feat: bls#2048
Conversation
| MintKeyPair::from_secret_key(SecretKey::bls_from_reduced_bytes(&digest)) | ||
| } | ||
| KeySetVersion::Version02 => MintKeyPair::from_secret_key( | ||
| SecretKey::bls_from_reduced_bytes(&secret_key.secret_bytes()), |
There was a problem hiding this comment.
Keys should also be rejection sampled, because the curve order of BLS is much smaller than
nutshell reference: https://github.com/cashubtc/nutshell/pull/999/changes#diff-3fb6bb16c1a8d73a624c853e623ef777662162ec5378f7970ad1ec2233caffbfR235-R247
| weight_material.extend_from_slice(&(i as u32).to_be_bytes()); | ||
| weight_material.push(counter); | ||
| let weight = Sha256Hash::hash(&weight_material).to_byte_array(); | ||
| let scalar = BlsSecretKey::from_reduced_bytes(&weight); |
There was a problem hiding this comment.
from_reduced_bytes reduces the sample modulo r instead of erroring? we should reject sample here as well. I'm pretty sure that's how the spec goes.
There was a problem hiding this comment.
Well spotted! Also, the counter should be u32, not u8 - it is part of the transcript, so a change in byte width means the transcript is different to spec.
derive_batch_weights used modular reduction and a single-byte counter, diverging from the spec (rejection sampling against BLS_FR_ORDER with a u32_BE counter) and failing the published NUT-00 batch test vector. Use canonical BlsSecretKey::from_bytes (rejects x >= order) plus a non-zero check, and encode the counter as u32_BE. Adds the NUT-00 batch vector as a conformance test.
generate_bls reduced 32 random bytes modulo the field order, biasing the distribution and admitting the forbidden zero scalar. Rejection-sample a canonical non-zero scalar in Fr* instead.
Adds two libFuzzer targets for the new pairing-based protocol: - fuzz_bls_pubkey_in_conditions: injects *valid* compressed BLS G1/G2 points into the secp256k1-only P2PK/HTLC pubkey positions (data field, pubkeys, refund_keys) and runs verify_p2pk/verify_htlc, asserting they return an error rather than panic. Random hex strings essentially never decode to a subgroup-correct BLS point, so this reaches the check_duplicate_pubkeys panic that the existing fuzz_p2pk_verify could not. Would have caught the parsing-panic DoS. - fuzz_bls_dhke: stresses panic-safety of BLS point/scalar parsing and the blind/sign/unblind/verify and batch-verify paths (including the rejection-sampling weight loop), and checks soundness invariants: honest v3 proofs verify, honest batches batch-verify, tampering fails. Adds bls_g1_pubkey_from/bls_g2_pubkey_from helpers to the fuzz lib.
3 participants
Description
Notes to the reviewers
Suggested CHANGELOG Updates
CHANGED
ADDED
REMOVED
FIXED
Checklist
just quick-checkbefore committingcrates/cdk-ffi)