1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
//! Requester side of the protocol //! //! # Note //! //! This **does not** include **any** networking code, such as any code to //! actually request protocol initiation. Also, the request for protocol //! initiation is neither defined nor implemented by this crate. use curve25519_dalek::{ constants::RISTRETTO_BASEPOINT_POINT, ristretto::{CompressedRistretto, RistrettoPoint}, scalar::Scalar, }; use digest::Digest; use rand::OsRng; use signature::UnblindedSigData; use typenum::U64; use Error::{WiredRistrettoPointMalformed, WiredScalarMalformed}; /// For managing the requester steps of the blind signature protocol. Actually /// initiating the protocol such that the signer knows to begin the first step /// (generating R') is orthogonal to this crate. pub struct BlindRequest { u: Scalar, v: Scalar, r: RistrettoPoint, e: Scalar, } impl BlindRequest { /// Perform the first set of requester side steps toward acquiring a blindly /// signed message. Generates a random 32 byte scalar to use as the message, /// seeing as it is uncommon to need any particular message to be blindly /// signed. /// /// # Arguments /// /// * 'rp' - A reference to a 32 byte CompressedRistrettoPoint represented /// as a [u8; 32]. This is the R' value received from the siger in response /// to a request for protocol initiation, though how it is requested or /// received is orthogonal to this crate. /// /// # Type Paramaeters /// /// H is the hash algorithm that will be used for generating e /// /// # Returns /// /// * Ok(([u8; 32], BlindRequest)) on success. The [u8; 32] represents the /// value e', which is sent to the server for blind signing. /// /// * Err(::Error) variant on error, which could be caused by the failure to /// initiate the RNG, or otherwise being input a malformed R' value from the /// signer. /// /// # Mathematics /// /// * R = u*R' + v*P /// * u = Randomly Generated Scalar by requester /// * v = Randomly Generated Scalar by requester /// _____ /// * e = H(R||m) /// * H() = A hash function producing 64 byte outputs /// * m = The bytes of the message to be blindly signed /// _____ /// * e' = e / u pub fn new<H>(rp: &[u8; 32]) -> ::Result<([u8; 32], Self)> where H: Digest<OutputSize = U64> + Default, { initiate::<H, &[u8; 32]>(rp, Scalar::random(&mut OsRng::new()?).as_bytes()) } /// The same as new, but allows for passing in a specific message value 'm' /// to be blindly signed. pub fn new_specific_msg<H, M>(rp: &[u8; 32], m: M) -> ::Result<([u8; 32], Self)> where H: Digest<OutputSize = U64> + Default, M: AsRef<[u8]>, { initiate::<H, M>(rp, m) } /// Input the blinded signature S' from the signer, consumes self and /// creates the complete blindly signed message structure. Note that this /// method does not actually verify that a correct sp value was received /// from the signer, only that it was a valid canonical scalar. /// /// # Arguments /// /// * 'sp' - A reference to a 32 byte Scalar represented as a [u8; 32]. This /// scalar is received from the signer and is the signature on the value e'. /// /// # Returns /// /// * Ok(UnblindedSigData) on success. The UnblindedSigData consists of /// /// 1. The unblinded S' value = **S**, the signature (on unblinded e' value, which is e = H(msg||R)) /// 2. The **e** value (which is the unblinded e' value, on which S is the signature) /// 3. The **R** value (which is the unblinded R' value that was originally received from the signer) /// /// * Err(::Error) on error. The only error is if the input sp is not a /// valid scalar. Note that this method **does not** actually ensure that /// the signature is valid, only that the scalar of the signature is /// correctly formed. /// /// # Mathematics /// /// * S = S' * u + v /// * v = Random scalar previously generated by requester /// * u = Random scalar previously generated by requester pub fn gen_signed_msg(self, sp: &[u8; 32]) -> ::Result<UnblindedSigData> { let sp = Scalar::from_canonical_bytes(*sp).ok_or(WiredScalarMalformed)?; Ok(UnblindedSigData::new(self.e, sp * self.u + self.v, self.r)) } } // Implementation internal functions, not exposed to crate users --> /// Internal code for all new variants (ie: with random or specific msg) #[allow(many_single_char_names)] fn initiate<H, M>(rp: &[u8; 32], m: M) -> ::Result<([u8; 32], BlindRequest)> where H: Digest<OutputSize = U64> + Default, M: AsRef<[u8]>, { let mut rng = OsRng::new()?; // Load the wired R' value into RistrettoPoint form, error if the wired // form was malformed. let rp = CompressedRistretto(*rp) .decompress() .ok_or(WiredRistrettoPointMalformed)?; // The random scalars u and v must be generated let u = Scalar::random(&mut rng); let v = Scalar::random(&mut rng); // R = u*R' + v*P let r = generate_r(u, v, rp); // e = H(R||m) let e = generate_e::<H>(r, m.as_ref()); // e' = e / u let ep = generate_ep(u, e); Ok((ep.to_bytes(), BlindRequest { u, v, r, e })) } /// The requester, given R' from the signer, calculates R = u*R' + v*P, where /// * u = a randomly chosen number by the requester /// * v = a randomly chosen number by the requester /// * P = a generator point in ECC fn generate_r(u: Scalar, v: Scalar, rp: RistrettoPoint) -> RistrettoPoint { u * rp + v * RISTRETTO_BASEPOINT_POINT } /// The requester generates e = H(R||m), where /// * H() = a hash function producing 64 byte outputs /// * R = the previously calculated R value /// * m = the message to be signed /// /// pub(crate) as used in signature.rs pub(crate) fn generate_e<H>(r: RistrettoPoint, m: &[u8]) -> Scalar where H: Digest<OutputSize = U64> + Default, { let mut hasher = H::default(); hasher.input(r.compress().as_bytes()); hasher.input(m); Scalar::from_hash(hasher) } /// The requester calculates e' = e / u, where /// * e = the previously generated e value /// * u = a randomly chosen number by the requester fn generate_ep(u: Scalar, e: Scalar) -> Scalar { u.invert() * e }