Stable branch missing crypto_core_ed25519_scalar_is_canonical

[Green-Sky]

I was trying to use crypto_core_ed25519_scalar_is_canonical() which was pushed to master 5 years ago c2efce1 .
But it never made it's way into stable.

[jedisct1]

This is not a bug. That function was never documented.

[Green-Sky]

Right, sorry for assuming it was. :)

[jedisct1]

It may be added to a future version, though. What is your use case for it?

[Green-Sky]

I am implementing the "secure comparator" zero knowledge proof using libsodium, and the random scalars don't work without certain extra bits cleared and set.

5.1 ECC-Specific Considerations
All numbers used in ECC calculations for best security must be less than ECC base point order. For
ed25519, a suitable number is any 32-byte array, but with three last bits cleared in the first byte,
first bit cleared and second bit set in the last byte. This applies to any random numbers used as well
as for the secrets themselves.

https://cossacklabs.com/files/secure-comparator-paper-rev12.pdf

Later on they also say that is is a requirement set by the ed25519 paper (ref 11).
I skimmed the ed25519 paper, but only found some of this. I am not a real cryptographer.

So additionally I want to to know why the random scalar function deviates here.

[Green-Sky]

(was writing while you wrote, oops)

[jedisct1]

The protocol does this to ensure that scalar multiplication results don’t fall into a small subgroup. It’s a protocol-specific workaround, but Ristretto255 would be a better choice, easier to use correctly and requires no bit-level modifications.

[jedisct1]

Just released something related: https://github.com/jedisct1/c-sigma

[Green-Sky]

Looks good.
Assuming I am using schnorr for verifying the knowledge of a shared secret, I could build a protocol that works something like this:

Setup

Hash shared_secret (potentially kdf/expensive, globally one time, so its fine)
Generate "public_key" from secret(witness).

Alice

Send request for proof of knowledge to Bob with random number(challenge) as message to sign.

Bob

Generates proof and sends it with his own challenge message to sign to Alice.

Alice

Verifies Bob's proof.
Generates proof for the provided messages and send to Bob.

Bob

Verifies Alice's proof.

And maybe some ack tail packets...