status-im/EIPs
2
0
Fork 0
mirror of https://github.com/status-im/EIPs.git synced 2025-02-04 19:13:48 +00:00
Code Issues Projects Releases Wiki Activity

add proposal text

Browse Source
This commit is contained in:
Tobias Oberstein 2018-03-25 20:55:44 +02:00
parent d5f1f9e10f
commit a70a025520
1 changed files with 60 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
EIPS/eip-665.md
View File

@ -1,45 +1,82 @@
---
eip: <to be assigned>
title: <EIP title>
author: <list of authors' names and optionally, email addresses>
discussions-to: <email address>
eip: 665
title: Add precompiled contract for Ed25519 signature verification
author: Tobias Oberstein <tobias.oberstein@crossbario.com>
status: Draft
type: <Standards Track (Core, Networking, Interface, ERC) | Informational | Meta>
category (*only required for Standard Track): <Core | Networking | Interface | ERC>
created: <date created on, in ISO 8601 (yyyy-mm-dd) format>
requires (*optional): <EIP number(s)>
replaces (*optional): <EIP number(s)>
type: Standards Track
category: Core
created: 2018-03-25
---
This is the suggested template for new EIPs.
Note that an EIP number will be assigned by an editor. When opening a pull request to submit your EIP, please use an abbreviated title in the filename, `eip-draft_title_abbrev.md`.
The title should be 44 characters or less.
## Simple Summary
"If you can't explain it simply, you don't understand it well enough." Provide a simplified and layman-accessible explanation of the EIP.
Support performant and cheap verification of Ed25519 cryptographic signatures in smart contracts in general by adding a precompiled contract for Ed25519 signature verification to the EVM.
## Abstract
A short (~200 word) description of the technical issue being addressed.
Verification of Ed25519 cryptographic signatures is obviously possible in EVM bytecode. However, the gas cost will be very high, and computationally expensive, as such tight, wide word operations intensive code as required for Ed25519 is not a good fit for the EVM bytecode model.
The addition of a native compiled function, in a precompiled contract, to the EVM solves both cost and performance problems.
## Motivation
The motivation is critical for EIPs that want to change the Ethereum protocol. It should clearly explain why the existing protocol specification is inadequate to address the problem that the EIP solves. EIP submissions without sufficient motivation may be rejected outright.
One motivation for Ed25519 signature verification in smart contracts is to associate existing off-chain systems, records or accounts that use Ed25519 with blockchain transactions.
Another motivation is the processing of external, Ed25519 proof-of-stake based blockchains within Ethereum smart contracts.
When a transactions contains data that comes with an Ed25519 signature, that proves that the sender of the Ethereum transaction was also in control of the private key (and the data), and this allows the contract to establish an association between the blockchain and the external system or account, and the external system establish the reverse relation.
For example, a contract might check a Ed25519 signed piece of data submitted to the Ethereum transaction like the current block number. That proves to the contract, that the sender is in possession of both the Ethereum private key and the Ed25518 private key, and hence the contract will accept an association between both. This again can be the root anchor for various powerful applications, as now a potentially crypto holding key owner has proven to be in control of some external off-chain system or account, like e.g. a DNS server, a DNS domain, a cluster node and so on.
## Specification
The technical specification should describe the syntax and semantics of any new feature. The specification should be detailed enough to allow competing, interoperable implementations for any of the current Ethereum platforms (cpp-ethereum, go-ethereum, parity, ethereumj, ethereumjs, ...).
The proposal adds a new precompiled function with the following signature
```
ed25519verify(bytes32 m, bytes32 pk, bytes32 s1, bytes32 s2) returns (uint8)
```
The `ed25519verify` function takes as parameters:
1. `m` (bytes32): The message that was signed.
2. `pk` (bytes32): The Ed25519 public key of the signer.
3. `s1` (bytes32): The first part of the 64-byte Ed25519 signature.
4. `s2` (bytes32): The second part of the 64-byte Ed25519 signature.
The `ed25519verify` function returns zero if the signature was valid, and a non-zero value if the signature was invalid.
## Rationale
The rationale fleshes out the specification by describing what motivated the design and why particular design decisions were made. It should describe alternate designs that were considered and related work, e.g. how the feature is supported in other languages. The rationale may also provide evidence of consensus within the community, and should discuss important objections or concerns raised during discussion.
The proposed `ed25519verify` function takes the signer public key as a call parameter, as with Ed25519, I don't believe it is possible to derive the signers public key from the signature and message alone.
The proposed `ed25519verify` function uses a zero return value to indicate success, since this allows for different errors to be distinguished by return value, as all non-zero return values signal a verification failure.
## Backwards Compatibility
All EIPs that introduce backwards incompatibilities must include a section describing these incompatibilities and their severity. The EIP must explain how the author proposes to deal with these incompatibilities. EIP submissions without a sufficient backwards compatibility treatise may be rejected outright.
The proposal is belived not to introduce any backward compatibility issues.
## Test Cases
Test cases for an implementation are mandatory for EIPs that are affecting consensus changes. Other EIPs can choose to include links to test cases if applicable.
Test vectors for Ed25519 can be found in this IETF ID https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-6.
More test vectors can be found in the regression tests of NaCl (see references).
## Implementation
The implementations must be completed before any EIP is given status "Final", but it need not be completed before the EIP is accepted. While there is merit to the approach of reaching consensus on the specification and rationale before writing code, the principle of "rough consensus and running code" is still useful when it comes to resolving many discussions of API details.
NaCl is a high-quality implementation of Ed25519, available from the same team that created the algorithms and cryptography behind Ed25519.
The library should allow implementations of the proposed `ed25519verify` function with few lines of code in the hosting Ethereum implementation.
## References
* Definition of Ed25519: https://ed25519.cr.yp.to/ed25519-20110926.pdf
* Ed25519 - high-speed high-security signatures: https://ed25519.cr.yp.to/
* NaCl - Networking and Cryptography library: https://nacl.cr.yp.to/sign.html
* NaCl Crypto Libraries (which contains Ed25519): https://ianix.com/pub/ed25519-deployment.html
* Test vectors for Ed25519: https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-6
* NaCl regression tests: https://ed25519.cr.yp.to/python/sign.py and https://ed25519.cr.yp.to/python/sign.input
* On the recoverability of public keys from signature+message (alone): https://crypto.stackexchange.com/questions/9936/what-signature-schemes-allow-recovering-the-public-key-from-a-signature
## Copyright
Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/).