Add EIP: Precompiled for secp256r1 Curve Support #7212

ulerdogan · 2023-06-22T12:35:49Z

Add EIP: Precompiled for secp256r1 Curve Support

The post is about a new EIP which proposes the addition of a new precompiled contract to the EVM that allows signature verifications in the “secp256r1” elliptic curve by given parameters of message hash, r - s components of the signature, and x - y coordinates of the public key.

eth-bot · 2023-06-22T12:36:20Z

File `EIPS/eip-7212.md`

Requires 1 more reviewers from @axic, @g11tech, @gcolvin, @lightclient, @Pandapip1, @SamWilsn

github-actions · 2023-06-22T13:12:37Z

The commit 1d87d6e (as a parent of ec7ea83) contains errors.
Please inspect the Run Summary for details.

xinbenlv

LGTM,

The proposal provided reasonable motivation and clear specs about the input and output and tests to validate, gave gas cost and other spec decision in the rationale. Editorially, I think this PR is good enough to merge as a Draft.

Leaving technical feedback, such as the design choice of verifying only v component, to the peer reviews by the client developers.

jwasinger

I left a few comments.

jwasinger · 2023-06-23T03:52:08Z

EIPS/eip-7212.md

+- [P256Verify Benchmark Test Results](../assets/eip-7212/p256Verify_benchmark_test)
+- [Ecrecover Benchmark Test Results](../assets/eip-7212/ecrecover_benchmark_test)
+
+```


IMO it's uneccessary to put system-specific benchmark results in the EIP itself.

Hi, thanks for your comments! How do the benchmarks be displayed? I think that it's important to propose gas costs for the precompiled contract. I thought if I am comparing two results to propose gas cost in the same system would be beneficial. Should I include more systems benchmark results or completely remove it?

IMHO The benchmark is being supplied as assets, I personally think it's a good supporting evidence for rationale like the gas cost choice. Hence I think it's good to be there. My two cents. Others might disagree.

EIPS/eip-7212.md

jwasinger · 2023-06-23T05:11:31Z

EIPS/eip-7212.md

+
+## Rationale
+
+The "secp256r1" elliptic curve signatures consists of `v`, `r`, `s` components. Even if recovering the public key on the curve is possible, most of the applications are not generating `v` component of the signature and it causes an uncertainty of the result values. However, the signatures can be verified with only `r` - `s` values. In order to provide an exact and more compatible method, verification is preferred over recovery to propose in a precompiled.


It would be nice to clarify exactly what we gain from requiring x/y as inputs. It's not clear to me from the explanation here.

And requiring them as inputs requires substantial added call data.

If I understand correctly,

v is a sign bit

the P256 precompile is intended to support hardware signatures

most of the existing hardware signature mechanisms (Secure Enclave, Webauthn, etc) return only the (r,s) signature

It's easy to recover v -- you try the two possible values, and see which one returns your public key.

So the comparison is something like

v, r, s style

Pros

Matches ecrecover.

Less calldata. On the surface, 1 word = 32 bytes less, but actual savings should be a bit more, since the v parameter is mostly 0 bytes and therefore cheaper.

Cons

Users / libraries have to recover v. This is a bit awkward. Instead of just calling (hardware signing module), it has to call (hardware signing module) > (attempt verification with + v) > (attempt verification with - v). I am not a cryptographer... maybe there's a better way.

v, r, x, y style

Pros

Better matches the hardware interface. Users/libraries don't have to recover v, they just pass a pubkey (x,y) directly from the hardware enclave.

FYI ERC-2098 by @ricmoo for might be relevant in the same spirit where user / library recovers v for secp256k1.

This is provided to you as a reference and you can gauge the preference by usage / adoption for designing the precompiles

Thanks @dcposch for the explanation of the logic.

Yes, the mechanisms using the curve are returning only r and s, so the verification is possible with inputting public key coordinates x and y.

We need v value to recover public key without the x and y coordinates. The v value can be found by above-mentioned methods, but let me explain my design choice:

While we are making recovery with the ecrecover, we can reach the public address of the EOA accounts, so it can be directly used in the smart contracts. Unlikely, recovering the secp256r1 public key does not match any default stored types, and we still need to store the account public key.

Having to find the v value in the implementation part of the signature creates complexity on the application side. So, I didn't want to bring this complexity for the applications. Still, I would love to reassess and edit the EIP to implement recovery after discussion.

EIPS/eip-7212.md

paulmillr · 2023-06-25T14:33:17Z

-1

256r1 is usually more vulnerable to timing attacks than stuff like 25519.
256r1 is not even recommended by nist at this point, 384r1 is.
There are some rumors with regards to general security of r1 curves, it's unclear.
Adding a new elliptic curve impl into ALL execution layer clients is not a trivial task. I don't think the feature is too useful for this.

xinbenlv · 2023-06-26T16:29:09Z

@paulmillr thanks for the feedback.
Editor here: for any technical feedback like those you gave, they are recommended to be put in https://ethereum-magicians.org/t/eip-7212-precompiled-for-secp256r1-curve-support/14789 so when this PR is merged, the discussion can continue and also has a higher chance to be seen by other peer reviewers.

ulerdogan · 2023-06-27T00:16:07Z

**paulmillr ** commented

Hi, thanks for you comment!

Moved it to the EM forum for discussion: https://ethereum-magicians.org/t/eip-7212-precompiled-for-secp256r1-curve-support/14789/5?u=ulerdogan

EIPS/eip-7212.md

Co-authored-by: Sam Wilson <57262657+SamWilsn@users.noreply.github.com>

* Add EIP: Precompiled for secp256r1 Curve Support * Update EIP: Fix the date * Update: Update with the numbers and links * Fix: Lint errors fixed * Fix: Lint errors v2 fixed * Fix: Disallowed links are removed * Update: Fix the specification misrepresentations * Update: Change license link Co-authored-by: Sam Wilson <57262657+SamWilsn@users.noreply.github.com> --------- Co-authored-by: Sam Wilson <57262657+SamWilsn@users.noreply.github.com>

ulerdogan added 2 commits May 17, 2023 21:41

Add EIP: Precompiled for secp256r1 Curve Support

a25412f

Update EIP: Fix the date

b3f1972

ulerdogan requested a review from eth-bot as a code owner June 22, 2023 12:35

github-actions bot added c-new Creates a brand new proposal s-draft This EIP is a Draft t-core labels Jun 22, 2023

eth-bot added e-consensus Waiting on editor consensus e-review Waiting on editor to review labels Jun 22, 2023

github-actions bot added the w-ci Waiting on CI to pass label Jun 22, 2023

ulerdogan and others added 2 commits June 22, 2023 15:48

Update: Update with the numbers and links

fb90cf4

Merge branch 'master' into ulerdogan/add-eip

6c775ee

github-actions bot added w-ci Waiting on CI to pass and removed w-ci Waiting on CI to pass labels Jun 22, 2023

ulerdogan added 2 commits June 22, 2023 16:00

Fix: Lint errors fixed

077d635

Fix: Lint errors v2 fixed

1d87d6e

github-actions bot removed the w-ci Waiting on CI to pass label Jun 22, 2023

github-actions bot added the w-ci Waiting on CI to pass label Jun 22, 2023

Fix: Disallowed links are removed

fbaaa02

github-actions bot removed the w-ci Waiting on CI to pass label Jun 22, 2023

ulerdogan mentioned this pull request Jun 22, 2023

EIPIP Meeting 84 ethcatherders/EIPIP#245

Closed

4 tasks

xinbenlv approved these changes Jun 22, 2023

View reviewed changes

ulerdogan mentioned this pull request Jun 22, 2023

EIP Editing Office Hour Meeting 20 ethcatherders/EIPIP#244

Closed

15 tasks

Merge branch 'master' into ulerdogan/add-eip

1d9a85c

jwasinger reviewed Jun 23, 2023

View reviewed changes

dcposch reviewed Jun 23, 2023

View reviewed changes

EIPS/eip-7212.md Show resolved Hide resolved

ulerdogan and others added 2 commits June 23, 2023 23:57

Update: Fix the specification misrepresentations

823c8ac

Merge branch 'master' into ulerdogan/add-eip

d5fb2f5

jskelly84 approved these changes Jun 26, 2023

View reviewed changes

SamWilsn reviewed Jun 27, 2023

View reviewed changes

EIPS/eip-7212.md Outdated Show resolved Hide resolved

SamWilsn previously approved these changes Jun 27, 2023

View reviewed changes

Update: Change license link

a265902

Co-authored-by: Sam Wilson <57262657+SamWilsn@users.noreply.github.com>

ulerdogan dismissed SamWilsn’s stale review via a265902 June 27, 2023 15:11

Merge branch 'master' into ulerdogan/add-eip

15f7137

ulerdogan requested a review from SamWilsn June 27, 2023 17:46

SamWilsn approved these changes Jun 27, 2023

View reviewed changes

jskelly84 approved these changes Jun 28, 2023

View reviewed changes

SamWilsn merged commit 64b7d76 into ethereum:master Jun 29, 2023

sambacha mentioned this pull request Jul 9, 2023

feat: migrate to CreateX for CREATE2 factory (or let user define create2 factory) foundry-rs/foundry#2638

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add EIP: Precompiled for secp256r1 Curve Support #7212

Add EIP: Precompiled for secp256r1 Curve Support #7212

ulerdogan commented Jun 22, 2023

eth-bot commented Jun 22, 2023 •

edited

Loading

github-actions bot commented Jun 22, 2023

xinbenlv left a comment

jwasinger left a comment •

edited

Loading

jwasinger Jun 23, 2023 •

edited

Loading

ulerdogan Jun 23, 2023

xinbenlv Jun 23, 2023

jwasinger Jun 23, 2023

dcposch Jun 23, 2023 •

edited

Loading

xinbenlv Jun 23, 2023 •

edited

Loading

ulerdogan Jun 23, 2023

paulmillr commented Jun 25, 2023

xinbenlv commented Jun 26, 2023

ulerdogan commented Jun 27, 2023


		## Rationale

		The "secp256r1" elliptic curve signatures consists of `v`, `r`, `s` components. Even if recovering the public key on the curve is possible, most of the applications are not generating `v` component of the signature and it causes an uncertainty of the result values. However, the signatures can be verified with only `r` - `s` values. In order to provide an exact and more compatible method, verification is preferred over recovery to propose in a precompiled.

Add EIP: Precompiled for secp256r1 Curve Support #7212

Add EIP: Precompiled for secp256r1 Curve Support #7212

Conversation

ulerdogan commented Jun 22, 2023

eth-bot commented Jun 22, 2023 • edited Loading

File EIPS/eip-7212.md

github-actions bot commented Jun 22, 2023

xinbenlv left a comment

Choose a reason for hiding this comment

jwasinger left a comment • edited Loading

Choose a reason for hiding this comment

jwasinger Jun 23, 2023 • edited Loading

Choose a reason for hiding this comment

ulerdogan Jun 23, 2023

Choose a reason for hiding this comment

xinbenlv Jun 23, 2023

Choose a reason for hiding this comment

jwasinger Jun 23, 2023

Choose a reason for hiding this comment

dcposch Jun 23, 2023 • edited Loading

Choose a reason for hiding this comment

v, r, s style

v, r, x, y style

xinbenlv Jun 23, 2023 • edited Loading

Choose a reason for hiding this comment

ulerdogan Jun 23, 2023

Choose a reason for hiding this comment

paulmillr commented Jun 25, 2023

xinbenlv commented Jun 26, 2023

ulerdogan commented Jun 27, 2023

eth-bot commented Jun 22, 2023 •

edited

Loading

File `EIPS/eip-7212.md`

jwasinger left a comment •

edited

Loading

jwasinger Jun 23, 2023 •

edited

Loading

dcposch Jun 23, 2023 •

edited

Loading

`v, r, s` style

`v, r, x, y` style

xinbenlv Jun 23, 2023 •

edited

Loading