Commit Graph

26 Commits

Author SHA1 Message Date
Jack Grigg c4ffb7c617 Rework PRF^expand to use explicit domains
`prf_expand{_vec}` have been replaced by the `PrfExpand` enum, which
has `PrfExpand::{expand, with_ad, with_ad_slices}` methods for use
within each domain as necessary.
2021-05-28 13:12:25 +01:00
Jack Grigg cea8a3ab69 Move prf_expand{_vec} into a submodule for clarity 2021-05-28 12:42:01 +01:00
str4d 2bbbc3ec94
Update comments
Co-authored-by: ying tong <yingtong@z.cash>
2021-05-21 21:24:08 +01:00
Jack Grigg 736de1156b Ensure that Notes always have valid commitments
Implements the change from spec version 2021.1.23 to sample a new rseed
if a note is generated without a valid commitment.
2021-05-11 18:51:57 +08:00
Jack Grigg 76a39d29c1 Change diversify_hash and ka_orchard to use non-zero types
This matches the changes to KA^Orchard in spec version 2021.1.23.
2021-05-11 18:51:57 +08:00
Jack Grigg 9a828febd7 Change `commit_ivk` to return a non-zero Pallas base field element
The type system now enforces that `ivk != 0`.
2021-05-11 18:51:57 +08:00
Jack Grigg c08d12cc52 Use incomplete addition in SinsemillaHashToPoint
This requires exposing the ⊥ case throughout the return types. We
prevent it from propagating into the Orchard note and key types by
ensuring that:

- When we generate keys or notes, if we encounter ⊥ we discard and
  re-generate.
- When we construct keys or notes via any other pathway (e.g. parsing
  from bytes), we check for and reject ⊥.
2021-04-20 10:05:56 +12:00
Jack Grigg 907ff46078 Simulate incomplete addition
Sinsemilla will use incomplete addition inside the circuit for
efficiency, but the pasta_curves crate uses complete addition.
2021-04-20 10:04:44 +12:00
Jack Grigg 4c34a61c57 Use const generics for poseidon::ConstantLength 2021-03-30 14:13:15 +13:00
Jack Grigg 0f8c5b7dd3 Document TODO for SinsemillaShortCommit usage
https://github.com/zcash/orchard/issues/55
2021-03-30 13:55:29 +13:00
Jack Grigg 3b14cfc133 Fix link to NU5 protocol spec draft 2021-03-30 13:54:23 +13:00
Jack Grigg 0f6eb9ca6c Nullifier derivation 2021-03-26 07:51:05 +13:00
Jack Grigg 1a37ca492d Extract spec::mod_r_p helper from spec::commit_ivk 2021-03-26 07:51:05 +13:00
therealyingtong 873e1b7d7e Call hash_to_curve() only when constructing new domain
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-03-24 12:10:37 +08:00
therealyingtong a3134e34c5 Introduce HashDomain and CommitDomain traits
Co-authored-by: Jack Grigg <thestr4d@gmail.com>
2021-03-24 12:09:11 +08:00
Jack Grigg 3911fb3202 Use Pallas directly from pasta_curves crate 2021-03-18 15:06:16 +13:00
str4d 05e86a4d98
Reuse the hasher inside diversify_hash
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-03-18 13:39:04 +13:00
Jack Grigg 42ea809b64 Update protocol spec references 2021-03-18 08:30:22 +13:00
Jack Grigg e0417268ad Make address generation infallible again
DiversifyHash is altered to replace the identity with another fixed
point that is known to not be the identity.
2021-03-18 08:30:22 +13:00
Jack Grigg 3c8befa0f3 Remove TODO from extract_p
The protocol spec now returns \mathbb{P}_x instead of a bit sequence,
matching what we do here.
2021-03-16 09:36:59 +13:00
Jack Grigg 46bf89c122 Update ivk derivation to match latest protocol spec draft 2021-03-16 09:33:07 +13:00
Jack Grigg e98f324d7d Ensure diversify_hash does not return the identity
This makes diversified address generation fallible (though with
negligible probability). We expose this to users, so they can decide how
to handle it (either just unwrapping, or incrementing the diversifier
index).

We alter spending key construction to reject spending keys that would
not result in a default address (with diversifier index 0).
2021-03-16 09:03:44 +13:00
Jack Grigg 2462bb219b Use [u8; 64] as the output of prf_expand to match the spec 2021-03-09 10:33:56 +13:00
Jack Grigg 26701c33af Fix commit_ivk specification
Commit^ivk takes ak as a point, and commits to its entire serialization
(not just the x coordinate).
2021-03-09 08:28:53 +13:00
Jack Grigg 9455158190 Use protocol spec URL anchors as link handles 2021-03-06 01:18:58 +00:00
Jack Grigg f0779792bc Orchard key components 2021-03-05 23:28:16 +00:00