## Summary

Adding a Syscall to support the verification of sigatures generated on the
secp256r1 curve.
Similar to the support for secp256k1 signatures that already exists in form of
the `KeccakSecp256k11111111111111111111111111111` native program an the
`secp256k1_recover()` syscall.

## Motivation

Solana should have option to secure your funds in a self custodial manner that
doesn't just airgap your private key with a hardware wallet (which even then
remains as a single point of failure). Arguably, multi-signature wallets fit
into this equation as they enable the dependency on multiple private keys.
However in practice the UX takes too much of a hit, as having to sign a
transaction a minimum of 3 seperate times and having to write down 3 seed
phrases is too cumbersome. It would be ideal to have an authetication form that
relies on a more familiar second factor, such as a users mobile device.

Passkeys & WebAuthn are a standardized implementation of this. They enable users
to save keypairs associated to different services natively on the secure
element of their mobile device. To authenticate with those services, the user
uses their biometrics to sign a message with the stored private key.

And although this is meant to enable password-less logins in web2, it makes for
an excellent canditate as a second factor of on-chain authentication.

Going past just securing funds, this would support other beneficial account
abstractions that make use of the simple UX of WebAuthn and Passkeys.

Note:

Although WebAuthn supports the following curves:

- P-256
- P-384
- P-521
- ed25519

P-256 is the only one suported by both Android & IOS (IOS being the more
restrictive of the two), hence the goal being to implement secp256r1 signature verification

General Documentation:

[WebAuthn](https://webauthn.io/)

[Passkeys](https://fidoalliance.org/passkeys/)

## Alternatives Considered

We have discussed the following alternatives:

1.) Realising signature verification with a native program/instruction similar
to `KeccakSecp256k11111111111111111111111111111` instead of a syscall. As the
signature is known/generated by the user upfront for a tx, an implementation
as a native program would also work.

## New Terminology

None

## Detailed Design

Initial direction would be as follows:

### Function

```rust
fn secp256r1_verify(
  pubkey: &[u8],
  message: &[u8],
  signature: &[u8]
  ) -> Result<(), Secp256r1Error>
```

Should be analog to what exists for `secp256k1_recover()` , except without
`recovery_id`. Should enable verifying one signature at a time.

### Implementation

The crates `ecdsa` and `p256` are a good starting point for the implementation.
Due to a current dependency version conflict of `zeroize` between
`curve25519-dalek` and `solana-program`, using these crates will require a
fix/bump of `zeroize` inside `curve25519-dalek`. See issue [#26688](https://github.com/solana-labs/solana/issues/26688)

### Compute Cost

Once the implementation is finished, benchmarking should take place on a
sufficiently powerful machine in order to determine average compute time. For
the sake of ensuring proper efficiency, a comparison to similar implementations
on polygon/optimism/ethereum would be conducted.

This is in line with how previous syscalls for EC group operations and
arithmetic were evaluated/benchmarked.
See [PR#27961](https://github.com/solana-labs/solana/pull/27961) & [PR#28503](https://github.com/solana-labs/solana/pull/28503)

## Impact

Would enable the on-chain usage of Passkeys and the WebAuthn Standard.

By extension this would also enable the creation of account abstractions and
forms of Two-Factor Authentication around those keypairs.

## Security Considerations

- Ensure parity of test results and parameters with those found in
  [SEC2](https://www.secg.org/sec2-v2.pdf) for the secp256r1 curve
- Ensure signature malleability is prevented/accounted for

## Backwards Compatibility

Programs using the syscall could not be used on Solana versions which don't
implement this feature. A Feature gate should be used to enable this feature
when the majority of the cluster is using the required version. Existing
programs that do not use this feature are not impacted.

Syscall for verifying secp256r1 signatures