Integrate mpt-crypto SDK lib for on-chain verification (#6679)

include/xrpl/protocol/ConfidentialTransfer.h

@@ -56,27 +56,6 @@ incrementConfidentialVersion(STObject& mptoken)
         mptoken[~sfConfidentialBalanceVersion].value_or(0u) + 1u;
 }
 
-/**
- * @brief Adds common fields to a serializer for ZKP context hash generation.
- *
- * Serializes the transaction type, account, issuance ID and sequence/ticket number
- * into the provided serializer. These fields form the base of all context
- * hashes used in zero-knowledge proofs.
- *
- * @param s          The serializer to append fields to.
- * @param txType     The transaction type identifier.
- * @param account    The account ID of the transaction sender.
- * @param issuanceID The MPToken Issuance ID.
- * @param sequence   The transaction sequence number or ticket number.
- */
-void
-addCommonZKPFields(
-    Serializer& s,
-    std::uint16_t txType,
-    AccountID const& account,
-    uint192 const& issuanceID,
-    std::uint32_t sequence);
-
 /**
  * @brief Generates the context hash for ConfidentialMPTSend transactions.
  *
@@ -265,25 +244,6 @@ encryptCanonicalZeroAmount(Slice const& pubKeySlice, AccountID const& account, M
 TER
 verifySchnorrProof(Slice const& pubKeySlice, Slice const& proofSlice, uint256 const& contextHash);
 
-/**
- * @brief Verifies that a ciphertext correctly encrypts a revealed amount.
- *
- * Given the plaintext amount and blinding factor, verifies that the
- * ciphertext was correctly constructed using ElGamal encryption.
- *
- * @param amount         The revealed plaintext amount.
- * @param blindingFactor The blinding factor used in encryption (size=xrpl::ecBlindingFactorLength).
- * @param pubKeySlice    The recipient's ElGamal public key (size=xrpl::ecPubKeyLength).
- * @param ciphertext     The ciphertext to verify (size=xrpl::ecGamalEncryptedTotalLength).
- * @return tesSUCCESS if the encryption is valid, or an error code otherwise.
- */
-TER
-verifyElGamalEncryption(
-    uint64_t const amount,
-    Slice const& blindingFactor,
-    Slice const& pubKeySlice,
-    Slice const& ciphertext);
-
 /**
  * @brief Validates the format of encrypted amount fields in a transaction.
  *
@@ -351,25 +311,6 @@ getEqualityProofSize(std::size_t nRecipients)
     return secp256k1_mpt_proof_equality_shared_r_size(nRecipients);
 }
 
-/**
- * @brief Verifies a multi-ciphertext equality proof.
- *
- * Proves that all ciphertexts in the recipients vector encrypt the same
- * plaintext amount, without revealing the amount itself.
- *
- * @param proof       The zero-knowledge proof bytes.
- * @param recipients  Vector of recipients with their public keys and ciphertexts.
- * @param nRecipients The number of recipients (must match recipients.size()).
- * @param contextHash The 256-bit context hash binding the proof.
- * @return tesSUCCESS if the proof is valid, or an error code otherwise.
- */
-TER
-verifyMultiCiphertextEqualityProof(
-    Slice const& proof,
-    std::vector<ConfidentialRecipient> const& recipients,
-    std::size_t const nRecipients,
-    uint256 const& contextHash);
-
 /**
  * @brief Verifies a clawback equality proof.
  *
@@ -462,21 +403,63 @@ verifyAggregatedBulletproof(
     uint256 const& contextHash);
 
 /**
- * @brief Computes the remainder commitment for ConfidentialMPTSend.
+ * @brief Verifies all zero-knowledge proofs for a ConfidentialMPTSend transaction.
  *
- * Given a balance commitment PC_bal = m_bal*G + rho_bal*H and an amount
- * commitment PC_amt = m_amt*G + rho_amt*H, this function computes:
- * PC_rem = PC_bal - PC_amt = (m_bal - m_amt)*G + (rho_bal - rho_amt)*H
+ * This function calls mpt_verify_send_proof API in the mpt-crypto utility lib, which verifies the
+ * equality proof, amount linkage, balance linkage, and range proof.
+ * Equality proof: Proves the same value is encrypted for the sender, receiver, issuer, and auditor.
+ * Amount linkage: Proves the send amount matches the amount Pedersen commitment.
+ * Balance linkage: Proves the sender's balance matches the balance Pedersen
+ * commitment.
+ * Range proof: Proves the amount and the remaining balance are within range [0, 2^64-1].
  *
- * This derived commitment is used in an aggregated range proof to ensure
- * the sender maintains a non-negative balance (m_bal - m_amt >= 0).
- *
- * @param balanceCommitment The compressed Pedersen commitment to the balance (33 bytes).
- * @param amountCommitment  The compressed Pedersen commitment to the amount (33 bytes).
- * @return The remainder commitment (33 bytes), or std::nullopt on failure.
+ * @param proof             The full proof blob.
+ * @param sender            The sender's public key and encrypted amount.
+ * @param destination       The destination's public key and encrypted amount.
+ * @param issuer            The issuer's public key and encrypted amount.
+ * @param auditor           The auditor's public key and encrypted amount if present.
+ * @param spendingBalance   The sender's current spending balance ciphertext.
+ * @param amountCommitment  The Pedersen commitment to the send amount.
+ * @param balanceCommitment The Pedersen commitment to the sender's balance.
+ * @param contextHash       The context hash binding the proof.
+ * @return tesSUCCESS if all proofs are valid, or an error code otherwise.
  */
-std::optional<Buffer>
-computeSendRemainder(Slice const& balanceCommitment, Slice const& amountCommitment);
+TER
+verifySendProof(
+    Slice const& proof,
+    ConfidentialRecipient const& sender,
+    ConfidentialRecipient const& destination,
+    ConfidentialRecipient const& issuer,
+    std::optional<ConfidentialRecipient> const& auditor,
+    Slice const& spendingBalance,
+    Slice const& amountCommitment,
+    Slice const& balanceCommitment,
+    uint256 const& contextHash);
+
+/**
+ * @brief Verifies all zero-knowledge proofs for a ConfidentialMPTConvertBack transaction.
+ *
+ * This function calls mpt_verify_convert_back_proof API in the mpt-crypto utility lib, which
+ * verifies the balance linkage proof and range proof. Balance linkage proof: proves the balance
+ * commitment matches the spending ciphertext. Range proof: proves the remaining balance after
+ * convert back is within range [0, 2^64-1].
+ *
+ * @param proof             The full proof blob.
+ * @param pubKeySlice       The holder's public key.
+ * @param spendingBalance   The holder's spending balance ciphertext.
+ * @param balanceCommitment The Pedersen commitment to the balance.
+ * @param amount            The amount being converted back to public.
+ * @param contextHash       The context hash binding the proof.
+ * @return tesSUCCESS if all proofs are valid, or an error code otherwise.
+ */
+TER
+verifyConvertBackProof(
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& spendingBalance,
+    Slice const& balanceCommitment,
+    uint64_t amount,
+    uint256 const& contextHash);
 
 /**
  * @brief Computes the remainder commitment for ConvertBack.