File Coverage

blib/lib/Crypt/ECDSA/Blind.pm

Criterion	Covered	Total	%
statement	167	187	89.3
branch	27	48	56.2
condition	4	8	50.0
subroutine	31	35	88.5
pod	8	8	100.0
total	237	286	82.8

# -*-cperl-*-
#
# Crypt::ECDSA::Blind - Blind ECDSA signatures
# Copyright (c) Ashish Gulhati
#
# $Id: lib/Crypt/ECDSA/Blind.pm v1.015 Tue Oct 16 22:40:55 PDT 2018 $

package Crypt::ECDSA::Blind;

use warnings;
use strict;
use DBI;
use Bytes::Random::Secure;
use Math::EllipticCurve::Prime;
use Digest::SHA;
use vars qw( $VERSION $AUTOLOAD );

our ( $VERSION ) = '$Revision: 1.015 $' =~ /\s+([\d\.]+)/;

sub new {
  my ($class, %arg) = @_; my $dbname = $arg{DB} || '/tmp/ceb.db';
  unlink $dbname if $arg{Clobber} and $dbname ne ':memory:';
  my $db = DBI->connect("dbi:SQLite:dbname=$dbname", undef, undef, {AutoCommit => 1});
  my @tables = $db->tables('%','%','initkeys','TABLE');
  unless ($tables[0]) {
    if ($arg{Create}) {
      return undef unless $db->do('CREATE TABLE initkeys (
		                                           Rp TEXT PRIMARY KEY,
		                                           k TEXT NOT NULL,
		                                           issued int NOT NULL
		                                         );');
      return undef unless $db->do('CREATE INDEX idx_initkeys_Rp ON initkeys(Rp);');
    }
    else {
      return undef;
    }
  }
  @tables = $db->tables('%','%','preinits','TABLE');
  unless ($tables[0]) {
    if ($arg{Create}) {
      return undef unless $db->do('CREATE TABLE preinits (
		                                           Rp TEXT PRIMARY KEY,
		                                           k TEXT NOT NULL
		                                         );');
    }
    else {
      return undef;
    }
  }
  bless { debug => 0,
	  db    => $db,
	  curve => Math::EllipticCurve::Prime->from_name('secp256k1')
	}, $class;
}

sub keygen {                               # Generate public, private key pair
  my $self = shift;
  my $random = Bytes::Random::Secure->new( Bits => 128 );
  my $d = _makerandom($self->curve->n);
  my $Q = $self->curve->g->multiply($d);
  $self->_diag("keygen(): d: $d, Q: x:" . $Q->x . ', y:' . $Q->y . "\n");
  return ((bless {Q => $Q}, 'Crypt::ECDSA::Blind::PubKey'),(bless {d => $d}, 'Crypt::ECDSA::Blind::SecKey'));
}

sub preinit {                              # Create an init vector in advance
  my $self = shift;
  my $count = $self->db->selectcol_arrayref("SELECT count() from preinits;")->[0];
  return if $count > 20;
  my ($k, $Rp, $rp);
  until ($rp) {
    $k = _makerandom($self->curve->n);
    $Rp = $self->curve->g->multiply($k);
    $rp = $Rp->x;
    $Rp = _compress($Rp);
  }
  $self->db->do("INSERT INTO preinits values ('$Rp','$k');");
}

sub init {                                 # Return an init vector
  my $self = shift;
  my ($k, $Rp, $rp) = $self->_getpreinit;
  unless ($k) {
    until ($rp) {
      $k = _makerandom($self->curve->n);
      $Rp = $self->curve->g->multiply($k);
      $rp = $Rp->x;
      $Rp = _compress($Rp);
    }
    $self->_initkey($Rp => $k);
  }
  return $Rp;
}

sub request {                                  # Create a signing request
  my ($self, %arg) = @_;
  my $n = $self->curve->n;
  my $Rp = _point_from_hex($arg{Init});
  my $rp = $Rp->x->bmod($n);
  my $A = _makerandom($n);
  my $B = _makerandom($n);
  my $R = $Rp->multiply($A)->add($self->curve->g->multiply($B));
  my $r = $R->x->bmod($n);
  my $hasher = Digest::SHA->new('sha256');
  $hasher->add($arg{Message});
  my $hash = $hasher->hexdigest; $hash =~ s/\s//g;
  my $H = Math::BigInt->from_hex($hash);
  my $mp = ($A * $H * $rp * $r->copy->bmodinv($n))->bmod($n);
  $self->_request($arg{Init} => { R => $R, B => $B, H => $H });
  $self->_diag("request(): mp: $mp\n");
  return $mp;
}

sub sign {                                 # Create a blind signature
  my ($self, %arg) = @_;
  my $n = $self->curve->n;
  my $Rp = _point_from_hex($arg{Init});
  my $rp = $Rp->x->bmod($n);
  return unless my $k = $self->_initkey($arg{Init});
  my $sp = ($arg{Key}->d * $rp + $k * $arg{Message})->bmod($n);
  $self->_diag("sign(): sp: $sp\n");
  return $sp;
}

sub unblind {                              # Unblind a blind signature
  my ($self, %arg) = @_;
  my $n = $self->curve->n;
  my $Rp = _point_from_hex($arg{Init});
  my $rp = $Rp->x->bmod($n);
  return unless my $req = $self->_request($arg{Init});
  my $r = $req->{R}->x->bmod($n);
  # Check here that sp and rp are in the range (1, n-1)
  my $s = ($arg{Signature} * $r * $rp->copy->bmodinv($n) + $req->{H} * $req->{B})->bmod($n);
  $self->_diag("unblind(): s: $s\n"); $s = $s->as_hex; $s =~ s/^0x//;
  return ( bless { s => $s,
		   R => _compress($req->{R})
		 }, 'Crypt::ECDSA::Blind::Signature' );
}

sub verify {                               # Verify a signature
  my ($self, %arg) = @_;
  my $r = $arg{Signature}->R->x->bmod($self->curve->n);
  my $Q = $arg{Key}->Q;
  my $hasher = Digest::SHA->new('sha256');
  $hasher->add($arg{Message});
  my $hash = $hasher->hexdigest; $hash =~ s/\s//g;
  my $H = Math::BigInt->from_hex($hash);
  $self->_diag('verify(): s: ' . $arg{Signature}->s . ', R(x): ' . $arg{Signature}->R->x . ", H: $H\n");
  my $u1 = $self->curve->g->multiply($arg{Signature}->s);
  my $u2 = $Q->multiply($r)->add($arg{Signature}->R->multiply($H));
  $self->_diag('verify(): u1: ' . $u1->x . ', u2: ' . $u2->x . "\n");
  $u1->to_hex eq $u2->to_hex;
}

sub _getpreinit {                          # Get a pre-created init vector
  my $self = shift;
  my $timestamp = time;
  while (1) {
    my ($k,$Rp) = $self->db->selectrow_array("SELECT k,Rp FROM preinits LIMIT 1;");
    return undef unless $k;
    $self->db->do("DELETE FROM preinits WHERE k='$k';");
    next unless $self->db->do("INSERT INTO initkeys values ('$Rp','$k','$timestamp');");
    return ($k, $Rp);
  }
}

sub _initkey {                             # Save or destructively retrieve a saved init vector
  my $self = shift;
  my $Rp = $_[0]; my $timestamp = time;
  if ($_[1]) {
    $self->db->do("INSERT INTO initkeys values ('$Rp','$_[1]','$timestamp');");
  }
  else {
    my $k = $self->db->selectcol_arrayref("SELECT k from initkeys WHERE Rp='$Rp';")->[0];
    $self->db->do("DELETE FROM initkeys WHERE Rp='$Rp';");
    return Math::BigInt->new($k);
  }
}

sub _request {                             # Save or destructively retrieve a saved request
  my $self = shift;
  my $Rp = $_[0]; my $ret;
  if ($_[1]) {
    $self->{Requests}->{$Rp} = $_[1];
  }
  else {
    $ret = $self->{Requests}->{$Rp};
    delete $self->{Requests}->{$Rp};
  }
  return $ret;
}

sub _makerandom {
  my $n = shift; my $nlen = length($n->as_bin)-2;
  my $random = Bytes::Random::Secure->new( Bits => 128 );
  my $r = 0;
  $r = Math::BigInt->from_bin($random->string_from('01',$nlen)) until ($r > 1 and $r < $n);
  return $r;
}

sub _point_from_hex {
  my $P = Math::EllipticCurve::Prime::Point->from_hex(_decompress(shift));
  $P->curve(Math::EllipticCurve::Prime->from_name('secp256k1'));
  $P;
}

sub _decompress {
  my $Kc = shift; $Kc =~ /^(..)(.*)/;
  my $i = $1; my $K = '04' . '0' x (64 - length($2)) . $2; my $x = Math::BigInt->from_hex($2);
  my $curve = Math::EllipticCurve::Prime->from_name('secp256k1');
  my ($p, $a, $b) = ($curve->p, $curve->a, $curve->b);
  my $y = ($x->bmodpow(3,$p)+$a*$x+$b)->bmodpow(($p+1)/4,$p);
  $y = $p - $y if $i%2 ne $y%2;
  my $yhex = $y->as_hex; $yhex =~ s/^0x//;
  $K .= '0' x (64 - length($yhex)) . $yhex; # print "D:$K\n";
  return $K;
}

sub _compress {
  my $K = shift; # print 'C:'. $K->to_hex . "\n";
  my $Kc = $K->x->as_hex; $Kc =~ s/^0x//;
  $Kc = '0' x (64 - length($Kc)) . $Kc;
  $Kc = ($K->y % 2 ? '03' : '02') . $Kc;
}

sub _diag {
  my $self = shift;
  print @_ if $self->debug;
}

sub AUTOLOAD {
  my $self = shift; (my $auto = $AUTOLOAD) =~ s/.*:://;
  return if $auto eq 'DESTROY';
  if ($auto =~ /^(db|debug)$/x) {
    $self->{$auto} = shift if (defined $_[0]);
  }
  if ($auto =~ /^(curve|db|debug)$/x) {
    return $self->{$auto};
  }
  else {
    die "Could not AUTOLOAD method $auto.";
  }
}

1; # End of Crypt::ECDSA::Blind

package Crypt::ECDSA::Blind::PubKey;

sub write {
  1;
}

sub as_hex {
  Crypt::ECDSA::Blind::_compress(shift->Q);
}

sub from_hex {
  bless {Q => Crypt::ECDSA::Blind::_point_from_hex(shift)}, 'Crypt::ECDSA::Blind::PubKey';
}

sub Q {
  shift->{Q};
}

1; # End of Crypt::ECDSA::Blind::PubKey

package Crypt::ECDSA::Blind::SecKey;

sub as_hex {
  my $d = shift->d->as_hex; $d =~ s/^0x//;
  $d;
}

sub from_hex {
  bless {d => Math::BigInt->from_hex(shift)}, 'Crypt::ECDSA::Blind::SecKey';
}

sub write {
  1;
}

sub d {
  shift->{d};
}

1; # End of Crypt::ECDSA::Blind::SecKey

package Crypt::ECDSA::Blind::Signature;

sub s {
  Math::BigInt->from_hex(shift->{'s'});
}

sub R {
  Crypt::ECDSA::Blind::_point_from_hex(shift->{R});
}

sub is_valid {
  my $self = shift;
  $self->{R} =~ /^[0-9a-f]+$/ and $self->{s} =~ /^[0-9a-f]+$/;
}

1; # End of Crypt::ECDSA::Blind::Signature

__END__