[Wallet/Mint] DLEQ proofs

[callebtc]

This PR introduces discrete log equality (DLEQ) proofs to Cashu.

DLEQ proofs enable the ecash receiver (Alice while minting tokens, or Carol while receiving tokens from Alice) to verify the mint's signature C without access to its private key a. Without DLEQ proofs, only the mint is able to verify its own signature.

The DLEQ proof

The purpose of this DLEQ is to prove that the mint has used the same private key a for creating its public key A and for signing the BlindedMessage B'. Bob the mint returns the proof with the blind signature C' during a mint or split operation. The complete DLEQ proof reads

# DLEQ Proof

(These steps occur once Bob returns C')

Bob:
r = random nonce
R1 = r*G
R2 = r*B'
e = hash(R1,R2,A,C')
s = r + e*a
return e, s

Alice:
R1 = s*G - e*A
R2 = s*B' - e*C'
e == hash(R1,R2,A,C')

If true, a in A = a*G must be equal to a in C' = a*B'

The mint produces these DLEQ proofs when returning BlindSignature's upon the POST /mint and POST /split responses:

BlindedSignature(
    id=keyset.id,
    amount=amount,
    C_=C_.serialize().hex(),
    dleq=DLEQ(
        e=e.hex(), s=s.hex()
    ),
)

e and s are the challenge and response of the DLEQ proof.

The BDHKE function step2_bob is extended to calculate and return the DLEQ proof:

def step2_bob(B_: PublicKey, a: PrivateKey) -> Tuple[PublicKey, PrivateKey, PrivateKey]:
    C_: PublicKey = B_.mult(a)  # type: ignore
    # produce dleq proof
    e, s = step2_bob_dleq(B_, a)
    return C_, e, s

def step2_bob_dleq(
    B_: PublicKey, a: PrivateKey, p_bytes: bytes = b""
) -> Tuple[PrivateKey, PrivateKey]:
    p = PrivateKey() # random nonce
    R1 = p.pubkey  # R1 = pG
    R2: PublicKey = B_.mult(p)  # R2 = pB_ 
    C_: PublicKey = B_.mult(a)  # C_ = aB_ 
    A = a.pubkey
    e = hash_e(R1, R2, A, C_)  # e = hash(R1, R2, A, C_)
    s = p.tweak_add(a.tweak_mul(e))  # s = p + ek
    return PrivateKey(e, raw=True), PrivateKey(s, raw=True)

Alice: Verify DLEQ proof upon /mint and /split

Alice who receives the DLEQ proof from the mint checks its validity using:

def alice_verify_dleq(
    B_: PublicKey, C_: PublicKey, e: PrivateKey, s: PrivateKey, A: PublicKey
) -> bool:
    R1 = s.pubkey - A.mult(e) 
    R2 = B_.mult(s) - C_.mult(e)
    return  e.private_key == hash_e(R1, R2, A, C_)

As we can see, in order to execute the proof, Alice needs e, s that are returned from Bob. Alice further needs B' (the BlindedMessage that Bob signed) and C', the BlindSignature from Bob, and A, the public key of Bob with which he signed the BlindedMessage. All these are available during or after the /mint and /split operations.

• If a DLEQ proof is included in the mint's response, wallet MUST verify the proof.

Carol: Verify DLEQ from Alice

A user Alice can generate a token that includes a DLEQ proof using the command cashu send <amount> --dleq (or -d for short).

When Alice sends a token including a DLEQ proof to another user Carol, Carol can execute the DLEQ proof herself to validate Bob's signature without having to talk to Bob. That means, Alice must include the following information in a token she sends to Carol:

• ( x, C ) – the ecash token
• ( e, s ) – the DLEQ proof
• ( r ) – Alice's blinding factor

Here, x is the Proof's secret, and C is the mint's signature on it. To execute the DLEQ proof like Alice above, Carol needs (B', C') which she can compute herself using the blinding factor r that she receives from Alice.

To verify the DLEQ proof of a received token, Carol executes the following code:

def carol_verify_dleq(
    secret_msg: str,
    r: PrivateKey,
    C: PublicKey,
    e: PrivateKey,
    s: PrivateKey,
    A: PublicKey,
) -> bool:
    Y: PublicKey = hash_to_curve(secret_msg.encode("utf-8"))
    C_: PublicKey = C + A.mult(r)  # type: ignore
    B_: PublicKey = Y + r.pubkey  # type: ignore
    return alice_verify_dleq(B_, C_, e, s, A)

• If a DLEQ proof is included in a received token, wallet MUST verify the proof.

Todo:

• Bob produces DLEQ proof
• DLEQ verification for Bob -> Alice
• DLEQ verification Alice -> Carol
• Backwards compatibility with pre-dleq mints
• Backwards compatibility with pre-dleq wallets
• Wallet store DLEQ in database
• Write tests for mint
• Write tests for wallet
• Rename wallet database entry to dleq_e and dleq_s
• Write NUT
• Fix Issue 11.05.2023

[codecov-commenter]

Codecov Report

Patch coverage: 93.46% and project coverage change: +1.66% 🎉

Comparison is base (a1802b2) 57.46% compared to head (b251c24) 59.12%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #175      +/-   ##
==========================================
+ Coverage   57.46%   59.12%   +1.66%     
==========================================
  Files          46       46              
  Lines        4046     4115      +69     
==========================================
+ Hits         2325     2433     +108     
+ Misses       1721     1682      -39     

Files Changed	Coverage Δ
cashu/mint/crud.py	70.00% <ø> (ø)
cashu/core/script.py	45.67% <33.33%> (ø)
cashu/wallet/api/router.py	69.19% <50.00%> (+0.94%)	⬆️
cashu/wallet/wallet.py	81.90% <89.39%> (+2.75%)	⬆️
cashu/core/base.py	96.55% <100.00%> (+0.79%)	⬆️
cashu/core/crypto/b_dhke.py	96.72% <100.00%> (+3.86%)	⬆️
cashu/mint/ledger.py	27.95% <100.00%> (-0.16%)	⬇️
cashu/mint/migrations.py	100.00% <100.00%> (ø)
cashu/wallet/cli/cli.py	53.33% <100.00%> (+4.11%)	⬆️
cashu/wallet/crud.py	73.98% <100.00%> (+0.21%)	⬆️
... and 4 more

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.