github-wownero/wownero
1
0
Fork 0
mirror of https://github.com/wownero/wownero.git synced 2026-10-17 23:51:37 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
fcmp-testnet
wownero/tests/unit_tests/carrot_core.cpp
T

3104 lines
137 KiB
C++
Raw Permalink Blame History

// Copyright (c) 2024-2026, The Monero Project
//
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without modification, are
// permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this list of
// conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice, this list
// of conditions and the following disclaimer in the documentation and/or other
// materials provided with the distribution.
//
// 3. Neither the name of the copyright holder nor the names of its contributors may be
// used to endorse or promote products derived from this software without specific
// prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#include "gtest/gtest.h"
#include "carrot_core/account_secrets.h"
#include "carrot_core/address_utils.h"
#include "carrot_core/enote_utils.h"
#include "carrot_core/output_set_finalization.h"
#include "carrot_core/payment_proposal.h"
#include "carrot_core/scan.h"
#include "carrot_core/scan_unsafe.h"
#include "carrot_mock_helpers.h"
#include "core_types.h"
#include "crypto/generators.h"
#include "mx25519.h"
#include "ringct/rctOps.h"
#include <openssl/evp.h>
using namespace carrot;
using namespace carrot::mock::people;
#undef MONERO_DEFAULT_LOG_CATEGORY
#define MONERO_DEFAULT_LOG_CATEGORY "unit_tests.carrot"
namespace
{
static bool verify_carrot_normal_janus_protection_to_mock_keys(const input_context_t &input_context,
const crypto::public_key &nominal_address_spend_pubkey,
const mock::mock_carrot_and_legacy_keys &keys,
const mx25519_pubkey &enote_ephemeral_pubkey,
const janus_anchor_t &nominal_janus_anchor,
const payment_id_t &nominal_payment_id)
{
const subaddress_index_extended subaddr_index = keys.subaddress_map.get_index_for_address_spend_pubkey(
nominal_address_spend_pubkey).value();
const CarrotDestinationV1 address = keys.subaddress(subaddr_index);
CHECK_AND_ASSERT_THROW_MES(address.address_spend_pubkey == nominal_address_spend_pubkey,
"Bad subaddress index lookup: mismatched address spend pubkeys");
return verify_carrot_normal_janus_protection(nominal_janus_anchor,
input_context,
nominal_address_spend_pubkey,
address.address_view_pubkey,
subaddr_index.index.is_subaddress(),
nominal_payment_id,
enote_ephemeral_pubkey);
}
} //anonymous namespace
//---------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, ECDH_cryptonote_completeness)
{
crypto::secret_key k_view = rct::rct2sk(rct::skGen());
crypto::public_key view_pubkey = rct::rct2pk(rct::scalarmultBase(rct::sk2rct(k_view)));
crypto::secret_key k_ephem = rct::rct2sk(rct::skGen());
ASSERT_NE(k_view, k_ephem);
mx25519_pubkey enote_ephemeral_pubkey;
make_carrot_enote_ephemeral_pubkey_cryptonote(k_ephem, enote_ephemeral_pubkey);
mx25519_pubkey s_sr_sender;
ASSERT_TRUE(try_make_carrot_shared_key_sender(k_ephem, view_pubkey, s_sr_sender));
mx25519_pubkey s_sr_receiver;
ASSERT_TRUE(try_make_carrot_shared_key_receiver(k_view, enote_ephemeral_pubkey, s_sr_receiver));
EXPECT_EQ(s_sr_sender, s_sr_receiver);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, ECDH_subaddress_completeness)
{
crypto::secret_key k_view = rct::rct2sk(rct::skGen());
crypto::public_key spend_pubkey = rct::rct2pk(rct::pkGen());
crypto::public_key view_pubkey = rct::rct2pk(rct::scalarmultKey(rct::pk2rct(spend_pubkey), rct::sk2rct(k_view)));
crypto::secret_key k_ephem = rct::rct2sk(rct::skGen());
ASSERT_NE(k_view, k_ephem);
mx25519_pubkey enote_ephemeral_pubkey;
ASSERT_TRUE(try_make_carrot_enote_ephemeral_pubkey_subaddress(k_ephem, spend_pubkey, enote_ephemeral_pubkey));
mx25519_pubkey s_sr_sender;
ASSERT_TRUE(try_make_carrot_shared_key_sender(k_ephem, view_pubkey, s_sr_sender));
mx25519_pubkey s_sr_receiver;
ASSERT_TRUE(try_make_carrot_shared_key_receiver(k_view, enote_ephemeral_pubkey, s_sr_receiver));
EXPECT_EQ(s_sr_sender, s_sr_receiver);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, ECDH_mx25519_convergence)
{
const mx25519_pubkey P = gen_x25519_pubkey();
const crypto::secret_key a = rct::rct2sk(rct::skGen());
const mx25519_impl *impl = mx25519_select_impl(MX25519_TYPE_AUTO);
ASSERT_NE(nullptr, impl);
// do Q = a * P using mx25519
mx25519_pubkey Q_mx25519;
mx25519_scmul_key_unclamped(impl, &Q_mx25519, reinterpret_cast<const mx25519_privkey*>(&a), &P);
// do Q = a * P using try_make_carrot_shared_key_receiver()
mx25519_pubkey Q_carrot;
ASSERT_TRUE(try_make_carrot_shared_key_receiver(a, P, Q_carrot));
// check equal
EXPECT_EQ(Q_mx25519, Q_carrot);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, ECDH_openssl_convergence_clamped)
{
MDEBUG("Testing OpenSSL impl of Carrot's X25519 ECDH using clamped keys.");
// generate clamped privkey as uniform 32 byte string
crypto::secret_key k;
unwrap(unwrap(k)) = crypto::rand<crypto::ec_scalar>();
k.data[31] &= 0x7f; // clear 255th bit
k.data[31] |= 0x40; // set 254th bit
k.data[0] &= 0xf8; // clear 0th-2nd bit
// load privkey into OpenSSL from bytes
EVP_PKEY* ssl_privkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, to_bytes(k), sizeof(k));
ASSERT_TRUE(ssl_privkey);
// generate pubkey and load into OpenSSL from bytes
const mx25519_pubkey P = gen_x25519_pubkey();
EVP_PKEY* ssl_peer_pubkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_X25519, NULL, P.data, sizeof(P));
ASSERT_TRUE(ssl_peer_pubkey);
// setup OpenSSL ECDH context
EVP_PKEY_CTX* ctx = EVP_PKEY_CTX_new(ssl_privkey, NULL);
ASSERT_TRUE(ctx);
ASSERT_GT(EVP_PKEY_derive_init(ctx), 0);
ASSERT_GT(EVP_PKEY_derive_set_peer(ctx, ssl_peer_pubkey), 0);
std::size_t ecdh_len = 0;
ASSERT_GT(EVP_PKEY_derive(ctx, NULL, &ecdh_len), 0);
ASSERT_EQ(32, ecdh_len); // sanity check shared secret buffer length
// do ECDH (OpenSSL)
mx25519_pubkey Q_ssl{};
ASSERT_GT(EVP_PKEY_derive(ctx, Q_ssl.data, &ecdh_len), 0);
// do ECDH (carrot_core lib)
mx25519_pubkey Q_cc;
ASSERT_TRUE(try_make_carrot_shared_key_receiver(k, P, Q_cc));
// compare results
ASSERT_EQ(0, memcmp(Q_ssl.data, Q_cc.data, sizeof(Q_ssl)));
// cleanup
EVP_PKEY_free(ssl_privkey);
EVP_PKEY_free(ssl_peer_pubkey);
EVP_PKEY_CTX_free(ctx);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, main_address_normal_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const CarrotDestinationV1 main_address = keys.cryptonote_address();
const CarrotPaymentProposalV1 proposal = CarrotPaymentProposalV1{
.destination = main_address,
.amount = crypto::rand<rct::xmr_amount>(),
.randomness = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_normal_v1(proposal,
tx_first_key_image,
enote_proposal,
encrypted_payment_id);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.legacy_acb.get_keys().m_view_secret_key,
enote_proposal.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(enote_proposal.enote,
encrypted_payment_id,
s_sender_receiver,
{&keys.carrot_account_spend_pubkey, 1},
keys.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination.address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(null_payment_id, recovered_payment_id);
EXPECT_EQ(CarrotEnoteType::PAYMENT, recovered_enote_type);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, subaddress_normal_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const uint32_t j_major = crypto::rand_idx(mock::MAX_SUBADDRESS_MAJOR_INDEX);
const uint32_t j_minor = crypto::rand_idx(mock::MAX_SUBADDRESS_MINOR_INDEX);
const CarrotDestinationV1 subaddress = keys.subaddress({{j_major, j_minor}});
const CarrotPaymentProposalV1 proposal = CarrotPaymentProposalV1{
.destination = subaddress,
.amount = crypto::rand<rct::xmr_amount>(),
.randomness = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_normal_v1(proposal,
tx_first_key_image,
enote_proposal,
encrypted_payment_id);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.legacy_acb.get_keys().m_view_secret_key,
enote_proposal.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(enote_proposal.enote,
encrypted_payment_id,
s_sender_receiver,
{&keys.carrot_account_spend_pubkey, 1},
keys.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination.address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(null_payment_id, recovered_payment_id);
EXPECT_EQ(CarrotEnoteType::PAYMENT, recovered_enote_type);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, integrated_address_normal_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const CarrotDestinationV1 integrated_address = keys.cryptonote_address(gen_payment_id());
const CarrotPaymentProposalV1 proposal = CarrotPaymentProposalV1{
.destination = integrated_address,
.amount = crypto::rand<rct::xmr_amount>(),
.randomness = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_normal_v1(proposal,
tx_first_key_image,
enote_proposal,
encrypted_payment_id);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.legacy_acb.get_keys().m_view_secret_key,
enote_proposal.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(enote_proposal.enote,
encrypted_payment_id,
s_sender_receiver,
{&keys.carrot_account_spend_pubkey, 1},
keys.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination.address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(integrated_address.payment_id, recovered_payment_id);
EXPECT_EQ(CarrotEnoteType::PAYMENT, recovered_enote_type);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, main_address_special_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
// try once with PAYMENT, once with CHANGE
for (int i = 0; i < 2; ++i)
{
const CarrotEnoteType enote_type = i ? CarrotEnoteType::PAYMENT : CarrotEnoteType::CHANGE;
const CarrotPaymentProposalSelfSendV1 proposal = CarrotPaymentProposalSelfSendV1{
.destination_address_spend_pubkey = keys.carrot_account_spend_pubkey,
.amount = crypto::rand<rct::xmr_amount>(),
.enote_type = enote_type,
.enote_ephemeral_privkey = mock::gen_secret_key()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
get_output_proposal_special_v1(proposal,
keys.k_view_incoming_dev,
tx_first_key_image,
nullptr,
nullptr,
enote_proposal);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.legacy_acb.get_keys().m_view_secret_key,
enote_proposal.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(enote_proposal.enote,
std::nullopt,
s_sender_receiver,
{&keys.carrot_account_spend_pubkey, 1},
keys.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination_address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(null_payment_id, recovered_payment_id);
EXPECT_EQ(enote_type, recovered_enote_type);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, subaddress_special_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const uint32_t j_major = crypto::rand_idx(mock::MAX_SUBADDRESS_MAJOR_INDEX);
const uint32_t j_minor = crypto::rand_idx(mock::MAX_SUBADDRESS_MINOR_INDEX);
const CarrotDestinationV1 subaddress = keys.subaddress({{j_major, j_minor}});
// try once with PAYMENT, once with CHANGE
for (int i = 0; i < 2; ++i)
{
const CarrotEnoteType enote_type = i ? CarrotEnoteType::PAYMENT : CarrotEnoteType::CHANGE;
const CarrotPaymentProposalSelfSendV1 proposal = CarrotPaymentProposalSelfSendV1{
.destination_address_spend_pubkey = subaddress.address_spend_pubkey,
.amount = crypto::rand<rct::xmr_amount>(),
.enote_type = enote_type,
.enote_ephemeral_privkey = mock::gen_secret_key()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
get_output_proposal_special_v1(proposal,
keys.k_view_incoming_dev,
tx_first_key_image,
nullptr,
nullptr,
enote_proposal);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.legacy_acb.get_keys().m_view_secret_key,
enote_proposal.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(enote_proposal.enote,
std::nullopt,
s_sender_receiver,
{&keys.carrot_account_spend_pubkey, 1},
keys.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination_address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(null_payment_id, recovered_payment_id);
EXPECT_EQ(enote_type, recovered_enote_type);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, main_address_internal_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const CarrotDestinationV1 main_address = keys.cryptonote_address();
// try once with PAYMENT, once with CHANGE
for (int i = 0; i < 2; ++i)
{
const CarrotEnoteType enote_type = i ? CarrotEnoteType::PAYMENT : CarrotEnoteType::CHANGE;
const CarrotPaymentProposalSelfSendV1 proposal = CarrotPaymentProposalSelfSendV1{
.destination_address_spend_pubkey = main_address.address_spend_pubkey,
.amount = crypto::rand<rct::xmr_amount>(),
.enote_type = enote_type,
.enote_ephemeral_privkey = mock::gen_secret_key(),
.internal_message = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
get_output_proposal_internal_v1(proposal,
keys.s_view_balance_dev,
tx_first_key_image,
nullptr,
nullptr,
enote_proposal);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
CarrotEnoteType recovered_enote_type;
janus_anchor_t recovered_internal_message;
const bool scan_success = try_scan_carrot_enote_internal_receiver(enote_proposal.enote,
keys.s_view_balance_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type,
recovered_internal_message);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination_address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(enote_type, recovered_enote_type);
EXPECT_EQ(proposal.internal_message, recovered_internal_message);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, subaddress_internal_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const uint32_t j_major = crypto::rand_idx(mock::MAX_SUBADDRESS_MAJOR_INDEX);
const uint32_t j_minor = crypto::rand_idx(mock::MAX_SUBADDRESS_MINOR_INDEX);
const CarrotDestinationV1 subaddress = keys.subaddress({{j_major, j_minor}});
// try once with PAYMENT, once with CHANGE
for (int i = 0; i < 2; ++i)
{
const CarrotEnoteType enote_type = i ? CarrotEnoteType::PAYMENT : CarrotEnoteType::CHANGE;
const CarrotPaymentProposalSelfSendV1 proposal = CarrotPaymentProposalSelfSendV1{
.destination_address_spend_pubkey = subaddress.address_spend_pubkey,
.amount = crypto::rand<rct::xmr_amount>(),
.enote_type = enote_type,
.enote_ephemeral_privkey = mock::gen_secret_key(),
.internal_message = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
RCTOutputEnoteProposal enote_proposal;
get_output_proposal_internal_v1(proposal,
keys.s_view_balance_dev,
tx_first_key_image,
nullptr,
nullptr,
enote_proposal);
ASSERT_EQ(proposal.amount, enote_proposal.amount);
const amount_commitment_t recomputed_amount_commitment
= commit_carrot_amount(enote_proposal.amount, enote_proposal.amount_blinding_factor);
ASSERT_EQ(enote_proposal.enote.amount_commitment, recomputed_amount_commitment);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
CarrotEnoteType recovered_enote_type;
janus_anchor_t recovered_internal_message;
const bool scan_success = try_scan_carrot_enote_internal_receiver(enote_proposal.enote,
keys.s_view_balance_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type,
recovered_internal_message);
ASSERT_TRUE(scan_success);
// check recovered data
EXPECT_EQ(proposal.destination_address_spend_pubkey, recovered_address_spend_pubkey);
EXPECT_EQ(proposal.amount, recovered_amount);
EXPECT_EQ(enote_proposal.amount_blinding_factor, recovered_amount_blinding_factor);
EXPECT_EQ(enote_type, recovered_enote_type);
EXPECT_EQ(proposal.internal_message, recovered_internal_message);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote_proposal.enote.onetime_address));
}
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, main_address_coinbase_scan_completeness)
{
const mock::mock_carrot_and_legacy_keys &keys = alice;
const CarrotDestinationV1 main_address = keys.cryptonote_address();
const CarrotPaymentProposalV1 proposal = CarrotPaymentProposalV1{
.destination = main_address,
.amount = crypto::rand<rct::xmr_amount>(),
.randomness = gen_janus_anchor()
};
const uint64_t block_index = crypto::rand<uint64_t>();
CarrotCoinbaseEnoteV1 enote;
get_coinbase_enote_v1(proposal,
block_index,
enote);
ASSERT_EQ(proposal.amount, enote.amount);
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(keys.k_view_incoming_dev,
enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
const bool scan_success = try_scan_carrot_coinbase_enote_receiver(enote,
s_sender_receiver,
keys.carrot_account_spend_pubkey,
keys.cryptonote_address().address_view_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t);
ASSERT_TRUE(scan_success);
// check spendability
EXPECT_TRUE(keys.can_open_fcmp_onetime_address(
keys.carrot_account_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
enote.onetime_address));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, keys_opening_for_main_address)
{
crypto::secret_key x;
crypto::secret_key y;
crypto::public_key address_spend_pubkey;
bob.opening_for_subaddress({{0, 0}}, x, y, address_spend_pubkey);
EXPECT_EQ(bob.carrot_account_spend_pubkey, address_spend_pubkey);
}
//----------------------------------------------------------------------------------------------------------------------
static void subtest_2out_transfer_get_output_enote_proposals_completeness(const bool alice_subaddress,
const bool bob_subaddress,
const bool bob_integrated,
const CarrotEnoteType alice_selfsend_type,
const bool alice_internal_selfsends)
{
// generate alice keys and address
const uint32_t alice_j_major = crypto::rand_idx(mock::MAX_SUBADDRESS_MAJOR_INDEX);
const uint32_t alice_j_minor = crypto::rand_idx(mock::MAX_SUBADDRESS_MINOR_INDEX);
CarrotDestinationV1 alice_address;
if (alice_subaddress)
{
alice_address = alice.subaddress({{alice_j_major, alice_j_minor}});
}
else // alice main address
{
alice_address = alice.cryptonote_address();
}
// generate bob keys and address
const uint32_t bob_j_major = crypto::rand_idx(mock::MAX_SUBADDRESS_MAJOR_INDEX);
const uint32_t bob_j_minor = crypto::rand_idx(mock::MAX_SUBADDRESS_MINOR_INDEX);
CarrotDestinationV1 bob_address;
if (bob_subaddress)
{
bob_address = bob.subaddress({{bob_j_major, bob_j_minor}});
}
else if (bob_integrated)
{
bob_address = bob.cryptonote_address(gen_payment_id());
}
else // bob main address
{
bob_address = bob.cryptonote_address();
}
// generate input context
const crypto::key_image tx_first_key_image = rct::rct2ki(rct::pkGen());
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// outgoing payment proposal to bob
const CarrotPaymentProposalV1 bob_payment_proposal = CarrotPaymentProposalV1{
.destination = bob_address,
.amount = crypto::rand_idx<rct::xmr_amount>(1000000),
.randomness = gen_janus_anchor()
};
// selfsend payment proposal to alice
const CarrotPaymentProposalSelfSendV1 alice_payment_proposal = CarrotPaymentProposalSelfSendV1{
.destination_address_spend_pubkey = alice_address.address_spend_pubkey,
.amount = crypto::rand_idx<rct::xmr_amount>(1000000),
.enote_type = CarrotEnoteType::CHANGE,
.enote_ephemeral_privkey = get_enote_ephemeral_privkey(bob_payment_proposal, input_context),
.internal_message = alice_internal_selfsends ? std::make_optional(gen_janus_anchor()) : std::nullopt
};
// calculate dummy encrypted pid
const std::optional<encrypted_payment_id_t> dummy_encrypted_pid = bob_integrated
? std::optional<encrypted_payment_id_t>{}
: gen_encrypted_payment_id();
// turn payment proposals into enotes, passing dummy pid_enc if bob isn't integrated
std::vector<RCTOutputEnoteProposal> enote_proposals;
encrypted_payment_id_t encrypted_payment_id;
get_output_enote_proposals({bob_payment_proposal},
{alice_payment_proposal},
dummy_encrypted_pid,
alice_internal_selfsends ? &alice.s_view_balance_dev : nullptr,
&alice.k_view_incoming_dev,
tx_first_key_image,
enote_proposals,
encrypted_payment_id);
ASSERT_EQ(2, enote_proposals.size()); // 2-out tx
// collect enotes
std::vector<CarrotEnoteV1> enotes;
for (const RCTOutputEnoteProposal &enote_proposal : enote_proposals)
enotes.push_back(enote_proposal.enote);
// check that alice scanned 1 enote
std::vector<mock::mock_scan_result_t> alice_scan_vec;
mock::mock_scan_enote_set(enotes, encrypted_payment_id, alice, alice_scan_vec);
ASSERT_EQ(1, alice_scan_vec.size());
mock::mock_scan_result_t alice_scan = alice_scan_vec.front();
// check that bob scanned 1 enote
std::vector<mock::mock_scan_result_t> bob_scan_vec;
mock::mock_scan_enote_set(enotes, encrypted_payment_id, bob, bob_scan_vec);
ASSERT_EQ(1, bob_scan_vec.size());
mock::mock_scan_result_t bob_scan = bob_scan_vec.front();
// set named references to enotes
ASSERT_TRUE((alice_scan.output_index == 0 && bob_scan.output_index == 1) ||
(alice_scan.output_index == 1 && bob_scan.output_index == 0));
const CarrotEnoteV1 &alice_enote = enotes.at(alice_scan.output_index);
const CarrotEnoteV1 &bob_enote = enotes.at(bob_scan.output_index);
// check Alice's recovered data
EXPECT_EQ(alice_payment_proposal.destination_address_spend_pubkey, alice_scan.address_spend_pubkey);
EXPECT_EQ(alice_payment_proposal.amount, alice_scan.amount);
EXPECT_EQ(alice_enote.amount_commitment, commit_carrot_amount(alice_scan.amount, alice_scan.amount_blinding_factor));
EXPECT_EQ(null_payment_id, alice_scan.payment_id);
EXPECT_EQ(alice_payment_proposal.enote_type, alice_scan.enote_type);
if (alice_internal_selfsends)
{
EXPECT_EQ(alice_payment_proposal.internal_message, alice_scan.internal_message);
}
// check Bob's recovered data
EXPECT_EQ(bob_payment_proposal.destination.address_spend_pubkey, bob_scan.address_spend_pubkey);
EXPECT_EQ(bob_payment_proposal.amount, bob_scan.amount);
EXPECT_EQ(bob_enote.amount_commitment, commit_carrot_amount(bob_scan.amount, bob_scan.amount_blinding_factor));
EXPECT_EQ(bob_integrated ? bob_address.payment_id : null_payment_id, bob_scan.payment_id);
EXPECT_EQ(CarrotEnoteType::PAYMENT, bob_scan.enote_type);
// check Alice spendability
EXPECT_TRUE(alice.can_open_fcmp_onetime_address(alice_payment_proposal.destination_address_spend_pubkey,
alice_scan.sender_extension_g,
alice_scan.sender_extension_t,
alice_enote.onetime_address));
// check Bob spendability
EXPECT_TRUE(bob.can_open_fcmp_onetime_address(bob_payment_proposal.destination.address_spend_pubkey,
bob_scan.sender_extension_g,
bob_scan.sender_extension_t,
bob_enote.onetime_address));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_main2main_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, false, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, false, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_main2sub_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, true, false, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, true, false, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_main2integ_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, true, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, true, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_sub2main_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, false, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, false, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_sub2sub_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, true, false, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, true, false, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_internal_ss_sub2integ_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, true, CarrotEnoteType::PAYMENT, true);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, true, CarrotEnoteType::CHANGE, true);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_main2main_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, false, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, false, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_main2sub_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, true, false, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, true, false, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_main2integ_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, true, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(false, false, true, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_sub2main_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, false, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, false, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_sub2sub_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, true, false, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, true, false, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, get_enote_output_proposals_external_ss_sub2integ_completeness)
{
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, true, CarrotEnoteType::PAYMENT, false);
subtest_2out_transfer_get_output_enote_proposals_completeness(true, false, true, CarrotEnoteType::CHANGE, false);
}
//----------------------------------------------------------------------------------------------------------------------
struct JanusAttackProposalV1
{
/// The address provided in the normal proposal is used to scale the enote ephemeral pubkey and derive s_sr.
/// The `readjusted_opening_address` is what is added to the sender extensions to derive K_o.
/// If `use_readjusted_address_in_ephemeral_privkey_hash=true`, then d_e is calculated as
/// d_e = H_n(anchor_norm, input_context, K^i_s, K^i_v, pid)), else it is normally calculated as
/// d_e = H_n(anchor_norm, input_context, K^j_s, K^j_v, pid)). It shouldn't make a difference to the attack either
/// way, but we will test that below.
carrot::CarrotPaymentProposalV1 normal; // contains address (is_subaddress, K^j_s, K^j_v, pid)
carrot::CarrotDestinationV1 readjusted_opening_address; // (K^i_s, K^i_v)
bool use_readjusted_address_in_ephemeral_privkey_hash;
};
//----------------------------------------------------------------------------------------------------------------------
static void get_output_proposal_janus_attack_v1(const JanusAttackProposalV1 &proposal,
const crypto::key_image &tx_first_key_image,
carrot::RCTOutputEnoteProposal &output_enote_out,
carrot::encrypted_payment_id_t &encrypted_payment_id_out)
{
// 1. sanity checks
CHECK_AND_ASSERT_THROW_MES(proposal.normal.randomness != carrot::janus_anchor_t{},
"jamtis payment proposal: invalid randomness for janus anchor (zero).");
const carrot::CarrotDestinationV1 &destination = proposal.normal.destination;
// 2. input context: input_context = "R" || KI_1
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// 3. decide if K^x_s = K^j_s XOR K^x_s = K^i_s
const carrot::CarrotDestinationV1 &destination_used_in_ephemeral_privkey_hash =
proposal.use_readjusted_address_in_ephemeral_privkey_hash
? proposal.readjusted_opening_address
: destination;
// 4. d_e = H_n(anchor_norm, input_context, K^x_s, K^x_v, pid)
crypto::secret_key enote_ephemeral_privkey;
carrot::make_carrot_enote_ephemeral_privkey(proposal.normal.randomness,
input_context,
destination_used_in_ephemeral_privkey_hash.address_spend_pubkey,
destination_used_in_ephemeral_privkey_hash.address_view_pubkey,
destination.payment_id,
enote_ephemeral_privkey);
// 5. make D_e
CHECK_AND_ASSERT_THROW_MES(try_make_carrot_enote_ephemeral_pubkey(enote_ephemeral_privkey,
destination.address_spend_pubkey,
destination.is_subaddress,
output_enote_out.enote.enote_ephemeral_pubkey),
"Bad given address points");
// 6. s_sr = d_e ConvertPointE(K^j_v)
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_sender(enote_ephemeral_privkey,
destination.address_view_pubkey,
s_sender_receiver);
// 7. build the output enote address pieces
crypto::hash s_sender_receiver_ctx;
make_carrot_contextualized_sender_receiver_secret(s_sender_receiver.data,
output_enote_out.enote.enote_ephemeral_pubkey,
input_context,
s_sender_receiver_ctx);
// 8. k_a = H_n(s^ctx_sr, a, K^i_s, enote_type)
make_carrot_amount_blinding_factor(s_sender_receiver_ctx,
proposal.normal.amount,
proposal.readjusted_opening_address.address_spend_pubkey,
carrot::CarrotEnoteType::PAYMENT,
output_enote_out.amount_blinding_factor);
// 9. C_a = k_a G + a H
output_enote_out.enote.amount_commitment = commit_carrot_amount(proposal.normal.amount,
output_enote_out.amount_blinding_factor);
// 10. Ko = K^i_s + K^o_ext = K^i_s + (k^o_g G + k^o_t T)
CHECK_AND_ASSERT_THROW_MES(try_make_carrot_onetime_address(
proposal.readjusted_opening_address.address_spend_pubkey,
s_sender_receiver_ctx,
output_enote_out.enote.amount_commitment,
output_enote_out.enote.onetime_address),
"invalid readjusted opening subaddress spend pubkey");
// 11. a_enc = a XOR m_a
output_enote_out.enote.amount_enc = carrot::encrypt_carrot_amount(proposal.normal.amount,
s_sender_receiver_ctx,
output_enote_out.enote.onetime_address);
// 12. pid_enc = pid XOR m_pid
encrypted_payment_id_out = encrypt_legacy_payment_id(destination.payment_id,
s_sender_receiver_ctx,
output_enote_out.enote.onetime_address);
// 13. vt = H_3(s_sr || input_context || Ko)
make_carrot_view_tag(s_sender_receiver.data,
input_context,
output_enote_out.enote.onetime_address,
output_enote_out.enote.view_tag);
// 14. anchor_enc = anchor XOR m_anchor
output_enote_out.enote.anchor_enc = encrypt_carrot_anchor(proposal.normal.randomness,
s_sender_receiver_ctx,
output_enote_out.enote.onetime_address);
// 14. save the amount and first key image
output_enote_out.amount = proposal.normal.amount;
output_enote_out.enote.tx_first_key_image = tx_first_key_image;
// Notice steps 8 & 10 specifically for where `readjusted_opening_address` is
// substituted instead of the actual address spend pubkey used for deriving D_e and s_sr.
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_main_sub_readjust_NOT_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_main,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_subaddr,
.use_readjusted_address_in_ephemeral_privkey_hash = false,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_main,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_main_sub_readjust_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_main,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_subaddr,
.use_readjusted_address_in_ephemeral_privkey_hash = true,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_main,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_sub_main_readjust_NOT_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_main,
.use_readjusted_address_in_ephemeral_privkey_hash = false,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_subaddr,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_sub_main_readjust_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_main,
.use_readjusted_address_in_ephemeral_privkey_hash = true,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_subaddr,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_sub_sub_readjust_NOT_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_subaddr1 = bob.subaddress({{4, 2}});
const CarrotDestinationV1 bob_subaddr2 = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr1,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_subaddr2,
.use_readjusted_address_in_ephemeral_privkey_hash = false,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_subaddr1,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_non_coinbase_sub_sub_readjust_in_d_e)
{
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const CarrotDestinationV1 bob_subaddr1 = bob.subaddress({{4, 2}});
const CarrotDestinationV1 bob_subaddr2 = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr1,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_subaddr2,
.use_readjusted_address_in_ephemeral_privkey_hash = true,
};
carrot::RCTOutputEnoteProposal output_enote;
carrot::encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_janus_attack_v1(proposal, tx_first_key_image, output_enote, encrypted_payment_id);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
carrot::payment_id_t nominal_payment_id;
carrot::CarrotEnoteType recovered_enote_type;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_enote_external_no_janus(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_EQ(amount, recovered_amount);
ASSERT_EQ(carrot::CarrotEnoteType::PAYMENT, recovered_enote_type);
ASSERT_EQ(output_enote.enote.amount_commitment, commit_carrot_amount(recovered_amount, recovered_amount_blinding_factor));
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
carrot::make_carrot_input_context(tx_first_key_image),
nominal_address_spend_pubkey,
bob,
output_enote.enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
nominal_payment_id));
EXPECT_FALSE(try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
nominal_payment_id,
recovered_enote_type));
EXPECT_FALSE(try_scan_carrot_enote_external_sender(output_enote.enote,
encrypted_payment_id,
bob_subaddr1,
s_sender_receiver,
sender_extension_g,
sender_extension_t,
recovered_amount,
recovered_amount_blinding_factor,
recovered_enote_type));
}
//----------------------------------------------------------------------------------------------------------------------
static void get_coinbase_output_proposal_janus_attack_v1(const JanusAttackProposalV1 &proposal,
const std::uint64_t block_index,
carrot::CarrotCoinbaseEnoteV1 &output_enote_out)
{
// 1. sanity checks
CHECK_AND_ASSERT_THROW_MES(proposal.normal.randomness != carrot::janus_anchor_t{},
"jamtis payment proposal: invalid randomness for janus anchor (zero).");
CHECK_AND_ASSERT_THROW_MES(proposal.normal.destination.is_subaddress,
"jamtis payment proposal: we need OG address to be a subaddress so we can make do ECDH against that");
const carrot::CarrotDestinationV1 &destination = proposal.normal.destination;
// 2. input context: input_context = "R" || KI_1
const input_context_t input_context = make_carrot_input_context_coinbase(block_index);
// 3. decide if K^x_s = K^j_s XOR K^x_s = K^i_s
const carrot::CarrotDestinationV1 &destination_used_in_ephemeral_privkey_hash =
proposal.use_readjusted_address_in_ephemeral_privkey_hash
? proposal.readjusted_opening_address
: destination;
// 4. d_e = H_n(anchor_norm, input_context, K^x_s, pid)
crypto::secret_key enote_ephemeral_privkey;
carrot::make_carrot_enote_ephemeral_privkey(proposal.normal.randomness,
input_context,
destination_used_in_ephemeral_privkey_hash.address_spend_pubkey,
destination_used_in_ephemeral_privkey_hash.address_view_pubkey,
destination.payment_id,
enote_ephemeral_privkey);
// 5. make D_e
CHECK_AND_ASSERT_THROW_MES(try_make_carrot_enote_ephemeral_pubkey(enote_ephemeral_privkey,
destination.address_spend_pubkey,
destination.is_subaddress,
output_enote_out.enote_ephemeral_pubkey),
"Bad given address points");
// 6. s_sr = d_e ConvertPointE(K^j_v)
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_sender(enote_ephemeral_privkey,
destination.address_view_pubkey,
s_sender_receiver);
// 7. build the output enote address pieces
crypto::hash s_sender_receiver_ctx;
make_carrot_contextualized_sender_receiver_secret(s_sender_receiver.data,
output_enote_out.enote_ephemeral_pubkey,
input_context,
s_sender_receiver_ctx);
// 8. Ko = K^i_s + K^o_ext = K^i_s + (k^o_g G + k^o_t T)
CHECK_AND_ASSERT_THROW_MES(try_make_carrot_onetime_address_coinbase(
proposal.readjusted_opening_address.address_spend_pubkey,
s_sender_receiver_ctx,
proposal.normal.amount,
output_enote_out.onetime_address),
"invalid readjusted opening subaddress spend pubkey");
// 9. vt = H_3(s_sr || input_context || Ko)
make_carrot_view_tag(s_sender_receiver.data,
input_context,
output_enote_out.onetime_address,
output_enote_out.view_tag);
// 10. anchor_enc = anchor XOR m_anchor
output_enote_out.anchor_enc = encrypt_carrot_anchor(proposal.normal.randomness,
s_sender_receiver_ctx,
output_enote_out.onetime_address);
// 11. save the amount and first key image
output_enote_out.amount = proposal.normal.amount;
output_enote_out.block_index = block_index;
// Notice step 8 specifically for where `readjusted_opening_address` is
// substituted instead of the actual address spend pubkey used for deriving D_e and s_sr.
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_coinbase_main_sub_readjust_NOT_in_d_e)
{
const std::uint64_t block_index = mock::gen_block_index();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_main,
.use_readjusted_address_in_ephemeral_privkey_hash = false,
};
carrot::CarrotCoinbaseEnoteV1 output_enote;
get_coinbase_output_proposal_janus_attack_v1(proposal, block_index, output_enote);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_coinbase_enote_no_janus(output_enote,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(
make_carrot_input_context_coinbase(block_index),
nominal_address_spend_pubkey,
bob,
output_enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
null_payment_id));
EXPECT_FALSE(try_scan_carrot_coinbase_enote_receiver(output_enote,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.cryptonote_address().address_view_pubkey,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey));
EXPECT_FALSE(try_scan_carrot_coinbase_enote_sender(output_enote,
bob_main,
proposal.normal.randomness,
sender_extension_g,
sender_extension_t));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_coinbase_main_sub_readjust_in_d_e)
{
const std::uint64_t block_index = mock::gen_block_index();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_main,
.use_readjusted_address_in_ephemeral_privkey_hash = true,
};
carrot::CarrotCoinbaseEnoteV1 output_enote;
get_coinbase_output_proposal_janus_attack_v1(proposal, block_index, output_enote);
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
carrot::try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key sender_extension_g;
crypto::secret_key sender_extension_t;
crypto::public_key nominal_address_spend_pubkey;
carrot::janus_anchor_t nominal_janus_anchor;
const bool scanned = carrot::try_scan_carrot_coinbase_enote_no_janus(output_enote,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey,
nominal_janus_anchor);
ASSERT_TRUE(scanned);
ASSERT_EQ(proposal.readjusted_opening_address.address_spend_pubkey, nominal_address_spend_pubkey);
ASSERT_TRUE(bob.can_open_fcmp_onetime_address(nominal_address_spend_pubkey,
sender_extension_g,
sender_extension_t,
output_enote.onetime_address));
EXPECT_FALSE(verify_carrot_normal_janus_protection_to_mock_keys(make_carrot_input_context_coinbase(block_index),
nominal_address_spend_pubkey,
bob,
output_enote.enote_ephemeral_pubkey,
nominal_janus_anchor,
null_payment_id));
EXPECT_FALSE(try_scan_carrot_coinbase_enote_receiver(output_enote,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.cryptonote_address().address_view_pubkey,
sender_extension_g,
sender_extension_t,
nominal_address_spend_pubkey));
EXPECT_FALSE(try_scan_carrot_coinbase_enote_sender(output_enote,
bob_main,
proposal.normal.randomness,
sender_extension_g,
sender_extension_t));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, janus_protection_use_readjusted_address_in_ephemeral_privkey_hash)
{
const std::uint64_t block_index = mock::gen_block_index();
const CarrotDestinationV1 bob_main = bob.cryptonote_address();
const CarrotDestinationV1 bob_subaddr = bob.subaddress({{2, 4}});
const rct::xmr_amount amount = rct::randXmrAmount(COIN);
const JanusAttackProposalV1 proposal1{
.normal = carrot::CarrotPaymentProposalV1{
.destination = bob_subaddr,
.amount = amount,
.randomness = carrot::gen_janus_anchor()
},
.readjusted_opening_address = bob_main,
.use_readjusted_address_in_ephemeral_privkey_hash = false,
};
JanusAttackProposalV1 proposal2 = proposal1;
proposal2.use_readjusted_address_in_ephemeral_privkey_hash = true;
carrot::CarrotCoinbaseEnoteV1 output_enote1;
get_coinbase_output_proposal_janus_attack_v1(proposal1, block_index, output_enote1);
carrot::CarrotCoinbaseEnoteV1 output_enote2;
get_coinbase_output_proposal_janus_attack_v1(proposal2, block_index, output_enote2);
EXPECT_NE(0, memcmp(&output_enote1.enote_ephemeral_pubkey,
&output_enote2.enote_ephemeral_pubkey,
sizeof(output_enote1.enote_ephemeral_pubkey)));
}
//----------------------------------------------------------------------------------------------------------------------
struct s_comm_T
{
crypto::hash h;
crypto::ec_point key;
crypto::ec_point comm;
};
//----------------------------------------------------------------------------------------------------------------------
static const ge_p3 T_p3 = crypto::get_T_p3();
//----------------------------------------------------------------------------------------------------------------------
static void generate_signature_T(const crypto::hash &prefix_hash, const crypto::public_key &pub,
const crypto::secret_key &sec, crypto::signature &sig)
{
// modified from crypto::generate_signature() to use T as a base
ge_p2 tmp2;
crypto::ec_scalar k;
s_comm_T buf;
buf.h = prefix_hash;
buf.key = pub;
try_again:
crypto::random32_unbiased(to_bytes(k));
ge_scalarmult(&tmp2, to_bytes(k), &T_p3);
ge_tobytes(to_bytes(buf.comm), &tmp2);
crypto::hash_to_scalar(&buf, sizeof(s_comm_T), sig.c);
if (!sc_isnonzero((const unsigned char*)sig.c.data))
goto try_again;
sc_mulsub(to_bytes(sig.r), to_bytes(sig.c), to_bytes(unwrap(sec)), to_bytes(k));
if (!sc_isnonzero((const unsigned char*)sig.r.data))
goto try_again;
memwipe(&k, sizeof(k));
}
//----------------------------------------------------------------------------------------------------------------------
static bool check_signature_T(const crypto::hash &prefix_hash, const crypto::public_key &pub,
const crypto::signature &sig)
{
// modified from crypto::check_signature() to use T as a base
ge_p3 tmp3;
crypto::ec_scalar c;
s_comm_T buf;
assert(check_key(pub));
buf.h = prefix_hash;
buf.key = pub;
if (ge_frombytes_vartime(&tmp3, to_bytes(pub)) != 0) {
return false;
}
if (sc_check(to_bytes(sig.c)) != 0 || sc_check(to_bytes(sig.r)) != 0 || !sc_isnonzero(to_bytes(sig.c))) {
return false;
}
{
// buf.comm = (sig.c) * pub + sig.r * T
ge_p3 tmp_a;
ge_scalarmult_p3(&tmp_a, to_bytes(sig.c), &tmp3);
ge_p3 tmp_b;
ge_scalarmult_p3(&tmp_b, to_bytes(sig.r), &T_p3);
ge_cached tmp_c;
ge_p3_to_cached(&tmp_c, &tmp_a);
ge_p1p1 tmp_d;
ge_add(&tmp_d, &tmp_b, &tmp_c);
ge_p2 tmp_e;
ge_p1p1_to_p2(&tmp_e, &tmp_d);
ge_tobytes(to_bytes(buf.comm), &tmp_e);
}
static const crypto::ec_point infinity = {{ 1 }};
if (memcmp(&buf.comm, &infinity, 32) == 0)
return false;
hash_to_scalar(&buf, sizeof(s_comm_T), c);
sc_sub(to_bytes(c), to_bytes(c), to_bytes(sig.c));
return sc_isnonzero(to_bytes(c)) == 0;
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, generate_signature_T)
{
crypto::secret_key sec;
crypto::random32_unbiased(to_bytes(sec));
crypto::public_key pub;
make_carrot_partial_spend_pubkey(sec, pub);
const crypto::hash h = crypto::rand<crypto::hash>();
crypto::signature sig;
generate_signature_T(h, pub, sec, sig);
EXPECT_TRUE(check_signature_T(h, pub, sig));
}
//----------------------------------------------------------------------------------------------------------------------
// https://gist.github.com/jeffro256/146bfd5306ea3a8a2a0ea4d660cd2243
static bool pq_turnstile_verify_coinbase(const crypto::hash &txid,
const std::size_t local_output_index,
const crypto::public_key &partial_spend_pubkey,
const crypto::secret_key &s_generate_image_preimage,
const crypto::hash &s_sender_receiver_ctx,
const rct::xmr_amount amount,
const crypto::hash &migration_tx_signable_hash,
const crypto::signature &sig,
const std::function<std::pair<crypto::public_key, rct::key>(const crypto::hash&, std::size_t)> &fetch_output,
const std::function<bool(const crypto::key_image&)> &is_key_image_spent
)
{
// step 1
crypto::public_key output_pubkey;
rct::key amount_commitment;
std::tie(output_pubkey, amount_commitment) = fetch_output(txid, local_output_index);
// step 2
const bool is_in_main_subgroup = rct::isInMainSubgroup(rct::pk2rct(output_pubkey))
&& rct::isInMainSubgroup(amount_commitment)
&& rct::isInMainSubgroup(rct::pk2rct(partial_spend_pubkey));
CHECK_AND_ASSERT_MES(is_in_main_subgroup, false, "one of input points not in main subgroup");
// step 3
crypto::secret_key k_generate_image;
make_carrot_generateimage_key(s_generate_image_preimage, partial_spend_pubkey, k_generate_image);
// step 4
rct::key account_spend_pubkey_rct;
rct::addKeys1(account_spend_pubkey_rct, rct::sk2rct(k_generate_image), rct::pk2rct(partial_spend_pubkey));
const crypto::public_key account_spend_pubkey = rct::rct2pk(account_spend_pubkey_rct);
// step 5
const rct::key amount_commitment_rc = rct::zeroCommitVartime(amount);
// step 6
CHECK_AND_ASSERT_MES(amount_commitment_rc == amount_commitment,
false, "failed to re-compute amount commitment");
// step 7-9
crypto::public_key output_pubkey_rc;
CHECK_AND_ASSERT_MES(try_make_carrot_onetime_address_coinbase(
account_spend_pubkey,
s_sender_receiver_ctx,
amount,
output_pubkey_rc),
false,
"invalid account spend pubkey");
// step 10
CHECK_AND_ASSERT_MES(output_pubkey_rc == output_pubkey, false, "failed to re-compute output pubkey");
// step 11
CHECK_AND_ASSERT_MES(check_signature_T(migration_tx_signable_hash, partial_spend_pubkey, sig),
false, "signature for partial spend pubkey did not validate");
// step 12
crypto::ec_point I;
crypto::derive_key_image_generator(output_pubkey, false, I);
crypto::secret_key sender_extension_g;
make_carrot_sender_extension_g_coinbase(s_sender_receiver_ctx,
amount,
account_spend_pubkey,
sender_extension_g);
crypto::secret_key ki_priv = k_generate_image;
sc_add(to_bytes(ki_priv), to_bytes(ki_priv), to_bytes(sender_extension_g));
const crypto::key_image ki = rct::rct2ki(rct::scalarmultKey(rct::pt2rct(I), rct::sk2rct(ki_priv)));
// step 13
CHECK_AND_ASSERT_MES(!is_key_image_spent(ki), false, "key image already spent in chain");
return true;
}
//----------------------------------------------------------------------------------------------------------------------
// https://gist.github.com/jeffro256/146bfd5306ea3a8a2a0ea4d660cd2243
static bool pq_turnstile_verify(const crypto::hash &txid,
const std::size_t local_output_index,
const crypto::public_key &partial_spend_pubkey,
const crypto::secret_key &s_generate_image_preimage,
const bool is_subaddress,
const crypto::secret_key &address_index_preimage_2,
const crypto::hash &s_sender_receiver_ctx,
const rct::xmr_amount amount,
const CarrotEnoteType enote_type,
const crypto::hash &migration_tx_signable_hash,
const crypto::signature &sig,
const std::function<std::pair<crypto::public_key, amount_commitment_t>(const crypto::hash&, std::size_t)> &get_out,
const std::function<bool(const crypto::key_image&)> &is_key_image_spent
)
{
// step 1
crypto::public_key output_pubkey;
amount_commitment_t amount_commitment;
std::tie(output_pubkey, amount_commitment) = get_out(txid, local_output_index);
// step 2
const bool is_in_main_subgroup = rct::isInMainSubgroup(rct::pk2rct(output_pubkey))
&& rct::isInMainSubgroup(reinterpret_cast<const rct::key&>(amount_commitment))
&& rct::isInMainSubgroup(rct::pk2rct(partial_spend_pubkey));
CHECK_AND_ASSERT_MES(is_in_main_subgroup, false, "one of input points not in main subgroup");
// step 3
crypto::secret_key k_generate_image;
make_carrot_generateimage_key(s_generate_image_preimage, partial_spend_pubkey, k_generate_image);
// step 4
rct::key account_spend_pubkey_rct;
rct::addKeys1(account_spend_pubkey_rct, rct::sk2rct(k_generate_image), rct::pk2rct(partial_spend_pubkey));
const crypto::public_key account_spend_pubkey = rct::rct2pk(account_spend_pubkey_rct);
// step 5
crypto::secret_key subaddress_scalar;
if (is_subaddress)
{
make_carrot_subaddress_scalar(address_index_preimage_2, account_spend_pubkey, subaddress_scalar);
}
else // main
{
subaddress_scalar = {{1}};
}
// step 6
const crypto::public_key address_spend_pubkey = rct::rct2pk(rct::scalarmultKey(account_spend_pubkey_rct,
rct::sk2rct(subaddress_scalar)));
// step 7
crypto::secret_key amount_blinding_factor;
make_carrot_amount_blinding_factor(s_sender_receiver_ctx, amount, address_spend_pubkey, enote_type,
amount_blinding_factor);
// step 8
const amount_commitment_t amount_commitment_rc = commit_carrot_amount(amount, amount_blinding_factor);
// step 9
CHECK_AND_ASSERT_MES(0 == memcmp(&amount_commitment_rc, &amount_commitment, sizeof(rct::key)),
false, "failed to re-compute amount commitment");
// step 10-12
crypto::public_key output_pubkey_rc;
CHECK_AND_ASSERT_MES(try_make_carrot_onetime_address(
address_spend_pubkey,
s_sender_receiver_ctx,
amount_commitment_rc,
output_pubkey_rc),
false,
"invalid address spend pubkey");
// step 13
CHECK_AND_ASSERT_MES(output_pubkey_rc == output_pubkey, false, "failed to re-compute output pubkey");
// step 14
CHECK_AND_ASSERT_MES(check_signature_T(migration_tx_signable_hash, partial_spend_pubkey, sig),
false, "signature for partial spend pubkey did not validate");
// step 15
crypto::ec_point I;
crypto::derive_key_image_generator(output_pubkey, false, I);
crypto::secret_key sender_extension_g;
make_carrot_sender_extension_g(s_sender_receiver_ctx, amount_commitment_rc, sender_extension_g);
crypto::secret_key ki_priv = k_generate_image;
sc_muladd(to_bytes(ki_priv), to_bytes(ki_priv), to_bytes(subaddress_scalar), to_bytes(sender_extension_g));
const crypto::key_image ki = rct::rct2ki(rct::scalarmultKey(rct::pt2rct(I), rct::sk2rct(ki_priv)));
// step 16
CHECK_AND_ASSERT_MES(!is_key_image_spent(ki), false, "key image already spent in chain");
return true;
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, pq_turnstile_completeness_main)
{
const CarrotDestinationV1 main_addr = bob.cryptonote_address();
const CarrotPaymentProposalV1 payment_proposal{
.destination = main_addr,
.amount = COIN,
.randomness = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = mock::gen_key_image();
RCTOutputEnoteProposal output_enote;
encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_normal_v1(payment_proposal, tx_first_key_image, output_enote, encrypted_payment_id);
const crypto::hash migration_tx_signable_hash = crypto::rand<crypto::hash>();
crypto::signature migration_sig;
generate_signature_T(migration_tx_signable_hash, bob.carrot_partial_spend_pubkey, bob.k_prove_spend, migration_sig);
crypto::hash s_sender_receiver_ctx;
{
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
// input_context = "R" || KI_1
const input_context_t input_context = make_carrot_input_context(output_enote.enote.tx_first_key_image);
// s^ctx_sr = H_32(s_sr, D_e, input_context)
make_carrot_contextualized_sender_receiver_secret(s_sender_receiver.data,
output_enote.enote.enote_ephemeral_pubkey,
input_context,
s_sender_receiver_ctx);
}
crypto::key_image ki;
const bool pq_ver = pq_turnstile_verify(/*txid=*/{},
/*local_output_index=*/{},
bob.carrot_partial_spend_pubkey,
bob.s_generate_image_preimage,
/*is_subaddress=*/false,
/*address_index_preimage_2=*/{},
s_sender_receiver_ctx,
payment_proposal.amount,
CarrotEnoteType::PAYMENT,
migration_tx_signable_hash,
migration_sig,
[&output_enote](auto,auto){ return std::pair(output_enote.enote.onetime_address, output_enote.enote.amount_commitment); },
[&ki](const crypto::key_image &derived_key_img){ ki = derived_key_img; return false;});
EXPECT_TRUE(pq_ver);
// scan and compute key image to test pq_turnstile_verify()
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(output_enote.enote,
encrypted_payment_id,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
const crypto::key_image scanned_ki = bob.derive_key_image(
recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
output_enote.enote.onetime_address,
false);
ASSERT_EQ(scanned_ki, ki);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, pq_turnstile_completeness_sub)
{
const subaddress_index subaddr_index = mock::gen_subaddress_index();
ASSERT_TRUE(subaddr_index.is_subaddress());
const CarrotDestinationV1 sub_addr = bob.subaddress({subaddr_index});
const CarrotPaymentProposalV1 payment_proposal{
.destination = sub_addr,
.amount = COIN,
.randomness = gen_janus_anchor()
};
const crypto::key_image tx_first_key_image = mock::gen_key_image();
RCTOutputEnoteProposal output_enote;
encrypted_payment_id_t encrypted_payment_id;
get_output_proposal_normal_v1(payment_proposal, tx_first_key_image, output_enote, encrypted_payment_id);
const crypto::hash migration_tx_signable_hash = crypto::rand<crypto::hash>();
crypto::signature migration_sig;
generate_signature_T(migration_tx_signable_hash, bob.carrot_partial_spend_pubkey, bob.k_prove_spend, migration_sig);
crypto::secret_key address_index_preimage_2;
{
crypto::secret_key address_index_preimage_1;
make_carrot_address_index_preimage_1(bob.s_generate_address, subaddr_index.major, subaddr_index.minor,
address_index_preimage_1);
make_carrot_address_index_preimage_2(address_index_preimage_1, subaddr_index.major, subaddr_index.minor,
bob.carrot_account_spend_pubkey, bob.carrot_account_view_pubkey, address_index_preimage_2);
}
crypto::hash s_sender_receiver_ctx;
{
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
// input_context = "R" || KI_1
const input_context_t input_context = make_carrot_input_context(output_enote.enote.tx_first_key_image);
// s^ctx_sr = H_32(s_sr, D_e, input_context)
make_carrot_contextualized_sender_receiver_secret(s_sender_receiver.data,
output_enote.enote.enote_ephemeral_pubkey,
input_context,
s_sender_receiver_ctx);
}
crypto::key_image ki;
const bool pq_ver = pq_turnstile_verify(/*txid=*/{},
/*local_output_index=*/{},
bob.carrot_partial_spend_pubkey,
bob.s_generate_image_preimage,
/*is_subaddress=*/true,
address_index_preimage_2,
s_sender_receiver_ctx,
payment_proposal.amount,
CarrotEnoteType::PAYMENT,
migration_tx_signable_hash,
migration_sig,
[&output_enote](auto,auto){ return std::pair(output_enote.enote.onetime_address, output_enote.enote.amount_commitment); },
[&ki](const crypto::key_image &derived_key_img){ ki = derived_key_img; return false;});
EXPECT_TRUE(pq_ver);
// scan and compute key image to test pq_turnstile_verify()
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
rct::xmr_amount recovered_amount;
crypto::secret_key recovered_amount_blinding_factor;
payment_id_t recovered_payment_id;
CarrotEnoteType recovered_enote_type;
const bool scan_success = try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey,
recovered_amount,
recovered_amount_blinding_factor,
recovered_payment_id,
recovered_enote_type);
ASSERT_TRUE(scan_success);
const crypto::key_image scanned_ki = bob.derive_key_image(
recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
output_enote.enote.onetime_address,
false);
ASSERT_EQ(scanned_ki, ki);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, pq_turnstile_completeness_coinbase)
{
const CarrotDestinationV1 main_addr = bob.cryptonote_address();
const CarrotPaymentProposalV1 payment_proposal{
.destination = main_addr,
.amount = COIN,
.randomness = gen_janus_anchor()
};
const std::uint64_t block_index = mock::gen_block_index();
CarrotCoinbaseEnoteV1 output_enote;
get_coinbase_enote_v1(payment_proposal, block_index, output_enote);
const crypto::hash migration_tx_signable_hash = crypto::rand<crypto::hash>();
crypto::signature migration_sig;
generate_signature_T(migration_tx_signable_hash, bob.carrot_partial_spend_pubkey, bob.k_prove_spend, migration_sig);
crypto::hash s_sender_receiver_ctx;
{
// s_sr = k_v D_e
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote_ephemeral_pubkey,
s_sender_receiver);
// input_context = "R" || KI_1
const input_context_t input_context = make_carrot_input_context_coinbase(output_enote.block_index);
// s^ctx_sr = H_32(s_sr, D_e, input_context)
make_carrot_contextualized_sender_receiver_secret(s_sender_receiver.data,
output_enote.enote_ephemeral_pubkey,
input_context,
s_sender_receiver_ctx);
}
crypto::key_image ki;
const bool pq_ver = pq_turnstile_verify_coinbase(/*txid=*/{},
/*local_output_index=*/{},
bob.carrot_partial_spend_pubkey,
bob.s_generate_image_preimage,
s_sender_receiver_ctx,
payment_proposal.amount,
migration_tx_signable_hash,
migration_sig,
[&output_enote](auto,auto){ return std::pair(output_enote.onetime_address, rct::zeroCommitVartime(output_enote.amount)); },
[&ki](const crypto::key_image &derived_key_img){ ki = derived_key_img; return false;});
EXPECT_TRUE(pq_ver);
// scan and compute key image to test pq_turnstile_verify()
mx25519_pubkey s_sender_receiver;
try_make_carrot_shared_key_receiver(bob.k_view_incoming_dev,
output_enote.enote_ephemeral_pubkey,
s_sender_receiver);
crypto::secret_key recovered_sender_extension_g;
crypto::secret_key recovered_sender_extension_t;
crypto::public_key recovered_address_spend_pubkey;
const bool scan_success = try_scan_carrot_coinbase_enote_receiver(output_enote,
s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.cryptonote_address().address_view_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
recovered_address_spend_pubkey);
ASSERT_TRUE(scan_success);
const crypto::key_image scanned_ki = bob.derive_key_image(
recovered_address_spend_pubkey,
recovered_sender_extension_g,
recovered_sender_extension_t,
output_enote.onetime_address,
false);
ASSERT_EQ(scanned_ki, ki);
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_normal_main)
{
const CarrotPaymentProposalV1 normal_payment_proposal{
.destination = bob.cryptonote_address(),
.amount = rct::randXmrAmount(9001 * COIN),
.randomness = gen_janus_anchor()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(normal_payment_proposal,
input_context);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultBase(rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(normal_payment_proposal, input_context);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
// s_sr [edwards]
const crypto::public_key s_sender_receiver_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(normal_payment_proposal.destination.address_view_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
{
RCTOutputEnoteProposal output_enote;
encrypted_payment_id_t pid_enc;
get_output_proposal_normal_v1(normal_payment_proposal, tx_first_key_image, output_enote, pid_enc);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, normal_payment_proposal.amount);
ASSERT_EQ(K_j_s, normal_payment_proposal.destination.address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_view_pubkey, boost::none,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_view_pubkey, boost::none,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, normal_payment_proposal.destination.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, boost::none, s_sender_receiver_ed25519,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
normal_payment_proposal.destination.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
boost::none, s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_normal_subaddr)
{
const CarrotPaymentProposalV1 normal_payment_proposal{
.destination = bob.subaddress({mock::gen_subaddress_index()}),
.amount = rct::randXmrAmount(9001 * COIN),
.randomness = gen_janus_anchor()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(normal_payment_proposal,
input_context);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(normal_payment_proposal.destination.address_spend_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(normal_payment_proposal, input_context);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
// s_sr [edwards]
const crypto::public_key s_sender_receiver_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(normal_payment_proposal.destination.address_view_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
{
RCTOutputEnoteProposal output_enote;
encrypted_payment_id_t pid_enc;
get_output_proposal_normal_v1(normal_payment_proposal, tx_first_key_image, output_enote, pid_enc);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, normal_payment_proposal.amount);
ASSERT_EQ(K_j_s, normal_payment_proposal.destination.address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_view_pubkey,
normal_payment_proposal.destination.address_spend_pubkey,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_view_pubkey,
normal_payment_proposal.destination.address_spend_pubkey,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, normal_payment_proposal.destination.address_view_pubkey,
enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_spend_pubkey,
s_sender_receiver_ed25519, bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, normal_payment_proposal.destination.address_view_pubkey,
enote_ephemeral_pubkey_ed25519,
normal_payment_proposal.destination.address_spend_pubkey,
s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_Nout_main)
{
const CarrotDestinationV1 bob_addr = bob.cryptonote_address();
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_addr.address_spend_pubkey,
.is_subaddress = bob_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_ephemeral_privkey = mock::gen_secret_key()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
nullptr, nullptr, tx_first_key_image);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::G, rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
nullptr, nullptr, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(selfsend_payment_proposal.enote_ephemeral_privkey.value(), enote_ephemeral_privkey);
// s_sr [edwards]
crypto::public_key s_sender_receiver_ed25519;
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519));
{
RCTOutputEnoteProposal output_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
bob.k_view_incoming_dev, tx_first_key_image,
nullptr, nullptr, output_enote);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
boost::none,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
boost::none,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, boost::none, s_sender_receiver_ed25519,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
boost::none, s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_Nout_subaddr)
{
const CarrotDestinationV1 bob_addr = bob.subaddress({mock::gen_subaddress_index()});
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_addr.address_spend_pubkey,
.is_subaddress = bob_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_ephemeral_privkey = mock::gen_secret_key()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
nullptr, nullptr, tx_first_key_image);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(bob_addr.address_spend_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
nullptr, nullptr, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(selfsend_payment_proposal.enote_ephemeral_privkey.value(), enote_ephemeral_privkey);
// s_sr [edwards]
crypto::public_key s_sender_receiver_ed25519;
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519));
{
RCTOutputEnoteProposal output_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
bob.k_view_incoming_dev, tx_first_key_image,
nullptr, nullptr, output_enote);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.address_spend_pubkey,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.address_spend_pubkey,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, bob_addr.address_spend_pubkey, s_sender_receiver_ed25519,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
bob_addr.address_spend_pubkey, s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_2out_1selfsend_main)
{
const CarrotDestinationV1 alice_addr = alice.cryptonote_address();
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = alice_addr.address_spend_pubkey,
.is_subaddress = alice_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::CHANGE
};
const CarrotDestinationV1 bob_addr = (crypto::rand<int>() & 1)
? bob.cryptonote_address() : bob.subaddress({mock::gen_subaddress_index()});
MDEBUG(__func__ << ": Bob subaddr? " << bob_addr.is_subaddress);
const CarrotPaymentProposalV1 other_normal_payment_proposal{
.destination = bob_addr,
.amount = rct::randXmrAmount(9001 * COIN),
.randomness = gen_janus_anchor()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
&other_normal_payment_proposal, nullptr, tx_first_key_image);
const crypto::public_key base_ephemeral_pubkey = bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : crypto::get_G();
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(base_ephemeral_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
&other_normal_payment_proposal, nullptr, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(get_enote_ephemeral_privkey(other_normal_payment_proposal, input_context),
enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_pubkey(other_normal_payment_proposal, input_context),
enote_ephemeral_pubkey);
// s_sr's [edwards]
crypto::public_key s_sender_receiver_ed25519_alice;
crypto::public_key s_sender_receiver_ed25519_bob;
ASSERT_TRUE(alice.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519_alice));
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519_bob));
ASSERT_EQ(s_sender_receiver_ed25519_bob, rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(bob_addr.address_view_pubkey), rct::sk2rct(enote_ephemeral_privkey))));
{
RCTOutputEnoteProposal alice_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
alice.k_view_incoming_dev, tx_first_key_image,
&other_normal_payment_proposal, nullptr, alice_enote);
RCTOutputEnoteProposal bob_enote;
encrypted_payment_id_t pid_enc;
get_output_proposal_normal_v1(other_normal_payment_proposal, tx_first_key_image,
bob_enote, pid_enc);
// test scannability for fun
mx25519_pubkey s_sender_receiver_alice;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver_alice.data,
to_bytes(s_sender_receiver_ed25519_alice)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(alice_enote.enote,
std::nullopt, s_sender_receiver_alice,
{&alice.carrot_account_spend_pubkey, 1},
alice.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
mx25519_pubkey s_sender_receiver_bob;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver_bob.data,
to_bytes(s_sender_receiver_ed25519_bob)));
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(bob_enote.enote,
pid_enc, s_sender_receiver_bob,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, other_normal_payment_proposal.amount);
ASSERT_EQ(K_j_s, other_normal_payment_proposal.destination.address_spend_pubkey);
}
// prove tx outproof (BOB)
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, enote_ephemeral_privkey, sig);
// verify tx outproof (BOB)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, sig, /*version=*/2));
// prove tx inproof (BOB)
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (BOB)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, sig, /*version=*/2));
// prove tx inproof (CHANGE)
ASSERT_NE(bob_addr, alice_addr);
ASSERT_TRUE(!alice_addr.is_subaddress);
crypto::generate_tx_proof(prefix_hash, alice_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, boost::none,
s_sender_receiver_ed25519_alice, alice.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (CHANGE)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
alice_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
boost::none, s_sender_receiver_ed25519_alice, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_2out_1selfsend_subaddr)
{
const CarrotDestinationV1 alice_addr = alice.subaddress({mock::gen_subaddress_index()});
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = alice_addr.address_spend_pubkey,
.is_subaddress = alice_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::CHANGE
};
const CarrotDestinationV1 bob_addr = (crypto::rand<int>() & 1)
? bob.cryptonote_address() : bob.subaddress({mock::gen_subaddress_index()});
MDEBUG(__func__ << ": Bob subaddr? " << bob_addr.is_subaddress);
const CarrotPaymentProposalV1 other_normal_payment_proposal{
.destination = bob_addr,
.amount = rct::randXmrAmount(9001 * COIN),
.randomness = gen_janus_anchor()
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
const input_context_t input_context = make_carrot_input_context(tx_first_key_image);
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
&other_normal_payment_proposal, nullptr, tx_first_key_image);
const crypto::public_key base_ephemeral_pubkey = bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : crypto::get_G();
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(base_ephemeral_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
&other_normal_payment_proposal, nullptr, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(get_enote_ephemeral_privkey(other_normal_payment_proposal, input_context),
enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_pubkey(other_normal_payment_proposal, input_context),
enote_ephemeral_pubkey);
// s_sr's [edwards]
crypto::public_key s_sender_receiver_ed25519_alice;
crypto::public_key s_sender_receiver_ed25519_bob;
ASSERT_TRUE(alice.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519_alice));
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519_bob));
ASSERT_EQ(s_sender_receiver_ed25519_bob, rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(bob_addr.address_view_pubkey), rct::sk2rct(enote_ephemeral_privkey))));
{
RCTOutputEnoteProposal alice_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
alice.k_view_incoming_dev, tx_first_key_image,
&other_normal_payment_proposal, nullptr, alice_enote);
RCTOutputEnoteProposal bob_enote;
encrypted_payment_id_t pid_enc;
get_output_proposal_normal_v1(other_normal_payment_proposal, tx_first_key_image,
bob_enote, pid_enc);
// test scannability for fun
mx25519_pubkey s_sender_receiver_alice;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver_alice.data,
to_bytes(s_sender_receiver_ed25519_alice)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(alice_enote.enote,
std::nullopt, s_sender_receiver_alice,
{&alice.carrot_account_spend_pubkey, 1},
alice.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
mx25519_pubkey s_sender_receiver_bob;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver_bob.data,
to_bytes(s_sender_receiver_ed25519_bob)));
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(bob_enote.enote,
pid_enc, s_sender_receiver_bob,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, other_normal_payment_proposal.amount);
ASSERT_EQ(K_j_s, other_normal_payment_proposal.destination.address_spend_pubkey);
}
// prove tx outproof (BOB)
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, enote_ephemeral_privkey, sig);
// verify tx outproof (BOB)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, sig, /*version=*/2));
// prove tx inproof (BOB)
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (BOB)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
bob_addr.is_subaddress ? bob_addr.address_spend_pubkey : boost::optional<crypto::public_key>(),
s_sender_receiver_ed25519_bob, sig, /*version=*/2));
// prove tx inproof (CHANGE)
ASSERT_NE(bob_addr, alice_addr);
ASSERT_TRUE(alice_addr.is_subaddress);
crypto::generate_tx_proof(prefix_hash, alice_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, alice_addr.address_spend_pubkey,
s_sender_receiver_ed25519_alice, alice.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (CHANGE)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
alice_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
alice_addr.address_spend_pubkey, s_sender_receiver_ed25519_alice, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_2out_2selfsend_main)
{
const CarrotDestinationV1 bob_addr = bob.cryptonote_address();
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_addr.address_spend_pubkey,
.is_subaddress = bob_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::PAYMENT,
.enote_ephemeral_privkey = mock::gen_secret_key(),
};
const CarrotDestinationV1 bob_other_addr = bob.subaddress({mock::gen_subaddress_index()});
const CarrotPaymentProposalSelfSendV1 other_selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_other_addr.address_spend_pubkey,
.is_subaddress = bob_other_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::CHANGE
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
nullptr, &other_selfsend_payment_proposal, tx_first_key_image);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::G, rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
nullptr, &other_selfsend_payment_proposal, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(selfsend_payment_proposal.enote_ephemeral_privkey.value(), enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_privkey(other_selfsend_payment_proposal,
nullptr, &selfsend_payment_proposal, tx_first_key_image),
enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_pubkey(other_selfsend_payment_proposal,
nullptr, &selfsend_payment_proposal, tx_first_key_image),
enote_ephemeral_pubkey);
// s_sr [edwards]
crypto::public_key s_sender_receiver_ed25519;
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519));
{
RCTOutputEnoteProposal output_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
bob.k_view_incoming_dev, tx_first_key_image,
nullptr, nullptr, output_enote);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
boost::none,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
boost::none,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, boost::none, s_sender_receiver_ed25519,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
boost::none, s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof (CHANGE)
ASSERT_NE(bob_addr, bob_other_addr);
ASSERT_TRUE(bob_other_addr.is_subaddress);
crypto::generate_tx_proof(prefix_hash, bob_other_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, bob_other_addr.address_spend_pubkey,
s_sender_receiver_ed25519, bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (CHANGE)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_other_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
bob_other_addr.address_spend_pubkey, s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
TEST(carrot_core, tx_inout_proof_special_2out_2selfsend_subaddr)
{
const CarrotDestinationV1 bob_addr = bob.subaddress({mock::gen_subaddress_index()});
const CarrotPaymentProposalSelfSendV1 selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_addr.address_spend_pubkey,
.is_subaddress = bob_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::PAYMENT,
.enote_ephemeral_privkey = mock::gen_secret_key(),
};
const CarrotDestinationV1 bob_other_addr = bob.cryptonote_address();
const CarrotPaymentProposalSelfSendV1 other_selfsend_payment_proposal{
.destination_address_spend_pubkey = bob_other_addr.address_spend_pubkey,
.is_subaddress = bob_other_addr.is_subaddress,
.amount = rct::randXmrAmount(9001 * COIN),
.enote_type = CarrotEnoteType::CHANGE
};
// input_context
const crypto::key_image tx_first_key_image = mock::gen_key_image();
// D_e / K_e
const crypto::secret_key enote_ephemeral_privkey = get_enote_ephemeral_privkey(selfsend_payment_proposal,
nullptr, &other_selfsend_payment_proposal, tx_first_key_image);
const crypto::public_key enote_ephemeral_pubkey_ed25519 = rct::rct2pk(rct::scalarmultKey(
rct::pk2rct(bob_addr.address_spend_pubkey), rct::sk2rct(enote_ephemeral_privkey)));
const mx25519_pubkey enote_ephemeral_pubkey = get_enote_ephemeral_pubkey(selfsend_payment_proposal,
nullptr, &other_selfsend_payment_proposal, tx_first_key_image);
mx25519_pubkey enote_ephemeral_pubkey_conv;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(enote_ephemeral_pubkey_conv.data, to_bytes(enote_ephemeral_pubkey_ed25519)));
ASSERT_EQ(0, memcmp(&enote_ephemeral_pubkey, &enote_ephemeral_pubkey_conv, sizeof(mx25519_pubkey)));
ASSERT_EQ(selfsend_payment_proposal.enote_ephemeral_privkey.value(), enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_privkey(other_selfsend_payment_proposal,
nullptr, &selfsend_payment_proposal, tx_first_key_image),
enote_ephemeral_privkey);
ASSERT_EQ(get_enote_ephemeral_pubkey(other_selfsend_payment_proposal,
nullptr, &selfsend_payment_proposal, tx_first_key_image),
enote_ephemeral_pubkey);
// s_sr [edwards]
crypto::public_key s_sender_receiver_ed25519;
ASSERT_TRUE(bob.k_view_incoming_dev.view_key_scalar_mult_ed25519(enote_ephemeral_pubkey_ed25519,
s_sender_receiver_ed25519));
{
RCTOutputEnoteProposal output_enote;
get_output_proposal_special_v1(selfsend_payment_proposal,
bob.k_view_incoming_dev, tx_first_key_image,
nullptr, nullptr, output_enote);
// test scannability for fun
mx25519_pubkey s_sender_receiver;
ASSERT_EQ(0, edwards_bytes_to_x25519_vartime(s_sender_receiver.data, to_bytes(s_sender_receiver_ed25519)));
crypto::secret_key k_g_o, k_t_o, k_a;
crypto::public_key K_j_s;
xmr_amount a;
payment_id_t pid;
CarrotEnoteType enote_type;
ASSERT_TRUE(try_scan_carrot_enote_external_receiver(output_enote.enote,
std::nullopt, s_sender_receiver,
{&bob.carrot_account_spend_pubkey, 1},
bob.k_view_incoming_dev, k_g_o, k_t_o,
K_j_s, a, k_a, pid, enote_type));
ASSERT_EQ(a, selfsend_payment_proposal.amount);
ASSERT_EQ(K_j_s, selfsend_payment_proposal.destination_address_spend_pubkey);
}
// prove tx outproof
const crypto::hash prefix_hash = crypto::rand<crypto::hash>();
crypto::signature sig;
crypto::generate_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.address_spend_pubkey,
s_sender_receiver_ed25519, enote_ephemeral_privkey, sig);
// verify tx outproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash, enote_ephemeral_pubkey_ed25519,
bob_addr.address_view_pubkey,
bob_addr.address_spend_pubkey,
s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof
crypto::generate_tx_proof(prefix_hash, bob_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, bob_addr.address_spend_pubkey, s_sender_receiver_ed25519,
bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
bob_addr.address_spend_pubkey, s_sender_receiver_ed25519, sig, /*version=*/2));
// prove tx inproof (CHANGE)
ASSERT_NE(bob_addr, bob_other_addr);
ASSERT_FALSE(bob_other_addr.is_subaddress);
crypto::generate_tx_proof(prefix_hash, bob_other_addr.address_view_pubkey,
enote_ephemeral_pubkey_ed25519, boost::none,
s_sender_receiver_ed25519, bob.legacy_acb.get_keys().m_view_secret_key, sig);
// verify tx inproof (CHANGE)
EXPECT_TRUE(crypto::check_tx_proof(prefix_hash,
bob_other_addr.address_view_pubkey, enote_ephemeral_pubkey_ed25519,
boost::none, s_sender_receiver_ed25519, sig, /*version=*/2));
}
//----------------------------------------------------------------------------------------------------------------------
Reference in New Issue View Git Blame Copy Permalink