layerxcom/zero-chain

A privacy-preserving blockchain on Substrate

Zerochain

Zerochain is a generic privacy-protecting layer on top of Substrate. It provides some useful substrate modules and toolkit for protecting user's privacy and sensitive data stored on chain. It is designed to get efficient zero-knowledge proving, reduce the on-chain storage cost and bring the flexibility for developing applications.

Have a look at Zerochain Book for usage and more information about using Zerochain.

Status

WARNING: Zerochain is alpha quality software, improvements and fixes are made frequently.

For now, only supported for the PoC of confidential payment inspired by Zether paper.

• Balance for each account is encrypted

• Transfer amount is encrypted

More features will be added... 💪💪

Initial Setup

curl https://sh.rustup.rs -sSf | sh

rustup update stable
rustup update nightly
rustup target add wasm32-unknown-unknown --toolchain nightly
cargo +nightly install --git https://github.com/alexcrichton/wasm-gc

You will also need to install the following packages:

• Mac:

brew install cmake pkg-config openssl git llvm

• Linux:

sudo apt install cmake pkg-config libssl-dev git clang libclang-dev

Building

git clone [email protected]:LayerXcom/zero-chain.git
cd zero-chain
./build.sh
cargo build --release

Usage and Tutorial

Documented in Zerochain Book.

Related Repositories

• polkadot.rs: JSON-RPC Client for Substrate API
• ZFace (in same repo currently): An interface for interacting with Zerochain
• librustzcash for zerochain: zcash's toolchains for Zerochain

Documentations

• (Work in progress) Zerochain Book
• Announcing Zerochain: Applying zk-SNARKs to Substrate
• (Slide) Zerochain: A privacy-protecting layer on top of Substrate
• (Slide) Zerochain: A privacy layer for blockchain

References

• Substrate repo
• Substrate Developer Hub
• Zcash Protocol Specification
• Zether: Towards Privacy in a Smart Contract World
• Sonic: Zero-Knowledge SNARKs from Linear-Size Universal and Updatable Structured Reference Strings

Contributing

• Feel free to submit your own issues and PRs
• For further discussions and questions talk to us on Gitter

Maintainers

• Osuke

zero-chain's Issues

Apply no_std mode

Add tests of primitives

Add tests of primitives
https://github.com/LayerXcom/zero-chain/blob/master/proofs/src/primitives/mod.rs

Consider the bit length of ElGamal-encrypted value

In order to decrypt the lifted-Elgamal encryption, it is needed to solve the discrete logarithm.
That is why the decryption is inefficiency. Needed to consider the bit length depending on computational times.

zero-chain/crypto/src/elgamal.rs

Lines 61 to 66 in 8cdf89f

	// for i in 0..u32::MAX {
	for i in 0..1000 { // FIXME:
	if find_point(i, &v_point, p_g, params) {
	return Some(i);
	}
	}

Update the substrate `runtime` and `src`

Currently, the part of node-template is outdated.
Needed update in order to build and run substrate's chain.

Gav said the version of node-template would be freezed in a couple of weeks.

Ref:
https://github.com/paritytech/substrate/tree/master/node-template

Fix key agreement

Update key agreement process for Ed25519 that is used in substrate key store.
I can not use below one because of lack of adopting Ed25519 algorithm, only X25519.
https://briansmith.org/rustdoc/ring/agreement/fn.agree_ephemeral.html

Here is the key exchange algorithm for Ed25519.
https://github.com/DaGenix/rust-crypto/blob/master/src/ed25519.rs#L132-L151

But I need to adopt for key generation of substrate.

ref: https://crypto.stackexchange.com/questions/27866/why-curve25519-for-encryption-but-ed25519-for-signatures

Add overflow checking for the encrypted value

Currently, there are not any overflow checking for the encrypted value. Add overflow checking or some restriction for the value.

zero-chain/crypto/src/elgamal.rs

Line 30 in e9a60f6

value: u32, // 32-bits restriction for the decryption.

Add test for note.rs

Implement CLI

like

init: // each account has 100 unit at the time of initialization
 	- address0: 0xaa
 	- spending_key0: 0x4ab
 	- address1: 0xab
 	- spending_key1: 0x1c8
 	・・・
 transfer 0xab<receiver> 10<amount> 0x4ab<spending_key>
 	- success
 balance 0xaa<addr> 0x4ab<spending_key>
 	- 90
 all_balances
 	- 0xaa => 0xdaf
 	- 0xab => 0xfa3
 	・・・

Inside the transfer would be

transfer(sender, receiver, amount, sk) {
 	r,v = api::get_balance(sender) // GET
 	proof = prove() // embedded params
 	enc = encrypt()
 	tx = gen_tx()
 	runtime_api::execute_block() // POST
 }

For getting the balances, needed decryption.

 get_balance(addr) -> r, v {
 	enc = get_storage(addr, from_index)
 	p = dec(enc)
 	calc(p)
 }

Implement the lifted-ElGamal decryption algorithm out of circuit

Update ECIES scheme

update ECIES scheme to more efficiency and secure.

Fix something wrong with the pairing test for a swap of the endian

zero-chain/pairing/src/tests/repr.rs

Lines 38 to 54 in 49eb9d1

	{
	let mut rdecoded_le = R::default();
	let mut rdecoded_be_flip = R::default();
	let mut v: Vec<u8> = vec![];
	r.write_le(&mut &mut v).unwrap();
	// This reads in little-endian, so we are done.
	rdecoded_le.read_le(&mut &v[..]).unwrap();
	// This reads in big-endian, so we perform a swap of the
	// bytes beforehand.
	let v: Vec<u8> = v.into_iter().rev().collect();
	rdecoded_be_flip.read_be(&mut &v[..]).unwrap();
	assert_eq!(rdecoded_le, rdecoded_be_flip);
	}

got the following error.

thread 'bls12_381::fq::fq_repr_tests' panicked at 'assertion failed: `(left == right)`
  left: `FqRepr([5457830654796382876, 14052294085650741142, 9037930377914938456, 17127803672399921366, 8651480755814397574, 10649476550251866400])`,
 right: `FqRepr([10649476550251866400, 8651480755814397574, 17127803672399921366, 9037930377914938456, 14052294085650741142, 5457830654796382876])`', pairing/src/tests/repr.rs:53:13
note: Run with `RUST_BACKTRACE=1` environment variable to display a backtrace.
test bls12_381::fq::fq_repr_tests ... FAILED

Add low order checks to primitives

Add low order checks to primitives at the time of reading from bytes to types.

To be compatible with the ethereum smart contracts

[Part 1] Define parameters of confidential transfers and inputs of zk proof

parameters of confidential transfers

• commitment root (anchor)
  A treestate consists of a note commitment tree and a nullifier set. The nullifier set is always updated together with the note commitment tree.
  The input treestate of each subsequent transaction in a block is the output treestate of the immediately preceding transaction.
  Namely, an anchor is the output treestate of either a previous block, or a previous JoinSplit transfer in this transaction

• nullifier
  nullifier for the input note.

• Note commitment:
  note commitment for the output note.

• public key
  a key agreement public key, used to derive the key for encryption of the transmitted notes ciphertext.

• random
  a seed that must be chosen independently at random for each transactions.

• tag
  a tag that bind h_sig to each private key of the input notes
  where h_sig = hash(random, nullifier, pubkey)
  In order to avoid malleability.

• zk proof
  a zero knowledge proof

• encrypted Note
  ciphertext components for the encrypted output note.

inputs of zk proof

primary input (public)

• commitment root
• nullifier
• Note commitment
• h_sig
• tag

auxiliary inputs (private)

• merkle path
• position
• Note_old
• Note_new
• private key
• phi (for uniquness of rho)
• merkle path enforcement

Re-added proof verification in proving function

Temporary removed because the prepared_verification_key can not read in bellman(std).

zero-chain/core/proofs/src/prover.rs

Lines 147 to 148 in 541f307

	// verify_proof(prepared_vk, &proof, &public_input[..])
	// .expect("verifying should not fail");

Add error handling for cm_encryption

Avoid using unwrap() in https://github.com/LayerXcom/zero-chain/blob/master/primitives/src/cm_encryption.rs

Use travis CI with wasm files in gitignore

wasm files are included here.

zero-chain/src/chain_spec.rs

Lines 86 to 87 in 8cdf89f

	// code: include_bytes!("../runtime/wasm/target/wasm32-unknown-unknown/release/node_template_runtime_wasm.compact.wasm").to_vec(),
	code: include_bytes!("../runtime/wasm/target/wasm32-unknown-unknown/release/zero_chain_runtime_wasm.wasm").to_vec(),

zero-chain/src/service.rs

Lines 30 to 31 in 8cdf89f

	// include_bytes!("../runtime/wasm/target/wasm32-unknown-unknown/release/node_template_runtime_wasm.compact.wasm")
	include_bytes!("../runtime/wasm/target/wasm32-unknown-unknown/release/zero_chain_runtime_wasm.wasm")

Refs:

• https://docs.travis-ci.com/user/environment-variables/
• https://stackoverflow.com/questions/40250937/how-to-use-travis-ci-with-some-files-in-gitignore
• https://stackoverflow.com/questions/42612221/path-to-repository-in-travis

Implement decryption for `Ciphertext`

zero-chain/primitives/src/cm_encryption.rs

Line 111 in 0cbfe71

// impl<E: JubjubEngine> Ciphertext<E> {

Avoid iterative setups for zkps

Output files of the setup parameters and then read the file for snark proving at the time of tx generation.

Refs:

• https://github.com/Zokrates/ZoKrates/blob/b1fbe401d2466998d373e0d73331e3603b5e7cd8/zokrates_cli/src/bin.rs

For wasm, add to zero-chain-proofs

bellman = { git = "https://github.com/osuketh/bellman", branch = "wasm" }
pairing = { git = "https://github.com/sorpaas/pairing", default-features = false }

Add jubjbubls12 params as aglobal variable into UI

Implement the homomorphic encryption in circuit

For simplicity, we should add the homomorphic encryption like ElGamal or lifted-ElGamal, paillier instead of pedersen commitment.

`<Bls12>` and `<JubjubBls12>`

Ensure the difference between <Bls12> and <JubjubBls12> as a Engine.

Avoid using incorrect `rng` traits in wasm

OsRng and ThereadRng can not be used in wasm.We will use ChachaRng for the entropy.

ref: kobigurk/wasm_proof@7389437

Ensure if `reader` is consumed in no_std

zero-chain/bellman-verifier/src/lib.rs

Lines 68 to 96 in 9d712d9

	reader.read(g1_repr.as_mut())?;
	let a = g1_repr
	.into_affine()
	.map_err(|_| io::Error::InvalidData)
	.and_then(|e| if e.is_zero() {
	Err(io::Error::PointInfinity)
	} else {
	Ok(e)
	})?;
	reader.read(g2_repr.as_mut())?;
	let b = g2_repr
	.into_affine()
	.map_err(|_| io::Error::InvalidData)
	.and_then(|e| if e.is_zero() {
	Err(io::Error::PointInfinity)
	} else {
	Ok(e)
	})?;
	reader.read(g1_repr.as_mut())?;
	let c = g1_repr
	.into_affine()
	.map_err(|_| io::Error::InvalidData)
	.and_then(|e| if e.is_zero() {
	Err(io::Error::PointInfinity)
	} else {
	Ok(e)
	})?;

Each of read function should consume the reader data.

`<,Unknown>` and `<,PrimeOrder>

Ensure the correct Subgroup for edwards::Point

Ensure the byteorder is correct

https://github.com/LayerXcom/zero-chain/blob/master/primitives/src/cm_encryption.rs

let mut plaintext = vec![];
        // TODO: Ensure the byteorder is correct
        (&mut plaintext).write_u64::<LittleEndian>(self.value).unwrap();
        (&mut plaintext).write_u64::<LittleEndian>(self.randomness).unwrap();  

Applying the self-defined origin/AccountID

Ensure preventing from small subgroup attacks

Integrate own constants for primitives

Apply to the bullet proofs

Change AES to MiMC

https://github.com/LayerXcom/zero-chain/blob/master/primitives/src/cm_encryption.rs

// Temporary use for enc/dec
use pcrypto::aes::{
    encrypt_128_ctr, 
    decrypt_128_ctr
};

Add ECIES for encryption and decryption Note

Fix the test of zk_proof byte-cast.

The test fails because the dummy_engine is not implemented the from_affine() for the test.

error logs

---- proof::tests::test_proof_into_from stdout ----
thread 'proof::tests::test_proof_into_from' panicked at 'not yet implemented', bellman-verifier/src/tests/dummy_engine.rs:400:9
note: Run with `RUST_BACKTRACE=1` for a backtrace.

zero-chain/primitives/src/proof.rs

Lines 94 to 106 in da32bd7

	fn test_proof_into_from() {
	// let mut rng = &mut XorShiftRng::from_seed([0x3dbe6259, 0x8d313d76, 0x3237db17, 0xe5bc0654]);
	// let proof1 = bellman_verifier::Proof::<DummyEngine> {
	// a: Fr(Wrapping(3269)),
	// b: Fr(Wrapping(471)),
	// c: Fr(Wrapping(8383)),
	// };
	// let proof_b = Proof::test_from_proof(&proof1);
	// println!("proof_b: {:?}", proof_b);
	// let proof2 = proof_b.test_into_proof().unwrap();
	// assert!(proof1 == proof2);

Implement `sighash`

"Zframe" as a privacy oriented blockchain framework

"Zerochain" would be a our public chain using Zframe.

Add module logic, storage and event on substrate

https://github.com/LayerXcom/zero-chain/blob/master/runtime/src/confidential_transfer.rs

Replace bellman dependencies from original crates to no_std crates

It makes simple to use std and no_std dependencies. It means it is enable to use same pairing and jubjub crates in both std and no_std environment.

Make correct sig hash for the compatibility with substrate

Need to be compatible with the signed data field between signing and verifying.

In unchecked_mortal_compact_extrinsic, the signature verification is implemented here.
https://github.com/paritytech/substrate/blob/1997487ec082f436e4c3279402d4528d67c861be/core/sr-primitives/src/generic/unchecked_mortal_compact_extrinsic.rs#L85-L96

In oo7, the signing scheme is implemented here.
https://github.com/paritytech/oo7/blob/79856e56658ad2b71115af5f682ac5d71a4f9ab3/packages/oo7-substrate/src/transact.js#L27-L42

Ensure if the public attributes are safe in pairing

Ensure if it is needed to change public to public(crate).

zero-chain/pairing/src/bls12_381/ec.rs

Lines 15 to 17 in 9d712d9

	pub x: $basefield,
	pub y: $basefield,
	pub infinity: bool

zero-chain/pairing/src/bls12_381/fq.rs

Line 701 in 9d712d9

pub struct Fq(pub FqRepr);

But if these are changed, the test of bellman-verifier would be failed because the proof is hard-coded, it cannot access as these fields are private out of the pairing crate.

zero-chain/bellman-verifier/src/lib.rs

Lines 272 to 294 in 9d712d9

	let proof = Proof::<Bls12> {
	a: G1Affine {
	x: Fq(FqRepr([16739797345307447054, 8770073581945912782, 2136235734558249053, 15708693206467346864, 8490922573673252286, 1579948179538746271])),
	y: Fq(FqRepr([6020268861830312380, 12879642226817054130, 17904268384441769431, 15221266273771162992, 5384025118770475327, 1217424206270675696])),
	infinity: false
	},
	b: G2Affine {
	x: Fq2 {
	c0: Fq(FqRepr([1955900693533848923, 1207270260807916624, 10030599496790334806, 13310839817113796132, 7335494448760471336, 1520001478562200471])),
	c1: Fq(FqRepr([10867545881237734656, 11292327308906943064, 4286427264655280722, 5033346395315998832, 9316987264960049565, 1093242448245841130]))
	},
	y: Fq2 {
	c0: Fq(FqRepr([6242954237310667968, 4585560269108097072, 5517602464819718440, 11574556308726901230, 9576729709326690239, 433440758793164942])),
	c1: Fq(FqRepr([11180820212476238720, 13504112200989036594, 2176986271111729977, 4481942420924131750, 16599268505710547724, 922146901424495142]))
	},
	infinity: false
	},
	c: G1Affine {
	x: Fq(FqRepr([16362720867114782945, 14827736289902972547, 7987695302896742039, 14289613131851611182, 7162884718192410854, 605698044002088945])),
	y: Fq(FqRepr([3093450141616622888, 7767002491037351418, 5972324121568597438, 2377138492074911281, 701452421528324862, 1373508511228186748])),
	infinity: false
	}
	};

Move nonce_increment logic from `executive` to `conf_transfer`

Currently, the nonces are tied with each one-time signature verification key in the executive logic, so we need to get it tied with pkd_address (aka account id).

Add byte casts for transaction components

Implement the byte casted types of transaction components for substrate.

Protect front running attacks

Add the pending transfer.
In the confidential transfer function, add epoch_check, roll over pendings and update last_epoch.

pub fn confTransfer() {
  RollOver(sender_addr)
  RollOver(recipient_addr)
  ・・・
  balances[sender_addr] += Enc(-value)
  pending_transfer[recipient_addr] += Enc(value)
  ・・・
}

fn RollOver(addr) {
  let H = block.number
  let e = H/E
  if lastRollOver[addr] < e:
    Set balance[addr] += pending_transfer[addr]
    Set pending_transfer[addr] = (1, 1)
    Set lastRollOver[addr] = e
}

In the storage, Add pending_transfer_map and last_epoch_map

storage{
  pending_transfer: map address => pending_value
  last_epoch: map address => block_height
  ・・・
}

Move the integration test for zk proof to appropriate path

The integration test that is reading proving_key and preapred_vk binary files, then proving and verifying is in core/proofs/src/prover.rs.

zero-chain/proofs/src/prover.rs

Line 173 in 90ebbfe

fn test_gen_proof() {

Implement the client of sending a transaction to substrate

It would be implemented in Rust and the interface of POST and GET would be in CLI.

Add MiMC circuit

Implement MiMC circuit in bellman.

Add appropriate storage in SRML

map nullifier => hash(Note)
map hash(account) => encNote
Vec<u8> root of commitment tree

Add attributes for structs

In order to send the own defined struct to substrate, needed to add attributes of Encode, Decode, Default.

Fix the variable name of `ExpandedSpendingKey` to `ExtendedSpendingKey`

https://github.com/LayerXcom/zero-chain/blob/master/proofs/src/primitives/mod.rs

Apply wasm for the web wallet