om_crypto_types/bls12381/

pop.rs

//! Proof-of-Possession (PoP) Implementation
//!
//! Proofs-of-possession (PoPs) are used to prevent rogue-key attacks in BLS
//! multisignatures and aggregate signatures.

use std::{
    fmt,
    io::{Read, Write},
};

use blst::BLST_ERROR;
use serde::{Deserialize, Deserializer, Serialize, Serializer};

use crate::{
    bls12381::{DST_BLS_POP_IN_G1, PrivateKey, PublicKey},
    error::{CryptoError, CryptoResult},
    io::{Export, Import},
};

/// A proof-of-possession (PoP) for a BLS private key
///
/// This is essentially a BLS signature on the public key itself,
/// proving that the signer knows the private key corresponding to the public
/// key.
#[derive(Clone, Debug, Eq, PartialEq, Hash, PartialOrd, Ord)]
pub struct ProofOfPossession {
    pub(crate) pop: [u8; Self::LENGTH],
}

impl Serialize for ProofOfPossession {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        if serializer.is_human_readable() {
            serializer.serialize_str(&hex::encode(self.pop))
        } else {
            serializer.serialize_bytes(&self.pop)
        }
    }
}

impl<'de> Deserialize<'de> for ProofOfPossession {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        if deserializer.is_human_readable() {
            let s: String = String::deserialize(deserializer)?;
            let bytes = hex::decode(s.trim_start_matches("0x")).map_err(serde::de::Error::custom)?;
            Self::from_bytes(&bytes).map_err(serde::de::Error::custom)
        } else {
            let bytes: Vec<u8> = Vec::deserialize(deserializer)?;
            Self::from_bytes(&bytes).map_err(serde::de::Error::custom)
        }
    }
}

impl ProofOfPossession {
    /// The length of a serialized PoP (48 bytes, same as a signature)
    pub const LENGTH: usize = 48;

    /// Create a proof-of-possession for a private key
    ///
    /// This signs the public key with the private key using a different domain
    /// separation tag than regular message signing.
    pub fn create(private_key: &PrivateKey, public_key: &PublicKey) -> Self {
        let pk_bytes = public_key.to_bytes();
        let pop = private_key.key.sign(&pk_bytes, DST_BLS_POP_IN_G1, &[]);
        Self { pop: pop.to_bytes() }
    }

    /// Verify a proof-of-possession
    ///
    /// This implicitly subgroup-checks both the PoP and the public key,
    /// so the caller doesn't need to do it manually.
    pub fn verify(&self, public_key: &PublicKey) -> CryptoResult<()> {
        let pop = blst::min_sig::Signature::from_bytes(&self.pop)
            .map_err(|_| CryptoError::ProofOfPossessionError("invalid PoP bytes".to_string()))?;

        let pk = blst::min_sig::PublicKey::from_bytes(&public_key.key)
            .map_err(|_| CryptoError::InvalidPublicKey("invalid BLS public key bytes".to_string()))?;

        let pk_bytes = public_key.to_bytes();

        // Verify with pk_validate=true to subgroup-check the public key
        let result = pop.verify(true, &pk_bytes, DST_BLS_POP_IN_G1, &[], &pk, true);

        if result == BLST_ERROR::BLST_SUCCESS {
            Ok(())
        } else {
            Err(CryptoError::ProofOfPossessionError(format!(
                "verification failed: {:?}",
                result
            )))
        }
    }

    /// Serialize the PoP to bytes
    pub fn to_bytes(&self) -> [u8; Self::LENGTH] {
        self.pop
    }

    /// Deserialize a PoP from bytes
    ///
    /// WARNING: Does NOT subgroup-check the PoP! This is done implicitly during
    /// verification.
    pub fn from_bytes(bytes: &[u8]) -> CryptoResult<Self> {
        if bytes.len() != Self::LENGTH {
            return Err(CryptoError::ProofOfPossessionError("invalid PoP length".to_string()));
        }
        let pop = <[u8; Self::LENGTH]>::try_from(bytes)
            .map_err(|_| CryptoError::ProofOfPossessionError("invalid PoP".to_string()))?;
        Ok(Self { pop })
    }

    /// Subgroup-check the PoP
    ///
    /// WARNING: This is done implicitly during verification, so you typically
    /// don't need to call this separately.
    pub fn subgroup_check(&self) -> CryptoResult<()> {
        let pop = blst::min_sig::Signature::from_bytes(&self.pop)
            .map_err(|_| CryptoError::ProofOfPossessionError("invalid PoP bytes".to_string()))?;
        pop.validate(true)
            .map_err(|e| CryptoError::ProofOfPossessionError(format!("subgroup check failed: {:?}", e)))
    }
}

impl fmt::Display for ProofOfPossession {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "0x{}", hex::encode(self.pop))
    }
}

impl Export<true> for ProofOfPossession {
    fn export<W: Write>(&self, writer: &mut W) -> crate::io::Result<()> {
        self.to_bytes().as_slice().export(writer)
    }
}

impl Import<true> for ProofOfPossession {
    fn import<R: Read>(reader: &mut R) -> crate::io::Result<Self> {
        let bytes = Vec::<u8>::import(reader)?;
        Self::from_bytes(&bytes)
            .map_err(|e| crate::io::IoError::Other(format!("Failed to import BLS proof of possession: {}", e)))
    }
}

#[cfg(test)]
mod tests {
    use rand::rngs::OsRng;

    use super::*;

    #[test]
    fn test_pop_create_and_verify() {
        let mut rng = OsRng;
        let sk = PrivateKey::generate(&mut rng);
        let pk = PublicKey::from(&sk);

        let pop = ProofOfPossession::create(&sk, &pk);
        assert!(pop.verify(&pk).is_ok());
    }

    #[test]
    fn test_pop_verify_wrong_key() {
        let mut rng = OsRng;
        let sk1 = PrivateKey::generate(&mut rng);
        let sk2 = PrivateKey::generate(&mut rng);
        let pk1 = PublicKey::from(&sk1);
        let pk2 = PublicKey::from(&sk2);

        let pop1 = ProofOfPossession::create(&sk1, &pk1);

        // PoP for pk1 should not verify against pk2
        assert!(pop1.verify(&pk2).is_err());
    }

    #[test]
    fn test_pop_serialization() {
        let mut rng = OsRng;
        let sk = PrivateKey::generate(&mut rng);
        let pk = PublicKey::from(&sk);

        let pop1 = ProofOfPossession::create(&sk, &pk);
        let pop_bytes = pop1.to_bytes();
        let pop2 = ProofOfPossession::from_bytes(&pop_bytes).unwrap();

        assert_eq!(pop1, pop2);
        assert!(pop2.verify(&pk).is_ok());
    }

    #[test]
    fn test_pop_multiple_validators() {
        let mut rng = OsRng;
        let num_validators = 10;

        for _ in 0..num_validators {
            let sk = PrivateKey::generate(&mut rng);
            let pk = PublicKey::from(&sk);
            let pop = ProofOfPossession::create(&sk, &pk);

            assert!(pop.verify(&pk).is_ok());
        }
    }
}