chore(crypto): CRP-2682 Change key derivation used in VetKD to BLS12-381 hash_to_scalar

rs/crypto/internal/crypto_lib/bls12_381/type/src/lib.rs

@@ -31,7 +31,7 @@ pub type NodeIndex = u32;
 #[cfg(test)]
 mod tests;
 
-use ic_bls12_381::hash_to_curve::{ExpandMsgXmd, HashToCurve};
+use ic_bls12_381::hash_to_curve::{ExpandMsgXmd, HashToCurve, HashToField};
 use itertools::multiunzip;
 use pairing::group::{ff::Field, Group};
 use paste::paste;
@@ -234,6 +234,18 @@ impl Scalar {
         Self::new(ic_bls12_381::Scalar::one())
     }
 
+    /// Hash to scalar
+    ///
+    /// Uses the same mechanism as RFC 9380's hash_to_field except
+    /// targeting the scalar group.
+    pub fn hash(domain_sep: &[u8], input: &[u8]) -> Self {
+        let mut s = [ic_bls12_381::Scalar::zero()];
+        <ic_bls12_381::Scalar as HashToField>::hash_to_field::<ExpandMsgXmd<sha2::Sha256>>(
+            input, domain_sep, &mut s,
+        );
+        Self::new(s[0])
+    }
+
     /// Return true iff this value is zero
     pub fn is_zero(&self) -> bool {
         bool::from(self.value.is_zero())

rs/crypto/internal/crypto_lib/bls12_381/type/tests/tests.rs

@@ -1332,6 +1332,39 @@ fn test_verify_bls_signature_batch_with_same_pk() {
     }
 }
 
+#[test]
+fn test_hash_to_scalar_matches_known_values() {
+    // I was not able to locate any official test vectors for BLS12-381 hash_to_scalar
+    // so these were just generated using ic_bls12_381 itself.
+
+    let dst = b"QUUX-V01-CS02-with-BLS12381SCALAR_XMD:SHA-256_SSWU_RO_";
+
+    scalar_test_encoding(
+        Scalar::hash(&dst[..], b""),
+        "3b3fdf74b194c0a0f683d67a312a4e72d663d74b8478dc7b56be41e0ce11caa1",
+    );
+
+    scalar_test_encoding(
+        Scalar::hash(&dst[..], b"abc"),
+        "47e7a8839695a3df27f202cf71e295a8554b47cef75c1e316b1865317720e188",
+    );
+
+    scalar_test_encoding(
+        Scalar::hash(&dst[..], b"abcdef0123456789"),
+        "3dff572f262e702f2ee8fb79b70e3225f5ee543a389eea2e58eec7b2bfd6afeb",
+    );
+
+    scalar_test_encoding(
+        Scalar::hash(&dst[..], format!("q128_{}", "q".repeat(128)).as_bytes()),
+        "2874c0e7814fcf42a5f63258417d4be8ea0465ff7352691493d0eca2dd5a9729",
+    );
+
+    scalar_test_encoding(
+        Scalar::hash(&dst[..], format!("a512_{}", "a".repeat(512)).as_bytes()),
+        "3cf6864b1a81fba0798c370f6daf9c23a838f9dbb96ea3a3a1145899ddf259b4",
+    );
+}
+
 #[test]
 fn test_hash_to_g1_matches_draft() {
     /*

rs/crypto/internal/crypto_lib/bls12_381/vetkd/BUILD.bazel

@@ -5,7 +5,6 @@ package(default_visibility = ["//rs/crypto:__subpackages__"])
 
 DEPENDENCIES = [
     # Keep sorted.
-    "//packages/ic-sha3",
     "//rs/crypto/internal/crypto_lib/bls12_381/type",
     "@crate_index//:rand",
 ]
@@ -14,6 +13,7 @@ MACRO_DEPENDENCIES = []
 
 DEV_DEPENDENCIES = [
     # Keep sorted.
+    "//packages/ic-sha3",
     "//rs/crypto/test_utils/reproducible_rng",
     "@crate_index//:hex",
     "@crate_index//:rand_chacha",

rs/crypto/internal/crypto_lib/bls12_381/vetkd/Cargo.toml

@@ -8,13 +8,13 @@ documentation.workspace = true
 
 [dependencies]
 ic-crypto-internal-bls12-381-type = { path = "../type" }
-ic-sha3 = { path = "../../../../../../packages/ic-sha3" }
 rand = { workspace = true }
 
 [dev-dependencies]
 criterion = { workspace = true }
 hex = { workspace = true }
 ic-crypto-test-utils-reproducible-rng = { path = "../../../../test_utils/reproducible_rng" }
+ic-sha3 = { path = "../../../../../../packages/ic-sha3" }
 rand_chacha = { workspace = true }
 
 [[bench]]

rs/crypto/internal/crypto_lib/bls12_381/vetkd/src/lib.rs

@@ -10,8 +10,6 @@ use ic_crypto_internal_bls12_381_type::{G2Prepared, Gt, LagrangeCoefficients};
 
 use rand::{CryptoRng, RngCore};
 
-mod ro;
-
 /// The index of a node
 pub type NodeIndex = u32;
 
@@ -24,15 +22,22 @@ pub struct DerivationPath {
 impl DerivationPath {
     /// Create a new derivation path
     pub fn new<U: AsRef<[u8]>>(canister_id: &[u8], extra_paths: &[U]) -> Self {
-        let mut ro = ro::RandomOracle::new("ic-crypto-vetkd-bls12-381-derivation-path");
+        let mut combined_inputs = vec![];
 
-        ro.update_bin(canister_id);
+        // Each input is prefixed with an 8 byte length field
+        let len = canister_id.len() as u64;
+        combined_inputs.extend_from_slice(&len.to_be_bytes());
+        combined_inputs.extend_from_slice(canister_id);
 
-        for path in extra_paths {
-            ro.update_bin(path.as_ref());
+        for input in extra_paths {
+            let len = input.as_ref().len() as u64;
+            combined_inputs.extend_from_slice(&len.to_be_bytes()); // 8 bytes length
+            combined_inputs.extend_from_slice(input.as_ref());
         }
 
-        let delta = ro.finalize_to_scalar();
+        let dst = b"ic-crypto-vetkd-bls12-381-g2-derivation-path";
+        let delta = Scalar::hash(dst, &combined_inputs);
+
         Self { delta }
     }
 

rs/crypto/internal/crypto_lib/bls12_381/vetkd/tests/tests.rs

@@ -137,19 +137,19 @@ fn encrypted_key_share_creation_is_stable() {
     let did = rng.gen::<[u8; 28]>();
 
     const EXPECTED_EKS_HASH: [&str; NODES] = [
-        "cb3075ecd2c5cd946dcfaf8486031cf7bbca656092aada97644307c598af5073",
-        "fbfaa432bd0fc9c60b456742368034d35d5fefceae1cdd027c27147ecc7f012c",
-        "7d6bd8ef201443fe5b570b62d244fc8192819f53783a1ae81e3fe747a793decd",
-        "12f894d3ddce41e5fa0cb1cd05e77d50ed214248cba809a9fe6fccf5515f5c13",
-        "d187e7bf4defab92ce9c82c692a9b3c3de65994cd4bf422438cbc515a8a48501",
-        "9aa47ad2dcf06a6a308152d935698684799714c772dfaf2b6654e6642a11937b",
-        "d96c4f897ba7e7ac657d363171b324adbad2faf13ef395bd0efa28a60273583d",
-        "fc3b2d0eae4c7d96212058d815d48701267a673c20197a08f28762301043405d",
-        "85ba21972c3a7717922d6bc734217d5dae12be7df42ffb93604e0ae7228ac9ed",
-        "3f7b6c16d35118519c92d31e074633f00fe30b6e4b522cda47d81088dc4011bb",
-        "658383824de7771db64a87b884ffbefe92567baeb851229785d9f3717c91bdda",
-        "e7a69b641278a5a8084938d1c03de2850a6639a882713a190fe0417f678e118e",
-        "d59283b0a48181d93c6e1a22e5ff9130df68a01bcadf96a25d37a2a092cb1a1a",
+        "80ed054859cdae9b7d09079a729b0c61e879892d91708cb45931ac6677195cbf",
+        "bcb9082b87a59f1a8803af65c15c5c6b0e5fdf3f13602266d476f8ce162d2e67",
+        "fc63816113db01e1a342ca3519737812d2b05d44553db94da06b71fb2143c76d",
+        "d8845c464bc5b8ed74c19e894d78b72568d3dc491699c2af3375b46115dbd380",
+        "c6b0d2c3aea119e335ed6ab11be0c01d062632ecb449e4de141ccc07faf72753",
+        "b12e66d0dde1eb179843dd0785b069baaa1d38347387176e5c71e1b4c90d789b",
+        "ed46532e685efba9ec730c3ddfd5e53b11abec2f54d1d2a4b7eda57cb278c07a",
+        "29069e6bca3d800e32a09bc9fd7a276f44794040e0ee14585ebe92d8a07e5d93",
+        "67430f3c8ccbc44a603fbdc9362bf5b229e9844ff43543f5c2b17603d863ef50",
+        "5c55e79fde3540b282ccb6100b9a20f78e6e3d6a844700e23b7e65239c2603e6",
+        "6711b786428bdc0063580d10b3bdc15da51054fa56ab58f39b5f82b6a08c9402",
+        "ab7752a8da81437d00d36884e73c51578cddbb364309a72efca951eb1266a9d7",
+        "d9d31f28af2b16d9fb8e877a8643bfb1a41854739454dceb1e09bd55fdb6bbe1",
     ];
 
     for (node_idx, expected_eks_hash) in EXPECTED_EKS_HASH.iter().enumerate() {

rs/crypto/internal/crypto_service_provider/src/vault/local_csp_vault/vetkd/tests.rs

@@ -36,9 +36,9 @@ fn should_correctly_create_encrypted_vetkd_key_share_for_smoke_test_vector() {
                 f3e68e13f62604d027660883213c90ea72810bcecee58b883fb62118e538243\
                 03718e6876ea400d083beb0439d3934122a4c4b2e58e3f145305b9a0c0a00e3\
                 2dd808574dec2605dbc7f122fe593ca0c07ca92720d0f17b7d53c9c68dbb93d\
-                489078859e5e5fe2b6612ac9536fe7f8b463cac948e6db97908b7f5a67b33b3\
-                e60a1c160889ef49448519a84be1aba0611829a7cca180cbbdf94f7b2cda2db\
-                6b14c65",
+                489078859e5e5fe2b6612ac9536fe7f8b463cafcc003efe88f1cddd26499322\
+                9229edb5ec96ea3fd2d083b815776b6cc7e03586d864374ba54d44c09201db8\
+                d33dd44",
             )
             .expect("invalid test vector")
         ))