{"action":"created","comment":{"url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/comments/183228423","pull_request_review_id":114192648,"id":183228423,"diff_hunk":"@@ -0,0 +1,137 @@\n+//! Implementation of RedJubjub, a specialization of RedDSA to the Jubjub curve.\n+//! See section 5.4.6 of the Sapling protocol specification.\n+\n+use pairing::Field;\n+use rand::Rng;\n+\n+use jubjub::{FixedGenerators, JubjubEngine, JubjubParams, Unknown, edwards::Point};\n+use util::hash_to_scalar;\n+\n+fn h_star<E: JubjubEngine>(a: &[u8], b: &[u8]) -> E::Fs {\n+    hash_to_scalar::<E>(b\"Zcash_RedJubjubH\", a, b)\n+}\n+\n+pub struct Signature<E: JubjubEngine> {\n+    r: Point<E, Unknown>,\n+    s: E::Fs,\n+}\n+\n+pub struct PrivateKey<E: JubjubEngine>(E::Fs);\n+\n+pub struct PublicKey<E: JubjubEngine>(Point<E, Unknown>);\n+\n+impl<E: JubjubEngine> PrivateKey<E> {\n+    pub fn randomize(&self, alpha: E::Fs) -> Self {\n+        let mut tmp = self.0;\n+        tmp.add_assign(&alpha);\n+        PrivateKey(tmp)\n+    }\n+\n+    pub fn sign<R: Rng>(&self, msg: &[u8], rng: &mut R, params: &E::Params) -> Signature<E> {\n+        // T = (l_H + 128) bits of randomness\n+        // For H*, l_H = 512 bits\n+        let mut t = [0u8; 80];\n+        rng.fill_bytes(&mut t[..]);\n+\n+        // r = H*(T || M)\n+        let r = h_star::<E>(&t[..], msg);\n+\n+        // R = r . G\n+        let r_g = params\n+            .generator(FixedGenerators::SpendingKeyGenerator)\n+            .mul(r, params);\n+        let mut rbar = [0u8; 32];\n+        r_g.write(&mut rbar[..])\n+            .expect(\"Jubjub points should serialize to 32 bytes\");\n+\n+        // S = r + H*(Rbar || M) . sk\n+        let mut s = h_star::<E>(&rbar[..], msg);\n+        s.mul_assign(&self.0);\n+        s.add_assign(&r);\n+\n+        Signature { r: r_g.into(), s }\n+    }\n+}\n+\n+impl<E: JubjubEngine> PublicKey<E> {\n+    pub fn from_private(privkey: &PrivateKey<E>, params: &E::Params) -> Self {\n+        let res = params\n+            .generator(FixedGenerators::SpendingKeyGenerator)\n+            .mul(privkey.0, params)\n+            .into();\n+        PublicKey(res)\n+    }\n+\n+    pub fn randomize(&self, alpha: E::Fs, params: &E::Params) -> Self {\n+        let res: Point<E, Unknown> = params\n+            .generator(FixedGenerators::SpendingKeyGenerator)\n+            .mul(alpha, params)\n+            .into();\n+        let res = res.add(&self.0, params);\n+        PublicKey(res)\n+    }\n+\n+    // Pre-conditions:\n+    // - rbar was the canonical representation of a point on the curve.\n+    // - sig.s < order(G)\n+    // TODO(str4d): Enforce these during deserialization of Signature\n+    pub fn verify(&self, msg: &[u8], sig: &Signature<E>, params: &E::Params) -> bool {\n+        // c = H*(Rbar || M)\n+        let mut rbar = [0u8; 32];\n+        sig.r\n+            .write(&mut rbar[..])\n+            .expect(\"Jubjub points should serialize to 32 bytes\");","path":"src/redjubjub.rs","position":83,"original_position":83,"commit_id":"840c23bd238a25e36b059ebe40adfe6397be3544","original_commit_id":"840c23bd238a25e36b059ebe40adfe6397be3544","user":{"login":"daira","id":643204,"avatar_url":"https://avatars2.githubusercontent.com/u/643204?v=4","gravatar_id":"","url":"https://api.github.com/users/daira","html_url":"https://github.com/daira","followers_url":"https://api.github.com/users/daira/followers","following_url":"https://api.github.com/users/daira/following{/other_user}","gists_url":"https://api.github.com/users/daira/gists{/gist_id}","starred_url":"https://api.github.com/users/daira/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daira/subscriptions","organizations_url":"https://api.github.com/users/daira/orgs","repos_url":"https://api.github.com/users/daira/repos","events_url":"https://api.github.com/users/daira/events{/privacy}","received_events_url":"https://api.github.com/users/daira/received_events","type":"User","site_admin":false},"body":"It was an intentional part of the design (inherited from EdDSA) that you hash the representation of R exactly as given in the signature. That implies that any change to the representation R̲ will result in a completely different hash, and so it's not possible to malleate the signature by changing R̲. (It still might be by changing S̲, but that's a simpler encoding.)\r\n\r\nI realize it is equivalent if the representation of R is ensured to be canonical, but then you have two places to look in the code to check that the signature is being verified correctly. As specified, a RedJubjub signature is a byte sequence, *not* a (point, integer) pair, and so I recommend that it be implemented that way for ease of auditing.","created_at":"2018-04-22T07:52:56Z","updated_at":"2018-04-22T07:52:56Z","html_url":"https://github.com/zcash-hackworks/sapling-crypto/pull/64#discussion_r183228423","pull_request_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/comments/183228423"},"html":{"href":"https://github.com/zcash-hackworks/sapling-crypto/pull/64#discussion_r183228423"},"pull_request":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64"}},"in_reply_to_id":183073610},"pull_request":{"url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64","id":181723623,"html_url":"https://github.com/zcash-hackworks/sapling-crypto/pull/64","diff_url":"https://github.com/zcash-hackworks/sapling-crypto/pull/64.diff","patch_url":"https://github.com/zcash-hackworks/sapling-crypto/pull/64.patch","issue_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/64","number":64,"state":"closed","locked":false,"title":"RedJubjub","user":{"login":"str4d","id":4993799,"avatar_url":"https://avatars0.githubusercontent.com/u/4993799?v=4","gravatar_id":"","url":"https://api.github.com/users/str4d","html_url":"https://github.com/str4d","followers_url":"https://api.github.com/users/str4d/followers","following_url":"https://api.github.com/users/str4d/following{/other_user}","gists_url":"https://api.github.com/users/str4d/gists{/gist_id}","starred_url":"https://api.github.com/users/str4d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/str4d/subscriptions","organizations_url":"https://api.github.com/users/str4d/orgs","repos_url":"https://api.github.com/users/str4d/repos","events_url":"https://api.github.com/users/str4d/events{/privacy}","received_events_url":"https://api.github.com/users/str4d/received_events","type":"User","site_admin":false},"body":"","created_at":"2018-04-15T22:02:50Z","updated_at":"2018-04-22T07:52:56Z","closed_at":"2018-04-19T18:44:39Z","merged_at":"2018-04-19T18:44:39Z","merge_commit_sha":"e4175d81e9dfca3ab4e1e72019f326b9d9bd1b6d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64/commits","review_comments_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64/comments","review_comment_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/64/comments","statuses_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/statuses/840c23bd238a25e36b059ebe40adfe6397be3544","head":{"label":"str4d:redjubjub","ref":"redjubjub","sha":"840c23bd238a25e36b059ebe40adfe6397be3544","user":{"login":"str4d","id":4993799,"avatar_url":"https://avatars0.githubusercontent.com/u/4993799?v=4","gravatar_id":"","url":"https://api.github.com/users/str4d","html_url":"https://github.com/str4d","followers_url":"https://api.github.com/users/str4d/followers","following_url":"https://api.github.com/users/str4d/following{/other_user}","gists_url":"https://api.github.com/users/str4d/gists{/gist_id}","starred_url":"https://api.github.com/users/str4d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/str4d/subscriptions","organizations_url":"https://api.github.com/users/str4d/orgs","repos_url":"https://api.github.com/users/str4d/repos","events_url":"https://api.github.com/users/str4d/events{/privacy}","received_events_url":"https://api.github.com/users/str4d/received_events","type":"User","site_admin":false},"repo":{"id":113350486,"name":"sapling-crypto","full_name":"str4d/sapling-crypto","owner":{"login":"str4d","id":4993799,"avatar_url":"https://avatars0.githubusercontent.com/u/4993799?v=4","gravatar_id":"","url":"https://api.github.com/users/str4d","html_url":"https://github.com/str4d","followers_url":"https://api.github.com/users/str4d/followers","following_url":"https://api.github.com/users/str4d/following{/other_user}","gists_url":"https://api.github.com/users/str4d/gists{/gist_id}","starred_url":"https://api.github.com/users/str4d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/str4d/subscriptions","organizations_url":"https://api.github.com/users/str4d/orgs","repos_url":"https://api.github.com/users/str4d/repos","events_url":"https://api.github.com/users/str4d/events{/privacy}","received_events_url":"https://api.github.com/users/str4d/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/str4d/sapling-crypto","description":"Zcash \"Sapling\" cryptography","fork":true,"url":"https://api.github.com/repos/str4d/sapling-crypto","forks_url":"https://api.github.com/repos/str4d/sapling-crypto/forks","keys_url":"https://api.github.com/repos/str4d/sapling-crypto/keys{/key_id}","collaborators_url":"https://api.github.com/repos/str4d/sapling-crypto/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/str4d/sapling-crypto/teams","hooks_url":"https://api.github.com/repos/str4d/sapling-crypto/hooks","issue_events_url":"https://api.github.com/repos/str4d/sapling-crypto/issues/events{/number}","events_url":"https://api.github.com/repos/str4d/sapling-crypto/events","assignees_url":"https://api.github.com/repos/str4d/sapling-crypto/assignees{/user}","branches_url":"https://api.github.com/repos/str4d/sapling-crypto/branches{/branch}","tags_url":"https://api.github.com/repos/str4d/sapling-crypto/tags","blobs_url":"https://api.github.com/repos/str4d/sapling-crypto/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/str4d/sapling-crypto/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/str4d/sapling-crypto/git/refs{/sha}","trees_url":"https://api.github.com/repos/str4d/sapling-crypto/git/trees{/sha}","statuses_url":"https://api.github.com/repos/str4d/sapling-crypto/statuses/{sha}","languages_url":"https://api.github.com/repos/str4d/sapling-crypto/languages","stargazers_url":"https://api.github.com/repos/str4d/sapling-crypto/stargazers","contributors_url":"https://api.github.com/repos/str4d/sapling-crypto/contributors","subscribers_url":"https://api.github.com/repos/str4d/sapling-crypto/subscribers","subscription_url":"https://api.github.com/repos/str4d/sapling-crypto/subscription","commits_url":"https://api.github.com/repos/str4d/sapling-crypto/commits{/sha}","git_commits_url":"https://api.github.com/repos/str4d/sapling-crypto/git/commits{/sha}","comments_url":"https://api.github.com/repos/str4d/sapling-crypto/comments{/number}","issue_comment_url":"https://api.github.com/repos/str4d/sapling-crypto/issues/comments{/number}","contents_url":"https://api.github.com/repos/str4d/sapling-crypto/contents/{+path}","compare_url":"https://api.github.com/repos/str4d/sapling-crypto/compare/{base}...{head}","merges_url":"https://api.github.com/repos/str4d/sapling-crypto/merges","archive_url":"https://api.github.com/repos/str4d/sapling-crypto/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/str4d/sapling-crypto/downloads","issues_url":"https://api.github.com/repos/str4d/sapling-crypto/issues{/number}","pulls_url":"https://api.github.com/repos/str4d/sapling-crypto/pulls{/number}","milestones_url":"https://api.github.com/repos/str4d/sapling-crypto/milestones{/number}","notifications_url":"https://api.github.com/repos/str4d/sapling-crypto/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/str4d/sapling-crypto/labels{/name}","releases_url":"https://api.github.com/repos/str4d/sapling-crypto/releases{/id}","deployments_url":"https://api.github.com/repos/str4d/sapling-crypto/deployments","created_at":"2017-12-06T18:04:06Z","updated_at":"2017-12-06T18:04:09Z","pushed_at":"2018-04-19T22:00:04Z","git_url":"git://github.com/str4d/sapling-crypto.git","ssh_url":"git@github.com:str4d/sapling-crypto.git","clone_url":"https://github.com/str4d/sapling-crypto.git","svn_url":"https://github.com/str4d/sapling-crypto","homepage":null,"size":314,"stargazers_count":0,"watchers_count":0,"language":"Rust","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zcash-hackworks:master","ref":"master","sha":"e554b473dd10885d232f42237c13282f5b6fee43","user":{"login":"zcash-hackworks","id":31554395,"avatar_url":"https://avatars0.githubusercontent.com/u/31554395?v=4","gravatar_id":"","url":"https://api.github.com/users/zcash-hackworks","html_url":"https://github.com/zcash-hackworks","followers_url":"https://api.github.com/users/zcash-hackworks/followers","following_url":"https://api.github.com/users/zcash-hackworks/following{/other_user}","gists_url":"https://api.github.com/users/zcash-hackworks/gists{/gist_id}","starred_url":"https://api.github.com/users/zcash-hackworks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcash-hackworks/subscriptions","organizations_url":"https://api.github.com/users/zcash-hackworks/orgs","repos_url":"https://api.github.com/users/zcash-hackworks/repos","events_url":"https://api.github.com/users/zcash-hackworks/events{/privacy}","received_events_url":"https://api.github.com/users/zcash-hackworks/received_events","type":"Organization","site_admin":false},"repo":{"id":111058300,"name":"sapling-crypto","full_name":"zcash-hackworks/sapling-crypto","owner":{"login":"zcash-hackworks","id":31554395,"avatar_url":"https://avatars0.githubusercontent.com/u/31554395?v=4","gravatar_id":"","url":"https://api.github.com/users/zcash-hackworks","html_url":"https://github.com/zcash-hackworks","followers_url":"https://api.github.com/users/zcash-hackworks/followers","following_url":"https://api.github.com/users/zcash-hackworks/following{/other_user}","gists_url":"https://api.github.com/users/zcash-hackworks/gists{/gist_id}","starred_url":"https://api.github.com/users/zcash-hackworks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcash-hackworks/subscriptions","organizations_url":"https://api.github.com/users/zcash-hackworks/orgs","repos_url":"https://api.github.com/users/zcash-hackworks/repos","events_url":"https://api.github.com/users/zcash-hackworks/events{/privacy}","received_events_url":"https://api.github.com/users/zcash-hackworks/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zcash-hackworks/sapling-crypto","description":"Zcash \"Sapling\" cryptography","fork":false,"url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto","forks_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/forks","keys_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/teams","hooks_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/hooks","issue_events_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/events{/number}","events_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/events","assignees_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/assignees{/user}","branches_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/branches{/branch}","tags_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/tags","blobs_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/git/refs{/sha}","trees_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/statuses/{sha}","languages_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/languages","stargazers_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/stargazers","contributors_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/contributors","subscribers_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/subscribers","subscription_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/subscription","commits_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/commits{/sha}","git_commits_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/git/commits{/sha}","comments_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/comments{/number}","issue_comment_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/comments{/number}","contents_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/contents/{+path}","compare_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/merges","archive_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/downloads","issues_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues{/number}","pulls_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls{/number}","milestones_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/milestones{/number}","notifications_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/labels{/name}","releases_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/releases{/id}","deployments_url":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/deployments","created_at":"2017-11-17T04:34:32Z","updated_at":"2018-04-19T18:44:41Z","pushed_at":"2018-04-19T18:44:40Z","git_url":"git://github.com/zcash-hackworks/sapling-crypto.git","ssh_url":"git@github.com:zcash-hackworks/sapling-crypto.git","clone_url":"https://github.com/zcash-hackworks/sapling-crypto.git","svn_url":"https://github.com/zcash-hackworks/sapling-crypto","homepage":null,"size":362,"stargazers_count":14,"watchers_count":14,"language":"Rust","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8,"mirror_url":null,"archived":false,"open_issues_count":20,"license":null,"forks":8,"open_issues":20,"watchers":14,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64"},"html":{"href":"https://github.com/zcash-hackworks/sapling-crypto/pull/64"},"issue":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/64"},"comments":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/issues/64/comments"},"review_comments":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64/comments"},"review_comment":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/pulls/64/commits"},"statuses":{"href":"https://api.github.com/repos/zcash-hackworks/sapling-crypto/statuses/840c23bd238a25e36b059ebe40adfe6397be3544"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"daira"}}