Merge branch 'develop' into next

This resolves the conflicts and gets the workspace `Cargo.toml`s to not be
invalid. It doesn't actually get clippy to pass again yet.

Does move `crypto/dkg/src/evrf` into a new `crypto/dkg/evrf` crate (which does
not yet compile).

crypto/dkg/evrf/src/tests/mod.rs

@@ -0,0 +1,79 @@
+use std::collections::HashMap;
+
+use zeroize::Zeroizing;
+use rand_core::OsRng;
+use rand::seq::SliceRandom;
+
+use ciphersuite::{group::ff::Field, Ciphersuite};
+
+use crate::{
+  Participant,
+  evrf::*,
+  tests::{THRESHOLD, PARTICIPANTS, recover_key},
+};
+
+mod proof;
+use proof::{Pallas, Vesta};
+
+#[test]
+fn evrf_dkg() {
+  let generators = EvrfGenerators::<Pallas>::new(THRESHOLD, PARTICIPANTS);
+  let context = [0; 32];
+
+  let mut priv_keys = vec![];
+  let mut pub_keys = vec![];
+  for i in 0 .. PARTICIPANTS {
+    let priv_key = <Vesta as Ciphersuite>::F::random(&mut OsRng);
+    pub_keys.push(<Vesta as Ciphersuite>::generator() * priv_key);
+    priv_keys.push((Participant::new(1 + i).unwrap(), Zeroizing::new(priv_key)));
+  }
+
+  let mut participations = HashMap::new();
+  // Shuffle the private keys so we iterate over a random subset of them
+  priv_keys.shuffle(&mut OsRng);
+  for (i, priv_key) in priv_keys.iter().take(usize::from(THRESHOLD)) {
+    participations.insert(
+      *i,
+      EvrfDkg::<Pallas>::participate(
+        &mut OsRng,
+        &generators,
+        context,
+        THRESHOLD,
+        &pub_keys,
+        priv_key,
+      )
+      .unwrap(),
+    );
+  }
+
+  let VerifyResult::Valid(dkg) = EvrfDkg::<Pallas>::verify(
+    &mut OsRng,
+    &generators,
+    context,
+    THRESHOLD,
+    &pub_keys,
+    &participations,
+  )
+  .unwrap() else {
+    panic!("verify didn't return VerifyResult::Valid")
+  };
+
+  let mut group_key = None;
+  let mut verification_shares = None;
+  let mut all_keys = HashMap::new();
+  for (i, priv_key) in priv_keys {
+    let keys = dkg.keys(&priv_key).into_iter().next().unwrap();
+    assert_eq!(keys.params().i(), i);
+    assert_eq!(keys.params().t(), THRESHOLD);
+    assert_eq!(keys.params().n(), PARTICIPANTS);
+    group_key = group_key.or(Some(keys.group_key()));
+    verification_shares = verification_shares.or(Some(keys.verification_shares()));
+    assert_eq!(Some(keys.group_key()), group_key);
+    assert_eq!(Some(keys.verification_shares()), verification_shares);
+
+    all_keys.insert(i, keys);
+  }
+
+  // TODO: Test for all possible combinations of keys
+  assert_eq!(Pallas::generator() * recover_key(&all_keys), group_key.unwrap());
+}

crypto/dkg/evrf/src/tests/proof.rs

@@ -0,0 +1,118 @@
+use std::time::Instant;
+
+use rand_core::OsRng;
+
+use zeroize::{Zeroize, Zeroizing};
+use generic_array::typenum::{Sum, Diff, Quot, U, U1, U2};
+use blake2::{Digest, Blake2b512};
+
+use ciphersuite::{
+  group::{
+    ff::{FromUniformBytes, Field, PrimeField},
+    Group,
+  },
+  Ciphersuite, Secp256k1, Ed25519, Ristretto,
+};
+use pasta_curves::{Ep, Eq, Fp, Fq};
+
+use generalized_bulletproofs::{Generators, tests::generators};
+use generalized_bulletproofs_ec_gadgets::DiscreteLogParameters;
+
+use crate::evrf::proof::*;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) struct Pallas;
+impl Ciphersuite for Pallas {
+  type F = Fq;
+  type G = Ep;
+  type H = Blake2b512;
+  const ID: &'static [u8] = b"Pallas";
+  fn generator() -> Ep {
+    Ep::generator()
+  }
+  fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
+    // This naive concat may be insecure in a real world deployment
+    // This is solely test code so it's fine
+    Self::F::from_uniform_bytes(&Self::H::digest([dst, msg].concat()).into())
+  }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) struct Vesta;
+impl Ciphersuite for Vesta {
+  type F = Fp;
+  type G = Eq;
+  type H = Blake2b512;
+  const ID: &'static [u8] = b"Vesta";
+  fn generator() -> Eq {
+    Eq::generator()
+  }
+  fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
+    // This naive concat may be insecure in a real world deployment
+    // This is solely test code so it's fine
+    Self::F::from_uniform_bytes(&Self::H::digest([dst, msg].concat()).into())
+  }
+}
+
+pub struct VestaParams;
+impl DiscreteLogParameters for VestaParams {
+  type ScalarBits = U<{ <<Vesta as Ciphersuite>::F as PrimeField>::NUM_BITS as usize }>;
+  type XCoefficients = Quot<Sum<Self::ScalarBits, U1>, U2>;
+  type XCoefficientsMinusOne = Diff<Self::XCoefficients, U1>;
+  type YxCoefficients = Diff<Quot<Sum<Sum<Self::ScalarBits, U1>, U1>, U2>, U2>;
+}
+
+impl EvrfCurve for Pallas {
+  type EmbeddedCurve = Vesta;
+  type EmbeddedCurveParameters = VestaParams;
+}
+
+fn evrf_proof_test<C: EvrfCurve>() {
+  let generators = generators(2048);
+  let vesta_private_key = Zeroizing::new(<C::EmbeddedCurve as Ciphersuite>::F::random(&mut OsRng));
+  let ecdh_public_keys = [
+    <C::EmbeddedCurve as Ciphersuite>::G::random(&mut OsRng),
+    <C::EmbeddedCurve as Ciphersuite>::G::random(&mut OsRng),
+  ];
+  let time = Instant::now();
+  let res =
+    Evrf::<C>::prove(&mut OsRng, &generators, [0; 32], 1, &ecdh_public_keys, &vesta_private_key)
+      .unwrap();
+  println!("Proving time: {:?}", time.elapsed());
+
+  let time = Instant::now();
+  let mut verifier = Generators::batch_verifier();
+  Evrf::<C>::verify(
+    &mut OsRng,
+    &generators,
+    &mut verifier,
+    [0; 32],
+    1,
+    &ecdh_public_keys,
+    C::EmbeddedCurve::generator() * *vesta_private_key,
+    &res.proof,
+  )
+  .unwrap();
+  assert!(generators.verify(verifier));
+  println!("Verifying time: {:?}", time.elapsed());
+}
+
+#[test]
+fn pallas_evrf_proof_test() {
+  evrf_proof_test::<Pallas>();
+}
+
+#[test]
+fn secp256k1_evrf_proof_test() {
+  evrf_proof_test::<Secp256k1>();
+}
+
+#[test]
+fn ed25519_evrf_proof_test() {
+  evrf_proof_test::<Ed25519>();
+}
+
+#[test]
+fn ristretto_evrf_proof_test() {
+  evrf_proof_test::<Ristretto>();
+}