008_密码学基础应用：区块链安全的数学基石与实践指南

Web3密码学应用层次：
基础层：哈希函数、对称加密、非对称加密
应用层：数字签名、密钥交换、身份验证
高级层：零知识证明、同态加密、多方计算
前沿层：后量子密码学、格密码学、基于配对的密码学

// 示例：哈希函数的基本特性展示
const crypto = require('crypto');

function demonstrateHashProperties() {
  // 1. 确定性
  const input = "Hello Web3 World";
  const hash1 = crypto.createHash('sha256').update(input).digest('hex');
  const hash2 = crypto.createHash('sha256').update(input).digest('hex');
  console.log("确定性:", hash1 === hash2); // true
  
  // 2. 雪崩效应
  const input1 = "Hello Web3 World";
  const input2 = "Hello Web3 Worlds";
  const hashA = crypto.createHash('sha256').update(input1).digest('hex');
  const hashB = crypto.createHash('sha256').update(input2).digest('hex');
  
  // 计算不同位数
  let differences = 0;
  for (let i = 0; i < hashA.length; i++) {
    if (hashA[i] !== hashB[i]) differences++;
  }
  console.log("雪崩效应 - 不同位数:", differences); // 大约一半的位不同
  
  return {
    input,
    hash: hash1,
    properties: {
      deterministic: hash1 === hash2,
      avalanche: differences > hashA.length * 0.4 // 超过40%的位不同
    }
  };
}

// 简化的区块结构与哈希链接示例
class Block {
  constructor(prevHash, transactions, timestamp = Date.now()) {
    this.prevHash = prevHash;
    this.transactions = transactions;
    this.timestamp = timestamp;
    this.nonce = 0;
    this.hash = this.calculateHash();
  }
  
  calculateHash() {
    const data = this.prevHash + JSON.stringify(this.transactions) + 
                 this.timestamp + this.nonce;
    return crypto.createHash('sha256').update(data).digest('hex');
  }
  
  mineBlock(difficulty) {
    // 工作量证明：找到满足特定难度的哈希值
    const target = Array(difficulty + 1).join('0');
    while (this.hash.substring(0, difficulty) !== target) {
      this.nonce++;
      this.hash = this.calculateHash();
    }
    console.log(`区块已挖出: ${this.hash}`);
  }
}

// 区块链类示例
class Blockchain {
  constructor(difficulty = 4) {
    this.chain = [this.createGenesisBlock()];
    this.difficulty = difficulty;
  }
  
  createGenesisBlock() {
    return new Block("0", [{ from: "genesis", to: "system", amount: 0 }], 0);
  }
  
  getLatestBlock() {
    return this.chain[this.chain.length - 1];
  }
  
  addBlock(newBlock) {
    newBlock.prevHash = this.getLatestBlock().hash;
    newBlock.mineBlock(this.difficulty);
    this.chain.push(newBlock);
  }
  
  isChainValid() {
    for (let i = 1; i < this.chain.length; i++) {
      const currentBlock = this.chain[i];
      const prevBlock = this.chain[i - 1];
      
      // 验证当前区块哈希
      if (currentBlock.hash !== currentBlock.calculateHash()) {
        return false;
      }
      
      // 验证区块链接
      if (currentBlock.prevHash !== prevBlock.hash) {
        return false;
      }
    }
    return true;
  }
}

// 简化的默克尔树实现
class MerkleTree {
  constructor(transactions) {
    this.transactions = transactions;
    this.root = this.buildMerkleTree();
  }
  
  buildMerkleTree() {
    if (this.transactions.length === 0) return null;
    
    let leaves = this.transactions.map(tx => 
      crypto.createHash('sha256').update(JSON.stringify(tx)).digest('hex')
    );
    
    // 如果节点数为奇数，复制最后一个节点
    while (leaves.length > 1) {
      const newLevel = [];
      
      for (let i = 0; i < leaves.length; i += 2) {
        // 如果是最后一个奇数节点，复制自身
        const left = leaves[i];
        const right = (i + 1 < leaves.length) ? leaves[i + 1] : left;
        
        // 计算父节点哈希
        const parentHash = crypto.createHash('sha256')
          .update(left + right)
          .digest('hex');
        
        newLevel.push(parentHash);
      }
      
      leaves = newLevel;
    }
    
    return leaves[0];
  }
  
  // 验证交易是否在树中
  verifyTransaction(transaction) {
    const txHash = crypto.createHash('sha256').update(JSON.stringify(transaction)).digest('hex');
    
    // 在实际实现中，这里需要构建默克尔证明并验证
    // 简化版本仅检查根哈希是否匹配
    const newTree = new MerkleTree([...this.transactions]);
    return newTree.root === this.root;
  }
}

// 示例：公钥密码学基础操作
const { generateKeyPairSync, publicEncrypt, privateDecrypt } = require('crypto');

function demonstrateAsymmetricCrypto() {
  // 生成密钥对
  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: { type: 'spki', format: 'pem' },
    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
  });
  
  // 原始数据
  const originalData = '这是要加密的Web3交易数据';
  
  // 公钥加密
  const encryptedData = publicEncrypt(
    { key: publicKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING },
    Buffer.from(originalData)
  );
  
  // 私钥解密
  const decryptedData = privateDecrypt(
    { key: privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING },
    encryptedData
  );
  
  return {
    original: originalData,
    decrypted: decryptedData.toString(),
    successfullyDecrypted: originalData === decryptedData.toString()
  };
}

// 简化的以太坊地址生成过程
function generateEthereumAddress() {
  // 在实际应用中，应使用专业的密码学库
  // 1. 生成随机私钥（256位）
  const privateKey = crypto.randomBytes(32);
  
  // 注意：实际以太坊地址生成需要使用椭圆曲线密码学
  // 这里只是概念演示
  
  // 2. 从私钥派生公钥（简化表示）
  const publicKey = crypto.createHash('sha256')
    .update(privateKey)
    .digest();
  
  // 3. 对公钥进行Keccak-256哈希
  // 注意：实际使用的是Keccak-256，这里用SHA-256模拟
  const publicKeyHash = crypto.createHash('sha256')
    .update(publicKey)
    .digest();
  
  // 4. 取后20字节作为地址
  const addressBytes = publicKeyHash.slice(-20);
  
  // 5. 添加前缀并进行十六进制编码
  const address = '0x' + addressBytes.toString('hex');
  
  return {
    privateKey: privateKey.toString('hex'),
    address
  };
}

// 简化的数字签名示例
function createAndVerifySignature(privateKey, data) {
  // 创建签名
  const signer = crypto.createSign('SHA256');
  signer.update(data);
  signer.end();
  const signature = signer.sign(privateKey, 'base64');
  
  // 验证签名
  const verifier = crypto.createVerify('SHA256');
  verifier.update(data);
  verifier.end();
  
  // 注意：在实际应用中，我们会使用对应的公钥进行验证
  // 这里简化处理
  const isValid = verifier.verify(/* 对应的公钥 */, signature, 'base64');
  
  return {
    data,
    signature,
    isValid
  };
}

// Solidity中的签名验证示例
contract SignatureVerifier {
    // 验证签名是否由特定地址生成
    function verifySignature(
        bytes32 messageHash,
        bytes memory signature,
        address expectedSigner
    ) public pure returns (bool) {
        // 恢复签名者地址
        address actualSigner = recoverSigner(messageHash, signature);
        
        // 比较签名者地址
        return actualSigner == expectedSigner;
    }
    
    // 从签名恢复地址
    function recoverSigner(bytes32 messageHash, bytes memory signature) 
        public pure returns (address) {
        require(signature.length == 65, "无效的签名长度");
        
        bytes32 r;
        bytes32 s;
        uint8 v;
        
        // 提取r, s, v值
        assembly {
            r := mload(add(signature, 32))
            s := mload(add(signature, 64))
            v := byte(0, mload(add(signature, 96)))
        }
        
        // 标准以太坊签名验证
        return ecrecover(messageHash, v, r, s);
    }
}

零知识证明的交互式协议：
1. 证明者准备证明材料
2. 验证者发送随机挑战
3. 证明者基于挑战生成响应
4. 验证者验证响应是否有效
5. 重复多次以提高置信度

// 简化的ZK-Rollup概念模型
class ZKRollup {
  constructor(verifierContract) {
    this.verifierContract = verifierContract;
    this.transactions = [];
    this.currentStateRoot = this.initialStateRoot;
  }
  
  // 添加交易到批次
  addTransaction(transaction) {
    this.transactions.push(transaction);
    return this.transactions.length;
  }
  
  // 批量处理交易并生成证明
  async processBatch() {
    if (this.transactions.length === 0) {
      return null;
    }
    
    // 计算新状态根
    const newStateRoot = this.computeNewStateRoot(this.transactions);
    
    // 生成零知识证明
    // 注意：实际实现中使用专业的ZK证明库如snarkjs
    const proof = await this.generateZKProof({
      oldStateRoot: this.currentStateRoot,
      transactions: this.transactions,
      newStateRoot
    });
    
    // 更新状态根
    this.currentStateRoot = newStateRoot;
    
    // 重置交易队列
    const batchTransactions = [...this.transactions];
    this.transactions = [];
    
    return {
      proof,
      transactions: batchTransactions,
      newStateRoot
    };
  }
  
  // 验证并提交批次
  async submitBatchOnChain() {
    const batch = await this.processBatch();
    if (!batch) return null;
    
    // 调用链上验证合约
    const tx = await this.verifierContract.verifyAndUpdateState(
      batch.oldStateRoot,
      batch.newStateRoot,
      batch.proof
    );
    
    return tx;
  }
}

// 使用Circom和SnarkJS构建简单零知识证明的示例
// 注意：这只是概念演示，实际使用需要安装相应库
async function demonstrateZKProof() {
  // 1. 定义电路（通常在单独的.circom文件中）
  const circuitSource = `
    pragma circom 2.0.0;
    
    template Multiplier() {
      signal input a;
      signal input b;
      signal output c;
      
      c <== a * b;
    }
    
    component main = Multiplier();
  `;
  
  // 2. 编译电路（伪代码）
  // const { circuit, witnessCalculator } = await compileCircuit(circuitSource);
  
  // 3. 可信设置（伪代码）
  // const { provingKey, verificationKey } = await setupTrustedSetup(circuit);
  
  // 4. 生成证明（伪代码）
  // const witness = await witnessCalculator.calculateWitness({
  //   a: 3,
  //   b: 4
  // });
  // const proof = await generateProof(witness, provingKey);
  
  // 5. 验证证明（伪代码）
  // const isValid = await verifyProof(proof, verificationKey, { c: 12 });
  
  console.log("零知识证明演示完成");
}

// 安全的私钥生成示例
function generateSecurePrivateKey() {
  // 使用密码学安全的随机数生成器
  const privateKey = crypto.randomBytes(32); // 256位私钥
  
  // 熵检测（简化版）
  const entropyScore = estimateEntropy(privateKey);
  
  if (entropyScore < 0.9) {
    console.warn("警告：生成的私钥熵值较低，建议重新生成");
    return generateSecurePrivateKey(); // 递归重新生成
  }
  
  return {
    privateKey: privateKey.toString('hex'),
    entropyScore
  };
}

// 简化的熵估计函数
function estimateEntropy(data) {
  // 实际应用中应使用专业的熵估计方法
  // 这里使用简单的分布均匀性检查
  const counts = new Map();
  for (let i = 0; i < data.length; i++) {
    const byte = data[i];
    counts.set(byte, (counts.get(byte) || 0) + 1);
  }
  
  // 均匀分布时，每个值出现的概率为1/256
  const expected = data.length / 256;
  let variance = 0;
  
  for (const count of counts.values()) {
    variance += Math.pow(count - expected, 2);
  }
  
  // 计算熵分数（0-1范围）
  // 方差越小，分布越均匀，熵分数越高
  const stdDev = Math.sqrt(variance / counts.size);
  const score = Math.max(0, Math.min(1, 1 - (stdDev / expected)));
  
  return score;
}

// 简化的Shamir密钥分片示例
class ShamirSecretSharing {
  constructor(threshold, totalShares) {
    this.threshold = threshold;
    this.totalShares = totalShares;
  }
  
  // 将密钥分割为多个片段
  split(secret) {
    // 将密钥转换为数字
    const secretNumber = BigInt('0x' + secret);
    
    // 生成随机多项式系数
    const coefficients = [];
    for (let i = 0; i < this.threshold - 1; i++) {
      coefficients.push(this.generateRandomBigInt());
    }
    
    // 生成份额
    const shares = [];
    for (let x = 1; x <= this.totalShares; x++) {
      let share = secretNumber;
      let xPower = BigInt(1);
      
      for (const coeff of coefficients) {
        xPower *= BigInt(x);
        share += coeff * xPower;
      }
      
      shares.push({ x,
        share: share.toString(16).padStart(64, '0')
      });
    }
    
    return shares;
  }
  
  // 从份额恢复密钥
  recover(shares) {
    if (shares.length < this.threshold) {
      throw new Error(`需要至少${this.threshold}个份额才能恢复密钥`);
    }
    
    // 拉格朗日插值法恢复密钥
    let secret = BigInt(0);
    
    for (let i = 0; i < shares.length; i++) {
      const { x: xi, share: yi } = shares[i];
      const yiBig = BigInt('0x' + yi);
      let li = BigInt(1);
      
      for (let j = 0; j < shares.length; j++) {
        if (i !== j) {
          const { x: xj } = shares[j];
          // 计算拉格朗日基多项式
          li *= (BigInt(xj) * this.modInverse(BigInt(xj) - BigInt(xi)));
        }
      }
      
      secret += yiBig * li;
    }
    
    return secret.toString(16).padStart(64, '0');
  }
  
  // 生成随机大整数
  generateRandomBigInt() {
    // 在实际应用中应使用密码学安全的随机数生成
    const randomBytes = crypto.randomBytes(32);
    return BigInt('0x' + randomBytes.toString('hex'));
  }
  
  // 模逆运算（简化版）
  modInverse(a, m = BigInt(2) ** BigInt(256)) {
    // 简化实现，实际应用中应使用扩展欧几里得算法
    // 这里仅用于概念演示
    let m0 = m;
    let y = BigInt(0);
    let x = BigInt(1);
    
    if (m === BigInt(1)) return BigInt(0);
    
    while (a > BigInt(1)) {
      let q = a / m;
      let t = m;
      
      m = a % m;
      a = t;
      t = y;
      
      y = x - q * t;
      x = t;
    }
    
    if (x < BigInt(0)) x += m0;
    
    return x;
  }
}

// 简化的多重签名钱包智能合约
contract MultiSigWallet {
    event Deposit(address indexed sender, uint amount);
    event SubmitTransaction(
        address indexed owner,
        uint indexed txIndex,
        address indexed to,
        uint value,
        bytes data
    );
    event ConfirmTransaction(address indexed owner, uint indexed txIndex);
    event ExecuteTransaction(address indexed owner, uint indexed txIndex);
    event RevokeConfirmation(address indexed owner, uint indexed txIndex);
    
    address[] public owners;
    mapping(address => bool) public isOwner;
    uint public numConfirmationsRequired;
    
    struct Transaction {
        address to;
        uint value;
        bytes data;
        bool executed;
        uint numConfirmations;
    }
    
    Transaction[] public transactions;
    mapping(uint => mapping(address => bool)) public isConfirmed;
    
    modifier onlyOwner() {
        require(isOwner[msg.sender], "不是钱包所有者");
        _;
    }
    
    modifier txExists(uint _txIndex) {
        require(_txIndex < transactions.length, "交易不存在");
        _;
    }
    
    modifier notExecuted(uint _txIndex) {
        require(!transactions[_txIndex].executed, "交易已执行");
        _;
    }
    
    modifier notConfirmed(uint _txIndex) {
        require(!isConfirmed[_txIndex][msg.sender], "交易已确认");
        _;
    }
    
    constructor(address[] memory _owners, uint _numConfirmationsRequired) {
        require(_owners.length > 0, "需要至少一个所有者");
        require(
            _numConfirmationsRequired > 0 &&
            _numConfirmationsRequired <= _owners.length,
            "确认数量无效"
        );
        
        for (uint i = 0; i < _owners.length; i++) {
            address owner = _owners[i];
            
            require(owner != address(0), "无效的所有者地址");
            require(!isOwner[owner], "所有者地址重复");
            
            isOwner[owner] = true;
            owners.push(owner);
        }
        
        numConfirmationsRequired = _numConfirmationsRequired;
    }
    
    // 接收以太币
    receive() external payable {
        emit Deposit(msg.sender, msg.value);
    }
    
    // 提交新交易
    function submitTransaction(
        address _to,
        uint _value,
        bytes memory _data
    ) public onlyOwner {
        uint txIndex = transactions.length;
        
        transactions.push(Transaction({
            to: _to,
            value: _value,
            data: _data,
            executed: false,
            numConfirmations: 0
        }));
        
        emit SubmitTransaction(msg.sender, txIndex, _to, _value, _data);
    }
    
    // 确认交易
    function confirmTransaction(uint _txIndex)
        public
        onlyOwner
        txExists(_txIndex)
        notExecuted(_txIndex)
        notConfirmed(_txIndex)
    {
        Transaction storage transaction = transactions[_txIndex];
        transaction.numConfirmations += 1;
        isConfirmed[_txIndex][msg.sender] = true;
        
        emit ConfirmTransaction(msg.sender, _txIndex);
    }
    
    // 执行交易
    function executeTransaction(uint _txIndex)
        public
        onlyOwner
        txExists(_txIndex)
        notExecuted(_txIndex)
    {
        Transaction storage transaction = transactions[_txIndex];
        
        require(
            transaction.numConfirmations >= numConfirmationsRequired,
            "确认数量不足"
        );
        
        transaction.executed = true;
        
        (bool success, ) = transaction.to.call{
            value: transaction.value
        }(transaction.data);
        require(success, "交易执行失败");
        
        emit ExecuteTransaction(msg.sender, _txIndex);
    }
    
    // 撤销确认
    function revokeConfirmation(uint _txIndex)
        public
        onlyOwner
        txExists(_txIndex)
        notExecuted(_txIndex)
    {
        require(isConfirmed[_txIndex][msg.sender], "交易未确认");
        
        Transaction storage transaction = transactions[_txIndex];
        transaction.numConfirmations -= 1;
        isConfirmed[_txIndex][msg.sender] = false;
        
        emit RevokeConfirmation(msg.sender, _txIndex);
    }
    
    // 获取所有者数量
    function getOwners() public view returns (address[] memory) {
        return owners;
    }
    
    // 获取交易数量
    function getTransactionCount() public view returns (uint) {
        return transactions.length;
    }
    
    // 获取交易详情
    function getTransaction(uint _txIndex)
        public
        view
        returns (
            address to,
            uint value,
            bytes memory data,
            bool executed,
            uint numConfirmations
        )
    {
        Transaction storage transaction = transactions[_txIndex];
        
        return (
            transaction.to,
            transaction.value,
            transaction.data,
            transaction.executed,
            transaction.numConfirmations
        );
    }
}

// 简化的跨链资产转移流程
class CrossChainBridge {
  constructor(chainASource, chainBSource, relayerNetwork) {
    this.chainASource = chainASource; // 源链接口
    this.chainBSource = chainBSource; // 目标链接口
    this.relayerNetwork = relayerNetwork; // 中继网络
    this.htlcContracts = {
      chainA: '0xChainAContractAddress',
      chainB: '0xChainBContractAddress'
    };
  }
  
  // 发起跨链转账
  async initiateTransfer(amount, recipient, expiryTime) {
    // 1. 生成随机哈希原像和哈希值
    const preimage = crypto.randomBytes(32).toString('hex');
    const hash = crypto.createHash('sha256')
      .update(preimage)
      .digest('hex');
    
    // 2. 在源链锁定资产
    const lockTx = await this.chainASource.lockAssets({
      contract: this.htlcContracts.chainA,
      amount,
      hash,
      recipient,
      expiryTime
    });
    
    // 3. 监听锁定期望确认
    await this.chainASource.waitForConfirmation(lockTx.txHash);
    
    // 4. 通知中继网络启动跨链流程
    await this.relayerNetwork.notifyTransfer({
      sourceChain: 'chainA',
      targetChain: 'chainB',
      hash,
      amount,
      recipient,
      expiryTime,
      sourceTxHash: lockTx.txHash
    });
    
    return {
      transferId: hash,
      preimage,
      lockTxHash: lockTx.txHash,
      expiryTime
    };
  }
  
  // 完成跨链转账
  async completeTransfer(transferId, preimage, targetChain = 'chainB') {
    // 1. 在目标链上提取资产
    const claimTx = await this.chainBSource.claimAssets({
      contract: this.htlcContracts[targetChain],
      hash: transferId,
      preimage
    });
    
    // 2. 等待确认
    await this.chainBSource.waitForConfirmation(claimTx.txHash);
    
    return {
      status: 'completed',
      claimTxHash: claimTx.txHash
    };
  }
  
  // 如果超时，取消转账并退款
  async refundTransfer(transferId, sourceChain = 'chainA') {
    // 1. 验证是否已过期
    const transferInfo = await this.relayerNetwork.getTransferInfo(transferId);
    if (Date.now() < transferInfo.expiryTime) {
      throw new Error('转账尚未过期，无法退款');
    }
    
    // 2. 在源链上发起退款
    const refundTx = await this.chainASource.refundAssets({
      contract: this.htlcContracts[sourceChain],
      hash: transferId
    });
    
    // 3. 等待确认
    await this.chainASource.waitForConfirmation(refundTx.txHash);
    
    return {
      status: 'refunded',
      refundTxHash: refundTx.txHash
    };
  }
}