feat: add secp256k1 ecrecover precompile

ceno_host/tests/test_elf.rs

@@ -438,6 +438,18 @@ fn test_secp256k1_decompress() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn test_secp256k1_ecrecover() -> Result<()> {
+    let _ = ceno_host::run(
+        CENO_PLATFORM,
+        ceno_examples::secp256k1_ecrecover,
+        &CenoStdin::default(),
+        None,
+    );
+
+    Ok(())
+}
+
 #[test]
 fn test_sha256_extend() -> Result<()> {
     let program_elf = ceno_examples::sha_extend_syscall;

ceno_rt/Cargo.toml

@@ -11,4 +11,5 @@ version = "0.1.0"
 
 [dependencies]
 getrandom = { version = "0.2.15", features = ["custom"], default-features = false }
+getrandom_v3 = { package = "getrandom", version = "0.3", default-features = false }
 rkyv.workspace = true

ceno_rt/src/lib.rs

@@ -86,6 +86,23 @@ pub fn my_get_random(buf: &mut [u8]) -> Result<(), Error> {
 }
 register_custom_getrandom!(my_get_random);
 
+/// Custom getrandom implementation for getrandom v0.3
+///
+/// see also: <https://docs.rs/getrandom/0.3.3/getrandom/#custom-backend>
+///
+/// # Safety
+/// - `dest` must be valid for writes of `len` bytes.
+#[unsafe(no_mangle)]
+pub unsafe extern "Rust" fn __getrandom_v03_custom(
+    dest: *mut u8,
+    len: usize,
+) -> Result<(), getrandom_v3::Error> {
+    unsafe {
+        sys_rand(dest, len);
+    }
+    Ok(())
+}
+
 pub fn halt(exit_code: u32) -> ! {
     #[cfg(target_arch = "riscv32")]
     unsafe {

ceno_rt/src/syscalls.rs

@@ -54,9 +54,11 @@ pub fn syscall_keccak_permute(state: &mut [u64; KECCAK_STATE_WORDS]) {
 /// - The caller must ensure that `p` and `q` are valid points on the `secp256k1` curve, and that `p` and `q` are not equal to each other.
 /// - The result is stored in the first point.
 #[allow(unused_variables)]
-pub fn syscall_secp256k1_add(p: *mut [u32; 16], q: *mut [u32; 16]) {
+pub fn syscall_secp256k1_add(p: &mut [u32; 16], q: &[u32; 16]) {
     #[cfg(target_os = "zkvm")]
     unsafe {
+        let p = p.as_mut_ptr();
+        let q = q.as_ptr();
         asm!(
             "ecall",
             in("t0") SECP256K1_ADD,
@@ -79,9 +81,10 @@ pub fn syscall_secp256k1_add(p: *mut [u32; 16], q: *mut [u32; 16]) {
 ///   For example, the word `p[0]` contains the least significant `4` bytes of `X` and their significance is maintained w.r.t `p[0]`
 /// - The result is stored in p
 #[allow(unused_variables)]
-pub fn syscall_secp256k1_double(p: *mut [u32; 16]) {
+pub fn syscall_secp256k1_double(p: &mut [u32; 16]) {
     #[cfg(target_os = "zkvm")]
     unsafe {
+        let p = p.as_mut_ptr();
         asm!(
             "ecall",
             in("t0") SECP256K1_DOUBLE,

examples-builder/build.rs

@@ -57,6 +57,7 @@ fn build_elfs() {
     }
     rerun_all_but_target(Path::new("../examples"));
     rerun_all_but_target(Path::new("../ceno_rt"));
+    rerun_all_but_target(Path::new("../guest_libs"));
 }
 
 fn main() {

examples/.cargo/config.toml

@@ -25,5 +25,7 @@ rustflags = [
   "-Zlocation-detail=none",
   "-C",
   "passes=lower-atomic",
+  '--cfg',
+  'getrandom_backend="custom"', # getrandom v3.3+ requires this cfg to use a custom getrandom implementation
 ]
 target = "../ceno_rt/riscv32im-ceno-zkvm-elf.json"

examples/Cargo.toml

@@ -11,8 +11,10 @@ version = "0.1.0"
 
 [dependencies]
 alloy-primitives = { version = "1.3", features = ["native-keccak"] }
+ceno_crypto = { path = "../guest_libs/crypto" }
 ceno_keccak = { path = "../guest_libs/keccak" }
 ceno_rt = { path = "../ceno_rt" }
+getrandom = { version = "0.3" }
 rand.workspace = true
 tiny-keccak.workspace = true
 

examples/examples/secp256k1_add_syscall.rs

@@ -41,9 +41,9 @@ fn bytes_to_words(bytes: [u8; 65]) -> [u32; 16] {
 }
 fn main() {
     let mut p: DecompressedPoint = bytes_to_words(P);
-    let mut q: DecompressedPoint = bytes_to_words(Q);
+    let q: DecompressedPoint = bytes_to_words(Q);
     let p_plus_q: DecompressedPoint = bytes_to_words(P_PLUS_Q);
 
-    syscall_secp256k1_add(&mut p, &mut q);
+    syscall_secp256k1_add(&mut p, &q);
     assert_eq!(p, p_plus_q);
 }

examples/examples/secp256k1_ecrecover.rs

@@ -0,0 +1,56 @@
+// Test ecrecover of real world signatures from scroll mainnet. Assert result inside the guest.
+extern crate ceno_rt;
+
+use alloy_primitives::{Address, B256, address, b256, hex};
+use ceno_crypto::secp256k1::secp256k1_ecrecover;
+
+const TEST_CASES: [(&[u8], u8, B256, Address); 5] = [
+    // (sig, recid, tx_hash, signer)
+    (
+        &hex!(
+            "15a7bb615483f66a697431cd414294b6bd1e1b9b9d6d163cfd97290ea77b53061810c4d228e424087ad77ee75bb25e77c832ad9038b89f7e573a34b574648348"
+        ),
+        0,
+        b256!("b329f831352e37f4426583986465b065d9c867901b42f576f00ef36dfac1cfdf"),
+        address!("ca585e09df67e83106c9bcd839c989ace537bf95"),
+    ),
+    (
+        &hex!(
+            "870077f742ca34760810033caf13c99e90e207db6f820124b827907e9658d7d04f302d6675c8625c02fc95c131a3ce77e7f90dba10dbda368efeaaba9be60916"
+        ),
+        0,
+        b256!("4e13990772a9454712c7560ad8a64b845fd472b913b90d680867ab3dad56a18d"),
+        address!("a79c12bcf11133af01b6b20f16f8aafaecdebc93"),
+    ),
+    (
+        &hex!(
+            "455a6249244154e8f5d516a3036e26576449bef05171657dbf3a5d7b9c02fe96629f7eb0aa2a006ff4ac6fc0523a6f5a365cf375240f5a560b1972eb21cec087"
+        ),
+        1,
+        b256!("4dedbd995fc79db979c6484132568fe30fdf6bfa8b64ac74ba844cc30e764b0c"),
+        address!("c623f214c8eefc771147c5806be250db39555555"),
+    ),
+    (
+        &hex!(
+            "854c4656c421158b4e5d8c29ccc3adcaee329587cee630398f3ce2e32745e45b67b1fc40e3206c70a75bcdf3c877c26874c75c2fabd5566c85b58c7c7d872e00"
+        ),
+        0,
+        b256!("e4559e37c72fb3df0349df42b3aa0e94607287ecb3e6530b7c50ed984e0428a2"),
+        address!("b82def35c814584d3d929cfb3a1fb1b886b6e57b"),
+    ),
+    (
+        &hex!(
+            "004a0ac1306d096c06fb77f82b76f43fb2459638826f4846444686b3036b9a4b3d6bf124bf22f23b851adfa2c4bdc670b4ecb5129186a4e89032916a77a56b90"
+        ),
+        0,
+        b256!("83e5e11daa2d14736ab1d578c41250c6f6445782c215684a18f67b44686ccb90"),
+        address!("0a6f0ed4896be1caa9e37047578e7519481f22ea"),
+    ),
+];
+
+fn main() {
+    for (sig, recid, tx_hash, signer) in TEST_CASES {
+        let recovered = secp256k1_ecrecover(sig.try_into().unwrap(), recid, &tx_hash.0).unwrap();
+        assert_eq!(&recovered[12..], &signer.0);
+    }
+}

examples/examples/syscalls.rs

@@ -51,9 +51,9 @@ pub fn test_syscalls() {
         ];
         {
             let mut p = bytes_to_words(P);
-            let mut q = bytes_to_words(Q);
+            let q = bytes_to_words(Q);
             let p_plus_q = bytes_to_words(P_PLUS_Q);
-            syscall_secp256k1_add(&mut p, &mut q);
+            syscall_secp256k1_add(&mut p, &q);
 
             assert!(p == p_plus_q);
         }

guest_libs/crypto/Cargo.toml

@@ -10,7 +10,9 @@ repository = "https://github.com/scroll-tech/ceno"
 version = "0.1.0"
 
 [dependencies]
+ceno_keccak = { path = "../keccak" }
 ceno_rt = { path = "../../ceno_rt" }
+k256 = { version = "0.13", default-features = false, features = ["std", "ecdsa"] }
 thiserror.workspace = true
 
 [dev-dependencies]

guest_libs/crypto/src/lib.rs

@@ -34,7 +34,7 @@ pub enum CenoCryptoError {
     Bn254PairLength,
     /// Sepk256k1 ecrecover error
     #[error("Secp256k1 ecrecover error")]
-    Secp256k1EcRecover,
+    Secp256k1Ecrecover(#[from] k256::ecdsa::Error),
 }
 
 #[cfg(test)]