BLS12-381 Crypto Primitives

.gitmodules

@@ -31,3 +31,6 @@
 [submodule "libraries/cli11/cli11"]
 	path = libraries/cli11/cli11
 	url = https://github.com/AntelopeIO/CLI11.git
+[submodule "libraries/libfc/libraries/bls12_381"]
+	path = libraries/libfc/libraries/bls12_381
+	url = https://github.com/mschoenebeck/bls12_381.git

libraries/chain/controller.cpp

@@ -33,6 +33,7 @@
 #include <fc/log/logger_config.hpp>
 #include <fc/scoped_exit.hpp>
 #include <fc/variant_object.hpp>
+#include <bls12_381.hpp>
 
 #include <new>
 #include <shared_mutex>
@@ -340,6 +341,8 @@ struct controller_impl {
       set_activation_handler<builtin_protocol_feature_t::get_code_hash>();
       set_activation_handler<builtin_protocol_feature_t::get_block_num>();
       set_activation_handler<builtin_protocol_feature_t::crypto_primitives>();
+      set_activation_handler<builtin_protocol_feature_t::bls_primitives>();
+      bls12_381::init();
 
       self.irreversible_block.connect([this](const block_state_ptr& bsp) {
          // producer_plugin has already asserted irreversible_block signal is
@@ -3846,6 +3849,22 @@ void controller_impl::on_activation<builtin_protocol_feature_t::crypto_primitive
    } );
 }
 
+template<>
+void controller_impl::on_activation<builtin_protocol_feature_t::bls_primitives>() {
+   db.modify( db.get<protocol_state_object>(), [&]( auto& ps ) {
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g1_add" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g2_add" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g1_mul" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g2_mul" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g1_exp" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g2_exp" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_pairing" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g1_map" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_g2_map" );
+      add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "bls_fp_mod" );
+   } );
+}
+
 /// End of protocol feature activation handlers
 
 } } /// eosio::chain

libraries/chain/include/eosio/chain/protocol_feature_manager.hpp

@@ -35,6 +35,7 @@ enum class builtin_protocol_feature_t : uint32_t {
    configurable_wasm_limits = 18, // configurable_wasm_limits2,
    crypto_primitives = 19,
    get_block_num = 20,
+   bls_primitives = 21,
    reserved_private_fork_protocol_features = 500000,
 };
 

libraries/chain/include/eosio/chain/types.hpp

@@ -76,7 +76,7 @@ namespace eosio::chain {
    using public_key_type  = fc::crypto::public_key;
    using private_key_type = fc::crypto::private_key;
    using signature_type   = fc::crypto::signature;
-   
+
    // configurable boost deque (for boost >= 1.71) performs much better than std::deque in our use cases
    using block_1024_option_t = boost::container::deque_options< boost::container::block_size<1024u> >::type;
    template<typename T>

libraries/chain/include/eosio/chain/webassembly/eos-vm-oc/intrinsic_mapping.hpp

@@ -267,7 +267,17 @@ inline constexpr auto get_intrinsic_table() {
       "env.sha3",
       "env.blake2_f",
       "env.k1_recover",
-      "env.get_block_num"
+      "env.get_block_num",
+      "env.bls_g1_add",
+      "env.bls_g2_add",
+      "env.bls_g1_mul",
+      "env.bls_g2_mul",
+      "env.bls_g1_exp",
+      "env.bls_g2_exp",
+      "env.bls_g1_pairing",
+      "env.bls_g1_map",
+      "env.bls_g2_map",
+      "env.bls_fp_mod"
    );
 }
 inline constexpr std::size_t find_intrinsic_index(std::string_view hf) {

libraries/chain/include/eosio/chain/webassembly/interface.hpp

@@ -1785,6 +1785,107 @@ namespace webassembly {
          */
          int32_t k1_recover( span<const char> signature, span<const char> digest, span<char> pub) const;
 
+         /**
+          * Host function for G1 addition on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param op1 - a span containing the first operand G1 point.
+          * @param op2 - a span containing the second operand G1 point.
+          * @param[out] result - the result op1 + op2.
+         */
+         void bls_g1_add(span<const char> op1, span<const char> op2, span<char> result) const;
+
+         /**
+          * Host function for G2 addition on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param op1 - a span containing the first operand G2 point.
+          * @param op2 - a span containing the second operand G2 point.
+          * @param[out] result - the result op1 + op2.
+         */
+         void bls_g2_add(span<const char> op1, span<const char> op2, span<char> result) const;
+
+         /**
+          * Host function for G1 scalar multiplication on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param point - a span containing the G1 point operand.
+          * @param scalar - a span containing the scalar operand.
+          * @param[out] result - the result: scalar * point.
+         */
+         void bls_g1_mul(span<const char> point, span<const char> scalar, span<char> result) const;
+
+         /**
+          * Host function for G2 scalar multiplication on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param point - a span containing the G2 point operand.
+          * @param scalar - a span containing the scalar operand.
+          * @param[out] result - the result op1 * op2.
+         */
+         void bls_g2_mul(span<const char> point, span<const char> scalar, span<char> result) const;
+
+         /**
+          * Host function for G1 multi-exponentiation on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param points - a span containing a list of G1 points (P0, P1, P2... Pn).
+          * @param scalars - a span containing a list of scalars (s0, s1, s2... sn).
+          * @param n - the number of elements in the lists.
+          * @param[out] result - the result s0 * P0 + s1 * P1 + ... + sn * Pn.
+         */
+         void bls_g1_exp(span<const char> points, span<const char> scalars, const uint32_t n, span<char> result) const;
+
+         /**
+          * Host function for G2 multi-exponentiation on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param points - a span containing a list of G2 points (P0, P1, P2... Pn).
+          * @param scalars - a span containing a list of scalars (s0, s1, s2... sn).
+          * @param n - the number of elements in the lists.
+          * @param[out] result - the result s0 * P0 + s1 * P1 + ... + sn * Pn.
+         */
+         void bls_g2_exp(span<const char> points, span<const char> scalars, const uint32_t n, span<char> result) const;
+
+         /**
+          * Host function to calculate the pairing of (G1, G2) pairs on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param g1_points - a span containing a list of G1 points (P0, P1, P2... Pn).
+          * @param g2_points - a span containing a list of G2 points (P0, P1, P2... Pn).
+          * @param n - the number of elements in the lists.
+          * @param[out] result - the result e(g1_0, g2_0) * e(g1_1, g2_1) * ... * e(g1_n, g2_n)
+         */
+         void bls_pairing(span<const char> g1_points, span<const char> g2_points, const uint32_t n, span<char> result) const;
+
+         /**
+          * Host function for mapping fp to G1 on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param e - a span containing the field element fp to be mapped.
+          * @param[out] result - the resulting element in G1.
+         */
+         void bls_g1_map(span<const char> e, span<char> result) const;
+
+         /**
+          * Host function for mapping fp2 to G2 on the elliptic curve bls12-381
+          *
+          * @ingroup crypto
+          * @param e - a span containing the field element fp2 to be mapped.
+          * @param[out] result - the resulting element in G2.
+         */
+         void bls_g2_map(span<const char> e, span<char> result) const;
+
+         /**
+          * Host function for modular reduction of 64 bytes wide scalar to a field element (fp, 48 bytes) of the elliptic curve bls12-381
+          * Involves Montgomery conversion on the resulting field element.
+          *
+          * @ingroup crypto
+          * @param s - a span containing the 64 bytes wide scalar to be reduced.
+          * @param[out] result - the resulting field element fp in Montogomery form.
+         */
+         void bls_fp_mod(span<const char> s, span<char> result) const;
+
          // compiler builtins api
          void __ashlti3(legacy_ptr<int128_t>, uint64_t, uint64_t, uint32_t) const;
          void __ashrti3(legacy_ptr<int128_t>, uint64_t, uint64_t, uint32_t) const;

libraries/chain/protocol_feature_manager.cpp

@@ -258,6 +258,17 @@ Adds new cryptographic host functions
 Builtin protocol feature: GET_BLOCK_NUM
 
 Enables new `get_block_num` intrinsic which returns the current block number.
+*/
+            {}
+         } )
+         (  builtin_protocol_feature_t::bls_primitives, builtin_protocol_feature_spec{
+            "BLS_PRIMITIVES",
+            fc::variant("01969c44de35999b924095ae7f50081a7f274409fdbccb9fc54fa7836c76089c").as<digest_type>(),
+            // SHA256 hash of the raw message below within the comment delimiters (do not modify message below).
+/*
+Builtin protocol feature: BLS_PRIMITIVES
+Adds new cryptographic host functions
+- Add, multiply, multi-exponentiation and pairing functions for the bls12-381 elliptic curve.
 */
             {}
          } )

libraries/chain/webassembly/crypto.cpp

@@ -7,6 +7,7 @@
 #include <fc/crypto/sha3.hpp>
 #include <fc/crypto/k1_recover.hpp>
 #include <bn256/bn256.h>
+#include <bls12_381.hpp>
 
 namespace {
     uint32_t ceil_log2(uint32_t n)
@@ -250,4 +251,105 @@ namespace eosio { namespace chain { namespace webassembly {
       return return_code::success;
    }
 
+   void interface::bls_g1_add(span<const char> op1, span<const char> op2, span<char> result) const
+   {
+       bls12_381::g1 a = bls12_381::g1::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(op1.data()), 144}, false, true);
+       bls12_381::g1 b = bls12_381::g1::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(op2.data()), 144}, false, true);
+       bls12_381::g1 c = a.add(b);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 144}, true);
+   }
+
+   void interface::bls_g2_add(span<const char> op1, span<const char> op2, span<char> result) const
+   {
+       bls12_381::g2 a = bls12_381::g2::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(op1.data()), 288}, false, true);
+       bls12_381::g2 b = bls12_381::g2::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(op2.data()), 288}, false, true);
+       bls12_381::g2 c = a.add(b);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 288}, true);
+   }
+
+   void interface::bls_g1_mul(span<const char> point, span<const char> scalar, span<char> result) const
+   {
+       bls12_381::g1 a = bls12_381::g1::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(point.data()), 144}, false, true);
+       std::array<uint64_t, 4> b = bls12_381::scalar::fromBytesLE<4>({reinterpret_cast<const uint8_t*>(scalar.data()), 32});
+       bls12_381::g1 c = a.mulScalar(b);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 144}, true);
+   }
+
+   void interface::bls_g2_mul(span<const char> point, span<const char> scalar, span<char> result) const
+   {
+       bls12_381::g2 a = bls12_381::g2::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(point.data()), 288}, false, true);
+       std::array<uint64_t, 4> b = bls12_381::scalar::fromBytesLE<4>({reinterpret_cast<const uint8_t*>(scalar.data()), 32});
+       bls12_381::g2 c = a.mulScalar(b);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 288}, true);
+   }
+
+   void interface::bls_g1_exp(span<const char> points, span<const char> scalars, const uint32_t n, span<char> result) const
+   {
+       std::vector<bls12_381::g1> pv;
+       std::vector<std::array<uint64_t, 4>> sv;
+       pv.reserve(n);
+       sv.reserve(n);
+       for(uint32_t i = 0; i < n; i++)
+       {
+           bls12_381::g1 p = bls12_381::g1::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(points.data() + i*144), 144}, false, true);
+           std::array<uint64_t, 4> s = bls12_381::scalar::fromBytesLE<4>({reinterpret_cast<const uint8_t*>(scalars.data() + i*32), 32});
+           pv.push_back(p);
+           sv.push_back(s);
+       }
+       bls12_381::g1 r = bls12_381::g1::multiExp(pv, sv);
+       r.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 144}, true);
+   }
+
+   void interface::bls_g2_exp(span<const char> points, span<const char> scalars, const uint32_t n, span<char> result) const
+   {
+       std::vector<bls12_381::g2> pv;
+       std::vector<std::array<uint64_t, 4>> sv;
+       pv.reserve(n);
+       sv.reserve(n);
+       for(uint32_t i = 0; i < n; i++)
+       {
+           bls12_381::g2 p = bls12_381::g2::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(points.data() + i*288), 288}, false, true);
+           std::array<uint64_t, 4> s = bls12_381::scalar::fromBytesLE<4>({reinterpret_cast<const uint8_t*>(scalars.data() + i*32), 32});
+           pv.push_back(p);
+           sv.push_back(s);
+       }
+       bls12_381::g2 r = bls12_381::g2::multiExp(pv, sv);
+       r.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 288}, true);
+   }
+
+   void interface::bls_pairing(span<const char> g1_points, span<const char> g2_points, const uint32_t n, span<char> result) const
+   {
+       std::vector<std::tuple<bls12_381::g1, bls12_381::g2>> v;
+       v.reserve(n);
+       for(uint32_t i = 0; i < n; i++)
+       {
+           bls12_381::g1 p_g1 = bls12_381::g1::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(g1_points.data() + i*144), 144}, false, true);
+           bls12_381::g2 p_g2 = bls12_381::g2::fromJacobianBytesLE({reinterpret_cast<const uint8_t*>(g2_points.data() + i*288), 288}, false, true);
+           bls12_381::pairing::add_pair(v, p_g1, p_g2);
+       }
+       bls12_381::fp12 r = bls12_381::pairing::calculate(v);
+       r.toBytesLE({reinterpret_cast<uint8_t*>(result.data()), 576}, true);
+   }
+
+   void interface::bls_g1_map(span<const char> e, span<char> result) const
+   {
+       bls12_381::fp a = bls12_381::fp::fromBytesLE({reinterpret_cast<const uint8_t*>(e.data()), 48}, false, true);
+       bls12_381::g1 c = bls12_381::g1::mapToCurve(a);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 144}, true);
+   }
+
+   void interface::bls_g2_map(span<const char> e, span<char> result) const
+   {
+       bls12_381::fp2 a = bls12_381::fp2::fromBytesLE({reinterpret_cast<const uint8_t*>(e.data()), 96}, false, true);
+       bls12_381::g2 c = bls12_381::g2::mapToCurve(a);
+       c.toJacobianBytesLE({reinterpret_cast<uint8_t*>(result.data()), 288}, true);
+   }
+
+   void interface::bls_fp_mod(span<const char> s, span<char> result) const
+   {
+       std::array<uint64_t, 8> k = bls12_381::scalar::fromBytesLE<8>({reinterpret_cast<const uint8_t*>(s.data()), 64});
+       bls12_381::fp e = bls12_381::fp::modPrime<8>(k);
+       e.toBytesLE({reinterpret_cast<uint8_t*>(result.data()), 48}, true);
+   }
+
 }}} // ns eosio::chain::webassembly

libraries/chain/webassembly/runtimes/eos-vm.cpp

@@ -620,6 +620,18 @@ REGISTER_CF_HOST_FUNCTION( blake2_f );
 REGISTER_CF_HOST_FUNCTION( sha3 );
 REGISTER_CF_HOST_FUNCTION( k1_recover );
 
+// bls_primitives protocol feature
+REGISTER_CF_HOST_FUNCTION( bls_g1_add );
+REGISTER_CF_HOST_FUNCTION( bls_g2_add );
+REGISTER_CF_HOST_FUNCTION( bls_g1_mul );
+REGISTER_CF_HOST_FUNCTION( bls_g2_mul );
+REGISTER_CF_HOST_FUNCTION( bls_g1_exp );
+REGISTER_CF_HOST_FUNCTION( bls_g2_exp );
+REGISTER_CF_HOST_FUNCTION( bls_pairing );
+REGISTER_CF_HOST_FUNCTION( bls_g1_map );
+REGISTER_CF_HOST_FUNCTION( bls_g2_map );
+REGISTER_CF_HOST_FUNCTION( bls_fp_mod );
+
 } // namespace webassembly
 } // namespace chain
 } // namespace eosio

libraries/libfc/CMakeLists.txt

@@ -1,5 +1,6 @@
 add_subdirectory( secp256k1 )
 add_subdirectory( libraries/bn256/src )
+add_subdirectory( libraries/bls12_381 )
 
 set(CMAKE_THREAD_PREFER_PTHREAD TRUE)
 set(THREADS_PREFER_PTHREAD_FLAG TRUE)
@@ -131,7 +132,7 @@ if(APPLE)
   find_library(corefoundation_framework CoreFoundation)
 endif()
 target_link_libraries( fc PUBLIC Boost::date_time Boost::chrono Boost::iostreams Threads::Threads
-                                 OpenSSL::Crypto ZLIB::ZLIB ${PLATFORM_SPECIFIC_LIBS} ${CMAKE_DL_LIBS} secp256k1 ${security_framework} ${corefoundation_framework})
+                                 OpenSSL::Crypto ZLIB::ZLIB ${PLATFORM_SPECIFIC_LIBS} ${CMAKE_DL_LIBS} secp256k1 bls12_381 ${security_framework} ${corefoundation_framework})
 
 # Critically, this ensures that OpenSSL 1.1 & 3.0 both have a variant of BN_zero() with void return value. But it also allows access
 #  to some obsoleted AES functions in 3.0 too, since 3.0's API_COMPAT is effectively 3.0 by default

libraries/libfc/test/CMakeLists.txt

@@ -1,5 +1,6 @@
 add_executable( test_fc
         crypto/test_blake2.cpp
+        crypto/test_bls.cpp
         crypto/test_cypher_suites.cpp
         crypto/test_hash_functions.cpp
         crypto/test_k1_recover.cpp