Switch from bls12_381 to bn254

node/Cargo.toml

@@ -27,17 +27,20 @@ async-trait = "0.1.71"
 bit-vec = "0.6"
 blst = "0.3.10"
 bn254 = "0.0.1"
+ark-bn254 = "0.4.0"
+ark-ec = "0.4.2"
+num-traits = "0.2.17"
 clap = { version = "4.3.3", features = ["derive"] }
 ed25519-dalek = { version = "2.0.0", features = ["serde", "rand_core"] }
 futures = "0.3.28"
 hex = "0.4.3"
-hyper = { version = "0.14.27", features = ["http1", "http2","server","tcp"] }
+hyper = { version = "0.14.27", features = ["http1", "http2", "server", "tcp"] }
 im = "15.1.0"
 once_cell = "1.17.1"
 pin-project = "1.1.0"
 prost = "0.11.0"
 prost-build = "0.11.0"
-prost-reflect = { version = "0.11.0", features = ["derive","serde"] }
+prost-reflect = { version = "0.11.0", features = ["derive", "serde"] }
 prost-reflect-build = "0.11.0"
 protoc-bin-vendored = "3.0.0"
 prettyplease = "0.2.6"

node/libs/crypto/Cargo.toml

@@ -10,6 +10,9 @@ license.workspace = true
 anyhow.workspace = true
 blst.workspace = true
 bn254.workspace = true
+ark-bn254.workspace = true
+ark-ec.workspace = true
+num-traits.workspace = true
 ed25519-dalek.workspace = true
 hex.workspace = true
 rand.workspace = true

node/libs/crypto/src/bn254/mod.rs

@@ -3,10 +3,11 @@
 use std::collections::BTreeMap;
 
 use anyhow::anyhow;
-use bn254::{PrivateKey, ECDSA};
+use bn254::{ECDSA, PrivateKey};
 use rand::Rng;
 
 pub use crate::bn254::error::Error;
+use crate::bn254_2::hash;
 use crate::ByteFmt;
 
 mod error;

node/libs/crypto/src/bn254_2/error.rs

@@ -0,0 +1,9 @@
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Signature verification failure")]
+    SignatureVerificationFailure,
+    #[error("Aggregate signature verification failure")]
+    AggregateSignatureVerificationFailure,
+    #[error("Signature aggregation failure")]
+    SignatureAggregationFailure,
+}

node/libs/crypto/src/bn254_2/hash.rs

@@ -0,0 +1,25 @@
+use sha2::Digest as _;
+use ark_ec::AffineRepr as _;
+use ark_bn254::{G1Affine, G1Projective};
+
+/// H(m) as a point in G1.
+pub(crate) fn hash_to_g1(msg: &[u8]) -> G1Projective {
+    for i in 0..100 {
+        // Hash the message with the index as suffix.
+        let bytes: [u8; 32] = sha2::Sha256::new()
+            .chain_update(&msg)
+            .chain_update((i as u32).to_be_bytes())
+            .finalize()
+            .into();
+
+        // Try to get a G1 point from the hash.
+        let p = G1Affine::from_random_bytes(&bytes);
+
+        if let Some(p) = p {
+            return p.into()
+
+        }
+    }
+    // It should be statistically infeasible to finish the loop without finding a point.
+    unreachable!()
+}

node/libs/crypto/src/bn254_2/mod.rs

@@ -0,0 +1,238 @@
+//! BLS signature scheme for BN254 curve.
+
+use std::collections::BTreeMap;
+
+use ark_bn254::{Bn254, Fr, G1Projective as G1, G2Projective as G2};
+use ark_ec::AffineRepr as _;
+use ark_ec::bn::Bn;
+use ark_ec::Group as _;
+use ark_ec::pairing::Pairing as _;
+use ark_ec::pairing::PairingOutput;
+use num_traits::Zero as _;
+use rand::Rng;
+
+pub use crate::bn254_2::error::Error;
+use crate::ByteFmt;
+
+mod error;
+
+mod testonly;
+#[cfg(test)]
+mod tests;
+pub mod hash;
+
+pub struct SecretKey(pub Fr);
+
+impl SecretKey {
+    /// Generates a random secret key
+    pub fn random<R: Rng>(rng: &mut R) -> Self {
+        let scalar = Fr::new(rng.gen());
+        SecretKey(scalar)
+    }
+
+    /// Gets the corresponding [`PublicKey`] for this [`SecretKey`]
+    pub fn public(&self) -> PublicKey {
+        let p = G2::generator() * self.0;
+        PublicKey(p)
+    }
+
+    /// Produces a signature using this [`SecretKey`]
+    pub fn sign(&self, msg: &[u8]) -> Signature {
+        let hash_point = hash::hash_to_g1(msg);
+        let sig = hash_point * self.0;
+        Signature(sig)
+    }
+}
+
+impl ByteFmt for SecretKey {
+    fn decode(bytes: &[u8]) -> anyhow::Result<Self> {
+        panic!("implement");
+        // bn254::PrivateKey::try_from(bytes)
+        //     .map(Self)
+        //     .map_err(|e| anyhow!("Failed to decode secret key: {e:?}"))
+    }
+
+    fn encode(&self) -> Vec<u8> {
+        panic!("implement");
+        // self.0.to_bytes().unwrap()
+    }
+}
+
+/// Type safety wrapper around a `bn254` public key.
+#[derive(Clone)]
+pub struct PublicKey(pub G2);
+
+impl PartialEq for PublicKey {
+    fn eq(&self, other: &Self) -> bool {
+        ByteFmt::encode(self).eq(&ByteFmt::encode(other))
+    }
+}
+
+impl Eq for PublicKey {}
+
+impl ByteFmt for PublicKey {
+    fn decode(bytes: &[u8]) -> anyhow::Result<Self> {
+        panic!("implement");
+        // bn254::PublicKey::from_compressed(bytes)
+        //     .map(Self)
+        //     .map_err(|err| anyhow!("Error decoding public key: {err:?}"))
+    }
+
+    fn encode(&self) -> Vec<u8> {
+        panic!("implement");
+        // self.0.to_compressed().unwrap()
+    }
+}
+
+impl std::hash::Hash for PublicKey {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        panic!("implement");
+        // state.write(&self.0.to_compressed().unwrap())
+    }
+}
+
+impl PartialOrd for PublicKey {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for PublicKey {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        ByteFmt::encode(self).cmp(&ByteFmt::encode(other))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Signature(pub G1);
+
+impl Signature {
+    pub fn verify(&self, msg: &[u8], pk: &PublicKey) -> Result<(), Error> {
+        let hash_point = hash::hash_to_g1(msg);
+
+        let mut vals = Vec::new();
+        // First pair: e(H(m): G1, pk: G2)
+        vals.push((hash_point, pk.0));
+        // Second pair: e(sig: G1, -generator: G2)
+        vals.push((self.0, -G2::generator()));
+
+        let output = multi_pairing(&vals);
+        // println!("{:?}", output);
+        // let a: PairingOutput<Bn254> = PairingOutput::zero();
+        // println!("{:?}", a);
+        if output == PairingOutput::zero() {
+            Ok(())
+        } else {
+            Err(Error::SignatureVerificationFailure)
+        }
+    }
+}
+
+fn multi_pairing(pairs: &[(G1, G2)]) -> PairingOutput<Bn254> {
+    let mut g1: Vec<G1> = Vec::new();
+    let mut g2: Vec<G2> = Vec::new();
+    for (p, q) in pairs {
+        g1.push(p.clone());
+        g2.push(q.clone());
+    }
+
+    Bn254::multi_pairing(g1, g2)
+}
+
+impl PartialEq for Signature {
+    fn eq(&self, other: &Self) -> bool {
+        ByteFmt::encode(self).eq(&ByteFmt::encode(other))
+    }
+}
+
+impl Eq for Signature {}
+
+impl ByteFmt for Signature {
+    fn decode(bytes: &[u8]) -> anyhow::Result<Self> {
+        panic!("implement");
+        // bn254::Signature::from_compressed(bytes)
+        //     .map(Self)
+        //     .map_err(|err| anyhow!("Error decoding signature: {err:?}"))
+    }
+    fn encode(&self) -> Vec<u8> {
+        panic!()
+        // self.0.to_compressed().unwrap()
+    }
+}
+
+impl PartialOrd for Signature {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for Signature {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        ByteFmt::encode(self).cmp(&ByteFmt::encode(other))
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AggregateSignature(Signature);
+
+impl AggregateSignature {
+    pub fn aggregate<'a>(sigs: impl IntoIterator<Item=&'a Signature>) -> Self {
+        panic!("implement");
+        // let sigs: Vec<bn254::Signature> = sigs.into_iter().map(|s| s.0).collect();
+        // let mut agg = sigs[0];
+        // for i in 1..sigs.len() {
+        //     agg = agg + sigs[i];
+        // }
+        //
+        // AggregateSignature(Signature(agg))
+    }
+
+    pub fn verify<'a>(
+        &self,
+        msgs_and_pks: impl Iterator<Item=(&'a [u8], &'a PublicKey)>,
+    ) -> Result<(), Error> {
+        // Aggregate public keys if they are signing the same hash. Each public key aggregated
+        // is one fewer pairing to calculate.
+        let mut tree_map: BTreeMap<_, PublicKey> = BTreeMap::new();
+
+        for (msg, pk) in msgs_and_pks {
+            if let Some(existing_pk) = tree_map.get_mut(msg) {
+                let agg = PublicKey(existing_pk.0 + pk.0);
+                tree_map.insert(msg, agg);
+            } else {
+                tree_map.insert(msg, (*pk).clone());
+            }
+        }
+
+        for (msg, pk) in tree_map {
+            if let Err(err) = self.0.verify(msg, &pk) {
+                return Err(err);
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl ByteFmt for AggregateSignature {
+    fn decode(bytes: &[u8]) -> anyhow::Result<Self> {
+        let signature = Signature::decode(bytes)?;
+        Ok(AggregateSignature(signature))
+    }
+
+    fn encode(&self) -> Vec<u8> {
+        Signature::encode(&self.0)
+    }
+}
+
+impl PartialOrd for AggregateSignature {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for AggregateSignature {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        ByteFmt::encode(self).cmp(&ByteFmt::encode(other))
+    }
+}

node/libs/crypto/src/bn254_2/testonly.rs

@@ -0,0 +1,35 @@
+//! Random key generation, intended for use in testing
+
+use super::{AggregateSignature, ByteFmt, PublicKey, SecretKey, Signature};
+use rand::{distributions::Standard, prelude::Distribution, Rng};
+
+/// Generates a random SecretKey. This is meant for testing purposes.
+impl Distribution<SecretKey> for Standard {
+    fn sample<R: Rng + ?Sized>(&self, rng: &mut R) -> SecretKey {
+        SecretKey::decode(&rng.gen::<[u8; 32]>()).unwrap()
+    }
+}
+
+/// Generates a random Signature. This is meant for testing purposes.
+impl Distribution<Signature> for Standard {
+    fn sample<R: Rng + ?Sized>(&self, rng: &mut R) -> Signature {
+        let key = rng.gen::<SecretKey>();
+        let msg = rng.gen::<[u8; 4]>();
+        key.sign(&msg)
+    }
+}
+
+/// Generates a random AggregateSignature. This is meant for testing purposes.
+impl Distribution<AggregateSignature> for Standard {
+    fn sample<R: Rng + ?Sized>(&self, rng: &mut R) -> AggregateSignature {
+        let sig: Signature = self.sample(rng);
+        AggregateSignature(sig)
+    }
+}
+
+/// Generates a random PublicKey. This is meant for testing purposes.
+impl Distribution<PublicKey> for Standard {
+    fn sample<R: Rng + ?Sized>(&self, rng: &mut R) -> PublicKey {
+        rng.gen::<SecretKey>().public()
+    }
+}