pakstr 0.0.3 → 0.1.0

package/android-template/app/src/main/java/com/pakstr/app/crypto/Bip340Verifier.kt

@@ -0,0 +1,318 @@
+package com.pakstr.app.crypto
+
+import com.pakstr.app.debug.AppDebugLogger
+import org.bouncycastle.math.ec.ECPoint
+import java.math.BigInteger
+import java.security.MessageDigest
+
+/**
+ * Verifies BIP-340 Schnorr signatures over the secp256k1 curve.
+ *
+ * This implementation follows the BIP-340 verification algorithm:
+ *
+ * 1. Validate public key, message and signature sizes.
+ * 2. Lift the x-only public key to a curve point.
+ * 3. Compute the tagged challenge hash.
+ * 4. Reconstruct R = sG - eP.
+ * 5. Verify that R has an even Y coordinate and that its X coordinate
+ *    matches the signature's R value.
+ *
+ * Returns true only if the signature is fully valid.
+ */
+object Bip340Verifier {
+
+    private const val CHALLENGE_TAG =
+        "BIP0340/challenge"
+
+    /**
+     * Verifies a BIP-340 Schnorr signature.
+     *
+     * @param pubkeyHex x-only public key in hexadecimal format.
+     * @param messageHex 32-byte message hash in hexadecimal format.
+     * @param signatureHex Schnorr signature (r || s) in hexadecimal format.
+     *
+     * @return true if the signature is valid.
+     */
+    fun verify(
+        pubkeyHex: String,
+        messageHex: String,
+        signatureHex: String
+    ): Boolean {
+
+        return try {
+
+            val pubkey =
+                hexToBytes(pubkeyHex)
+
+            val message =
+                hexToBytes(messageHex)
+
+            val signature =
+                hexToBytes(signatureHex)
+
+            // BIP340 sizes
+            if (pubkey.size != 32)
+                return false
+
+            if (message.size != 32)
+                return false
+
+            if (signature.size != 64)
+                return false
+
+            // Extract r and s values from the 64-byte signature.
+            val r =
+                BigInteger(
+                    1,
+                    signature.copyOfRange(
+                        0,
+                        32
+                    )
+                )
+
+            val s =
+                BigInteger(
+                    1,
+                    signature.copyOfRange(
+                        32,
+                        64
+                    )
+                )
+
+            // BIP340 range checks
+            if (r >= Secp256k1.P)
+                return false
+
+
+            if (s >= Secp256k1.N)
+                return false
+
+            // Lift the x-only public key into a full secp256k1 point.
+            val P =
+                liftX(pubkey)
+
+            // Compute the BIP-340 tagged challenge hash.
+            val eBytes =
+                taggedHash(
+                    CHALLENGE_TAG,
+                    signature.copyOfRange(
+                        0,
+                        32
+                    ) +
+                            pubkey +
+                            message
+                )
+
+            val e =
+                BigInteger(
+                    1,
+                    eBytes
+                )
+                    .mod(
+                        Secp256k1.N
+                    )
+
+            // Reconstruct R = sG - eP as defined by BIP-340.
+            val R =
+                Secp256k1.G
+                    .multiply(s)
+                    .subtract(
+                        P.multiply(e)
+                    )
+                    .normalize()
+
+            if (R.isInfinity)
+                return false
+
+
+            if (!R.isValid)
+                return false
+
+            // BIP-340 requires the reconstructed point to have an even Y coordinate.
+            if (
+                R.affineYCoord
+                    .toBigInteger()
+                    .testBit(0)
+            ) {
+
+                return false
+
+            }
+
+            // Signature is valid only if the reconstructed X coordinate equals r.
+            val x = R.affineXCoord.toBigInteger()
+
+            return x == r
+
+        } catch (e: Exception) {
+
+            AppDebugLogger.log(
+                "BIP340",
+                "Verification failed: ${e.message}"
+            )
+
+            false
+
+        }
+    }
+
+    /**
+     * Converts a BIP-340 x-only public key into a full secp256k1 curve point.
+     *
+     * BIP-340 uses x-only public keys, so the corresponding curve point is
+     * reconstructed by selecting the even Y coordinate.
+     *
+     * @throws IllegalArgumentException if the provided x coordinate does not
+     * represent a valid point on the secp256k1 curve.
+     */
+    private fun liftX(
+        xBytes: ByteArray
+    ): ECPoint {
+
+        val x =
+            BigInteger(
+                1,
+                xBytes
+            )
+
+        if (x >= Secp256k1.P) {
+
+            throw IllegalArgumentException(
+                "Invalid x coordinate"
+            )
+        }
+
+        val curve =
+            Secp256k1.CURVE.curve
+
+        val alpha =
+            x.modPow(
+                BigInteger.valueOf(3),
+                Secp256k1.P
+            )
+                .add(
+                    curve.b.toBigInteger()
+                )
+                .mod(
+                    Secp256k1.P
+                )
+
+        var y =
+            sqrtMod(
+                alpha,
+                Secp256k1.P
+            )
+
+        // verify square root exists
+        if (
+            y.multiply(y)
+                .mod(Secp256k1.P) != alpha
+        ) {
+
+            throw IllegalArgumentException(
+                "Invalid public key"
+            )
+        }
+
+        if (y.testBit(0)) {
+
+            y = Secp256k1.P.subtract(y)
+
+        }
+
+        val point =
+            curve.createPoint(
+                x,
+                y
+            )
+
+        if (point.isInfinity) {
+
+            throw IllegalArgumentException(
+                "Point at infinity"
+            )
+        }
+
+        if (!point.isValid) {
+
+            throw IllegalArgumentException(
+                "Invalid curve point"
+            )
+
+        }
+        return point
+    }
+
+    /**
+     * Calculates modular square root for secp256k1.
+     *
+     * Since secp256k1 prime satisfies p ≡ 3 (mod 4),
+     * the square root can be calculated as a^((p+1)/4) mod p.
+     */
+    private fun sqrtMod(
+        a: BigInteger,
+        p: BigInteger
+    ): BigInteger {
+
+        return a.modPow(
+            p.add(BigInteger.ONE)
+                .divide(
+                    BigInteger.valueOf(4)
+                ),
+            p
+        )
+    }
+
+    private fun taggedHash(
+        tag: String,
+        msg: ByteArray
+    ): ByteArray {
+
+        val tagHash =
+            sha256(
+                tag.toByteArray()
+            )
+
+        return sha256(
+            tagHash +
+                    tagHash +
+                    msg
+        )
+
+    }
+
+    private fun sha256(
+        data: ByteArray
+    ): ByteArray {
+
+        return MessageDigest
+            .getInstance(
+                "SHA-256"
+            )
+            .digest(
+                data
+            )
+    }
+
+    private fun hexToBytes(
+        hex: String
+    ): ByteArray {
+
+        require(
+            hex.length % 2 == 0
+        )
+
+        return ByteArray(
+            hex.length / 2
+        ) { index ->
+
+            hex.substring(
+                index * 2,
+                index * 2 + 2
+            )
+                .toInt(16)
+                .toByte()
+
+        }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/CryptoInitializer.kt

@@ -0,0 +1,34 @@
+package com.pakstr.app.crypto
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider
+import java.security.Security
+
+/**
+ * Initializes the Bouncy Castle cryptographic provider.
+ *
+ * Bouncy Castle provides additional cryptographic algorithms and elliptic
+ * curve support required by the Nostr crypto layer, including secp256k1
+ * operations used for BIP-340 Schnorr signature verification.
+ *
+ * The provider is registered only once to avoid duplicate registrations.
+ */
+object CryptoInitializer {
+
+    /**
+     * Registers Bouncy Castle as a security provider if it is not already
+     * available.
+     *
+     * This method should be called during application startup before any
+     * cryptographic operations are performed.
+     */
+    fun init() {
+
+        if (
+            Security.getProvider("BC") == null
+        ) {
+            Security.addProvider(
+                BouncyCastleProvider()
+            )
+        }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/NostrEventHasher.kt

@@ -0,0 +1,100 @@
+package com.pakstr.app.crypto
+
+import org.json.JSONArray
+import org.json.JSONObject
+import java.security.MessageDigest
+
+/**
+ * Calculates Nostr event IDs according to the Nostr event hashing specification.
+ *
+ * The event ID is the SHA-256 hash of the serialized event array:
+ *
+ * [
+ *   0,
+ *   pubkey,
+ *   created_at,
+ *   kind,
+ *   tags,
+ *   content
+ * ]
+ *
+ * The resulting hash is used as the event identifier and is later signed
+ * using a Schnorr signature (BIP-340).
+ */
+object NostrEventHasher {
+
+    /**
+     * Calculates the SHA-256 event ID for a Nostr event.
+     *
+     * @param event unsigned Nostr event JSON object.
+     *
+     * @return hexadecimal SHA-256 hash of the serialized event.
+     */
+    fun hashEvent(
+        event: JSONObject
+    ): String {
+
+        val serialized =
+            JSONArray()
+                .apply {
+
+                    put(0)
+
+                    put(
+                        event.getString("pubkey")
+                    )
+
+                    put(
+                        event.getLong("created_at")
+                    )
+
+                    put(
+                        event.getInt("kind")
+                    )
+
+                    put(
+                        event.getJSONArray("tags")
+                    )
+
+                    put(
+                        event.getString("content")
+                    )
+
+                }
+                .toString()
+
+
+        return sha256Hex(
+            serialized.toByteArray()
+        )
+
+    }
+
+    /**
+     * Calculates SHA-256 digest.
+     */
+    private fun sha256(
+        data: ByteArray
+    ): ByteArray {
+
+        return MessageDigest
+            .getInstance("SHA-256")
+            .digest(data)
+
+    }
+
+    /**
+     * Calculates SHA-256 digest and returns it as lowercase hexadecimal string.
+     */
+    private fun sha256Hex(
+        data: ByteArray
+    ): String {
+
+        return sha256(data)
+            .joinToString("") {
+
+                "%02x".format(it)
+
+            }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/NostrEventVerifier.kt

@@ -0,0 +1,54 @@
+package com.pakstr.app.crypto
+
+import org.json.JSONObject
+
+/**
+ * Validates a complete signed Nostr event.
+ *
+ * A Nostr event is considered valid only when:
+ *
+ * 1. The event ID matches the SHA-256 hash of the canonical event data.
+ * 2. The Schnorr signature is valid for the event ID and public key.
+ *
+ * This ensures that the event was not modified after signing
+ * and that the signature belongs to the provided public key.
+ */
+object NostrEventVerifier {
+
+    /**
+     * Verifies the integrity and signature of a signed Nostr event.
+     *
+     * @param event Signed Nostr event containing:
+     *              id, pubkey, created_at, kind, tags, content and sig.
+     *
+     * @return true if both event hash and signature are valid.
+     */
+    fun verify(
+        event: JSONObject
+    ): Boolean {
+
+        val eventId =
+            event.getString("id")
+
+        val calculatedId =
+            NostrEventHasher.hashEvent(
+                event
+            )
+
+        if (
+            eventId != calculatedId
+        ) {
+            return false
+        }
+
+        return NostrSignatureVerifier.verify(
+
+            eventId,
+
+            event.getString("pubkey"),
+
+            event.getString("sig")
+
+        )
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/NostrSignatureVerifier.kt

@@ -0,0 +1,43 @@
+package com.pakstr.app.crypto
+
+/**
+ * Verifies Nostr Schnorr signatures.
+ *
+ * This class acts as a bridge between the Nostr event validation layer
+ * and the underlying BIP-340 Schnorr signature verification.
+ *
+ * The signature is verified against:
+ *
+ * - event ID (32-byte message hash)
+ * - x-only public key
+ * - Schnorr signature (r || s)
+ *
+ * A valid signature proves that the event was signed by the owner
+ * of the corresponding private key.
+ */
+object NostrSignatureVerifier {
+    /**
+     * Verifies the signature of a Nostr event.
+     *
+     * @param eventId SHA-256 event ID used as the signed message.
+     * @param pubkey x-only secp256k1 public key.
+     * @param signature BIP-340 Schnorr signature.
+     *
+     * @return true if the signature is valid, otherwise false.
+     */
+    fun verify(
+        eventId: String,
+        pubkey: String,
+        signature: String
+    ): Boolean {
+
+
+        return Bip340Verifier.verify(
+            pubkeyHex = pubkey,
+            messageHex = eventId,
+            signatureHex = signature
+        )
+
+    }
+
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/Secp256k1.kt

@@ -0,0 +1,63 @@
+package com.pakstr.app.crypto
+
+import org.bouncycastle.asn1.x9.X9ECParameters
+import org.bouncycastle.crypto.ec.CustomNamedCurves
+import org.bouncycastle.math.ec.ECPoint
+import java.math.BigInteger
+
+/**
+ * Provides secp256k1 curve parameters used by BIP-340 Schnorr verification.
+ *
+ * secp256k1 is the elliptic curve used by Bitcoin and Nostr Schnorr signatures.
+ *
+ * This object exposes the curve constants required for elliptic curve
+ * operations:
+ *
+ * - G: Generator point of the curve.
+ * - N: Order of the generator point.
+ * - P: Field prime defining the finite field.
+ *
+ * These values are used by Bip340Verifier when reconstructing and validating
+ * Schnorr signature points.
+ */
+object Secp256k1 {
+
+    /**
+     * secp256k1 curve parameters provided by Bouncy Castle.
+     */
+    val CURVE: X9ECParameters =
+        CustomNamedCurves.getByName(
+            "secp256k1"
+        )
+
+    /**
+     * Generator point (G) of the secp256k1 curve.
+     *
+     * All public keys are derived as:
+     *
+     * publicKey = privateKey * G
+     */
+    val G: ECPoint =
+        CURVE.g
+
+    /**
+     * Order of the generator point.
+     *
+     * Used for scalar multiplication limits in Schnorr verification.
+     */
+    val N: BigInteger =
+        CURVE.n
+
+    /**
+     * Field prime (p) defining the secp256k1 finite field.
+     *
+     * The curve equation is:
+     *
+     * y² = x³ + 7 mod p
+     */
+    val P: BigInteger =
+        CURVE.curve
+            .field
+            .characteristic
+
+}

package/android-template/app/src/main/java/com/pakstr/app/debug/AppDebugLogger.kt

@@ -0,0 +1,21 @@
+package com.pakstr.app.debug
+
+import android.util.Log
+import com.pakstr.app.BuildConfig
+
+object AppDebugLogger {
+
+    fun log(
+        tag: String,
+        message: String
+    ) {
+
+        if (BuildConfig.DEBUG) {
+
+            Log.d(
+                tag,
+                message
+            )
+        }
+    }
+}