Skip to content

Commit df633cd

Browse files
committed
Add _prefix and _bip324 ellswift_xdh hash functions
1 parent 9695deb commit df633cd

File tree

3 files changed

+158
-8
lines changed

3 files changed

+158
-8
lines changed

include/secp256k1_ellswift.h

+14-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ extern "C" {
88
#endif
99

1010
/* This module provides an implementation of ElligatorSwift as well as a
11-
* version of x-only ECDH using it.
11+
* version of x-only ECDH using it (including compatibility with BIP324).
1212
*
1313
* ElligatorSwift is described in https://eprint.iacr.org/2022/759 by
1414
* Chavez-Saab, Rodriguez-Henriquez, and Tibouchi. It permits encoding
@@ -67,6 +67,19 @@ typedef int (*secp256k1_ellswift_xdh_hash_function)(
6767
void *data
6868
);
6969

70+
/** An implementation of an secp256k1_ellswift_xdh_hash_function which uses
71+
* SHA256(prefix64 || ell_a64 || ell_b64 || x32), where prefix64 is the 64-byte
72+
* array pointed to by data. */
73+
SECP256K1_API_VAR const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_prefix;
74+
75+
/** An implementation of an secp256k1_ellswift_xdh_hash_function compatible with
76+
* BIP324. It returns H_tag(ell_a64 || ell_b64 || x32), where H_tag is the
77+
* BIP340 tagged hash function with tag "bip324_ellswift_xonly_ecdh". Equivalent
78+
* to secp256k1_ellswift_xdh_hash_function_prefix with prefix64 set to
79+
* SHA256("bip324_ellswift_xonly_ecdh")||SHA256("bip324_ellswift_xonly_ecdh").
80+
* The data argument is ignored. */
81+
SECP256K1_API_VAR const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_bip324;
82+
7083
/** Construct a 64-byte ElligatorSwift encoding of a given pubkey.
7184
*
7285
* Returns: 1 always.

src/modules/ellswift/main_impl.h

+45
Original file line numberDiff line numberDiff line change
@@ -498,6 +498,51 @@ int secp256k1_ellswift_decode(const secp256k1_context *ctx, secp256k1_pubkey *pu
498498
return 1;
499499
}
500500

501+
static int ellswift_xdh_hash_function_prefix(unsigned char *output, const unsigned char *x32, const unsigned char *ell_a64, const unsigned char *ell_b64, void *data) {
502+
secp256k1_sha256 sha;
503+
504+
secp256k1_sha256_initialize(&sha);
505+
secp256k1_sha256_write(&sha, data, 64);
506+
secp256k1_sha256_write(&sha, ell_a64, 64);
507+
secp256k1_sha256_write(&sha, ell_b64, 64);
508+
secp256k1_sha256_write(&sha, x32, 32);
509+
secp256k1_sha256_finalize(&sha, output);
510+
511+
return 1;
512+
}
513+
514+
/** Set hash state to the BIP340 tagged hash midstate for "bip324_ellswift_xonly_ecdh". */
515+
static void secp256k1_ellswift_sha256_init_bip324(secp256k1_sha256* hash) {
516+
secp256k1_sha256_initialize(hash);
517+
hash->s[0] = 0x8c12d730ul;
518+
hash->s[1] = 0x827bd392ul;
519+
hash->s[2] = 0x9e4fb2eeul;
520+
hash->s[3] = 0x207b373eul;
521+
hash->s[4] = 0x2292bd7aul;
522+
hash->s[5] = 0xaa5441bcul;
523+
hash->s[6] = 0x15c3779ful;
524+
hash->s[7] = 0xcfb52549ul;
525+
526+
hash->bytes = 64;
527+
}
528+
529+
static int ellswift_xdh_hash_function_bip324(unsigned char* output, const unsigned char *x32, const unsigned char *ell_a64, const unsigned char *ell_b64, void *data) {
530+
secp256k1_sha256 sha;
531+
532+
(void)data;
533+
534+
secp256k1_ellswift_sha256_init_bip324(&sha);
535+
secp256k1_sha256_write(&sha, ell_a64, 64);
536+
secp256k1_sha256_write(&sha, ell_b64, 64);
537+
secp256k1_sha256_write(&sha, x32, 32);
538+
secp256k1_sha256_finalize(&sha, output);
539+
540+
return 1;
541+
}
542+
543+
const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_prefix = ellswift_xdh_hash_function_prefix;
544+
const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_bip324 = ellswift_xdh_hash_function_bip324;
545+
501546
int secp256k1_ellswift_xdh(const secp256k1_context *ctx, unsigned char *output, const unsigned char *ell_a64, const unsigned char *ell_b64, const unsigned char *seckey32, int party, secp256k1_ellswift_xdh_hash_function hashfp, void *data) {
502547
int ret = 0;
503548
int overflow;

0 commit comments

Comments
 (0)