xmr: getting rid of CtKey from the state

- only lightweight objects are kept in the state. CtKey is import heavy object. Each set_out call locally imports a new own version of the Ctkey which causes a memory leak.

src/apps/monero/protocol/signing/state.py

@@ -57,7 +57,7 @@ def __init__(self, ctx):
         self.input_alphas = []
         self.input_pseudo_outs = []
         self.output_sk_masks = []
-        self.output_pk = []
+        self.output_pk_masks = []  # commitments
         self.output_amounts = []
         self.output_masks = []
         self.rsig_type = 0

src/apps/monero/protocol/signing/step_06_set_out1.py

@@ -90,7 +90,7 @@ async def set_out1(state: State, dst_entr, dst_entr_hmac, rsig_data=None):
 
     # Output_pk is stored to the state as it is used during the signature and hashed to the
     # RctSigBase later.
-    state.output_pk.append(out_pk)
+    state.output_pk_masks.append(out_pk.mask)
     state.mem_trace(14, True)
 
     from trezor.messages.MoneroTransactionSetOutputAck import (

src/apps/monero/protocol/signing/step_08_mlsag_done.py

@@ -38,8 +38,8 @@ def _out_pk(state: State):
     """
     Sets out_pk for the incremental hashing mlsag.
     """
-    if state.output_count != len(state.output_pk):
+    if state.output_count != len(state.output_pk_masks):
         raise ValueError("Invalid number of ecdh")
 
-    for out in state.output_pk:
-        state.full_message_hasher.set_out_pk(out)
+    for out in state.output_pk_masks:
+        state.full_message_hasher.set_out_pk_mask(out)

src/apps/monero/protocol/signing/step_09_sign_input.py

@@ -157,7 +157,7 @@ async def sign_input(
             mix_ring,
             [in_sk],
             state.output_sk_masks,
-            state.output_pk,
+            state.output_pk_masks,
             kLRki,
             None,
             index,

src/apps/monero/xmr/mlsag2.py

@@ -177,7 +177,7 @@ def gen_mlsag_ext(message, pk, xx, kLRki, mscout, index, dsRows):
 
 
 def prove_rct_mg(
-    message, pubs, in_sk, out_sk_mask, out_pk, kLRki, mscout, index, txn_fee_key
+    message, pubs, in_sk, out_sk_mask, out_pk_mask, kLRki, mscout, index, txn_fee_key
 ):
     """
     c.f. http://eprint.iacr.org/2015/1098 section 4. definition 10.
@@ -197,7 +197,7 @@ def prove_rct_mg(
 
     if len(in_sk) != rows:
         raise ValueError("Bad inSk size")
-    if len(out_sk_mask) != len(out_pk):
+    if len(out_sk_mask) != len(out_pk_mask):
         raise ValueError("Bad outsk/putpk size")
     if (not kLRki or not mscout) and (kLRki and mscout):
         raise ValueError("Only one of kLRki/mscout is present")
@@ -221,15 +221,15 @@ def prove_rct_mg(
         sk[rows] = crypto.sc_add(sk[rows], in_sk[j].mask)  # add masks in last row
 
     for i in range(cols):
-        for j in range(len(out_pk)):
+        for j in range(len(out_pk_mask)):
             M[i][rows] = crypto.point_sub(
-                M[i][rows], crypto.decodepoint(out_pk[j].mask)
+                M[i][rows], crypto.decodepoint(out_pk_mask[j])
             )  # subtract output Ci's in last row
 
         # Subtract txn fee output in last row
         M[i][rows] = crypto.point_sub(M[i][rows], txn_fee_key)
 
-    for j in range(len(out_pk)):
+    for j in range(len(out_pk_mask)):
         sk[rows] = crypto.sc_sub(
             sk[rows], out_sk_mask[j]
         )  # subtract output masks in last row

src/apps/monero/xmr/sub/mlsag_hasher.py

@@ -72,11 +72,11 @@ def set_ecdh(self, ecdh):
         self.state = 4
         self.rtcsig_hasher.buffer(ecdh)
 
-    def set_out_pk(self, out_pk):
+    def set_out_pk_mask(self, out_pk_mask):
         if self.state != 4 and self.state != 5:
             raise ValueError("State error")
         self.state = 5
-        self.rtcsig_hasher.buffer(out_pk.mask)  # ECKey
+        self.rtcsig_hasher.buffer(out_pk_mask)  # ECKey
 
     def rctsig_base_done(self):
         if self.state != 5: