pakstr 0.20.0 → 0.21.1

package/android-template/app/src/main/java/com/pakstr/app/crypto/Bip340Signer.kt

@@ -0,0 +1,104 @@
+package com.pakstr.app.crypto
+
+import java.math.BigInteger
+import java.util.Arrays
+
+internal object Bip340Signer {
+    private const val AUXILIARY_TAG = "BIP0340/aux"
+    private const val NONCE_TAG = "BIP0340/nonce"
+    private const val CHALLENGE_TAG = "BIP0340/challenge"
+
+    fun sign(
+        privateKey: ByteArray,
+        message: ByteArray,
+        auxiliaryRandom: ByteArray
+    ): ByteArray {
+        require(message.size == 32) {
+            "Message must be 32 bytes"
+        }
+        require(auxiliaryRandom.size == 32) {
+            "Auxiliary randomness must be 32 bytes"
+        }
+
+        val originalScalar = Secp256k1.privateScalar(privateKey)
+        val publicPoint = Secp256k1.G.multiply(originalScalar).normalize()
+        val publicKey =
+            Secp256k1.fixedSizeBytes(
+                publicPoint.affineXCoord.toBigInteger()
+            )
+        val scalar =
+            if (publicPoint.affineYCoord.toBigInteger().testBit(0)) {
+                Secp256k1.N.subtract(originalScalar)
+            } else {
+                originalScalar
+            }
+
+        val scalarBytes = Secp256k1.fixedSizeBytes(scalar)
+        val auxiliaryHash =
+            Bip340Hash.taggedHash(
+                AUXILIARY_TAG,
+                auxiliaryRandom
+            )
+        val maskedScalar = ByteArray(32) { index ->
+            (scalarBytes[index].toInt() xor
+                    auxiliaryHash[index].toInt()).toByte()
+        }
+        val nonceHash =
+            Bip340Hash.taggedHash(
+                NONCE_TAG,
+                maskedScalar,
+                publicKey,
+                message
+            )
+
+        try {
+            var nonce =
+                BigInteger(1, nonceHash)
+                    .mod(Secp256k1.N)
+            require(nonce.signum() != 0) {
+                "Invalid signing nonce"
+            }
+
+            val noncePoint = Secp256k1.G.multiply(nonce).normalize()
+            if (noncePoint.affineYCoord.toBigInteger().testBit(0)) {
+                nonce = Secp256k1.N.subtract(nonce)
+            }
+
+            val r =
+                Secp256k1.fixedSizeBytes(
+                    noncePoint.affineXCoord.toBigInteger()
+                )
+            val challenge =
+                BigInteger(
+                    1,
+                    Bip340Hash.taggedHash(
+                        CHALLENGE_TAG,
+                        r,
+                        publicKey,
+                        message
+                    )
+                ).mod(Secp256k1.N)
+            val s =
+                nonce.add(challenge.multiply(scalar))
+                    .mod(Secp256k1.N)
+            val signature = r + Secp256k1.fixedSizeBytes(s)
+
+            check(
+                Bip340Verifier.verify(
+                    Bip340Hash.bytesToHex(publicKey),
+                    Bip340Hash.bytesToHex(message),
+                    Bip340Hash.bytesToHex(signature)
+                )
+            ) {
+                "Generated signature failed verification"
+            }
+
+            return signature
+        } finally {
+            Arrays.fill(scalarBytes, 0)
+            Arrays.fill(auxiliaryHash, 0)
+            Arrays.fill(maskedScalar, 0)
+            Arrays.fill(nonceHash, 0)
+        }
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/crypto/Bip340Verifier.kt

@@ -1,9 +1,6 @@
 package com.pakstr.app.crypto
 
-import com.pakstr.app.debug.AppDebugLogger
-import org.bouncycastle.math.ec.ECPoint
 import java.math.BigInteger
-import java.security.MessageDigest
 
 /**
  * Verifies BIP-340 Schnorr signatures over the secp256k1 curve.
@@ -24,6 +21,18 @@ object Bip340Verifier {
     private const val CHALLENGE_TAG =
         "BIP0340/challenge"
 
+    internal fun isValidXOnlyPubkey(
+        pubkeyHex: String
+    ): Boolean {
+        return try {
+            val pubkey = Bip340Hash.hexToBytes(pubkeyHex)
+
+            pubkey.size == 32 && Secp256k1.liftX(pubkey).isValid
+        } catch (_: Exception) {
+            false
+        }
+    }
+
     /**
      * Verifies a BIP-340 Schnorr signature.
      *
@@ -42,13 +51,13 @@ object Bip340Verifier {
         return try {
 
             val pubkey =
-                hexToBytes(pubkeyHex)
+                Bip340Hash.hexToBytes(pubkeyHex)
 
             val message =
-                hexToBytes(messageHex)
+                Bip340Hash.hexToBytes(messageHex)
 
             val signature =
-                hexToBytes(signatureHex)
+                Bip340Hash.hexToBytes(signatureHex)
 
             // BIP340 sizes
             if (pubkey.size != 32)
@@ -89,18 +98,18 @@ object Bip340Verifier {
 
             // Lift the x-only public key into a full secp256k1 point.
             val P =
-                liftX(pubkey)
+                Secp256k1.liftX(pubkey)
 
             // Compute the BIP-340 tagged challenge hash.
             val eBytes =
-                taggedHash(
+                Bip340Hash.taggedHash(
                     CHALLENGE_TAG,
                     signature.copyOfRange(
                         0,
                         32
-                    ) +
-                            pubkey +
-                            message
+                    ),
+                    pubkey,
+                    message
                 )
 
             val e =
@@ -151,163 +160,4 @@ object Bip340Verifier {
         }
     }
 
-    /**
-     * Converts a BIP-340 x-only public key into a full secp256k1 curve point.
-     *
-     * BIP-340 uses x-only public keys, so the corresponding curve point is
-     * reconstructed by selecting the even Y coordinate.
-     *
-     * @throws IllegalArgumentException if the provided x coordinate does not
-     * represent a valid point on the secp256k1 curve.
-     */
-    private fun liftX(
-        xBytes: ByteArray
-    ): ECPoint {
-
-        val x =
-            BigInteger(
-                1,
-                xBytes
-            )
-
-        if (x >= Secp256k1.P) {
-
-            throw IllegalArgumentException(
-                "Invalid x coordinate"
-            )
-        }
-
-        val curve =
-            Secp256k1.CURVE.curve
-
-        val alpha =
-            x.modPow(
-                BigInteger.valueOf(3),
-                Secp256k1.P
-            )
-                .add(
-                    curve.b.toBigInteger()
-                )
-                .mod(
-                    Secp256k1.P
-                )
-
-        var y =
-            sqrtMod(
-                alpha,
-                Secp256k1.P
-            )
-
-        // verify square root exists
-        if (
-            y.multiply(y)
-                .mod(Secp256k1.P) != alpha
-        ) {
-
-            throw IllegalArgumentException(
-                "Invalid public key"
-            )
-        }
-
-        if (y.testBit(0)) {
-
-            y = Secp256k1.P.subtract(y)
-
-        }
-
-        val point =
-            curve.createPoint(
-                x,
-                y
-            )
-
-        if (point.isInfinity) {
-
-            throw IllegalArgumentException(
-                "Point at infinity"
-            )
-        }
-
-        if (!point.isValid) {
-
-            throw IllegalArgumentException(
-                "Invalid curve point"
-            )
-
-        }
-        return point
-    }
-
-    /**
-     * Calculates modular square root for secp256k1.
-     *
-     * Since secp256k1 prime satisfies p ≡ 3 (mod 4),
-     * the square root can be calculated as a^((p+1)/4) mod p.
-     */
-    private fun sqrtMod(
-        a: BigInteger,
-        p: BigInteger
-    ): BigInteger {
-
-        return a.modPow(
-            p.add(BigInteger.ONE)
-                .divide(
-                    BigInteger.valueOf(4)
-                ),
-            p
-        )
-    }
-
-    private fun taggedHash(
-        tag: String,
-        msg: ByteArray
-    ): ByteArray {
-
-        val tagHash =
-            sha256(
-                tag.toByteArray()
-            )
-
-        return sha256(
-            tagHash +
-                    tagHash +
-                    msg
-        )
-
-    }
-
-    private fun sha256(
-        data: ByteArray
-    ): ByteArray {
-
-        return MessageDigest
-            .getInstance(
-                "SHA-256"
-            )
-            .digest(
-                data
-            )
-    }
-
-    private fun hexToBytes(
-        hex: String
-    ): ByteArray {
-
-        require(
-            hex.length % 2 == 0
-        )
-
-        return ByteArray(
-            hex.length / 2
-        ) { index ->
-
-            hex.substring(
-                index * 2,
-                index * 2 + 2
-            )
-                .toInt(16)
-                .toByte()
-
-        }
-    }
 }