Skip to content

Commit 112b909

Browse files
bobbinthbobbinth
committed
refactor: rename eddsa proc to verify_prehash
1 parent b57ff93 commit 112b909

File tree

7 files changed

+44
-30
lines changed

7 files changed

+44
-30
lines changed

‎crates/lib/core/asm/crypto/dsa/ecdsa_k256_keccak.masm‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,19 +33,26 @@ const SIG_LEN_FELTS = 17 # 65.div_ceil(4)
3333
#!
3434
#! Inputs:
3535
#! Operand stack: [PK_COMM, MSG, ...]
36-
#! Advice stack: [PK[9] | SIG_BYTES[17] | ...]
36+
#! Advice stack: [PK[9] | SIG[17] | ...]
3737
#! Outputs:
3838
#! Operand stack: []
3939
#! Advice stack: []
4040
#!
41+
#! Where:
42+
#! - `PK_COMM`: RPO hash commitment of the 32-byte ECDSA public key
43+
#! - `MSG`: single word (4 field elements) representing the message to verify
44+
#! - `PK[9]`: 33-byte public key packed as 9 field elements on advice stack
45+
#! - `SIG[17]`: 65-byte signature packed as 17 field elements on advice stack
46+
#!
4147
#! Local memory layout (element addresses):
4248
#! - locaddr[0 ..9 ] : compressed public key (33 bytes packed as 9 felts)
4349
#! - locaddr[12..20] : message bytes (MSG written as eight u32 limbs)
4450
#! - locaddr[20..28] : keccak256(message) digest (8 felts)
45-
#! - locaddr[28..45] : signature (66 bytes packed as 17 felts)
51+
#! - locaddr[28..45] : signature (65 bytes packed as 17 felts)
4652
#!
47-
#! The procedure traps if the public key in the advice stack does not hash to `PK_COMM`;
48-
#! otherwise it returns cleanly after emitting the deferred verification request.
53+
#! The procedure traps if:
54+
#! - The public key does not hash to `PK_COMM` (invalid commitment)
55+
#! - The signature verification fails
4956
@locals(48)
5057
pub proc verify
5158
# Load the compressed public key (9 felts) into local memory at locaddr.[0..9]
@@ -86,10 +93,13 @@ pub proc verify
8693
# => [pk_ptr, digest_ptr, sig_ptr]
8794
exec.verify_prehash
8895
# => [result, ...]
96+
97+
# Trap if verification failed
8998
assert.err="ECDSA signature verification failed"
9099
end
91100

92101
#! Verifies an ECDSA signature with pre-hashed message using deferred execution.
102+
#!
93103
#! This procedure is intended for manual signature verification where the caller
94104
#! has already computed the message digest.
95105
#!
@@ -98,13 +108,13 @@ end
98108
#! In typical flows the digest is obtained from `keccak256::hash_bytes`, but any 32-byte prehash
99109
#! is accepted.
100110
#!
101-
#! Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`
111+
#! Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`
102112
#! Output: `[result, ...]`
103113
#!
104114
#! Where:
105115
#! - `pk_ptr`: word-aligned memory address containing the 33-byte compressed secp256k1 public key
106116
#! - `digest_ptr`: word-aligned memory address containing the 32-byte message digest
107-
#! - `sig_ptr`: word-aligned memory address containing the 66-byte signature
117+
#! - `sig_ptr`: word-aligned memory address containing the 65-byte signature
108118
#! - `result`: 1 if the signature is valid, 0 if invalid
109119
#!
110120
#! All data must be stored in memory as packed u32 values (little-endian), with unused bytes
@@ -138,7 +148,7 @@ end
138148
#! Where:
139149
#! - `pk_ptr`: word-aligned memory address containing 33-byte public key
140150
#! - `digest_ptr`: word-aligned memory address containing 32-byte digest
141-
#! - `sig_ptr`: word-aligned memory address containing 66-byte signature
151+
#! - `sig_ptr`: word-aligned memory address containing 65-byte signature
142152
#! - `COMM`: commitment to calldata computed as
143153
#! `Rpo256(Rpo256(Rpo256(pk) || Rpo256(digest)) || Rpo256(sig))`
144154
#! - `TAG`: `[ECDSA_VERIFY_EVENT, result, 0, 0]`

‎crates/lib/core/asm/crypto/dsa/eddsa_ed25519.masm‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ pub proc verify
110110
locaddr.16 # sig_ptr
111111
locaddr.56 # k_digest_ptr
112112
locaddr.0 # pk_ptr
113-
exec.verify_with_unchecked_k_digest
113+
exec.verify_prehash
114114
# => [result, ...]
115115

116116
# Trap if verification failed
@@ -120,6 +120,9 @@ end
120120

121121
#! Verifies an EdDSA (Ed25519) signature with a pre-computed nonce digest.
122122
#!
123+
#! This procedure is intended for manual signature verification where the caller
124+
#! has already computed the message digest.
125+
#!
123126
#! This procedure uses deferred verification via a precompile. The actual cryptographic
124127
#! verification is performed by the host, and the result is provided via the advice stack.
125128
#!
@@ -134,8 +137,8 @@ end
134137
#!
135138
#! All data must be stored in memory as packed u32 field elements (little-endian), with unused limbs
136139
#! in the final word set to zero.
137-
pub proc verify_with_unchecked_k_digest
138-
exec.verify_with_unchecked_k_digest_impl
140+
pub proc verify_prehash
141+
exec.verify_prehash_impl
139142
# => [COMM, TAG, result, ...]
140143

141144
# Log the precompile request for deferred verification.
@@ -218,7 +221,7 @@ end
218221
#! - `COMM`: `Rpo256(Rpo256(Rpo256(pk) || Rpo256(k_digest)) || Rpo256(sig))`
219222
#! - `TAG`: `[EDDSA_VERIFY_EVENT, result, 0, 0]`
220223
#! - `result`: host verification result (1 or 0)
221-
pub proc verify_with_unchecked_k_digest_impl
224+
pub proc verify_prehash_impl
222225
emit.EDDSA_VERIFY_EVENT
223226
# => [pk_ptr, k_digest_ptr, sig_ptr, ...]
224227

‎crates/lib/core/docs/crypto/dsa/ecdsa_k256_keccak.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
## miden::core::crypto::dsa::ecdsa_k256_keccak
33
| Procedure | Description |
44
| ----------- | ------------- |
5-
| verify | Verifies an secp256k1 ECDSA signature compatible with `miden-crypto::ecdsa_k256_keccak`.<br /><br />This wrapper mirrors the materialization performed in `miden-crypto::ecdsa_k256_keccak`: given<br />a public key commitment and the original message, it reconstructs the calldata expected by the<br />precompile (public key bytes, Keccak256(message), signature). The public key and signature are<br />supplied via the advice stack, and can be obtained with the `ecdsa_k256_keccak` function.<br /><br />Inputs:<br />Operand stack: [PK_COMM, MSG, ...]<br />Advice stack: [PK[9] \| SIG_BYTES[17] \| ...]<br />Outputs:<br />Operand stack: []<br />Advice stack: []<br /><br />Local memory layout (element addresses):<br />- locaddr[0 ..9 ] : compressed public key (33 bytes packed as 9 felts)<br />- locaddr[12..20] : message bytes (MSG written as eight u32 limbs)<br />- locaddr[20..28] : keccak256(message) digest (8 felts)<br />- locaddr[28..45] : signature (66 bytes packed as 17 felts)<br /><br />The procedure traps if the public key in the advice stack does not hash to `PK_COMM`;<br />otherwise it returns cleanly after emitting the deferred verification request.<br /> |
6-
| verify_prehash | Verifies an ECDSA signature with pre-hashed message using deferred execution.<br />This procedure is intended for manual signature verification where the caller<br />has already computed the message digest.<br /><br />The caller provides the public key, the pre-hashed message digest, and the signature data in<br />memory. This routine forwards the request to the host precompile and returns the boolean result.<br />In typical flows the digest is obtained from `keccak256::hash_bytes`, but any 32-byte prehash<br />is accepted.<br /><br />Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`<br />Output: `[result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing the 33-byte compressed secp256k1 public key<br />- `digest_ptr`: word-aligned memory address containing the 32-byte message digest<br />- `sig_ptr`: word-aligned memory address containing the 66-byte signature<br />- `result`: 1 if the signature is valid, 0 if invalid<br /><br />All data must be stored in memory as packed u32 values (little-endian), with unused bytes<br />in the final u32 set to zero.<br /> |
7-
| verify_prehash_impl | Internal implementation of ECDSA signature verification via deferred computation.<br />This procedure is intended for manual signature verification where the caller<br />has already computed the message digest.<br /><br />Emits an event to trigger the precompile handler, reads the verification result from<br />the advice stack, and computes the commitment and tag for tracking deferred verification.<br /><br />This procedure mimics the `ecdsa_secp256k1::PublicKey::verify_prehash()` function from<br />`miden-crypto`, which takes a pre-hashed message that the caller must provide<br />(e.g. obtained using the keccak256 precompile).<br /><br />Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`<br />Output: `[COMM, TAG, result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing 33-byte public key<br />- `digest_ptr`: word-aligned memory address containing 32-byte digest<br />- `sig_ptr`: word-aligned memory address containing 66-byte signature<br />- `COMM`: commitment to calldata computed as<br />`Rpo256(Rpo256(Rpo256(pk) \|\| Rpo256(digest)) \|\| Rpo256(sig))`<br />- `TAG`: `[ECDSA_VERIFY_EVENT, result, 0, 0]`<br />- `result`: 1 if signature is valid, 0 if invalid<br /> |
5+
| verify | Verifies an secp256k1 ECDSA signature compatible with `miden-crypto::ecdsa_k256_keccak`.<br /><br />This wrapper mirrors the materialization performed in `miden-crypto::ecdsa_k256_keccak`: given<br />a public key commitment and the original message, it reconstructs the calldata expected by the<br />precompile (public key bytes, Keccak256(message), signature). The public key and signature are<br />supplied via the advice stack, and can be obtained with the `ecdsa_k256_keccak` function.<br /><br />Inputs:<br />Operand stack: [PK_COMM, MSG, ...]<br />Advice stack: [PK[9] \| SIG[17] \| ...]<br />Outputs:<br />Operand stack: []<br />Advice stack: []<br /><br />Where:<br />- `PK_COMM`: RPO hash commitment of the 32-byte ECDSA public key<br />- `MSG`: single word (4 field elements) representing the message to verify<br />- `PK[9]`: 33-byte public key packed as 9 field elements on advice stack<br />- `SIG[17]`: 65-byte signature packed as 17 field elements on advice stack<br /><br />Local memory layout (element addresses):<br />- locaddr[0 ..9 ] : compressed public key (33 bytes packed as 9 felts)<br />- locaddr[12..20] : message bytes (MSG written as eight u32 limbs)<br />- locaddr[20..28] : keccak256(message) digest (8 felts)<br />- locaddr[28..45] : signature (65 bytes packed as 17 felts)<br /><br />The procedure traps if:<br />- The public key does not hash to `PK_COMM` (invalid commitment)<br />- The signature verification fails<br /> |
6+
| verify_prehash | Verifies an ECDSA signature with pre-hashed message using deferred execution.<br /><br />This procedure is intended for manual signature verification where the caller<br />has already computed the message digest.<br /><br />The caller provides the public key, the pre-hashed message digest, and the signature data in<br />memory. This routine forwards the request to the host precompile and returns the boolean result.<br />In typical flows the digest is obtained from `keccak256::hash_bytes`, but any 32-byte prehash<br />is accepted.<br /><br />Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`<br />Output: `[result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing the 33-byte compressed secp256k1 public key<br />- `digest_ptr`: word-aligned memory address containing the 32-byte message digest<br />- `sig_ptr`: word-aligned memory address containing the 65-byte signature<br />- `result`: 1 if the signature is valid, 0 if invalid<br /><br />All data must be stored in memory as packed u32 values (little-endian), with unused bytes<br />in the final u32 set to zero.<br /> |
7+
| verify_prehash_impl | Internal implementation of ECDSA signature verification via deferred computation.<br />This procedure is intended for manual signature verification where the caller<br />has already computed the message digest.<br /><br />Emits an event to trigger the precompile handler, reads the verification result from<br />the advice stack, and computes the commitment and tag for tracking deferred verification.<br /><br />This procedure mimics the `ecdsa_secp256k1::PublicKey::verify_prehash()` function from<br />`miden-crypto`, which takes a pre-hashed message that the caller must provide<br />(e.g. obtained using the keccak256 precompile).<br /><br />Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`<br />Output: `[COMM, TAG, result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing 33-byte public key<br />- `digest_ptr`: word-aligned memory address containing 32-byte digest<br />- `sig_ptr`: word-aligned memory address containing 65-byte signature<br />- `COMM`: commitment to calldata computed as<br />`Rpo256(Rpo256(Rpo256(pk) \|\| Rpo256(digest)) \|\| Rpo256(sig))`<br />- `TAG`: `[ECDSA_VERIFY_EVENT, result, 0, 0]`<br />- `result`: 1 if signature is valid, 0 if invalid<br /> |

‎crates/lib/core/docs/crypto/dsa/eddsa_ed25519.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33
| Procedure | Description |
44
| ----------- | ------------- |
55
| verify | Verifies an Ed25519 EdDSA signature compatible with `miden-crypto::eddsa_25519_sha512`.<br /><br />This wrapper mirrors the materialization performed in `miden-crypto::eddsa_25519_sha512`: given<br />a public key commitment and the original message, it reconstructs the calldata expected by the<br />precompile (public key bytes, SHA512(R \|\| PK \|\| MSG), signature). The public key and signature<br />are supplied via the advice stack, and can be obtained with the `eddsa_sign` function.<br /><br />Inputs:<br />Operand stack: [PK_COMM, MSG, ...]<br />Advice stack: [PK[8] \| SIG[16] \| ...]<br />Outputs:<br />Operand stack: []<br />Advice stack: []<br /><br />Where:<br />- `PK_COMM`: RPO hash commitment of the 32-byte Ed25519 public key<br />- `MSG`: single word (4 field elements) representing the message to verify<br />- `PK[8]`: 32-byte public key packed as 8 field elements on advice stack<br />- `SIG[16]`: 64-byte signature packed as 16 field elements on advice stack<br /><br />Local memory layout (element addresses):<br />- locaddr[0..8]: public key (32 bytes packed as 8 felts)<br />- locaddr[8..16]: message (32 bytes = 8 felts)<br />- locaddr[16..32]: signature (64 bytes packed as 16 felts)<br />- locaddr[32..56]: SHA512 input buffer (R \|\| PK \|\| MSG = 96 bytes = 24 felts)<br />- locaddr[56..72]: k_digest = SHA512(R \|\| PK \|\| MSG) (64 bytes = 16 felts)<br /><br />The procedure traps if:<br />- The public key does not hash to `PK_COMM` (invalid commitment)<br />- The signature verification fails<br /> |
6-
| verify_with_unchecked_k_digest | Verifies an EdDSA (Ed25519) signature with a pre-computed nonce digest.<br /><br />This procedure uses deferred verification via a precompile. The actual cryptographic<br />verification is performed by the host, and the result is provided via the advice stack.<br /><br />Input: `[pk_ptr, k_digest_ptr, sig_ptr, ...]`<br />Output: `[result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing the 32-byte Ed25519 public key<br />- `k_digest_ptr`: word-aligned memory address containing the 64-byte challenge hash `k`<br />- `sig_ptr`: word-aligned memory address containing the 64-byte Ed25519 signature<br />- `result`: 1 if the signature is valid, 0 otherwise<br /><br />All data must be stored in memory as packed u32 field elements (little-endian), with unused limbs<br />in the final word set to zero.<br /> |
7-
| verify_with_unchecked_k_digest_impl | Internal implementation of EdDSA verification via deferred computation.<br /><br />Emits an event to trigger the host precompile, reads the verification result from the<br />advice stack, and computes the commitment/tag pair used for deferred verification.<br /><br />Input: `[pk_ptr, k_digest_ptr, sig_ptr, ...]`<br />Output: `[COMM, TAG, result, ...]`<br /><br />Where:<br />- `COMM`: `Rpo256(Rpo256(Rpo256(pk) \|\| Rpo256(k_digest)) \|\| Rpo256(sig))`<br />- `TAG`: `[EDDSA_VERIFY_EVENT, result, 0, 0]`<br />- `result`: host verification result (1 or 0)<br /> |
6+
| verify_prehash | Verifies an EdDSA (Ed25519) signature with a pre-computed nonce digest.<br /><br />This procedure is intended for manual signature verification where the caller<br />has already computed the message digest.<br /><br />This procedure uses deferred verification via a precompile. The actual cryptographic<br />verification is performed by the host, and the result is provided via the advice stack.<br /><br />Input: `[pk_ptr, digest_ptr, sig_ptr, ...]`<br />Output: `[result, ...]`<br /><br />Where:<br />- `pk_ptr`: word-aligned memory address containing the 32-byte Ed25519 public key<br />- `digest_ptr`: word-aligned memory address containing the 64-byte challenge hash `k`<br />- `sig_ptr`: word-aligned memory address containing the 64-byte Ed25519 signature<br />- `result`: 1 if the signature is valid, 0 otherwise<br /><br />All data must be stored in memory as packed u32 field elements (little-endian), with unused limbs<br />in the final word set to zero.<br /> |
7+
| verify_prehash_impl | Internal implementation of EdDSA verification via deferred computation.<br /><br />Emits an event to trigger the host precompile, reads the verification result from the<br />advice stack, and computes the commitment/tag pair used for deferred verification.<br /><br />Input: `[pk_ptr, k_digest_ptr, sig_ptr, ...]`<br />Output: `[COMM, TAG, result, ...]`<br /><br />Where:<br />- `COMM`: `Rpo256(Rpo256(Rpo256(pk) \|\| Rpo256(k_digest)) \|\| Rpo256(sig))`<br />- `TAG`: `[EDDSA_VERIFY_EVENT, result, 0, 0]`<br />- `result`: host verification result (1 or 0)<br /> |

‎crates/lib/core/tests/crypto/eddsa_ed25519.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ fn test_eddsa_verify_prehash_cases() {
5555
{memory_stores}
5656
5757
push.{SIG_ADDR}.{K_DIGEST_ADDR}.{PK_ADDR}
58-
exec.eddsa_ed25519::verify_with_unchecked_k_digest
58+
exec.eddsa_ed25519::verify_prehash
5959
6060
exec.sys::truncate_stack
6161
end
@@ -83,7 +83,7 @@ fn test_eddsa_verify_prehash_cases() {
8383
{memory_stores}
8484
8585
push.{SIG_ADDR}.{K_DIGEST_ADDR}.{PK_ADDR}
86-
exec.eddsa_ed25519::verify_with_unchecked_k_digest
86+
exec.eddsa_ed25519::verify_prehash
8787
8888
exec.sys::truncate_stack
8989
end
@@ -122,7 +122,7 @@ fn test_eddsa_verify_prehash_impl_commitment() {
122122
{memory_stores}
123123
124124
push.{SIG_ADDR}.{K_DIGEST_ADDR}.{PK_ADDR}
125-
exec.eddsa_ed25519::verify_with_unchecked_k_digest_impl
125+
exec.eddsa_ed25519::verify_prehash_impl
126126
127127
exec.sys::truncate_stack
128128
end
@@ -150,7 +150,7 @@ fn test_eddsa_verify_prehash_impl_commitment() {
150150

151151
assert!(
152152
output.advice_provider().stack().is_empty(),
153-
"advice stack should be empty after verify_with_unchecked_k_digest_impl"
153+
"advice stack should be empty after verify_prehash_impl"
154154
);
155155
}
156156
}

0 commit comments

Comments
 (0)