tx: Port for pasta.

Makefile

@@ -25,13 +25,13 @@ $(BINS): $(BINDEPS)
 	cp target/release/$@ $@
 
 test:
-	$(CARGO) test --release --all-features
+	$(CARGO) test --release --all-features --lib
 
 fix:
 	$(CARGO) fix --release --all-features --allow-dirty
 
 clippy:
-	$(CARGO) clippy --release --all-features
+	$(CARGO) clippy --release --all-features --lib
 
 install: all
 	mkdir -p $(DESTDIR)$(PREFIX)/bin

src/crypto/mint_proof.rs

@@ -142,10 +142,11 @@ pub fn create_mint_proof(
     Ok((proof, revealed))
 }
 
-pub fn verify_mint_proof(proof: Proof, revealed: &MintRevealedValues) -> Result<()> {
+pub fn verify_mint_proof(
+    vk: &VerifyingKey,
+    proof: Proof,
+    revealed: &MintRevealedValues,
+) -> Result<()> {
     let public_inputs = revealed.make_outputs();
-
-    // TODO: Don't always build this
-    let vk = VerifyingKey::build(11, MintContract::default());
-    Ok(proof.verify(&vk, &public_inputs)?)
+    Ok(proof.verify(vk, &public_inputs)?)
 }

src/crypto/mod.rs

@@ -11,7 +11,7 @@ pub mod schnorr;
 pub mod spend_proof;
 pub mod util;
 
-use incrementalmerkletree::bridgetree::Frontier as BridgeFrontier;
+pub(crate) use {mint_proof::MintRevealedValues, proof::Proof, spend_proof::SpendRevealedValues};
 
 use crate::types::DrkSecretKey;
 

src/crypto/note.rs

@@ -59,8 +59,8 @@ impl Note {
     pub fn encrypt(&self, public: &DrkPublicKey) -> Result<EncryptedNote> {
         let ephem_secret = DrkSecretKey::random(&mut OsRng);
         let ephem_public = derive_publickey(ephem_secret);
-        let shared_secret = sapling_ka_agree(&mod_r_p(ephem_secret), public.into());
-        let key = kdf_sapling(shared_secret, &ephem_public.into());
+        let shared_secret = sapling_ka_agree(&mod_r_p(ephem_secret), public);
+        let key = kdf_sapling(shared_secret, &ephem_public);
 
         let mut input = Vec::new();
         self.encode(&mut input)?;
@@ -108,8 +108,8 @@ impl Decodable for EncryptedNote {
 
 impl EncryptedNote {
     pub fn decrypt(&self, secret: &DrkSecretKey) -> Result<Note> {
-        let shared_secret = sapling_ka_agree(&mod_r_p(*secret), &self.ephem_public.into());
-        let key = kdf_sapling(shared_secret, &self.ephem_public.into());
+        let shared_secret = sapling_ka_agree(&mod_r_p(*secret), &self.ephem_public);
+        let key = kdf_sapling(shared_secret, &self.ephem_public);
 
         let mut plaintext = [0; ENC_CIPHERTEXT_SIZE];
         assert_eq!(

src/crypto/proof.rs

@@ -94,7 +94,7 @@ impl Proof {
 
 impl Encodable for Proof {
     fn encode<S: io::Write>(&self, mut s: S) -> Result<usize> {
-        s.write_slice(&self.as_ref()[..])?;
+        s.write_slice(self.as_ref())?;
         Ok(self.as_ref().len())
     }
 }

src/crypto/spend_proof.rs

@@ -171,10 +171,11 @@ pub fn create_spend_proof(
     Ok((proof, revealed))
 }
 
-pub fn verify_spend_proof(proof: Proof, revealed: &SpendRevealedValues) -> Result<()> {
+pub fn verify_spend_proof(
+    vk: &VerifyingKey,
+    proof: Proof,
+    revealed: &SpendRevealedValues,
+) -> Result<()> {
     let public_inputs = revealed.make_outputs();
-
-    // TODO: Don't always build this
-    let vk = VerifyingKey::build(11, SpendContract::default());
-    Ok(proof.verify(&vk, &public_inputs)?)
+    Ok(proof.verify(vk, &public_inputs)?)
 }

src/error.rs

@@ -1,7 +1,7 @@
 use std::fmt;
 
 //use crate::client;
-//use crate::state;
+use crate::state;
 
 pub type Result<T> = std::result::Result<T, Error>;
 
@@ -266,13 +266,13 @@ impl From<std::str::Utf8Error> for Error {
     }
 }
 
-/*
 impl From<state::VerifyFailed> for Error {
     fn from(_err: state::VerifyFailed) -> Error {
         Error::VerifyFailed
     }
 }
 
+/*
 impl From<client::ClientFailed> for Error {
     fn from(err: client::ClientFailed) -> Error {
         Error::ClientFailed(err.to_string())

src/lib.rs

@@ -11,10 +11,10 @@ pub mod net;
 pub mod rpc;
 pub mod serial;
 // pub mod service;
-// pub mod state;
+pub mod state;
 pub mod system;
+pub mod tx;
 pub mod types;
-// pub mod tx;
 // pub mod util;
 // pub mod vm;
 // pub mod vm_serial;

src/state.rs

@@ -1,5 +1,6 @@
 use std::fmt;
 
+/*
 use bellman::groth16;
 use bls12_381::Bls12;
 use log::debug;
@@ -23,6 +24,7 @@ pub struct StateUpdate {
     pub coins: Vec<Coin>,
     pub enc_notes: Vec<EncryptedNote>,
 }
+*/
 
 pub type VerifyResult<T> = std::result::Result<T, VerifyFailed>;
 
@@ -69,6 +71,7 @@ impl fmt::Display for VerifyFailed {
     }
 }
 
+/*
 pub fn state_transition<S: ProgramState>(
     state: &async_std::sync::MutexGuard<S>,
     tx: tx::Transaction,
@@ -132,3 +135,4 @@ pub fn state_transition<S: ProgramState>(
         enc_notes,
     })
 }
+*/

src/tx/builder.rs

@@ -1,6 +1,4 @@
-use bellman::groth16;
-use bls12_381::Bls12;
-use ff::Field;
+use pasta_curves::arithmetic::Field;
 use rand::rngs::OsRng;
 
 use super::{
@@ -8,10 +6,10 @@ use super::{
     Transaction, TransactionClearInput, TransactionInput, TransactionOutput,
 };
 use crate::crypto::{
-    create_mint_proof, create_spend_proof, merkle::MerklePath, merkle_node::MerkleNode, note::Note,
-    schnorr,
+    mint_proof::create_mint_proof, note::Note, schnorr, spend_proof::create_spend_proof,
 };
 use crate::serial::Encodable;
+use crate::{types::*, Result};
 
 pub struct TransactionBuilder {
     pub clear_inputs: Vec<TransactionBuilderClearInputInfo>,
@@ -21,32 +19,32 @@ pub struct TransactionBuilder {
 
 pub struct TransactionBuilderClearInputInfo {
     pub value: u64,
-    pub token_id: jubjub::Fr,
-    pub signature_secret: jubjub::Fr,
+    pub token_id: DrkTokenId,
+    pub signature_secret: DrkSecretKey,
 }
 
 pub struct TransactionBuilderInputInfo {
-    pub merkle_path: MerklePath<MerkleNode>,
-    pub secret: jubjub::Fr,
+    //pub merkle_path: MerklePath<MerkleNode>, // TODO:
+    pub secret: DrkSecretKey,
     pub note: Note,
 }
 
 pub struct TransactionBuilderOutputInfo {
     pub value: u64,
-    pub token_id: jubjub::Fr,
-    pub public: jubjub::SubgroupPoint,
+    pub token_id: DrkTokenId,
+    pub public: DrkPublicKey,
 }
 
 impl TransactionBuilder {
     fn compute_remainder_blind(
         clear_inputs: &[PartialTransactionClearInput],
-        input_blinds: &[jubjub::Fr],
-        output_blinds: &[jubjub::Fr],
-    ) -> jubjub::Fr {
-        let mut total = jubjub::Fr::zero();
+        input_blinds: &[DrkValueBlind],
+        output_blinds: &[DrkValueBlind],
+    ) -> DrkValueBlind {
+        let mut total = DrkValueBlind::zero();
 
         for input in clear_inputs {
-            total += input.valcom_blind;
+            total += input.value_blind;
         }
 
         for input_blind in input_blinds {
@@ -60,23 +58,18 @@ impl TransactionBuilder {
         total
     }
 
-    pub fn build(
-        self,
-        mint_params: &groth16::Parameters<Bls12>,
-        spend_params: &groth16::Parameters<Bls12>,
-    ) -> Transaction {
+    pub fn build(self) -> Result<Transaction> {
         let mut clear_inputs = vec![];
-        let token_commit_blind: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
+        let token_blind = DrkValueBlind::random(&mut OsRng);
         for input in &self.clear_inputs {
-            let signature_public =
-                zcash_primitives::constants::SPENDING_KEY_GENERATOR * input.signature_secret;
+            let signature_public = derive_publickey(input.signature_secret);
+            let value_blind = DrkValueBlind::random(&mut OsRng);
 
-            let valcom_blind: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
             let clear_input = PartialTransactionClearInput {
                 value: input.value,
                 token_id: input.token_id,
-                valcom_blind,
-                token_commit_blind,
+                value_blind,
+                token_blind,
                 signature_public,
             };
             clear_inputs.push(clear_input);
@@ -86,12 +79,11 @@ impl TransactionBuilder {
         let mut input_blinds = vec![];
         let mut signature_secrets = vec![];
         for input in &self.inputs {
-            input_blinds.push(input.note.valcom_blind);
+            input_blinds.push(input.note.value_blind);
 
-            let signature_secret: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
-
-            // make proof
+            let signature_secret = DrkSecretKey::random(&mut OsRng);
 
+            /*
             // TODO: Some stupid glue code. Need to sort this out
             let auth_path: Vec<(bls12_381::Scalar, bool)> = input
                 .merkle_path
@@ -99,19 +91,21 @@ impl TransactionBuilder {
                 .iter()
                 .map(|(node, b)| ((*node).into(), *b))
                 .collect();
+            */
+            // TODO: FIXME:
+            let auth_path = vec![DrkCoin::random(&mut OsRng)];
 
             let (proof, revealed) = create_spend_proof(
-                spend_params,
                 input.note.value,
                 input.note.token_id,
-                input.note.valcom_blind,
-                token_commit_blind,
+                input.note.value_blind,
+                token_blind,
                 input.note.serial,
                 input.note.coin_blind,
                 input.secret,
                 auth_path,
                 signature_secret,
-            );
+            )?;
 
             // First we make the tx then sign after
             let signature_secret = schnorr::SecretKey(signature_secret);
@@ -128,26 +122,25 @@ impl TransactionBuilder {
         let mut output_blinds = vec![];
 
         for (i, output) in self.outputs.iter().enumerate() {
-            let valcom_blind = if i == self.outputs.len() - 1 {
+            let value_blind = if i == self.outputs.len() - 1 {
                 Self::compute_remainder_blind(&clear_inputs, &input_blinds, &output_blinds)
             } else {
-                jubjub::Fr::random(&mut OsRng)
+                DrkValueBlind::random(&mut OsRng)
             };
-            output_blinds.push(valcom_blind);
+            output_blinds.push(value_blind);
 
-            let serial: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
-            let coin_blind: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
+            let serial = DrkSerial::random(&mut OsRng);
+            let coin_blind = DrkCoinBlind::random(&mut OsRng);
 
             let (mint_proof, revealed) = create_mint_proof(
-                mint_params,
                 output.value,
                 output.token_id,
-                valcom_blind,
-                token_commit_blind,
+                value_blind,
+                token_blind,
                 serial,
                 coin_blind,
                 output.public,
-            );
+            )?;
 
             // Encrypted note
 
@@ -156,7 +149,7 @@ impl TransactionBuilder {
                 value: output.value,
                 token_id: output.token_id,
                 coin_blind,
-                valcom_blind,
+                value_blind,
             };
 
             let encrypted_note = note.encrypt(&output.public).unwrap();
@@ -199,10 +192,10 @@ impl TransactionBuilder {
             inputs.push(input);
         }
 
-        Transaction {
+        Ok(Transaction {
             clear_inputs,
             inputs,
             outputs: partial_tx.outputs,
-        }
+        })
     }
 }

src/tx/mod.rs

@@ -1,25 +1,21 @@
 pub mod builder;
 pub mod partial;
 
-use bellman::groth16;
-use bls12_381::Bls12;
-use group::Group;
 use std::io;
 
-use self::partial::{PartialTransactionClearInput, PartialTransactionInput};
+use pasta_curves::group::Group;
+
 use crate::crypto::{
-    note::EncryptedNote, schnorr, verify_mint_proof, verify_spend_proof, MintRevealedValues,
-    SpendRevealedValues,
+    mint_proof::verify_mint_proof,
+    note::EncryptedNote,
+    proof::{Proof, VerifyingKey},
+    schnorr,
+    spend_proof::verify_spend_proof,
+    util::{mod_r_p, pedersen_commitment_scalar, pedersen_commitment_u64},
+    MintRevealedValues, SpendRevealedValues,
 };
-use crate::error::Result;
-use crate::impl_vec;
 use crate::serial::{Decodable, Encodable, VarInt};
-use crate::state;
-
-pub use self::builder::{
-    TransactionBuilder, TransactionBuilderClearInputInfo, TransactionBuilderInputInfo,
-    TransactionBuilderOutputInfo,
-};
+use crate::{impl_vec, state, types::*, Result};
 
 pub struct Transaction {
     pub clear_inputs: Vec<TransactionClearInput>,
@@ -29,21 +25,21 @@ pub struct Transaction {
 
 pub struct TransactionClearInput {
     pub value: u64,
-    pub token_id: jubjub::Fr,
-    pub valcom_blind: jubjub::Fr,
-    pub token_commit_blind: jubjub::Fr,
-    pub signature_public: jubjub::SubgroupPoint,
+    pub token_id: DrkTokenId,
+    pub value_blind: DrkValueBlind,
+    pub token_blind: DrkValueBlind,
+    pub signature_public: DrkPublicKey,
     pub signature: schnorr::Signature,
 }
 
 pub struct TransactionInput {
-    pub spend_proof: groth16::Proof<Bls12>,
+    pub spend_proof: Proof,
     pub revealed: SpendRevealedValues,
     pub signature: schnorr::Signature,
 }
 
 pub struct TransactionOutput {
-    pub mint_proof: groth16::Proof<Bls12>,
+    pub mint_proof: Proof,
     pub revealed: MintRevealedValues,
     pub enc_note: EncryptedNote,
 }
@@ -57,11 +53,6 @@ impl Transaction {
         Ok(len)
     }
 
-    fn compute_pedersen_commit(value: jubjub::Fr, blind: &jubjub::Fr) -> jubjub::SubgroupPoint {
-        (zcash_primitives::constants::VALUE_COMMITMENT_VALUE_GENERATOR * value)
-            + (zcash_primitives::constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR * blind)
-    }
-
     fn verify_token_commitments(&self) -> bool {
         assert_ne!(self.outputs.len(), 0);
         let token_commit_value = self.outputs[0].revealed.token_commit;
@@ -77,7 +68,7 @@ impl Transaction {
                 .any(|output| output.revealed.token_commit != token_commit_value);
         failed = failed
             || self.clear_inputs.iter().any(|input| {
-                Self::compute_pedersen_commit(input.token_id, &input.token_commit_blind)
+                pedersen_commitment_scalar(mod_r_p(input.token_id), input.token_blind)
                     != token_commit_value
             });
         !failed
@@ -85,28 +76,30 @@ impl Transaction {
 
     pub fn verify(
         &self,
-        mint_pvk: &groth16::PreparedVerifyingKey<Bls12>,
-        spend_pvk: &groth16::PreparedVerifyingKey<Bls12>,
+        mint_pvk: &VerifyingKey,
+        spend_pvk: &VerifyingKey,
     ) -> state::VerifyResult<()> {
-        let mut valcom_total = jubjub::SubgroupPoint::identity();
+        let mut valcom_total = DrkValueCommit::identity();
+
         for input in &self.clear_inputs {
-            let value = jubjub::Fr::from(input.value);
-            valcom_total += Self::compute_pedersen_commit(value, &input.valcom_blind);
+            valcom_total += pedersen_commitment_u64(input.value, input.value_blind);
         }
+
         for (i, input) in self.inputs.iter().enumerate() {
-            if !verify_spend_proof(spend_pvk, &input.spend_proof, &input.revealed) {
+            if verify_spend_proof(spend_pvk, input.spend_proof.clone(), &input.revealed).is_err() {
                 return Err(state::VerifyFailed::SpendProof(i));
             }
             valcom_total += &input.revealed.value_commit;
         }
+
         for (i, output) in self.outputs.iter().enumerate() {
-            if !verify_mint_proof(mint_pvk, &output.mint_proof, &output.revealed) {
+            if verify_mint_proof(mint_pvk, output.mint_proof.clone(), &output.revealed).is_err() {
                 return Err(state::VerifyFailed::MintProof(i));
             }
             valcom_total -= &output.revealed.value_commit;
         }
 
-        if valcom_total != jubjub::SubgroupPoint::identity() {
+        if valcom_total != DrkValueCommit::identity() {
             return Err(state::VerifyFailed::MissingFunds);
         }
 
@@ -137,12 +130,15 @@ impl Transaction {
 }
 
 impl TransactionClearInput {
-    fn from_partial(partial: PartialTransactionClearInput, signature: schnorr::Signature) -> Self {
+    fn from_partial(
+        partial: partial::PartialTransactionClearInput,
+        signature: schnorr::Signature,
+    ) -> Self {
         Self {
             value: partial.value,
             token_id: partial.token_id,
-            valcom_blind: partial.valcom_blind,
-            token_commit_blind: partial.token_commit_blind,
+            value_blind: partial.value_blind,
+            token_blind: partial.token_blind,
             signature_public: partial.signature_public,
             signature,
         }
@@ -152,15 +148,18 @@ impl TransactionClearInput {
         let mut len = 0;
         len += self.value.encode(&mut s)?;
         len += self.token_id.encode(&mut s)?;
-        len += self.valcom_blind.encode(&mut s)?;
-        len += self.token_commit_blind.encode(&mut s)?;
+        len += self.value_blind.encode(&mut s)?;
+        len += self.token_blind.encode(&mut s)?;
         len += self.signature_public.encode(s)?;
         Ok(len)
     }
 }
 
 impl TransactionInput {
-    fn from_partial(partial: PartialTransactionInput, signature: schnorr::Signature) -> Self {
+    fn from_partial(
+        partial: partial::PartialTransactionInput,
+        signature: schnorr::Signature,
+    ) -> Self {
         Self {
             spend_proof: partial.spend_proof,
             revealed: partial.revealed,
@@ -201,8 +200,8 @@ impl Encodable for TransactionClearInput {
         let mut len = 0;
         len += self.value.encode(&mut s)?;
         len += self.token_id.encode(&mut s)?;
-        len += self.valcom_blind.encode(&mut s)?;
-        len += self.token_commit_blind.encode(&mut s)?;
+        len += self.value_blind.encode(&mut s)?;
+        len += self.token_blind.encode(&mut s)?;
         len += self.signature_public.encode(&mut s)?;
         len += self.signature.encode(s)?;
         Ok(len)
@@ -214,8 +213,8 @@ impl Decodable for TransactionClearInput {
         Ok(Self {
             value: Decodable::decode(&mut d)?,
             token_id: Decodable::decode(&mut d)?,
-            valcom_blind: Decodable::decode(&mut d)?,
-            token_commit_blind: Decodable::decode(&mut d)?,
+            value_blind: Decodable::decode(&mut d)?,
+            token_blind: Decodable::decode(&mut d)?,
             signature_public: Decodable::decode(&mut d)?,
             signature: Decodable::decode(d)?,
         })

src/tx/partial.rs

@@ -1,12 +1,10 @@
-use bellman::groth16;
-use bls12_381::Bls12;
 use std::io;
 
 use super::TransactionOutput;
-use crate::crypto::SpendRevealedValues;
-use crate::error::Result;
-use crate::impl_vec;
+use crate::crypto::{Proof, SpendRevealedValues};
 use crate::serial::{Decodable, Encodable, VarInt};
+use crate::types::*;
+use crate::{impl_vec, Result};
 
 pub struct PartialTransaction {
     pub clear_inputs: Vec<PartialTransactionClearInput>,
@@ -16,14 +14,14 @@ pub struct PartialTransaction {
 
 pub struct PartialTransactionClearInput {
     pub value: u64,
-    pub token_id: jubjub::Fr,
-    pub valcom_blind: jubjub::Fr,
-    pub token_commit_blind: jubjub::Fr,
-    pub signature_public: jubjub::SubgroupPoint,
+    pub token_id: DrkTokenId,
+    pub value_blind: DrkValueBlind,
+    pub token_blind: DrkValueBlind,
+    pub signature_public: DrkPublicKey,
 }
 
 pub struct PartialTransactionInput {
-    pub spend_proof: groth16::Proof<Bls12>,
+    pub spend_proof: Proof,
     pub revealed: SpendRevealedValues,
 }
 
@@ -52,8 +50,8 @@ impl Encodable for PartialTransactionClearInput {
         let mut len = 0;
         len += self.value.encode(&mut s)?;
         len += self.token_id.encode(&mut s)?;
-        len += self.valcom_blind.encode(&mut s)?;
-        len += self.token_commit_blind.encode(&mut s)?;
+        len += self.value_blind.encode(&mut s)?;
+        len += self.token_blind.encode(&mut s)?;
         len += self.signature_public.encode(&mut s)?;
         Ok(len)
     }
@@ -63,8 +61,8 @@ impl Decodable for PartialTransactionClearInput {
         Ok(Self {
             value: Decodable::decode(&mut d)?,
             token_id: Decodable::decode(&mut d)?,
-            valcom_blind: Decodable::decode(&mut d)?,
-            token_commit_blind: Decodable::decode(&mut d)?,
+            value_blind: Decodable::decode(&mut d)?,
+            token_blind: Decodable::decode(&mut d)?,
             signature_public: Decodable::decode(&mut d)?,
         })
     }