[WIP]Feat/zcash #1366

soralit · 2024-09-26T02:15:46Z

Keystone Zcash UR Registries

This protocol is based on the Uniform Resources. It describes the data schemas (UR Registries) used in Zcash integrations.

Introduction

Keystone's QR workflow involves two main steps: linking the wallet and signing data, broken down into three sub-steps:

Wallet Linking: Keystone generates a QR code with public key info for the Watch-Only wallet to scan and import.
Transaction Creation: The Watch-Only wallet creates a transaction and generates a QR code for Keystone to scan, parse, and display.
Signing Authorization: Keystone signs the transaction, displays the result as a QR code for the Watch-Only wallet to scan and broadcast.

Two UR Registries are needed for these steps, utilizing the Partially Created Zcash Transaction structure.

Zcash Accounts

Unified Full Viewing Key (UFVK)

UFVK is a standard account expression format in Zcash as per ZIP-316. It consists of:

Transparent
Sprout
Sapling
Orchard

This protocol focuses on the Transparent and Orchard components.

CDDL for Zcash Accounts

The specification uses CDDL and includes crypto-hdkey and crypto-key-path specs defined in https://github.com/BlockchainCommons/Research/blob/master/papers/bcr-2020-007-hdkey.md.

zcash-accounts = {
    seed-fingerprint: bytes.32, ; the seed fingerprint specified by ZIP-32 to identify the wallet
    accounts: [+ zcash-ufvk],
    ? origin: text, ; source of data, e.g., Keystone
}

zcash-ufvk = {
    ? transparent: crypto-hdkey,
    orchard: zcash-fvk,
    ? name: text,
}

zcash-fvk = {
    key-path: crypto-key-path,
    key-data: bytes,
}

zcash-ufvk describes the UFVK of a Zcash account. Each seed has multiple accounts with different indexes. For index 0, zcash-ufvk should contain a BIP32 extended public key with path M/44'/133'/0' (transparent) and an Orchard FVK with path M_orchard/32'/133'/0' (Orchard).

CDDL for Zcash PCZT

zcash-pczt {
    data: bytes, ; Zcash PCZT, signatures inserted after signing.
}

daira · 2024-09-26T07:24:08Z

docs/protocols/ur_registrys/draft/zcash.md

+
+```cddl
+zcash-accounts = {
+    master-fingerprint: uint32, ; the master fingerprint to identify the wallet


ZIP 32 specifies a 16-byte seed fingerprint: https://zips.z.cash/zip-0032#seed-fingerprints
It's a byte array so endian-independent.

It's good to use this seed fingerprint instead.

daira · 2024-09-26T07:25:07Z

docs/protocols/ur_registrys/draft/zcash.md

+}
+```
+
+`zcash-ufvk` describes the UFVK of a Zcash account. Each seed has multiple accounts with different indexes. For index 0, `zcash-ufvk` should contain a BIP32 extended public key with path `M/44'/133'/0'` (transparent) and an Orchard FVK with path `M_orchard/32'/133'/0'` (Orchard).


Specify that:

M is defined as in https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#master-key-generation

M_orchard (we use $m_{\mathsf{Orchard}}$) is defined as in https://zips.z.cash/zip-0032#orchard-master-key-generation .

133' is for mainnet. Like other coins, we use 1' for testnet as specified in SLIP 44.

soralit · 2024-10-08T10:38:55Z

Latest protocol is updated in the code base.

daira · 2024-10-08T14:42:55Z

//is versionGroupId still needed?

The purpose of versionGroupId is to unambiguously identify the transaction format even if version numbers are reused across Zcash forks, and that's still relevant for PCZTs.

I think we'd want to include Sapling components even if it isn't supported for Keystone, because it is needed for other applications of PCZTs.

soralit · 2024-10-09T07:49:21Z

rust/pczt/src/protos/pczt.proto

Added a proto file. Also added the sapling definitions.

daira · 2024-10-09T14:35:56Z

images/coin/coinZec.png

I see that the barred Z is transparent. I think that's correct in that it should be white in light mode and black in dark mode (see "Horizontal logos" or "Vertical logos" at https://z.cash/press/ ).

daira · 2024-10-09T14:40:33Z

images/walletList/walletListZashi.png

This is probably not going to work in light mode, because the Zashi logo and name are in white.

str4d · 2024-12-12T13:12:45Z

rust/apps/zcash/src/pczt/check.rs

+                                if target.public_key().serialize().to_vec()
+                                    != input.script_pubkey().clone()
+                                {
+                                    return Err(ZcashError::InvalidPczt(
+                                        "transparent input script pubkey mismatch".to_string(),
+                                    ));
+                                }


I have not confirmed the alterations to your vendored code, but if target here has type bip32::ExtendedPublicKey<secp256k1::PublicKey> (like it does inside zcash_primitives::legacy::keys::AccountPubKey) then there is a bug here: you are comparing the serialized public key to the script_pubkey, but for P2PKH scripts the serialized public key appears in the script_sig; only its hash is present in script_pubkey.

str4d · 2024-12-12T13:16:26Z

rust/apps/zcash/src/pczt/check.rs

+    match script.address() {
+        Some(TransparentAddress::PublicKeyHash(hash)) => {
+            let pubkey = input.bip32_derivation().keys().find(|pubkey| {
+                return hash[..] == Ripemd160::digest(Sha256::digest(pubkey))[..];
+            });


Similarly, this check is incorrect:

hash is the hash of the script_pubkey

input.bip32_derivation() contains a map from the encoded public key to its derivation.

This follows PSBT semantics (from BIP 174) where the derivation map lists encoded keys; bip32_derivation is not a map from script_pubkey to derivation path. This is because a P2SH script may contain multiple such keys and require multiple signatures. A P2PKH script happens to only contain one, but for symmetry the PCZT format treats it the same way (like PSBT).

str4d · 2024-12-12T13:16:45Z

rust/apps/zcash/src/pczt/check.rs

+    match script.address() {
+        Some(TransparentAddress::PublicKeyHash(hash)) => {
+            let pubkey = output
+                .bip32_derivation()
+                .keys()
+                .find(|pubkey| hash[..] == Ripemd160::digest(Sha256::digest(pubkey))[..]);


This is similarly incorrect.

str4d · 2024-12-12T13:16:55Z

rust/apps/zcash/src/pczt/check.rs

+                                if target.public_key().serialize().to_vec()
+                                    != output.script_pubkey().clone()
+                                {
+                                    return Err(ZcashError::InvalidPczt(
+                                        "transparent output script pubkey mismatch".to_string(),
+                                    ));
+                                }


This is similarly incorrect.

soralit marked this pull request as draft September 26, 2024 02:15

daira reviewed Sep 26, 2024

View reviewed changes

soralit force-pushed the feat/zcash branch from 4d593a4 to a38baee Compare September 29, 2024 04:00

soralit force-pushed the feat/zcash branch from a38baee to 6f857af Compare October 8, 2024 10:43

soralit force-pushed the feat/zcash branch from 6f857af to 580014a Compare October 9, 2024 07:47

soralit commented Oct 9, 2024

View reviewed changes

rust/pczt/src/protos/pczt.proto Outdated

Copy link

Contributor Author

soralit Oct 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a proto file. Also added the sapling definitions.

soralit force-pushed the feat/zcash branch 3 times, most recently from 9cda39e to 90596a9 Compare October 9, 2024 09:38

daira reviewed Oct 9, 2024

View reviewed changes

images/walletList/walletListZashi.png Outdated

Copy link

daira Oct 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably not going to work in light mode, because the Zashi logo and name are in white.

soralit force-pushed the feat/zcash branch 3 times, most recently from 13f57a2 to a809fdc Compare October 14, 2024 05:31

soralit force-pushed the feat/zcash branch 2 times, most recently from 515890a to ea142af Compare November 5, 2024 10:13

soralit force-pushed the feat/zcash branch from ea142af to 1b8acca Compare November 13, 2024 07:49

soralit added 10 commits November 21, 2024 10:59

feat: zcash basic support

4aad569

feat: introduce pczt vendor crate

2903b14

refactor: zcash crates

8e43145

fix: build

127a132

feat: update pczt data hash

f428dec

feat: extend pczt functionality

eb53eb9

feat: impl signer for pczt

00e880c

fix: pczt hash

ca85624

fix: adjust transaction signing code

2764d40

feat: adopt pczt latest changes

87feccf

soralit added 8 commits November 21, 2024 11:00

feat: support pczt check and parse output ciphertext

1b4302a

feat: parst pczt transparent and orchard

25bc664

feat: add zcash interfaces

1f91864

feat: zcash ui

c6e21ce

feat: add rust structs

4b91615

chore: reduce firmware size

dd424bc

chore: update dep

e1b7dca

feat: zcash basic transaction view

24ab478

soralit force-pushed the feat/zcash branch from bfe5f9a to 24ab478 Compare November 26, 2024 06:28

soralit added 2 commits December 6, 2024 17:42

feat: pull pczt latest changes

2fb035d

fix: correct sign hash and check

c85b881

soralit force-pushed the feat/zcash branch 3 times, most recently from 6786374 to 65ec54c Compare December 10, 2024 10:06

chore: bump version

60abf50

soralit force-pushed the feat/zcash branch from 65ec54c to 60abf50 Compare December 10, 2024 10:10

soralit added 4 commits December 11, 2024 16:01

fix: should not render transparent part when it is None

9d47c92

chore: bump version

3eae55d

fix: omit pczt checking ATM

101a0d8

chore: bump beta version

011282a

soralit force-pushed the feat/zcash branch from 6453e73 to 011282a Compare December 11, 2024 11:59

soralit added 3 commits December 12, 2024 14:09

fix: wrong total transfer value

c4a4ac7

fix: pczt transaction signing and display issues

055e8f4

chore: bump beta version

1edc768

str4d suggested changes Dec 12, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP]Feat/zcash #1366

[WIP]Feat/zcash #1366

soralit commented Sep 26, 2024 •

edited

Loading

daira Sep 26, 2024

soralit Sep 27, 2024

daira Sep 26, 2024

soralit commented Oct 8, 2024 •

edited

Loading

daira commented Oct 8, 2024 •

edited

Loading

soralit Oct 9, 2024

daira Oct 9, 2024

daira Oct 9, 2024

str4d Dec 12, 2024

str4d Dec 12, 2024

str4d Dec 12, 2024

str4d Dec 12, 2024

[WIP]Feat/zcash #1366

Are you sure you want to change the base?

[WIP]Feat/zcash #1366

Conversation

soralit commented Sep 26, 2024 • edited Loading

Keystone Zcash UR Registries

Introduction

Zcash Accounts

Unified Full Viewing Key (UFVK)

CDDL for Zcash Accounts

CDDL for Zcash PCZT

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soralit commented Oct 8, 2024 • edited Loading

daira commented Oct 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soralit commented Sep 26, 2024 •

edited

Loading

soralit commented Oct 8, 2024 •

edited

Loading

daira commented Oct 8, 2024 •

edited

Loading