Note encryption test vectors

src/address.rs

@@ -13,7 +13,7 @@ use crate::{
 /// let sk = SpendingKey::from_bytes([7; 32]).unwrap();
 /// let address = FullViewingKey::from(&sk).default_address();
 /// ```
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Address {
     d: Diversifier,
     pk_d: DiversifiedTransmissionKey,

src/keys.rs

@@ -291,7 +291,7 @@ impl DiversifierKey {
 /// Defined in [Zcash Protocol Spec § 4.2.3: Orchard Key Components][orchardkeycomponents].
 ///
 /// [orchardkeycomponents]: https://zips.z.cash/protocol/nu5.pdf#orchardkeycomponents
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Diversifier([u8; 11]);
 
 impl Diversifier {
@@ -376,6 +376,16 @@ impl From<&FullViewingKey> for IncomingViewingKey {
 }
 
 impl IncomingViewingKey {
+    /// Parses an Orchard incoming viewing key from its raw encoding.
+    pub fn from_bytes(bytes: &[u8; 64]) -> CtOption<Self> {
+        NonZeroPallasBase::from_bytes(bytes[32..].try_into().unwrap()).map(|ivk| {
+            IncomingViewingKey {
+                dk: DiversifierKey(bytes[..32].try_into().unwrap()),
+                ivk: KeyAgreementPrivateKey(ivk.into()),
+            }
+        })
+    }
+
     /// Returns the default payment address for this key.
     pub fn default_address(&self) -> Address {
         self.address(self.dk.default_diversifier())
@@ -410,6 +420,12 @@ impl From<&FullViewingKey> for OutgoingViewingKey {
     }
 }
 
+impl From<[u8; 32]> for OutgoingViewingKey {
+    fn from(ovk: [u8; 32]) -> Self {
+        OutgoingViewingKey(ovk)
+    }
+}
+
 impl AsRef<[u8; 32]> for OutgoingViewingKey {
     fn as_ref(&self) -> &[u8; 32] {
         &self.0
@@ -421,7 +437,7 @@ impl AsRef<[u8; 32]> for OutgoingViewingKey {
 /// Defined in [Zcash Protocol Spec § 4.2.3: Orchard Key Components][orchardkeycomponents].
 ///
 /// [orchardkeycomponents]: https://zips.z.cash/protocol/nu5.pdf#orchardkeycomponents
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct DiversifiedTransmissionKey(NonIdentityPallasPoint);
 
 impl DiversifiedTransmissionKey {
@@ -517,6 +533,12 @@ impl EphemeralPublicKey {
 pub struct SharedSecret(NonIdentityPallasPoint);
 
 impl SharedSecret {
+    /// For checking test vectors only.
+    #[cfg(test)]
+    pub(crate) fn to_bytes(&self) -> [u8; 32] {
+        self.0.to_bytes()
+    }
+
     /// Defined in [Zcash Protocol Spec § 5.4.5.6: Orchard Key Agreement][concreteorchardkdf].
     ///
     /// [concreteorchardkdf]: https://zips.z.cash/protocol/nu5.pdf#concreteorchardkdf

src/note.rs

@@ -95,6 +95,16 @@ pub struct Note {
     rseed: RandomSeed,
 }
 
+impl PartialEq for Note {
+    fn eq(&self, other: &Self) -> bool {
+        // Notes are canonically defined by their commitments.
+        ExtractedNoteCommitment::from(self.commitment())
+            .eq(&ExtractedNoteCommitment::from(other.commitment()))
+    }
+}
+
+impl Eq for Note {}
+
 impl Note {
     pub(crate) fn from_parts(
         recipient: Address,

src/note/commitment.rs

@@ -3,7 +3,7 @@ use std::iter;
 use bitvec::{array::BitArray, order::Lsb0};
 use ff::PrimeFieldBits;
 use pasta_curves::{arithmetic::FieldExt, pallas};
-use subtle::CtOption;
+use subtle::{ConstantTimeEq, CtOption};
 
 use crate::{constants::L_ORCHARD_BASE, primitives::sinsemilla, spec::extract_p, value::NoteValue};
 
@@ -77,3 +77,17 @@ impl From<&ExtractedNoteCommitment> for [u8; 32] {
         cmx.to_bytes()
     }
 }
+
+impl ConstantTimeEq for ExtractedNoteCommitment {
+    fn ct_eq(&self, other: &Self) -> subtle::Choice {
+        self.0.ct_eq(&other.0)
+    }
+}
+
+impl PartialEq for ExtractedNoteCommitment {
+    fn eq(&self, other: &Self) -> bool {
+        self.ct_eq(other).into()
+    }
+}
+
+impl Eq for ExtractedNoteCommitment {}

src/note_encryption.rs

@@ -248,3 +248,163 @@ impl<T> ShieldedOutput<OrchardDomain> for Action<T> {
         &self.encrypted_note().enc_ciphertext
     }
 }
+
+struct CompactAction {
+    ephemeral_key: EphemeralKeyBytes,
+    cmx: ExtractedNoteCommitment,
+    enc_ciphertext: [u8; 52],
+}
+
+impl<T> From<&Action<T>> for CompactAction {
+    fn from(action: &Action<T>) -> Self {
+        CompactAction {
+            ephemeral_key: action.ephemeral_key(),
+            cmx: action.cmx().clone(),
+            enc_ciphertext: action.encrypted_note().enc_ciphertext[..52]
+                .try_into()
+                .unwrap(),
+        }
+    }
+}
+
+impl ShieldedOutput<OrchardDomain> for CompactAction {
+    fn ephemeral_key(&self) -> EphemeralKeyBytes {
+        EphemeralKeyBytes(self.ephemeral_key.0)
+    }
+
+    fn cmstar_bytes(&self) -> [u8; 32] {
+        self.cmx.to_bytes()
+    }
+
+    fn enc_ciphertext(&self) -> &[u8] {
+        &self.enc_ciphertext
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rand::rngs::OsRng;
+    use zcash_note_encryption::{
+        try_compact_note_decryption, try_note_decryption, try_output_recovery_with_ovk,
+        EphemeralKeyBytes,
+    };
+
+    use super::{prf_ock_orchard, CompactAction, OrchardDomain, OrchardNoteEncryption};
+    use crate::{
+        bundle::Action,
+        keys::{
+            DiversifiedTransmissionKey, Diversifier, EphemeralSecretKey, IncomingViewingKey,
+            OutgoingViewingKey,
+        },
+        note::{ExtractedNoteCommitment, Nullifier, RandomSeed, TransmittedNoteCiphertext},
+        primitives::redpallas,
+        value::{NoteValue, ValueCommitment},
+        Address, Note,
+    };
+
+    #[test]
+    fn test_vectors() {
+        let test_vectors = crate::test_vectors::note_encryption::test_vectors();
+
+        for tv in test_vectors {
+            //
+            // Load the test vector components
+            //
+
+            // Recipient key material
+            let ivk = IncomingViewingKey::from_bytes(&tv.incoming_viewing_key).unwrap();
+            let ovk = OutgoingViewingKey::from(tv.ovk);
+            let d = Diversifier::from_bytes(tv.default_d);
+            let pk_d = DiversifiedTransmissionKey::from_bytes(&tv.default_pk_d).unwrap();
+
+            // Received Action
+            let cv_net = ValueCommitment::from_bytes(&tv.cv_net).unwrap();
+            let rho = Nullifier::from_bytes(&tv.rho).unwrap();
+            let cmx = ExtractedNoteCommitment::from_bytes(&tv.cmx).unwrap();
+
+            let esk = EphemeralSecretKey::from_bytes(&tv.esk).unwrap();
+            let ephemeral_key = EphemeralKeyBytes(tv.ephemeral_key);
+
+            // Details about the expected note
+            let value = NoteValue::from_raw(tv.v);
+            let rseed = RandomSeed::from_bytes(tv.rseed, &rho).unwrap();
+
+            //
+            // Test the individual components
+            //
+
+            let shared_secret = esk.agree(&pk_d);
+            assert_eq!(shared_secret.to_bytes(), tv.shared_secret);
+
+            let k_enc = shared_secret.kdf_orchard(&ephemeral_key);
+            assert_eq!(k_enc.as_bytes(), tv.k_enc);
+
+            let ock = prf_ock_orchard(&ovk, &cv_net, &cmx.to_bytes(), &ephemeral_key);
+            assert_eq!(ock.as_ref(), tv.ock);
+
+            let recipient = Address::from_parts(d, pk_d);
+            let note = Note::from_parts(recipient, value, rho, rseed);
+            assert_eq!(ExtractedNoteCommitment::from(note.commitment()), cmx);
+
+            let action = Action::from_parts(
+                // rho is the nullifier in the receiving Action.
+                rho,
+                // We don't need a valid rk for this test.
+                redpallas::VerificationKey::dummy(),
+                cmx.clone(),
+                TransmittedNoteCiphertext {
+                    epk_bytes: ephemeral_key.0,
+                    enc_ciphertext: tv.c_enc,
+                    out_ciphertext: tv.c_out,
+                },
+                cv_net.clone(),
+                (),
+            );
+
+            //
+            // Test decryption
+            // (Tested first because it only requires immutable references.)
+            //
+
+            let domain = OrchardDomain { rho };
+
+            match try_note_decryption(&domain, &ivk, &action) {
+                Some((decrypted_note, decrypted_to, decrypted_memo)) => {
+                    assert_eq!(decrypted_note, note);
+                    assert_eq!(decrypted_to, recipient);
+                    assert_eq!(&decrypted_memo[..], &tv.memo[..]);
+                }
+                None => panic!("Note decryption failed"),
+            }
+
+            match try_compact_note_decryption(&domain, &ivk, &CompactAction::from(&action)) {
+                Some((decrypted_note, decrypted_to)) => {
+                    assert_eq!(decrypted_note, note);
+                    assert_eq!(decrypted_to, recipient);
+                }
+                None => panic!("Compact note decryption failed"),
+            }
+
+            match try_output_recovery_with_ovk(&domain, &ovk, &action, &cv_net, &tv.c_out) {
+                Some((decrypted_note, decrypted_to, decrypted_memo)) => {
+                    assert_eq!(decrypted_note, note);
+                    assert_eq!(decrypted_to, recipient);
+                    assert_eq!(&decrypted_memo[..], &tv.memo[..]);
+                }
+                None => panic!("Output recovery failed"),
+            }
+
+            //
+            // Test encryption
+            //
+
+            let ne = OrchardNoteEncryption::new_with_esk(esk, Some(ovk), note, recipient, tv.memo);
+
+            assert_eq!(ne.encrypt_note_plaintext().as_ref(), &tv.c_enc[..]);
+            assert_eq!(
+                &ne.encrypt_outgoing_plaintext(&cv_net, &cmx, &mut OsRng)[..],
+                &tv.c_out[..]
+            );
+        }
+    }
+}

src/primitives/redpallas.rs

@@ -5,6 +5,9 @@ use std::convert::{TryFrom, TryInto};
 use pasta_curves::pallas;
 use rand::{CryptoRng, RngCore};
 
+#[cfg(test)]
+use rand::rngs::OsRng;
+
 /// A RedPallas signature type.
 pub trait SigType: reddsa::SigType + private::Sealed {}
 
@@ -93,6 +96,12 @@ impl<T: SigType> PartialEq for VerificationKey<T> {
 }
 
 impl VerificationKey<SpendAuth> {
+    /// Used in the note encryption tests.
+    #[cfg(test)]
+    pub(crate) fn dummy() -> Self {
+        VerificationKey((&reddsa::SigningKey::new(OsRng)).into())
+    }
+
     /// Randomizes this verification key with the given `randomizer`.
     ///
     /// Randomization is only supported for `SpendAuth` keys.

src/test_vectors.rs

@@ -1,2 +1,3 @@
 pub(crate) mod commitment_tree;
 pub(crate) mod keys;
+pub(crate) mod note_encryption;