Line data Source code
1 : #ifndef HEADER_fd_src_ballet_bls_fd_bls_h 2 : #define HEADER_fd_src_ballet_bls_fd_bls_h 3 : 4 : #include "../../util/fd_util.h" 5 : #include "../../third_party/blst/bindings/blst.h" 6 : 7 0 : #define FD_BLS_SEC_SZ (32UL) 8 0 : #define FD_BLS_PUB_SZ (96UL) 9 0 : #define FD_BLS_PUB_COMPRESSED_SZ (48UL) 10 0 : #define FD_BLS_SIG_SZ (192UL) 11 0 : #define FD_BLS_SIG_COMPRESSED_SZ (96UL) 12 0 : #define FD_BLS_SET_MAX (2000UL) /* TODO make set_dynamic so this isn't dependent on the VAT cap */ 13 0 : #define FD_BLS_DST "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_" 14 0 : #define FD_BLS_DST_SZ (sizeof(FD_BLS_DST)-1UL) 15 : 16 : typedef blst_scalar fd_bls_sec_t; 17 : typedef blst_p1 fd_bls_pub_t; 18 : typedef blst_p2 fd_bls_sig_t; 19 : typedef blst_p2_affine fd_bls_hash_t; 20 : 21 : #define SET_NAME fd_bls_set 22 0 : #define SET_MAX FD_BLS_SET_MAX 23 : #include "../../util/tmpl/fd_set.c" /* TODO make set_dynamic so this isn't dependent on the VAT cap */ 24 : 25 : struct fd_bls_agg { 26 : fd_bls_pub_t pub; 27 : fd_bls_sig_t sig; 28 : fd_bls_set_t set[ fd_bls_set_word_cnt ]; /* bit position is the signer's epoch rank */ 29 : }; 30 : typedef struct fd_bls_agg fd_bls_agg_t; 31 : 32 : FD_PROTOTYPES_BEGIN 33 : 34 : /* Secret keys */ 35 : void fd_bls_sec_to_pub( fd_bls_sec_t const * sec, fd_bls_pub_t * pub ); 36 : void fd_bls_sec_derive( fd_bls_sec_t * sec, uchar const * ikm, ulong ikm_sz ); 37 : void fd_bls_sec_sign( fd_bls_sec_t const * sec, uchar const * msg, ulong msg_sz, fd_bls_sig_t * sig ); 38 : 39 : /* Public Keys (G1). fd_bls_pub_de accepts compressed or uncompressed 40 : encodings and rejects infinity and points outside G1. */ 41 : int fd_bls_pub_de ( fd_bls_pub_t * pub, uchar const * buf, ulong buf_sz ); 42 : /* fd_bls_pub_de_unchecked checks that the encoding is a curve point, 43 : but skips the infinity and G1 subgroup checks. It is only for keys 44 : that have already passed those checks. */ 45 : int fd_bls_pub_de_unchecked( fd_bls_pub_t * pub, uchar const buf[ static FD_BLS_PUB_SZ ] ); 46 : void fd_bls_pub_compress( fd_bls_pub_t const * pub, uchar buf[ static FD_BLS_PUB_COMPRESSED_SZ ] ); 47 : void fd_bls_pub_add ( fd_bls_pub_t * out, fd_bls_pub_t const * a, fd_bls_pub_t const * b ); 48 : void fd_bls_pub_neg ( fd_bls_pub_t * out, fd_bls_pub_t const * a ); 49 : int fd_bls_pub_is_inf ( fd_bls_pub_t const * pub ); 50 : int fd_bls_pub_eq ( fd_bls_pub_t const * a, fd_bls_pub_t const * b ); 51 : /* Overwrites out with the sum of the set-selected public keys. The 52 : cached variant may use full (the sum of pubs[0..pub_cnt)) to subtract 53 : the complement when set is dense. full may be NULL. */ 54 : void fd_bls_pub_sum ( fd_bls_pub_t * out, fd_bls_pub_t const * pubs, fd_bls_set_t const * set ); 55 : void fd_bls_pub_sum_cached( fd_bls_pub_t * out, fd_bls_pub_t const * pubs, ulong pub_cnt, fd_bls_set_t const * set, fd_bls_pub_t const * full ); 56 : 57 : /* Signatures (G2). fd_bls_sig_de and _de_compressed subgroup-check their 58 : input. _de_unchecked only checks that an uncompressed encoding is a curve 59 : point.*/ 60 : void fd_bls_sig_ser ( fd_bls_sig_t const * sig, uchar buf[ static FD_BLS_SIG_SZ ] ); 61 : void fd_bls_sig_compress ( fd_bls_sig_t const * sig, uchar buf[ static FD_BLS_SIG_COMPRESSED_SZ ] ); 62 : int fd_bls_sig_de ( fd_bls_sig_t * sig, uchar const buf[ static FD_BLS_SIG_SZ ] ); 63 : int fd_bls_sig_de_compressed( fd_bls_sig_t * sig, uchar const buf[ static FD_BLS_SIG_COMPRESSED_SZ ] ); 64 : int fd_bls_sig_de_unchecked ( fd_bls_sig_t * sig, uchar const buf[ static FD_BLS_SIG_SZ ] ); 65 : void fd_bls_sig_add ( fd_bls_sig_t * out, fd_bls_sig_t const * a, fd_bls_sig_t const * b ); 66 : void fd_bls_sig_neg ( fd_bls_sig_t * out, fd_bls_sig_t const * a ); 67 : int fd_bls_sig_validate ( fd_bls_sig_t const * sig ); 68 : int fd_bls_sig_is_inf ( fd_bls_sig_t const * sig ); 69 : int fd_bls_sig_eq ( fd_bls_sig_t const * a, fd_bls_sig_t const * b ); 70 : 71 : /* Hash-to-curve and verification */ 72 : void fd_bls_hash_msg( uchar const * msg, ulong msg_sz, fd_bls_hash_t * hash ); 73 : int fd_bls_hash_eq( fd_bls_hash_t const * a, fd_bls_hash_t const * b ); 74 : int fd_bls_agg_verify_hashed( fd_bls_hash_t const * hash, fd_bls_pub_t const * pub, fd_bls_sig_t const * sig ); 75 : int fd_bls_agg_verify( uchar const * msg, ulong msg_sz, fd_bls_pub_t const * pub, fd_bls_sig_t const * sig ); 76 : int fd_bls_agg_verify_pair( uchar const * msg, ulong msg_sz, 77 : fd_bls_pub_t const * pub, 78 : uchar const * msg_fallback, ulong msg_fallback_sz, 79 : fd_bls_pub_t const * pub_fallback, fd_bls_sig_t const * sig ); 80 : 81 : /* Aggregate bookkeeping and bad-signer isolation */ 82 : fd_bls_agg_t * fd_bls_agg_null( fd_bls_agg_t * agg ); 83 : fd_bls_agg_t * fd_bls_agg_construct( fd_bls_agg_t * agg, fd_bls_pub_t const * pub, 84 : fd_bls_sig_t const * sig, fd_bls_set_t const * set ); 85 : int fd_bls_agg_verify_subtract( fd_bls_agg_t * agg, 86 : uchar const * msg, ulong msg_sz, 87 : fd_bls_pub_t const * pub, fd_bls_sig_t const * sig, 88 : fd_bls_set_t * bad ); 89 : 90 : FD_PROTOTYPES_END 91 : 92 : #endif /* HEADER_fd_src_ballet_bls_fd_bls_h */
