mirror of https://github.com/zcash/orchard.git
93 lines
3.9 KiB
Rust
93 lines
3.9 KiB
Rust
//! Utility functions for computing bundle commitments
|
|
|
|
use blake2b_simd::{Hash as Blake2bHash, Params, State};
|
|
|
|
use crate::bundle::{Authorization, Authorized, Bundle};
|
|
|
|
const ZCASH_ORCHARD_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrchardHash";
|
|
const ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActCHash";
|
|
const ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActMHash";
|
|
const ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOrcActNHash";
|
|
const ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxAuthOrchaHash";
|
|
|
|
fn hasher(personal: &[u8; 16]) -> State {
|
|
Params::new().hash_length(32).personal(personal).to_state()
|
|
}
|
|
|
|
/// Write disjoint parts of each Orchard shielded action as 3 separate hashes:
|
|
/// * \[(nullifier, cmx, ephemeral_key, enc_ciphertext\[..52\])*\] personalized
|
|
/// with ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION
|
|
/// * \[enc_ciphertext\[52..564\]*\] (memo ciphertexts) personalized
|
|
/// with ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION
|
|
/// * \[(cv, rk, enc_ciphertext\[564..\], out_ciphertext)*\] personalized
|
|
/// with ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION
|
|
/// as defined in [ZIP-244: Transaction Identifier Non-Malleability][zip244]
|
|
///
|
|
/// Then, hash these together along with (flags, value_balance_orchard, anchor_orchard),
|
|
/// personalized with ZCASH_ORCHARD_ACTIONS_HASH_PERSONALIZATION
|
|
///
|
|
/// [zip244]: https://zips.z.cash/zip-0244
|
|
pub(crate) fn hash_bundle_txid_data<A: Authorization, V: Copy + Into<i64>>(
|
|
bundle: &Bundle<A, V>,
|
|
) -> Blake2bHash {
|
|
let mut h = hasher(ZCASH_ORCHARD_HASH_PERSONALIZATION);
|
|
let mut ch = hasher(ZCASH_ORCHARD_ACTIONS_COMPACT_HASH_PERSONALIZATION);
|
|
let mut mh = hasher(ZCASH_ORCHARD_ACTIONS_MEMOS_HASH_PERSONALIZATION);
|
|
let mut nh = hasher(ZCASH_ORCHARD_ACTIONS_NONCOMPACT_HASH_PERSONALIZATION);
|
|
|
|
for action in bundle.actions().iter() {
|
|
ch.update(&action.nullifier().to_bytes());
|
|
ch.update(&action.cmx().to_bytes());
|
|
ch.update(&action.encrypted_note().epk_bytes);
|
|
ch.update(&action.encrypted_note().enc_ciphertext[..52]);
|
|
|
|
mh.update(&action.encrypted_note().enc_ciphertext[52..564]);
|
|
|
|
nh.update(&action.cv_net().to_bytes());
|
|
nh.update(&<[u8; 32]>::from(action.rk()));
|
|
nh.update(&action.encrypted_note().enc_ciphertext[564..]);
|
|
nh.update(&action.encrypted_note().out_ciphertext);
|
|
}
|
|
|
|
h.update(ch.finalize().as_bytes());
|
|
h.update(mh.finalize().as_bytes());
|
|
h.update(nh.finalize().as_bytes());
|
|
h.update(&[bundle.flags().to_byte()]);
|
|
h.update(&(*bundle.value_balance()).into().to_le_bytes());
|
|
h.update(&bundle.anchor().to_bytes());
|
|
h.finalize()
|
|
}
|
|
|
|
/// Construct the commitment for the absent bundle as defined in
|
|
/// [ZIP-244: Transaction Identifier Non-Malleability][zip244]
|
|
///
|
|
/// [zip244]: https://zips.z.cash/zip-0244
|
|
pub fn hash_bundle_txid_empty() -> Blake2bHash {
|
|
hasher(ZCASH_ORCHARD_HASH_PERSONALIZATION).finalize()
|
|
}
|
|
|
|
/// Construct the commitment to the authorizing data of an
|
|
/// authorized bundle as defined in [ZIP-244: Transaction
|
|
/// Identifier Non-Malleability][zip244]
|
|
///
|
|
/// [zip244]: https://zips.z.cash/zip-0244
|
|
pub(crate) fn hash_bundle_auth_data<V>(bundle: &Bundle<Authorized, V>) -> Blake2bHash {
|
|
let mut h = hasher(ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION);
|
|
h.update(bundle.authorization().proof().as_ref());
|
|
for action in bundle.actions().iter() {
|
|
h.update(&<[u8; 64]>::from(action.authorization()));
|
|
}
|
|
h.update(&<[u8; 64]>::from(
|
|
bundle.authorization().binding_signature(),
|
|
));
|
|
h.finalize()
|
|
}
|
|
|
|
/// Construct the commitment for an absent bundle as defined in
|
|
/// [ZIP-244: Transaction Identifier Non-Malleability][zip244]
|
|
///
|
|
/// [zip244]: https://zips.z.cash/zip-0244
|
|
pub fn hash_bundle_auth_empty() -> Blake2bHash {
|
|
hasher(ZCASH_ORCHARD_SIGS_HASH_PERSONALIZATION).finalize()
|
|
}
|