Switch dependencies to accelerated versions

Cargo.toml

@@ -13,9 +13,15 @@ resolver = "2"
 
 [dependencies]
 hex = { version = "0.4", default-features = false, features = ["alloc"] }
-sha2 = { version = "0.9", default-features = false }
+sha2 = { git = "https://github.com/risc0/RustCrypto-hashes", tag = "sha2-v0.10.8-risczero.0" }
 rand_core = { version = "0.6", default-features = false }
-curve25519-dalek = { package = "curve25519-dalek-ng", version = "4.1", default-features = false, features = ["u64_backend", "alloc"] }
+curve25519-dalek = { git = "https://github.com/risc0/curve25519-dalek", tag = "curve25519-4.1.2-risczero.0", default-features = false, features = [
+	"alloc",
+	"zeroize",
+	"legacy_compatibility",
+	"digest",
+	"precomputed-tables",
+] }
 serde = { version = "1", optional = true, features = ["derive"] }
 zeroize = { version = "1.1", default-features = false }
 thiserror = { version = "1", optional = true }

src/batch.rs

@@ -51,12 +51,13 @@
 use std::{collections::HashMap, convert::TryFrom};
 
 use curve25519_dalek::{
+    digest::Update,
     edwards::{CompressedEdwardsY, EdwardsPoint},
     scalar::Scalar,
     traits::{IsIdentity, VartimeMultiscalarMul},
 };
 use rand_core::{CryptoRng, RngCore};
-use sha2::{Digest, Sha512};
+use sha2::Sha512;
 
 use crate::{Error, Signature, VerificationKey, VerificationKeyBytes};
 
@@ -177,20 +178,21 @@ impl Verifier {
         let mut As = Vec::with_capacity(m);
         let mut R_coeffs = Vec::with_capacity(self.batch_size);
         let mut Rs = Vec::with_capacity(self.batch_size);
-        let mut B_coeff = Scalar::zero();
+        let mut B_coeff = Scalar::ZERO;
 
         for (vk_bytes, sigs) in self.signatures.iter() {
             let A = CompressedEdwardsY(vk_bytes.0)
                 .decompress()
                 .ok_or(Error::InvalidSignature)?;
 
-            let mut A_coeff = Scalar::zero();
+            let mut A_coeff = Scalar::ZERO;
 
             for (k, sig) in sigs.iter() {
                 let R = CompressedEdwardsY(sig.R_bytes)
                     .decompress()
                     .ok_or(Error::InvalidSignature)?;
-                let s = Scalar::from_canonical_bytes(sig.s_bytes).ok_or(Error::InvalidSignature)?;
+                let s: Scalar = Option::from(Scalar::from_canonical_bytes(sig.s_bytes))
+                    .ok_or(Error::InvalidSignature)?;
                 let z = Scalar::from(gen_u128(&mut rng));
                 B_coeff -= z * s;
                 Rs.push(R);

src/signing_key.rs

@@ -1,6 +1,6 @@
 use core::convert::TryFrom;
 
-use curve25519_dalek::{constants, scalar::Scalar};
+use curve25519_dalek::{constants, digest::Update, scalar::Scalar};
 use rand_core::{CryptoRng, RngCore};
 use sha2::{Digest, Sha512};
 
@@ -100,6 +100,7 @@ impl From<[u8; 32]> for SigningKey {
             scalar_bytes[0] &= 248;
             scalar_bytes[31] &= 127;
             scalar_bytes[31] |= 64;
+            #[allow(deprecated)]
             Scalar::from_bits(scalar_bytes)
         };
 
@@ -111,7 +112,7 @@ impl From<[u8; 32]> for SigningKey {
         };
 
         // Compute the public key as A = [s]B.
-        let A = &s * &constants::ED25519_BASEPOINT_TABLE;
+        let A = &s * constants::ED25519_BASEPOINT_TABLE;
 
         SigningKey {
             seed,
@@ -160,7 +161,7 @@ impl SigningKey {
     pub fn sign(&self, msg: &[u8]) -> Signature {
         let r = Scalar::from_hash(Sha512::default().chain(&self.prefix[..]).chain(msg));
 
-        let R_bytes = (&r * &constants::ED25519_BASEPOINT_TABLE)
+        let R_bytes = (&r * constants::ED25519_BASEPOINT_TABLE)
             .compress()
             .to_bytes();
 

src/verification_key.rs

@@ -1,11 +1,12 @@
 use core::convert::{TryFrom, TryInto};
 
 use curve25519_dalek::{
+    digest::Update,
     edwards::{CompressedEdwardsY, EdwardsPoint},
     scalar::Scalar,
     traits::IsIdentity,
 };
-use sha2::{Digest, Sha512};
+use sha2::Sha512;
 
 use crate::{Error, Signature};
 
@@ -237,7 +238,8 @@ impl VerificationKey {
     #[allow(non_snake_case)]
     pub(crate) fn verify_prehashed(&self, signature: &Signature, k: Scalar) -> Result<(), Error> {
         // `s_bytes` MUST represent an integer less than the prime `l`.
-        let s = Scalar::from_canonical_bytes(signature.s_bytes).ok_or(Error::InvalidSignature)?;
+        let s = Option::from(Scalar::from_canonical_bytes(signature.s_bytes))
+            .ok_or(Error::InvalidSignature)?;
         // `R_bytes` MUST be an encoding of a point on the twisted Edwards form of Curve25519.
         let R = CompressedEdwardsY(signature.R_bytes)
             .decompress()

tests/batch.rs

@@ -1,3 +1,5 @@
+#![cfg(feature = "std")]
+
 use rand::thread_rng;
 
 use ed25519_consensus::*;

tests/small_order.rs

@@ -1,17 +1,18 @@
 use color_eyre::Report;
 use curve25519_dalek::{
-    constants::EIGHT_TORSION, edwards::CompressedEdwardsY, scalar::Scalar, traits::IsIdentity,
+    constants::EIGHT_TORSION, digest::Update, edwards::CompressedEdwardsY, scalar::Scalar,
+    traits::IsIdentity,
 };
 use once_cell::sync::Lazy;
-use sha2::{Digest, Sha512};
+use sha2::Sha512;
 
 mod util;
 use util::TestCase;
 
 #[allow(non_snake_case)]
 pub static SMALL_ORDER_SIGS: Lazy<Vec<TestCase>> = Lazy::new(|| {
     let mut tests = Vec::new();
-    let s = Scalar::zero();
+    let s = Scalar::ZERO;
 
     // Use all the canonical encodings of the 8-torsion points,
     // and the low-order non-canonical encodings.
@@ -86,6 +87,7 @@ fn conformance() -> Result<(), Report> {
 }
 
 #[test]
+#[cfg(feature = "std")]
 fn individual_matches_batch_verification() -> Result<(), Report> {
     use ed25519_consensus::{batch, Signature, VerificationKey, VerificationKeyBytes};
     use std::convert::TryFrom;

tests/util/mod.rs

@@ -58,7 +58,7 @@ impl TestCase {
     fn check_zip215(&self) -> Result<(), Report> {
         use ed25519_consensus::{Signature, VerificationKey};
         let sig = Signature::from(self.sig_bytes);
-        VerificationKey::try_from(self.vk_bytes).and_then(|vk| vk.verify(&sig, b"Zcash"))?;
+        VerificationKey::try_from(self.vk_bytes).and_then(|vk| vk.verify(&sig, b"Zcash")).unwrap();
         Ok(())
     }
 }