Sapphire.generateSigningKeyPair returns wrong secret key, and Sapphire.generateCurve25519KeyPair returns zeros about oasis-sdk

[HarryR]

The 'secret' returned from generateSigningKeyPair is useful as the first 32 bytes are the derived x25519 secret for use with Sapphire.deriveSymmetricKey. But, without a working CURVE25519_PUBLIC_KEY operation I needed to convert the Ed25519 point to its montgomery coordinates (see js snippet below).

Have provided an example of client<->contract encryption at: https://gist.github.com/HarryR/eb5fd5fb77eda9f509cb94c91fe76fef

Using this method I am able to establish a known secret between contract and an ephemeral x25519 key.

const nacl = require('tweetnacl');

// XXX: why isn't this exported in nacl.lowlevel, field inversion is useful!
function inv25519(o, i) {
  const {gf, S, M} = nacl.lowlevel;
  var c = gf();
  var a;
  for (a = 0; a < 16; a++) c[a] = i[a];
  for (a = 253; a >= 0; a--) {
    S(c, c);
    if(a !== 2 && a !== 4) M(c, c, i);
  }
  for (a = 0; a < 16; a++) o[a] = c[a];
}

/**
 * convert ed25519 public key to its montgomery coordinate
 * 
 * ed25519 is birationally equiv. to montgomery curve
 * 
 * (u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)
 * (x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))
 * 
 * Examples:
 *  - https://github.com/StableLib/stablelib/blob/master/packages/ed25519/ed25519.ts#L861 (convertPublicKeyToX25519)
 *  - https://docs.rs/ed25519_to_curve25519/latest/src/ed25519_to_curve25519/lib.rs.html#1-108
 */
function ed25519_public_to_mont25519(publicKey) {
  const {gf, pack25519, unpack25519, A, Z, M} = nacl.lowlevel;
  var AY = gf();
  unpack25519(AY, publicKey);
  var one_minus_y = gf([1]);
  Z(one_minus_y, one_minus_y, AY);
  inv25519(one_minus_y, one_minus_y);
  var x = gf([1]);
  A(x, x, AY);
  M(x, x, one_minus_y);
  var o = new Uint8Array(32);
  pack25519(o, x);
  return o;
}

[kostko]

Thanks for your report and interest in confidential contracts! I see that you are using the sapphire-dev image which is currently using Sapphire 0.4.0 (the version also deployed on Mainnet). The CURVE25519_PUBLIC_KEY operation has only been added in 0.5.0-testnet (which is currently deployed on Sapphire Testnet).

Can you test the operation out on Sapphire Testnet (parameters, faucet) and report back?

[HarryR]

Ah.

Modifying the following parameters similar to https://github.com/oasisprotocol/oasis-web3-gateway/pull/375/files so I can run 0.5.0 locally has fixed the problem. Existing tests work and the CURVE25519_PUBLIC_KEY builtin works as expected.

ENV OASIS_CORE_VERSION=22.2.7
ENV PARATIME_VERSION=0.5.0-testnet

[kostko]

Thanks for confirming!