Add schnorrsig module which implements BIP-340 compliant signatures by jonasnick · Pull Request #558 · bitcoin-core/secp256k1

jonasnick · 2018-09-25T15:33:00Z

This PR implements signing, verification and batch verification as described in BIP-340 in an experimental module named schnorrsig. It includes the test vectors and a benchmarking tool.
This PR also adds a module extrakeys that allows BIP-341-style key tweaking.

(Adding ChaCha20 as a CSPRNG and batch verification was moved to PR #760).

In order to enable the module run ./configure with --enable-experimental --enable-module-schnorrsig.

Based on apoelstra's work.

jonasnick · 2018-09-25T16:54:22Z

Replaced the chacha20 commit with a similar commit from secp256k1-zkp (BlockstreamResearch/secp256k1-zkp@c3794f9).

apoelstra · 2018-09-26T15:58:38Z

ACK except nit about sha object, bikeshedding about the module name, and also I did not check that the static test vectors match those in the BIP.

gmaxwell · 2018-09-30T00:19:53Z

Maybe we should consider adopting an anti-covert-channel warden workflow as the standard interface for this function?

jimpo

Nice! Such hype.

I skipped the tests, hoping to get back around to them.

apoelstra · 2018-10-01T15:59:31Z

@gmaxwell By anti-covert channel do you mean essentially sign-to-contracting random data? I would like this. One thing blocking it is that our nonce function does not take a secp context currently, which makes sign-to-contract unergonmic -- see in sighacker how the sign-to-contract context needs to contain a pointer to the secp context.

I think we should fix that but it should probably be in another PR.

jonasnick · 2018-10-02T08:47:02Z

Thanks @jimpo. I added a commit that addresses your comments.

ghost · 2018-10-08T23:59:32Z

how does this relate to #212 ?

apoelstra · 2018-10-09T00:21:02Z

#212 is not secure against rogue-key attacks nor does it commit to the public key being signed for.

jonasnick · 2018-10-09T00:48:20Z

and #212 was removed in #425

real-or-random · 2018-10-12T09:28:55Z

Oh I was not aware of this PR.
FYI, I suggested that a CSPRNG is not enough for batch validation and we need a hash function to generate the seed (https://github.com/sipa/bips/pull/15/files) but now I see that this PR is doing that anyway. :)

jonasnick · 2018-10-15T13:57:36Z

@real-or-random Thanks for the review. I added a commit to address your comments.

jonasnick · 2018-10-24T14:29:58Z

Added a test to increase the coverage of schnorrsig_sign. Now coverage in the schnorrsig module is 100% when excluding the lines that can't be hit. See https://htmlpreview.github.io/?https://raw.githubusercontent.com/jonasnick/secp256k1/schnorrsig-stats/coverage.src_modules_schnorrsig_main_impl.h.html

jonasnick · 2018-11-01T17:34:52Z

squashed and rebased on master

jonasnick · 2018-11-08T11:26:20Z

Added commit that will switch to little endian format when interpreting chacha20 output, replace chacha20 tests with test vectors from the RFC, add sipa's chacha20 test.

real-or-random

ACK f431b3f careful code review

I have a few minor comments in my notes but all of those can be addressed later.

b9c1a76 Squashed 'src/secp256k1/' changes from 2ed54da..8ab24e8 (Pieter Wuille) Pull request description: This updates our src/secp256k1 subtree to the latest libsecp256k1 upstream version. As it adds BIP340 support (see bitcoin-core/secp256k1#558), this is a prerequisite for #17977. In particular, it contains: * A few generic library improvements * Support for x-only public keys as used by BIP340. * Support for "key pair" objects, making signing more efficient by using a precomputed public key. * Signing support for BIP340 Schnorr (single-party) signatures. * Verification support for BIP340 Schnorr signatures. * Support for verifying tweaked x-only keys, as used by BIP341's Taproot construction. Things that are not included: * MuSig, nor any kind of multisignatures, threshold signatures, ... on top. * Batch verification. * Support for variable-length messages in BIP340 (which are still being discussed, but won't affect BIP341, or Bitcoin Core). * A few more generic improvements that are still in the pipeline, including faster modular inversions. ACKs for top commit: instagibbs: ACK 894fb33 fanquake: ACK 894fb33. Any Valgrind concerns will be addressed upstream, see discussion in bitcoin-core/secp256k1#813, and if necessary, can be pulled into our tree prior to the 0.21.0 branch off. They are not a blocker for merging this PR in it's current state. benthecarman: ACK `894fb33` Tree-SHA512: 6dc992f4477069b7fbd223316f1be955750923be1479c38adad2312649fdca1f316edb375c42ef9d97cea2407caaef49fb8c93abd6c037fe1a522910cbbc2479

b9c1a76 Squashed 'src/secp256k1/' changes from 2ed54da..8ab24e8 (Pieter Wuille) Pull request description: This updates our src/secp256k1 subtree to the latest libsecp256k1 upstream version. As it adds BIP340 support (see bitcoin-core/secp256k1#558), this is a prerequisite for bitcoin#17977. In particular, it contains: * A few generic library improvements * Support for x-only public keys as used by BIP340. * Support for "key pair" objects, making signing more efficient by using a precomputed public key. * Signing support for BIP340 Schnorr (single-party) signatures. * Verification support for BIP340 Schnorr signatures. * Support for verifying tweaked x-only keys, as used by BIP341's Taproot construction. Things that are not included: * MuSig, nor any kind of multisignatures, threshold signatures, ... on top. * Batch verification. * Support for variable-length messages in BIP340 (which are still being discussed, but won't affect BIP341, or Bitcoin Core). * A few more generic improvements that are still in the pipeline, including faster modular inversions. ACKs for top commit: instagibbs: ACK 894fb33 fanquake: ACK 894fb33. Any Valgrind concerns will be addressed upstream, see discussion in bitcoin-core/secp256k1#813, and if necessary, can be pulled into our tree prior to the 0.21.0 branch off. They are not a blocker for merging this PR in it's current state. benthecarman: ACK `894fb33` Tree-SHA512: 6dc992f4477069b7fbd223316f1be955750923be1479c38adad2312649fdca1f316edb375c42ef9d97cea2407caaef49fb8c93abd6c037fe1a522910cbbc2479

Summary: This is required to declassify pointers to constant memory. Declassify should never modify its argument. This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@3e08b02 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7636

Summary: This is to prepare for xonly_pubkeys and keypairs. This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@47e6618 Test Plan: ninja check-secp256k1 And with the module on: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Subscribers: Fabien Differential Revision: https://reviews.bitcoinabc.org/D7638

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@4cd2ee4 Depends on D7638 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7639

Summary: This is in preparation for allowing code reuse by xonly tweak add functions This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@176bfb1 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7640

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@910d9c2 Depends on D7639 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7641

Summary: This is in preparation for allowing code reuse by keypair functions This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@f001034 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7642

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@5825446 Depends on D7641 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7643

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@6fcb5b8 Depends on D7643 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7644

Summary: This will be used by the schnorrsig module This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@eabd9bc Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7645

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@7a703fd Test Plan: ninja check-secp256k1 With missing extrakeys: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_SCHNORRSIG=On Check that we get an error. And with the module: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On -DSECP256K1_ENABLE_MODULE_SCHNORRSIG=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7646

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@7332d2d Depends on D7646 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7647

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@4e43520 Depends on D7647 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7648

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@8dfd53e Depends on D7648 Test Plan: ninja bench-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7649

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@16ffa9d Depends on D7649 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7650

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@f431b3f Depends on D7650 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7651

Summary: This is required to declassify pointers to constant memory. Declassify should never modify its argument. This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@3e08b02 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7636

Summary: This is to prepare for xonly_pubkeys and keypairs. This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@47e6618 Test Plan: ninja check-secp256k1 And with the module on: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Subscribers: Fabien Differential Revision: https://reviews.bitcoinabc.org/D7638

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@4cd2ee4 Depends on D7638 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7639

Summary: This is in preparation for allowing code reuse by xonly tweak add functions This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@176bfb1 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7640

Summary: This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@910d9c2 Depends on D7639 Test Plan: cmake -GNinja .. -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=On ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7641

Summary: This is in preparation for allowing code reuse by keypair functions This is a partial backport of secp256k1 [[bitcoin-core/secp256k1#558 | PR558]] : bitcoin-core/secp256k1@f001034 Test Plan: ninja check-secp256k1 Reviewers: #bitcoin_abc, Fabien Reviewed By: #bitcoin_abc, Fabien Differential Revision: https://reviews.bitcoinabc.org/D7642

DesWurstes reviewed Sep 25, 2018

View reviewed changes

Comment thread src/scalar_8x32_impl.h Outdated

jonasnick force-pushed the schnorrsig branch 2 times, most recently from 220012e to 547ad32 Compare September 25, 2018 16:53

apoelstra reviewed Sep 26, 2018

View reviewed changes

Comment thread include/secp256k1_schnorrsig.h Outdated

apoelstra reviewed Sep 26, 2018

View reviewed changes

Comment thread src/modules/schnorrsig/main_impl.h Outdated

jimpo reviewed Sep 30, 2018

View reviewed changes

Christewart mentioned this pull request Oct 3, 2018

Add secp256k1jni bindings for the schnorrsig module in libsecp256k1 bitcoin-s/bitcoin-s#212

Closed

real-or-random reviewed Oct 12, 2018

View reviewed changes

real-or-random reviewed Oct 16, 2018

View reviewed changes

Comment thread src/modules/schnorrsig/main_impl.h Outdated

jonasnick force-pushed the schnorrsig branch from 7d8391d to 8193edd Compare October 16, 2018 16:06

real-or-random mentioned this pull request Oct 28, 2018

Fix integer overflow in ecmult_multi_var when n is large #568

Merged

jonasnick mentioned this pull request Nov 1, 2018

Add anti nonce-sidechannel protocol to schnorrsigs #572

Closed

jonasnick force-pushed the schnorrsig branch 2 times, most recently from bd39a05 to f12dd1a Compare November 1, 2018 17:34

sipa reviewed Nov 5, 2018

View reviewed changes

Comment thread src/tests.c

Comment thread src/scalar_8x32_impl.h Outdated

Comment thread include/secp256k1_schnorrsig.h Outdated

deadalnix reviewed Dec 1, 2018

View reviewed changes

Comment thread src/modules/schnorrsig/tests_impl.h

jonasnick mentioned this pull request Dec 22, 2018

Add MuSig module BlockstreamResearch/secp256k1-zkp#35

Merged

roconnor-blockstream reviewed Sep 10, 2020

View reviewed changes

Comment thread include/secp256k1_schnorrsig.h

real-or-random approved these changes Sep 11, 2020

View reviewed changes

real-or-random merged commit 8ab24e8 into bitcoin-core:master Sep 11, 2020

sipa mentioned this pull request Sep 11, 2020

Update secp256k1 subtree (including BIP340 support) bitcoin/bitcoin#19944

Merged

jonasnick mentioned this pull request Sep 11, 2020

travis: run bench_schnorrsig #812

Merged

sipa mentioned this pull request Sep 12, 2020

Exhaustive test improvements + exhaustive schnorrsig tests #808

Merged

AdamISZ mentioned this pull request Jul 27, 2021

secp256k1 version bump JoinMarket-Org/joinmarket-clientserver#938

Merged

Conversation

jonasnick commented Sep 25, 2018 • edited by real-or-random Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jonasnick commented Sep 25, 2018

Uh oh!

Uh oh!

Uh oh!

apoelstra commented Sep 26, 2018

Uh oh!

gmaxwell commented Sep 30, 2018

Uh oh!

jimpo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

apoelstra commented Oct 1, 2018

Uh oh!

jonasnick commented Oct 2, 2018

Uh oh!

ghost commented Oct 8, 2018

Uh oh!

apoelstra commented Oct 9, 2018

Uh oh!

jonasnick commented Oct 9, 2018

Uh oh!

real-or-random commented Oct 12, 2018

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonasnick commented Oct 15, 2018

Uh oh!

Uh oh!

jonasnick commented Oct 24, 2018

Uh oh!

jonasnick commented Nov 1, 2018

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonasnick commented Nov 8, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

real-or-random left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

jonasnick commented Sep 25, 2018 •

edited by real-or-random

Loading

jonasnick commented Nov 8, 2018 •

edited

Loading