[WIP] Schnorr signatures

[bitgamma]

Current status:

• [x] Valid signature on SECP256k1
• [x] Based on BIP Schnorr with some differences.
• [x] Uses RSA for fast(ish) multiplications
• [x] Works on JCOP3 (about 900ms with modulo, 450ms without)
• [x] Works on JCOP4 (about 500ms with modulo, 190ms without)
• [x] Calculate the modulo of (k + ed) on-card
• [ ] Decide how to handle XY coords in the final implementation
• [ ] Decide what hashing algo to use in the final implementation

The differences with BIP-Schnorr are:

• [x] XY are used and sent in their full format (65-bytes). Makes the signature larger but faster to generate. Affects compatibility.
• [x] Regular SHA256 instead of "tagged" hash is used. The JavaCard API specifies a way to give an inital state so this can be implemented if needed and if supported by our cards. Affects compatibility.
• [x] Instead of a deterministic k value, a really random one is used. Faster and since a TRNG is onboard no security issue. This does not affect compatibility at all..

Notes:

• RSA cannot be used to calculate the modulo because setting the exponent to 1 makes the encryption fail (since the output would be the same as input except for the modulo).
• The only other way to calculate the modulo fast would be proprietary APIs.

[bitgamma]

thinking about it, the modulo of k + ed must obviously be calculated on card, since d is the private key and e is known a lot of the bits of the private key would be recoverable (didn't calculate how many)

[willianpaixao]

Hey @bitgamma, great work! What's left in this PR? Can we help out? Would love this feature.

[bitgamma]

Hey @bitgamma, great work! What's left in this PR? Can we help out? Would love this feature.

this code is a proof of concept, it cannot be used in production