mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-13 22:49:25 +00:00
Redo the Bulletproofs impl
Uses the IP-impl from the FCMP++ work.
This commit is contained in:
Luke Parker
@@ -1,395 +1,344 @@
|
||||
use std_shims::{vec, vec::Vec, sync::OnceLock};
|
||||
use std_shims::{sync::OnceLock, vec::Vec};
|
||||
|
||||
use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use zeroize::Zeroize;
|
||||
use subtle::{Choice, ConditionallySelectable};
|
||||
|
||||
use curve25519_dalek::{
|
||||
constants::{ED25519_BASEPOINT_POINT, ED25519_BASEPOINT_TABLE},
|
||||
scalar::Scalar,
|
||||
edwards::EdwardsPoint,
|
||||
};
|
||||
use curve25519_dalek::{constants::ED25519_BASEPOINT_POINT, Scalar, EdwardsPoint};
|
||||
|
||||
use monero_generators::{H, Generators};
|
||||
use monero_primitives::{INV_EIGHT, Commitment, keccak256_to_scalar};
|
||||
use monero_generators::{H, Generators, MAX_COMMITMENTS, COMMITMENT_BITS};
|
||||
use monero_primitives::{Commitment, INV_EIGHT, keccak256_to_scalar};
|
||||
use crate::{core::multiexp, scalar_vector::ScalarVector, BulletproofsBatchVerifier};
|
||||
|
||||
use crate::{core::*, ScalarVector, batch_verifier::BulletproofsBatchVerifier};
|
||||
pub(crate) mod inner_product;
|
||||
use inner_product::*;
|
||||
pub(crate) use inner_product::IpProof;
|
||||
|
||||
include!(concat!(env!("OUT_DIR"), "/generators.rs"));
|
||||
|
||||
static TWO_N_CELL: OnceLock<ScalarVector> = OnceLock::new();
|
||||
fn TWO_N() -> &'static ScalarVector {
|
||||
TWO_N_CELL.get_or_init(|| ScalarVector::powers(Scalar::from(2u8), COMMITMENT_BITS))
|
||||
#[derive(Clone, Debug)]
|
||||
pub(crate) struct AggregateRangeStatement<'a> {
|
||||
commitments: &'a [EdwardsPoint],
|
||||
}
|
||||
|
||||
static IP12_CELL: OnceLock<Scalar> = OnceLock::new();
|
||||
fn IP12() -> Scalar {
|
||||
*IP12_CELL.get_or_init(|| ScalarVector(vec![Scalar::ONE; COMMITMENT_BITS]).inner_product(TWO_N()))
|
||||
#[derive(Clone, Debug)]
|
||||
pub(crate) struct AggregateRangeWitness {
|
||||
commitments: Vec<Commitment>,
|
||||
}
|
||||
|
||||
fn MN(outputs: usize) -> (usize, usize, usize) {
|
||||
let mut logM = 0;
|
||||
let mut M;
|
||||
while {
|
||||
M = 1 << logM;
|
||||
(M <= MAX_COMMITMENTS) && (M < outputs)
|
||||
} {
|
||||
logM += 1;
|
||||
}
|
||||
|
||||
(logM + LOG_COMMITMENT_BITS, M, M * COMMITMENT_BITS)
|
||||
}
|
||||
|
||||
fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) {
|
||||
let (_, M, MN) = MN(commitments.len());
|
||||
|
||||
let sv = commitments.iter().map(|c| Scalar::from(c.amount)).collect::<Vec<_>>();
|
||||
let mut aL = ScalarVector::new(MN);
|
||||
let mut aR = ScalarVector::new(MN);
|
||||
|
||||
for j in 0 .. M {
|
||||
for i in (0 .. COMMITMENT_BITS).rev() {
|
||||
let bit =
|
||||
if j < sv.len() { Choice::from((sv[j][i / 8] >> (i % 8)) & 1) } else { Choice::from(0) };
|
||||
aL.0[(j * COMMITMENT_BITS) + i] =
|
||||
Scalar::conditional_select(&Scalar::ZERO, &Scalar::ONE, bit);
|
||||
aR.0[(j * COMMITMENT_BITS) + i] =
|
||||
Scalar::conditional_select(&-Scalar::ONE, &Scalar::ZERO, bit);
|
||||
}
|
||||
}
|
||||
|
||||
(aL, aR)
|
||||
}
|
||||
|
||||
fn hash_commitments<C: IntoIterator<Item = EdwardsPoint>>(
|
||||
commitments: C,
|
||||
) -> (Scalar, Vec<EdwardsPoint>) {
|
||||
let V = commitments.into_iter().map(|c| c * INV_EIGHT()).collect::<Vec<_>>();
|
||||
(keccak256_to_scalar(V.iter().flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>()), V)
|
||||
}
|
||||
|
||||
fn alpha_rho<R: RngCore + CryptoRng>(
|
||||
rng: &mut R,
|
||||
generators: &Generators,
|
||||
aL: &ScalarVector,
|
||||
aR: &ScalarVector,
|
||||
) -> (Scalar, EdwardsPoint) {
|
||||
fn vector_exponent(generators: &Generators, a: &ScalarVector, b: &ScalarVector) -> EdwardsPoint {
|
||||
debug_assert_eq!(a.len(), b.len());
|
||||
(a * &generators.G[.. a.len()]) + (b * &generators.H[.. b.len()])
|
||||
}
|
||||
|
||||
let ar = Scalar::random(rng);
|
||||
(ar, (vector_exponent(generators, aL, aR) + (ED25519_BASEPOINT_TABLE * &ar)) * INV_EIGHT())
|
||||
}
|
||||
|
||||
fn LR_statements(
|
||||
a: &ScalarVector,
|
||||
G_i: &[EdwardsPoint],
|
||||
b: &ScalarVector,
|
||||
H_i: &[EdwardsPoint],
|
||||
cL: Scalar,
|
||||
U: EdwardsPoint,
|
||||
) -> Vec<(Scalar, EdwardsPoint)> {
|
||||
let mut res = a
|
||||
.0
|
||||
.iter()
|
||||
.copied()
|
||||
.zip(G_i.iter().copied())
|
||||
.chain(b.0.iter().copied().zip(H_i.iter().copied()))
|
||||
.collect::<Vec<_>>();
|
||||
res.push((cL, U));
|
||||
res
|
||||
}
|
||||
|
||||
fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar {
|
||||
let slice =
|
||||
&[cache.to_bytes().as_ref(), mash.iter().copied().flatten().collect::<Vec<_>>().as_ref()]
|
||||
.concat();
|
||||
*cache = keccak256_to_scalar(slice);
|
||||
*cache
|
||||
}
|
||||
|
||||
fn hadamard_fold(
|
||||
l: &[EdwardsPoint],
|
||||
r: &[EdwardsPoint],
|
||||
a: Scalar,
|
||||
b: Scalar,
|
||||
) -> Vec<EdwardsPoint> {
|
||||
let mut res = Vec::with_capacity(l.len() / 2);
|
||||
for i in 0 .. l.len() {
|
||||
res.push(multiexp(&[(a, l[i]), (b, r[i])]));
|
||||
}
|
||||
res
|
||||
}
|
||||
|
||||
/// Internal structure representing a Bulletproof, as defined by Monero..
|
||||
#[doc(hidden)]
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct OriginalStruct {
|
||||
#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
|
||||
pub struct AggregateRangeProof {
|
||||
pub(crate) A: EdwardsPoint,
|
||||
pub(crate) S: EdwardsPoint,
|
||||
pub(crate) T1: EdwardsPoint,
|
||||
pub(crate) T2: EdwardsPoint,
|
||||
pub(crate) tau_x: Scalar,
|
||||
pub(crate) mu: Scalar,
|
||||
pub(crate) L: Vec<EdwardsPoint>,
|
||||
pub(crate) R: Vec<EdwardsPoint>,
|
||||
pub(crate) a: Scalar,
|
||||
pub(crate) b: Scalar,
|
||||
pub(crate) t: Scalar,
|
||||
pub(crate) t_hat: Scalar,
|
||||
pub(crate) ip: IpProof,
|
||||
}
|
||||
|
||||
impl OriginalStruct {
|
||||
pub(crate) fn prove<R: RngCore + CryptoRng>(
|
||||
rng: &mut R,
|
||||
commitments: &[Commitment],
|
||||
) -> OriginalStruct {
|
||||
let (logMN, M, MN) = MN(commitments.len());
|
||||
|
||||
let (aL, aR) = bit_decompose(commitments);
|
||||
let commitments_points = commitments.iter().map(Commitment::calculate).collect::<Vec<_>>();
|
||||
let (mut cache, _) = hash_commitments(commitments_points.clone());
|
||||
|
||||
let (sL, sR) =
|
||||
ScalarVector((0 .. (MN * 2)).map(|_| Scalar::random(&mut *rng)).collect::<Vec<_>>()).split();
|
||||
|
||||
let generators = GENERATORS();
|
||||
let (mut alpha, A) = alpha_rho(&mut *rng, generators, &aL, &aR);
|
||||
let (mut rho, S) = alpha_rho(&mut *rng, generators, &sL, &sR);
|
||||
|
||||
let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]);
|
||||
let mut cache = keccak256_to_scalar(y.to_bytes());
|
||||
let z = cache;
|
||||
|
||||
let l0 = aL - z;
|
||||
let l1 = sL;
|
||||
|
||||
let mut zero_twos = Vec::with_capacity(MN);
|
||||
let zpow = ScalarVector::powers(z, M + 2);
|
||||
for j in 0 .. M {
|
||||
for i in 0 .. COMMITMENT_BITS {
|
||||
zero_twos.push(zpow[j + 2] * TWO_N()[i]);
|
||||
}
|
||||
impl<'a> AggregateRangeStatement<'a> {
|
||||
pub(crate) fn new(commitments: &'a [EdwardsPoint]) -> Option<Self> {
|
||||
if commitments.is_empty() || (commitments.len() > MAX_COMMITMENTS) {
|
||||
None?;
|
||||
}
|
||||
Some(Self { commitments })
|
||||
}
|
||||
}
|
||||
|
||||
let yMN = ScalarVector::powers(y, MN);
|
||||
let r0 = ((aR + z) * &yMN) + &ScalarVector(zero_twos);
|
||||
let r1 = yMN * &sR;
|
||||
impl AggregateRangeWitness {
|
||||
pub(crate) fn new(commitments: Vec<Commitment>) -> Option<Self> {
|
||||
if commitments.is_empty() || (commitments.len() > MAX_COMMITMENTS) {
|
||||
None?;
|
||||
}
|
||||
Some(Self { commitments })
|
||||
}
|
||||
}
|
||||
|
||||
let (T1, T2, x, mut tau_x) = {
|
||||
let t1 = l0.clone().inner_product(&r1) + r0.clone().inner_product(&l1);
|
||||
let t2 = l1.clone().inner_product(&r1);
|
||||
impl<'a> AggregateRangeStatement<'a> {
|
||||
fn initial_transcript(&self) -> (Scalar, Vec<EdwardsPoint>) {
|
||||
let V = self.commitments.iter().map(|c| c * INV_EIGHT()).collect::<Vec<_>>();
|
||||
(keccak256_to_scalar(V.iter().flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>()), V)
|
||||
}
|
||||
|
||||
let mut tau1 = Scalar::random(&mut *rng);
|
||||
let mut tau2 = Scalar::random(&mut *rng);
|
||||
fn transcript_A_S(transcript: Scalar, A: EdwardsPoint, S: EdwardsPoint) -> (Scalar, Scalar) {
|
||||
let mut buf = Vec::with_capacity(96);
|
||||
buf.extend(transcript.to_bytes());
|
||||
buf.extend(A.compress().to_bytes());
|
||||
buf.extend(S.compress().to_bytes());
|
||||
let y = keccak256_to_scalar(buf);
|
||||
let z = keccak256_to_scalar(y.to_bytes());
|
||||
(y, z)
|
||||
}
|
||||
|
||||
let T1 = multiexp(&[(t1, H()), (tau1, ED25519_BASEPOINT_POINT)]) * INV_EIGHT();
|
||||
let T2 = multiexp(&[(t2, H()), (tau2, ED25519_BASEPOINT_POINT)]) * INV_EIGHT();
|
||||
fn transcript_T12(transcript: Scalar, T1: EdwardsPoint, T2: EdwardsPoint) -> Scalar {
|
||||
let mut buf = Vec::with_capacity(128);
|
||||
buf.extend(transcript.to_bytes());
|
||||
buf.extend(transcript.to_bytes());
|
||||
buf.extend(T1.compress().to_bytes());
|
||||
buf.extend(T2.compress().to_bytes());
|
||||
keccak256_to_scalar(buf)
|
||||
}
|
||||
|
||||
let x =
|
||||
hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]);
|
||||
fn transcript_tau_x_mu_t_hat(
|
||||
transcript: Scalar,
|
||||
tau_x: Scalar,
|
||||
mu: Scalar,
|
||||
t_hat: Scalar,
|
||||
) -> Scalar {
|
||||
let mut buf = Vec::with_capacity(128);
|
||||
buf.extend(transcript.to_bytes());
|
||||
buf.extend(transcript.to_bytes());
|
||||
buf.extend(tau_x.to_bytes());
|
||||
buf.extend(mu.to_bytes());
|
||||
buf.extend(t_hat.to_bytes());
|
||||
keccak256_to_scalar(buf)
|
||||
}
|
||||
|
||||
let tau_x = (tau2 * (x * x)) + (tau1 * x);
|
||||
|
||||
tau1.zeroize();
|
||||
tau2.zeroize();
|
||||
(T1, T2, x, tau_x)
|
||||
#[allow(clippy::needless_pass_by_value)]
|
||||
pub(crate) fn prove(
|
||||
self,
|
||||
rng: &mut (impl RngCore + CryptoRng),
|
||||
witness: AggregateRangeWitness,
|
||||
) -> Option<AggregateRangeProof> {
|
||||
if self.commitments != witness.commitments.iter().map(Commitment::calculate).collect::<Vec<_>>()
|
||||
{
|
||||
None?
|
||||
};
|
||||
|
||||
let mu = (x * rho) + alpha;
|
||||
alpha.zeroize();
|
||||
rho.zeroize();
|
||||
let generators = GENERATORS();
|
||||
|
||||
for (i, gamma) in commitments.iter().map(|c| c.mask).enumerate() {
|
||||
tau_x += zpow[i + 2] * gamma;
|
||||
let (mut transcript, _) = self.initial_transcript();
|
||||
|
||||
// Find out the padded amount of commitments
|
||||
let mut padded_pow_of_2 = 1;
|
||||
while padded_pow_of_2 < witness.commitments.len() {
|
||||
padded_pow_of_2 <<= 1;
|
||||
}
|
||||
|
||||
let l = l0 + &(l1 * x);
|
||||
let r = r0 + &(r1 * x);
|
||||
|
||||
let t = l.clone().inner_product(&r);
|
||||
|
||||
let x_ip =
|
||||
hash_cache(&mut cache, &[x.to_bytes(), tau_x.to_bytes(), mu.to_bytes(), t.to_bytes()]);
|
||||
|
||||
let mut a = l;
|
||||
let mut b = r;
|
||||
|
||||
let yinv = y.invert();
|
||||
let yinvpow = ScalarVector::powers(yinv, MN);
|
||||
|
||||
let mut G_proof = generators.G[.. a.len()].to_vec();
|
||||
let mut H_proof = generators.H[.. a.len()].to_vec();
|
||||
H_proof.iter_mut().zip(yinvpow.0.iter()).for_each(|(this_H, yinvpow)| *this_H *= yinvpow);
|
||||
let U = H() * x_ip;
|
||||
|
||||
let mut L = Vec::with_capacity(logMN);
|
||||
let mut R = Vec::with_capacity(logMN);
|
||||
|
||||
while a.len() != 1 {
|
||||
let (aL, aR) = a.split();
|
||||
let (bL, bR) = b.split();
|
||||
|
||||
let cL = aL.clone().inner_product(&bR);
|
||||
let cR = aR.clone().inner_product(&bL);
|
||||
|
||||
let (G_L, G_R) = G_proof.split_at(aL.len());
|
||||
let (H_L, H_R) = H_proof.split_at(aL.len());
|
||||
|
||||
let L_i = multiexp(&LR_statements(&aL, G_R, &bR, H_L, cL, U)) * INV_EIGHT();
|
||||
let R_i = multiexp(&LR_statements(&aR, G_L, &bL, H_R, cR, U)) * INV_EIGHT();
|
||||
L.push(L_i);
|
||||
R.push(R_i);
|
||||
|
||||
let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]);
|
||||
let w_inv = w.invert();
|
||||
|
||||
a = (aL * w) + &(aR * w_inv);
|
||||
b = (bL * w_inv) + &(bR * w);
|
||||
|
||||
if a.len() != 1 {
|
||||
G_proof = hadamard_fold(G_L, G_R, w_inv, w);
|
||||
H_proof = hadamard_fold(H_L, H_R, w, w_inv);
|
||||
let mut aL = ScalarVector::new(padded_pow_of_2 * COMMITMENT_BITS);
|
||||
for (i, commitment) in witness.commitments.iter().enumerate() {
|
||||
let mut amount = commitment.amount;
|
||||
for j in 0 .. COMMITMENT_BITS {
|
||||
aL[(i * COMMITMENT_BITS) + j] = Scalar::from(amount & 1);
|
||||
amount >>= 1;
|
||||
}
|
||||
}
|
||||
let aR = aL.clone() - Scalar::ONE;
|
||||
|
||||
let res = OriginalStruct { A, S, T1, T2, tau_x, mu, L, R, a: a[0], b: b[0], t };
|
||||
let alpha = Scalar::random(&mut *rng);
|
||||
|
||||
let A = {
|
||||
let mut terms = Vec::with_capacity(1 + (2 * aL.len()));
|
||||
terms.push((alpha, ED25519_BASEPOINT_POINT));
|
||||
for (aL, G) in aL.0.iter().zip(&generators.G) {
|
||||
terms.push((*aL, *G));
|
||||
}
|
||||
for (aR, H) in aR.0.iter().zip(&generators.H) {
|
||||
terms.push((*aR, *H));
|
||||
}
|
||||
let res = multiexp(&terms) * INV_EIGHT();
|
||||
terms.zeroize();
|
||||
res
|
||||
};
|
||||
|
||||
let mut sL = ScalarVector::new(padded_pow_of_2 * COMMITMENT_BITS);
|
||||
let mut sR = ScalarVector::new(padded_pow_of_2 * COMMITMENT_BITS);
|
||||
for i in 0 .. (padded_pow_of_2 * COMMITMENT_BITS) {
|
||||
sL[i] = Scalar::random(&mut *rng);
|
||||
sR[i] = Scalar::random(&mut *rng);
|
||||
}
|
||||
let rho = Scalar::random(&mut *rng);
|
||||
|
||||
let S = {
|
||||
let mut terms = Vec::with_capacity(1 + (2 * sL.len()));
|
||||
terms.push((rho, ED25519_BASEPOINT_POINT));
|
||||
for (sL, G) in sL.0.iter().zip(&generators.G) {
|
||||
terms.push((*sL, *G));
|
||||
}
|
||||
for (sR, H) in sR.0.iter().zip(&generators.H) {
|
||||
terms.push((*sR, *H));
|
||||
}
|
||||
let res = multiexp(&terms) * INV_EIGHT();
|
||||
terms.zeroize();
|
||||
res
|
||||
};
|
||||
|
||||
let (y, z) = Self::transcript_A_S(transcript, A, S);
|
||||
transcript = z;
|
||||
|
||||
let twos = ScalarVector::powers(Scalar::from(2u8), COMMITMENT_BITS);
|
||||
|
||||
let l = [aL - z, sL];
|
||||
let y_pow_n = ScalarVector::powers(y, aR.len());
|
||||
let mut r = [((aR + z) * &y_pow_n), sR * &y_pow_n];
|
||||
{
|
||||
let mut z_current = z * z;
|
||||
for j in 0 .. padded_pow_of_2 {
|
||||
for i in 0 .. COMMITMENT_BITS {
|
||||
r[0].0[(j * COMMITMENT_BITS) + i] += z_current * twos[i];
|
||||
}
|
||||
z_current *= z;
|
||||
}
|
||||
}
|
||||
let t1 = (l[0].clone().inner_product(&r[1])) + (r[0].clone().inner_product(&l[1]));
|
||||
let t2 = l[1].clone().inner_product(&r[1]);
|
||||
|
||||
let tau_1 = Scalar::random(&mut *rng);
|
||||
let T1 = {
|
||||
let mut T1_terms = [(t1, H()), (tau_1, ED25519_BASEPOINT_POINT)];
|
||||
for term in &mut T1_terms {
|
||||
term.0 *= INV_EIGHT();
|
||||
}
|
||||
let T1 = multiexp(&T1_terms);
|
||||
T1_terms.zeroize();
|
||||
T1
|
||||
};
|
||||
let tau_2 = Scalar::random(&mut *rng);
|
||||
let T2 = {
|
||||
let mut T2_terms = [(t2, H()), (tau_2, ED25519_BASEPOINT_POINT)];
|
||||
for term in &mut T2_terms {
|
||||
term.0 *= INV_EIGHT();
|
||||
}
|
||||
let T2 = multiexp(&T2_terms);
|
||||
T2_terms.zeroize();
|
||||
T2
|
||||
};
|
||||
|
||||
transcript = Self::transcript_T12(transcript, T1, T2);
|
||||
let x = transcript;
|
||||
|
||||
let [l0, l1] = l;
|
||||
let l = l0 + &(l1 * x);
|
||||
let [r0, r1] = r;
|
||||
let r = r0 + &(r1 * x);
|
||||
let t_hat = l.clone().inner_product(&r);
|
||||
let mut tau_x = ((tau_2 * x) + tau_1) * x;
|
||||
{
|
||||
let mut z_current = z * z;
|
||||
for commitment in &witness.commitments {
|
||||
tau_x += z_current * commitment.mask;
|
||||
z_current *= z;
|
||||
}
|
||||
}
|
||||
let mu = alpha + (rho * x);
|
||||
|
||||
let y_inv_pow_n = ScalarVector::powers(y.invert(), l.len());
|
||||
|
||||
transcript = Self::transcript_tau_x_mu_t_hat(transcript, tau_x, mu, t_hat);
|
||||
let x_ip = transcript;
|
||||
|
||||
let ip = IpStatement::new_without_P_transcript(y_inv_pow_n, x_ip)
|
||||
.prove(transcript, IpWitness::new(l, r).unwrap())
|
||||
.unwrap();
|
||||
|
||||
let res = AggregateRangeProof { A, S, T1, T2, tau_x, mu, t_hat, ip };
|
||||
#[cfg(debug_assertions)]
|
||||
{
|
||||
let mut verifier = BulletproofsBatchVerifier::default();
|
||||
debug_assert!(res.verify(rng, &mut verifier, &commitments_points));
|
||||
debug_assert!(self.verify(rng, &mut verifier, res.clone()));
|
||||
debug_assert!(verifier.verify());
|
||||
}
|
||||
|
||||
res
|
||||
Some(res)
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub(crate) fn verify<R: RngCore + CryptoRng>(
|
||||
&self,
|
||||
rng: &mut R,
|
||||
pub(crate) fn verify(
|
||||
self,
|
||||
rng: &mut (impl RngCore + CryptoRng),
|
||||
verifier: &mut BulletproofsBatchVerifier,
|
||||
commitments: &[EdwardsPoint],
|
||||
mut proof: AggregateRangeProof,
|
||||
) -> bool {
|
||||
// Verify commitments are valid
|
||||
if commitments.is_empty() || (commitments.len() > MAX_COMMITMENTS) {
|
||||
return false;
|
||||
let mut padded_pow_of_2 = 1;
|
||||
while padded_pow_of_2 < self.commitments.len() {
|
||||
padded_pow_of_2 <<= 1;
|
||||
}
|
||||
let ip_rows = padded_pow_of_2 * COMMITMENT_BITS;
|
||||
|
||||
while verifier.0.g_bold.len() < ip_rows {
|
||||
verifier.0.g_bold.push(Scalar::ZERO);
|
||||
verifier.0.h_bold.push(Scalar::ZERO);
|
||||
}
|
||||
|
||||
// Verify L and R are properly sized
|
||||
if self.L.len() != self.R.len() {
|
||||
return false;
|
||||
let (mut transcript, mut commitments) = self.initial_transcript();
|
||||
for commitment in &mut commitments {
|
||||
*commitment = commitment.mul_by_cofactor();
|
||||
}
|
||||
|
||||
let (logMN, M, MN) = MN(commitments.len());
|
||||
if self.L.len() != logMN {
|
||||
return false;
|
||||
}
|
||||
let (y, z) = Self::transcript_A_S(transcript, proof.A, proof.S);
|
||||
transcript = z;
|
||||
transcript = Self::transcript_T12(transcript, proof.T1, proof.T2);
|
||||
let x = transcript;
|
||||
transcript = Self::transcript_tau_x_mu_t_hat(transcript, proof.tau_x, proof.mu, proof.t_hat);
|
||||
let x_ip = transcript;
|
||||
|
||||
// Rebuild all challenges
|
||||
let (mut cache, commitments) = hash_commitments(commitments.iter().copied());
|
||||
let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]);
|
||||
proof.A = proof.A.mul_by_cofactor();
|
||||
proof.S = proof.S.mul_by_cofactor();
|
||||
proof.T1 = proof.T1.mul_by_cofactor();
|
||||
proof.T2 = proof.T2.mul_by_cofactor();
|
||||
|
||||
let z = keccak256_to_scalar(y.to_bytes());
|
||||
cache = z;
|
||||
let y_pow_n = ScalarVector::powers(y, ip_rows);
|
||||
let y_inv_pow_n = ScalarVector::powers(y.invert(), ip_rows);
|
||||
|
||||
let x = hash_cache(
|
||||
&mut cache,
|
||||
&[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()],
|
||||
);
|
||||
let twos = ScalarVector::powers(Scalar::from(2u8), COMMITMENT_BITS);
|
||||
|
||||
let x_ip = hash_cache(
|
||||
&mut cache,
|
||||
&[x.to_bytes(), self.tau_x.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()],
|
||||
);
|
||||
|
||||
let mut w_and_w_inv = Vec::with_capacity(logMN);
|
||||
for (L, R) in self.L.iter().zip(&self.R) {
|
||||
let w = hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()]);
|
||||
let w_inv = w.invert();
|
||||
w_and_w_inv.push((w, w_inv));
|
||||
}
|
||||
|
||||
// Convert the proof from * INV_EIGHT to its actual form
|
||||
let normalize = |point: &EdwardsPoint| point.mul_by_cofactor();
|
||||
|
||||
let L = self.L.iter().map(normalize).collect::<Vec<_>>();
|
||||
let R = self.R.iter().map(normalize).collect::<Vec<_>>();
|
||||
let T1 = normalize(&self.T1);
|
||||
let T2 = normalize(&self.T2);
|
||||
let A = normalize(&self.A);
|
||||
let S = normalize(&self.S);
|
||||
|
||||
let commitments = commitments.iter().map(EdwardsPoint::mul_by_cofactor).collect::<Vec<_>>();
|
||||
|
||||
// Verify it
|
||||
let zpow = ScalarVector::powers(z, M + 3);
|
||||
|
||||
// First multiexp
|
||||
// 65
|
||||
{
|
||||
let verifier_weight = Scalar::random(rng);
|
||||
let weight = Scalar::random(&mut *rng);
|
||||
verifier.0.h += weight * proof.t_hat;
|
||||
verifier.0.g += weight * proof.tau_x;
|
||||
|
||||
let ip1y = ScalarVector::powers(y, M * COMMITMENT_BITS).sum();
|
||||
let mut k = -(zpow[2] * ip1y);
|
||||
for j in 1 ..= M {
|
||||
k -= zpow[j + 2] * IP12();
|
||||
}
|
||||
let y1 = self.t - ((z * ip1y) + k);
|
||||
verifier.0.h -= verifier_weight * y1;
|
||||
// Now that we've accumulated the lhs, negate the weight and accumulate the rhs
|
||||
// These will now sum to 0 if equal
|
||||
let weight = -weight;
|
||||
|
||||
verifier.0.g -= verifier_weight * self.tau_x;
|
||||
verifier.0.h += weight * (z - (z * z)) * y_pow_n.sum();
|
||||
|
||||
for (j, commitment) in commitments.iter().enumerate() {
|
||||
verifier.0.other.push((verifier_weight * zpow[j + 2], *commitment));
|
||||
let mut z_current = z * z;
|
||||
for commitment in &commitments {
|
||||
verifier.0.other.push((weight * z_current, *commitment));
|
||||
z_current *= z;
|
||||
}
|
||||
|
||||
verifier.0.other.push((verifier_weight * x, T1));
|
||||
verifier.0.other.push((verifier_weight * (x * x), T2));
|
||||
let mut z_current = z * z * z;
|
||||
for _ in 0 .. padded_pow_of_2 {
|
||||
verifier.0.h -= weight * z_current * twos.clone().sum();
|
||||
z_current *= z;
|
||||
}
|
||||
verifier.0.other.push((weight * x, proof.T1));
|
||||
verifier.0.other.push((weight * (x * x), proof.T2));
|
||||
}
|
||||
|
||||
// Second multiexp
|
||||
let ip_weight = Scalar::random(&mut *rng);
|
||||
|
||||
// 66
|
||||
verifier.0.other.push((ip_weight, proof.A));
|
||||
verifier.0.other.push((ip_weight * x, proof.S));
|
||||
// TODO: g_sum
|
||||
for i in 0 .. ip_rows {
|
||||
verifier.0.g_bold[i] += ip_weight * -z;
|
||||
}
|
||||
// TODO: h_sum
|
||||
for i in 0 .. ip_rows {
|
||||
verifier.0.h_bold[i] += ip_weight * z;
|
||||
}
|
||||
{
|
||||
let verifier_weight = Scalar::random(rng);
|
||||
let z3 = (self.t - (self.a * self.b)) * x_ip;
|
||||
verifier.0.h += verifier_weight * z3;
|
||||
verifier.0.g -= verifier_weight * self.mu;
|
||||
|
||||
verifier.0.other.push((verifier_weight, A));
|
||||
verifier.0.other.push((verifier_weight * x, S));
|
||||
|
||||
{
|
||||
let ypow = ScalarVector::powers(y, MN);
|
||||
let yinv = y.invert();
|
||||
let yinvpow = ScalarVector::powers(yinv, MN);
|
||||
|
||||
let w_cache = challenge_products(&w_and_w_inv);
|
||||
|
||||
while verifier.0.g_bold.len() < MN {
|
||||
verifier.0.g_bold.push(Scalar::ZERO);
|
||||
let mut z_current = z * z;
|
||||
for j in 0 .. padded_pow_of_2 {
|
||||
for i in 0 .. COMMITMENT_BITS {
|
||||
let full_i = (j * COMMITMENT_BITS) + i;
|
||||
verifier.0.h_bold[full_i] += ip_weight * y_inv_pow_n[full_i] * z_current * twos[i];
|
||||
}
|
||||
while verifier.0.h_bold.len() < MN {
|
||||
verifier.0.h_bold.push(Scalar::ZERO);
|
||||
}
|
||||
|
||||
for i in 0 .. MN {
|
||||
let g = (self.a * w_cache[i]) + z;
|
||||
verifier.0.g_bold[i] -= verifier_weight * g;
|
||||
|
||||
let mut h = self.b * yinvpow[i] * w_cache[(!i) & (MN - 1)];
|
||||
h -= ((zpow[(i / COMMITMENT_BITS) + 2] * TWO_N()[i % COMMITMENT_BITS]) + (z * ypow[i])) *
|
||||
yinvpow[i];
|
||||
verifier.0.h_bold[i] -= verifier_weight * h;
|
||||
}
|
||||
}
|
||||
|
||||
for i in 0 .. logMN {
|
||||
verifier.0.other.push((verifier_weight * (w_and_w_inv[i].0 * w_and_w_inv[i].0), L[i]));
|
||||
verifier.0.other.push((verifier_weight * (w_and_w_inv[i].1 * w_and_w_inv[i].1), R[i]));
|
||||
z_current *= z;
|
||||
}
|
||||
}
|
||||
verifier.0.h += ip_weight * x_ip * proof.t_hat;
|
||||
|
||||
true
|
||||
// 67, 68
|
||||
verifier.0.g += ip_weight * -proof.mu;
|
||||
let res = IpStatement::new_without_P_transcript(y_inv_pow_n, x_ip)
|
||||
.verify(verifier, ip_rows, transcript, ip_weight, proof.ip);
|
||||
res.is_ok()
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user