + (-r_i) * X = H
|
||||
|
||||
point_t stake_out_asset_id = c_point_H + stake_out_asset_id_blinding_mask * c_point_X; // T_i = H + r_i * X
|
||||
|
||||
point_t pseudo_out_amount_commitment = a * stake_out_asset_id + pseudo_out_amount_blinding_mask * c_point_G; // A^p_i = a_i * T_i + f'_i * G
|
||||
result.pseudo_out_amount_commitment = (c_scalar_1div8 * pseudo_out_amount_commitment).to_public_key();
|
||||
|
||||
TRY_ENTRY()
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(generate_CLSAG_GGXXG(m, ring, pseudo_out_amount_commitment, c_point_H, C, stake_ki,
|
||||
secret_x, stake_out_amount_blinding_mask - pseudo_out_amount_blinding_mask, -pseudo_out_asset_id_blinding_mask, x0 - a * stake_out_asset_id_blinding_mask, secret_q, secret_index,
|
||||
result.clsag_ggxxg), 20);
|
||||
CATCH_ENTRY2(false);
|
||||
|
||||
return true;
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("zarcanum_verify_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool zarcanum_verify_proof(const hash& m, const hash& kernel_hash, const std::vector<CLSAG_GGXXG_input_ref_t>& ring,
|
||||
const scalar_t& last_pow_block_id_hashed, const key_image& stake_ki,
|
||||
const mp::uint128_t& pos_difficulty,
|
||||
const zarcanum_proof& sig, uint8_t* p_err /* = nullptr */) noexcept
|
||||
{
|
||||
TRY_ENTRY()
|
||||
{
|
||||
DBG_PRINT("zarcanum_verify_proof");
|
||||
//bool r = false;
|
||||
|
||||
//std::cout << "===== zarcanum_verify_proof =====" << ENDL
|
||||
// << "m: " << m << ENDL
|
||||
// << "kernel_hash: " << kernel_hash << ENDL
|
||||
// << "last_pow_block_id_hashed: " << last_pow_block_id_hashed << ENDL
|
||||
// << "stake_ki: " << stake_ki << ENDL
|
||||
// << "pos_difficulty: " << pos_difficulty << ENDL;
|
||||
//size_t ii = 0;
|
||||
//for(const auto& el : ring)
|
||||
//{
|
||||
// std::cout << "[" << ii << "]" << ENDL
|
||||
// << " amount_commitment: " << el.amount_commitment << ENDL
|
||||
// << " blinded_asset_id: " << el.blinded_asset_id << ENDL
|
||||
// << " concealing_point: " << el.concealing_point << ENDL
|
||||
// << " stealth_address: " << el.stealth_address << ENDL;
|
||||
//}
|
||||
|
||||
// make sure 0 < d <= l / floor(z * D)
|
||||
const mp::uint256_t l_div_z_D_mp = zarcanum_precalculate_l_div_z_D(pos_difficulty);
|
||||
const scalar_t l_div_z_D(l_div_z_D_mp);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(!sig.d.is_zero() && sig.d < l_div_z_D, 2);
|
||||
const scalar_t dz = sig.d * c_zarcanum_z_coeff_s;
|
||||
|
||||
// calculate h
|
||||
const scalar_t h = scalar_t(kernel_hash);
|
||||
|
||||
// calculate F
|
||||
point_t C_prime = point_t(sig.C_prime);
|
||||
C_prime.modify_mul8();
|
||||
point_t C = point_t(sig.C);
|
||||
C.modify_mul8();
|
||||
point_t E = point_t(sig.E);
|
||||
E.modify_mul8();
|
||||
point_t F = h * C_prime - dz * C + E + last_pow_block_id_hashed * h * c_point_H;
|
||||
|
||||
DBG_VAL_PRINT(h); DBG_VAL_PRINT(last_pow_block_id_hashed); DBG_VAL_PRINT(dz);
|
||||
DBG_VAL_PRINT(C); DBG_VAL_PRINT(C_prime); DBG_VAL_PRINT(E); DBG_VAL_PRINT(F);
|
||||
|
||||
// check three proofs with a shared Fiat-Shamir challenge c
|
||||
point_t C_plus_C_prime = C + C_prime;
|
||||
point_t C_minus_C_prime = C - C_prime;
|
||||
hash_helper_t::hs_t hash_calc(7);
|
||||
hash_calc.add_32_chars(CRYPTO_HDS_ZARCANUM_PROOF_HASH);
|
||||
hash_calc.add_point(sig.y0 * c_point_X + sig.y1 * c_point_H_plus_G - sig.c * C_plus_C_prime); // y_0 * X + y1 (H + G) - c (C + C')
|
||||
hash_calc.add_point(sig.y2 * c_point_X + sig.y3 * c_point_H_minus_G - sig.c * C_minus_C_prime); // y_2 * X + y3 (H - G) - c (C - C')
|
||||
hash_calc.add_point(sig.y4 * c_point_X - sig.c * F); // y_4 * X - c * F
|
||||
hash_calc.add_point(C_plus_C_prime);
|
||||
hash_calc.add_point(C_minus_C_prime);
|
||||
hash_calc.add_point(F);
|
||||
scalar_t c_prime = hash_calc.calc_hash();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.c == c_prime, 3);
|
||||
|
||||
// check extended range proof for E
|
||||
std::vector<point_t> E_for_range_proof = { point_t(sig.E) }; // consider changing to 8*sig.E to avoid additional conversion
|
||||
std::vector<bppe_sig_commit_ref_t> range_proofs = { bppe_sig_commit_ref_t(sig.E_range_proof, E_for_range_proof) };
|
||||
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(bppe_verify<bpp_crypto_trait_Zarcanum>(range_proofs), 10);
|
||||
|
||||
static public_key native_coin_asset_id = (c_scalar_1div8 * c_point_H).to_public_key(); // consider making it less ugly -- sowle
|
||||
|
||||
// check extended CLSAG-GGXG ring signature
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(verify_CLSAG_GGXXG(m, ring, sig.pseudo_out_amount_commitment, native_coin_asset_id, sig.C, stake_ki, sig.clsag_ggxxg), 1);
|
||||
}
|
||||
CATCH_ENTRY_CUSTOM2({if (p_err) *p_err = 100;}, false)
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("generate_vector_UG_aggregation_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool generate_vector_UG_aggregation_proof(const hash& m, const scalar_vec_t& u_secrets, const scalar_vec_t& g_secrets0, const scalar_vec_t& g_secrets1,
|
||||
const std::vector<point_t>& amount_commitments,
|
||||
const std::vector<point_t>& amount_commitments_for_rp_aggregation,
|
||||
const std::vector<point_t>& blinded_asset_ids,
|
||||
vector_UG_aggregation_proof& result, uint8_t* p_err /* = nullptr */)
|
||||
{
|
||||
// w - public random weighting factor
|
||||
// proof of knowing e_j and y'' in zero knowledge in the following eq:
|
||||
// E_j + w * E'_j = e_j * (T'_j + w * U) + (y_j + w * y'_j) * G
|
||||
// where:
|
||||
// e_j -- output's amount
|
||||
// T'_j -- output's blinded asset tag
|
||||
// E_j == e_j * T'_j + y_j * G -- output's amount commitments
|
||||
// E'_j == e_j * U + y'_j * G -- additional commitment to the same amount for range proof aggregation
|
||||
|
||||
// amount_commitments[j] + w * amount_commitments_for_rp_aggregation[j]
|
||||
// ==
|
||||
// u_secrets[j] * (blinded_asset_ids[j] + w * U) + (g_secrets0[j] + w * g_secrets1[j]) * G
|
||||
|
||||
const size_t n = u_secrets.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n != 0, 1);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n == g_secrets0.size(), 2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n == g_secrets1.size(), 3);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n == amount_commitments.size(), 4);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n == amount_commitments_for_rp_aggregation.size(), 5);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n == blinded_asset_ids.size(), 6);
|
||||
|
||||
hash_helper_t::hs_t hash_calculator(1 + 3 * n);
|
||||
hash_calculator.add_hash(m);
|
||||
hash_calculator.add_points_array(amount_commitments);
|
||||
hash_calculator.add_points_array(amount_commitments_for_rp_aggregation);
|
||||
scalar_t w = hash_calculator.calc_hash(false); // don't clean the buffer
|
||||
DBG_VAL_PRINT(w);
|
||||
|
||||
#ifndef NDEBUG
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(amount_commitments[j] + w * amount_commitments_for_rp_aggregation[j] == u_secrets[j] * (blinded_asset_ids[j] + w * c_point_U) + (g_secrets0[j] + w * g_secrets1[j]) * c_point_G, 20);
|
||||
#endif
|
||||
|
||||
result.amount_commitments_for_rp_aggregation.clear();
|
||||
result.y0s.clear();
|
||||
result.y1s.clear();
|
||||
|
||||
scalar_vec_t r0, r1;
|
||||
r0.resize_and_make_random(n);
|
||||
r1.resize_and_make_random(n);
|
||||
|
||||
std::vector<point_t> asset_tag_plus_U_vec(n);
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
asset_tag_plus_U_vec[j] = blinded_asset_ids[j] + w * c_point_U;
|
||||
|
||||
std::vector<point_t> R(n);
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
R[j].assign_mul_plus_G(r0[j], asset_tag_plus_U_vec[j], r1[j]); // R[j] = r0[j] * asset_tag_plus_U_vec[j] + r1[j] * G
|
||||
|
||||
hash_calculator.add_points_array(R);
|
||||
result.c = hash_calculator.calc_hash();
|
||||
|
||||
DBG_VAL_PRINT(asset_tag_plus_U_vec); DBG_VAL_PRINT(m); DBG_VAL_PRINT(amount_commitments); DBG_VAL_PRINT(amount_commitments_for_rp_aggregation); DBG_VAL_PRINT(R);
|
||||
DBG_VAL_PRINT(result.c);
|
||||
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
{
|
||||
result.y0s.emplace_back(r0[j] - result.c * u_secrets[j]);
|
||||
result.y1s.emplace_back(r1[j] - result.c * (g_secrets0[j] + w * g_secrets1[j]));
|
||||
result.amount_commitments_for_rp_aggregation.emplace_back((c_scalar_1div8 * amount_commitments_for_rp_aggregation[j]).to_public_key());
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
#define CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(cond, err_code) \
|
||||
if (!(cond)) { LOG_PRINT_RED("verify_vector_UG_aggregation_proof: \"" << #cond << "\" is false at " << LOCATION_SS << ENDL << "error code = " << (int)err_code, LOG_LEVEL_3); \
|
||||
if (p_err) { *p_err = err_code; } return false; }
|
||||
|
||||
bool verify_vector_UG_aggregation_proof(const hash& m, const std::vector<const public_key*> amount_commitments_1div8, const std::vector<const public_key*> blinded_asset_ids_1div8,
|
||||
const vector_UG_aggregation_proof& sig, uint8_t* p_err /* = nullptr */) noexcept
|
||||
{
|
||||
TRY_ENTRY()
|
||||
{
|
||||
const size_t n = amount_commitments_1div8.size();
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(n > 0, 1);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(blinded_asset_ids_1div8.size() == n, 2);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.amount_commitments_for_rp_aggregation.size() == n, 3);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.y0s.size() == n, 4);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.y1s.size() == n, 5);
|
||||
|
||||
hash_helper_t::hs_t hash_calculator(1 + 3 * n);
|
||||
hash_calculator.add_hash(m);
|
||||
DBG_VAL_PRINT(m);
|
||||
|
||||
std::vector<point_t> amount_commitments_pt;
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
{
|
||||
point_t A = point_t(*amount_commitments_1div8[j]).modify_mul8();
|
||||
hash_calculator.add_point(A);
|
||||
amount_commitments_pt.emplace_back(A);
|
||||
DBG_VAL_PRINT(A);
|
||||
}
|
||||
|
||||
std::vector<point_t> amount_commitments_for_rp_aggregation_pt;
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
{
|
||||
point_t Arpa = point_t(sig.amount_commitments_for_rp_aggregation[j]).modify_mul8();
|
||||
hash_calculator.add_point(Arpa); // TODO @#@ performance: consider adding premultiplied by 1/8 points to the hash
|
||||
amount_commitments_for_rp_aggregation_pt.emplace_back(Arpa);
|
||||
DBG_VAL_PRINT(Arpa);
|
||||
}
|
||||
|
||||
scalar_t w = hash_calculator.calc_hash(false); // don't clear the buffer
|
||||
DBG_VAL_PRINT(w);
|
||||
|
||||
std::vector<point_t> asset_tag_plus_U_vec(n);
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
asset_tag_plus_U_vec[j] = point_t(*blinded_asset_ids_1div8[j]).modify_mul8() + w * c_point_U;
|
||||
DBG_VAL_PRINT(asset_tag_plus_U_vec);
|
||||
|
||||
for(size_t j = 0; j < n; ++j)
|
||||
{
|
||||
hash_calculator.add_pub_key(point_t(
|
||||
sig.y0s[j] * asset_tag_plus_U_vec[j] +
|
||||
sig.y1s[j] * c_point_G +
|
||||
sig.c * (amount_commitments_pt[j] + w * amount_commitments_for_rp_aggregation_pt[j])
|
||||
).to_public_key());
|
||||
DBG_VAL_PRINT(hash_calculator.m_elements.back().pk);
|
||||
}
|
||||
|
||||
scalar_t c = hash_calculator.calc_hash();
|
||||
DBG_VAL_PRINT(c); DBG_VAL_PRINT(sig.c);
|
||||
CHECK_AND_FAIL_WITH_ERROR_IF_FALSE(sig.c == c, 0);
|
||||
}
|
||||
CATCH_ENTRY_CUSTOM2({if (p_err) *p_err = 100; }, false)
|
||||
|
||||
return true;
|
||||
}
|
||||
#undef CHECK_AND_FAIL_WITH_ERROR_IF_FALSE
|
||||
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
314
crypto/upstream/zarcanum.h
Executable file
314
crypto/upstream/zarcanum.h
Executable file
|
|
@ -0,0 +1,314 @@
|
|||
// Copyright (c) 2014-2018 Zano Project
|
||||
// Copyright (c) 2014-2018 The Louisdor Project
|
||||
// Copyright (c) 2012-2013 The Boolberry developers
|
||||
// Copyright (c) 2017-2025 Lethean (https://lt.hn)
|
||||
//
|
||||
// Licensed under the European Union Public Licence (EUPL) version 1.2.
|
||||
// You may obtain a copy of the licence at:
|
||||
//
|
||||
// https://joinup.ec.europa.eu/software/page/eupl/licence-eupl
|
||||
//
|
||||
// The EUPL is a copyleft licence that is compatible with the MIT/X11
|
||||
// licence used by the original projects; the MIT terms are therefore
|
||||
// considered “grandfathered” under the EUPL for this code.
|
||||
//
|
||||
// SPDX‑License‑Identifier: EUPL-1.2
|
||||
//
|
||||
#pragma once
|
||||
#include "crypto-sugar.h"
|
||||
#include "range_proofs.h"
|
||||
#include "clsag.h"
|
||||
|
||||
namespace crypto
|
||||
{
|
||||
extern const mp::uint256_t c_zarcanum_z_coeff_mp;
|
||||
extern const scalar_t c_zarcanum_z_coeff_s;
|
||||
|
||||
mp::uint256_t zarcanum_precalculate_l_div_z_D(const mp::uint128_t& pos_difficulty);
|
||||
mp::uint256_t zarcanum_precalculate_z_l_div_z_D(const mp::uint128_t& pos_difficulty);
|
||||
|
||||
bool zarcanum_check_main_pos_inequality(const hash& kernel_hash, const scalar_t& blinding_mask, const scalar_t& secret_q,
|
||||
const scalar_t& last_pow_block_id_hashed, const mp::uint256_t& z_l_div_z_D_, uint64_t stake_amount, mp::uint256_t& lhs, mp::uint512_t& rhs);
|
||||
|
||||
|
||||
struct zarcanum_proof
|
||||
{
|
||||
scalar_t d = 0;
|
||||
public_key C; // premultiplied by 1/8
|
||||
public_key C_prime; // premultiplied by 1/8
|
||||
public_key E; // premultiplied by 1/8
|
||||
|
||||
scalar_t c; // shared Fiat-Shamir challenge for the following three proofs
|
||||
scalar_t y0; // 1st linear composition proof
|
||||
scalar_t y1; // ( C + C' = lin(X, H + G) )
|
||||
scalar_t y2; // 2nd linear composition proof
|
||||
scalar_t y3; // ( C - C' = lin(X, H - G) )
|
||||
scalar_t y4; // Schnorr proof (F = lin(X))
|
||||
|
||||
bppe_signature E_range_proof;
|
||||
|
||||
public_key pseudo_out_amount_commitment; // premultiplied by 1/8
|
||||
CLSAG_GGXXG_signature clsag_ggxxg;
|
||||
};
|
||||
|
||||
bool zarcanum_generate_proof(const hash& m, const hash& kernel_hash, const std::vector<CLSAG_GGXXG_input_ref_t>& ring,
|
||||
const scalar_t& last_pow_block_id_hashed, const key_image& stake_ki,
|
||||
const scalar_t& secret_x, const scalar_t& secret_q, uint64_t secret_index, uint64_t stake_amount,
|
||||
const scalar_t& stake_out_asset_id_blinding_mask, const scalar_t& stake_out_amount_blinding_mask, const scalar_t& pseudo_out_amount_blinding_mask,
|
||||
zarcanum_proof& result, uint8_t* p_err = nullptr);
|
||||
|
||||
|
||||
bool zarcanum_verify_proof(const hash& m, const hash& kernel_hash, const std::vector<CLSAG_GGXXG_input_ref_t>& ring,
|
||||
const scalar_t& last_pow_block_id_hashed, const key_image& stake_ki,
|
||||
const mp::uint128_t& pos_difficulty,
|
||||
const zarcanum_proof& sig, uint8_t* p_err = nullptr) noexcept;
|
||||
|
||||
|
||||
// TODO @#@#: make sure it is used, implement, then move it to an appropriate place
|
||||
struct linear_composition_proof
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_t y0;
|
||||
scalar_t y1;
|
||||
};
|
||||
|
||||
enum generator_tag { gt_void = 0, gt_G = 1, gt_H = 2, gt_H2 = 3, gt_X = 4, gt_U = 5 };
|
||||
|
||||
template<generator_tag gen0 = gt_H, generator_tag gen1 = gt_G>
|
||||
bool generate_linear_composition_proof(const hash& m, const public_key& A, const scalar_t& secret_a, const scalar_t& secret_b, linear_composition_proof& result, uint8_t* p_err = nullptr)
|
||||
{
|
||||
// consider embedding generators' tags into random entropy to distinguish proofs made with different generators during verification
|
||||
return false;
|
||||
}
|
||||
|
||||
template<generator_tag gen0 = gt_H, generator_tag gen1 = gt_G>
|
||||
bool verify_linear_composition_proof(const hash& m, const public_key& A, const linear_composition_proof& sig, uint8_t* p_err = nullptr)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
struct generic_schnorr_sig
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_t y;
|
||||
};
|
||||
|
||||
|
||||
template<typename generator_t>
|
||||
inline bool generate_schnorr_sig_custom_generator(const hash& m, const point_t& A, const scalar_t& secret_a, generic_schnorr_sig& result, const generator_t& g_point_g)
|
||||
{
|
||||
#ifndef NDEBUG
|
||||
if (A != secret_a * g_point_g)
|
||||
return false;
|
||||
#endif
|
||||
scalar_t r = scalar_t::random();
|
||||
point_t R = r * g_point_g;
|
||||
hash_helper_t::hs_t hsc(3);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_point(A);
|
||||
hsc.add_point(R);
|
||||
result.c = hsc.calc_hash();
|
||||
result.y.assign_mulsub(result.c, secret_a, r); // y = r - c * secret_a
|
||||
return true;
|
||||
}
|
||||
|
||||
template<generator_tag gen = gt_G>
|
||||
inline bool generate_schnorr_sig(const hash& m, const point_t& A, const scalar_t& secret_a, generic_schnorr_sig& result);
|
||||
|
||||
template<>
|
||||
inline bool generate_schnorr_sig<gt_G>(const hash& m, const point_t& A, const scalar_t& secret_a, generic_schnorr_sig& result)
|
||||
{
|
||||
return generate_schnorr_sig_custom_generator(m, A, secret_a, result, c_point_G);
|
||||
}
|
||||
|
||||
template<>
|
||||
inline bool generate_schnorr_sig<gt_X>(const hash& m, const point_t& A, const scalar_t& secret_a, generic_schnorr_sig& result)
|
||||
{
|
||||
return generate_schnorr_sig_custom_generator(m, A, secret_a, result, c_point_X);
|
||||
}
|
||||
|
||||
inline bool generate_schnorr_sig(const hash& m, const public_key& A, const secret_key& secret_a, generic_schnorr_sig& result)
|
||||
{
|
||||
return generate_schnorr_sig(m, point_t(A), scalar_t(secret_a), result);
|
||||
}
|
||||
|
||||
inline bool generate_schnorr_sig(const hash& m, const secret_key& secret_a, generic_schnorr_sig& result)
|
||||
{
|
||||
scalar_t secret_a_s(secret_a);
|
||||
if (!secret_a_s.is_reduced())
|
||||
return false;
|
||||
point_t A = secret_a_s * c_point_G;
|
||||
return generate_schnorr_sig_custom_generator(m, A, secret_a_s, result, c_point_G);
|
||||
}
|
||||
|
||||
|
||||
template<generator_tag gen = gt_G>
|
||||
inline bool verify_schnorr_sig(const hash& m, const public_key& A, const generic_schnorr_sig& sig) noexcept;
|
||||
|
||||
// TODO @#@# make optimized version inline bool verify_schnorr_sig(const hash& m, const point_t& A, const generic_schnorr_sig& sig) noexcept;
|
||||
// and change check_tx_balance() accordingly
|
||||
|
||||
template<>
|
||||
inline bool verify_schnorr_sig<gt_G>(const hash& m, const public_key& A, const generic_schnorr_sig& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!sig.c.is_reduced() || !sig.y.is_reduced())
|
||||
return false;
|
||||
hash_helper_t::hs_t hsc(3);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_pub_key(A);
|
||||
hsc.add_point(point_t(A).mul_plus_G(sig.c, sig.y)); // sig.y * G + sig.c * A
|
||||
return sig.c == hsc.calc_hash();
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
template<>
|
||||
inline bool verify_schnorr_sig<gt_X>(const hash& m, const public_key& A, const generic_schnorr_sig& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!sig.c.is_reduced() || !sig.y.is_reduced())
|
||||
return false;
|
||||
hash_helper_t::hs_t hsc(3);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_pub_key(A);
|
||||
hsc.add_point(sig.y * c_point_X + sig.c * point_t(A));
|
||||
return sig.c == hsc.calc_hash();
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// --------------------------------------------
|
||||
|
||||
// multi-base Schnorr-like proof (two generators, two secrets, one Fiat-Shamir challenge)
|
||||
struct generic_double_schnorr_sig
|
||||
{
|
||||
scalar_t c;
|
||||
scalar_t y0;
|
||||
scalar_t y1;
|
||||
};
|
||||
|
||||
template<generator_tag gen0, generator_tag gen1>
|
||||
inline bool generate_double_schnorr_sig(const hash& m, const point_t& A, const scalar_t& secret_a, const point_t& B, const scalar_t& secret_b, generic_double_schnorr_sig& result);
|
||||
|
||||
template<>
|
||||
inline bool generate_double_schnorr_sig<gt_G, gt_G>(const hash& m, const point_t& A, const scalar_t& secret_a, const point_t& B, const scalar_t& secret_b, generic_double_schnorr_sig& result)
|
||||
{
|
||||
#ifndef NDEBUG
|
||||
if (A != secret_a * c_point_G || B != secret_b * c_point_G)
|
||||
return false;
|
||||
#endif
|
||||
scalar_t r0 = scalar_t::random();
|
||||
scalar_t r1 = scalar_t::random();
|
||||
point_t R0 = r0 * c_point_G;
|
||||
point_t R1 = r1 * c_point_G;
|
||||
hash_helper_t::hs_t hsc(5);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_point(A);
|
||||
hsc.add_point(B);
|
||||
hsc.add_point(R0);
|
||||
hsc.add_point(R1);
|
||||
result.c = hsc.calc_hash();
|
||||
result.y0.assign_mulsub(result.c, secret_a, r0); // y0 = r0 - c * secret_a
|
||||
result.y1.assign_mulsub(result.c, secret_b, r1); // y1 = r1 - c * secret_b
|
||||
return true;
|
||||
}
|
||||
|
||||
template<>
|
||||
inline bool generate_double_schnorr_sig<gt_X, gt_G>(const hash& m, const point_t& A, const scalar_t& secret_a, const point_t& B, const scalar_t& secret_b, generic_double_schnorr_sig& result)
|
||||
{
|
||||
#ifndef NDEBUG
|
||||
if (A != secret_a * c_point_X || B != secret_b * c_point_G)
|
||||
return false;
|
||||
#endif
|
||||
scalar_t r0 = scalar_t::random();
|
||||
scalar_t r1 = scalar_t::random();
|
||||
point_t R0 = r0 * c_point_X;
|
||||
point_t R1 = r1 * c_point_G;
|
||||
hash_helper_t::hs_t hsc(5);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_point(A);
|
||||
hsc.add_point(B);
|
||||
hsc.add_point(R0);
|
||||
hsc.add_point(R1);
|
||||
result.c = hsc.calc_hash();
|
||||
result.y0.assign_mulsub(result.c, secret_a, r0); // y0 = r0 - c * secret_a
|
||||
result.y1.assign_mulsub(result.c, secret_b, r1); // y1 = r1 - c * secret_b
|
||||
return true;
|
||||
}
|
||||
|
||||
template<generator_tag gen0, generator_tag gen1>
|
||||
inline bool verify_double_schnorr_sig(const hash& m, const point_t& A, const public_key& B, const generic_double_schnorr_sig& sig) noexcept;
|
||||
|
||||
template<>
|
||||
inline bool verify_double_schnorr_sig<gt_G, gt_G>(const hash& m, const point_t& A, const public_key& B, const generic_double_schnorr_sig& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!sig.c.is_reduced() || !sig.y0.is_reduced() || !sig.y1.is_reduced())
|
||||
return false;
|
||||
hash_helper_t::hs_t hsc(5);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_point(A);
|
||||
hsc.add_pub_key(B);
|
||||
hsc.add_point(A.mul_plus_G(sig.c, sig.y0)); // sig.y0 * G + sig.c * A
|
||||
hsc.add_point(point_t(B).mul_plus_G(sig.c, sig.y1)); // sig.y1 * G + sig.c * B
|
||||
return sig.c == hsc.calc_hash();
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
template<>
|
||||
inline bool verify_double_schnorr_sig<gt_X, gt_G>(const hash& m, const point_t& A, const public_key& B, const generic_double_schnorr_sig& sig) noexcept
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!sig.c.is_reduced() || !sig.y0.is_reduced() || !sig.y1.is_reduced())
|
||||
return false;
|
||||
hash_helper_t::hs_t hsc(5);
|
||||
hsc.add_hash(m);
|
||||
hsc.add_point(A);
|
||||
hsc.add_pub_key(B);
|
||||
hsc.add_point(sig.y0 * c_point_X + sig.c * A);
|
||||
hsc.add_point(point_t(B).mul_plus_G(sig.c, sig.y1)); // sig.y1 * G + sig.c * B
|
||||
return sig.c == hsc.calc_hash();
|
||||
}
|
||||
catch(...)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// TODO: improve this proof using random weightning factor
|
||||
struct vector_UG_aggregation_proof
|
||||
{
|
||||
std::vector<public_key> amount_commitments_for_rp_aggregation; // E' = e * U + y' * G, premultiplied by 1/8
|
||||
scalar_vec_t y0s;
|
||||
scalar_vec_t y1s;
|
||||
scalar_t c; // common challenge
|
||||
};
|
||||
|
||||
bool generate_vector_UG_aggregation_proof(const hash& m, const scalar_vec_t& u_secrets, const scalar_vec_t& g_secrets0, const scalar_vec_t& g_secrets1,
|
||||
const std::vector<point_t>& amount_commitments,
|
||||
const std::vector<point_t>& amount_commitments_for_rp_aggregation,
|
||||
const std::vector<point_t>& blinded_asset_ids,
|
||||
vector_UG_aggregation_proof& result, uint8_t* p_err = nullptr);
|
||||
|
||||
bool verify_vector_UG_aggregation_proof(const hash& m, const std::vector<const public_key*> amount_commitments_1div8, const std::vector<const public_key*> blinded_asset_ids_1div8,
|
||||
const vector_UG_aggregation_proof& sig, uint8_t* p_err = nullptr) noexcept;
|
||||
|
||||
|
||||
} // namespace crypto
|
||||
Loading…
Add table
Reference in a new issue