From 714ce68deb96cc249121b30993e12cb2d2e75623 Mon Sep 17 00:00:00 2001 From: Luke Parker Date: Tue, 7 Jun 2022 00:02:10 -0400 Subject: [PATCH] Add pippenger under multiexp --- crypto/frost/src/key_gen.rs | 2 +- crypto/frost/src/tests/curve.rs | 18 +++ crypto/multiexp/src/batch.rs | 78 +++++++++++++ crypto/multiexp/src/lib.rs | 189 +++++++------------------------ crypto/multiexp/src/pippenger.rs | 79 +++++++++++++ crypto/multiexp/src/straus.rs | 69 +++++++++++ 6 files changed, 286 insertions(+), 149 deletions(-) create mode 100644 crypto/multiexp/src/batch.rs create mode 100644 crypto/multiexp/src/pippenger.rs create mode 100644 crypto/multiexp/src/straus.rs diff --git a/crypto/frost/src/key_gen.rs b/crypto/frost/src/key_gen.rs index c30962de..8f235b6b 100644 --- a/crypto/frost/src/key_gen.rs +++ b/crypto/frost/src/key_gen.rs @@ -254,7 +254,7 @@ fn complete_r2( // Calculate each user's verification share let mut verification_shares = HashMap::new(); for i in 1 ..= params.n() { - verification_shares.insert(i, multiexp_vartime(exponential(i, &stripes), C::LITTLE_ENDIAN)); + verification_shares.insert(i, multiexp_vartime(&exponential(i, &stripes), C::LITTLE_ENDIAN)); } debug_assert_eq!(C::GENERATOR_TABLE * secret_share, verification_shares[¶ms.i()]); diff --git a/crypto/frost/src/tests/curve.rs b/crypto/frost/src/tests/curve.rs index 33f4f516..eed4e62a 100644 --- a/crypto/frost/src/tests/curve.rs +++ b/crypto/frost/src/tests/curve.rs @@ -1,5 +1,8 @@ use rand_core::{RngCore, CryptoRng}; +use ff::Field; +use group::Group; + use crate::{Curve, MultisigKeys, tests::key_gen}; // Test generation of FROST keys @@ -18,6 +21,21 @@ fn keys_serialization(rng: &mut R) { pub fn test_curve(rng: &mut R) { // TODO: Test the Curve functions themselves + // Test successful multiexp, with enough pairs to trigger its variety of algorithms + // TODO: This should probably be under multiexp + { + let mut pairs = Vec::with_capacity(1000); + let mut sum = C::G::identity(); + for _ in 0 .. 10 { + for _ in 0 .. 100 { + pairs.push((C::F::random(&mut *rng), C::GENERATOR * C::F::random(&mut *rng))); + sum += pairs[pairs.len() - 1].1 * pairs[pairs.len() - 1].0; + } + assert_eq!(multiexp::multiexp(&pairs, C::LITTLE_ENDIAN), sum); + assert_eq!(multiexp::multiexp_vartime(&pairs, C::LITTLE_ENDIAN), sum); + } + } + // Test FROST key generation and serialization of MultisigKeys works as expected key_generation::<_, C>(rng); keys_serialization::<_, C>(rng); diff --git a/crypto/multiexp/src/batch.rs b/crypto/multiexp/src/batch.rs new file mode 100644 index 00000000..6962ea86 --- /dev/null +++ b/crypto/multiexp/src/batch.rs @@ -0,0 +1,78 @@ +use rand_core::{RngCore, CryptoRng}; + +use group::{ff::Field, Group}; + +use crate::{multiexp, multiexp_vartime}; + +#[cfg(feature = "batch")] +pub struct BatchVerifier(Vec<(Id, Vec<(G::Scalar, G)>)>, bool); + +#[cfg(feature = "batch")] +impl BatchVerifier { + pub fn new(capacity: usize, endian: bool) -> BatchVerifier { + BatchVerifier(Vec::with_capacity(capacity), endian) + } + + pub fn queue< + R: RngCore + CryptoRng, + I: IntoIterator + >(&mut self, rng: &mut R, id: Id, pairs: I) { + // Define a unique scalar factor for this set of variables so individual items can't overlap + let u = if self.0.len() == 0 { + G::Scalar::one() + } else { + G::Scalar::random(rng) + }; + self.0.push((id, pairs.into_iter().map(|(scalar, point)| (scalar * u, point)).collect())); + } + + pub fn verify(&self) -> bool { + multiexp( + &self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::>(), + self.1 + ).is_identity().into() + } + + pub fn verify_vartime(&self) -> bool { + multiexp_vartime( + &self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::>(), + self.1 + ).is_identity().into() + } + + // A constant time variant may be beneficial for robust protocols + pub fn blame_vartime(&self) -> Option { + let mut slice = self.0.as_slice(); + while slice.len() > 1 { + let split = slice.len() / 2; + if multiexp_vartime( + &slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::>(), + self.1 + ).is_identity().into() { + slice = &slice[split ..]; + } else { + slice = &slice[.. split]; + } + } + + slice.get(0).filter( + |(_, value)| !bool::from(multiexp_vartime(value, self.1).is_identity()) + ).map(|(id, _)| *id) + } + + pub fn verify_with_vartime_blame(&self) -> Result<(), Id> { + if self.verify() { + Ok(()) + } else { + Err(self.blame_vartime().unwrap()) + } + } + + pub fn verify_vartime_with_vartime_blame(&self) -> Result<(), Id> { + if self.verify_vartime() { + Ok(()) + } else { + Err(self.blame_vartime().unwrap()) + } + } +} diff --git a/crypto/multiexp/src/lib.rs b/crypto/multiexp/src/lib.rs index 0d145f16..51651e64 100644 --- a/crypto/multiexp/src/lib.rs +++ b/crypto/multiexp/src/lib.rs @@ -1,156 +1,49 @@ -use group::{ff::PrimeField, Group}; +use group::Group; + +mod straus; +use straus::*; + +mod pippenger; +use pippenger::*; #[cfg(feature = "batch")] -use group::ff::Field; +mod batch; #[cfg(feature = "batch")] -use rand_core::{RngCore, CryptoRng}; +pub use batch::BatchVerifier; -fn prep< - G: Group, - I: IntoIterator ->(pairs: I, little: bool) -> (Vec>, Vec<[G; 16]>) { - let mut nibbles = vec![]; - let mut tables = vec![]; - for pair in pairs.into_iter() { - let p = nibbles.len(); - nibbles.push(vec![]); - { - let mut repr = pair.0.to_repr(); - let bytes = repr.as_mut(); - if !little { - bytes.reverse(); - } - - nibbles[p].resize(bytes.len() * 2, 0); - for i in 0 .. bytes.len() { - nibbles[p][i * 2] = bytes[i] & 0b1111; - nibbles[p][(i * 2) + 1] = (bytes[i] >> 4) & 0b1111; - } - } - - tables.push([G::identity(); 16]); - let mut accum = G::identity(); - for i in 1 .. 16 { - accum += pair.1; - tables[p][i] = accum; - } - } - - (nibbles, tables) +#[derive(Clone, Copy, PartialEq, Eq, Debug)] +enum Algorithm { + Straus, + Pippenger } -// An implementation of Straus, with a extremely minimal API that lets us add other algorithms in -// the future. Takes in an iterator of scalars and points with a boolean for if the scalars are -// little endian encoded in their Reprs or not -pub fn multiexp< - G: Group, - I: IntoIterator ->(pairs: I, little: bool) -> G { - let (nibbles, tables) = prep(pairs, little); - - let mut res = G::identity(); - for b in (0 .. nibbles[0].len()).rev() { - for _ in 0 .. 4 { - res = res.double(); - } - - for s in 0 .. tables.len() { - res += tables[s][usize::from(nibbles[s][b])]; - } - } - res -} - -pub fn multiexp_vartime< - G: Group, - I: IntoIterator ->(pairs: I, little: bool) -> G { - let (nibbles, tables) = prep(pairs, little); - - let mut res = G::identity(); - for b in (0 .. nibbles[0].len()).rev() { - for _ in 0 .. 4 { - res = res.double(); - } - - for s in 0 .. tables.len() { - if nibbles[s][b] != 0 { - res += tables[s][usize::from(nibbles[s][b])]; - } - } - } - res -} - -#[cfg(feature = "batch")] -pub struct BatchVerifier(Vec<(Id, Vec<(G::Scalar, G)>)>, bool); - -#[cfg(feature = "batch")] -impl BatchVerifier { - pub fn new(capacity: usize, endian: bool) -> BatchVerifier { - BatchVerifier(Vec::with_capacity(capacity), endian) - } - - pub fn queue< - R: RngCore + CryptoRng, - I: IntoIterator - >(&mut self, rng: &mut R, id: Id, pairs: I) { - // Define a unique scalar factor for this set of variables so individual items can't overlap - let u = if self.0.len() == 0 { - G::Scalar::one() - } else { - G::Scalar::random(rng) - }; - self.0.push((id, pairs.into_iter().map(|(scalar, point)| (scalar * u, point)).collect())); - } - - pub fn verify(&self) -> bool { - multiexp( - self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned(), - self.1 - ).is_identity().into() - } - - pub fn verify_vartime(&self) -> bool { - multiexp_vartime( - self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned(), - self.1 - ).is_identity().into() - } - - // A constant time variant may be beneficial for robust protocols - pub fn blame_vartime(&self) -> Option { - let mut slice = self.0.as_slice(); - while slice.len() > 1 { - let split = slice.len() / 2; - if multiexp_vartime( - slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned(), - self.1 - ).is_identity().into() { - slice = &slice[split ..]; - } else { - slice = &slice[.. split]; - } - } - - slice.get(0).filter( - |(_, value)| !bool::from(multiexp_vartime(value.clone(), self.1).is_identity()) - ).map(|(id, _)| *id) - } - - pub fn verify_with_vartime_blame(&self) -> Result<(), Id> { - if self.verify() { - Ok(()) - } else { - Err(self.blame_vartime().unwrap()) - } - } - - pub fn verify_vartime_with_vartime_blame(&self) -> Result<(), Id> { - if self.verify_vartime() { - Ok(()) - } else { - Err(self.blame_vartime().unwrap()) - } +fn algorithm(pairs: usize) -> Algorithm { + // TODO: Replace this with an actual formula determining which will use less additions + // Right now, Straus is used until 600, instead of the far more accurate 300, as Pippenger + // operates per byte instead of per nibble, and therefore requires a much longer series to be + // performant + // Technically, 800 is dalek's number for when to use byte Pippenger, yet given Straus's own + // implementation limitations... + if pairs < 600 { + Algorithm::Straus + } else { + Algorithm::Pippenger + } +} + +// Performs a multiexp, automatically selecting the optimal algorithm based on amount of pairs +// Takes in an iterator of scalars and points, with a boolean for if the scalars are little endian +// encoded in their Reprs or not +pub fn multiexp(pairs: &[(G::Scalar, G)], little: bool) -> G { + match algorithm(pairs.len()) { + Algorithm::Straus => straus(pairs, little), + Algorithm::Pippenger => pippenger(pairs, little) + } +} + +pub fn multiexp_vartime(pairs: &[(G::Scalar, G)], little: bool) -> G { + match algorithm(pairs.len()) { + Algorithm::Straus => straus_vartime(pairs, little), + Algorithm::Pippenger => pippenger_vartime(pairs, little) } } diff --git a/crypto/multiexp/src/pippenger.rs b/crypto/multiexp/src/pippenger.rs new file mode 100644 index 00000000..b812c922 --- /dev/null +++ b/crypto/multiexp/src/pippenger.rs @@ -0,0 +1,79 @@ +use group::{ff::PrimeField, Group}; + +fn prep(pairs: &[(G::Scalar, G)], little: bool) -> (Vec>, Vec) { + let mut res = vec![]; + let mut points = vec![]; + for pair in pairs { + let p = res.len(); + res.push(vec![]); + { + let mut repr = pair.0.to_repr(); + let bytes = repr.as_mut(); + if !little { + bytes.reverse(); + } + + res[p].resize(bytes.len(), 0); + for i in 0 .. bytes.len() { + res[p][i] = bytes[i]; + } + } + + points.push(pair.1); + } + + (res, points) +} + +pub(crate) fn pippenger(pairs: &[(G::Scalar, G)], little: bool) -> G { + let (bytes, points) = prep(pairs, little); + + let mut res = G::identity(); + for n in (0 .. bytes[0].len()).rev() { + for _ in 0 .. 8 { + res = res.double(); + } + + let mut buckets = [G::identity(); 256]; + for p in 0 .. bytes.len() { + buckets[usize::from(bytes[p][n])] += points[p]; + } + + let mut intermediate_sum = G::identity(); + for b in (1 .. buckets.len()).rev() { + intermediate_sum += buckets[b]; + res += intermediate_sum; + } + } + + res +} + +pub(crate) fn pippenger_vartime(pairs: &[(G::Scalar, G)], little: bool) -> G { + let (bytes, points) = prep(pairs, little); + + let mut res = G::identity(); + for n in (0 .. bytes[0].len()).rev() { + if n != (bytes[0].len() - 1) { + for _ in 0 .. 8 { + res = res.double(); + } + } + + let mut buckets = [G::identity(); 256]; + for p in 0 .. bytes.len() { + let nibble = usize::from(bytes[p][n]); + if nibble != 0 { + buckets[nibble] += points[p]; + } + } + + let mut intermediate_sum = G::identity(); + for b in (1 .. buckets.len()).rev() { + intermediate_sum += buckets[b]; + res += intermediate_sum; + } + } + + res +} diff --git a/crypto/multiexp/src/straus.rs b/crypto/multiexp/src/straus.rs new file mode 100644 index 00000000..b8660f1b --- /dev/null +++ b/crypto/multiexp/src/straus.rs @@ -0,0 +1,69 @@ +use group::{ff::PrimeField, Group}; + +fn prep(pairs: &[(G::Scalar, G)], little: bool) -> (Vec>, Vec<[G; 16]>) { + let mut nibbles = vec![]; + let mut tables = vec![]; + for pair in pairs { + let p = nibbles.len(); + nibbles.push(vec![]); + { + let mut repr = pair.0.to_repr(); + let bytes = repr.as_mut(); + if !little { + bytes.reverse(); + } + + nibbles[p].resize(bytes.len() * 2, 0); + for i in 0 .. bytes.len() { + nibbles[p][i * 2] = bytes[i] & 0b1111; + nibbles[p][(i * 2) + 1] = (bytes[i] >> 4) & 0b1111; + } + } + + tables.push([G::identity(); 16]); + let mut accum = G::identity(); + for i in 1 .. 16 { + accum += pair.1; + tables[p][i] = accum; + } + } + + (nibbles, tables) +} + +pub(crate) fn straus(pairs: &[(G::Scalar, G)], little: bool) -> G { + let (nibbles, tables) = prep(pairs, little); + + let mut res = G::identity(); + for b in (0 .. nibbles[0].len()).rev() { + for _ in 0 .. 4 { + res = res.double(); + } + + for s in 0 .. tables.len() { + res += tables[s][usize::from(nibbles[s][b])]; + } + } + res +} + +pub(crate) fn straus_vartime(pairs: &[(G::Scalar, G)], little: bool) -> G { + let (nibbles, tables) = prep(pairs, little); + + let mut res = G::identity(); + for b in (0 .. nibbles[0].len()).rev() { + if b != (nibbles[0].len() - 1) { + for _ in 0 .. 4 { + res = res.double(); + } + } + + for s in 0 .. tables.len() { + if nibbles[s][b] != 0 { + res += tables[s][usize::from(nibbles[s][b])]; + } + } + } + + res +}