(WIP) Add pre-compile: verification for ed25519 sig made via GPG #2

nkrishang · 2024-12-25T06:03:08Z

A pre-compile contract at 0xed that uses gopengpg to verify signatures produced on signing a bytes message with an ed25519 key via GPG.

Usage

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract ED25519Verifier {
    
    function verify(bytes memory message, bytes memory publicKey, bytes memory signature) external view returns (bool) {
        // Pack the input in the format expected by the precompile:
        // message_len (32 bytes) || message || pubkey_len (32 bytes) || pubkey || sig_len (32 bytes) || signature
        bytes memory input = abi.encodePacked(
            bytes32(message.length),
            message,
            bytes32(publicKey.length),
            publicKey,
            bytes32(signature.length),
            signature
        );
        
        (bool success, bytes memory result) = address(0xed).staticcall(input);
        require(success, "ED25519 verification failed");
        
        return result.length > 0 && result[0] == 1;
    }
}

zobront

This looks great. Definitely seems clear that this is the better path than using EIP665 and implementing the GPG stuff in Solidity.

I left a few comments on areas that will require some tweaks.

Before testing in Foundry, I would recommend adding a test to contracts_test.go. You can hardcode 1 correct signature and one incorrect signature into a JSON file, and should be able to plug that in to verify the signature verification is working as expected.

zobront · 2024-12-25T16:17:13Z

params/protocol_params.go

@@ -170,6 +170,7 @@ const (
 	Bls12381MapG2Gas          uint64 = 75000 // Gas price for BLS12-381 mapping field element to G2 operation

 	P256VerifyGas uint64 = 3450 // secp256r1 elliptic curve signature verifier gas price
+	GpgEd25519VerifyGas uint64 = 2000 // GPG Ed25519 signature verification gas price


We should do some benchmarking to make sure this price is still appropriate, given the extra computation.

Plan for this:

run other precompile benchmarks to get MGas/s on local machine

run our precompile to get a sense of runs/s with varying inputs

create pricing formula that leads to MGas/s equal or greater than compared precompiles for all inputs

if the resulting gas price is very low, round up to be safe

I'd also like to get a sense of whether there are codepaths in the Go libs that are very time intensive that could be abused as a DOS vector. We can poke around a bit, but also will leave a note for auditors to explore this.

core/vm/contracts.go

zobront · 2024-12-25T16:19:05Z

core/vm/contracts.go

+	if len(input) < int(offset+32+pubKeyLen) {
+		return nil, errPubKeyTooShort
+	}
+	pubKey := input[offset+32 : offset+32+pubKeyLen]


Is there a specific length the pubKey is supposed to be that we should verify?

Similar to the comment on signature length. The armored public key length is non-deterministic (exported via gpg --export --armor <your-key-id>).

Agreed, no way to do this. I'm going to leave this comment open as a reminder that I need to talk to the Tea team to figure out a reasonable upper bound to make sure that (a) there is sufficient gas to handle it, and (b) that there is no DOS risk based on whatever gas params we choose.

nkrishang · 2024-12-26T13:00:11Z

I've added tests and benchmarks in core/vm/contracts_test.go. Please see the comments on signature length and public key length. An open question I'll mention is whether to create a max message size limit.

Overall, enshrining GPG specific code in a precompile like this means using it with public keys and signatures in the GPG specific armored format, instead of raw 32 bytes public keys and 64 bytes signatures. So far, I haven't landed on a solution to go back and forth from armored format (pKey or signature) to hex and back.

core/vm/contracts.go

nkrishang · 2024-12-30T08:07:54Z

params/protocol_params.go

@@ -170,7 +170,7 @@ const (
 	Bls12381MapG2Gas          uint64 = 75000 // Gas price for BLS12-381 mapping field element to G2 operation

 	P256VerifyGas uint64 = 3450 // secp256r1 elliptic curve signature verifier gas price
-	GpgEd25519VerifyGas uint64 = 2000 // GPG Ed25519 signature verification gas price
+	GpgEd25519VerifyGas uint64 = 7900 // GPG Ed25519 signature verification gas price


Assuming Ecrecover is fairly priced (as per EIP-152 Blake2 precompile) at 3000 gas/op for ~50,100 ns/op.

GpgEd25519Verify should be priced proportionately 7900 gas/op for ~134,000 ns/op as a good first estimate for gas cost.

add gpg-ed25519

67bd272

zobront reviewed Dec 25, 2024

View reviewed changes

Add tests

cbc7d3a

zobront reviewed Dec 26, 2024

View reviewed changes

core/vm/contracts.go Outdated Show resolved Hide resolved

nkrishang and others added 9 commits December 27, 2024 11:56

Return bytes32(0) for verification failure

051364b

bypass public key expiration check

528401f

precompile expects dearmored bytes inputs

72aaf0b

limit message size to 32 bytes

8b33d68

update expected input abi encoding

d3c407b

input is abi.encode not abi.encodePacked

cdf66f7

decode using /abi

4e8cd56

move decode into helper func

72d0145

Update gas for gpgEd25519Verify

c08cefc

nkrishang commented Dec 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(WIP) Add pre-compile: verification for ed25519 sig made via GPG #2

(WIP) Add pre-compile: verification for ed25519 sig made via GPG #2

nkrishang commented Dec 25, 2024 •

edited

Loading

zobront left a comment

zobront Dec 25, 2024

zobront Dec 28, 2024 •

edited

Loading

zobront Dec 28, 2024

zobront Dec 25, 2024

nkrishang Dec 26, 2024

zobront Dec 27, 2024

nkrishang commented Dec 26, 2024

nkrishang Dec 30, 2024

(WIP) Add pre-compile: verification for ed25519 sig made via GPG #2

Are you sure you want to change the base?

(WIP) Add pre-compile: verification for ed25519 sig made via GPG #2

Conversation

nkrishang commented Dec 25, 2024 • edited Loading

Usage

zobront left a comment

Choose a reason for hiding this comment

zobront Dec 25, 2024

Choose a reason for hiding this comment

zobront Dec 28, 2024 • edited Loading

Choose a reason for hiding this comment

zobront Dec 28, 2024

Choose a reason for hiding this comment

zobront Dec 25, 2024

Choose a reason for hiding this comment

nkrishang Dec 26, 2024

Choose a reason for hiding this comment

zobront Dec 27, 2024

Choose a reason for hiding this comment

nkrishang commented Dec 26, 2024

nkrishang Dec 30, 2024

Choose a reason for hiding this comment

nkrishang commented Dec 25, 2024 •

edited

Loading

zobront Dec 28, 2024 •

edited

Loading