From cb1cc757ba5ff5eafe496062583d93e867e14e74 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 9 Jan 2018 13:57:01 +0000 Subject: [PATCH 01/56] performance_tests: don't override log level to 0 --- tests/performance_tests/main.cpp | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 1733e3409..5fe8263b2 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -63,7 +63,6 @@ int main(int argc, char** argv) set_thread_high_priority(); mlog_configure(mlog_get_default_log_path("performance_tests.log"), true); - mlog_set_log_level(0); po::options_description desc_options("Command line options"); const command_line::arg_descriptor arg_filter = { "filter", "Regular expression filter for which tests to run" }; From aacfd6e3702810c43365658da61bb1afc7470fd5 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 3 Jan 2018 21:37:18 +0000 Subject: [PATCH 02/56] bulletproofs: multi-output bulletproofs --- src/ringct/bulletproofs.cc | 348 +++++++++++++++++++++++++++--- src/ringct/bulletproofs.h | 2 + src/ringct/rctTypes.h | 2 + tests/unit_tests/bulletproofs.cpp | 19 ++ 4 files changed, 339 insertions(+), 32 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index fd15ffbc4..40d097f20 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -51,14 +51,16 @@ namespace rct { static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b); -static rct::keyV vector_powers(rct::key x, size_t n); +static rct::keyV vector_powers(const rct::key &x, size_t n); +static rct::keyV vector_dup(const rct::key &x, size_t n); static rct::key inner_product(const rct::keyV &a, const rct::keyV &b); static constexpr size_t maxN = 64; -static rct::key Hi[maxN], Gi[maxN]; -static ge_dsmp Gprecomp[64], Hprecomp[64]; +static constexpr size_t maxM = 16; +static rct::key Hi[maxN*maxM], Gi[maxN*maxM]; +static ge_dsmp Gprecomp[maxN*maxM], Hprecomp[maxN*maxM]; static const rct::key TWO = { {0x02, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; -static const rct::keyV oneN = vector_powers(rct::identity(), maxN); +static const rct::keyV oneN = vector_dup(rct::identity(), maxN); static const rct::keyV twoN = vector_powers(TWO, maxN); static const rct::key ip12 = inner_product(oneN, twoN); static boost::mutex init_mutex; @@ -77,7 +79,7 @@ static void init_exponents() static bool init_done = false; if (init_done) return; - for (size_t i = 0; i < maxN; ++i) + for (size_t i = 0; i < maxN*maxM; ++i) { Hi[i] = get_exponent(rct::H, i * 2); rct::precomp(Hprecomp[i], Hi[i]); @@ -91,7 +93,7 @@ static void init_exponents() static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b) { CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); - CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN, "Incompatible sizes of a and maxN"); + CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); rct::key res = rct::identity(); for (size_t i = 0; i < a.size(); ++i) { @@ -108,7 +110,7 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c CHECK_AND_ASSERT_THROW_MES(A.size() == B.size(), "Incompatible sizes of A and B"); CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() == A.size(), "Incompatible sizes of a and A"); - CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN, "Incompatible sizes of a and maxN"); + CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); rct::key res = rct::identity(); for (size_t i = 0; i < a.size(); ++i) { @@ -145,7 +147,7 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c } /* Given a scalar, construct a vector of powers */ -static rct::keyV vector_powers(rct::key x, size_t n) +static rct::keyV vector_powers(const rct::key &x, size_t n) { rct::keyV res(n); if (n == 0) @@ -232,6 +234,12 @@ static rct::keyV vector_scalar(const rct::keyV &a, const rct::key &x) return res; } +/* Create a vector from copies of a single value */ +static rct::keyV vector_dup(const rct::key &x, size_t N) +{ + return rct::keyV(N, x); +} + /* Exponentiate a curve vector by a scalar */ static rct::keyV vector_scalar2(const rct::keyV &a, const rct::key &x) { @@ -243,6 +251,17 @@ static rct::keyV vector_scalar2(const rct::keyV &a, const rct::key &x) return res; } +/* Get the sum of a vector's elements */ +static rct::key vector_sum(const rct::keyV &a) +{ + rct::key res = rct::zero(); + for (size_t i = 0; i < a.size(); ++i) + { + sc_add(res.bytes, res.bytes, a[i].bytes); + } + return res; +} + static rct::key switch_endianness(rct::key k) { std::reverse(k.bytes, k.bytes + sizeof(k)); @@ -405,7 +424,7 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) const auto yN = vector_powers(y, N); - rct::key ip1y = inner_product(oneN, yN); + rct::key ip1y = vector_sum(yN); rct::key tmp; sc_muladd(t0.bytes, z.bytes, ip1y.bytes, t0.bytes); @@ -437,7 +456,7 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) PERF_TIMER_START_BP(PROVE_step2); const auto HyNsR = hadamard(yN, sR); - const auto vpIz = vector_scalar(oneN, z); + const auto vpIz = vector_dup(z, N); const auto vp2zsq = vector_scalar(twoN, zsq); const auto aL_vpIz = vector_subtract(aL, vpIz); const auto aR_vpIz = vector_add(aR, vpIz); @@ -567,23 +586,284 @@ Bulletproof bulletproof_PROVE(uint64_t v, const rct::key &gamma) return bulletproof_PROVE(sv, gamma); } +/* Given a set of values v (0..2^N-1) and masks gamma, construct a range proof */ +Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) +{ + CHECK_AND_ASSERT_THROW_MES(sv.size() == gamma.size(), "Incompatible sizes of sv and gamma"); + CHECK_AND_ASSERT_THROW_MES(!sv.empty(), "sv is empty"); + + init_exponents(); + + PERF_TIMER_UNIT(PROVE, 1000000); + + constexpr size_t logN = 6; // log2(64) + constexpr size_t N = 1< 0; ) + { + if (j >= sv.size()) + { + aL[j*N+i] = rct::zero(); + } + else if (sv[j][i/8] & (((uint64_t)1)<<(i%8))) + { + aL[j*N+i] = rct::identity(); + } + else + { + aL[j*N+i] = rct::zero(); + } + sc_sub(aR[j*N+i].bytes, aL[j*N+i].bytes, rct::identity().bytes); + } + } + PERF_TIMER_STOP(PROVE_aLaR); + + rct::key hash_cache = rct::hash_to_scalar(V); + + // DEBUG: Test to ensure this recovers the value +#ifdef DEBUG_BP + for (size_t j = 0; j < M; ++j) + { + uint64_t test_aL = 0, test_aR = 0; + for (size_t i = 0; i < N; ++i) + { + if (aL[j*N+i] == rct::identity()) + test_aL += ((uint64_t)1)<= (j-1)*N && i < j*N) + { + CHECK_AND_ASSERT_THROW_MES(1+j < zpow.size(), "invalid zpow index"); + CHECK_AND_ASSERT_THROW_MES(i-(j-1)*N < twoN.size(), "invalid twoN index"); + sc_muladd(zero_twos[i].bytes, zpow[1+j].bytes, twoN[i-(j-1)*N].bytes, zero_twos[i].bytes); + } + } + } + + rct::keyV r0 = vector_add(aR, zMN); + const auto yMN = vector_powers(y, MN); + r0 = hadamard(r0, yMN); + r0 = vector_add(r0, zero_twos); + rct::keyV r1 = hadamard(yMN, sR); + + // Polynomial construction before PAPER LINE 46 + rct::key t1_1 = inner_product(l0, r1); + rct::key t1_2 = inner_product(l1, r0); + rct::key t1; + sc_add(t1.bytes, t1_1.bytes, t1_2.bytes); + rct::key t2 = inner_product(l1, r1); + + PERF_TIMER_STOP(PROVE_step1); + + PERF_TIMER_START_BP(PROVE_step2); + // PAPER LINES 47-48 + rct::key tau1 = rct::skGen(), tau2 = rct::skGen(); + + rct::key T1 = rct::addKeys(rct::scalarmultKey(rct::H, t1), rct::scalarmultBase(tau1)); + rct::key T2 = rct::addKeys(rct::scalarmultKey(rct::H, t2), rct::scalarmultBase(tau2)); + + // PAPER LINES 49-51 + rct::key x = hash_cache_mash(hash_cache, z, T1, T2); + + // PAPER LINES 52-53 + rct::key taux; + sc_mul(taux.bytes, tau1.bytes, x.bytes); + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + sc_muladd(taux.bytes, tau2.bytes, xsq.bytes, taux.bytes); + for (size_t j = 1; j <= sv.size(); ++j) + { + CHECK_AND_ASSERT_THROW_MES(j+1 < zpow.size(), "invalid zpow index"); + sc_muladd(taux.bytes, zpow[j+1].bytes, gamma[j-1].bytes, taux.bytes); + } + rct::key mu; + sc_muladd(mu.bytes, x.bytes, rho.bytes, alpha.bytes); + + // PAPER LINES 54-57 + rct::keyV l = l0; + l = vector_add(l, vector_scalar(l1, x)); + rct::keyV r = r0; + r = vector_add(r, vector_scalar(r1, x)); + PERF_TIMER_STOP(PROVE_step2); + + PERF_TIMER_START_BP(PROVE_step3); + rct::key t = inner_product(l, r); + + // DEBUG: Test if the l and r vectors match the polynomial forms +#ifdef DEBUG_BP + rct::key test_t; + const rct::key t0 = inner_product(l0, r0); + sc_muladd(test_t.bytes, t1.bytes, x.bytes, t0.bytes); + sc_muladd(test_t.bytes, t2.bytes, xsq.bytes, test_t.bytes); + CHECK_AND_ASSERT_THROW_MES(test_t == t, "test_t check failed"); +#endif + + // PAPER LINES 32-33 + rct::key x_ip = hash_cache_mash(hash_cache, x, taux, mu, t); + + // These are used in the inner product rounds + size_t nprime = MN; + rct::keyV Gprime(MN); + rct::keyV Hprime(MN); + rct::keyV aprime(MN); + rct::keyV bprime(MN); + const rct::key yinv = invert(y); + rct::key yinvpow = rct::identity(); + for (size_t i = 0; i < MN; ++i) + { + Gprime[i] = Gi[i]; + Hprime[i] = scalarmultKey(Hi[i], yinvpow); + sc_mul(yinvpow.bytes, yinvpow.bytes, yinv.bytes); + aprime[i] = l[i]; + bprime[i] = r[i]; + } + rct::keyV L(logMN); + rct::keyV R(logMN); + int round = 0; + rct::keyV w(logMN); // this is the challenge x in the inner product protocol + PERF_TIMER_STOP(PROVE_step3); + + PERF_TIMER_START_BP(PROVE_step4); + // PAPER LINE 13 + while (nprime > 1) + { + // PAPER LINE 15 + nprime /= 2; + + // PAPER LINES 16-17 + rct::key cL = inner_product(slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); + rct::key cR = inner_product(slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); + + // PAPER LINES 18-19 + L[round] = vector_exponent_custom(slice(Gprime, nprime, Gprime.size()), slice(Hprime, 0, nprime), slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); + sc_mul(tmp.bytes, cL.bytes, x_ip.bytes); + rct::addKeys(L[round], L[round], rct::scalarmultKey(rct::H, tmp)); + R[round] = vector_exponent_custom(slice(Gprime, 0, nprime), slice(Hprime, nprime, Hprime.size()), slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); + sc_mul(tmp.bytes, cR.bytes, x_ip.bytes); + rct::addKeys(R[round], R[round], rct::scalarmultKey(rct::H, tmp)); + + // PAPER LINES 21-22 + w[round] = hash_cache_mash(hash_cache, L[round], R[round]); + + // PAPER LINES 24-25 + const rct::key winv = invert(w[round]); + Gprime = hadamard2(vector_scalar2(slice(Gprime, 0, nprime), winv), vector_scalar2(slice(Gprime, nprime, Gprime.size()), w[round])); + Hprime = hadamard2(vector_scalar2(slice(Hprime, 0, nprime), w[round]), vector_scalar2(slice(Hprime, nprime, Hprime.size()), winv)); + + // PAPER LINES 28-29 + aprime = vector_add(vector_scalar(slice(aprime, 0, nprime), w[round]), vector_scalar(slice(aprime, nprime, aprime.size()), winv)); + bprime = vector_add(vector_scalar(slice(bprime, 0, nprime), winv), vector_scalar(slice(bprime, nprime, bprime.size()), w[round])); + + ++round; + } + PERF_TIMER_STOP(PROVE_step4); + + // PAPER LINE 58 (with inclusions from PAPER LINE 8 and PAPER LINE 20) + return Bulletproof(V, A, S, T1, T2, taux, mu, L, R, aprime[0], bprime[0], t); +} + +Bulletproof bulletproof_PROVE(const std::vector &v, const rct::keyV &gamma) +{ + CHECK_AND_ASSERT_THROW_MES(v.size() == gamma.size(), "Incompatible sizes of v and gamma"); + + // vG + gammaH + PERF_TIMER_START_BP(PROVE_v); + rct::keyV sv(v.size()); + for (size_t i = 0; i < v.size(); ++i) + { + sv[i] = rct::zero(); + sv[i].bytes[0] = v[i] & 255; + sv[i].bytes[1] = (v[i] >> 8) & 255; + sv[i].bytes[2] = (v[i] >> 16) & 255; + sv[i].bytes[3] = (v[i] >> 24) & 255; + sv[i].bytes[4] = (v[i] >> 32) & 255; + sv[i].bytes[5] = (v[i] >> 40) & 255; + sv[i].bytes[6] = (v[i] >> 48) & 255; + sv[i].bytes[7] = (v[i] >> 56) & 255; + } + PERF_TIMER_STOP(PROVE_v); + return bulletproof_PROVE(sv, gamma); +} + /* Given a range proof, determine if it is valid */ bool bulletproof_VERIFY(const Bulletproof &proof) { init_exponents(); - CHECK_AND_ASSERT_MES(proof.V.size() == 1, false, "V does not have exactly one element"); + CHECK_AND_ASSERT_MES(proof.V.size() >= 1, false, "V does not have at least one element"); CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), false, "Mismatched L and R sizes"); CHECK_AND_ASSERT_MES(proof.L.size() > 0, false, "Empty proof"); - CHECK_AND_ASSERT_MES(proof.L.size() == 6, false, "Proof is not for 64 bits"); - const size_t logN = proof.L.size(); + const size_t logN = 6; const size_t N = 1 << logN; + rct::key tmp, tmp2; + + size_t M, logM; + for (logM = 0; (M = 1< 0, false, "Zero rounds"); PERF_TIMER_START_BP(VERIFY_line_21_22); @@ -666,7 +948,7 @@ bool bulletproof_VERIFY(const Bulletproof &proof) winv[i] = invert(w[i]); PERF_TIMER_STOP(VERIFY_line_24_25_invert); - for (size_t i = 0; i < N; ++i) + for (size_t i = 0; i < MN; ++i) { // Convert the index to binary IN REVERSE and construct the scalar exponent rct::key g_scalar = proof.a; @@ -691,7 +973,9 @@ bool bulletproof_VERIFY(const Bulletproof &proof) // Adjust the scalars using the exponents from PAPER LINE 62 sc_add(g_scalar.bytes, g_scalar.bytes, z.bytes); - sc_mul(tmp.bytes, zsq.bytes, twoN[i].bytes); + CHECK_AND_ASSERT_MES(2+i/N < zpow.size(), false, "invalid zpow index"); + CHECK_AND_ASSERT_MES(i%N < twoN.size(), false, "invalid twoN index"); + sc_mul(tmp.bytes, zpow[2+i/N].bytes, twoN[i%N].bytes); sc_muladd(tmp.bytes, z.bytes, ypow.bytes, tmp.bytes); sc_mulsub(h_scalar.bytes, tmp.bytes, yinvpow.bytes, h_scalar.bytes); @@ -700,7 +984,7 @@ bool bulletproof_VERIFY(const Bulletproof &proof) rct::addKeys3(tmp, g_scalar, Gprecomp[i], h_scalar, Hprecomp[i]); rct::addKeys(inner_prod, inner_prod, tmp); - if (i != N-1) + if (i != MN-1) { sc_mul(yinvpow.bytes, yinvpow.bytes, yinv.bytes); sc_mul(ypow.bytes, ypow.bytes, y.bytes); diff --git a/src/ringct/bulletproofs.h b/src/ringct/bulletproofs.h index 3061d272e..3dfa38b12 100644 --- a/src/ringct/bulletproofs.h +++ b/src/ringct/bulletproofs.h @@ -40,6 +40,8 @@ namespace rct Bulletproof bulletproof_PROVE(const rct::key &v, const rct::key &gamma); Bulletproof bulletproof_PROVE(uint64_t v, const rct::key &gamma); +Bulletproof bulletproof_PROVE(const rct::keyV &v, const rct::keyV &gamma); +Bulletproof bulletproof_PROVE(const std::vector &v, const rct::keyV &gamma); bool bulletproof_VERIFY(const Bulletproof &proof); } diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index f6987d3f3..68f04b0f1 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -190,6 +190,8 @@ namespace rct { Bulletproof() {} Bulletproof(const rct::key &V, const rct::key &A, const rct::key &S, const rct::key &T1, const rct::key &T2, const rct::key &taux, const rct::key &mu, const rct::keyV &L, const rct::keyV &R, const rct::key &a, const rct::key &b, const rct::key &t): V({V}), A(A), S(S), T1(T1), T2(T2), taux(taux), mu(mu), L(L), R(R), a(a), b(b), t(t) {} + Bulletproof(const rct::keyV &V, const rct::key &A, const rct::key &S, const rct::key &T1, const rct::key &T2, const rct::key &taux, const rct::key &mu, const rct::keyV &L, const rct::keyV &R, const rct::key &a, const rct::key &b, const rct::key &t): + V(V), A(A), S(S), T1(T1), T2(T2), taux(taux), mu(mu), L(L), R(R), a(a), b(b), t(t) {} BEGIN_SERIALIZE_OBJECT() // Commitments aren't saved, they're restored via outPk diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index 00595a4c7..d3b804530 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -32,6 +32,7 @@ #include "ringct/rctOps.h" #include "ringct/bulletproofs.h" +#include "misc_log_ex.h" TEST(bulletproofs, valid_zero) { @@ -54,6 +55,24 @@ TEST(bulletproofs, valid_random) } } +TEST(bulletproofs, valid_multi_random) +{ + for (int n = 0; n < 8; ++n) + { + size_t outputs = 2 + n; + std::vector amounts; + rct::keyV gamma; + for (size_t i = 0; i < outputs; ++i) + { + amounts.push_back(crypto::rand()); + gamma.push_back(rct::skGen()); + } + rct::Bulletproof proof = bulletproof_PROVE(amounts, gamma); + ASSERT_TRUE(rct::bulletproof_VERIFY(proof)); + } +} + + TEST(bulletproofs, invalid_8) { rct::key invalid_amount = rct::zero(); From 1aa10c4364be4ba48df06f5ff582eef10b9288c3 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 5 Jan 2018 12:36:32 +0000 Subject: [PATCH 03/56] performance_tests: add (Borromean) range proofs --- tests/performance_tests/CMakeLists.txt | 1 + tests/performance_tests/main.cpp | 4 ++ tests/performance_tests/range_proof.h | 63 ++++++++++++++++++++++++++ 3 files changed, 68 insertions(+) create mode 100644 tests/performance_tests/range_proof.h diff --git a/tests/performance_tests/CMakeLists.txt b/tests/performance_tests/CMakeLists.txt index 8cbd71444..690489ab8 100644 --- a/tests/performance_tests/CMakeLists.txt +++ b/tests/performance_tests/CMakeLists.txt @@ -42,6 +42,7 @@ set(performance_tests_headers generate_keypair.h is_out_to_acc.h subaddress_expand.h + range_proof.h multi_tx_test_base.h performance_tests.h performance_utils.h diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 5fe8263b2..27fa56afb 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -52,6 +52,7 @@ #include "cn_fast_hash.h" #include "rct_mlsag.h" #include "equality.h" +#include "range_proof.h" namespace po = boost::program_options; @@ -156,6 +157,9 @@ int main(int argc, char** argv) TEST_PERFORMANCE2(filter, test_equality, verify32, false); TEST_PERFORMANCE2(filter, test_equality, verify32, false); + TEST_PERFORMANCE1(filter, test_range_proof, true); + TEST_PERFORMANCE1(filter, test_range_proof, false); + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; diff --git a/tests/performance_tests/range_proof.h b/tests/performance_tests/range_proof.h new file mode 100644 index 000000000..0ce962cd9 --- /dev/null +++ b/tests/performance_tests/range_proof.h @@ -0,0 +1,63 @@ +// Copyright (c) 2014-2017, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once + +#include "ringct/rctSigs.h" + +template +class test_range_proof +{ +public: + static const size_t loop_count = 50; + static const bool verify = a_verify; + + bool init() + { + rct::key mask; + sig = rct::proveRange(C, mask, 84932483243793); + return true; + } + + bool test() + { + bool ret = true; + rct::key mask; + if (verify) + ret = rct::verRange(C, sig); + else + rct::proveRange(C, mask, 84932483243793); + return ret; + } + +private: + rct::key C; + rct::rangeSig sig; +}; From 8f4ce989c2b586667d9fed4a342576472ace5ff4 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 31 Dec 2017 18:58:45 +0000 Subject: [PATCH 04/56] performance_tests: add RingCT MLSAG gen/ver tests --- tests/performance_tests/main.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 27fa56afb..1025d9a44 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -53,6 +53,7 @@ #include "rct_mlsag.h" #include "equality.h" #include "range_proof.h" +#include "rct_mlsag.h" namespace po = boost::program_options; @@ -160,6 +161,15 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, test_range_proof, true); TEST_PERFORMANCE1(filter, test_range_proof, false); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, false); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, false); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, false); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, false); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, true); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, true); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, true); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, true); + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; From f5d7b9933a68e70002ac74b65a9b6e3f4ccd2d24 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 5 Jan 2018 13:10:14 +0000 Subject: [PATCH 05/56] performance_tests: add bulletproofs --- tests/performance_tests/CMakeLists.txt | 1 + tests/performance_tests/bulletproof.h | 62 ++++++++++++++++++++++++++ tests/performance_tests/main.cpp | 10 +++++ 3 files changed, 73 insertions(+) create mode 100644 tests/performance_tests/bulletproof.h diff --git a/tests/performance_tests/CMakeLists.txt b/tests/performance_tests/CMakeLists.txt index 690489ab8..a41359ca7 100644 --- a/tests/performance_tests/CMakeLists.txt +++ b/tests/performance_tests/CMakeLists.txt @@ -43,6 +43,7 @@ set(performance_tests_headers is_out_to_acc.h subaddress_expand.h range_proof.h + bulletproof.h multi_tx_test_base.h performance_tests.h performance_utils.h diff --git a/tests/performance_tests/bulletproof.h b/tests/performance_tests/bulletproof.h new file mode 100644 index 000000000..b11c9fe97 --- /dev/null +++ b/tests/performance_tests/bulletproof.h @@ -0,0 +1,62 @@ +// Copyright (c) 2014-2017, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once + +#include "ringct/rctSigs.h" +#include "ringct/bulletproofs.h" + +template +class test_bulletproof +{ +public: + static const size_t approx_loop_count = 100 / n_amounts; + static const size_t loop_count = (approx_loop_count >= 10 ? approx_loop_count : 10) / (a_verify ? 1 : 5); + static const bool verify = a_verify; + + bool init() + { + proof = rct::bulletproof_PROVE(std::vector(n_amounts, 749327532984), rct::skvGen(n_amounts)); + return true; + } + + bool test() + { + bool ret = true; + if (verify) + ret = rct::bulletproof_VERIFY(proof); + else + rct::bulletproof_PROVE(std::vector(n_amounts, 749327532984), rct::skvGen(n_amounts)); + return ret; + } + +private: + rct::Bulletproof proof; +}; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 1025d9a44..7fd1873b5 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -54,6 +54,7 @@ #include "equality.h" #include "range_proof.h" #include "rct_mlsag.h" +#include "bulletproof.h" namespace po = boost::program_options; @@ -161,6 +162,15 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, test_range_proof, true); TEST_PERFORMANCE1(filter, test_range_proof, false); + TEST_PERFORMANCE2(filter, test_bulletproof, true, 1); + TEST_PERFORMANCE2(filter, test_bulletproof, false, 1); + + TEST_PERFORMANCE2(filter, test_bulletproof, true, 2); + TEST_PERFORMANCE2(filter, test_bulletproof, false, 2); + + TEST_PERFORMANCE2(filter, test_bulletproof, true, 15); + TEST_PERFORMANCE2(filter, test_bulletproof, false, 15); + TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, false); TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, false); TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, false); From 112f32f068e2e6d0b8e713ccf49090b73e542b5d Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 5 Jan 2018 16:30:24 +0000 Subject: [PATCH 06/56] performance_tests: add crypto ops --- tests/performance_tests/CMakeLists.txt | 1 + tests/performance_tests/crypto_ops.h | 116 +++++++++++++++++++++++++ tests/performance_tests/main.cpp | 16 ++++ 3 files changed, 133 insertions(+) create mode 100644 tests/performance_tests/crypto_ops.h diff --git a/tests/performance_tests/CMakeLists.txt b/tests/performance_tests/CMakeLists.txt index a41359ca7..47f441dda 100644 --- a/tests/performance_tests/CMakeLists.txt +++ b/tests/performance_tests/CMakeLists.txt @@ -44,6 +44,7 @@ set(performance_tests_headers subaddress_expand.h range_proof.h bulletproof.h + crypto_ops.h multi_tx_test_base.h performance_tests.h performance_utils.h diff --git a/tests/performance_tests/crypto_ops.h b/tests/performance_tests/crypto_ops.h new file mode 100644 index 000000000..852a6670d --- /dev/null +++ b/tests/performance_tests/crypto_ops.h @@ -0,0 +1,116 @@ +// Copyright (c) 2014-2017, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once + +#include "crypto/crypto.h" +#include "ringct/rctOps.h" + +enum test_op +{ + op_sc_add, + op_sc_sub, + op_sc_mul, + op_ge_add_raw, + op_ge_add_p3_p3, + ops_fast, + + op_addKeys, + op_scalarmultBase, + op_scalarmultKey, + op_ge_double_scalarmult_base_vartime, + op_ge_double_scalarmult_precomp_vartime, + op_ge_double_scalarmult_precomp_vartime2, + op_addKeys2, + op_addKeys3, + op_addKeys3_2, +}; + +template +class test_crypto_ops +{ +public: + static const size_t loop_count = op < ops_fast ? 10000000 : 1000; + + bool init() + { + scalar0 = rct::skGen(); + scalar1 = rct::skGen(); + point0 = rct::scalarmultBase(rct::skGen()); + point1 = rct::scalarmultBase(rct::skGen()); + if (ge_frombytes_vartime(&p3_0, point0.bytes) != 0) + return false; + if (ge_frombytes_vartime(&p3_1, point1.bytes) != 0) + return false; + ge_p3_to_cached(&cached, &p3_0); + rct::precomp(precomp0, point0); + rct::precomp(precomp1, point1); + return true; + } + + bool test() + { + rct::key key; + ge_cached tmp_cached; + ge_p1p1 tmp_p1p1; + ge_p2 tmp_p2; + switch (op) + { + case op_sc_add: sc_add(key.bytes, scalar0.bytes, scalar1.bytes); break; + case op_sc_sub: sc_sub(key.bytes, scalar0.bytes, scalar1.bytes); break; + case op_sc_mul: sc_mul(key.bytes, scalar0.bytes, scalar1.bytes); break; + case op_ge_add_p3_p3: { + ge_p3_to_cached(&tmp_cached, &p3_0); + ge_add(&tmp_p1p1, &p3_1, &tmp_cached); + ge_p1p1_to_p3(&p3_1, &tmp_p1p1); + break; + } + case op_ge_add_raw: ge_add(&tmp_p1p1, &p3_1, &cached); break; + case op_addKeys: rct::addKeys(key, point0, point1); break; + case op_scalarmultBase: rct::scalarmultBase(scalar0); break; + case op_scalarmultKey: rct::scalarmultKey(point0, scalar0); break; + case op_ge_double_scalarmult_base_vartime: ge_double_scalarmult_base_vartime(&tmp_p2, scalar0.bytes, &p3_0, scalar1.bytes); break; + case op_ge_double_scalarmult_precomp_vartime: ge_double_scalarmult_precomp_vartime(&tmp_p2, scalar0.bytes, &p3_0, scalar1.bytes, precomp0); break; + case op_ge_double_scalarmult_precomp_vartime2: ge_double_scalarmult_precomp_vartime2(&tmp_p2, scalar0.bytes, precomp0, scalar1.bytes, precomp1); break; + case op_addKeys2: rct::addKeys2(key, scalar0, scalar1, point0); break; + case op_addKeys3: rct::addKeys3(key, scalar0, point0, scalar1, precomp1); break; + case op_addKeys3_2: rct::addKeys3(key, scalar0, precomp0, scalar1, precomp1); break; + default: return false; + } + return true; + } + +private: + rct::key scalar0, scalar1; + rct::key point0, point1; + ge_p3 p3_0, p3_1; + ge_cached cached; + ge_dsmp precomp0, precomp1; +}; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 7fd1873b5..5b7a30f96 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -55,6 +55,7 @@ #include "range_proof.h" #include "rct_mlsag.h" #include "bulletproof.h" +#include "crypto_ops.h" namespace po = boost::program_options; @@ -180,6 +181,21 @@ int main(int argc, char** argv) TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, true); TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, true); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_add); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_sub); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_mul); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_add_raw); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_add_p3_p3); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_scalarmultBase); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_scalarmultKey); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_base_vartime); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys2); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3); + TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3_2); + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; From e9164bb38ba6105810597c8fa0d5a9bdfa295b07 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 5 Jan 2018 22:39:59 +0000 Subject: [PATCH 07/56] bulletproofs: misc optimizations Use double mults where possible, avoid conversions, simplify --- src/ringct/bulletproofs.cc | 110 +++++++++++++++++++++++++++++-------- 1 file changed, 87 insertions(+), 23 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 40d097f20..aa56b0589 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -65,6 +65,33 @@ static const rct::keyV twoN = vector_powers(TWO, maxN); static const rct::key ip12 = inner_product(oneN, twoN); static boost::mutex init_mutex; +//addKeys3acc_p3 +//aAbB += a*A + b*B where a, b are scalars, A, B are curve points +//A and B must be input after applying "precomp" +static void addKeys3acc_p3(ge_p3 *aAbB, const key &a, const ge_dsmp A, const key &b, const ge_dsmp B) +{ + ge_p3 rv; + ge_p1p1 p1; + ge_p2 p2; + ge_double_scalarmult_precomp_vartime2_p3(&rv, a.bytes, A, b.bytes, B); + ge_cached cached; + ge_p3_to_cached(&cached, aAbB); + ge_add(&p1, &rv, &cached); + ge_p1p1_to_p3(aAbB, &p1); +} + +static void addKeys_acc_p3(ge_p3 *acc_p3, const rct::key &a, const rct::key &point) +{ + ge_p3 p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&p3, point.bytes) == 0, "ge_frombytes_vartime failed"); + ge_scalarmult_p3(&p3, a.bytes, &p3); + ge_cached cached; + ge_p3_to_cached(&cached, acc_p3); + ge_p1p1 p1; + ge_add(&p1, &p3, &cached); + ge_p1p1_to_p3(acc_p3, &p1); +} + static rct::key get_exponent(const rct::key &base, size_t idx) { static const std::string salt("bulletproof"); @@ -94,13 +121,13 @@ static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b) { CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); - rct::key res = rct::identity(); + ge_p3 res_p3 = ge_p3_identity; for (size_t i = 0; i < a.size(); ++i) { - rct::key term; - rct::addKeys3(term, a[i], Gprecomp[i], b[i], Hprecomp[i]); - rct::addKeys(res, res, term); + rct::addKeys3acc_p3(&res_p3, a[i], Gprecomp[i], b[i], Hprecomp[i]); } + rct::key res; + ge_p3_tobytes(res.bytes, &res_p3); return res; } @@ -111,11 +138,11 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() == A.size(), "Incompatible sizes of a and A"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); - rct::key res = rct::identity(); + ge_p3 res_p3 = ge_p3_identity; for (size_t i = 0; i < a.size(); ++i) { - rct::key term; #if 0 + rct::key term; // we happen to know where A and B might fall, so don't bother checking the rest ge_dsmp *Acache = NULL, *Bcache = NULL; ge_dsmp Acache_custom[1], Bcache_custom[1]; @@ -136,13 +163,16 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c Bcache = Bcache_custom; } rct::addKeys3(term, a[i], *Acache, b[i], *Bcache); + rct::addKeys(res, res, term); #else ge_dsmp Acache, Bcache; rct::precomp(Bcache, B[i]); - rct::addKeys3(term, a[i], A[i], b[i], Bcache); + rct::precomp(Acache, A[i]); + addKeys3acc_p3(&res_p3, a[i], Acache, b[i], Bcache); #endif - rct::addKeys(res, res, term); } + rct::key res; + ge_p3_tobytes(res.bytes, &res_p3); return res; } @@ -163,6 +193,24 @@ static rct::keyV vector_powers(const rct::key &x, size_t n) return res; } +/* Given a scalar, return the sum of its powers from 0 to n-1 */ +static rct::key vector_power_sum(const rct::key &x, size_t n) +{ + if (n == 0) + return rct::zero(); + rct::key res = rct::identity(); + if (n == 1) + return res; + rct::key prev = x; + for (size_t i = 1; i < n; ++i) + { + if (i > 1) + sc_mul(prev.bytes, prev.bytes, x.bytes); + sc_add(res.bytes, res.bytes, prev.bytes); + } + return res; +} + /* Given two scalar arrays, construct the inner product */ static rct::key inner_product(const rct::keyV &a, const rct::keyV &b) { @@ -876,12 +924,13 @@ bool bulletproof_VERIFY(const Bulletproof &proof) PERF_TIMER_START_BP(VERIFY_line_61); // PAPER LINE 61 - rct::key L61Left = rct::addKeys(rct::scalarmultBase(proof.taux), rct::scalarmultKey(rct::H, proof.t)); + rct::key L61Left; + rct::addKeys2(L61Left, proof.taux, proof.t, rct::H); const rct::keyV zpow = vector_powers(z, M+3); rct::key k; - const rct::key ip1y = vector_sum(vector_powers(y, MN)); + const rct::key ip1y = vector_power_sum(y, MN); sc_mulsub(k.bytes, zpow[2].bytes, ip1y.bytes, rct::zero().bytes); for (size_t j = 1; j <= M; ++j) { @@ -893,20 +942,32 @@ bool bulletproof_VERIFY(const Bulletproof &proof) PERF_TIMER_START_BP(VERIFY_line_61rl); sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); rct::key L61Right = rct::scalarmultKey(rct::H, tmp); - for (size_t j = 0; j < M; ++j) + ge_p3 L61Right_p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); + for (size_t j = 0; j+1 < proof.V.size(); j += 2) + { + CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); + ge_dsmp precomp0, precomp1; + rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); + rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); + rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); + } + for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) { CHECK_AND_ASSERT_MES(j+2 < zpow.size(), false, "invalid zpow index"); - tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); - rct::addKeys(L61Right, L61Right, tmp); + // faster equivalent to: + // tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); + // rct::addKeys(L61Right, L61Right, tmp); + if (j < proof.V.size()) + addKeys_acc_p3(&L61Right_p3, zpow[j+2], proof.V[j]); } - tmp = rct::scalarmultKey(proof.T1, x); - rct::addKeys(L61Right, L61Right, tmp); + addKeys_acc_p3(&L61Right_p3, x, proof.T1); rct::key xsq; sc_mul(xsq.bytes, x.bytes, x.bytes); - tmp = rct::scalarmultKey(proof.T2, xsq); - rct::addKeys(L61Right, L61Right, tmp); + addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); + ge_p3_tobytes(L61Right.bytes, &L61Right_p3); PERF_TIMER_STOP(VERIFY_line_61rl); if (!(L61Right == L61Left)) @@ -937,7 +998,7 @@ bool bulletproof_VERIFY(const Bulletproof &proof) PERF_TIMER_START_BP(VERIFY_line_24_25); // Basically PAPER LINES 24-25 // Compute the curvepoints from G[i] and H[i] - rct::key inner_prod = rct::identity(); + ge_p3 inner_prod_p3 = ge_p3_identity; rct::key yinvpow = rct::identity(); rct::key ypow = rct::identity(); @@ -981,8 +1042,7 @@ bool bulletproof_VERIFY(const Bulletproof &proof) // Now compute the basepoint's scalar multiplication // Each of these could be written as a multiexp operation instead - rct::addKeys3(tmp, g_scalar, Gprecomp[i], h_scalar, Hprecomp[i]); - rct::addKeys(inner_prod, inner_prod, tmp); + addKeys3acc_p3(&inner_prod_p3, g_scalar, Gprecomp[i], h_scalar, Hprecomp[i]); if (i != MN-1) { @@ -990,6 +1050,8 @@ bool bulletproof_VERIFY(const Bulletproof &proof) sc_mul(ypow.bytes, ypow.bytes, y.bytes); } } + rct::key inner_prod; + ge_p3_tobytes(inner_prod.bytes, &inner_prod_p3); PERF_TIMER_STOP(VERIFY_line_24_25); PERF_TIMER_START_BP(VERIFY_line_26); @@ -997,6 +1059,8 @@ bool bulletproof_VERIFY(const Bulletproof &proof) rct::key pprime; sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); + ge_p3 pprime_p3; + CHECK_AND_ASSERT_MES(ge_frombytes_vartime(&pprime_p3, pprime.bytes) == 0, false, "ge_frombytes_vartime failed"); for (size_t i = 0; i < rounds; ++i) { @@ -1006,15 +1070,15 @@ bool bulletproof_VERIFY(const Bulletproof &proof) ge_dsmp cacheL, cacheR; rct::precomp(cacheL, proof.L[i]); rct::precomp(cacheR, proof.R[i]); - rct::addKeys3(tmp, tmp, cacheL, tmp2, cacheR); - rct::addKeys(pprime, pprime, tmp); + addKeys3acc_p3(&pprime_p3, tmp, cacheL, tmp2, cacheR); #else rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.L[i], tmp)); rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.R[i], tmp2)); #endif } sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); - rct::addKeys(pprime, pprime, rct::scalarmultKey(rct::H, tmp)); + addKeys_acc_p3(&pprime_p3, tmp, rct::H); + ge_p3_tobytes(pprime.bytes, &pprime_p3); PERF_TIMER_STOP(VERIFY_line_26); PERF_TIMER_START_BP(VERIFY_step2_check); From 9ff6e6a0a75d24fb3189e695def0b51b4fa67e92 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 9 Jan 2018 13:51:17 +0000 Subject: [PATCH 08/56] ringct: add bos coster multiexp --- src/ringct/CMakeLists.txt | 2 + src/ringct/bulletproofs.cc | 215 ++++++++++++++++++++++++--------- src/ringct/multiexp.cc | 239 +++++++++++++++++++++++++++++++++++++ src/ringct/multiexp.h | 60 ++++++++++ 4 files changed, 460 insertions(+), 56 deletions(-) create mode 100644 src/ringct/multiexp.cc create mode 100644 src/ringct/multiexp.h diff --git a/src/ringct/CMakeLists.txt b/src/ringct/CMakeLists.txt index c8dcdca26..29f166a3b 100644 --- a/src/ringct/CMakeLists.txt +++ b/src/ringct/CMakeLists.txt @@ -30,11 +30,13 @@ set(ringct_basic_sources rctOps.cpp rctTypes.cpp rctCryptoOps.c + multiexp.cc bulletproofs.cc) set(ringct_basic_private_headers rctOps.h rctTypes.h + multiexp.h bulletproofs.h) monero_private_headers(ringct_basic diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index aa56b0589..057f19029 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -38,6 +38,7 @@ extern "C" #include "crypto/crypto-ops.h" } #include "rctOps.h" +#include "multiexp.h" #include "bulletproofs.h" #undef MONERO_DEFAULT_LOG_CATEGORY @@ -58,6 +59,7 @@ static rct::key inner_product(const rct::keyV &a, const rct::keyV &b); static constexpr size_t maxN = 64; static constexpr size_t maxM = 16; static rct::key Hi[maxN*maxM], Gi[maxN*maxM]; +static ge_p3 Hi_p3[maxN*maxM], Gi_p3[maxN*maxM]; static ge_dsmp Gprecomp[maxN*maxM], Hprecomp[maxN*maxM]; static const rct::key TWO = { {0x02, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; static const rct::keyV oneN = vector_dup(rct::identity(), maxN); @@ -110,9 +112,12 @@ static void init_exponents() { Hi[i] = get_exponent(rct::H, i * 2); rct::precomp(Hprecomp[i], Hi[i]); + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&Hi_p3[i], Hi[i].bytes) == 0, "ge_frombytes_vartime failed"); Gi[i] = get_exponent(rct::H, i * 2 + 1); rct::precomp(Gprecomp[i], Gi[i]); + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&Gi_p3[i], Gi[i].bytes) == 0, "ge_frombytes_vartime failed"); } + MINFO("cache size: " << (sizeof(Hi)+sizeof(Hprecomp)+sizeof(Hi_p3))*2/1024 << " kB"); init_done = true; } @@ -121,6 +126,26 @@ static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b) { CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); +#if 1 + std::vector multiexp_data; + multiexp_data.reserve(a.size()*2); + for (size_t i = 0; i < a.size(); ++i) + { + if (!(a[i] == rct::zero())) + { + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = a[i]; + multiexp_data.back().point = Gi_p3[i]; + } + if (!(b[i] == rct::zero())) + { + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = b[i]; + multiexp_data.back().point = Hi_p3[i]; + } + } + return bos_coster_heap_conv_robust(multiexp_data); +#else ge_p3 res_p3 = ge_p3_identity; for (size_t i = 0; i < a.size(); ++i) { @@ -129,6 +154,7 @@ static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b) rct::key res; ge_p3_tobytes(res.bytes, &res_p3); return res; +#endif } /* Compute a custom vector-scalar commitment */ @@ -138,6 +164,26 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() == A.size(), "Incompatible sizes of a and A"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); +#if 1 + std::vector multiexp_data; + multiexp_data.reserve(a.size()*2); + for (size_t i = 0; i < a.size(); ++i) + { + if (!(a[i] == rct::zero())) + { + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = a[i]; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, A[i].bytes) == 0, "ge_frombytes_vartime failed"); + } + if (!(b[i] == rct::zero())) + { + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = b[i]; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, B[i].bytes) == 0, "ge_frombytes_vartime failed"); + } + } + return bos_coster_heap_conv_robust(multiexp_data); +#else ge_p3 res_p3 = ge_p3_identity; for (size_t i = 0; i < a.size(); ++i) { @@ -174,6 +220,7 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c rct::key res; ge_p3_tobytes(res.bytes, &res_p3); return res; +#endif } /* Given a scalar, construct a vector of powers */ @@ -924,7 +971,7 @@ bool bulletproof_VERIFY(const Bulletproof &proof) PERF_TIMER_START_BP(VERIFY_line_61); // PAPER LINE 61 - rct::key L61Left; + rct::key L61Left, L61Right; rct::addKeys2(L61Left, proof.taux, proof.t, rct::H); const rct::keyV zpow = vector_powers(z, M+3); @@ -939,37 +986,62 @@ bool bulletproof_VERIFY(const Bulletproof &proof) } PERF_TIMER_STOP(VERIFY_line_61); - PERF_TIMER_START_BP(VERIFY_line_61rl); - sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); - rct::key L61Right = rct::scalarmultKey(rct::H, tmp); - ge_p3 L61Right_p3; - CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); - for (size_t j = 0; j+1 < proof.V.size(); j += 2) + // multiexp is slower for small numbers of calcs + if (M >= 16) { - CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); - ge_dsmp precomp0, precomp1; - rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); - rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); - rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); + PERF_TIMER_START_BP(VERIFY_line_61rl_new); + sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); + std::vector multiexp_data; + multiexp_data.reserve(3+M); + multiexp_data.push_back({tmp, rct::H}); + for (size_t j = 0; j < M; j++) + { + if (!(zpow[j+2] == rct::zero())) + multiexp_data.push_back({zpow[j+2], j < proof.V.size() ? proof.V[j] : rct::identity()}); + } + if (!(x == rct::zero())) + multiexp_data.push_back({x, proof.T1}); + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + if (!(xsq == rct::zero())) + multiexp_data.push_back({xsq, proof.T2}); + L61Right = bos_coster_heap_conv_robust(multiexp_data); + PERF_TIMER_STOP(VERIFY_line_61rl_new); } - for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) + else { - CHECK_AND_ASSERT_MES(j+2 < zpow.size(), false, "invalid zpow index"); - // faster equivalent to: - // tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); - // rct::addKeys(L61Right, L61Right, tmp); - if (j < proof.V.size()) - addKeys_acc_p3(&L61Right_p3, zpow[j+2], proof.V[j]); + PERF_TIMER_START_BP(VERIFY_line_61rl_old); + sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); + L61Right = rct::scalarmultKey(rct::H, tmp); + ge_p3 L61Right_p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); + for (size_t j = 0; j+1 < proof.V.size(); j += 2) + { + CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); + ge_dsmp precomp0, precomp1; + rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); + rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); + rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); + } + for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) + { + CHECK_AND_ASSERT_MES(j+2 < zpow.size(), false, "invalid zpow index"); + // faster equivalent to: + // tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); + // rct::addKeys(L61Right, L61Right, tmp); + if (j < proof.V.size()) + addKeys_acc_p3(&L61Right_p3, zpow[j+2], proof.V[j]); + } + + addKeys_acc_p3(&L61Right_p3, x, proof.T1); + + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); + ge_p3_tobytes(L61Right.bytes, &L61Right_p3); + PERF_TIMER_STOP(VERIFY_line_61rl_old); } - addKeys_acc_p3(&L61Right_p3, x, proof.T1); - - rct::key xsq; - sc_mul(xsq.bytes, x.bytes, x.bytes); - addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); - ge_p3_tobytes(L61Right.bytes, &L61Right_p3); - PERF_TIMER_STOP(VERIFY_line_61rl); - if (!(L61Right == L61Left)) { MERROR("Verification failure at step 1"); @@ -998,7 +1070,6 @@ bool bulletproof_VERIFY(const Bulletproof &proof) PERF_TIMER_START_BP(VERIFY_line_24_25); // Basically PAPER LINES 24-25 // Compute the curvepoints from G[i] and H[i] - ge_p3 inner_prod_p3 = ge_p3_identity; rct::key yinvpow = rct::identity(); rct::key ypow = rct::identity(); @@ -1009,6 +1080,9 @@ bool bulletproof_VERIFY(const Bulletproof &proof) winv[i] = invert(w[i]); PERF_TIMER_STOP(VERIFY_line_24_25_invert); + std::vector multiexp_data; + multiexp_data.clear(); + multiexp_data.reserve(MN*2); for (size_t i = 0; i < MN; ++i) { // Convert the index to binary IN REVERSE and construct the scalar exponent @@ -1040,9 +1114,10 @@ bool bulletproof_VERIFY(const Bulletproof &proof) sc_muladd(tmp.bytes, z.bytes, ypow.bytes, tmp.bytes); sc_mulsub(h_scalar.bytes, tmp.bytes, yinvpow.bytes, h_scalar.bytes); - // Now compute the basepoint's scalar multiplication - // Each of these could be written as a multiexp operation instead - addKeys3acc_p3(&inner_prod_p3, g_scalar, Gprecomp[i], h_scalar, Hprecomp[i]); + if (!(g_scalar == rct::zero())) + multiexp_data.push_back({g_scalar, Gi_p3[i]}); + if (!(h_scalar == rct::zero())) + multiexp_data.push_back({h_scalar, Hi_p3[i]}); if (i != MN-1) { @@ -1050,36 +1125,64 @@ bool bulletproof_VERIFY(const Bulletproof &proof) sc_mul(ypow.bytes, ypow.bytes, y.bytes); } } - rct::key inner_prod; - ge_p3_tobytes(inner_prod.bytes, &inner_prod_p3); + + rct::key inner_prod = bos_coster_heap_conv_robust(multiexp_data); PERF_TIMER_STOP(VERIFY_line_24_25); - PERF_TIMER_START_BP(VERIFY_line_26); - // PAPER LINE 26 rct::key pprime; - sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); - rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); - ge_p3 pprime_p3; - CHECK_AND_ASSERT_MES(ge_frombytes_vartime(&pprime_p3, pprime.bytes) == 0, false, "ge_frombytes_vartime failed"); - - for (size_t i = 0; i < rounds; ++i) + // multiexp does not seem to give any speedup here + if(0) { - sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); - sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); -#if 1 - ge_dsmp cacheL, cacheR; - rct::precomp(cacheL, proof.L[i]); - rct::precomp(cacheR, proof.R[i]); - addKeys3acc_p3(&pprime_p3, tmp, cacheL, tmp2, cacheR); -#else - rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.L[i], tmp)); - rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.R[i], tmp2)); -#endif + PERF_TIMER_START_BP(VERIFY_line_26_new); + // PAPER LINE 26 + std::vector multiexp_data; + multiexp_data.reserve(1+2*rounds); + + sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); + rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); + for (size_t i = 0; i < rounds; ++i) + { + sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); + sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); + if (!(tmp == rct::zero())) + multiexp_data.push_back({tmp, proof.L[i]}); + if (!(tmp2 == rct::zero())) + multiexp_data.push_back({tmp2, proof.R[i]}); + } + sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); + if (!(tmp == rct::zero())) + multiexp_data.push_back({tmp, rct::H}); + addKeys(pprime, pprime, bos_coster_heap_conv_robust(multiexp_data)); + PERF_TIMER_STOP(VERIFY_line_26_new); + } + + { + PERF_TIMER_START_BP(VERIFY_line_26_old); + // PAPER LINE 26 + sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); + rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); + ge_p3 pprime_p3; + CHECK_AND_ASSERT_MES(ge_frombytes_vartime(&pprime_p3, pprime.bytes) == 0, false, "ge_frombytes_vartime failed"); + + for (size_t i = 0; i < rounds; ++i) + { + sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); + sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); +#if 1 + ge_dsmp cacheL, cacheR; + rct::precomp(cacheL, proof.L[i]); + rct::precomp(cacheR, proof.R[i]); + addKeys3acc_p3(&pprime_p3, tmp, cacheL, tmp2, cacheR); +#else + rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.L[i], tmp)); + rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.R[i], tmp2)); +#endif + } + sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); + addKeys_acc_p3(&pprime_p3, tmp, rct::H); + ge_p3_tobytes(pprime.bytes, &pprime_p3); + PERF_TIMER_STOP(VERIFY_line_26_old); } - sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); - addKeys_acc_p3(&pprime_p3, tmp, rct::H); - ge_p3_tobytes(pprime.bytes, &pprime_p3); - PERF_TIMER_STOP(VERIFY_line_26); PERF_TIMER_START_BP(VERIFY_step2_check); sc_mul(tmp.bytes, proof.a.bytes, proof.b.bytes); diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc new file mode 100644 index 000000000..2545325ae --- /dev/null +++ b/src/ringct/multiexp.cc @@ -0,0 +1,239 @@ +// Copyright (c) 2017, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Adapted from Python code by Sarang Noether + +#include "misc_log_ex.h" +#include "common/perf_timer.h" +extern "C" +{ +#include "crypto/crypto-ops.h" +} +#include "rctOps.h" +#include "multiexp.h" + +#undef MONERO_DEFAULT_LOG_CATEGORY +#define MONERO_DEFAULT_LOG_CATEGORY "multiexp.boscoster" + +//#define MULTIEXP_PERF(x) x +#define MULTIEXP_PERF(x) + +namespace rct +{ + +static inline bool operator<(const rct::key &k0, const rct::key&k1) +{ + for (int n = 31; n >= 0; --n) + { + if (k0.bytes[n] < k1.bytes[n]) + return true; + if (k0.bytes[n] > k1.bytes[n]) + return false; + } + return false; +} + +static inline rct::key div2(const rct::key &k) +{ + rct::key res; + int carry = 0; + for (int n = 31; n >= 0; --n) + { + int new_carry = (k.bytes[n] & 1) << 7; + res.bytes[n] = k.bytes[n] / 2 + carry; + carry = new_carry; + } + return res; +} + +rct::key bos_coster_heap_conv(std::vector &data) +{ + MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); + size_t points = data.size(); + CHECK_AND_ASSERT_THROW_MES(points > 1, "Not enough points"); + std::vector heap(points); + for (size_t n = 0; n < points; ++n) + heap[n] = n; + + auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; + std::make_heap(heap.begin(), heap.end(), Comp); + MULTIEXP_PERF(PERF_TIMER_STOP(setup)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(loop, 1000000)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(pop, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(pop)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(add, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(add)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(sub, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(sub)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(push, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(push)); + while (heap.size() > 1) + { + MULTIEXP_PERF(PERF_TIMER_RESUME(pop)); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index1 = heap.back(); + heap.pop_back(); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index2 = heap.back(); + heap.pop_back(); + MULTIEXP_PERF(PERF_TIMER_PAUSE(pop)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(add)); + ge_cached cached; + ge_p3_to_cached(&cached, &data[index1].point); + ge_p1p1 p1; + ge_add(&p1, &data[index2].point, &cached); + ge_p1p1_to_p3(&data[index2].point, &p1); + MULTIEXP_PERF(PERF_TIMER_PAUSE(add)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(sub)); + sc_sub(data[index1].scalar.bytes, data[index1].scalar.bytes, data[index2].scalar.bytes); + MULTIEXP_PERF(PERF_TIMER_PAUSE(sub)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(push)); + if (!(data[index1].scalar == rct::zero())) + { + heap.push_back(index1); + std::push_heap(heap.begin(), heap.end(), Comp); + } + + heap.push_back(index2); + std::push_heap(heap.begin(), heap.end(), Comp); + MULTIEXP_PERF(PERF_TIMER_PAUSE(push)); + } + MULTIEXP_PERF(PERF_TIMER_STOP(push)); + MULTIEXP_PERF(PERF_TIMER_STOP(sub)); + MULTIEXP_PERF(PERF_TIMER_STOP(add)); + MULTIEXP_PERF(PERF_TIMER_STOP(pop)); + MULTIEXP_PERF(PERF_TIMER_STOP(loop)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(end, 1000000)); + //return rct::scalarmultKey(data[index1].point, data[index1].scalar); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index1 = heap.back(); + heap.pop_back(); + ge_p2 p2; + ge_scalarmult(&p2, data[index1].scalar.bytes, &data[index1].point); + rct::key res; + ge_tobytes(res.bytes, &p2); + return res; +} + +rct::key bos_coster_heap_conv_robust(std::vector &data) +{ + MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); + size_t points = data.size(); + CHECK_AND_ASSERT_THROW_MES(points > 1, "Not enough points"); + std::vector heap(points); + for (size_t n = 0; n < points; ++n) + heap[n] = n; + + auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; + std::make_heap(heap.begin(), heap.end(), Comp); + MULTIEXP_PERF(PERF_TIMER_STOP(setup)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(loop, 1000000)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(pop, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(pop)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(div, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(div)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(add, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(add)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(sub, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(sub)); + MULTIEXP_PERF(PERF_TIMER_START_UNIT(push, 1000000)); MULTIEXP_PERF(PERF_TIMER_PAUSE(push)); + while (heap.size() > 1) + { + MULTIEXP_PERF(PERF_TIMER_RESUME(pop)); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index1 = heap.back(); + heap.pop_back(); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index2 = heap.back(); + heap.pop_back(); + MULTIEXP_PERF(PERF_TIMER_PAUSE(pop)); + + ge_cached cached; + ge_p1p1 p1; + + MULTIEXP_PERF(PERF_TIMER_RESUME(div)); + while (1) + { + rct::key s1_2 = div2(data[index1].scalar); + if (!(data[index2].scalar < s1_2)) + break; + if (data[index1].scalar.bytes[0] & 1) + { + data.resize(data.size()+1); + data.back().scalar = rct::identity(); + data.back().point = data[index1].point; + heap.push_back(data.size() - 1); + std::push_heap(heap.begin(), heap.end(), Comp); + } + data[index1].scalar = div2(data[index1].scalar); + ge_p3_to_cached(&cached, &data[index1].point); + ge_add(&p1, &data[index1].point, &cached); + ge_p1p1_to_p3(&data[index1].point, &p1); + } + MULTIEXP_PERF(PERF_TIMER_PAUSE(div)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(add)); + ge_p3_to_cached(&cached, &data[index1].point); + ge_add(&p1, &data[index2].point, &cached); + ge_p1p1_to_p3(&data[index2].point, &p1); + MULTIEXP_PERF(PERF_TIMER_PAUSE(add)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(sub)); + sc_sub(data[index1].scalar.bytes, data[index1].scalar.bytes, data[index2].scalar.bytes); + MULTIEXP_PERF(PERF_TIMER_PAUSE(sub)); + + MULTIEXP_PERF(PERF_TIMER_RESUME(push)); + if (!(data[index1].scalar == rct::zero())) + { + heap.push_back(index1); + std::push_heap(heap.begin(), heap.end(), Comp); + } + + heap.push_back(index2); + std::push_heap(heap.begin(), heap.end(), Comp); + MULTIEXP_PERF(PERF_TIMER_PAUSE(push)); + } + MULTIEXP_PERF(PERF_TIMER_STOP(push)); + MULTIEXP_PERF(PERF_TIMER_STOP(sub)); + MULTIEXP_PERF(PERF_TIMER_STOP(add)); + MULTIEXP_PERF(PERF_TIMER_STOP(pop)); + MULTIEXP_PERF(PERF_TIMER_STOP(loop)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(end, 1000000)); + //return rct::scalarmultKey(data[index1].point, data[index1].scalar); + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index1 = heap.back(); + heap.pop_back(); + ge_p2 p2; + ge_scalarmult(&p2, data[index1].scalar.bytes, &data[index1].point); + rct::key res; + ge_tobytes(res.bytes, &p2); + return res; +} + +} diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h new file mode 100644 index 000000000..108db7c39 --- /dev/null +++ b/src/ringct/multiexp.h @@ -0,0 +1,60 @@ +// Copyright (c) 2017, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Adapted from Python code by Sarang Noether + +#pragma once + +#ifndef MULTIEXP_H +#define MULTIEXP_H + +#include +#include "crypto/crypto.h" +#include "rctTypes.h" + +namespace rct +{ + +struct MultiexpData { + rct::key scalar; + ge_p3 point; + + MultiexpData() {} + MultiexpData(const rct::key &s, const ge_p3 &p): scalar(s), point(p) {} + MultiexpData(const rct::key &s, const rct::key &p): scalar(s) + { + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&point, p.bytes) == 0, "ge_frombytes_vartime failed"); + } +}; + +rct::key bos_coster_heap_conv(std::vector &data); +rct::key bos_coster_heap_conv_robust(std::vector &data); + +} + +#endif From 939bc2233281c47427c9987fc5310cfb77b085f9 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 14 Jan 2018 23:06:55 +0000 Subject: [PATCH 09/56] add Straus multiexp --- src/ringct/bulletproofs.cc | 192 +++++++------------------ src/ringct/multiexp.cc | 137 +++++++++++++++++- src/ringct/multiexp.h | 5 +- tests/performance_tests/CMakeLists.txt | 1 + tests/performance_tests/main.cpp | 15 ++ tests/performance_tests/multiexp.h | 81 +++++++++++ 6 files changed, 280 insertions(+), 151 deletions(-) create mode 100644 tests/performance_tests/multiexp.h diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 057f19029..1c29b1b99 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -67,6 +67,14 @@ static const rct::keyV twoN = vector_powers(TWO, maxN); static const rct::key ip12 = inner_product(oneN, twoN); static boost::mutex init_mutex; +static inline rct::key multiexp(const std::vector &data, bool HiGi) +{ + if (HiGi || data.size() < 1000) + return straus(data, HiGi); + else + return bos_coster_heap_conv_robust(data); +} + //addKeys3acc_p3 //aAbB += a*A + b*B where a, b are scalars, A, B are curve points //A and B must be input after applying "precomp" @@ -126,35 +134,15 @@ static rct::key vector_exponent(const rct::keyV &a, const rct::keyV &b) { CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); -#if 1 + std::vector multiexp_data; multiexp_data.reserve(a.size()*2); for (size_t i = 0; i < a.size(); ++i) { - if (!(a[i] == rct::zero())) - { - multiexp_data.resize(multiexp_data.size() + 1); - multiexp_data.back().scalar = a[i]; - multiexp_data.back().point = Gi_p3[i]; - } - if (!(b[i] == rct::zero())) - { - multiexp_data.resize(multiexp_data.size() + 1); - multiexp_data.back().scalar = b[i]; - multiexp_data.back().point = Hi_p3[i]; - } + multiexp_data.emplace_back(a[i], Gi_p3[i]); + multiexp_data.emplace_back(b[i], Hi_p3[i]); } - return bos_coster_heap_conv_robust(multiexp_data); -#else - ge_p3 res_p3 = ge_p3_identity; - for (size_t i = 0; i < a.size(); ++i) - { - rct::addKeys3acc_p3(&res_p3, a[i], Gprecomp[i], b[i], Hprecomp[i]); - } - rct::key res; - ge_p3_tobytes(res.bytes, &res_p3); - return res; -#endif + return multiexp(multiexp_data, true); } /* Compute a custom vector-scalar commitment */ @@ -164,63 +152,19 @@ static rct::key vector_exponent_custom(const rct::keyV &A, const rct::keyV &B, c CHECK_AND_ASSERT_THROW_MES(a.size() == b.size(), "Incompatible sizes of a and b"); CHECK_AND_ASSERT_THROW_MES(a.size() == A.size(), "Incompatible sizes of a and A"); CHECK_AND_ASSERT_THROW_MES(a.size() <= maxN*maxM, "Incompatible sizes of a and maxN"); -#if 1 + std::vector multiexp_data; multiexp_data.reserve(a.size()*2); for (size_t i = 0; i < a.size(); ++i) { - if (!(a[i] == rct::zero())) - { - multiexp_data.resize(multiexp_data.size() + 1); - multiexp_data.back().scalar = a[i]; - CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, A[i].bytes) == 0, "ge_frombytes_vartime failed"); - } - if (!(b[i] == rct::zero())) - { - multiexp_data.resize(multiexp_data.size() + 1); - multiexp_data.back().scalar = b[i]; - CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, B[i].bytes) == 0, "ge_frombytes_vartime failed"); - } + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = a[i]; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, A[i].bytes) == 0, "ge_frombytes_vartime failed"); + multiexp_data.resize(multiexp_data.size() + 1); + multiexp_data.back().scalar = b[i]; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&multiexp_data.back().point, B[i].bytes) == 0, "ge_frombytes_vartime failed"); } - return bos_coster_heap_conv_robust(multiexp_data); -#else - ge_p3 res_p3 = ge_p3_identity; - for (size_t i = 0; i < a.size(); ++i) - { -#if 0 - rct::key term; - // we happen to know where A and B might fall, so don't bother checking the rest - ge_dsmp *Acache = NULL, *Bcache = NULL; - ge_dsmp Acache_custom[1], Bcache_custom[1]; - if (Gi[i] == A[i]) - Acache = Gprecomp + i; - else if (i<32 && Gi[i+32] == A[i]) - Acache = Gprecomp + i + 32; - else - { - rct::precomp(Acache_custom[0], A[i]); - Acache = Acache_custom; - } - if (i == 0 && B[i] == Hi[0]) - Bcache = Hprecomp; - else - { - rct::precomp(Bcache_custom[0], B[i]); - Bcache = Bcache_custom; - } - rct::addKeys3(term, a[i], *Acache, b[i], *Bcache); - rct::addKeys(res, res, term); -#else - ge_dsmp Acache, Bcache; - rct::precomp(Bcache, B[i]); - rct::precomp(Acache, A[i]); - addKeys3acc_p3(&res_p3, a[i], Acache, b[i], Bcache); -#endif - } - rct::key res; - ge_p3_tobytes(res.bytes, &res_p3); - return res; -#endif + return multiexp(multiexp_data, false); } /* Given a scalar, construct a vector of powers */ @@ -986,26 +930,23 @@ bool bulletproof_VERIFY(const Bulletproof &proof) } PERF_TIMER_STOP(VERIFY_line_61); - // multiexp is slower for small numbers of calcs - if (M >= 16) + // bos coster is slower for small numbers of calcs, straus seems not + if (1) { PERF_TIMER_START_BP(VERIFY_line_61rl_new); sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); std::vector multiexp_data; - multiexp_data.reserve(3+M); - multiexp_data.push_back({tmp, rct::H}); - for (size_t j = 0; j < M; j++) + multiexp_data.reserve(3+proof.V.size()); + multiexp_data.emplace_back(tmp, rct::H); + for (size_t j = 0; j < proof.V.size(); j++) { - if (!(zpow[j+2] == rct::zero())) - multiexp_data.push_back({zpow[j+2], j < proof.V.size() ? proof.V[j] : rct::identity()}); + multiexp_data.emplace_back(zpow[j+2], proof.V[j]); } - if (!(x == rct::zero())) - multiexp_data.push_back({x, proof.T1}); + multiexp_data.emplace_back(x, proof.T1); rct::key xsq; sc_mul(xsq.bytes, x.bytes, x.bytes); - if (!(xsq == rct::zero())) - multiexp_data.push_back({xsq, proof.T2}); - L61Right = bos_coster_heap_conv_robust(multiexp_data); + multiexp_data.emplace_back(xsq, proof.T2); + L61Right = multiexp(multiexp_data, false); PERF_TIMER_STOP(VERIFY_line_61rl_new); } else @@ -1114,10 +1055,8 @@ bool bulletproof_VERIFY(const Bulletproof &proof) sc_muladd(tmp.bytes, z.bytes, ypow.bytes, tmp.bytes); sc_mulsub(h_scalar.bytes, tmp.bytes, yinvpow.bytes, h_scalar.bytes); - if (!(g_scalar == rct::zero())) - multiexp_data.push_back({g_scalar, Gi_p3[i]}); - if (!(h_scalar == rct::zero())) - multiexp_data.push_back({h_scalar, Hi_p3[i]}); + multiexp_data.emplace_back(g_scalar, Gi_p3[i]); + multiexp_data.emplace_back(h_scalar, Hi_p3[i]); if (i != MN-1) { @@ -1126,63 +1065,28 @@ bool bulletproof_VERIFY(const Bulletproof &proof) } } - rct::key inner_prod = bos_coster_heap_conv_robust(multiexp_data); + rct::key inner_prod = multiexp(multiexp_data, true); PERF_TIMER_STOP(VERIFY_line_24_25); + // PAPER LINE 26 rct::key pprime; - // multiexp does not seem to give any speedup here - if(0) + PERF_TIMER_START_BP(VERIFY_line_26_new); + multiexp_data.clear(); + multiexp_data.reserve(1+2*rounds); + + sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); + rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); + for (size_t i = 0; i < rounds; ++i) { - PERF_TIMER_START_BP(VERIFY_line_26_new); - // PAPER LINE 26 - std::vector multiexp_data; - multiexp_data.reserve(1+2*rounds); - - sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); - rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); - for (size_t i = 0; i < rounds; ++i) - { - sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); - sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); - if (!(tmp == rct::zero())) - multiexp_data.push_back({tmp, proof.L[i]}); - if (!(tmp2 == rct::zero())) - multiexp_data.push_back({tmp2, proof.R[i]}); - } - sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); - if (!(tmp == rct::zero())) - multiexp_data.push_back({tmp, rct::H}); - addKeys(pprime, pprime, bos_coster_heap_conv_robust(multiexp_data)); - PERF_TIMER_STOP(VERIFY_line_26_new); - } - - { - PERF_TIMER_START_BP(VERIFY_line_26_old); - // PAPER LINE 26 - sc_sub(tmp.bytes, rct::zero().bytes, proof.mu.bytes); - rct::addKeys(pprime, P, rct::scalarmultBase(tmp)); - ge_p3 pprime_p3; - CHECK_AND_ASSERT_MES(ge_frombytes_vartime(&pprime_p3, pprime.bytes) == 0, false, "ge_frombytes_vartime failed"); - - for (size_t i = 0; i < rounds; ++i) - { - sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); - sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); -#if 1 - ge_dsmp cacheL, cacheR; - rct::precomp(cacheL, proof.L[i]); - rct::precomp(cacheR, proof.R[i]); - addKeys3acc_p3(&pprime_p3, tmp, cacheL, tmp2, cacheR); -#else - rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.L[i], tmp)); - rct::addKeys(pprime, pprime, rct::scalarmultKey(proof.R[i], tmp2)); -#endif - } - sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); - addKeys_acc_p3(&pprime_p3, tmp, rct::H); - ge_p3_tobytes(pprime.bytes, &pprime_p3); - PERF_TIMER_STOP(VERIFY_line_26_old); + sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); + sc_mul(tmp2.bytes, winv[i].bytes, winv[i].bytes); + multiexp_data.emplace_back(tmp, proof.L[i]); + multiexp_data.emplace_back(tmp2, proof.R[i]); } + sc_mul(tmp.bytes, proof.t.bytes, x_ip.bytes); + multiexp_data.emplace_back(tmp, rct::H); + addKeys(pprime, pprime, multiexp(multiexp_data, false)); + PERF_TIMER_STOP(VERIFY_line_26_new); PERF_TIMER_START_BP(VERIFY_step2_check); sc_mul(tmp.bytes, proof.a.bytes, proof.b.bytes); diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 2545325ae..b70d92d46 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -38,7 +38,7 @@ extern "C" #include "multiexp.h" #undef MONERO_DEFAULT_LOG_CATEGORY -#define MONERO_DEFAULT_LOG_CATEGORY "multiexp.boscoster" +#define MONERO_DEFAULT_LOG_CATEGORY "multiexp" //#define MULTIEXP_PERF(x) x #define MULTIEXP_PERF(x) @@ -71,7 +71,15 @@ static inline rct::key div2(const rct::key &k) return res; } -rct::key bos_coster_heap_conv(std::vector &data) +static inline rct::key pow2(size_t n) +{ + CHECK_AND_ASSERT_THROW_MES(n < 256, "Invalid pow2 argument"); + rct::key res = rct::zero(); + res[n >> 3] |= 1<<(n&7); + return res; +} + +rct::key bos_coster_heap_conv(std::vector data) { MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); @@ -142,15 +150,20 @@ rct::key bos_coster_heap_conv(std::vector &data) return res; } -rct::key bos_coster_heap_conv_robust(std::vector &data) +rct::key bos_coster_heap_conv_robust(std::vector data) { MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); size_t points = data.size(); CHECK_AND_ASSERT_THROW_MES(points > 1, "Not enough points"); - std::vector heap(points); + std::vector heap; + heap.reserve(points); for (size_t n = 0; n < points; ++n) - heap[n] = n; + { + if (!(data[n].scalar == rct::zero()) && memcmp(&data[n].point, &ge_p3_identity, sizeof(ge_p3))) + heap.push_back(n); + } + points = heap.size(); auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; std::make_heap(heap.begin(), heap.end(), Comp); @@ -236,4 +249,118 @@ rct::key bos_coster_heap_conv_robust(std::vector &data) return res; } +rct::key straus(const std::vector &data, bool HiGi) +{ + MULTIEXP_PERF(PERF_TIMER_UNIT(straus, 1000000)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); + static constexpr unsigned int c = 4; + static constexpr unsigned int mask = (1<> HiGi_multiples; + std::vector> local_multiples, &multiples = HiGi ? HiGi_multiples : local_multiples; + ge_cached cached; + ge_p1p1 p1; + ge_p3 p3; + + std::vector skip(data.size()); + for (size_t i = 0; i < data.size(); ++i) + skip[i] = data[i].scalar == rct::zero() || !memcmp(&data[i].point, &ge_p3_identity, sizeof(ge_p3)); + + MULTIEXP_PERF(PERF_TIMER_START_UNIT(multiples, 1000000)); + multiples.resize(1<> digits; + digits.resize(data.size()); + for (size_t j = 0; j < data.size(); ++j) + { + digits[j].resize(256); + unsigned char bytes33[33]; + memcpy(bytes33, data[j].scalar.bytes, 32); + bytes33[32] = 0; +#if 1 + static_assert(c == 4, "optimized version needs c == 4"); + const unsigned char *bytes = bytes33; + unsigned int i; + for (i = 0; i < 256; i += 8, bytes++) + { + digits[j][i] = bytes[0] & 0xf; + digits[j][i+1] = (bytes[0] >> 1) & 0xf; + digits[j][i+2] = (bytes[0] >> 2) & 0xf; + digits[j][i+3] = (bytes[0] >> 3) & 0xf; + digits[j][i+4] = ((bytes[0] >> 4) | (bytes[1]<<4)) & 0xf; + digits[j][i+5] = ((bytes[0] >> 5) | (bytes[1]<<3)) & 0xf; + digits[j][i+6] = ((bytes[0] >> 6) | (bytes[1]<<2)) & 0xf; + digits[j][i+7] = ((bytes[0] >> 7) | (bytes[1]<<1)) & 0xf; + } +#elif 1 + for (size_t i = 0; i < 256; ++i) + digits[j][i] = ((bytes[i>>3] | (bytes[(i>>3)+1]<<8)) >> (i&7)) & mask; +#else + rct::key shifted = data[j].scalar; + for (size_t i = 0; i < 256; ++i) + { + digits[j][i] = shifted.bytes[0] & 0xf; + shifted = div2(shifted, (256-i)>>3); + } +#endif + } + MULTIEXP_PERF(PERF_TIMER_STOP(digits)); + + rct::key maxscalar = rct::zero(); + for (size_t i = 0; i < data.size(); ++i) + if (maxscalar < data[i].scalar) + maxscalar = data[i].scalar; + size_t i = 0; + while (i < 256 && !(maxscalar < pow2(i))) + i += c; + MULTIEXP_PERF(PERF_TIMER_STOP(setup)); + + ge_p3 res_p3 = ge_p3_identity; + if (!(i < c)) + goto skipfirst; + while (!(i < c)) + { + for (size_t j = 0; j < c; ++j) + { + ge_p3_to_cached(&cached, &res_p3); + ge_add(&p1, &res_p3, &cached); + ge_p1p1_to_p3(&res_p3, &p1); + } +skipfirst: + i -= c; + for (size_t j = 0; j < data.size(); ++j) + { + if (skip[j]) + continue; + int digit = digits[j][i]; + if (digit) + { + ge_add(&p1, &res_p3, &multiples[digit][j]); + ge_p1p1_to_p3(&res_p3, &p1); + } + } + } + + rct::key res; + ge_p3_tobytes(res.bytes, &res_p3); + return res; +} + } diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h index 108db7c39..cc53e633e 100644 --- a/src/ringct/multiexp.h +++ b/src/ringct/multiexp.h @@ -52,8 +52,9 @@ struct MultiexpData { } }; -rct::key bos_coster_heap_conv(std::vector &data); -rct::key bos_coster_heap_conv_robust(std::vector &data); +rct::key bos_coster_heap_conv(std::vector data); +rct::key bos_coster_heap_conv_robust(std::vector data); +rct::key straus(const std::vector &data, bool HiGi = false); } diff --git a/tests/performance_tests/CMakeLists.txt b/tests/performance_tests/CMakeLists.txt index 47f441dda..3ffd84aa6 100644 --- a/tests/performance_tests/CMakeLists.txt +++ b/tests/performance_tests/CMakeLists.txt @@ -45,6 +45,7 @@ set(performance_tests_headers range_proof.h bulletproof.h crypto_ops.h + multiexp.h multi_tx_test_base.h performance_tests.h performance_utils.h diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 5b7a30f96..739c6cc87 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -56,6 +56,7 @@ #include "rct_mlsag.h" #include "bulletproof.h" #include "crypto_ops.h" +#include "multiexp.h" namespace po = boost::program_options; @@ -196,6 +197,20 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3); TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3_2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 8); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 4096); + + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 8); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4096); + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; diff --git a/tests/performance_tests/multiexp.h b/tests/performance_tests/multiexp.h new file mode 100644 index 000000000..ac5f60fdf --- /dev/null +++ b/tests/performance_tests/multiexp.h @@ -0,0 +1,81 @@ +// Copyright (c) 2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once + +#include +#include "ringct/rctOps.h" +#include "ringct/multiexp.h" + +enum test_multiexp_algorithm +{ + multiexp_bos_coster, + multiexp_straus, +}; + +template +class test_multiexp +{ +public: + static const size_t loop_count = npoints >= 1024 ? 10 : npoints < 256 ? 1000 : 100; + + bool init() + { + data.resize(npoints); + res = rct::identity(); + for (size_t n = 0; n < npoints; ++n) + { + data[n].scalar = rct::skGen(); + rct::key point = rct::scalarmultBase(rct::skGen()); + if (ge_frombytes_vartime(&data[n].point, point.bytes)) + return false; + rct::key kn = rct::scalarmultKey(point, data[n].scalar); + res = rct::addKeys(res, kn); + } + return true; + } + + bool test() + { + switch (algorithm) + { + case multiexp_bos_coster: + return res == bos_coster_heap_conv_robust(data); + case multiexp_straus: + return res == straus(data, false); + default: + return false; + } + } + +private: + std::vector data; + rct::key res; +}; From 0793184bd008b51cc6865738a86bcd10792d42e0 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 14 Jan 2018 23:02:34 +0000 Subject: [PATCH 10/56] performance_tests: add a --verbose flag, and default to terse --- tests/performance_tests/main.cpp | 183 ++++++++++---------- tests/performance_tests/performance_tests.h | 35 ++-- 2 files changed, 116 insertions(+), 102 deletions(-) diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 739c6cc87..ba1640263 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -71,7 +71,9 @@ int main(int argc, char** argv) po::options_description desc_options("Command line options"); const command_line::arg_descriptor arg_filter = { "filter", "Regular expression filter for which tests to run" }; - command_line::add_arg(desc_options, arg_filter); + const command_line::arg_descriptor arg_verbose = { "verbose", "Verbose output", false }; + command_line::add_arg(desc_options, arg_filter, ""); + command_line::add_arg(desc_options, arg_verbose, ""); po::variables_map vm; bool r = command_line::handle_error_helper(desc_options, [&]() @@ -84,118 +86,119 @@ int main(int argc, char** argv) return 1; const std::string filter = tools::glob_to_regex(command_line::get_arg(vm, arg_filter)); + bool verbose = command_line::get_arg(vm, arg_verbose); performance_timer timer; timer.start(); - TEST_PERFORMANCE3(filter, test_construct_tx, 1, 1, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 1, 2, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 1, 10, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 1, 100, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 1, 1000, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 1, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 2, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 1000, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 1, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 2, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 10, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 1, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 2, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 100, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 1, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 2, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 10, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 1, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 2, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 100, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 1, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 2, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 10, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 1, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 2, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 100, false); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 1, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 2, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 2, 10, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 1, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 2, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 10, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 1, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 2, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 10, 10, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 1, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 2, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 10, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 1, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 2, true); - TEST_PERFORMANCE3(filter, test_construct_tx, 100, 10, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 1, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 2, true); + TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 10, true); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 1, false); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 2, false); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 10, false); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 100, false); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 1, false); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 2, false); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 10, false); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 100, false); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 2, true); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 10, true); - TEST_PERFORMANCE2(filter, test_check_tx_signature, 100, true); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 2, true); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 10, true); + TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 100, true); - TEST_PERFORMANCE0(filter, test_is_out_to_acc); - TEST_PERFORMANCE0(filter, test_is_out_to_acc_precomp); - TEST_PERFORMANCE0(filter, test_generate_key_image_helper); - TEST_PERFORMANCE0(filter, test_generate_key_derivation); - TEST_PERFORMANCE0(filter, test_generate_key_image); - TEST_PERFORMANCE0(filter, test_derive_public_key); - TEST_PERFORMANCE0(filter, test_derive_secret_key); - TEST_PERFORMANCE0(filter, test_ge_frombytes_vartime); - TEST_PERFORMANCE0(filter, test_generate_keypair); - TEST_PERFORMANCE0(filter, test_sc_reduce32); + TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc); + TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc_precomp); + TEST_PERFORMANCE0(filter, verbose, test_generate_key_image_helper); + TEST_PERFORMANCE0(filter, verbose, test_generate_key_derivation); + TEST_PERFORMANCE0(filter, verbose, test_generate_key_image); + TEST_PERFORMANCE0(filter, verbose, test_derive_public_key); + TEST_PERFORMANCE0(filter, verbose, test_derive_secret_key); + TEST_PERFORMANCE0(filter, verbose, test_ge_frombytes_vartime); + TEST_PERFORMANCE0(filter, verbose, test_generate_keypair); + TEST_PERFORMANCE0(filter, verbose, test_sc_reduce32); - TEST_PERFORMANCE2(filter, test_wallet2_expand_subaddresses, 50, 200); + TEST_PERFORMANCE2(filter, verbose, test_wallet2_expand_subaddresses, 50, 200); - TEST_PERFORMANCE0(filter, test_cn_slow_hash); - TEST_PERFORMANCE1(filter, test_cn_fast_hash, 32); - TEST_PERFORMANCE1(filter, test_cn_fast_hash, 16384); + TEST_PERFORMANCE0(filter, verbose, test_cn_slow_hash); + TEST_PERFORMANCE1(filter, verbose, test_cn_fast_hash, 32); + TEST_PERFORMANCE1(filter, verbose, test_cn_fast_hash, 16384); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, true); - TEST_PERFORMANCE2(filter, test_equality, memcmp32, true); - TEST_PERFORMANCE2(filter, test_equality, memcmp32, false); - TEST_PERFORMANCE2(filter, test_equality, verify32, false); - TEST_PERFORMANCE2(filter, test_equality, verify32, false); + TEST_PERFORMANCE2(filter, verbose, test_equality, memcmp32, true); + TEST_PERFORMANCE2(filter, verbose, test_equality, memcmp32, false); + TEST_PERFORMANCE2(filter, verbose, test_equality, verify32, false); + TEST_PERFORMANCE2(filter, verbose, test_equality, verify32, false); - TEST_PERFORMANCE1(filter, test_range_proof, true); - TEST_PERFORMANCE1(filter, test_range_proof, false); + TEST_PERFORMANCE1(filter, verbose, test_range_proof, true); + TEST_PERFORMANCE1(filter, verbose, test_range_proof, false); - TEST_PERFORMANCE2(filter, test_bulletproof, true, 1); - TEST_PERFORMANCE2(filter, test_bulletproof, false, 1); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 1); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 1); - TEST_PERFORMANCE2(filter, test_bulletproof, true, 2); - TEST_PERFORMANCE2(filter, test_bulletproof, false, 2); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 2); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 2); - TEST_PERFORMANCE2(filter, test_bulletproof, true, 15); - TEST_PERFORMANCE2(filter, test_bulletproof, false, 15); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 15); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 15); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, false); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 3, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 5, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 10, true); - TEST_PERFORMANCE3(filter, test_ringct_mlsag, 1, 100, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, false); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, true); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, true); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_add); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_sub); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_sc_mul); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_add_raw); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_add_p3_p3); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_scalarmultBase); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_scalarmultKey); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_base_vartime); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys2); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3); - TEST_PERFORMANCE1(filter, test_crypto_ops, op_addKeys3_2); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_add); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_sub); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_mul); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_add_raw); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_add_p3_p3); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_scalarmultBase); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_scalarmultKey); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_base_vartime); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys2); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys3); + TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys3_2); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 8); diff --git a/tests/performance_tests/performance_tests.h b/tests/performance_tests/performance_tests.h index 29d296571..6f613e0a5 100644 --- a/tests/performance_tests/performance_tests.h +++ b/tests/performance_tests/performance_tests.h @@ -67,8 +67,9 @@ template class test_runner { public: - test_runner() + test_runner(bool verbose = true) : m_elapsed(0) + , m_verbose(verbose) { } @@ -81,7 +82,8 @@ public: performance_timer timer; timer.start(); warm_up(); - std::cout << "Warm up: " << timer.elapsed_ms() << " ms" << std::endl; + if (m_verbose) + std::cout << "Warm up: " << timer.elapsed_ms() << " ms" << std::endl; timer.start(); for (size_t i = 0; i < T::loop_count; ++i) @@ -120,21 +122,29 @@ private: private: volatile uint64_t m_warm_up; /// -void run_test(const std::string &filter, const char* test_name) +void run_test(const std::string &filter, bool verbose, const char* test_name) { boost::smatch match; if (!filter.empty() && !boost::regex_match(std::string(test_name), match, boost::regex(filter))) return; - test_runner runner; + test_runner runner(verbose); if (runner.run()) { - std::cout << test_name << " - OK:\n"; - std::cout << " loop count: " << T::loop_count << '\n'; - std::cout << " elapsed: " << runner.elapsed_time() << " ms\n"; + if (verbose) + { + std::cout << test_name << " - OK:\n"; + std::cout << " loop count: " << T::loop_count << '\n'; + std::cout << " elapsed: " << runner.elapsed_time() << " ms\n"; + } + else + { + std::cout << test_name << " (" << T::loop_count << " calls) - OK:"; + } const char *unit = "ms"; int time_per_call = runner.time_per_call(); if (time_per_call < 30000) { @@ -145,7 +155,7 @@ void run_test(const std::string &filter, const char* test_name) unit = "µs"; #endif } - std::cout << " time per call: " << time_per_call << " " << unit << "/call\n" << std::endl; + std::cout << (verbose ? " time per call: " : " ") << time_per_call << " " << unit << "/call" << (verbose ? "\n" : "") << std::endl; } else { @@ -154,7 +164,8 @@ void run_test(const std::string &filter, const char* test_name) } #define QUOTEME(x) #x -#define TEST_PERFORMANCE0(filter, test_class) run_test< test_class >(filter, QUOTEME(test_class)) -#define TEST_PERFORMANCE1(filter, test_class, a0) run_test< test_class >(filter, QUOTEME(test_class)) -#define TEST_PERFORMANCE2(filter, test_class, a0, a1) run_test< test_class >(filter, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ">") -#define TEST_PERFORMANCE3(filter, test_class, a0, a1, a2) run_test< test_class >(filter, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ">") +#define TEST_PERFORMANCE0(filter, verbose, test_class) run_test< test_class >(filter, verbose, QUOTEME(test_class)) +#define TEST_PERFORMANCE1(filter, verbose, test_class, a0) run_test< test_class >(filter, verbose, QUOTEME(test_class)) +#define TEST_PERFORMANCE2(filter, verbose, test_class, a0, a1) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ">") +#define TEST_PERFORMANCE3(filter, verbose, test_class, a0, a1, a2) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ">") +#define TEST_PERFORMANCE4(filter, verbose, test_class, a0, a1, a2, a3) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ">") From f34e2e20bdfbefa171e3bbb46615b2b0513ca394 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 14 Jan 2018 23:05:48 +0000 Subject: [PATCH 11/56] performance_tests: add tx checking tests with more than 2 outputs --- tests/performance_tests/check_tx_signature.h | 12 +++++++---- tests/performance_tests/main.cpp | 21 +++++++++++++------- 2 files changed, 22 insertions(+), 11 deletions(-) diff --git a/tests/performance_tests/check_tx_signature.h b/tests/performance_tests/check_tx_signature.h index ec570e69d..93a8304be 100644 --- a/tests/performance_tests/check_tx_signature.h +++ b/tests/performance_tests/check_tx_signature.h @@ -40,15 +40,17 @@ #include "multi_tx_test_base.h" -template +template class test_check_tx_signature : private multi_tx_test_base { static_assert(0 < a_ring_size, "ring_size must be greater than 0"); public: - static const size_t loop_count = a_rct ? 10 : a_ring_size < 100 ? 100 : 10; + static const size_t loop_count = a_rct ? (a_ring_size <= 2 ? 50 : 10) : a_ring_size < 100 ? 100 : 10; static const size_t ring_size = a_ring_size; + static const size_t outputs = a_outputs; static const bool rct = a_rct; + static const bool bulletproof = a_bulletproof; typedef multi_tx_test_base base_class; @@ -62,13 +64,15 @@ public: m_alice.generate(); std::vector destinations; - destinations.push_back(tx_destination_entry(this->m_source_amount, m_alice.get_keys().m_account_address, false)); + destinations.push_back(tx_destination_entry(this->m_source_amount - outputs + 1, m_alice.get_keys().m_account_address, false)); + for (size_t n = 1; n < outputs; ++n) + destinations.push_back(tx_destination_entry(1, m_alice.get_keys().m_account_address, false)); crypto::secret_key tx_key; std::vector additional_tx_keys; std::unordered_map subaddresses; subaddresses[this->m_miners[this->real_source_idx].get_keys().m_account_address.m_spend_public_key] = {0,0}; - if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct)) + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, bulletproof)) return false; get_transaction_prefix_hash(m_tx, m_tx_prefix_hash); diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index ba1640263..c18a653c8 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -124,14 +124,21 @@ int main(int argc, char** argv) TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 2, true); TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 10, true); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 1, false); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 2, false); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 10, false); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 100, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 1, 2, false, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, false, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, false, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, false, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, false, false); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 2, true); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 10, true); - TEST_PERFORMANCE2(filter, verbose, test_check_tx_signature, 100, true); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, true, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, true, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, true, false); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, true, false); + + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, true, true); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, true, true); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, true, true); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, true, true); TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc); TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc_precomp); From 9ce9f8caf6e290088711ce4d5d90c1507a837bf2 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 17 Jan 2018 21:50:03 +0000 Subject: [PATCH 12/56] bulletproofs: add multi output bulletproofs to rct --- src/cryptonote_core/blockchain.cpp | 16 +++ src/cryptonote_core/cryptonote_tx_utils.cpp | 12 +- src/cryptonote_core/cryptonote_tx_utils.h | 4 +- src/ringct/rctSigs.cpp | 143 ++++++++++--------- src/ringct/rctSigs.h | 4 +- src/ringct/rctTypes.cpp | 32 +++++ src/ringct/rctTypes.h | 18 ++- src/wallet/wallet2.cpp | 42 ++++-- src/wallet/wallet2.h | 4 +- tests/core_tests/multisig.cpp | 2 +- tests/performance_tests/check_tx_signature.h | 2 +- tests/unit_tests/bulletproofs.cpp | 63 ++++++++ tests/unit_tests/json_serialization.cpp | 2 +- 13 files changed, 247 insertions(+), 97 deletions(-) diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index e96dc6bb6..c815b507e 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -3059,6 +3059,22 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, MERROR_VER("Unsupported rct type: " << rv.type); return false; } + + // for bulletproofs, check they're only multi-output after v8 + if (rv.type == rct::RCTTypeFullBulletproof || rv.type == rct::RCTTypeSimpleBulletproof) + { + if (hf_version < 8) + { + for (const rct::Bulletproof &proof: rv.p.bulletproofs) + { + if (proof.V.size() > 1) + { + MERROR_VER("Multi output bulletproofs are invalid before v8"); + return false; + } + } + } + } } return true; } diff --git a/src/cryptonote_core/cryptonote_tx_utils.cpp b/src/cryptonote_core/cryptonote_tx_utils.cpp index 1581f3088..32031e950 100644 --- a/src/cryptonote_core/cryptonote_tx_utils.cpp +++ b/src/cryptonote_core/cryptonote_tx_utils.cpp @@ -195,7 +195,7 @@ namespace cryptonote return addr.m_view_public_key; } //--------------------------------------------------------------- - bool construct_tx_with_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, const crypto::secret_key &tx_key, const std::vector &additional_tx_keys, bool rct, bool bulletproof, rct::multisig_out *msout, bool shuffle_outs) + bool construct_tx_with_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, const crypto::secret_key &tx_key, const std::vector &additional_tx_keys, bool rct, rct::RangeProofType range_proof_type, rct::multisig_out *msout, bool shuffle_outs) { hw::device &hwdev = sender_account_keys.get_device(); @@ -589,9 +589,9 @@ namespace cryptonote get_transaction_prefix_hash(tx, tx_prefix_hash); rct::ctkeyV outSk; if (use_simple_rct) - tx.rct_signatures = rct::genRctSimple(rct::hash2rct(tx_prefix_hash), inSk, destinations, inamounts, outamounts, amount_in - amount_out, mixRing, amount_keys, msout ? &kLRki : NULL, msout, index, outSk, bulletproof, hwdev); + tx.rct_signatures = rct::genRctSimple(rct::hash2rct(tx_prefix_hash), inSk, destinations, inamounts, outamounts, amount_in - amount_out, mixRing, amount_keys, msout ? &kLRki : NULL, msout, index, outSk, range_proof_type, hwdev); else - tx.rct_signatures = rct::genRct(rct::hash2rct(tx_prefix_hash), inSk, destinations, outamounts, mixRing, amount_keys, msout ? &kLRki[0] : NULL, msout, sources[0].real_output, outSk, bulletproof, hwdev); // same index assumption + tx.rct_signatures = rct::genRct(rct::hash2rct(tx_prefix_hash), inSk, destinations, outamounts, mixRing, amount_keys, msout ? &kLRki[0] : NULL, msout, sources[0].real_output, outSk, range_proof_type, hwdev); // same index assumption memwipe(inSk.data(), inSk.size() * sizeof(rct::ctkey)); CHECK_AND_ASSERT_MES(tx.vout.size() == outSk.size(), false, "outSk size does not match vout"); @@ -604,7 +604,7 @@ namespace cryptonote return true; } //--------------------------------------------------------------- - bool construct_tx_and_get_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, crypto::secret_key &tx_key, std::vector &additional_tx_keys, bool rct, bool bulletproof, rct::multisig_out *msout) + bool construct_tx_and_get_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, crypto::secret_key &tx_key, std::vector &additional_tx_keys, bool rct, rct::RangeProofType range_proof_type, rct::multisig_out *msout) { hw::device &hwdev = sender_account_keys.get_device(); hwdev.open_tx(tx_key); @@ -622,7 +622,7 @@ namespace cryptonote additional_tx_keys.push_back(keypair::generate(sender_account_keys.get_device()).sec); } - bool r = construct_tx_with_tx_key(sender_account_keys, subaddresses, sources, destinations, change_addr, extra, tx, unlock_time, tx_key, additional_tx_keys, rct, bulletproof, msout); + bool r = construct_tx_with_tx_key(sender_account_keys, subaddresses, sources, destinations, change_addr, extra, tx, unlock_time, tx_key, additional_tx_keys, rct, range_proof_type, msout); hwdev.close_tx(); return r; } @@ -634,7 +634,7 @@ namespace cryptonote crypto::secret_key tx_key; std::vector additional_tx_keys; std::vector destinations_copy = destinations; - return construct_tx_and_get_tx_key(sender_account_keys, subaddresses, sources, destinations_copy, change_addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, false, NULL); + return construct_tx_and_get_tx_key(sender_account_keys, subaddresses, sources, destinations_copy, change_addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, rct::RangeProofBorromean, NULL); } //--------------------------------------------------------------- bool generate_genesis_block( diff --git a/src/cryptonote_core/cryptonote_tx_utils.h b/src/cryptonote_core/cryptonote_tx_utils.h index a5d149fca..08e8725f7 100644 --- a/src/cryptonote_core/cryptonote_tx_utils.h +++ b/src/cryptonote_core/cryptonote_tx_utils.h @@ -90,8 +90,8 @@ namespace cryptonote //--------------------------------------------------------------- crypto::public_key get_destination_view_key_pub(const std::vector &destinations, const boost::optional& change_addr); bool construct_tx(const account_keys& sender_account_keys, std::vector &sources, const std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time); - bool construct_tx_with_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, const crypto::secret_key &tx_key, const std::vector &additional_tx_keys, bool rct = false, bool bulletproof = false, rct::multisig_out *msout = NULL, bool shuffle_outs = true); - bool construct_tx_and_get_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, crypto::secret_key &tx_key, std::vector &additional_tx_keys, bool rct = false, bool bulletproof = false, rct::multisig_out *msout = NULL); + bool construct_tx_with_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, const crypto::secret_key &tx_key, const std::vector &additional_tx_keys, bool rct = false, rct::RangeProofType range_proof_type = rct::RangeProofBorromean, rct::multisig_out *msout = NULL, bool shuffle_outs = true); + bool construct_tx_and_get_tx_key(const account_keys& sender_account_keys, const std::unordered_map& subaddresses, std::vector& sources, std::vector& destinations, const boost::optional& change_addr, std::vector extra, transaction& tx, uint64_t unlock_time, crypto::secret_key &tx_key, std::vector &additional_tx_keys, bool rct = false, rct::RangeProofType range_proof_type = rct::RangeProofBorromean, rct::multisig_out *msout = NULL); bool generate_genesis_block( block& bl diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index cc966c44b..6dcb203bf 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -45,30 +45,6 @@ using namespace std; #define CHECK_AND_ASSERT_MES_L1(expr, ret, message) {if(!(expr)) {MCERROR("verify", message); return ret;}} namespace rct { - bool is_simple(int type) - { - switch (type) - { - case RCTTypeSimple: - case RCTTypeSimpleBulletproof: - return true; - default: - return false; - } - } - - bool is_bulletproof(int type) - { - switch (type) - { - case RCTTypeSimpleBulletproof: - case RCTTypeFullBulletproof: - return true; - default: - return false; - } - } - Bulletproof proveRangeBulletproof(key &C, key &mask, uint64_t amount) { mask = rct::skGen(); @@ -78,6 +54,15 @@ namespace rct { return proof; } + Bulletproof proveRangeBulletproof(keyV &C, keyV &masks, const std::vector &amounts) + { + masks = rct::skvGen(amounts.size()); + Bulletproof proof = bulletproof_PROVE(amounts, masks); + CHECK_AND_ASSERT_THROW_MES(proof.V.size() == amounts.size(), "V does not have the expected size"); + C = proof.V; + return proof; + } + bool verBulletproof(const Bulletproof &proof) { try { return bulletproof_VERIFY(proof); } @@ -389,7 +374,7 @@ namespace rct { std::stringstream ss; binary_archive ba(ss); CHECK_AND_ASSERT_THROW_MES(!rv.mixRing.empty(), "Empty mixRing"); - const size_t inputs = is_simple(rv.type) ? rv.mixRing.size() : rv.mixRing[0].size(); + const size_t inputs = is_rct_simple(rv.type) ? rv.mixRing.size() : rv.mixRing[0].size(); const size_t outputs = rv.ecdhInfo.size(); key prehash; CHECK_AND_ASSERT_THROW_MES(const_cast(rv).serialize_rctsig_base(ba, inputs, outputs), @@ -659,7 +644,8 @@ namespace rct { // must know the destination private key to find the correct amount, else will return a random number // Note: For txn fees, the last index in the amounts vector should contain that // Thus the amounts vector will be "one" longer than the destinations vectort - rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, bool bulletproof, hw::device &hwdev) { + rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev) { + const bool bulletproof = range_proof_type != RangeProofBorromean; CHECK_AND_ASSERT_THROW_MES(amounts.size() == destinations.size() || amounts.size() == destinations.size() + 1, "Different number of amounts/destinations"); CHECK_AND_ASSERT_THROW_MES(amount_keys.size() == destinations.size(), "Different number of amount_keys/destinations"); CHECK_AND_ASSERT_THROW_MES(index < mixRing.size(), "Bad index into mixRing"); @@ -672,9 +658,7 @@ namespace rct { rv.type = bulletproof ? RCTTypeFullBulletproof : RCTTypeFull; rv.message = message; rv.outPk.resize(destinations.size()); - if (bulletproof) - rv.p.bulletproofs.resize(destinations.size()); - else + if (!bulletproof) rv.p.rangeSigs.resize(destinations.size()); rv.ecdhInfo.resize(destinations.size()); @@ -684,18 +668,46 @@ namespace rct { for (i = 0; i < destinations.size(); i++) { //add destination to sig rv.outPk[i].dest = copy(destinations[i]); - //compute range proof - if (bulletproof) - rv.p.bulletproofs[i] = proveRangeBulletproof(rv.outPk[i].mask, outSk[i].mask, amounts[i]); - else + //compute range proof (bulletproofs are done later) + if (!bulletproof) + { rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, amounts[i]); #ifdef DBG - if (bulletproof) - CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs[i]), "verBulletproof failed on newly created proof"); - else CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof"); #endif + } + } + rv.p.bulletproofs.clear(); + if (bulletproof) + { + std::vector proof_amounts; + size_t amounts_proved = 0; + while (amounts_proved < amounts.size()) + { + size_t batch_size = 1; + if (range_proof_type == RangeProofMultiOutputBulletproof) + while (batch_size * 2 + amounts_proved <= amounts.size()) + batch_size *= 2; + rct::keyV C, masks; + std::vector batch_amounts(batch_size); + for (i = 0; i < batch_size; ++i) + batch_amounts[i] = amounts[i + amounts_proved]; + rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, batch_amounts)); + #ifdef DBG + CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof"); + #endif + for (i = 0; i < batch_size; ++i) + { + rv.outPk[i + amounts_proved].mask = C[i]; + outSk[i + amounts_proved].mask = masks[i]; + } + amounts_proved += batch_size; + } + } + + for (i = 0; i < outSk.size(); ++i) + { //mask amount and mask rv.ecdhInfo[i].mask = copy(outSk[i].mask); rv.ecdhInfo[i].amount = d2h(amounts[i]); @@ -725,12 +737,13 @@ namespace rct { ctkeyM mixRing; ctkeyV outSk; tie(mixRing, index) = populateFromBlockchain(inPk, mixin); - return genRct(message, inSk, destinations, amounts, mixRing, amount_keys, kLRki, msout, index, outSk, false, hwdev); + return genRct(message, inSk, destinations, amounts, mixRing, amount_keys, kLRki, msout, index, outSk, RangeProofBorromean, hwdev); } //RCT simple //for post-rct only - rctSig genRctSimple(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector &inamounts, const vector &outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, bool bulletproof, hw::device &hwdev) { + rctSig genRctSimple(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector &inamounts, const vector &outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev) { + const bool bulletproof = range_proof_type != RangeProofBorromean; CHECK_AND_ASSERT_THROW_MES(inamounts.size() > 0, "Empty inamounts"); CHECK_AND_ASSERT_THROW_MES(inamounts.size() == inSk.size(), "Different number of inamounts/inSk"); CHECK_AND_ASSERT_THROW_MES(outamounts.size() == destinations.size(), "Different number of amounts/destinations"); @@ -822,7 +835,7 @@ namespace rct { mixRing[i].resize(mixin+1); index[i] = populateFromBlockchainSimple(mixRing[i], inPk[i], mixin); } - return genRctSimple(message, inSk, destinations, inamounts, outamounts, txnFee, mixRing, amount_keys, kLRki, msout, index, outSk, false, hwdev); + return genRctSimple(message, inSk, destinations, inamounts, outamounts, txnFee, mixRing, amount_keys, kLRki, msout, index, outSk, RangeProofBorromean, hwdev); } //RingCT protocol @@ -838,10 +851,11 @@ namespace rct { bool verRct(const rctSig & rv, bool semantics) { PERF_TIMER(verRct); CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeFullBulletproof, false, "verRct called on non-full rctSig"); + const bool bulletproof = is_rct_bulletproof(rv.type); if (semantics) { - if (rv.type == RCTTypeFullBulletproof) - CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.bulletproofs.size(), false, "Mismatched sizes of outPk and rv.p.bulletproofs"); + if (bulletproof) + CHECK_AND_ASSERT_MES(rv.outPk.size() == n_bulletproof_amounts(rv.p.bulletproofs), false, "Mismatched sizes of outPk and bulletproofs"); else CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.rangeSigs.size(), false, "Mismatched sizes of outPk and rv.p.rangeSigs"); CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.ecdhInfo.size(), false, "Mismatched sizes of outPk and rv.ecdhInfo"); @@ -858,21 +872,19 @@ namespace rct { if (semantics) { tools::threadpool& tpool = tools::threadpool::getInstance(); tools::threadpool::waiter waiter; - std::deque results(rv.outPk.size(), false); + std::deque results(bulletproof ? rv.p.bulletproofs.size() : rv.outPk.size(), false); DP("range proofs verified?"); - for (size_t i = 0; i < rv.outPk.size(); i++) { - tpool.submit(&waiter, [&, i] { - if (rv.p.rangeSigs.empty()) - results[i] = verBulletproof(rv.p.bulletproofs[i]); - else - results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); - }, true); - } + if (bulletproof) + for (size_t i = 0; i < rv.p.bulletproofs.size(); i++) + tpool.submit(&waiter, [&, i] { results[i] = verBulletproof(rv.p.bulletproofs[i]); }); + else + for (size_t i = 0; i < rv.outPk.size(); i++) + tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); waiter.wait(&tpool); - for (size_t i = 0; i < rv.outPk.size(); ++i) { + for (size_t i = 0; i < results.size(); ++i) { if (!results[i]) { - LOG_PRINT_L1("Range proof verified failed for output " << i); + LOG_PRINT_L1("Range proof verified failed for proof " << i); return false; } } @@ -912,11 +924,12 @@ namespace rct { PERF_TIMER(verRctSimple); CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctSimple called on non simple rctSig"); + const bool bulletproof = is_rct_bulletproof(rv.type); if (semantics) { - if (rv.type == RCTTypeSimpleBulletproof) + if (bulletproof) { - CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.bulletproofs.size(), false, "Mismatched sizes of outPk and rv.p.bulletproofs"); + CHECK_AND_ASSERT_MES(rv.outPk.size() == n_bulletproof_amounts(rv.p.bulletproofs), false, "Mismatched sizes of outPk and bulletproofs"); CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.p.MGs.size(), false, "Mismatched sizes of rv.p.pseudoOuts and rv.p.MGs"); CHECK_AND_ASSERT_MES(rv.pseudoOuts.empty(), false, "rv.pseudoOuts is not empty"); } @@ -931,7 +944,7 @@ namespace rct { else { // semantics check is early, and mixRing/MGs aren't resolved yet - if (rv.type == RCTTypeSimpleBulletproof) + if (bulletproof) CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.p.pseudoOuts and mixRing"); else CHECK_AND_ASSERT_MES(rv.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.pseudoOuts and mixRing"); @@ -943,7 +956,7 @@ namespace rct { tools::threadpool& tpool = tools::threadpool::getInstance(); tools::threadpool::waiter waiter; - const keyV &pseudoOuts = is_bulletproof(rv.type) ? rv.p.pseudoOuts : rv.pseudoOuts; + const keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts; if (semantics) { key sumOutpks = identity(); @@ -967,20 +980,18 @@ namespace rct { } results.clear(); - results.resize(rv.outPk.size()); - for (size_t i = 0; i < rv.outPk.size(); i++) { - tpool.submit(&waiter, [&, i] { - if (rv.p.rangeSigs.empty()) - results[i] = verBulletproof(rv.p.bulletproofs[i]); - else - results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); - }, true); - } + results.resize(bulletproof ? rv.p.bulletproofs.size() : rv.outPk.size()); + if (bulletproof) + for (size_t i = 0; i < rv.p.bulletproofs.size(); i++) + tpool.submit(&waiter, [&, i] { results[i] = verBulletproof(rv.p.bulletproofs[i]); }); + else + for (size_t i = 0; i < rv.p.rangeSigs.size(); i++) + tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); waiter.wait(&tpool); for (size_t i = 0; i < results.size(); ++i) { if (!results[i]) { - LOG_PRINT_L1("Range proof verified failed for output " << i); + LOG_PRINT_L1("Range proof verified failed for proof " << i); return false; } } diff --git a/src/ringct/rctSigs.h b/src/ringct/rctSigs.h index 5a9b2dd44..9a66310c7 100644 --- a/src/ringct/rctSigs.h +++ b/src/ringct/rctSigs.h @@ -119,10 +119,10 @@ namespace rct { //decodeRct: (c.f. https://eprint.iacr.org/2015/1098 section 5.1.1) // uses the attached ecdh info to find the amounts represented by each output commitment // must know the destination private key to find the correct amount, else will return a random number - rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const std::vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, bool bulletproof, hw::device &hwdev); + rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const std::vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev); rctSig genRct(const key &message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const std::vector & amounts, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, const int mixin, hw::device &hwdev); rctSig genRctSimple(const key & message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, xmr_amount txnFee, unsigned int mixin, hw::device &hwdev); - rctSig genRctSimple(const key & message, const ctkeyV & inSk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, bool bulletproof, hw::device &hwdev); + rctSig genRctSimple(const key & message, const ctkeyV & inSk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev); bool verRct(const rctSig & rv, bool semantics); static inline bool verRct(const rctSig & rv) { return verRct(rv, true) && verRct(rv, false); } bool verRctSimple(const rctSig & rv, bool semantics); diff --git a/src/ringct/rctTypes.cpp b/src/ringct/rctTypes.cpp index 5650b3ba1..72ef75780 100644 --- a/src/ringct/rctTypes.cpp +++ b/src/ringct/rctTypes.cpp @@ -209,4 +209,36 @@ namespace rct { return vali; } + bool is_rct_simple(int type) + { + switch (type) + { + case RCTTypeSimple: + case RCTTypeSimpleBulletproof: + return true; + default: + return false; + } + } + + bool is_rct_bulletproof(int type) + { + switch (type) + { + case RCTTypeSimpleBulletproof: + case RCTTypeFullBulletproof: + return true; + default: + return false; + } + } + + size_t n_bulletproof_amounts(const std::vector &proofs) + { + size_t n = 0; + for (const Bulletproof &proof: proofs) + n += proof.V.size(); + return n; + } + } diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index 68f04b0f1..5574c7784 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -213,6 +213,8 @@ namespace rct { END_SERIALIZE() }; + size_t n_bulletproof_amounts(const std::vector &proofs); + //A container to hold all signatures necessary for RingCT // rangeSigs holds all the rangeproof data of a transaction // MG holds the MLSAG signature of a transaction @@ -227,6 +229,7 @@ namespace rct { RCTTypeFullBulletproof = 3, RCTTypeSimpleBulletproof = 4, }; + enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof }; struct rctSigBase { uint8_t type; key message; @@ -310,15 +313,19 @@ namespace rct { { ar.tag("bp"); ar.begin_array(); - PREPARE_CUSTOM_VECTOR_SERIALIZATION(outputs, bulletproofs); - if (bulletproofs.size() != outputs) + uint32_t nbp = bulletproofs.size(); + FIELD(nbp) + PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs); + if (bulletproofs.size() > outputs) return false; - for (size_t i = 0; i < outputs; ++i) + for (size_t i = 0; i < nbp; ++i) { FIELDS(bulletproofs[i]) - if (outputs - i > 1) + if (nbp - i > 1) ar.delimit_array(); } + if (n_bulletproof_amounts(bulletproofs) != outputs) + return false; ar.end_array(); } else @@ -519,6 +526,9 @@ namespace rct { //int[64] to uint long long xmr_amount b2d(bits amountb); + bool is_rct_simple(int type); + bool is_rct_bulletproof(int type); + static inline const rct::key &pk2rct(const crypto::public_key &pk) { return (const rct::key&)pk; } static inline const rct::key &sk2rct(const crypto::secret_key &sk) { return (const rct::key&)sk; } static inline const rct::key &ki2rct(const crypto::key_image &ki) { return (const rct::key&)ki; } diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp index a2e36706e..fdba6d84a 100644 --- a/src/wallet/wallet2.cpp +++ b/src/wallet/wallet2.cpp @@ -5268,10 +5268,18 @@ bool wallet2::sign_tx(unsigned_tx_set &exported_txs, std::vector 1) + range_proof_type = rct::RangeProofMultiOutputBulletproof; + } crypto::secret_key tx_key; std::vector additional_tx_keys; rct::multisig_out msout; - bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sd.sources, sd.splitted_dsts, sd.change_dts.addr, sd.extra, ptx.tx, sd.unlock_time, tx_key, additional_tx_keys, sd.use_rct, sd.use_bulletproofs, m_multisig ? &msout : NULL); + bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sd.sources, sd.splitted_dsts, sd.change_dts.addr, sd.extra, ptx.tx, sd.unlock_time, tx_key, additional_tx_keys, sd.use_rct, range_proof_type, m_multisig ? &msout : NULL); THROW_WALLET_EXCEPTION_IF(!r, error::tx_not_constructed, sd.sources, sd.splitted_dsts, sd.unlock_time, m_nettype); // we don't test tx size, because we don't know the current limit, due to not having a blockchain, // and it's a bit pointless to fail there anyway, since it'd be a (good) guess only. We sign anyway, @@ -5684,7 +5692,15 @@ bool wallet2::sign_multisig_tx(multisig_tx_set &exported_txs, std::vector 1) + range_proof_type = rct::RangeProofMultiOutputBulletproof; + } + bool r = cryptonote::construct_tx_with_tx_key(m_account.get_keys(), m_subaddresses, sources, sd.splitted_dsts, ptx.change_dts.addr, sd.extra, tx, sd.unlock_time, ptx.tx_key, ptx.additional_tx_keys, sd.use_rct, range_proof_type, &msout, false); THROW_WALLET_EXCEPTION_IF(!r, error::tx_not_constructed, sd.sources, sd.splitted_dsts, sd.unlock_time, m_nettype); THROW_WALLET_EXCEPTION_IF(get_transaction_prefix_hash (tx) != get_transaction_prefix_hash(ptx.tx), @@ -7054,7 +7070,7 @@ void wallet2::transfer_selected(const std::vector additional_tx_keys; rct::multisig_out msout; LOG_PRINT_L2("constructing tx"); - bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sources, splitted_dsts, change_dts.addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, false, m_multisig ? &msout : NULL); + bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sources, splitted_dsts, change_dts.addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, rct::RangeProofBulletproof, m_multisig ? &msout : NULL); LOG_PRINT_L2("constructed tx, r="< dsts, const std::vector& selected_transfers, size_t fake_outputs_count, std::vector> &outs, - uint64_t unlock_time, uint64_t fee, const std::vector& extra, cryptonote::transaction& tx, pending_tx &ptx, bool bulletproof) + uint64_t unlock_time, uint64_t fee, const std::vector& extra, cryptonote::transaction& tx, pending_tx &ptx, rct::RangeProofType range_proof_type) { using namespace cryptonote; // throw if attempting a transaction with no destinations @@ -7259,7 +7275,7 @@ void wallet2::transfer_selected_rct(std::vector wallet2::create_transactions_2(std::vector test_ptx.fee) { if (use_rct) transfer_selected_rct(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, - test_tx, test_ptx, bulletproof); + test_tx, test_ptx, range_proof_type); else transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); @@ -8442,7 +8459,7 @@ skip_tx: extra, /* const std::vector& extra, */ test_tx, /* OUT cryptonote::transaction& tx, */ test_ptx, /* OUT cryptonote::transaction& tx, */ - bulletproof); + range_proof_type); } else { transfer_selected(tx.dsts, tx.selected_transfers, @@ -8581,6 +8598,7 @@ std::vector wallet2::create_transactions_from(const crypton const bool use_rct = fake_outs_count > 0 && use_fork_rules(4, 0); const bool bulletproof = use_fork_rules(get_bulletproof_fork(), 0); + const rct::RangeProofType range_proof_type = bulletproof ? rct::RangeProofBulletproof : rct::RangeProofBorromean; const uint64_t fee_per_kb = get_per_kb_fee(); const uint64_t fee_multiplier = get_fee_multiplier(priority, get_fee_algorithm()); @@ -8636,7 +8654,7 @@ std::vector wallet2::create_transactions_from(const crypton tx.selected_transfers.size() << " outputs"); if (use_rct) transfer_selected_rct(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, - test_tx, test_ptx, bulletproof); + test_tx, test_ptx, range_proof_type); else transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); @@ -8653,7 +8671,7 @@ std::vector wallet2::create_transactions_from(const crypton tx.dsts[0].amount = available_for_fee - needed_fee; if (use_rct) transfer_selected_rct(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, - test_tx, test_ptx, bulletproof); + test_tx, test_ptx, range_proof_type); else transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); @@ -8692,7 +8710,7 @@ std::vector wallet2::create_transactions_from(const crypton pending_tx test_ptx; if (use_rct) { transfer_selected_rct(tx.dsts, tx.selected_transfers, fake_outs_count, tx.outs, unlock_time, tx.needed_fee, extra, - test_tx, test_ptx, bulletproof); + test_tx, test_ptx, range_proof_type); } else { transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, tx.outs, unlock_time, tx.needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); diff --git a/src/wallet/wallet2.h b/src/wallet/wallet2.h index 556679f51..3ba51a27c 100644 --- a/src/wallet/wallet2.h +++ b/src/wallet/wallet2.h @@ -729,7 +729,7 @@ namespace tools uint64_t unlock_time, uint64_t fee, const std::vector& extra, T destination_split_strategy, const tx_dust_policy& dust_policy, cryptonote::transaction& tx, pending_tx &ptx); void transfer_selected_rct(std::vector dsts, const std::vector& selected_transfers, size_t fake_outputs_count, std::vector> &outs, - uint64_t unlock_time, uint64_t fee, const std::vector& extra, cryptonote::transaction& tx, pending_tx &ptx, bool bulletproof); + uint64_t unlock_time, uint64_t fee, const std::vector& extra, cryptonote::transaction& tx, pending_tx &ptx, rct::RangeProofType range_proof_type); void commit_tx(pending_tx& ptx_vector); void commit_tx(std::vector& ptx_vector); @@ -1968,7 +1968,7 @@ namespace tools crypto::secret_key tx_key; std::vector additional_tx_keys; rct::multisig_out msout; - bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sources, splitted_dsts, change_dts.addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, false, m_multisig ? &msout : NULL); + bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sources, splitted_dsts, change_dts.addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, rct::RangeProofBorromean, m_multisig ? &msout : NULL); THROW_WALLET_EXCEPTION_IF(!r, error::tx_not_constructed, sources, splitted_dsts, unlock_time, m_nettype); THROW_WALLET_EXCEPTION_IF(upper_transaction_size_limit <= get_object_blobsize(tx), error::tx_too_big, tx, upper_transaction_size_limit); diff --git a/tests/core_tests/multisig.cpp b/tests/core_tests/multisig.cpp index 936a4b742..46cc0ff35 100644 --- a/tests/core_tests/multisig.cpp +++ b/tests/core_tests/multisig.cpp @@ -285,7 +285,7 @@ bool gen_multisig_tx_validation_base::generate_with(std::vector additional_tx_secret_keys; auto sources_copy = sources; - r = construct_tx_and_get_tx_key(miner_account[creator].get_keys(), subaddresses, sources, destinations, boost::none, std::vector(), tx, 0, tx_key, additional_tx_secret_keys, true, false, msoutp); + r = construct_tx_and_get_tx_key(miner_account[creator].get_keys(), subaddresses, sources, destinations, boost::none, std::vector(), tx, 0, tx_key, additional_tx_secret_keys, true, rct::RangeProofBorromean, msoutp); CHECK_AND_ASSERT_MES(r, false, "failed to construct transaction"); #ifndef NO_MULTISIG diff --git a/tests/performance_tests/check_tx_signature.h b/tests/performance_tests/check_tx_signature.h index 93a8304be..693ea1866 100644 --- a/tests/performance_tests/check_tx_signature.h +++ b/tests/performance_tests/check_tx_signature.h @@ -72,7 +72,7 @@ public: std::vector additional_tx_keys; std::unordered_map subaddresses; subaddresses[this->m_miners[this->real_source_idx].get_keys().m_account_address.m_spend_public_key] = {0,0}; - if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, bulletproof)) + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, bulletproof ? rct::RangeProofMultiOutputBulletproof : rct::RangeProofBorromean)) return false; get_transaction_prefix_hash(m_tx, m_tx_prefix_hash); diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index d3b804530..183bb5167 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -31,7 +31,9 @@ #include "gtest/gtest.h" #include "ringct/rctOps.h" +#include "ringct/rctSigs.h" #include "ringct/bulletproofs.h" +#include "device/device.hpp" #include "misc_log_ex.h" TEST(bulletproofs, valid_zero) @@ -72,6 +74,67 @@ TEST(bulletproofs, valid_multi_random) } } +TEST(bulletproofs, multi_splitting) +{ + rct::ctkeyV sc, pc; + rct::ctkey sctmp, pctmp; + + std::tie(sctmp, pctmp) = rct::ctskpkGen(6000); + sc.push_back(sctmp); + pc.push_back(pctmp); + + std::tie(sctmp, pctmp) = rct::ctskpkGen(7000); + sc.push_back(sctmp); + pc.push_back(pctmp); + + const int mixin = 3, max_outputs = 16; + + for (int n_outputs = 1; n_outputs <= max_outputs; ++n_outputs) + { + std::vector amounts; + rct::keyV amount_keys; + rct::keyV destinations; + rct::key Sk, Pk; + uint64_t available = 6000 + 7000; + uint64_t amount; + rct::ctkeyM mixRing(mixin+1); + + //add output + for (size_t i = 0; i < n_outputs; ++i) + { + amount = rct::randXmrAmount(available); + amounts.push_back(amount); + amount_keys.push_back(rct::hash_to_scalar(rct::zero())); + rct::skpkGen(Sk, Pk); + destinations.push_back(Pk); + available -= amount; + } + if (!amounts.empty()) + amounts.back() += available; + + for (size_t j = 0; j <= mixin; ++j) + { + for (size_t i = 0; i < sc.size(); ++i) + { + if (j == 1) + mixRing[j].push_back(pc[i]); + else + mixRing[j].push_back({rct::scalarmultBase(rct::skGen()), rct::scalarmultBase(rct::skGen())}); + } + } + + rct::ctkeyV outSk; + rct::rctSig s = rct::genRct(rct::zero(), sc, destinations, amounts, mixRing, amount_keys, NULL, NULL, 1, outSk, rct::RangeProofMultiOutputBulletproof, hw::get_device("default")); + ASSERT_TRUE(rct::verRct(s)); + for (size_t i = 0; i < n_outputs; ++i) + { + rct::key mask; + rct::decodeRct(s, amount_keys[i], i, mask, hw::get_device("default")); + ASSERT_TRUE(mask == outSk[i].mask); + } + } +} + TEST(bulletproofs, invalid_8) { diff --git a/tests/unit_tests/json_serialization.cpp b/tests/unit_tests/json_serialization.cpp index ac6b60846..234cb2c33 100644 --- a/tests/unit_tests/json_serialization.cpp +++ b/tests/unit_tests/json_serialization.cpp @@ -75,7 +75,7 @@ namespace std::unordered_map subaddresses; subaddresses[from.m_account_address.m_spend_public_key] = {0,0}; - if (!cryptonote::construct_tx_and_get_tx_key(from, subaddresses, actual_sources, to, boost::none, {}, tx, 0, tx_key, extra_keys, rct, bulletproof)) + if (!cryptonote::construct_tx_and_get_tx_key(from, subaddresses, actual_sources, to, boost::none, {}, tx, 0, tx_key, extra_keys, rct, bulletproof ? rct::RangeProofBulletproof : rct::RangeProofBorromean)) throw std::runtime_error{"transaction construction error"}; return tx; From 7f48bf05d7229112fb16373fc58e540cdae3b0d0 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 18 Jan 2018 12:00:47 +0000 Subject: [PATCH 13/56] multiexp: bos coster now works for just one point --- src/ringct/multiexp.cc | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index b70d92d46..7ed9672f2 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -155,7 +155,7 @@ rct::key bos_coster_heap_conv_robust(std::vector data) MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); size_t points = data.size(); - CHECK_AND_ASSERT_THROW_MES(points > 1, "Not enough points"); + CHECK_AND_ASSERT_THROW_MES(points > 0, "Not enough points"); std::vector heap; heap.reserve(points); for (size_t n = 0; n < points; ++n) @@ -164,6 +164,16 @@ rct::key bos_coster_heap_conv_robust(std::vector data) heap.push_back(n); } points = heap.size(); + if (points == 0) + return rct::identity(); + if (points < 2) + { + ge_p2 p2; + ge_scalarmult(&p2, data[0].scalar.bytes, &data[0].point); + rct::key res; + ge_tobytes(res.bytes, &p2); + return res; + } auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; std::make_heap(heap.begin(), heap.end(), Comp); From e895c3def1aa6c037c3d9c2daca8dacbd62e74dd Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 18 Jan 2018 12:01:45 +0000 Subject: [PATCH 14/56] make straus cached mode thread safe, and add tests for it --- src/ringct/bulletproofs.cc | 11 ++- src/ringct/multiexp.cc | 86 +++++++++++------ src/ringct/multiexp.h | 7 +- tests/performance_tests/main.cpp | 7 ++ tests/performance_tests/multiexp.h | 7 +- tests/unit_tests/CMakeLists.txt | 1 + tests/unit_tests/multiexp.cpp | 149 +++++++++++++++++++++++++++++ 7 files changed, 233 insertions(+), 35 deletions(-) create mode 100644 tests/unit_tests/multiexp.cpp diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 1c29b1b99..6ba984b03 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -61,6 +61,7 @@ static constexpr size_t maxM = 16; static rct::key Hi[maxN*maxM], Gi[maxN*maxM]; static ge_p3 Hi_p3[maxN*maxM], Gi_p3[maxN*maxM]; static ge_dsmp Gprecomp[maxN*maxM], Hprecomp[maxN*maxM]; +static std::shared_ptr HiGi_cache; static const rct::key TWO = { {0x02, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; static const rct::keyV oneN = vector_dup(rct::identity(), maxN); static const rct::keyV twoN = vector_powers(TWO, maxN); @@ -70,7 +71,7 @@ static boost::mutex init_mutex; static inline rct::key multiexp(const std::vector &data, bool HiGi) { if (HiGi || data.size() < 1000) - return straus(data, HiGi); + return straus(data, HiGi ? HiGi_cache: NULL); else return bos_coster_heap_conv_robust(data); } @@ -116,6 +117,7 @@ static void init_exponents() static bool init_done = false; if (init_done) return; + std::vector data; for (size_t i = 0; i < maxN*maxM; ++i) { Hi[i] = get_exponent(rct::H, i * 2); @@ -124,8 +126,13 @@ static void init_exponents() Gi[i] = get_exponent(rct::H, i * 2 + 1); rct::precomp(Gprecomp[i], Gi[i]); CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&Gi_p3[i], Gi[i].bytes) == 0, "ge_frombytes_vartime failed"); + + data.push_back({rct::zero(), Gi[i]}); + data.push_back({rct::zero(), Hi[i]}); } - MINFO("cache size: " << (sizeof(Hi)+sizeof(Hprecomp)+sizeof(Hi_p3))*2/1024 << " kB"); + HiGi_cache = straus_init_cache(data); + size_t cache_size = (sizeof(Hi)+sizeof(Hprecomp)+sizeof(Hi_p3))*2 + straus_get_cache_size(HiGi_cache); + MINFO("cache size: " << cache_size/1024 << " kB"); init_done = true; } diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 7ed9672f2..4f16bd588 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -259,15 +259,58 @@ rct::key bos_coster_heap_conv_robust(std::vector data) return res; } -rct::key straus(const std::vector &data, bool HiGi) +struct straus_cached_data +{ + std::vector> multiples; +}; + +static constexpr unsigned int STRAUS_C = 4; + +std::shared_ptr straus_init_cache(const std::vector &data) +{ + MULTIEXP_PERF(PERF_TIMER_START_UNIT(multiples, 1000000)); + ge_cached cached; + ge_p1p1 p1; + ge_p3 p3; + std::shared_ptr cache(new straus_cached_data()); + + cache->multiples.resize(1<multiples[1].size(); + cache->multiples[1].resize(std::max(offset, data.size())); + for (size_t i = offset; i < data.size(); ++i) + ge_p3_to_cached(&cache->multiples[1][i], &data[i].point); + for (size_t i=2;i<1<multiples[i].resize(std::max(offset, data.size())); + for (size_t j=offset;jmultiples[i-1][j]); + ge_p1p1_to_p3(&p3, &p1); + ge_p3_to_cached(&cache->multiples[i][j], &p3); + } + } + MULTIEXP_PERF(PERF_TIMER_STOP(multiples)); + + return cache; +} + +size_t straus_get_cache_size(const std::shared_ptr &cache) +{ + size_t sz = 0; + for (const auto &e0: cache->multiples) + sz += e0.size() * sizeof(ge_p3); + return sz; +} + +rct::key straus(const std::vector &data, const std::shared_ptr &cache) { MULTIEXP_PERF(PERF_TIMER_UNIT(straus, 1000000)); + bool HiGi = cache != NULL; MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); - static constexpr unsigned int c = 4; - static constexpr unsigned int mask = (1<> HiGi_multiples; - std::vector> local_multiples, &multiples = HiGi ? HiGi_multiples : local_multiples; + static constexpr unsigned int mask = (1< local_cache = cache == NULL ? straus_init_cache(data) : cache; ge_cached cached; ge_p1p1 p1; ge_p3 p3; @@ -276,25 +319,6 @@ rct::key straus(const std::vector &data, bool HiGi) for (size_t i = 0; i < data.size(); ++i) skip[i] = data[i].scalar == rct::zero() || !memcmp(&data[i].point, &ge_p3_identity, sizeof(ge_p3)); - MULTIEXP_PERF(PERF_TIMER_START_UNIT(multiples, 1000000)); - multiples.resize(1<> digits; digits.resize(data.size()); @@ -305,7 +329,7 @@ rct::key straus(const std::vector &data, bool HiGi) memcpy(bytes33, data[j].scalar.bytes, 32); bytes33[32] = 0; #if 1 - static_assert(c == 4, "optimized version needs c == 4"); + static_assert(STRAUS_C == 4, "optimized version needs STRAUS_C == 4"); const unsigned char *bytes = bytes33; unsigned int i; for (i = 0; i < 256; i += 8, bytes++) @@ -339,22 +363,22 @@ rct::key straus(const std::vector &data, bool HiGi) maxscalar = data[i].scalar; size_t i = 0; while (i < 256 && !(maxscalar < pow2(i))) - i += c; + i += STRAUS_C; MULTIEXP_PERF(PERF_TIMER_STOP(setup)); ge_p3 res_p3 = ge_p3_identity; - if (!(i < c)) + if (!(i < STRAUS_C)) goto skipfirst; - while (!(i < c)) + while (!(i < STRAUS_C)) { - for (size_t j = 0; j < c; ++j) + for (size_t j = 0; j < STRAUS_C; ++j) { ge_p3_to_cached(&cached, &res_p3); ge_add(&p1, &res_p3, &cached); ge_p1p1_to_p3(&res_p3, &p1); } skipfirst: - i -= c; + i -= STRAUS_C; for (size_t j = 0; j < data.size(); ++j) { if (skip[j]) @@ -362,7 +386,7 @@ skipfirst: int digit = digits[j][i]; if (digit) { - ge_add(&p1, &res_p3, &multiples[digit][j]); + ge_add(&p1, &res_p3, &local_cache->multiples[digit][j]); ge_p1p1_to_p3(&res_p3, &p1); } } diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h index cc53e633e..44998e2e0 100644 --- a/src/ringct/multiexp.h +++ b/src/ringct/multiexp.h @@ -36,6 +36,7 @@ #include #include "crypto/crypto.h" #include "rctTypes.h" +#include "misc_log_ex.h" namespace rct { @@ -52,9 +53,13 @@ struct MultiexpData { } }; +struct straus_cached_data; + rct::key bos_coster_heap_conv(std::vector data); rct::key bos_coster_heap_conv_robust(std::vector data); -rct::key straus(const std::vector &data, bool HiGi = false); +std::shared_ptr straus_init_cache(const std::vector &data); +size_t straus_get_cache_size(const std::shared_ptr &cache); +rct::key straus(const std::vector &data, const std::shared_ptr &cache = NULL); } diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index c18a653c8..a00f05ce7 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -221,6 +221,13 @@ int main(int argc, char** argv) TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 1024); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4096); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 8); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 4096); + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; diff --git a/tests/performance_tests/multiexp.h b/tests/performance_tests/multiexp.h index ac5f60fdf..ab5af166b 100644 --- a/tests/performance_tests/multiexp.h +++ b/tests/performance_tests/multiexp.h @@ -38,6 +38,7 @@ enum test_multiexp_algorithm { multiexp_bos_coster, multiexp_straus, + multiexp_straus_cached, }; template @@ -59,6 +60,7 @@ public: rct::key kn = rct::scalarmultKey(point, data[n].scalar); res = rct::addKeys(res, kn); } + cache = rct::straus_init_cache(data); return true; } @@ -69,7 +71,9 @@ public: case multiexp_bos_coster: return res == bos_coster_heap_conv_robust(data); case multiexp_straus: - return res == straus(data, false); + return res == straus(data); + case multiexp_straus_cached: + return res == straus(data, cache); default: return false; } @@ -77,5 +81,6 @@ public: private: std::vector data; + std::shared_ptr cache; rct::key res; }; diff --git a/tests/unit_tests/CMakeLists.txt b/tests/unit_tests/CMakeLists.txt index 7366990ad..cdb741699 100644 --- a/tests/unit_tests/CMakeLists.txt +++ b/tests/unit_tests/CMakeLists.txt @@ -58,6 +58,7 @@ set(unit_tests_sources mlocker.cpp mnemonics.cpp mul_div.cpp + multiexp.cpp multisig.cpp parse_amount.cpp random.cpp diff --git a/tests/unit_tests/multiexp.cpp b/tests/unit_tests/multiexp.cpp new file mode 100644 index 000000000..2dce5bb80 --- /dev/null +++ b/tests/unit_tests/multiexp.cpp @@ -0,0 +1,149 @@ +// Copyright (c) 2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#include "gtest/gtest.h" + +#include "crypto/crypto.h" +#include "ringct/rctOps.h" +#include "ringct/multiexp.h" + +static const rct::key TESTSCALAR = rct::H; +static const rct::key TESTPOINT = rct::scalarmultBase(rct::H); + +static rct::key basic(const std::vector &data) +{ + ge_p3 res_p3 = ge_p3_identity; + for (const auto &d: data) + { + ge_cached cached; + ge_p3 p3; + ge_p1p1 p1; + ge_scalarmult_p3(&p3, d.scalar.bytes, &d.point); + ge_p3_to_cached(&cached, &p3); + ge_add(&p1, &res_p3, &cached); + ge_p1p1_to_p3(&res_p3, &p1); + } + rct::key res; + ge_p3_tobytes(res.bytes, &res_p3); + return res; +} + +static ge_p3 get_p3(const rct::key &point) +{ + ge_p3 p3; + EXPECT_TRUE(ge_frombytes_vartime(&p3, point.bytes) == 0); + return p3; +} + +TEST(multiexp, bos_coster_empty) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); +} + +TEST(multiexp, straus_empty) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == straus(data)); +} + +TEST(multiexp, bos_coster_only_zeroes) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); +} + +TEST(multiexp, straus_only_zeroes) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == straus(data)); +} + +TEST(multiexp, bos_coster_only_identities) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({TESTSCALAR, get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); +} + +TEST(multiexp, straus_only_identities) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({TESTSCALAR, get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == straus(data)); +} + +TEST(multiexp, bos_coster_random) +{ + std::vector data; + for (int n = 0; n < 32; ++n) + { + data.push_back({rct::skGen(), get_p3(rct::scalarmultBase(rct::skGen()))}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); + } +} + +TEST(multiexp, straus_random) +{ + std::vector data; + for (int n = 0; n < 32; ++n) + { + data.push_back({rct::skGen(), get_p3(rct::scalarmultBase(rct::skGen()))}); + ASSERT_TRUE(basic(data) == straus(data)); + } +} + +TEST(multiexp, straus_cached) +{ + static constexpr size_t N = 256; + std::vector P(N); + for (size_t n = 0; n < N; ++n) + { + P[n].scalar = rct::zero(); + ASSERT_TRUE(ge_frombytes_vartime(&P[n].point, rct::scalarmultBase(rct::skGen()).bytes) == 0); + } + std::shared_ptr cache = rct::straus_init_cache(P); + for (size_t n = 0; n < N/16; ++n) + { + std::vector data; + size_t sz = 1 + crypto::rand() % (N-1); + for (size_t s = 0; s < sz; ++s) + { + data.push_back({rct::skGen(), P[s].point}); + } + ASSERT_TRUE(basic(data) == straus(data, cache)); + } +} From bacf0a1e2ff54ef1fc77e3f6ec92e87946084c1a Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sat, 3 Feb 2018 14:36:29 +0000 Subject: [PATCH 15/56] bulletproofs: add aggregated verification Ported from sarang's java code --- src/cryptonote_core/blockchain.cpp | 2 +- src/cryptonote_core/cryptonote_core.cpp | 2 +- src/ringct/bulletproofs.cc | 428 +++++++++++--------- src/ringct/bulletproofs.h | 2 + src/ringct/rctSigs.cpp | 185 ++++++--- src/ringct/rctSigs.h | 6 +- tests/performance_tests/bulletproof.h | 38 ++ tests/performance_tests/main.cpp | 11 + tests/performance_tests/performance_tests.h | 2 + tests/unit_tests/bulletproofs.cpp | 19 + tests/unit_tests/ringct.cpp | 17 + 11 files changed, 453 insertions(+), 259 deletions(-) diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index c815b507e..0800409b5 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -2988,7 +2988,7 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, } } - if (!rct::verRctSimple(rv, false)) + if (!rct::verRctNonSemanticsSimple(rv)) { MERROR_VER("Failed to check ringct signatures!"); return false; diff --git a/src/cryptonote_core/cryptonote_core.cpp b/src/cryptonote_core/cryptonote_core.cpp index d0db38799..4928bb528 100644 --- a/src/cryptonote_core/cryptonote_core.cpp +++ b/src/cryptonote_core/cryptonote_core.cpp @@ -896,7 +896,7 @@ namespace cryptonote return false; case rct::RCTTypeSimple: case rct::RCTTypeSimpleBulletproof: - if (!rct::verRctSimple(rv, true)) + if (!rct::verRctSemanticsSimple(rv)) { MERROR_VER("rct signature semantics check failed"); return false; diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 6ba984b03..e2540fb22 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -889,219 +889,248 @@ Bulletproof bulletproof_PROVE(const std::vector &v, const rct::keyV &g } /* Given a range proof, determine if it is valid */ -bool bulletproof_VERIFY(const Bulletproof &proof) +bool bulletproof_VERIFY(const std::vector &proofs) { init_exponents(); - CHECK_AND_ASSERT_MES(proof.V.size() >= 1, false, "V does not have at least one element"); - CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), false, "Mismatched L and R sizes"); - CHECK_AND_ASSERT_MES(proof.L.size() > 0, false, "Empty proof"); + PERF_TIMER_START_BP(VERIFY); + + // sanity and figure out which proof is longest + size_t max_length = 0; + for (const Bulletproof *p: proofs) + { + const Bulletproof &proof = *p; + CHECK_AND_ASSERT_MES(proof.V.size() >= 1, false, "V does not have at least one element"); + CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), false, "Mismatched L and R sizes"); + CHECK_AND_ASSERT_MES(proof.L.size() > 0, false, "Empty proof"); + + max_length = std::max(max_length, proof.L.size()); + } + CHECK_AND_ASSERT_MES(max_length < 32, false, "At least one proof is too large"); + size_t maxMN = 1u << max_length; const size_t logN = 6; const size_t N = 1 << logN; - rct::key tmp, tmp2; + rct::key tmp; - size_t M, logM; - for (logM = 0; (M = 1< multiexp_data; - multiexp_data.reserve(3+proof.V.size()); - multiexp_data.emplace_back(tmp, rct::H); - for (size_t j = 0; j < proof.V.size(); j++) - { - multiexp_data.emplace_back(zpow[j+2], proof.V[j]); - } - multiexp_data.emplace_back(x, proof.T1); - rct::key xsq; - sc_mul(xsq.bytes, x.bytes, x.bytes); - multiexp_data.emplace_back(xsq, proof.T2); - L61Right = multiexp(multiexp_data, false); - PERF_TIMER_STOP(VERIFY_line_61rl_new); - } - else - { - PERF_TIMER_START_BP(VERIFY_line_61rl_old); - sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); - L61Right = rct::scalarmultKey(rct::H, tmp); - ge_p3 L61Right_p3; - CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); - for (size_t j = 0; j+1 < proof.V.size(); j += 2) - { - CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); - ge_dsmp precomp0, precomp1; - rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); - rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); - rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); - } - for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) + size_t M, logM; + for (logM = 0; (M = 1< multiexp_data; + multiexp_data.reserve(3+proof.V.size()); + multiexp_data.emplace_back(tmp, rct::H); + for (size_t j = 0; j < proof.V.size(); j++) + { + multiexp_data.emplace_back(zpow[j+2], proof.V[j]); + } + multiexp_data.emplace_back(x, proof.T1); + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + multiexp_data.emplace_back(xsq, proof.T2); + L61Right = multiexp(multiexp_data, false); + PERF_TIMER_STOP(VERIFY_line_61rl_new); + } + else + { + PERF_TIMER_START_BP(VERIFY_line_61rl_old); + sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); + L61Right = rct::scalarmultKey(rct::H, tmp); + ge_p3 L61Right_p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); + for (size_t j = 0; j+1 < proof.V.size(); j += 2) + { + CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); + ge_dsmp precomp0, precomp1; + rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); + rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); + rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); + } + for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) + { + CHECK_AND_ASSERT_MES(j+2 < zpow.size(), false, "invalid zpow index"); + // faster equivalent to: + // tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); + // rct::addKeys(L61Right, L61Right, tmp); + if (j < proof.V.size()) + addKeys_acc_p3(&L61Right_p3, zpow[j+2], proof.V[j]); + } + + addKeys_acc_p3(&L61Right_p3, x, proof.T1); + + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); + ge_p3_tobytes(L61Right.bytes, &L61Right_p3); + PERF_TIMER_STOP(VERIFY_line_61rl_old); } - addKeys_acc_p3(&L61Right_p3, x, proof.T1); + if (!(L61Right == L61Left)) + { + MERROR("Verification failure at step 1"); + return false; + } - rct::key xsq; - sc_mul(xsq.bytes, x.bytes, x.bytes); - addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); - ge_p3_tobytes(L61Right.bytes, &L61Right_p3); - PERF_TIMER_STOP(VERIFY_line_61rl_old); + PERF_TIMER_START_BP(VERIFY_line_62); + // PAPER LINE 62 + rct::addKeys(Z0, Z0, rct::scalarmultKey(rct::addKeys(proof.A, rct::scalarmultKey(proof.S, x)), weight)); + PERF_TIMER_STOP(VERIFY_line_62); + + // Compute the number of rounds for the inner product + const size_t rounds = logM+logN; + CHECK_AND_ASSERT_MES(rounds > 0, false, "Zero rounds"); + + PERF_TIMER_START_BP(VERIFY_line_21_22); + // PAPER LINES 21-22 + // The inner product challenges are computed per round + rct::keyV w(rounds); + for (size_t i = 0; i < rounds; ++i) + { + w[i] = hash_cache_mash(hash_cache, proof.L[i], proof.R[i]); + } + PERF_TIMER_STOP(VERIFY_line_21_22); + + PERF_TIMER_START_BP(VERIFY_line_24_25); + // Basically PAPER LINES 24-25 + // Compute the curvepoints from G[i] and H[i] + rct::key yinvpow = rct::identity(); + rct::key ypow = rct::identity(); + + PERF_TIMER_START_BP(VERIFY_line_24_25_invert); + const rct::key yinv = invert(y); + rct::keyV winv(rounds); + for (size_t i = 0; i < rounds; ++i) + winv[i] = invert(w[i]); + PERF_TIMER_STOP(VERIFY_line_24_25_invert); + + for (size_t i = 0; i < MN; ++i) + { + // Convert the index to binary IN REVERSE and construct the scalar exponent + rct::key g_scalar = proof.a; + rct::key h_scalar; + sc_mul(h_scalar.bytes, proof.b.bytes, yinvpow.bytes); + + for (size_t j = rounds; j-- > 0; ) + { + size_t J = w.size() - j - 1; + + if ((i & (((size_t)1)< multiexp_data; + multiexp_data.reserve(2*rounds); + + sc_muladd(z1.bytes, proof.mu.bytes, weight.bytes, z1.bytes); + for (size_t i = 0; i < rounds; ++i) + { + sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); + multiexp_data.emplace_back(tmp, proof.L[i]); + sc_mul(tmp.bytes, winv[i].bytes, winv[i].bytes); + multiexp_data.emplace_back(tmp, proof.R[i]); + } + rct::key acc = multiexp(multiexp_data, false); + rct::addKeys(Z2, Z2, rct::scalarmultKey(acc, weight)); + sc_mulsub(tmp.bytes, proof.a.bytes, proof.b.bytes, proof.t.bytes); + sc_mul(tmp.bytes, tmp.bytes, x_ip.bytes); + sc_muladd(z3.bytes, tmp.bytes, weight.bytes, z3.bytes); + PERF_TIMER_STOP(VERIFY_line_26_new); } - if (!(L61Right == L61Left)) - { - MERROR("Verification failure at step 1"); - return false; - } - - PERF_TIMER_START_BP(VERIFY_line_62); - // PAPER LINE 62 - rct::key P = rct::addKeys(proof.A, rct::scalarmultKey(proof.S, x)); - PERF_TIMER_STOP(VERIFY_line_62); - - // Compute the number of rounds for the inner product - const size_t rounds = logM+logN; - CHECK_AND_ASSERT_MES(rounds > 0, false, "Zero rounds"); - - PERF_TIMER_START_BP(VERIFY_line_21_22); - // PAPER LINES 21-22 - // The inner product challenges are computed per round - rct::keyV w(rounds); - for (size_t i = 0; i < rounds; ++i) - { - w[i] = hash_cache_mash(hash_cache, proof.L[i], proof.R[i]); - } - PERF_TIMER_STOP(VERIFY_line_21_22); - - PERF_TIMER_START_BP(VERIFY_line_24_25); - // Basically PAPER LINES 24-25 - // Compute the curvepoints from G[i] and H[i] - rct::key yinvpow = rct::identity(); - rct::key ypow = rct::identity(); - - PERF_TIMER_START_BP(VERIFY_line_24_25_invert); - const rct::key yinv = invert(y); - rct::keyV winv(rounds); - for (size_t i = 0; i < rounds; ++i) - winv[i] = invert(w[i]); - PERF_TIMER_STOP(VERIFY_line_24_25_invert); + // now check all proofs at once + PERF_TIMER_START_BP(VERIFY_step2_check); + rct::key Y = Z0; + sc_sub(tmp.bytes, rct::zero().bytes, z1.bytes); + rct::addKeys(Y, Y, rct::scalarmultBase(tmp)); + rct::addKeys(Y, Y, Z2); + rct::addKeys(Y, Y, rct::scalarmultKey(rct::H, z3)); std::vector multiexp_data; - multiexp_data.clear(); - multiexp_data.reserve(MN*2); - for (size_t i = 0; i < MN; ++i) + multiexp_data.reserve(2 * maxMN); + for (size_t i = 0; i < maxMN; ++i) { - // Convert the index to binary IN REVERSE and construct the scalar exponent - rct::key g_scalar = proof.a; - rct::key h_scalar; - sc_mul(h_scalar.bytes, proof.b.bytes, yinvpow.bytes); - - for (size_t j = rounds; j-- > 0; ) - { - size_t J = w.size() - j - 1; - - if ((i & (((size_t)1)< &proofs) +{ + std::vector proof_pointers; + for (const Bulletproof &proof: proofs) + proof_pointers.push_back(&proof); + return bulletproof_VERIFY(proof_pointers); +} + +bool bulletproof_VERIFY(const Bulletproof &proof) +{ + std::vector proofs; + proofs.push_back(&proof); + return bulletproof_VERIFY(proofs); +} + } diff --git a/src/ringct/bulletproofs.h b/src/ringct/bulletproofs.h index 3dfa38b12..b86202ccc 100644 --- a/src/ringct/bulletproofs.h +++ b/src/ringct/bulletproofs.h @@ -43,6 +43,8 @@ Bulletproof bulletproof_PROVE(uint64_t v, const rct::key &gamma); Bulletproof bulletproof_PROVE(const rct::keyV &v, const rct::keyV &gamma); Bulletproof bulletproof_PROVE(const std::vector &v, const rct::keyV &gamma); bool bulletproof_VERIFY(const Bulletproof &proof); +bool bulletproof_VERIFY(const std::vector &proofs); +bool bulletproof_VERIFY(const std::vector &proofs); } diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index 6dcb203bf..2e2b07fcc 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -70,6 +70,13 @@ namespace rct { catch (...) { return false; } } + bool verBulletproof(const std::vector &proofs) + { + try { return bulletproof_VERIFY(proofs); } + // we can get deep throws from ge_frombytes_vartime if input isn't valid + catch (...) { return false; } + } + //Borromean (c.f. gmax/andytoshi's paper) boroSig genBorromean(const key64 x, const key64 P1, const key64 P2, const bits indices) { key64 L[2], alpha; @@ -918,15 +925,23 @@ namespace rct { //ver RingCT simple //assumes only post-rct style inputs (at least for max anonymity) - bool verRctSimple(const rctSig & rv, bool semantics) { + bool verRctSemanticsSimple(const std::vector & rvv) { try { - PERF_TIMER(verRctSimple); + PERF_TIMER(verRctSemanticsSimple); - CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctSimple called on non simple rctSig"); - const bool bulletproof = is_rct_bulletproof(rv.type); - if (semantics) + tools::threadpool& tpool = tools::threadpool::getInstance(); + tools::threadpool::waiter waiter; + std::deque results; + std::vector proofs; + size_t max_non_bp_proofs = 0, offset = 0; + + for (const rctSig *rvp: rvv) { + CHECK_AND_ASSERT_MES(rvp, false, "rctSig pointer is NULL"); + const rctSig &rv = *rvp; + CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctSemanticsSimple called on non simple rctSig"); + const bool bulletproof = is_rct_bulletproof(rv.type); if (bulletproof) { CHECK_AND_ASSERT_MES(rv.outPk.size() == n_bulletproof_amounts(rv.p.bulletproofs), false, "Mismatched sizes of outPk and bulletproofs"); @@ -940,15 +955,99 @@ namespace rct { CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.empty(), false, "rv.p.pseudoOuts is not empty"); } CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.ecdhInfo.size(), false, "Mismatched sizes of outPk and rv.ecdhInfo"); + + if (!bulletproof) + max_non_bp_proofs += rv.p.rangeSigs.size(); } - else + + results.resize(max_non_bp_proofs); + for (const rctSig *rvp: rvv) { - // semantics check is early, and mixRing/MGs aren't resolved yet + const rctSig &rv = *rvp; + + const bool bulletproof = is_rct_bulletproof(rv.type); + const keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts; + + key sumOutpks = identity(); + for (size_t i = 0; i < rv.outPk.size(); i++) { + addKeys(sumOutpks, sumOutpks, rv.outPk[i].mask); + } + DP(sumOutpks); + key txnFeeKey = scalarmultH(d2h(rv.txnFee)); + addKeys(sumOutpks, txnFeeKey, sumOutpks); + + key sumPseudoOuts = identity(); + for (size_t i = 0 ; i < pseudoOuts.size() ; i++) { + addKeys(sumPseudoOuts, sumPseudoOuts, pseudoOuts[i]); + } + DP(sumPseudoOuts); + + //check pseudoOuts vs Outs.. + if (!equalKeys(sumPseudoOuts, sumOutpks)) { + LOG_PRINT_L1("Sum check failed"); + return false; + } + if (bulletproof) - CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.p.pseudoOuts and mixRing"); + { + for (size_t i = 0; i < rv.p.bulletproofs.size(); i++) + proofs.push_back(&rv.p.bulletproofs[i]); + } else - CHECK_AND_ASSERT_MES(rv.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.pseudoOuts and mixRing"); + { + for (size_t i = 0; i < rv.p.rangeSigs.size(); i++) + tpool.submit(&waiter, [&, i, offset] { results[i+offset] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); + offset += rv.p.rangeSigs.size(); + } } + if (!proofs.empty() && !verBulletproof(proofs)) + { + LOG_PRINT_L1("Aggregate range proof verified failed"); + return false; + } + + waiter.wait(&tpool); + for (size_t i = 0; i < results.size(); ++i) { + if (!results[i]) { + LOG_PRINT_L1("Range proof verified failed for proof " << i); + return false; + } + } + + return true; + } + // we can get deep throws from ge_frombytes_vartime if input isn't valid + catch (const std::exception &e) + { + LOG_PRINT_L1("Error in verRctSemanticsSimple: " << e.what()); + return false; + } + catch (...) + { + LOG_PRINT_L1("Error in verRctSemanticsSimple, but not an actual exception"); + return false; + } + } + + bool verRctSemanticsSimple(const rctSig & rv) + { + return verRctSemanticsSimple(std::vector(1, &rv)); + } + + //ver RingCT simple + //assumes only post-rct style inputs (at least for max anonymity) + bool verRctNonSemanticsSimple(const rctSig & rv) { + try + { + PERF_TIMER(verRctNonSemanticsSimple); + + CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctNonSemanticsSimple called on non simple rctSig"); + const bool bulletproof = is_rct_bulletproof(rv.type); + // semantics check is early, and mixRing/MGs aren't resolved yet + if (bulletproof) + CHECK_AND_ASSERT_MES(rv.p.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.p.pseudoOuts and mixRing"); + else + CHECK_AND_ASSERT_MES(rv.pseudoOuts.size() == rv.mixRing.size(), false, "Mismatched sizes of rv.pseudoOuts and mixRing"); const size_t threads = std::max(rv.outPk.size(), rv.mixRing.size()); @@ -958,61 +1057,21 @@ namespace rct { const keyV &pseudoOuts = bulletproof ? rv.p.pseudoOuts : rv.pseudoOuts; - if (semantics) { - key sumOutpks = identity(); - for (size_t i = 0; i < rv.outPk.size(); i++) { - addKeys(sumOutpks, sumOutpks, rv.outPk[i].mask); - } - DP(sumOutpks); - key txnFeeKey = scalarmultH(d2h(rv.txnFee)); - addKeys(sumOutpks, txnFeeKey, sumOutpks); + const key message = get_pre_mlsag_hash(rv, hw::get_device("default")); - key sumPseudoOuts = identity(); - for (size_t i = 0 ; i < pseudoOuts.size() ; i++) { - addKeys(sumPseudoOuts, sumPseudoOuts, pseudoOuts[i]); - } - DP(sumPseudoOuts); - - //check pseudoOuts vs Outs.. - if (!equalKeys(sumPseudoOuts, sumOutpks)) { - LOG_PRINT_L1("Sum check failed"); - return false; - } - - results.clear(); - results.resize(bulletproof ? rv.p.bulletproofs.size() : rv.outPk.size()); - if (bulletproof) - for (size_t i = 0; i < rv.p.bulletproofs.size(); i++) - tpool.submit(&waiter, [&, i] { results[i] = verBulletproof(rv.p.bulletproofs[i]); }); - else - for (size_t i = 0; i < rv.p.rangeSigs.size(); i++) - tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); - waiter.wait(&tpool); - - for (size_t i = 0; i < results.size(); ++i) { - if (!results[i]) { - LOG_PRINT_L1("Range proof verified failed for proof " << i); - return false; - } - } + results.clear(); + results.resize(rv.mixRing.size()); + for (size_t i = 0 ; i < rv.mixRing.size() ; i++) { + tpool.submit(&waiter, [&, i] { + results[i] = verRctMGSimple(message, rv.p.MGs[i], rv.mixRing[i], pseudoOuts[i]); + }); } - else { - const key message = get_pre_mlsag_hash(rv, hw::get_device("default")); + waiter.wait(&tpool); - results.clear(); - results.resize(rv.mixRing.size()); - for (size_t i = 0 ; i < rv.mixRing.size() ; i++) { - tpool.submit(&waiter, [&, i] { - results[i] = verRctMGSimple(message, rv.p.MGs[i], rv.mixRing[i], pseudoOuts[i]); - }, true); - } - waiter.wait(&tpool); - - for (size_t i = 0; i < results.size(); ++i) { - if (!results[i]) { - LOG_PRINT_L1("verRctMGSimple failed for input " << i); - return false; - } + for (size_t i = 0; i < results.size(); ++i) { + if (!results[i]) { + LOG_PRINT_L1("verRctMGSimple failed for input " << i); + return false; } } @@ -1021,12 +1080,12 @@ namespace rct { // we can get deep throws from ge_frombytes_vartime if input isn't valid catch (const std::exception &e) { - LOG_PRINT_L1("Error in verRct: " << e.what()); + LOG_PRINT_L1("Error in verRctNonSemanticsSimple: " << e.what()); return false; } catch (...) { - LOG_PRINT_L1("Error in verRct, but not an actual exception"); + LOG_PRINT_L1("Error in verRctNonSemanticsSimple, but not an actual exception"); return false; } } diff --git a/src/ringct/rctSigs.h b/src/ringct/rctSigs.h index 9a66310c7..d1090ca77 100644 --- a/src/ringct/rctSigs.h +++ b/src/ringct/rctSigs.h @@ -125,8 +125,10 @@ namespace rct { rctSig genRctSimple(const key & message, const ctkeyV & inSk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev); bool verRct(const rctSig & rv, bool semantics); static inline bool verRct(const rctSig & rv) { return verRct(rv, true) && verRct(rv, false); } - bool verRctSimple(const rctSig & rv, bool semantics); - static inline bool verRctSimple(const rctSig & rv) { return verRctSimple(rv, true) && verRctSimple(rv, false); } + bool verRctSemanticsSimple(const rctSig & rv); + bool verRctSemanticsSimple(const std::vector & rv); + bool verRctNonSemanticsSimple(const rctSig & rv); + static inline bool verRctSimple(const rctSig & rv) { return verRctSemanticsSimple(rv) && verRctNonSemanticsSimple(rv); } xmr_amount decodeRct(const rctSig & rv, const key & sk, unsigned int i, key & mask, hw::device &hwdev); xmr_amount decodeRct(const rctSig & rv, const key & sk, unsigned int i, hw::device &hwdev); xmr_amount decodeRctSimple(const rctSig & rv, const key & sk, unsigned int i, key & mask, hw::device &hwdev); diff --git a/tests/performance_tests/bulletproof.h b/tests/performance_tests/bulletproof.h index b11c9fe97..7bb702c3d 100644 --- a/tests/performance_tests/bulletproof.h +++ b/tests/performance_tests/bulletproof.h @@ -60,3 +60,41 @@ public: private: rct::Bulletproof proof; }; + +template +class test_aggregated_bulletproof +{ +public: + static const size_t loop_count = 500 / (N * repeat); + + bool init() + { + size_t o = start; + for (size_t n = 0; n < N; ++n) + { + //printf("adding %zu times %zu\n", repeat, o); + for (size_t i = 0; i < repeat; ++i) + proofs.push_back(rct::bulletproof_PROVE(std::vector(o, 749327532984), rct::skvGen(o))); + o = o * mul + add; + } + return true; + } + + bool test() + { + if (batch) + { + return rct::bulletproof_VERIFY(proofs); + } + else + { + for (const rct::Bulletproof &proof: proofs) + if (!rct::bulletproof_VERIFY(proof)) + return false; + return true; + } + } + +private: + std::vector proofs; +}; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index a00f05ce7..c125f9042 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -183,6 +183,17 @@ int main(int argc, char** argv) TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 15); TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 15); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 8, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 8, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 1, 2, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 1, 2, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 8, 1, 1, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 8, 1, 1, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 64); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 64); + TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, false); diff --git a/tests/performance_tests/performance_tests.h b/tests/performance_tests/performance_tests.h index 6f613e0a5..ce9baf61f 100644 --- a/tests/performance_tests/performance_tests.h +++ b/tests/performance_tests/performance_tests.h @@ -169,3 +169,5 @@ void run_test(const std::string &filter, bool verbose, const char* test_name) #define TEST_PERFORMANCE2(filter, verbose, test_class, a0, a1) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ">") #define TEST_PERFORMANCE3(filter, verbose, test_class, a0, a1, a2) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ">") #define TEST_PERFORMANCE4(filter, verbose, test_class, a0, a1, a2, a3) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ">") +#define TEST_PERFORMANCE5(filter, verbose, test_class, a0, a1, a2, a3, a4) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ">") +#define TEST_PERFORMANCE6(filter, verbose, test_class, a0, a1, a2, a3, a4, a5) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ", " QUOTEME(a5) ">") diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index 183bb5167..db14c050a 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -135,6 +135,25 @@ TEST(bulletproofs, multi_splitting) } } +TEST(bulletproofs, valid_aggregated) +{ + static const size_t N_PROOFS = 8; + std::vector proofs(N_PROOFS); + for (size_t n = 0; n < N_PROOFS; ++n) + { + size_t outputs = 2 + n; + std::vector amounts; + rct::keyV gamma; + for (size_t i = 0; i < outputs; ++i) + { + amounts.push_back(crypto::rand()); + gamma.push_back(rct::skGen()); + } + proofs[n] = bulletproof_PROVE(amounts, gamma); + } + ASSERT_TRUE(rct::bulletproof_VERIFY(proofs)); +} + TEST(bulletproofs, invalid_8) { diff --git a/tests/unit_tests/ringct.cpp b/tests/unit_tests/ringct.cpp index 6e3958f8a..d4e942176 100644 --- a/tests/unit_tests/ringct.cpp +++ b/tests/unit_tests/ringct.cpp @@ -1085,3 +1085,20 @@ TEST(ringct, zeroCommmit) const rct::key manual = rct::addKeys(a, b); ASSERT_EQ(z, manual); } + +TEST(ringct, aggregated) +{ + static const size_t N_PROOFS = 16; + std::vector s(N_PROOFS); + std::vector sp(N_PROOFS); + + for (size_t n = 0; n < N_PROOFS; ++n) + { + static const uint64_t inputs[] = {1000, 1000}; + static const uint64_t outputs[] = {500, 1500}; + s[n] = make_sample_simple_rct_sig(NELTS(inputs), inputs, NELTS(outputs), outputs, 0); + sp[n] = &s[n]; + } + + ASSERT_TRUE(verRctSemanticsSimple(sp)); +} From cb9ecab197b2a7f4594ba2208ce5b6386d65d287 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 16 Mar 2018 19:02:55 +0000 Subject: [PATCH 16/56] performance_tests: add signature generation/verification --- tests/performance_tests/CMakeLists.txt | 1 + tests/performance_tests/main.cpp | 3 ++ tests/performance_tests/signature.h | 68 ++++++++++++++++++++++++++ 3 files changed, 72 insertions(+) create mode 100644 tests/performance_tests/signature.h diff --git a/tests/performance_tests/CMakeLists.txt b/tests/performance_tests/CMakeLists.txt index 3ffd84aa6..837d39bd3 100644 --- a/tests/performance_tests/CMakeLists.txt +++ b/tests/performance_tests/CMakeLists.txt @@ -40,6 +40,7 @@ set(performance_tests_headers generate_key_image.h generate_key_image_helper.h generate_keypair.h + signature.h is_out_to_acc.h subaddress_expand.h range_proof.h diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index c125f9042..ea23ec9ea 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -46,6 +46,7 @@ #include "generate_key_image.h" #include "generate_key_image_helper.h" #include "generate_keypair.h" +#include "signature.h" #include "is_out_to_acc.h" #include "subaddress_expand.h" #include "sc_reduce32.h" @@ -150,6 +151,8 @@ int main(int argc, char** argv) TEST_PERFORMANCE0(filter, verbose, test_ge_frombytes_vartime); TEST_PERFORMANCE0(filter, verbose, test_generate_keypair); TEST_PERFORMANCE0(filter, verbose, test_sc_reduce32); + TEST_PERFORMANCE1(filter, verbose, test_signature, false); + TEST_PERFORMANCE1(filter, verbose, test_signature, true); TEST_PERFORMANCE2(filter, verbose, test_wallet2_expand_subaddresses, 50, 200); diff --git a/tests/performance_tests/signature.h b/tests/performance_tests/signature.h new file mode 100644 index 000000000..21110b525 --- /dev/null +++ b/tests/performance_tests/signature.h @@ -0,0 +1,68 @@ +// Copyright (c) 2014-2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once + +#include "crypto/crypto.h" +#include "cryptonote_basic/cryptonote_basic.h" + +#include "single_tx_test_base.h" + +template +class test_signature : public single_tx_test_base +{ +public: + static const size_t loop_count = 10000; + + bool init() + { + if (!single_tx_test_base::init()) + return false; + + message = crypto::rand(); + keys = cryptonote::keypair::generate(hw::get_device("default")); + crypto::generate_signature(message, keys.pub, keys.sec, m_signature); + + return true; + } + + bool test() + { + if (verify) + return crypto::check_signature(message, keys.pub, m_signature); + crypto::generate_signature(message, keys.pub, keys.sec, m_signature); + return true; + } + +private: + cryptonote::keypair keys; + crypto::hash message; + crypto::signature m_signature; +}; From 71d67bda7418603ad3a34c1c9e8e9374a7607b90 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 27 Mar 2018 12:35:27 +0100 Subject: [PATCH 17/56] aligned: aligned memory alloc/realloc/free --- src/common/CMakeLists.txt | 6 +- src/common/aligned.c | 139 ++++++++++++++++++++++++++++++++ src/common/aligned.h | 41 ++++++++++ tests/unit_tests/CMakeLists.txt | 3 +- tests/unit_tests/aligned.cpp | 86 ++++++++++++++++++++ 5 files changed, 272 insertions(+), 3 deletions(-) create mode 100644 src/common/aligned.c create mode 100644 src/common/aligned.h create mode 100644 tests/unit_tests/aligned.cpp diff --git a/src/common/CMakeLists.txt b/src/common/CMakeLists.txt index f0df05b0d..c6bac2199 100644 --- a/src/common/CMakeLists.txt +++ b/src/common/CMakeLists.txt @@ -38,7 +38,8 @@ set(common_sources password.cpp perf_timer.cpp threadpool.cpp - updates.cpp) + updates.cpp + aligned.c) if (STACK_TRACE) list(APPEND common_sources stack_trace.cpp) @@ -67,7 +68,8 @@ set(common_private_headers perf_timer.h stack_trace.h threadpool.h - updates.h) + updates.h + aligned.h) monero_private_headers(common ${common_private_headers}) diff --git a/src/common/aligned.c b/src/common/aligned.c new file mode 100644 index 000000000..763dfd0e7 --- /dev/null +++ b/src/common/aligned.c @@ -0,0 +1,139 @@ +// Copyright (c) 2017-2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#include +#include +#include +#include +#include +#include "aligned.h" + +static inline int is_power_of_2(size_t n) { return n && (n & (n-1)) == 0; } + +#define MAGIC 0xaa0817161500ff81 +#define MAGIC_FREED 0xaa0817161500ff82 + +static void local_abort(const char *msg) +{ + fprintf(stderr, "%s\n", msg); +#ifdef NDEBUG + _exit(1); +#else + abort(); +#endif +} + +typedef struct +{ + uint64_t magic; + void *raw; + size_t bytes; + size_t align; +} control; + +void *aligned_malloc(size_t bytes, size_t align) +{ + void *raw, *ptr; + control *ctrl; + + if (!is_power_of_2(align)) + return NULL; + if (bytes > (size_t)-1 - align) + return NULL; + if (bytes + align > (size_t)-1 - sizeof(control)) + return NULL; + + raw = malloc(bytes + sizeof(control) + align); + if (!raw) + return NULL; + ptr = (void*)(((uintptr_t)raw + align + sizeof(control) - 1) & ~(align-1)); + ctrl = ((control*)ptr) - 1; + ctrl->magic = MAGIC; + ctrl->raw = raw; + ctrl->bytes = bytes; + ctrl->align = align; + return ptr; +} + +void *aligned_realloc(void *ptr, size_t bytes, size_t align) +{ + void *raw, *ptr2; + control *ctrl, *ctrl2; + + if (!ptr) + return aligned_malloc(bytes, align); + if (!bytes) + { + aligned_free(ptr); + return NULL; + } + if (!is_power_of_2(align)) + return NULL; + + ctrl = ((control*)ptr) - 1; + if (ctrl->magic == MAGIC_FREED) + local_abort("Double free detected"); + if (ctrl->magic != MAGIC) + local_abort("Freeing unallocated memory"); + if (ctrl->align != align) + return NULL; + if (ctrl->bytes >= bytes) + return ptr; + + if (ctrl->bytes > (size_t)-1 - ctrl->align) + return NULL; + if (ctrl->bytes + ctrl->align > (size_t)-1 - sizeof(control)) + return NULL; + + raw = malloc(bytes + sizeof(control) + ctrl->align); + if (!raw) + return NULL; + ptr2 = (void*)(((uintptr_t)raw + ctrl->align + sizeof(control) - 1) & ~(ctrl->align-1)); + memcpy(ptr2, ptr, ctrl->bytes); + ctrl2 = ((control*)ptr2) - 1; + ctrl2->magic = MAGIC; + ctrl2->raw = raw; + ctrl2->bytes = bytes; + ctrl2->align = ctrl->align; + ctrl->magic = MAGIC_FREED; + free(ctrl->raw); + return ptr2; +} + +void aligned_free(void *ptr) +{ + if (!ptr) + return; + control *ctrl = ((control*)ptr) - 1; + if (ctrl->magic == MAGIC_FREED) + local_abort("Double free detected"); + if (ctrl->magic != MAGIC) + local_abort("Freeing unallocated memory"); + ctrl->magic = MAGIC_FREED; + free(ctrl->raw); +} diff --git a/src/common/aligned.h b/src/common/aligned.h new file mode 100644 index 000000000..fed3ccb36 --- /dev/null +++ b/src/common/aligned.h @@ -0,0 +1,41 @@ +// Copyright (c) 2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#pragma once + +#ifdef __cplusplus +extern "C" { +#endif + +void *aligned_malloc(size_t bytes, size_t align); +void *aligned_realloc(void *ptr, size_t bytes, size_t align); +void aligned_free(void *ptr); + +#ifdef __cplusplus +} +#endif diff --git a/tests/unit_tests/CMakeLists.txt b/tests/unit_tests/CMakeLists.txt index cdb741699..741bb1882 100644 --- a/tests/unit_tests/CMakeLists.txt +++ b/tests/unit_tests/CMakeLists.txt @@ -79,7 +79,8 @@ set(unit_tests_sources vercmp.cpp ringdb.cpp wipeable_string.cpp - is_hdd.cpp) + is_hdd.cpp + aligned.cpp) set(unit_tests_headers unit_tests_utils.h) diff --git a/tests/unit_tests/aligned.cpp b/tests/unit_tests/aligned.cpp new file mode 100644 index 000000000..ad4837bec --- /dev/null +++ b/tests/unit_tests/aligned.cpp @@ -0,0 +1,86 @@ +// Copyright (c) 2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#include "gtest/gtest.h" + +#include "common/aligned.h" + +TEST(aligned, large_null) { ASSERT_TRUE(aligned_malloc((size_t)-1, 1) == NULL); } +TEST(aligned, free_null) { aligned_free(NULL); } +TEST(aligned, zero) { void *ptr = aligned_malloc(0, 1); ASSERT_TRUE(ptr); aligned_free(ptr); } +TEST(aligned, aligned1) { void *ptr = aligned_malloc(1, 1); ASSERT_TRUE(ptr); aligned_free(ptr); } +TEST(aligned, aligned4096) { void *ptr = aligned_malloc(1, 4096); ASSERT_TRUE(ptr && ((uintptr_t)ptr & 4095) == 0); aligned_free(ptr); } +TEST(aligned, aligned8) { void *ptr = aligned_malloc(1, 8); ASSERT_TRUE(ptr && ((uintptr_t)ptr & 7) == 0); aligned_free(ptr); } +TEST(aligned, realloc_null) { void *ptr = aligned_realloc(NULL, 1, 4096); ASSERT_TRUE(ptr && ((uintptr_t)ptr & 4095) == 0); aligned_free(ptr); } +TEST(aligned, realloc_diff_align) { void *ptr = aligned_malloc(1, 4096); ASSERT_TRUE(!aligned_realloc(ptr, 1, 2048)); aligned_free(ptr); } +TEST(aligned, realloc_same) { void *ptr = aligned_malloc(1, 4096), *ptr2 = aligned_realloc(ptr, 1, 4096); ASSERT_TRUE(ptr == ptr2); aligned_free(ptr2); } +TEST(aligned, realloc_larger) { void *ptr = aligned_malloc(1, 4096), *ptr2 = aligned_realloc(ptr, 2, 4096); ASSERT_TRUE(ptr != ptr2); aligned_free(ptr2); } +TEST(aligned, realloc_zero) { void *ptr = aligned_malloc(1, 4096), *ptr2 = aligned_realloc(ptr, 0, 4096); ASSERT_TRUE(ptr && !ptr2); } + +TEST(aligned, contents_larger) +{ + unsigned char *ptr = (unsigned char*)aligned_malloc(50, 256); + ASSERT_TRUE(ptr); + for (int n = 0; n < 50; ++n) + ptr[n] = n; + unsigned char *ptr2 = (unsigned char*)aligned_realloc(ptr, 51, 256); + for (int n = 0; n < 50; ++n) + { + ASSERT_TRUE(ptr2[n] == n); + } + aligned_free(ptr2); +} + +TEST(aligned, contents_same) +{ + unsigned char *ptr = (unsigned char*)aligned_malloc(50, 256); + ASSERT_TRUE(ptr); + for (int n = 0; n < 50; ++n) + ptr[n] = n; + unsigned char *ptr2 = (unsigned char*)aligned_realloc(ptr, 50, 256); + for (int n = 0; n < 50; ++n) + { + ASSERT_TRUE(ptr2[n] == n); + } + aligned_free(ptr2); +} + +TEST(aligned, contents_smaller) +{ + unsigned char *ptr = (unsigned char*)aligned_malloc(50, 256); + ASSERT_TRUE(ptr); + for (int n = 0; n < 50; ++n) + ptr[n] = n; + unsigned char *ptr2 = (unsigned char*)aligned_realloc(ptr, 49, 256); + for (int n = 0; n < 49; ++n) + { + ASSERT_TRUE(ptr2[n] == n); + } + aligned_free(ptr2); +} + From 126196b017cd93ff399212b7315f9053511afb07 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 25 Mar 2018 12:17:37 +0100 Subject: [PATCH 18/56] multiexp: some speedups - use a raw memory block to store cache - use aligned memory - use doubling API where appropriate - calculate straus in bands --- src/ringct/bulletproofs.cc | 3 +- src/ringct/multiexp.cc | 146 ++++++++++++++++++++++++++++++------- src/ringct/multiexp.h | 2 +- 3 files changed, 122 insertions(+), 29 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index e2540fb22..94be0e545 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -70,8 +70,9 @@ static boost::mutex init_mutex; static inline rct::key multiexp(const std::vector &data, bool HiGi) { + static const size_t STEP = getenv("STRAUS_STEP") ? atoi(getenv("STRAUS_STEP")) : 0; if (HiGi || data.size() < 1000) - return straus(data, HiGi ? HiGi_cache: NULL); + return straus(data, HiGi ? HiGi_cache: NULL, STEP); else return bos_coster_heap_conv_robust(data); } diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 4f16bd588..99bef25f3 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -34,6 +34,7 @@ extern "C" { #include "crypto/crypto-ops.h" } +#include "common/aligned.h" #include "rctOps.h" #include "multiexp.h" @@ -43,6 +44,17 @@ extern "C" //#define MULTIEXP_PERF(x) x #define MULTIEXP_PERF(x) +#define RAW_MEMORY_BLOCK +//#define ALTERNATE_LAYOUT +//#define TRACK_STRAUS_ZERO_IDENTITY + +// per points us for N/B points (B point bands) +// raw alt 128/192 4096/192 4096/4096 +// 0 0 52.6 71 71.2 +// 0 1 53.2 72.2 72.4 +// 1 0 52.7 67 67.1 +// 1 1 52.8 70.4 70.2 + namespace rct { @@ -198,6 +210,7 @@ rct::key bos_coster_heap_conv_robust(std::vector data) ge_cached cached; ge_p1p1 p1; + ge_p2 p2; MULTIEXP_PERF(PERF_TIMER_RESUME(div)); while (1) @@ -214,8 +227,8 @@ rct::key bos_coster_heap_conv_robust(std::vector data) std::push_heap(heap.begin(), heap.end(), Comp); } data[index1].scalar = div2(data[index1].scalar); - ge_p3_to_cached(&cached, &data[index1].point); - ge_add(&p1, &data[index1].point, &cached); + ge_p3_to_p2(&p2, &data[index1].point); + ge_p2_dbl(&p1, &p2); ge_p1p1_to_p3(&data[index1].point, &p1); } MULTIEXP_PERF(PERF_TIMER_PAUSE(div)); @@ -259,12 +272,32 @@ rct::key bos_coster_heap_conv_robust(std::vector data) return res; } +static constexpr unsigned int STRAUS_C = 4; + struct straus_cached_data { +#ifdef RAW_MEMORY_BLOCK + size_t size; + ge_cached *multiples; + straus_cached_data(): size(0), multiples(NULL) {} + ~straus_cached_data() { aligned_free(multiples); } +#else std::vector> multiples; +#endif }; - -static constexpr unsigned int STRAUS_C = 4; +#ifdef RAW_MEMORY_BLOCK +#ifdef ALTERNATE_LAYOUT +#define CACHE_OFFSET(cache,point,digit) cache->multiples[(point)*((1<multiples[(point)+cache->size*((digit)-1)] +#endif +#else +#ifdef ALTERNATE_LAYOUT +#define CACHE_OFFSET(cache,point,digit) local_cache->multiples[j][digit-1] +#else +#define CACHE_OFFSET(cache,point,digit) local_cache->multiples[digit][j] +#endif +#endif std::shared_ptr straus_init_cache(const std::vector &data) { @@ -274,6 +307,36 @@ std::shared_ptr straus_init_cache(const std::vector cache(new straus_cached_data()); +#ifdef RAW_MEMORY_BLOCK + const size_t offset = cache->size; + cache->multiples = (ge_cached*)aligned_realloc(cache->multiples, sizeof(ge_cached) * ((1<size = data.size(); + for (size_t j=offset;jmultiples.size(); + cache->multiples.resize(std::max(offset, data.size())); + for (size_t i = offset; i < data.size(); ++i) + { + cache->multiples[i].resize((1<multiples[i][0], &data[i].point); + for (size_t j=2;j<1<multiples[i][j-2]); + ge_p1p1_to_p3(&p3, &p1); + ge_p3_to_cached(&cache->multiples[i][j-1], &p3); + } + } +#else cache->multiples.resize(1<multiples[1].size(); cache->multiples[1].resize(std::max(offset, data.size())); @@ -290,6 +353,8 @@ std::shared_ptr straus_init_cache(const std::vectormultiples[i][j], &p3); } } +#endif +#endif MULTIEXP_PERF(PERF_TIMER_STOP(multiples)); return cache; @@ -298,15 +363,20 @@ std::shared_ptr straus_init_cache(const std::vector &cache) { size_t sz = 0; +#ifdef RAW_MEMORY_BLOCK + sz += cache->size * sizeof(ge_cached) * ((1<multiples) - sz += e0.size() * sizeof(ge_p3); + sz += e0.size() * sizeof(ge_cached); +#endif return sz; } -rct::key straus(const std::vector &data, const std::shared_ptr &cache) +rct::key straus(const std::vector &data, const std::shared_ptr &cache, size_t STEP) { MULTIEXP_PERF(PERF_TIMER_UNIT(straus, 1000000)); bool HiGi = cache != NULL; + STEP = STEP ? STEP : 192; MULTIEXP_PERF(PERF_TIMER_START_UNIT(setup, 1000000)); static constexpr unsigned int mask = (1< &data, const std::shared_ptr skip(data.size()); for (size_t i = 0; i < data.size(); ++i) skip[i] = data[i].scalar == rct::zero() || !memcmp(&data[i].point, &ge_p3_identity, sizeof(ge_p3)); + MULTIEXP_PERF(PERF_TIMER_STOP(skip)); +#endif MULTIEXP_PERF(PERF_TIMER_START_UNIT(digits, 1000000)); std::vector> digits; @@ -361,35 +435,53 @@ rct::key straus(const std::vector &data, const std::shared_ptrmultiples[digit][j]); - ge_p1p1_to_p3(&res_p3, &p1); + ge_p2_dbl(&p1, &p2); + if (j == STRAUS_C - 1) + ge_p1p1_to_p3(&band_p3, &p1); + else + ge_p1p1_to_p2(&p2, &p1); + } +skipfirst: + i -= STRAUS_C; + for (size_t j = start_offset; j < start_offset + num_points; ++j) + { +#ifdef TRACK_STRAUS_ZERO_IDENTITY + if (skip[j]) + continue; +#endif + const uint8_t digit = digits[j][i]; + if (digit) + { + ge_add(&p1, &band_p3, &CACHE_OFFSET(local_cache, j, digit)); + ge_p1p1_to_p3(&band_p3, &p1); + } } } + + ge_p3_to_cached(&cached, &band_p3); + ge_add(&p1, &res_p3, &cached); + ge_p1p1_to_p3(&res_p3, &p1); } rct::key res; diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h index 44998e2e0..c08c70858 100644 --- a/src/ringct/multiexp.h +++ b/src/ringct/multiexp.h @@ -59,7 +59,7 @@ rct::key bos_coster_heap_conv(std::vector data); rct::key bos_coster_heap_conv_robust(std::vector data); std::shared_ptr straus_init_cache(const std::vector &data); size_t straus_get_cache_size(const std::shared_ptr &cache); -rct::key straus(const std::vector &data, const std::shared_ptr &cache = NULL); +rct::key straus(const std::vector &data, const std::shared_ptr &cache = NULL, size_t STEP = 0); } From 2a8fcb421bc41eb254f95379dd73238915dd509d Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 30 Mar 2018 20:29:42 +0100 Subject: [PATCH 19/56] Bulletproof aggregated verification and tests Also constrains bulletproofs to simple rct, for simplicity --- .../cryptonote_boost_serialization.h | 6 +- .../cryptonote_format_utils.cpp | 18 +- src/cryptonote_core/blockchain.cpp | 15 +- src/cryptonote_core/cryptonote_core.cpp | 186 +++++++--- src/cryptonote_core/cryptonote_core.h | 3 + src/cryptonote_core/cryptonote_tx_utils.cpp | 4 +- src/device/device_ledger.cpp | 2 +- src/ringct/rctSigs.cpp | 133 +++---- src/ringct/rctSigs.h | 2 +- src/ringct/rctTypes.cpp | 19 +- src/ringct/rctTypes.h | 20 +- src/wallet/wallet2.cpp | 3 +- tests/core_tests/CMakeLists.txt | 7 +- tests/core_tests/bulletproofs.cpp | 339 ++++++++++++++++++ tests/core_tests/bulletproofs.h | 170 +++++++++ tests/core_tests/chaingen.h | 46 ++- tests/core_tests/chaingen_main.cpp | 12 + tests/core_tests/chaingen_tests_list.h | 1 + tests/core_tests/rct.cpp | 2 +- tests/performance_tests/check_tx_signature.h | 2 +- tests/unit_tests/bulletproofs.cpp | 28 +- 21 files changed, 844 insertions(+), 174 deletions(-) create mode 100644 tests/core_tests/bulletproofs.cpp create mode 100644 tests/core_tests/bulletproofs.h diff --git a/src/cryptonote_basic/cryptonote_boost_serialization.h b/src/cryptonote_basic/cryptonote_boost_serialization.h index 143133163..0725a2bb8 100644 --- a/src/cryptonote_basic/cryptonote_boost_serialization.h +++ b/src/cryptonote_basic/cryptonote_boost_serialization.h @@ -295,7 +295,7 @@ namespace boost a & x.type; if (x.type == rct::RCTTypeNull) return; - if (x.type != rct::RCTTypeFull && x.type != rct::RCTTypeFullBulletproof && x.type != rct::RCTTypeSimple && x.type != rct::RCTTypeSimpleBulletproof) + if (x.type != rct::RCTTypeFull && x.type != rct::RCTTypeSimple && x.type != rct::RCTTypeBulletproof) throw boost::archive::archive_exception(boost::archive::archive_exception::other_exception, "Unsupported rct type"); // a & x.message; message is not serialized, as it can be reconstructed from the tx data // a & x.mixRing; mixRing is not serialized, as it can be reconstructed from the offsets @@ -323,7 +323,7 @@ namespace boost a & x.type; if (x.type == rct::RCTTypeNull) return; - if (x.type != rct::RCTTypeFull && x.type != rct::RCTTypeFullBulletproof && x.type != rct::RCTTypeSimple && x.type != rct::RCTTypeSimpleBulletproof) + if (x.type != rct::RCTTypeFull && x.type != rct::RCTTypeSimple && x.type != rct::RCTTypeBulletproof) throw boost::archive::archive_exception(boost::archive::archive_exception::other_exception, "Unsupported rct type"); // a & x.message; message is not serialized, as it can be reconstructed from the tx data // a & x.mixRing; mixRing is not serialized, as it can be reconstructed from the offsets @@ -337,7 +337,7 @@ namespace boost if (x.p.rangeSigs.empty()) a & x.p.bulletproofs; a & x.p.MGs; - if (x.type == rct::RCTTypeSimpleBulletproof) + if (x.type == rct::RCTTypeBulletproof) a & x.p.pseudoOuts; } } diff --git a/src/cryptonote_basic/cryptonote_format_utils.cpp b/src/cryptonote_basic/cryptonote_format_utils.cpp index 428be1c9c..524cbf7ae 100644 --- a/src/cryptonote_basic/cryptonote_format_utils.cpp +++ b/src/cryptonote_basic/cryptonote_format_utils.cpp @@ -139,18 +139,26 @@ namespace cryptonote if (!base_only) { - const bool bulletproof = rv.type == rct::RCTTypeFullBulletproof || rv.type == rct::RCTTypeSimpleBulletproof; + const bool bulletproof = rct::is_rct_bulletproof(rv.type); if (bulletproof) { - if (rv.p.bulletproofs.size() != tx.vout.size()) + if (rct::n_bulletproof_amounts(rv.p.bulletproofs) != tx.vout.size()) { LOG_PRINT_L1("Failed to parse transaction from blob, bad bulletproofs size in tx " << get_transaction_hash(tx)); return false; } - for (size_t n = 0; n < rv.outPk.size(); ++n) + size_t idx = 0; + for (size_t n = 0; n < rv.p.bulletproofs.size(); ++n) { - rv.p.bulletproofs[n].V.resize(1); - rv.p.bulletproofs[n].V[0] = rv.outPk[n].mask; + //rv.p.bulletproofs[n].V.resize(1); + //rv.p.bulletproofs[n].V[0] = rv.outPk[n].mask; + CHECK_AND_ASSERT_MES(rv.p.bulletproofs[n].L.size() >= 6, false, "Bad bulletproofs L size"); // at least 64 bits + const size_t n_amounts = rct::n_bulletproof_amounts(rv.p.bulletproofs[n]); + CHECK_AND_ASSERT_MES(idx + n_amounts <= rv.outPk.size(), false, "Internal error filling out V"); + rv.p.bulletproofs[n].V.resize(n_amounts); + rv.p.bulletproofs[n].V.clear(); + for (size_t i = 0; i < n_amounts; ++i) + rv.p.bulletproofs[n].V[i] = rv.outPk[idx++].mask; } } } diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index 0800409b5..9beb28fbd 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -2597,7 +2597,7 @@ bool Blockchain::check_tx_outputs(const transaction& tx, tx_verification_context // from v8, allow bulletproofs if (hf_version < 8) { - const bool bulletproof = tx.rct_signatures.type == rct::RCTTypeFullBulletproof || tx.rct_signatures.type == rct::RCTTypeSimpleBulletproof; + const bool bulletproof = rct::is_rct_bulletproof(tx.rct_signatures.type); if (bulletproof || !tx.rct_signatures.p.bulletproofs.empty()) { MERROR("Bulletproofs are not allowed before v8"); @@ -2631,7 +2631,7 @@ bool Blockchain::expand_transaction_2(transaction &tx, const crypto::hash &tx_pr rv.message = rct::hash2rct(tx_prefix_hash); // mixRing - full and simple store it in opposite ways - if (rv.type == rct::RCTTypeFull || rv.type == rct::RCTTypeFullBulletproof) + if (rv.type == rct::RCTTypeFull) { CHECK_AND_ASSERT_MES(!pubkeys.empty() && !pubkeys[0].empty(), false, "empty pubkeys"); rv.mixRing.resize(pubkeys[0].size()); @@ -2646,7 +2646,7 @@ bool Blockchain::expand_transaction_2(transaction &tx, const crypto::hash &tx_pr } } } - else if (rv.type == rct::RCTTypeSimple || rv.type == rct::RCTTypeSimpleBulletproof) + else if (rv.type == rct::RCTTypeSimple || rv.type == rct::RCTTypeBulletproof) { CHECK_AND_ASSERT_MES(!pubkeys.empty() && !pubkeys[0].empty(), false, "empty pubkeys"); rv.mixRing.resize(pubkeys.size()); @@ -2665,14 +2665,14 @@ bool Blockchain::expand_transaction_2(transaction &tx, const crypto::hash &tx_pr } // II - if (rv.type == rct::RCTTypeFull || rv.type == rct::RCTTypeFullBulletproof) + if (rv.type == rct::RCTTypeFull) { rv.p.MGs.resize(1); rv.p.MGs[0].II.resize(tx.vin.size()); for (size_t n = 0; n < tx.vin.size(); ++n) rv.p.MGs[0].II[n] = rct::ki2rct(boost::get(tx.vin[n]).k_image); } - else if (rv.type == rct::RCTTypeSimple || rv.type == rct::RCTTypeSimpleBulletproof) + else if (rv.type == rct::RCTTypeSimple || rv.type == rct::RCTTypeBulletproof) { CHECK_AND_ASSERT_MES(rv.p.MGs.size() == tx.vin.size(), false, "Bad MGs size"); for (size_t n = 0; n < tx.vin.size(); ++n) @@ -2938,7 +2938,7 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, return false; } case rct::RCTTypeSimple: - case rct::RCTTypeSimpleBulletproof: + case rct::RCTTypeBulletproof: { // check all this, either reconstructed (so should really pass), or not { @@ -2996,7 +2996,6 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, break; } case rct::RCTTypeFull: - case rct::RCTTypeFullBulletproof: { // check all this, either reconstructed (so should really pass), or not { @@ -3061,7 +3060,7 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, } // for bulletproofs, check they're only multi-output after v8 - if (rv.type == rct::RCTTypeFullBulletproof || rv.type == rct::RCTTypeSimpleBulletproof) + if (rct::is_rct_bulletproof(rv.type)) { if (hf_version < 8) { diff --git a/src/cryptonote_core/cryptonote_core.cpp b/src/cryptonote_core/cryptonote_core.cpp index 4928bb528..f1a666814 100644 --- a/src/cryptonote_core/cryptonote_core.cpp +++ b/src/cryptonote_core/cryptonote_core.cpp @@ -692,26 +692,142 @@ namespace cryptonote return false; } + // resolve outPk references in rct txes + // outPk aren't the only thing that need resolving for a fully resolved tx, + // but outPk (1) are needed now to check range proof semantics, and + // (2) do not need access to the blockchain to find data + if (tx.version >= 2) + { + rct::rctSig &rv = tx.rct_signatures; + if (rv.outPk.size() != tx.vout.size()) + { + LOG_PRINT_L1("WRONG TRANSACTION BLOB, Bad outPk size in tx " << tx_hash << ", rejected"); + tvc.m_verifivation_failed = true; + return false; + } + for (size_t n = 0; n < tx.rct_signatures.outPk.size(); ++n) + rv.outPk[n].dest = rct::pk2rct(boost::get(tx.vout[n].target).key); + + const bool bulletproof = rct::is_rct_bulletproof(rv.type); + if (bulletproof) + { + if (rct::n_bulletproof_amounts(rv.p.bulletproofs) != tx.vout.size()) + { + LOG_PRINT_L1("WRONG TRANSACTION BLOB, Bad bulletproofs size in tx " << tx_hash << ", rejected"); + tvc.m_verifivation_failed = true; + return false; + } + size_t idx = 0; + for (size_t n = 0; n < rv.p.bulletproofs.size(); ++n) + { + CHECK_AND_ASSERT_MES(rv.p.bulletproofs[n].L.size() >= 6, false, "Bad bulletproofs L size"); // at least 64 bits + const size_t n_amounts = rct::n_bulletproof_amounts(rv.p.bulletproofs[n]); + CHECK_AND_ASSERT_MES(idx + n_amounts <= rv.outPk.size(), false, "Internal error filling out V"); + rv.p.bulletproofs[n].V.clear(); + for (size_t i = 0; i < n_amounts; ++i) + rv.p.bulletproofs[n].V.push_back(rv.outPk[idx++].mask); + } + } + } + return true; + } + //----------------------------------------------------------------------------------------------- + void core::set_semantics_failed(const crypto::hash &tx_hash) + { + LOG_PRINT_L1("WRONG TRANSACTION BLOB, Failed to check tx " << tx_hash << " semantic, rejected"); + bad_semantics_txes_lock.lock(); + bad_semantics_txes[0].insert(tx_hash); + if (bad_semantics_txes[0].size() >= BAD_SEMANTICS_TXES_MAX_SIZE) + { + std::swap(bad_semantics_txes[0], bad_semantics_txes[1]); + bad_semantics_txes[0].clear(); + } + bad_semantics_txes_lock.unlock(); + } + //----------------------------------------------------------------------------------------------- + bool core::handle_incoming_tx_accumulated_batch(std::vector &tx_info, bool keeped_by_block) + { + bool ret = true; if (keeped_by_block && get_blockchain_storage().is_within_compiled_block_hash_area()) { MTRACE("Skipping semantics check for tx kept by block in embedded hash area"); - } - else if(!check_tx_semantic(tx, keeped_by_block)) - { - LOG_PRINT_L1("WRONG TRANSACTION BLOB, Failed to check tx " << tx_hash << " semantic, rejected"); - tvc.m_verifivation_failed = true; - bad_semantics_txes_lock.lock(); - bad_semantics_txes[0].insert(tx_hash); - if (bad_semantics_txes[0].size() >= BAD_SEMANTICS_TXES_MAX_SIZE) - { - std::swap(bad_semantics_txes[0], bad_semantics_txes[1]); - bad_semantics_txes[0].clear(); - } - bad_semantics_txes_lock.unlock(); - return false; + return true; } - return true; + std::vector rvv; + for (size_t n = 0; n < tx_info.size(); ++n) + { + if (!check_tx_semantic(*tx_info[n].tx, keeped_by_block)) + { + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + continue; + } + + if (tx_info[n].tx->version < 2) + continue; + const rct::rctSig &rv = tx_info[n].tx->rct_signatures; + switch (rv.type) { + case rct::RCTTypeNull: + // coinbase should not come here, so we reject for all other types + MERROR_VER("Unexpected Null rctSig type"); + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + break; + case rct::RCTTypeSimple: + if (!rct::verRctSemanticsSimple(rv)) + { + MERROR_VER("rct signature semantics check failed"); + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + break; + } + break; + case rct::RCTTypeFull: + if (!rct::verRct(rv, true)) + { + MERROR_VER("rct signature semantics check failed"); + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + break; + } + break; + case rct::RCTTypeBulletproof: + rvv.push_back(&rv); // delayed batch verification + break; + default: + MERROR_VER("Unknown rct type: " << rv.type); + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + break; + } + } + if (!rvv.empty() && !rct::verRctSemanticsSimple(rvv)) + { + LOG_PRINT_L1("One transaction among this group has bad semantics, verifying one at a time"); + ret = false; + const bool assumed_bad = rvv.size() == 1; // if there's only one tx, it must be the bad one + for (size_t n = 0; n < tx_info.size(); ++n) + { + if (!tx_info[n].result) + continue; + if (tx_info[n].tx->rct_signatures.type != rct::RCTTypeBulletproof) + continue; + if (assumed_bad || !rct::verRctSemanticsSimple(tx_info[n].tx->rct_signatures)) + { + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + } + } + } + + return ret; } //----------------------------------------------------------------------------------------------- bool core::handle_incoming_txs(const std::vector& tx_blobs, std::vector& tvc, bool keeped_by_block, bool relayed, bool do_not_relay) @@ -769,6 +885,16 @@ namespace cryptonote } waiter.wait(&tpool); + std::vector tx_info; + tx_info.reserve(tx_blobs.size()); + for (size_t i = 0; i < tx_blobs.size(); i++) { + if (!results[i].res) + continue; + tx_info.push_back({&results[i].tx, results[i].hash, tvc[i], results[i].res}); + } + if (!tx_info.empty()) + handle_incoming_tx_accumulated_batch(tx_info, keeped_by_block); + bool ok = true; it = tx_blobs.begin(); for (size_t i = 0; i < tx_blobs.size(); i++, ++it) { @@ -886,36 +1012,6 @@ namespace cryptonote return false; } - if (tx.version >= 2) - { - const rct::rctSig &rv = tx.rct_signatures; - switch (rv.type) { - case rct::RCTTypeNull: - // coinbase should not come here, so we reject for all other types - MERROR_VER("Unexpected Null rctSig type"); - return false; - case rct::RCTTypeSimple: - case rct::RCTTypeSimpleBulletproof: - if (!rct::verRctSemanticsSimple(rv)) - { - MERROR_VER("rct signature semantics check failed"); - return false; - } - break; - case rct::RCTTypeFull: - case rct::RCTTypeFullBulletproof: - if (!rct::verRct(rv, true)) - { - MERROR_VER("rct signature semantics check failed"); - return false; - } - break; - default: - MERROR_VER("Unknown rct type: " << rv.type); - return false; - } - } - return true; } //----------------------------------------------------------------------------------------------- diff --git a/src/cryptonote_core/cryptonote_core.h b/src/cryptonote_core/cryptonote_core.h index 84e1bb918..497b16214 100644 --- a/src/cryptonote_core/cryptonote_core.h +++ b/src/cryptonote_core/cryptonote_core.h @@ -864,9 +864,12 @@ namespace cryptonote * @return true if all the checks pass, otherwise false */ bool check_tx_semantic(const transaction& tx, bool keeped_by_block) const; + void set_semantics_failed(const crypto::hash &tx_hash); bool handle_incoming_tx_pre(const blobdata& tx_blob, tx_verification_context& tvc, cryptonote::transaction &tx, crypto::hash &tx_hash, crypto::hash &tx_prefixt_hash, bool keeped_by_block, bool relayed, bool do_not_relay); bool handle_incoming_tx_post(const blobdata& tx_blob, tx_verification_context& tvc, cryptonote::transaction &tx, crypto::hash &tx_hash, crypto::hash &tx_prefixt_hash, bool keeped_by_block, bool relayed, bool do_not_relay); + struct tx_verification_batch_info { const cryptonote::transaction *tx; crypto::hash tx_hash; tx_verification_context &tvc; bool &result; }; + bool handle_incoming_tx_accumulated_batch(std::vector &tx_info, bool keeped_by_block); /** * @copydoc miner::on_block_chain_update diff --git a/src/cryptonote_core/cryptonote_tx_utils.cpp b/src/cryptonote_core/cryptonote_tx_utils.cpp index 32031e950..525945079 100644 --- a/src/cryptonote_core/cryptonote_tx_utils.cpp +++ b/src/cryptonote_core/cryptonote_tx_utils.cpp @@ -491,7 +491,7 @@ namespace cryptonote // the non-simple version is slightly smaller, but assumes all real inputs // are on the same index, so can only be used if there just one ring. - bool use_simple_rct = sources.size() > 1; + bool use_simple_rct = sources.size() > 1 || range_proof_type == rct::RangeProofMultiOutputBulletproof || range_proof_type == rct::RangeProofBulletproof; if (!use_simple_rct) { @@ -591,7 +591,7 @@ namespace cryptonote if (use_simple_rct) tx.rct_signatures = rct::genRctSimple(rct::hash2rct(tx_prefix_hash), inSk, destinations, inamounts, outamounts, amount_in - amount_out, mixRing, amount_keys, msout ? &kLRki : NULL, msout, index, outSk, range_proof_type, hwdev); else - tx.rct_signatures = rct::genRct(rct::hash2rct(tx_prefix_hash), inSk, destinations, outamounts, mixRing, amount_keys, msout ? &kLRki[0] : NULL, msout, sources[0].real_output, outSk, range_proof_type, hwdev); // same index assumption + tx.rct_signatures = rct::genRct(rct::hash2rct(tx_prefix_hash), inSk, destinations, outamounts, mixRing, amount_keys, msout ? &kLRki[0] : NULL, msout, sources[0].real_output, outSk, hwdev); // same index assumption memwipe(inSk.data(), inSk.size() * sizeof(rct::ctkey)); CHECK_AND_ASSERT_MES(tx.vout.size() == outSk.size(), false, "outSk size does not match vout"); diff --git a/src/device/device_ledger.cpp b/src/device/device_ledger.cpp index c4e9e40b7..658b379e4 100644 --- a/src/device/device_ledger.cpp +++ b/src/device/device_ledger.cpp @@ -1354,7 +1354,7 @@ namespace hw { this->exchange(); //pseudoOuts - if ((type == rct::RCTTypeSimple) || (type == rct::RCTTypeSimpleBulletproof)) { + if ((type == rct::RCTTypeSimple) || (type == rct::RCTTypeBulletproof)) { for ( i = 0; i < inputs_size; i++) { offset = set_command_header(INS_VALIDATE, 0x01, i+2); //options diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index 2e2b07fcc..2175d1659 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -390,7 +390,7 @@ namespace rct { hashes.push_back(hash2rct(h)); keyV kv; - if (rv.type == RCTTypeSimpleBulletproof || rv.type == RCTTypeFullBulletproof) + if (rv.type == RCTTypeBulletproof) { kv.reserve((6*2+9) * rv.p.bulletproofs.size()); for (const auto &p: rv.p.bulletproofs) @@ -651,8 +651,7 @@ namespace rct { // must know the destination private key to find the correct amount, else will return a random number // Note: For txn fees, the last index in the amounts vector should contain that // Thus the amounts vector will be "one" longer than the destinations vectort - rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev) { - const bool bulletproof = range_proof_type != RangeProofBorromean; + rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, hw::device &hwdev) { CHECK_AND_ASSERT_THROW_MES(amounts.size() == destinations.size() || amounts.size() == destinations.size() + 1, "Different number of amounts/destinations"); CHECK_AND_ASSERT_THROW_MES(amount_keys.size() == destinations.size(), "Different number of amount_keys/destinations"); CHECK_AND_ASSERT_THROW_MES(index < mixRing.size(), "Bad index into mixRing"); @@ -662,11 +661,10 @@ namespace rct { CHECK_AND_ASSERT_THROW_MES((kLRki && msout) || (!kLRki && !msout), "Only one of kLRki/msout is present"); rctSig rv; - rv.type = bulletproof ? RCTTypeFullBulletproof : RCTTypeFull; + rv.type = RCTTypeFull; rv.message = message; rv.outPk.resize(destinations.size()); - if (!bulletproof) - rv.p.rangeSigs.resize(destinations.size()); + rv.p.rangeSigs.resize(destinations.size()); rv.ecdhInfo.resize(destinations.size()); size_t i = 0; @@ -675,46 +673,11 @@ namespace rct { for (i = 0; i < destinations.size(); i++) { //add destination to sig rv.outPk[i].dest = copy(destinations[i]); - //compute range proof (bulletproofs are done later) - if (!bulletproof) - { - rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, amounts[i]); + //compute range proof + rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, amounts[i]); #ifdef DBG - CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof"); + CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof"); #endif - } - } - - rv.p.bulletproofs.clear(); - if (bulletproof) - { - std::vector proof_amounts; - size_t amounts_proved = 0; - while (amounts_proved < amounts.size()) - { - size_t batch_size = 1; - if (range_proof_type == RangeProofMultiOutputBulletproof) - while (batch_size * 2 + amounts_proved <= amounts.size()) - batch_size *= 2; - rct::keyV C, masks; - std::vector batch_amounts(batch_size); - for (i = 0; i < batch_size; ++i) - batch_amounts[i] = amounts[i + amounts_proved]; - rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, batch_amounts)); - #ifdef DBG - CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof"); - #endif - for (i = 0; i < batch_size; ++i) - { - rv.outPk[i + amounts_proved].mask = C[i]; - outSk[i + amounts_proved].mask = masks[i]; - } - amounts_proved += batch_size; - } - } - - for (i = 0; i < outSk.size(); ++i) - { //mask amount and mask rv.ecdhInfo[i].mask = copy(outSk[i].mask); rv.ecdhInfo[i].amount = d2h(amounts[i]); @@ -744,7 +707,7 @@ namespace rct { ctkeyM mixRing; ctkeyV outSk; tie(mixRing, index) = populateFromBlockchain(inPk, mixin); - return genRct(message, inSk, destinations, amounts, mixRing, amount_keys, kLRki, msout, index, outSk, RangeProofBorromean, hwdev); + return genRct(message, inSk, destinations, amounts, mixRing, amount_keys, kLRki, msout, index, outSk, hwdev); } //RCT simple @@ -766,35 +729,61 @@ namespace rct { } rctSig rv; - rv.type = bulletproof ? RCTTypeSimpleBulletproof : RCTTypeSimple; + rv.type = bulletproof ? RCTTypeBulletproof : RCTTypeSimple; rv.message = message; rv.outPk.resize(destinations.size()); - if (bulletproof) - rv.p.bulletproofs.resize(destinations.size()); - else + if (!bulletproof) rv.p.rangeSigs.resize(destinations.size()); rv.ecdhInfo.resize(destinations.size()); size_t i; keyV masks(destinations.size()); //sk mask.. outSk.resize(destinations.size()); - key sumout = zero(); for (i = 0; i < destinations.size(); i++) { //add destination to sig rv.outPk[i].dest = copy(destinations[i]); //compute range proof - if (bulletproof) - rv.p.bulletproofs[i] = proveRangeBulletproof(rv.outPk[i].mask, outSk[i].mask, outamounts[i]); - else + if (!bulletproof) rv.p.rangeSigs[i] = proveRange(rv.outPk[i].mask, outSk[i].mask, outamounts[i]); #ifdef DBG - if (bulletproof) - CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs[i]), "verBulletproof failed on newly created proof"); - else + if (!bulletproof) CHECK_AND_ASSERT_THROW_MES(verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]), "verRange failed on newly created proof"); #endif - + } + + rv.p.bulletproofs.clear(); + if (bulletproof) + { + std::vector proof_amounts; + size_t n_amounts = outamounts.size(); + size_t amounts_proved = 0; + while (amounts_proved < n_amounts) + { + size_t batch_size = 1; + if (range_proof_type == RangeProofMultiOutputBulletproof) + while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= 16) + batch_size *= 2; + rct::keyV C, masks; + std::vector batch_amounts(batch_size); + for (i = 0; i < batch_size; ++i) + batch_amounts[i] = outamounts[i + amounts_proved]; + rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, batch_amounts)); + #ifdef DBG + CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof"); + #endif + for (i = 0; i < batch_size; ++i) + { + rv.outPk[i + amounts_proved].mask = C[i]; + outSk[i + amounts_proved].mask = masks[i]; + } + amounts_proved += batch_size; + } + } + + key sumout = zero(); + for (i = 0; i < outSk.size(); ++i) + { sc_add(sumout.bytes, outSk[i].mask.bytes, sumout.bytes); //mask amount and mask @@ -857,14 +846,10 @@ namespace rct { // must know the destination private key to find the correct amount, else will return a random number bool verRct(const rctSig & rv, bool semantics) { PERF_TIMER(verRct); - CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeFullBulletproof, false, "verRct called on non-full rctSig"); - const bool bulletproof = is_rct_bulletproof(rv.type); + CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull, false, "verRct called on non-full rctSig"); if (semantics) { - if (bulletproof) - CHECK_AND_ASSERT_MES(rv.outPk.size() == n_bulletproof_amounts(rv.p.bulletproofs), false, "Mismatched sizes of outPk and bulletproofs"); - else - CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.rangeSigs.size(), false, "Mismatched sizes of outPk and rv.p.rangeSigs"); + CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.p.rangeSigs.size(), false, "Mismatched sizes of outPk and rv.p.rangeSigs"); CHECK_AND_ASSERT_MES(rv.outPk.size() == rv.ecdhInfo.size(), false, "Mismatched sizes of outPk and rv.ecdhInfo"); CHECK_AND_ASSERT_MES(rv.p.MGs.size() == 1, false, "full rctSig has not one MG"); } @@ -879,14 +864,10 @@ namespace rct { if (semantics) { tools::threadpool& tpool = tools::threadpool::getInstance(); tools::threadpool::waiter waiter; - std::deque results(bulletproof ? rv.p.bulletproofs.size() : rv.outPk.size(), false); + std::deque results(rv.outPk.size(), false); DP("range proofs verified?"); - if (bulletproof) - for (size_t i = 0; i < rv.p.bulletproofs.size(); i++) - tpool.submit(&waiter, [&, i] { results[i] = verBulletproof(rv.p.bulletproofs[i]); }); - else - for (size_t i = 0; i < rv.outPk.size(); i++) - tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); + for (size_t i = 0; i < rv.outPk.size(); i++) + tpool.submit(&waiter, [&, i] { results[i] = verRange(rv.outPk[i].mask, rv.p.rangeSigs[i]); }); waiter.wait(&tpool); for (size_t i = 0; i < results.size(); ++i) { @@ -940,7 +921,7 @@ namespace rct { { CHECK_AND_ASSERT_MES(rvp, false, "rctSig pointer is NULL"); const rctSig &rv = *rvp; - CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctSemanticsSimple called on non simple rctSig"); + CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "verRctSemanticsSimple called on non simple rctSig"); const bool bulletproof = is_rct_bulletproof(rv.type); if (bulletproof) { @@ -1041,7 +1022,7 @@ namespace rct { { PERF_TIMER(verRctNonSemanticsSimple); - CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "verRctNonSemanticsSimple called on non simple rctSig"); + CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "verRctNonSemanticsSimple called on non simple rctSig"); const bool bulletproof = is_rct_bulletproof(rv.type); // semantics check is early, and mixRing/MGs aren't resolved yet if (bulletproof) @@ -1101,7 +1082,7 @@ namespace rct { // uses the attached ecdh info to find the amounts represented by each output commitment // must know the destination private key to find the correct amount, else will return a random number xmr_amount decodeRct(const rctSig & rv, const key & sk, unsigned int i, key & mask, hw::device &hwdev) { - CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeFullBulletproof, false, "decodeRct called on non-full rctSig"); + CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull, false, "decodeRct called on non-full rctSig"); CHECK_AND_ASSERT_THROW_MES(i < rv.ecdhInfo.size(), "Bad index"); CHECK_AND_ASSERT_THROW_MES(rv.outPk.size() == rv.ecdhInfo.size(), "Mismatched sizes of rv.outPk and rv.ecdhInfo"); @@ -1129,7 +1110,7 @@ namespace rct { } xmr_amount decodeRctSimple(const rctSig & rv, const key & sk, unsigned int i, key &mask, hw::device &hwdev) { - CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeSimpleBulletproof, false, "decodeRct called on non simple rctSig"); + CHECK_AND_ASSERT_MES(rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "decodeRct called on non simple rctSig"); CHECK_AND_ASSERT_THROW_MES(i < rv.ecdhInfo.size(), "Bad index"); CHECK_AND_ASSERT_THROW_MES(rv.outPk.size() == rv.ecdhInfo.size(), "Mismatched sizes of rv.outPk and rv.ecdhInfo"); @@ -1157,12 +1138,12 @@ namespace rct { } bool signMultisig(rctSig &rv, const std::vector &indices, const keyV &k, const multisig_out &msout, const key &secret_key) { - CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeSimple || rv.type == RCTTypeFullBulletproof || rv.type == RCTTypeSimpleBulletproof, + CHECK_AND_ASSERT_MES(rv.type == RCTTypeFull || rv.type == RCTTypeSimple || rv.type == RCTTypeBulletproof, false, "unsupported rct type"); CHECK_AND_ASSERT_MES(indices.size() == k.size(), false, "Mismatched k/indices sizes"); CHECK_AND_ASSERT_MES(k.size() == rv.p.MGs.size(), false, "Mismatched k/MGs size"); CHECK_AND_ASSERT_MES(k.size() == msout.c.size(), false, "Mismatched k/msout.c size"); - if (rv.type == RCTTypeFull || rv.type == RCTTypeFullBulletproof) + if (rv.type == RCTTypeFull) { CHECK_AND_ASSERT_MES(rv.p.MGs.size() == 1, false, "MGs not a single element"); } diff --git a/src/ringct/rctSigs.h b/src/ringct/rctSigs.h index d1090ca77..ae8bb91d7 100644 --- a/src/ringct/rctSigs.h +++ b/src/ringct/rctSigs.h @@ -119,7 +119,7 @@ namespace rct { //decodeRct: (c.f. https://eprint.iacr.org/2015/1098 section 5.1.1) // uses the attached ecdh info to find the amounts represented by each output commitment // must know the destination private key to find the correct amount, else will return a random number - rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const std::vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev); + rctSig genRct(const key &message, const ctkeyV & inSk, const keyV & destinations, const std::vector & amounts, const ctkeyM &mixRing, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, unsigned int index, ctkeyV &outSk, hw::device &hwdev); rctSig genRct(const key &message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const std::vector & amounts, const keyV &amount_keys, const multisig_kLRki *kLRki, multisig_out *msout, const int mixin, hw::device &hwdev); rctSig genRctSimple(const key & message, const ctkeyV & inSk, const ctkeyV & inPk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, xmr_amount txnFee, unsigned int mixin, hw::device &hwdev); rctSig genRctSimple(const key & message, const ctkeyV & inSk, const keyV & destinations, const std::vector & inamounts, const std::vector & outamounts, xmr_amount txnFee, const ctkeyM & mixRing, const keyV &amount_keys, const std::vector *kLRki, multisig_out *msout, const std::vector & index, ctkeyV &outSk, RangeProofType range_proof_type, hw::device &hwdev); diff --git a/src/ringct/rctTypes.cpp b/src/ringct/rctTypes.cpp index 72ef75780..e67637af6 100644 --- a/src/ringct/rctTypes.cpp +++ b/src/ringct/rctTypes.cpp @@ -28,6 +28,7 @@ // STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF // THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +#include "misc_log_ex.h" #include "rctTypes.h" using namespace crypto; using namespace std; @@ -214,7 +215,7 @@ namespace rct { switch (type) { case RCTTypeSimple: - case RCTTypeSimpleBulletproof: + case RCTTypeBulletproof: return true; default: return false; @@ -225,19 +226,29 @@ namespace rct { { switch (type) { - case RCTTypeSimpleBulletproof: - case RCTTypeFullBulletproof: + case RCTTypeBulletproof: return true; default: return false; } } + size_t n_bulletproof_amounts(const Bulletproof &proof) + { + CHECK_AND_ASSERT_MES(proof.L.size() >= 6, 0, "Invalid bulletproof L size"); + return 1 << (proof.L.size() - 6); + } + size_t n_bulletproof_amounts(const std::vector &proofs) { size_t n = 0; for (const Bulletproof &proof: proofs) - n += proof.V.size(); + { + size_t n2 = n_bulletproof_amounts(proof); + if (n2 == 0) + return 0; + n += n2; + } return n; } diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index 5574c7784..894f747b8 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -213,6 +213,7 @@ namespace rct { END_SERIALIZE() }; + size_t n_bulletproof_amounts(const Bulletproof &proof); size_t n_bulletproof_amounts(const std::vector &proofs); //A container to hold all signatures necessary for RingCT @@ -226,8 +227,7 @@ namespace rct { RCTTypeNull = 0, RCTTypeFull = 1, RCTTypeSimple = 2, - RCTTypeFullBulletproof = 3, - RCTTypeSimpleBulletproof = 4, + RCTTypeBulletproof = 3, }; enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof }; struct rctSigBase { @@ -246,7 +246,7 @@ namespace rct { FIELD(type) if (type == RCTTypeNull) return true; - if (type != RCTTypeFull && type != RCTTypeFullBulletproof && type != RCTTypeSimple && type != RCTTypeSimpleBulletproof) + if (type != RCTTypeFull && type != RCTTypeSimple && type != RCTTypeBulletproof) return false; VARINT_FIELD(txnFee) // inputs/outputs not saved, only here for serialization help @@ -307,9 +307,9 @@ namespace rct { { if (type == RCTTypeNull) return true; - if (type != RCTTypeFull && type != RCTTypeFullBulletproof && type != RCTTypeSimple && type != RCTTypeSimpleBulletproof) + if (type != RCTTypeFull && type != RCTTypeSimple && type != RCTTypeBulletproof) return false; - if (type == RCTTypeSimpleBulletproof || type == RCTTypeFullBulletproof) + if (type == RCTTypeBulletproof) { ar.tag("bp"); ar.begin_array(); @@ -348,7 +348,7 @@ namespace rct { ar.begin_array(); // we keep a byte for size of MGs, because we don't know whether this is // a simple or full rct signature, and it's starting to annoy the hell out of me - size_t mg_elements = (type == RCTTypeSimple || type == RCTTypeSimpleBulletproof) ? inputs : 1; + size_t mg_elements = (type == RCTTypeSimple || type == RCTTypeBulletproof) ? inputs : 1; PREPARE_CUSTOM_VECTOR_SERIALIZATION(mg_elements, MGs); if (MGs.size() != mg_elements) return false; @@ -366,7 +366,7 @@ namespace rct { for (size_t j = 0; j < mixin + 1; ++j) { ar.begin_array(); - size_t mg_ss2_elements = ((type == RCTTypeSimple || type == RCTTypeSimpleBulletproof) ? 1 : inputs) + 1; + size_t mg_ss2_elements = ((type == RCTTypeSimple || type == RCTTypeBulletproof) ? 1 : inputs) + 1; PREPARE_CUSTOM_VECTOR_SERIALIZATION(mg_ss2_elements, MGs[i].ss[j]); if (MGs[i].ss[j].size() != mg_ss2_elements) return false; @@ -392,7 +392,7 @@ namespace rct { ar.delimit_array(); } ar.end_array(); - if (type == RCTTypeSimpleBulletproof) + if (type == RCTTypeBulletproof) { ar.tag("pseudoOuts"); ar.begin_array(); @@ -416,12 +416,12 @@ namespace rct { keyV& get_pseudo_outs() { - return type == RCTTypeSimpleBulletproof ? p.pseudoOuts : pseudoOuts; + return type == RCTTypeBulletproof ? p.pseudoOuts : pseudoOuts; } keyV const& get_pseudo_outs() const { - return type == RCTTypeSimpleBulletproof ? p.pseudoOuts : pseudoOuts; + return type == RCTTypeBulletproof ? p.pseudoOuts : pseudoOuts; } }; diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp index fdba6d84a..37340e22b 100644 --- a/src/wallet/wallet2.cpp +++ b/src/wallet/wallet2.cpp @@ -1142,10 +1142,9 @@ static uint64_t decodeRct(const rct::rctSig & rv, const crypto::key_derivation & switch (rv.type) { case rct::RCTTypeSimple: - case rct::RCTTypeSimpleBulletproof: + case rct::RCTTypeBulletproof: return rct::decodeRctSimple(rv, rct::sk2rct(scalar1), i, mask, hwdev); case rct::RCTTypeFull: - case rct::RCTTypeFullBulletproof: return rct::decodeRct(rv, rct::sk2rct(scalar1), i, mask, hwdev); default: LOG_ERROR("Unsupported rct type: " << rv.type); diff --git a/tests/core_tests/CMakeLists.txt b/tests/core_tests/CMakeLists.txt index c8ee7d9db..1ac0e7864 100644 --- a/tests/core_tests/CMakeLists.txt +++ b/tests/core_tests/CMakeLists.txt @@ -41,7 +41,8 @@ set(core_tests_sources transaction_tests.cpp tx_validation.cpp v2_tests.cpp - rct.cpp) + rct.cpp + bulletproofs.cpp) set(core_tests_headers block_reward.h @@ -58,7 +59,8 @@ set(core_tests_headers transaction_tests.h tx_validation.h v2_tests.h - rct.h) + rct.h + bulletproofs.h) add_executable(core_tests ${core_tests_sources} @@ -73,6 +75,7 @@ target_link_libraries(core_tests device ${CMAKE_THREAD_LIBS_INIT} ${EXTRA_LIBRARIES}) +enable_stack_trace(core_tests) set_property(TARGET core_tests PROPERTY FOLDER "tests") diff --git a/tests/core_tests/bulletproofs.cpp b/tests/core_tests/bulletproofs.cpp new file mode 100644 index 000000000..3f2a2567c --- /dev/null +++ b/tests/core_tests/bulletproofs.cpp @@ -0,0 +1,339 @@ +// Copyright (c) 2014-2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#include "ringct/rctSigs.h" +#include "ringct/bulletproofs.h" +#include "chaingen.h" +#include "bulletproofs.h" +#include "device/device.hpp" + +using namespace epee; +using namespace crypto; +using namespace cryptonote; + +//---------------------------------------------------------------------------------------------------------------------- +// Tests + +bool gen_bp_tx_validation_base::generate_with(std::vector& events, + const int *out_idx, int mixin, size_t n_txes, const uint64_t *amounts_paid, bool valid, const bool *multi_out, + const std::function &sources, std::vector &destinations, size_t tx_idx)> &pre_tx, + const std::function &post_tx) const +{ + uint64_t ts_start = 1338224400; + + GENERATE_ACCOUNT(miner_account); + MAKE_GENESIS_BLOCK(events, blk_0, miner_account, ts_start); + + // create 8 miner accounts, and have them mine the next 8 blocks + cryptonote::account_base miner_accounts[8]; + const cryptonote::block *prev_block = &blk_0; + cryptonote::block blocks[8 + CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW]; + for (size_t n = 0; n < 8; ++n) { + miner_accounts[n].generate(); + CHECK_AND_ASSERT_MES(generator.construct_block_manually(blocks[n], *prev_block, miner_accounts[n], + test_generator::bf_major_ver | test_generator::bf_minor_ver | test_generator::bf_timestamp | test_generator::bf_hf_version, + 2, 2, prev_block->timestamp + DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN * 2, // v2 has blocks twice as long + crypto::hash(), 0, transaction(), std::vector(), 0, 0, 2), + false, "Failed to generate block"); + events.push_back(blocks[n]); + prev_block = blocks + n; + LOG_PRINT_L0("Initial miner tx " << n << ": " << obj_to_json_str(blocks[n].miner_tx)); + } + + // rewind + cryptonote::block blk_r, blk_last; + { + blk_last = blocks[7]; + for (size_t i = 0; i < CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW; ++i) + { + CHECK_AND_ASSERT_MES(generator.construct_block_manually(blocks[8+i], blk_last, miner_account, + test_generator::bf_major_ver | test_generator::bf_minor_ver | test_generator::bf_timestamp | test_generator::bf_hf_version, + 2, 2, blk_last.timestamp + DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN * 2, // v2 has blocks twice as long + crypto::hash(), 0, transaction(), std::vector(), 0, 0, 2), + false, "Failed to generate block"); + events.push_back(blocks[8+i]); + blk_last = blocks[8+i]; + } + blk_r = blk_last; + } + + // create 4 txes from these miners in another block, to generate some rct outputs + std::vector rct_txes; + cryptonote::block blk_txes; + std::vector starting_rct_tx_hashes; + static const uint64_t input_amounts_available[] = {5000000000000, 30000000000000, 100000000000, 80000000000}; + for (size_t n = 0; n < n_txes; ++n) + { + std::vector sources; + + sources.resize(1); + tx_source_entry& src = sources.back(); + + const uint64_t needed_amount = input_amounts_available[n]; + src.amount = input_amounts_available[n]; + size_t real_index_in_tx = 0; + for (size_t m = 0; m < 7; ++m) { + size_t index_in_tx = 0; + for (size_t i = 0; i < blocks[m].miner_tx.vout.size(); ++i) + if (blocks[m].miner_tx.vout[i].amount == needed_amount) + index_in_tx = i; + CHECK_AND_ASSERT_MES(blocks[m].miner_tx.vout[index_in_tx].amount == needed_amount, false, "Expected amount not found"); + src.push_output(m, boost::get(blocks[m].miner_tx.vout[index_in_tx].target).key, src.amount); + if (m == n) + real_index_in_tx = index_in_tx; + } + src.real_out_tx_key = cryptonote::get_tx_pub_key_from_extra(blocks[n].miner_tx); + src.real_output = n; + src.real_output_in_tx_index = real_index_in_tx; + src.mask = rct::identity(); + src.rct = false; + + //fill outputs entry + tx_destination_entry td; + td.addr = miner_accounts[n].get_keys().m_account_address; + std::vector destinations; + for (int o = 0; amounts_paid[o] != (uint64_t)-1; ++o) + { + td.amount = amounts_paid[o]; + destinations.push_back(td); + } + + if (pre_tx && !pre_tx(sources, destinations, n)) + { + MDEBUG("pre_tx returned failure"); + return false; + } + + crypto::secret_key tx_key; + std::vector additional_tx_keys; + std::unordered_map subaddresses; + subaddresses[miner_accounts[n].get_keys().m_account_address.m_spend_public_key] = {0,0}; + rct_txes.resize(rct_txes.size() + 1); + bool r = construct_tx_and_get_tx_key(miner_accounts[n].get_keys(), subaddresses, sources, destinations, cryptonote::account_public_address{}, std::vector(), rct_txes.back(), 0, tx_key, additional_tx_keys, true, multi_out[n] ? rct::RangeProofMultiOutputBulletproof : rct::RangeProofBulletproof); + CHECK_AND_ASSERT_MES(r, false, "failed to construct transaction"); + + if (post_tx && !post_tx(rct_txes.back(), n)) + { + MDEBUG("post_tx returned failure"); + return false; + } + + //events.push_back(rct_txes.back()); + starting_rct_tx_hashes.push_back(get_transaction_hash(rct_txes.back())); + LOG_PRINT_L0("Test tx: " << obj_to_json_str(rct_txes.back())); + + for (int o = 0; amounts_paid[o] != (uint64_t)-1; ++o) + { + crypto::key_derivation derivation; + bool r = crypto::generate_key_derivation(destinations[o].addr.m_view_public_key, tx_key, derivation); + CHECK_AND_ASSERT_MES(r, false, "Failed to generate key derivation"); + crypto::secret_key amount_key; + crypto::derivation_to_scalar(derivation, o, amount_key); + rct::key rct_tx_mask; + if (rct_txes.back().rct_signatures.type == rct::RCTTypeSimple || rct_txes.back().rct_signatures.type == rct::RCTTypeBulletproof) + rct::decodeRctSimple(rct_txes.back().rct_signatures, rct::sk2rct(amount_key), o, rct_tx_mask, hw::get_device("default")); + else + rct::decodeRct(rct_txes.back().rct_signatures, rct::sk2rct(amount_key), o, rct_tx_mask, hw::get_device("default")); + } + + while (amounts_paid[0] != (size_t)-1) + ++amounts_paid; + ++amounts_paid; + } + if (!valid) + DO_CALLBACK(events, "mark_invalid_tx"); + events.push_back(rct_txes); + + CHECK_AND_ASSERT_MES(generator.construct_block_manually(blk_txes, blk_last, miner_account, + test_generator::bf_major_ver | test_generator::bf_minor_ver | test_generator::bf_timestamp | test_generator::bf_tx_hashes | test_generator::bf_hf_version | test_generator::bf_max_outs, + 8, 8, blk_last.timestamp + DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN * 2, // v2 has blocks twice as long + crypto::hash(), 0, transaction(), starting_rct_tx_hashes, 0, 6, 8), + false, "Failed to generate block"); + if (!valid) + DO_CALLBACK(events, "mark_invalid_block"); + events.push_back(blk_txes); + blk_last = blk_txes; + + return true; +} + +bool gen_bp_tx_validation_base::check_bp(const cryptonote::transaction &tx, size_t tx_idx, const size_t *sizes, const char *context) const +{ + DEFINE_TESTS_ERROR_CONTEXT(context); + CHECK_TEST_CONDITION(tx.version >= 2); + CHECK_TEST_CONDITION(rct::is_rct_bulletproof(tx.rct_signatures.type)); + size_t n_sizes = 0, n_amounts = 0; + for (size_t n = 0; n < tx_idx; ++n) + { + while (sizes[0] != (size_t)-1) + ++sizes; + ++sizes; + } + while (sizes[n_sizes] != (size_t)-1) + n_amounts += sizes[n_sizes++]; + CHECK_TEST_CONDITION(tx.rct_signatures.p.bulletproofs.size() == n_sizes); + CHECK_TEST_CONDITION(rct::n_bulletproof_amounts(tx.rct_signatures.p.bulletproofs) == n_amounts); + for (size_t n = 0; n < n_sizes; ++n) + CHECK_TEST_CONDITION(rct::n_bulletproof_amounts(tx.rct_signatures.p.bulletproofs[n]) == sizes[n]); + return true; +} + +bool gen_bp_tx_valid_1::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; + const size_t bp_sizes[] = {1, (size_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1"); }); +} + +bool gen_bp_tx_valid_1_1::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; + const size_t bp_sizes[] = {1, 1, (size_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1_1"); }); +} + +bool gen_bp_tx_valid_2::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; + const size_t bp_sizes[] = {2, (size_t)-1}; + const bool multi_out[] = {true}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_2"); }); +} + +bool gen_bp_tx_valid_4_2_1::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; + const size_t bp_sizes[] = {4, 2, 1, (size_t)-1}; + const bool multi_out[] = {true}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_4_2_1"); }); +} + +bool gen_bp_tx_valid_16_16::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; + const size_t bp_sizes[] = {16, 16, (size_t)-1}; + const bool multi_out[] = {true}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_16_16"); }); +} + +bool gen_bp_txs_valid_2_and_2::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {1000, 1000, (size_t)-1, 1000, 1000, (uint64_t)-1}; + const size_t bp_sizes[] = {2, (size_t)-1, 2, (size_t)-1}; + const bool multi_out[] = {true}; + return generate_with(events, out_idx, mixin, 2, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_2_2"); }); +} + +bool gen_bp_txs_valid_1_1_and_8_2_and_16_16_1::generate(std::vector& events) const +{ + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; + const bool multi_out[] = {false, true, true}; + const size_t bp_sizes[] = {1, 1, (size_t)-1, 8, 2, (size_t)-1, 16, 16, 1, (size_t)-1}; + return generate_with(events, out_idx, mixin, 3, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_1_1_and_8_2_and_16_16_1"); }); +} + +bool gen_bp_tx_invalid_not_enough_proofs::generate(std::vector& events) const +{ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_not_enough_proofs"); + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); + CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); + tx.rct_signatures.p.bulletproofs.pop_back(); + return true; + }); +} + +bool gen_bp_tx_invalid_too_many_proofs::generate(std::vector& events) const +{ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_too_many_proofs"); + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); + CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); + tx.rct_signatures.p.bulletproofs.push_back(tx.rct_signatures.p.bulletproofs.back()); + return true; + }); +} + +bool gen_bp_tx_invalid_wrong_amount::generate(std::vector& events) const +{ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_wrong_amount"); + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); + CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); + tx.rct_signatures.p.bulletproofs.back() = rct::bulletproof_PROVE(1000, rct::skGen()); + return true; + }); +} + +bool gen_bp_tx_invalid_switched::generate(std::vector& events) const +{ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_switched"); + const int mixin = 6; + const int out_idx[] = {1, -1}; + const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; + const bool multi_out[] = {false}; + return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t tx_idx){ + CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); + CHECK_TEST_CONDITION(tx.rct_signatures.p.bulletproofs.size() == 2); + rct::Bulletproof proof = tx.rct_signatures.p.bulletproofs[0]; + tx.rct_signatures.p.bulletproofs[0] = tx.rct_signatures.p.bulletproofs[1]; + tx.rct_signatures.p.bulletproofs[1] = proof; + return true; + }); +} + diff --git a/tests/core_tests/bulletproofs.h b/tests/core_tests/bulletproofs.h new file mode 100644 index 000000000..25d1cbb8b --- /dev/null +++ b/tests/core_tests/bulletproofs.h @@ -0,0 +1,170 @@ +// Copyright (c) 2014-2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// +// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers + +#pragma once +#include "chaingen.h" + +struct gen_bp_tx_validation_base : public test_chain_unit_base +{ + gen_bp_tx_validation_base() + : m_invalid_tx_index(0) + , m_invalid_block_index(0) + { + REGISTER_CALLBACK_METHOD(gen_bp_tx_validation_base, mark_invalid_tx); + REGISTER_CALLBACK_METHOD(gen_bp_tx_validation_base, mark_invalid_block); + } + + bool check_tx_verification_context(const cryptonote::tx_verification_context& tvc, bool tx_added, size_t event_idx, const cryptonote::transaction& /*tx*/) + { + if (m_invalid_tx_index == event_idx) + return tvc.m_verifivation_failed; + else + return !tvc.m_verifivation_failed && tx_added; + } + + bool check_tx_verification_context(const std::vector& tvcs, size_t tx_added, size_t event_idx, const std::vector& /*txs*/) + { + size_t failed = 0; + for (const cryptonote::tx_verification_context &tvc: tvcs) + if (tvc.m_verifivation_failed) + ++failed; + if (m_invalid_tx_index == event_idx) + return failed > 0; + else + return failed == 0 && tx_added == tvcs.size(); + } + + bool check_block_verification_context(const cryptonote::block_verification_context& bvc, size_t event_idx, const cryptonote::block& /*block*/) + { + if (m_invalid_block_index == event_idx) + return bvc.m_verifivation_failed; + else + return !bvc.m_verifivation_failed; + } + + bool mark_invalid_block(cryptonote::core& /*c*/, size_t ev_index, const std::vector& /*events*/) + { + m_invalid_block_index = ev_index + 1; + return true; + } + + bool mark_invalid_tx(cryptonote::core& /*c*/, size_t ev_index, const std::vector& /*events*/) + { + m_invalid_tx_index = ev_index + 1; + return true; + } + + bool generate_with(std::vector& events, const int *out_idx, int mixin, + size_t n_txes, const uint64_t *amounts_paid, bool valid, const bool *multi_out, + const std::function &sources, std::vector &destinations, size_t)> &pre_tx, + const std::function &post_tx) const; + + bool check_bp(const cryptonote::transaction &tx, size_t tx_idx, const size_t *sizes, const char *context) const; + +private: + size_t m_invalid_tx_index; + size_t m_invalid_block_index; +}; + +template<> +struct get_test_options { + const std::pair hard_forks[4] = {std::make_pair(1, 0), std::make_pair(2, 1), std::make_pair(8, 69), std::make_pair(0, 0)}; + const cryptonote::test_options test_options = { + hard_forks + }; +}; + +// valid +struct gen_bp_tx_valid_1 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_valid_1_1 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_valid_2 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_valid_4_2_1 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_valid_16_16 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_txs_valid_2_and_2 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_txs_valid_1_1_and_8_2_and_16_16_1 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_not_enough_proofs : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_too_many_proofs : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_wrong_amount : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_switched : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + diff --git a/tests/core_tests/chaingen.h b/tests/core_tests/chaingen.h index bbc9edd19..e44bcd37b 100644 --- a/tests/core_tests/chaingen.h +++ b/tests/core_tests/chaingen.h @@ -135,7 +135,7 @@ VARIANT_TAG(binary_archive, serialized_block, 0xcd); VARIANT_TAG(binary_archive, serialized_transaction, 0xce); VARIANT_TAG(binary_archive, event_visitor_settings, 0xcf); -typedef boost::variant test_event_entry; +typedef boost::variant, cryptonote::account_base, callback_entry, serialized_block, serialized_transaction, event_visitor_settings> test_event_entry; typedef std::unordered_map map_hash2tx_t; class test_chain_unit_base @@ -263,6 +263,30 @@ bool check_tx_verification_context(const cryptonote::tx_verification_context& tv } //-------------------------------------------------------------------------- template +auto do_check_tx_verification_context(const std::vector& tvcs, size_t tx_added, size_t event_index, const std::vector& txs, t_test_class& validator, int) + -> decltype(validator.check_tx_verification_context(tvcs, tx_added, event_index, txs)) +{ + return validator.check_tx_verification_context(tvcs, tx_added, event_index, txs); +} +//-------------------------------------------------------------------------- +template +bool do_check_tx_verification_context(const std::vector& tvcs, size_t tx_added, size_t /*event_index*/, const std::vector& /*txs*/, t_test_class&, long) +{ + // Default block verification context check + for (const cryptonote::tx_verification_context &tvc: tvcs) + if (tvc.m_verifivation_failed) + throw std::runtime_error("Transaction verification failed"); + return true; +} +//-------------------------------------------------------------------------- +template +bool check_tx_verification_context(const std::vector& tvcs, size_t tx_added, size_t event_index, const std::vector& txs, t_test_class& validator) +{ + // SFINAE in action + return do_check_tx_verification_context(tvcs, tx_added, event_index, txs, validator, 0); +} +//-------------------------------------------------------------------------- +template auto do_check_block_verification_context(const cryptonote::block_verification_context& bvc, size_t event_index, const cryptonote::block& blk, t_test_class& validator, int) -> decltype(validator.check_block_verification_context(bvc, event_index, blk)) { @@ -339,6 +363,26 @@ public: return true; } + bool operator()(const std::vector& txs) const + { + log_event("cryptonote::transaction"); + + std::vector tx_blobs; + std::vector tvcs; + cryptonote::tx_verification_context tvc0 = AUTO_VAL_INIT(tvc0); + for (const auto &tx: txs) + { + tx_blobs.push_back(t_serializable_object_to_blob(tx)); + tvcs.push_back(tvc0); + } + size_t pool_size = m_c.get_pool_transactions_count(); + m_c.handle_incoming_txs(tx_blobs, tvcs, m_txs_keeped_by_block, false, false); + size_t tx_added = m_c.get_pool_transactions_count() - pool_size; + bool r = check_tx_verification_context(tvcs, tx_added, m_ev_index, txs, m_validator); + CHECK_AND_NO_ASSERT_MES(r, false, "tx verification context check failed"); + return true; + } + bool operator()(const cryptonote::block& b) const { log_event("cryptonote::block"); diff --git a/tests/core_tests/chaingen_main.cpp b/tests/core_tests/chaingen_main.cpp index c31655070..f662c68df 100644 --- a/tests/core_tests/chaingen_main.cpp +++ b/tests/core_tests/chaingen_main.cpp @@ -224,6 +224,18 @@ int main(int argc, char* argv[]) GENERATE_AND_PLAY(gen_multisig_tx_invalid_33_1_2_no_threshold); GENERATE_AND_PLAY(gen_multisig_tx_invalid_33_1_3_no_threshold); + GENERATE_AND_PLAY(gen_bp_tx_valid_1); + GENERATE_AND_PLAY(gen_bp_tx_valid_1_1); + GENERATE_AND_PLAY(gen_bp_tx_valid_2); + GENERATE_AND_PLAY(gen_bp_tx_valid_4_2_1); + GENERATE_AND_PLAY(gen_bp_tx_valid_16_16); + GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_2); + GENERATE_AND_PLAY(gen_bp_txs_valid_1_1_and_8_2_and_16_16_1); + GENERATE_AND_PLAY(gen_bp_tx_invalid_not_enough_proofs); + GENERATE_AND_PLAY(gen_bp_tx_invalid_too_many_proofs); + GENERATE_AND_PLAY(gen_bp_tx_invalid_wrong_amount); + GENERATE_AND_PLAY(gen_bp_tx_invalid_switched); + el::Level level = (failed_tests.empty() ? el::Level::Info : el::Level::Error); MLOG(level, "\nREPORT:"); MLOG(level, " Test run: " << tests_count); diff --git a/tests/core_tests/chaingen_tests_list.h b/tests/core_tests/chaingen_tests_list.h index 174610d5d..c12e97f95 100644 --- a/tests/core_tests/chaingen_tests_list.h +++ b/tests/core_tests/chaingen_tests_list.h @@ -42,6 +42,7 @@ #include "v2_tests.h" #include "rct.h" #include "multisig.h" +#include "bulletproofs.h" /************************************************************************/ /* */ /************************************************************************/ diff --git a/tests/core_tests/rct.cpp b/tests/core_tests/rct.cpp index 55401c4cb..342c3f1ee 100644 --- a/tests/core_tests/rct.cpp +++ b/tests/core_tests/rct.cpp @@ -133,7 +133,7 @@ bool gen_rct_tx_validation_base::generate_with(std::vector& ev CHECK_AND_ASSERT_MES(r, false, "Failed to generate key derivation"); crypto::secret_key amount_key; crypto::derivation_to_scalar(derivation, o, amount_key); - if (rct_txes[n].rct_signatures.type == rct::RCTTypeSimple || rct_txes[n].rct_signatures.type == rct::RCTTypeSimpleBulletproof) + if (rct_txes[n].rct_signatures.type == rct::RCTTypeSimple || rct_txes[n].rct_signatures.type == rct::RCTTypeBulletproof) rct::decodeRctSimple(rct_txes[n].rct_signatures, rct::sk2rct(amount_key), o, rct_tx_masks[o+n*4], hw::get_device("default")); else rct::decodeRct(rct_txes[n].rct_signatures, rct::sk2rct(amount_key), o, rct_tx_masks[o+n*4], hw::get_device("default")); diff --git a/tests/performance_tests/check_tx_signature.h b/tests/performance_tests/check_tx_signature.h index 693ea1866..79132ccee 100644 --- a/tests/performance_tests/check_tx_signature.h +++ b/tests/performance_tests/check_tx_signature.h @@ -84,7 +84,7 @@ public: { if (rct) { - if (m_tx.rct_signatures.type == rct::RCTTypeFull || m_tx.rct_signatures.type == rct::RCTTypeFullBulletproof) + if (m_tx.rct_signatures.type == rct::RCTTypeFull) return rct::verRct(m_tx.rct_signatures); else return rct::verRctSimple(m_tx.rct_signatures); diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index db14c050a..077e02d5f 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -78,58 +78,62 @@ TEST(bulletproofs, multi_splitting) { rct::ctkeyV sc, pc; rct::ctkey sctmp, pctmp; + std::vector index; + std::vector inamounts, outamounts; std::tie(sctmp, pctmp) = rct::ctskpkGen(6000); sc.push_back(sctmp); pc.push_back(pctmp); + inamounts.push_back(6000); + index.push_back(1); std::tie(sctmp, pctmp) = rct::ctskpkGen(7000); sc.push_back(sctmp); pc.push_back(pctmp); + inamounts.push_back(7000); + index.push_back(1); const int mixin = 3, max_outputs = 16; for (int n_outputs = 1; n_outputs <= max_outputs; ++n_outputs) { - std::vector amounts; + std::vector outamounts; rct::keyV amount_keys; rct::keyV destinations; rct::key Sk, Pk; uint64_t available = 6000 + 7000; uint64_t amount; - rct::ctkeyM mixRing(mixin+1); + rct::ctkeyM mixRing(sc.size()); //add output for (size_t i = 0; i < n_outputs; ++i) { amount = rct::randXmrAmount(available); - amounts.push_back(amount); + outamounts.push_back(amount); amount_keys.push_back(rct::hash_to_scalar(rct::zero())); rct::skpkGen(Sk, Pk); destinations.push_back(Pk); available -= amount; } - if (!amounts.empty()) - amounts.back() += available; - for (size_t j = 0; j <= mixin; ++j) + for (size_t i = 0; i < sc.size(); ++i) { - for (size_t i = 0; i < sc.size(); ++i) + for (size_t j = 0; j <= mixin; ++j) { if (j == 1) - mixRing[j].push_back(pc[i]); + mixRing[i].push_back(pc[i]); else - mixRing[j].push_back({rct::scalarmultBase(rct::skGen()), rct::scalarmultBase(rct::skGen())}); + mixRing[i].push_back({rct::scalarmultBase(rct::skGen()), rct::scalarmultBase(rct::skGen())}); } } rct::ctkeyV outSk; - rct::rctSig s = rct::genRct(rct::zero(), sc, destinations, amounts, mixRing, amount_keys, NULL, NULL, 1, outSk, rct::RangeProofMultiOutputBulletproof, hw::get_device("default")); - ASSERT_TRUE(rct::verRct(s)); + rct::rctSig s = rct::genRctSimple(rct::zero(), sc, destinations, inamounts, outamounts, available, mixRing, amount_keys, NULL, NULL, index, outSk, rct::RangeProofMultiOutputBulletproof, hw::get_device("default")); + ASSERT_TRUE(rct::verRctSimple(s)); for (size_t i = 0; i < n_outputs; ++i) { rct::key mask; - rct::decodeRct(s, amount_keys[i], i, mask, hw::get_device("default")); + rct::decodeRctSimple(s, amount_keys[i], i, mask, hw::get_device("default")); ASSERT_TRUE(mask == outSk[i].mask); } } From 7e67c52fa2a4ee68437a5fd906d9848a2f0a7150 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 30 Mar 2018 20:44:51 +0100 Subject: [PATCH 20/56] Add a define for the max number of bulletproof multi-outputs --- src/cryptonote_config.h | 2 ++ src/ringct/bulletproofs.cc | 3 ++- src/ringct/rctSigs.cpp | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/cryptonote_config.h b/src/cryptonote_config.h index a0dcf2df1..00bc2f275 100644 --- a/src/cryptonote_config.h +++ b/src/cryptonote_config.h @@ -141,6 +141,8 @@ #define DEFAULT_TXPOOL_MAX_SIZE 648000000ull // 3 days at 300000, in bytes +#define BULLETPROOF_MAX_OUTPUTS 16 + // New constants are intended to go here namespace config { diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 94be0e545..dc5918738 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -33,6 +33,7 @@ #include #include "misc_log_ex.h" #include "common/perf_timer.h" +#include "cryptonote_config.h" extern "C" { #include "crypto/crypto-ops.h" @@ -57,7 +58,7 @@ static rct::keyV vector_dup(const rct::key &x, size_t n); static rct::key inner_product(const rct::keyV &a, const rct::keyV &b); static constexpr size_t maxN = 64; -static constexpr size_t maxM = 16; +static constexpr size_t maxM = BULLETPROOF_MAX_OUTPUTS; static rct::key Hi[maxN*maxM], Gi[maxN*maxM]; static ge_p3 Hi_p3[maxN*maxM], Gi_p3[maxN*maxM]; static ge_dsmp Gprecomp[maxN*maxM], Hprecomp[maxN*maxM]; diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index 2175d1659..d2dc87e27 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -762,7 +762,7 @@ namespace rct { { size_t batch_size = 1; if (range_proof_type == RangeProofMultiOutputBulletproof) - while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= 16) + while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= BULLETPROOF_MAX_OUTPUTS) batch_size *= 2; rct::keyV C, masks; std::vector batch_amounts(batch_size); From c444b1b22922b423256c6d15887a27e77d060d7f Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sat, 31 Mar 2018 10:49:53 +0100 Subject: [PATCH 21/56] require canonical multi output bulletproof layout --- src/cryptonote_core/cryptonote_core.cpp | 29 +++++++++++++++++++++++++ tests/core_tests/bulletproofs.cpp | 14 ++++++------ tests/core_tests/bulletproofs.h | 8 +++---- tests/core_tests/chaingen_main.cpp | 4 ++-- 4 files changed, 42 insertions(+), 13 deletions(-) diff --git a/src/cryptonote_core/cryptonote_core.cpp b/src/cryptonote_core/cryptonote_core.cpp index f1a666814..f9e0b68d0 100644 --- a/src/cryptonote_core/cryptonote_core.cpp +++ b/src/cryptonote_core/cryptonote_core.cpp @@ -745,6 +745,25 @@ namespace cryptonote bad_semantics_txes_lock.unlock(); } //----------------------------------------------------------------------------------------------- + static bool is_canonical_bulletproof_layout(const std::vector &proofs) + { + size_t n_amounts = rct::n_bulletproof_amounts(proofs), amounts_proved = 0; + size_t n = 0; + while (amounts_proved < n_amounts) + { + if (n >= proofs.size()) + return false; + size_t batch_size = 1; + while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= BULLETPROOF_MAX_OUTPUTS) + batch_size *= 2; + if (rct::n_bulletproof_amounts(proofs[n]) != batch_size) + return false; + amounts_proved += batch_size; + ++n; + } + return true; + } + //----------------------------------------------------------------------------------------------- bool core::handle_incoming_tx_accumulated_batch(std::vector &tx_info, bool keeped_by_block) { bool ret = true; @@ -797,6 +816,16 @@ namespace cryptonote } break; case rct::RCTTypeBulletproof: + // in addition to valid bulletproofs, we want multi-out + // proofs to be in decreasing power of 2 constituents + if (!is_canonical_bulletproof_layout(rv.p.bulletproofs)) + { + MERROR_VER("Bulletproof does not use decreasing power of 2 rule"); + set_semantics_failed(tx_info[n].tx_hash); + tx_info[n].tvc.m_verifivation_failed = true; + tx_info[n].result = false; + break; + } rvv.push_back(&rv); // delayed batch verification break; default: diff --git a/tests/core_tests/bulletproofs.cpp b/tests/core_tests/bulletproofs.cpp index 3f2a2567c..a675b2c59 100644 --- a/tests/core_tests/bulletproofs.cpp +++ b/tests/core_tests/bulletproofs.cpp @@ -215,14 +215,14 @@ bool gen_bp_tx_valid_1::generate(std::vector& events) const return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1"); }); } -bool gen_bp_tx_valid_1_1::generate(std::vector& events) const +bool gen_bp_tx_invalid_1_1::generate(std::vector& events) const { const int mixin = 6; const int out_idx[] = {1, -1}; const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; const size_t bp_sizes[] = {1, 1, (size_t)-1}; const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1_1"); }); + return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_invalid_1_1"); }); } bool gen_bp_tx_valid_2::generate(std::vector& events) const @@ -265,13 +265,13 @@ bool gen_bp_txs_valid_2_and_2::generate(std::vector& events) c return generate_with(events, out_idx, mixin, 2, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_2_2"); }); } -bool gen_bp_txs_valid_1_1_and_8_2_and_16_16_1::generate(std::vector& events) const +bool gen_bp_txs_valid_2_and_8_2_and_16_16_1::generate(std::vector& events) const { const int mixin = 6; const int out_idx[] = {1, -1}; const uint64_t amounts_paid[] = {1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; - const bool multi_out[] = {false, true, true}; - const size_t bp_sizes[] = {1, 1, (size_t)-1, 8, 2, (size_t)-1, 16, 16, 1, (size_t)-1}; + const bool multi_out[] = {true, true, true}; + const size_t bp_sizes[] = {2, (size_t)-1, 8, 2, (size_t)-1, 16, 16, 1, (size_t)-1}; return generate_with(events, out_idx, mixin, 3, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_1_1_and_8_2_and_16_16_1"); }); } @@ -325,8 +325,8 @@ bool gen_bp_tx_invalid_switched::generate(std::vector& events) DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_switched"); const int mixin = 6; const int out_idx[] = {1, -1}; - const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; - const bool multi_out[] = {false}; + const uint64_t amounts_paid[] = {1001, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; + const bool multi_out[] = {true}; return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t tx_idx){ CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); CHECK_TEST_CONDITION(tx.rct_signatures.p.bulletproofs.size() == 2); diff --git a/tests/core_tests/bulletproofs.h b/tests/core_tests/bulletproofs.h index 25d1cbb8b..d3b65f5bd 100644 --- a/tests/core_tests/bulletproofs.h +++ b/tests/core_tests/bulletproofs.h @@ -108,11 +108,11 @@ struct gen_bp_tx_valid_1 : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; -struct gen_bp_tx_valid_1_1 : public gen_bp_tx_validation_base +struct gen_bp_tx_invalid_1_1 : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; +template<> struct get_test_options: public get_test_options {}; struct gen_bp_tx_valid_2 : public gen_bp_tx_validation_base { @@ -138,11 +138,11 @@ struct gen_bp_txs_valid_2_and_2 : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; -struct gen_bp_txs_valid_1_1_and_8_2_and_16_16_1 : public gen_bp_tx_validation_base +struct gen_bp_txs_valid_2_and_8_2_and_16_16_1 : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; +template<> struct get_test_options: public get_test_options {}; struct gen_bp_tx_invalid_not_enough_proofs : public gen_bp_tx_validation_base { diff --git a/tests/core_tests/chaingen_main.cpp b/tests/core_tests/chaingen_main.cpp index f662c68df..60de110fa 100644 --- a/tests/core_tests/chaingen_main.cpp +++ b/tests/core_tests/chaingen_main.cpp @@ -225,12 +225,12 @@ int main(int argc, char* argv[]) GENERATE_AND_PLAY(gen_multisig_tx_invalid_33_1_3_no_threshold); GENERATE_AND_PLAY(gen_bp_tx_valid_1); - GENERATE_AND_PLAY(gen_bp_tx_valid_1_1); + GENERATE_AND_PLAY(gen_bp_tx_invalid_1_1); GENERATE_AND_PLAY(gen_bp_tx_valid_2); GENERATE_AND_PLAY(gen_bp_tx_valid_4_2_1); GENERATE_AND_PLAY(gen_bp_tx_valid_16_16); GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_2); - GENERATE_AND_PLAY(gen_bp_txs_valid_1_1_and_8_2_and_16_16_1); + GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_8_2_and_16_16_1); GENERATE_AND_PLAY(gen_bp_tx_invalid_not_enough_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_too_many_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_wrong_amount); From 3011178021690d31e031ed66ed56d5a7300005d2 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 2 Apr 2018 15:09:10 +0100 Subject: [PATCH 22/56] unit_tests: a couple more bulletproof unit tests for gamma --- tests/unit_tests/bulletproofs.cpp | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index 077e02d5f..f163f7a20 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -174,3 +174,22 @@ TEST(bulletproofs, invalid_31) rct::Bulletproof proof = bulletproof_PROVE(invalid_amount, rct::skGen()); ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); } + +TEST(bulletproofs, invalid_gamma_0) +{ + rct::key invalid_amount = rct::zero(); + invalid_amount[8] = 1; + rct::key gamma = rct::zero(); + rct::Bulletproof proof = bulletproof_PROVE(invalid_amount, gamma); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); +} + +TEST(bulletproofs, invalid_gamma_ff) +{ + rct::key invalid_amount = rct::zero(); + invalid_amount[8] = 1; + rct::key gamma = rct::zero(); + memset(&gamma, 0xff, sizeof(gamma)); + rct::Bulletproof proof = bulletproof_PROVE(invalid_amount, gamma); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); +} From ef56529f9325ece4a67ac11969a585cbe5b75c4d Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 22 May 2018 00:48:09 +0100 Subject: [PATCH 23/56] performance_tests: document the tested bulletproof layouts --- tests/performance_tests/main.cpp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index ea23ec9ea..912376595 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -177,25 +177,25 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, verbose, test_range_proof, true); TEST_PERFORMANCE1(filter, verbose, test_range_proof, false); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 1); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 1); // 1 bulletproof with 1 amount TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 1); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 2); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 2); // 1 bulletproof with 2 amounts TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 2); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 15); + TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 15); // 1 bulletproof with 15 amounts TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 15); TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 4); // 4 proofs, each with 2 amounts TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 8, 1, 1, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 8, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 8, 1, 1, 0, 4); // 4 proofs, each with 8 amounts TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 1, 2, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 1, 2, 0, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 1, 2, 0, 4); // 4 proofs with 1, 2, 4, 8 amounts TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 8, 1, 1, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 8, 1, 1, 4); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 8, 1, 1, 4); // 32 proofs, with 1, 2, 3, 4 amounts, 8 of each TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 64); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 64); + TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 64); // 64 proof, each with 2 amounts TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); From 1b867e7f4087378a04a0b94d720d3bed8505e245 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 24 May 2018 20:14:09 +0100 Subject: [PATCH 24/56] precalc the ge_p3 representation of H --- src/crypto/crypto-ops-data.c | 6 ++++++ src/crypto/crypto-ops.h | 1 + src/ringct/bulletproofs.cc | 22 +++++++++++----------- src/ringct/rctOps.cpp | 4 +--- tests/unit_tests/ringct.cpp | 7 +++++++ 5 files changed, 26 insertions(+), 14 deletions(-) diff --git a/src/crypto/crypto-ops-data.c b/src/crypto/crypto-ops-data.c index 4ff4310de..1f77513ca 100644 --- a/src/crypto/crypto-ops-data.c +++ b/src/crypto/crypto-ops-data.c @@ -871,3 +871,9 @@ const fe fe_fffb2 = {8166131, -6741800, -17040804, 3154616, 21461005, 1466302, - const fe fe_fffb3 = {-13620103, 14639558, 4532995, 7679154, 16815101, -15883539, -22863840, -14813421, 13716513, -6477756}; /* sqrt(-sqrt(-1) * A * (A + 2)) */ const fe fe_fffb4 = {-21786234, -12173074, 21573800, 4524538, -4645904, 16204591, 8012863, -8444712, 3212926, 6885324}; /* sqrt(sqrt(-1) * A * (A + 2)) */ const ge_p3 ge_p3_identity = { {0}, {1, 0}, {1, 0}, {0} }; +const ge_p3 ge_p3_H = { + {7329926, -15101362, 31411471, 7614783, 27996851, -3197071, -11157635, -6878293, 466949, -7986503}, + {5858699, 5096796, 21321203, -7536921, -5553480, -11439507, -5627669, 15045946, 19977121, 5275251}, + {1, 0, 0, 0, 0, 0, 0, 0, 0, 0}, + {23443568, -5110398, -8776029, -4345135, 6889568, -14710814, 7474843, 3279062, 14550766, -7453428} +}; diff --git a/src/crypto/crypto-ops.h b/src/crypto/crypto-ops.h index dc3c60794..52854889f 100644 --- a/src/crypto/crypto-ops.h +++ b/src/crypto/crypto-ops.h @@ -140,6 +140,7 @@ extern const fe fe_fffb2; extern const fe fe_fffb3; extern const fe fe_fffb4; extern const ge_p3 ge_p3_identity; +extern const ge_p3 ge_p3_H; void ge_fromfe_frombytes_vartime(ge_p2 *, const unsigned char *); void sc_0(unsigned char *); void sc_reduce32(unsigned char *); diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index dc5918738..884c99537 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -521,8 +521,8 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) // PAPER LINES 47-48 rct::key tau1 = rct::skGen(), tau2 = rct::skGen(); - rct::key T1 = rct::addKeys(rct::scalarmultKey(rct::H, t1), rct::scalarmultBase(tau1)); - rct::key T2 = rct::addKeys(rct::scalarmultKey(rct::H, t2), rct::scalarmultBase(tau2)); + rct::key T1 = rct::addKeys(rct::scalarmultH(t1), rct::scalarmultBase(tau1)); + rct::key T2 = rct::addKeys(rct::scalarmultH(t2), rct::scalarmultBase(tau2)); // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); @@ -592,10 +592,10 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) // PAPER LINES 18-19 L[round] = vector_exponent_custom(slice(Gprime, nprime, Gprime.size()), slice(Hprime, 0, nprime), slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); sc_mul(tmp.bytes, cL.bytes, x_ip.bytes); - rct::addKeys(L[round], L[round], rct::scalarmultKey(rct::H, tmp)); + rct::addKeys(L[round], L[round], rct::scalarmultH(tmp)); R[round] = vector_exponent_custom(slice(Gprime, 0, nprime), slice(Hprime, nprime, Hprime.size()), slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); sc_mul(tmp.bytes, cR.bytes, x_ip.bytes); - rct::addKeys(R[round], R[round], rct::scalarmultKey(rct::H, tmp)); + rct::addKeys(R[round], R[round], rct::scalarmultH(tmp)); // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); @@ -764,8 +764,8 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 47-48 rct::key tau1 = rct::skGen(), tau2 = rct::skGen(); - rct::key T1 = rct::addKeys(rct::scalarmultKey(rct::H, t1), rct::scalarmultBase(tau1)); - rct::key T2 = rct::addKeys(rct::scalarmultKey(rct::H, t2), rct::scalarmultBase(tau2)); + rct::key T1 = rct::addKeys(rct::scalarmultH(t1), rct::scalarmultBase(tau1)); + rct::key T2 = rct::addKeys(rct::scalarmultH(t2), rct::scalarmultBase(tau2)); // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); @@ -842,10 +842,10 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 18-19 L[round] = vector_exponent_custom(slice(Gprime, nprime, Gprime.size()), slice(Hprime, 0, nprime), slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); sc_mul(tmp.bytes, cL.bytes, x_ip.bytes); - rct::addKeys(L[round], L[round], rct::scalarmultKey(rct::H, tmp)); + rct::addKeys(L[round], L[round], rct::scalarmultH(tmp)); R[round] = vector_exponent_custom(slice(Gprime, 0, nprime), slice(Hprime, nprime, Hprime.size()), slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); sc_mul(tmp.bytes, cR.bytes, x_ip.bytes); - rct::addKeys(R[round], R[round], rct::scalarmultKey(rct::H, tmp)); + rct::addKeys(R[round], R[round], rct::scalarmultH(tmp)); // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); @@ -964,7 +964,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); std::vector multiexp_data; multiexp_data.reserve(3+proof.V.size()); - multiexp_data.emplace_back(tmp, rct::H); + multiexp_data.emplace_back(tmp, ge_p3_H); for (size_t j = 0; j < proof.V.size(); j++) { multiexp_data.emplace_back(zpow[j+2], proof.V[j]); @@ -980,7 +980,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) { PERF_TIMER_START_BP(VERIFY_line_61rl_old); sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); - L61Right = rct::scalarmultKey(rct::H, tmp); + L61Right = rct::scalarmultH(tmp); ge_p3 L61Right_p3; CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); for (size_t j = 0; j+1 < proof.V.size(); j += 2) @@ -1118,7 +1118,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_sub(tmp.bytes, rct::zero().bytes, z1.bytes); rct::addKeys(Y, Y, rct::scalarmultBase(tmp)); rct::addKeys(Y, Y, Z2); - rct::addKeys(Y, Y, rct::scalarmultKey(rct::H, z3)); + rct::addKeys(Y, Y, rct::scalarmultH(z3)); std::vector multiexp_data; multiexp_data.reserve(2 * maxMN); diff --git a/src/ringct/rctOps.cpp b/src/ringct/rctOps.cpp index 50693bad7..fe0ad8747 100644 --- a/src/ringct/rctOps.cpp +++ b/src/ringct/rctOps.cpp @@ -193,10 +193,8 @@ namespace rct { //Computes aH where H= toPoint(cn_fast_hash(G)), G the basepoint key scalarmultH(const key & a) { - ge_p3 A; ge_p2 R; - CHECK_AND_ASSERT_THROW_MES_L1(ge_frombytes_vartime(&A, H.bytes) == 0, "ge_frombytes_vartime failed at "+boost::lexical_cast(__LINE__)); - ge_scalarmult(&R, a.bytes, &A); + ge_scalarmult(&R, a.bytes, &ge_p3_H); key aP; ge_tobytes(aP.bytes, &R); return aP; diff --git a/tests/unit_tests/ringct.cpp b/tests/unit_tests/ringct.cpp index d4e942176..360529b9e 100644 --- a/tests/unit_tests/ringct.cpp +++ b/tests/unit_tests/ringct.cpp @@ -1086,6 +1086,13 @@ TEST(ringct, zeroCommmit) ASSERT_EQ(z, manual); } +TEST(ringct, H) +{ + ge_p3 p3; + ASSERT_EQ(ge_frombytes_vartime(&p3, rct::H.bytes), 0); + ASSERT_EQ(memcmp(&p3, &ge_p3_H, sizeof(ge_p3)), 0); +} + TEST(ringct, aggregated) { static const size_t N_PROOFS = 16; From 1ed0ed4de46dbb93dd1030a68f2239615fb80eb6 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sat, 26 May 2018 23:19:21 +0100 Subject: [PATCH 25/56] multiexp: cut down on memory allocations --- src/ringct/multiexp.cc | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 99bef25f3..52c6feb71 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -394,37 +394,35 @@ rct::key straus(const std::vector &data, const std::shared_ptr> digits; - digits.resize(data.size()); + std::unique_ptr digits{new uint8_t[256 * data.size()]}; for (size_t j = 0; j < data.size(); ++j) { - digits[j].resize(256); unsigned char bytes33[33]; memcpy(bytes33, data[j].scalar.bytes, 32); bytes33[32] = 0; + const unsigned char *bytes = bytes33; #if 1 static_assert(STRAUS_C == 4, "optimized version needs STRAUS_C == 4"); - const unsigned char *bytes = bytes33; unsigned int i; for (i = 0; i < 256; i += 8, bytes++) { - digits[j][i] = bytes[0] & 0xf; - digits[j][i+1] = (bytes[0] >> 1) & 0xf; - digits[j][i+2] = (bytes[0] >> 2) & 0xf; - digits[j][i+3] = (bytes[0] >> 3) & 0xf; - digits[j][i+4] = ((bytes[0] >> 4) | (bytes[1]<<4)) & 0xf; - digits[j][i+5] = ((bytes[0] >> 5) | (bytes[1]<<3)) & 0xf; - digits[j][i+6] = ((bytes[0] >> 6) | (bytes[1]<<2)) & 0xf; - digits[j][i+7] = ((bytes[0] >> 7) | (bytes[1]<<1)) & 0xf; + digits[j*256+i] = bytes[0] & 0xf; + digits[j*256+i+1] = (bytes[0] >> 1) & 0xf; + digits[j*256+i+2] = (bytes[0] >> 2) & 0xf; + digits[j*256+i+3] = (bytes[0] >> 3) & 0xf; + digits[j*256+i+4] = ((bytes[0] >> 4) | (bytes[1]<<4)) & 0xf; + digits[j*256+i+5] = ((bytes[0] >> 5) | (bytes[1]<<3)) & 0xf; + digits[j*256+i+6] = ((bytes[0] >> 6) | (bytes[1]<<2)) & 0xf; + digits[j*256+i+7] = ((bytes[0] >> 7) | (bytes[1]<<1)) & 0xf; } #elif 1 for (size_t i = 0; i < 256; ++i) - digits[j][i] = ((bytes[i>>3] | (bytes[(i>>3)+1]<<8)) >> (i&7)) & mask; + digits[j*256+i] = ((bytes[i>>3] | (bytes[(i>>3)+1]<<8)) >> (i&7)) & mask; #else rct::key shifted = data[j].scalar; for (size_t i = 0; i < 256; ++i) { - digits[j][i] = shifted.bytes[0] & 0xf; + digits[j*256+i] = shifted.bytes[0] & 0xf; shifted = div2(shifted, (256-i)>>3); } #endif @@ -470,7 +468,7 @@ skipfirst: if (skip[j]) continue; #endif - const uint8_t digit = digits[j][i]; + const uint8_t digit = digits[j*256+i]; if (digit) { ge_add(&p1, &band_p3, &CACHE_OFFSET(local_cache, j, digit)); From 263431c486bcaddf442c912cf56171a778322316 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 28 May 2018 00:27:54 +0100 Subject: [PATCH 26/56] Pippenger multiexp Based on sarang's python code --- src/ringct/bulletproofs.cc | 6 +- src/ringct/multiexp.cc | 133 +++++++++++++++++++++++++++ src/ringct/multiexp.h | 2 + tests/performance_tests/main.cpp | 142 +++++++++++++++++++++++++++++ tests/performance_tests/multiexp.h | 5 +- 5 files changed, 284 insertions(+), 4 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 884c99537..83005eaa4 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -72,10 +72,10 @@ static boost::mutex init_mutex; static inline rct::key multiexp(const std::vector &data, bool HiGi) { static const size_t STEP = getenv("STRAUS_STEP") ? atoi(getenv("STRAUS_STEP")) : 0; - if (HiGi || data.size() < 1000) - return straus(data, HiGi ? HiGi_cache: NULL, STEP); + if (HiGi) + return data.size() <= 256 ? straus(data, HiGi_cache, STEP) : pippenger(data, get_pippenger_c(data.size())); else - return bos_coster_heap_conv_robust(data); + return data.size() <= 64 ? straus(data, NULL, STEP) : pippenger(data, get_pippenger_c(data.size())); } //addKeys3acc_p3 diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 52c6feb71..fd2d1cbd7 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -55,6 +55,30 @@ extern "C" // 1 0 52.7 67 67.1 // 1 1 52.8 70.4 70.2 +// Pippenger: +// 1 2 3 4 5 6 7 8 9 bestN +// 2 555 598 621 804 1038 1733 2486 5020 8304 1 +// 4 783 747 800 1006 1428 2132 3285 5185 9806 2 +// 8 1174 1071 1095 1286 1640 2398 3869 6378 12080 2 +// 16 2279 1874 1745 1739 2144 2831 4209 6964 12007 4 +// 32 3910 3706 2588 2477 2782 3467 4856 7489 12618 4 +// 64 7184 5429 4710 4368 4010 4672 6027 8559 13684 5 +// 128 14097 10574 8452 7297 6841 6718 8615 10580 15641 6 +// 256 27715 20800 16000 13550 11875 11400 11505 14090 18460 6 +// 512 55100 41250 31740 26570 22030 19830 20760 21380 25215 6 +// 1024 111520 79000 61080 49720 43080 38320 37600 35040 36750 8 +// 2048 219480 162680 122120 102080 83760 70360 66600 63920 66160 8 +// 4096 453320 323080 247240 210200 180040 150240 132440 114920 110560 9 + +// 2 4 8 16 32 64 128 256 512 1024 2048 4096 +// Bos Coster 858 994 1316 1949 3183 5512 9865 17830 33485 63160 124280 246320 +// Straus 226 341 548 980 1870 3538 7039 14490 29020 57200 118640 233640 +// Straus/cached 226 315 485 785 1514 2858 5753 11065 22970 45120 98880 194840 +// Pippenger 555 747 1071 1739 2477 4010 6718 11400 19830 35040 63920 110560 + +// Best/cached Straus Straus Straus Straus Straus Straus Straus Straus Pip Pip Pip Pip +// Best/uncached Straus Straus Straus Straus Straus Straus Pip Pip Pip Pip Pip Pip + namespace rct { @@ -91,6 +115,26 @@ static inline rct::key pow2(size_t n) return res; } +static inline int test(const rct::key &k, size_t n) +{ + if (n >= 256) return 0; + return k[n >> 3] & (1 << (n & 7)); +} + +static inline void add(ge_p3 &p3, const ge_cached &other) +{ + ge_p1p1 p1; + ge_add(&p1, &p3, &other); + ge_p1p1_to_p3(&p3, &p1); +} + +static inline void add(ge_p3 &p3, const ge_p3 &other) +{ + ge_cached cached; + ge_p3_to_cached(&cached, &other); + add(p3, cached); +} + rct::key bos_coster_heap_conv(std::vector data) { MULTIEXP_PERF(PERF_TIMER_START_UNIT(bos_coster, 1000000)); @@ -487,4 +531,93 @@ skipfirst: return res; } +size_t get_pippenger_c(size_t N) +{ +// 2:1, 4:2, 8:2, 16:3, 32:4, 64:4, 128:5, 256:6, 512:7, 1024:7, 2048:8, 4096:9 + if (N <= 2) return 1; + if (N <= 8) return 2; + if (N <= 16) return 3; + if (N <= 64) return 4; + if (N <= 128) return 5; + if (N <= 256) return 6; + if (N <= 1024) return 7; + if (N <= 2048) return 8; + return 9; +} + +rct::key pippenger(const std::vector &data, size_t c) +{ + CHECK_AND_ASSERT_THROW_MES(c <= 9, "c is too large"); + + ge_p3 result = ge_p3_identity; + std::unique_ptr buckets{new ge_p3[1< cached_points{new ge_cached[data.size()]}; + + for (size_t i = 0; i < data.size(); ++i) + { + ge_p3_to_cached(&cached_points[i], &data[i].point); + } + + rct::key maxscalar = rct::zero(); + for (size_t i = 0; i < data.size(); ++i) + if (maxscalar < data[i].scalar) + maxscalar = data[i].scalar; + size_t groups = 0; + while (groups < 256 && pow2(groups) < maxscalar) + ++groups; + groups = (groups + c - 1) / c; + + for (size_t k = groups; k-- > 0; ) + { + if (memcmp(&result, &ge_p3_identity, sizeof(ge_p3))) + { + ge_p2 p2; + ge_p3_to_p2(&p2, &result); + for (size_t i = 0; i < c; ++i) + { + ge_p1p1 p1; + ge_p2_dbl(&p1, &p2); + if (i == c - 1) + ge_p1p1_to_p3(&result, &p1); + else + ge_p1p1_to_p2(&p2, &p1); + } + } + for (size_t i = 0; i < (1u< 0; --i) + { + if (memcmp(&buckets[i], &ge_p3_identity, sizeof(ge_p3))) + add(pail, buckets[i]); + if (memcmp(&pail, &ge_p3_identity, sizeof(ge_p3))) + add(result, pail); + } + } + + rct::key res; + ge_p3_tobytes(res.bytes, &result); + return res; +} + } diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h index c08c70858..2ed8db279 100644 --- a/src/ringct/multiexp.h +++ b/src/ringct/multiexp.h @@ -60,6 +60,8 @@ rct::key bos_coster_heap_conv_robust(std::vector data); std::shared_ptr straus_init_cache(const std::vector &data); size_t straus_get_cache_size(const std::shared_ptr &cache); rct::key straus(const std::vector &data, const std::shared_ptr &cache = NULL, size_t STEP = 0); +size_t get_pippenger_c(size_t N); +rct::key pippenger(const std::vector &data, size_t c); } diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 912376595..c3e1bb4e0 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -222,26 +222,168 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys3_2); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 4); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 8); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 32); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 64); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 128); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 512); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2048); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 4096); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 8); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 32); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 64); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 128); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 512); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 2048); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4096); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 2); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 4); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 8); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 16); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 32); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 64); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 128); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 256); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 512); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 1024); + TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 2048); TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 4096); +#if 1 + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 9); +#else + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 9); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 1); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 2); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 3); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 4); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 5); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 6); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 7); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 8); + TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 9); +#endif + std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; return 0; diff --git a/tests/performance_tests/multiexp.h b/tests/performance_tests/multiexp.h index ab5af166b..294e74116 100644 --- a/tests/performance_tests/multiexp.h +++ b/tests/performance_tests/multiexp.h @@ -39,9 +39,10 @@ enum test_multiexp_algorithm multiexp_bos_coster, multiexp_straus, multiexp_straus_cached, + multiexp_pippenger, }; -template +template class test_multiexp { public: @@ -74,6 +75,8 @@ public: return res == straus(data); case multiexp_straus_cached: return res == straus(data, cache); + case multiexp_pippenger: + return res == pippenger(data, c); default: return false; } From d126a02b5de6989d045f92cedf0408e251648f87 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 28 May 2018 12:54:11 +0100 Subject: [PATCH 27/56] performance_tests: add aggregated bulletproof tx verification --- tests/performance_tests/check_tx_signature.h | 71 ++++++++++++++++++++ tests/performance_tests/main.cpp | 10 +++ 2 files changed, 81 insertions(+) diff --git a/tests/performance_tests/check_tx_signature.h b/tests/performance_tests/check_tx_signature.h index 79132ccee..bcd3b3dfe 100644 --- a/tests/performance_tests/check_tx_signature.h +++ b/tests/performance_tests/check_tx_signature.h @@ -101,3 +101,74 @@ private: cryptonote::transaction m_tx; crypto::hash m_tx_prefix_hash; }; + +template +class test_check_tx_signature_aggregated_bulletproofs : private multi_tx_test_base +{ + static_assert(0 < a_ring_size, "ring_size must be greater than 0"); + +public: + static const size_t loop_count = a_ring_size <= 2 ? 50 : 10; + static const size_t ring_size = a_ring_size; + static const size_t outputs = a_outputs; + + typedef multi_tx_test_base base_class; + + bool init() + { + using namespace cryptonote; + + if (!base_class::init()) + return false; + + m_alice.generate(); + + std::vector destinations; + destinations.push_back(tx_destination_entry(this->m_source_amount - outputs + 1, m_alice.get_keys().m_account_address, false)); + for (size_t n = 1; n < outputs; ++n) + destinations.push_back(tx_destination_entry(1, m_alice.get_keys().m_account_address, false)); + + crypto::secret_key tx_key; + std::vector additional_tx_keys; + std::unordered_map subaddresses; + subaddresses[this->m_miners[this->real_source_idx].get_keys().m_account_address.m_spend_public_key] = {0,0}; + + m_txes.resize(a_num_txes + (extra_outs > 0 ? 1 : 0)); + for (size_t n = 0; n < a_num_txes; ++n) + { + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_txes[n], 0, tx_key, additional_tx_keys, true, rct::RangeProofMultiOutputBulletproof)) + return false; + } + + if (extra_outs) + { + destinations.clear(); + destinations.push_back(tx_destination_entry(this->m_source_amount - extra_outs + 1, m_alice.get_keys().m_account_address, false)); + for (size_t n = 1; n < extra_outs; ++n) + destinations.push_back(tx_destination_entry(1, m_alice.get_keys().m_account_address, false)); + + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_txes.back(), 0, tx_key, additional_tx_keys, true, rct::RangeProofMultiOutputBulletproof)) + return false; + } + + return true; + } + + bool test() + { + std::vector rvv; + rvv.reserve(m_txes.size()); + for (size_t n = 0; n < m_txes.size(); ++n) + { + const rct::rctSig &rv = m_txes[n].rct_signatures; + if (!rct::verRctNonSemanticsSimple(rv)) + return false; + rvv.push_back(&rv); + } + return rct::verRctSemanticsSimple(rvv); + } + +private: + cryptonote::account_base m_alice; + std::vector m_txes; +}; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index c3e1bb4e0..abcc2a3d0 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -141,6 +141,16 @@ int main(int argc, char** argv) TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, true, true); TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, true, true); + TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 64); + TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 64); + TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 100, 2, 64); + TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 10, 64); + + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 62, 4); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 62, 4); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 56, 16); + TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 56, 16); + TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc); TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc_precomp); TEST_PERFORMANCE0(filter, verbose, test_generate_key_image_helper); From 7314d919e7a600545c10c8ebced8e44769c7f43f Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 28 May 2018 19:16:25 +0100 Subject: [PATCH 28/56] perf_timer: split timer class into a base one and a logging one --- src/common/perf_timer.cpp | 26 +++++++++++++++++++------- src/common/perf_timer.h | 32 ++++++++++++++++++++++++-------- 2 files changed, 43 insertions(+), 15 deletions(-) diff --git a/src/common/perf_timer.cpp b/src/common/perf_timer.cpp index 16abdfd99..6910ebdd4 100644 --- a/src/common/perf_timer.cpp +++ b/src/common/perf_timer.cpp @@ -33,7 +33,7 @@ #undef MONERO_DEFAULT_LOG_CATEGORY #define MONERO_DEFAULT_LOG_CATEGORY "perf" -namespace +namespace tools { uint64_t get_tick_count() { @@ -83,7 +83,7 @@ namespace tools el::Level performance_timer_log_level = el::Level::Debug; -static __thread std::vector *performance_timers = NULL; +static __thread std::vector *performance_timers = NULL; void set_performance_timer_log_level(el::Level level) { @@ -96,17 +96,24 @@ void set_performance_timer_log_level(el::Level level) performance_timer_log_level = level; } -PerformanceTimer::PerformanceTimer(const std::string &s, uint64_t unit, el::Level l): name(s), unit(unit), level(l), started(false), paused(false) +PerformanceTimer::PerformanceTimer(bool paused): started(true), paused(paused) +{ + if (paused) + ticks = 0; + else + ticks = get_tick_count(); +} + +LoggingPerformanceTimer::LoggingPerformanceTimer(const std::string &s, uint64_t unit, el::Level l): PerformanceTimer(), name(s), unit(unit), level(l) { - ticks = get_tick_count(); if (!performance_timers) { MLOG(level, "PERF ----------"); - performance_timers = new std::vector(); + performance_timers = new std::vector(); } else { - PerformanceTimer *pt = performance_timers->back(); + LoggingPerformanceTimer *pt = performance_timers->back(); if (!pt->started && !pt->paused) { size_t size = 0; for (const auto *tmp: *performance_timers) if (!tmp->paused) ++size; @@ -119,9 +126,14 @@ PerformanceTimer::PerformanceTimer(const std::string &s, uint64_t unit, el::Leve PerformanceTimer::~PerformanceTimer() { - performance_timers->pop_back(); if (!paused) ticks = get_tick_count() - ticks; +} + +LoggingPerformanceTimer::~LoggingPerformanceTimer() +{ + pause(); + performance_timers->pop_back(); char s[12]; snprintf(s, sizeof(s), "%8llu ", (unsigned long long)(ticks_to_ns(ticks) / (1000000000 / unit))); size_t size = 0; for (const auto *tmp: *performance_timers) if (!tmp->paused || tmp==this) ++size; diff --git a/src/common/perf_timer.h b/src/common/perf_timer.h index 0e910caf9..675d6234d 100644 --- a/src/common/perf_timer.h +++ b/src/common/perf_timer.h @@ -43,30 +43,46 @@ class PerformanceTimer; extern el::Level performance_timer_log_level; +uint64_t get_tick_count(); +uint64_t get_ticks_per_ns(); +uint64_t ticks_to_ns(uint64_t ticks); + class PerformanceTimer { public: - PerformanceTimer(const std::string &s, uint64_t unit, el::Level l = el::Level::Debug); + PerformanceTimer(bool paused = false); ~PerformanceTimer(); void pause(); void resume(); -private: - std::string name; - uint64_t unit; - el::Level level; + uint64_t value() const { return ticks; } +void set(uint64_t v){ticks=v;} + +protected: uint64_t ticks; bool started; bool paused; }; +class LoggingPerformanceTimer: public PerformanceTimer +{ +public: + LoggingPerformanceTimer(const std::string &s, uint64_t unit, el::Level l = el::Level::Debug); + ~LoggingPerformanceTimer(); + +private: + std::string name; + uint64_t unit; + el::Level level; +}; + void set_performance_timer_log_level(el::Level level); -#define PERF_TIMER_UNIT(name, unit) tools::PerformanceTimer pt_##name(#name, unit, tools::performance_timer_log_level) -#define PERF_TIMER_UNIT_L(name, unit, l) tools::PerformanceTimer pt_##name(#name, unit, l) +#define PERF_TIMER_UNIT(name, unit) tools::LoggingPerformanceTimer pt_##name(#name, unit, tools::performance_timer_log_level) +#define PERF_TIMER_UNIT_L(name, unit, l) tools::LoggingPerformanceTimer pt_##name(#name, unit, l) #define PERF_TIMER(name) PERF_TIMER_UNIT(name, 1000) #define PERF_TIMER_L(name, l) PERF_TIMER_UNIT_L(name, 1000, l) -#define PERF_TIMER_START_UNIT(name, unit) std::unique_ptr pt_##name(new tools::PerformanceTimer(#name, unit, el::Level::Info)) +#define PERF_TIMER_START_UNIT(name, unit) std::unique_ptr pt_##name(new tools::LoggingPerformanceTimer(#name, unit, el::Level::Info)) #define PERF_TIMER_START(name) PERF_TIMER_START_UNIT(name, 1000) #define PERF_TIMER_STOP(name) do { pt_##name.reset(NULL); } while(0) #define PERF_TIMER_PAUSE(name) pt_##name->pause() From b17b8db3f557d6070fd8cf2da16b229259f9d986 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 28 May 2018 19:17:11 +0100 Subject: [PATCH 29/56] performance_tests: add stats and loop count multiplier options Stats are: min, median, standard deviation --- tests/performance_tests/main.cpp | 551 ++++++++++---------- tests/performance_tests/performance_tests.h | 123 ++++- 2 files changed, 383 insertions(+), 291 deletions(-) diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index abcc2a3d0..de9f0e647 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -73,8 +73,12 @@ int main(int argc, char** argv) po::options_description desc_options("Command line options"); const command_line::arg_descriptor arg_filter = { "filter", "Regular expression filter for which tests to run" }; const command_line::arg_descriptor arg_verbose = { "verbose", "Verbose output", false }; + const command_line::arg_descriptor arg_stats = { "stats", "Including statistics (min/median)", false }; + const command_line::arg_descriptor arg_loop_multiplier = { "loop-multiplier", "Run for that many times more loops", 1 }; command_line::add_arg(desc_options, arg_filter, ""); command_line::add_arg(desc_options, arg_verbose, ""); + command_line::add_arg(desc_options, arg_stats, ""); + command_line::add_arg(desc_options, arg_loop_multiplier, ""); po::variables_map vm; bool r = command_line::handle_error_helper(desc_options, [&]() @@ -87,311 +91,314 @@ int main(int argc, char** argv) return 1; const std::string filter = tools::glob_to_regex(command_line::get_arg(vm, arg_filter)); - bool verbose = command_line::get_arg(vm, arg_verbose); + Params p; + p.verbose = command_line::get_arg(vm, arg_verbose); + p.stats = command_line::get_arg(vm, arg_stats); + p.loop_multiplier = command_line::get_arg(vm, arg_loop_multiplier); performance_timer timer; timer.start(); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 1, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 2, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 1, 1000, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 1, 1, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 1, 2, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 1, 10, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 1, 100, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 1, 1000, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 1, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 2, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 100, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 1, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 2, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 10, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 1, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 2, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 100, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 1, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 2, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 10, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 1, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 2, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 100, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 1, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 2, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 10, false); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 1, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 2, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 2, 10, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 1, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 2, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 2, 10, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 1, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 2, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 10, 10, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 1, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 2, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 10, 10, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 1, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 2, true); - TEST_PERFORMANCE3(filter, verbose, test_construct_tx, 100, 10, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 1, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 2, true); + TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 10, true); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 1, 2, false, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, false, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, false, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, false, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, false, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 1, 2, false, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, false, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, false, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, false, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, false, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, true, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, true, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, true, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, true, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, false); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 2, true, true); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 10, 2, true, true); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 100, 2, true, true); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature, 2, 10, true, true); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, true); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, true); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, true); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, true); - TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 64); - TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 64); - TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 100, 2, 64); - TEST_PERFORMANCE3(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 10, 64); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 64); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 64); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 100, 2, 64); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 2, 10, 64); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 62, 4); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 62, 4); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 56, 16); - TEST_PERFORMANCE4(filter, verbose, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 56, 16); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 62, 4); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 62, 4); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 56, 16); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 56, 16); - TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc); - TEST_PERFORMANCE0(filter, verbose, test_is_out_to_acc_precomp); - TEST_PERFORMANCE0(filter, verbose, test_generate_key_image_helper); - TEST_PERFORMANCE0(filter, verbose, test_generate_key_derivation); - TEST_PERFORMANCE0(filter, verbose, test_generate_key_image); - TEST_PERFORMANCE0(filter, verbose, test_derive_public_key); - TEST_PERFORMANCE0(filter, verbose, test_derive_secret_key); - TEST_PERFORMANCE0(filter, verbose, test_ge_frombytes_vartime); - TEST_PERFORMANCE0(filter, verbose, test_generate_keypair); - TEST_PERFORMANCE0(filter, verbose, test_sc_reduce32); - TEST_PERFORMANCE1(filter, verbose, test_signature, false); - TEST_PERFORMANCE1(filter, verbose, test_signature, true); + TEST_PERFORMANCE0(filter, p, test_is_out_to_acc); + TEST_PERFORMANCE0(filter, p, test_is_out_to_acc_precomp); + TEST_PERFORMANCE0(filter, p, test_generate_key_image_helper); + TEST_PERFORMANCE0(filter, p, test_generate_key_derivation); + TEST_PERFORMANCE0(filter, p, test_generate_key_image); + TEST_PERFORMANCE0(filter, p, test_derive_public_key); + TEST_PERFORMANCE0(filter, p, test_derive_secret_key); + TEST_PERFORMANCE0(filter, p, test_ge_frombytes_vartime); + TEST_PERFORMANCE0(filter, p, test_generate_keypair); + TEST_PERFORMANCE0(filter, p, test_sc_reduce32); + TEST_PERFORMANCE1(filter, p, test_signature, false); + TEST_PERFORMANCE1(filter, p, test_signature, true); - TEST_PERFORMANCE2(filter, verbose, test_wallet2_expand_subaddresses, 50, 200); + TEST_PERFORMANCE2(filter, p, test_wallet2_expand_subaddresses, 50, 200); - TEST_PERFORMANCE0(filter, verbose, test_cn_slow_hash); - TEST_PERFORMANCE1(filter, verbose, test_cn_fast_hash, 32); - TEST_PERFORMANCE1(filter, verbose, test_cn_fast_hash, 16384); + TEST_PERFORMANCE0(filter, p, test_cn_slow_hash); + TEST_PERFORMANCE1(filter, p, test_cn_fast_hash, 32); + TEST_PERFORMANCE1(filter, p, test_cn_fast_hash, 16384); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 3, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 5, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 10, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 100, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 3, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 5, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 10, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 100, true); - TEST_PERFORMANCE2(filter, verbose, test_equality, memcmp32, true); - TEST_PERFORMANCE2(filter, verbose, test_equality, memcmp32, false); - TEST_PERFORMANCE2(filter, verbose, test_equality, verify32, false); - TEST_PERFORMANCE2(filter, verbose, test_equality, verify32, false); + TEST_PERFORMANCE2(filter, p, test_equality, memcmp32, true); + TEST_PERFORMANCE2(filter, p, test_equality, memcmp32, false); + TEST_PERFORMANCE2(filter, p, test_equality, verify32, false); + TEST_PERFORMANCE2(filter, p, test_equality, verify32, false); - TEST_PERFORMANCE1(filter, verbose, test_range_proof, true); - TEST_PERFORMANCE1(filter, verbose, test_range_proof, false); + TEST_PERFORMANCE1(filter, p, test_range_proof, true); + TEST_PERFORMANCE1(filter, p, test_range_proof, false); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 1); // 1 bulletproof with 1 amount - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 1); + TEST_PERFORMANCE2(filter, p, test_bulletproof, true, 1); // 1 bulletproof with 1 amount + TEST_PERFORMANCE2(filter, p, test_bulletproof, false, 1); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 2); // 1 bulletproof with 2 amounts - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 2); + TEST_PERFORMANCE2(filter, p, test_bulletproof, true, 2); // 1 bulletproof with 2 amounts + TEST_PERFORMANCE2(filter, p, test_bulletproof, false, 2); - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, true, 15); // 1 bulletproof with 15 amounts - TEST_PERFORMANCE2(filter, verbose, test_bulletproof, false, 15); + TEST_PERFORMANCE2(filter, p, test_bulletproof, true, 15); // 1 bulletproof with 15 amounts + TEST_PERFORMANCE2(filter, p, test_bulletproof, false, 15); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 4); // 4 proofs, each with 2 amounts - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 8, 1, 1, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 8, 1, 1, 0, 4); // 4 proofs, each with 8 amounts - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 1, 2, 0, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 1, 2, 0, 4); // 4 proofs with 1, 2, 4, 8 amounts - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 1, 8, 1, 1, 4); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 1, 8, 1, 1, 4); // 32 proofs, with 1, 2, 3, 4 amounts, 8 of each - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, false, 2, 1, 1, 0, 64); - TEST_PERFORMANCE6(filter, verbose, test_aggregated_bulletproof, true, 2, 1, 1, 0, 64); // 64 proof, each with 2 amounts + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, false, 2, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, true, 2, 1, 1, 0, 4); // 4 proofs, each with 2 amounts + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, false, 8, 1, 1, 0, 4); + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, true, 8, 1, 1, 0, 4); // 4 proofs, each with 8 amounts + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, false, 1, 1, 2, 0, 4); + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, true, 1, 1, 2, 0, 4); // 4 proofs with 1, 2, 4, 8 amounts + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, false, 1, 8, 1, 1, 4); + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, true, 1, 8, 1, 1, 4); // 32 proofs, with 1, 2, 3, 4 amounts, 8 of each + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, false, 2, 1, 1, 0, 64); + TEST_PERFORMANCE6(filter, p, test_aggregated_bulletproof, true, 2, 1, 1, 0, 64); // 64 proof, each with 2 amounts - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, false); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 3, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 5, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 10, true); - TEST_PERFORMANCE3(filter, verbose, test_ringct_mlsag, 1, 100, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 3, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 5, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 10, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 100, false); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 3, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 5, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 10, true); + TEST_PERFORMANCE3(filter, p, test_ringct_mlsag, 1, 100, true); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_add); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_sub); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_sc_mul); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_add_raw); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_add_p3_p3); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_scalarmultBase); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_scalarmultKey); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_base_vartime); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys2); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys3); - TEST_PERFORMANCE1(filter, verbose, test_crypto_ops, op_addKeys3_2); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_sc_add); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_sc_sub); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_sc_mul); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_add_raw); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_add_p3_p3); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmultBase); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmultKey); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_base_vartime); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys2); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys3); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys3_2); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 4); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 8); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 16); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 32); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 64); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 128); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 256); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 512); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 1024); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 2048); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_bos_coster, 4096); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 2); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 4); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 8); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 16); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 32); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 64); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 128); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 256); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 512); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 1024); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 2048); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 4096); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 2); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 8); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 16); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 32); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 64); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 128); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 256); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 512); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 1024); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 2048); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus, 4096); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 2); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 4); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 8); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 16); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 32); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 64); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 128); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 256); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 512); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 1024); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 2048); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus, 4096); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 2); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 4); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 8); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 16); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 32); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 64); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 128); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 256); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 512); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 1024); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 2048); - TEST_PERFORMANCE2(filter, verbose, test_multiexp, multiexp_straus_cached, 4096); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 2); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 4); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 8); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 16); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 32); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 64); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 128); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 256); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 512); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 1024); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 2048); + TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_straus_cached, 4096); #if 1 - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 9); #else - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 8, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 16, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 32, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 64, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 128, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 256, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 512, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 1024, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 2048, 9); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 1); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 2); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 3); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 4); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 5); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 6); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 7); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 8); - TEST_PERFORMANCE3(filter, verbose, test_multiexp, multiexp_pippenger, 4096, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 9); #endif std::cout << "Tests finished. Elapsed time: " << timer.elapsed_ms() / 1000 << " sec" << std::endl; diff --git a/tests/performance_tests/performance_tests.h b/tests/performance_tests/performance_tests.h index ce9baf61f..d37dda729 100644 --- a/tests/performance_tests/performance_tests.h +++ b/tests/performance_tests/performance_tests.h @@ -36,6 +36,9 @@ #include #include +#include "misc_language.h" +#include "common/perf_timer.h" + class performance_timer { public: @@ -62,14 +65,21 @@ private: clock::time_point m_start; }; +struct Params +{ + bool verbose; + bool stats; + unsigned loop_multiplier; +}; template class test_runner { public: - test_runner(bool verbose = true) + test_runner(const Params ¶ms) : m_elapsed(0) - , m_verbose(verbose) + , m_params(params) + , m_per_call_timers(T::loop_count * params.loop_multiplier, {true}) { } @@ -82,14 +92,18 @@ public: performance_timer timer; timer.start(); warm_up(); - if (m_verbose) + if (m_params.verbose) std::cout << "Warm up: " << timer.elapsed_ms() << " ms" << std::endl; timer.start(); - for (size_t i = 0; i < T::loop_count; ++i) + for (size_t i = 0; i < T::loop_count * m_params.loop_multiplier; ++i) { + if (m_params.stats) + m_per_call_timers[i].resume(); if (!test.test()) return false; + if (m_params.stats) + m_per_call_timers[i].pause(); } m_elapsed = timer.elapsed_ms(); @@ -101,9 +115,62 @@ public: int time_per_call(int scale = 1) const { static_assert(0 < T::loop_count, "T::loop_count must be greater than 0"); - return m_elapsed * scale / T::loop_count; + return m_elapsed * scale / (T::loop_count * m_params.loop_multiplier); } + uint64_t per_call_min() const + { + uint64_t v = std::numeric_limits::max(); + for (const auto &pt: m_per_call_timers) + v = std::min(v, pt.value()); + return v; + } + + uint64_t per_call_max() const + { + uint64_t v = std::numeric_limits::min(); + for (const auto &pt: m_per_call_timers) + v = std::max(v, pt.value()); + return v; + } + + uint64_t per_call_mean() const + { + uint64_t v = 0; + for (const auto &pt: m_per_call_timers) + v += pt.value(); + return v / m_per_call_timers.size(); + } + + uint64_t per_call_median() const + { + std::vector values; + values.reserve(m_per_call_timers.size()); + for (const auto &pt: m_per_call_timers) + values.push_back(pt.value()); + return epee::misc_utils::median(values); + } + + uint64_t per_call_stddev() const + { + if (m_per_call_timers.size() <= 1) + return 0; + const uint64_t mean = per_call_mean(); + uint64_t acc = 0; + for (const auto &pt: m_per_call_timers) + { + int64_t dv = pt.value() - mean; + acc += dv * dv; + } + acc /= m_per_call_timers.size () - 1; + return sqrt(acc); + } + + uint64_t min_time_ns() const { return tools::ticks_to_ns(per_call_min()); } + uint64_t max_time_ns() const { return tools::ticks_to_ns(per_call_max()); } + uint64_t median_time_ns() const { return tools::ticks_to_ns(per_call_median()); } + uint64_t standard_deviation_time_ns() const { return tools::ticks_to_ns(per_call_stddev()); } + private: /** * Warm up processor core, enabling turbo boost, etc. @@ -122,30 +189,39 @@ private: private: volatile uint64_t m_warm_up; /// m_per_call_timers; }; template -void run_test(const std::string &filter, bool verbose, const char* test_name) +void run_test(const std::string &filter, const Params ¶ms, const char* test_name) { boost::smatch match; if (!filter.empty() && !boost::regex_match(std::string(test_name), match, boost::regex(filter))) return; - test_runner runner(verbose); + test_runner runner(params); if (runner.run()) { - if (verbose) + if (params.verbose) { std::cout << test_name << " - OK:\n"; - std::cout << " loop count: " << T::loop_count << '\n'; + std::cout << " loop count: " << T::loop_count * params.loop_multiplier << '\n'; std::cout << " elapsed: " << runner.elapsed_time() << " ms\n"; + if (params.stats) + { + std::cout << " min: " << runner.min_time_ns() << " ns\n"; + std::cout << " max: " << runner.max_time_ns() << " ns\n"; + std::cout << " median: " << runner.median_time_ns() << " ns\n"; + std::cout << " std dev: " << runner.standard_deviation_time_ns() << " ns\n"; + } } else { - std::cout << test_name << " (" << T::loop_count << " calls) - OK:"; + std::cout << test_name << " (" << T::loop_count * params.loop_multiplier << " calls) - OK:"; } const char *unit = "ms"; + uint64_t scale = 1000000; int time_per_call = runner.time_per_call(); if (time_per_call < 30000) { time_per_call = runner.time_per_call(1000); @@ -154,8 +230,17 @@ void run_test(const std::string &filter, bool verbose, const char* test_name) #else unit = "µs"; #endif + scale = 1000; } - std::cout << (verbose ? " time per call: " : " ") << time_per_call << " " << unit << "/call" << (verbose ? "\n" : "") << std::endl; + std::cout << (params.verbose ? " time per call: " : " ") << time_per_call << " " << unit << "/call" << (params.verbose ? "\n" : ""); + if (params.stats) + { + uint64_t min_ns = runner.min_time_ns() / scale; + uint64_t med_ns = runner.median_time_ns() / scale; + uint64_t stddev_ns = runner.standard_deviation_time_ns() / scale; + std::cout << " (min " << min_ns << " " << unit << ", median " << med_ns << " " << unit << ", std dev " << stddev_ns << " " << unit << ")"; + } + std::cout << std::endl; } else { @@ -164,10 +249,10 @@ void run_test(const std::string &filter, bool verbose, const char* test_name) } #define QUOTEME(x) #x -#define TEST_PERFORMANCE0(filter, verbose, test_class) run_test< test_class >(filter, verbose, QUOTEME(test_class)) -#define TEST_PERFORMANCE1(filter, verbose, test_class, a0) run_test< test_class >(filter, verbose, QUOTEME(test_class)) -#define TEST_PERFORMANCE2(filter, verbose, test_class, a0, a1) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ">") -#define TEST_PERFORMANCE3(filter, verbose, test_class, a0, a1, a2) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ">") -#define TEST_PERFORMANCE4(filter, verbose, test_class, a0, a1, a2, a3) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ">") -#define TEST_PERFORMANCE5(filter, verbose, test_class, a0, a1, a2, a3, a4) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ">") -#define TEST_PERFORMANCE6(filter, verbose, test_class, a0, a1, a2, a3, a4, a5) run_test< test_class >(filter, verbose, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ", " QUOTEME(a5) ">") +#define TEST_PERFORMANCE0(filter, params, test_class) run_test< test_class >(filter, params, QUOTEME(test_class)) +#define TEST_PERFORMANCE1(filter, params, test_class, a0) run_test< test_class >(filter, params, QUOTEME(test_class)) +#define TEST_PERFORMANCE2(filter, params, test_class, a0, a1) run_test< test_class >(filter, params, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ">") +#define TEST_PERFORMANCE3(filter, params, test_class, a0, a1, a2) run_test< test_class >(filter, params, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ">") +#define TEST_PERFORMANCE4(filter, params, test_class, a0, a1, a2, a3) run_test< test_class >(filter, params, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ">") +#define TEST_PERFORMANCE5(filter, params, test_class, a0, a1, a2, a3, a4) run_test< test_class >(filter, params, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ">") +#define TEST_PERFORMANCE6(filter, params, test_class, a0, a1, a2, a3, a4, a5) run_test< test_class >(filter, params, QUOTEME(test_class) "<" QUOTEME(a0) ", " QUOTEME(a1) ", " QUOTEME(a2) ", " QUOTEME(a3) ", " QUOTEME(a4) ", " QUOTEME(a5) ">") From 51eb3bdcd6090ae42d4aca24c35772f0d6104c72 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 29 May 2018 12:38:21 +0100 Subject: [PATCH 30/56] add pippenger unit tests --- tests/unit_tests/multiexp.cpp | 55 +++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/tests/unit_tests/multiexp.cpp b/tests/unit_tests/multiexp.cpp index 2dce5bb80..10303c392 100644 --- a/tests/unit_tests/multiexp.cpp +++ b/tests/unit_tests/multiexp.cpp @@ -74,6 +74,13 @@ TEST(multiexp, straus_empty) ASSERT_TRUE(basic(data) == straus(data)); } +TEST(multiexp, pippenger_empty) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == pippenger(data)); +} + TEST(multiexp, bos_coster_only_zeroes) { std::vector data; @@ -90,6 +97,14 @@ TEST(multiexp, straus_only_zeroes) ASSERT_TRUE(basic(data) == straus(data)); } +TEST(multiexp, pippenger_only_zeroes) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == pippenger(data)); +} + TEST(multiexp, bos_coster_only_identities) { std::vector data; @@ -106,6 +121,14 @@ TEST(multiexp, straus_only_identities) ASSERT_TRUE(basic(data) == straus(data)); } +TEST(multiexp, pippenger_only_identities) +{ + std::vector data; + for (int n = 0; n < 16; ++n) + data.push_back({TESTSCALAR, get_p3(rct::identity())}); + ASSERT_TRUE(basic(data) == pippenger(data)); +} + TEST(multiexp, bos_coster_random) { std::vector data; @@ -126,6 +149,16 @@ TEST(multiexp, straus_random) } } +TEST(multiexp, pippenger_random) +{ + std::vector data; + for (int n = 0; n < 32; ++n) + { + data.push_back({rct::skGen(), get_p3(rct::scalarmultBase(rct::skGen()))}); + ASSERT_TRUE(basic(data) == pippenger(data)); + } +} + TEST(multiexp, straus_cached) { static constexpr size_t N = 256; @@ -147,3 +180,25 @@ TEST(multiexp, straus_cached) ASSERT_TRUE(basic(data) == straus(data, cache)); } } + +TEST(multiexp, pippenger_cached) +{ + static constexpr size_t N = 256; + std::vector P(N); + for (size_t n = 0; n < N; ++n) + { + P[n].scalar = rct::zero(); + ASSERT_TRUE(ge_frombytes_vartime(&P[n].point, rct::scalarmultBase(rct::skGen()).bytes) == 0); + } + std::shared_ptr cache = rct::pippenger_init_cache(P); + for (size_t n = 0; n < N/16; ++n) + { + std::vector data; + size_t sz = 1 + crypto::rand() % (N-1); + for (size_t s = 0; s < sz; ++s) + { + data.push_back({rct::skGen(), P[s].point}); + } + ASSERT_TRUE(basic(data) == pippenger(data, cache)); + } +} From 0b05a0fa74512970ceba3c15ed2cbf027ef7b6da Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 29 May 2018 12:39:00 +0100 Subject: [PATCH 31/56] Add Pippenger cache and limit Straus cache size --- src/ringct/bulletproofs.cc | 29 +++++-- src/ringct/multiexp.cc | 76 ++++++++++++----- src/ringct/multiexp.h | 7 +- tests/performance_tests/main.cpp | 131 +++++++++++++++++++++++++++-- tests/performance_tests/multiexp.h | 13 ++- 5 files changed, 217 insertions(+), 39 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 83005eaa4..4eb6d6d5b 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -49,6 +49,9 @@ extern "C" #define PERF_TIMER_START_BP(x) PERF_TIMER_START_UNIT(x, 1000000) +#define STRAUS_SIZE_LIMIT 128 +#define PIPPENGER_SIZE_LIMIT 0 + namespace rct { @@ -61,8 +64,8 @@ static constexpr size_t maxN = 64; static constexpr size_t maxM = BULLETPROOF_MAX_OUTPUTS; static rct::key Hi[maxN*maxM], Gi[maxN*maxM]; static ge_p3 Hi_p3[maxN*maxM], Gi_p3[maxN*maxM]; -static ge_dsmp Gprecomp[maxN*maxM], Hprecomp[maxN*maxM]; -static std::shared_ptr HiGi_cache; +static std::shared_ptr straus_HiGi_cache; +static std::shared_ptr pippenger_HiGi_cache; static const rct::key TWO = { {0x02, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; static const rct::keyV oneN = vector_dup(rct::identity(), maxN); static const rct::keyV twoN = vector_powers(TWO, maxN); @@ -73,9 +76,12 @@ static inline rct::key multiexp(const std::vector &data, bool HiGi { static const size_t STEP = getenv("STRAUS_STEP") ? atoi(getenv("STRAUS_STEP")) : 0; if (HiGi) - return data.size() <= 256 ? straus(data, HiGi_cache, STEP) : pippenger(data, get_pippenger_c(data.size())); + { + static_assert(128 <= STRAUS_SIZE_LIMIT, "Straus in precalc mode can only be calculated till STRAUS_SIZE_LIMIT"); + return data.size() <= 128 ? straus(data, straus_HiGi_cache, STEP) : pippenger(data, pippenger_HiGi_cache, get_pippenger_c(data.size())); + } else - return data.size() <= 64 ? straus(data, NULL, STEP) : pippenger(data, get_pippenger_c(data.size())); + return data.size() <= 64 ? straus(data, NULL, STEP) : pippenger(data, NULL, get_pippenger_c(data.size())); } //addKeys3acc_p3 @@ -123,18 +129,23 @@ static void init_exponents() for (size_t i = 0; i < maxN*maxM; ++i) { Hi[i] = get_exponent(rct::H, i * 2); - rct::precomp(Hprecomp[i], Hi[i]); CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&Hi_p3[i], Hi[i].bytes) == 0, "ge_frombytes_vartime failed"); Gi[i] = get_exponent(rct::H, i * 2 + 1); - rct::precomp(Gprecomp[i], Gi[i]); CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&Gi_p3[i], Gi[i].bytes) == 0, "ge_frombytes_vartime failed"); data.push_back({rct::zero(), Gi[i]}); data.push_back({rct::zero(), Hi[i]}); } - HiGi_cache = straus_init_cache(data); - size_t cache_size = (sizeof(Hi)+sizeof(Hprecomp)+sizeof(Hi_p3))*2 + straus_get_cache_size(HiGi_cache); - MINFO("cache size: " << cache_size/1024 << " kB"); + + straus_HiGi_cache = straus_init_cache(data, STRAUS_SIZE_LIMIT); + pippenger_HiGi_cache = pippenger_init_cache(data, PIPPENGER_SIZE_LIMIT); + + MINFO("Hi/Gi cache size: " << (sizeof(Hi)+sizeof(Gi))/1024 << " kB"); + MINFO("Hi_p3/Gi_p3 cache size: " << (sizeof(Hi_p3)+sizeof(Gi_p3))/1024 << " kB"); + MINFO("Straus cache size: " << straus_get_cache_size(straus_HiGi_cache)/1024 << " kB"); + MINFO("Pippenger cache size: " << pippenger_get_cache_size(pippenger_HiGi_cache)/1024 << " kB"); + size_t cache_size = (sizeof(Hi)+sizeof(Hi_p3))*2 + straus_get_cache_size(straus_HiGi_cache) + pippenger_get_cache_size(pippenger_HiGi_cache); + MINFO("Total cache size: " << cache_size/1024 << "kB"); init_done = true; } diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index fd2d1cbd7..f9ef9e422 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -343,9 +343,12 @@ struct straus_cached_data #endif #endif -std::shared_ptr straus_init_cache(const std::vector &data) +std::shared_ptr straus_init_cache(const std::vector &data, size_t N) { MULTIEXP_PERF(PERF_TIMER_START_UNIT(multiples, 1000000)); + if (N == 0) + N = data.size(); + CHECK_AND_ASSERT_THROW_MES(N <= data.size(), "Bad cache base data"); ge_cached cached; ge_p1p1 p1; ge_p3 p3; @@ -353,9 +356,10 @@ std::shared_ptr straus_init_cache(const std::vectorsize; - cache->multiples = (ge_cached*)aligned_realloc(cache->multiples, sizeof(ge_cached) * ((1<size = data.size(); - for (size_t j=offset;jmultiples = (ge_cached*)aligned_realloc(cache->multiples, sizeof(ge_cached) * ((1<multiples, "Out of memory"); + cache->size = N; + for (size_t j=offset;j straus_init_cache(const std::vectormultiples.size(); - cache->multiples.resize(std::max(offset, data.size())); - for (size_t i = offset; i < data.size(); ++i) + cache->multiples.resize(std::max(offset, N)); + for (size_t i = offset; i < N; ++i) { cache->multiples[i].resize((1<multiples[i][0], &data[i].point); @@ -383,12 +387,12 @@ std::shared_ptr straus_init_cache(const std::vectormultiples.resize(1<multiples[1].size(); - cache->multiples[1].resize(std::max(offset, data.size())); - for (size_t i = offset; i < data.size(); ++i) + cache->multiples[1].resize(std::max(offset, N)); + for (size_t i = offset; i < N; ++i) ge_p3_to_cached(&cache->multiples[1][i], &data[i].point); for (size_t i=2;i<1<multiples[i].resize(std::max(offset, data.size())); - for (size_t j=offset;jmultiples[i].resize(std::max(offset, N)); + for (size_t j=offset;j &cache) rct::key straus(const std::vector &data, const std::shared_ptr &cache, size_t STEP) { + CHECK_AND_ASSERT_THROW_MES(cache == NULL || cache->size >= data.size(), "Cache is too small"); MULTIEXP_PERF(PERF_TIMER_UNIT(straus, 1000000)); bool HiGi = cache != NULL; STEP = STEP ? STEP : 192; @@ -533,7 +538,8 @@ skipfirst: size_t get_pippenger_c(size_t N) { -// 2:1, 4:2, 8:2, 16:3, 32:4, 64:4, 128:5, 256:6, 512:7, 1024:7, 2048:8, 4096:9 +// uncached: 2:1, 4:2, 8:2, 16:3, 32:4, 64:4, 128:5, 256:6, 512:7, 1024:7, 2048:8, 4096:9 +// cached: 2:1, 4:2, 8:2, 16:3, 32:4, 64:4, 128:5, 256:6, 512:7, 1024:7, 2048:8, 4096:9 if (N <= 2) return 1; if (N <= 8) return 2; if (N <= 16) return 3; @@ -545,23 +551,55 @@ size_t get_pippenger_c(size_t N) return 9; } -rct::key pippenger(const std::vector &data, size_t c) +struct pippenger_cached_data { + size_t size; + ge_cached *cached; + pippenger_cached_data(): size(0), cached(NULL) {} + ~pippenger_cached_data() { aligned_free(cached); } +}; + +std::shared_ptr pippenger_init_cache(const std::vector &data, size_t N) +{ + MULTIEXP_PERF(PERF_TIMER_START_UNIT(pippenger_init_cache, 1000000)); + if (N == 0) + N = data.size(); + CHECK_AND_ASSERT_THROW_MES(N <= data.size(), "Bad cache base data"); + ge_cached cached; + std::shared_ptr cache(new pippenger_cached_data()); + + cache->size = N; + cache->cached = (ge_cached*)aligned_realloc(cache->cached, N * sizeof(ge_cached), 4096); + CHECK_AND_ASSERT_THROW_MES(cache->cached, "Out of memory"); + for (size_t i = 0; i < N; ++i) + ge_p3_to_cached(&cache->cached[i], &data[i].point); + + MULTIEXP_PERF(PERF_TIMER_STOP(pippenger_init_cache)); + return cache; +} + +size_t pippenger_get_cache_size(const std::shared_ptr &cache) +{ + return cache->size * sizeof(*cache->cached); +} + +rct::key pippenger(const std::vector &data, const std::shared_ptr &cache, size_t c) +{ + CHECK_AND_ASSERT_THROW_MES(cache == NULL || cache->size >= data.size(), "Cache is too small"); + if (c == 0) + c = get_pippenger_c(data.size()); CHECK_AND_ASSERT_THROW_MES(c <= 9, "c is too large"); ge_p3 result = ge_p3_identity; std::unique_ptr buckets{new ge_p3[1< cached_points{new ge_cached[data.size()]}; - - for (size_t i = 0; i < data.size(); ++i) - { - ge_p3_to_cached(&cached_points[i], &data[i].point); - } + std::shared_ptr local_cache = cache == NULL ? pippenger_init_cache(data) : cache; rct::key maxscalar = rct::zero(); for (size_t i = 0; i < data.size(); ++i) + { if (maxscalar < data[i].scalar) maxscalar = data[i].scalar; + } size_t groups = 0; while (groups < 256 && pow2(groups) < maxscalar) ++groups; @@ -598,7 +636,7 @@ rct::key pippenger(const std::vector &data, size_t c) CHECK_AND_ASSERT_THROW_MES(bucket < (1u<cached[i]); } else buckets[bucket] = data[i].point; diff --git a/src/ringct/multiexp.h b/src/ringct/multiexp.h index 2ed8db279..559ab664a 100644 --- a/src/ringct/multiexp.h +++ b/src/ringct/multiexp.h @@ -54,14 +54,17 @@ struct MultiexpData { }; struct straus_cached_data; +struct pippenger_cached_data; rct::key bos_coster_heap_conv(std::vector data); rct::key bos_coster_heap_conv_robust(std::vector data); -std::shared_ptr straus_init_cache(const std::vector &data); +std::shared_ptr straus_init_cache(const std::vector &data, size_t N =0); size_t straus_get_cache_size(const std::shared_ptr &cache); rct::key straus(const std::vector &data, const std::shared_ptr &cache = NULL, size_t STEP = 0); +std::shared_ptr pippenger_init_cache(const std::vector &data, size_t N =0); +size_t pippenger_get_cache_size(const std::shared_ptr &cache); size_t get_pippenger_c(size_t N); -rct::key pippenger(const std::vector &data, size_t c); +rct::key pippenger(const std::vector &data, const std::shared_ptr &cache = NULL, size_t c = 0); } diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index de9f0e647..142e544dd 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -281,16 +281,137 @@ int main(int argc, char** argv) TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 1); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4, 2); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 8, 2); - TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 16, 3); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 32, 4); - TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 5); - TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 64, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 128, 5); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 256, 6); - TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 6); - TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 512, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 1024, 7); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2048, 8); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 4096, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 9); #else + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 8, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 16, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 32, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 64, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 128, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 256, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 512, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 1024, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 2048, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 1); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 2); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 3); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 4); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 5); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 6); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 7); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 8); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger_cached, 4096, 9); + TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 1); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 2); TEST_PERFORMANCE3(filter, p, test_multiexp, multiexp_pippenger, 2, 3); diff --git a/tests/performance_tests/multiexp.h b/tests/performance_tests/multiexp.h index 294e74116..b8b87b3a6 100644 --- a/tests/performance_tests/multiexp.h +++ b/tests/performance_tests/multiexp.h @@ -40,6 +40,7 @@ enum test_multiexp_algorithm multiexp_straus, multiexp_straus_cached, multiexp_pippenger, + multiexp_pippenger_cached, }; template @@ -61,7 +62,8 @@ public: rct::key kn = rct::scalarmultKey(point, data[n].scalar); res = rct::addKeys(res, kn); } - cache = rct::straus_init_cache(data); + straus_cache = rct::straus_init_cache(data); + pippenger_cache = rct::pippenger_init_cache(data); return true; } @@ -74,9 +76,11 @@ public: case multiexp_straus: return res == straus(data); case multiexp_straus_cached: - return res == straus(data, cache); + return res == straus(data, straus_cache); case multiexp_pippenger: - return res == pippenger(data, c); + return res == pippenger(data, NULL, c); + case multiexp_pippenger_cached: + return res == pippenger(data, pippenger_cache, c); default: return false; } @@ -84,6 +88,7 @@ public: private: std::vector data; - std::shared_ptr cache; + std::shared_ptr straus_cache; + std::shared_ptr pippenger_cache; rct::key res; }; From 15697177183db06b31a73d45a4e8406eaaa4cf5b Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 20 Jun 2018 16:54:13 +0100 Subject: [PATCH 32/56] bulletproofs: speed up a few multiplies using existing Hi cache --- src/ringct/bulletproofs.cc | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 4eb6d6d5b..bc7e15f35 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -111,6 +111,15 @@ static void addKeys_acc_p3(ge_p3 *acc_p3, const rct::key &a, const rct::key &poi ge_p1p1_to_p3(acc_p3, &p1); } +static rct::key scalarmultKey(const ge_p3 &P, const rct::key &a) +{ + ge_p2 R; + ge_scalarmult(&R, a.bytes, &P); + rct::key aP; + ge_tobytes(aP.bytes, &R); + return aP; +} + static rct::key get_exponent(const rct::key &base, size_t idx) { static const std::string salt("bulletproof"); @@ -578,7 +587,7 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) for (size_t i = 0; i < N; ++i) { Gprime[i] = Gi[i]; - Hprime[i] = scalarmultKey(Hi[i], yinvpow); + Hprime[i] = scalarmultKey(Hi_p3[i], yinvpow); sc_mul(yinvpow.bytes, yinvpow.bytes, yinv.bytes); aprime[i] = l[i]; bprime[i] = r[i]; @@ -828,7 +837,7 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) for (size_t i = 0; i < MN; ++i) { Gprime[i] = Gi[i]; - Hprime[i] = scalarmultKey(Hi[i], yinvpow); + Hprime[i] = scalarmultKey(Hi_p3[i], yinvpow); sc_mul(yinvpow.bytes, yinvpow.bytes, yinv.bytes); aprime[i] = l[i]; bprime[i] = r[i]; From c42917624849daeac0b4bc2fb1cd1f2539470b28 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 29 Jun 2018 15:03:00 +0100 Subject: [PATCH 33/56] bulletproofs: reject points not in the main subgroup --- src/ringct/bulletproofs.cc | 13 ++++++ src/ringct/rctOps.cpp | 17 ++++++++ src/ringct/rctOps.h | 3 ++ tests/performance_tests/crypto_ops.h | 2 + tests/performance_tests/main.cpp | 1 + tests/unit_tests/bulletproofs.cpp | 61 ++++++++++++++++++++++++++++ 6 files changed, 97 insertions(+) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index bc7e15f35..7ec87378b 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -922,6 +922,19 @@ bool bulletproof_VERIFY(const std::vector &proofs) for (const Bulletproof *p: proofs) { const Bulletproof &proof = *p; + + // check subgroup + for (const rct::key &k: proof.V) + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); + for (const rct::key &k: proof.L) + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); + for (const rct::key &k: proof.R) + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.A), false, "Input point not in subgroup"); + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.S), false, "Input point not in subgroup"); + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T1), false, "Input point not in subgroup"); + CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T2), false, "Input point not in subgroup"); + CHECK_AND_ASSERT_MES(proof.V.size() >= 1, false, "V does not have at least one element"); CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), false, "Mismatched L and R sizes"); CHECK_AND_ASSERT_MES(proof.L.size() > 0, false, "Empty proof"); diff --git a/src/ringct/rctOps.cpp b/src/ringct/rctOps.cpp index fe0ad8747..df027f4b6 100644 --- a/src/ringct/rctOps.cpp +++ b/src/ringct/rctOps.cpp @@ -60,6 +60,17 @@ namespace rct { //Various key generation functions + bool toPointCheckOrder(ge_p3 *P, const unsigned char *data) + { + if (ge_frombytes_vartime(P, data)) + return false; + ge_p2 R; + ge_scalarmult(&R, curveOrder().bytes, P); + key tmp; + ge_tobytes(tmp.bytes, &R); + return tmp == identity(); + } + //generates a random scalar which can be used as a secret key or mask void skGen(key &sk) { random32_unbiased(sk.bytes); @@ -200,6 +211,12 @@ namespace rct { return aP; } + //Computes aL where L is the curve order + bool isInMainSubgroup(const key & a) { + ge_p3 p3; + return toPointCheckOrder(&p3, a.bytes); + } + //Curve addition / subtractions //for curve points: AB = A + B diff --git a/src/ringct/rctOps.h b/src/ringct/rctOps.h index f8889af5c..f0320f333 100644 --- a/src/ringct/rctOps.h +++ b/src/ringct/rctOps.h @@ -83,6 +83,7 @@ namespace rct { keyM keyMInit(size_t rows, size_t cols); //Various key generation functions + bool toPointCheckOrder(ge_p3 *P, const unsigned char *data); //generates a random scalar which can be used as a secret key or mask key skGen(); @@ -119,6 +120,8 @@ namespace rct { key scalarmultKey(const key &P, const key &a); //Computes aH where H= toPoint(cn_fast_hash(G)), G the basepoint key scalarmultH(const key & a); + // checks a is in the main subgroup (ie, not a small one) + bool isInMainSubgroup(const key & a); //Curve addition / subtractions diff --git a/tests/performance_tests/crypto_ops.h b/tests/performance_tests/crypto_ops.h index 852a6670d..f52faa708 100644 --- a/tests/performance_tests/crypto_ops.h +++ b/tests/performance_tests/crypto_ops.h @@ -51,6 +51,7 @@ enum test_op op_addKeys2, op_addKeys3, op_addKeys3_2, + op_isInMainSubgroup, }; template @@ -102,6 +103,7 @@ public: case op_addKeys2: rct::addKeys2(key, scalar0, scalar1, point0); break; case op_addKeys3: rct::addKeys3(key, scalar0, point0, scalar1, precomp1); break; case op_addKeys3_2: rct::addKeys3(key, scalar0, precomp0, scalar1, precomp1); break; + case op_isInMainSubgroup: rct::isInMainSubgroup(point0); break; default: return false; } return true; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 142e544dd..19c2cb5e5 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -237,6 +237,7 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys2); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys3); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys3_2); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_isInMainSubgroup); TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 2); TEST_PERFORMANCE2(filter, p, test_multiexp, multiexp_bos_coster, 4); diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index f163f7a20..2358aa27a 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -30,6 +30,7 @@ #include "gtest/gtest.h" +#include "string_tools.h" #include "ringct/rctOps.h" #include "ringct/rctSigs.h" #include "ringct/bulletproofs.h" @@ -193,3 +194,63 @@ TEST(bulletproofs, invalid_gamma_ff) rct::Bulletproof proof = bulletproof_PROVE(invalid_amount, gamma); ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); } + +static const char * const torsion_elements[] = +{ + "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa", + "0000000000000000000000000000000000000000000000000000000000000000", + "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85", + "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f", + "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05", + "0000000000000000000000000000000000000000000000000000000000000080", + "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a", +}; + +TEST(bulletproofs, invalid_torsion) +{ + rct::Bulletproof proof = bulletproof_PROVE(7329838943733, rct::skGen()); + ASSERT_TRUE(rct::bulletproof_VERIFY(proof)); + for (const auto &xs: torsion_elements) + { + rct::key x; + ASSERT_TRUE(epee::string_tools::hex_to_pod(xs, x)); + ASSERT_FALSE(rct::isInMainSubgroup(x)); + for (auto &k: proof.V) + { + const rct::key org_k = k; + rct::addKeys(k, org_k, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + k = org_k; + } + for (auto &k: proof.L) + { + const rct::key org_k = k; + rct::addKeys(k, org_k, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + k = org_k; + } + for (auto &k: proof.R) + { + const rct::key org_k = k; + rct::addKeys(k, org_k, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + k = org_k; + } + const rct::key org_A = proof.A; + rct::addKeys(proof.A, org_A, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + proof.A = org_A; + const rct::key org_S = proof.S; + rct::addKeys(proof.S, org_S, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + proof.S = org_S; + const rct::key org_T1 = proof.T1; + rct::addKeys(proof.T1, org_T1, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + proof.T1 = org_T1; + const rct::key org_T2 = proof.T2; + rct::addKeys(proof.T2, org_T2, x); + ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); + proof.T2 = org_T2; + } +} From 869b3bf824387ae50ab28be9bce66caae21bcae9 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 16 Jul 2018 14:40:51 +0100 Subject: [PATCH 34/56] bulletproofs: a few fixes from the Kudelski review - fix integer overflow in n_bulletproof_amounts - check input scalars are in range - remove use of environment variable to tweak straus performance - do not use implementation defined signed shift for signum --- src/crypto/crypto-ops.c | 3 +-- src/ringct/bulletproofs.cc | 23 ++++++++++++++++++++--- src/ringct/rctTypes.cpp | 2 ++ tests/unit_tests/bulletproofs.cpp | 10 ---------- 4 files changed, 23 insertions(+), 15 deletions(-) diff --git a/src/crypto/crypto-ops.c b/src/crypto/crypto-ops.c index 45d412ac6..c1fff1d44 100644 --- a/src/crypto/crypto-ops.c +++ b/src/crypto/crypto-ops.c @@ -3707,9 +3707,8 @@ void sc_muladd(unsigned char *s, const unsigned char *a, const unsigned char *b, s[31] = s11 >> 17; } -/* Assumes that a != INT64_MIN */ static int64_t signum(int64_t a) { - return (a >> 63) - ((-a) >> 63); + return a > 0 ? 1 : a < 0 ? -1 : 0; } int sc_check(const unsigned char *s) { diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 7ec87378b..d3822c454 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -74,14 +74,20 @@ static boost::mutex init_mutex; static inline rct::key multiexp(const std::vector &data, bool HiGi) { - static const size_t STEP = getenv("STRAUS_STEP") ? atoi(getenv("STRAUS_STEP")) : 0; if (HiGi) { static_assert(128 <= STRAUS_SIZE_LIMIT, "Straus in precalc mode can only be calculated till STRAUS_SIZE_LIMIT"); - return data.size() <= 128 ? straus(data, straus_HiGi_cache, STEP) : pippenger(data, pippenger_HiGi_cache, get_pippenger_c(data.size())); + return data.size() <= 128 ? straus(data, straus_HiGi_cache, 0) : pippenger(data, pippenger_HiGi_cache, get_pippenger_c(data.size())); } else - return data.size() <= 64 ? straus(data, NULL, STEP) : pippenger(data, NULL, get_pippenger_c(data.size())); + return data.size() <= 64 ? straus(data, NULL, 0) : pippenger(data, NULL, get_pippenger_c(data.size())); +} + +static bool is_reduced(const rct::key &scalar) +{ + rct::key reduced = scalar; + sc_reduce32(reduced.bytes); + return scalar == reduced; } //addKeys3acc_p3 @@ -659,6 +665,10 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) { CHECK_AND_ASSERT_THROW_MES(sv.size() == gamma.size(), "Incompatible sizes of sv and gamma"); CHECK_AND_ASSERT_THROW_MES(!sv.empty(), "sv is empty"); + for (const rct::key &sve: sv) + CHECK_AND_ASSERT_THROW_MES(is_reduced(sve), "Invalid sv input"); + for (const rct::key &g: gamma) + CHECK_AND_ASSERT_THROW_MES(is_reduced(g), "Invalid gamma input"); init_exponents(); @@ -935,6 +945,13 @@ bool bulletproof_VERIFY(const std::vector &proofs) CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T1), false, "Input point not in subgroup"); CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T2), false, "Input point not in subgroup"); + // check scalar range + CHECK_AND_ASSERT_MES(is_reduced(proof.taux), false, "Input scalar not in range"); + CHECK_AND_ASSERT_MES(is_reduced(proof.mu), false, "Input scalar not in range"); + CHECK_AND_ASSERT_MES(is_reduced(proof.a), false, "Input scalar not in range"); + CHECK_AND_ASSERT_MES(is_reduced(proof.b), false, "Input scalar not in range"); + CHECK_AND_ASSERT_MES(is_reduced(proof.t), false, "Input scalar not in range"); + CHECK_AND_ASSERT_MES(proof.V.size() >= 1, false, "V does not have at least one element"); CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), false, "Mismatched L and R sizes"); CHECK_AND_ASSERT_MES(proof.L.size() > 0, false, "Empty proof"); diff --git a/src/ringct/rctTypes.cpp b/src/ringct/rctTypes.cpp index e67637af6..5dd59aec3 100644 --- a/src/ringct/rctTypes.cpp +++ b/src/ringct/rctTypes.cpp @@ -236,6 +236,7 @@ namespace rct { size_t n_bulletproof_amounts(const Bulletproof &proof) { CHECK_AND_ASSERT_MES(proof.L.size() >= 6, 0, "Invalid bulletproof L size"); + CHECK_AND_ASSERT_MES(proof.L.size() <= 31, 0, "Insane bulletproof L size"); return 1 << (proof.L.size() - 6); } @@ -245,6 +246,7 @@ namespace rct { for (const Bulletproof &proof: proofs) { size_t n2 = n_bulletproof_amounts(proof); + CHECK_AND_ASSERT_MES(n2 < std::numeric_limits::max() - n, 0, "Invalid number of bulletproofs"); if (n2 == 0) return 0; n += n2; diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index 2358aa27a..e34982070 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -185,16 +185,6 @@ TEST(bulletproofs, invalid_gamma_0) ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); } -TEST(bulletproofs, invalid_gamma_ff) -{ - rct::key invalid_amount = rct::zero(); - invalid_amount[8] = 1; - rct::key gamma = rct::zero(); - memset(&gamma, 0xff, sizeof(gamma)); - rct::Bulletproof proof = bulletproof_PROVE(invalid_amount, gamma); - ASSERT_FALSE(rct::bulletproof_VERIFY(proof)); -} - static const char * const torsion_elements[] = { "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa", From 5ffb2ff9b7c301eda5811a939c705f26627c4735 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 18 Jul 2018 22:24:53 +0100 Subject: [PATCH 35/56] v8: per byte fee, pad bulletproofs, fixed 11 ring size --- src/blockchain_db/berkeleydb/db_bdb.cpp | 10 +- src/blockchain_db/berkeleydb/db_bdb.h | 6 +- src/blockchain_db/blockchain_db.cpp | 4 +- src/blockchain_db/blockchain_db.h | 20 +- src/blockchain_db/lmdb/db_lmdb.cpp | 33 +- src/blockchain_db/lmdb/db_lmdb.h | 6 +- .../blockchain_import.cpp | 6 +- src/blockchain_utilities/bootstrap_file.cpp | 4 +- .../bootstrap_serialization.h | 4 +- .../cryptonote_basic_impl.cpp | 28 +- src/cryptonote_basic/cryptonote_basic_impl.h | 4 +- .../cryptonote_format_utils.cpp | 58 ++- .../cryptonote_format_utils.h | 2 + src/cryptonote_config.h | 6 +- src/cryptonote_core/blockchain.cpp | 297 +++++++------ src/cryptonote_core/blockchain.h | 83 ++-- src/cryptonote_core/cryptonote_core.cpp | 88 +--- src/cryptonote_core/cryptonote_core.h | 4 +- src/cryptonote_core/cryptonote_tx_utils.cpp | 6 +- src/cryptonote_core/cryptonote_tx_utils.h | 2 +- src/cryptonote_core/tx_pool.cpp | 163 +++---- src/cryptonote_core/tx_pool.h | 46 +- src/daemon/rpc_command_executor.cpp | 27 +- src/ringct/rctSigs.cpp | 15 +- src/ringct/rctTypes.cpp | 47 ++- src/ringct/rctTypes.h | 7 +- src/rpc/core_rpc_server.cpp | 19 +- src/rpc/core_rpc_server.h | 4 +- src/rpc/core_rpc_server_commands_defs.h | 18 +- src/rpc/daemon_handler.cpp | 5 +- src/rpc/message_data_structs.h | 4 + src/serialization/json_object.cpp | 8 + src/simplewallet/simplewallet.cpp | 47 ++- src/wallet/api/wallet.cpp | 1 + src/wallet/node_rpc_proxy.cpp | 66 ++- src/wallet/node_rpc_proxy.h | 14 +- src/wallet/wallet2.cpp | 396 ++++++++++++------ src/wallet/wallet2.h | 24 +- src/wallet/wallet_errors.h | 12 +- src/wallet/wallet_rpc_server.cpp | 1 - src/wallet/wallet_rpc_server_commands_defs.h | 2 - tests/core_tests/block_reward.cpp | 54 +-- tests/core_tests/block_validation.cpp | 4 +- tests/core_tests/bulletproofs.cpp | 146 +++---- tests/core_tests/bulletproofs.h | 35 +- tests/core_tests/chaingen.cpp | 76 ++-- tests/core_tests/chaingen.h | 14 +- tests/core_tests/chaingen_main.cpp | 10 +- tests/performance_tests/check_tx_signature.h | 7 +- tests/performance_tests/main.cpp | 30 +- tests/unit_tests/block_reward.cpp | 84 ++-- tests/unit_tests/blockchain_db.cpp | 2 +- tests/unit_tests/bulletproofs.cpp | 2 +- tests/unit_tests/fee.cpp | 54 +-- tests/unit_tests/hardfork.cpp | 4 +- 55 files changed, 1241 insertions(+), 878 deletions(-) diff --git a/src/blockchain_db/berkeleydb/db_bdb.cpp b/src/blockchain_db/berkeleydb/db_bdb.cpp index f827ab7c3..6c79120e8 100644 --- a/src/blockchain_db/berkeleydb/db_bdb.cpp +++ b/src/blockchain_db/berkeleydb/db_bdb.cpp @@ -224,7 +224,7 @@ struct Dbt_safe : public Dbt namespace cryptonote { -void BlockchainBDB::add_block(const block& blk, const size_t& block_size, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const crypto::hash& blk_hash) +void BlockchainBDB::add_block(const block& blk, size_t block_weight, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const crypto::hash& blk_hash) { LOG_PRINT_L3("BlockchainBDB::" << __func__); check_open(); @@ -255,7 +255,7 @@ void BlockchainBDB::add_block(const block& blk, const size_t& block_size, const if (res) throw0(DB_ERROR("Failed to add block blob to db transaction.")); - Dbt_copy sz(block_size); + Dbt_copy sz(block_weight); if (m_block_sizes->put(DB_DEFAULT_TX, &key, &sz, 0)) throw0(DB_ERROR("Failed to add block size to db transaction.")); @@ -1353,7 +1353,7 @@ uint64_t BlockchainBDB::get_top_block_timestamp() const return get_block_timestamp(m_height - 1); } -size_t BlockchainBDB::get_block_size(const uint64_t& height) const +size_t BlockchainBDB::get_block_weight(const uint64_t& height) const { LOG_PRINT_L3("BlockchainBDB::" << __func__); check_open(); @@ -1861,7 +1861,7 @@ void BlockchainBDB::block_txn_abort() // TODO } -uint64_t BlockchainBDB::add_block(const block& blk, const size_t& block_size, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const std::vector& txs) +uint64_t BlockchainBDB::add_block(const block& blk, size_t block_weight, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const std::vector& txs) { LOG_PRINT_L3("BlockchainBDB::" << __func__); check_open(); @@ -1874,7 +1874,7 @@ uint64_t BlockchainBDB::add_block(const block& blk, const size_t& block_size, co uint64_t num_outputs = m_num_outputs; try { - BlockchainDB::add_block(blk, block_size, cumulative_difficulty, coins_generated, txs); + BlockchainDB::add_block(blk, block_weight, cumulative_difficulty, coins_generated, txs); m_write_txn = NULL; TIME_MEASURE_START(time1); diff --git a/src/blockchain_db/berkeleydb/db_bdb.h b/src/blockchain_db/berkeleydb/db_bdb.h index 8c99ab255..76d0a0517 100644 --- a/src/blockchain_db/berkeleydb/db_bdb.h +++ b/src/blockchain_db/berkeleydb/db_bdb.h @@ -266,7 +266,7 @@ public: virtual uint64_t get_top_block_timestamp() const; - virtual size_t get_block_size(const uint64_t& height) const; + virtual size_t get_block_weight(const uint64_t& height) const; virtual difficulty_type get_block_cumulative_difficulty(const uint64_t& height) const; @@ -318,7 +318,7 @@ public: virtual bool has_key_image(const crypto::key_image& img) const; virtual uint64_t add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , const std::vector& txs @@ -353,7 +353,7 @@ public: private: virtual void add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , const crypto::hash& block_hash diff --git a/src/blockchain_db/blockchain_db.cpp b/src/blockchain_db/blockchain_db.cpp index 78d63fdcf..be0ffeac3 100644 --- a/src/blockchain_db/blockchain_db.cpp +++ b/src/blockchain_db/blockchain_db.cpp @@ -196,7 +196,7 @@ void BlockchainDB::add_transaction(const crypto::hash& blk_hash, const transacti } uint64_t BlockchainDB::add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , const std::vector& txs @@ -241,7 +241,7 @@ uint64_t BlockchainDB::add_block( const block& blk // call out to subclass implementation to add the block & metadata time1 = epee::misc_utils::get_tick_count(); - add_block(blk, block_size, cumulative_difficulty, coins_generated, num_rct_outs, blk_hash); + add_block(blk, block_weight, cumulative_difficulty, coins_generated, num_rct_outs, blk_hash); TIME_MEASURE_FINISH(time1); time_add_block1 += time1; diff --git a/src/blockchain_db/blockchain_db.h b/src/blockchain_db/blockchain_db.h index 4431ca44c..396ae7544 100644 --- a/src/blockchain_db/blockchain_db.h +++ b/src/blockchain_db/blockchain_db.h @@ -137,7 +137,7 @@ struct txpool_tx_meta_t { crypto::hash max_used_block_id; crypto::hash last_failed_id; - uint64_t blob_size; + uint64_t weight; uint64_t fee; uint64_t max_used_block_height; uint64_t last_failed_height; @@ -358,13 +358,13 @@ private: * subclass of DB_EXCEPTION * * @param blk the block to be added - * @param block_size the size of the block (transactions and all) + * @param block_weight the weight of the block (transactions and all) * @param cumulative_difficulty the accumulated difficulty after this block * @param coins_generated the number of coins generated total after this block * @param blk_hash the hash of the block */ virtual void add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , uint64_t num_rct_outs @@ -376,7 +376,7 @@ private: * * The subclass implementing this will remove the block data from the top * block in the chain. The data to be removed is that which was added in - * BlockchainDB::add_block(const block& blk, const size_t& block_size, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const crypto::hash& blk_hash) + * BlockchainDB::add_block(const block& blk, size_t block_weight, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const crypto::hash& blk_hash) * * If any of this cannot be done, the subclass should throw the corresponding * subclass of DB_EXCEPTION @@ -789,7 +789,7 @@ public: * subclass of DB_EXCEPTION * * @param blk the block to be added - * @param block_size the size of the block (transactions and all) + * @param block_weight the size of the block (transactions and all) * @param cumulative_difficulty the accumulated difficulty after this block * @param coins_generated the number of coins generated total after this block * @param txs the transactions in the block @@ -797,7 +797,7 @@ public: * @return the height of the chain post-addition */ virtual uint64_t add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , const std::vector& txs @@ -930,18 +930,18 @@ public: virtual uint64_t get_top_block_timestamp() const = 0; /** - * @brief fetch a block's size + * @brief fetch a block's weight * - * The subclass should return the size of the block with the + * The subclass should return the weight of the block with the * given height. * * If the block does not exist, the subclass should throw BLOCK_DNE * * @param height the height requested * - * @return the size + * @return the weight */ - virtual size_t get_block_size(const uint64_t& height) const = 0; + virtual size_t get_block_weight(const uint64_t& height) const = 0; /** * @brief fetch a block's cumulative difficulty diff --git a/src/blockchain_db/lmdb/db_lmdb.cpp b/src/blockchain_db/lmdb/db_lmdb.cpp index d854cbeaf..9e22e2e4b 100644 --- a/src/blockchain_db/lmdb/db_lmdb.cpp +++ b/src/blockchain_db/lmdb/db_lmdb.cpp @@ -256,7 +256,7 @@ typedef struct mdb_block_info_old uint64_t bi_height; uint64_t bi_timestamp; uint64_t bi_coins; - uint64_t bi_size; // a size_t really but we need 32-bit compat + uint64_t bi_weight; // a size_t really but we need 32-bit compat difficulty_type bi_diff; crypto::hash bi_hash; } mdb_block_info_old; @@ -266,7 +266,7 @@ typedef struct mdb_block_info uint64_t bi_height; uint64_t bi_timestamp; uint64_t bi_coins; - uint64_t bi_size; // a size_t really but we need 32-bit compat + uint64_t bi_weight; // a size_t really but we need 32-bit compat difficulty_type bi_diff; crypto::hash bi_hash; uint64_t bi_cum_rct; @@ -652,8 +652,11 @@ uint64_t BlockchainLMDB::get_estimated_batch_size(uint64_t batch_num_blocks, uin block_rtxn_start(&rtxn, &rcurs); for (uint64_t block_num = block_start; block_num <= block_stop; ++block_num) { - uint32_t block_size = get_block_size(block_num); - total_block_size += block_size; + // we have access to block weight, which will be greater or equal to block size, + // so use this as a proxy. If it's too much off, we might have to check actual size, + // which involves reading more data, so is not really wanted + size_t block_weight = get_block_weight(block_num); + total_block_size += block_weight; // Track number of blocks being totalled here instead of assuming, in case // some blocks were to be skipped for being outliers. ++num_blocks_used; @@ -674,7 +677,7 @@ estim: return threshold_size; } -void BlockchainLMDB::add_block(const block& blk, const size_t& block_size, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, +void BlockchainLMDB::add_block(const block& blk, size_t block_weight, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, uint64_t num_rct_outs, const crypto::hash& blk_hash) { LOG_PRINT_L3("BlockchainLMDB::" << __func__); @@ -720,7 +723,7 @@ void BlockchainLMDB::add_block(const block& blk, const size_t& block_size, const bi.bi_height = m_height; bi.bi_timestamp = blk.timestamp; bi.bi_coins = coins_generated; - bi.bi_size = block_size; + bi.bi_weight = block_weight; bi.bi_diff = cumulative_difficulty; bi.bi_hash = blk_hash; bi.bi_cum_rct = num_rct_outs; @@ -743,7 +746,9 @@ void BlockchainLMDB::add_block(const block& blk, const size_t& block_size, const if (result) throw0(DB_ERROR(lmdb_error("Failed to add block height by hash to db transaction: ", result).c_str())); - m_cum_size += block_size; + // we use weight as a proxy for size, since we don't have size but weight is >= size + // and often actually equal + m_cum_size += block_weight; m_cum_count++; } @@ -2011,7 +2016,7 @@ uint64_t BlockchainLMDB::get_top_block_timestamp() const return get_block_timestamp(m_height - 1); } -size_t BlockchainLMDB::get_block_size(const uint64_t& height) const +size_t BlockchainLMDB::get_block_weight(const uint64_t& height) const { LOG_PRINT_L3("BlockchainLMDB::" << __func__); check_open(); @@ -2029,7 +2034,7 @@ size_t BlockchainLMDB::get_block_size(const uint64_t& height) const throw0(DB_ERROR("Error attempting to retrieve a block size from the db")); mdb_block_info *bi = (mdb_block_info *)result.mv_data; - size_t ret = bi->bi_size; + size_t ret = bi->bi_weight; TXN_POSTFIX_RDONLY(); return ret; } @@ -3090,7 +3095,7 @@ void BlockchainLMDB::block_txn_abort() } } -uint64_t BlockchainLMDB::add_block(const block& blk, const size_t& block_size, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, +uint64_t BlockchainLMDB::add_block(const block& blk, size_t block_weight, const difficulty_type& cumulative_difficulty, const uint64_t& coins_generated, const std::vector& txs) { LOG_PRINT_L3("BlockchainLMDB::" << __func__); @@ -3109,7 +3114,7 @@ uint64_t BlockchainLMDB::add_block(const block& blk, const size_t& block_size, c try { - BlockchainDB::add_block(blk, block_size, cumulative_difficulty, coins_generated, txs); + BlockchainDB::add_block(blk, block_weight, cumulative_difficulty, coins_generated, txs); } catch (const DB_ERROR_TXN_START& e) { @@ -3698,9 +3703,9 @@ void BlockchainLMDB::migrate_0_1() if (result) throw0(DB_ERROR(lmdb_error("Failed to get a record from block_sizes: ", result).c_str())); if (v.mv_size == sizeof(uint32_t)) - bi.bi_size = *(uint32_t *)v.mv_data; + bi.bi_weight = *(uint32_t *)v.mv_data; else - bi.bi_size = *(uint64_t *)v.mv_data; // this is a 32/64 compat bug in version 0 + bi.bi_weight = *(uint64_t *)v.mv_data; // this is a 32/64 compat bug in version 0 result = mdb_cursor_get(c_timestamps, &k, &v, MDB_NEXT); if (result) throw0(DB_ERROR(lmdb_error("Failed to get a record from block_timestamps: ", result).c_str())); @@ -4259,7 +4264,7 @@ void BlockchainLMDB::migrate_2_3() bi.bi_height = bi_old->bi_height; bi.bi_timestamp = bi_old->bi_timestamp; bi.bi_coins = bi_old->bi_coins; - bi.bi_size = bi_old->bi_size; + bi.bi_weight = bi_old->bi_weight; bi.bi_diff = bi_old->bi_diff; bi.bi_hash = bi_old->bi_hash; if (bi_old->bi_height >= distribution.size()) diff --git a/src/blockchain_db/lmdb/db_lmdb.h b/src/blockchain_db/lmdb/db_lmdb.h index f700d3178..e1f748ed8 100644 --- a/src/blockchain_db/lmdb/db_lmdb.h +++ b/src/blockchain_db/lmdb/db_lmdb.h @@ -205,7 +205,7 @@ public: virtual uint64_t get_top_block_timestamp() const; - virtual size_t get_block_size(const uint64_t& height) const; + virtual size_t get_block_weight(const uint64_t& height) const; virtual difficulty_type get_block_cumulative_difficulty(const uint64_t& height) const; @@ -273,7 +273,7 @@ public: virtual bool for_all_outputs(uint64_t amount, const std::function &f) const; virtual uint64_t add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , const std::vector& txs @@ -317,7 +317,7 @@ private: uint64_t get_estimated_batch_size(uint64_t batch_num_blocks, uint64_t batch_bytes) const; virtual void add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , uint64_t num_rct_outs diff --git a/src/blockchain_utilities/blockchain_import.cpp b/src/blockchain_utilities/blockchain_import.cpp index 7291dbd68..9ec768d26 100644 --- a/src/blockchain_utilities/blockchain_import.cpp +++ b/src/blockchain_utilities/blockchain_import.cpp @@ -474,17 +474,17 @@ int import_from_file(cryptonote::core& core, const std::string& import_file_path txs.push_back(tx); } - size_t block_size; + size_t block_weight; difficulty_type cumulative_difficulty; uint64_t coins_generated; - block_size = bp.block_size; + block_weight = bp.block_weight; cumulative_difficulty = bp.cumulative_difficulty; coins_generated = bp.coins_generated; try { - core.get_blockchain_storage().get_db().add_block(b, block_size, cumulative_difficulty, coins_generated, txs); + core.get_blockchain_storage().get_db().add_block(b, block_weight, cumulative_difficulty, coins_generated, txs); } catch (const std::exception& e) { diff --git a/src/blockchain_utilities/bootstrap_file.cpp b/src/blockchain_utilities/bootstrap_file.cpp index ba2697226..beaad2abc 100644 --- a/src/blockchain_utilities/bootstrap_file.cpp +++ b/src/blockchain_utilities/bootstrap_file.cpp @@ -236,11 +236,11 @@ void BootstrapFile::write_block(block& block) bool include_extra_block_data = true; if (include_extra_block_data) { - size_t block_size = m_blockchain_storage->get_db().get_block_size(block_height); + size_t block_weight = m_blockchain_storage->get_db().get_block_weight(block_height); difficulty_type cumulative_difficulty = m_blockchain_storage->get_db().get_block_cumulative_difficulty(block_height); uint64_t coins_generated = m_blockchain_storage->get_db().get_block_already_generated_coins(block_height); - bp.block_size = block_size; + bp.block_weight = block_weight; bp.cumulative_difficulty = cumulative_difficulty; bp.coins_generated = coins_generated; } diff --git a/src/blockchain_utilities/bootstrap_serialization.h b/src/blockchain_utilities/bootstrap_serialization.h index 8755d3fe3..278a7b40f 100644 --- a/src/blockchain_utilities/bootstrap_serialization.h +++ b/src/blockchain_utilities/bootstrap_serialization.h @@ -70,14 +70,14 @@ namespace cryptonote { cryptonote::block block; std::vector txs; - size_t block_size; + size_t block_weight; difficulty_type cumulative_difficulty; uint64_t coins_generated; BEGIN_SERIALIZE() FIELD(block) FIELD(txs) - VARINT_FIELD(block_size) + VARINT_FIELD(block_weight) VARINT_FIELD(cumulative_difficulty) VARINT_FIELD(coins_generated) END_SERIALIZE() diff --git a/src/cryptonote_basic/cryptonote_basic_impl.cpp b/src/cryptonote_basic/cryptonote_basic_impl.cpp index cff23695f..b18ef1c5c 100644 --- a/src/cryptonote_basic/cryptonote_basic_impl.cpp +++ b/src/cryptonote_basic/cryptonote_basic_impl.cpp @@ -67,7 +67,7 @@ namespace cryptonote { /* Cryptonote helper functions */ /************************************************************************/ //----------------------------------------------------------------------------------------------- - size_t get_min_block_size(uint8_t version) + size_t get_min_block_weight(uint8_t version) { if (version < 2) return CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1; @@ -86,7 +86,7 @@ namespace cryptonote { return CRYPTONOTE_MAX_TX_SIZE; } //----------------------------------------------------------------------------------------------- - bool get_block_reward(size_t median_size, size_t current_block_size, uint64_t already_generated_coins, uint64_t &reward, uint8_t version) { + bool get_block_reward(size_t median_weight, size_t current_block_weight, uint64_t already_generated_coins, uint64_t &reward, uint8_t version) { static_assert(DIFFICULTY_TARGET_V2%60==0&&DIFFICULTY_TARGET_V1%60==0,"difficulty targets must be a multiple of 60"); const int target = version < 2 ? DIFFICULTY_TARGET_V1 : DIFFICULTY_TARGET_V2; const int target_minutes = target / 60; @@ -98,37 +98,37 @@ namespace cryptonote { base_reward = FINAL_SUBSIDY_PER_MINUTE*target_minutes; } - uint64_t full_reward_zone = get_min_block_size(version); + uint64_t full_reward_zone = get_min_block_weight(version); //make it soft - if (median_size < full_reward_zone) { - median_size = full_reward_zone; + if (median_weight < full_reward_zone) { + median_weight = full_reward_zone; } - if (current_block_size <= median_size) { + if (current_block_weight <= median_weight) { reward = base_reward; return true; } - if(current_block_size > 2 * median_size) { - MERROR("Block cumulative size is too big: " << current_block_size << ", expected less than " << 2 * median_size); + if(current_block_weight > 2 * median_weight) { + MERROR("Block cumulative weight is too big: " << current_block_weight << ", expected less than " << 2 * median_weight); return false; } - assert(median_size < std::numeric_limits::max()); - assert(current_block_size < std::numeric_limits::max()); + assert(median_weight < std::numeric_limits::max()); + assert(current_block_weight < std::numeric_limits::max()); uint64_t product_hi; // BUGFIX: 32-bit saturation bug (e.g. ARM7), the result was being // treated as 32-bit by default. - uint64_t multiplicand = 2 * median_size - current_block_size; - multiplicand *= current_block_size; + uint64_t multiplicand = 2 * median_weight - current_block_weight; + multiplicand *= current_block_weight; uint64_t product_lo = mul128(base_reward, multiplicand, &product_hi); uint64_t reward_hi; uint64_t reward_lo; - div128_32(product_hi, product_lo, static_cast(median_size), &reward_hi, &reward_lo); - div128_32(reward_hi, reward_lo, static_cast(median_size), &reward_hi, &reward_lo); + div128_32(product_hi, product_lo, static_cast(median_weight), &reward_hi, &reward_lo); + div128_32(reward_hi, reward_lo, static_cast(median_weight), &reward_hi, &reward_lo); assert(0 == reward_hi); assert(reward_lo < base_reward); diff --git a/src/cryptonote_basic/cryptonote_basic_impl.h b/src/cryptonote_basic/cryptonote_basic_impl.h index f59785021..c804a88fa 100644 --- a/src/cryptonote_basic/cryptonote_basic_impl.h +++ b/src/cryptonote_basic/cryptonote_basic_impl.h @@ -86,10 +86,10 @@ namespace cryptonote { /************************************************************************/ /* Cryptonote helper functions */ /************************************************************************/ - size_t get_min_block_size(uint8_t version); + size_t get_min_block_weight(uint8_t version); size_t get_max_block_size(); size_t get_max_tx_size(); - bool get_block_reward(size_t median_size, size_t current_block_size, uint64_t already_generated_coins, uint64_t &reward, uint8_t version); + bool get_block_reward(size_t median_weight, size_t current_block_weight, uint64_t already_generated_coins, uint64_t &reward, uint8_t version); uint8_t get_account_address_checksum(const public_address_outer_blob& bl); uint8_t get_account_integrated_address_checksum(const public_integrated_address_outer_blob& bl); diff --git a/src/cryptonote_basic/cryptonote_format_utils.cpp b/src/cryptonote_basic/cryptonote_format_utils.cpp index 524cbf7ae..f1a5c4d94 100644 --- a/src/cryptonote_basic/cryptonote_format_utils.cpp +++ b/src/cryptonote_basic/cryptonote_format_utils.cpp @@ -142,24 +142,27 @@ namespace cryptonote const bool bulletproof = rct::is_rct_bulletproof(rv.type); if (bulletproof) { - if (rct::n_bulletproof_amounts(rv.p.bulletproofs) != tx.vout.size()) + if (rv.p.bulletproofs.size() != 1) { LOG_PRINT_L1("Failed to parse transaction from blob, bad bulletproofs size in tx " << get_transaction_hash(tx)); return false; } - size_t idx = 0; - for (size_t n = 0; n < rv.p.bulletproofs.size(); ++n) + if (rv.p.bulletproofs[0].L.size() < 6) { - //rv.p.bulletproofs[n].V.resize(1); - //rv.p.bulletproofs[n].V[0] = rv.outPk[n].mask; - CHECK_AND_ASSERT_MES(rv.p.bulletproofs[n].L.size() >= 6, false, "Bad bulletproofs L size"); // at least 64 bits - const size_t n_amounts = rct::n_bulletproof_amounts(rv.p.bulletproofs[n]); - CHECK_AND_ASSERT_MES(idx + n_amounts <= rv.outPk.size(), false, "Internal error filling out V"); - rv.p.bulletproofs[n].V.resize(n_amounts); - rv.p.bulletproofs[n].V.clear(); - for (size_t i = 0; i < n_amounts; ++i) - rv.p.bulletproofs[n].V[i] = rv.outPk[idx++].mask; + LOG_PRINT_L1("Failed to parse transaction from blob, bad bulletproofs L size in tx " << get_transaction_hash(tx)); + return false; } + const size_t max_outputs = 1 << (rv.p.bulletproofs[0].L.size() - 6); + if (max_outputs < tx.vout.size()) + { + LOG_PRINT_L1("Failed to parse transaction from blob, bad bulletproofs max outputs in tx " << get_transaction_hash(tx)); + return false; + } + const size_t n_amounts = tx.vout.size(); + CHECK_AND_ASSERT_MES(n_amounts == rv.outPk.size(), false, "Internal error filling out V"); + rv.p.bulletproofs[0].V.resize(n_amounts); + for (size_t i = 0; i < n_amounts; ++i) + rv.p.bulletproofs[0].V[i] = rv.outPk[i].mask; } } } @@ -326,6 +329,37 @@ namespace cryptonote return string_tools::get_xtype_from_string(amount, str_amount); } //--------------------------------------------------------------- + uint64_t get_transaction_weight(const transaction &tx, size_t blob_size) + { + if (tx.version < 2) + return blob_size; + const rct::rctSig &rv = tx.rct_signatures; + if (!rct::is_rct_bulletproof(rv.type)) + return blob_size; + const size_t n_outputs = tx.vout.size(); + if (n_outputs <= 2) + return blob_size; + const uint64_t bp_base = 368; + const size_t n_padded_outputs = rct::n_bulletproof_max_amounts(rv.p.bulletproofs); + size_t nlr = 0; + for (const auto &bp: rv.p.bulletproofs) + nlr += bp.L.size() * 2; + const size_t bp_size = 32 * (9 + nlr); + CHECK_AND_ASSERT_THROW_MES_L1(bp_base * n_padded_outputs >= bp_size, "Invalid bulletproof clawback"); + const uint64_t bp_clawback = (bp_base * n_padded_outputs - bp_size) * 4 / 5; + CHECK_AND_ASSERT_THROW_MES_L1(bp_clawback <= std::numeric_limits::max() - blob_size, "Weight overflow"); + return blob_size + bp_clawback; + } + //--------------------------------------------------------------- + uint64_t get_transaction_weight(const transaction &tx) + { + std::ostringstream s; + binary_archive a(s); + ::serialization::serialize(a, const_cast(tx)); + const cryptonote::blobdata blob = s.str(); + return get_transaction_weight(tx, blob.size()); + } + //--------------------------------------------------------------- bool get_tx_fee(const transaction& tx, uint64_t & fee) { if (tx.version > 1) diff --git a/src/cryptonote_basic/cryptonote_format_utils.h b/src/cryptonote_basic/cryptonote_format_utils.h index 8a5296d5b..bf71eb591 100644 --- a/src/cryptonote_basic/cryptonote_format_utils.h +++ b/src/cryptonote_basic/cryptonote_format_utils.h @@ -117,6 +117,8 @@ namespace cryptonote bool check_inputs_types_supported(const transaction& tx); bool check_outs_valid(const transaction& tx); bool parse_amount(uint64_t& amount, const std::string& str_amount); + uint64_t get_transaction_weight(const transaction &tx); + uint64_t get_transaction_weight(const transaction &tx, size_t blob_size); bool check_money_overflow(const transaction& tx); bool check_outs_overflow(const transaction& tx); diff --git a/src/cryptonote_config.h b/src/cryptonote_config.h index 00bc2f275..a6858ce7c 100644 --- a/src/cryptonote_config.h +++ b/src/cryptonote_config.h @@ -65,9 +65,11 @@ #define FEE_PER_KB_OLD ((uint64_t)10000000000) // pow(10, 10) #define FEE_PER_KB ((uint64_t)2000000000) // 2 * pow(10, 9) +#define FEE_PER_BYTE ((uint64_t)300000) #define DYNAMIC_FEE_PER_KB_BASE_FEE ((uint64_t)2000000000) // 2 * pow(10,9) #define DYNAMIC_FEE_PER_KB_BASE_BLOCK_REWARD ((uint64_t)10000000000000) // 10 * pow(10,12) #define DYNAMIC_FEE_PER_KB_BASE_FEE_V5 ((uint64_t)2000000000 * (uint64_t)CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V5) +#define DYNAMIC_FEE_REFERENCE_TRANSACTION_WEIGHT ((uint64_t)3000) #define ORPHANED_BLOCKS_MAX_COUNT 100 @@ -133,13 +135,15 @@ #define HF_VERSION_DYNAMIC_FEE 4 #define HF_VERSION_MIN_MIXIN_4 6 #define HF_VERSION_MIN_MIXIN_6 7 +#define HF_VERSION_MIN_MIXIN_10 8 #define HF_VERSION_ENFORCE_RCT 6 +#define HF_VERSION_PER_BYTE_FEE 8 #define PER_KB_FEE_QUANTIZATION_DECIMALS 8 #define HASH_OF_HASHES_STEP 256 -#define DEFAULT_TXPOOL_MAX_SIZE 648000000ull // 3 days at 300000, in bytes +#define DEFAULT_TXPOOL_MAX_WEIGHT 648000000ull // 3 days at 300000, in bytes #define BULLETPROOF_MAX_OUTPUTS 16 diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index 9beb28fbd..6fe4a287f 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -155,7 +155,7 @@ static const struct { //------------------------------------------------------------------ Blockchain::Blockchain(tx_memory_pool& tx_pool) : - m_db(), m_tx_pool(tx_pool), m_hardfork(NULL), m_timestamps_and_difficulties_height(0), m_current_block_cumul_sz_limit(0), m_current_block_cumul_sz_median(0), + m_db(), m_tx_pool(tx_pool), m_hardfork(NULL), m_timestamps_and_difficulties_height(0), m_current_block_cumul_weight_limit(0), m_current_block_cumul_weight_median(0), m_enforce_dns_checkpoints(false), m_max_prepare_blocks_threads(4), m_db_sync_on_blocks(true), m_db_sync_threshold(1), m_db_sync_mode(db_async), m_db_default_sync(false), m_fast_sync(true), m_show_time_stats(false), m_sync_counter(0), m_bytes_to_sync(0), m_cancel(false), m_difficulty_for_next_block_top_hash(crypto::null_hash), m_difficulty_for_next_block(1), @@ -482,7 +482,7 @@ bool Blockchain::init(BlockchainDB* db, const network_type nettype, bool offline m_tx_pool.on_blockchain_dec(m_db->height()-1, get_tail_id()); } - update_next_cumulative_size_limit(); + update_next_cumulative_weight_limit(); return true; } //------------------------------------------------------------------ @@ -631,7 +631,7 @@ block Blockchain::pop_block_from_blockchain() m_blocks_txs_check.clear(); m_check_txin_table.clear(); - update_next_cumulative_size_limit(); + update_next_cumulative_weight_limit(); m_tx_pool.on_blockchain_dec(m_db->height()-1, get_tail_id()); invalidate_block_template_cache(); @@ -650,7 +650,7 @@ bool Blockchain::reset_and_set_genesis_block(const block& b) block_verification_context bvc = boost::value_initialized(); add_new_block(b, bvc); - update_next_cumulative_size_limit(); + update_next_cumulative_weight_limit(); return bvc.m_added_to_main_chain && !bvc.m_verifivation_failed; } //------------------------------------------------------------------ @@ -1113,7 +1113,7 @@ bool Blockchain::prevalidate_miner_transaction(const block& b, uint64_t height) } //------------------------------------------------------------------ // This function validates the miner transaction reward -bool Blockchain::validate_miner_transaction(const block& b, size_t cumulative_block_size, uint64_t fee, uint64_t& base_reward, uint64_t already_generated_coins, bool &partial_block_reward, uint8_t version) +bool Blockchain::validate_miner_transaction(const block& b, size_t cumulative_block_weight, uint64_t fee, uint64_t& base_reward, uint64_t already_generated_coins, bool &partial_block_reward, uint8_t version) { LOG_PRINT_L3("Blockchain::" << __func__); //validate reward @@ -1131,11 +1131,11 @@ bool Blockchain::validate_miner_transaction(const block& b, size_t cumulative_bl } } - std::vector last_blocks_sizes; - get_last_n_blocks_sizes(last_blocks_sizes, CRYPTONOTE_REWARD_BLOCKS_WINDOW); - if (!get_block_reward(epee::misc_utils::median(last_blocks_sizes), cumulative_block_size, already_generated_coins, base_reward, version)) + std::vector last_blocks_weights; + get_last_n_blocks_weights(last_blocks_weights, CRYPTONOTE_REWARD_BLOCKS_WINDOW); + if (!get_block_reward(epee::misc_utils::median(last_blocks_weights), cumulative_block_weight, already_generated_coins, base_reward, version)) { - MERROR_VER("block size " << cumulative_block_size << " is bigger than allowed for this blockchain"); + MERROR_VER("block weight " << cumulative_block_weight << " is bigger than allowed for this blockchain"); return false; } if(base_reward + fee < money_in_use) @@ -1165,8 +1165,8 @@ bool Blockchain::validate_miner_transaction(const block& b, size_t cumulative_bl return true; } //------------------------------------------------------------------ -// get the block sizes of the last blocks, and return by reference . -void Blockchain::get_last_n_blocks_sizes(std::vector& sz, size_t count) const +// get the block weights of the last blocks, and return by reference . +void Blockchain::get_last_n_blocks_weights(std::vector& weights, size_t count) const { LOG_PRINT_L3("Blockchain::" << __func__); CRITICAL_REGION_LOCAL(m_blockchain_lock); @@ -1177,26 +1177,26 @@ void Blockchain::get_last_n_blocks_sizes(std::vector& sz, size_t count) return; m_db->block_txn_start(true); - // add size of last blocks to vector (or less, if blockchain size < count) + // add weight of last blocks to vector (or less, if blockchain size < count) size_t start_offset = h - std::min(h, count); - sz.reserve(sz.size() + h - start_offset); + weights.reserve(weights.size() + h - start_offset); for(size_t i = start_offset; i < h; i++) { - sz.push_back(m_db->get_block_size(i)); + weights.push_back(m_db->get_block_weight(i)); } m_db->block_txn_stop(); } //------------------------------------------------------------------ -uint64_t Blockchain::get_current_cumulative_blocksize_limit() const +uint64_t Blockchain::get_current_cumulative_block_weight_limit() const { LOG_PRINT_L3("Blockchain::" << __func__); - return m_current_block_cumul_sz_limit; + return m_current_block_cumul_weight_limit; } //------------------------------------------------------------------ -uint64_t Blockchain::get_current_cumulative_blocksize_median() const +uint64_t Blockchain::get_current_cumulative_block_weight_median() const { LOG_PRINT_L3("Blockchain::" << __func__); - return m_current_block_cumul_sz_median; + return m_current_block_cumul_weight_median; } //------------------------------------------------------------------ //TODO: This function only needed minor modification to work with BlockchainDB, @@ -1213,7 +1213,7 @@ uint64_t Blockchain::get_current_cumulative_blocksize_median() const bool Blockchain::create_block_template(block& b, const account_public_address& miner_address, difficulty_type& diffic, uint64_t& height, uint64_t& expected_reward, const blobdata& ex_nonce) { LOG_PRINT_L3("Blockchain::" << __func__); - size_t median_size; + size_t median_weight; uint64_t already_generated_coins; uint64_t pool_cookie; @@ -1250,20 +1250,20 @@ bool Blockchain::create_block_template(block& b, const account_public_address& m diffic = get_difficulty_for_next_block(); CHECK_AND_ASSERT_MES(diffic, false, "difficulty overhead."); - median_size = m_current_block_cumul_sz_limit / 2; + median_weight = m_current_block_cumul_weight_limit / 2; already_generated_coins = m_db->get_block_already_generated_coins(height - 1); CRITICAL_REGION_END(); - size_t txs_size; + size_t txs_weight; uint64_t fee; - if (!m_tx_pool.fill_block_template(b, median_size, already_generated_coins, txs_size, fee, expected_reward, m_hardfork->get_current_version())) + if (!m_tx_pool.fill_block_template(b, median_weight, already_generated_coins, txs_weight, fee, expected_reward, m_hardfork->get_current_version())) { return false; } pool_cookie = m_tx_pool.cookie(); #if defined(DEBUG_CREATE_BLOCK_TEMPLATE) - size_t real_txs_size = 0; + size_t real_txs_weight = 0; uint64_t real_fee = 0; CRITICAL_REGION_BEGIN(m_tx_pool.m_transactions_lock); for(crypto::hash &cur_hash: b.tx_hashes) @@ -1275,11 +1275,11 @@ bool Blockchain::create_block_template(block& b, const account_public_address& m continue; } tx_memory_pool::tx_details &cur_tx = cur_res->second; - real_txs_size += cur_tx.blob_size; + real_txs_weight += cur_tx.weight; real_fee += cur_tx.fee; - if (cur_tx.blob_size != get_object_blobsize(cur_tx.tx)) + if (cur_tx.weight != get_transaction_weight(cur_tx.tx)) { - LOG_ERROR("Creating block template: error: invalid transaction size"); + LOG_ERROR("Creating block template: error: invalid transaction weight"); } if (cur_tx.tx.version == 1) { @@ -1301,9 +1301,9 @@ bool Blockchain::create_block_template(block& b, const account_public_address& m } } } - if (txs_size != real_txs_size) + if (txs_weight != real_txs_weight) { - LOG_ERROR("Creating block template: error: wrongly calculated transaction size"); + LOG_ERROR("Creating block template: error: wrongly calculated transaction weight"); } if (fee != real_fee) { @@ -1311,70 +1311,70 @@ bool Blockchain::create_block_template(block& b, const account_public_address& m } CRITICAL_REGION_END(); MDEBUG("Creating block template: height " << height << - ", median size " << median_size << + ", median weight " << median_weight << ", already generated coins " << already_generated_coins << - ", transaction size " << txs_size << + ", transaction weight " << txs_weight << ", fee " << fee); #endif /* - two-phase miner transaction generation: we don't know exact block size until we prepare block, but we don't know reward until we know - block size, so first miner transaction generated with fake amount of money, and with phase we know think we know expected block size + two-phase miner transaction generation: we don't know exact block weight until we prepare block, but we don't know reward until we know + block weight, so first miner transaction generated with fake amount of money, and with phase we know think we know expected block weight */ - //make blocks coin-base tx looks close to real coinbase tx to get truthful blob size + //make blocks coin-base tx looks close to real coinbase tx to get truthful blob weight uint8_t hf_version = m_hardfork->get_current_version(); size_t max_outs = hf_version >= 4 ? 1 : 11; - bool r = construct_miner_tx(height, median_size, already_generated_coins, txs_size, fee, miner_address, b.miner_tx, ex_nonce, max_outs, hf_version); + bool r = construct_miner_tx(height, median_weight, already_generated_coins, txs_weight, fee, miner_address, b.miner_tx, ex_nonce, max_outs, hf_version); CHECK_AND_ASSERT_MES(r, false, "Failed to construct miner tx, first chance"); - size_t cumulative_size = txs_size + get_object_blobsize(b.miner_tx); + size_t cumulative_weight = txs_weight + get_transaction_weight(b.miner_tx); #if defined(DEBUG_CREATE_BLOCK_TEMPLATE) - MDEBUG("Creating block template: miner tx size " << get_object_blobsize(b.miner_tx) << - ", cumulative size " << cumulative_size); + MDEBUG("Creating block template: miner tx weight " << get_transaction_weight(b.miner_tx) << + ", cumulative weight " << cumulative_weight); #endif for (size_t try_count = 0; try_count != 10; ++try_count) { - r = construct_miner_tx(height, median_size, already_generated_coins, cumulative_size, fee, miner_address, b.miner_tx, ex_nonce, max_outs, hf_version); + r = construct_miner_tx(height, median_weight, already_generated_coins, cumulative_weight, fee, miner_address, b.miner_tx, ex_nonce, max_outs, hf_version); CHECK_AND_ASSERT_MES(r, false, "Failed to construct miner tx, second chance"); - size_t coinbase_blob_size = get_object_blobsize(b.miner_tx); - if (coinbase_blob_size > cumulative_size - txs_size) + size_t coinbase_weight = get_transaction_weight(b.miner_tx); + if (coinbase_weight > cumulative_weight - txs_weight) { - cumulative_size = txs_size + coinbase_blob_size; + cumulative_weight = txs_weight + coinbase_weight; #if defined(DEBUG_CREATE_BLOCK_TEMPLATE) - MDEBUG("Creating block template: miner tx size " << coinbase_blob_size << - ", cumulative size " << cumulative_size << " is greater than before"); + MDEBUG("Creating block template: miner tx weight " << coinbase_weight << + ", cumulative weight " << cumulative_weight << " is greater than before"); #endif continue; } - if (coinbase_blob_size < cumulative_size - txs_size) + if (coinbase_weight < cumulative_weight - txs_weight) { - size_t delta = cumulative_size - txs_size - coinbase_blob_size; + size_t delta = cumulative_weight - txs_weight - coinbase_weight; #if defined(DEBUG_CREATE_BLOCK_TEMPLATE) - MDEBUG("Creating block template: miner tx size " << coinbase_blob_size << - ", cumulative size " << txs_size + coinbase_blob_size << + MDEBUG("Creating block template: miner tx weight " << coinbase_weight << + ", cumulative weight " << txs_weight + coinbase_weight << " is less than before, adding " << delta << " zero bytes"); #endif b.miner_tx.extra.insert(b.miner_tx.extra.end(), delta, 0); //here could be 1 byte difference, because of extra field counter is varint, and it can become from 1-byte len to 2-bytes len. - if (cumulative_size != txs_size + get_object_blobsize(b.miner_tx)) + if (cumulative_weight != txs_weight + get_transaction_weight(b.miner_tx)) { - CHECK_AND_ASSERT_MES(cumulative_size + 1 == txs_size + get_object_blobsize(b.miner_tx), false, "unexpected case: cumulative_size=" << cumulative_size << " + 1 is not equal txs_cumulative_size=" << txs_size << " + get_object_blobsize(b.miner_tx)=" << get_object_blobsize(b.miner_tx)); + CHECK_AND_ASSERT_MES(cumulative_weight + 1 == txs_weight + get_transaction_weight(b.miner_tx), false, "unexpected case: cumulative_weight=" << cumulative_weight << " + 1 is not equal txs_cumulative_weight=" << txs_weight << " + get_transaction_weight(b.miner_tx)=" << get_transaction_weight(b.miner_tx)); b.miner_tx.extra.resize(b.miner_tx.extra.size() - 1); - if (cumulative_size != txs_size + get_object_blobsize(b.miner_tx)) + if (cumulative_weight != txs_weight + get_transaction_weight(b.miner_tx)) { - //fuck, not lucky, -1 makes varint-counter size smaller, in that case we continue to grow with cumulative_size + //fuck, not lucky, -1 makes varint-counter size smaller, in that case we continue to grow with cumulative_weight MDEBUG("Miner tx creation has no luck with delta_extra size = " << delta << " and " << delta - 1); - cumulative_size += delta - 1; + cumulative_weight += delta - 1; continue; } MDEBUG("Setting extra for block: " << b.miner_tx.extra.size() << ", try_count=" << try_count); } } - CHECK_AND_ASSERT_MES(cumulative_size == txs_size + get_object_blobsize(b.miner_tx), false, "unexpected case: cumulative_size=" << cumulative_size << " is not equal txs_cumulative_size=" << txs_size << " + get_object_blobsize(b.miner_tx)=" << get_object_blobsize(b.miner_tx)); + CHECK_AND_ASSERT_MES(cumulative_weight == txs_weight + get_transaction_weight(b.miner_tx), false, "unexpected case: cumulative_weight=" << cumulative_weight << " is not equal txs_cumulative_weight=" << txs_weight << " + get_transaction_weight(b.miner_tx)=" << get_transaction_weight(b.miner_tx)); #if defined(DEBUG_CREATE_BLOCK_TEMPLATE) - MDEBUG("Creating block template: miner tx size " << coinbase_blob_size << - ", cumulative size " << cumulative_size << " is now good"); + MDEBUG("Creating block template: miner tx weight " << coinbase_weight << + ", cumulative weight " << cumulative_weight << " is now good"); #endif cache_block_template(b, miner_address, ex_nonce, diffic, expected_reward, pool_cookie); @@ -2540,7 +2540,7 @@ bool Blockchain::check_tx_inputs(transaction& tx, uint64_t& max_used_block_heigh if(m_show_time_stats) { size_t ring_size = !tx.vin.empty() && tx.vin[0].type() == typeid(txin_to_key) ? boost::get(tx.vin[0]).key_offsets.size() : 0; - MINFO("HASH: " << get_transaction_hash(tx) << " I/M/O: " << tx.vin.size() << "/" << ring_size << "/" << tx.vout.size() << " H: " << max_used_block_height << " ms: " << a + m_fake_scan_time << " B: " << get_object_blobsize(tx)); + MINFO("HASH: " << get_transaction_hash(tx) << " I/M/O: " << tx.vin.size() << "/" << ring_size << "/" << tx.vout.size() << " H: " << max_used_block_height << " ms: " << a + m_fake_scan_time << " B: " << get_object_blobsize(tx) << " W: " << get_transaction_weight(tx)); } if (!res) return false; @@ -2597,12 +2597,27 @@ bool Blockchain::check_tx_outputs(const transaction& tx, tx_verification_context // from v8, allow bulletproofs if (hf_version < 8) { - const bool bulletproof = rct::is_rct_bulletproof(tx.rct_signatures.type); - if (bulletproof || !tx.rct_signatures.p.bulletproofs.empty()) - { - MERROR("Bulletproofs are not allowed before v8"); - tvc.m_invalid_output = true; - return false; + if (tx.version >= 2) { + const bool bulletproof = rct::is_rct_bulletproof(tx.rct_signatures.type); + if (bulletproof || !tx.rct_signatures.p.bulletproofs.empty()) + { + MERROR("Bulletproofs are not allowed before v8"); + tvc.m_invalid_output = true; + return false; + } + } + } + + // from v9, forbid borromean range proofs + if (hf_version > 8) { + if (tx.version >= 2) { + const bool borromean = rct::is_rct_borromean(tx.rct_signatures.type); + if (borromean) + { + MERROR("Borromean range proofs are not allowed after v8"); + tvc.m_invalid_output = true; + return false; + } } } @@ -2714,7 +2729,7 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, { size_t n_unmixable = 0, n_mixable = 0; size_t mixin = std::numeric_limits::max(); - const size_t min_mixin = hf_version >= HF_VERSION_MIN_MIXIN_6 ? 6 : hf_version >= HF_VERSION_MIN_MIXIN_4 ? 4 : 2; + const size_t min_mixin = hf_version >= HF_VERSION_MIN_MIXIN_10 ? 10 : hf_version >= HF_VERSION_MIN_MIXIN_6 ? 6 : hf_version >= HF_VERSION_MIN_MIXIN_4 ? 4 : 2; for (const auto& txin : tx.vin) { // non txin_to_key inputs will be rejected below @@ -2743,6 +2758,13 @@ bool Blockchain::check_tx_inputs(transaction& tx, tx_verification_context &tvc, } } + if (hf_version >= HF_VERSION_MIN_MIXIN_10 && mixin != 10) + { + MERROR_VER("Tx " << get_transaction_hash(tx) << " has invalid ring size (" << (mixin + 1) << "), it should be 11"); + tvc.m_low_mixin = true; + return false; + } + if (mixin < min_mixin) { if (n_unmixable == 0) @@ -3093,7 +3115,7 @@ void Blockchain::check_ring_signature(const crypto::hash &tx_prefix_hash, const } //------------------------------------------------------------------ -static uint64_t get_fee_quantization_mask() +uint64_t Blockchain::get_fee_quantization_mask() { static uint64_t mask = 0; if (mask == 0) @@ -3106,16 +3128,27 @@ static uint64_t get_fee_quantization_mask() } //------------------------------------------------------------------ -uint64_t Blockchain::get_dynamic_per_kb_fee(uint64_t block_reward, size_t median_block_size, uint8_t version) +uint64_t Blockchain::get_dynamic_base_fee(uint64_t block_reward, size_t median_block_weight, uint8_t version) { - const uint64_t min_block_size = get_min_block_size(version); - const uint64_t fee_per_kb_base = version >= 5 ? DYNAMIC_FEE_PER_KB_BASE_FEE_V5 : DYNAMIC_FEE_PER_KB_BASE_FEE; + const uint64_t min_block_weight = get_min_block_weight(version); + if (median_block_weight < min_block_weight) + median_block_weight = min_block_weight; + uint64_t hi, lo; - if (median_block_size < min_block_size) - median_block_size = min_block_size; + if (version >= HF_VERSION_PER_BYTE_FEE) + { + lo = mul128(block_reward, DYNAMIC_FEE_REFERENCE_TRANSACTION_WEIGHT, &hi); + div128_32(hi, lo, min_block_weight, &hi, &lo); + div128_32(hi, lo, median_block_weight, &hi, &lo); + assert(hi == 0); + lo /= 5; + return lo; + } - uint64_t unscaled_fee_per_kb = (fee_per_kb_base * min_block_size / median_block_size); - uint64_t hi, lo = mul128(unscaled_fee_per_kb, block_reward, &hi); + const uint64_t fee_base = version >= 5 ? DYNAMIC_FEE_PER_KB_BASE_FEE_V5 : DYNAMIC_FEE_PER_KB_BASE_FEE; + + uint64_t unscaled_fee_base = (fee_base * min_block_weight / median_block_weight); + lo = mul128(unscaled_fee_base, block_reward, &hi); static_assert(DYNAMIC_FEE_PER_KB_BASE_BLOCK_REWARD % 1000000 == 0, "DYNAMIC_FEE_PER_KB_BASE_BLOCK_REWARD must be divisible by 1000000"); static_assert(DYNAMIC_FEE_PER_KB_BASE_BLOCK_REWARD / 1000000 <= std::numeric_limits::max(), "DYNAMIC_FEE_PER_KB_BASE_BLOCK_REWARD is too large"); @@ -3133,29 +3166,48 @@ uint64_t Blockchain::get_dynamic_per_kb_fee(uint64_t block_reward, size_t median } //------------------------------------------------------------------ -bool Blockchain::check_fee(size_t blob_size, uint64_t fee) const +bool Blockchain::check_fee(size_t tx_weight, uint64_t fee) const { const uint8_t version = get_current_hard_fork_version(); - uint64_t fee_per_kb; - if (version < HF_VERSION_DYNAMIC_FEE) + uint64_t median = 0; + uint64_t already_generated_coins = 0; + uint64_t base_reward = 0; + if (version >= HF_VERSION_DYNAMIC_FEE) { - fee_per_kb = FEE_PER_KB; + median = m_current_block_cumul_weight_limit / 2; + already_generated_coins = m_db->height() ? m_db->get_block_already_generated_coins(m_db->height() - 1) : 0; + if (!get_block_reward(median, 1, already_generated_coins, base_reward, version)) + return false; + } + + uint64_t needed_fee; + if (version >= HF_VERSION_PER_BYTE_FEE) + { + uint64_t fee_per_byte = get_dynamic_base_fee(base_reward, median, version); + MDEBUG("Using " << print_money(fee_per_byte) << "/byte fee"); + needed_fee = tx_weight * fee_per_byte; + // quantize fee up to 8 decimals + const uint64_t mask = get_fee_quantization_mask(); + needed_fee = (needed_fee + mask - 1) / mask * mask; } else { - uint64_t median = m_current_block_cumul_sz_limit / 2; - uint64_t already_generated_coins = m_db->height() ? m_db->get_block_already_generated_coins(m_db->height() - 1) : 0; - uint64_t base_reward; - if (!get_block_reward(median, 1, already_generated_coins, base_reward, version)) - return false; - fee_per_kb = get_dynamic_per_kb_fee(base_reward, median, version); - } - MDEBUG("Using " << print_money(fee_per_kb) << "/kB fee"); + uint64_t fee_per_kb; + if (version < HF_VERSION_DYNAMIC_FEE) + { + fee_per_kb = FEE_PER_KB; + } + else + { + fee_per_kb = get_dynamic_base_fee(base_reward, median, version); + } + MDEBUG("Using " << print_money(fee_per_kb) << "/kB fee"); - uint64_t needed_fee = blob_size / 1024; - needed_fee += (blob_size % 1024) ? 1 : 0; - needed_fee *= fee_per_kb; + needed_fee = tx_weight / 1024; + needed_fee += (tx_weight % 1024) ? 1 : 0; + needed_fee *= fee_per_kb; + } if (fee < needed_fee - needed_fee / 50) // keep a little 2% buffer on acceptance - no integer overflow { @@ -3166,7 +3218,7 @@ bool Blockchain::check_fee(size_t blob_size, uint64_t fee) const } //------------------------------------------------------------------ -uint64_t Blockchain::get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks) const +uint64_t Blockchain::get_dynamic_base_fee_estimate(uint64_t grace_blocks) const { const uint8_t version = get_current_hard_fork_version(); @@ -3176,16 +3228,16 @@ uint64_t Blockchain::get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks) cons if (grace_blocks >= CRYPTONOTE_REWARD_BLOCKS_WINDOW) grace_blocks = CRYPTONOTE_REWARD_BLOCKS_WINDOW - 1; - const uint64_t min_block_size = get_min_block_size(version); - std::vector sz; - get_last_n_blocks_sizes(sz, CRYPTONOTE_REWARD_BLOCKS_WINDOW - grace_blocks); - sz.reserve(grace_blocks); + const uint64_t min_block_weight = get_min_block_weight(version); + std::vector weights; + get_last_n_blocks_weights(weights, CRYPTONOTE_REWARD_BLOCKS_WINDOW - grace_blocks); + weights.reserve(grace_blocks); for (size_t i = 0; i < grace_blocks; ++i) - sz.push_back(min_block_size); + weights.push_back(min_block_weight); - uint64_t median = epee::misc_utils::median(sz); - if(median <= min_block_size) - median = min_block_size; + uint64_t median = epee::misc_utils::median(weights); + if(median <= min_block_weight) + median = min_block_weight; uint64_t already_generated_coins = m_db->height() ? m_db->get_block_already_generated_coins(m_db->height() - 1) : 0; uint64_t base_reward; @@ -3195,8 +3247,9 @@ uint64_t Blockchain::get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks) cons base_reward = BLOCK_REWARD_OVERESTIMATE; } - uint64_t fee = get_dynamic_per_kb_fee(base_reward, median, version); - MDEBUG("Estimating " << grace_blocks << "-block fee at " << print_money(fee) << "/kB"); + uint64_t fee = get_dynamic_base_fee(base_reward, median, version); + const bool per_byte = version < HF_VERSION_PER_BYTE_FEE; + MDEBUG("Estimating " << grace_blocks << "-block fee at " << print_money(fee) << "/" << (per_byte ? "byte" : "kB")); return fee; } @@ -3372,11 +3425,11 @@ bool Blockchain::flush_txes_from_pool(const std::vector &txids) for (const auto &txid: txids) { cryptonote::transaction tx; - size_t blob_size; + size_t tx_weight; uint64_t fee; bool relayed, do_not_relay, double_spend_seen; MINFO("Removing txid " << txid << " from the pool"); - if(m_tx_pool.have_tx(txid) && !m_tx_pool.take_tx(txid, tx, blob_size, fee, relayed, do_not_relay, double_spend_seen)) + if(m_tx_pool.have_tx(txid) && !m_tx_pool.take_tx(txid, tx, tx_weight, fee, relayed, do_not_relay, double_spend_seen)) { MERROR("Failed to remove txid " << txid << " from the pool"); res = false; @@ -3536,8 +3589,8 @@ leave: goto leave; } - size_t coinbase_blob_size = get_object_blobsize(bl.miner_tx); - size_t cumulative_block_size = coinbase_blob_size; + size_t coinbase_weight = get_transaction_weight(bl.miner_tx); + size_t cumulative_block_weight = coinbase_weight; std::vector txs; key_images_container keys; @@ -3559,7 +3612,7 @@ leave: for (const crypto::hash& tx_id : bl.tx_hashes) { transaction tx; - size_t blob_size = 0; + size_t tx_weight = 0; uint64_t fee = 0; bool relayed = false, do_not_relay = false, double_spend_seen = false; TIME_MEASURE_START(aa); @@ -3578,7 +3631,7 @@ leave: TIME_MEASURE_START(bb); // get transaction with hash from tx_pool - if(!m_tx_pool.take_tx(tx_id, tx, blob_size, fee, relayed, do_not_relay, double_spend_seen)) + if(!m_tx_pool.take_tx(tx_id, tx, tx_weight, fee, relayed, do_not_relay, double_spend_seen)) { MERROR_VER("Block with id: " << id << " has at least one unknown transaction with id: " << tx_id); bvc.m_verifivation_failed = true; @@ -3649,7 +3702,7 @@ leave: TIME_MEASURE_FINISH(cc); t_checktx += cc; fee_summary += fee; - cumulative_block_size += blob_size; + cumulative_block_weight += tx_weight; } m_blocks_txs_check.clear(); @@ -3657,7 +3710,7 @@ leave: TIME_MEASURE_START(vmt); uint64_t base_reward = 0; uint64_t already_generated_coins = m_db->height() ? m_db->get_block_already_generated_coins(m_db->height() - 1) : 0; - if(!validate_miner_transaction(bl, cumulative_block_size, fee_summary, base_reward, already_generated_coins, bvc.m_partial_block_reward, m_hardfork->get_current_version())) + if(!validate_miner_transaction(bl, cumulative_block_weight, fee_summary, base_reward, already_generated_coins, bvc.m_partial_block_reward, m_hardfork->get_current_version())) { MERROR_VER("Block with id: " << id << " has incorrect miner transaction"); bvc.m_verifivation_failed = true; @@ -3666,11 +3719,11 @@ leave: } TIME_MEASURE_FINISH(vmt); - size_t block_size; + size_t block_weight; difficulty_type cumulative_difficulty; // populate various metadata about the block to be stored alongside it. - block_size = cumulative_block_size; + block_weight = cumulative_block_weight; cumulative_difficulty = current_diffic; // In the "tail" state when the minimum subsidy (implemented in get_block_reward) is in effect, the number of // coins will eventually exceed MONEY_SUPPLY and overflow a uint64. To prevent overflow, cap already_generated_coins @@ -3691,7 +3744,7 @@ leave: { try { - new_height = m_db->add_block(bl, block_size, cumulative_difficulty, already_generated_coins, txs); + new_height = m_db->add_block(bl, block_weight, cumulative_difficulty, already_generated_coins, txs); } catch (const KEY_IMAGE_EXISTS& e) { @@ -3716,14 +3769,14 @@ leave: TIME_MEASURE_FINISH(addblock); - // do this after updating the hard fork state since the size limit may change due to fork - update_next_cumulative_size_limit(); + // do this after updating the hard fork state since the weight limit may change due to fork + update_next_cumulative_weight_limit(); - MINFO("+++++ BLOCK SUCCESSFULLY ADDED" << std::endl << "id:\t" << id << std::endl << "PoW:\t" << proof_of_work << std::endl << "HEIGHT " << new_height-1 << ", difficulty:\t" << current_diffic << std::endl << "block reward: " << print_money(fee_summary + base_reward) << "(" << print_money(base_reward) << " + " << print_money(fee_summary) << "), coinbase_blob_size: " << coinbase_blob_size << ", cumulative size: " << cumulative_block_size << ", " << block_processing_time << "(" << target_calculating_time << "/" << longhash_calculating_time << ")ms"); + MINFO("+++++ BLOCK SUCCESSFULLY ADDED" << std::endl << "id:\t" << id << std::endl << "PoW:\t" << proof_of_work << std::endl << "HEIGHT " << new_height-1 << ", difficulty:\t" << current_diffic << std::endl << "block reward: " << print_money(fee_summary + base_reward) << "(" << print_money(base_reward) << " + " << print_money(fee_summary) << "), coinbase_weight: " << coinbase_weight << ", cumulative weight: " << cumulative_block_weight << ", " << block_processing_time << "(" << target_calculating_time << "/" << longhash_calculating_time << ")ms"); if(m_show_time_stats) { - MINFO("Height: " << new_height << " blob: " << coinbase_blob_size << " cumm: " - << cumulative_block_size << " p/t: " << block_processing_time << " (" + MINFO("Height: " << new_height << " coinbase weight: " << coinbase_weight << " cumm: " + << cumulative_block_weight << " p/t: " << block_processing_time << " (" << target_calculating_time << "/" << longhash_calculating_time << "/" << t1 << "/" << t2 << "/" << t3 << "/" << t_exists << "/" << t_pool << "/" << t_checktx << "/" << t_dblspnd << "/" << vmt << "/" << addblock << ")ms"); @@ -3740,20 +3793,20 @@ leave: return true; } //------------------------------------------------------------------ -bool Blockchain::update_next_cumulative_size_limit() +bool Blockchain::update_next_cumulative_weight_limit() { - uint64_t full_reward_zone = get_min_block_size(get_current_hard_fork_version()); + uint64_t full_reward_zone = get_min_block_weight(get_current_hard_fork_version()); LOG_PRINT_L3("Blockchain::" << __func__); - std::vector sz; - get_last_n_blocks_sizes(sz, CRYPTONOTE_REWARD_BLOCKS_WINDOW); + std::vector weights; + get_last_n_blocks_weights(weights, CRYPTONOTE_REWARD_BLOCKS_WINDOW); - uint64_t median = epee::misc_utils::median(sz); - m_current_block_cumul_sz_median = median; + uint64_t median = epee::misc_utils::median(weights); + m_current_block_cumul_weight_median = median; if(median <= full_reward_zone) median = full_reward_zone; - m_current_block_cumul_sz_limit = median*2; + m_current_block_cumul_weight_limit = median*2; return true; } //------------------------------------------------------------------ @@ -4650,14 +4703,14 @@ void Blockchain::load_compiled_in_block_hashes() std::vector txs; m_tx_pool.get_transactions(txs); - size_t blob_size; + size_t tx_weight; uint64_t fee; bool relayed, do_not_relay, double_spend_seen; transaction pool_tx; for(const transaction &tx : txs) { crypto::hash tx_hash = get_transaction_hash(tx); - m_tx_pool.take_tx(tx_hash, pool_tx, blob_size, fee, relayed, do_not_relay, double_spend_seen); + m_tx_pool.take_tx(tx_hash, pool_tx, tx_weight, fee, relayed, do_not_relay, double_spend_seen); } } } diff --git a/src/cryptonote_core/blockchain.h b/src/cryptonote_core/blockchain.h index 2292ffbf3..7e2ba7a39 100644 --- a/src/cryptonote_core/blockchain.h +++ b/src/cryptonote_core/blockchain.h @@ -95,7 +95,7 @@ namespace cryptonote { block bl; //!< the block uint64_t height; //!< the height of the block in the blockchain - size_t block_cumulative_size; //!< the size (in bytes) of the block + size_t block_cumulative_weight; //!< the weight of the block difficulty_type cumulative_difficulty; //!< the accumulated difficulty after that block uint64_t already_generated_coins; //!< the total coins minted after that block }; @@ -579,46 +579,57 @@ namespace cryptonote bool check_tx_inputs(transaction& tx, uint64_t& pmax_used_block_height, crypto::hash& max_used_block_id, tx_verification_context &tvc, bool kept_by_block = false); /** - * @brief get dynamic per kB fee for a given block size + * @brief get fee quantization mask * - * The dynamic fee is based on the block size in a past window, and - * the current block reward. It is expressed by kB. + * The dynamic fee may be quantized, to mask out the last decimal places * - * @param block_reward the current block reward - * @param median_block_size the median blob's size in the past window - * @param version hard fork version for rules and constants to use - * - * @return the per kB fee + * @return the fee quantized mask */ - static uint64_t get_dynamic_per_kb_fee(uint64_t block_reward, size_t median_block_size, uint8_t version); + static uint64_t get_fee_quantization_mask(); /** - * @brief get dynamic per kB fee estimate for the next few blocks + * @brief get dynamic per kB or byte fee for a given block weight * - * The dynamic fee is based on the block size in a past window, and - * the current block reward. It is expressed by kB. This function - * calculates an estimate for a dynamic fee which will be valid for - * the next grace_blocks + * The dynamic fee is based on the block weight in a past window, and + * the current block reward. It is expressed by kB before v8, and + * per byte from v8. + * + * @param block_reward the current block reward + * @param median_block_weight the median block weight in the past window + * @param version hard fork version for rules and constants to use + * + * @return the fee + */ + static uint64_t get_dynamic_base_fee(uint64_t block_reward, size_t median_block_weight, uint8_t version); + + /** + * @brief get dynamic per kB or byte fee estimate for the next few blocks + * + * The dynamic fee is based on the block weight in a past window, and + * the current block reward. It is expressed by kB before v8, and + * per byte from v8. + * This function calculates an estimate for a dynamic fee which will be + * valid for the next grace_blocks * * @param grace_blocks number of blocks we want the fee to be valid for * - * @return the per kB fee estimate + * @return the fee estimate */ - uint64_t get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks) const; + uint64_t get_dynamic_base_fee_estimate(uint64_t grace_blocks) const; /** * @brief validate a transaction's fee * * This function validates the fee is enough for the transaction. - * This is based on the size of the transaction blob, and, after a - * height threshold, on the average size of transaction in a past window + * This is based on the weight of the transaction, and, after a + * height threshold, on the average weight of transaction in a past window * - * @param blob_size the transaction blob's size + * @param tx_weight the transaction weight * @param fee the fee * * @return true if the fee is enough, false otherwise */ - bool check_fee(size_t blob_size, uint64_t fee) const; + bool check_fee(size_t tx_weight, uint64_t fee) const; /** * @brief check that a transaction's outputs conform to current standards @@ -635,18 +646,18 @@ namespace cryptonote bool check_tx_outputs(const transaction& tx, tx_verification_context &tvc); /** - * @brief gets the blocksize limit based on recent blocks + * @brief gets the block weight limit based on recent blocks * * @return the limit */ - uint64_t get_current_cumulative_blocksize_limit() const; + uint64_t get_current_cumulative_block_weight_limit() const; /** - * @brief gets the blocksize median based on recent blocks (same window as for the limit) + * @brief gets the block weight median based on recent blocks (same window as for the limit) * * @return the median */ - uint64_t get_current_cumulative_blocksize_median() const; + uint64_t get_current_cumulative_block_weight_median() const; /** * @brief gets the difficulty of the block with a given height @@ -1001,8 +1012,8 @@ namespace cryptonote // main chain transactions_container m_transactions; - size_t m_current_block_cumul_sz_limit; - size_t m_current_block_cumul_sz_median; + size_t m_current_block_cumul_weight_limit; + size_t m_current_block_cumul_weight_median; // metadata containers std::unordered_map>> m_scan_table; @@ -1225,7 +1236,7 @@ namespace cryptonote * and that his miner transaction totals reward + fee. * * @param b the block containing the miner transaction to be validated - * @param cumulative_block_size the block's size + * @param cumulative_block_weight the block's weight * @param fee the total fees collected in the block * @param base_reward return-by-reference the new block's generated coins * @param already_generated_coins the amount of currency generated prior to this block @@ -1234,7 +1245,7 @@ namespace cryptonote * * @return false if anything is found wrong with the miner transaction, otherwise true */ - bool validate_miner_transaction(const block& b, size_t cumulative_block_size, uint64_t fee, uint64_t& base_reward, uint64_t already_generated_coins, bool &partial_block_reward, uint8_t version); + bool validate_miner_transaction(const block& b, size_t cumulative_block_weight, uint64_t fee, uint64_t& base_reward, uint64_t already_generated_coins, bool &partial_block_reward, uint8_t version); /** * @brief reverts the blockchain to its previous state following a failed switch @@ -1251,14 +1262,14 @@ namespace cryptonote bool rollback_blockchain_switching(std::list& original_chain, uint64_t rollback_height); /** - * @brief gets recent block sizes for median calculation + * @brief gets recent block weights for median calculation * - * get the block sizes of the last blocks, and return by reference . + * get the block weights of the last blocks, and return by reference . * - * @param sz return-by-reference the list of sizes - * @param count the number of blocks to get sizes for + * @param sz return-by-reference the list of weights + * @param count the number of blocks to get weights for */ - void get_last_n_blocks_sizes(std::vector& sz, size_t count) const; + void get_last_n_blocks_weights(std::vector& weights, size_t count) const; /** * @brief adds the given output to the requested set of random outputs @@ -1373,11 +1384,11 @@ namespace cryptonote bool complete_timestamps_vector(uint64_t start_height, std::vector& timestamps); /** - * @brief calculate the block size limit for the next block to be added + * @brief calculate the block weight limit for the next block to be added * * @return true */ - bool update_next_cumulative_size_limit(); + bool update_next_cumulative_weight_limit(); void return_tx_to_pool(std::vector &txs); /** diff --git a/src/cryptonote_core/cryptonote_core.cpp b/src/cryptonote_core/cryptonote_core.cpp index f9e0b68d0..c4eaa0cc4 100644 --- a/src/cryptonote_core/cryptonote_core.cpp +++ b/src/cryptonote_core/cryptonote_core.cpp @@ -162,10 +162,10 @@ namespace cryptonote , "Relay blocks as normal blocks" , false }; - static const command_line::arg_descriptor arg_max_txpool_size = { - "max-txpool-size" - , "Set maximum txpool size in bytes." - , DEFAULT_TXPOOL_MAX_SIZE + static const command_line::arg_descriptor arg_max_txpool_weight = { + "max-txpool-weight" + , "Set maximum txpool weight in bytes." + , DEFAULT_TXPOOL_MAX_WEIGHT }; //----------------------------------------------------------------------------------------------- @@ -274,7 +274,7 @@ namespace cryptonote command_line::add_arg(desc, arg_test_dbg_lock_sleep); command_line::add_arg(desc, arg_offline); command_line::add_arg(desc, arg_disable_dns_checkpoints); - command_line::add_arg(desc, arg_max_txpool_size); + command_line::add_arg(desc, arg_max_txpool_weight); miner::init_options(desc); BlockchainDB::init_options(desc); @@ -402,7 +402,7 @@ namespace cryptonote bool fast_sync = command_line::get_arg(vm, arg_fast_block_sync) != 0; uint64_t blocks_threads = command_line::get_arg(vm, arg_prep_blocks_threads); std::string check_updates_string = command_line::get_arg(vm, arg_check_updates); - size_t max_txpool_size = command_line::get_arg(vm, arg_max_txpool_size); + size_t max_txpool_weight = command_line::get_arg(vm, arg_max_txpool_weight); boost::filesystem::path folder(m_config_folder); if (m_nettype == FAKECHAIN) @@ -551,7 +551,7 @@ namespace cryptonote const difficulty_type fixed_difficulty = command_line::get_arg(vm, arg_fixed_difficulty); r = m_blockchain_storage.init(db.release(), m_nettype, m_offline, regtest ? ®test_test_options : test_options, fixed_difficulty); - r = m_mempool.init(max_txpool_size); + r = m_mempool.init(max_txpool_weight); CHECK_AND_ASSERT_MES(r, false, "Failed to initialize memory pool"); // now that we have a valid m_blockchain_storage, we can clean out any @@ -692,43 +692,6 @@ namespace cryptonote return false; } - // resolve outPk references in rct txes - // outPk aren't the only thing that need resolving for a fully resolved tx, - // but outPk (1) are needed now to check range proof semantics, and - // (2) do not need access to the blockchain to find data - if (tx.version >= 2) - { - rct::rctSig &rv = tx.rct_signatures; - if (rv.outPk.size() != tx.vout.size()) - { - LOG_PRINT_L1("WRONG TRANSACTION BLOB, Bad outPk size in tx " << tx_hash << ", rejected"); - tvc.m_verifivation_failed = true; - return false; - } - for (size_t n = 0; n < tx.rct_signatures.outPk.size(); ++n) - rv.outPk[n].dest = rct::pk2rct(boost::get(tx.vout[n].target).key); - - const bool bulletproof = rct::is_rct_bulletproof(rv.type); - if (bulletproof) - { - if (rct::n_bulletproof_amounts(rv.p.bulletproofs) != tx.vout.size()) - { - LOG_PRINT_L1("WRONG TRANSACTION BLOB, Bad bulletproofs size in tx " << tx_hash << ", rejected"); - tvc.m_verifivation_failed = true; - return false; - } - size_t idx = 0; - for (size_t n = 0; n < rv.p.bulletproofs.size(); ++n) - { - CHECK_AND_ASSERT_MES(rv.p.bulletproofs[n].L.size() >= 6, false, "Bad bulletproofs L size"); // at least 64 bits - const size_t n_amounts = rct::n_bulletproof_amounts(rv.p.bulletproofs[n]); - CHECK_AND_ASSERT_MES(idx + n_amounts <= rv.outPk.size(), false, "Internal error filling out V"); - rv.p.bulletproofs[n].V.clear(); - for (size_t i = 0; i < n_amounts; ++i) - rv.p.bulletproofs[n].V.push_back(rv.outPk[idx++].mask); - } - } - } return true; } //----------------------------------------------------------------------------------------------- @@ -747,20 +710,11 @@ namespace cryptonote //----------------------------------------------------------------------------------------------- static bool is_canonical_bulletproof_layout(const std::vector &proofs) { - size_t n_amounts = rct::n_bulletproof_amounts(proofs), amounts_proved = 0; - size_t n = 0; - while (amounts_proved < n_amounts) - { - if (n >= proofs.size()) - return false; - size_t batch_size = 1; - while (batch_size * 2 + amounts_proved <= n_amounts && batch_size * 2 <= BULLETPROOF_MAX_OUTPUTS) - batch_size *= 2; - if (rct::n_bulletproof_amounts(proofs[n]) != batch_size) - return false; - amounts_proved += batch_size; - ++n; - } + if (proofs.size() != 1) + return false; + const size_t sz = proofs[0].V.size(); + if (sz == 0 || sz > BULLETPROOF_MAX_OUTPUTS) + return false; return true; } //----------------------------------------------------------------------------------------------- @@ -816,11 +770,9 @@ namespace cryptonote } break; case rct::RCTTypeBulletproof: - // in addition to valid bulletproofs, we want multi-out - // proofs to be in decreasing power of 2 constituents if (!is_canonical_bulletproof_layout(rv.p.bulletproofs)) { - MERROR_VER("Bulletproof does not use decreasing power of 2 rule"); + MERROR_VER("Bulletproof does not have canonical form"); set_semantics_failed(tx_info[n].tx_hash); tx_info[n].tvc.m_verifivation_failed = true; tx_info[n].result = false; @@ -933,7 +885,8 @@ namespace cryptonote continue; } - ok &= add_new_tx(results[i].tx, results[i].hash, results[i].prefix_hash, it->size(), tvc[i], keeped_by_block, relayed, do_not_relay); + const size_t weight = get_transaction_weight(results[i].tx, it->size()); + ok &= add_new_tx(results[i].tx, results[i].hash, results[i].prefix_hash, weight, tvc[i], keeped_by_block, relayed, do_not_relay); if(tvc[i].m_verifivation_failed) {MERROR_VER("Transaction verification failed: " << results[i].hash);} else if(tvc[i].m_verifivation_impossible) @@ -1016,9 +969,9 @@ namespace cryptonote } // for version > 1, ringct signatures check verifies amounts match - if(!keeped_by_block && get_object_blobsize(tx) >= m_blockchain_storage.get_current_cumulative_blocksize_limit() - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE) + if(!keeped_by_block && get_transaction_weight(tx) >= m_blockchain_storage.get_current_cumulative_block_weight_limit() - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE) { - MERROR_VER("tx is too large " << get_object_blobsize(tx) << ", expected not bigger than " << m_blockchain_storage.get_current_cumulative_blocksize_limit() - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE); + MERROR_VER("tx is too large " << get_transaction_weight(tx) << ", expected not bigger than " << m_blockchain_storage.get_current_cumulative_block_weight_limit() - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE); return false; } @@ -1150,7 +1103,8 @@ namespace cryptonote crypto::hash tx_prefix_hash = get_transaction_prefix_hash(tx); blobdata bl; t_serializable_object_to_blob(tx, bl); - return add_new_tx(tx, tx_hash, tx_prefix_hash, bl.size(), tvc, keeped_by_block, relayed, do_not_relay); + size_t tx_weight = get_transaction_weight(tx, bl.size()); + return add_new_tx(tx, tx_hash, tx_prefix_hash, tx_weight, tvc, keeped_by_block, relayed, do_not_relay); } //----------------------------------------------------------------------------------------------- size_t core::get_blockchain_total_transactions() const @@ -1158,7 +1112,7 @@ namespace cryptonote return m_blockchain_storage.get_total_transactions(); } //----------------------------------------------------------------------------------------------- - bool core::add_new_tx(transaction& tx, const crypto::hash& tx_hash, const crypto::hash& tx_prefix_hash, size_t blob_size, tx_verification_context& tvc, bool keeped_by_block, bool relayed, bool do_not_relay) + bool core::add_new_tx(transaction& tx, const crypto::hash& tx_hash, const crypto::hash& tx_prefix_hash, size_t tx_weight, tx_verification_context& tvc, bool keeped_by_block, bool relayed, bool do_not_relay) { if (keeped_by_block) get_blockchain_storage().on_new_tx_from_block(tx); @@ -1176,7 +1130,7 @@ namespace cryptonote } uint8_t version = m_blockchain_storage.get_current_hard_fork_version(); - return m_mempool.add_tx(tx, tx_hash, blob_size, tvc, keeped_by_block, relayed, do_not_relay, version); + return m_mempool.add_tx(tx, tx_hash, tx_weight, tvc, keeped_by_block, relayed, do_not_relay, version); } //----------------------------------------------------------------------------------------------- bool core::relay_txpool_transactions() diff --git a/src/cryptonote_core/cryptonote_core.h b/src/cryptonote_core/cryptonote_core.h index 497b16214..8b68f5e2b 100644 --- a/src/cryptonote_core/cryptonote_core.h +++ b/src/cryptonote_core/cryptonote_core.h @@ -788,12 +788,12 @@ namespace cryptonote * * @param tx_hash the transaction's hash * @param tx_prefix_hash the transaction prefix' hash - * @param blob_size the size of the transaction + * @param tx_weight the weight of the transaction * @param relayed whether or not the transaction was relayed to us * @param do_not_relay whether to prevent the transaction from being relayed * */ - bool add_new_tx(transaction& tx, const crypto::hash& tx_hash, const crypto::hash& tx_prefix_hash, size_t blob_size, tx_verification_context& tvc, bool keeped_by_block, bool relayed, bool do_not_relay); + bool add_new_tx(transaction& tx, const crypto::hash& tx_hash, const crypto::hash& tx_prefix_hash, size_t tx_weight, tx_verification_context& tvc, bool keeped_by_block, bool relayed, bool do_not_relay); /** * @brief add a new transaction to the transaction pool diff --git a/src/cryptonote_core/cryptonote_tx_utils.cpp b/src/cryptonote_core/cryptonote_tx_utils.cpp index 525945079..fb2af9ceb 100644 --- a/src/cryptonote_core/cryptonote_tx_utils.cpp +++ b/src/cryptonote_core/cryptonote_tx_utils.cpp @@ -74,7 +74,7 @@ namespace cryptonote LOG_PRINT_L2("destinations include " << num_stdaddresses << " standard addresses and " << num_subaddresses << " subaddresses"); } //--------------------------------------------------------------- - bool construct_miner_tx(size_t height, size_t median_size, uint64_t already_generated_coins, size_t current_block_size, uint64_t fee, const account_public_address &miner_address, transaction& tx, const blobdata& extra_nonce, size_t max_outs, uint8_t hard_fork_version) { + bool construct_miner_tx(size_t height, size_t median_weight, uint64_t already_generated_coins, size_t current_block_weight, uint64_t fee, const account_public_address &miner_address, transaction& tx, const blobdata& extra_nonce, size_t max_outs, uint8_t hard_fork_version) { tx.vin.clear(); tx.vout.clear(); tx.extra.clear(); @@ -89,7 +89,7 @@ namespace cryptonote in.height = height; uint64_t block_reward; - if(!get_block_reward(median_size, current_block_size, already_generated_coins, block_reward, hard_fork_version)) + if(!get_block_reward(median_weight, current_block_weight, already_generated_coins, block_reward, hard_fork_version)) { LOG_PRINT_L0("Block is too big"); return false; @@ -491,7 +491,7 @@ namespace cryptonote // the non-simple version is slightly smaller, but assumes all real inputs // are on the same index, so can only be used if there just one ring. - bool use_simple_rct = sources.size() > 1 || range_proof_type == rct::RangeProofMultiOutputBulletproof || range_proof_type == rct::RangeProofBulletproof; + bool use_simple_rct = sources.size() > 1 || range_proof_type != rct::RangeProofBorromean; if (!use_simple_rct) { diff --git a/src/cryptonote_core/cryptonote_tx_utils.h b/src/cryptonote_core/cryptonote_tx_utils.h index 08e8725f7..f2cf7b6ca 100644 --- a/src/cryptonote_core/cryptonote_tx_utils.h +++ b/src/cryptonote_core/cryptonote_tx_utils.h @@ -37,7 +37,7 @@ namespace cryptonote { //--------------------------------------------------------------- - bool construct_miner_tx(size_t height, size_t median_size, uint64_t already_generated_coins, size_t current_block_size, uint64_t fee, const account_public_address &miner_address, transaction& tx, const blobdata& extra_nonce = blobdata(), size_t max_outs = 999, uint8_t hard_fork_version = 1); + bool construct_miner_tx(size_t height, size_t median_weight, uint64_t already_generated_coins, size_t current_block_weight, uint64_t fee, const account_public_address &miner_address, transaction& tx, const blobdata& extra_nonce = blobdata(), size_t max_outs = 999, uint8_t hard_fork_version = 1); struct tx_source_entry { diff --git a/src/cryptonote_core/tx_pool.cpp b/src/cryptonote_core/tx_pool.cpp index 41c58fcb6..b12a329bb 100644 --- a/src/cryptonote_core/tx_pool.cpp +++ b/src/cryptonote_core/tx_pool.cpp @@ -80,9 +80,13 @@ namespace cryptonote return amount * ACCEPT_THRESHOLD; } - uint64_t get_transaction_size_limit(uint8_t version) + uint64_t get_transaction_weight_limit(uint8_t version) { - return get_min_block_size(version) - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + // from v8, limit a tx to 50% of the minimum block weight + if (version >= 8) + return get_min_block_weight(version) / 2 - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + else + return get_min_block_weight(version) - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; } // This class is meant to create a batch when none currently exists. @@ -102,12 +106,12 @@ namespace cryptonote } //--------------------------------------------------------------------------------- //--------------------------------------------------------------------------------- - tx_memory_pool::tx_memory_pool(Blockchain& bchs): m_blockchain(bchs), m_txpool_max_size(DEFAULT_TXPOOL_MAX_SIZE), m_txpool_size(0), m_cookie(0) + tx_memory_pool::tx_memory_pool(Blockchain& bchs): m_blockchain(bchs), m_txpool_max_weight(DEFAULT_TXPOOL_MAX_WEIGHT), m_txpool_weight(0), m_cookie(0) { } //--------------------------------------------------------------------------------- - bool tx_memory_pool::add_tx(transaction &tx, /*const crypto::hash& tx_prefix_hash,*/ const crypto::hash &id, size_t blob_size, tx_verification_context& tvc, bool kept_by_block, bool relayed, bool do_not_relay, uint8_t version) + bool tx_memory_pool::add_tx(transaction &tx, /*const crypto::hash& tx_prefix_hash,*/ const crypto::hash &id, size_t tx_weight, tx_verification_context& tvc, bool kept_by_block, bool relayed, bool do_not_relay, uint8_t version) { // this should already be called with that lock, but let's make it explicit for clarity CRITICAL_REGION_LOCAL(m_transactions_lock); @@ -173,17 +177,17 @@ namespace cryptonote fee = tx.rct_signatures.txnFee; } - if (!kept_by_block && !m_blockchain.check_fee(blob_size, fee)) + if (!kept_by_block && !m_blockchain.check_fee(tx_weight, fee)) { tvc.m_verifivation_failed = true; tvc.m_fee_too_low = true; return false; } - size_t tx_size_limit = get_transaction_size_limit(version); - if (!kept_by_block && blob_size > tx_size_limit) + size_t tx_weight_limit = get_transaction_weight_limit(version); + if (!kept_by_block && tx_weight > tx_weight_limit) { - LOG_PRINT_L1("transaction is too big: " << blob_size << " bytes, maximum size: " << tx_size_limit); + LOG_PRINT_L1("transaction is too heavy: " << tx_weight << " bytes, maximum weight: " << tx_weight_limit); tvc.m_verifivation_failed = true; tvc.m_too_big = true; return false; @@ -227,7 +231,7 @@ namespace cryptonote // may become valid again, so ignore the failed inputs check. if(kept_by_block) { - meta.blob_size = blob_size; + meta.weight = tx_weight; meta.fee = fee; meta.max_used_block_id = null_hash; meta.max_used_block_height = 0; @@ -248,7 +252,7 @@ namespace cryptonote m_blockchain.add_txpool_tx(tx, meta); if (!insert_key_images(tx, kept_by_block)) return false; - m_txs_by_fee_and_receive_time.emplace(std::pair(fee / (double)blob_size, receive_time), id); + m_txs_by_fee_and_receive_time.emplace(std::pair(fee / (double)tx_weight, receive_time), id); } catch (const std::exception &e) { @@ -267,7 +271,7 @@ namespace cryptonote }else { //update transactions container - meta.blob_size = blob_size; + meta.weight = tx_weight; meta.kept_by_block = kept_by_block; meta.fee = fee; meta.max_used_block_id = max_used_block_id; @@ -290,7 +294,7 @@ namespace cryptonote m_blockchain.add_txpool_tx(tx, meta); if (!insert_key_images(tx, kept_by_block)) return false; - m_txs_by_fee_and_receive_time.emplace(std::pair(fee / (double)blob_size, receive_time), id); + m_txs_by_fee_and_receive_time.emplace(std::pair(fee / (double)tx_weight, receive_time), id); } catch (const std::exception &e) { @@ -304,13 +308,13 @@ namespace cryptonote } tvc.m_verifivation_failed = false; - m_txpool_size += blob_size; + m_txpool_weight += tx_weight; ++m_cookie; - MINFO("Transaction added to pool: txid " << id << " bytes: " << blob_size << " fee/byte: " << (fee / (double)blob_size)); + MINFO("Transaction added to pool: txid " << id << " weight: " << tx_weight << " fee/byte: " << (fee / (double)tx_weight)); - prune(m_txpool_max_size); + prune(m_txpool_max_weight); return true; } @@ -321,26 +325,26 @@ namespace cryptonote size_t blob_size = 0; if (!get_transaction_hash(tx, h, blob_size) || blob_size == 0) return false; - return add_tx(tx, h, blob_size, tvc, keeped_by_block, relayed, do_not_relay, version); + return add_tx(tx, h, get_transaction_weight(tx, blob_size), tvc, keeped_by_block, relayed, do_not_relay, version); } //--------------------------------------------------------------------------------- - size_t tx_memory_pool::get_txpool_size() const + size_t tx_memory_pool::get_txpool_weight() const { CRITICAL_REGION_LOCAL(m_transactions_lock); - return m_txpool_size; + return m_txpool_weight; } //--------------------------------------------------------------------------------- - void tx_memory_pool::set_txpool_max_size(size_t bytes) + void tx_memory_pool::set_txpool_max_weight(size_t bytes) { CRITICAL_REGION_LOCAL(m_transactions_lock); - m_txpool_max_size = bytes; + m_txpool_max_weight = bytes; } //--------------------------------------------------------------------------------- void tx_memory_pool::prune(size_t bytes) { CRITICAL_REGION_LOCAL(m_transactions_lock); if (bytes == 0) - bytes = m_txpool_max_size; + bytes = m_txpool_max_weight; CRITICAL_REGION_LOCAL1(m_blockchain); LockedTXN lock(m_blockchain); bool changed = false; @@ -349,7 +353,7 @@ namespace cryptonote auto it = --m_txs_by_fee_and_receive_time.end(); while (it != m_txs_by_fee_and_receive_time.begin()) { - if (m_txpool_size <= bytes) + if (m_txpool_weight <= bytes) break; try { @@ -374,11 +378,11 @@ namespace cryptonote return; } // remove first, in case this throws, so key images aren't removed - MINFO("Pruning tx " << txid << " from txpool: size: " << it->first.second << ", fee/byte: " << it->first.first); + MINFO("Pruning tx " << txid << " from txpool: weight: " << it->first.second << ", fee/byte: " << it->first.first); m_blockchain.remove_txpool_tx(txid); - m_txpool_size -= txblob.size(); + m_txpool_weight -= it->first.second; remove_transaction_keyimages(tx); - MINFO("Pruned tx " << txid << " from txpool: size: " << it->first.second << ", fee/byte: " << it->first.first); + MINFO("Pruned tx " << txid << " from txpool: weight: " << it->first.second << ", fee/byte: " << it->first.first); m_txs_by_fee_and_receive_time.erase(it--); changed = true; } @@ -390,8 +394,8 @@ namespace cryptonote } if (changed) ++m_cookie; - if (m_txpool_size > bytes) - MINFO("Pool size after pruning is larger than limit: " << m_txpool_size << "/" << bytes); + if (m_txpool_weight > bytes) + MINFO("Pool weight after pruning is larger than limit: " << m_txpool_weight << "/" << bytes); } //--------------------------------------------------------------------------------- bool tx_memory_pool::insert_key_images(const transaction &tx, bool kept_by_block) @@ -446,7 +450,7 @@ namespace cryptonote return true; } //--------------------------------------------------------------------------------- - bool tx_memory_pool::take_tx(const crypto::hash &id, transaction &tx, size_t& blob_size, uint64_t& fee, bool &relayed, bool &do_not_relay, bool &double_spend_seen) + bool tx_memory_pool::take_tx(const crypto::hash &id, transaction &tx, size_t& tx_weight, uint64_t& fee, bool &relayed, bool &do_not_relay, bool &double_spend_seen) { CRITICAL_REGION_LOCAL(m_transactions_lock); CRITICAL_REGION_LOCAL1(m_blockchain); @@ -470,7 +474,7 @@ namespace cryptonote MERROR("Failed to parse tx from txpool"); return false; } - blob_size = meta.blob_size; + tx_weight = meta.weight; fee = meta.fee; relayed = meta.relayed; do_not_relay = meta.do_not_relay; @@ -478,7 +482,7 @@ namespace cryptonote // remove first, in case this throws, so key images aren't removed m_blockchain.remove_txpool_tx(id); - m_txpool_size -= blob_size; + m_txpool_weight -= tx_weight; remove_transaction_keyimages(tx); } catch (const std::exception &e) @@ -552,7 +556,7 @@ namespace cryptonote { // remove first, so we only remove key images if the tx removal succeeds m_blockchain.remove_txpool_tx(txid); - m_txpool_size -= bd.size(); + m_txpool_weight -= get_transaction_weight(tx, bd.size()); remove_transaction_keyimages(tx); } } @@ -670,7 +674,7 @@ namespace cryptonote const uint64_t now = time(NULL); backlog.reserve(m_blockchain.get_txpool_tx_count(include_unrelayed_txes)); m_blockchain.for_all_txpool_txes([&backlog, now](const crypto::hash &txid, const txpool_tx_meta_t &meta, const cryptonote::blobdata *bd){ - backlog.push_back({meta.blob_size, meta.fee, meta.receive_time - now}); + backlog.push_back({meta.weight, meta.fee, meta.receive_time - now}); return true; }, false, include_unrelayed_txes); } @@ -682,15 +686,15 @@ namespace cryptonote const uint64_t now = time(NULL); std::map agebytes; stats.txs_total = m_blockchain.get_txpool_tx_count(include_unrelayed_txes); - std::vector sizes; - sizes.reserve(stats.txs_total); - m_blockchain.for_all_txpool_txes([&stats, &sizes, now, &agebytes](const crypto::hash &txid, const txpool_tx_meta_t &meta, const cryptonote::blobdata *bd){ - sizes.push_back(meta.blob_size); - stats.bytes_total += meta.blob_size; - if (!stats.bytes_min || meta.blob_size < stats.bytes_min) - stats.bytes_min = meta.blob_size; - if (meta.blob_size > stats.bytes_max) - stats.bytes_max = meta.blob_size; + std::vector weights; + weights.reserve(stats.txs_total); + m_blockchain.for_all_txpool_txes([&stats, &weights, now, &agebytes](const crypto::hash &txid, const txpool_tx_meta_t &meta, const cryptonote::blobdata *bd){ + weights.push_back(meta.weight); + stats.bytes_total += meta.weight; + if (!stats.bytes_min || meta.weight < stats.bytes_min) + stats.bytes_min = meta.weight; + if (meta.weight > stats.bytes_max) + stats.bytes_max = meta.weight; if (!meta.relayed) stats.num_not_relayed++; stats.fee_total += meta.fee; @@ -702,12 +706,12 @@ namespace cryptonote stats.num_failing++; uint64_t age = now - meta.receive_time + (now == meta.receive_time); agebytes[age].txs++; - agebytes[age].bytes += meta.blob_size; + agebytes[age].bytes += meta.weight; if (meta.double_spend_seen) ++stats.num_double_spends; return true; }, false, include_unrelayed_txes); - stats.bytes_med = epee::misc_utils::median(sizes); + stats.bytes_med = epee::misc_utils::median(weights); if (stats.txs_total > 1) { /* looking for 98th percentile */ @@ -771,7 +775,8 @@ namespace cryptonote return true; } txi.tx_json = obj_to_json_str(tx); - txi.blob_size = meta.blob_size; + txi.blob_size = bd->size(); + txi.weight = meta.weight; txi.fee = meta.fee; txi.kept_by_block = meta.kept_by_block; txi.max_used_block_height = meta.max_used_block_height; @@ -842,7 +847,8 @@ namespace cryptonote return true; } txi.tx = tx; - txi.blob_size = meta.blob_size; + txi.blob_size = bd->size(); + txi.weight = meta.weight; txi.fee = meta.fee; txi.kept_by_block = meta.kept_by_block; txi.max_used_block_height = meta.max_used_block_height; @@ -1116,7 +1122,8 @@ namespace cryptonote } ss << obj_to_json_str(tx) << std::endl; } - ss << "blob_size: " << meta.blob_size << std::endl + ss << "blob_size: " << (short_format ? "-" : std::to_string(txblob->size())) << std::endl + << "weight: " << meta.weight << std::endl << "fee: " << print_money(meta.fee) << std::endl << "kept_by_block: " << (meta.kept_by_block ? 'T' : 'F') << std::endl << "double_spend_seen: " << (meta.double_spend_seen ? 'T' : 'F') << std::endl @@ -1131,25 +1138,25 @@ namespace cryptonote } //--------------------------------------------------------------------------------- //TODO: investigate whether boolean return is appropriate - bool tx_memory_pool::fill_block_template(block &bl, size_t median_size, uint64_t already_generated_coins, size_t &total_size, uint64_t &fee, uint64_t &expected_reward, uint8_t version) + bool tx_memory_pool::fill_block_template(block &bl, size_t median_weight, uint64_t already_generated_coins, size_t &total_weight, uint64_t &fee, uint64_t &expected_reward, uint8_t version) { CRITICAL_REGION_LOCAL(m_transactions_lock); CRITICAL_REGION_LOCAL1(m_blockchain); uint64_t best_coinbase = 0, coinbase = 0; - total_size = 0; + total_weight = 0; fee = 0; //baseline empty block - get_block_reward(median_size, total_size, already_generated_coins, best_coinbase, version); + get_block_reward(median_weight, total_weight, already_generated_coins, best_coinbase, version); - size_t max_total_size_pre_v5 = (130 * median_size) / 100 - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; - size_t max_total_size_v5 = 2 * median_size - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; - size_t max_total_size = version >= 5 ? max_total_size_v5 : max_total_size_pre_v5; + size_t max_total_weight_pre_v5 = (130 * median_weight) / 100 - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + size_t max_total_weight_v5 = 2 * median_weight - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + size_t max_total_weight = version >= 5 ? max_total_weight_v5 : max_total_weight_pre_v5; std::unordered_set k_images; - LOG_PRINT_L2("Filling block template, median size " << median_size << ", " << m_txs_by_fee_and_receive_time.size() << " txes in the pool"); + LOG_PRINT_L2("Filling block template, median weight " << median_weight << ", " << m_txs_by_fee_and_receive_time.size() << " txes in the pool"); LockedTXN lock(m_blockchain); @@ -1162,12 +1169,12 @@ namespace cryptonote MERROR(" failed to find tx meta"); continue; } - LOG_PRINT_L2("Considering " << sorted_it->second << ", size " << meta.blob_size << ", current block size " << total_size << "/" << max_total_size << ", current coinbase " << print_money(best_coinbase)); + LOG_PRINT_L2("Considering " << sorted_it->second << ", weight " << meta.weight << ", current block weight " << total_weight << "/" << max_total_weight << ", current coinbase " << print_money(best_coinbase)); - // Can not exceed maximum block size - if (max_total_size < total_size + meta.blob_size) + // Can not exceed maximum block weight + if (max_total_weight < total_weight + meta.weight) { - LOG_PRINT_L2(" would exceed maximum block size"); + LOG_PRINT_L2(" would exceed maximum block weight"); continue; } @@ -1177,9 +1184,9 @@ namespace cryptonote // If we're getting lower coinbase tx, // stop including more tx uint64_t block_reward; - if(!get_block_reward(median_size, total_size + meta.blob_size, already_generated_coins, block_reward, version)) + if(!get_block_reward(median_weight, total_weight + meta.weight, already_generated_coins, block_reward, version)) { - LOG_PRINT_L2(" would exceed maximum block size"); + LOG_PRINT_L2(" would exceed maximum block weight"); continue; } coinbase = block_reward + fee + meta.fee; @@ -1191,11 +1198,11 @@ namespace cryptonote } else { - // If we've exceeded the penalty free size, + // If we've exceeded the penalty free weight, // stop including more tx - if (total_size > median_size) + if (total_weight > median_weight) { - LOG_PRINT_L2(" would exceed median block size"); + LOG_PRINT_L2(" would exceed median block weight"); break; } } @@ -1241,16 +1248,16 @@ namespace cryptonote } bl.tx_hashes.push_back(sorted_it->second); - total_size += meta.blob_size; + total_weight += meta.weight; fee += meta.fee; best_coinbase = coinbase; append_key_images(k_images, tx); - LOG_PRINT_L2(" added, new block size " << total_size << "/" << max_total_size << ", coinbase " << print_money(best_coinbase)); + LOG_PRINT_L2(" added, new block weight " << total_weight << "/" << max_total_weight << ", coinbase " << print_money(best_coinbase)); } expected_reward = best_coinbase; - LOG_PRINT_L2("Block template filled with " << bl.tx_hashes.size() << " txes, size " - << total_size << "/" << max_total_size << ", coinbase " << print_money(best_coinbase) + LOG_PRINT_L2("Block template filled with " << bl.tx_hashes.size() << " txes, weight " + << total_weight << "/" << max_total_weight << ", coinbase " << print_money(best_coinbase) << " (including " << print_money(fee) << " in fees)"); return true; } @@ -1259,14 +1266,14 @@ namespace cryptonote { CRITICAL_REGION_LOCAL(m_transactions_lock); CRITICAL_REGION_LOCAL1(m_blockchain); - size_t tx_size_limit = get_transaction_size_limit(version); + size_t tx_weight_limit = get_transaction_weight_limit(version); std::unordered_set remove; - m_txpool_size = 0; - m_blockchain.for_all_txpool_txes([this, &remove, tx_size_limit](const crypto::hash &txid, const txpool_tx_meta_t &meta, const cryptonote::blobdata*) { - m_txpool_size += meta.blob_size; - if (meta.blob_size > tx_size_limit) { - LOG_PRINT_L1("Transaction " << txid << " is too big (" << meta.blob_size << " bytes), removing it from pool"); + m_txpool_weight = 0; + m_blockchain.for_all_txpool_txes([this, &remove, tx_weight_limit](const crypto::hash &txid, const txpool_tx_meta_t &meta, const cryptonote::blobdata*) { + m_txpool_weight += meta.weight; + if (meta.weight > tx_weight_limit) { + LOG_PRINT_L1("Transaction " << txid << " is too big (" << meta.weight << " bytes), removing it from pool"); remove.insert(txid); } else if (m_blockchain.have_tx(txid)) { @@ -1293,7 +1300,7 @@ namespace cryptonote } // remove tx from db first m_blockchain.remove_txpool_tx(txid); - m_txpool_size -= txblob.size(); + m_txpool_weight -= get_transaction_weight(tx, txblob.size()); remove_transaction_keyimages(tx); auto sorted_it = find_tx_in_sorted_container(txid); if (sorted_it == m_txs_by_fee_and_receive_time.end()) @@ -1318,15 +1325,15 @@ namespace cryptonote return n_removed; } //--------------------------------------------------------------------------------- - bool tx_memory_pool::init(size_t max_txpool_size) + bool tx_memory_pool::init(size_t max_txpool_weight) { CRITICAL_REGION_LOCAL(m_transactions_lock); CRITICAL_REGION_LOCAL1(m_blockchain); - m_txpool_max_size = max_txpool_size ? max_txpool_size : DEFAULT_TXPOOL_MAX_SIZE; + m_txpool_max_weight = max_txpool_weight ? max_txpool_weight : DEFAULT_TXPOOL_MAX_WEIGHT; m_txs_by_fee_and_receive_time.clear(); m_spent_key_images.clear(); - m_txpool_size = 0; + m_txpool_weight = 0; std::vector remove; // first add the not kept by block, then the kept by block, @@ -1348,8 +1355,8 @@ namespace cryptonote MFATAL("Failed to insert key images from txpool tx"); return false; } - m_txs_by_fee_and_receive_time.emplace(std::pair(meta.fee / (double)meta.blob_size, meta.receive_time), txid); - m_txpool_size += meta.blob_size; + m_txs_by_fee_and_receive_time.emplace(std::pair(meta.fee / (double)meta.weight, meta.receive_time), txid); + m_txpool_weight += meta.weight; return true; }, true); if (!r) diff --git a/src/cryptonote_core/tx_pool.h b/src/cryptonote_core/tx_pool.h index 4abfef85c..892cadc69 100644 --- a/src/cryptonote_core/tx_pool.h +++ b/src/cryptonote_core/tx_pool.h @@ -84,7 +84,7 @@ namespace cryptonote * * This handling includes: * storing the transactions - * organizing the transactions by fee per size + * organizing the transactions by fee per weight unit * taking/giving transactions to and from various other components * saving the transactions to disk on shutdown * helping create a new block template by choosing transactions for it @@ -105,9 +105,9 @@ namespace cryptonote * @copydoc add_tx(transaction&, tx_verification_context&, bool, bool, uint8_t) * * @param id the transaction's hash - * @param blob_size the transaction's size + * @param tx_weight the transaction's weight */ - bool add_tx(transaction &tx, const crypto::hash &id, size_t blob_size, tx_verification_context& tvc, bool kept_by_block, bool relayed, bool do_not_relay, uint8_t version); + bool add_tx(transaction &tx, const crypto::hash &id, size_t tx_weight, tx_verification_context& tvc, bool kept_by_block, bool relayed, bool do_not_relay, uint8_t version); /** * @brief add a transaction to the transaction pool @@ -133,7 +133,7 @@ namespace cryptonote * * @param id the hash of the transaction * @param tx return-by-reference the transaction taken - * @param blob_size return-by-reference the transaction's size + * @param tx_weight return-by-reference the transaction's weight * @param fee the transaction fee * @param relayed return-by-reference was transaction relayed to us by the network? * @param do_not_relay return-by-reference is transaction not to be relayed to the network? @@ -141,7 +141,7 @@ namespace cryptonote * * @return true unless the transaction cannot be found in the pool */ - bool take_tx(const crypto::hash &id, transaction &tx, size_t& blob_size, uint64_t& fee, bool &relayed, bool &do_not_relay, bool &double_spend_seen); + bool take_tx(const crypto::hash &id, transaction &tx, size_t& tx_weight, uint64_t& fee, bool &relayed, bool &do_not_relay, bool &double_spend_seen); /** * @brief checks if the pool has a transaction with the given hash @@ -198,11 +198,11 @@ namespace cryptonote /** * @brief loads pool state (if any) from disk, and initializes pool * - * @param max_txpool_size the max size in bytes + * @param max_txpool_weight the max weight in bytes * * @return true */ - bool init(size_t max_txpool_size = 0); + bool init(size_t max_txpool_weight = 0); /** * @brief attempts to save the transaction pool state to disk @@ -219,16 +219,16 @@ namespace cryptonote * @brief Chooses transactions for a block to include * * @param bl return-by-reference the block to fill in with transactions - * @param median_size the current median block size + * @param median_weight the current median block weight * @param already_generated_coins the current total number of coins "minted" - * @param total_size return-by-reference the total size of the new block + * @param total_weight return-by-reference the total weight of the new block * @param fee return-by-reference the total of fees from the included transactions * @param expected_reward return-by-reference the total reward awarded to the miner finding this block, including transaction fees * @param version hard fork version to use for consensus rules * * @return true */ - bool fill_block_template(block &bl, size_t median_size, uint64_t already_generated_coins, size_t &total_size, uint64_t &fee, uint64_t &expected_reward, uint8_t version); + bool fill_block_template(block &bl, size_t median_weight, uint64_t already_generated_coins, size_t &total_weight, uint64_t &fee, uint64_t &expected_reward, uint8_t version); /** * @brief get a list of all transactions in the pool @@ -249,7 +249,7 @@ namespace cryptonote void get_transaction_hashes(std::vector& txs, bool include_unrelayed_txes = true) const; /** - * @brief get (size, fee, receive time) for all transaction in the pool + * @brief get (weight, fee, receive time) for all transaction in the pool * * @param txs return-by-reference that data * @param include_unrelayed_txes include unrelayed txes in the result @@ -370,21 +370,21 @@ namespace cryptonote uint64_t cookie() const { return m_cookie; } /** - * @brief get the cumulative txpool size in bytes + * @brief get the cumulative txpool weight in bytes * - * @return the cumulative txpool size in bytes + * @return the cumulative txpool weight in bytes */ - size_t get_txpool_size() const; + size_t get_txpool_weight() const; /** - * @brief set the max cumulative txpool size in bytes + * @brief set the max cumulative txpool weight in bytes * - * @param bytes the max cumulative txpool size in bytes + * @param bytes the max cumulative txpool weight in bytes */ - void set_txpool_max_size(size_t bytes); + void set_txpool_max_weight(size_t bytes); #define CURRENT_MEMPOOL_ARCHIVE_VER 11 -#define CURRENT_MEMPOOL_TX_DETAILS_ARCHIVE_VER 12 +#define CURRENT_MEMPOOL_TX_DETAILS_ARCHIVE_VER 13 /** * @brief information about a single transaction @@ -393,6 +393,7 @@ namespace cryptonote { transaction tx; //!< the transaction size_t blob_size; //!< the transaction's size + size_t weight; //!< the transaction's weight uint64_t fee; //!< the transaction's fee amount crypto::hash max_used_block_id; //!< the hash of the highest block referenced by an input uint64_t max_used_block_height; //!< the height of the highest block referenced by an input @@ -522,7 +523,7 @@ namespace cryptonote /** * @brief prune lowest fee/byte txes till we're not above bytes * - * if bytes is 0, use m_txpool_max_size + * if bytes is 0, use m_txpool_max_weight */ void prune(size_t bytes = 0); @@ -578,8 +579,8 @@ private: Blockchain& m_blockchain; //!< reference to the Blockchain object - size_t m_txpool_max_size; - size_t m_txpool_size; + size_t m_txpool_max_weight; + size_t m_txpool_weight; mutable std::unordered_map> m_input_cache; }; @@ -608,6 +609,9 @@ namespace boost if (version < 12) return; ar & td.do_not_relay; + if (version < 13) + return; + ar & td.weight; } } } diff --git a/src/daemon/rpc_command_executor.cpp b/src/daemon/rpc_command_executor.cpp index 45ba81e16..9ab1be246 100644 --- a/src/daemon/rpc_command_executor.cpp +++ b/src/daemon/rpc_command_executor.cpp @@ -76,6 +76,7 @@ namespace { << "difficulty: " << boost::lexical_cast(header.difficulty) << std::endl << "POW hash: " << header.pow_hash << std::endl << "block size: " << header.block_size << std::endl + << "block weight: " << header.block_weight << std::endl << "num txes: " << header.num_txes << std::endl << "reward: " << cryptonote::print_money(header.reward); } @@ -558,7 +559,7 @@ bool t_rpc_command_executor::print_blockchain_info(uint64_t start_block_index, u std::cout << std::endl; std::cout << "height: " << header.height << ", timestamp: " << header.timestamp - << ", size: " << header.block_size << ", transactions: " << header.num_txes << std::endl + << ", size: " << header.block_size << ", weight: " << header.block_weight << ", transactions: " << header.num_txes << std::endl << "major version: " << (unsigned)header.major_version << ", minor version: " << (unsigned)header.minor_version << std::endl << "block id: " << header.hash << ", previous block id: " << header.prev_hash << std::endl << "difficulty: " << header.difficulty << ", nonce " << header.nonce << ", reward " << cryptonote::print_money(header.reward) << std::endl; @@ -857,8 +858,9 @@ bool t_rpc_command_executor::print_transaction_pool_long() { tools::msg_writer() << "id: " << tx_info.id_hash << std::endl << tx_info.tx_json << std::endl << "blob_size: " << tx_info.blob_size << std::endl + << "weight: " << tx_info.weight << std::endl << "fee: " << cryptonote::print_money(tx_info.fee) << std::endl - << "fee/byte: " << cryptonote::print_money(tx_info.fee / (double)tx_info.blob_size) << std::endl + << "fee/byte: " << cryptonote::print_money(tx_info.fee / (double)tx_info.weight) << std::endl << "receive_time: " << tx_info.receive_time << " (" << get_human_time_ago(tx_info.receive_time, now) << ")" << std::endl << "relayed: " << [&](const cryptonote::tx_info &tx_info)->std::string { if (!tx_info.relayed) return "no"; return boost::lexical_cast(tx_info.last_relayed_time) + " (" + get_human_time_ago(tx_info.last_relayed_time, now) + ")"; } (tx_info) << std::endl << "do_not_relay: " << (tx_info.do_not_relay ? 'T' : 'F') << std::endl @@ -940,8 +942,9 @@ bool t_rpc_command_executor::print_transaction_pool_short() { { tools::msg_writer() << "id: " << tx_info.id_hash << std::endl << "blob_size: " << tx_info.blob_size << std::endl + << "weight: " << tx_info.weight << std::endl << "fee: " << cryptonote::print_money(tx_info.fee) << std::endl - << "fee/byte: " << cryptonote::print_money(tx_info.fee / (double)tx_info.blob_size) << std::endl + << "fee/byte: " << cryptonote::print_money(tx_info.fee / (double)tx_info.weight) << std::endl << "receive_time: " << tx_info.receive_time << " (" << get_human_time_ago(tx_info.receive_time, now) << ")" << std::endl << "relayed: " << [&](const cryptonote::tx_info &tx_info)->std::string { if (!tx_info.relayed) return "no"; return boost::lexical_cast(tx_info.last_relayed_time) + " (" + get_human_time_ago(tx_info.last_relayed_time, now) + ")"; } (tx_info) << std::endl << "do_not_relay: " << (tx_info.do_not_relay ? 'T' : 'F') << std::endl @@ -996,7 +999,7 @@ bool t_rpc_command_executor::print_transaction_pool_stats() { size_t avg_bytes = n_transactions ? res.pool_stats.bytes_total / n_transactions : 0; std::string backlog_message; - const uint64_t full_reward_zone = ires.block_size_limit / 2; + const uint64_t full_reward_zone = ires.block_weight_limit / 2; if (res.pool_stats.bytes_total <= full_reward_zone) { backlog_message = "no backlog"; @@ -1701,8 +1704,8 @@ bool t_rpc_command_executor::print_blockchain_dynamic_stats(uint64_t nblocks) cryptonote::COMMAND_RPC_GET_INFO::response ires; cryptonote::COMMAND_RPC_GET_BLOCK_HEADERS_RANGE::request bhreq; cryptonote::COMMAND_RPC_GET_BLOCK_HEADERS_RANGE::response bhres; - cryptonote::COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::request fereq; - cryptonote::COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::response feres; + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::request fereq; + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::response feres; epee::json_rpc::error error_resp; std::string fail_message = "Problem fetching info"; @@ -1726,7 +1729,7 @@ bool t_rpc_command_executor::print_blockchain_dynamic_stats(uint64_t nblocks) tools::fail_msg_writer() << make_error(fail_message, ires.status); return true; } - if (!m_rpc_server->on_get_per_kb_fee_estimate(fereq, feres, error_resp) || feres.status != CORE_RPC_STATUS_OK) + if (!m_rpc_server->on_get_base_fee_estimate(fereq, feres, error_resp) || feres.status != CORE_RPC_STATUS_OK) { tools::fail_msg_writer() << make_error(fail_message, feres.status); return true; @@ -1762,8 +1765,8 @@ bool t_rpc_command_executor::print_blockchain_dynamic_stats(uint64_t nblocks) double avgdiff = 0; double avgnumtxes = 0; double avgreward = 0; - std::vector sizes; - sizes.reserve(nblocks); + std::vector weights; + weights.reserve(nblocks); uint64_t earliest = std::numeric_limits::max(), latest = 0; std::vector major_versions(256, 0), minor_versions(256, 0); for (const auto &bhr: bhres.headers) @@ -1771,7 +1774,7 @@ bool t_rpc_command_executor::print_blockchain_dynamic_stats(uint64_t nblocks) avgdiff += bhr.difficulty; avgnumtxes += bhr.num_txes; avgreward += bhr.reward; - sizes.push_back(bhr.block_size); + weights.push_back(bhr.block_weight); static_assert(sizeof(bhr.major_version) == 1, "major_version expected to be uint8_t"); static_assert(sizeof(bhr.minor_version) == 1, "major_version expected to be uint8_t"); major_versions[(unsigned)bhr.major_version]++; @@ -1782,9 +1785,9 @@ bool t_rpc_command_executor::print_blockchain_dynamic_stats(uint64_t nblocks) avgdiff /= nblocks; avgnumtxes /= nblocks; avgreward /= nblocks; - uint64_t median_block_size = epee::misc_utils::median(sizes); + uint64_t median_block_weight = epee::misc_utils::median(weights); tools::msg_writer() << "Last " << nblocks << ": avg. diff " << (uint64_t)avgdiff << ", " << (latest - earliest) / nblocks << " avg sec/block, avg num txes " << avgnumtxes - << ", avg. reward " << cryptonote::print_money(avgreward) << ", median block size " << median_block_size; + << ", avg. reward " << cryptonote::print_money(avgreward) << ", median block weight " << median_block_weight; unsigned int max_major = 256, max_minor = 256; while (max_major > 0 && !major_versions[--max_major]); diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index d2dc87e27..dbbf29fd1 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -758,7 +758,20 @@ namespace rct { std::vector proof_amounts; size_t n_amounts = outamounts.size(); size_t amounts_proved = 0; - while (amounts_proved < n_amounts) + if (range_proof_type == RangeProofPaddedBulletproof) + { + rct::keyV C, masks; + rv.p.bulletproofs.push_back(proveRangeBulletproof(C, masks, outamounts)); + #ifdef DBG + CHECK_AND_ASSERT_THROW_MES(verBulletproof(rv.p.bulletproofs.back()), "verBulletproof failed on newly created proof"); + #endif + for (i = 0; i < outamounts.size(); ++i) + { + rv.outPk[i].mask = C[i]; + outSk[i].mask = masks[i]; + } + } + else while (amounts_proved < n_amounts) { size_t batch_size = 1; if (range_proof_type == RangeProofMultiOutputBulletproof) diff --git a/src/ringct/rctTypes.cpp b/src/ringct/rctTypes.cpp index 5dd59aec3..90ed65df0 100644 --- a/src/ringct/rctTypes.cpp +++ b/src/ringct/rctTypes.cpp @@ -29,6 +29,7 @@ // THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include "misc_log_ex.h" +#include "cryptonote_config.h" #include "rctTypes.h" using namespace crypto; using namespace std; @@ -233,11 +234,29 @@ namespace rct { } } + bool is_rct_borromean(int type) + { + switch (type) + { + case RCTTypeSimple: + case RCTTypeFull: + return true; + default: + return false; + } + } + size_t n_bulletproof_amounts(const Bulletproof &proof) { CHECK_AND_ASSERT_MES(proof.L.size() >= 6, 0, "Invalid bulletproof L size"); - CHECK_AND_ASSERT_MES(proof.L.size() <= 31, 0, "Insane bulletproof L size"); - return 1 << (proof.L.size() - 6); + CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), 0, "Mismatched bulletproof L/R size"); + static const size_t extra_bits = 4; + static_assert((1 << extra_bits) == BULLETPROOF_MAX_OUTPUTS, "log2(BULLETPROOF_MAX_OUTPUTS) is out of date"); + CHECK_AND_ASSERT_MES(proof.L.size() <= 6 + extra_bits, 0, "Invalid bulletproof L size"); + CHECK_AND_ASSERT_MES(proof.V.size() <= (1u<<(proof.L.size()-6)), 0, "Invalid bulletproof V/L"); + CHECK_AND_ASSERT_MES(proof.V.size() * 2 > (1u<<(proof.L.size()-6)), 0, "Invalid bulletproof V/L"); + CHECK_AND_ASSERT_MES(proof.V.size() > 0, 0, "Empty bulletproof"); + return proof.V.size(); } size_t n_bulletproof_amounts(const std::vector &proofs) @@ -254,4 +273,28 @@ namespace rct { return n; } + size_t n_bulletproof_max_amounts(const Bulletproof &proof) + { + CHECK_AND_ASSERT_MES(proof.L.size() >= 6, 0, "Invalid bulletproof L size"); + CHECK_AND_ASSERT_MES(proof.L.size() == proof.R.size(), 0, "Mismatched bulletproof L/R size"); + static const size_t extra_bits = 4; + static_assert((1 << extra_bits) == BULLETPROOF_MAX_OUTPUTS, "log2(BULLETPROOF_MAX_OUTPUTS) is out of date"); + CHECK_AND_ASSERT_MES(proof.L.size() <= 6 + extra_bits, 0, "Invalid bulletproof L size"); + return 1 << (proof.L.size() - 6); + } + + size_t n_bulletproof_max_amounts(const std::vector &proofs) + { + size_t n = 0; + for (const Bulletproof &proof: proofs) + { + size_t n2 = n_bulletproof_max_amounts(proof); + CHECK_AND_ASSERT_MES(n2 < std::numeric_limits::max() - n, 0, "Invalid number of bulletproofs"); + if (n2 == 0) + return 0; + n += n2; + } + return n; + } + } diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index 894f747b8..5c02f92aa 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -214,7 +214,9 @@ namespace rct { }; size_t n_bulletproof_amounts(const Bulletproof &proof); + size_t n_bulletproof_max_amounts(const Bulletproof &proof); size_t n_bulletproof_amounts(const std::vector &proofs); + size_t n_bulletproof_max_amounts(const std::vector &proofs); //A container to hold all signatures necessary for RingCT // rangeSigs holds all the rangeproof data of a transaction @@ -229,7 +231,7 @@ namespace rct { RCTTypeSimple = 2, RCTTypeBulletproof = 3, }; - enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof }; + enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof, RangeProofPaddedBulletproof }; struct rctSigBase { uint8_t type; key message; @@ -324,7 +326,7 @@ namespace rct { if (nbp - i > 1) ar.delimit_array(); } - if (n_bulletproof_amounts(bulletproofs) != outputs) + if (n_bulletproof_max_amounts(bulletproofs) < outputs) return false; ar.end_array(); } @@ -528,6 +530,7 @@ namespace rct { bool is_rct_simple(int type); bool is_rct_bulletproof(int type); + bool is_rct_borromean(int type); static inline const rct::key &pk2rct(const crypto::public_key &pk) { return (const rct::key&)pk; } static inline const rct::key &sk2rct(const crypto::secret_key &sk) { return (const rct::key&)sk; } diff --git a/src/rpc/core_rpc_server.cpp b/src/rpc/core_rpc_server.cpp index 0a6daf8f0..4383ad190 100644 --- a/src/rpc/core_rpc_server.cpp +++ b/src/rpc/core_rpc_server.cpp @@ -195,8 +195,8 @@ namespace cryptonote res.stagenet = m_nettype == STAGENET; res.nettype = m_nettype == MAINNET ? "mainnet" : m_nettype == TESTNET ? "testnet" : m_nettype == STAGENET ? "stagenet" : "fakechain"; res.cumulative_difficulty = m_core.get_blockchain_storage().get_db().get_block_cumulative_difficulty(res.height - 1); - res.block_size_limit = m_core.get_blockchain_storage().get_current_cumulative_blocksize_limit(); - res.block_size_median = m_core.get_blockchain_storage().get_current_cumulative_blocksize_median(); + res.block_size_limit = res.block_weight_limit = m_core.get_blockchain_storage().get_current_cumulative_block_weight_limit(); + res.block_size_median = res.block_weight_median = m_core.get_blockchain_storage().get_current_cumulative_block_weight_median(); res.status = CORE_RPC_STATUS_OK; res.start_time = (uint64_t)m_core.get_start_time(); res.free_space = m_restricted ? std::numeric_limits::max() : m_core.get_free_space(); @@ -1313,7 +1313,7 @@ namespace cryptonote response.hash = string_tools::pod_to_hex(hash); response.difficulty = m_core.get_blockchain_storage().block_difficulty(height); response.reward = get_block_reward(blk); - response.block_size = m_core.get_blockchain_storage().get_db().get_block_size(height); + response.block_size = response.block_weight = m_core.get_blockchain_storage().get_db().get_block_weight(height); response.num_txes = blk.tx_hashes.size(); response.pow_hash = fill_pow_hash ? string_tools::pod_to_hex(get_block_longhash(blk, height)) : ""; return true; @@ -1646,8 +1646,8 @@ namespace cryptonote res.stagenet = m_nettype == STAGENET; res.nettype = m_nettype == MAINNET ? "mainnet" : m_nettype == TESTNET ? "testnet" : m_nettype == STAGENET ? "stagenet" : "fakechain"; res.cumulative_difficulty = m_core.get_blockchain_storage().get_db().get_block_cumulative_difficulty(res.height - 1); - res.block_size_limit = m_core.get_blockchain_storage().get_current_cumulative_blocksize_limit(); - res.block_size_median = m_core.get_blockchain_storage().get_current_cumulative_blocksize_median(); + res.block_size_limit = res.block_weight_limit = m_core.get_blockchain_storage().get_current_cumulative_block_weight_limit(); + res.block_size_median = res.block_weight_median = m_core.get_blockchain_storage().get_current_cumulative_block_weight_median(); res.status = CORE_RPC_STATUS_OK; res.start_time = (uint64_t)m_core.get_start_time(); res.free_space = m_restricted ? std::numeric_limits::max() : m_core.get_free_space(); @@ -1839,14 +1839,15 @@ namespace cryptonote return true; } //------------------------------------------------------------------------------------------------------------------------------ - bool core_rpc_server::on_get_per_kb_fee_estimate(const COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::request& req, COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::response& res, epee::json_rpc::error& error_resp) + bool core_rpc_server::on_get_base_fee_estimate(const COMMAND_RPC_GET_BASE_FEE_ESTIMATE::request& req, COMMAND_RPC_GET_BASE_FEE_ESTIMATE::response& res, epee::json_rpc::error& error_resp) { - PERF_TIMER(on_get_per_kb_fee_estimate); + PERF_TIMER(on_get_base_fee_estimate); bool r; - if (use_bootstrap_daemon_if_necessary(invoke_http_mode::JON_RPC, "get_fee_estimate", req, res, r)) + if (use_bootstrap_daemon_if_necessary(invoke_http_mode::JON_RPC, "get_fee_estimate", req, res, r)) return r; - res.fee = m_core.get_blockchain_storage().get_dynamic_per_kb_fee_estimate(req.grace_blocks); + res.fee = m_core.get_blockchain_storage().get_dynamic_base_fee_estimate(req.grace_blocks); + res.quantization_mask = Blockchain::get_fee_quantization_mask(); res.status = CORE_RPC_STATUS_OK; return true; } diff --git a/src/rpc/core_rpc_server.h b/src/rpc/core_rpc_server.h index 166020d01..5dbe44d24 100644 --- a/src/rpc/core_rpc_server.h +++ b/src/rpc/core_rpc_server.h @@ -150,7 +150,7 @@ namespace cryptonote MAP_JON_RPC_WE("get_output_histogram", on_get_output_histogram, COMMAND_RPC_GET_OUTPUT_HISTOGRAM) MAP_JON_RPC_WE("get_version", on_get_version, COMMAND_RPC_GET_VERSION) MAP_JON_RPC_WE_IF("get_coinbase_tx_sum", on_get_coinbase_tx_sum, COMMAND_RPC_GET_COINBASE_TX_SUM, !m_restricted) - MAP_JON_RPC_WE("get_fee_estimate", on_get_per_kb_fee_estimate, COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE) + MAP_JON_RPC_WE("get_fee_estimate", on_get_base_fee_estimate, COMMAND_RPC_GET_BASE_FEE_ESTIMATE) MAP_JON_RPC_WE_IF("get_alternate_chains",on_get_alternate_chains, COMMAND_RPC_GET_ALTERNATE_CHAINS, !m_restricted) MAP_JON_RPC_WE_IF("relay_tx", on_relay_tx, COMMAND_RPC_RELAY_TX, !m_restricted) MAP_JON_RPC_WE_IF("sync_info", on_sync_info, COMMAND_RPC_SYNC_INFO, !m_restricted) @@ -214,7 +214,7 @@ namespace cryptonote bool on_get_output_histogram(const COMMAND_RPC_GET_OUTPUT_HISTOGRAM::request& req, COMMAND_RPC_GET_OUTPUT_HISTOGRAM::response& res, epee::json_rpc::error& error_resp); bool on_get_version(const COMMAND_RPC_GET_VERSION::request& req, COMMAND_RPC_GET_VERSION::response& res, epee::json_rpc::error& error_resp); bool on_get_coinbase_tx_sum(const COMMAND_RPC_GET_COINBASE_TX_SUM::request& req, COMMAND_RPC_GET_COINBASE_TX_SUM::response& res, epee::json_rpc::error& error_resp); - bool on_get_per_kb_fee_estimate(const COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::request& req, COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::response& res, epee::json_rpc::error& error_resp); + bool on_get_base_fee_estimate(const COMMAND_RPC_GET_BASE_FEE_ESTIMATE::request& req, COMMAND_RPC_GET_BASE_FEE_ESTIMATE::response& res, epee::json_rpc::error& error_resp); bool on_get_alternate_chains(const COMMAND_RPC_GET_ALTERNATE_CHAINS::request& req, COMMAND_RPC_GET_ALTERNATE_CHAINS::response& res, epee::json_rpc::error& error_resp); bool on_relay_tx(const COMMAND_RPC_RELAY_TX::request& req, COMMAND_RPC_RELAY_TX::response& res, epee::json_rpc::error& error_resp); bool on_sync_info(const COMMAND_RPC_SYNC_INFO::request& req, COMMAND_RPC_SYNC_INFO::response& res, epee::json_rpc::error& error_resp); diff --git a/src/rpc/core_rpc_server_commands_defs.h b/src/rpc/core_rpc_server_commands_defs.h index e2d120cad..da4c8b6cf 100644 --- a/src/rpc/core_rpc_server_commands_defs.h +++ b/src/rpc/core_rpc_server_commands_defs.h @@ -48,8 +48,8 @@ namespace cryptonote // whether they can talk to a given daemon without having to know in // advance which version they will stop working with // Don't go over 32767 for any of these -#define CORE_RPC_VERSION_MAJOR 1 -#define CORE_RPC_VERSION_MINOR 21 +#define CORE_RPC_VERSION_MAJOR 2 +#define CORE_RPC_VERSION_MINOR 0 #define MAKE_CORE_RPC_VERSION(major,minor) (((major)<<16)|(minor)) #define CORE_RPC_VERSION MAKE_CORE_RPC_VERSION(CORE_RPC_VERSION_MAJOR, CORE_RPC_VERSION_MINOR) @@ -959,7 +959,9 @@ namespace cryptonote std::string top_block_hash; uint64_t cumulative_difficulty; uint64_t block_size_limit; + uint64_t block_weight_limit; uint64_t block_size_median; + uint64_t block_weight_median; uint64_t start_time; uint64_t free_space; bool offline; @@ -990,7 +992,9 @@ namespace cryptonote KV_SERIALIZE(top_block_hash) KV_SERIALIZE(cumulative_difficulty) KV_SERIALIZE(block_size_limit) + KV_SERIALIZE_OPT(block_weight_limit, (uint64_t)0) KV_SERIALIZE(block_size_median) + KV_SERIALIZE_OPT(block_weight_median, (uint64_t)0) KV_SERIALIZE(start_time) KV_SERIALIZE(free_space) KV_SERIALIZE(offline) @@ -1195,6 +1199,7 @@ namespace cryptonote difficulty_type difficulty; uint64_t reward; uint64_t block_size; + uint64_t block_weight; uint64_t num_txes; std::string pow_hash; @@ -1211,6 +1216,7 @@ namespace cryptonote KV_SERIALIZE(difficulty) KV_SERIALIZE(reward) KV_SERIALIZE(block_size) + KV_SERIALIZE_OPT(block_weight, (uint64_t)0) KV_SERIALIZE(num_txes) KV_SERIALIZE(pow_hash) END_KV_SERIALIZE_MAP() @@ -1451,6 +1457,7 @@ namespace cryptonote std::string id_hash; std::string tx_json; // TODO - expose this data directly uint64_t blob_size; + uint64_t weight; uint64_t fee; std::string max_used_block_id_hash; uint64_t max_used_block_height; @@ -1468,6 +1475,7 @@ namespace cryptonote KV_SERIALIZE(id_hash) KV_SERIALIZE(tx_json) KV_SERIALIZE(blob_size) + KV_SERIALIZE_OPT(weight, (uint64_t)0) KV_SERIALIZE(fee) KV_SERIALIZE(max_used_block_id_hash) KV_SERIALIZE(max_used_block_height) @@ -1564,7 +1572,7 @@ namespace cryptonote struct tx_backlog_entry { - uint64_t blob_size; + uint64_t weight; uint64_t fee; uint64_t time_in_pool; }; @@ -2102,7 +2110,7 @@ namespace cryptonote }; }; - struct COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE + struct COMMAND_RPC_GET_BASE_FEE_ESTIMATE { struct request { @@ -2117,11 +2125,13 @@ namespace cryptonote { std::string status; uint64_t fee; + uint64_t quantization_mask; bool untrusted; BEGIN_KV_SERIALIZE_MAP() KV_SERIALIZE(status) KV_SERIALIZE(fee) + KV_SERIALIZE_OPT(quantization_mask, (uint64_t)1) KV_SERIALIZE(untrusted) END_KV_SERIALIZE_MAP() }; diff --git a/src/rpc/daemon_handler.cpp b/src/rpc/daemon_handler.cpp index 25abe4825..26f102a8b 100644 --- a/src/rpc/daemon_handler.cpp +++ b/src/rpc/daemon_handler.cpp @@ -472,7 +472,8 @@ namespace rpc res.info.testnet = m_core.get_nettype() == TESTNET; res.info.stagenet = m_core.get_nettype() == STAGENET; res.info.cumulative_difficulty = m_core.get_blockchain_storage().get_db().get_block_cumulative_difficulty(res.info.height - 1); - res.info.block_size_limit = m_core.get_blockchain_storage().get_current_cumulative_blocksize_limit(); + res.info.block_size_limit = res.info.block_weight_limit = m_core.get_blockchain_storage().get_current_cumulative_block_weight_limit(); + res.info.block_size_median = res.info.block_weight_median = m_core.get_blockchain_storage().get_current_cumulative_block_weight_median(); res.info.start_time = (uint64_t)m_core.get_start_time(); res.status = Message::STATUS_OK; @@ -763,7 +764,7 @@ namespace rpc void DaemonHandler::handle(const GetPerKBFeeEstimate::Request& req, GetPerKBFeeEstimate::Response& res) { - res.estimated_fee_per_kb = m_core.get_blockchain_storage().get_dynamic_per_kb_fee_estimate(req.num_grace_blocks); + res.estimated_fee_per_kb = m_core.get_blockchain_storage().get_dynamic_base_fee_estimate(req.num_grace_blocks); res.status = Message::STATUS_OK; } diff --git a/src/rpc/message_data_structs.h b/src/rpc/message_data_structs.h index 20390aee8..cf15ade1c 100644 --- a/src/rpc/message_data_structs.h +++ b/src/rpc/message_data_structs.h @@ -85,6 +85,7 @@ namespace rpc cryptonote::transaction tx; crypto::hash tx_hash; uint64_t blob_size; + uint64_t weight; uint64_t fee; crypto::hash max_used_block_hash; uint64_t max_used_block_height; @@ -185,6 +186,9 @@ namespace rpc crypto::hash top_block_hash; uint64_t cumulative_difficulty; uint64_t block_size_limit; + uint64_t block_weight_limit; + uint64_t block_size_median; + uint64_t block_weight_median; uint64_t start_time; }; diff --git a/src/serialization/json_object.cpp b/src/serialization/json_object.cpp index 67fe709dc..89a1dbd23 100644 --- a/src/serialization/json_object.cpp +++ b/src/serialization/json_object.cpp @@ -757,6 +757,7 @@ void toJsonValue(rapidjson::Document& doc, const cryptonote::rpc::tx_in_pool& tx INSERT_INTO_JSON_OBJECT(val, doc, tx, tx.tx); INSERT_INTO_JSON_OBJECT(val, doc, tx_hash, tx.tx_hash); INSERT_INTO_JSON_OBJECT(val, doc, blob_size, tx.blob_size); + INSERT_INTO_JSON_OBJECT(val, doc, weight, tx.weight); INSERT_INTO_JSON_OBJECT(val, doc, fee, tx.fee); INSERT_INTO_JSON_OBJECT(val, doc, max_used_block_hash, tx.max_used_block_hash); INSERT_INTO_JSON_OBJECT(val, doc, max_used_block_height, tx.max_used_block_height); @@ -780,6 +781,7 @@ void fromJsonValue(const rapidjson::Value& val, cryptonote::rpc::tx_in_pool& tx) GET_FROM_JSON_OBJECT(val, tx.tx, tx); GET_FROM_JSON_OBJECT(val, tx.blob_size, blob_size); + GET_FROM_JSON_OBJECT(val, tx.weight, weight); GET_FROM_JSON_OBJECT(val, tx.fee, fee); GET_FROM_JSON_OBJECT(val, tx.max_used_block_hash, max_used_block_hash); GET_FROM_JSON_OBJECT(val, tx.max_used_block_height, max_used_block_height); @@ -1195,6 +1197,9 @@ void toJsonValue(rapidjson::Document& doc, const cryptonote::rpc::DaemonInfo& in INSERT_INTO_JSON_OBJECT(val, doc, top_block_hash, info.top_block_hash); INSERT_INTO_JSON_OBJECT(val, doc, cumulative_difficulty, info.cumulative_difficulty); INSERT_INTO_JSON_OBJECT(val, doc, block_size_limit, info.block_size_limit); + INSERT_INTO_JSON_OBJECT(val, doc, block_weight_limit, info.block_weight_limit); + INSERT_INTO_JSON_OBJECT(val, doc, block_size_median, info.block_size_median); + INSERT_INTO_JSON_OBJECT(val, doc, block_weight_median, info.block_weight_median); INSERT_INTO_JSON_OBJECT(val, doc, start_time, info.start_time); } @@ -1221,6 +1226,9 @@ void fromJsonValue(const rapidjson::Value& val, cryptonote::rpc::DaemonInfo& inf GET_FROM_JSON_OBJECT(val, info.top_block_hash, top_block_hash); GET_FROM_JSON_OBJECT(val, info.cumulative_difficulty, cumulative_difficulty); GET_FROM_JSON_OBJECT(val, info.block_size_limit, block_size_limit); + GET_FROM_JSON_OBJECT(val, info.block_weight_limit, block_weight_limit); + GET_FROM_JSON_OBJECT(val, info.block_size_median, block_size_median); + GET_FROM_JSON_OBJECT(val, info.block_weight_median, block_weight_median); GET_FROM_JSON_OBJECT(val, info.start_time, start_time); } diff --git a/src/simplewallet/simplewallet.cpp b/src/simplewallet/simplewallet.cpp index f5aeabded..bcdf2a43f 100644 --- a/src/simplewallet/simplewallet.cpp +++ b/src/simplewallet/simplewallet.cpp @@ -86,9 +86,9 @@ typedef cryptonote::simple_wallet sw; #define EXTENDED_LOGS_FILE "wallet_details.log" -#define DEFAULT_MIX 6 +#define DEFAULT_MIX 10 -#define MIN_RING_SIZE 7 // Used to inform user about min ring size -- does not track actual protocol +#define MIN_RING_SIZE 11 // Used to inform user about min ring size -- does not track actual protocol #define LOCK_IDLE_SCOPE() \ bool auto_refresh_enabled = m_auto_refresh_enabled.load(std::memory_order_relaxed); \ @@ -829,21 +829,24 @@ bool simple_wallet::print_fee_info(const std::vector &args/* = std: fail_msg_writer() << tr("Cannot connect to daemon"); return true; } - const uint64_t per_kb_fee = m_wallet->get_per_kb_fee(); - const uint64_t typical_size_kb = 13; - message_writer() << (boost::format(tr("Current fee is %s %s per kB")) % print_money(per_kb_fee) % cryptonote::get_unit(cryptonote::get_default_decimal_point())).str(); + const bool per_byte = m_wallet->use_fork_rules(HF_VERSION_PER_BYTE_FEE); + const uint64_t base_fee = m_wallet->get_base_fee(); + const char *base = per_byte ? "byte" : "kB"; + const uint64_t typical_size = per_byte ? 2500 : 13; + const uint64_t size_granularity = per_byte ? 1 : 1024; + message_writer() << (boost::format(tr("Current fee is %s %s per %s")) % print_money(base_fee) % cryptonote::get_unit(cryptonote::get_default_decimal_point()) % base).str(); std::vector fees; for (uint32_t priority = 1; priority <= 4; ++priority) { uint64_t mult = m_wallet->get_fee_multiplier(priority); - fees.push_back(per_kb_fee * typical_size_kb * mult); + fees.push_back(base_fee * typical_size * mult); } std::vector> blocks; try { - uint64_t base_size = typical_size_kb * 1024; - blocks = m_wallet->estimate_backlog(base_size, base_size + 1023, fees); + uint64_t base_size = typical_size * size_granularity; + blocks = m_wallet->estimate_backlog(base_size, base_size + size_granularity - 1, fees); } catch (const std::exception &e) { @@ -1839,6 +1842,8 @@ bool simple_wallet::set_default_ring_size(const std::vector &args/* if (ring_size != 0 && ring_size != DEFAULT_MIX+1) message_writer() << tr("WARNING: this is a non default ring size, which may harm your privacy. Default is recommended."); + else if (ring_size == DEFAULT_MIX) + message_writer() << tr("WARNING: from v8, ring size will be fixed and this setting will be ignored."); const auto pwd_container = get_and_verify_password(); if (pwd_container) @@ -4704,6 +4709,11 @@ bool simple_wallet::transfer_main(int transfer_type, const std::vector &args_) if (fake_outs_count == 0) fake_outs_count = DEFAULT_MIX; } + else if (ring_size == 0) + { + fail_msg_writer() << tr("Ring size must not be 0"); + return true; + } else { fake_outs_count = ring_size - 1; local_args.erase(local_args.begin()); } } + uint64_t adjusted_fake_outs_count = m_wallet->adjust_mixin(fake_outs_count); + if (adjusted_fake_outs_count > fake_outs_count) + { + fail_msg_writer() << (boost::format(tr("ring size %u is too small, minimum is %u")) % (fake_outs_count+1) % (adjusted_fake_outs_count+1)).str(); + return true; + } + if (adjusted_fake_outs_count < fake_outs_count) + { + fail_msg_writer() << (boost::format(tr("ring size %u is too large, maximum is %u")) % (fake_outs_count+1) % (adjusted_fake_outs_count+1)).str(); + return true; + } std::vector extra; bool payment_id_seen = false; diff --git a/src/wallet/api/wallet.cpp b/src/wallet/api/wallet.cpp index 7b4ad27e4..3780d7271 100644 --- a/src/wallet/api/wallet.cpp +++ b/src/wallet/api/wallet.cpp @@ -1297,6 +1297,7 @@ PendingTransaction *WalletImpl::createTransaction(const string &dst_addr, const size_t fake_outs_count = mixin_count > 0 ? mixin_count : m_wallet->default_mixin(); if (fake_outs_count == 0) fake_outs_count = DEFAULT_MIXIN; + fake_outs_count = m_wallet->adjust_mixin(fake_outs_count); uint32_t adjusted_priority = m_wallet->adjust_priority(static_cast(priority)); diff --git a/src/wallet/node_rpc_proxy.cpp b/src/wallet/node_rpc_proxy.cpp index 2072495cd..21f75371b 100644 --- a/src/wallet/node_rpc_proxy.cpp +++ b/src/wallet/node_rpc_proxy.cpp @@ -50,12 +50,13 @@ void NodeRPCProxy::invalidate() m_height = 0; for (size_t n = 0; n < 256; ++n) m_earliest_height[n] = 0; - m_dynamic_per_kb_fee_estimate = 0; - m_dynamic_per_kb_fee_estimate_cached_height = 0; - m_dynamic_per_kb_fee_estimate_grace_blocks = 0; + m_dynamic_base_fee_estimate = 0; + m_dynamic_base_fee_estimate_cached_height = 0; + m_dynamic_base_fee_estimate_grace_blocks = 0; + m_fee_quantization_mask = 1; m_rpc_version = 0; m_target_height = 0; - m_block_size_limit = 0; + m_block_weight_limit = 0; m_get_info_time = 0; } @@ -99,7 +100,7 @@ boost::optional NodeRPCProxy::get_info() const CHECK_AND_ASSERT_MES(resp_t.status == CORE_RPC_STATUS_OK, resp_t.status, "Failed to get target blockchain height"); m_height = resp_t.height; m_target_height = resp_t.target_height; - m_block_size_limit = resp_t.block_size_limit; + m_block_weight_limit = resp_t.block_weight_limit ? resp_t.block_weight_limit : resp_t.block_size_limit; m_get_info_time = now; } return boost::optional(); @@ -123,12 +124,12 @@ boost::optional NodeRPCProxy::get_target_height(uint64_t &height) c return boost::optional(); } -boost::optional NodeRPCProxy::get_block_size_limit(uint64_t &block_size_limit) const +boost::optional NodeRPCProxy::get_block_weight_limit(uint64_t &block_weight_limit) const { auto res = get_info(); if (res) return res; - block_size_limit = m_block_size_limit; + block_weight_limit = m_block_weight_limit; return boost::optional(); } @@ -153,7 +154,7 @@ boost::optional NodeRPCProxy::get_earliest_height(uint8_t version, return boost::optional(); } -boost::optional NodeRPCProxy::get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks, uint64_t &fee) const +boost::optional NodeRPCProxy::get_dynamic_base_fee_estimate(uint64_t grace_blocks, uint64_t &fee) const { uint64_t height; @@ -161,10 +162,10 @@ boost::optional NodeRPCProxy::get_dynamic_per_kb_fee_estimate(uint6 if (result) return result; - if (m_dynamic_per_kb_fee_estimate_cached_height != height || m_dynamic_per_kb_fee_estimate_grace_blocks != grace_blocks) + if (m_dynamic_base_fee_estimate_cached_height != height || m_dynamic_base_fee_estimate_grace_blocks != grace_blocks) { - cryptonote::COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::request req_t = AUTO_VAL_INIT(req_t); - cryptonote::COMMAND_RPC_GET_PER_KB_FEE_ESTIMATE::response resp_t = AUTO_VAL_INIT(resp_t); + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::request req_t = AUTO_VAL_INIT(req_t); + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::response resp_t = AUTO_VAL_INIT(resp_t); m_daemon_rpc_mutex.lock(); req_t.grace_blocks = grace_blocks; @@ -173,12 +174,47 @@ boost::optional NodeRPCProxy::get_dynamic_per_kb_fee_estimate(uint6 CHECK_AND_ASSERT_MES(r, std::string(), "Failed to connect to daemon"); CHECK_AND_ASSERT_MES(resp_t.status != CORE_RPC_STATUS_BUSY, resp_t.status, "Failed to connect to daemon"); CHECK_AND_ASSERT_MES(resp_t.status == CORE_RPC_STATUS_OK, resp_t.status, "Failed to get fee estimate"); - m_dynamic_per_kb_fee_estimate = resp_t.fee; - m_dynamic_per_kb_fee_estimate_cached_height = height; - m_dynamic_per_kb_fee_estimate_grace_blocks = grace_blocks; + m_dynamic_base_fee_estimate = resp_t.fee; + m_dynamic_base_fee_estimate_cached_height = height; + m_dynamic_base_fee_estimate_grace_blocks = grace_blocks; + m_fee_quantization_mask = resp_t.quantization_mask; } - fee = m_dynamic_per_kb_fee_estimate; + fee = m_dynamic_base_fee_estimate; + return boost::optional(); +} + +boost::optional NodeRPCProxy::get_fee_quantization_mask(uint64_t &fee_quantization_mask) const +{ + uint64_t height; + + boost::optional result = get_height(height); + if (result) + return result; + + if (m_dynamic_base_fee_estimate_cached_height != height) + { + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::request req_t = AUTO_VAL_INIT(req_t); + cryptonote::COMMAND_RPC_GET_BASE_FEE_ESTIMATE::response resp_t = AUTO_VAL_INIT(resp_t); + + m_daemon_rpc_mutex.lock(); + req_t.grace_blocks = m_dynamic_base_fee_estimate_grace_blocks; + bool r = net_utils::invoke_http_json_rpc("/json_rpc", "get_fee_estimate", req_t, resp_t, m_http_client, rpc_timeout); + m_daemon_rpc_mutex.unlock(); + CHECK_AND_ASSERT_MES(r, std::string(), "Failed to connect to daemon"); + CHECK_AND_ASSERT_MES(resp_t.status != CORE_RPC_STATUS_BUSY, resp_t.status, "Failed to connect to daemon"); + CHECK_AND_ASSERT_MES(resp_t.status == CORE_RPC_STATUS_OK, resp_t.status, "Failed to get fee estimate"); + m_dynamic_base_fee_estimate = resp_t.fee; + m_dynamic_base_fee_estimate_cached_height = height; + m_fee_quantization_mask = resp_t.quantization_mask; + } + + fee_quantization_mask = m_fee_quantization_mask; + if (fee_quantization_mask == 0) + { + MERROR("Fee quantization mask is 0, forcing to 1"); + fee_quantization_mask = 1; + } return boost::optional(); } diff --git a/src/wallet/node_rpc_proxy.h b/src/wallet/node_rpc_proxy.h index 8a65884f7..65f13eaaa 100644 --- a/src/wallet/node_rpc_proxy.h +++ b/src/wallet/node_rpc_proxy.h @@ -47,9 +47,10 @@ public: boost::optional get_height(uint64_t &height) const; void set_height(uint64_t h); boost::optional get_target_height(uint64_t &height) const; - boost::optional get_block_size_limit(uint64_t &block_size_limit) const; + boost::optional get_block_weight_limit(uint64_t &block_weight_limit) const; boost::optional get_earliest_height(uint8_t version, uint64_t &earliest_height) const; - boost::optional get_dynamic_per_kb_fee_estimate(uint64_t grace_blocks, uint64_t &fee) const; + boost::optional get_dynamic_base_fee_estimate(uint64_t grace_blocks, uint64_t &fee) const; + boost::optional get_fee_quantization_mask(uint64_t &fee_quantization_mask) const; private: boost::optional get_info() const; @@ -59,12 +60,13 @@ private: mutable uint64_t m_height; mutable uint64_t m_earliest_height[256]; - mutable uint64_t m_dynamic_per_kb_fee_estimate; - mutable uint64_t m_dynamic_per_kb_fee_estimate_cached_height; - mutable uint64_t m_dynamic_per_kb_fee_estimate_grace_blocks; + mutable uint64_t m_dynamic_base_fee_estimate; + mutable uint64_t m_dynamic_base_fee_estimate_cached_height; + mutable uint64_t m_dynamic_base_fee_estimate_grace_blocks; + mutable uint64_t m_fee_quantization_mask; mutable uint32_t m_rpc_version; mutable uint64_t m_target_height; - mutable uint64_t m_block_size_limit; + mutable uint64_t m_block_weight_limit; mutable time_t m_get_info_time; }; diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp index 37340e22b..6c0aec4a4 100644 --- a/src/wallet/wallet2.cpp +++ b/src/wallet/wallet2.cpp @@ -84,8 +84,8 @@ using namespace cryptonote; // used to choose when to stop adding outputs to a tx #define APPROXIMATE_INPUT_BYTES 80 -// used to target a given block size (additional outputs may be added on top to build fee) -#define TX_SIZE_TARGET(bytes) (bytes*2/3) +// used to target a given block weight (additional outputs may be added on top to build fee) +#define TX_WEIGHT_TARGET(bytes) (bytes*2/3) // arbitrary, used to generate different hashes from the same input #define CHACHA8_KEY_TAIL 0x8c @@ -183,19 +183,21 @@ uint64_t calculate_fee(uint64_t fee_per_kb, size_t bytes, uint64_t fee_multiplie return kB * fee_per_kb * fee_multiplier; } -uint64_t calculate_fee(uint64_t fee_per_kb, const cryptonote::blobdata &blob, uint64_t fee_multiplier) +uint64_t calculate_fee_from_weight(uint64_t base_fee, uint64_t weight, uint64_t fee_multiplier, uint64_t fee_quantization_mask) { - return calculate_fee(fee_per_kb, blob.size(), fee_multiplier); + uint64_t fee = weight * base_fee * fee_multiplier; + fee = (fee + fee_quantization_mask - 1) / fee_quantization_mask * fee_quantization_mask; + return fee; } -std::string get_size_string(size_t sz) +std::string get_weight_string(size_t weight) { - return std::to_string(sz) + " bytes (" + std::to_string((sz + 1023) / 1024) + " kB)"; + return std::to_string(weight) + " weight"; } -std::string get_size_string(const cryptonote::blobdata &tx) +std::string get_weight_string(const cryptonote::transaction &tx, size_t blob_size) { - return get_size_string(tx.size()); + return get_weight_string(get_transaction_weight(tx, blob_size)); } std::unique_ptr make_basic(const boost::program_options::variables_map& vm, bool rpc, const options& opts, const std::function(const char *, bool)> &password_prompter) @@ -576,7 +578,12 @@ size_t estimate_rct_tx_size(int n_inputs, int mixin, int n_outputs, size_t extra // rangeSigs if (bulletproof) - size += ((2*6 + 4 + 5)*32 + 3) * n_outputs; + { + size_t log_padded_outputs = 0; + while ((1< 2) + { + const uint64_t bp_base = 368; + size_t log_padded_outputs = 2; + while ((1< wallet2::make_dummy(const boost::program_options::varia } //---------------------------------------------------------------------------------------------------- -bool wallet2::init(bool rpc, std::string daemon_address, boost::optional daemon_login, uint64_t upper_transaction_size_limit, bool ssl, bool trusted_daemon) +bool wallet2::init(bool rpc, std::string daemon_address, boost::optional daemon_login, uint64_t upper_transaction_weight_limit, bool ssl, bool trusted_daemon) { m_rpc = rpc; m_checkpoints.init_default_checkpoints(m_nettype); if(m_http_client.is_connected()) m_http_client.disconnect(); m_is_initialized = true; - m_upper_transaction_size_limit = upper_transaction_size_limit; + m_upper_transaction_weight_limit = upper_transaction_weight_limit; m_daemon_address = std::move(daemon_address); m_daemon_login = std::move(daemon_login); m_trusted_daemon = trusted_daemon; @@ -5273,7 +5320,7 @@ bool wallet2::sign_tx(unsigned_tx_set &exported_txs, std::vector 1) - range_proof_type = rct::RangeProofMultiOutputBulletproof; + range_proof_type = rct::RangeProofPaddedBulletproof; } crypto::secret_key tx_key; std::vector additional_tx_keys; @@ -5697,7 +5744,7 @@ bool wallet2::sign_multisig_tx(multisig_tx_set &exported_txs, std::vector 1) - range_proof_type = rct::RangeProofMultiOutputBulletproof; + range_proof_type = rct::RangeProofPaddedBulletproof; } bool r = cryptonote::construct_tx_with_tx_key(m_account.get_keys(), m_subaddresses, sources, sd.splitted_dsts, ptx.change_dts.addr, sd.extra, tx, sd.unlock_time, ptx.tx_key, ptx.additional_tx_keys, sd.use_rct, range_proof_type, &msout, false); THROW_WALLET_EXCEPTION_IF(!r, error::tx_not_constructed, sd.sources, sd.splitted_dsts, sd.unlock_time, m_nettype); @@ -5799,9 +5846,18 @@ bool wallet2::sign_multisig_tx_from_file(const std::string &filename, std::vecto //---------------------------------------------------------------------------------------------------- uint64_t wallet2::get_fee_multiplier(uint32_t priority, int fee_algorithm) const { - static const uint64_t old_multipliers[3] = {1, 2, 3}; - static const uint64_t new_multipliers[3] = {1, 20, 166}; - static const uint64_t newer_multipliers[4] = {1, 4, 20, 166}; + static const struct + { + size_t count; + uint64_t multipliers[4]; + } + multipliers[] = + { + { 3, {1, 2, 3} }, + { 3, {1, 20, 166} }, + { 4, {1, 4, 20, 166} }, + { 4, {1, 5, 25, 1000} }, + }; if (fee_algorithm == -1) fee_algorithm = get_fee_algorithm(); @@ -5817,47 +5873,68 @@ uint64_t wallet2::get_fee_multiplier(uint32_t priority, int fee_algorithm) const priority = 1; } + THROW_WALLET_EXCEPTION_IF(fee_algorithm < 0 || fee_algorithm > 3, error::invalid_priority); + // 1 to 3/4 are allowed as priorities - uint32_t max_priority = (fee_algorithm >= 2) ? 4 : 3; + const uint32_t max_priority = multipliers[fee_algorithm].count; if (priority >= 1 && priority <= max_priority) { - switch (fee_algorithm) - { - case 0: return old_multipliers[priority-1]; - case 1: return new_multipliers[priority-1]; - case 2: return newer_multipliers[priority-1]; - default: THROW_WALLET_EXCEPTION_IF (true, error::invalid_priority); - } + return multipliers[fee_algorithm].multipliers[priority-1]; } THROW_WALLET_EXCEPTION_IF (false, error::invalid_priority); return 1; } //---------------------------------------------------------------------------------------------------- -uint64_t wallet2::get_dynamic_per_kb_fee_estimate() const +uint64_t wallet2::get_dynamic_base_fee_estimate() const { uint64_t fee; - boost::optional result = m_node_rpc_proxy.get_dynamic_per_kb_fee_estimate(FEE_ESTIMATE_GRACE_BLOCKS, fee); + boost::optional result = m_node_rpc_proxy.get_dynamic_base_fee_estimate(FEE_ESTIMATE_GRACE_BLOCKS, fee); if (!result) return fee; - LOG_PRINT_L1("Failed to query per kB fee, using " << print_money(FEE_PER_KB)); - return FEE_PER_KB; + const uint64_t base_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE) ? FEE_PER_BYTE : FEE_PER_KB; + LOG_PRINT_L1("Failed to query base fee, using " << print_money(base_fee)); + return base_fee; } //---------------------------------------------------------------------------------------------------- -uint64_t wallet2::get_per_kb_fee() const +uint64_t wallet2::get_base_fee() const { if(m_light_wallet) - return m_light_wallet_per_kb_fee; + { + if (use_fork_rules(HF_VERSION_PER_BYTE_FEE)) + return m_light_wallet_per_kb_fee / 1024; + else + return m_light_wallet_per_kb_fee; + } bool use_dyn_fee = use_fork_rules(HF_VERSION_DYNAMIC_FEE, -720 * 1); if (!use_dyn_fee) return FEE_PER_KB; - return get_dynamic_per_kb_fee_estimate(); + return get_dynamic_base_fee_estimate(); +} +//---------------------------------------------------------------------------------------------------- +uint64_t wallet2::get_fee_quantization_mask() const +{ + if(m_light_wallet) + { + return 1; // TODO + } + bool use_per_byte_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE, 0); + if (!use_per_byte_fee) + return 1; + + uint64_t fee_quantization_mask; + boost::optional result = m_node_rpc_proxy.get_fee_quantization_mask(fee_quantization_mask); + if (result) + return 1; + return fee_quantization_mask; } //---------------------------------------------------------------------------------------------------- int wallet2::get_fee_algorithm() const { - // changes at v3 and v5 + // changes at v3, v5, v8 + if (use_fork_rules(HF_VERSION_PER_BYTE_FEE, 0)) + return 3; if (use_fork_rules(5, 0)) return 2; if (use_fork_rules(3, -720 * 14)) @@ -5865,19 +5942,39 @@ int wallet2::get_fee_algorithm() const return 0; } //------------------------------------------------------------------------------------------------------------------------------ +uint64_t wallet2::get_min_ring_size() const +{ + if (use_fork_rules(8, 10)) + return 11; + if (use_fork_rules(7, 10)) + return 7; + if (use_fork_rules(6, 10)) + return 5; + if (use_fork_rules(2, 10)) + return 3; + return 0; +} +//------------------------------------------------------------------------------------------------------------------------------ +uint64_t wallet2::get_max_ring_size() const +{ + if (use_fork_rules(8, 10)) + return 11; + return 0; +} +//------------------------------------------------------------------------------------------------------------------------------ uint64_t wallet2::adjust_mixin(uint64_t mixin) const { - if (mixin < 6 && use_fork_rules(7, 10)) { - MWARNING("Requested ring size " << (mixin + 1) << " too low for hard fork 7, using 7"); - mixin = 6; + const uint64_t min_ring_size = get_min_ring_size(); + if (mixin + 1 < min_ring_size) + { + MWARNING("Requested ring size " << (mixin + 1) << " too low, using " << min_ring_size); + mixin = min_ring_size-1; } - else if (mixin < 4 && use_fork_rules(6, 10)) { - MWARNING("Requested ring size " << (mixin + 1) << " too low for hard fork 6, using 5"); - mixin = 4; - } - else if (mixin < 2 && use_fork_rules(2, 10)) { - MWARNING("Requested ring size " << (mixin + 1) << " too low for hard fork 2, using 3"); - mixin = 2; + const uint64_t max_ring_size = get_max_ring_size(); + if (max_ring_size && mixin + 1 > max_ring_size) + { + MWARNING("Requested ring size " << (mixin + 1) << " too high, using " << max_ring_size); + mixin = max_ring_size-1; } return mixin; } @@ -5889,7 +5986,10 @@ uint32_t wallet2::adjust_priority(uint32_t priority) try { // check if there's a backlog in the tx pool - const double fee_level = get_fee_multiplier(1) * get_per_kb_fee() * (12/(double)13) / (double)1024; + const bool use_per_byte_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE, 0); + const uint64_t base_fee = get_base_fee(); + const uint64_t fee_multiplier = get_fee_multiplier(1); + const double fee_level = fee_multiplier * base_fee * (use_per_byte_fee ? 1 : (12/(double)13 / (double)1024)); const std::vector> blocks = estimate_backlog({std::make_pair(fee_level, fee_level)}); if (blocks.size() != 1) { @@ -5903,10 +6003,10 @@ uint32_t wallet2::adjust_priority(uint32_t priority) } // get the current full reward zone - uint64_t block_size_limit = 0; - const auto result = m_node_rpc_proxy.get_block_size_limit(block_size_limit); + uint64_t block_weight_limit = 0; + const auto result = m_node_rpc_proxy.get_block_weight_limit(block_weight_limit); throw_on_rpc_response_error(result, "get_info"); - const uint64_t full_reward_zone = block_size_limit / 2; + const uint64_t full_reward_zone = block_weight_limit / 2; // get the last N block headers and sum the block sizes const size_t N = 10; @@ -5930,14 +6030,14 @@ uint32_t wallet2::adjust_priority(uint32_t priority) MERROR("Bad blockheaders size"); return priority; } - size_t block_size_sum = 0; + size_t block_weight_sum = 0; for (const cryptonote::block_header_response &i : getbh_res.headers) { - block_size_sum += i.block_size; + block_weight_sum += i.block_weight; } // estimate how 'full' the last N blocks are - const size_t P = 100 * block_size_sum / (N * full_reward_zone); + const size_t P = 100 * block_weight_sum / (N * full_reward_zone); MINFO((boost::format("The last %d blocks fill roughly %d%% of the full reward zone.") % N % P).str()); if (P > 80) { @@ -5963,8 +6063,10 @@ std::vector wallet2::create_transactions(std::vector unused_transfers_indices = select_available_outputs_from_histogram(fake_outs_count + 1, true, true, true); - const uint64_t fee_per_kb = get_per_kb_fee(); + const uint64_t base_fee = get_base_fee(); const uint64_t fee_multiplier = get_fee_multiplier(priority, get_fee_algorithm()); + const bool use_per_byte_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE); + const uint64_t fee_quantization_mask = get_fee_quantization_mask(); // failsafe split attempt counter size_t attempt_count = 0; @@ -5991,13 +6093,12 @@ std::vector wallet2::create_transactions(std::vector(), msout}); @@ -7990,11 +8091,11 @@ std::vector wallet2::create_transactions_2(std::vector dsts; cryptonote::transaction tx; pending_tx ptx; - size_t bytes; + size_t weight; uint64_t needed_fee; std::vector> outs; - TX() : bytes(0), needed_fee(0) {} + TX() : weight(0), needed_fee(0) {} void add(const account_public_address &addr, bool is_subaddress, uint64_t amount, unsigned int original_output_index, bool merge_destinations) { if (merge_destinations) @@ -8022,13 +8123,15 @@ std::vector wallet2::create_transactions_2(std::vector txes; bool adding_fee; // true if new outputs go towards fee, rather than destinations uint64_t needed_fee, available_for_fee = 0; - uint64_t upper_transaction_size_limit = get_upper_transaction_size_limit(); + uint64_t upper_transaction_weight_limit = get_upper_transaction_weight_limit(); + const bool use_per_byte_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE, 0); const bool use_rct = use_fork_rules(4, 0); const bool bulletproof = use_fork_rules(get_bulletproof_fork(), 0); - const rct::RangeProofType range_proof_type = bulletproof ? rct::RangeProofMultiOutputBulletproof : rct::RangeProofBorromean; + const rct::RangeProofType range_proof_type = bulletproof ? rct::RangeProofPaddedBulletproof : rct::RangeProofBorromean; - const uint64_t fee_per_kb = get_per_kb_fee(); + const uint64_t base_fee = get_base_fee(); const uint64_t fee_multiplier = get_fee_multiplier(priority, get_fee_algorithm()); + const uint64_t fee_quantization_mask = get_fee_quantization_mask(); // throw if attempting a transaction with no destinations THROW_WALLET_EXCEPTION_IF(dsts.empty(), error::zero_destination); @@ -8059,7 +8162,7 @@ std::vector wallet2::create_transactions_2(std::vector wallet2::create_transactions_2(std::vector tx_size_two_rings, error::wallet_internal_error, "Estimated tx size with 1 input is larger than with 2 inputs!"); - const size_t tx_size_per_ring = tx_size_two_rings - tx_size_one_ring; - const uint64_t fractional_threshold = (fee_multiplier * fee_per_kb * tx_size_per_ring) / 1024; + const size_t tx_weight_one_ring = estimate_tx_weight(use_rct, 1, fake_outs_count, 2, 0, bulletproof); + const size_t tx_weight_two_rings = estimate_tx_weight(use_rct, 2, fake_outs_count, 2, 0, bulletproof); + THROW_WALLET_EXCEPTION_IF(tx_weight_one_ring > tx_weight_two_rings, error::wallet_internal_error, "Estimated tx weight with 1 input is larger than with 2 inputs!"); + const size_t tx_weight_per_ring = tx_weight_two_rings - tx_weight_one_ring; + const uint64_t fractional_threshold = (fee_multiplier * base_fee * tx_weight_per_ring) / (use_per_byte_fee ? 1 : 1024); // gather all dust and non-dust outputs belonging to specified subaddresses size_t num_nondust_outputs = 0; @@ -8174,7 +8277,7 @@ std::vector wallet2::create_transactions_2(std::vector wallet2::create_transactions_2(std::vector 0) || adding_fee || !preferred_inputs.empty() || should_pick_a_second_output(use_rct, txes.back().selected_transfers.size(), *unused_transfers_indices, *unused_dust_indices)) { TX &tx = txes.back(); - LOG_PRINT_L2("Start of loop with " << unused_transfers_indices->size() << " " << unused_dust_indices->size()); + LOG_PRINT_L2("Start of loop with " << unused_transfers_indices->size() << " " << unused_dust_indices->size() << ", tx.dsts.size() " << tx.dsts.size()); LOG_PRINT_L2("unused_transfers_indices: " << strjoin(*unused_transfers_indices, " ")); LOG_PRINT_L2("unused_dust_indices: " << strjoin(*unused_dust_indices, " ")); LOG_PRINT_L2("dsts size " << dsts.size() << ", first " << (dsts.empty() ? "-" : cryptonote::print_money(dsts[0].amount))); @@ -8279,7 +8382,7 @@ std::vector wallet2::create_transactions_2(std::vector wallet2::create_transactions_2(std::vector 0 && !dsts.empty() && estimate_tx_size(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size(), extra.size(), bulletproof) < TX_SIZE_TARGET(upper_transaction_size_limit)) { + if (available_amount > 0 && !dsts.empty() && estimate_tx_weight(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size()+1, extra.size(), bulletproof) < TX_WEIGHT_TARGET(upper_transaction_weight_limit)) { // we can partially fill that destination LOG_PRINT_L2("We can partially pay " << get_account_address_as_str(m_nettype, dsts[0].is_subaddress, dsts[0].addr) << " for " << print_money(available_amount) << "/" << print_money(dsts[0].amount)); @@ -8303,7 +8406,7 @@ std::vector wallet2::create_transactions_2(std::vector wallet2::create_transactions_2(std::vector= TX_SIZE_TARGET(upper_transaction_size_limit)); + const size_t estimated_rct_tx_weight = estimate_tx_weight(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size()+1, extra.size(), bulletproof); + try_tx = dsts.empty() || (estimated_rct_tx_weight >= TX_WEIGHT_TARGET(upper_transaction_weight_limit)); } } @@ -8324,8 +8427,7 @@ std::vector wallet2::create_transactions_2(std::vector wallet2::create_transactions_2(std::vector available_for_fee && !dsts.empty() && dsts[0].amount > 0) @@ -8390,17 +8492,17 @@ std::vector wallet2::create_transactions_2(std::vector ptx_vector; @@ -8486,7 +8588,7 @@ skip_tx: for (size_t idx: tx.selected_transfers) tx_money += m_transfers[idx].amount(); LOG_PRINT_L1(" Transaction " << (1+std::distance(txes.begin(), i)) << "/" << txes.size() << - " " << get_transaction_hash(tx.ptx.tx) << ": " << get_size_string(tx.bytes) << ", sending " << print_money(tx_money) << " in " << tx.selected_transfers.size() << + " " << get_transaction_hash(tx.ptx.tx) << ": " << get_weight_string(tx.weight) << ", sending " << print_money(tx_money) << " in " << tx.selected_transfers.size() << " outputs to " << tx.dsts.size() << " destination(s), including " << print_money(tx.ptx.fee) << " fee, " << print_money(tx.ptx.change_dts.amount) << " change"); ptx_vector.push_back(tx.ptx); @@ -8584,22 +8686,24 @@ std::vector wallet2::create_transactions_from(const crypton std::vector dsts; cryptonote::transaction tx; pending_tx ptx; - size_t bytes; + size_t weight; uint64_t needed_fee; std::vector> outs; - TX() : bytes(0), needed_fee(0) {} + TX() : weight(0), needed_fee(0) {} }; std::vector txes; uint64_t needed_fee, available_for_fee = 0; - uint64_t upper_transaction_size_limit = get_upper_transaction_size_limit(); + uint64_t upper_transaction_weight_limit = get_upper_transaction_weight_limit(); std::vector> outs; + const bool use_per_byte_fee = use_fork_rules(HF_VERSION_PER_BYTE_FEE); const bool use_rct = fake_outs_count > 0 && use_fork_rules(4, 0); const bool bulletproof = use_fork_rules(get_bulletproof_fork(), 0); - const rct::RangeProofType range_proof_type = bulletproof ? rct::RangeProofBulletproof : rct::RangeProofBorromean; - const uint64_t fee_per_kb = get_per_kb_fee(); + const rct::RangeProofType range_proof_type = bulletproof ? rct::RangeProofPaddedBulletproof : rct::RangeProofBorromean; + const uint64_t base_fee = get_base_fee(); const uint64_t fee_multiplier = get_fee_multiplier(priority, get_fee_algorithm()); + const uint64_t fee_quantization_mask = get_fee_quantization_mask(); LOG_PRINT_L2("Starting with " << unused_transfers_indices.size() << " non-dust outputs and " << unused_dust_indices.size() << " dust outputs"); @@ -8621,7 +8725,25 @@ std::vector wallet2::create_transactions_from(const crypton // get a random unspent output and use it to pay next chunk. We try to alternate // dust and non dust to ensure we never get with only dust, from which we might // get a tx that can't pay for itself - size_t idx = unused_transfers_indices.empty() ? pop_best_value(unused_dust_indices, tx.selected_transfers) : unused_dust_indices.empty() ? pop_best_value(unused_transfers_indices, tx.selected_transfers) : ((tx.selected_transfers.size() & 1) || accumulated_outputs > fee_per_kb * fee_multiplier * (upper_transaction_size_limit + 1023) / 1024) ? pop_best_value(unused_dust_indices, tx.selected_transfers) : pop_best_value(unused_transfers_indices, tx.selected_transfers); + uint64_t fee_dust_threshold; + if (use_fork_rules(HF_VERSION_PER_BYTE_FEE)) + { + const uint64_t estimated_tx_weight_with_one_extra_output = estimate_tx_weight(use_rct, tx.selected_transfers.size() + 1, fake_outs_count, tx.dsts.size()+1, extra.size(), bulletproof); + fee_dust_threshold = calculate_fee_from_weight(base_fee, estimated_tx_weight_with_one_extra_output, fee_multiplier, fee_quantization_mask); + } + else + { + fee_dust_threshold = base_fee * fee_multiplier * (upper_transaction_weight_limit + 1023) / 1024; + } + + size_t idx = + unused_transfers_indices.empty() + ? pop_best_value(unused_dust_indices, tx.selected_transfers) + : unused_dust_indices.empty() + ? pop_best_value(unused_transfers_indices, tx.selected_transfers) + : ((tx.selected_transfers.size() & 1) || accumulated_outputs > fee_dust_threshold) + ? pop_best_value(unused_dust_indices, tx.selected_transfers) + : pop_best_value(unused_transfers_indices, tx.selected_transfers); const transfer_details &td = m_transfers[idx]; LOG_PRINT_L2("Picking output " << idx << ", amount " << print_money(td.amount())); @@ -8636,16 +8758,15 @@ std::vector wallet2::create_transactions_from(const crypton // here, check if we need to sent tx and start a new one LOG_PRINT_L2("Considering whether to create a tx now, " << tx.selected_transfers.size() << " inputs, tx limit " - << upper_transaction_size_limit); - const size_t estimated_rct_tx_size = estimate_tx_size(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size() + 1, extra.size(), bulletproof); - bool try_tx = (unused_dust_indices.empty() && unused_transfers_indices.empty()) || ( estimated_rct_tx_size >= TX_SIZE_TARGET(upper_transaction_size_limit)); + << upper_transaction_weight_limit); + const size_t estimated_rct_tx_weight = estimate_tx_weight(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size() + 2, extra.size(), bulletproof); + bool try_tx = (unused_dust_indices.empty() && unused_transfers_indices.empty()) || ( estimated_rct_tx_weight >= TX_WEIGHT_TARGET(upper_transaction_weight_limit)); if (try_tx) { cryptonote::transaction test_tx; pending_tx test_ptx; - const size_t estimated_tx_size = estimate_tx_size(use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size(), extra.size(), bulletproof); - needed_fee = calculate_fee(fee_per_kb, estimated_tx_size, fee_multiplier); + needed_fee = estimate_fee(use_per_byte_fee, use_rct, tx.selected_transfers.size(), fake_outs_count, tx.dsts.size()+1, extra.size(), bulletproof, base_fee, fee_multiplier, fee_quantization_mask); tx.dsts.push_back(tx_destination_entry(1, address, is_subaddress)); @@ -8658,9 +8779,9 @@ std::vector wallet2::create_transactions_from(const crypton transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); auto txBlob = t_serializable_object_to_blob(test_ptx.tx); - needed_fee = calculate_fee(fee_per_kb, txBlob, fee_multiplier); + needed_fee = calculate_fee(use_per_byte_fee, test_ptx.tx, txBlob.size(), base_fee, fee_multiplier, fee_quantization_mask); available_for_fee = test_ptx.fee + test_ptx.dests[0].amount + test_ptx.change_dts.amount; - LOG_PRINT_L2("Made a " << get_size_string(txBlob) << " tx, with " << print_money(available_for_fee) << " available for fee (" << + LOG_PRINT_L2("Made a " << get_weight_string(test_ptx.tx, txBlob.size()) << " tx, with " << print_money(available_for_fee) << " available for fee (" << print_money(needed_fee) << " needed)"); THROW_WALLET_EXCEPTION_IF(needed_fee > available_for_fee, error::wallet_internal_error, "Transaction cannot pay for itself"); @@ -8675,17 +8796,17 @@ std::vector wallet2::create_transactions_from(const crypton transfer_selected(tx.dsts, tx.selected_transfers, fake_outs_count, outs, unlock_time, needed_fee, extra, detail::digit_split_strategy, tx_dust_policy(::config::DEFAULT_DUST_THRESHOLD), test_tx, test_ptx); txBlob = t_serializable_object_to_blob(test_ptx.tx); - needed_fee = calculate_fee(fee_per_kb, txBlob, fee_multiplier); - LOG_PRINT_L2("Made an attempt at a final " << get_size_string(txBlob) << " tx, with " << print_money(test_ptx.fee) << + needed_fee = calculate_fee(use_per_byte_fee, test_ptx.tx, txBlob.size(), base_fee, fee_multiplier, fee_quantization_mask); + LOG_PRINT_L2("Made an attempt at a final " << get_weight_string(test_ptx.tx, txBlob.size()) << " tx, with " << print_money(test_ptx.fee) << " fee and " << print_money(test_ptx.change_dts.amount) << " change"); } while (needed_fee > test_ptx.fee); - LOG_PRINT_L2("Made a final " << get_size_string(txBlob) << " tx, with " << print_money(test_ptx.fee) << + LOG_PRINT_L2("Made a final " << get_weight_string(test_ptx.tx, txBlob.size()) << " tx, with " << print_money(test_ptx.fee) << " fee and " << print_money(test_ptx.change_dts.amount) << " change"); tx.tx = test_tx; tx.ptx = test_ptx; - tx.bytes = txBlob.size(); + tx.weight = get_transaction_weight(test_tx, txBlob.size()); tx.outs = outs; tx.needed_fee = needed_fee; accumulated_fee += test_ptx.fee; @@ -8717,7 +8838,7 @@ std::vector wallet2::create_transactions_from(const crypton auto txBlob = t_serializable_object_to_blob(test_ptx.tx); tx.tx = test_tx; tx.ptx = test_ptx; - tx.bytes = txBlob.size(); + tx.weight = get_transaction_weight(test_tx, txBlob.size()); } std::vector ptx_vector; @@ -8728,7 +8849,7 @@ std::vector wallet2::create_transactions_from(const crypton for (size_t idx: tx.selected_transfers) tx_money += m_transfers[idx].amount(); LOG_PRINT_L1(" Transaction " << (1+std::distance(txes.begin(), i)) << "/" << txes.size() << - " " << get_transaction_hash(tx.ptx.tx) << ": " << get_size_string(tx.bytes) << ", sending " << print_money(tx_money) << " in " << tx.selected_transfers.size() << + " " << get_transaction_hash(tx.ptx.tx) << ": " << get_weight_string(tx.weight) << ", sending " << print_money(tx_money) << " in " << tx.selected_transfers.size() << " outputs to " << tx.dsts.size() << " destination(s), including " << print_money(tx.ptx.fee) << " fee, " << print_money(tx.ptx.change_dts.amount) << " change"); ptx_vector.push_back(tx.ptx); @@ -8763,12 +8884,15 @@ bool wallet2::use_fork_rules(uint8_t version, int64_t early_blocks) const return close_enough; } //---------------------------------------------------------------------------------------------------- -uint64_t wallet2::get_upper_transaction_size_limit() const +uint64_t wallet2::get_upper_transaction_weight_limit() const { - if (m_upper_transaction_size_limit > 0) - return m_upper_transaction_size_limit; + if (m_upper_transaction_weight_limit > 0) + return m_upper_transaction_weight_limit; uint64_t full_reward_zone = use_fork_rules(5, 10) ? CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V5 : use_fork_rules(2, 10) ? CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 : CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1; - return full_reward_zone - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + if (use_fork_rules(8, 10)) + return full_reward_zone / 2 - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; + else + return full_reward_zone - CRYPTONOTE_COINBASE_BLOB_RESERVED_SIZE; } //---------------------------------------------------------------------------------------------------- std::vector wallet2::select_available_outputs(const std::function &f) const @@ -8874,16 +8998,14 @@ const wallet2::transfer_details &wallet2::get_transfer_details(size_t idx) const //---------------------------------------------------------------------------------------------------- std::vector wallet2::select_available_unmixable_outputs() { - // request all outputs with less than 3 instances - const size_t min_mixin = use_fork_rules(7, 10) ? 6 : use_fork_rules(6, 10) ? 4 : 2; // v6 increases min mixin from 2 to 4, v7 to 6 - return select_available_outputs_from_histogram(min_mixin + 1, false, true, false); + // request all outputs with less instances than the min ring size + return select_available_outputs_from_histogram(get_min_ring_size(), false, true, false); } //---------------------------------------------------------------------------------------------------- std::vector wallet2::select_available_mixable_outputs() { - // request all outputs with at least 3 instances, so we can use mixin 2 with - const size_t min_mixin = use_fork_rules(7, 10) ? 6 : use_fork_rules(6, 10) ? 4 : 2; // v6 increases min mixin from 2 to 4, v7 to 6 - return select_available_outputs_from_histogram(min_mixin + 1, true, true, true); + // request all outputs with at least as many instances as the min ring size + return select_available_outputs_from_histogram(get_min_ring_size(), true, true, true); } //---------------------------------------------------------------------------------------------------- std::vector wallet2::create_unmixable_sweep_transactions() @@ -8892,7 +9014,7 @@ std::vector wallet2::create_unmixable_sweep_transactions() const bool hf1_rules = use_fork_rules(2, 10); // first hard fork has version 2 tx_dust_policy dust_policy(hf1_rules ? 0 : ::config::DEFAULT_DUST_THRESHOLD); - const uint64_t fee_per_kb = get_per_kb_fee(); + const uint64_t base_fee = get_base_fee(); // may throw std::vector unmixable_outputs = select_available_unmixable_outputs(); @@ -8907,7 +9029,7 @@ std::vector wallet2::create_unmixable_sweep_transactions() std::vector unmixable_transfer_outputs, unmixable_dust_outputs; for (auto n: unmixable_outputs) { - if (m_transfers[n].amount() < fee_per_kb) + if (m_transfers[n].amount() < base_fee) unmixable_dust_outputs.push_back(n); else unmixable_transfer_outputs.push_back(n); @@ -11228,46 +11350,46 @@ std::vector> wallet2::estimate_backlog(const std:: THROW_WALLET_EXCEPTION_IF(res.status == CORE_RPC_STATUS_BUSY, error::daemon_busy, "get_txpool_backlog"); THROW_WALLET_EXCEPTION_IF(res.status != CORE_RPC_STATUS_OK, error::get_tx_pool_error); - uint64_t block_size_limit = 0; - const auto result = m_node_rpc_proxy.get_block_size_limit(block_size_limit); + uint64_t block_weight_limit = 0; + const auto result = m_node_rpc_proxy.get_block_weight_limit(block_weight_limit); throw_on_rpc_response_error(result, "get_info"); - uint64_t full_reward_zone = block_size_limit / 2; - THROW_WALLET_EXCEPTION_IF(full_reward_zone == 0, error::wallet_internal_error, "Invalid block size limit from daemon"); + uint64_t full_reward_zone = block_weight_limit / 2; + THROW_WALLET_EXCEPTION_IF(full_reward_zone == 0, error::wallet_internal_error, "Invalid block weight limit from daemon"); std::vector> blocks; for (const auto &fee_level: fee_levels) { const double our_fee_byte_min = fee_level.first; const double our_fee_byte_max = fee_level.second; - uint64_t priority_size_min = 0, priority_size_max = 0; + uint64_t priority_weight_min = 0, priority_weight_max = 0; for (const auto &i: res.backlog) { - if (i.blob_size == 0) + if (i.weight == 0) { - MWARNING("Got 0 sized blob from txpool, ignored"); + MWARNING("Got 0 weight tx from txpool, ignored"); continue; } - double this_fee_byte = i.fee / (double)i.blob_size; + double this_fee_byte = i.fee / (double)i.weight; if (this_fee_byte >= our_fee_byte_min) - priority_size_min += i.blob_size; + priority_weight_min += i.weight; if (this_fee_byte >= our_fee_byte_max) - priority_size_max += i.blob_size; + priority_weight_max += i.weight; } - uint64_t nblocks_min = priority_size_min / full_reward_zone; - uint64_t nblocks_max = priority_size_max / full_reward_zone; - MDEBUG("estimate_backlog: priority_size " << priority_size_min << " - " << priority_size_max << " for " + uint64_t nblocks_min = priority_weight_min / full_reward_zone; + uint64_t nblocks_max = priority_weight_max / full_reward_zone; + MDEBUG("estimate_backlog: priority_weight " << priority_weight_min << " - " << priority_weight_max << " for " << our_fee_byte_min << " - " << our_fee_byte_max << " piconero byte fee, " - << nblocks_min << " - " << nblocks_max << " blocks at block size " << full_reward_zone); + << nblocks_min << " - " << nblocks_max << " blocks at block weight " << full_reward_zone); blocks.push_back(std::make_pair(nblocks_min, nblocks_max)); } return blocks; } //---------------------------------------------------------------------------------------------------- -std::vector> wallet2::estimate_backlog(uint64_t min_blob_size, uint64_t max_blob_size, const std::vector &fees) +std::vector> wallet2::estimate_backlog(uint64_t min_tx_weight, uint64_t max_tx_weight, const std::vector &fees) { - THROW_WALLET_EXCEPTION_IF(min_blob_size == 0, error::wallet_internal_error, "Invalid 0 fee"); - THROW_WALLET_EXCEPTION_IF(max_blob_size == 0, error::wallet_internal_error, "Invalid 0 fee"); + THROW_WALLET_EXCEPTION_IF(min_tx_weight == 0, error::wallet_internal_error, "Invalid 0 fee"); + THROW_WALLET_EXCEPTION_IF(max_tx_weight == 0, error::wallet_internal_error, "Invalid 0 fee"); for (uint64_t fee: fees) { THROW_WALLET_EXCEPTION_IF(fee == 0, error::wallet_internal_error, "Invalid 0 fee"); @@ -11275,7 +11397,7 @@ std::vector> wallet2::estimate_backlog(uint64_t mi std::vector> fee_levels; for (uint64_t fee: fees) { - double our_fee_byte_min = fee / (double)min_blob_size, our_fee_byte_max = fee / (double)max_blob_size; + double our_fee_byte_min = fee / (double)min_tx_weight, our_fee_byte_max = fee / (double)max_tx_weight; fee_levels.emplace_back(our_fee_byte_min, our_fee_byte_max); } return estimate_backlog(fee_levels); diff --git a/src/wallet/wallet2.h b/src/wallet/wallet2.h index 3ba51a27c..f9b516bff 100644 --- a/src/wallet/wallet2.h +++ b/src/wallet/wallet2.h @@ -630,14 +630,9 @@ namespace tools void explicit_refresh_from_block_height(bool expl) {m_explicit_refresh_from_block_height = expl;} bool explicit_refresh_from_block_height() const {return m_explicit_refresh_from_block_height;} - // upper_transaction_size_limit as defined below is set to - // approximately 125% of the fixed minimum allowable penalty - // free block size. TODO: fix this so that it actually takes - // into account the current median block size rather than - // the minimum block size. bool deinit(); bool init(bool rpc, std::string daemon_address = "http://localhost:8080", - boost::optional daemon_login = boost::none, uint64_t upper_transaction_size_limit = 0, bool ssl = false, bool trusted_daemon = false); + boost::optional daemon_login = boost::none, uint64_t upper_transaction_weight_limit = 0, bool ssl = false, bool trusted_daemon = false); void stop() { m_run.store(false, std::memory_order_relaxed); } @@ -1084,10 +1079,13 @@ namespace tools bool is_synced() const; std::vector> estimate_backlog(const std::vector> &fee_levels); - std::vector> estimate_backlog(uint64_t min_blob_size, uint64_t max_blob_size, const std::vector &fees); + std::vector> estimate_backlog(uint64_t min_tx_weight, uint64_t max_tx_weight, const std::vector &fees); uint64_t get_fee_multiplier(uint32_t priority, int fee_algorithm = -1) const; - uint64_t get_per_kb_fee() const; + uint64_t get_base_fee() const; + uint64_t get_fee_quantization_mask() const; + uint64_t get_min_ring_size() const; + uint64_t get_max_ring_size() const; uint64_t adjust_mixin(uint64_t mixin) const; uint32_t adjust_priority(uint32_t priority); @@ -1212,9 +1210,9 @@ namespace tools void check_acc_out_precomp(const cryptonote::tx_out &o, const crypto::key_derivation &derivation, const std::vector &additional_derivations, size_t i, const is_out_data *is_out_data, tx_scan_info_t &tx_scan_info) const; void check_acc_out_precomp_once(const cryptonote::tx_out &o, const crypto::key_derivation &derivation, const std::vector &additional_derivations, size_t i, const is_out_data *is_out_data, tx_scan_info_t &tx_scan_info, bool &already_seen) const; void parse_block_round(const cryptonote::blobdata &blob, cryptonote::block &bl, crypto::hash &bl_id, bool &error) const; - uint64_t get_upper_transaction_size_limit() const; + uint64_t get_upper_transaction_weight_limit() const; std::vector get_unspent_amounts_vector() const; - uint64_t get_dynamic_per_kb_fee_estimate() const; + uint64_t get_dynamic_base_fee_estimate() const; float get_output_relatedness(const transfer_details &td0, const transfer_details &td1) const; std::vector pick_preferred_rct_inputs(uint64_t needed_money, uint32_t subaddr_account, const std::set &subaddr_indices) const; void set_spent(size_t idx, uint64_t height); @@ -1269,7 +1267,7 @@ namespace tools std::unordered_map m_attributes; std::vector m_address_book; std::pair, std::vector> m_account_tags; - uint64_t m_upper_transaction_size_limit; //TODO: auto-calc this value or request from daemon, now use some fixed value + uint64_t m_upper_transaction_weight_limit; //TODO: auto-calc this value or request from daemon, now use some fixed value const std::vector> *m_multisig_rescan_info; const std::vector> *m_multisig_rescan_k; @@ -1838,7 +1836,7 @@ namespace tools THROW_WALLET_EXCEPTION_IF(m_multisig, error::wallet_internal_error, "Multisig wallets cannot spend non rct outputs"); - uint64_t upper_transaction_size_limit = get_upper_transaction_size_limit(); + uint64_t upper_transaction_weight_limit = get_upper_transaction_weight_limit(); uint64_t needed_money = fee; // calculate total amount being sent to all destinations @@ -1970,7 +1968,7 @@ namespace tools rct::multisig_out msout; bool r = cryptonote::construct_tx_and_get_tx_key(m_account.get_keys(), m_subaddresses, sources, splitted_dsts, change_dts.addr, extra, tx, unlock_time, tx_key, additional_tx_keys, false, rct::RangeProofBorromean, m_multisig ? &msout : NULL); THROW_WALLET_EXCEPTION_IF(!r, error::tx_not_constructed, sources, splitted_dsts, unlock_time, m_nettype); - THROW_WALLET_EXCEPTION_IF(upper_transaction_size_limit <= get_object_blobsize(tx), error::tx_too_big, tx, upper_transaction_size_limit); + THROW_WALLET_EXCEPTION_IF(upper_transaction_weight_limit <= get_transaction_weight(tx), error::tx_too_big, tx, upper_transaction_weight_limit); std::string key_images; bool all_are_txin_to_key = std::all_of(tx.vin.begin(), tx.vin.end(), [&](const txin_v& s_e) -> bool diff --git a/src/wallet/wallet_errors.h b/src/wallet/wallet_errors.h index 243953280..a30e807b1 100644 --- a/src/wallet/wallet_errors.h +++ b/src/wallet/wallet_errors.h @@ -679,30 +679,30 @@ namespace tools //---------------------------------------------------------------------------------------------------- struct tx_too_big : public transfer_error { - explicit tx_too_big(std::string&& loc, const cryptonote::transaction& tx, uint64_t tx_size_limit) + explicit tx_too_big(std::string&& loc, const cryptonote::transaction& tx, uint64_t tx_weight_limit) : transfer_error(std::move(loc), "transaction is too big") , m_tx(tx) - , m_tx_size_limit(tx_size_limit) + , m_tx_weight_limit(tx_weight_limit) { } const cryptonote::transaction& tx() const { return m_tx; } - uint64_t tx_size_limit() const { return m_tx_size_limit; } + uint64_t tx_weight_limit() const { return m_tx_weight_limit; } std::string to_string() const { std::ostringstream ss; cryptonote::transaction tx = m_tx; ss << transfer_error::to_string() << - ", tx_size_limit = " << m_tx_size_limit << - ", tx size = " << get_object_blobsize(m_tx) << + ", tx_weight_limit = " << m_tx_weight_limit << + ", tx weight = " << get_transaction_weight(m_tx) << ", tx:\n" << cryptonote::obj_to_json_str(tx); return ss.str(); } private: cryptonote::transaction m_tx; - uint64_t m_tx_size_limit; + uint64_t m_tx_weight_limit; }; //---------------------------------------------------------------------------------------------------- struct zero_destination : public transfer_error diff --git a/src/wallet/wallet_rpc_server.cpp b/src/wallet/wallet_rpc_server.cpp index 96ad23e60..a6fe4e244 100644 --- a/src/wallet/wallet_rpc_server.cpp +++ b/src/wallet/wallet_rpc_server.cpp @@ -1542,7 +1542,6 @@ namespace tools rpc_transfers.spent = td.m_spent; rpc_transfers.global_index = td.m_global_output_index; rpc_transfers.tx_hash = epee::string_tools::pod_to_hex(td.m_txid); - rpc_transfers.tx_size = txBlob.size(); rpc_transfers.subaddr_index = td.m_subaddr_index.minor; rpc_transfers.key_image = req.verbose && td.m_key_image_known ? epee::string_tools::pod_to_hex(td.m_key_image) : ""; res.transfers.push_back(rpc_transfers); diff --git a/src/wallet/wallet_rpc_server_commands_defs.h b/src/wallet/wallet_rpc_server_commands_defs.h index 2d0f8c659..ce10e2917 100644 --- a/src/wallet/wallet_rpc_server_commands_defs.h +++ b/src/wallet/wallet_rpc_server_commands_defs.h @@ -865,7 +865,6 @@ namespace wallet_rpc bool spent; uint64_t global_index; std::string tx_hash; - uint64_t tx_size; uint32_t subaddr_index; std::string key_image; @@ -874,7 +873,6 @@ namespace wallet_rpc KV_SERIALIZE(spent) KV_SERIALIZE(global_index) KV_SERIALIZE(tx_hash) - KV_SERIALIZE(tx_size) KV_SERIALIZE(subaddr_index) KV_SERIALIZE(key_image) END_KV_SERIALIZE_MAP() diff --git a/tests/core_tests/block_reward.cpp b/tests/core_tests/block_reward.cpp index 9b0e74911..e55378439 100644 --- a/tests/core_tests/block_reward.cpp +++ b/tests/core_tests/block_reward.cpp @@ -36,24 +36,24 @@ using namespace cryptonote; namespace { - bool construct_miner_tx_by_size(transaction& miner_tx, uint64_t height, uint64_t already_generated_coins, - const account_public_address& miner_address, std::vector& block_sizes, size_t target_tx_size, - size_t target_block_size, uint64_t fee = 0) + bool construct_miner_tx_by_weight(transaction& miner_tx, uint64_t height, uint64_t already_generated_coins, + const account_public_address& miner_address, std::vector& block_weights, size_t target_tx_weight, + size_t target_block_weight, uint64_t fee = 0) { - if (!construct_miner_tx(height, misc_utils::median(block_sizes), already_generated_coins, target_block_size, fee, miner_address, miner_tx)) + if (!construct_miner_tx(height, misc_utils::median(block_weights), already_generated_coins, target_block_weight, fee, miner_address, miner_tx)) return false; - size_t current_size = get_object_blobsize(miner_tx); + size_t current_weight = get_transaction_weight(miner_tx); size_t try_count = 0; - while (target_tx_size != current_size) + while (target_tx_weight != current_weight) { ++try_count; if (10 < try_count) return false; - if (target_tx_size < current_size) + if (target_tx_weight < current_weight) { - size_t diff = current_size - target_tx_size; + size_t diff = current_weight - target_tx_weight; if (diff <= miner_tx.extra.size()) miner_tx.extra.resize(miner_tx.extra.size() - diff); else @@ -61,28 +61,28 @@ namespace } else { - size_t diff = target_tx_size - current_size; + size_t diff = target_tx_weight - current_weight; miner_tx.extra.resize(miner_tx.extra.size() + diff); } - current_size = get_object_blobsize(miner_tx); + current_weight = get_transaction_weight(miner_tx); } return true; } - bool construct_max_size_block(test_generator& generator, block& blk, const block& blk_prev, const account_base& miner_account, + bool construct_max_weight_block(test_generator& generator, block& blk, const block& blk_prev, const account_base& miner_account, size_t median_block_count = CRYPTONOTE_REWARD_BLOCKS_WINDOW) { - std::vector block_sizes; - generator.get_last_n_block_sizes(block_sizes, get_block_hash(blk_prev), median_block_count); + std::vector block_weights; + generator.get_last_n_block_weights(block_weights, get_block_hash(blk_prev), median_block_count); - size_t median = misc_utils::median(block_sizes); + size_t median = misc_utils::median(block_weights); median = std::max(median, static_cast(CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1)); transaction miner_tx; - bool r = construct_miner_tx_by_size(miner_tx, get_block_height(blk_prev) + 1, generator.get_already_generated_coins(blk_prev), - miner_account.get_keys().m_account_address, block_sizes, 2 * median, 2 * median); + bool r = construct_miner_tx_by_weight(miner_tx, get_block_height(blk_prev) + 1, generator.get_already_generated_coins(blk_prev), + miner_account.get_keys().m_account_address, block_weights, 2 * median, 2 * median); if (!r) return false; @@ -97,7 +97,7 @@ namespace for (size_t i = 0; i < block_count; ++i) { block blk_i; - if (!construct_max_size_block(generator, blk_i, blk, miner_account)) + if (!construct_max_weight_block(generator, blk_i, blk, miner_account)) return false; events.push_back(blk_i); @@ -141,18 +141,18 @@ bool gen_block_reward::generate(std::vector& events) const // Test: block reward is calculated using median of the latest CRYPTONOTE_REWARD_BLOCKS_WINDOW blocks DO_CALLBACK(events, "mark_invalid_block"); block blk_1_bad_1; - if (!construct_max_size_block(generator, blk_1_bad_1, blk_0r, miner_account, CRYPTONOTE_REWARD_BLOCKS_WINDOW + 1)) + if (!construct_max_weight_block(generator, blk_1_bad_1, blk_0r, miner_account, CRYPTONOTE_REWARD_BLOCKS_WINDOW + 1)) return false; events.push_back(blk_1_bad_1); DO_CALLBACK(events, "mark_invalid_block"); block blk_1_bad_2; - if (!construct_max_size_block(generator, blk_1_bad_2, blk_0r, miner_account, CRYPTONOTE_REWARD_BLOCKS_WINDOW - 1)) + if (!construct_max_weight_block(generator, blk_1_bad_2, blk_0r, miner_account, CRYPTONOTE_REWARD_BLOCKS_WINDOW - 1)) return false; events.push_back(blk_1_bad_2); block blk_1; - if (!construct_max_size_block(generator, blk_1, blk_0r, miner_account)) + if (!construct_max_weight_block(generator, blk_1, blk_0r, miner_account)) return false; events.push_back(blk_1); @@ -187,16 +187,16 @@ bool gen_block_reward::generate(std::vector& events) const { transaction tx_1 = construct_tx_with_fee(events, blk_5, miner_account, bob_account, MK_COINS(1), 11 * TESTS_DEFAULT_FEE); transaction tx_2 = construct_tx_with_fee(events, blk_5, miner_account, bob_account, MK_COINS(1), 13 * TESTS_DEFAULT_FEE); - size_t txs_1_size = get_object_blobsize(tx_1) + get_object_blobsize(tx_2); + size_t txs_1_weight = get_transaction_weight(tx_1) + get_transaction_weight(tx_2); uint64_t txs_fee = get_tx_fee(tx_1) + get_tx_fee(tx_2); - std::vector block_sizes; - generator.get_last_n_block_sizes(block_sizes, get_block_hash(blk_7), CRYPTONOTE_REWARD_BLOCKS_WINDOW); - size_t median = misc_utils::median(block_sizes); + std::vector block_weights; + generator.get_last_n_block_weights(block_weights, get_block_hash(blk_7), CRYPTONOTE_REWARD_BLOCKS_WINDOW); + size_t median = misc_utils::median(block_weights); transaction miner_tx; - bool r = construct_miner_tx_by_size(miner_tx, get_block_height(blk_7) + 1, generator.get_already_generated_coins(blk_7), - miner_account.get_keys().m_account_address, block_sizes, 2 * median - txs_1_size, 2 * median, txs_fee); + bool r = construct_miner_tx_by_weight(miner_tx, get_block_height(blk_7) + 1, generator.get_already_generated_coins(blk_7), + miner_account.get_keys().m_account_address, block_weights, 2 * median - txs_1_weight, 2 * median, txs_fee); if (!r) return false; @@ -206,7 +206,7 @@ bool gen_block_reward::generate(std::vector& events) const block blk_8; generator.construct_block_manually(blk_8, blk_7, miner_account, test_generator::bf_miner_tx | test_generator::bf_tx_hashes, - 0, 0, 0, crypto::hash(), 0, miner_tx, txs_1_hashes, txs_1_size); + 0, 0, 0, crypto::hash(), 0, miner_tx, txs_1_hashes, txs_1_weight); events.push_back(blk_8); DO_CALLBACK(events, "mark_checked_block"); diff --git a/tests/core_tests/block_validation.cpp b/tests/core_tests/block_validation.cpp index 598cd4098..760cc4328 100644 --- a/tests/core_tests/block_validation.cpp +++ b/tests/core_tests/block_validation.cpp @@ -586,11 +586,11 @@ bool gen_block_invalid_binary_format::generate(std::vector& ev block blk_test; std::vector tx_hashes; tx_hashes.push_back(get_transaction_hash(tx_0)); - size_t txs_size = get_object_blobsize(tx_0); + size_t txs_weight = get_transaction_weight(tx_0); diffic = next_difficulty(timestamps, cummulative_difficulties,DIFFICULTY_TARGET_V1); if (!generator.construct_block_manually(blk_test, blk_last, miner_account, test_generator::bf_diffic | test_generator::bf_timestamp | test_generator::bf_tx_hashes, 0, 0, blk_last.timestamp, - crypto::hash(), diffic, transaction(), tx_hashes, txs_size)) + crypto::hash(), diffic, transaction(), tx_hashes, txs_weight)) return false; blobdata blob = t_serializable_object_to_blob(blk_test); diff --git a/tests/core_tests/bulletproofs.cpp b/tests/core_tests/bulletproofs.cpp index a675b2c59..3b3039a18 100644 --- a/tests/core_tests/bulletproofs.cpp +++ b/tests/core_tests/bulletproofs.cpp @@ -42,7 +42,7 @@ using namespace cryptonote; // Tests bool gen_bp_tx_validation_base::generate_with(std::vector& events, - const int *out_idx, int mixin, size_t n_txes, const uint64_t *amounts_paid, bool valid, const bool *multi_out, + size_t mixin, size_t n_txes, const uint64_t *amounts_paid, bool valid, const rct::RangeProofType *range_proof_type, const std::function &sources, std::vector &destinations, size_t tx_idx)> &pre_tx, const std::function &post_tx) const { @@ -51,11 +51,11 @@ bool gen_bp_tx_validation_base::generate_with(std::vector& eve GENERATE_ACCOUNT(miner_account); MAKE_GENESIS_BLOCK(events, blk_0, miner_account, ts_start); - // create 8 miner accounts, and have them mine the next 8 blocks - cryptonote::account_base miner_accounts[8]; + // create 12 miner accounts, and have them mine the next 12 blocks + cryptonote::account_base miner_accounts[12]; const cryptonote::block *prev_block = &blk_0; - cryptonote::block blocks[8 + CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW]; - for (size_t n = 0; n < 8; ++n) { + cryptonote::block blocks[12 + CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW]; + for (size_t n = 0; n < 12; ++n) { miner_accounts[n].generate(); CHECK_AND_ASSERT_MES(generator.construct_block_manually(blocks[n], *prev_block, miner_accounts[n], test_generator::bf_major_ver | test_generator::bf_minor_ver | test_generator::bf_timestamp | test_generator::bf_hf_version, @@ -70,16 +70,16 @@ bool gen_bp_tx_validation_base::generate_with(std::vector& eve // rewind cryptonote::block blk_r, blk_last; { - blk_last = blocks[7]; + blk_last = blocks[11]; for (size_t i = 0; i < CRYPTONOTE_MINED_MONEY_UNLOCK_WINDOW; ++i) { - CHECK_AND_ASSERT_MES(generator.construct_block_manually(blocks[8+i], blk_last, miner_account, + CHECK_AND_ASSERT_MES(generator.construct_block_manually(blocks[12+i], blk_last, miner_account, test_generator::bf_major_ver | test_generator::bf_minor_ver | test_generator::bf_timestamp | test_generator::bf_hf_version, 2, 2, blk_last.timestamp + DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN * 2, // v2 has blocks twice as long crypto::hash(), 0, transaction(), std::vector(), 0, 0, 2), false, "Failed to generate block"); - events.push_back(blocks[8+i]); - blk_last = blocks[8+i]; + events.push_back(blocks[12+i]); + blk_last = blocks[12+i]; } blk_r = blk_last; } @@ -99,7 +99,7 @@ bool gen_bp_tx_validation_base::generate_with(std::vector& eve const uint64_t needed_amount = input_amounts_available[n]; src.amount = input_amounts_available[n]; size_t real_index_in_tx = 0; - for (size_t m = 0; m < 7; ++m) { + for (size_t m = 0; m <= mixin; ++m) { size_t index_in_tx = 0; for (size_t i = 0; i < blocks[m].miner_tx.vout.size(); ++i) if (blocks[m].miner_tx.vout[i].amount == needed_amount) @@ -136,7 +136,7 @@ bool gen_bp_tx_validation_base::generate_with(std::vector& eve std::unordered_map subaddresses; subaddresses[miner_accounts[n].get_keys().m_account_address.m_spend_public_key] = {0,0}; rct_txes.resize(rct_txes.size() + 1); - bool r = construct_tx_and_get_tx_key(miner_accounts[n].get_keys(), subaddresses, sources, destinations, cryptonote::account_public_address{}, std::vector(), rct_txes.back(), 0, tx_key, additional_tx_keys, true, multi_out[n] ? rct::RangeProofMultiOutputBulletproof : rct::RangeProofBulletproof); + bool r = construct_tx_and_get_tx_key(miner_accounts[n].get_keys(), subaddresses, sources, destinations, cryptonote::account_public_address{}, std::vector(), rct_txes.back(), 0, tx_key, additional_tx_keys, true, range_proof_type[n]); CHECK_AND_ASSERT_MES(r, false, "failed to construct transaction"); if (post_tx && !post_tx(rct_txes.back(), n)) @@ -199,93 +199,100 @@ bool gen_bp_tx_validation_base::check_bp(const cryptonote::transaction &tx, size while (sizes[n_sizes] != (size_t)-1) n_amounts += sizes[n_sizes++]; CHECK_TEST_CONDITION(tx.rct_signatures.p.bulletproofs.size() == n_sizes); - CHECK_TEST_CONDITION(rct::n_bulletproof_amounts(tx.rct_signatures.p.bulletproofs) == n_amounts); + CHECK_TEST_CONDITION(rct::n_bulletproof_max_amounts(tx.rct_signatures.p.bulletproofs) == n_amounts); for (size_t n = 0; n < n_sizes; ++n) - CHECK_TEST_CONDITION(rct::n_bulletproof_amounts(tx.rct_signatures.p.bulletproofs[n]) == sizes[n]); + CHECK_TEST_CONDITION(rct::n_bulletproof_max_amounts(tx.rct_signatures.p.bulletproofs[n]) == sizes[n]); return true; } bool gen_bp_tx_valid_1::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; const size_t bp_sizes[] = {1, (size_t)-1}; - const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1"); }); + const rct::RangeProofType range_proof_type[] = {rct::RangeProofPaddedBulletproof}; + return generate_with(events, mixin, 1, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_1"); }); } bool gen_bp_tx_invalid_1_1::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; - const size_t bp_sizes[] = {1, 1, (size_t)-1}; - const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_invalid_1_1"); }); + const rct::RangeProofType range_proof_type[] = { rct::RangeProofBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, NULL); } bool gen_bp_tx_valid_2::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; const size_t bp_sizes[] = {2, (size_t)-1}; - const bool multi_out[] = {true}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_2"); }); + const rct::RangeProofType range_proof_type[] = {rct::RangeProofPaddedBulletproof}; + return generate_with(events, mixin, 1, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_2"); }); } -bool gen_bp_tx_valid_4_2_1::generate(std::vector& events) const +bool gen_bp_tx_valid_3::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; + const uint64_t amounts_paid[] = {5000, 5000, 5000, (uint64_t)-1}; + const size_t bp_sizes[] = {4, (size_t)-1}; + const rct::RangeProofType range_proof_type[] = { rct::RangeProofPaddedBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_3"); }); +} + +bool gen_bp_tx_valid_16::generate(std::vector& events) const +{ + const size_t mixin = 10; + const uint64_t amounts_paid[] = {500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, (uint64_t)-1}; + const size_t bp_sizes[] = {16, (size_t)-1}; + const rct::RangeProofType range_proof_type[] = { rct::RangeProofPaddedBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_16"); }); +} + +bool gen_bp_tx_invalid_4_2_1::generate(std::vector& events) const +{ + const size_t mixin = 10; const uint64_t amounts_paid[] = {1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; - const size_t bp_sizes[] = {4, 2, 1, (size_t)-1}; - const bool multi_out[] = {true}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_4_2_1"); }); + const rct::RangeProofType range_proof_type[] = { rct::RangeProofMultiOutputBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, NULL); } -bool gen_bp_tx_valid_16_16::generate(std::vector& events) const +bool gen_bp_tx_invalid_16_16::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; - const size_t bp_sizes[] = {16, 16, (size_t)-1}; - const bool multi_out[] = {true}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_tx_valid_16_16"); }); + const rct::RangeProofType range_proof_type[] = { rct::RangeProofMultiOutputBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, NULL); } bool gen_bp_txs_valid_2_and_2::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {1000, 1000, (size_t)-1, 1000, 1000, (uint64_t)-1}; const size_t bp_sizes[] = {2, (size_t)-1, 2, (size_t)-1}; - const bool multi_out[] = {true}; - return generate_with(events, out_idx, mixin, 2, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_2_2"); }); + const rct::RangeProofType range_proof_type[] = { rct::RangeProofPaddedBulletproof, rct::RangeProofPaddedBulletproof}; + return generate_with(events, mixin, 2, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_2_and_2"); }); } -bool gen_bp_txs_valid_2_and_8_2_and_16_16_1::generate(std::vector& events) const +bool gen_bp_txs_invalid_2_and_8_2_and_16_16_1::generate(std::vector& events) const { - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; - const bool multi_out[] = {true, true, true}; - const size_t bp_sizes[] = {2, (size_t)-1, 8, 2, (size_t)-1, 16, 16, 1, (size_t)-1}; - return generate_with(events, out_idx, mixin, 3, amounts_paid, true, multi_out, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx){ return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_1_1_and_8_2_and_16_16_1"); }); + const rct::RangeProofType range_proof_type[] = {rct::RangeProofMultiOutputBulletproof, rct::RangeProofMultiOutputBulletproof, rct::RangeProofMultiOutputBulletproof}; + return generate_with(events, mixin, 3, amounts_paid, false, range_proof_type, NULL, NULL); } bool gen_bp_tx_invalid_not_enough_proofs::generate(std::vector& events) const { DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_not_enough_proofs"); - const int mixin = 6; - const int out_idx[] = {1, -1}; - const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; - const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + const size_t mixin = 10; + const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; + const rct::RangeProofType range_proof_type[] = { rct::RangeProofBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, [&](cryptonote::transaction &tx, size_t idx){ CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); tx.rct_signatures.p.bulletproofs.pop_back(); + CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); return true; }); } @@ -293,11 +300,10 @@ bool gen_bp_tx_invalid_not_enough_proofs::generate(std::vector bool gen_bp_tx_invalid_too_many_proofs::generate(std::vector& events) const { DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_too_many_proofs"); - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; - const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + const rct::RangeProofType range_proof_type[] = { rct::RangeProofBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, [&](cryptonote::transaction &tx, size_t idx){ CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); tx.rct_signatures.p.bulletproofs.push_back(tx.rct_signatures.p.bulletproofs.back()); @@ -308,11 +314,10 @@ bool gen_bp_tx_invalid_too_many_proofs::generate(std::vector& bool gen_bp_tx_invalid_wrong_amount::generate(std::vector& events) const { DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_wrong_amount"); - const int mixin = 6; - const int out_idx[] = {1, -1}; + const size_t mixin = 10; const uint64_t amounts_paid[] = {10000, (uint64_t)-1}; - const bool multi_out[] = {false}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t idx){ + const rct::RangeProofType range_proof_type[] = { rct::RangeProofBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, [&](cryptonote::transaction &tx, size_t idx){ CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); CHECK_TEST_CONDITION(!tx.rct_signatures.p.bulletproofs.empty()); tx.rct_signatures.p.bulletproofs.back() = rct::bulletproof_PROVE(1000, rct::skGen()); @@ -320,20 +325,15 @@ bool gen_bp_tx_invalid_wrong_amount::generate(std::vector& eve }); } -bool gen_bp_tx_invalid_switched::generate(std::vector& events) const +bool gen_bp_tx_invalid_borromean_type::generate(std::vector& events) const { - DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_switched"); - const int mixin = 6; - const int out_idx[] = {1, -1}; - const uint64_t amounts_paid[] = {1001, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, 1000, (uint64_t)-1}; - const bool multi_out[] = {true}; - return generate_with(events, out_idx, mixin, 1, amounts_paid, false, multi_out, NULL, [&](cryptonote::transaction &tx, size_t tx_idx){ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_borromean_type"); + const size_t mixin = 10; + const uint64_t amounts_paid[] = {5000, 5000, (uint64_t)-1}; + const rct::RangeProofType range_proof_type[] = {rct::RangeProofPaddedBulletproof}; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, [&](cryptonote::transaction &tx, size_t tx_idx){ CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); - CHECK_TEST_CONDITION(tx.rct_signatures.p.bulletproofs.size() == 2); - rct::Bulletproof proof = tx.rct_signatures.p.bulletproofs[0]; - tx.rct_signatures.p.bulletproofs[0] = tx.rct_signatures.p.bulletproofs[1]; - tx.rct_signatures.p.bulletproofs[1] = proof; + tx.rct_signatures.type = rct::RCTTypeSimple; return true; }); } - diff --git a/tests/core_tests/bulletproofs.h b/tests/core_tests/bulletproofs.h index d3b65f5bd..13faa3493 100644 --- a/tests/core_tests/bulletproofs.h +++ b/tests/core_tests/bulletproofs.h @@ -81,8 +81,8 @@ struct gen_bp_tx_validation_base : public test_chain_unit_base return true; } - bool generate_with(std::vector& events, const int *out_idx, int mixin, - size_t n_txes, const uint64_t *amounts_paid, bool valid, const bool *multi_out, + bool generate_with(std::vector& events, size_t mixin, + size_t n_txes, const uint64_t *amounts_paid, bool valid, const rct::RangeProofType *range_proof_type, const std::function &sources, std::vector &destinations, size_t)> &pre_tx, const std::function &post_tx) const; @@ -95,7 +95,7 @@ private: template<> struct get_test_options { - const std::pair hard_forks[4] = {std::make_pair(1, 0), std::make_pair(2, 1), std::make_pair(8, 69), std::make_pair(0, 0)}; + const std::pair hard_forks[4] = {std::make_pair(1, 0), std::make_pair(2, 1), std::make_pair(8, 73), std::make_pair(0, 0)}; const cryptonote::test_options test_options = { hard_forks }; @@ -120,17 +120,29 @@ struct gen_bp_tx_valid_2 : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; -struct gen_bp_tx_valid_4_2_1 : public gen_bp_tx_validation_base +struct gen_bp_tx_valid_3 : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; +template<> struct get_test_options: public get_test_options {}; -struct gen_bp_tx_valid_16_16 : public gen_bp_tx_validation_base +struct gen_bp_tx_valid_16 : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_4_2_1 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + +struct gen_bp_tx_invalid_16_16 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; struct gen_bp_txs_valid_2_and_2 : public gen_bp_tx_validation_base { @@ -138,11 +150,11 @@ struct gen_bp_txs_valid_2_and_2 : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; -struct gen_bp_txs_valid_2_and_8_2_and_16_16_1 : public gen_bp_tx_validation_base +struct gen_bp_txs_invalid_2_and_8_2_and_16_16_1 : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; +template<> struct get_test_options: public get_test_options {}; struct gen_bp_tx_invalid_not_enough_proofs : public gen_bp_tx_validation_base { @@ -162,9 +174,8 @@ struct gen_bp_tx_invalid_wrong_amount : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; -struct gen_bp_tx_invalid_switched : public gen_bp_tx_validation_base +struct gen_bp_tx_invalid_borromean_type : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; }; -template<> struct get_test_options: public get_test_options {}; - +template<> struct get_test_options: public get_test_options {}; diff --git a/tests/core_tests/chaingen.cpp b/tests/core_tests/chaingen.cpp index 41256a4f1..d3cb52246 100644 --- a/tests/core_tests/chaingen.cpp +++ b/tests/core_tests/chaingen.cpp @@ -69,13 +69,13 @@ void test_generator::get_block_chain(std::vector& blockchain, const std::reverse(blockchain.begin(), blockchain.end()); } -void test_generator::get_last_n_block_sizes(std::vector& block_sizes, const crypto::hash& head, size_t n) const +void test_generator::get_last_n_block_weights(std::vector& block_weights, const crypto::hash& head, size_t n) const { std::vector blockchain; get_block_chain(blockchain, head, n); BOOST_FOREACH(auto& bi, blockchain) { - block_sizes.push_back(bi.block_size); + block_weights.push_back(bi.block_weight); } } @@ -95,17 +95,17 @@ uint64_t test_generator::get_already_generated_coins(const cryptonote::block& bl return get_already_generated_coins(blk_hash); } -void test_generator::add_block(const cryptonote::block& blk, size_t tsx_size, std::vector& block_sizes, uint64_t already_generated_coins, uint8_t hf_version) +void test_generator::add_block(const cryptonote::block& blk, size_t txs_weight, std::vector& block_weights, uint64_t already_generated_coins, uint8_t hf_version) { - const size_t block_size = tsx_size + get_object_blobsize(blk.miner_tx); + const size_t block_weight = txs_weight + get_transaction_weight(blk.miner_tx); uint64_t block_reward; - get_block_reward(misc_utils::median(block_sizes), block_size, already_generated_coins, block_reward, hf_version); - m_blocks_info[get_block_hash(blk)] = block_info(blk.prev_id, already_generated_coins + block_reward, block_size); + get_block_reward(misc_utils::median(block_weights), block_weight, already_generated_coins, block_reward, hf_version); + m_blocks_info[get_block_hash(blk)] = block_info(blk.prev_id, already_generated_coins + block_reward, block_weight); } bool test_generator::construct_block(cryptonote::block& blk, uint64_t height, const crypto::hash& prev_id, const cryptonote::account_base& miner_acc, uint64_t timestamp, uint64_t already_generated_coins, - std::vector& block_sizes, const std::list& tx_list) + std::vector& block_weights, const std::list& tx_list) { blk.major_version = CURRENT_BLOCK_MAJOR_VERSION; blk.minor_version = CURRENT_BLOCK_MINOR_VERSION; @@ -121,52 +121,52 @@ bool test_generator::construct_block(cryptonote::block& blk, uint64_t height, co } uint64_t total_fee = 0; - size_t txs_size = 0; + size_t txs_weight = 0; BOOST_FOREACH(auto& tx, tx_list) { uint64_t fee = 0; bool r = get_tx_fee(tx, fee); CHECK_AND_ASSERT_MES(r, false, "wrong transaction passed to construct_block"); total_fee += fee; - txs_size += get_object_blobsize(tx); + txs_weight += get_transaction_weight(tx); } blk.miner_tx = AUTO_VAL_INIT(blk.miner_tx); - size_t target_block_size = txs_size + get_object_blobsize(blk.miner_tx); + size_t target_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); while (true) { - if (!construct_miner_tx(height, misc_utils::median(block_sizes), already_generated_coins, target_block_size, total_fee, miner_acc.get_keys().m_account_address, blk.miner_tx, blobdata(), 10)) + if (!construct_miner_tx(height, misc_utils::median(block_weights), already_generated_coins, target_block_weight, total_fee, miner_acc.get_keys().m_account_address, blk.miner_tx, blobdata(), 10)) return false; - size_t actual_block_size = txs_size + get_object_blobsize(blk.miner_tx); - if (target_block_size < actual_block_size) + size_t actual_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); + if (target_block_weight < actual_block_weight) { - target_block_size = actual_block_size; + target_block_weight = actual_block_weight; } - else if (actual_block_size < target_block_size) + else if (actual_block_weight < target_block_weight) { - size_t delta = target_block_size - actual_block_size; + size_t delta = target_block_weight - actual_block_weight; blk.miner_tx.extra.resize(blk.miner_tx.extra.size() + delta, 0); - actual_block_size = txs_size + get_object_blobsize(blk.miner_tx); - if (actual_block_size == target_block_size) + actual_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); + if (actual_block_weight == target_block_weight) { break; } else { - CHECK_AND_ASSERT_MES(target_block_size < actual_block_size, false, "Unexpected block size"); - delta = actual_block_size - target_block_size; + CHECK_AND_ASSERT_MES(target_block_weight < actual_block_weight, false, "Unexpected block size"); + delta = actual_block_weight - target_block_weight; blk.miner_tx.extra.resize(blk.miner_tx.extra.size() - delta); - actual_block_size = txs_size + get_object_blobsize(blk.miner_tx); - if (actual_block_size == target_block_size) + actual_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); + if (actual_block_weight == target_block_weight) { break; } else { - CHECK_AND_ASSERT_MES(actual_block_size < target_block_size, false, "Unexpected block size"); + CHECK_AND_ASSERT_MES(actual_block_weight < target_block_weight, false, "Unexpected block size"); blk.miner_tx.extra.resize(blk.miner_tx.extra.size() + delta, 0); - target_block_size = txs_size + get_object_blobsize(blk.miner_tx); + target_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); } } } @@ -183,16 +183,16 @@ bool test_generator::construct_block(cryptonote::block& blk, uint64_t height, co while (!miner::find_nonce_for_given_block(blk, get_test_difficulty(), height)) blk.timestamp++; - add_block(blk, txs_size, block_sizes, already_generated_coins); + add_block(blk, txs_weight, block_weights, already_generated_coins); return true; } bool test_generator::construct_block(cryptonote::block& blk, const cryptonote::account_base& miner_acc, uint64_t timestamp) { - std::vector block_sizes; + std::vector block_weights; std::list tx_list; - return construct_block(blk, 0, null_hash, miner_acc, timestamp, 0, block_sizes, tx_list); + return construct_block(blk, 0, null_hash, miner_acc, timestamp, 0, block_weights, tx_list); } bool test_generator::construct_block(cryptonote::block& blk, const cryptonote::block& blk_prev, @@ -204,10 +204,10 @@ bool test_generator::construct_block(cryptonote::block& blk, const cryptonote::b // Keep difficulty unchanged uint64_t timestamp = blk_prev.timestamp + DIFFICULTY_BLOCKS_ESTIMATE_TIMESPAN; uint64_t already_generated_coins = get_already_generated_coins(prev_id); - std::vector block_sizes; - get_last_n_block_sizes(block_sizes, prev_id, CRYPTONOTE_REWARD_BLOCKS_WINDOW); + std::vector block_weights; + get_last_n_block_weights(block_weights, prev_id, CRYPTONOTE_REWARD_BLOCKS_WINDOW); - return construct_block(blk, height, prev_id, miner_acc, timestamp, already_generated_coins, block_sizes, tx_list); + return construct_block(blk, height, prev_id, miner_acc, timestamp, already_generated_coins, block_weights, tx_list); } bool test_generator::construct_block_manually(block& blk, const block& prev_block, const account_base& miner_acc, @@ -216,7 +216,7 @@ bool test_generator::construct_block_manually(block& blk, const block& prev_bloc const crypto::hash& prev_id/* = crypto::hash()*/, const difficulty_type& diffic/* = 1*/, const transaction& miner_tx/* = transaction()*/, const std::vector& tx_hashes/* = std::vector()*/, - size_t txs_sizes/* = 0*/, size_t max_outs/* = 0*/, uint8_t hf_version/* = 1*/) + size_t txs_weight/* = 0*/, size_t max_outs/* = 0*/, uint8_t hf_version/* = 1*/) { blk.major_version = actual_params & bf_major_ver ? major_ver : CURRENT_BLOCK_MAJOR_VERSION; blk.minor_version = actual_params & bf_minor_ver ? minor_ver : CURRENT_BLOCK_MINOR_VERSION; @@ -228,17 +228,17 @@ bool test_generator::construct_block_manually(block& blk, const block& prev_bloc size_t height = get_block_height(prev_block) + 1; uint64_t already_generated_coins = get_already_generated_coins(prev_block); - std::vector block_sizes; - get_last_n_block_sizes(block_sizes, get_block_hash(prev_block), CRYPTONOTE_REWARD_BLOCKS_WINDOW); + std::vector block_weights; + get_last_n_block_weights(block_weights, get_block_hash(prev_block), CRYPTONOTE_REWARD_BLOCKS_WINDOW); if (actual_params & bf_miner_tx) { blk.miner_tx = miner_tx; } else { - size_t current_block_size = txs_sizes + get_object_blobsize(blk.miner_tx); + size_t current_block_weight = txs_weight + get_transaction_weight(blk.miner_tx); // TODO: This will work, until size of constructed block is less then CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE - if (!construct_miner_tx(height, misc_utils::median(block_sizes), already_generated_coins, current_block_size, 0, miner_acc.get_keys().m_account_address, blk.miner_tx, blobdata(), max_outs, hf_version)) + if (!construct_miner_tx(height, misc_utils::median(block_weights), already_generated_coins, current_block_weight, 0, miner_acc.get_keys().m_account_address, blk.miner_tx, blobdata(), max_outs, hf_version)) return false; } @@ -247,16 +247,16 @@ bool test_generator::construct_block_manually(block& blk, const block& prev_bloc difficulty_type a_diffic = actual_params & bf_diffic ? diffic : get_test_difficulty(); fill_nonce(blk, a_diffic, height); - add_block(blk, txs_sizes, block_sizes, already_generated_coins, hf_version); + add_block(blk, txs_weight, block_weights, already_generated_coins, hf_version); return true; } bool test_generator::construct_block_manually_tx(cryptonote::block& blk, const cryptonote::block& prev_block, const cryptonote::account_base& miner_acc, - const std::vector& tx_hashes, size_t txs_size) + const std::vector& tx_hashes, size_t txs_weight) { - return construct_block_manually(blk, prev_block, miner_acc, bf_tx_hashes, 0, 0, 0, crypto::hash(), 0, transaction(), tx_hashes, txs_size); + return construct_block_manually(blk, prev_block, miner_acc, bf_tx_hashes, 0, 0, 0, crypto::hash(), 0, transaction(), tx_hashes, txs_weight); } diff --git a/tests/core_tests/chaingen.h b/tests/core_tests/chaingen.h index e44bcd37b..34b205ae5 100644 --- a/tests/core_tests/chaingen.h +++ b/tests/core_tests/chaingen.h @@ -159,20 +159,20 @@ public: block_info() : prev_id() , already_generated_coins(0) - , block_size(0) + , block_weight(0) { } - block_info(crypto::hash a_prev_id, uint64_t an_already_generated_coins, size_t a_block_size) + block_info(crypto::hash a_prev_id, uint64_t an_already_generated_coins, size_t a_block_weight) : prev_id(a_prev_id) , already_generated_coins(an_already_generated_coins) - , block_size(a_block_size) + , block_weight(a_block_weight) { } crypto::hash prev_id; uint64_t already_generated_coins; - size_t block_size; + size_t block_weight; }; enum block_fields @@ -190,15 +190,15 @@ public: }; void get_block_chain(std::vector& blockchain, const crypto::hash& head, size_t n) const; - void get_last_n_block_sizes(std::vector& block_sizes, const crypto::hash& head, size_t n) const; + void get_last_n_block_weights(std::vector& block_weights, const crypto::hash& head, size_t n) const; uint64_t get_already_generated_coins(const crypto::hash& blk_id) const; uint64_t get_already_generated_coins(const cryptonote::block& blk) const; - void add_block(const cryptonote::block& blk, size_t tsx_size, std::vector& block_sizes, uint64_t already_generated_coins, + void add_block(const cryptonote::block& blk, size_t tsx_size, std::vector& block_weights, uint64_t already_generated_coins, uint8_t hf_version = 1); bool construct_block(cryptonote::block& blk, uint64_t height, const crypto::hash& prev_id, const cryptonote::account_base& miner_acc, uint64_t timestamp, uint64_t already_generated_coins, - std::vector& block_sizes, const std::list& tx_list); + std::vector& block_weights, const std::list& tx_list); bool construct_block(cryptonote::block& blk, const cryptonote::account_base& miner_acc, uint64_t timestamp); bool construct_block(cryptonote::block& blk, const cryptonote::block& blk_prev, const cryptonote::account_base& miner_acc, const std::list& tx_list = std::list()); diff --git a/tests/core_tests/chaingen_main.cpp b/tests/core_tests/chaingen_main.cpp index 60de110fa..278ef81a6 100644 --- a/tests/core_tests/chaingen_main.cpp +++ b/tests/core_tests/chaingen_main.cpp @@ -227,14 +227,16 @@ int main(int argc, char* argv[]) GENERATE_AND_PLAY(gen_bp_tx_valid_1); GENERATE_AND_PLAY(gen_bp_tx_invalid_1_1); GENERATE_AND_PLAY(gen_bp_tx_valid_2); - GENERATE_AND_PLAY(gen_bp_tx_valid_4_2_1); - GENERATE_AND_PLAY(gen_bp_tx_valid_16_16); + GENERATE_AND_PLAY(gen_bp_tx_valid_3); + GENERATE_AND_PLAY(gen_bp_tx_valid_16); + GENERATE_AND_PLAY(gen_bp_tx_invalid_4_2_1); + GENERATE_AND_PLAY(gen_bp_tx_invalid_16_16); GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_2); - GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_8_2_and_16_16_1); + GENERATE_AND_PLAY(gen_bp_txs_invalid_2_and_8_2_and_16_16_1); GENERATE_AND_PLAY(gen_bp_tx_invalid_not_enough_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_too_many_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_wrong_amount); - GENERATE_AND_PLAY(gen_bp_tx_invalid_switched); + GENERATE_AND_PLAY(gen_bp_tx_invalid_borromean_type); el::Level level = (failed_tests.empty() ? el::Level::Info : el::Level::Error); MLOG(level, "\nREPORT:"); diff --git a/tests/performance_tests/check_tx_signature.h b/tests/performance_tests/check_tx_signature.h index bcd3b3dfe..ee382d9ad 100644 --- a/tests/performance_tests/check_tx_signature.h +++ b/tests/performance_tests/check_tx_signature.h @@ -40,7 +40,7 @@ #include "multi_tx_test_base.h" -template +template class test_check_tx_signature : private multi_tx_test_base { static_assert(0 < a_ring_size, "ring_size must be greater than 0"); @@ -50,7 +50,6 @@ public: static const size_t ring_size = a_ring_size; static const size_t outputs = a_outputs; static const bool rct = a_rct; - static const bool bulletproof = a_bulletproof; typedef multi_tx_test_base base_class; @@ -72,7 +71,7 @@ public: std::vector additional_tx_keys; std::unordered_map subaddresses; subaddresses[this->m_miners[this->real_source_idx].get_keys().m_account_address.m_spend_public_key] = {0,0}; - if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, bulletproof ? rct::RangeProofMultiOutputBulletproof : rct::RangeProofBorromean)) + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, range_proof_type)) return false; get_transaction_prefix_hash(m_tx, m_tx_prefix_hash); @@ -136,7 +135,7 @@ public: m_txes.resize(a_num_txes + (extra_outs > 0 ? 1 : 0)); for (size_t n = 0; n < a_num_txes; ++n) { - if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_txes[n], 0, tx_key, additional_tx_keys, true, rct::RangeProofMultiOutputBulletproof)) + if (!construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, destinations, cryptonote::account_public_address{}, std::vector(), m_txes[n], 0, tx_key, additional_tx_keys, true, rct::RangeProofPaddedBulletproof)) return false; } diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 19c2cb5e5..6007242bf 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -132,21 +132,25 @@ int main(int argc, char** argv) TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 2, true); TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 10, true); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 1, 2, false, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, false, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, false, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, false, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, false, false); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 1, 2, false); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 2, 2, false); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 10, 2, false); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 100, 2, false); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 2, 10, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, false); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, false); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, rct::RangeProofBorromean); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, rct::RangeProofBorromean); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, rct::RangeProofBorromean); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, rct::RangeProofBorromean); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, true); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, true); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, true); - TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, true); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 2, true, rct::RangeProofMultiOutputBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 10, 2, true, rct::RangeProofMultiOutputBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 100, 2, true, rct::RangeProofMultiOutputBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_check_tx_signature, 2, 10, true, rct::RangeProofMultiOutputBulletproof); TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 2, 2, 64); TEST_PERFORMANCE3(filter, p, test_check_tx_signature_aggregated_bulletproofs, 10, 2, 64); diff --git a/tests/unit_tests/block_reward.cpp b/tests/unit_tests/block_reward.cpp index ca863ded9..a897e4140 100644 --- a/tests/unit_tests/block_reward.cpp +++ b/tests/unit_tests/block_reward.cpp @@ -40,14 +40,14 @@ namespace class block_reward_and_already_generated_coins : public ::testing::Test { protected: - static const size_t current_block_size = CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 / 2; + static const size_t current_block_weight = CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 / 2; bool m_block_not_too_big; uint64_t m_block_reward; }; #define TEST_ALREADY_GENERATED_COINS(already_generated_coins, expected_reward) \ - m_block_not_too_big = get_block_reward(0, current_block_size, already_generated_coins, m_block_reward,1); \ + m_block_not_too_big = get_block_reward(0, current_block_weight, already_generated_coins, m_block_reward,1); \ ASSERT_TRUE(m_block_not_too_big); \ ASSERT_EQ(m_block_reward, expected_reward); @@ -74,7 +74,7 @@ namespace } //-------------------------------------------------------------------------------------------------------------------- - class block_reward_and_current_block_size : public ::testing::Test + class block_reward_and_current_block_weight : public ::testing::Test { protected: virtual void SetUp() @@ -84,9 +84,9 @@ namespace ASSERT_LT(CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1, m_standard_block_reward); } - void do_test(size_t median_block_size, size_t current_block_size) + void do_test(size_t median_block_weight, size_t current_block_weight) { - m_block_not_too_big = get_block_reward(median_block_size, current_block_size, already_generated_coins, m_block_reward, 1); + m_block_not_too_big = get_block_reward(median_block_weight, current_block_weight, already_generated_coins, m_block_reward, 1); } static const uint64_t already_generated_coins = 0; @@ -96,28 +96,28 @@ namespace uint64_t m_standard_block_reward; }; - TEST_F(block_reward_and_current_block_size, handles_block_size_less_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_less_relevance_level) { do_test(0, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 - 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_current_block_size, handles_block_size_eq_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_eq_relevance_level) { do_test(0, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_current_block_size, handles_block_size_gt_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_gt_relevance_level) { do_test(0, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 + 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_LT(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_current_block_size, handles_block_size_less_2_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_less_2_relevance_level) { do_test(0, 2 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 - 1); ASSERT_TRUE(m_block_not_too_big); @@ -125,21 +125,21 @@ namespace ASSERT_LT(0, m_block_reward); } - TEST_F(block_reward_and_current_block_size, handles_block_size_eq_2_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_eq_2_relevance_level) { do_test(0, 2 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(0, m_block_reward); } - TEST_F(block_reward_and_current_block_size, handles_block_size_gt_2_relevance_level) + TEST_F(block_reward_and_current_block_weight, handles_block_weight_gt_2_relevance_level) { do_test(0, 2 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1 + 1); ASSERT_FALSE(m_block_not_too_big); } #ifdef __x86_64__ // For 64-bit systems only, because block size is limited to size_t. - TEST_F(block_reward_and_current_block_size, fails_on_huge_median_size) + TEST_F(block_reward_and_current_block_weight, fails_on_huge_median_size) { #if !defined(NDEBUG) size_t huge_size = std::numeric_limits::max() + UINT64_C(2); @@ -147,7 +147,7 @@ namespace #endif } - TEST_F(block_reward_and_current_block_size, fails_on_huge_block_size) + TEST_F(block_reward_and_current_block_weight, fails_on_huge_block_weight) { #if !defined(NDEBUG) size_t huge_size = std::numeric_limits::max() + UINT64_C(2); @@ -157,94 +157,94 @@ namespace #endif // __x86_64__ //-------------------------------------------------------------------------------------------------------------------- - class block_reward_and_last_block_sizes : public ::testing::Test + class block_reward_and_last_block_weights : public ::testing::Test { protected: virtual void SetUp() { - m_last_block_sizes.push_back(3 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); - m_last_block_sizes.push_back(5 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); - m_last_block_sizes.push_back(7 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); - m_last_block_sizes.push_back(11 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); - m_last_block_sizes.push_back(13 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); + m_last_block_weights.push_back(3 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); + m_last_block_weights.push_back(5 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); + m_last_block_weights.push_back(7 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); + m_last_block_weights.push_back(11 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); + m_last_block_weights.push_back(13 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1); - m_last_block_sizes_median = 7 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1; + m_last_block_weights_median = 7 * CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1; - m_block_not_too_big = get_block_reward(epee::misc_utils::median(m_last_block_sizes), 0, already_generated_coins, m_standard_block_reward, 1); + m_block_not_too_big = get_block_reward(epee::misc_utils::median(m_last_block_weights), 0, already_generated_coins, m_standard_block_reward, 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_LT(CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V1, m_standard_block_reward); } - void do_test(size_t current_block_size) + void do_test(size_t current_block_weight) { - m_block_not_too_big = get_block_reward(epee::misc_utils::median(m_last_block_sizes), current_block_size, already_generated_coins, m_block_reward, 1); + m_block_not_too_big = get_block_reward(epee::misc_utils::median(m_last_block_weights), current_block_weight, already_generated_coins, m_block_reward, 1); } static const uint64_t already_generated_coins = 0; - std::vector m_last_block_sizes; - uint64_t m_last_block_sizes_median; + std::vector m_last_block_weights; + uint64_t m_last_block_weights_median; bool m_block_not_too_big; uint64_t m_block_reward; uint64_t m_standard_block_reward; }; - TEST_F(block_reward_and_last_block_sizes, handles_block_size_less_median) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_less_median) { - do_test(m_last_block_sizes_median - 1); + do_test(m_last_block_weights_median - 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_last_block_sizes, handles_block_size_eq_median) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_eq_median) { - do_test(m_last_block_sizes_median); + do_test(m_last_block_weights_median); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_last_block_sizes, handles_block_size_gt_median) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_gt_median) { - do_test(m_last_block_sizes_median + 1); + do_test(m_last_block_weights_median + 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_LT(m_block_reward, m_standard_block_reward); } - TEST_F(block_reward_and_last_block_sizes, handles_block_size_less_2_medians) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_less_2_medians) { - do_test(2 * m_last_block_sizes_median - 1); + do_test(2 * m_last_block_weights_median - 1); ASSERT_TRUE(m_block_not_too_big); ASSERT_LT(m_block_reward, m_standard_block_reward); ASSERT_LT(0, m_block_reward); } - TEST_F(block_reward_and_last_block_sizes, handles_block_size_eq_2_medians) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_eq_2_medians) { - do_test(2 * m_last_block_sizes_median); + do_test(2 * m_last_block_weights_median); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(0, m_block_reward); } - TEST_F(block_reward_and_last_block_sizes, handles_block_size_gt_2_medians) + TEST_F(block_reward_and_last_block_weights, handles_block_weight_gt_2_medians) { - do_test(2 * m_last_block_sizes_median + 1); + do_test(2 * m_last_block_weights_median + 1); ASSERT_FALSE(m_block_not_too_big); } - TEST_F(block_reward_and_last_block_sizes, calculates_correctly) + TEST_F(block_reward_and_last_block_weights, calculates_correctly) { - ASSERT_EQ(0, m_last_block_sizes_median % 8); + ASSERT_EQ(0, m_last_block_weights_median % 8); - do_test(m_last_block_sizes_median * 9 / 8); + do_test(m_last_block_weights_median * 9 / 8); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward * 63 / 64); // 3/2 = 12/8 - do_test(m_last_block_sizes_median * 3 / 2); + do_test(m_last_block_weights_median * 3 / 2); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward * 3 / 4); - do_test(m_last_block_sizes_median * 15 / 8); + do_test(m_last_block_weights_median * 15 / 8); ASSERT_TRUE(m_block_not_too_big); ASSERT_EQ(m_block_reward, m_standard_block_reward * 15 / 64); } diff --git a/tests/unit_tests/blockchain_db.cpp b/tests/unit_tests/blockchain_db.cpp index 3a62fba69..7e7ce9bf7 100644 --- a/tests/unit_tests/blockchain_db.cpp +++ b/tests/unit_tests/blockchain_db.cpp @@ -319,7 +319,7 @@ TYPED_TEST(BlockchainDBTest, RetrieveBlockData) ASSERT_NO_THROW(this->m_db->add_block(this->m_blocks[0], t_sizes[0], t_diffs[0], t_coins[0], this->m_txs[0])); - ASSERT_EQ(t_sizes[0], this->m_db->get_block_size(0)); + ASSERT_EQ(t_sizes[0], this->m_db->get_block_weight(0)); ASSERT_EQ(t_diffs[0], this->m_db->get_block_cumulative_difficulty(0)); ASSERT_EQ(t_diffs[0], this->m_db->get_block_difficulty(0)); ASSERT_EQ(t_coins[0], this->m_db->get_block_already_generated_coins(0)); diff --git a/tests/unit_tests/bulletproofs.cpp b/tests/unit_tests/bulletproofs.cpp index e34982070..45075c63d 100644 --- a/tests/unit_tests/bulletproofs.cpp +++ b/tests/unit_tests/bulletproofs.cpp @@ -129,7 +129,7 @@ TEST(bulletproofs, multi_splitting) } rct::ctkeyV outSk; - rct::rctSig s = rct::genRctSimple(rct::zero(), sc, destinations, inamounts, outamounts, available, mixRing, amount_keys, NULL, NULL, index, outSk, rct::RangeProofMultiOutputBulletproof, hw::get_device("default")); + rct::rctSig s = rct::genRctSimple(rct::zero(), sc, destinations, inamounts, outamounts, available, mixRing, amount_keys, NULL, NULL, index, outSk, rct::RangeProofPaddedBulletproof, hw::get_device("default")); ASSERT_TRUE(rct::verRctSimple(s)); for (size_t i = 0; i < n_outputs; ++i) { diff --git a/tests/unit_tests/fee.cpp b/tests/unit_tests/fee.cpp index c5589ab96..8ccb38fc9 100644 --- a/tests/unit_tests/fee.cpp +++ b/tests/unit_tests/fee.cpp @@ -58,46 +58,46 @@ namespace TEST_F(fee, 10xmr) { // CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 and lower are clamped - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(2000000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(2000000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(2000000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, 1, 3), 2000000000); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(2000000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(2000000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(2000000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, 1, 3), 2000000000); // higher is inverse proportional - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(2000000000 / 2)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(2000000000 / 10)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(2000000000 / 1000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(2000000000 / 20000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(2000000000 / 2)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(2000000000 / 10)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(2000000000 / 1000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(10000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(2000000000 / 20000)); } TEST_F(fee, 1xmr) { // CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 and lower are clamped - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(200000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(200000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(200000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, 1, 3), 200000000); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(200000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(200000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(200000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, 1, 3), 200000000); // higher is inverse proportional - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(200000000 / 2)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(200000000 / 10)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(200000000 / 1000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(200000000 / 20000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(200000000 / 2)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(200000000 / 10)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(200000000 / 1000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(1000000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(200000000 / 20000)); } TEST_F(fee, dot3xmr) { // CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 and lower are clamped - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(60000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(60000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(60000000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, 1, 3), 60000000); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, 3), clamp_fee(60000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 2, 3), clamp_fee(60000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 / 100, 3), clamp_fee(60000000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, 1, 3), 60000000); // higher is inverse proportional - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(60000000 / 2)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(60000000 / 10)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(60000000 / 1000)); - ASSERT_EQ(Blockchain::get_dynamic_per_kb_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(60000000 / 20000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, 3), clamp_fee(60000000 / 2)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, 3), clamp_fee(60000000 / 10)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 1000, 3), clamp_fee(60000000 / 1000)); + ASSERT_EQ(Blockchain::get_dynamic_base_fee(300000000000, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 20000ull, 3), clamp_fee(60000000 / 20000)); } static bool is_more_or_less(double x, double y) @@ -116,7 +116,7 @@ namespace 600000000000ull, // .6 monero, minimum reward per block at 2min 300000000000ull, // .3 monero, minimum reward per block at 1min }; - static const uint64_t median_block_sizes[] = { + static const uint64_t median_block_weights[] = { CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 2, CRYPTONOTE_BLOCK_GRANTED_FULL_REWARD_ZONE_V2 * 10, @@ -127,9 +127,9 @@ namespace for (uint64_t block_reward: block_rewards) { - for (uint64_t median_block_size: median_block_sizes) + for (uint64_t median_block_weight: median_block_weights) { - ASSERT_TRUE(is_more_or_less(Blockchain::get_dynamic_per_kb_fee(block_reward, median_block_size, 3) * (median_block_size / 1024.) * MAX_MULTIPLIER / (double)block_reward, 1.992 * 1000 / 1024)); + ASSERT_TRUE(is_more_or_less(Blockchain::get_dynamic_base_fee(block_reward, median_block_weight, 3) * (median_block_weight / 1024.) * MAX_MULTIPLIER / (double)block_reward, 1.992 * 1000 / 1024)); } } } diff --git a/tests/unit_tests/hardfork.cpp b/tests/unit_tests/hardfork.cpp index 8155c65f9..47177db1c 100644 --- a/tests/unit_tests/hardfork.cpp +++ b/tests/unit_tests/hardfork.cpp @@ -72,7 +72,7 @@ public: virtual uint64_t get_block_timestamp(const uint64_t& height) const { return 0; } virtual std::vector get_block_cumulative_rct_outputs(const std::vector &heights) const { return {}; } virtual uint64_t get_top_block_timestamp() const { return 0; } - virtual size_t get_block_size(const uint64_t& height) const { return 128; } + virtual size_t get_block_weight(const uint64_t& height) const { return 128; } virtual difficulty_type get_block_cumulative_difficulty(const uint64_t& height) const { return 10; } virtual difficulty_type get_block_difficulty(const uint64_t& height) const { return 0; } virtual uint64_t get_block_already_generated_coins(const uint64_t& height) const { return 10000000000; } @@ -130,7 +130,7 @@ public: virtual bool for_all_txpool_txes(std::function, bool include_blob = false, bool include_unrelayed_txes = false) const { return false; } virtual void add_block( const block& blk - , const size_t& block_size + , size_t block_weight , const difficulty_type& cumulative_difficulty , const uint64_t& coins_generated , uint64_t num_rct_outs From fe0fa3b9c5098ae61f9c60ddc9f1f3dd5b008ec6 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 19:56:48 +0100 Subject: [PATCH 36/56] bulletproofs: reject x, y, z, or w[i] being zero Also try again when we're generate a proof with those characteristics Reported by QuarksLab. --- src/ringct/bulletproofs.cc | 65 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 63 insertions(+), 2 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index d3822c454..3f4a6fd10 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -473,6 +473,7 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) CHECK_AND_ASSERT_THROW_MES(test_aR == v_test, "test_aR failed"); #endif +try_again: PERF_TIMER_START_BP(PROVE_step1); // PAPER LINES 38-39 rct::key alpha = rct::skGen(); @@ -489,7 +490,19 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) // PAPER LINES 43-45 rct::key y = hash_cache_mash(hash_cache, A, S); + if (y == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step1); + MINFO("y is 0, trying again"); + goto try_again; + } rct::key z = hash_cache = rct::hash_to_scalar(y); + if (z == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step1); + MINFO("z is 0, trying again"); + goto try_again; + } // Polynomial construction before PAPER LINE 46 rct::key t0 = rct::zero(); @@ -552,6 +565,12 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); + if (x == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step2); + MINFO("x is 0, trying again"); + goto try_again; + } // PAPER LINES 52-53 rct::key taux = rct::zero(); @@ -625,6 +644,12 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); + if (w[round] == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step4); + MINFO("w[round] is 0, trying again"); + goto try_again; + } // PAPER LINES 24-25 const rct::key winv = invert(w[round]); @@ -713,8 +738,6 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) } PERF_TIMER_STOP(PROVE_aLaR); - rct::key hash_cache = rct::hash_to_scalar(V); - // DEBUG: Test to ensure this recovers the value #ifdef DEBUG_BP for (size_t j = 0; j < M; ++j) @@ -735,6 +758,9 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) } #endif +try_again: + rct::key hash_cache = rct::hash_to_scalar(V); + PERF_TIMER_START_BP(PROVE_step1); // PAPER LINES 38-39 rct::key alpha = rct::skGen(); @@ -751,7 +777,19 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 43-45 rct::key y = hash_cache_mash(hash_cache, A, S); + if (y == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step1); + MINFO("y is 0, trying again"); + goto try_again; + } rct::key z = hash_cache = rct::hash_to_scalar(y); + if (z == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step1); + MINFO("z is 0, trying again"); + goto try_again; + } // Polynomial construction by coefficients const auto zMN = vector_dup(z, MN); @@ -799,6 +837,12 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); + if (x == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step2); + MINFO("x is 0, trying again"); + goto try_again; + } // PAPER LINES 52-53 rct::key taux; @@ -835,6 +879,12 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 32-33 rct::key x_ip = hash_cache_mash(hash_cache, x, taux, mu, t); + if (x_ip == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step3); + MINFO("x_ip is 0, trying again"); + goto try_again; + } // These are used in the inner product rounds size_t nprime = MN; @@ -879,6 +929,12 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); + if (w[round] == rct::zero()) + { + PERF_TIMER_STOP(PROVE_step4); + MINFO("w[round] is 0, trying again"); + goto try_again; + } // PAPER LINES 24-25 const rct::key winv = invert(w[round]); @@ -985,9 +1041,13 @@ bool bulletproof_VERIFY(const std::vector &proofs) PERF_TIMER_START_BP(VERIFY_start); rct::key hash_cache = rct::hash_to_scalar(proof.V); rct::key y = hash_cache_mash(hash_cache, proof.A, proof.S); + CHECK_AND_ASSERT_MES(!(y == rct::zero()), false, "y == 0"); rct::key z = hash_cache = rct::hash_to_scalar(y); + CHECK_AND_ASSERT_MES(!(z == rct::zero()), false, "z == 0"); rct::key x = hash_cache_mash(hash_cache, z, proof.T1, proof.T2); + CHECK_AND_ASSERT_MES(!(x == rct::zero()), false, "x == 0"); rct::key x_ip = hash_cache_mash(hash_cache, x, proof.taux, proof.mu, proof.t); + CHECK_AND_ASSERT_MES(!(x_ip == rct::zero()), false, "x_ip == 0"); PERF_TIMER_STOP(VERIFY_start); PERF_TIMER_START_BP(VERIFY_line_61); @@ -1082,6 +1142,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) for (size_t i = 0; i < rounds; ++i) { w[i] = hash_cache_mash(hash_cache, proof.L[i], proof.R[i]); + CHECK_AND_ASSERT_MES(!(w[i] == rct::zero()), false, "w[i] == 0"); } PERF_TIMER_STOP(VERIFY_line_21_22); From a1359ad43c9263c919f8c39b54224ac9fc992d74 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 20:17:32 +0100 Subject: [PATCH 37/56] Check inputs to addKeys are in range Reported by QuarksLab. --- src/ringct/rctSigs.cpp | 4 ++++ src/wallet/wallet2.cpp | 2 ++ 2 files changed, 6 insertions(+) diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index dbbf29fd1..ae58ad12c 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -1108,6 +1108,8 @@ namespace rct { DP("C"); DP(C); key Ctmp; + CHECK_AND_ASSERT_THROW_MES(sc_check(mask.bytes) == 0, "warning, bad ECDH mask"); + CHECK_AND_ASSERT_THROW_MES(sc_check(amount.bytes) == 0, "warning, bad ECDH amount"); addKeys2(Ctmp, mask, amount, H); DP("Ctmp"); DP(Ctmp); @@ -1136,6 +1138,8 @@ namespace rct { DP("C"); DP(C); key Ctmp; + CHECK_AND_ASSERT_THROW_MES(sc_check(mask.bytes) == 0, "warning, bad ECDH mask"); + CHECK_AND_ASSERT_THROW_MES(sc_check(amount.bytes) == 0, "warning, bad ECDH amount"); addKeys2(Ctmp, mask, amount, H); DP("Ctmp"); DP(Ctmp); diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp index 6c0aec4a4..9b977350e 100644 --- a/src/wallet/wallet2.cpp +++ b/src/wallet/wallet2.cpp @@ -9422,6 +9422,8 @@ void wallet2::check_tx_key_helper(const crypto::hash &txid, const crypto::key_de hwdev.ecdhDecode(ecdh_info, rct::sk2rct(scalar1)); const rct::key C = tx.rct_signatures.outPk[n].mask; rct::key Ctmp; + THROW_WALLET_EXCEPTION_IF(sc_check(ecdh_info.mask.bytes) != 0, error::wallet_internal_error, "Bad ECDH input mask"); + THROW_WALLET_EXCEPTION_IF(sc_check(ecdh_info.amount.bytes) != 0, error::wallet_internal_error, "Bad ECDH input amount"); rct::addKeys2(Ctmp, ecdh_info.mask, ecdh_info.amount, rct::H); if (rct::equalKeys(C, Ctmp)) amount = rct::h2d(ecdh_info.amount); From 0825e974362ee5e62f44e08fae08dbb10e48383c Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 20:26:43 +0100 Subject: [PATCH 38/56] multiexp: fix wrong Bos-Coster result for 1 non trivial input Reported by QuarksLab. --- src/ringct/multiexp.cc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index f9ef9e422..b05840322 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -222,17 +222,21 @@ rct::key bos_coster_heap_conv_robust(std::vector data) points = heap.size(); if (points == 0) return rct::identity(); + + auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; + std::make_heap(heap.begin(), heap.end(), Comp); + if (points < 2) { + std::pop_heap(heap.begin(), heap.end(), Comp); + size_t index1 = heap.back(); ge_p2 p2; - ge_scalarmult(&p2, data[0].scalar.bytes, &data[0].point); + ge_scalarmult(&p2, data[index1].scalar.bytes, &data[index1].point); rct::key res; ge_tobytes(res.bytes, &p2); return res; } - auto Comp = [&](size_t e0, size_t e1) { return data[e0].scalar < data[e1].scalar; }; - std::make_heap(heap.begin(), heap.end(), Comp); MULTIEXP_PERF(PERF_TIMER_STOP(setup)); MULTIEXP_PERF(PERF_TIMER_START_UNIT(loop, 1000000)); From 7434df1cc6e96b5d98ea6e3ec095eaae4ac9a95c Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 20:53:09 +0100 Subject: [PATCH 39/56] crypto: never return zero in random32_unbiased This avoids problems when the caller can't deal with a zero walue, which happens often enough that it's worth nipping the problem in the bud. --- src/crypto/crypto.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp index 4243c71fd..d6e3b8e0e 100644 --- a/src/crypto/crypto.cpp +++ b/src/crypto/crypto.cpp @@ -116,7 +116,7 @@ namespace crypto { do { generate_random_bytes_thread_safe(32, bytes); - } while (!less32(bytes, limit)); // should be good about 15/16 of the time + } while (!sc_isnonzero(bytes) && !less32(bytes, limit)); // should be good about 15/16 of the time sc_reduce32(bytes); } /* generate a random 32-byte (256-bit) integer and copy it to res */ From a4317e61b5f48c05bb094f8bfe1a8cc890885a6f Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 21:12:57 +0100 Subject: [PATCH 40/56] crypto: some paranoid checks in generate_signature/check_signature Reported by QuarksLab. --- src/crypto/crypto.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp index d6e3b8e0e..ad7721cf0 100644 --- a/src/crypto/crypto.cpp +++ b/src/crypto/crypto.cpp @@ -274,11 +274,18 @@ namespace crypto { #endif buf.h = prefix_hash; buf.key = pub; + try_again: random_scalar(k); + if (((const uint32_t*)(&k))[7] == 0) // we don't want tiny numbers here + goto try_again; ge_scalarmult_base(&tmp3, &k); ge_p3_tobytes(&buf.comm, &tmp3); hash_to_scalar(&buf, sizeof(s_comm), sig.c); + if (!sc_isnonzero((const unsigned char*)sig.c.data)) + goto try_again; sc_mulsub(&sig.r, &sig.c, &unwrap(sec), &k); + if (!sc_isnonzero((const unsigned char*)sig.r.data)) + goto try_again; } bool crypto_ops::check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) { @@ -292,11 +299,14 @@ namespace crypto { if (ge_frombytes_vartime(&tmp3, &pub) != 0) { return false; } - if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0) { + if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0 || !sc_isnonzero(&sig.c)) { return false; } ge_double_scalarmult_base_vartime(&tmp2, &sig.c, &tmp3, &sig.r); ge_tobytes(&buf.comm, &tmp2); + static const ec_point infinity = {{ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}; + if (memcmp(&buf.comm, &infinity, 32) == 0) + return false; hash_to_scalar(&buf, sizeof(s_comm), c); sc_sub(&c, &c, &sig.c); return sc_isnonzero(&c) == 0; From 61632dc166c25d172681a928583836b6bc2e1562 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 21:23:08 +0100 Subject: [PATCH 41/56] ringct: prevent a potential very large allocation Reported by QuarksLab. --- src/ringct/rctTypes.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index 5c02f92aa..ffc4df3ed 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -317,9 +317,9 @@ namespace rct { ar.begin_array(); uint32_t nbp = bulletproofs.size(); FIELD(nbp) - PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs); - if (bulletproofs.size() > outputs) + if (nbp > outputs) return false; + PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs); for (size_t i = 0; i < nbp; ++i) { FIELDS(bulletproofs[i]) From d1591853bf0df9a278420e874b7d8dd03966b66d Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 21:32:49 +0100 Subject: [PATCH 42/56] cryptonote_basic: check output type before using it Reported by QuarksLab. --- src/cryptonote_basic/cryptonote_format_utils.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/cryptonote_basic/cryptonote_format_utils.cpp b/src/cryptonote_basic/cryptonote_format_utils.cpp index f1a5c4d94..9061bf105 100644 --- a/src/cryptonote_basic/cryptonote_format_utils.cpp +++ b/src/cryptonote_basic/cryptonote_format_utils.cpp @@ -135,7 +135,14 @@ namespace cryptonote return false; } for (size_t n = 0; n < tx.rct_signatures.outPk.size(); ++n) + { + if (tx.vout[n].target.type() != typeid(txout_to_key)) + { + LOG_PRINT_L1("Unsupported output type in tx " << get_transaction_hash(tx)); + return false; + } rv.outPk[n].dest = rct::pk2rct(boost::get(tx.vout[n].target).key); + } if (!base_only) { From 7ed496cc780489f9bb8fe13c4d97885666e0dfaf Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 25 Jul 2018 10:10:46 +0100 Subject: [PATCH 43/56] ringct: error out when hashToPoint* returns the point at infinity Reported by QuarksLab. --- src/ringct/bulletproofs.cc | 4 +++- src/ringct/rctSigs.cpp | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 3f4a6fd10..2964fc469 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -130,7 +130,9 @@ static rct::key get_exponent(const rct::key &base, size_t idx) { static const std::string salt("bulletproof"); std::string hashed = std::string((const char*)base.bytes, sizeof(base)) + salt + tools::get_varint_data(idx); - return rct::hashToPoint(rct::hash2rct(crypto::cn_fast_hash(hashed.data(), hashed.size()))); + const rct::key e = rct::hashToPoint(rct::hash2rct(crypto::cn_fast_hash(hashed.data(), hashed.size()))); + CHECK_AND_ASSERT_THROW_MES(!(e == rct::identity()), "Exponent is point at infinity"); + return e; } static void init_exponents() diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index ae58ad12c..e98e62903 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -277,6 +277,7 @@ namespace rct { for (j = 0; j < dsRows; j++) { addKeys2(L, rv.ss[i][j], c_old, pk[i][j]); hashToPoint(Hi, pk[i][j]); + CHECK_AND_ASSERT_MES(!(Hi == rct::identity()), false, "Data hashed to point at infinity"); addKeys3(R, rv.ss[i][j], Hi, c_old, Ip[j].k); toHash[3 * j + 1] = pk[i][j]; toHash[3 * j + 2] = L; From a129bbd944f717d00cff6ee099c47ecede4dbc3c Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 25 Jul 2018 21:56:39 +0100 Subject: [PATCH 44/56] multiexp: fix maxscalar off by one Reported by QuarksLab. --- src/ringct/multiexp.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index b05840322..901b00edd 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -605,7 +605,7 @@ rct::key pippenger(const std::vector &data, const std::shared_ptr< maxscalar = data[i].scalar; } size_t groups = 0; - while (groups < 256 && pow2(groups) < maxscalar) + while (groups < 256 && !(maxscalar < pow2(groups))) ++groups; groups = (groups + c - 1) / c; From 6526d87f17a153a6a7f9f1e81a53b113c20e5f3b Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 26 Jul 2018 10:21:28 +0100 Subject: [PATCH 45/56] core_tests: add a test for a tx with empty bulletproof --- tests/core_tests/bulletproofs.cpp | 13 +++++++++++++ tests/core_tests/bulletproofs.h | 6 ++++++ tests/core_tests/chaingen_main.cpp | 1 + 3 files changed, 20 insertions(+) diff --git a/tests/core_tests/bulletproofs.cpp b/tests/core_tests/bulletproofs.cpp index 3b3039a18..aea502faa 100644 --- a/tests/core_tests/bulletproofs.cpp +++ b/tests/core_tests/bulletproofs.cpp @@ -297,6 +297,19 @@ bool gen_bp_tx_invalid_not_enough_proofs::generate(std::vector }); } +bool gen_bp_tx_invalid_empty_proofs::generate(std::vector& events) const +{ + DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_empty_proofs"); + const size_t mixin = 10; + const uint64_t amounts_paid[] = {50000, 50000, (uint64_t)-1}; + const rct::RangeProofType range_proof_type[] = { rct::RangeProofBulletproof }; + return generate_with(events, mixin, 1, amounts_paid, false, range_proof_type, NULL, [&](cryptonote::transaction &tx, size_t idx){ + CHECK_TEST_CONDITION(tx.rct_signatures.type == rct::RCTTypeBulletproof); + tx.rct_signatures.p.bulletproofs.clear(); + return true; + }); +} + bool gen_bp_tx_invalid_too_many_proofs::generate(std::vector& events) const { DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_too_many_proofs"); diff --git a/tests/core_tests/bulletproofs.h b/tests/core_tests/bulletproofs.h index 13faa3493..c3a7db2c7 100644 --- a/tests/core_tests/bulletproofs.h +++ b/tests/core_tests/bulletproofs.h @@ -162,6 +162,12 @@ struct gen_bp_tx_invalid_not_enough_proofs : public gen_bp_tx_validation_base }; template<> struct get_test_options: public get_test_options {}; +struct gen_bp_tx_invalid_empty_proofs : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + struct gen_bp_tx_invalid_too_many_proofs : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; diff --git a/tests/core_tests/chaingen_main.cpp b/tests/core_tests/chaingen_main.cpp index 278ef81a6..6f26e6532 100644 --- a/tests/core_tests/chaingen_main.cpp +++ b/tests/core_tests/chaingen_main.cpp @@ -234,6 +234,7 @@ int main(int argc, char* argv[]) GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_2); GENERATE_AND_PLAY(gen_bp_txs_invalid_2_and_8_2_and_16_16_1); GENERATE_AND_PLAY(gen_bp_tx_invalid_not_enough_proofs); + GENERATE_AND_PLAY(gen_bp_tx_invalid_empty_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_too_many_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_wrong_amount); GENERATE_AND_PLAY(gen_bp_tx_invalid_borromean_type); From d0a0565f7d2aa658b0632acd11b61ac705bd2294 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 26 Jul 2018 11:09:48 +0100 Subject: [PATCH 46/56] unit_tests: add a few more multiexp unit tests --- tests/unit_tests/multiexp.cpp | 54 +++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/tests/unit_tests/multiexp.cpp b/tests/unit_tests/multiexp.cpp index 10303c392..d8d79a7a2 100644 --- a/tests/unit_tests/multiexp.cpp +++ b/tests/unit_tests/multiexp.cpp @@ -32,8 +32,10 @@ #include "ringct/rctOps.h" #include "ringct/multiexp.h" -static const rct::key TESTSCALAR = rct::H; -static const rct::key TESTPOINT = rct::scalarmultBase(rct::H); +static const rct::key TESTSCALAR = rct::skGen(); +static const rct::key TESTPOW2SCALAR = {{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}; +static const rct::key TESTSMALLSCALAR = {{5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}; +static const rct::key TESTPOINT = rct::scalarmultBase(rct::skGen()); static rct::key basic(const std::vector &data) { @@ -81,6 +83,54 @@ TEST(multiexp, pippenger_empty) ASSERT_TRUE(basic(data) == pippenger(data)); } +TEST(multiexp, bos_coster_zero_and_non_zero) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + data.push_back({TESTSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); +} + +TEST(multiexp, straus_zero_and_non_zero) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + data.push_back({TESTSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == straus(data)); +} + +TEST(multiexp, pippenger_zero_and_non_zero) +{ + std::vector data; + data.push_back({rct::zero(), get_p3(TESTPOINT)}); + data.push_back({TESTSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == pippenger(data)); +} + +TEST(multiexp, bos_coster_pow2_scalar) +{ + std::vector data; + data.push_back({TESTPOW2SCALAR, get_p3(TESTPOINT)}); + data.push_back({TESTSMALLSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == bos_coster_heap_conv_robust(data)); +} + +TEST(multiexp, straus_pow2_scalar) +{ + std::vector data; + data.push_back({TESTPOW2SCALAR, get_p3(TESTPOINT)}); + data.push_back({TESTSMALLSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == straus(data)); +} + +TEST(multiexp, pippenger_pow2_scalar) +{ + std::vector data; + data.push_back({TESTPOW2SCALAR, get_p3(TESTPOINT)}); + data.push_back({TESTSMALLSCALAR, get_p3(TESTPOINT)}); + ASSERT_TRUE(basic(data) == pippenger(data)); +} + TEST(multiexp, bos_coster_only_zeroes) { std::vector data; From 463434d1f7159780f64b0fe2ca4d042cb49f1b2a Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Thu, 26 Jul 2018 18:03:10 +0100 Subject: [PATCH 47/56] more comprehensive test for ge_p3 comparison to identity/point at infinity Reported by QuarksLab. --- src/crypto/crypto-ops.c | 13 +++++++++++++ src/crypto/crypto-ops.h | 2 ++ src/ringct/multiexp.cc | 12 ++++++------ 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/src/crypto/crypto-ops.c b/src/crypto/crypto-ops.c index c1fff1d44..09296d6f9 100644 --- a/src/crypto/crypto-ops.c +++ b/src/crypto/crypto-ops.c @@ -3729,3 +3729,16 @@ int sc_isnonzero(const unsigned char *s) { s[18] | s[19] | s[20] | s[21] | s[22] | s[23] | s[24] | s[25] | s[26] | s[27] | s[28] | s[29] | s[30] | s[31]) - 1) >> 8) + 1; } + +int ge_p3_is_point_at_infinity(const ge_p3 *p) { + // X = 0 and Y == Z + int n; + for (n = 0; n < 10; ++n) + { + if (p->X[n] | p->T[n]) + return 0; + if (p->Y[n] != p->Z[n]) + return 0; + } + return 1; +} diff --git a/src/crypto/crypto-ops.h b/src/crypto/crypto-ops.h index 52854889f..2910dafd4 100644 --- a/src/crypto/crypto-ops.h +++ b/src/crypto/crypto-ops.h @@ -159,3 +159,5 @@ void ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q); void fe_add(fe h, const fe f, const fe g); void fe_tobytes(unsigned char *, const fe); void fe_invert(fe out, const fe z); + +int ge_p3_is_point_at_infinity(const ge_p3 *p); diff --git a/src/ringct/multiexp.cc b/src/ringct/multiexp.cc index 901b00edd..21957b94c 100644 --- a/src/ringct/multiexp.cc +++ b/src/ringct/multiexp.cc @@ -216,7 +216,7 @@ rct::key bos_coster_heap_conv_robust(std::vector data) heap.reserve(points); for (size_t n = 0; n < points; ++n) { - if (!(data[n].scalar == rct::zero()) && memcmp(&data[n].point, &ge_p3_identity, sizeof(ge_p3))) + if (!(data[n].scalar == rct::zero()) && !ge_p3_is_point_at_infinity(&data[n].point)) heap.push_back(n); } points = heap.size(); @@ -442,7 +442,7 @@ rct::key straus(const std::vector &data, const std::shared_ptr skip(data.size()); for (size_t i = 0; i < data.size(); ++i) - skip[i] = data[i].scalar == rct::zero() || !memcmp(&data[i].point, &ge_p3_identity, sizeof(ge_p3)); + skip[i] = data[i].scalar == rct::zero() || ge_p3_is_point_at_infinity(&data[i].point); MULTIEXP_PERF(PERF_TIMER_STOP(skip)); #endif @@ -611,7 +611,7 @@ rct::key pippenger(const std::vector &data, const std::shared_ptr< for (size_t k = groups; k-- > 0; ) { - if (memcmp(&result, &ge_p3_identity, sizeof(ge_p3))) + if (!ge_p3_is_point_at_infinity(&result)) { ge_p2 p2; ge_p3_to_p2(&p2, &result); @@ -638,7 +638,7 @@ rct::key pippenger(const std::vector &data, const std::shared_ptr< if (bucket == 0) continue; CHECK_AND_ASSERT_THROW_MES(bucket < (1u<cached[i]); } @@ -650,9 +650,9 @@ rct::key pippenger(const std::vector &data, const std::shared_ptr< ge_p3 pail = ge_p3_identity; for (size_t i = (1< 0; --i) { - if (memcmp(&buckets[i], &ge_p3_identity, sizeof(ge_p3))) + if (!ge_p3_is_point_at_infinity(&buckets[i])) add(pail, buckets[i]); - if (memcmp(&pail, &ge_p3_identity, sizeof(ge_p3))) + if (!ge_p3_is_point_at_infinity(&pail)) add(result, pail); } } From 0e6ed559c674a6d945201c70372dde6e0d65d107 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 27 Jul 2018 17:00:48 +0100 Subject: [PATCH 48/56] fuzz_tests: add a bulletproof fuzz test --- contrib/fuzz_testing/fuzz.sh | 6 +-- tests/data/fuzz/bulletproof/BP0 | Bin 0 -> 674 bytes tests/fuzz/CMakeLists.txt | 15 +++++++ tests/fuzz/bulletproof.cpp | 70 ++++++++++++++++++++++++++++++++ 4 files changed, 88 insertions(+), 3 deletions(-) create mode 100644 tests/data/fuzz/bulletproof/BP0 create mode 100644 tests/fuzz/bulletproof.cpp diff --git a/contrib/fuzz_testing/fuzz.sh b/contrib/fuzz_testing/fuzz.sh index f1c4ff202..efd43c231 100755 --- a/contrib/fuzz_testing/fuzz.sh +++ b/contrib/fuzz_testing/fuzz.sh @@ -10,12 +10,12 @@ fi type="$1" if test -z "$type" then - echo "usage: $0 block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin" + echo "usage: $0 block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin|bulletproof" exit 1 fi case "$type" in - block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin) ;; - *) echo "usage: $0 block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin"; exit 1 ;; + block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin|bulletproof) ;; + *) echo "usage: $0 block|transaction|signature|cold-outputs|cold-transaction|load-from-binary|load-from-json|base58|parse-url|http-client|levin|bulletproof"; exit 1 ;; esac if test -d "fuzz-out/$type" diff --git a/tests/data/fuzz/bulletproof/BP0 b/tests/data/fuzz/bulletproof/BP0 new file mode 100644 index 0000000000000000000000000000000000000000..17590b770f6a74ccb1e5065fcbfc4b979033cfff GIT binary patch literal 674 zcmV;T0$u%NxPE*JzbSo!yl8;_<%@E7;r2giX!3#@nHF}2-yz+wfqp|7UR-Qdwj9+b zzCA1#U07b7lAA#mNq&?bjnQ%5NX~;-+@vW>_jHL#6B`fLDMRr~G4Z7+HOcdq{^g>cW0<5H-Txs zK4^_g#!JWQSe6SEjg1uh@>$ribRSaIIv4B`#$HHNU(+&)9-{sr$Z-P(gY>f%HczN- za1u>r^P-gfu0d}oXj61%803yc{grnI+ce515z8NmJGsZgqc*F{cSD9a4_JXrYCEgK z%fU~J??G4(LyRLT^RI)RLH>-2{RZt_&3b>tvmin9NbYfKg>2LXjkZ0h6G>=P`ET*& zIaow&d`@bEw*Y88(e}D&0nva?>R-g?jlXw>y_Coit+~vfKkQ}2lQ*1LLgnUTZlR%L zz&TUwpTi`WrrpG?6{ZANr-8Qo8*}(rEWbzx2GslX-cyLfzVka(l*7S~7FDVQhwsS9 z-tJ3}RYQVg(7>|!YlEm_LUn=EtnEqaT?pVzdl}L*H?^X9{p;_{h12KI`A%;1N_xfW zwtheafYmjZkv7ZvWIiU}7i9>2E_`jlZqsGpb`20yw_I(6-#3eqm-x7dHajrQ3eXdfwg5aH4heiKcz@yZ#LI_3x$jRo zP|8a34cKy3t|62EU5ceKO0?rk{rb{XE1$H1^ZDF0#KpzSwL9&|*G-GN4EBiR+{Y6= zxkyX^?uN1&+RM&m3p*0{1G$wM6rgk14vz;EWFS)LR+Nl#vm1~CqY1M!00p8zEI>r} II8_ht0=-5~!~g&Q literal 0 HcmV?d00001 diff --git a/tests/fuzz/CMakeLists.txt b/tests/fuzz/CMakeLists.txt index dfbbaeca6..fdb745699 100644 --- a/tests/fuzz/CMakeLists.txt +++ b/tests/fuzz/CMakeLists.txt @@ -173,3 +173,18 @@ set_property(TARGET levin_fuzz_tests PROPERTY FOLDER "tests") +add_executable(bulletproof_fuzz_tests bulletproof.cpp fuzzer.cpp) +target_link_libraries(bulletproof_fuzz_tests + PRIVATE + common + epee + ${Boost_THREAD_LIBRARY} + ${Boost_CHRONO_LIBRARY} + ${Boost_REGEX_LIBRARY} + ${Boost_PROGRAM_OPTIONS_LIBRARY} + ${CMAKE_THREAD_LIBS_INIT} + ${EXTRA_LIBRARIES}) +set_property(TARGET bulletproof_fuzz_tests + PROPERTY + FOLDER "tests") + diff --git a/tests/fuzz/bulletproof.cpp b/tests/fuzz/bulletproof.cpp new file mode 100644 index 000000000..2f4dfd0ea --- /dev/null +++ b/tests/fuzz/bulletproof.cpp @@ -0,0 +1,70 @@ +// Copyright (c) 2017-2018, The Monero Project +// +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are +// permitted provided that the following conditions are met: +// +// 1. Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// 2. Redistributions in binary form must reproduce the above copyright notice, this list +// of conditions and the following disclaimer in the documentation and/or other +// materials provided with the distribution. +// +// 3. Neither the name of the copyright holder nor the names of its contributors may be +// used to endorse or promote products derived from this software without specific +// prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY +// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL +// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF +// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#include "include_base_utils.h" +#include "file_io_utils.h" +#include "cryptonote_basic/blobdatatype.h" +#include "cryptonote_basic/cryptonote_basic.h" +#include "cryptonote_basic/cryptonote_format_utils.h" +#include "fuzzer.h" + +class BulletproofFuzzer: public Fuzzer +{ +public: + virtual int run(const std::string &filename); + +private: +}; + +int BulletproofFuzzer::run(const std::string &filename) +{ + std::string s; + + if (!epee::file_io_utils::load_file_to_string(filename, s)) + { + std::cout << "Error: failed to load file " << filename << std::endl; + return 1; + } + std::stringstream ss; + ss << s; + binary_archive ba(ss); + rct::Bulletproof proof = AUTO_VAL_INIT(proof); + bool r = ::serialization::serialize(ba, proof); + if(!r) + { + std::cout << "Error: failed to parse bulletproof from file " << filename << std::endl; + return 1; + } + return 0; +} + +int main(int argc, const char **argv) +{ + BulletproofFuzzer fuzzer; + return run_fuzzer(argc, argv, fuzzer); +} From 1224e53b744f8338163998d06b139a3f7a006b08 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Sun, 29 Jul 2018 14:04:42 +0100 Subject: [PATCH 49/56] core_tests: add a test for 4-aggregated BP verification --- tests/core_tests/bulletproofs.cpp | 9 +++++++++ tests/core_tests/bulletproofs.h | 6 ++++++ tests/core_tests/chaingen_main.cpp | 1 + 3 files changed, 16 insertions(+) diff --git a/tests/core_tests/bulletproofs.cpp b/tests/core_tests/bulletproofs.cpp index aea502faa..db875d2a2 100644 --- a/tests/core_tests/bulletproofs.cpp +++ b/tests/core_tests/bulletproofs.cpp @@ -282,6 +282,15 @@ bool gen_bp_txs_invalid_2_and_8_2_and_16_16_1::generate(std::vector& events) const +{ + const size_t mixin = 10; + const uint64_t amounts_paid[] = {11111115000, 11111115000, (uint64_t)-1, 11111115000, 11111115000, 11111115001, (uint64_t)-1, 11111115000, 11111115002, (uint64_t)-1, 11111115000, 11111115000, 11111115000, 11111115003, (uint64_t)-1}; + const rct::RangeProofType range_proof_type[] = {rct::RangeProofPaddedBulletproof, rct::RangeProofPaddedBulletproof, rct::RangeProofPaddedBulletproof, rct::RangeProofPaddedBulletproof}; + const size_t bp_sizes[] = {2, (size_t)-1, 4, (size_t)-1, 2, (size_t)-1, 4, (size_t)-1}; + return generate_with(events, mixin, 4, amounts_paid, true, range_proof_type, NULL, [&](const cryptonote::transaction &tx, size_t tx_idx) { return check_bp(tx, tx_idx, bp_sizes, "gen_bp_txs_valid_2_and_3_and_2_and_4"); }); +} + bool gen_bp_tx_invalid_not_enough_proofs::generate(std::vector& events) const { DEFINE_TESTS_ERROR_CONTEXT("gen_bp_tx_invalid_not_enough_proofs"); diff --git a/tests/core_tests/bulletproofs.h b/tests/core_tests/bulletproofs.h index c3a7db2c7..e29b34690 100644 --- a/tests/core_tests/bulletproofs.h +++ b/tests/core_tests/bulletproofs.h @@ -156,6 +156,12 @@ struct gen_bp_txs_invalid_2_and_8_2_and_16_16_1 : public gen_bp_tx_validation_ba }; template<> struct get_test_options: public get_test_options {}; +struct gen_bp_txs_valid_2_and_3_and_2_and_4 : public gen_bp_tx_validation_base +{ + bool generate(std::vector& events) const; +}; +template<> struct get_test_options: public get_test_options {}; + struct gen_bp_tx_invalid_not_enough_proofs : public gen_bp_tx_validation_base { bool generate(std::vector& events) const; diff --git a/tests/core_tests/chaingen_main.cpp b/tests/core_tests/chaingen_main.cpp index 6f26e6532..abc412318 100644 --- a/tests/core_tests/chaingen_main.cpp +++ b/tests/core_tests/chaingen_main.cpp @@ -233,6 +233,7 @@ int main(int argc, char* argv[]) GENERATE_AND_PLAY(gen_bp_tx_invalid_16_16); GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_2); GENERATE_AND_PLAY(gen_bp_txs_invalid_2_and_8_2_and_16_16_1); + GENERATE_AND_PLAY(gen_bp_txs_valid_2_and_3_and_2_and_4); GENERATE_AND_PLAY(gen_bp_tx_invalid_not_enough_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_empty_proofs); GENERATE_AND_PLAY(gen_bp_tx_invalid_too_many_proofs); From ce0c7432050fff7e6abcfa7a0bca294208d9b13f Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 3 Aug 2018 21:53:20 +0000 Subject: [PATCH 50/56] performance_tests: add padded bulletproof construction --- tests/performance_tests/construct_tx.h | 4 ++-- tests/performance_tests/main.cpp | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/tests/performance_tests/construct_tx.h b/tests/performance_tests/construct_tx.h index 99c7f1b18..378065ddd 100644 --- a/tests/performance_tests/construct_tx.h +++ b/tests/performance_tests/construct_tx.h @@ -36,7 +36,7 @@ #include "multi_tx_test_base.h" -template +template class test_construct_tx : private multi_tx_test_base { static_assert(0 < a_in_count, "in_count must be greater than 0"); @@ -73,7 +73,7 @@ public: std::vector additional_tx_keys; std::unordered_map subaddresses; subaddresses[this->m_miners[this->real_source_idx].get_keys().m_account_address.m_spend_public_key] = {0,0}; - return cryptonote::construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, m_destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct); + return cryptonote::construct_tx_and_get_tx_key(this->m_miners[this->real_source_idx].get_keys(), subaddresses, this->m_sources, m_destinations, cryptonote::account_public_address{}, std::vector(), m_tx, 0, tx_key, additional_tx_keys, rct, range_proof_type); } private: diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index 6007242bf..d83486296 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -132,6 +132,18 @@ int main(int argc, char** argv) TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 2, true); TEST_PERFORMANCE3(filter, p, test_construct_tx, 100, 10, true); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 2, 1, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 2, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 2, 10, true, rct::RangeProofPaddedBulletproof); + + TEST_PERFORMANCE4(filter, p, test_construct_tx, 10, 1, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 10, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 10, 10, true, rct::RangeProofPaddedBulletproof); + + TEST_PERFORMANCE4(filter, p, test_construct_tx, 100, 1, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 100, 2, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE4(filter, p, test_construct_tx, 100, 10, true, rct::RangeProofPaddedBulletproof); + TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 1, 2, false); TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 2, 2, false); TEST_PERFORMANCE3(filter, p, test_check_tx_signature, 10, 2, false); From c83012c47654d05ca6b045c3942d3e57da6ad199 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 6 Aug 2018 10:09:46 +0000 Subject: [PATCH 51/56] bulletproofs: match aggregated verification to sarang's latest prototype --- src/ringct/bulletproofs.cc | 103 ++++++++++++++----------------------- 1 file changed, 39 insertions(+), 64 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 2964fc469..acf0dc36e 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -1029,6 +1029,8 @@ bool bulletproof_VERIFY(const std::vector &proofs) rct::key Z2 = rct::identity(); rct::key z3 = rct::zero(); rct::keyV z4(maxMN, rct::zero()), z5(maxMN, rct::zero()); + rct::key Y2 = rct::identity(), Y3 = rct::identity(), Y4 = rct::identity(); + rct::key y0 = rct::zero(), y1 = rct::zero(); for (const Bulletproof *p: proofs) { const Bulletproof &proof = *p; @@ -1054,8 +1056,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) PERF_TIMER_START_BP(VERIFY_line_61); // PAPER LINE 61 - rct::key L61Left, L61Right; - rct::addKeys2(L61Left, proof.taux, proof.t, rct::H); + sc_muladd(y0.bytes, proof.taux.bytes, weight.bytes, y0.bytes); const rct::keyV zpow = vector_powers(z, M+3); @@ -1069,64 +1070,26 @@ bool bulletproof_VERIFY(const std::vector &proofs) } PERF_TIMER_STOP(VERIFY_line_61); - // bos coster is slower for small numbers of calcs, straus seems not - if (1) + PERF_TIMER_START_BP(VERIFY_line_61rl_new); + sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); + std::vector multiexp_data; + multiexp_data.reserve(proof.V.size()); + sc_sub(tmp.bytes, proof.t.bytes, tmp.bytes); + sc_muladd(y1.bytes, tmp.bytes, weight.bytes, y1.bytes); + for (size_t j = 0; j < proof.V.size(); j++) { - PERF_TIMER_START_BP(VERIFY_line_61rl_new); - sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); - std::vector multiexp_data; - multiexp_data.reserve(3+proof.V.size()); - multiexp_data.emplace_back(tmp, ge_p3_H); - for (size_t j = 0; j < proof.V.size(); j++) - { - multiexp_data.emplace_back(zpow[j+2], proof.V[j]); - } - multiexp_data.emplace_back(x, proof.T1); - rct::key xsq; - sc_mul(xsq.bytes, x.bytes, x.bytes); - multiexp_data.emplace_back(xsq, proof.T2); - L61Right = multiexp(multiexp_data, false); - PERF_TIMER_STOP(VERIFY_line_61rl_new); + multiexp_data.emplace_back(zpow[j+2], proof.V[j]); } - else - { - PERF_TIMER_START_BP(VERIFY_line_61rl_old); - sc_muladd(tmp.bytes, z.bytes, ip1y.bytes, k.bytes); - L61Right = rct::scalarmultH(tmp); - ge_p3 L61Right_p3; - CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&L61Right_p3, L61Right.bytes) == 0, "ge_frombytes_vartime failed"); - for (size_t j = 0; j+1 < proof.V.size(); j += 2) - { - CHECK_AND_ASSERT_MES(j+2+1 < zpow.size(), false, "invalid zpow index"); - ge_dsmp precomp0, precomp1; - rct::precomp(precomp0, j < proof.V.size() ? proof.V[j] : rct::identity()); - rct::precomp(precomp1, j+1 < proof.V.size() ? proof.V[j+1] : rct::identity()); - rct::addKeys3acc_p3(&L61Right_p3, zpow[j+2], precomp0, zpow[j+2+1], precomp1); - } - for (size_t j = proof.V.size() & 0xfffffffe; j < M; j++) - { - CHECK_AND_ASSERT_MES(j+2 < zpow.size(), false, "invalid zpow index"); - // faster equivalent to: - // tmp = rct::scalarmultKey(j < proof.V.size() ? proof.V[j] : rct::identity(), zpow[j+2]); - // rct::addKeys(L61Right, L61Right, tmp); - if (j < proof.V.size()) - addKeys_acc_p3(&L61Right_p3, zpow[j+2], proof.V[j]); - } + rct::key temp = multiexp(multiexp_data, false); - addKeys_acc_p3(&L61Right_p3, x, proof.T1); - - rct::key xsq; - sc_mul(xsq.bytes, x.bytes, x.bytes); - addKeys_acc_p3(&L61Right_p3, xsq, proof.T2); - ge_p3_tobytes(L61Right.bytes, &L61Right_p3); - PERF_TIMER_STOP(VERIFY_line_61rl_old); - } - - if (!(L61Right == L61Left)) - { - MERROR("Verification failure at step 1"); - return false; - } + rct::addKeys(Y2, Y2, rct::scalarmultKey(temp, weight)); + sc_mul(tmp.bytes, x.bytes, weight.bytes); + rct::addKeys(Y3, Y3, rct::scalarmultKey(proof.T1, tmp)); + rct::key xsq; + sc_mul(xsq.bytes, x.bytes, x.bytes); + sc_mul(tmp.bytes, xsq.bytes, weight.bytes); + rct::addKeys(Y4, Y4, rct::scalarmultKey(proof.T2, tmp)); + PERF_TIMER_STOP(VERIFY_line_61rl_new); PERF_TIMER_START_BP(VERIFY_line_62); // PAPER LINE 62 @@ -1206,7 +1169,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) // PAPER LINE 26 PERF_TIMER_START_BP(VERIFY_line_26_new); - std::vector multiexp_data; + multiexp_data.clear(); multiexp_data.reserve(2*rounds); sc_muladd(z1.bytes, proof.mu.bytes, weight.bytes, z1.bytes); @@ -1227,11 +1190,23 @@ bool bulletproof_VERIFY(const std::vector &proofs) // now check all proofs at once PERF_TIMER_START_BP(VERIFY_step2_check); - rct::key Y = Z0; + rct::key check1 = rct::identity(); + rct::addKeys(check1, check1, rct::scalarmultBase(y0)); + rct::addKeys(check1, check1, rct::scalarmultH(y1)); + rct::subKeys(check1, check1, Y2); + rct::subKeys(check1, check1, Y3); + rct::subKeys(check1, check1, Y4); + if (!(check1 == rct::identity())) + { + MERROR("Verification failure at step 1"); + return false; + } + rct::key check2 = rct::identity(); + rct::addKeys(check2, check2, Z0); sc_sub(tmp.bytes, rct::zero().bytes, z1.bytes); - rct::addKeys(Y, Y, rct::scalarmultBase(tmp)); - rct::addKeys(Y, Y, Z2); - rct::addKeys(Y, Y, rct::scalarmultH(z3)); + rct::addKeys(check2, check2, rct::scalarmultBase(tmp)); + rct::addKeys(check2, check2, Z2); + rct::addKeys(check2, check2, rct::scalarmultH(z3)); std::vector multiexp_data; multiexp_data.reserve(2 * maxMN); @@ -1242,10 +1217,10 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_sub(tmp.bytes, rct::zero().bytes, z5[i].bytes); multiexp_data.emplace_back(tmp, Hi_p3[i]); } - rct::addKeys(Y, Y, multiexp(multiexp_data, true)); + rct::addKeys(check2, check2, multiexp(multiexp_data, true)); PERF_TIMER_STOP(VERIFY_step2_check); - if (!(Y == rct::identity())) + if (!(check2 == rct::identity())) { MERROR("Verification failure at step 2"); return false; From 044dff5a30deb05f5236f36ebae5e671d15ddb4e Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 6 Aug 2018 11:05:20 +0000 Subject: [PATCH 52/56] bulletproofs: scale points by 8 to ensure subgroup validity --- .../cryptonote_format_utils.cpp | 2 +- src/ringct/bulletproofs.cc | 44 ++++++++++++------- src/ringct/rctOps.h | 2 + src/ringct/rctSigs.cpp | 4 +- 4 files changed, 33 insertions(+), 19 deletions(-) diff --git a/src/cryptonote_basic/cryptonote_format_utils.cpp b/src/cryptonote_basic/cryptonote_format_utils.cpp index 9061bf105..7ea4718d2 100644 --- a/src/cryptonote_basic/cryptonote_format_utils.cpp +++ b/src/cryptonote_basic/cryptonote_format_utils.cpp @@ -169,7 +169,7 @@ namespace cryptonote CHECK_AND_ASSERT_MES(n_amounts == rv.outPk.size(), false, "Internal error filling out V"); rv.p.bulletproofs[0].V.resize(n_amounts); for (size_t i = 0; i < n_amounts; ++i) - rv.p.bulletproofs[0].V[i] = rv.outPk[i].mask; + rv.p.bulletproofs[0].V[i] = rct::scalarmultKey(rv.outPk[i].mask, rct::INV_EIGHT); } } } diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index acf0dc36e..5bcdd968d 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -67,6 +67,8 @@ static ge_p3 Hi_p3[maxN*maxM], Gi_p3[maxN*maxM]; static std::shared_ptr straus_HiGi_cache; static std::shared_ptr pippenger_HiGi_cache; static const rct::key TWO = { {0x02, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; +static const rct::key MINUS_ONE = { { 0xec, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 } }; +static const rct::key MINUS_INV_EIGHT = { { 0x74, 0xa4, 0x19, 0x7a, 0xf0, 0x7d, 0x0b, 0xf7, 0x05, 0xc2, 0xda, 0x25, 0x2b, 0x5c, 0x0b, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a } }; static const rct::keyV oneN = vector_dup(rct::identity(), maxN); static const rct::keyV twoN = vector_powers(TWO, maxN); static const rct::key ip12 = inner_product(oneN, twoN); @@ -440,6 +442,7 @@ Bulletproof bulletproof_PROVE(const rct::key &sv, const rct::key &gamma) PERF_TIMER_START_BP(PROVE_v); rct::addKeys2(V, gamma, sv, rct::H); + V = rct::scalarmultKey(V, INV_EIGHT); PERF_TIMER_STOP(PROVE_v); PERF_TIMER_START_BP(PROVE_aLaR); @@ -482,6 +485,7 @@ try_again: rct::key ve = vector_exponent(aL, aR); rct::key A; rct::addKeys(A, ve, rct::scalarmultBase(alpha)); + A = rct::scalarmultKey(A, INV_EIGHT); // PAPER LINES 40-42 rct::keyV sL = rct::skvGen(N), sR = rct::skvGen(N); @@ -489,6 +493,7 @@ try_again: ve = vector_exponent(sL, sR); rct::key S; rct::addKeys(S, ve, rct::scalarmultBase(rho)); + S = rct::scalarmultKey(S, INV_EIGHT); // PAPER LINES 43-45 rct::key y = hash_cache_mash(hash_cache, A, S); @@ -563,7 +568,9 @@ try_again: rct::key tau1 = rct::skGen(), tau2 = rct::skGen(); rct::key T1 = rct::addKeys(rct::scalarmultH(t1), rct::scalarmultBase(tau1)); + T1 = rct::scalarmultKey(T1, INV_EIGHT); rct::key T2 = rct::addKeys(rct::scalarmultH(t2), rct::scalarmultBase(tau2)); + T2 = rct::scalarmultKey(T2, INV_EIGHT); // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); @@ -640,9 +647,11 @@ try_again: L[round] = vector_exponent_custom(slice(Gprime, nprime, Gprime.size()), slice(Hprime, 0, nprime), slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); sc_mul(tmp.bytes, cL.bytes, x_ip.bytes); rct::addKeys(L[round], L[round], rct::scalarmultH(tmp)); + L[round] = rct::scalarmultKey(L[round], INV_EIGHT); R[round] = vector_exponent_custom(slice(Gprime, 0, nprime), slice(Hprime, nprime, Hprime.size()), slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); sc_mul(tmp.bytes, cR.bytes, x_ip.bytes); rct::addKeys(R[round], R[round], rct::scalarmultH(tmp)); + R[round] = rct::scalarmultKey(R[round], INV_EIGHT); // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); @@ -715,7 +724,10 @@ Bulletproof bulletproof_PROVE(const rct::keyV &sv, const rct::keyV &gamma) PERF_TIMER_START_BP(PROVE_v); for (size_t i = 0; i < sv.size(); ++i) + { rct::addKeys2(V[i], gamma[i], sv[i], rct::H); + V[i] = rct::scalarmultKey(V[i], INV_EIGHT); + } PERF_TIMER_STOP(PROVE_v); PERF_TIMER_START_BP(PROVE_aLaR); @@ -769,6 +781,7 @@ try_again: rct::key ve = vector_exponent(aL, aR); rct::key A; rct::addKeys(A, ve, rct::scalarmultBase(alpha)); + A = rct::scalarmultKey(A, INV_EIGHT); // PAPER LINES 40-42 rct::keyV sL = rct::skvGen(MN), sR = rct::skvGen(MN); @@ -776,6 +789,7 @@ try_again: ve = vector_exponent(sL, sR); rct::key S; rct::addKeys(S, ve, rct::scalarmultBase(rho)); + S = rct::scalarmultKey(S, INV_EIGHT); // PAPER LINES 43-45 rct::key y = hash_cache_mash(hash_cache, A, S); @@ -835,7 +849,9 @@ try_again: rct::key tau1 = rct::skGen(), tau2 = rct::skGen(); rct::key T1 = rct::addKeys(rct::scalarmultH(t1), rct::scalarmultBase(tau1)); + T1 = rct::scalarmultKey(T1, INV_EIGHT); rct::key T2 = rct::addKeys(rct::scalarmultH(t2), rct::scalarmultBase(tau2)); + T2 = rct::scalarmultKey(T2, INV_EIGHT); // PAPER LINES 49-51 rct::key x = hash_cache_mash(hash_cache, z, T1, T2); @@ -925,9 +941,11 @@ try_again: L[round] = vector_exponent_custom(slice(Gprime, nprime, Gprime.size()), slice(Hprime, 0, nprime), slice(aprime, 0, nprime), slice(bprime, nprime, bprime.size())); sc_mul(tmp.bytes, cL.bytes, x_ip.bytes); rct::addKeys(L[round], L[round], rct::scalarmultH(tmp)); + L[round] = rct::scalarmultKey(L[round], INV_EIGHT); R[round] = vector_exponent_custom(slice(Gprime, 0, nprime), slice(Hprime, nprime, Hprime.size()), slice(aprime, nprime, aprime.size()), slice(bprime, 0, nprime)); sc_mul(tmp.bytes, cR.bytes, x_ip.bytes); rct::addKeys(R[round], R[round], rct::scalarmultH(tmp)); + R[round] = rct::scalarmultKey(R[round], INV_EIGHT); // PAPER LINES 21-22 w[round] = hash_cache_mash(hash_cache, L[round], R[round]); @@ -991,18 +1009,6 @@ bool bulletproof_VERIFY(const std::vector &proofs) { const Bulletproof &proof = *p; - // check subgroup - for (const rct::key &k: proof.V) - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); - for (const rct::key &k: proof.L) - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); - for (const rct::key &k: proof.R) - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(k), false, "Input point not in subgroup"); - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.A), false, "Input point not in subgroup"); - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.S), false, "Input point not in subgroup"); - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T1), false, "Input point not in subgroup"); - CHECK_AND_ASSERT_MES(rct::isInMainSubgroup(proof.T2), false, "Input point not in subgroup"); - // check scalar range CHECK_AND_ASSERT_MES(is_reduced(proof.taux), false, "Input scalar not in range"); CHECK_AND_ASSERT_MES(is_reduced(proof.mu), false, "Input scalar not in range"); @@ -1078,22 +1084,26 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_muladd(y1.bytes, tmp.bytes, weight.bytes, y1.bytes); for (size_t j = 0; j < proof.V.size(); j++) { - multiexp_data.emplace_back(zpow[j+2], proof.V[j]); + sc_mul(tmp.bytes, zpow[j+2].bytes, EIGHT.bytes); + multiexp_data.emplace_back(tmp, proof.V[j]); } rct::key temp = multiexp(multiexp_data, false); rct::addKeys(Y2, Y2, rct::scalarmultKey(temp, weight)); - sc_mul(tmp.bytes, x.bytes, weight.bytes); + rct::key weight8; + sc_mul(weight8.bytes, weight.bytes, EIGHT.bytes); + sc_mul(tmp.bytes, x.bytes, weight8.bytes); rct::addKeys(Y3, Y3, rct::scalarmultKey(proof.T1, tmp)); rct::key xsq; sc_mul(xsq.bytes, x.bytes, x.bytes); - sc_mul(tmp.bytes, xsq.bytes, weight.bytes); + sc_mul(tmp.bytes, xsq.bytes, weight8.bytes); rct::addKeys(Y4, Y4, rct::scalarmultKey(proof.T2, tmp)); PERF_TIMER_STOP(VERIFY_line_61rl_new); PERF_TIMER_START_BP(VERIFY_line_62); // PAPER LINE 62 - rct::addKeys(Z0, Z0, rct::scalarmultKey(rct::addKeys(proof.A, rct::scalarmultKey(proof.S, x)), weight)); + sc_mul(tmp.bytes, x.bytes, EIGHT.bytes); + rct::addKeys(Z0, Z0, rct::scalarmultKey(rct::addKeys(rct::scalarmultKey(proof.A, EIGHT), rct::scalarmultKey(proof.S, tmp)), weight)); PERF_TIMER_STOP(VERIFY_line_62); // Compute the number of rounds for the inner product @@ -1176,8 +1186,10 @@ bool bulletproof_VERIFY(const std::vector &proofs) for (size_t i = 0; i < rounds; ++i) { sc_mul(tmp.bytes, w[i].bytes, w[i].bytes); + sc_mul(tmp.bytes, tmp.bytes, EIGHT.bytes); multiexp_data.emplace_back(tmp, proof.L[i]); sc_mul(tmp.bytes, winv[i].bytes, winv[i].bytes); + sc_mul(tmp.bytes, tmp.bytes, EIGHT.bytes); multiexp_data.emplace_back(tmp, proof.R[i]); } rct::key acc = multiexp(multiexp_data, false); diff --git a/src/ringct/rctOps.h b/src/ringct/rctOps.h index f0320f333..53c8e1d01 100644 --- a/src/ringct/rctOps.h +++ b/src/ringct/rctOps.h @@ -63,6 +63,8 @@ namespace rct { static const key I = { {0x01, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; static const key L = { {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 } }; static const key G = { {0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66 } }; + static const key EIGHT = { {0x08, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 , 0x00, 0x00, 0x00,0x00 } }; + static const key INV_EIGHT = { { 0x79, 0x2f, 0xdc, 0xe2, 0x29, 0xe5, 0x06, 0x61, 0xd0, 0xda, 0x1c, 0x7d, 0xb3, 0x9d, 0xd3, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06 } }; //Creates a zero scalar inline key zero() { return Z; } diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index e98e62903..29743c790 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -768,7 +768,7 @@ namespace rct { #endif for (i = 0; i < outamounts.size(); ++i) { - rv.outPk[i].mask = C[i]; + rv.outPk[i].mask = rct::scalarmultKey(C[i], EIGHT); outSk[i].mask = masks[i]; } } @@ -788,7 +788,7 @@ namespace rct { #endif for (i = 0; i < batch_size; ++i) { - rv.outPk[i + amounts_proved].mask = C[i]; + rv.outPk[i + amounts_proved].mask = rct::scalarmultKey(C[i], EIGHT); outSk[i + amounts_proved].mask = masks[i]; } amounts_proved += batch_size; From 2bf636503fa09346b02964b2903ca70579f94c6b Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Mon, 6 Aug 2018 15:21:07 +0000 Subject: [PATCH 53/56] bulletproofs: speed up the latest changes a bit --- src/ringct/bulletproofs.cc | 70 +++++++++++++++------------- src/ringct/rctOps.cpp | 14 ++++++ src/ringct/rctOps.h | 2 + src/ringct/rctSigs.cpp | 4 +- tests/performance_tests/crypto_ops.h | 4 ++ tests/performance_tests/main.cpp | 2 + tests/unit_tests/ringct.cpp | 7 +++ 7 files changed, 68 insertions(+), 35 deletions(-) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 5bcdd968d..165691bfe 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -92,21 +92,6 @@ static bool is_reduced(const rct::key &scalar) return scalar == reduced; } -//addKeys3acc_p3 -//aAbB += a*A + b*B where a, b are scalars, A, B are curve points -//A and B must be input after applying "precomp" -static void addKeys3acc_p3(ge_p3 *aAbB, const key &a, const ge_dsmp A, const key &b, const ge_dsmp B) -{ - ge_p3 rv; - ge_p1p1 p1; - ge_p2 p2; - ge_double_scalarmult_precomp_vartime2_p3(&rv, a.bytes, A, b.bytes, B); - ge_cached cached; - ge_p3_to_cached(&cached, aAbB); - ge_add(&p1, &rv, &cached); - ge_p1p1_to_p3(aAbB, &p1); -} - static void addKeys_acc_p3(ge_p3 *acc_p3, const rct::key &a, const rct::key &point) { ge_p3 p3; @@ -119,6 +104,28 @@ static void addKeys_acc_p3(ge_p3 *acc_p3, const rct::key &a, const rct::key &poi ge_p1p1_to_p3(acc_p3, &p1); } +static void add_acc_p3(ge_p3 *acc_p3, const rct::key &point) +{ + ge_p3 p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&p3, point.bytes) == 0, "ge_frombytes_vartime failed"); + ge_cached cached; + ge_p3_to_cached(&cached, &p3); + ge_p1p1 p1; + ge_add(&p1, acc_p3, &cached); + ge_p1p1_to_p3(acc_p3, &p1); +} + +static void sub_acc_p3(ge_p3 *acc_p3, const rct::key &point) +{ + ge_p3 p3; + CHECK_AND_ASSERT_THROW_MES(ge_frombytes_vartime(&p3, point.bytes) == 0, "ge_frombytes_vartime failed"); + ge_cached cached; + ge_p3_to_cached(&cached, &p3); + ge_p1p1 p1; + ge_sub(&p1, acc_p3, &cached); + ge_p1p1_to_p3(acc_p3, &p1); +} + static rct::key scalarmultKey(const ge_p3 &P, const rct::key &a) { ge_p2 R; @@ -1087,9 +1094,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_mul(tmp.bytes, zpow[j+2].bytes, EIGHT.bytes); multiexp_data.emplace_back(tmp, proof.V[j]); } - rct::key temp = multiexp(multiexp_data, false); - - rct::addKeys(Y2, Y2, rct::scalarmultKey(temp, weight)); + rct::addKeys(Y2, Y2, rct::scalarmultKey(multiexp(multiexp_data, false), weight)); rct::key weight8; sc_mul(weight8.bytes, weight.bytes, EIGHT.bytes); sc_mul(tmp.bytes, x.bytes, weight8.bytes); @@ -1103,7 +1108,7 @@ bool bulletproof_VERIFY(const std::vector &proofs) PERF_TIMER_START_BP(VERIFY_line_62); // PAPER LINE 62 sc_mul(tmp.bytes, x.bytes, EIGHT.bytes); - rct::addKeys(Z0, Z0, rct::scalarmultKey(rct::addKeys(rct::scalarmultKey(proof.A, EIGHT), rct::scalarmultKey(proof.S, tmp)), weight)); + rct::addKeys(Z0, Z0, rct::scalarmultKey(rct::addKeys(rct::scalarmult8(proof.A), rct::scalarmultKey(proof.S, tmp)), weight)); PERF_TIMER_STOP(VERIFY_line_62); // Compute the number of rounds for the inner product @@ -1202,23 +1207,22 @@ bool bulletproof_VERIFY(const std::vector &proofs) // now check all proofs at once PERF_TIMER_START_BP(VERIFY_step2_check); - rct::key check1 = rct::identity(); - rct::addKeys(check1, check1, rct::scalarmultBase(y0)); - rct::addKeys(check1, check1, rct::scalarmultH(y1)); - rct::subKeys(check1, check1, Y2); - rct::subKeys(check1, check1, Y3); - rct::subKeys(check1, check1, Y4); - if (!(check1 == rct::identity())) + ge_p3 check1; + ge_scalarmult_base(&check1, y0.bytes); + addKeys_acc_p3(&check1, y1, rct::H); + sub_acc_p3(&check1, Y2); + sub_acc_p3(&check1, Y3); + sub_acc_p3(&check1, Y4); + if (!ge_p3_is_point_at_infinity(&check1)) { MERROR("Verification failure at step 1"); return false; } - rct::key check2 = rct::identity(); - rct::addKeys(check2, check2, Z0); + ge_p3 check2; sc_sub(tmp.bytes, rct::zero().bytes, z1.bytes); - rct::addKeys(check2, check2, rct::scalarmultBase(tmp)); - rct::addKeys(check2, check2, Z2); - rct::addKeys(check2, check2, rct::scalarmultH(z3)); + ge_double_scalarmult_base_vartime_p3(&check2, z3.bytes, &ge_p3_H, tmp.bytes); + add_acc_p3(&check2, Z0); + add_acc_p3(&check2, Z2); std::vector multiexp_data; multiexp_data.reserve(2 * maxMN); @@ -1229,10 +1233,10 @@ bool bulletproof_VERIFY(const std::vector &proofs) sc_sub(tmp.bytes, rct::zero().bytes, z5[i].bytes); multiexp_data.emplace_back(tmp, Hi_p3[i]); } - rct::addKeys(check2, check2, multiexp(multiexp_data, true)); + add_acc_p3(&check2, multiexp(multiexp_data, true)); PERF_TIMER_STOP(VERIFY_step2_check); - if (!(check2 == rct::identity())) + if (!ge_p3_is_point_at_infinity(&check2)) { MERROR("Verification failure at step 2"); return false; diff --git a/src/ringct/rctOps.cpp b/src/ringct/rctOps.cpp index df027f4b6..6c3c4500e 100644 --- a/src/ringct/rctOps.cpp +++ b/src/ringct/rctOps.cpp @@ -211,6 +211,20 @@ namespace rct { return aP; } + //Computes 8P + key scalarmult8(const key & P) { + ge_p3 p3; + CHECK_AND_ASSERT_THROW_MES_L1(ge_frombytes_vartime(&p3, P.bytes) == 0, "ge_frombytes_vartime failed at "+boost::lexical_cast(__LINE__)); + ge_p2 p2; + ge_p3_to_p2(&p2, &p3); + ge_p1p1 p1; + ge_mul8(&p1, &p2); + ge_p1p1_to_p2(&p2, &p1); + rct::key res; + ge_tobytes(res.bytes, &p2); + return res; + } + //Computes aL where L is the curve order bool isInMainSubgroup(const key & a) { ge_p3 p3; diff --git a/src/ringct/rctOps.h b/src/ringct/rctOps.h index 53c8e1d01..50645821c 100644 --- a/src/ringct/rctOps.h +++ b/src/ringct/rctOps.h @@ -122,6 +122,8 @@ namespace rct { key scalarmultKey(const key &P, const key &a); //Computes aH where H= toPoint(cn_fast_hash(G)), G the basepoint key scalarmultH(const key & a); + // multiplies a point by 8 + key scalarmult8(const key & P); // checks a is in the main subgroup (ie, not a small one) bool isInMainSubgroup(const key & a); diff --git a/src/ringct/rctSigs.cpp b/src/ringct/rctSigs.cpp index 29743c790..fe0cd9c57 100644 --- a/src/ringct/rctSigs.cpp +++ b/src/ringct/rctSigs.cpp @@ -768,7 +768,7 @@ namespace rct { #endif for (i = 0; i < outamounts.size(); ++i) { - rv.outPk[i].mask = rct::scalarmultKey(C[i], EIGHT); + rv.outPk[i].mask = rct::scalarmult8(C[i]); outSk[i].mask = masks[i]; } } @@ -788,7 +788,7 @@ namespace rct { #endif for (i = 0; i < batch_size; ++i) { - rv.outPk[i + amounts_proved].mask = rct::scalarmultKey(C[i], EIGHT); + rv.outPk[i + amounts_proved].mask = rct::scalarmult8(C[i]); outSk[i + amounts_proved].mask = masks[i]; } amounts_proved += batch_size; diff --git a/tests/performance_tests/crypto_ops.h b/tests/performance_tests/crypto_ops.h index f52faa708..3c68583c5 100644 --- a/tests/performance_tests/crypto_ops.h +++ b/tests/performance_tests/crypto_ops.h @@ -45,6 +45,8 @@ enum test_op op_addKeys, op_scalarmultBase, op_scalarmultKey, + op_scalarmultH, + op_scalarmult8, op_ge_double_scalarmult_base_vartime, op_ge_double_scalarmult_precomp_vartime, op_ge_double_scalarmult_precomp_vartime2, @@ -97,6 +99,8 @@ public: case op_addKeys: rct::addKeys(key, point0, point1); break; case op_scalarmultBase: rct::scalarmultBase(scalar0); break; case op_scalarmultKey: rct::scalarmultKey(point0, scalar0); break; + case op_scalarmultH: rct::scalarmultH(scalar0); break; + case op_scalarmult8: rct::scalarmult8(point0); break; case op_ge_double_scalarmult_base_vartime: ge_double_scalarmult_base_vartime(&tmp_p2, scalar0.bytes, &p3_0, scalar1.bytes); break; case op_ge_double_scalarmult_precomp_vartime: ge_double_scalarmult_precomp_vartime(&tmp_p2, scalar0.bytes, &p3_0, scalar1.bytes, precomp0); break; case op_ge_double_scalarmult_precomp_vartime2: ge_double_scalarmult_precomp_vartime2(&tmp_p2, scalar0.bytes, precomp0, scalar1.bytes, precomp1); break; diff --git a/tests/performance_tests/main.cpp b/tests/performance_tests/main.cpp index d83486296..7c5135c65 100644 --- a/tests/performance_tests/main.cpp +++ b/tests/performance_tests/main.cpp @@ -247,6 +247,8 @@ int main(int argc, char** argv) TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_addKeys); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmultBase); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmultKey); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmultH); + TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_scalarmult8); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_base_vartime); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime); TEST_PERFORMANCE1(filter, p, test_crypto_ops, op_ge_double_scalarmult_precomp_vartime2); diff --git a/tests/unit_tests/ringct.cpp b/tests/unit_tests/ringct.cpp index 360529b9e..3877ef785 100644 --- a/tests/unit_tests/ringct.cpp +++ b/tests/unit_tests/ringct.cpp @@ -1093,6 +1093,13 @@ TEST(ringct, H) ASSERT_EQ(memcmp(&p3, &ge_p3_H, sizeof(ge_p3)), 0); } +TEST(ringct, mul8) +{ + ASSERT_EQ(rct::scalarmult8(rct::identity()), rct::identity()); + ASSERT_EQ(rct::scalarmult8(rct::H), rct::scalarmultKey(rct::H, rct::EIGHT)); + ASSERT_EQ(rct::scalarmultKey(rct::scalarmultKey(rct::H, rct::INV_EIGHT), rct::EIGHT), rct::H); +} + TEST(ringct, aggregated) { static const size_t N_PROOFS = 16; From 8f418a6db0953d7a1d0c1dfa24d79f59cef618b7 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 21 Aug 2018 15:28:06 +0000 Subject: [PATCH 54/56] bulletproofs: #include Apparently needed for openssl 1.1.x --- src/ringct/bulletproofs.cc | 1 + 1 file changed, 1 insertion(+) diff --git a/src/ringct/bulletproofs.cc b/src/ringct/bulletproofs.cc index 165691bfe..abe4ef18d 100644 --- a/src/ringct/bulletproofs.cc +++ b/src/ringct/bulletproofs.cc @@ -30,6 +30,7 @@ #include #include +#include #include #include "misc_log_ex.h" #include "common/perf_timer.h" From ac4f71c200d24613ae9abdc35756e64672114cba Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Fri, 24 Aug 2018 11:05:03 +0000 Subject: [PATCH 55/56] wallet2: bump testnet rollback to account for coming reorg --- src/wallet/wallet2.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp index 9b977350e..a50a88b59 100644 --- a/src/wallet/wallet2.cpp +++ b/src/wallet/wallet2.cpp @@ -9994,7 +9994,7 @@ uint64_t wallet2::get_approximate_blockchain_height() const // Calculated blockchain height uint64_t approx_blockchain_height = fork_block + (time(NULL) - fork_time)/seconds_per_block; // testnet got some huge rollbacks, so the estimation is way off - static const uint64_t approximate_testnet_rolled_back_blocks = 148540; + static const uint64_t approximate_testnet_rolled_back_blocks = 303967; if (m_nettype == TESTNET && approx_blockchain_height > approximate_testnet_rolled_back_blocks) approx_blockchain_height -= approximate_testnet_rolled_back_blocks; LOG_PRINT_L2("Calculated blockchain height: " << approx_blockchain_height); From 9137ad2c635daa63d1ff804a0646457a5238d8b1 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 21 Aug 2018 22:53:07 +0000 Subject: [PATCH 56/56] blockchain: add a testnet v9 a day after v8 So that bulletproofs become mandatory --- src/cryptonote_core/blockchain.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index 6fe4a287f..b20fe9869 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -132,6 +132,7 @@ static const struct { { 6, 971400, 0, 1501709789 }, { 7, 1057027, 0, 1512211236 }, { 8, 1057058, 0, 1515967497 }, + { 9, 1057778, 0, 1515967498 }, }; static const uint64_t testnet_hard_fork_version_1_till = 624633;