Merge pull request #140 from nuttycom/bundle_zip244_commitments

Implement ZIP-244 txid and authorizing commitments.

src/bundle.rs

@@ -1,10 +1,15 @@
 //! Structs related to bundles of Orchard actions.
 
+pub mod commitments;
+
+use std::io;
 use std::mem;
 
+use blake2b_simd::Hash as Blake2bHash;
 use nonempty::NonEmpty;
 
 use crate::{
+    bundle::commitments::{hash_bundle_auth_data, hash_bundle_txid_data},
     circuit::{Instance, Proof, VerifyingKey},
     note::{ExtractedNoteCommitment, Nullifier, TransmittedNoteCiphertext},
     primitives::redpallas::{self, Binding, SpendAuth},
@@ -142,6 +147,10 @@ pub struct Flags {
     outputs_enabled: bool,
 }
 
+const FLAG_SPENDS_ENABLED: u8 = 0b0000_0001;
+const FLAG_OUTPUTS_ENABLED: u8 = 0b0000_0010;
+const FLAGS_EXPECTED_UNSET: u8 = !(FLAG_SPENDS_ENABLED | FLAG_OUTPUTS_ENABLED);
+
 impl Flags {
     /// Construct a set of flags from its constituent parts
     pub fn from_parts(spends_enabled: bool, outputs_enabled: bool) -> Self {
@@ -168,6 +177,39 @@ impl Flags {
     pub fn outputs_enabled(&self) -> bool {
         self.outputs_enabled
     }
+
+    /// Serialize flags to a byte as defined in [Zcash Protocol Spec § 7.1: Transaction
+    /// Encoding And Consensus][txencoding].
+    ///
+    /// [txencoding]: https://zips.z.cash/protocol/protocol.pdf#txnencoding
+    pub fn to_byte(&self) -> u8 {
+        let mut value = 0u8;
+        if self.spends_enabled {
+            value |= FLAG_SPENDS_ENABLED;
+        }
+        if self.outputs_enabled {
+            value |= FLAG_OUTPUTS_ENABLED;
+        }
+        value
+    }
+
+    /// Parse from a single byte as defined in [Zcash Protocol Spec § 7.1: Transaction
+    /// Encoding And Consensus][txencoding].
+    ///
+    /// [txencoding]: https://zips.z.cash/protocol/protocol.pdf#txnencoding
+    pub fn from_byte(value: u8) -> io::Result<Self> {
+        if value & FLAGS_EXPECTED_UNSET == 0 {
+            Ok(Self::from_parts(
+                value & FLAG_SPENDS_ENABLED != 0,
+                value & FLAG_OUTPUTS_ENABLED != 0,
+            ))
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "Unexpected bits set in Orchard flags value.",
+            ))
+        }
+    }
 }
 
 /// Defines the authorization type of an Orchard bundle.
@@ -242,8 +284,11 @@ impl<T: Authorization, V> Bundle<T, V> {
 
     /// Computes a commitment to the effects of this bundle, suitable for inclusion within
     /// a transaction ID.
-    pub fn commitment(&self) -> BundleCommitment {
-        todo!()
+    pub fn commitment<'a>(&'a self) -> BundleCommitment
+    where
+        i64: From<&'a V>,
+    {
+        BundleCommitment(hash_bundle_txid_data(self))
     }
 
     /// Construct a new bundle by applying a transformation that might fail
@@ -370,7 +415,7 @@ impl<V> Bundle<Authorized, V> {
     ///
     /// This together with `Bundle::commitment` bind the entire bundle.
     pub fn authorizing_commitment(&self) -> BundleAuthorizingCommitment {
-        todo!()
+        BundleAuthorizingCommitment(hash_bundle_auth_data(self))
     }
 
     /// Verifies the proof for this bundle.
@@ -386,11 +431,11 @@ impl<V> Bundle<Authorized, V> {
 /// This commitment is non-malleable, in the sense that a bundle's commitment will only
 /// change if the effects of the bundle are altered.
 #[derive(Debug)]
-pub struct BundleCommitment;
+pub struct BundleCommitment(pub Blake2bHash);
 
 /// A commitment to the authorizing data within a bundle of actions.
 #[derive(Debug)]
-pub struct BundleAuthorizingCommitment;
+pub struct BundleAuthorizingCommitment(pub Blake2bHash);
 
 /// Generators for property testing.
 #[cfg(any(test, feature = "test-dependencies"))]

src/bundle/commitments.rs

@@ -0,0 +1,102 @@
+//! Utility functions for computing bundle commitments
+
+use blake2b_simd::{Hash as Blake2bHash, Params, State};
+use std::io::Write;
+
+use crate::bundle::{Authorization, Authorized, Bundle};
+
+const ZCASH_ORCHARD_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrchardHash";
+const ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActCHash";
+const ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActMHash";
+const ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActNHash";
+const ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxAuthOrchaHash";
+
+fn hasher(personal: &[u8; 16]) -> State {
+    Params::new().hash_length(32).personal(personal).to_state()
+}
+
+/// Write disjoint parts of each Orchard shielded action as 3 separate hashes:
+/// * \[(nullifier, cmx, ephemeral_key, enc_ciphertext\[..52\])*\] personalized
+///   with ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION
+/// * \[enc_ciphertext\[52..564\]*\] (memo ciphertexts) personalized
+///   with ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION
+/// * \[(cv, rk, enc_ciphertext\[564..\], out_ciphertext)*\] personalized
+///   with ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION
+/// as defined in [ZIP-244: Transaction Identifier Non-Malleability][zip244]
+///
+/// Then, hash these together along with (flags, value_balance_orchard, anchor_orchard),
+/// personalized with ZCASH_ORCHARD_ACTIONS_HASH_PERSONALIZATION
+///
+/// [zip244]: https://zips.z.cash/zip-0244
+pub fn hash_bundle_txid_data<'a, A: Authorization, V>(bundle: &'a Bundle<A, V>) -> Blake2bHash
+where
+    i64: From<&'a V>,
+{
+    let mut h = hasher(ZCASH_ORCHARD_HASH_PERSONALIZATION);
+    let mut ch = hasher(ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION);
+    let mut mh = hasher(ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION);
+    let mut nh = hasher(ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION);
+
+    for action in bundle.actions().iter() {
+        ch.write_all(&action.nullifier().to_bytes()).unwrap();
+        ch.write_all(&action.cmx().to_bytes()).unwrap();
+        ch.write_all(&action.encrypted_note().epk_bytes).unwrap();
+        ch.write_all(&action.encrypted_note().enc_ciphertext[..52])
+            .unwrap();
+
+        mh.write_all(&action.encrypted_note().enc_ciphertext[52..564])
+            .unwrap();
+
+        nh.write_all(&action.cv_net().to_bytes()).unwrap();
+        nh.write_all(&<[u8; 32]>::from(action.rk())).unwrap();
+        nh.write_all(&action.encrypted_note().enc_ciphertext[564..])
+            .unwrap();
+        nh.write_all(&action.encrypted_note().out_ciphertext)
+            .unwrap();
+    }
+
+    h.write_all(&ch.finalize().as_bytes()).unwrap();
+    h.write_all(&mh.finalize().as_bytes()).unwrap();
+    h.write_all(&nh.finalize().as_bytes()).unwrap();
+    h.write_all(&[bundle.flags().to_byte()]).unwrap();
+    h.write_all(&<i64>::from(bundle.value_balance()).to_le_bytes())
+        .unwrap();
+    h.write_all(&bundle.anchor().to_bytes()).unwrap();
+    h.finalize()
+}
+
+/// Construct the commitment for the absent bundle as defined in
+/// [ZIP-244: Transaction Identifier Non-Malleability][zip244]
+///
+/// [zip244]: https://zips.z.cash/zip-0244
+pub fn hash_bundle_txid_empty() -> Blake2bHash {
+    hasher(ZCASH_ORCHARD_HASH_PERSONALIZATION).finalize()
+}
+
+/// Construct the commitment to the authorizing data of an
+/// authorized bundle as defined in [ZIP-244: Transaction
+/// Identifier Non-Malleability][zip244]
+///
+/// [zip244]: https://zips.z.cash/zip-0244
+pub fn hash_bundle_auth_data<V>(bundle: &Bundle<Authorized, V>) -> Blake2bHash {
+    let mut h = hasher(ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION);
+    h.write_all(bundle.authorization().proof().as_ref())
+        .unwrap();
+    for action in bundle.actions().iter() {
+        h.write_all(&<[u8; 64]>::from(action.authorization()))
+            .unwrap();
+    }
+    h.write_all(&<[u8; 64]>::from(
+        bundle.authorization().binding_signature(),
+    ))
+    .unwrap();
+    h.finalize()
+}
+
+/// Construct the commitment for an absent bundle as defined in
+/// [ZIP-244: Transaction Identifier Non-Malleability][zip244]
+///
+/// [zip244]: https://zips.z.cash/zip-0244
+pub fn hash_bundle_auth_empty() -> Blake2bHash {
+    hasher(ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION).finalize()
+}