int SecretToPublicKey(const ec_secret& secret, ec_point& out)
{
// -- public key = private * G
int rv = 0;
EC_GROUP* ecgrp = EC_GROUP_new_by_curve_name(NID_secp256k1);
if (!ecgrp)
{
LogPrintf("SecretToPublicKey(): EC_GROUP_new_by_curve_name failed.\n");
return 1;
};
BIGNUM* bnIn = BN_bin2bn(&secret.e[0], ec_secret_size, BN_new());
if (!bnIn)
{
EC_GROUP_free(ecgrp);
LogPrintf("SecretToPublicKey(): BN_bin2bn failed\n");
return 1;
};
EC_POINT* pub = EC_POINT_new(ecgrp);
EC_POINT_mul(ecgrp, pub, bnIn, NULL, NULL, NULL);
BIGNUM* bnOut = EC_POINT_point2bn(ecgrp, pub, POINT_CONVERSION_COMPRESSED, BN_new(), NULL);
if (!bnOut)
{
LogPrintf("SecretToPublicKey(): point2bn failed\n");
rv = 1;
} else
{
out.resize(ec_compressed_size);
if (BN_num_bytes(bnOut) != (int) ec_compressed_size
|| BN_bn2bin(bnOut, &out[0]) != (int) ec_compressed_size)
{
LogPrintf("SecretToPublicKey(): bnOut incorrect length.\n");
rv = 1;
};
BN_free(bnOut);
};
EC_POINT_free(pub);
BN_free(bnIn);
EC_GROUP_free(ecgrp);
return rv;
};
int getOldKeyImage(CPubKey &publicKey, ec_point &keyImage)
{
// - PublicKey * Hash(PublicKey)
if (publicKey.size() != EC_COMPRESSED_SIZE)
return errorN(1, "%s: Invalid publicKey.", __func__);
int rv = 0;
uint256 pkHash = publicKey.GetHash();
BN_CTX_start(bnCtx);
BIGNUM *bnTmp = BN_CTX_get(bnCtx);
EC_POINT *ptPk = NULL;
// Hash to BIGNUM
if (!BN_bin2bn(pkHash.begin(), EC_SECRET_SIZE, bnTmp)
&& (rv = errorN(1, "%s: BN_bin2bn failed.", __func__)))
goto End;
// PublicKey point
if (!(ptPk = EC_POINT_new(ecGrp))
&& (rv = errorN(1, "%s: EC_POINT_new failed.", __func__)))
goto End;
if(!EC_POINT_oct2point(ecGrp, ptPk, publicKey.begin(), EC_COMPRESSED_SIZE, bnCtx)
&& (rv = errorN(1, "%s: EC_POINT_oct2point failed.", __func__)))
goto End;
// PublicKey * Hash(PublicKey)
if (!EC_POINT_mul(ecGrp, ptPk, NULL, ptPk, bnTmp, bnCtx)
&& (rv = errorN(1, "%s: EC_POINT_mul failed.", __func__)))
goto End;
try { keyImage.resize(EC_COMPRESSED_SIZE); } catch (std::exception& e)
{
LogPrintf("%s: keyImage.resize threw: %s.\n", __func__, e.what());
rv = 1; goto End;
}
// Point to BIGNUM to bin
if (!(EC_POINT_point2bn(ecGrp, ptPk, POINT_CONVERSION_COMPRESSED, bnTmp, bnCtx))
||BN_num_bytes(bnTmp) != (int) EC_COMPRESSED_SIZE
||BN_bn2bin(bnTmp, &keyImage[0]) != (int) EC_COMPRESSED_SIZE)
rv = errorN(1, "%s: point -> keyImage failed.", __func__);
End:
EC_POINT_free(ptPk);
BN_CTX_end(bnCtx);
return 0;
}
int generateKeyImage(ec_point &publicKey, ec_secret secret, ec_point &keyImage)
{
// - keyImage = secret * hash(publicKey) * G
if (publicKey.size() != EC_COMPRESSED_SIZE)
return errorN(1, "%s: Invalid publicKey.", __func__);
BN_CTX_start(bnCtx);
int rv = 0;
BIGNUM *bnTmp = BN_CTX_get(bnCtx);
BIGNUM *bnSec = BN_CTX_get(bnCtx);
EC_POINT *hG = NULL;
if (!(hG = EC_POINT_new(ecGrp))
&& (rv = errorN(1, "%s: EC_POINT_new failed.", __func__)))
goto End;
if (hashToEC(&publicKey[0], publicKey.size(), bnTmp, hG)
&& (rv = errorN(1, "%s: hashToEC failed.", __func__)))
goto End;
if (!(BN_bin2bn(&secret.e[0], EC_SECRET_SIZE, bnSec))
&& (rv = errorN(1, "%s: BN_bin2bn failed.", __func__)))
goto End;
if (!EC_POINT_mul(ecGrp, hG, NULL, hG, bnSec, bnCtx)
&& (rv = errorN(1, "%s: kimg EC_POINT_mul failed.", __func__)))
goto End;
try { keyImage.resize(EC_COMPRESSED_SIZE); } catch (std::exception& e)
{
LogPrintf("%s: keyImage.resize threw: %s.\n", __func__, e.what());
rv = 1; goto End;
}
if ((!(EC_POINT_point2bn(ecGrp, hG, POINT_CONVERSION_COMPRESSED, bnTmp, bnCtx))
|| BN_num_bytes(bnTmp) != (int) EC_COMPRESSED_SIZE
|| BN_bn2bin(bnTmp, &keyImage[0]) != (int) EC_COMPRESSED_SIZE)
&& (rv = errorN(1, "%s: point -> keyImage failed.", __func__)))
goto End;
if (fDebugRingSig)
LogPrintf("keyImage %s\n", HexStr(keyImage).c_str());
End:
EC_POINT_free(hG);
BN_CTX_end(bnCtx);
return rv;
};
int StealthSecret(ec_secret& secret, ec_point& pubkey, const ec_point& pkSpend, ec_secret& sharedSOut, ec_point& pkOut)
{
/*
send:
secret = ephem_secret, pubkey = scan_pubkey
receive:
secret = scan_secret, pubkey = ephem_pubkey
c = H(dP)
Q = public scan key (EC point, 33 bytes)
d = private scan key (integer, 32 bytes)
R = public spend key
f = private spend key
Q = dG //单次使用的私钥
R = fG
Sender (has Q and R, not d or f):
P = eG
c = H(eQ) = H(dP)
R' = R + cG
Recipient gets R' and P
test 0 and infinity?
*/
int rv = 0;
std::vector<uint8_t> vchOutQ;
BN_CTX* bnCtx = NULL;
BIGNUM* bnEphem = NULL;
BIGNUM* bnQ = NULL;
EC_POINT* Q = NULL;
BIGNUM* bnOutQ = NULL;
BIGNUM* bnc = NULL;
EC_POINT* C = NULL;
BIGNUM* bnR = NULL;
EC_POINT* R = NULL;
EC_POINT* Rout = NULL;
BIGNUM* bnOutR = NULL;
EC_GROUP* ecgrp = EC_GROUP_new_by_curve_name(NID_secp256k1);
if (!ecgrp)
{
printf("StealthSecret(): EC_GROUP_new_by_curve_name failed.\n");
return 1;
};
if (!(bnCtx = BN_CTX_new()))
{
printf("StealthSecret(): BN_CTX_new failed.\n");
rv = 2;
goto End;
};
if (!(bnEphem = BN_bin2bn(&secret.e[0], ec_secret_size, BN_new())))
{
printf("StealthSecret(): bnEphem BN_bin2bn failed.\n");
rv = 3;
goto End;
};
if (!(bnQ = BN_bin2bn(&pubkey[0], pubkey.size(), BN_new())))
{
printf("StealthSecret(): bnQ BN_bin2bn failed\n");
rv = 4;
goto End;
};
if (!(Q = EC_POINT_bn2point(ecgrp, bnQ, NULL, bnCtx)))
{
printf("StealthSecret(): Q EC_POINT_bn2point failed\n");
rv = 5;
goto End;
};
// -- eQ
// EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, const EC_POINT *q, const BIGNUM *m, BN_CTX *ctx);
// EC_POINT_mul calculates the value generator * n + q * m and stores the result in r. The value n may be NULL in which case the result is just q * m.
if (!EC_POINT_mul(ecgrp, Q, NULL, Q, bnEphem, bnCtx))
{
printf("StealthSecret(): eQ EC_POINT_mul failed\n");
rv = 6;
goto End;
};
if (!(bnOutQ = EC_POINT_point2bn(ecgrp, Q, POINT_CONVERSION_COMPRESSED, BN_new(), bnCtx)))
{
printf("StealthSecret(): Q EC_POINT_bn2point failed\n");
rv = 7;
goto End;
};
vchOutQ.resize(ec_compressed_size);
if (BN_num_bytes(bnOutQ) != (int) ec_compressed_size
|| BN_bn2bin(bnOutQ, &vchOutQ[0]) != (int) ec_compressed_size)
{
printf("StealthSecret(): bnOutQ incorrect length.\n");
rv = 8;
goto End;
};
SHA256(&vchOutQ[0], vchOutQ.size(), &sharedSOut.e[0]);
if (!(bnc = BN_bin2bn(&sharedSOut.e[0], ec_secret_size, BN_new())))
{
printf("StealthSecret(): BN_bin2bn failed\n");
rv = 9;
goto End;
};
// -- cG
if (!(C = EC_POINT_new(ecgrp)))
{
printf("StealthSecret(): C EC_POINT_new failed\n");
rv = 10;
goto End;
};
if (!EC_POINT_mul(ecgrp, C, bnc, NULL, NULL, bnCtx))
{
printf("StealthSecret(): C EC_POINT_mul failed\n");
rv = 11;
goto End;
};
if (!(bnR = BN_bin2bn(&pkSpend[0], pkSpend.size(), BN_new())))
{
printf("StealthSecret(): bnR BN_bin2bn failed\n");
rv = 12;
goto End;
};
if (!(R = EC_POINT_bn2point(ecgrp, bnR, NULL, bnCtx)))
{
printf("StealthSecret(): R EC_POINT_bn2point failed\n");
rv = 13;
goto End;
};
if (!EC_POINT_mul(ecgrp, C, bnc, NULL, NULL, bnCtx))
{
printf("StealthSecret(): C EC_POINT_mul failed\n");
rv = 14;
goto End;
};
if (!(Rout = EC_POINT_new(ecgrp)))
{
printf("StealthSecret(): Rout EC_POINT_new failed\n");
rv = 15;
goto End;
};
if (!EC_POINT_add(ecgrp, Rout, R, C, bnCtx))
{
printf("StealthSecret(): Rout EC_POINT_add failed\n");
rv = 16;
goto End;
};
if (!(bnOutR = EC_POINT_point2bn(ecgrp, Rout, POINT_CONVERSION_COMPRESSED, BN_new(), bnCtx)))
{
printf("StealthSecret(): Rout EC_POINT_bn2point failed\n");
rv = 17;
goto End;
};
pkOut.resize(ec_compressed_size);
if (BN_num_bytes(bnOutR) != (int) ec_compressed_size
|| BN_bn2bin(bnOutR, &pkOut[0]) != (int) ec_compressed_size)
{
printf("StealthSecret(): pkOut incorrect length.\n");
rv = 18;
goto End;
};
End:
if (bnOutR) BN_free(bnOutR);
if (Rout) EC_POINT_free(Rout);
if (R) EC_POINT_free(R);
if (bnR) BN_free(bnR);
if (C) EC_POINT_free(C);
if (bnc) BN_free(bnc);
if (bnOutQ) BN_free(bnOutQ);
if (Q) EC_POINT_free(Q);
if (bnQ) BN_free(bnQ);
if (bnEphem) BN_free(bnEphem);
if (bnCtx) BN_CTX_free(bnCtx);
EC_GROUP_free(ecgrp);
return rv;
};