fixed scalarmultKey() calls in Carrot-specific CLSAG code; added new signing function for T terms in CLSAG

src/device/device.hpp

@@ -237,6 +237,7 @@ namespace hw {
         virtual bool clsag_sign(const rct::key &c, const rct::key &a, const rct::key &p, const rct::key &z, const rct::key &mu_P, const rct::key &mu_C, rct::key &s) = 0;
 
         virtual bool clsag_prepare_carrot(const rct::key &p, const rct::key &z, rct::key &I, rct::key &D, const rct::key &H, rct::key &a, rct::key &aG, rct::key &b, rct::key &bT, rct::key &aH) = 0;
+        virtual bool clsag_sign_y(const rct::key &c, const rct::key &b, const rct::key &y, const rct::key &mu_P, rct::key &s) = 0;
 
         virtual bool  close_tx(void) = 0;
 

src/device/device_default.cpp

@@ -433,7 +433,7 @@ namespace hw {
 
             // bT = b*T
             rct::skGen(b);
-            bT = rct::scalarmultKey(b, rct::pk2rct(crypto::get_T()));
+            bT = rct::scalarmultKey(rct::pk2rct(crypto::get_T()), b);
 
             return true;
         }
@@ -454,6 +454,17 @@ namespace hw {
             return true;
         }
 
+        // In device_default.cpp (implementation)
+        bool device_default::clsag_sign_y(const rct::key &c, const rct::key &b, const rct::key &y, const rct::key &mu_P, rct::key &s) {
+          rct::key y_mu_P;
+          sc_mul(y_mu_P.bytes, mu_P.bytes, y.bytes); // y_mu_P = y * mu_P
+          
+          // s = b - c * (y * mu_P)
+          // This is equivalent to: sc_sub(s.bytes, b.bytes, temp.bytes); where temp = c * y_mu_P
+          sc_mulsub(s.bytes, c.bytes, y_mu_P.bytes, b.bytes);
+          return true;
+        }
+      
         bool device_default::close_tx() {
             return true;
         }

src/device/device_default.hpp

@@ -141,6 +141,8 @@ namespace hw {
             bool clsag_sign(const rct::key &c, const rct::key &a, const rct::key &p, const rct::key &z, const rct::key &mu_P, const rct::key &mu_C, rct::key &s) override;
 
             bool clsag_prepare_carrot(const rct::key &p, const rct::key &z, rct::key &I, rct::key &D, const rct::key &H, rct::key &a, rct::key &aG, rct::key &b, rct::key &bT, rct::key &aH);
+            bool clsag_sign_y(const rct::key &c, const rct::key &b, const rct::key &y, const rct::key &mu_P, rct::key &s);
+      
             bool  close_tx(void) override;
         };
 

src/device/device_ledger.cpp

@@ -2350,6 +2350,9 @@ namespace hw {
         return true;
     }
 
+    bool device_ledger::clsag_sign_y(const rct::key &c, const rct::key &b, const rct::key &y, const rct::key &mu_P, rct::key &s) {
+      return true;
+    }
 
     bool device_ledger::close_tx() {
         AUTO_LOCK_CMD();

src/device/device_ledger.hpp

@@ -283,7 +283,7 @@ namespace hw {
         bool clsag_sign(const rct::key &c, const rct::key &a, const rct::key &p, const rct::key &z, const rct::key &mu_P, const rct::key &mu_C, rct::key &s) override;
 
         bool clsag_prepare_carrot(const rct::key &p, const rct::key &z, rct::key &I, rct::key &D, const rct::key &H, rct::key &a, rct::key &aG, rct::key &b, rct::key &bT, rct::key &aH) override;
-
+        bool clsag_sign_y(const rct::key &c, const rct::key &b, const rct::key &y, const rct::key &mu_P, rct::key &s) override;
 
         bool  close_tx(void) override;
 

src/ringct/rctSigs.cpp

@@ -482,10 +482,11 @@ namespace rct {
         precomp(C_precomp.k, C[i]);
 
         // Compute L
-        addKeys_aGbBcC(L, sig.sx[i], c_p, P_precomp.k, c_c, C_precomp.k);
+        key xGyT;
-        // add the T term
+        addKeys2(xGyT, sig.sx[i], sig.sy[i], rct::pk2rct(crypto::get_T()));
-        key rT = rct::scalarmultKey(b, rct::pk2rct(crypto::get_T()));
+        key temp_precomp;
-        L = addKeys(L, rT);
+        addKeys3(temp_precomp, c_p, P_precomp.k, c_c, C_precomp.k);
+        L = addKeys(xGyT, temp_precomp);
         
         // Compute R
         hash_to_p3(Hi_p3,P[i]);
@@ -504,7 +505,7 @@ namespace rct {
 
       // Compute final scalars
       hwdev.clsag_sign(c, a, x, z, mu_P, mu_C, sig.sx[l]);
-      hwdev.clsag_sign(c, b, y, z, mu_P, mu_C, sig.sy[l]);
+      hwdev.clsag_sign_y(c, b, y, mu_P, sig.sy[l]);
       memwipe(&a, sizeof(key));
       memwipe(&b, sizeof(key));
 
@@ -1264,6 +1265,7 @@ namespace rct {
             }
             c_to_hash[2*n+1] = C_offset;
             c_to_hash[2*n+2] = message;
+
             key c_p; // = c[i]*mu_P
             key c_c; // = c[i]*mu_C
             key c_new;
@@ -1291,10 +1293,11 @@ namespace rct {
                 ge_dsm_precomp(C_precomp.k,&temp_p3);
 
                 // Compute L
-                addKeys_aGbBcC(L, sig.sx[i], c_p, P_precomp.k, c_c, C_precomp.k);
+                key xGyT;
-                // add the T term
+                addKeys2(xGyT, sig.sx[i], sig.sy[i], rct::pk2rct(crypto::get_T()));
-                key rT = rct::scalarmultKey(sig.sy[i], rct::pk2rct(crypto::get_T()));
+                key temp_precomp;
-                L = addKeys(L, rT);
+                addKeys3(temp_precomp, c_p, P_precomp.k, c_c, C_precomp.k);
+                L = addKeys(xGyT, temp_precomp);
 
                 // Compute R
                 hash_to_p3(hash8_p3,pubs[i].dest);