Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto, refactor: add new KeyPair class #30051

Merged
merged 6 commits into from
Aug 7, 2024
Merged

crypto, refactor: add new KeyPair class #30051

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f14900b
bench: add benchmark for signing with a taptweak
josibake Aug 3, 2024
5d507a0
tests: add key tweak smoke test
josibake Jul 21, 2024
c39fd39
crypto: add KeyPair wrapper class
josibake Jul 16, 2024
cebb08b
refactor: move SignSchnorr to KeyPair
josibake Jul 16, 2024
72a5822
tests: add tests for KeyPair
josibake Jul 16, 2024
ec973dd
refactor: remove un-tested early returns
josibake Aug 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions src/bench/sign_transaction.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
#include <script/script.h>
#include <script/sign.h>
#include <uint256.h>
#include <test/util/random.h>
#include <util/translation.h>

enum class InputType {
Expand Down Expand Up @@ -66,5 +67,33 @@ static void SignTransactionSingleInput(benchmark::Bench& bench, InputType input_
static void SignTransactionECDSA(benchmark::Bench& bench) { SignTransactionSingleInput(bench, InputType::P2WPKH); }
static void SignTransactionSchnorr(benchmark::Bench& bench) { SignTransactionSingleInput(bench, InputType::P2TR); }

static void SignSchnorrTapTweakBenchmark(benchmark::Bench& bench, bool use_null_merkle_root)
{
ECC_Context ecc_context{};

auto key = GenerateRandomKey();
auto msg = InsecureRand256();
auto merkle_root = use_null_merkle_root ? uint256() : InsecureRand256();
auto aux = InsecureRand256();
std::vector<unsigned char> sig(64);

bench.minEpochIterations(100).run([&] {
bool success = key.SignSchnorr(msg, sig, &merkle_root, aux);
assert(success);
});
}

static void SignSchnorrWithMerkleRoot(benchmark::Bench& bench)
{
SignSchnorrTapTweakBenchmark(bench, /*use_null_merkle_root=*/false);
}

static void SignSchnorrWithNullMerkleRoot(benchmark::Bench& bench)
{
SignSchnorrTapTweakBenchmark(bench, /*use_null_merkle_root=*/true);
}

BENCHMARK(SignTransactionECDSA, benchmark::PriorityLevel::HIGH);
BENCHMARK(SignTransactionSchnorr, benchmark::PriorityLevel::HIGH);
BENCHMARK(SignSchnorrWithMerkleRoot, benchmark::PriorityLevel::HIGH);
BENCHMARK(SignSchnorrWithNullMerkleRoot, benchmark::PriorityLevel::HIGH);
61 changes: 40 additions & 21 deletions src/key.cpp
View file
Open in desktop
josibake marked this conversation as resolved.
Show resolved Hide resolved
josibake marked this conversation as resolved.
Show resolved Hide resolved
josibake marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -271,27 +271,8 @@ bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig)

bool CKey::SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint256* merkle_root, const uint256& aux) const
{
assert(sig.size() == 64);
josibake marked this conversation as resolved.
Show resolved Hide resolved
secp256k1_keypair keypair;
if (!secp256k1_keypair_create(secp256k1_context_sign, &keypair, UCharCast(begin()))) return false;
if (merkle_root) {
secp256k1_xonly_pubkey pubkey;
if (!secp256k1_keypair_xonly_pub(secp256k1_context_sign, &pubkey, nullptr, &keypair)) return false;
unsigned char pubkey_bytes[32];
if (!secp256k1_xonly_pubkey_serialize(secp256k1_context_sign, pubkey_bytes, &pubkey)) return false;
uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
if (!secp256k1_keypair_xonly_tweak_add(secp256k1_context_static, &keypair, tweak.data())) return false;
}
bool ret = secp256k1_schnorrsig_sign32(secp256k1_context_sign, sig.data(), hash.data(), &keypair, aux.data());
if (ret) {
// Additional verification step to prevent using a potentially corrupted signature
secp256k1_xonly_pubkey pubkey_verify;
ret = secp256k1_keypair_xonly_pub(secp256k1_context_static, &pubkey_verify, nullptr, &keypair);
ret &= secp256k1_schnorrsig_verify(secp256k1_context_static, sig.data(), hash.begin(), 32, &pubkey_verify);
}
if (!ret) memory_cleanse(sig.data(), sig.size());
memory_cleanse(&keypair, sizeof(keypair));
return ret;
KeyPair kp = ComputeKeyPair(merkle_root);
josibake marked this conversation as resolved.
Show resolved Hide resolved
return kp.SignSchnorr(hash, sig, aux);
}

bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
Expand Down Expand Up @@ -363,6 +344,11 @@ ECDHSecret CKey::ComputeBIP324ECDHSecret(const EllSwiftPubKey& their_ellswift, c
return output;
}

KeyPair CKey::ComputeKeyPair(const uint256* merkle_root) const
{
return KeyPair(*this, merkle_root);
}

CKey GenerateRandomKey(bool compressed) noexcept
{
CKey key;
Expand Down Expand Up @@ -420,6 +406,39 @@ void CExtKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
if ((nDepth == 0 && (nChild != 0 || ReadLE32(vchFingerprint) != 0)) || code[41] != 0) key = CKey();
}

KeyPair::KeyPair(const CKey& key, const uint256* merkle_root)
{
static_assert(std::tuple_size<KeyType>() == sizeof(secp256k1_keypair));
MakeKeyPairData();
auto keypair = reinterpret_cast<secp256k1_keypair*>(m_keypair->data());
bool success = secp256k1_keypair_create(secp256k1_context_sign, keypair, UCharCast(key.data()));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice adding ec973dd

if (success && merkle_root) {
secp256k1_xonly_pubkey pubkey;
unsigned char pubkey_bytes[32];
assert(secp256k1_keypair_xonly_pub(secp256k1_context_sign, &pubkey, nullptr, keypair));
assert(secp256k1_xonly_pubkey_serialize(secp256k1_context_sign, pubkey_bytes, &pubkey));
Comment on lines +418 to +419
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: AFAIR, for a long time we preferred to store the return value in a ret boolean and assert only on that (see e.g. $ git grep ret.*secp256k1 vs $ git grep assert.*secp256k1), but not sure if we still have a developer guideline like "don't use assert with side-effects" in place (I think we once had, and removed it, so this way seems to be fine.)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've had something like that before: #30051 (comment)

But it was ambiguous, as to whether it can fail or not during execution as we can see here:
https://github.com/hebasto/bitcoin/blob/master/src/pubkey.cpp#L345-L350 or https://github.com/hebasto/bitcoin/blob/master/src/secp256k1/src/secp256k1.c#L685

But @josibake argued that they cannot fail at that point - if they do it's a bug, but we didn't want to ignore the return values either. So we ended up asserting, like we did in GetPubKey already.

uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
success = secp256k1_keypair_xonly_tweak_add(secp256k1_context_static, keypair, tweak.data());
}
if (!success) ClearKeyPairData();
}

bool KeyPair::SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint256& aux) const
{
assert(sig.size() == 64);
josibake marked this conversation as resolved.
Show resolved Hide resolved
josibake marked this conversation as resolved.
Show resolved Hide resolved
if (!IsValid()) return false;
auto keypair = reinterpret_cast<const secp256k1_keypair*>(m_keypair->data());
bool ret = secp256k1_schnorrsig_sign32(secp256k1_context_sign, sig.data(), hash.data(), keypair, aux.data());
if (ret) {
// Additional verification step to prevent using a potentially corrupted signature
secp256k1_xonly_pubkey pubkey_verify;
ret = secp256k1_keypair_xonly_pub(secp256k1_context_static, &pubkey_verify, nullptr, keypair);
ret &= secp256k1_schnorrsig_verify(secp256k1_context_static, sig.data(), hash.begin(), 32, &pubkey_verify);
}
if (!ret) memory_cleanse(sig.data(), sig.size());
return ret;
}

bool ECC_InitSanityCheck() {
CKey key = GenerateRandomKey();
CPubKey pubkey = key.GetPubKey();
Expand Down
73 changes: 73 additions & 0 deletions src/key.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ constexpr static size_t ECDH_SECRET_SIZE = CSHA256::OUTPUT_SIZE;
// Used to represent ECDH shared secret (ECDH_SECRET_SIZE bytes)
using ECDHSecret = std::array<std::byte, ECDH_SECRET_SIZE>;

class KeyPair;

/** An encapsulated private key. */
class CKey
{
Expand Down Expand Up @@ -202,6 +204,22 @@ class CKey
ECDHSecret ComputeBIP324ECDHSecret(const EllSwiftPubKey& their_ellswift,
const EllSwiftPubKey& our_ellswift,
bool initiating) const;
/** Compute a KeyPair
*
* Wraps a `secp256k1_keypair` type.
*
* `merkle_root` is used to optionally perform tweaking of
* the internal key, as specified in BIP341:
*
* - If merkle_root == nullptr: no tweaking is done, use the internal key directly (this is
* used for signatures in BIP342 script).
* - If merkle_root->IsNull(): tweak the internal key with H_TapTweak(pubkey) (this is used for
* key path spending when no scripts are present).
* - Otherwise: tweak the internal key with H_TapTweak(pubkey || *merkle_root)
* (this is used for key path spending with the
* Merkle root of the script tree).
*/
KeyPair ComputeKeyPair(const uint256* merkle_root) const;
josibake marked this conversation as resolved.
Show resolved Hide resolved
};

CKey GenerateRandomKey(bool compressed = true) noexcept;
Expand Down Expand Up @@ -235,6 +253,61 @@ struct CExtKey {
void SetSeed(Span<const std::byte> seed);
};

/** KeyPair
josibake marked this conversation as resolved.
Show resolved Hide resolved
*
* Wraps a `secp256k1_keypair` type, an opaque data structure for holding a secret and public key.
* This is intended for BIP340 keys and allows us to easily determine if the secret key needs to
* be negated by checking the parity of the public key. This class primarily intended for passing
* secret keys to libsecp256k1 functions expecting a `secp256k1_keypair`. For all other cases,
* CKey should be preferred.
*
* A KeyPair can be created from a CKey with an optional merkle_root tweak (per BIP342). See
* CKey::ComputeKeyPair for more details.
*/
class KeyPair
{
public:
KeyPair() noexcept = default;
KeyPair(KeyPair&&) noexcept = default;
KeyPair& operator=(KeyPair&&) noexcept = default;
KeyPair& operator=(const KeyPair& other)
{
if (this != &other) {
if (other.m_keypair) {
MakeKeyPairData();
*m_keypair = *other.m_keypair;
} else {
ClearKeyPairData();
}
}
return *this;
}

KeyPair(const KeyPair& other) { *this = other; }

friend KeyPair CKey::ComputeKeyPair(const uint256* merkle_root) const;
[[nodiscard]] bool SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint256& aux) const;

//! Check whether this keypair is valid.
bool IsValid() const { return !!m_keypair; }

private:
KeyPair(const CKey& key, const uint256* merkle_root);

using KeyType = std::array<unsigned char, 96>;
josibake marked this conversation as resolved.
Show resolved Hide resolved
secure_unique_ptr<KeyType> m_keypair;

void MakeKeyPairData()
{
if (!m_keypair) m_keypair = make_secure_unique<KeyType>();
}

void ClearKeyPairData()
{
m_keypair.reset();
}
};

/** Check that required EC support is available at runtime. */
bool ECC_InitSanityCheck();

Expand Down
41 changes: 41 additions & 0 deletions src/test/key_tests.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
#include <key_io.h>
#include <span.h>
#include <streams.h>
#include <secp256k1_extrakeys.h>
#include <test/util/random.h>
#include <test/util/setup_common.h>
#include <uint256.h>
Expand Down Expand Up @@ -299,6 +300,13 @@ BOOST_AUTO_TEST_CASE(bip340_test_vectors)
// Verify those signatures for good measure.
josibake marked this conversation as resolved.
Show resolved Hide resolved
BOOST_CHECK(pubkey.VerifySchnorr(msg256, sig64));

// Repeat the same check, but use the KeyPair directly without any merkle tweak
KeyPair keypair = key.ComputeKeyPair(/*merkle_root=*/nullptr);
bool kp_ok = keypair.SignSchnorr(msg256, sig64, aux256);
BOOST_CHECK(kp_ok);
BOOST_CHECK(pubkey.VerifySchnorr(msg256, sig64));
BOOST_CHECK(std::vector<unsigned char>(sig64, sig64 + 64) == sig);
josibake marked this conversation as resolved.
Show resolved Hide resolved

// Do 10 iterations where we sign with a random Merkle root to tweak,
// and compare against the resulting tweaked keys, with random aux.
// In iteration i=0 we tweak with empty Merkle tree.
Expand All @@ -312,6 +320,12 @@ BOOST_AUTO_TEST_CASE(bip340_test_vectors)
bool ok = key.SignSchnorr(msg256, sig64, &merkle_root, aux256);
BOOST_CHECK(ok);
BOOST_CHECK(tweaked_key.VerifySchnorr(msg256, sig64));

// Repeat the same check, but use the KeyPair class directly
KeyPair keypair = key.ComputeKeyPair(&merkle_root);
bool kp_ok = keypair.SignSchnorr(msg256, sig64, aux256);
BOOST_CHECK(kp_ok);
BOOST_CHECK(tweaked_key.VerifySchnorr(msg256, sig64));
}
}
}
Expand Down Expand Up @@ -345,4 +359,31 @@ BOOST_AUTO_TEST_CASE(bip341_test_h)
BOOST_CHECK(XOnlyPubKey::NUMS_H == H);
}

BOOST_AUTO_TEST_CASE(key_schnorr_tweak_smoke_test)
{
// Sanity check to ensure we get the same tweak using CPubKey vs secp256k1 functions
secp256k1_context* secp256k1_context_sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit:
secp256k1_context_create docs says

 The only valid non-deprecated flag in recent library versions is
 *  SECP256K1_CONTEXT_NONE, which will create a context sufficient for all functionality
 *  offered by the library. All other (deprecated) flags will be treated as equivalent
 *  to the SECP256K1_CONTEXT_NONE flag.
Suggested change
secp256k1_context* secp256k1_context_sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
secp256k1_context* secp256k1_context_sign = secp256k1_context_create(SECP256K1_CONTEXT_NONE);

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, nice! Good catch. Will change if I end up retouching.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you do that, please change other usages as well

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, did a quick grep and it looks there is at least one other place in the fuzz tests where _SIGN is used, so this one is probably best as a follow up PR to replace all instances with _NONE in the codebase and perhaps add a mention to the developer notes.


CKey key;
key.MakeNewKey(true);
Comment on lines +367 to +368
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit, if you have to retouch:

Suggested change
CKey key;
key.MakeNewKey(true);
CKey key = GenerateRandomKey();

uint256 merkle_root = InsecureRand256();

// secp256k1 functions
secp256k1_keypair keypair;
BOOST_CHECK(secp256k1_keypair_create(secp256k1_context_sign, &keypair, UCharCast(key.begin())));
secp256k1_xonly_pubkey xonly_pubkey;
BOOST_CHECK(secp256k1_keypair_xonly_pub(secp256k1_context_sign, &xonly_pubkey, nullptr, &keypair));
unsigned char xonly_bytes[32];
BOOST_CHECK(secp256k1_xonly_pubkey_serialize(secp256k1_context_sign, xonly_bytes, &xonly_pubkey));
uint256 tweak_old = XOnlyPubKey(xonly_bytes).ComputeTapTweakHash(&merkle_root);

// CPubKey
CPubKey pubkey = key.GetPubKey();
uint256 tweak_new = XOnlyPubKey(pubkey).ComputeTapTweakHash(&merkle_root);
Comment on lines +378 to +382
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this effectively only tests that given a certain private key, the same XOnlyPubKey objects result with both used methods (once via the secp256k1 keypair functions, once with .GetPubKey()). So strictly speaking computing and comparing the tweak hashes on top of that isn't needed and could be removed, but no strong feelings about that, as it also doesn't hurt. (Seems like this was already discussed in #30051 (comment) ff., so feel free to ignore).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was the result of a change that was reverted since, where it was important to test the exact before/after structure.


BOOST_CHECK_EQUAL(tweak_old, tweak_new);

secp256k1_context_destroy(secp256k1_context_sign);
}

BOOST_AUTO_TEST_SUITE_END()
Loading