Constant-time note commitment

Cargo.toml

@@ -29,8 +29,8 @@ blake2b_simd = "1"
 ff = "0.12"
 fpe = "0.5"
 group = { version = "0.12.1", features = ["wnaf-memuse"] }
-halo2_gadgets = "0.2"
-halo2_proofs = "0.2"
+halo2_gadgets = {git = "https://github.com/QED-it/halo2", branch = "add_sinsemilla_functionalities"}
+halo2_proofs = {git = "https://github.com/QED-it/halo2", branch = "add_sinsemilla_functionalities"}
 hex = "0.4"
 lazy_static = "1"
 memuse = { version = "0.2.1", features = ["nonempty"] }
@@ -52,7 +52,7 @@ plotters = { version = "0.3.0", optional = true }
 
 [dev-dependencies]
 criterion = "0.3"
-halo2_gadgets = { version = "0.2", features = ["test-dependencies"] }
+halo2_gadgets = { git = "https://github.com/QED-it/halo2", branch = "add_sinsemilla_functionalities", features = ["test-dependencies"] }
 hex = "0.4"
 proptest = "1.0.0"
 zcash_note_encryption = { version = "0.2", features = ["pre-zip-212"] }

src/note/commitment.rs

@@ -63,29 +63,34 @@ impl NoteCommitment {
             .chain(rho_bits.iter().by_vals().take(L_ORCHARD_BASE))
             .chain(psi_bits.iter().by_vals().take(L_ORCHARD_BASE));
 
-        // TODO: make this constant-time.
+        let type_bits = BitArray::<_, Lsb0>::new(asset.to_bytes());
+        let zsa_note_bits = iter::empty()
+            .chain(g_d_bits.iter().by_vals())
+            .chain(pk_d_bits.iter().by_vals())
+            .chain(v_bits.iter().by_vals())
+            .chain(rho_bits.iter().by_vals().take(L_ORCHARD_BASE))
+            .chain(psi_bits.iter().by_vals().take(L_ORCHARD_BASE))
+            .chain(type_bits.iter().by_vals());
+
+        let zec_domain = sinsemilla::CommitDomain::new(NOTE_COMMITMENT_PERSONALIZATION);
+        let zsa_domain = sinsemilla::CommitDomain::new(NOTE_ZSA_COMMITMENT_PERSONALIZATION);
+
+        let zec_hash_point = zec_domain.hash_to_point_inner(zec_note_bits);
+        let zsa_hash_point = zsa_domain.hash_to_point_inner(zsa_note_bits);
+
+        let zec_blind = zec_domain.blinding_factor(&rcm.0);
+        let zsa_blind = zsa_domain.blinding_factor(&rcm.0);
+
         if asset.is_native().into() {
-            // Commit to ZEC notes as per the Orchard protocol.
-            Self::commit(NOTE_COMMITMENT_PERSONALIZATION, zec_note_bits, rcm)
+            CtOption::<pallas::Point>::from(zec_hash_point)
+                .map(|p| p + zec_blind)
+                .map(NoteCommitment)
         } else {
-            // Commit to non-ZEC notes as per the ZSA protocol.
-            // Append the note type to the Orchard note encoding.
-            let type_bits = BitArray::<_, Lsb0>::new(asset.to_bytes());
-            let zsa_note_bits = zec_note_bits.chain(type_bits.iter().by_vals());
-
-            // Commit in a different domain than Orchard notes.
-            Self::commit(NOTE_ZSA_COMMITMENT_PERSONALIZATION, zsa_note_bits, rcm)
+            CtOption::<pallas::Point>::from(zsa_hash_point)
+                .map(|p| p + zsa_blind)
+                .map(NoteCommitment)
         }
     }
-
-    fn commit(
-        personalization: &str,
-        bits: impl Iterator<Item = bool>,
-        rcm: NoteCommitTrapdoor,
-    ) -> CtOption<Self> {
-        let domain = sinsemilla::CommitDomain::new(personalization);
-        domain.commit(bits, &rcm.0).map(NoteCommitment)
-    }
 }
 
 /// The x-coordinate of the commitment to a note.
@@ -140,3 +145,34 @@ impl PartialEq for ExtractedNoteCommitment {
 }
 
 impl Eq for ExtractedNoteCommitment {}
+
+#[cfg(test)]
+mod tests {
+    use crate::constants::fixed_bases::NOTE_COMMITMENT_PERSONALIZATION;
+    use crate::note::commitment::NoteCommitTrapdoor;
+    use ff::Field;
+    use halo2_gadgets::sinsemilla::primitives as sinsemilla;
+    use pasta_curves::pallas;
+    use rand::{rngs::OsRng, Rng};
+    use subtle::CtOption;
+
+    #[test]
+    fn test_note_commit() {
+        let mut os_rng = OsRng::default();
+        let msg: Vec<bool> = (0..36).map(|_| os_rng.gen::<bool>()).collect();
+
+        let rcm = NoteCommitTrapdoor(pallas::Scalar::random(&mut os_rng));
+
+        let domain = sinsemilla::CommitDomain::new(NOTE_COMMITMENT_PERSONALIZATION);
+
+        let expected_commit = domain.commit(msg.clone().into_iter(), &rcm.0);
+
+        let commit = {
+            let hash_point = domain.hash_to_point_inner(msg.into_iter());
+            let blind_factor = domain.blinding_factor(&rcm.0);
+            CtOption::<pallas::Point>::from(hash_point).map(|p| p + blind_factor)
+        };
+
+        assert_eq!(expected_commit.unwrap(), commit.unwrap());
+    }
+}