spark_cryptography/

adaptor_signature.rs

// use bitcoin::secp256k1::{Message, PublicKey, Secp256k1, SecretKey, schnorr::Signature};
// use elliptic_curve::{PrimeField, generic_array::GenericArray, group::GroupEncoding};
// use hmac::Mac;
// use k256::ProjectivePoint;
// use k256::schnorr::{
//     SigningKey, VerifyingKey,
//     signature::{Signer, Verifier},
// };
// use rand::thread_rng;
// use sha2::{Digest, Sha256};

// #[derive(Debug)]
// pub struct AdaptorSignature {
//     pub signature: [u8; 64],
//     pub adaptor_private_key: [u8; 32],
// }

// const MOCK_SECRET_KEY: [u8; 32] = [
//     0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
//     0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
// ];

// const MOCK_ADAPTOR_KEY: [u8; 32] = [
//     0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
//     0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
// ];

// pub fn generate_adaptor_from_signature(
//     signature: &[u8; 64],
// ) -> Result<AdaptorSignature, Box<dyn std::error::Error>> {
//     let secp = Secp256k1::new();
//     let mut rng = thread_rng();

//     // Generate random adaptor private key
//     let adaptor_private_key = SecretKey::new(&mut rng);

//     // Parse the original signature
//     let sig = Signature::from_slice(signature)?;

//     // Extract r and s components
//     let r = sig[..32].to_vec();
//     let s = sig[32..].to_vec();

//     let s_ga = GenericArray::from_slice(&s);
//     let adaptor_private_key_ga = GenericArray::from_slice(adaptor_private_key.as_ref());

//     // Convert s to scalar
//     let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
//     let t_scalar = k256::Scalar::from_repr(*adaptor_private_key_ga).unwrap();

//     // Calculate s - adaptor_private_key
//     let new_s = s_scalar - t_scalar;

//     // Create new signature
//     let mut new_signature = [0u8; 64];
//     new_signature[..32].copy_from_slice(&r);
//     new_signature[32..].copy_from_slice(&new_s.to_bytes());

//     Ok(AdaptorSignature {
//         signature: new_signature,
//         adaptor_private_key: adaptor_private_key.secret_bytes(),
//     })
// }

// pub fn validate_outbound_adaptor_signature(
//     pubkey: &[u8],
//     message: &[u8],
//     signature: &[u8],
//     adaptor_pubkey: &[u8],
// ) -> Result<bool, Box<dyn std::error::Error>> {
//     schnorr_verify_with_adaptor(signature, message, pubkey, adaptor_pubkey, false)
// }

// pub fn apply_adaptor_to_signature(
//     pubkey: &[u8],
//     message: &[u8],
//     signature: &[u8],
//     adaptor_private_key: &[u8],
// ) -> Result<[u8; 64], Box<dyn std::error::Error>> {
//     let secp = Secp256k1::new();

//     // Parse the signature
//     let sig: [u8; 64] = signature
//         .try_into()
//         .map_err(|_| "Invalid signature length")?;
//     let (r, s) = sig.split_at(32);

//     // let r_ga = GenericArray::from_slice(r);
//     let s_ga = GenericArray::from_slice(s);
//     let adaptor_private_key_ga = GenericArray::from_slice(adaptor_private_key);

//     // Convert to scalars
//     let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
//     let t_scalar = k256::Scalar::from_repr(*adaptor_private_key_ga).unwrap();

//     // Try adding adaptor first
//     let new_s = s_scalar + t_scalar;
//     let mut new_sig = [0u8; 64];
//     new_sig[..32].copy_from_slice(r);
//     new_sig[32..].copy_from_slice(&new_s.to_bytes());

//     // Verify the signature
//     let msg = Message::from_slice(message)?;
//     let pk = PublicKey::from_slice(pubkey)?;

//     if secp
//         .verify_schnorr(
//             &bitcoin::secp256k1::schnorr::Signature::from_slice(&new_sig)?,
//             &msg,
//             &pk.x_only_public_key().0,
//         )
//         .is_ok()
//     {
//         return Ok(new_sig);
//     }

//     // If adding didn't work, try subtracting
//     let alt_s = s_scalar - t_scalar;
//     let mut alt_sig = [0u8; 64];
//     alt_sig[..32].copy_from_slice(r);
//     alt_sig[32..].copy_from_slice(&alt_s.to_bytes());

//     if secp
//         .verify_schnorr(
//             &bitcoin::secp256k1::schnorr::Signature::from_slice(&alt_sig)?,
//             &msg,
//             &pk.x_only_public_key().0,
//         )
//         .is_ok()
//     {
//         return Ok(alt_sig);
//     }

//     Err("Cannot apply adaptor to signature".into())
// }

// fn schnorr_verify_with_adaptor(
//     signature: &[u8],
//     message: &[u8],
//     pubkey: &[u8],
//     adaptor_pubkey: &[u8],
//     inbound: bool,
// ) -> Result<bool, Box<dyn std::error::Error>> {
//     // Verify message length
//     if message.len() != 32 {
//         return Err(format!("wrong size for message (got {}, want 32)", message.len()).into());
//     }

//     // Parse public key
//     let pk = PublicKey::from_slice(pubkey)?;
//     let pk_bytes = pk.serialize();
//     let pk_ga = GenericArray::from_slice(pk_bytes.as_slice());
//     let pk_point = ProjectivePoint::from_bytes(pk_ga).unwrap();

//     // Parse signature
//     if signature.len() != 64 {
//         return Err(format!("wrong signature length: {}", signature.len()).into());
//     }

//     let (r_bytes, s_bytes) = signature.split_at(32);

//     // Compute tagged hash for challenge
//     let mut hasher = Sha256::new();
//     hasher.update(b"BIP0340/challenge");
//     hasher.update(r_bytes);
//     hasher.update(&pk.serialize()[1..]); // Skip first byte (parity)
//     hasher.update(message);
//     let e = hasher.finalize();

//     // Convert challenge to scalar
//     let e_ga = GenericArray::from_slice(e.as_slice());
//     let e_scalar = k256::Scalar::from_repr(*e_ga).unwrap();
//     let neg_e = -e_scalar;

//     // Calculate R = sG - eP
//     let s_ga = GenericArray::from_slice(s_bytes);
//     let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
//     let base_point = ProjectivePoint::GENERATOR;
//     let r_point = (base_point * s_scalar) + (pk_point * neg_e);

//     // Add adaptor public key
//     let adaptor_ga = GenericArray::from_slice(adaptor_pubkey);
//     let adaptor_point = ProjectivePoint::from_bytes(adaptor_ga).unwrap();
//     let new_r = r_point + adaptor_point;

//     // TODO: Check for point at infinity
//     // if !inbound && new_r.is_identity().into() {
//     //     return Err("calculated R point is the point at infinity".into());
//     // }

//     // TODO: Convert to affine and check y coordinate parity
//     // let new_r_affine = new_r.to_affine();
//     // if new_r_affine.y().is_odd().into() {
//     //     return Err("calculated R y-value is odd".into());
//     // }

//     // TODO: Check if x coordinate matches r
//     let r_ga = GenericArray::from_slice(r_bytes);
//     let r_scalar = k256::Scalar::from_repr(*r_ga).unwrap();
//     // if new_r.x() != &r_scalar.into() {
//     //     return Err("calculated R point was not given R".into());
//     // }

//     Ok(true)
// }

// #[cfg(test)]
// mod tests {
//     use std::str::FromStr;

//     use super::*;
//     use k256::ecdsa::signature::SignerMut;
//     use schnorr_fun::{Schnorr, fun::nonce::Deterministic};
//     use secp256k1::Keypair;

//     #[test]
//     fn test_adaptor_signature() {
//         let secp = Secp256k1::new();

//         // Use mock secret key
//         println!(
//             "RUST: Using mock secret key: {:?}",
//             hex::encode(&MOCK_SECRET_KEY)
//         );
//         let secret_key = SecretKey::from_slice(&MOCK_SECRET_KEY).unwrap();
//         let public_key = PublicKey::from_secret_key(&secp, &secret_key);
//         println!(
//             "RUST: Generated public key: {:?}",
//             hex::encode(&public_key.serialize())
//         );
//         // generate Schnorr verifying key
//         let verifying_key = public_key.x_only_public_key().0;
//         println!(
//             "RUST: Schnorr verifying == xonly pubkey: {:?}",
//             hex::encode(&verifying_key.serialize())
//         );

//         // Create test message and hash
//         let message = b"test";
//         println!("RUST: Test message: {:?}", hex::encode(&message));
//         let mut hasher = Sha256::new();
//         hasher.update(message);
//         let msg_hash = hasher.finalize();
//         println!("RUST: Message hash: {:?}", hex::encode(&msg_hash));

//         // Create original signature
//         let msg = Message::from_slice(&msg_hash).unwrap();
//         let keypair = Keypair::from_secret_key(&secp, &secret_key);

//         let signature = Signature::from_str("b28a65d8651818ea04cfdf945455d64bbd7bac068532289a8cc0801a9ed283046159052e7ec6972cc113b2d6bc17883d5d1d4e12a4563f05b220e7b8533342e3")
//             .unwrap();
//         let is_valid = secp
//             .verify_schnorr(
//                 &signature,
//                 &msg,
//                 &keypair.public_key().x_only_public_key().0,
//             )
//             .is_ok();

//         println!("is_valid: {}", is_valid);
//     }
// }

// const RFC6979_EXTRA_DATA: &[u8] = b"BIP-340";

// fn rfc6979_generate_k(
//     priv_key: &[u8],
//     msg_hash: &[u8],
//     extra_data: &[u8],
//     iteration: u32,
// ) -> [u8; 32] {
//     type HmacSha256 = hmac::Hmac<sha2::Sha256>;

//     let mut v = [0x01; 32];
//     let mut k = [0x00; 32];

//     // Step A
//     let mut hmac = HmacSha256::new_from_slice(&k).unwrap();
//     hmac.update(&v);
//     hmac.update(&[0x00]);
//     hmac.update(priv_key);
//     hmac.update(msg_hash);
//     hmac.update(extra_data);
//     hmac.update(&iteration.to_be_bytes());
//     k = hmac.finalize().into_bytes().try_into().unwrap();

//     // Step B
//     let mut hmac = HmacSha256::new_from_slice(&k).unwrap();
//     hmac.update(&v);
//     v = hmac.finalize().into_bytes().try_into().unwrap();

//     // Step C
//     let mut hmac = HmacSha256::new_from_slice(&k).unwrap();
//     hmac.update(&v);
//     hmac.update(&[0x01]);
//     hmac.update(priv_key);
//     hmac.update(msg_hash);
//     hmac.update(extra_data);
//     hmac.update(&iteration.to_be_bytes());
//     k = hmac.finalize().into_bytes().try_into().unwrap();

//     // Step D
//     let mut hmac = HmacSha256::new_from_slice(&k).unwrap();
//     hmac.update(&v);
//     v = hmac.finalize().into_bytes().try_into().unwrap();

//     // Step E
//     let mut hmac = HmacSha256::new_from_slice(&k).unwrap();
//     hmac.update(&v);
//     v = hmac.finalize().into_bytes().try_into().unwrap();

//     v
// }

// pub fn sign_schnorr_btcd_compatible(secret_key: &[u8; 32], msg: &[u8]) -> [u8; 64] {
//     // Hash message
//     let mut hasher = Sha256::new();
//     hasher.update(msg);
//     let msg_hash = hasher.finalize();

//     // Generate RFC6979 nonce matching btcd (with iteration 0)
//     let aux_rand = rfc6979_generate_k(secret_key, &msg_hash, RFC6979_EXTRA_DATA, 0);

//     // Create signing key
//     let signing_key = SigningKey::from_bytes(secret_key).unwrap();

//     // Sign using the generated aux_rand
//     let sig = signing_key
//         .sign_prehash_with_aux_rand(&msg_hash.into(), &aux_rand)
//         .unwrap();

//     sig.to_bytes()
// }

use bitcoin::secp256k1::{schnorr::Signature, Message, PublicKey, Secp256k1, SecretKey};
use elliptic_curve::{generic_array::GenericArray, group::GroupEncoding, PrimeField};
use k256::elliptic_curve::point::AffineCoordinates;
use k256::ProjectivePoint;

use rand::thread_rng;
use sha2::{Digest, Sha256};

#[derive(Debug)]
pub struct AdaptorSignature {
    pub signature: [u8; 64],
    pub adaptor_private_key: [u8; 32],
}

pub fn generate_adaptor_from_signature(
    signature: &[u8; 64],
) -> Result<AdaptorSignature, Box<dyn std::error::Error>> {
    let mut rng = thread_rng();

    // Generate random adaptor private key
    let adaptor_private_key = SecretKey::new(&mut rng);

    // Parse the original signature
    let sig = Signature::from_slice(signature)?;

    // Extract r and s components
    let r = sig[..32].to_vec();
    let s = sig[32..].to_vec();

    let s_ga = GenericArray::from_slice(&s);
    let adaptor_private_key_ga = GenericArray::from_slice(adaptor_private_key.as_ref());

    // Convert s to scalar
    let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
    let t_scalar = k256::Scalar::from_repr(*adaptor_private_key_ga).unwrap();

    // Calculate s - adaptor_private_key
    let new_s = s_scalar - t_scalar;

    // Create new signature
    let mut new_signature = [0u8; 64];
    new_signature[..32].copy_from_slice(&r);
    new_signature[32..].copy_from_slice(&new_s.to_bytes());

    Ok(AdaptorSignature {
        signature: new_signature,
        adaptor_private_key: adaptor_private_key.secret_bytes(),
    })
}

pub fn validate_outbound_adaptor_signature(
    pubkey: &[u8],
    message: &[u8],
    signature: &[u8],
    adaptor_pubkey: &[u8],
) -> Result<bool, Box<dyn std::error::Error>> {
    schnorr_verify_with_adaptor(signature, message, pubkey, adaptor_pubkey, false)
}

pub fn apply_adaptor_to_signature(
    pubkey: &[u8],
    message: &[u8],
    signature: &[u8],
    adaptor_private_key: &[u8],
) -> Result<[u8; 64], Box<dyn std::error::Error>> {
    let secp = Secp256k1::new();

    // Parse the signature
    let sig: [u8; 64] = signature
        .try_into()
        .map_err(|_| "Invalid signature length")?;
    let (r, s) = sig.split_at(32);

    // let r_ga = GenericArray::from_slice(r);
    let s_ga = GenericArray::from_slice(s);
    let adaptor_private_key_ga = GenericArray::from_slice(adaptor_private_key);

    // Convert to scalars
    let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
    let t_scalar = k256::Scalar::from_repr(*adaptor_private_key_ga).unwrap();

    // Try adding adaptor first
    let new_s = s_scalar + t_scalar;
    let mut new_sig = [0u8; 64];
    new_sig[..32].copy_from_slice(r);
    new_sig[32..].copy_from_slice(&new_s.to_bytes());

    // Verify the signature
    let msg = Message::from_digest_slice(message).map_err(|_| "Invalid message")?;
    let pk = PublicKey::from_slice(pubkey).map_err(|_| "Invalid public key")?;

    if secp
        .verify_schnorr(
            &bitcoin::secp256k1::schnorr::Signature::from_slice(&new_sig)?,
            &msg,
            &pk.x_only_public_key().0,
        )
        .is_ok()
    {
        return Ok(new_sig);
    }

    // If adding didn't work, try subtracting
    let alt_s = s_scalar - t_scalar;
    let mut alt_sig = [0u8; 64];
    alt_sig[..32].copy_from_slice(r);
    alt_sig[32..].copy_from_slice(&alt_s.to_bytes());

    if secp
        .verify_schnorr(
            &bitcoin::secp256k1::schnorr::Signature::from_slice(&alt_sig)?,
            &msg,
            &pk.x_only_public_key().0,
        )
        .is_ok()
    {
        return Ok(alt_sig);
    }

    Err("Cannot apply adaptor to signature".into())
}

pub fn generate_signature_from_existing_adaptor(
    signature: &[u8],
    adaptor_private_key: &[u8],
) -> Result<[u8; 64], Box<dyn std::error::Error>> {
    // Parse signature
    if signature.len() != 64 {
        return Err(format!("wrong signature length: {}", signature.len()).into());
    }

    let (r, s) = signature.split_at(32);
    let s_ga = GenericArray::from_slice(s);
    let adaptor_private_key_ga = GenericArray::from_slice(adaptor_private_key);

    // Convert to scalars
    let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
    let mut t_scalar = k256::Scalar::from_repr(*adaptor_private_key_ga).unwrap();

    // Negate t
    t_scalar = -t_scalar;

    // Add negated t to s
    let new_s = s_scalar + t_scalar;

    // Create new signature
    let mut new_sig = [0u8; 64];
    new_sig[..32].copy_from_slice(r);
    new_sig[32..].copy_from_slice(&new_s.to_bytes());

    Ok(new_sig)
}

fn schnorr_verify_with_adaptor(
    signature: &[u8],
    message: &[u8],
    pubkey: &[u8],
    adaptor_pubkey: &[u8],
    inbound: bool,
) -> Result<bool, Box<dyn std::error::Error>> {
    // Verify message length
    if message.len() != 32 {
        return Err(format!("wrong size for message (got {}, want 32)", message.len()).into());
    }

    // Parse public key
    let pk = PublicKey::from_slice(pubkey)?;
    let pk_bytes = pk.serialize();
    let pk_ga = GenericArray::from_slice(pk_bytes.as_slice());
    let pk_point = ProjectivePoint::from_bytes(pk_ga).unwrap();

    // Parse signature
    if signature.len() != 64 {
        return Err(format!("wrong signature length: {}", signature.len()).into());
    }

    let (r_bytes, s_bytes) = signature.split_at(32);

    // Compute tagged hash for challenge
    let mut hasher = Sha256::new();
    hasher.update(b"BIP0340/chllenge");
    hasher.update(r_bytes);
    hasher.update(&pk.serialize()[1..]); // Skip first byte (parity)
    hasher.update(message);
    let e = hasher.finalize();

    // Convert challenge to scalar
    let e_ga = GenericArray::from_slice(e.as_slice());
    let e_scalar = k256::Scalar::from_repr(*e_ga).unwrap();
    let neg_e = -e_scalar;

    // Calculate R = sG - eP
    let s_ga = GenericArray::from_slice(s_bytes);
    let s_scalar = k256::Scalar::from_repr(*s_ga).unwrap();
    let base_point = ProjectivePoint::GENERATOR;
    let r_point = (base_point * s_scalar) + (pk_point * neg_e);

    // Add adaptor public key
    let adaptor_ga = GenericArray::from_slice(adaptor_pubkey);
    let adaptor_point = ProjectivePoint::from_bytes(adaptor_ga).unwrap();
    let new_r = r_point + adaptor_point;

    // TODO: Check for point at infinity
    if !inbound && new_r == ProjectivePoint::IDENTITY {
        return Err("calculated R point is the point at infinity".into());
    }

    // TODO: Convert to affine and check y coordinate parity
    let new_r_affine = new_r.to_affine();
    // if new_r_affine.y().is_odd().into() {
    //     return Err("calculated R y-value is odd".into());
    // }

    // TODO: Check if x coordinate matches r
    let r_ga = GenericArray::from_slice(r_bytes);
    let r_scalar = k256::Scalar::from_repr(*r_ga).unwrap();
    let new_r_x = new_r_affine.x();
    if new_r_x != r_scalar.to_bytes() {
        return Err("calculated R point x-coordinate does not match r".into());
    }

    Ok(true)
}

#[cfg(test)]
mod tests {
    use secp256k1::Keypair;

    use super::*;

    #[test]
    #[ignore]
    fn test_adaptor_signature_flow() {
        let secp = Secp256k1::new();
        let mut rng = thread_rng();

        // Generate test keys
        let secret_key = SecretKey::new(&mut rng);
        let public_key = PublicKey::from_secret_key(&secp, &secret_key);

        // Create test message
        let message = b"Hello, world!";
        let msg_hash = Sha256::digest(message);

        // Create original signature
        let msg = Message::from_digest_slice(&msg_hash).unwrap();
        let keypair = Keypair::from_secret_key(&secp, &secret_key);
        let sig = secp.sign_schnorr(&msg, &keypair);

        // Generate adaptor signature
        let adaptor_result = generate_adaptor_from_signature(&sig.as_ref()).unwrap();

        // Validate adaptor signature
        let adaptor_pubkey = PublicKey::from_secret_key(
            &secp,
            &SecretKey::from_slice(&adaptor_result.adaptor_private_key).unwrap(),
        );

        let is_valid = validate_outbound_adaptor_signature(
            &public_key.serialize(),
            &msg_hash,
            &adaptor_result.signature,
            &adaptor_pubkey.serialize(),
        )
        .unwrap();

        assert!(is_valid);

        // Apply adaptor to signature
        let final_sig = apply_adaptor_to_signature(
            &public_key.serialize(),
            &msg_hash,
            &adaptor_result.signature,
            &adaptor_result.adaptor_private_key,
        )
        .unwrap();

        // Verify final signature
        assert!(secp
            .verify_schnorr(
                &bitcoin::secp256k1::schnorr::Signature::from_slice(&final_sig).unwrap(),
                &msg,
                &public_key.x_only_public_key().0
            )
            .is_ok());
    }
}