view release on metacpan or  search on metacpan

libsecp256k1/include/secp256k1_ellswift.h  view on Meta::CPAN

#ifndef SECP256K1_ELLSWIFT_H
#define SECP256K1_ELLSWIFT_H

#include "secp256k1.h"

#ifdef __cplusplus
extern "C" {
#endif

/* This module provides an implementation of ElligatorSwift as well as a
 * version of x-only ECDH using it (including compatibility with BIP324).
 *
 * ElligatorSwift is described in https://eprint.iacr.org/2022/759 by
 * Chavez-Saab, Rodriguez-Henriquez, and Tibouchi. It permits encoding
 * uniformly chosen public keys as 64-byte arrays which are indistinguishable
 * from uniformly random arrays.
 *
 * Let f be the function from pairs of field elements to point X coordinates,
 * defined as follows (all operations modulo p = 2^256 - 2^32 - 977)
 * f(u,t):
 * - Let C = 0xa2d2ba93507f1df233770c2a797962cc61f6d15da14ecd47d8d27ae1cd5f852,
 *   a square root of -3.
 * - If u=0, set u=1 instead.
 * - If t=0, set t=1 instead.
 * - If u^3 + t^2 + 7 = 0, multiply t by 2.
 * - Let X = (u^3 + 7 - t^2) / (2 * t)
 * - Let Y = (X + t) / (C * u)
 * - Return the first in [u + 4 * Y^2, (-X/Y - u) / 2, (X/Y - u) / 2] that is an
 *   X coordinate on the curve (at least one of them is, for any u and t).
 *
 * Then an ElligatorSwift encoding of x consists of the 32-byte big-endian
 * encodings of field elements u and t concatenated, where f(u,t) = x.
 * The encoding algorithm is described in the paper, and effectively picks a
 * uniformly random pair (u,t) among those which encode x.
 *
 * If the Y coordinate is relevant, it is given the same parity as t.
 *
 * Changes w.r.t. the paper:
 * - The u=0, t=0, and u^3+t^2+7=0 conditions result in decoding to the point
 *   at infinity in the paper. Here they are remapped to finite points.
 * - The paper uses an additional encoding bit for the parity of y. Here the
 *   parity of t is used (negating t does not affect the decoded x coordinate,
 *   so this is possible).
 *
 * For mathematical background about the scheme, see the doc/ellswift.md file.
 */

/** A pointer to a function used by secp256k1_ellswift_xdh to hash the shared X
 *  coordinate along with the encoded public keys to a uniform shared secret.
 *
 *  Returns: 1 if a shared secret was successfully computed.
 *           0 will cause secp256k1_ellswift_xdh to fail and return 0.
 *           Other return values are not allowed, and the behaviour of
 *           secp256k1_ellswift_xdh is undefined for other return values.
 *  Out:     output:     pointer to an array to be filled by the function
 *  In:      x32:        pointer to the 32-byte serialized X coordinate
 *                       of the resulting shared point (will not be NULL)
 *           ell_a64:    pointer to the 64-byte encoded public key of party A
 *                       (will not be NULL)
 *           ell_b64:    pointer to the 64-byte encoded public key of party B
 *                       (will not be NULL)
 *           data:       arbitrary data pointer that is passed through
 */
typedef int (*secp256k1_ellswift_xdh_hash_function)(
    unsigned char *output,
    const unsigned char *x32,
    const unsigned char *ell_a64,
    const unsigned char *ell_b64,
    void *data
);

/** An implementation of an secp256k1_ellswift_xdh_hash_function which uses
 *  SHA256(prefix64 || ell_a64 || ell_b64 || x32), where prefix64 is the 64-byte
 *  array pointed to by data. */
SECP256K1_API const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_prefix;

/** An implementation of an secp256k1_ellswift_xdh_hash_function compatible with
 *  BIP324. It returns H_tag(ell_a64 || ell_b64 || x32), where H_tag is the
 *  BIP340 tagged hash function with tag "bip324_ellswift_xonly_ecdh". Equivalent
 *  to secp256k1_ellswift_xdh_hash_function_prefix with prefix64 set to
 *  SHA256("bip324_ellswift_xonly_ecdh")||SHA256("bip324_ellswift_xonly_ecdh").
 *  The data argument is ignored. */
SECP256K1_API const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_bip324;

/** Construct a 64-byte ElligatorSwift encoding of a given pubkey.
 *
 *  Returns: 1 always.
 *  Args:    ctx:        pointer to a context object
 *  Out:     ell64:      pointer to a 64-byte array to be filled
 *  In:      pubkey:     pointer to a secp256k1_pubkey containing an
 *                       initialized public key
 *           rnd32:      pointer to 32 bytes of randomness
 *
 * It is recommended that rnd32 consists of 32 uniformly random bytes, not
 * known to any adversary trying to detect whether public keys are being
 * encoded, though 16 bytes of randomness (padded to an array of 32 bytes,
 * e.g., with zeros) suffice to make the result indistinguishable from
 * uniform. The randomness in rnd32 must not be a deterministic function of
 * the pubkey (it can be derived from the private key, though).
 *
 * It is not guaranteed that the computed encoding is stable across versions
 * of the library, even if all arguments to this function (including rnd32)
 * are the same.
 *
 * This function runs in variable time.