Add orchard binding_verification_key

[oxarbitrage]

Motivation

Binding verification key must be implemented.

Closes #2102
Closes #2103

Specifications

https://zips.z.cash/protocol/protocol.pdf#orchardbalance

Solution

Implement simular to sapling. This is a draft.

Review

I will like @dconnolly to take an initial view. I made some comments where i have some doubts.

Reviewer Checklist

• Code implements Specs and Designs
• Tests for Expected Behaviour
• Tests for Errors

Follow Up Work

---

This change is 

[teor2345]

It looks like we need to do two things before we can make progress on this PR:

1. Fix the sapling value balance errors in Fix sapling binding signature errors #1939
2. Work with a cryptographer to understand the Orchard value balance consensus rules, and how they are different from Sapling

[dconnolly]

We need to merge PR #2472 before merging this PR, so we're sure that the common Sapling/Orchard binding signature code works.

#2472 and #2463 have been merged so we can move forward with this PR i think

[teor2345]

We need to merge PR #2472 before merging this PR, so we're sure that the common Sapling/Orchard binding signature code works.

#2472 and #2463 have been merged so we can move forward with this PR i think

Also our cached state tests actually test this code now!

[dconnolly]

@oxarbitrage I moved this from draft to not-draft if that's ok with you

[teor2345]

@oxarbitrage I moved this from draft to not-draft if that's ok with you

Can we focus on state changes for this sprint?

We can do this validation next sprint, or delay it until we have time.
But we need a bunch of the state changes sorted to move forward with the mempool.

[dconnolly]

@oxarbitrage I moved this from draft to not-draft if that's ok with you

Can we focus on state changes for this sprint?

We can do this validation next sprint, or delay it until we have time.
But we need a bunch of the state changes sorted to move forward with the mempool.

Oh sure yes 👍

[dconnolly]

Code looks good, some suggestions on the doc comments 📜

[dconnolly]

Code looks good, some suggestions on the doc comments 📜

[mpguerra]

Does this no longer close #2103 also?

[oxarbitrage]

Does this no longer close #2103 also?

Thank you for the question. I removed more code than i should in one of the rebases, the validation code was here so i will readd. With this addition this PR will close both tickets as initially intended.

was not requested

[oxarbitrage]

Reviewable status: 0 of 2 files reviewed, 6 unresolved discussions (waiting on @dconnolly and @teor2345)

---

zebra-chain/src/orchard/shielded_data.rs, line 61 at r4 (raw file):

Previously, dconnolly (Deirdre Connolly) wrote…

    /// Getting the binding signature validating key from the Action description 
    /// value commitments and the balancing value implicitly checks that the 
    /// balancing value is consistent with the value transferred in the
    /// Action descriptions, but also proves that the signer knew the
    /// randomness used for the Action value commitments, which
    /// prevents replays of Action descriptions that perform an output.
    /// In Orchard, all Action descriptions have a spend authorization signature,
    /// therefore the proof of knowledge of the value commitment randomness
    /// is less important, but stills provides defense in depth, and reduces the 
    /// differences between Orchard and Sapling.

Done.

---

zebra-chain/src/orchard/shielded_data.rs, line 65 at r4 (raw file):

Previously, dconnolly (Deirdre Connolly) wrote…

    /// The net value of Orchard spends minus outputs in a transaction
    /// is called the balancing value, measured in zatoshi as a signed integer
    /// cv_balance.

Done.

---

zebra-chain/src/orchard/shielded_data.rs, line 69 at r4 (raw file):

Previously, dconnolly (Deirdre Connolly) wrote…

    /// Consistency of cv_balance with the value commitments in Action 
    /// descriptions is enforced by the binding signature.

Done.

---

zebra-chain/src/orchard/shielded_data.rs, line 73 at r4 (raw file):

Previously, dconnolly (Deirdre Connolly) wrote…

    /// Instead of generating a key pair at random, we generate it as a function
    /// of the value commitments in the Action descriptions of the transaction, and 
    /// the balancing value.

Done.

---

zebra-chain/src/orchard/shielded_data.rs, line 82 at r4 (raw file):

Previously, dconnolly (Deirdre Connolly) wrote…

Looks good 👍

Done.

---

zebra-consensus/src/transaction.rs, line 544 at r1 (raw file):

Previously, teor2345 (teor) wrote…

Please add TODO comments about the missing Orchard checks, with a ticket number for each check.

Done.

[dconnolly]

🎉