mirror of
https://github.com/serai-dex/serai.git
synced 2024-12-22 19:49:22 +00:00
Consolidate concise/efficient and clean
This commit is contained in:
parent
7d80b6e854
commit
1a2e6dc5cf
13 changed files with 458 additions and 663 deletions
|
@ -55,6 +55,8 @@ impl<
|
||||||
> Aos<G0, G1, RING_LEN> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
> Aos<G0, G1, RING_LEN> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||||
#[allow(non_snake_case)]
|
#[allow(non_snake_case)]
|
||||||
fn nonces<T: Transcript>(mut transcript: T, nonces: (G0, G1)) -> (G0::Scalar, G1::Scalar) {
|
fn nonces<T: Transcript>(mut transcript: T, nonces: (G0, G1)) -> (G0::Scalar, G1::Scalar) {
|
||||||
|
transcript.domain_separate(b"aos_membership_proof");
|
||||||
|
transcript.append_message(b"ring_len", &u8::try_from(RING_LEN).unwrap().to_le_bytes());
|
||||||
transcript.append_message(b"nonce_0", nonces.0.to_bytes().as_ref());
|
transcript.append_message(b"nonce_0", nonces.0.to_bytes().as_ref());
|
||||||
transcript.append_message(b"nonce_1", nonces.1.to_bytes().as_ref());
|
transcript.append_message(b"nonce_1", nonces.1.to_bytes().as_ref());
|
||||||
mutual_scalar_from_bytes(transcript.challenge(b"challenge").as_ref())
|
mutual_scalar_from_bytes(transcript.challenge(b"challenge").as_ref())
|
||||||
|
@ -151,6 +153,7 @@ impl<
|
||||||
debug_assert!((RING_LEN == 2) || (RING_LEN == 4));
|
debug_assert!((RING_LEN == 2) || (RING_LEN == 4));
|
||||||
debug_assert_eq!(RING_LEN, ring.len());
|
debug_assert_eq!(RING_LEN, ring.len());
|
||||||
|
|
||||||
|
#[allow(non_snake_case)]
|
||||||
match self.Re_0 {
|
match self.Re_0 {
|
||||||
Re::R(R0_0, R1_0) => {
|
Re::R(R0_0, R1_0) => {
|
||||||
let mut e = Self::nonces(transcript.clone(), (R0_0, R1_0));
|
let mut e = Self::nonces(transcript.clone(), (R0_0, R1_0));
|
||||||
|
@ -164,6 +167,7 @@ impl<
|
||||||
*ring.last().unwrap(),
|
*ring.last().unwrap(),
|
||||||
e
|
e
|
||||||
);
|
);
|
||||||
|
// TODO: Make something else negative to speed up vartime
|
||||||
statements.0.push((-G0::Scalar::one(), R0_0));
|
statements.0.push((-G0::Scalar::one(), R0_0));
|
||||||
statements.1.push((-G1::Scalar::one(), R1_0));
|
statements.1.push((-G1::Scalar::one(), R1_0));
|
||||||
batch.0.queue(&mut *rng, (), statements.0);
|
batch.0.queue(&mut *rng, (), statements.0);
|
|
@ -3,73 +3,89 @@ use rand_core::{RngCore, CryptoRng};
|
||||||
use transcript::Transcript;
|
use transcript::Transcript;
|
||||||
|
|
||||||
use group::{ff::PrimeFieldBits, prime::PrimeGroup};
|
use group::{ff::PrimeFieldBits, prime::PrimeGroup};
|
||||||
|
use multiexp::BatchVerifier;
|
||||||
|
|
||||||
use crate::{Generators, cross_group::DLEqError};
|
use crate::{Generators, cross_group::{DLEqError, aos::{Re, Aos}}};
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
use std::io::{Read, Write};
|
use std::io::{Read, Write};
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
use crate::cross_group::read_point;
|
use crate::cross_group::read_point;
|
||||||
|
|
||||||
pub trait RingSignature<G0: PrimeGroup, G1: PrimeGroup>: Sized {
|
pub(crate) enum BitSignature {
|
||||||
type Context;
|
ConciseLinear,
|
||||||
|
EfficientLinear
|
||||||
|
}
|
||||||
|
|
||||||
const LEN: usize;
|
impl BitSignature {
|
||||||
|
pub(crate) const fn to_u8(&self) -> u8 {
|
||||||
|
match self {
|
||||||
|
BitSignature::ConciseLinear => 0,
|
||||||
|
BitSignature::EfficientLinear => 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
fn prove<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
pub(crate) const fn from(algorithm: u8) -> BitSignature {
|
||||||
rng: &mut R,
|
match algorithm {
|
||||||
transcript: T,
|
0 => BitSignature::ConciseLinear,
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
1 => BitSignature::EfficientLinear,
|
||||||
ring: &[(G0, G1)],
|
_ => panic!("Unknown algorithm")
|
||||||
actual: usize,
|
}
|
||||||
blinding_key: (G0::Scalar, G1::Scalar)
|
}
|
||||||
) -> Self;
|
|
||||||
|
|
||||||
fn verify<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
pub(crate) const fn bits(&self) -> usize {
|
||||||
&self,
|
match self {
|
||||||
rng: &mut R,
|
BitSignature::ConciseLinear => 2,
|
||||||
transcript: T,
|
BitSignature::EfficientLinear => 1
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
}
|
||||||
context: &mut Self::Context,
|
}
|
||||||
ring: &[(G0, G1)]
|
|
||||||
) -> Result<(), DLEqError>;
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
pub(crate) const fn ring_len(&self) -> usize {
|
||||||
fn serialize<W: Write>(&self, w: &mut W) -> std::io::Result<()>;
|
2_usize.pow(self.bits() as u32)
|
||||||
#[cfg(feature = "serialize")]
|
}
|
||||||
fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self>;
|
|
||||||
|
fn aos_form<G0: PrimeGroup, G1: PrimeGroup>(&self) -> Re<G0, G1> {
|
||||||
|
match self {
|
||||||
|
BitSignature::ConciseLinear => Re::e_default(),
|
||||||
|
BitSignature::EfficientLinear => Re::R_default()
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||||
pub(crate) struct Bits<G0: PrimeGroup, G1: PrimeGroup, RING: RingSignature<G0, G1>> {
|
pub(crate) struct Bits<
|
||||||
|
G0: PrimeGroup,
|
||||||
|
G1: PrimeGroup,
|
||||||
|
const SIGNATURE: u8,
|
||||||
|
const RING_LEN: usize
|
||||||
|
> {
|
||||||
pub(crate) commitments: (G0, G1),
|
pub(crate) commitments: (G0, G1),
|
||||||
signature: RING
|
signature: Aos<G0, G1, RING_LEN>
|
||||||
}
|
}
|
||||||
|
|
||||||
impl<G0: PrimeGroup, G1: PrimeGroup, RING: RingSignature<G0, G1>> Bits<G0, G1, RING>
|
impl<
|
||||||
where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
G0: PrimeGroup,
|
||||||
|
G1: PrimeGroup,
|
||||||
|
const SIGNATURE: u8,
|
||||||
|
const RING_LEN: usize
|
||||||
|
> Bits<G0, G1, SIGNATURE, RING_LEN> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||||
fn transcript<T: Transcript>(transcript: &mut T, i: usize, commitments: (G0, G1)) {
|
fn transcript<T: Transcript>(transcript: &mut T, i: usize, commitments: (G0, G1)) {
|
||||||
if i == 0 {
|
transcript.domain_separate(b"bits");
|
||||||
transcript.domain_separate(b"cross_group_dleq");
|
transcript.append_message(b"group", &u16::try_from(i).unwrap().to_le_bytes());
|
||||||
}
|
|
||||||
transcript.append_message(b"bit_group", &u16::try_from(i).unwrap().to_le_bytes());
|
|
||||||
transcript.append_message(b"commitment_0", commitments.0.to_bytes().as_ref());
|
transcript.append_message(b"commitment_0", commitments.0.to_bytes().as_ref());
|
||||||
transcript.append_message(b"commitment_1", commitments.1.to_bytes().as_ref());
|
transcript.append_message(b"commitment_1", commitments.1.to_bytes().as_ref());
|
||||||
}
|
}
|
||||||
|
|
||||||
fn ring(pow_2: (G0, G1), commitments: (G0, G1)) -> Vec<(G0, G1)> {
|
fn ring(pow_2: (G0, G1), commitments: (G0, G1)) -> Vec<(G0, G1)> {
|
||||||
let mut res = vec![(G0::identity(), G1::identity()); RING::LEN];
|
let mut res = vec![commitments; RING_LEN];
|
||||||
res[RING::LEN - 1] = commitments;
|
for i in 1 .. RING_LEN {
|
||||||
for i in (0 .. (RING::LEN - 1)).rev() {
|
res[i] = (res[i - 1].0 - pow_2.0, res[i - 1].1 - pow_2.1);
|
||||||
res[i] = (res[i + 1].0 - pow_2.0, res[i + 1].1 - pow_2.1);
|
|
||||||
}
|
}
|
||||||
res
|
res
|
||||||
}
|
}
|
||||||
|
|
||||||
fn shift(pow_2: &mut (G0, G1)) {
|
fn shift(pow_2: &mut (G0, G1)) {
|
||||||
pow_2.0 = pow_2.0.double();
|
for _ in 0 .. BitSignature::from(SIGNATURE).bits() {
|
||||||
pow_2.1 = pow_2.1.double();
|
|
||||||
if RING::LEN == 4 {
|
|
||||||
pow_2.0 = pow_2.0.double();
|
pow_2.0 = pow_2.0.double();
|
||||||
pow_2.1 = pow_2.1.double();
|
pow_2.1 = pow_2.1.double();
|
||||||
}
|
}
|
||||||
|
@ -84,20 +100,24 @@ impl<G0: PrimeGroup, G1: PrimeGroup, RING: RingSignature<G0, G1>> Bits<G0, G1, R
|
||||||
bits: u8,
|
bits: u8,
|
||||||
blinding_key: (G0::Scalar, G1::Scalar)
|
blinding_key: (G0::Scalar, G1::Scalar)
|
||||||
) -> Self {
|
) -> Self {
|
||||||
debug_assert!((RING::LEN == 2) || (RING::LEN == 4));
|
|
||||||
|
|
||||||
let mut commitments = (
|
let mut commitments = (
|
||||||
(generators.0.alt * blinding_key.0),
|
(generators.0.alt * blinding_key.0),
|
||||||
(generators.1.alt * blinding_key.1)
|
(generators.1.alt * blinding_key.1)
|
||||||
);
|
);
|
||||||
commitments.0 += pow_2.0 * G0::Scalar::from(bits.into());
|
commitments.0 += pow_2.0 * G0::Scalar::from(bits.into());
|
||||||
commitments.1 += pow_2.1 * G1::Scalar::from(bits.into());
|
commitments.1 += pow_2.1 * G1::Scalar::from(bits.into());
|
||||||
|
|
||||||
Self::transcript(transcript, i, commitments);
|
Self::transcript(transcript, i, commitments);
|
||||||
|
|
||||||
let ring = Self::ring(*pow_2, commitments);
|
let signature = Aos::prove(
|
||||||
// Invert the index to get the raw blinding key's position in the ring
|
rng,
|
||||||
let actual = RING::LEN - 1 - usize::from(bits);
|
transcript.clone(),
|
||||||
let signature = RING::prove(rng, transcript.clone(), generators, &ring, actual, blinding_key);
|
generators,
|
||||||
|
&Self::ring(*pow_2, commitments),
|
||||||
|
usize::from(bits),
|
||||||
|
blinding_key,
|
||||||
|
BitSignature::from(SIGNATURE).aos_form()
|
||||||
|
);
|
||||||
|
|
||||||
Self::shift(pow_2);
|
Self::shift(pow_2);
|
||||||
Bits { commitments, signature }
|
Bits { commitments, signature }
|
||||||
|
@ -108,18 +128,17 @@ impl<G0: PrimeGroup, G1: PrimeGroup, RING: RingSignature<G0, G1>> Bits<G0, G1, R
|
||||||
rng: &mut R,
|
rng: &mut R,
|
||||||
transcript: &mut T,
|
transcript: &mut T,
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
generators: (Generators<G0>, Generators<G1>),
|
||||||
context: &mut RING::Context,
|
batch: &mut (BatchVerifier<(), G0>, BatchVerifier<(), G1>),
|
||||||
i: usize,
|
i: usize,
|
||||||
pow_2: &mut (G0, G1)
|
pow_2: &mut (G0, G1)
|
||||||
) -> Result<(), DLEqError> {
|
) -> Result<(), DLEqError> {
|
||||||
debug_assert!((RING::LEN == 2) || (RING::LEN == 4));
|
|
||||||
|
|
||||||
Self::transcript(transcript, i, self.commitments);
|
Self::transcript(transcript, i, self.commitments);
|
||||||
|
|
||||||
self.signature.verify(
|
self.signature.verify(
|
||||||
rng,
|
rng,
|
||||||
transcript.clone(),
|
transcript.clone(),
|
||||||
generators,
|
generators,
|
||||||
context,
|
batch,
|
||||||
&Self::ring(*pow_2, self.commitments)
|
&Self::ring(*pow_2, self.commitments)
|
||||||
)?;
|
)?;
|
||||||
|
|
||||||
|
@ -135,7 +154,7 @@ impl<G0: PrimeGroup, G1: PrimeGroup, RING: RingSignature<G0, G1>> Bits<G0, G1, R
|
||||||
}
|
}
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
pub(crate) fn deserialize<Re: Read>(r: &mut Re) -> std::io::Result<Self> {
|
pub(crate) fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
||||||
Ok(Bits { commitments: (read_point(r)?, read_point(r)?), signature: RING::deserialize(r)? })
|
Ok(Bits { commitments: (read_point(r)?, read_point(r)?), signature: Aos::deserialize(r)? })
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,217 +0,0 @@
|
||||||
use rand_core::{RngCore, CryptoRng};
|
|
||||||
|
|
||||||
use digest::Digest;
|
|
||||||
|
|
||||||
use transcript::Transcript;
|
|
||||||
|
|
||||||
use group::{ff::{Field, PrimeField, PrimeFieldBits}, prime::PrimeGroup};
|
|
||||||
|
|
||||||
use crate::{
|
|
||||||
Generators,
|
|
||||||
cross_group::{
|
|
||||||
DLEqError, DLEqProof,
|
|
||||||
scalar::{scalar_convert, mutual_scalar_from_bytes},
|
|
||||||
schnorr::SchnorrPoK,
|
|
||||||
linear::aos::ClassicAos,
|
|
||||||
bits::Bits
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use std::io::{Read, Write};
|
|
||||||
|
|
||||||
pub type ConciseDLEq<G0, G1> = DLEqProof<
|
|
||||||
G0,
|
|
||||||
G1,
|
|
||||||
ClassicAos<G0, G1, 4>,
|
|
||||||
ClassicAos<G0, G1, 2>
|
|
||||||
>;
|
|
||||||
|
|
||||||
impl<G0: PrimeGroup, G1: PrimeGroup> ConciseDLEq<G0, G1>
|
|
||||||
where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
|
||||||
fn prove_internal<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
f: (G0::Scalar, G1::Scalar)
|
|
||||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
|
||||||
Self::initialize_transcript(
|
|
||||||
transcript,
|
|
||||||
generators,
|
|
||||||
((generators.0.primary * f.0), (generators.1.primary * f.1))
|
|
||||||
);
|
|
||||||
|
|
||||||
let poks = (
|
|
||||||
SchnorrPoK::<G0>::prove(rng, transcript, generators.0.primary, f.0),
|
|
||||||
SchnorrPoK::<G1>::prove(rng, transcript, generators.1.primary, f.1)
|
|
||||||
);
|
|
||||||
|
|
||||||
let mut blinding_key_total = (G0::Scalar::zero(), G1::Scalar::zero());
|
|
||||||
let mut blinding_key = |rng: &mut R, last| {
|
|
||||||
let blinding_key = (
|
|
||||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.0, last),
|
|
||||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.1, last)
|
|
||||||
);
|
|
||||||
if last {
|
|
||||||
debug_assert_eq!(blinding_key_total.0, G0::Scalar::zero());
|
|
||||||
debug_assert_eq!(blinding_key_total.1, G1::Scalar::zero());
|
|
||||||
}
|
|
||||||
blinding_key
|
|
||||||
};
|
|
||||||
|
|
||||||
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
|
||||||
|
|
||||||
let raw_bits = f.0.to_le_bits();
|
|
||||||
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
|
|
||||||
let mut bits = Vec::with_capacity(capacity);
|
|
||||||
let mut these_bits: u8 = 0;
|
|
||||||
for (i, bit) in raw_bits.iter().enumerate() {
|
|
||||||
if i > ((capacity / 2) * 2) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
let bit = *bit as u8;
|
|
||||||
debug_assert_eq!(bit | 1, 1);
|
|
||||||
|
|
||||||
if (i % 2) == 0 {
|
|
||||||
these_bits = bit;
|
|
||||||
continue;
|
|
||||||
} else {
|
|
||||||
these_bits += bit << 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
let last = i == (capacity - 1);
|
|
||||||
let blinding_key = blinding_key(&mut *rng, last);
|
|
||||||
bits.push(
|
|
||||||
Bits::prove(&mut *rng, transcript, generators, i / 2, &mut pow_2, these_bits, blinding_key)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut remainder = None;
|
|
||||||
if (capacity % 2) == 1 {
|
|
||||||
let blinding_key = blinding_key(&mut *rng, true);
|
|
||||||
remainder = Some(
|
|
||||||
Bits::prove(
|
|
||||||
&mut *rng,
|
|
||||||
transcript,
|
|
||||||
generators,
|
|
||||||
capacity / 2,
|
|
||||||
&mut pow_2,
|
|
||||||
these_bits,
|
|
||||||
blinding_key
|
|
||||||
)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
let proof = DLEqProof { bits, remainder, poks };
|
|
||||||
debug_assert_eq!(
|
|
||||||
proof.reconstruct_keys(),
|
|
||||||
(generators.0.primary * f.0, generators.1.primary * f.1)
|
|
||||||
);
|
|
||||||
(proof, f)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar created as
|
|
||||||
/// the output of the passed in Digest. Given the non-standard requirements to achieve
|
|
||||||
/// uniformity, needing to be < 2^x instead of less than a prime moduli, this is the simplest way
|
|
||||||
/// to safely and securely generate a Scalar, without risk of failure, nor bias
|
|
||||||
/// It also ensures a lack of determinable relation between keys, guaranteeing security in the
|
|
||||||
/// currently expected use case for this, atomic swaps, where each swap leaks the key. Knowing
|
|
||||||
/// the relationship between keys would allow breaking all swaps after just one
|
|
||||||
pub fn prove<R: RngCore + CryptoRng, T: Clone + Transcript, D: Digest>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
digest: D
|
|
||||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
|
||||||
Self::prove_internal(
|
|
||||||
rng,
|
|
||||||
transcript,
|
|
||||||
generators,
|
|
||||||
mutual_scalar_from_bytes(digest.finalize().as_ref())
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar passed in,
|
|
||||||
/// failing if it's not mutually valid. This allows for rejection sampling externally derived
|
|
||||||
/// scalars until they're safely usable, as needed
|
|
||||||
pub fn prove_without_bias<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
f0: G0::Scalar
|
|
||||||
) -> Option<(Self, (G0::Scalar, G1::Scalar))> {
|
|
||||||
scalar_convert(f0).map(|f1| Self::prove_internal(rng, transcript, generators, (f0, f1)))
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Verify a cross-Group Discrete Log Equality statement, returning the points proven for
|
|
||||||
pub fn verify<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
&self,
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>)
|
|
||||||
) -> Result<(G0, G1), DLEqError> {
|
|
||||||
let capacity = G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY);
|
|
||||||
if (self.bits.len() != (capacity / 2).try_into().unwrap()) || (
|
|
||||||
// These shouldn't be possible, as deserialize ensures this is present for fields with this
|
|
||||||
// characteristic, and proofs locally generated will have it. Regardless, best to ensure
|
|
||||||
(self.remainder.is_none() && ((capacity % 2) == 1)) ||
|
|
||||||
(self.remainder.is_some() && ((capacity % 2) == 0))
|
|
||||||
) {
|
|
||||||
return Err(DLEqError::InvalidProofLength);
|
|
||||||
}
|
|
||||||
|
|
||||||
let keys = self.reconstruct_keys();
|
|
||||||
Self::initialize_transcript(transcript, generators, keys);
|
|
||||||
if !(
|
|
||||||
self.poks.0.verify(transcript, generators.0.primary, keys.0) &&
|
|
||||||
self.poks.1.verify(transcript, generators.1.primary, keys.1)
|
|
||||||
) {
|
|
||||||
Err(DLEqError::InvalidProofOfKnowledge)?;
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
|
||||||
for (i, bits) in self.bits.iter().enumerate() {
|
|
||||||
bits.verify(&mut *rng, transcript, generators, &mut (), i, &mut pow_2)?;
|
|
||||||
}
|
|
||||||
if let Some(bit) = &self.remainder {
|
|
||||||
bit.verify(&mut *rng, transcript, generators, &mut (), self.bits.len(), &mut pow_2)?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(keys)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
pub fn serialize<W: Write>(&self, w: &mut W) -> std::io::Result<()> {
|
|
||||||
for bit in &self.bits {
|
|
||||||
bit.serialize(w)?;
|
|
||||||
}
|
|
||||||
if let Some(bit) = &self.remainder {
|
|
||||||
bit.serialize(w)?;
|
|
||||||
}
|
|
||||||
self.poks.0.serialize(w)?;
|
|
||||||
self.poks.1.serialize(w)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
pub fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
|
||||||
let capacity = G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY);
|
|
||||||
let mut bits = Vec::with_capacity(capacity.try_into().unwrap());
|
|
||||||
for _ in 0 .. (capacity / 2) {
|
|
||||||
bits.push(Bits::deserialize(r)?);
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut remainder = None;
|
|
||||||
if (capacity % 2) == 1 {
|
|
||||||
remainder = Some(Bits::deserialize(r)?);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(
|
|
||||||
DLEqProof {
|
|
||||||
bits,
|
|
||||||
remainder,
|
|
||||||
poks: (SchnorrPoK::deserialize(r)?, SchnorrPoK::deserialize(r)?)
|
|
||||||
}
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
|
@ -1,182 +0,0 @@
|
||||||
use rand_core::{RngCore, CryptoRng};
|
|
||||||
|
|
||||||
use digest::Digest;
|
|
||||||
|
|
||||||
use transcript::Transcript;
|
|
||||||
|
|
||||||
use group::{ff::{Field, PrimeField, PrimeFieldBits}, prime::PrimeGroup};
|
|
||||||
use multiexp::BatchVerifier;
|
|
||||||
|
|
||||||
use crate::{
|
|
||||||
Generators,
|
|
||||||
cross_group::{
|
|
||||||
DLEqError, DLEqProof,
|
|
||||||
scalar::{scalar_convert, mutual_scalar_from_bytes},
|
|
||||||
schnorr::SchnorrPoK,
|
|
||||||
linear::aos::MultiexpAos,
|
|
||||||
bits::Bits
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use std::io::{Read, Write};
|
|
||||||
|
|
||||||
pub type EfficientDLEq<G0, G1> = DLEqProof<G0, G1, MultiexpAos<G0, G1>, MultiexpAos<G0, G1>>;
|
|
||||||
|
|
||||||
impl<G0: PrimeGroup, G1: PrimeGroup> EfficientDLEq<G0, G1>
|
|
||||||
where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
|
||||||
fn prove_internal<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
f: (G0::Scalar, G1::Scalar)
|
|
||||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
|
||||||
Self::initialize_transcript(
|
|
||||||
transcript,
|
|
||||||
generators,
|
|
||||||
((generators.0.primary * f.0), (generators.1.primary * f.1))
|
|
||||||
);
|
|
||||||
|
|
||||||
let poks = (
|
|
||||||
SchnorrPoK::<G0>::prove(rng, transcript, generators.0.primary, f.0),
|
|
||||||
SchnorrPoK::<G1>::prove(rng, transcript, generators.1.primary, f.1)
|
|
||||||
);
|
|
||||||
|
|
||||||
let mut blinding_key_total = (G0::Scalar::zero(), G1::Scalar::zero());
|
|
||||||
let mut blinding_key = |rng: &mut R, last| {
|
|
||||||
let blinding_key = (
|
|
||||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.0, last),
|
|
||||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.1, last)
|
|
||||||
);
|
|
||||||
if last {
|
|
||||||
debug_assert_eq!(blinding_key_total.0, G0::Scalar::zero());
|
|
||||||
debug_assert_eq!(blinding_key_total.1, G1::Scalar::zero());
|
|
||||||
}
|
|
||||||
blinding_key
|
|
||||||
};
|
|
||||||
|
|
||||||
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
|
||||||
|
|
||||||
let raw_bits = f.0.to_le_bits();
|
|
||||||
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
|
|
||||||
let mut bits = Vec::with_capacity(capacity);
|
|
||||||
for (i, bit) in raw_bits.iter().enumerate() {
|
|
||||||
let bit = *bit as u8;
|
|
||||||
debug_assert_eq!(bit | 1, 1);
|
|
||||||
|
|
||||||
let last = i == (capacity - 1);
|
|
||||||
let blinding_key = blinding_key(&mut *rng, last);
|
|
||||||
bits.push(
|
|
||||||
Bits::prove(&mut *rng, transcript, generators, i, &mut pow_2, bit, blinding_key)
|
|
||||||
);
|
|
||||||
|
|
||||||
if last {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
let proof = DLEqProof { bits, remainder: None, poks };
|
|
||||||
debug_assert_eq!(
|
|
||||||
proof.reconstruct_keys(),
|
|
||||||
(generators.0.primary * f.0, generators.1.primary * f.1)
|
|
||||||
);
|
|
||||||
(proof, f)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar created as
|
|
||||||
/// the output of the passed in Digest. Given the non-standard requirements to achieve
|
|
||||||
/// uniformity, needing to be < 2^x instead of less than a prime moduli, this is the simplest way
|
|
||||||
/// to safely and securely generate a Scalar, without risk of failure, nor bias
|
|
||||||
/// It also ensures a lack of determinable relation between keys, guaranteeing security in the
|
|
||||||
/// currently expected use case for this, atomic swaps, where each swap leaks the key. Knowing
|
|
||||||
/// the relationship between keys would allow breaking all swaps after just one
|
|
||||||
pub fn prove<R: RngCore + CryptoRng, T: Clone + Transcript, D: Digest>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
digest: D
|
|
||||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
|
||||||
Self::prove_internal(
|
|
||||||
rng,
|
|
||||||
transcript,
|
|
||||||
generators,
|
|
||||||
mutual_scalar_from_bytes(digest.finalize().as_ref())
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar passed in,
|
|
||||||
/// failing if it's not mutually valid. This allows for rejection sampling externally derived
|
|
||||||
/// scalars until they're safely usable, as needed
|
|
||||||
pub fn prove_without_bias<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
|
||||||
f0: G0::Scalar
|
|
||||||
) -> Option<(Self, (G0::Scalar, G1::Scalar))> {
|
|
||||||
scalar_convert(f0).map(|f1| Self::prove_internal(rng, transcript, generators, (f0, f1)))
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Verify a cross-Group Discrete Log Equality statement, returning the points proven for
|
|
||||||
pub fn verify<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
|
||||||
&self,
|
|
||||||
rng: &mut R,
|
|
||||||
transcript: &mut T,
|
|
||||||
generators: (Generators<G0>, Generators<G1>)
|
|
||||||
) -> Result<(G0, G1), DLEqError> {
|
|
||||||
let capacity = G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY);
|
|
||||||
// The latter case shouldn't be possible yet would explicitly be invalid
|
|
||||||
if (self.bits.len() != capacity.try_into().unwrap()) || self.remainder.is_some() {
|
|
||||||
return Err(DLEqError::InvalidProofLength);
|
|
||||||
}
|
|
||||||
|
|
||||||
let keys = self.reconstruct_keys();
|
|
||||||
Self::initialize_transcript(transcript, generators, keys);
|
|
||||||
// TODO: Batch
|
|
||||||
if !(
|
|
||||||
self.poks.0.verify(transcript, generators.0.primary, keys.0) &&
|
|
||||||
self.poks.1.verify(transcript, generators.1.primary, keys.1)
|
|
||||||
) {
|
|
||||||
Err(DLEqError::InvalidProofOfKnowledge)?;
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut batch = (
|
|
||||||
BatchVerifier::new(self.bits.len() * 3),
|
|
||||||
BatchVerifier::new(self.bits.len() * 3)
|
|
||||||
);
|
|
||||||
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
|
||||||
for (i, bits) in self.bits.iter().enumerate() {
|
|
||||||
bits.verify(&mut *rng, transcript, generators, &mut batch, i, &mut pow_2)?;
|
|
||||||
}
|
|
||||||
if (!batch.0.verify_vartime()) || (!batch.1.verify_vartime()) {
|
|
||||||
Err(DLEqError::InvalidProof)?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(keys)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
pub fn serialize<W: Write>(&self, w: &mut W) -> std::io::Result<()> {
|
|
||||||
for bit in &self.bits {
|
|
||||||
bit.serialize(w)?;
|
|
||||||
}
|
|
||||||
self.poks.0.serialize(w)?;
|
|
||||||
self.poks.1.serialize(w)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
pub fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
|
||||||
let capacity = G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY);
|
|
||||||
let mut bits = Vec::with_capacity(capacity.try_into().unwrap());
|
|
||||||
for _ in 0 .. capacity {
|
|
||||||
bits.push(Bits::deserialize(r)?);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(
|
|
||||||
DLEqProof {
|
|
||||||
bits,
|
|
||||||
remainder: None,
|
|
||||||
poks: (SchnorrPoK::deserialize(r)?, SchnorrPoK::deserialize(r)?)
|
|
||||||
}
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
|
@ -1,7 +0,0 @@
|
||||||
pub(crate) mod aos;
|
|
||||||
|
|
||||||
mod concise;
|
|
||||||
pub use concise::ConciseDLEq;
|
|
||||||
|
|
||||||
mod efficient;
|
|
||||||
pub use efficient::EfficientDLEq;
|
|
|
@ -1,24 +1,28 @@
|
||||||
use thiserror::Error;
|
use thiserror::Error;
|
||||||
|
|
||||||
use rand_core::{RngCore, CryptoRng};
|
use rand_core::{RngCore, CryptoRng};
|
||||||
|
use digest::Digest;
|
||||||
|
|
||||||
use transcript::Transcript;
|
use transcript::Transcript;
|
||||||
|
|
||||||
use group::{ff::{PrimeField, PrimeFieldBits}, prime::PrimeGroup};
|
use group::{ff::{Field, PrimeField, PrimeFieldBits}, prime::PrimeGroup};
|
||||||
|
use multiexp::BatchVerifier;
|
||||||
|
|
||||||
use crate::Generators;
|
use crate::Generators;
|
||||||
|
|
||||||
pub mod scalar;
|
pub mod scalar;
|
||||||
|
use scalar::{scalar_convert, mutual_scalar_from_bytes};
|
||||||
|
|
||||||
pub(crate) mod schnorr;
|
pub(crate) mod schnorr;
|
||||||
use schnorr::SchnorrPoK;
|
use schnorr::SchnorrPoK;
|
||||||
|
|
||||||
mod bits;
|
pub(crate) mod aos;
|
||||||
use bits::{RingSignature, Bits};
|
|
||||||
|
|
||||||
pub mod linear;
|
mod bits;
|
||||||
|
use bits::{BitSignature, Bits};
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
use std::io::Read;
|
use std::io::{Read, Write};
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
pub(crate) fn read_point<R: Read, G: PrimeGroup>(r: &mut R) -> std::io::Result<G> {
|
pub(crate) fn read_point<R: Read, G: PrimeGroup>(r: &mut R) -> std::io::Result<G> {
|
||||||
|
@ -49,25 +53,48 @@ pub enum DLEqError {
|
||||||
pub struct DLEqProof<
|
pub struct DLEqProof<
|
||||||
G0: PrimeGroup,
|
G0: PrimeGroup,
|
||||||
G1: PrimeGroup,
|
G1: PrimeGroup,
|
||||||
RING: RingSignature<G0, G1>,
|
const SIGNATURE: u8,
|
||||||
REM: RingSignature<G0, G1>
|
const RING_LEN: usize,
|
||||||
|
const REMAINDER_RING_LEN: usize
|
||||||
> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||||
bits: Vec<Bits<G0, G1, RING>>,
|
bits: Vec<Bits<G0, G1, SIGNATURE, RING_LEN>>,
|
||||||
remainder: Option<Bits<G0, G1, REM>>,
|
remainder: Option<Bits<G0, G1, SIGNATURE, REMAINDER_RING_LEN>>,
|
||||||
poks: (SchnorrPoK<G0>, SchnorrPoK<G1>)
|
poks: (SchnorrPoK<G0>, SchnorrPoK<G1>)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub type ConciseLinearDLEq<G0, G1> = DLEqProof<
|
||||||
|
G0,
|
||||||
|
G1,
|
||||||
|
{ BitSignature::ConciseLinear.to_u8() },
|
||||||
|
{ BitSignature::ConciseLinear.ring_len() },
|
||||||
|
// There may not be a remainder, yet if there is, it'll be just one bit
|
||||||
|
// A ring for one bit has a RING_LEN of 2
|
||||||
|
2
|
||||||
|
>;
|
||||||
|
|
||||||
|
pub type EfficientLinearDLEq<G0, G1> = DLEqProof<
|
||||||
|
G0,
|
||||||
|
G1,
|
||||||
|
{ BitSignature::EfficientLinear.to_u8() },
|
||||||
|
{ BitSignature::EfficientLinear.ring_len() },
|
||||||
|
0
|
||||||
|
>;
|
||||||
|
|
||||||
impl<
|
impl<
|
||||||
G0: PrimeGroup,
|
G0: PrimeGroup,
|
||||||
G1: PrimeGroup,
|
G1: PrimeGroup,
|
||||||
RING: RingSignature<G0, G1>,
|
const SIGNATURE: u8,
|
||||||
REM: RingSignature<G0, G1>
|
const RING_LEN: usize,
|
||||||
> DLEqProof<G0, G1, RING, REM> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
const REMAINDER_RING_LEN: usize
|
||||||
pub(crate) fn initialize_transcript<T: Transcript>(
|
> DLEqProof<G0, G1, SIGNATURE, RING_LEN, REMAINDER_RING_LEN> where
|
||||||
|
G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||||
|
|
||||||
|
pub(crate) fn transcript<T: Transcript>(
|
||||||
transcript: &mut T,
|
transcript: &mut T,
|
||||||
generators: (Generators<G0>, Generators<G1>),
|
generators: (Generators<G0>, Generators<G1>),
|
||||||
keys: (G0, G1)
|
keys: (G0, G1)
|
||||||
) {
|
) {
|
||||||
|
transcript.domain_separate(b"cross_group_dleq");
|
||||||
generators.0.transcript(transcript);
|
generators.0.transcript(transcript);
|
||||||
generators.1.transcript(transcript);
|
generators.1.transcript(transcript);
|
||||||
transcript.domain_separate(b"points");
|
transcript.domain_separate(b"points");
|
||||||
|
@ -102,4 +129,214 @@ impl<
|
||||||
|
|
||||||
res
|
res
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn prove_internal<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
||||||
|
rng: &mut R,
|
||||||
|
transcript: &mut T,
|
||||||
|
generators: (Generators<G0>, Generators<G1>),
|
||||||
|
f: (G0::Scalar, G1::Scalar)
|
||||||
|
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
||||||
|
Self::transcript(
|
||||||
|
transcript,
|
||||||
|
generators,
|
||||||
|
((generators.0.primary * f.0), (generators.1.primary * f.1))
|
||||||
|
);
|
||||||
|
|
||||||
|
let poks = (
|
||||||
|
SchnorrPoK::<G0>::prove(rng, transcript, generators.0.primary, f.0),
|
||||||
|
SchnorrPoK::<G1>::prove(rng, transcript, generators.1.primary, f.1)
|
||||||
|
);
|
||||||
|
|
||||||
|
let mut blinding_key_total = (G0::Scalar::zero(), G1::Scalar::zero());
|
||||||
|
let mut blinding_key = |rng: &mut R, last| {
|
||||||
|
let blinding_key = (
|
||||||
|
Self::blinding_key(&mut *rng, &mut blinding_key_total.0, last),
|
||||||
|
Self::blinding_key(&mut *rng, &mut blinding_key_total.1, last)
|
||||||
|
);
|
||||||
|
if last {
|
||||||
|
debug_assert_eq!(blinding_key_total.0, G0::Scalar::zero());
|
||||||
|
debug_assert_eq!(blinding_key_total.1, G1::Scalar::zero());
|
||||||
|
}
|
||||||
|
blinding_key
|
||||||
|
};
|
||||||
|
|
||||||
|
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
|
||||||
|
let bits_per_group = BitSignature::from(SIGNATURE).bits();
|
||||||
|
|
||||||
|
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
||||||
|
|
||||||
|
let raw_bits = f.0.to_le_bits();
|
||||||
|
let mut bits = Vec::with_capacity(capacity);
|
||||||
|
let mut these_bits: u8 = 0;
|
||||||
|
for (i, bit) in raw_bits.iter().enumerate() {
|
||||||
|
if i == capacity {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
let bit = *bit as u8;
|
||||||
|
debug_assert_eq!(bit | 1, 1);
|
||||||
|
|
||||||
|
// Accumulate this bit
|
||||||
|
these_bits |= bit << (i % bits_per_group);
|
||||||
|
if (i % bits_per_group) == (bits_per_group - 1) {
|
||||||
|
let last = i == (capacity - 1);
|
||||||
|
let blinding_key = blinding_key(&mut *rng, last);
|
||||||
|
bits.push(
|
||||||
|
Bits::prove(
|
||||||
|
&mut *rng,
|
||||||
|
transcript,
|
||||||
|
generators,
|
||||||
|
i / bits_per_group,
|
||||||
|
&mut pow_2,
|
||||||
|
these_bits,
|
||||||
|
blinding_key
|
||||||
|
)
|
||||||
|
);
|
||||||
|
these_bits = 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
debug_assert_eq!(bits.len(), capacity / bits_per_group);
|
||||||
|
|
||||||
|
let mut remainder = None;
|
||||||
|
if capacity != ((capacity / bits_per_group) * bits_per_group) {
|
||||||
|
let blinding_key = blinding_key(&mut *rng, true);
|
||||||
|
remainder = Some(
|
||||||
|
Bits::prove(
|
||||||
|
&mut *rng,
|
||||||
|
transcript,
|
||||||
|
generators,
|
||||||
|
capacity / bits_per_group,
|
||||||
|
&mut pow_2,
|
||||||
|
these_bits,
|
||||||
|
blinding_key
|
||||||
|
)
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let proof = DLEqProof { bits, remainder, poks };
|
||||||
|
debug_assert_eq!(
|
||||||
|
proof.reconstruct_keys(),
|
||||||
|
(generators.0.primary * f.0, generators.1.primary * f.1)
|
||||||
|
);
|
||||||
|
(proof, f)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar created as
|
||||||
|
/// the output of the passed in Digest. Given the non-standard requirements to achieve
|
||||||
|
/// uniformity, needing to be < 2^x instead of less than a prime moduli, this is the simplest way
|
||||||
|
/// to safely and securely generate a Scalar, without risk of failure, nor bias
|
||||||
|
/// It also ensures a lack of determinable relation between keys, guaranteeing security in the
|
||||||
|
/// currently expected use case for this, atomic swaps, where each swap leaks the key. Knowing
|
||||||
|
/// the relationship between keys would allow breaking all swaps after just one
|
||||||
|
pub fn prove<R: RngCore + CryptoRng, T: Clone + Transcript, D: Digest>(
|
||||||
|
rng: &mut R,
|
||||||
|
transcript: &mut T,
|
||||||
|
generators: (Generators<G0>, Generators<G1>),
|
||||||
|
digest: D
|
||||||
|
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
||||||
|
Self::prove_internal(
|
||||||
|
rng,
|
||||||
|
transcript,
|
||||||
|
generators,
|
||||||
|
mutual_scalar_from_bytes(digest.finalize().as_ref())
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Prove the cross-Group Discrete Log Equality for the points derived from the scalar passed in,
|
||||||
|
/// failing if it's not mutually valid. This allows for rejection sampling externally derived
|
||||||
|
/// scalars until they're safely usable, as needed
|
||||||
|
pub fn prove_without_bias<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
||||||
|
rng: &mut R,
|
||||||
|
transcript: &mut T,
|
||||||
|
generators: (Generators<G0>, Generators<G1>),
|
||||||
|
f0: G0::Scalar
|
||||||
|
) -> Option<(Self, (G0::Scalar, G1::Scalar))> {
|
||||||
|
scalar_convert(f0).map(|f1| Self::prove_internal(rng, transcript, generators, (f0, f1)))
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Verify a cross-Group Discrete Log Equality statement, returning the points proven for
|
||||||
|
pub fn verify<R: RngCore + CryptoRng, T: Clone + Transcript>(
|
||||||
|
&self,
|
||||||
|
rng: &mut R,
|
||||||
|
transcript: &mut T,
|
||||||
|
generators: (Generators<G0>, Generators<G1>)
|
||||||
|
) -> Result<(G0, G1), DLEqError> {
|
||||||
|
let capacity = usize::try_from(
|
||||||
|
G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)
|
||||||
|
).unwrap();
|
||||||
|
let bits_per_group = BitSignature::from(SIGNATURE).bits();
|
||||||
|
let has_remainder = (capacity % bits_per_group) != 0;
|
||||||
|
|
||||||
|
// These shouldn't be possible, as locally created and deserialized proofs should be properly
|
||||||
|
// formed in these regards, yet it doesn't hurt to check and would be problematic if true
|
||||||
|
if (self.bits.len() != (capacity / bits_per_group)) || (
|
||||||
|
(self.remainder.is_none() && has_remainder) || (self.remainder.is_some() && !has_remainder)
|
||||||
|
) {
|
||||||
|
return Err(DLEqError::InvalidProofLength);
|
||||||
|
}
|
||||||
|
|
||||||
|
let keys = self.reconstruct_keys();
|
||||||
|
Self::transcript(transcript, generators, keys);
|
||||||
|
|
||||||
|
let batch_capacity = match BitSignature::from(SIGNATURE) {
|
||||||
|
BitSignature::ConciseLinear => 3,
|
||||||
|
BitSignature::EfficientLinear => (self.bits.len() + 1) * 3
|
||||||
|
};
|
||||||
|
let mut batch = (BatchVerifier::new(batch_capacity), BatchVerifier::new(batch_capacity));
|
||||||
|
|
||||||
|
self.poks.0.verify(&mut *rng, transcript, generators.0.primary, keys.0, &mut batch.0);
|
||||||
|
self.poks.1.verify(&mut *rng, transcript, generators.1.primary, keys.1, &mut batch.1);
|
||||||
|
|
||||||
|
let mut pow_2 = (generators.0.primary, generators.1.primary);
|
||||||
|
for (i, bits) in self.bits.iter().enumerate() {
|
||||||
|
bits.verify(&mut *rng, transcript, generators, &mut batch, i, &mut pow_2)?;
|
||||||
|
}
|
||||||
|
if let Some(bit) = &self.remainder {
|
||||||
|
bit.verify(&mut *rng, transcript, generators, &mut batch, self.bits.len(), &mut pow_2)?;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!batch.0.verify_vartime()) || (!batch.1.verify_vartime()) {
|
||||||
|
Err(DLEqError::InvalidProof)?;
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(keys)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(feature = "serialize")]
|
||||||
|
pub fn serialize<W: Write>(&self, w: &mut W) -> std::io::Result<()> {
|
||||||
|
for bit in &self.bits {
|
||||||
|
bit.serialize(w)?;
|
||||||
|
}
|
||||||
|
if let Some(bit) = &self.remainder {
|
||||||
|
bit.serialize(w)?;
|
||||||
|
}
|
||||||
|
self.poks.0.serialize(w)?;
|
||||||
|
self.poks.1.serialize(w)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(feature = "serialize")]
|
||||||
|
pub fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
||||||
|
let capacity = usize::try_from(
|
||||||
|
G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)
|
||||||
|
).unwrap();
|
||||||
|
let bits_per_group = BitSignature::from(SIGNATURE).bits();
|
||||||
|
|
||||||
|
let mut bits = Vec::with_capacity(capacity / bits_per_group);
|
||||||
|
for _ in 0 .. (capacity / bits_per_group) {
|
||||||
|
bits.push(Bits::deserialize(r)?);
|
||||||
|
}
|
||||||
|
|
||||||
|
let mut remainder = None;
|
||||||
|
if (capacity % bits_per_group) != 0 {
|
||||||
|
remainder = Some(Bits::deserialize(r)?);
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(
|
||||||
|
DLEqProof {
|
||||||
|
bits,
|
||||||
|
remainder,
|
||||||
|
poks: (SchnorrPoK::deserialize(r)?, SchnorrPoK::deserialize(r)?)
|
||||||
|
}
|
||||||
|
)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -2,7 +2,8 @@ use rand_core::{RngCore, CryptoRng};
|
||||||
|
|
||||||
use transcript::Transcript;
|
use transcript::Transcript;
|
||||||
|
|
||||||
use group::{ff::Field, prime::PrimeGroup};
|
use group::{ff::{Field, PrimeFieldBits}, prime::PrimeGroup};
|
||||||
|
use multiexp::BatchVerifier;
|
||||||
|
|
||||||
use crate::challenge;
|
use crate::challenge;
|
||||||
|
|
||||||
|
@ -20,7 +21,7 @@ pub(crate) struct SchnorrPoK<G: PrimeGroup> {
|
||||||
s: G::Scalar
|
s: G::Scalar
|
||||||
}
|
}
|
||||||
|
|
||||||
impl<G: PrimeGroup> SchnorrPoK<G> {
|
impl<G: PrimeGroup> SchnorrPoK<G> where G::Scalar: PrimeFieldBits {
|
||||||
// Not hram due to the lack of m
|
// Not hram due to the lack of m
|
||||||
#[allow(non_snake_case)]
|
#[allow(non_snake_case)]
|
||||||
fn hra<T: Transcript>(transcript: &mut T, generator: G, R: G, A: G) -> G::Scalar {
|
fn hra<T: Transcript>(transcript: &mut T, generator: G, R: G, A: G) -> G::Scalar {
|
||||||
|
@ -46,16 +47,23 @@ impl<G: PrimeGroup> SchnorrPoK<G> {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
#[must_use]
|
pub(crate) fn verify<R: RngCore + CryptoRng, T: Transcript>(
|
||||||
pub(crate) fn verify<T: Transcript>(
|
|
||||||
&self,
|
&self,
|
||||||
|
rng: &mut R,
|
||||||
transcript: &mut T,
|
transcript: &mut T,
|
||||||
generator: G,
|
generator: G,
|
||||||
public_key: G
|
public_key: G,
|
||||||
) -> bool {
|
batch: &mut BatchVerifier<(), G>
|
||||||
(generator * self.s) == (
|
) {
|
||||||
self.R + (public_key * Self::hra(transcript, generator, self.R, public_key))
|
batch.queue(
|
||||||
)
|
rng,
|
||||||
|
(),
|
||||||
|
[
|
||||||
|
(-self.s, generator),
|
||||||
|
(G::Scalar::one(), self.R),
|
||||||
|
(Self::hra(transcript, generator, self.R, public_key), public_key)
|
||||||
|
]
|
||||||
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
#[cfg(feature = "serialize")]
|
||||||
|
|
|
@ -5,7 +5,7 @@ use group::{ff::Field, Group};
|
||||||
use multiexp::BatchVerifier;
|
use multiexp::BatchVerifier;
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
cross_group::linear::aos::{Re, Aos},
|
cross_group::aos::{Re, Aos},
|
||||||
tests::cross_group::{G0, G1, transcript, generators}
|
tests::cross_group::{G0, G1, transcript, generators}
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -21,6 +21,8 @@ fn test_aos<const RING_LEN: usize>(default: Re<G0, G1>) {
|
||||||
let generators = generators();
|
let generators = generators();
|
||||||
|
|
||||||
let mut ring_keys = [(<G0 as Group>::Scalar::zero(), <G1 as Group>::Scalar::zero()); RING_LEN];
|
let mut ring_keys = [(<G0 as Group>::Scalar::zero(), <G1 as Group>::Scalar::zero()); RING_LEN];
|
||||||
|
// Side-effect of G0 being a type-alias with identity() deprecated
|
||||||
|
#[allow(deprecated)]
|
||||||
let mut ring = [(G0::identity(), G1::identity()); RING_LEN];
|
let mut ring = [(G0::identity(), G1::identity()); RING_LEN];
|
||||||
for i in 0 .. RING_LEN {
|
for i in 0 .. RING_LEN {
|
||||||
ring_keys[i] = (
|
ring_keys[i] = (
|
||||||
|
@ -58,6 +60,7 @@ fn test_aos_e() {
|
||||||
test_aos::<4>(Re::e_default());
|
test_aos::<4>(Re::e_default());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[allow(non_snake_case)]
|
||||||
#[test]
|
#[test]
|
||||||
fn test_aos_R() {
|
fn test_aos_R() {
|
||||||
// Batch verification appreciates the longer vectors, which means not batching bits
|
// Batch verification appreciates the longer vectors, which means not batching bits
|
|
@ -1,98 +0,0 @@
|
||||||
use rand_core::{RngCore, OsRng};
|
|
||||||
|
|
||||||
use ff::{Field, PrimeField};
|
|
||||||
|
|
||||||
use k256::Scalar;
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use k256::ProjectivePoint;
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use dalek_ff_group::EdwardsPoint;
|
|
||||||
|
|
||||||
use blake2::{Digest, Blake2b512};
|
|
||||||
|
|
||||||
use crate::{
|
|
||||||
cross_group::{scalar::mutual_scalar_from_bytes, linear::ConciseDLEq},
|
|
||||||
tests::cross_group::{transcript, generators}
|
|
||||||
};
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn test_linear_concise_cross_group_dleq() {
|
|
||||||
let generators = generators();
|
|
||||||
|
|
||||||
for i in 0 .. 1 {
|
|
||||||
let (proof, keys) = if i == 0 {
|
|
||||||
let mut seed = [0; 32];
|
|
||||||
OsRng.fill_bytes(&mut seed);
|
|
||||||
|
|
||||||
ConciseDLEq::prove(
|
|
||||||
&mut OsRng,
|
|
||||||
&mut transcript(),
|
|
||||||
generators,
|
|
||||||
Blake2b512::new().chain_update(seed)
|
|
||||||
)
|
|
||||||
} else {
|
|
||||||
let mut key;
|
|
||||||
let mut res;
|
|
||||||
while {
|
|
||||||
key = Scalar::random(&mut OsRng);
|
|
||||||
res = ConciseDLEq::prove_without_bias(
|
|
||||||
&mut OsRng,
|
|
||||||
&mut transcript(),
|
|
||||||
generators,
|
|
||||||
key
|
|
||||||
);
|
|
||||||
res.is_none()
|
|
||||||
} {}
|
|
||||||
let res = res.unwrap();
|
|
||||||
assert_eq!(key, res.1.0);
|
|
||||||
res
|
|
||||||
};
|
|
||||||
|
|
||||||
let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
assert_eq!(generators.0.primary * keys.0, public_keys.0);
|
|
||||||
assert_eq!(generators.1.primary * keys.1, public_keys.1);
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
{
|
|
||||||
let mut buf = vec![];
|
|
||||||
proof.serialize(&mut buf).unwrap();
|
|
||||||
let deserialized = ConciseDLEq::<ProjectivePoint, EdwardsPoint>::deserialize(
|
|
||||||
&mut std::io::Cursor::new(&buf)
|
|
||||||
).unwrap();
|
|
||||||
assert_eq!(proof, deserialized);
|
|
||||||
deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn test_remainder() {
|
|
||||||
// Uses Secp256k1 for both to achieve an odd capacity of 255
|
|
||||||
assert_eq!(Scalar::CAPACITY, 255);
|
|
||||||
let generators = (generators().0, generators().0);
|
|
||||||
let keys = mutual_scalar_from_bytes(&[0xFF; 32]);
|
|
||||||
assert_eq!(keys.0, keys.1);
|
|
||||||
|
|
||||||
let (proof, res) = ConciseDLEq::prove_without_bias(
|
|
||||||
&mut OsRng,
|
|
||||||
&mut transcript(),
|
|
||||||
generators,
|
|
||||||
keys.0
|
|
||||||
).unwrap();
|
|
||||||
assert_eq!(keys, res);
|
|
||||||
|
|
||||||
let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
assert_eq!(generators.0.primary * keys.0, public_keys.0);
|
|
||||||
assert_eq!(generators.1.primary * keys.1, public_keys.1);
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
{
|
|
||||||
let mut buf = vec![];
|
|
||||||
proof.serialize(&mut buf).unwrap();
|
|
||||||
let deserialized = ConciseDLEq::<ProjectivePoint, ProjectivePoint>::deserialize(
|
|
||||||
&mut std::io::Cursor::new(&buf)
|
|
||||||
).unwrap();
|
|
||||||
assert_eq!(proof, deserialized);
|
|
||||||
deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
}
|
|
||||||
}
|
|
|
@ -1,66 +0,0 @@
|
||||||
use rand_core::{RngCore, OsRng};
|
|
||||||
|
|
||||||
use ff::Field;
|
|
||||||
|
|
||||||
use k256::Scalar;
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use k256::ProjectivePoint;
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
use dalek_ff_group::EdwardsPoint;
|
|
||||||
|
|
||||||
use blake2::{Digest, Blake2b512};
|
|
||||||
|
|
||||||
use crate::{
|
|
||||||
cross_group::linear::EfficientDLEq,
|
|
||||||
tests::cross_group::{transcript, generators}
|
|
||||||
};
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn test_linear_efficient_cross_group_dleq() {
|
|
||||||
let generators = generators();
|
|
||||||
|
|
||||||
for i in 0 .. 1 {
|
|
||||||
let (proof, keys) = if i == 0 {
|
|
||||||
let mut seed = [0; 32];
|
|
||||||
OsRng.fill_bytes(&mut seed);
|
|
||||||
|
|
||||||
EfficientDLEq::prove(
|
|
||||||
&mut OsRng,
|
|
||||||
&mut transcript(),
|
|
||||||
generators,
|
|
||||||
Blake2b512::new().chain_update(seed)
|
|
||||||
)
|
|
||||||
} else {
|
|
||||||
let mut key;
|
|
||||||
let mut res;
|
|
||||||
while {
|
|
||||||
key = Scalar::random(&mut OsRng);
|
|
||||||
res = EfficientDLEq::prove_without_bias(
|
|
||||||
&mut OsRng,
|
|
||||||
&mut transcript(),
|
|
||||||
generators,
|
|
||||||
key
|
|
||||||
);
|
|
||||||
res.is_none()
|
|
||||||
} {}
|
|
||||||
let res = res.unwrap();
|
|
||||||
assert_eq!(key, res.1.0);
|
|
||||||
res
|
|
||||||
};
|
|
||||||
|
|
||||||
let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
assert_eq!(generators.0.primary * keys.0, public_keys.0);
|
|
||||||
assert_eq!(generators.1.primary * keys.1, public_keys.1);
|
|
||||||
|
|
||||||
#[cfg(feature = "serialize")]
|
|
||||||
{
|
|
||||||
let mut buf = vec![];
|
|
||||||
proof.serialize(&mut buf).unwrap();
|
|
||||||
let deserialized = EfficientDLEq::<ProjectivePoint, EdwardsPoint>::deserialize(
|
|
||||||
&mut std::io::Cursor::new(&buf)
|
|
||||||
).unwrap();
|
|
||||||
assert_eq!(proof, deserialized);
|
|
||||||
deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
|
@ -1,2 +0,0 @@
|
||||||
mod concise;
|
|
||||||
mod efficient;
|
|
|
@ -1,26 +1,33 @@
|
||||||
mod scalar;
|
|
||||||
mod schnorr;
|
|
||||||
|
|
||||||
use hex_literal::hex;
|
use hex_literal::hex;
|
||||||
use rand_core::OsRng;
|
use rand_core::{RngCore, OsRng};
|
||||||
|
|
||||||
use ff::{Field, PrimeField};
|
use ff::{Field, PrimeField};
|
||||||
use group::{Group, GroupEncoding};
|
use group::{Group, GroupEncoding};
|
||||||
|
|
||||||
|
use blake2::{Digest, Blake2b512};
|
||||||
|
|
||||||
use k256::{Scalar, ProjectivePoint};
|
use k256::{Scalar, ProjectivePoint};
|
||||||
use dalek_ff_group::{self as dfg, EdwardsPoint, CompressedEdwardsY};
|
use dalek_ff_group::{self as dfg, EdwardsPoint, CompressedEdwardsY};
|
||||||
|
|
||||||
use transcript::RecommendedTranscript;
|
use transcript::RecommendedTranscript;
|
||||||
|
|
||||||
use crate::{Generators, cross_group::linear::EfficientDLEq};
|
use crate::{
|
||||||
|
Generators,
|
||||||
|
cross_group::{scalar::mutual_scalar_from_bytes, EfficientLinearDLEq, ConciseLinearDLEq}
|
||||||
|
};
|
||||||
|
|
||||||
mod linear;
|
mod scalar;
|
||||||
|
mod schnorr;
|
||||||
|
mod aos;
|
||||||
|
|
||||||
|
type G0 = ProjectivePoint;
|
||||||
|
type G1 = EdwardsPoint;
|
||||||
|
|
||||||
pub(crate) fn transcript() -> RecommendedTranscript {
|
pub(crate) fn transcript() -> RecommendedTranscript {
|
||||||
RecommendedTranscript::new(b"Cross-Group DLEq Proof Test")
|
RecommendedTranscript::new(b"Cross-Group DLEq Proof Test")
|
||||||
}
|
}
|
||||||
|
|
||||||
pub(crate) fn generators() -> (Generators<ProjectivePoint>, Generators<EdwardsPoint>) {
|
pub(crate) fn generators() -> (Generators<G0>, Generators<G1>) {
|
||||||
(
|
(
|
||||||
Generators::new(
|
Generators::new(
|
||||||
ProjectivePoint::GENERATOR,
|
ProjectivePoint::GENERATOR,
|
||||||
|
@ -38,6 +45,66 @@ pub(crate) fn generators() -> (Generators<ProjectivePoint>, Generators<EdwardsPo
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
macro_rules! verify_and_deserialize {
|
||||||
|
($type: ident, $proof: ident, $generators: ident, $keys: ident) => {
|
||||||
|
let public_keys = $proof.verify(&mut OsRng, &mut transcript(), $generators).unwrap();
|
||||||
|
assert_eq!($generators.0.primary * $keys.0, public_keys.0);
|
||||||
|
assert_eq!($generators.1.primary * $keys.1, public_keys.1);
|
||||||
|
|
||||||
|
#[cfg(feature = "serialize")]
|
||||||
|
{
|
||||||
|
let mut buf = vec![];
|
||||||
|
$proof.serialize(&mut buf).unwrap();
|
||||||
|
let deserialized = $type::<G0, G1>::deserialize(&mut std::io::Cursor::new(&buf)).unwrap();
|
||||||
|
assert_eq!(proof, deserialized);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! test_dleq {
|
||||||
|
($name: ident, $type: ident) => {
|
||||||
|
#[test]
|
||||||
|
fn $name() {
|
||||||
|
let generators = generators();
|
||||||
|
|
||||||
|
for i in 0 .. 1 {
|
||||||
|
let (proof, keys) = if i == 0 {
|
||||||
|
let mut seed = [0; 32];
|
||||||
|
OsRng.fill_bytes(&mut seed);
|
||||||
|
|
||||||
|
$type::prove(
|
||||||
|
&mut OsRng,
|
||||||
|
&mut transcript(),
|
||||||
|
generators,
|
||||||
|
Blake2b512::new().chain_update(seed)
|
||||||
|
)
|
||||||
|
} else {
|
||||||
|
let mut key;
|
||||||
|
let mut res;
|
||||||
|
while {
|
||||||
|
key = Scalar::random(&mut OsRng);
|
||||||
|
res = $type::prove_without_bias(
|
||||||
|
&mut OsRng,
|
||||||
|
&mut transcript(),
|
||||||
|
generators,
|
||||||
|
key
|
||||||
|
);
|
||||||
|
res.is_none()
|
||||||
|
} {}
|
||||||
|
let res = res.unwrap();
|
||||||
|
assert_eq!(key, res.1.0);
|
||||||
|
res
|
||||||
|
};
|
||||||
|
|
||||||
|
verify_and_deserialize!($type, proof, generators, keys);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_dleq!(test_efficient_linear_dleq, EfficientLinearDLEq);
|
||||||
|
test_dleq!(test_concise_linear_dleq, ConciseLinearDLEq);
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn test_rejection_sampling() {
|
fn test_rejection_sampling() {
|
||||||
let mut pow_2 = Scalar::one();
|
let mut pow_2 = Scalar::one();
|
||||||
|
@ -46,7 +113,8 @@ fn test_rejection_sampling() {
|
||||||
}
|
}
|
||||||
|
|
||||||
assert!(
|
assert!(
|
||||||
EfficientDLEq::prove_without_bias(
|
// Either would work
|
||||||
|
EfficientLinearDLEq::prove_without_bias(
|
||||||
&mut OsRng,
|
&mut OsRng,
|
||||||
&mut RecommendedTranscript::new(b""),
|
&mut RecommendedTranscript::new(b""),
|
||||||
generators(),
|
generators(),
|
||||||
|
@ -54,3 +122,24 @@ fn test_rejection_sampling() {
|
||||||
).is_none()
|
).is_none()
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_remainder() {
|
||||||
|
// Uses Secp256k1 for both to achieve an odd capacity of 255
|
||||||
|
assert_eq!(Scalar::CAPACITY, 255);
|
||||||
|
let generators = (generators().0, generators().0);
|
||||||
|
// This will ignore any unused bits, ensuring every remaining one is set
|
||||||
|
let keys = mutual_scalar_from_bytes(&[0xFF; 32]);
|
||||||
|
assert_eq!(keys.0 + Scalar::one(), Scalar::from(2u64).pow_vartime(&[255]));
|
||||||
|
assert_eq!(keys.0, keys.1);
|
||||||
|
|
||||||
|
let (proof, res) = ConciseLinearDLEq::prove_without_bias(
|
||||||
|
&mut OsRng,
|
||||||
|
&mut transcript(),
|
||||||
|
generators,
|
||||||
|
keys.0
|
||||||
|
).unwrap();
|
||||||
|
assert_eq!(keys, res);
|
||||||
|
|
||||||
|
verify_and_deserialize!(ConciseLinearDLEq, proof, generators, keys);
|
||||||
|
}
|
||||||
|
|
|
@ -1,23 +1,30 @@
|
||||||
use rand_core::OsRng;
|
use rand_core::OsRng;
|
||||||
|
|
||||||
use group::{ff::Field, prime::PrimeGroup};
|
use group::{ff::{Field, PrimeFieldBits}, prime::PrimeGroup};
|
||||||
|
use multiexp::BatchVerifier;
|
||||||
|
|
||||||
use transcript::RecommendedTranscript;
|
use transcript::RecommendedTranscript;
|
||||||
|
|
||||||
use crate::cross_group::schnorr::SchnorrPoK;
|
use crate::cross_group::schnorr::SchnorrPoK;
|
||||||
|
|
||||||
fn test_schnorr<G: PrimeGroup>() {
|
fn test_schnorr<G: PrimeGroup>() where G::Scalar: PrimeFieldBits {
|
||||||
let private = G::Scalar::random(&mut OsRng);
|
let private = G::Scalar::random(&mut OsRng);
|
||||||
|
|
||||||
let transcript = RecommendedTranscript::new(b"Schnorr Test");
|
let transcript = RecommendedTranscript::new(b"Schnorr Test");
|
||||||
assert!(
|
let mut batch = BatchVerifier::new(3);
|
||||||
SchnorrPoK::prove(
|
SchnorrPoK::prove(
|
||||||
&mut OsRng,
|
&mut OsRng,
|
||||||
&mut transcript.clone(),
|
&mut transcript.clone(),
|
||||||
G::generator(),
|
G::generator(),
|
||||||
private
|
private
|
||||||
).verify(&mut transcript.clone(), G::generator(), G::generator() * private)
|
).verify(
|
||||||
|
&mut OsRng,
|
||||||
|
&mut transcript.clone(),
|
||||||
|
G::generator(),
|
||||||
|
G::generator() * private,
|
||||||
|
&mut batch
|
||||||
);
|
);
|
||||||
|
assert!(batch.verify_vartime());
|
||||||
}
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
|
|
Loading…
Reference in a new issue