sdk/schnorr: add the pubkey to challenge hash of commit

src/sdk/src/crypto/schnorr.rs

@@ -64,7 +64,11 @@ impl SchnorrSecret for SecretKey {
         let mask = pallas::Scalar::random(rng);
         let commit = NullifierK.generator() * mask;
 
-        let challenge = hash_to_scalar(DRK_SCHNORR_DOMAIN, &commit.to_bytes(), message);
+        let commit_bytes = commit.to_bytes();
+        let pubkey_bytes = PublicKey::from_secret(*self).to_bytes();
+        let transcript = &[&commit_bytes, &pubkey_bytes, message];
+
+        let challenge = hash_to_scalar(DRK_SCHNORR_DOMAIN, transcript);
         let response = mask + challenge * fp_mod_fv(self.inner());
 
         Signature { commit, response }
@@ -73,7 +77,11 @@ impl SchnorrSecret for SecretKey {
 
 impl SchnorrPublic for PublicKey {
     fn verify(&self, message: &[u8], signature: &Signature) -> bool {
-        let challenge = hash_to_scalar(DRK_SCHNORR_DOMAIN, &signature.commit.to_bytes(), message);
+        let commit_bytes = signature.commit.to_bytes();
+        let pubkey_bytes = self.to_bytes();
+        let transcript = &[&commit_bytes, &pubkey_bytes, message];
+
+        let challenge = hash_to_scalar(DRK_SCHNORR_DOMAIN, transcript);
         NullifierK.generator() * signature.response - self.inner() * challenge == signature.commit
     }
 }

src/sdk/src/crypto/util.rs

@@ -25,14 +25,16 @@ use pasta_curves::{
 use std::io::Cursor;
 use subtle::CtOption;
 
-/// Hash `a` and `b` together with a prefix `persona` and return a `pallas::Scalar`
-/// element from the digest.
-pub fn hash_to_scalar(persona: &[u8], a: &[u8], b: &[u8]) -> pallas::Scalar {
+/// Hash a slice of values together with a prefix `persona` using BLAKE2b
+/// and return a `pallas::Scalar` element from the digest.
+pub fn hash_to_scalar(persona: &[u8], vals: &[&[u8]]) -> pallas::Scalar {
     let mut hasher = blake2b_simd::Params::new().hash_length(64).personal(persona).to_state();
-    hasher.update(a);
-    hasher.update(b);
-    let ret = hasher.finalize();
-    pallas::Scalar::from_uniform_bytes(ret.as_array())
+
+    for v in vals {
+        hasher.update(v);
+    }
+
+    pallas::Scalar::from_uniform_bytes(hasher.finalize().as_array())
 }
 
 /// Converts from pallas::Base to pallas::Scalar (aka $x \pmod{r_\mathbb{P}}$).