Commit Graph

156 Commits

Author SHA1 Message Date
Daira Hopwood ea92aba9fe Move bigint arithmetic implementations to libsnark. 2016-08-22 15:46:58 -06:00
Sean Bowe f0dab51cf3 Implement zkSNARK compression. 2016-08-22 00:36:12 -06:00
zkbot 365845216b Auto merge of #1268 - ThisIsNotOfficialCodeItsJustForks:t1130-upgrade-libsodium, r=ebfull
Upgrade libsodium for AVX2-detection bugfix.

Upgrades libsodium to bring in an AVX2-detection bugfix (to help with #1130).
2016-08-22 02:34:30 +00:00
zkbot 7e556172d9 Auto merge of #1236 - tomrittervg:tomrittervg-comments-1, r=ebfull
Clarify comment about nonce space for Note Encryption
2016-08-18 23:38:36 +00:00
Taylor Hornby 2902ac7ce8 Use libsodium's s < L check, instead checking that libsodium checks that. 2016-08-18 16:38:20 -06:00
Tom Ritter 36d5f42948 Update NoteEncryption.hpp 2016-08-18 16:51:15 -05:00
zkbot 28a30f7801 Auto merge of #1254 - ebfull:tx-structure-changes, r=bitcartel
Change memo field size and relocate `ciphertexts` field of JoinSplit description

Closes #1190
Closes #1187
2016-08-18 16:49:47 +00:00
ebfull 2ee6ed64eb Add parenthesis around macro value definition 2016-08-18 10:43:58 -06:00
Sean Bowe f5e5707d4c Change memo field size and relocate `ciphertexts` field of JoinSplit description. 2016-08-15 09:39:14 -06:00
Tom Ritter 2dd950ecae Clarify comment about nonce space for Note Encryption 2016-08-11 13:48:47 -05:00
Jack Grigg 7c929cf5bc Add support for spending keys to the basic key store 2016-08-09 17:38:25 +12:00
Simon d81c31f5fb Extend try catch block around calls to libsnark, per discussion in #1126. 2016-07-29 00:02:22 -07:00
Sean Bowe 25d2197043 Remove more from libsnark, and fix potential remote-DoS. 2016-07-21 18:34:59 -06:00
Sean Bowe bf76024eb7 Pass our constraint system to libsnark, so that it doesn't need to (de)serialize it in the proving key. 2016-07-15 10:45:59 -06:00
Sean Bowe 1fad6b87e5 Initialize libsodium in this routine, which is now necessary because libsnark uses its PRNG. 2016-07-15 10:45:22 -06:00
zkbot 6caacc892e Auto merge of #1058 - ebfull:coin-cache, r=ebfull
Flush to disk more consistently by accounting memory usage of serials/anchors in cache.

Closes #626.

It's important that this at least *approximates* the memory usage, so that we flush the cache to disk as expected. It's okay that we overestimate. The serials are stored in keys in the `boost::unordered_map`, so we can simply use that map's `DynamicMemoryUsage`. The anchors are another story.
2016-07-11 17:23:19 +00:00
Sean Bowe 2668a1bc13 Remove the rest of libzerocash. 2016-07-10 20:25:02 -06:00
Sean Bowe 7f3c7a683b Flush to disk more consistently by accounting memory usage of serials/anchors in cache. 2016-06-27 10:52:34 -06:00
zkbot 62a2d12672 Auto merge of #1026 - ebfull:address-serialization, r=ebfull
Zcash address encoding

We need to encode Zcash addresses so they aren't as large and unweildy. We're using Base58Check just like upstream does, and to ensure the first character is "z" in our addresses we must use two bytes for the version string. Two bytes gives us an extra character for free, so this PR targets the beginning of addresses to have "zc".

```
$ ./src/zcash-cli zcrawkeygen
{
    "zcaddress" : "tnvaj4ZbZG83tj4RwZcFeLgJoSt8nw1ZvSCG8EMyowAsXTQgJPat77Y43BVdVCrwrbLy7GG9msJDYdn5hmreHmkXAkX17hb",
    "zcsecretkey" : "SKzkxCRWvscKnroSFyhCqhY332KcDMH4LLNdK2TsSvbmr3CGAB8B",
    "zcviewingkey" : "10aa74046f31cbe5eaa8965d1e104853234c3d6c6e45f9c497ca3a025d159755"
}
```

This PR also encodes the spending keys with a prefix that targets "SK". The spec needs to be updated with these changes.

Testnet addresses will start with "tn".

Closes #572
2016-06-16 18:52:30 +00:00
Sean Bowe 62b7cd6173 Do not encode leading bytes in `PaymentAddress` serialization; this is a task for a higher-level API. 2016-06-15 14:58:30 -06:00
Sean Bowe c5f766b9b1 Change merkle tree depth to 29. 2016-06-03 20:42:15 -06:00
Sean Bowe 83e018b160 Remove redundant constraints. 2016-06-03 20:27:51 -06:00
Taylor Hornby 6aae9d1a55 Sign JoinSplit transactions 2016-05-30 11:05:31 -06:00
zkbot 8ff7c0752e Auto merge of #954 - ebfull:fix-cpourtx-structure, r=ebfull
CPourTx structural changes

* Enable binary serialization of proofs and the proving key (closes #799) and make the proofs fixed-size.
* Reorder fields of CPourTx to match the spec (closes #927)
2016-05-25 16:33:31 +00:00
Sean Bowe 9285bba885 Enable binary serializations of proofs and r1cs keys, and make the `CPourTx` proof field fixed-size. 2016-05-24 11:08:31 -06:00
Sean Bowe defe37a6d4 Enforce first four bits are zero for all spending keys and phi. 2016-05-24 11:07:09 -06:00
Sean Bowe 1bcdec40a4 Refactor PRF_gadget to hand responsibility to PRF_addr_a_pk_gadget for creating the '0' argument to the PRF. 2016-05-23 10:43:25 -06:00
Taylor Hornby bf2e3122ac Remove the Merkle tree hash function's fixed point. 2016-05-16 20:20:36 -06:00
Sean Bowe 81469bbb83 `Note` values should be little-endian byte order. 2016-05-12 16:45:12 -06:00
Sean Bowe 032164d5d5 Rename hmac -> mac in circuit. 2016-05-12 16:45:12 -06:00
Sean Bowe a9640f67f1 Rename ZCASH_ constants to ZC_. 2016-05-12 16:45:07 -06:00
Sean Bowe 53ab7c06ba Use inheritance for PRF gadgets. 2016-05-12 16:44:49 -06:00
Sean Bowe 5975bf1c32 Added public zkSNARK parameter generation utility. 2016-05-12 16:44:49 -06:00
Daira Hopwood dbab243725 zkSNARK: Add constraint that the total value in a JoinSplit is a 64-bit integer. 2016-05-12 16:44:30 -06:00
Sean Bowe 59c3d926c6 zkSNARK: Enforce merkle authentication path from nonzero-valued public inputs to root. 2016-05-12 16:44:30 -06:00
Sean Bowe fcece37f00 zkSNARK: Witness commitments to input notes. 2016-05-12 16:44:30 -06:00
Sean Bowe e5f7c49d55 zkSNARK: Ensure that values balance correctly. 2016-05-12 16:44:30 -06:00
Sean Bowe 5e61a78fec zkSNARK: Enforce disclosure of commitments to output notes. 2016-05-12 16:44:30 -06:00
Sean Bowe 6b010d9bfd zkSNARK: Enforce that new output notes have unique `rho` to prevent faerie gold attack. 2016-05-12 16:44:30 -06:00
Sean Bowe e52f40e839 zkSNARK: Authenticate h_sig with a_sk 2016-05-12 16:44:30 -06:00
Sean Bowe 2a2f3fb80f zkSNARK: Enforce disclosure of input note nullifiers 2016-05-12 16:44:30 -06:00
Sean Bowe ca8d6c9347 zkSNARK: Enforce spend-authority of input notes. 2016-05-12 16:44:30 -06:00
Sean Bowe 53d2ade7c2 zkSNARK: Add "zero" constant variable. 2016-05-12 16:44:30 -06:00
Sean Bowe 074eb3a2cf zkSNARK: Foundations of circuit design and verification logic. 2016-05-12 16:44:30 -06:00
Sean Bowe 369df06583 Introduce new `libzcash` Zcash protocol API and crypto constructions surrounding the zkSNARK circuit. 2016-05-12 16:44:27 -06:00
Sean Bowe 5961dcb6da Change ciphertext length to match protocol spec, and refactor the use of constants. 2016-05-05 21:02:03 -06:00
zkbot 92f3c6082a Auto merge of #889 - ebfull:new-imt-redux, r=ebfull
Implement and integrate new Incremental Merkle Tree

This supersedes #823.

----

This is an implementation of a new incremental merkle tree with

* no memory safety issues
* a more sensible internal design
* better space efficiency (tree representation, witnessing)
* simpler API

It is intended that this tracks the behavior of the previous tree, which it does, as verified by tests. I even wrote a little circuit for testing that all the paths work.

This PR also integrates the tree into the codebase and deprecates the old tree in almost all of our code. (I left it alone in `zerocashTest` but everything else has been changed.)

This change is compatible with the testnet but you will need to clear your *local* blockchain data out since the serialized representation of the merkle tree is now different.

Closes #517, Closes #519, Closes #591, Closes #460, Closes #473
2016-05-03 17:33:27 +00:00
Sean Bowe 26007222e8 Distinguish the failure cases of wfcheck in tree. 2016-05-03 11:23:54 -06:00
Sean Bowe 6f1b70300d Small nit fixes 2016-04-30 11:59:39 -06:00
Sean Bowe 70ac6ce2ee Clarify the usage of decryption API. 2016-04-28 17:06:08 -06:00
Sean Bowe 6c36a9fe03 NoteEncryption implementation and integration, removal of ECIES and crypto++ dependencies. 2016-04-28 16:25:12 -06:00
Sean Bowe 9b92a9d5fb Make appending algorithm more succinct. 2016-04-28 16:07:52 -06:00
Sean Bowe d0c4b0e850 Add more well-formedness checks/tests to tree. 2016-04-28 16:07:52 -06:00
Sean Bowe 01e4ff0f74 Improve well-formedness checks and add additional serialization/deserialization tests. 2016-04-28 16:07:52 -06:00
Sean Bowe 482aefbd0d Test old tree along with new tree as much as possible. 2016-04-28 16:07:52 -06:00
Sean Bowe e1ff849d8d New implementation of incremental merkle tree
This is a new implementation of the incremental merkle tree used by our
scheme to witness commitments to spendable value. It serves as a fixed-sized
accumulator.

This new construction has a much simpler API surface area, avoids memory
safety issues, remains pruned at all times, avoids serialization edge cases,
has more efficient insertion, and is abstract over the depth and hash
function used at the type level.

Further, it lays the groundwork for efficient "fast-forwarding" of witnesses
into the tree as the treestate is updated.
2016-04-28 16:07:52 -06:00