Add challenge to proof ownership flows

[GeorgeTsagk]

Description

Currently, our ProveAssetOwnership / VerifyAssetOwnership calls create an ownership proof by creating a vPSBT that spends the asset to a NUMS key, and that challenge witness would be appended to the proof for the verifier to check.

In this PR we add a new [32]byte challenge field on both methods.

• ProveAssetOwnership: if a challenge is defined we instead spend it to NUMS + challenge*G, otherwise just NUMS (noop)
• VerifyAssetOwnership: if a challenge is defined we will construct a virtual tx that spends to NUMS +challenge*G and verify that state transition, otherwise just NUMS (noop)

Comment

In the original issue there's the expectation to encode the challenge in the proof. Since the verifier is supposed to have knowledge of the challenge, we instead add the challenge as a parameter to the VerifyAssetOwnership. This way we don't have to change the Proof TLV encoders to accept an optional [32]byte challenge, which significantly reduces code pollution and minimizes diff.

Closes #819

[coveralls]

Pull Request Test Coverage Report for Build 10405979240

Details

• 49 of 89 (55.06%) changed or added relevant lines in 6 files are covered.
• 6 unchanged lines in 3 files lost coverage.
• Overall coverage increased (+0.03%) to 40.194%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
tapchannel/aux_funding_controller.go	0	1	0.0%
tapfreighter/wallet.go	0	2	0.0%
tappsbt/create.go	0	4	0.0%
proof/verifier.go	14	22	63.64%
rpcserver.go	0	25	0.0%

Files with Coverage Reduction	New Missed Lines	%
tapdb/addrs.go	2	79.04%
tappsbt/create.go	2	53.22%
commitment/tap.go	2	84.43%

Totals
Change from base Build 10385622104:	0.03%
Covered Lines:	23731
Relevant Lines:	59041

---

💛 - Coveralls

[GeorgeTsagk]

Needs rebase after merging #1075
Will do with 1st round of fixes

[guggero]

Looks very good, thanks a lot!
Have a couple of improvements and nits, nothing major.

[guggero]

Very nice, LGTM 🎉

[guggero]

Oh, linter is unhappy. A line is too long.

[Roasbeef]

LGTM 💫

Nice n clean!

Left one comment re a simplification we can make:

• We don't need to obtain G, to then create the point G*challenge
• Instead, we can just do G*challenge, which is known as a scalar base mult

[Roasbeef]

I think we can simplify slightly: we can just do: challenge*G here, which is the same operations as creating a new EC point from a private scalar. Under the hood it handles obtaining the generator as a Jacobian point: https://github.com/decred/dcrd/blob/9aba0ced85c954fb3bff07eb2e9af7688fa21c94/dcrec/secp256k1/curve.go#L1235-L1238

[Roasbeef]

In other words, we only need to do:

var challengePoint btcec.JacobianPoint
secp256k1.ScalarBaseMultNonConst(challenge, challengePoint)

[Roasbeef]

👍

[Roasbeef]

Can can also further bind the challenge if we use h(nums || challenge) instead of just challenge.