Implement eVRF traits, all the way up to the DKG, for secp256k1/ed25519

crypto/evrf/secq256k1/Cargo.toml

@@ -21,15 +21,15 @@ rand_core = { version = "0.6", default-features = false, features = ["std"] }
 zeroize = { version = "^1.5", default-features = false, features = ["std", "zeroize_derive"] }
 subtle = { version = "^2.4", default-features = false, features = ["std"] }
 
-ff = { version = "0.13", default-features = false, features = ["std", "bits"] }
-group = { version = "0.13", default-features = false }
-
 generic-array = { version = "0.14", default-features = false }
 crypto-bigint = { version = "0.5", default-features = false, features = ["zeroize"] }
 
 k256 = { version = "0.13", default-features = false, features = ["arithmetic"] }
 
+blake2 = { version = "0.10", default-features = false, features = ["std"] }
+ciphersuite = { path = "../../ciphersuite", version = "0.4", default-features = false, features = ["std"] }
 ec-divisors = { path = "../divisors" }
+generalized-bulletproofs-ec-gadgets = { path = "../ec-gadgets" }
 
 [dev-dependencies]
 hex = "0.4"

crypto/evrf/secq256k1/src/backend.rs

@@ -90,7 +90,9 @@ macro_rules! field {
 
     use crypto_bigint::{Integer, NonZero, Encoding, impl_modulus};
 
-    use ff::{Field, PrimeField, FieldBits, PrimeFieldBits, helpers::sqrt_ratio_generic};
+    use ciphersuite::group::ff::{
+      Field, PrimeField, FieldBits, PrimeFieldBits, helpers::sqrt_ratio_generic,
+    };
 
     use $crate::backend::u8_from_bool;
 

crypto/evrf/secq256k1/src/lib.rs

@@ -1,6 +1,9 @@
 #![cfg_attr(docsrs, feature(doc_auto_cfg))]
 #![doc = include_str!("../README.md")]
 
+use generic_array::typenum::{Sum, Diff, Quot, U, U1, U2};
+use ciphersuite::group::{ff::PrimeField, Group};
+
 #[macro_use]
 mod backend;
 
@@ -11,3 +14,34 @@ pub use k256::Scalar as FieldElement;
 
 mod point;
 pub use point::Point;
+
+/// Ciphersuite for Secq256k1.
+///
+/// hash_to_F is implemented with a naive concatenation of the dst and data, allowing transposition
+/// between the two. This means `dst: b"abc", data: b"def"`, will produce the same scalar as
+/// `dst: "abcdef", data: b""`. Please use carefully, not letting dsts be substrings of each other.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, zeroize::Zeroize)]
+pub struct Secq256k1;
+impl ciphersuite::Ciphersuite for Secq256k1 {
+  type F = Scalar;
+  type G = Point;
+  type H = blake2::Blake2b512;
+
+  const ID: &'static [u8] = b"secq256k1";
+
+  fn generator() -> Self::G {
+    Point::generator()
+  }
+
+  fn hash_to_F(dst: &[u8], data: &[u8]) -> Self::F {
+    use blake2::Digest;
+    Scalar::wide_reduce(Self::H::digest([dst, data].concat()).as_slice().try_into().unwrap())
+  }
+}
+
+impl generalized_bulletproofs_ec_gadgets::DiscreteLogParameters for Secq256k1 {
+  type ScalarBits = U<{ Scalar::NUM_BITS as usize }>;
+  type XCoefficients = Quot<Sum<Self::ScalarBits, U1>, U2>;
+  type XCoefficientsMinusOne = Diff<Self::XCoefficients, U1>;
+  type YxCoefficients = Diff<Quot<Sum<Self::ScalarBits, U1>, U2>, U2>;
+}

crypto/evrf/secq256k1/src/point.rs

@@ -10,7 +10,7 @@ use subtle::{Choice, CtOption, ConstantTimeEq, ConditionallySelectable, Conditio
 
 use generic_array::{typenum::U33, GenericArray};
 
-use group::{
+use ciphersuite::group::{
   ff::{Field, PrimeField, PrimeFieldBits},
   Group, GroupEncoding,
   prime::PrimeGroup,