native: add test for custom Koblitz witness verification script

[AnnaShaleva]

Every single thing is already implemented in the protocol for Koblitz verification scripts. An alternative to neo-project/neo#3205.

A note for reviewers

This PR contains a large number of file changes, but two most important files are:

• Native CryptoLib's verifyWithECDsa extension (./pkg/core/native/crypto.go file);
• Custom witness scripts builder (./pkg/core/native/native_test/cryptolib_verificacation_test.go file);

Single signature verification

What user signs	Invocation script length	Verification script length	Witness verification cost*
keccak256([4-bytes-network-magic-LE, txHash-bytes-BE])**	66 bytes	110 bytes	2154270 GAS
keccak256([var-bytes-network-magic, txHash-bytes-BE])	66 bytes	98 bytes	2092530 GAS
keccak256([var-bytes-network-magic, txHash-bytes-BE]) (static magic)	66 bytes	95 bytes	2092320 GAS
keccak256(sha256([var-bytes-network-magic, txHash-bytes-BE]))	66 bytes	136 bytes	4120620 GAS
keccak256(sha256([4-bytes-network-magic-LE, txHash-bytes-BE]))	66 bytes	186 bytes	5116020 GAS

* Verification cost is based on the default execution fee value.
** The proposed verification method. Other methods are less preferable and are added for comparison.

Multisignature verification

What user signs	Multisig M out of N	Invocation script length	Verification script length	Witness verification cost*
keccak256([4-bytes-network-magic-LE, txHash-bytes-BE])**	3 out of 4	198 bytes (= 66*3 bytes)	264 bytes	8390070 GAS

* Verification cost is based on the default execution fee value.
** The proposed verification method. Other methods are less preferable and are added for comparison.

@roman-khimov, let's review&improve&merge, and after that I may create a comment in the core repo (or even an issue).

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.16%. Comparing base (b21db99) to head (e275495).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3425      +/-   ##
==========================================
+ Coverage   86.12%   86.16%   +0.04%     
==========================================
  Files         332      332              
  Lines       38435    38443       +8     
==========================================
+ Hits        33102    33125      +23     
+ Misses       3804     3793      -11     
+ Partials     1529     1525       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[roman-khimov]

I think it's viable. Minor improvements can be done, but overall it's something that can be discussed.

[Jim8y]

@AnnaShaleva I have no preference to solutions, yours here is much more elegent, i can close mine when you are done. But please make it:

1. support both SHA256 and Keccak256 hasher. 2. support multi-sig. 3. Update the corresponding costs.

Erik has asked to make it scalable, but i think currently we can only focus on dealing k1.

And we will need to help COZ to update their neojs SDK as well as other SDKs from other communities.

[AnnaShaleva]

Let it be here, CryptoLib extension is there, and I'm still working on the multisignature verification script, will update soon.

[AnnaShaleva]

@roman-khimov, multisignature version is ready, let's review and improve it (a couple of TODOs are there, we need to decide about them). But overall the algorithm works as expected and is quite clear.

Meanwhile I'll add results for other multisig combinations and port CryptoLib's change to the C# repo.

[roman-khimov]

Please leave it internal to native contract. pkg/crypto is about proper Neo stuff, importing keccak there won't be correct.

[AnnaShaleva]

But Keccak256 is a proper Neo stuff, and it's not related to the Koblitz-based witnesses. We have keccak256 method in CryptoLib, so it's a part of Neo.

Are you sure we need to keep it inside CryptoLib?

[roman-khimov]

Not exactly. It is available in VM, but you only need it for compatibility with E-chain. And there is zero Neo specifics wrt this hash handling (like Hash160 or DoubleSha256). Yes, it reminds of RipeMD160 in some ways, but you can't have accounts without it. Keccak is different, you can live a happy life without it.

I'm mostly concerned about dependency management here.

[roman-khimov]

Still there, but it's NeoGo-specific.

[AnnaShaleva]

Fixed.

[roman-khimov]

Multisignature is interesting wrt calculatenetworkfee, btw. I'm sure our implementation can handle simple signature case, but multisig cost currently depends on correct/incorrect flow (and POPITEM from #3425 (comment) can make it worse), so we can have a trouble estimating verification cost for it.

[roman-khimov]

I think we have both simple and multisig working fine at this stage. Simple sig is perfect to me. Multisig can be changed in very minor details, but those are opinionated. Current code is pretty simple and clear, can be reviewed easily. Let's port to C# and collect more feedback.

[roman-khimov]

Conflicts.