Trying to run tutorial code for witness generation of EdDSA signature

[311923]

Good day - I am just starting with a basic implementation of SNARK verification of EdDSA signatures. Unfortunately, I do not see how to run even just the witness generation code from the documentation here.

The exact code I use (essentially just taken from the tutorial) is provided below, along with the error output. As far as I can tell I have faithfully implemented the witness generation (not the SNARK circuit) part of the tutorial, but there seems to be a problem during the signing phase.

I expect that there is a trivial misunderstanding somewhere.

Many thanks-

package main

import (
	crand "crypto/rand"
	"fmt"

	"github.com/consensys/gnark-crypto/ecc/twistededwards"
	"github.com/consensys/gnark-crypto/hash"

	"github.com/consensys/gnark-crypto/signature/eddsa"
)

func main() {
	// instantiate hash function
	hFunc := hash.MIMC_BN254.New()

	// create a eddsa key pair
	privateKey, err := eddsa.New(twistededwards.BN254, crand.Reader)

	if err != nil {
		fmt.Println("A:", err.Error())
	}

	publicKey := privateKey.Public()

	//msg := []byte{0xde, 0xad, 0xf0, 0x0d}
	// Extending the message beyond that in the demo code to 32 bytes eliminates the slice bounds out of range error. To be understood.
	msg := []byte{0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d}

	signature, err := privateKey.Sign(msg, hFunc)

	if err != nil {
		fmt.Println("B: ", err.Error())
	}

	isValid, err := publicKey.Verify(signature, msg, hFunc)

	if err != nil {
		fmt.Println("C: ", err.Error())

	}
	if !isValid {
		fmt.Println("Invalid signature")
	} else {
		fmt.Println("Valid signature")
	}
}

The output is as follows:

B:  invalid fr.Element encoding
C:  wrong size buffer
Invalid signature

[311923]

It looks like the tutorial code didn't hash the message to a bn254 Fr element. I include here a working version, but would appreciate feedback. The most pertinent five lines of code are as follows, and the full code is also below.

msg := []byte{0xde, 0xad, 0xf0, 0x0d}
sep := []byte("separator")
res, _ := bn254fr.Hash(msg, sep, 1)

msgHashedFr := res[0]

signature, err := privateKey.Sign(msgHashedFr.Marshal(), hFunc)

The full code:

package main

import (
	crand "crypto/rand"
	"fmt"

	bn254fr "github.com/consensys/gnark-crypto/ecc/bn254/fr"
	bn254frHash "github.com/consensys/gnark-crypto/ecc/bn254/fr/hash_to_field"

	"github.com/consensys/gnark-crypto/ecc/twistededwards"
	"github.com/consensys/gnark-crypto/hash"

	"github.com/consensys/gnark-crypto/signature/eddsa"
	
)

func main() {
	// instantiate hash function
	hFunc := hash.MIMC_BN254.New()

	// create a eddsa key pair
	privateKey, err := eddsa.New(twistededwards.BN254, crand.Reader)

	if err != nil {
		fmt.Println("A:", err.Error())
	}

	publicKey := privateKey.Public()

	msg := []byte{0xde, 0xad, 0xf0, 0x0d}
	sep := []byte("separator")
	res, err := bn254fr.Hash(msg, sep, 1)
	if err != nil {
		fmt.Println("hash to field", err)
	}
	msgHashedFr := res[0]

	signature, err := privateKey.Sign(msgHashedFr.Marshal(), hFunc)

	if err != nil {
		fmt.Println("B: ", err.Error())
	}

	isValid, err := publicKey.Verify(signature, msgHashedFr.Marshal(), hFunc)

	if err != nil {
		fmt.Println("C: ", err.Error())
	}

	if !isValid {
		fmt.Println("Invalid signature")
	} else {

		fmt.Println("Valid signature")
	}

}

[ThomasPiellard]

Hi, so in your first sample your message (msg := []byte{0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d, 0xde, 0xad, 0xf0, 0x0d}) when interpreted as an fr.Element exceeds the modulus r, and the bn254 hash function returns an error when a block exceeds the modulus. For context we did follow the golang interface for hashing, where Write takes a stream of bytes, but algebraic hashes like mimc reason on FrElement, and parsing a random stream of bytes into blocks of elements that are smaller than the modulus lead to either ambiguous choices or inefficient computation (namely trying to interpret a stream of bytes as a big number and take the digits of this number interpreted in basis r as blocks), so we went for the simplest solution where we throw an error if a block of 32bytes exceeds the modulus.