Fix BLS pop dst and no context API

cardano-crypto-class/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 * Replace memory dependency with ram (drop in replacement)
 * Depend on crypton ^>- 1.1
+* Fix the DST used when hashing the public key for BLS12-381 proofs of possession:
+  `createPossessionProofDSIGN` and `verifyPossessionProofDSIGN` now use the
+  `"BLS_POP_"`-prefixed DST prescribed by draft-irtf-cfrg-bls-signature-06
+  (Section 4.2.3) instead of the `"BLS_SIG_"` one used for ordinary signatures.
+  The PoP DST is selected internally per curve variant, so these functions (and
+  `aggregateVerKeysDSIGN`) no longer take a signing context.
+* Select the BLS12-381 *signing* DST internally per curve variant as well:
+  `ContextDSIGN (BLS12381DSIGN curve)` is now `()`, and `signDSIGN` /
+  `verifyDSIGN` use the canonical `"BLS_SIG_"`-prefixed DST of the PoP
+  ciphersuite for the chosen variant. `BLS12381SignContext`, `minSigPoPDST` and
+  `minVerKeyPoPDST` are removed from the public API, and message augmentation
+  is no longer supported (the POP scheme does not use it).
 
 ## 2.5.1.0
 

cardano-crypto-class/bench/Bench/Crypto/DSIGN.hs

@@ -29,7 +29,7 @@ import Cardano.Crypto.Hash.Blake2b
 import Criterion
 
 import Bench.Crypto.BenchData
-import Cardano.Crypto.DSIGN.BLS12381.Internal (BLS12381MinSigDSIGN, BLS12381MinVerKeyDSIGN, BLS12381DSIGN, BLS12381SignContext (..))
+import Cardano.Crypto.DSIGN.BLS12381.Internal (BLS12381MinSigDSIGN, BLS12381MinVerKeyDSIGN, BLS12381DSIGN)
 
 benchmarks :: Benchmark
 benchmarks = bgroup "DSIGN"
@@ -114,9 +114,8 @@ instance ExampleContext SchnorrSecp256k1DSIGN where
   exampleContext _ = ()
 #endif
 
--- | This example context sets both the dst and augmentation to Nothing.
 instance ExampleContext (BLS12381DSIGN curve) where
-  exampleContext _ = BLS12381SignContext Nothing Nothing
+  exampleContext _ = ()
 
 benchAggDSIGN :: forall v a
   . ( DSIGNAggregatable v
@@ -139,15 +138,15 @@ benchAggDSIGN _ lbl =
       [ bgroup ("n=" <> show n)
           [ env (pure (mkCase @v ctx msg n)) $ \c ->
               bench "provePoP (all)" $
-                nf (proveAllPoPs @v ctx) (caseSKs c)
+                nf (proveAllPoPs @v) (caseSKs c)
 
           , env (pure (mkCase @v ctx msg n)) $ \c ->
               bench "verifyPoP (all)" $
-                nf (verifyAllPoPs @v ctx) (caseVKPoPs c)
+                nf (verifyAllPoPs @v) (caseVKPoPs c)
 
           , env (pure (mkCase @v ctx msg n)) $ \c ->
               bench "aggregateVerKeys (with PoPs)" $
-                nf (aggregateVerKeysDSIGN @v ctx) (caseVKPoPs c)
+                nf (aggregateVerKeysDSIGN @v) (caseVKPoPs c)
 
           , env (pure (mkCase @v ctx msg n)) $ \c ->
               bench "aggregateVerKeys (no PoPs)" $
@@ -184,17 +183,16 @@ mkCase :: forall v a. (DSIGNAggregatable v, Signable v a)
 mkCase ctx msg n =
   let sks  = replicate n (genKeyDSIGN @v testSeed)
       vks  = map deriveVerKeyDSIGN sks
-      pops = map (createPossessionProofDSIGN @v ctx) sks
+      pops = map (createPossessionProofDSIGN @v) sks
       sigs = map (signDSIGN @v ctx msg) sks
       vkp  = zip vks pops
   in AggCase sks vks vkp sigs
 
 proveAllPoPs :: forall v. DSIGNAggregatable v
-  => ContextDSIGN v -> [SignKeyDSIGN v] -> [PossessionProofDSIGN v]
-proveAllPoPs ctx = map (createPossessionProofDSIGN @v ctx)
+  => [SignKeyDSIGN v] -> [PossessionProofDSIGN v]
+proveAllPoPs = map (createPossessionProofDSIGN @v)
 
 verifyAllPoPs :: forall v. DSIGNAggregatable v
-  => ContextDSIGN v
-  -> [(VerKeyDSIGN v, PossessionProofDSIGN v)]
+  => [(VerKeyDSIGN v, PossessionProofDSIGN v)]
   -> Either String ()
-verifyAllPoPs ctx = F.foldl' (\acc (vk,pop) -> acc >> verifyPossessionProofDSIGN @v ctx vk pop) (Right ())
+verifyAllPoPs = F.foldl' (\acc (vk,pop) -> acc >> verifyPossessionProofDSIGN @v vk pop) (Right ())

cardano-crypto-class/src/Cardano/Crypto/DSIGN/BLS12381.hs

@@ -1,8 +1,6 @@
 module Cardano.Crypto.DSIGN.BLS12381 (
   module X,
-  BLS12381SignContext,
 )
 where
 
-import Cardano.Crypto.DSIGN.BLS12381.Internal (BLS12381SignContext)
-import Cardano.Crypto.DSIGN.BLS12381.Internal as X hiding (BLS12381SignContext)
+import Cardano.Crypto.DSIGN.BLS12381.Internal as X