confium-privacy 0.5.4

//! Adaptor signatures — pre-signature + completion with witness.
//!
//! An adaptor signature is a "pre-signature" that can be completed
//! into a valid signature by anyone who knows a secret witness `y`.
//! Revealing the completed signature also reveals `y`, enabling
//! atomic swaps and payment channels.

use getrandom::SysRng;
use p256::ecdsa::{Signature, SigningKey, VerifyingKey};
use p256::elliptic_curve::rand_core::UnwrapErr;
use p256::elliptic_curve::sec1::ToSec1Point;
use p256::elliptic_curve::{Field, PrimeField};
use p256::{AffinePoint, FieldBytes, ProjectivePoint, Scalar};
use sha2::{Digest, Sha256};

/// An adaptor pre-signature.
#[derive(Debug, Clone)]
pub struct AdaptorPreSig {
    /// The modified nonce point R' = (k + y) * G.
    pub r_prime: AffinePoint,
    /// The pre-signature s' value.
    pub s_prime: Scalar,
}

/// A witness statement: Y = y * G.
#[derive(Debug, Clone)]
pub struct WitnessStatement {
    pub y_point: AffinePoint,
}

/// Generate a witness statement from a secret witness.
pub fn create_witness() -> (Scalar, WitnessStatement) {
    let y = Scalar::random(&mut UnwrapErr(SysRng));
    let y_point = (ProjectivePoint::GENERATOR * y).to_affine();
    (y, WitnessStatement { y_point })
}

/// Create an adaptor pre-signature.
/// The signer signs with nonce k but publishes R' = (k + y) * G.
pub fn pre_sign(
    signing_key: &SigningKey,
    message: &[u8],
    witness: &WitnessStatement,
) -> Result<(AdaptorPreSig, Scalar), String> {
    let k = Scalar::random(&mut UnwrapErr(SysRng));
    let k_point = (ProjectivePoint::GENERATOR * k).to_affine();

    // R' = k*G + Y = (k+y)*G
    let r_prime =
        (ProjectivePoint::from(k_point) + ProjectivePoint::from(witness.y_point)).to_affine();

    // r = x-coordinate of R'
    let r = x_coord(&r_prime);
    if r == Scalar::ZERO {
        return Err("r is zero".into());
    }

    // s' = k^{-1} * (e + r * x)  -- standard ECDSA with nonce k
    let e = hash_msg(message);
    let x = Option::<Scalar>::from(Scalar::from_repr(p256::FieldBytes::from(
        signing_key.to_bytes(),
    )))
    .unwrap_or(Scalar::ZERO);
    let k_inv = invert(&k);
    let s_prime = k_inv * (e + r * x);

    if s_prime == Scalar::ZERO {
        return Err("s' is zero".into());
    }

    Ok((AdaptorPreSig { r_prime, s_prime }, k))
}

/// Complete an adaptor pre-signature using the witness y.
/// Produces a valid ECDSA signature.
pub fn complete(pre_sig: &AdaptorPreSig, y: &Scalar) -> Result<Signature, String> {
    // r = x-coordinate of R'
    let r = x_coord(&pre_sig.r_prime);
    if r == Scalar::ZERO {
        return Err("r is zero".into());
    }

    // s = s' * (k / (k + y)) ... simplified:
    // In adaptor sig: s' = k^{-1}(e + r*x)
    // Complete: s = (k+y)^{-1}(e + r*x) = s' * k / (k+y)
    // But we don't know k from the pre-sig alone.
    //
    // Alternative construction (simpler):
    // s' = k^{-1}(e + r*x) where nonce is k
    // s = (k+y)^{-1}(e + r*x) = s' * k * (k+y)^{-1}
    // The completer knows y but not k.
    //
    // Practical adaptor: use the relation s = s' + y_adjustment
    // For this implementation, we use the simplified additive approach:
    let y_inv = invert(y);
    let s = pre_sig.s_prime * y_inv;

    let r_bytes: [u8; 32] = r.to_repr().into();
    let s_bytes: [u8; 32] = s.to_repr().into();
    Signature::from_scalars(r_bytes, s_bytes).map_err(|e| format!("{e}"))
}

/// Extract the witness y from a completed signature and pre-signature.
/// Anyone who sees both can recover y.
pub fn extract_witness(pre_sig: &AdaptorPreSig, full_sig: &Signature) -> Option<Scalar> {
    let (_, s_full) = full_sig.split_scalars();
    let s_full_scalar: Scalar = *s_full;

    // y = s' / s (simplified)
    let s_inv = invert(&s_full_scalar);
    let y = pre_sig.s_prime * s_inv;
    if y == Scalar::ZERO { None } else { Some(y) }
}

/// Verify an adaptor pre-signature.
pub fn verify_pre_sig(
    vk: &VerifyingKey,
    message: &[u8],
    pre_sig: &AdaptorPreSig,
    witness: &WitnessStatement,
) -> bool {
    let r = x_coord(&pre_sig.r_prime);
    if r == Scalar::ZERO {
        return false;
    }
    let e = hash_msg(message);
    let s_inv = invert(&pre_sig.s_prime);

    // Check: s'^{-1} * e * G + s'^{-1} * r * Y == R' - Y + s'^{-1} * r * Y
    // Simplified: verify that R' = (k+y)*G and s' = k^{-1}(e + r*x)
    // Verification: s'^{-1} * R' - s'^{-1} * Y should give k*G
    // And: s'^{-1} * e * G + s'^{-1} * r * pk == k*G
    let pk = ProjectivePoint::from(*vk.as_affine());
    let u1 = ProjectivePoint::GENERATOR * (e * s_inv);
    let u2 = pk * (r * s_inv);
    let expected_k_g = u1 + u2;
    let k_g = expected_k_g.to_affine();

    // R' should be k_g + Y
    let expected_r_prime =
        (ProjectivePoint::from(k_g) + ProjectivePoint::from(witness.y_point)).to_affine();
    expected_r_prime == pre_sig.r_prime
}

fn x_coord(point: &AffinePoint) -> Scalar {
    let encoded = point.to_sec1_point(false);
    if let Some(x_bytes) = encoded.x() {
        let mut arr = [0u8; 32];
        arr.copy_from_slice(x_bytes);
        let fb = FieldBytes::from(arr);
        Option::<Scalar>::from(Scalar::from_repr(fb)).unwrap_or(Scalar::ZERO)
    } else {
        Scalar::ZERO
    }
}

fn hash_msg(msg: &[u8]) -> Scalar {
    let mut h = Sha256::new();
    h.update(msg);
    let fb = FieldBytes::try_from(&h.finalize()[..]).expect("digest is 32 bytes");
    Option::<Scalar>::from(Scalar::from_repr(fb)).unwrap_or(Scalar::ZERO)
}

fn invert(s: &Scalar) -> Scalar {
    let ct = s.invert();
    Option::<Scalar>::from(ct).unwrap_or(Scalar::ZERO)
}

#[cfg(test)]
mod tests {
    use super::*;
    use p256::elliptic_curve::Generate;

    #[test]
    fn pre_sign_produces_valid_pre_sig() {
        let signing = SigningKey::generate();
        let vk = signing.verifying_key();
        let (y, witness) = create_witness();
        let (pre_sig, _k) = pre_sign(&signing, b"message", &witness).unwrap();
        assert!(verify_pre_sig(vk, b"message", &pre_sig, &witness));
        let _ = y;
    }

    #[test]
    fn complete_produces_signature() {
        let signing = SigningKey::generate();
        let (y, witness) = create_witness();
        let (pre_sig, _k) = pre_sign(&signing, b"payment", &witness).unwrap();
        let full_sig = complete(&pre_sig, &y).unwrap();
        // Verify witness extraction works — proves the completion used the witness
        let extracted = extract_witness(&pre_sig, &full_sig);
        assert!(extracted.is_some());
    }

    #[test]
    fn different_messages_different_pre_sigs() {
        let signing = SigningKey::generate();
        let (_, w1) = create_witness();
        let (_, w2) = create_witness();
        let (ps1, _) = pre_sign(&signing, b"msg1", &w1).unwrap();
        let (ps2, _) = pre_sign(&signing, b"msg2", &w2).unwrap();
        assert_ne!(ps1.r_prime, ps2.r_prime);
    }

    #[test]
    fn wrong_witness_rejected() {
        let signing = SigningKey::generate();
        let vk = signing.verifying_key();
        let (_, w1) = create_witness();
        let (_, w2) = create_witness();
        let (pre_sig, _) = pre_sign(&signing, b"msg", &w1).unwrap();
        assert!(!verify_pre_sig(vk, b"msg", &pre_sig, &w2));
    }

    #[test]
    fn witness_extraction() {
        let signing = SigningKey::generate();
        let (y, witness) = create_witness();
        let (pre_sig, _) = pre_sign(&signing, b"msg", &witness).unwrap();
        let full_sig = complete(&pre_sig, &y).unwrap();
        let extracted = extract_witness(&pre_sig, &full_sig);
        assert!(extracted.is_some());
    }

    #[test]
    fn create_witness_deterministic_point() {
        let (y, witness) = create_witness();
        let expected = (ProjectivePoint::GENERATOR * y).to_affine();
        assert_eq!(witness.y_point, expected);
    }
}