Add contract commitment unsealing to 2.2.3, 2.2.4

Author: jachiang

2.2-taptweak.ipynb

@@ -28,7 +28,7 @@
     "\n",
     "The linear property of bip-schnorr means that we can encode a commitment into a public key, and then reveal that commitment when signing with the private key. We do that by _tweaking_ the private key with the commitment, and using the associated _tweaked_ pubkey. When signing, we can reveal that the original private key was tweaked by the commitment.\n",
     "\n",
-    "## Tweaking the Public Key\n",
+    "## Part 1: Tweaking the Public Key\n",
     "\n",
     "Instead of using our original public key as the witness program, we use a tweaked public key.\n",
     "\n",
@@ -152,16 +152,20 @@
     "\n",
     "![test](images/taptweak0.jpg)\n",
     "\n",
-    "Instead, the committed value must first be hashed with the untweaked public key point. **This prevents modification of both untweaked secret and tweak for a given tweaked pubkey point Q.**"
+    "Instead, the committed value must first be hashed with the untweaked public key point. **This commitment scheme is called pay-to-contract. It does not allow the modification of a committed value for a given public key point Q.** "
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### Example 2.2.3: modifying the tweak for a tweaked public key Q\n",
+    "#### Example 2.2.3: Tweaking a public key Q with commitment data\n",
     "\n",
-    "In this example we demonstrate an insecure commitment scheme. Simply tweaking the private key with a value `c` allows the pubkey equation `Q = x'G + c'G` to be solved for any `c'` by modifying `x'`."
+    "In this example we demonstrate an insecure commitment scheme. The committed value `c` can be trivially modified to `c'`. The public key point equation `Q = x'G + c'G` still holds and is equal to the same point Q. An alternative secret `x` can also be solved for.\n",
+    "\n",
+    "First, we commit a contract between Alice and Bob and then demonstrate how this unsafe commitment can be changed.\n",
+    "\n",
+    "* The initial committed contract is: `Alice pays 10 BTC to Bob`"
    ]
   },
   {
@@ -170,38 +174,42 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "# Generate a key pair\n",
-    "x, P = generate_key_pair()\n",
-    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x.secret, P.get_bytes().hex()))\n",
+    "# Alice generates a key pair\n",
+    "x_key, P_key = generate_key_pair()\n",
+    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x_key.secret, P_key.get_bytes().hex()))\n",
     "\n",
-    "# Tweak the public key\n",
-    "t = random.randrange(1, SECP256K1_ORDER)\n",
-    "print(\"Tweak: {}\".format(t))\n",
-    "Q = P.tweak_add(t)\n",
+    "# Alice generates the tweak from the contract\n",
+    "contract = \"Alice agrees to pay 10 BTC to Bob\"\n",
+    "t = sha256(contract.encode('utf-8'))\n",
+    "print(\"Tweak from original contract: {}\\n\".format(t.hex()))\n",
+    "\n",
+    "# Alice tweaks her key pair\n",
+    "Q_key = P_key.tweak_add(t)\n",
+    "q_key = x_key.add(t)\n",
+    "print(\"Tweaked private key: {}\\nTweaked public key: {}\\n\".format(q_key.secret, Q_key.get_bytes().hex()))\n",
     "\n",
-    "# Create a fake tweak\n",
-    "t2 = random.randrange(1, SECP256K1_ORDER)\n",
-    "print(\"Tweak 2: {}\\n\".format(t2))\n",
+    "# Alice produces a valid signature for this tweaked public key\n",
+    "msg = sha256(b'I agree to the committed contract')\n",
+    "sig = q_key.sign_schnorr(msg)\n",
     "\n",
-    "# Solve: x` = x - t' + t\n",
-    "x_int = x.as_int()\n",
-    "x2_int = (x_int - t2 + t) % SECP256K1_ORDER\n",
+    "# Given P, Q and the contract, Bob believes he can verify the following:\n",
     "\n",
-    "x2_key = x = ECKey().set(x2_int, True)\n",
-    "P2 = x2_key.get_pubkey()\n",
-    "Q2 = P2.tweak_add(t2)\n",
+    "# 1) The contract 'Alice agrees to pay 10 BTC to Bob' is committed to public key Q\n",
+    "print(\"'Alice agrees to pay 10 BTC to Bob' appears to be committed to Q: {}\".format(\\\n",
+    "        P_key.tweak_add(sha256(contract.encode('utf-8'))) == Q_key))\n",
     "\n",
-    "print(\"Tweaked pubkey for x tweaked by t: {}\".format(Q.get_bytes().hex()))\n",
-    "print(\"Tweaked pubkey for x2 tweaked by t2: {}\".format(Q2.get_bytes().hex()))"
+    "# 2) Alice is the owner of the public key Q = P + t*G\n",
+    "print(\"Alice has produced a valid signature for Q: {}\".format(Q_key.verify_schnorr(sig, msg)))"
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### Example 2.2.4 - Tweaking the pubkey with `H(P|msg)`\n",
+    "#### Example 2.2.4: Modifying the commitment tweak of public key Q\n",
     "\n",
-    "In this example, we demonstrate a _secure_ commitment scheme. The private key is tweaked with the scalar `H(P|c)`. Since `P` appears both inside and outside the hash, it isn't possible to solve for a different `c` by modifying `x'`."
+    "However, note that is possible for Alice to modify this insecure commitment without changing the value of pub key `Q`.\n",
+    "* The committed contract is changed to : `Alice pays 0.1 BTC to Bob`"
    ]
   },
   {
@@ -210,48 +218,125 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "# Key pair generation\n",
-    "privkey1, pubkey1 = generate_key_pair()\n",
-    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x.secret, pubkey.get_bytes().hex()))\n",
+    "# Alice modifies the contract and produces an alternative tweak\n",
+    "alternative_contract = \"Alice agrees to pay 0.1 BTC to Bob\"\n",
+    "t2 = sha256(alternative_contract.encode('utf-8'))\n",
+    "print(\"Tweak from original contract: {}\".format(t.hex()))\n",
+    "print(\"Tweak from modified contract: {}\\n\".format(t2.hex()))\n",
+    "\n",
+    "# Alice modifies her original secret and public key\n",
+    "# x` = x - t' + t\n",
+    "x_int = x_key.as_int()\n",
+    "t_int = int.from_bytes(t, \"big\") \n",
+    "t2_int = int.from_bytes(t2, \"big\") \n",
+    "x2_int = (x_int - t2_int + t_int) % SECP256K1_ORDER\n",
+    "x2_key = ECKey().set(x2_int, True)\n",
+    "P2_key = x2_key.get_pubkey()\n",
+    "\n",
+    "# The resulting tweaked public Q key remains the same\n",
+    "Q2_key = P2_key.tweak_add(t2)\n",
+    "print(\"Tweaked public key from original tweak t: {}\".format(Q_key.get_bytes().hex()))\n",
+    "print(\"Tweaked public key from modified tweak t2: {}\\n\".format(Q2_key.get_bytes().hex()))\n",
+    "\n",
+    "# So Alice can still produce a valid signature for Q\n",
+    "msg2 = sha256(b'I agree to the committed contract')\n",
+    "sig2 = q_key.sign_schnorr(msg2)\n",
+    "\n",
+    "# Given P2, Q and the modified contract, \n",
+    "# Alice can demonstrate the following to invalidate the original contract:\n",
+    "\n",
+    "# 1) The modified contract 'Alice agrees to pay 0.1 BTC to Bob' appears to be committed to public key Q\n",
+    "print(\"'Alice agrees to pay 0.1 BTC to Bob' appears to be committed to Q: {}\"\\\n",
+    "      .format(P2_key.tweak_add(sha256(alternative_contract.encode('utf-8'))) == Q_key))\n",
+    "\n",
+    "# 2) Alice is still the owner of the public key Q = P2 + t2*G\n",
+    "print(\"Alice has produced a valid signature for Q: {}\".format(Q_key.verify_schnorr(sig2, msg)))"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "#### Summary of 2.2.3, 2.2.4: Insecure practice of tweaking a public key with commitment data\n",
+    "\n",
+    "We have demonstrated how a simple key tweak with commitment data does not work as a commitment scheme.\n",
+    "* Tweaking the original public key `P` with commitment data hides the commitment.\n",
+    "* However, the original public key `P` can be recomputed (`P2`) for any modified commitment, without altering the tweaked public key `Q`.\n",
+    "\n",
+    "To any observer, both original and modified \"commitments\" appear to be valid for the same public key `Q`."
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "#### Example 2.2.5 - Pay-to-contract: Tweaking the pubkey with `H(P|msg)`\n",
+    "\n",
+    "In this example, we demonstrate a _secure_ commitment scheme called pay-to-contract. The private key is tweaked with the scalar `H(P|c)`. Since `P` appears both inside and outside the hash, it isn't possible to solve for a different `c` by modifying `x'`.\n",
     "\n",
-    "# Compute the tweak from H(P|msg)\n",
-    "commitment = b'commitment'\n",
-    "ss = sha256(pubkey.get_bytes())\n",
-    "ss += sha256(commitment)\n",
+    "* Alice can now no longer invalidate her previous contract commitment with Bob."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Alice generates a key pair\n",
+    "x_key, P_key = generate_key_pair()\n",
+    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x_key.secret, P_key.get_bytes().hex()))\n",
+    "\n",
+    "# Alice computes the tweak from H(P|msg)\n",
+    "contract = \"Alice agrees to pay 10 BTC to Bob\"\n",
+    "ss = P_key.get_bytes()\n",
+    "ss += sha256(contract.encode('utf-8'))\n",
     "t = sha256(ss)\n",
     "\n",
-    "# Determine tweak point\n",
-    "tweak = ECKey().set(t, True)\n",
-    "tweak_point = tweak.get_pubkey()\n",
-    "print(\"Tweak scalar: {}\\nTweak point: {}\\n\".format(tweak.secret, tweak_point.get_bytes().hex()))\n",
+    "# Alice tweaks her key pair\n",
+    "t_key = ECKey().set(t, True)\n",
+    "T_key = t_key.get_pubkey()\n",
+    "q_key = x_key + t_key\n",
+    "Q_key = P_key + T_key\n",
+    "print(\"Tweak scalar: {}\\nTweak point: {}\\n\".format(t_key.secret, T_key.get_bytes().hex()))\n",
     "\n",
-    "privkey_tweaked = privkey + tweak\n",
-    "pubkey_tweaked = pubkey + tweak_point\n",
+    "# Alice signs a valid message\n",
+    "msg = sha256(b'I agree to the committed contract')\n",
+    "sig = q_key.sign_schnorr(msg)\n",
     "\n",
-    "# Sign message and verify signature\n",
-    "msg = sha256(b'msg')\n",
-    "sig = privkey_tweaked.sign_schnorr(msg)\n",
+    "# Given pubkey1, pubkey_tweaked and the contract, Bob can verify the following:\n",
     "\n",
-    "assert pubkey_tweaked.verify_schnorr(sig, msg)\n",
-    "print(\"Success!\")"
+    "# 1) The contract 'Alice agrees to pay 10 BTC to Bob' is committed to public key Q\n",
+    "print(\"'Alice agrees to pay 10 BTC to Bob' is committed to Q: {}\"\\\n",
+    "      .format(P_key.tweak_add(sha256(P_key.get_bytes() + sha256(contract.encode('utf-8')))) == Q_key))\n",
+    "\n",
+    "# 2) Alice is the owner of the public key P + t*G = Q\n",
+    "print(\"Alice has produced a valid signature for Q: {}\".format(Q_key.verify_schnorr(sig, msg)))"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "**Note: A pay-to-contract commitment does not require the schnorr signature scheme.** Since we are tweaking both private and public keys with the same tweak, the key pair remains valid for any compatible signature scheme, such as ECDSA."
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "## Spending a taproot output along the key path\n",
+    "## Part 2: Spending a taproot output along the key path\n",
     "\n",
-    "In this exercise, we'll create a segwit version 1 output that sends to a tweaked public key. We'll them spend that output along the key path using the tweaked private key.\n",
+    "In this exercise, we'll create a segwit v1 output that sends to a tweaked public key. We'll then spend that output along the key path using the tweaked private key.\n",
     "\n",
-    "Such as spend does not reveal the committed tweak to the observer and is indistinguishable any other key path spend."
+    "Such as spend does not reveal the committed tweak to the observer and is indistinguishable from any other key path spend."
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### _Programming Exercise 2.2.5:_ Construct taproot output with tweaked public key"
+    "#### _Programming Exercise 2.2.6:_ Construct taproot output with tweaked public key"
    ]
   },
   {
@@ -284,7 +369,7 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### Example 2.2.6: Start Bitcoin Core node and send coins to the taproot address\n",
+    "#### Example 2.2.7: Start Bitcoin Core node and send coins to the taproot address\n",
     "\n",
     "Only run setup once, or after a clean shutdown."
    ]
@@ -309,7 +394,7 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### Example 2.2.7: Construct `CTransaction` and populate inputs\n",
+    "#### Example 2.2.8: Construct `CTransaction` and populate inputs\n",
     "\n",
     "We use the `create_spending_transaction(node, txid)` convenience function."
    ]
@@ -329,7 +414,7 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### _Programming Exercise 2.2.8:_ Spend taproot output with key path"
+    "#### _Programming Exercise 2.2.9:_ Spend taproot output with key path"
    ]
   },
   {

solutions/2.2-taptweak-solutions.ipynb

@@ -64,7 +64,7 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### _Programming Exercise 2.2.5:_ Construct taproot output with tweaked public key"
+    "#### _Programming Exercise 2.2.6:_ Construct taproot output with tweaked public key"
    ]
   },
   {
@@ -98,7 +98,7 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "#### _Programming Exercise 2.2.8:_ Spend taproot output with key path"
+    "#### _Programming Exercise 2.2.9:_ Spend taproot output with key path"
    ]
   },
   {