mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-08 12:19:24 +00:00
Apply an initial set of rustfmt rules
This commit is contained in:
@@ -9,16 +9,15 @@ use ff::{Field, PrimeField, FieldBits, PrimeFieldBits};
|
||||
|
||||
use crate::{choice, constant_time, math_op, math, from_wrapper, from_uint};
|
||||
|
||||
const FIELD_MODULUS: U256 = U256::from_be_hex(
|
||||
"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"
|
||||
);
|
||||
const FIELD_MODULUS: U256 =
|
||||
U256::from_be_hex("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
|
||||
|
||||
#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
|
||||
pub struct FieldElement(U256);
|
||||
|
||||
pub const SQRT_M1: FieldElement = FieldElement(
|
||||
U256::from_be_hex("2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0")
|
||||
);
|
||||
pub const SQRT_M1: FieldElement = FieldElement(U256::from_be_hex(
|
||||
"2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0",
|
||||
));
|
||||
|
||||
constant_time!(FieldElement, U256);
|
||||
math!(
|
||||
@@ -33,7 +32,7 @@ math!(
|
||||
|
||||
let wide = U256::mul_wide(&x, &y);
|
||||
U256::from_le_slice(
|
||||
&U512::from((wide.1, wide.0)).reduce(&WIDE_MODULUS).unwrap().to_le_bytes()[.. 32]
|
||||
&U512::from((wide.1, wide.0)).reduce(&WIDE_MODULUS).unwrap().to_le_bytes()[.. 32],
|
||||
)
|
||||
}
|
||||
);
|
||||
@@ -41,7 +40,9 @@ from_uint!(FieldElement, U256);
|
||||
|
||||
impl Neg for FieldElement {
|
||||
type Output = Self;
|
||||
fn neg(self) -> Self::Output { Self(self.0.neg_mod(&FIELD_MODULUS)) }
|
||||
fn neg(self) -> Self::Output {
|
||||
Self(self.0.neg_mod(&FIELD_MODULUS))
|
||||
}
|
||||
}
|
||||
|
||||
impl Field for FieldElement {
|
||||
@@ -53,17 +54,23 @@ impl Field for FieldElement {
|
||||
let WIDE_MODULUS: U512 = U512::from((U256::ZERO, FIELD_MODULUS));
|
||||
debug_assert_eq!(FIELD_MODULUS.to_le_bytes()[..], WIDE_MODULUS.to_le_bytes()[.. 32]);
|
||||
|
||||
FieldElement(
|
||||
U256::from_le_slice(
|
||||
&U512::from_be_bytes(bytes).reduce(&WIDE_MODULUS).unwrap().to_le_bytes()[.. 32]
|
||||
)
|
||||
)
|
||||
FieldElement(U256::from_le_slice(
|
||||
&U512::from_be_bytes(bytes).reduce(&WIDE_MODULUS).unwrap().to_le_bytes()[.. 32],
|
||||
))
|
||||
}
|
||||
|
||||
fn zero() -> Self { Self(U256::ZERO) }
|
||||
fn one() -> Self { Self(U256::ONE) }
|
||||
fn square(&self) -> Self { *self * self }
|
||||
fn double(&self) -> Self { *self + self }
|
||||
fn zero() -> Self {
|
||||
Self(U256::ZERO)
|
||||
}
|
||||
fn one() -> Self {
|
||||
Self(U256::ONE)
|
||||
}
|
||||
fn square(&self) -> Self {
|
||||
*self * self
|
||||
}
|
||||
fn double(&self) -> Self {
|
||||
*self + self
|
||||
}
|
||||
|
||||
fn invert(&self) -> CtOption<Self> {
|
||||
CtOption::new(self.pow(-FieldElement(U256::from(2u64))), !self.is_zero())
|
||||
@@ -80,9 +87,15 @@ impl Field for FieldElement {
|
||||
CtOption::new(Self::conditional_select(&tv2, &tv1, tv1.square().ct_eq(self)), 1.into())
|
||||
}
|
||||
|
||||
fn is_zero(&self) -> Choice { self.0.ct_eq(&U256::ZERO) }
|
||||
fn cube(&self) -> Self { *self * self * self }
|
||||
fn pow_vartime<S: AsRef<[u64]>>(&self, _exp: S) -> Self { unimplemented!() }
|
||||
fn is_zero(&self) -> Choice {
|
||||
self.0.ct_eq(&U256::ZERO)
|
||||
}
|
||||
fn cube(&self) -> Self {
|
||||
*self * self * self
|
||||
}
|
||||
fn pow_vartime<S: AsRef<[u64]>>(&self, _exp: S) -> Self {
|
||||
unimplemented!()
|
||||
}
|
||||
}
|
||||
|
||||
impl PrimeField for FieldElement {
|
||||
@@ -93,15 +106,21 @@ impl PrimeField for FieldElement {
|
||||
let res = Self(U256::from_le_bytes(bytes));
|
||||
CtOption::new(res, res.0.add_mod(&U256::ZERO, &FIELD_MODULUS).ct_eq(&res.0))
|
||||
}
|
||||
fn to_repr(&self) -> [u8; 32] { self.0.to_le_bytes() }
|
||||
fn to_repr(&self) -> [u8; 32] {
|
||||
self.0.to_le_bytes()
|
||||
}
|
||||
|
||||
const S: u32 = 2;
|
||||
fn is_odd(&self) -> Choice { unimplemented!() }
|
||||
fn multiplicative_generator() -> Self { 2u64.into() }
|
||||
fn is_odd(&self) -> Choice {
|
||||
unimplemented!()
|
||||
}
|
||||
fn multiplicative_generator() -> Self {
|
||||
2u64.into()
|
||||
}
|
||||
fn root_of_unity() -> Self {
|
||||
FieldElement(
|
||||
U256::from_be_hex("2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0")
|
||||
)
|
||||
FieldElement(U256::from_be_hex(
|
||||
"2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0",
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
use core::{
|
||||
ops::{Deref, Add, AddAssign, Sub, SubAssign, Neg, Mul, MulAssign},
|
||||
borrow::Borrow,
|
||||
iter::{Iterator, Sum}
|
||||
iter::{Iterator, Sum},
|
||||
};
|
||||
|
||||
use subtle::{ConstantTimeEq, ConditionallySelectable};
|
||||
@@ -20,15 +20,13 @@ use dalek::{
|
||||
traits::Identity,
|
||||
scalar::Scalar as DScalar,
|
||||
edwards::{
|
||||
EdwardsPoint as DEdwardsPoint,
|
||||
EdwardsBasepointTable as DEdwardsBasepointTable,
|
||||
CompressedEdwardsY as DCompressedEdwards
|
||||
EdwardsPoint as DEdwardsPoint, EdwardsBasepointTable as DEdwardsBasepointTable,
|
||||
CompressedEdwardsY as DCompressedEdwards,
|
||||
},
|
||||
ristretto::{
|
||||
RistrettoPoint as DRistrettoPoint,
|
||||
RistrettoBasepointTable as DRistrettoBasepointTable,
|
||||
CompressedRistretto as DCompressedRistretto
|
||||
}
|
||||
RistrettoPoint as DRistrettoPoint, RistrettoBasepointTable as DRistrettoBasepointTable,
|
||||
CompressedRistretto as DCompressedRistretto,
|
||||
},
|
||||
};
|
||||
|
||||
use ff::{Field, PrimeField, FieldBits, PrimeFieldBits};
|
||||
@@ -64,7 +62,7 @@ macro_rules! deref_borrow {
|
||||
&self.0
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
@@ -72,7 +70,9 @@ macro_rules! deref_borrow {
|
||||
macro_rules! constant_time {
|
||||
($Value: ident, $Inner: ident) => {
|
||||
impl ConstantTimeEq for $Value {
|
||||
fn ct_eq(&self, other: &Self) -> Choice { self.0.ct_eq(&other.0) }
|
||||
fn ct_eq(&self, other: &Self) -> Choice {
|
||||
self.0.ct_eq(&other.0)
|
||||
}
|
||||
}
|
||||
|
||||
impl ConditionallySelectable for $Value {
|
||||
@@ -80,7 +80,7 @@ macro_rules! constant_time {
|
||||
$Value($Inner::conditional_select(&a.0, &b.0, choice))
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
@@ -117,7 +117,7 @@ macro_rules! math_op {
|
||||
self.0 = $function(self.0, other.0);
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
@@ -127,7 +127,7 @@ macro_rules! math {
|
||||
math_op!($Value, $Value, Add, add, AddAssign, add_assign, $add);
|
||||
math_op!($Value, $Value, Sub, sub, SubAssign, sub_assign, $sub);
|
||||
math_op!($Value, $Factor, Mul, mul, MulAssign, mul_assign, $mul);
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
macro_rules! math_neg {
|
||||
@@ -136,9 +136,11 @@ macro_rules! math_neg {
|
||||
|
||||
impl Neg for $Value {
|
||||
type Output = Self;
|
||||
fn neg(self) -> Self::Output { Self(-self.0) }
|
||||
fn neg(self) -> Self::Output {
|
||||
Self(-self.0)
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
@@ -146,9 +148,11 @@ macro_rules! math_neg {
|
||||
macro_rules! from_wrapper {
|
||||
($wrapper: ident, $inner: ident, $uint: ident) => {
|
||||
impl From<$uint> for $wrapper {
|
||||
fn from(a: $uint) -> $wrapper { Self($inner::from(a)) }
|
||||
fn from(a: $uint) -> $wrapper {
|
||||
Self($inner::from(a))
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
@@ -159,7 +163,7 @@ macro_rules! from_uint {
|
||||
from_wrapper!($wrapper, $inner, u16);
|
||||
from_wrapper!($wrapper, $inner, u32);
|
||||
from_wrapper!($wrapper, $inner, u64);
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
/// Wrapper around the dalek Scalar type
|
||||
@@ -191,17 +195,33 @@ impl Field for Scalar {
|
||||
Self(DScalar::from_bytes_mod_order_wide(&r))
|
||||
}
|
||||
|
||||
fn zero() -> Self { Self(DScalar::zero()) }
|
||||
fn one() -> Self { Self(DScalar::one()) }
|
||||
fn square(&self) -> Self { *self * self }
|
||||
fn double(&self) -> Self { *self + self }
|
||||
fn zero() -> Self {
|
||||
Self(DScalar::zero())
|
||||
}
|
||||
fn one() -> Self {
|
||||
Self(DScalar::one())
|
||||
}
|
||||
fn square(&self) -> Self {
|
||||
*self * self
|
||||
}
|
||||
fn double(&self) -> Self {
|
||||
*self + self
|
||||
}
|
||||
fn invert(&self) -> CtOption<Self> {
|
||||
CtOption::new(Self(self.0.invert()), !self.is_zero())
|
||||
}
|
||||
fn sqrt(&self) -> CtOption<Self> { unimplemented!() }
|
||||
fn is_zero(&self) -> Choice { self.0.ct_eq(&DScalar::zero()) }
|
||||
fn cube(&self) -> Self { *self * self * self }
|
||||
fn pow_vartime<S: AsRef<[u64]>>(&self, _exp: S) -> Self { unimplemented!() }
|
||||
fn sqrt(&self) -> CtOption<Self> {
|
||||
unimplemented!()
|
||||
}
|
||||
fn is_zero(&self) -> Choice {
|
||||
self.0.ct_eq(&DScalar::zero())
|
||||
}
|
||||
fn cube(&self) -> Self {
|
||||
*self * self * self
|
||||
}
|
||||
fn pow_vartime<S: AsRef<[u64]>>(&self, _exp: S) -> Self {
|
||||
unimplemented!()
|
||||
}
|
||||
}
|
||||
|
||||
impl PrimeField for Scalar {
|
||||
@@ -213,12 +233,20 @@ impl PrimeField for Scalar {
|
||||
// TODO: This unwrap_or isn't constant time, yet do we have an alternative?
|
||||
CtOption::new(Scalar(scalar.unwrap_or(DScalar::zero())), choice(scalar.is_some()))
|
||||
}
|
||||
fn to_repr(&self) -> [u8; 32] { self.0.to_bytes() }
|
||||
fn to_repr(&self) -> [u8; 32] {
|
||||
self.0.to_bytes()
|
||||
}
|
||||
|
||||
const S: u32 = 2;
|
||||
fn is_odd(&self) -> Choice { unimplemented!() }
|
||||
fn multiplicative_generator() -> Self { 2u64.into() }
|
||||
fn root_of_unity() -> Self { unimplemented!() }
|
||||
fn is_odd(&self) -> Choice {
|
||||
unimplemented!()
|
||||
}
|
||||
fn multiplicative_generator() -> Self {
|
||||
2u64.into()
|
||||
}
|
||||
fn root_of_unity() -> Self {
|
||||
unimplemented!()
|
||||
}
|
||||
}
|
||||
|
||||
impl PrimeFieldBits for Scalar {
|
||||
@@ -260,21 +288,35 @@ macro_rules! dalek_group {
|
||||
pub const $BASEPOINT_POINT: $Point = $Point(constants::$BASEPOINT_POINT);
|
||||
|
||||
impl Sum<$Point> for $Point {
|
||||
fn sum<I: Iterator<Item = $Point>>(iter: I) -> $Point { Self($DPoint::sum(iter)) }
|
||||
fn sum<I: Iterator<Item = $Point>>(iter: I) -> $Point {
|
||||
Self($DPoint::sum(iter))
|
||||
}
|
||||
}
|
||||
impl<'a> Sum<&'a $Point> for $Point {
|
||||
fn sum<I: Iterator<Item = &'a $Point>>(iter: I) -> $Point { Self($DPoint::sum(iter)) }
|
||||
fn sum<I: Iterator<Item = &'a $Point>>(iter: I) -> $Point {
|
||||
Self($DPoint::sum(iter))
|
||||
}
|
||||
}
|
||||
|
||||
impl Group for $Point {
|
||||
type Scalar = Scalar;
|
||||
// Ideally, this would be cryptographically secure, yet that's not a bound on the trait
|
||||
// k256 also does this
|
||||
fn random(rng: impl RngCore) -> Self { &$BASEPOINT_TABLE * Scalar::random(rng) }
|
||||
fn identity() -> Self { Self($DPoint::identity()) }
|
||||
fn generator() -> Self { $BASEPOINT_POINT }
|
||||
fn is_identity(&self) -> Choice { self.0.ct_eq(&$DPoint::identity()) }
|
||||
fn double(&self) -> Self { *self + self }
|
||||
fn random(rng: impl RngCore) -> Self {
|
||||
&$BASEPOINT_TABLE * Scalar::random(rng)
|
||||
}
|
||||
fn identity() -> Self {
|
||||
Self($DPoint::identity())
|
||||
}
|
||||
fn generator() -> Self {
|
||||
$BASEPOINT_POINT
|
||||
}
|
||||
fn is_identity(&self) -> Choice {
|
||||
self.0.ct_eq(&$DPoint::identity())
|
||||
}
|
||||
fn double(&self) -> Self {
|
||||
*self + self
|
||||
}
|
||||
}
|
||||
|
||||
impl GroupEncoding for $Point {
|
||||
@@ -306,7 +348,9 @@ macro_rules! dalek_group {
|
||||
|
||||
impl Mul<Scalar> for &$Table {
|
||||
type Output = $Point;
|
||||
fn mul(self, b: Scalar) -> $Point { $Point(&b.0 * &self.0) }
|
||||
fn mul(self, b: Scalar) -> $Point {
|
||||
$Point(&b.0 * &self.0)
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
@@ -315,12 +359,9 @@ dalek_group!(
|
||||
EdwardsPoint,
|
||||
DEdwardsPoint,
|
||||
|point: DEdwardsPoint| point.is_torsion_free(),
|
||||
|
||||
EdwardsBasepointTable,
|
||||
DEdwardsBasepointTable,
|
||||
|
||||
DCompressedEdwards,
|
||||
|
||||
ED25519_BASEPOINT_POINT,
|
||||
ED25519_BASEPOINT_TABLE
|
||||
);
|
||||
@@ -329,12 +370,9 @@ dalek_group!(
|
||||
RistrettoPoint,
|
||||
DRistrettoPoint,
|
||||
|_| true,
|
||||
|
||||
RistrettoBasepointTable,
|
||||
DRistrettoBasepointTable,
|
||||
|
||||
DCompressedRistretto,
|
||||
|
||||
RISTRETTO_BASEPOINT_POINT,
|
||||
RISTRETTO_BASEPOINT_TABLE
|
||||
);
|
||||
|
||||
@@ -2,12 +2,16 @@ use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use transcript::Transcript;
|
||||
|
||||
use group::{ff::{Field, PrimeFieldBits}, prime::PrimeGroup};
|
||||
use group::{
|
||||
ff::{Field, PrimeFieldBits},
|
||||
prime::PrimeGroup,
|
||||
};
|
||||
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
use crate::cross_group::{
|
||||
Generators, DLEqError, scalar::{scalar_convert, mutual_scalar_from_bytes}
|
||||
Generators, DLEqError,
|
||||
scalar::{scalar_convert, mutual_scalar_from_bytes},
|
||||
};
|
||||
|
||||
#[cfg(feature = "serialize")]
|
||||
@@ -26,7 +30,7 @@ pub(crate) enum Re<G0: PrimeGroup, G1: PrimeGroup> {
|
||||
// present here, which is then hashed for each of the two challenges, remaining unbiased/unique
|
||||
// while maintaining the bandwidth savings, yet also while adding 252 hashes for
|
||||
// Secp256k1/Ed25519
|
||||
e(G0::Scalar)
|
||||
e(G0::Scalar),
|
||||
}
|
||||
|
||||
impl<G0: PrimeGroup, G1: PrimeGroup> Re<G0, G1> {
|
||||
@@ -44,14 +48,14 @@ impl<G0: PrimeGroup, G1: PrimeGroup> Re<G0, G1> {
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub(crate) struct Aos<G0: PrimeGroup, G1: PrimeGroup, const RING_LEN: usize> {
|
||||
Re_0: Re<G0, G1>,
|
||||
s: [(G0::Scalar, G1::Scalar); RING_LEN]
|
||||
s: [(G0::Scalar, G1::Scalar); RING_LEN],
|
||||
}
|
||||
|
||||
impl<
|
||||
G0: PrimeGroup,
|
||||
G1: PrimeGroup,
|
||||
const RING_LEN: usize
|
||||
> Aos<G0, G1, RING_LEN> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||
impl<G0: PrimeGroup, G1: PrimeGroup, const RING_LEN: usize> Aos<G0, G1, RING_LEN>
|
||||
where
|
||||
G0::Scalar: PrimeFieldBits,
|
||||
G1::Scalar: PrimeFieldBits,
|
||||
{
|
||||
#[allow(non_snake_case)]
|
||||
fn nonces<T: Transcript>(mut transcript: T, nonces: (G0, G1)) -> (G0::Scalar, G1::Scalar) {
|
||||
transcript.domain_separate(b"aos_membership_proof");
|
||||
@@ -66,7 +70,7 @@ impl<
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
s: (G0::Scalar, G1::Scalar),
|
||||
A: (G0, G1),
|
||||
e: (G0::Scalar, G1::Scalar)
|
||||
e: (G0::Scalar, G1::Scalar),
|
||||
) -> (G0, G1) {
|
||||
(((generators.0.alt * s.0) - (A.0 * e.0)), ((generators.1.alt * s.1) - (A.1 * e.1)))
|
||||
}
|
||||
@@ -76,7 +80,7 @@ impl<
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
s: (G0::Scalar, G1::Scalar),
|
||||
A: (G0, G1),
|
||||
e: (G0::Scalar, G1::Scalar)
|
||||
e: (G0::Scalar, G1::Scalar),
|
||||
) -> (Vec<(G0::Scalar, G0)>, Vec<(G1::Scalar, G1)>) {
|
||||
(vec![(-s.0, generators.0.alt), (e.0, A.0)], vec![(-s.1, generators.1.alt), (e.1, A.1)])
|
||||
}
|
||||
@@ -87,7 +91,7 @@ impl<
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
s: (G0::Scalar, G1::Scalar),
|
||||
A: (G0, G1),
|
||||
e: (G0::Scalar, G1::Scalar)
|
||||
e: (G0::Scalar, G1::Scalar),
|
||||
) -> (G0::Scalar, G1::Scalar) {
|
||||
Self::nonces(transcript, Self::R(generators, s, A, e))
|
||||
}
|
||||
@@ -100,7 +104,7 @@ impl<
|
||||
ring: &[(G0, G1)],
|
||||
actual: usize,
|
||||
blinding_key: (G0::Scalar, G1::Scalar),
|
||||
mut Re_0: Re<G0, G1>
|
||||
mut Re_0: Re<G0, G1>,
|
||||
) -> Self {
|
||||
// While it is possible to use larger values, it's not efficient to do so
|
||||
// 2 + 2 == 2^2, yet 2 + 2 + 2 < 2^3
|
||||
@@ -119,8 +123,11 @@ impl<
|
||||
let e = Self::nonces(transcript.clone(), R);
|
||||
if i == 0 {
|
||||
match Re_0 {
|
||||
Re::R(ref mut R0_0, ref mut R1_0) => { *R0_0 = R.0; *R1_0 = R.1 },
|
||||
Re::e(ref mut e_0) => *e_0 = e.0
|
||||
Re::R(ref mut R0_0, ref mut R1_0) => {
|
||||
*R0_0 = R.0;
|
||||
*R1_0 = R.1
|
||||
}
|
||||
Re::e(ref mut e_0) => *e_0 = e.0,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -147,7 +154,7 @@ impl<
|
||||
transcript: T,
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
batch: &mut (BatchVerifier<(), G0>, BatchVerifier<(), G1>),
|
||||
ring: &[(G0, G1)]
|
||||
ring: &[(G0, G1)],
|
||||
) -> Result<(), DLEqError> {
|
||||
debug_assert!((RING_LEN == 2) || (RING_LEN == 4));
|
||||
debug_assert_eq!(RING_LEN, ring.len());
|
||||
@@ -160,25 +167,25 @@ impl<
|
||||
e = Self::R_nonces(transcript.clone(), generators, self.s[i], ring[i], e);
|
||||
}
|
||||
|
||||
let mut statements = Self::R_batch(
|
||||
generators,
|
||||
*self.s.last().unwrap(),
|
||||
*ring.last().unwrap(),
|
||||
e
|
||||
);
|
||||
let mut statements =
|
||||
Self::R_batch(generators, *self.s.last().unwrap(), *ring.last().unwrap(), e);
|
||||
statements.0.push((G0::Scalar::one(), R0_0));
|
||||
statements.1.push((G1::Scalar::one(), R1_0));
|
||||
batch.0.queue(&mut *rng, (), statements.0);
|
||||
batch.1.queue(&mut *rng, (), statements.1);
|
||||
},
|
||||
}
|
||||
|
||||
Re::e(e_0) => {
|
||||
let e_0 = (e_0, scalar_convert(e_0).ok_or(DLEqError::InvalidChallenge)?);
|
||||
let mut e = None;
|
||||
for i in 0 .. RING_LEN {
|
||||
e = Some(
|
||||
Self::R_nonces(transcript.clone(), generators, self.s[i], ring[i], e.unwrap_or(e_0))
|
||||
);
|
||||
e = Some(Self::R_nonces(
|
||||
transcript.clone(),
|
||||
generators,
|
||||
self.s[i],
|
||||
ring[i],
|
||||
e.unwrap_or(e_0),
|
||||
));
|
||||
}
|
||||
|
||||
// Will panic if the above loop is never run somehow
|
||||
@@ -199,8 +206,8 @@ impl<
|
||||
Re::R(R0, R1) => {
|
||||
w.write_all(R0.to_bytes().as_ref())?;
|
||||
w.write_all(R1.to_bytes().as_ref())?;
|
||||
},
|
||||
Re::e(e) => w.write_all(e.to_repr().as_ref())?
|
||||
}
|
||||
Re::e(e) => w.write_all(e.to_repr().as_ref())?,
|
||||
}
|
||||
|
||||
for i in 0 .. RING_LEN {
|
||||
@@ -215,8 +222,11 @@ impl<
|
||||
#[cfg(feature = "serialize")]
|
||||
pub(crate) fn deserialize<R: Read>(r: &mut R, mut Re_0: Re<G0, G1>) -> std::io::Result<Self> {
|
||||
match Re_0 {
|
||||
Re::R(ref mut R0, ref mut R1) => { *R0 = read_point(r)?; *R1 = read_point(r)? },
|
||||
Re::e(ref mut e) => *e = read_scalar(r)?
|
||||
Re::R(ref mut R0, ref mut R1) => {
|
||||
*R0 = read_point(r)?;
|
||||
*R1 = read_point(r)?
|
||||
}
|
||||
Re::e(ref mut e) => *e = read_scalar(r)?,
|
||||
}
|
||||
|
||||
let mut s = [(G0::Scalar::zero(), G1::Scalar::zero()); RING_LEN];
|
||||
|
||||
@@ -5,7 +5,10 @@ use transcript::Transcript;
|
||||
use group::{ff::PrimeFieldBits, prime::PrimeGroup};
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
use crate::cross_group::{Generators, DLEqError, aos::{Re, Aos}};
|
||||
use crate::cross_group::{
|
||||
Generators, DLEqError,
|
||||
aos::{Re, Aos},
|
||||
};
|
||||
|
||||
#[cfg(feature = "serialize")]
|
||||
use std::io::{Read, Write};
|
||||
@@ -16,7 +19,7 @@ pub(crate) enum BitSignature {
|
||||
ClassicLinear,
|
||||
ConciseLinear,
|
||||
EfficientLinear,
|
||||
CompromiseLinear
|
||||
CompromiseLinear,
|
||||
}
|
||||
|
||||
impl BitSignature {
|
||||
@@ -25,7 +28,7 @@ impl BitSignature {
|
||||
BitSignature::ClassicLinear => 0,
|
||||
BitSignature::ConciseLinear => 1,
|
||||
BitSignature::EfficientLinear => 2,
|
||||
BitSignature::CompromiseLinear => 3
|
||||
BitSignature::CompromiseLinear => 3,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -35,7 +38,7 @@ impl BitSignature {
|
||||
1 => BitSignature::ConciseLinear,
|
||||
2 => BitSignature::EfficientLinear,
|
||||
3 => BitSignature::CompromiseLinear,
|
||||
_ => panic!("Unknown algorithm")
|
||||
_ => panic!("Unknown algorithm"),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,7 +47,7 @@ impl BitSignature {
|
||||
BitSignature::ClassicLinear => 1,
|
||||
BitSignature::ConciseLinear => 2,
|
||||
BitSignature::EfficientLinear => 1,
|
||||
BitSignature::CompromiseLinear => 2
|
||||
BitSignature::CompromiseLinear => 2,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -57,28 +60,23 @@ impl BitSignature {
|
||||
BitSignature::ClassicLinear => Re::e_default(),
|
||||
BitSignature::ConciseLinear => Re::e_default(),
|
||||
BitSignature::EfficientLinear => Re::R_default(),
|
||||
BitSignature::CompromiseLinear => Re::R_default()
|
||||
BitSignature::CompromiseLinear => Re::R_default(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub(crate) struct Bits<
|
||||
G0: PrimeGroup,
|
||||
G1: PrimeGroup,
|
||||
const SIGNATURE: u8,
|
||||
const RING_LEN: usize
|
||||
> {
|
||||
pub(crate) struct Bits<G0: PrimeGroup, G1: PrimeGroup, const SIGNATURE: u8, const RING_LEN: usize> {
|
||||
pub(crate) commitments: (G0, G1),
|
||||
signature: Aos<G0, G1, RING_LEN>
|
||||
signature: Aos<G0, G1, RING_LEN>,
|
||||
}
|
||||
|
||||
impl<
|
||||
G0: PrimeGroup,
|
||||
G1: PrimeGroup,
|
||||
const SIGNATURE: u8,
|
||||
const RING_LEN: usize
|
||||
> Bits<G0, G1, SIGNATURE, RING_LEN> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||
impl<G0: PrimeGroup, G1: PrimeGroup, const SIGNATURE: u8, const RING_LEN: usize>
|
||||
Bits<G0, G1, SIGNATURE, RING_LEN>
|
||||
where
|
||||
G0::Scalar: PrimeFieldBits,
|
||||
G1::Scalar: PrimeFieldBits,
|
||||
{
|
||||
fn transcript<T: Transcript>(transcript: &mut T, i: usize, commitments: (G0, G1)) {
|
||||
transcript.domain_separate(b"bits");
|
||||
transcript.append_message(b"group", &u16::try_from(i).unwrap().to_le_bytes());
|
||||
@@ -88,7 +86,7 @@ impl<
|
||||
|
||||
fn ring(pow_2: (G0, G1), commitments: (G0, G1)) -> Vec<(G0, G1)> {
|
||||
let mut res = vec![commitments; RING_LEN];
|
||||
for i in 1 .. RING_LEN {
|
||||
for i in 1 .. RING_LEN {
|
||||
res[i] = (res[i - 1].0 - pow_2.0, res[i - 1].1 - pow_2.1);
|
||||
}
|
||||
res
|
||||
@@ -108,12 +106,10 @@ impl<
|
||||
i: usize,
|
||||
pow_2: &mut (G0, G1),
|
||||
bits: u8,
|
||||
blinding_key: (G0::Scalar, G1::Scalar)
|
||||
blinding_key: (G0::Scalar, G1::Scalar),
|
||||
) -> Self {
|
||||
let mut commitments = (
|
||||
(generators.0.alt * blinding_key.0),
|
||||
(generators.1.alt * blinding_key.1)
|
||||
);
|
||||
let mut commitments =
|
||||
((generators.0.alt * blinding_key.0), (generators.1.alt * blinding_key.1));
|
||||
commitments.0 += pow_2.0 * G0::Scalar::from(bits.into());
|
||||
commitments.1 += pow_2.1 * G1::Scalar::from(bits.into());
|
||||
|
||||
@@ -126,7 +122,7 @@ impl<
|
||||
&Self::ring(*pow_2, commitments),
|
||||
usize::from(bits),
|
||||
blinding_key,
|
||||
BitSignature::from(SIGNATURE).aos_form()
|
||||
BitSignature::from(SIGNATURE).aos_form(),
|
||||
);
|
||||
|
||||
Self::shift(pow_2);
|
||||
@@ -140,7 +136,7 @@ impl<
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
batch: &mut (BatchVerifier<(), G0>, BatchVerifier<(), G1>),
|
||||
i: usize,
|
||||
pow_2: &mut (G0, G1)
|
||||
pow_2: &mut (G0, G1),
|
||||
) -> Result<(), DLEqError> {
|
||||
Self::transcript(transcript, i, self.commitments);
|
||||
|
||||
@@ -149,7 +145,7 @@ impl<
|
||||
transcript.clone(),
|
||||
generators,
|
||||
batch,
|
||||
&Self::ring(*pow_2, self.commitments)
|
||||
&Self::ring(*pow_2, self.commitments),
|
||||
)?;
|
||||
|
||||
Self::shift(pow_2);
|
||||
@@ -165,11 +161,9 @@ impl<
|
||||
|
||||
#[cfg(feature = "serialize")]
|
||||
pub(crate) fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
||||
Ok(
|
||||
Bits {
|
||||
commitments: (read_point(r)?, read_point(r)?),
|
||||
signature: Aos::deserialize(r, BitSignature::from(SIGNATURE).aos_form())?
|
||||
}
|
||||
)
|
||||
Ok(Bits {
|
||||
commitments: (read_point(r)?, read_point(r)?),
|
||||
signature: Aos::deserialize(r, BitSignature::from(SIGNATURE).aos_form())?,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,7 +5,10 @@ use digest::Digest;
|
||||
|
||||
use transcript::Transcript;
|
||||
|
||||
use group::{ff::{Field, PrimeField, PrimeFieldBits}, prime::PrimeGroup};
|
||||
use group::{
|
||||
ff::{Field, PrimeField, PrimeFieldBits},
|
||||
prime::PrimeGroup,
|
||||
};
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
pub mod scalar;
|
||||
@@ -36,7 +39,7 @@ pub(crate) fn read_point<R: Read, G: PrimeGroup>(r: &mut R) -> std::io::Result<G
|
||||
#[derive(Clone, Copy, PartialEq, Eq)]
|
||||
pub struct Generators<G: PrimeGroup> {
|
||||
pub primary: G,
|
||||
pub alt: G
|
||||
pub alt: G,
|
||||
}
|
||||
|
||||
impl<G: PrimeGroup> Generators<G> {
|
||||
@@ -60,7 +63,7 @@ pub enum DLEqError {
|
||||
#[error("invalid challenge")]
|
||||
InvalidChallenge,
|
||||
#[error("invalid proof")]
|
||||
InvalidProof
|
||||
InvalidProof,
|
||||
}
|
||||
|
||||
// This should never be directly instantiated and uses a u8 to represent internal values
|
||||
@@ -74,11 +77,14 @@ pub struct __DLEqProof<
|
||||
G1: PrimeGroup,
|
||||
const SIGNATURE: u8,
|
||||
const RING_LEN: usize,
|
||||
const REMAINDER_RING_LEN: usize
|
||||
> where G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||
const REMAINDER_RING_LEN: usize,
|
||||
> where
|
||||
G0::Scalar: PrimeFieldBits,
|
||||
G1::Scalar: PrimeFieldBits,
|
||||
{
|
||||
bits: Vec<Bits<G0, G1, SIGNATURE, RING_LEN>>,
|
||||
remainder: Option<Bits<G0, G1, SIGNATURE, REMAINDER_RING_LEN>>,
|
||||
poks: (SchnorrPoK<G0>, SchnorrPoK<G1>)
|
||||
poks: (SchnorrPoK<G0>, SchnorrPoK<G1>),
|
||||
}
|
||||
|
||||
macro_rules! dleq {
|
||||
@@ -90,9 +96,15 @@ macro_rules! dleq {
|
||||
{ $signature.ring_len() },
|
||||
// There may not be a remainder, yet if there is one, it'll be just one bit
|
||||
// A ring for one bit has a RING_LEN of 2
|
||||
{ if $remainder { 2 } else { 0 } }
|
||||
{
|
||||
if $remainder {
|
||||
2
|
||||
} else {
|
||||
0
|
||||
}
|
||||
},
|
||||
>;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
// Proves for 1-bit at a time with the signature form (e, s), as originally described in MRL-0010.
|
||||
@@ -119,18 +131,20 @@ dleq!(EfficientLinearDLEq, BitSignature::EfficientLinear, false);
|
||||
dleq!(CompromiseLinearDLEq, BitSignature::CompromiseLinear, true);
|
||||
|
||||
impl<
|
||||
G0: PrimeGroup,
|
||||
G1: PrimeGroup,
|
||||
const SIGNATURE: u8,
|
||||
const RING_LEN: usize,
|
||||
const REMAINDER_RING_LEN: usize
|
||||
> __DLEqProof<G0, G1, SIGNATURE, RING_LEN, REMAINDER_RING_LEN> where
|
||||
G0::Scalar: PrimeFieldBits, G1::Scalar: PrimeFieldBits {
|
||||
|
||||
G0: PrimeGroup,
|
||||
G1: PrimeGroup,
|
||||
const SIGNATURE: u8,
|
||||
const RING_LEN: usize,
|
||||
const REMAINDER_RING_LEN: usize,
|
||||
> __DLEqProof<G0, G1, SIGNATURE, RING_LEN, REMAINDER_RING_LEN>
|
||||
where
|
||||
G0::Scalar: PrimeFieldBits,
|
||||
G1::Scalar: PrimeFieldBits,
|
||||
{
|
||||
pub(crate) fn transcript<T: Transcript>(
|
||||
transcript: &mut T,
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
keys: (G0, G1)
|
||||
keys: (G0, G1),
|
||||
) {
|
||||
transcript.domain_separate(b"cross_group_dleq");
|
||||
generators.0.transcript(transcript);
|
||||
@@ -143,13 +157,9 @@ impl<
|
||||
pub(crate) fn blinding_key<R: RngCore + CryptoRng, F: PrimeField>(
|
||||
rng: &mut R,
|
||||
total: &mut F,
|
||||
last: bool
|
||||
last: bool,
|
||||
) -> F {
|
||||
let blinding_key = if last {
|
||||
-*total
|
||||
} else {
|
||||
F::random(&mut *rng)
|
||||
};
|
||||
let blinding_key = if last { -*total } else { F::random(&mut *rng) };
|
||||
*total += blinding_key;
|
||||
blinding_key
|
||||
}
|
||||
@@ -157,7 +167,7 @@ impl<
|
||||
fn reconstruct_keys(&self) -> (G0, G1) {
|
||||
let mut res = (
|
||||
self.bits.iter().map(|bit| bit.commitments.0).sum::<G0>(),
|
||||
self.bits.iter().map(|bit| bit.commitments.1).sum::<G1>()
|
||||
self.bits.iter().map(|bit| bit.commitments.1).sum::<G1>(),
|
||||
);
|
||||
|
||||
if let Some(bit) = &self.remainder {
|
||||
@@ -172,24 +182,24 @@ impl<
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
f: (G0::Scalar, G1::Scalar)
|
||||
f: (G0::Scalar, G1::Scalar),
|
||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
||||
Self::transcript(
|
||||
transcript,
|
||||
generators,
|
||||
((generators.0.primary * f.0), (generators.1.primary * f.1))
|
||||
((generators.0.primary * f.0), (generators.1.primary * f.1)),
|
||||
);
|
||||
|
||||
let poks = (
|
||||
SchnorrPoK::<G0>::prove(rng, transcript, generators.0.primary, f.0),
|
||||
SchnorrPoK::<G1>::prove(rng, transcript, generators.1.primary, f.1)
|
||||
SchnorrPoK::<G1>::prove(rng, transcript, generators.1.primary, f.1),
|
||||
);
|
||||
|
||||
let mut blinding_key_total = (G0::Scalar::zero(), G1::Scalar::zero());
|
||||
let mut blinding_key = |rng: &mut R, last| {
|
||||
let blinding_key = (
|
||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.0, last),
|
||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.1, last)
|
||||
Self::blinding_key(&mut *rng, &mut blinding_key_total.1, last),
|
||||
);
|
||||
if last {
|
||||
debug_assert_eq!(blinding_key_total.0, G0::Scalar::zero());
|
||||
@@ -219,17 +229,15 @@ impl<
|
||||
if (i % bits_per_group) == (bits_per_group - 1) {
|
||||
let last = i == (capacity - 1);
|
||||
let blinding_key = blinding_key(&mut *rng, last);
|
||||
bits.push(
|
||||
Bits::prove(
|
||||
&mut *rng,
|
||||
transcript,
|
||||
generators,
|
||||
i / bits_per_group,
|
||||
&mut pow_2,
|
||||
these_bits,
|
||||
blinding_key
|
||||
)
|
||||
);
|
||||
bits.push(Bits::prove(
|
||||
&mut *rng,
|
||||
transcript,
|
||||
generators,
|
||||
i / bits_per_group,
|
||||
&mut pow_2,
|
||||
these_bits,
|
||||
blinding_key,
|
||||
));
|
||||
these_bits = 0;
|
||||
}
|
||||
}
|
||||
@@ -238,17 +246,15 @@ impl<
|
||||
let mut remainder = None;
|
||||
if capacity != ((capacity / bits_per_group) * bits_per_group) {
|
||||
let blinding_key = blinding_key(&mut *rng, true);
|
||||
remainder = Some(
|
||||
Bits::prove(
|
||||
&mut *rng,
|
||||
transcript,
|
||||
generators,
|
||||
capacity / bits_per_group,
|
||||
&mut pow_2,
|
||||
these_bits,
|
||||
blinding_key
|
||||
)
|
||||
);
|
||||
remainder = Some(Bits::prove(
|
||||
&mut *rng,
|
||||
transcript,
|
||||
generators,
|
||||
capacity / bits_per_group,
|
||||
&mut pow_2,
|
||||
these_bits,
|
||||
blinding_key,
|
||||
));
|
||||
}
|
||||
|
||||
let proof = __DLEqProof { bits, remainder, poks };
|
||||
@@ -270,13 +276,13 @@ impl<
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
digest: D
|
||||
digest: D,
|
||||
) -> (Self, (G0::Scalar, G1::Scalar)) {
|
||||
Self::prove_internal(
|
||||
rng,
|
||||
transcript,
|
||||
generators,
|
||||
mutual_scalar_from_bytes(digest.finalize().as_ref())
|
||||
mutual_scalar_from_bytes(digest.finalize().as_ref()),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -287,7 +293,7 @@ impl<
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
f0: G0::Scalar
|
||||
f0: G0::Scalar,
|
||||
) -> Option<(Self, (G0::Scalar, G1::Scalar))> {
|
||||
scalar_convert(f0).map(|f1| Self::prove_internal(rng, transcript, generators, (f0, f1)))
|
||||
}
|
||||
@@ -297,19 +303,18 @@ impl<
|
||||
&self,
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generators: (Generators<G0>, Generators<G1>)
|
||||
generators: (Generators<G0>, Generators<G1>),
|
||||
) -> Result<(G0, G1), DLEqError> {
|
||||
let capacity = usize::try_from(
|
||||
G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)
|
||||
).unwrap();
|
||||
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
|
||||
let bits_per_group = BitSignature::from(SIGNATURE).bits();
|
||||
let has_remainder = (capacity % bits_per_group) != 0;
|
||||
|
||||
// These shouldn't be possible, as locally created and deserialized proofs should be properly
|
||||
// formed in these regards, yet it doesn't hurt to check and would be problematic if true
|
||||
if (self.bits.len() != (capacity / bits_per_group)) || (
|
||||
(self.remainder.is_none() && has_remainder) || (self.remainder.is_some() && !has_remainder)
|
||||
) {
|
||||
if (self.bits.len() != (capacity / bits_per_group)) ||
|
||||
((self.remainder.is_none() && has_remainder) ||
|
||||
(self.remainder.is_some() && !has_remainder))
|
||||
{
|
||||
return Err(DLEqError::InvalidProofLength);
|
||||
}
|
||||
|
||||
@@ -320,7 +325,7 @@ impl<
|
||||
BitSignature::ClassicLinear => 3,
|
||||
BitSignature::ConciseLinear => 3,
|
||||
BitSignature::EfficientLinear => (self.bits.len() + 1) * 3,
|
||||
BitSignature::CompromiseLinear => (self.bits.len() + 1) * 3
|
||||
BitSignature::CompromiseLinear => (self.bits.len() + 1) * 3,
|
||||
};
|
||||
let mut batch = (BatchVerifier::new(batch_capacity), BatchVerifier::new(batch_capacity));
|
||||
|
||||
@@ -356,9 +361,7 @@ impl<
|
||||
|
||||
#[cfg(feature = "serialize")]
|
||||
pub fn deserialize<R: Read>(r: &mut R) -> std::io::Result<Self> {
|
||||
let capacity = usize::try_from(
|
||||
G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)
|
||||
).unwrap();
|
||||
let capacity = usize::try_from(G0::Scalar::CAPACITY.min(G1::Scalar::CAPACITY)).unwrap();
|
||||
let bits_per_group = BitSignature::from(SIGNATURE).bits();
|
||||
|
||||
let mut bits = Vec::with_capacity(capacity / bits_per_group);
|
||||
@@ -371,12 +374,10 @@ impl<
|
||||
remainder = Some(Bits::deserialize(r)?);
|
||||
}
|
||||
|
||||
Ok(
|
||||
__DLEqProof {
|
||||
bits,
|
||||
remainder,
|
||||
poks: (SchnorrPoK::deserialize(r)?, SchnorrPoK::deserialize(r)?)
|
||||
}
|
||||
)
|
||||
Ok(__DLEqProof {
|
||||
bits,
|
||||
remainder,
|
||||
poks: (SchnorrPoK::deserialize(r)?, SchnorrPoK::deserialize(r)?),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,10 @@ use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use transcript::Transcript;
|
||||
|
||||
use group::{ff::{Field, PrimeFieldBits}, prime::PrimeGroup};
|
||||
use group::{
|
||||
ff::{Field, PrimeFieldBits},
|
||||
prime::PrimeGroup,
|
||||
};
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
use crate::challenge;
|
||||
@@ -18,10 +21,13 @@ use crate::{read_scalar, cross_group::read_point};
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub(crate) struct SchnorrPoK<G: PrimeGroup> {
|
||||
R: G,
|
||||
s: G::Scalar
|
||||
s: G::Scalar,
|
||||
}
|
||||
|
||||
impl<G: PrimeGroup> SchnorrPoK<G> where G::Scalar: PrimeFieldBits {
|
||||
impl<G: PrimeGroup> SchnorrPoK<G>
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
// Not hram due to the lack of m
|
||||
#[allow(non_snake_case)]
|
||||
fn hra<T: Transcript>(transcript: &mut T, generator: G, R: G, A: G) -> G::Scalar {
|
||||
@@ -36,14 +42,14 @@ impl<G: PrimeGroup> SchnorrPoK<G> where G::Scalar: PrimeFieldBits {
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generator: G,
|
||||
private_key: G::Scalar
|
||||
private_key: G::Scalar,
|
||||
) -> SchnorrPoK<G> {
|
||||
let nonce = G::Scalar::random(rng);
|
||||
#[allow(non_snake_case)]
|
||||
let R = generator * nonce;
|
||||
SchnorrPoK {
|
||||
R,
|
||||
s: nonce + (private_key * SchnorrPoK::hra(transcript, generator, R, generator * private_key))
|
||||
s: nonce + (private_key * SchnorrPoK::hra(transcript, generator, R, generator * private_key)),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -53,7 +59,7 @@ impl<G: PrimeGroup> SchnorrPoK<G> where G::Scalar: PrimeFieldBits {
|
||||
transcript: &mut T,
|
||||
generator: G,
|
||||
public_key: G,
|
||||
batch: &mut BatchVerifier<(), G>
|
||||
batch: &mut BatchVerifier<(), G>,
|
||||
) {
|
||||
batch.queue(
|
||||
rng,
|
||||
@@ -61,8 +67,8 @@ impl<G: PrimeGroup> SchnorrPoK<G> where G::Scalar: PrimeFieldBits {
|
||||
[
|
||||
(-self.s, generator),
|
||||
(G::Scalar::one(), self.R),
|
||||
(Self::hra(transcript, generator, self.R, public_key), public_key)
|
||||
]
|
||||
(Self::hra(transcript, generator, self.R, public_key), public_key),
|
||||
],
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -55,13 +55,13 @@ fn read_scalar<R: Read, F: PrimeField>(r: &mut R) -> io::Result<F> {
|
||||
|
||||
#[derive(Debug)]
|
||||
pub enum DLEqError {
|
||||
InvalidProof
|
||||
InvalidProof,
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct DLEqProof<G: PrimeGroup> {
|
||||
c: G::Scalar,
|
||||
s: G::Scalar
|
||||
s: G::Scalar,
|
||||
}
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
@@ -76,7 +76,7 @@ impl<G: PrimeGroup> DLEqProof<G> {
|
||||
rng: &mut R,
|
||||
transcript: &mut T,
|
||||
generators: &[G],
|
||||
scalar: G::Scalar
|
||||
scalar: G::Scalar,
|
||||
) -> DLEqProof<G> {
|
||||
let r = G::Scalar::random(rng);
|
||||
|
||||
@@ -95,7 +95,7 @@ impl<G: PrimeGroup> DLEqProof<G> {
|
||||
&self,
|
||||
transcript: &mut T,
|
||||
generators: &[G],
|
||||
points: &[G]
|
||||
points: &[G],
|
||||
) -> Result<(), DLEqError> {
|
||||
if generators.len() != points.len() {
|
||||
Err(DLEqError::InvalidProof)?;
|
||||
|
||||
@@ -6,7 +6,7 @@ use multiexp::BatchVerifier;
|
||||
|
||||
use crate::{
|
||||
cross_group::aos::{Re, Aos},
|
||||
tests::cross_group::{G0, G1, transcript, generators}
|
||||
tests::cross_group::{G0, G1, transcript, generators},
|
||||
};
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
@@ -26,10 +26,8 @@ fn test_aos<const RING_LEN: usize>(default: Re<G0, G1>) {
|
||||
#[allow(deprecated)]
|
||||
let mut ring = [(G0::identity(), G1::identity()); RING_LEN];
|
||||
for i in 0 .. RING_LEN {
|
||||
ring_keys[i] = (
|
||||
<G0 as Group>::Scalar::random(&mut OsRng),
|
||||
<G1 as Group>::Scalar::random(&mut OsRng)
|
||||
);
|
||||
ring_keys[i] =
|
||||
(<G0 as Group>::Scalar::random(&mut OsRng), <G1 as Group>::Scalar::random(&mut OsRng));
|
||||
ring[i] = (generators.0.alt * ring_keys[i].0, generators.1.alt * ring_keys[i].1);
|
||||
}
|
||||
|
||||
@@ -41,7 +39,7 @@ fn test_aos<const RING_LEN: usize>(default: Re<G0, G1>) {
|
||||
&ring,
|
||||
actual,
|
||||
ring_keys[actual],
|
||||
default.clone()
|
||||
default.clone(),
|
||||
);
|
||||
|
||||
let mut batch = (BatchVerifier::new(0), BatchVerifier::new(0));
|
||||
|
||||
@@ -13,9 +13,9 @@ use transcript::{Transcript, RecommendedTranscript};
|
||||
|
||||
use crate::{
|
||||
cross_group::{
|
||||
scalar::mutual_scalar_from_bytes,
|
||||
Generators, ClassicLinearDLEq, EfficientLinearDLEq, ConciseLinearDLEq, CompromiseLinearDLEq
|
||||
}
|
||||
scalar::mutual_scalar_from_bytes, Generators, ClassicLinearDLEq, EfficientLinearDLEq,
|
||||
ConciseLinearDLEq, CompromiseLinearDLEq,
|
||||
},
|
||||
};
|
||||
|
||||
mod scalar;
|
||||
@@ -34,16 +34,17 @@ pub(crate) fn generators() -> (Generators<G0>, Generators<G1>) {
|
||||
Generators::new(
|
||||
ProjectivePoint::GENERATOR,
|
||||
ProjectivePoint::from_bytes(
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0").into())
|
||||
).unwrap()
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0").into()),
|
||||
)
|
||||
.unwrap(),
|
||||
),
|
||||
|
||||
Generators::new(
|
||||
EdwardsPoint::generator(),
|
||||
EdwardsPoint::from_bytes(
|
||||
&hex!("8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94")
|
||||
).unwrap()
|
||||
)
|
||||
EdwardsPoint::from_bytes(&hex!(
|
||||
"8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94"
|
||||
))
|
||||
.unwrap(),
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -60,7 +61,7 @@ macro_rules! verify_and_deserialize {
|
||||
let deserialized = <$type>::deserialize(&mut std::io::Cursor::new(&buf)).unwrap();
|
||||
assert_eq!($proof, deserialized);
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
macro_rules! test_dleq {
|
||||
@@ -110,7 +111,7 @@ macro_rules! test_dleq {
|
||||
&mut OsRng,
|
||||
&mut transcript(),
|
||||
generators,
|
||||
Blake2b512::new().chain_update(seed)
|
||||
Blake2b512::new().chain_update(seed),
|
||||
)
|
||||
} else {
|
||||
let mut key;
|
||||
@@ -121,14 +122,14 @@ macro_rules! test_dleq {
|
||||
res.is_none()
|
||||
} {}
|
||||
let res = res.unwrap();
|
||||
assert_eq!(key, res.1.0);
|
||||
assert_eq!(key, res.1 .0);
|
||||
res
|
||||
};
|
||||
|
||||
verify_and_deserialize!($type::<G0, G1>, proof, generators, keys);
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
test_dleq!("ClassicLinear", benchmark_classic_linear, test_classic_linear, ClassicLinearDLEq);
|
||||
@@ -155,12 +156,8 @@ fn test_rejection_sampling() {
|
||||
|
||||
assert!(
|
||||
// Either would work
|
||||
EfficientLinearDLEq::prove_without_bias(
|
||||
&mut OsRng,
|
||||
&mut transcript(),
|
||||
generators(),
|
||||
pow_2
|
||||
).is_none()
|
||||
EfficientLinearDLEq::prove_without_bias(&mut OsRng, &mut transcript(), generators(), pow_2)
|
||||
.is_none()
|
||||
);
|
||||
}
|
||||
|
||||
@@ -174,12 +171,9 @@ fn test_remainder() {
|
||||
assert_eq!(keys.0 + Scalar::one(), Scalar::from(2u64).pow_vartime(&[255]));
|
||||
assert_eq!(keys.0, keys.1);
|
||||
|
||||
let (proof, res) = ConciseLinearDLEq::prove_without_bias(
|
||||
&mut OsRng,
|
||||
&mut transcript(),
|
||||
generators,
|
||||
keys.0
|
||||
).unwrap();
|
||||
let (proof, res) =
|
||||
ConciseLinearDLEq::prove_without_bias(&mut OsRng, &mut transcript(), generators, keys.0)
|
||||
.unwrap();
|
||||
assert_eq!(keys, res);
|
||||
|
||||
verify_and_deserialize!(
|
||||
|
||||
@@ -1,28 +1,29 @@
|
||||
use rand_core::OsRng;
|
||||
|
||||
use group::{ff::{Field, PrimeFieldBits}, prime::PrimeGroup};
|
||||
use group::{
|
||||
ff::{Field, PrimeFieldBits},
|
||||
prime::PrimeGroup,
|
||||
};
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
use transcript::{Transcript, RecommendedTranscript};
|
||||
|
||||
use crate::cross_group::schnorr::SchnorrPoK;
|
||||
|
||||
fn test_schnorr<G: PrimeGroup>() where G::Scalar: PrimeFieldBits {
|
||||
fn test_schnorr<G: PrimeGroup>()
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let private = G::Scalar::random(&mut OsRng);
|
||||
|
||||
let transcript = RecommendedTranscript::new(b"Schnorr Test");
|
||||
let mut batch = BatchVerifier::new(3);
|
||||
SchnorrPoK::prove(
|
||||
&mut OsRng,
|
||||
&mut transcript.clone(),
|
||||
G::generator(),
|
||||
private
|
||||
).verify(
|
||||
SchnorrPoK::prove(&mut OsRng, &mut transcript.clone(), G::generator(), private).verify(
|
||||
&mut OsRng,
|
||||
&mut transcript.clone(),
|
||||
G::generator(),
|
||||
G::generator() * private,
|
||||
&mut batch
|
||||
&mut batch,
|
||||
);
|
||||
assert!(batch.verify_vartime());
|
||||
}
|
||||
|
||||
@@ -20,18 +20,22 @@ fn test_dleq() {
|
||||
let generators = [
|
||||
ProjectivePoint::GENERATOR,
|
||||
ProjectivePoint::from_bytes(
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0").into())
|
||||
).unwrap(),
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0").into()),
|
||||
)
|
||||
.unwrap(),
|
||||
// Just an increment of the last byte from the previous, where the previous two are valid
|
||||
ProjectivePoint::from_bytes(
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac4").into())
|
||||
).unwrap(),
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac4").into()),
|
||||
)
|
||||
.unwrap(),
|
||||
ProjectivePoint::from_bytes(
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803aca").into())
|
||||
).unwrap(),
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803aca").into()),
|
||||
)
|
||||
.unwrap(),
|
||||
ProjectivePoint::from_bytes(
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803acb").into())
|
||||
).unwrap()
|
||||
&(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803acb").into()),
|
||||
)
|
||||
.unwrap(),
|
||||
];
|
||||
|
||||
for i in 0 .. 5 {
|
||||
@@ -48,9 +52,8 @@ fn test_dleq() {
|
||||
{
|
||||
let mut buf = vec![];
|
||||
proof.serialize(&mut buf).unwrap();
|
||||
let deserialized = DLEqProof::<ProjectivePoint>::deserialize(
|
||||
&mut std::io::Cursor::new(&buf)
|
||||
).unwrap();
|
||||
let deserialized =
|
||||
DLEqProof::<ProjectivePoint>::deserialize(&mut std::io::Cursor::new(&buf)).unwrap();
|
||||
assert_eq!(proof, deserialized);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -55,12 +55,7 @@ pub trait Algorithm<C: Curve>: Clone {
|
||||
/// Verify a specific share given as a response. Used to determine blame if signature
|
||||
/// verification fails
|
||||
#[must_use]
|
||||
fn verify_share(
|
||||
&self,
|
||||
verification_share: C::G,
|
||||
nonces: &[Vec<C::G>],
|
||||
share: C::F,
|
||||
) -> bool;
|
||||
fn verify_share(&self, verification_share: C::G, nonces: &[Vec<C::G>], share: C::F) -> bool;
|
||||
}
|
||||
|
||||
// Transcript which will create an IETF compliant serialization for the binding factor
|
||||
@@ -88,7 +83,6 @@ impl Transcript for IetfTranscript {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
pub trait Hram<C: Curve>: Clone {
|
||||
/// HRAM function to generate a challenge
|
||||
/// H2 from the IETF draft despite having a different argument set (not pre-formatted)
|
||||
@@ -105,11 +99,7 @@ pub struct Schnorr<C: Curve, H: Hram<C>> {
|
||||
|
||||
impl<C: Curve, H: Hram<C>> Schnorr<C, H> {
|
||||
pub fn new() -> Schnorr<C, H> {
|
||||
Schnorr {
|
||||
transcript: IetfTranscript(vec![]),
|
||||
c: None,
|
||||
_hram: PhantomData
|
||||
}
|
||||
Schnorr { transcript: IetfTranscript(vec![]), c: None, _hram: PhantomData }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -166,16 +156,11 @@ impl<C: Curve, H: Hram<C>> Algorithm<C> for Schnorr<C, H> {
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
fn verify_share(
|
||||
&self,
|
||||
verification_share: C::G,
|
||||
nonces: &[Vec<C::G>],
|
||||
share: C::F,
|
||||
) -> bool {
|
||||
fn verify_share(&self, verification_share: C::G, nonces: &[Vec<C::G>], share: C::F) -> bool {
|
||||
schnorr::verify::<C>(
|
||||
verification_share,
|
||||
self.c.unwrap(),
|
||||
&SchnorrSignature { R: nonces[0][0], s: share}
|
||||
&SchnorrSignature { R: nonces[0][0], s: share },
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -63,7 +63,7 @@ macro_rules! dalek_curve {
|
||||
$Curve::hash_to_F($chal, &[&R.compress().to_bytes(), &A.compress().to_bytes(), m].concat())
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[cfg(any(test, feature = "ristretto"))]
|
||||
|
||||
@@ -6,7 +6,10 @@ use sha2::{digest::Update, Digest, Sha256};
|
||||
|
||||
use group::{ff::Field, GroupEncoding};
|
||||
|
||||
use elliptic_curve::{bigint::{Encoding, U384}, hash2curve::{Expander, ExpandMsg, ExpandMsgXmd}};
|
||||
use elliptic_curve::{
|
||||
bigint::{Encoding, U384},
|
||||
hash2curve::{Expander, ExpandMsg, ExpandMsgXmd},
|
||||
};
|
||||
|
||||
use crate::{curve::Curve, algorithm::Hram};
|
||||
|
||||
@@ -36,12 +39,7 @@ macro_rules! kp_curve {
|
||||
}
|
||||
|
||||
fn hash_msg(msg: &[u8]) -> Vec<u8> {
|
||||
(&Sha256::new()
|
||||
.chain($CONTEXT)
|
||||
.chain(b"digest")
|
||||
.chain(msg)
|
||||
.finalize()
|
||||
).to_vec()
|
||||
(&Sha256::new().chain($CONTEXT).chain(b"digest").chain(msg).finalize()).to_vec()
|
||||
}
|
||||
|
||||
fn hash_binding_factor(binding: &[u8]) -> Self::F {
|
||||
@@ -60,19 +58,17 @@ macro_rules! kp_curve {
|
||||
let mut modulus = vec![0; 16];
|
||||
modulus.extend((Self::F::zero() - Self::F::one()).to_bytes());
|
||||
let modulus = U384::from_be_slice(&modulus).wrapping_add(&U384::ONE);
|
||||
Self::read_F(
|
||||
&mut Cursor::new(
|
||||
&U384::from_be_slice(&{
|
||||
let mut bytes = [0; 48];
|
||||
ExpandMsgXmd::<Sha256>::expand_message(
|
||||
&[msg],
|
||||
dst,
|
||||
48
|
||||
).unwrap().fill_bytes(&mut bytes);
|
||||
bytes
|
||||
}).reduce(&modulus).unwrap().to_be_bytes()[16 ..]
|
||||
)
|
||||
).unwrap()
|
||||
Self::read_F(&mut Cursor::new(
|
||||
&U384::from_be_slice(&{
|
||||
let mut bytes = [0; 48];
|
||||
ExpandMsgXmd::<Sha256>::expand_message(&[msg], dst, 48).unwrap().fill_bytes(&mut bytes);
|
||||
bytes
|
||||
})
|
||||
.reduce(&modulus)
|
||||
.unwrap()
|
||||
.to_be_bytes()[16 ..],
|
||||
))
|
||||
.unwrap()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -83,27 +79,15 @@ macro_rules! kp_curve {
|
||||
fn hram(R: &$lib::ProjectivePoint, A: &$lib::ProjectivePoint, m: &[u8]) -> $lib::Scalar {
|
||||
$Curve::hash_to_F(
|
||||
&[$CONTEXT as &[u8], b"chal"].concat(),
|
||||
&[R.to_bytes().as_ref(), A.to_bytes().as_ref(), m].concat()
|
||||
&[R.to_bytes().as_ref(), A.to_bytes().as_ref(), m].concat(),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
#[cfg(feature = "p256")]
|
||||
kp_curve!(
|
||||
p256,
|
||||
P256,
|
||||
IetfP256Hram,
|
||||
b"P-256",
|
||||
b"FROST-P256-SHA256-v5"
|
||||
);
|
||||
kp_curve!(p256, P256, IetfP256Hram, b"P-256", b"FROST-P256-SHA256-v5");
|
||||
|
||||
#[cfg(feature = "secp256k1")]
|
||||
kp_curve!(
|
||||
k256,
|
||||
Secp256k1,
|
||||
NonIetfSecp256k1Hram,
|
||||
b"secp256k1",
|
||||
b"FROST-secp256k1-SHA256-v7"
|
||||
);
|
||||
kp_curve!(k256, Secp256k1, NonIetfSecp256k1Hram, b"secp256k1", b"FROST-secp256k1-SHA256-v7");
|
||||
|
||||
@@ -102,9 +102,8 @@ pub trait Curve: Clone + Copy + PartialEq + Eq + Debug {
|
||||
let mut encoding = <Self::G as GroupEncoding>::Repr::default();
|
||||
r.read_exact(encoding.as_mut()).map_err(|_| CurveError::InvalidPoint)?;
|
||||
|
||||
let point = Option::<Self::G>::from(
|
||||
Self::G::from_bytes(&encoding)
|
||||
).ok_or(CurveError::InvalidPoint)?;
|
||||
let point =
|
||||
Option::<Self::G>::from(Self::G::from_bytes(&encoding)).ok_or(CurveError::InvalidPoint)?;
|
||||
// Ban the identity, per the FROST spec, and non-canonical points
|
||||
if (point.is_identity().into()) || (point.to_bytes().as_ref() != encoding.as_ref()) {
|
||||
Err(CurveError::InvalidPoint)?;
|
||||
|
||||
@@ -1,8 +1,15 @@
|
||||
use std::{marker::PhantomData, io::{Read, Cursor}, collections::HashMap};
|
||||
use std::{
|
||||
marker::PhantomData,
|
||||
io::{Read, Cursor},
|
||||
collections::HashMap,
|
||||
};
|
||||
|
||||
use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use group::{ff::{Field, PrimeField}, GroupEncoding};
|
||||
use group::{
|
||||
ff::{Field, PrimeField},
|
||||
GroupEncoding,
|
||||
};
|
||||
|
||||
use multiexp::{multiexp_vartime, BatchVerifier};
|
||||
|
||||
@@ -10,7 +17,7 @@ use crate::{
|
||||
curve::Curve,
|
||||
FrostError, FrostParams, FrostKeys,
|
||||
schnorr::{self, SchnorrSignature},
|
||||
validate_map
|
||||
validate_map,
|
||||
};
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
@@ -56,13 +63,9 @@ fn generate_key_r1<R: RngCore + CryptoRng, C: Curve>(
|
||||
// There's no reason to spend the time and effort to make this deterministic besides a
|
||||
// general obsession with canonicity and determinism though
|
||||
r,
|
||||
challenge::<C>(
|
||||
context,
|
||||
params.i(),
|
||||
(C::GENERATOR * r).to_bytes().as_ref(),
|
||||
&serialized
|
||||
)
|
||||
).serialize()
|
||||
challenge::<C>(context, params.i(), (C::GENERATOR * r).to_bytes().as_ref(), &serialized),
|
||||
)
|
||||
.serialize(),
|
||||
);
|
||||
|
||||
// Step 4: Broadcast
|
||||
@@ -114,7 +117,7 @@ fn verify_r1<Re: Read, R: RngCore + CryptoRng, C: Curve>(
|
||||
l,
|
||||
these_commitments[0],
|
||||
challenge::<C>(context, l, R.to_bytes().as_ref(), &Am),
|
||||
SchnorrSignature::<C> { R, s }
|
||||
SchnorrSignature::<C> { R, s },
|
||||
));
|
||||
}
|
||||
|
||||
@@ -126,10 +129,7 @@ fn verify_r1<Re: Read, R: RngCore + CryptoRng, C: Curve>(
|
||||
Ok(commitments)
|
||||
}
|
||||
|
||||
fn polynomial<F: PrimeField>(
|
||||
coefficients: &[F],
|
||||
l: u16
|
||||
) -> F {
|
||||
fn polynomial<F: PrimeField>(coefficients: &[F], l: u16) -> F {
|
||||
let l = F::from(u64::from(l));
|
||||
let mut share = F::zero();
|
||||
for (idx, coefficient) in coefficients.iter().rev().enumerate() {
|
||||
@@ -207,13 +207,10 @@ fn complete_r2<Re: Read, R: RngCore + CryptoRng, C: Curve>(
|
||||
let exponential = |i: u16, values: &[_]| {
|
||||
let i = C::F::from(i.into());
|
||||
let mut res = Vec::with_capacity(params.t().into());
|
||||
(0 .. usize::from(params.t())).into_iter().fold(
|
||||
C::F::one(),
|
||||
|exp, l| {
|
||||
res.push((exp, values[l]));
|
||||
exp * i
|
||||
}
|
||||
);
|
||||
(0 .. usize::from(params.t())).into_iter().fold(C::F::one(), |exp, l| {
|
||||
res.push((exp, values[l]));
|
||||
exp * i
|
||||
});
|
||||
res
|
||||
};
|
||||
|
||||
@@ -254,15 +251,7 @@ fn complete_r2<Re: Read, R: RngCore + CryptoRng, C: Curve>(
|
||||
|
||||
// TODO: Clear serialized and shares
|
||||
|
||||
Ok(
|
||||
FrostKeys {
|
||||
params,
|
||||
secret_share,
|
||||
group_key: stripes[0],
|
||||
verification_shares,
|
||||
offset: None
|
||||
}
|
||||
)
|
||||
Ok(FrostKeys { params, secret_share, group_key: stripes[0], verification_shares, offset: None })
|
||||
}
|
||||
|
||||
pub struct KeyGenMachine<C: Curve> {
|
||||
@@ -298,11 +287,8 @@ impl<C: Curve> KeyGenMachine<C> {
|
||||
self,
|
||||
rng: &mut R,
|
||||
) -> (SecretShareMachine<C>, Vec<u8>) {
|
||||
let (
|
||||
coefficients,
|
||||
our_commitments,
|
||||
serialized
|
||||
) = generate_key_r1::<_, C>(rng, &self.params, &self.context);
|
||||
let (coefficients, our_commitments, serialized) =
|
||||
generate_key_r1::<_, C>(rng, &self.params, &self.context);
|
||||
|
||||
(
|
||||
SecretShareMachine {
|
||||
|
||||
@@ -3,7 +3,10 @@ use std::{io::Read, collections::HashMap};
|
||||
|
||||
use thiserror::Error;
|
||||
|
||||
use group::{ff::{Field, PrimeField}, GroupEncoding};
|
||||
use group::{
|
||||
ff::{Field, PrimeField},
|
||||
GroupEncoding,
|
||||
};
|
||||
|
||||
mod schnorr;
|
||||
|
||||
@@ -28,11 +31,7 @@ pub struct FrostParams {
|
||||
}
|
||||
|
||||
impl FrostParams {
|
||||
pub fn new(
|
||||
t: u16,
|
||||
n: u16,
|
||||
i: u16
|
||||
) -> Result<FrostParams, FrostError> {
|
||||
pub fn new(t: u16, n: u16, i: u16) -> Result<FrostParams, FrostError> {
|
||||
if (t == 0) || (n == 0) {
|
||||
Err(FrostError::ZeroParameter(t, n))?;
|
||||
}
|
||||
@@ -46,12 +45,18 @@ impl FrostParams {
|
||||
Err(FrostError::InvalidParticipantIndex(n, i))?;
|
||||
}
|
||||
|
||||
Ok(FrostParams{ t, n, i })
|
||||
Ok(FrostParams { t, n, i })
|
||||
}
|
||||
|
||||
pub fn t(&self) -> u16 { self.t }
|
||||
pub fn n(&self) -> u16 { self.n }
|
||||
pub fn i(&self) -> u16 { self.i }
|
||||
pub fn t(&self) -> u16 {
|
||||
self.t
|
||||
}
|
||||
pub fn n(&self) -> u16 {
|
||||
self.n
|
||||
}
|
||||
pub fn i(&self) -> u16 {
|
||||
self.i
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Copy, Clone, Error, Debug)]
|
||||
@@ -112,10 +117,7 @@ impl<C: Curve> FrostView<C> {
|
||||
}
|
||||
|
||||
/// Calculate the lagrange coefficient for a signing set
|
||||
pub fn lagrange<F: PrimeField>(
|
||||
i: u16,
|
||||
included: &[u16],
|
||||
) -> F {
|
||||
pub fn lagrange<F: PrimeField>(i: u16, included: &[u16]) -> F {
|
||||
let mut num = F::one();
|
||||
let mut denom = F::one();
|
||||
for l in included {
|
||||
@@ -192,12 +194,13 @@ impl<C: Curve> FrostKeys<C> {
|
||||
Ok(FrostView {
|
||||
group_key: self.group_key,
|
||||
secret_share: secret_share + offset_share,
|
||||
verification_shares: self.verification_shares.iter().map(
|
||||
|(l, share)| (
|
||||
*l,
|
||||
(*share * lagrange::<C::F>(*l, &included)) + (C::GENERATOR * offset_share)
|
||||
)
|
||||
).collect(),
|
||||
verification_shares: self
|
||||
.verification_shares
|
||||
.iter()
|
||||
.map(|(l, share)| {
|
||||
(*l, (*share * lagrange::<C::F>(*l, &included)) + (C::GENERATOR * offset_share))
|
||||
})
|
||||
.collect(),
|
||||
included: included.to_vec(),
|
||||
})
|
||||
}
|
||||
@@ -242,36 +245,35 @@ impl<C: Curve> FrostKeys<C> {
|
||||
let (t, n, i) = {
|
||||
let mut read_u16 = || {
|
||||
let mut value = [0; 2];
|
||||
cursor.read_exact(&mut value).map_err(
|
||||
|_| FrostError::InternalError("missing participant quantities")
|
||||
)?;
|
||||
cursor
|
||||
.read_exact(&mut value)
|
||||
.map_err(|_| FrostError::InternalError("missing participant quantities"))?;
|
||||
Ok(u16::from_be_bytes(value))
|
||||
};
|
||||
(read_u16()?, read_u16()?, read_u16()?)
|
||||
};
|
||||
|
||||
let secret_share = C::read_F(cursor)
|
||||
.map_err(|_| FrostError::InternalError("invalid secret share"))?;
|
||||
let group_key = C::read_G(cursor).map_err(|_| FrostError::InternalError("invalid group key"))?;
|
||||
let secret_share =
|
||||
C::read_F(cursor).map_err(|_| FrostError::InternalError("invalid secret share"))?;
|
||||
let group_key =
|
||||
C::read_G(cursor).map_err(|_| FrostError::InternalError("invalid group key"))?;
|
||||
|
||||
let mut verification_shares = HashMap::new();
|
||||
for l in 1 ..= n {
|
||||
verification_shares.insert(
|
||||
l,
|
||||
C::read_G(cursor).map_err(|_| FrostError::InternalError("invalid verification share"))?
|
||||
C::read_G(cursor).map_err(|_| FrostError::InternalError("invalid verification share"))?,
|
||||
);
|
||||
}
|
||||
|
||||
Ok(
|
||||
FrostKeys {
|
||||
params: FrostParams::new(t, n, i)
|
||||
.map_err(|_| FrostError::InternalError("invalid parameters"))?,
|
||||
secret_share,
|
||||
group_key,
|
||||
verification_shares,
|
||||
offset: None
|
||||
}
|
||||
)
|
||||
Ok(FrostKeys {
|
||||
params: FrostParams::new(t, n, i)
|
||||
.map_err(|_| FrostError::InternalError("invalid parameters"))?,
|
||||
secret_share,
|
||||
group_key,
|
||||
verification_shares,
|
||||
offset: None,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -279,7 +281,7 @@ impl<C: Curve> FrostKeys<C> {
|
||||
pub(crate) fn validate_map<T>(
|
||||
map: &mut HashMap<u16, T>,
|
||||
included: &[u16],
|
||||
ours: u16
|
||||
ours: u16,
|
||||
) -> Result<(), FrostError> {
|
||||
if (map.len() + 1) != included.len() {
|
||||
Err(FrostError::InvalidParticipantQuantity(included.len(), map.len() + 1))?;
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use group::{ff::{Field, PrimeField}, GroupEncoding};
|
||||
use group::{
|
||||
ff::{Field, PrimeField},
|
||||
GroupEncoding,
|
||||
};
|
||||
|
||||
use multiexp::BatchVerifier;
|
||||
|
||||
@@ -25,26 +28,23 @@ impl<C: Curve> SchnorrSignature<C> {
|
||||
pub(crate) fn sign<C: Curve>(
|
||||
private_key: C::F,
|
||||
nonce: C::F,
|
||||
challenge: C::F
|
||||
challenge: C::F,
|
||||
) -> SchnorrSignature<C> {
|
||||
SchnorrSignature {
|
||||
R: C::GENERATOR * nonce,
|
||||
s: nonce + (private_key * challenge)
|
||||
}
|
||||
SchnorrSignature { R: C::GENERATOR * nonce, s: nonce + (private_key * challenge) }
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub(crate) fn verify<C: Curve>(
|
||||
public_key: C::G,
|
||||
challenge: C::F,
|
||||
signature: &SchnorrSignature<C>
|
||||
signature: &SchnorrSignature<C>,
|
||||
) -> bool {
|
||||
(C::GENERATOR * signature.s) == (signature.R + (public_key * challenge))
|
||||
}
|
||||
|
||||
pub(crate) fn batch_verify<C: Curve, R: RngCore + CryptoRng>(
|
||||
rng: &mut R,
|
||||
triplets: &[(u16, C::G, C::F, SchnorrSignature<C>)]
|
||||
triplets: &[(u16, C::G, C::F, SchnorrSignature<C>)],
|
||||
) -> Result<(), u16> {
|
||||
let mut values = [(C::F::one(), C::GENERATOR); 3];
|
||||
let mut batch = BatchVerifier::new(triplets.len());
|
||||
|
||||
@@ -1,20 +1,24 @@
|
||||
use core::fmt;
|
||||
use std::{io::{Read, Cursor}, sync::Arc, collections::HashMap};
|
||||
use std::{
|
||||
io::{Read, Cursor},
|
||||
sync::Arc,
|
||||
collections::HashMap,
|
||||
};
|
||||
|
||||
use rand_core::{RngCore, CryptoRng};
|
||||
|
||||
use transcript::Transcript;
|
||||
|
||||
use group::{ff::{Field, PrimeField}, Group, GroupEncoding};
|
||||
use group::{
|
||||
ff::{Field, PrimeField},
|
||||
Group, GroupEncoding,
|
||||
};
|
||||
use multiexp::multiexp_vartime;
|
||||
|
||||
use dleq::DLEqProof;
|
||||
|
||||
use crate::{
|
||||
curve::Curve,
|
||||
FrostError, FrostParams, FrostKeys, FrostView,
|
||||
algorithm::Algorithm,
|
||||
validate_map
|
||||
curve::Curve, FrostError, FrostParams, FrostKeys, FrostView, algorithm::Algorithm, validate_map,
|
||||
};
|
||||
|
||||
/// Pairing of an Algorithm with a FrostKeys instance and this specific signing set
|
||||
@@ -88,11 +92,14 @@ fn preprocess<R: RngCore + CryptoRng, C: Curve, A: Algorithm<C>>(
|
||||
params: &mut Params<C, A>,
|
||||
) -> (PreprocessPackage<C>, Vec<u8>) {
|
||||
let mut serialized = Vec::with_capacity(2 * C::G_len());
|
||||
let (nonces, commitments) = params.algorithm.nonces().iter().map(
|
||||
|generators| {
|
||||
let (nonces, commitments) = params
|
||||
.algorithm
|
||||
.nonces()
|
||||
.iter()
|
||||
.map(|generators| {
|
||||
let nonces = [
|
||||
C::random_nonce(params.view().secret_share(), &mut *rng),
|
||||
C::random_nonce(params.view().secret_share(), &mut *rng)
|
||||
C::random_nonce(params.view().secret_share(), &mut *rng),
|
||||
];
|
||||
|
||||
let commit = |generator: C::G, buf: &mut Vec<u8>| {
|
||||
@@ -116,18 +123,15 @@ fn preprocess<R: RngCore + CryptoRng, C: Curve, A: Algorithm<C>>(
|
||||
// This could be further optimized with a multi-nonce proof.
|
||||
// See https://github.com/serai-dex/serai/issues/38
|
||||
for nonce in nonces {
|
||||
DLEqProof::prove(
|
||||
&mut *rng,
|
||||
&mut transcript,
|
||||
&generators,
|
||||
nonce
|
||||
).serialize(&mut serialized).unwrap();
|
||||
DLEqProof::prove(&mut *rng, &mut transcript, &generators, nonce)
|
||||
.serialize(&mut serialized)
|
||||
.unwrap();
|
||||
}
|
||||
}
|
||||
|
||||
(nonces, commitments)
|
||||
}
|
||||
).unzip();
|
||||
})
|
||||
.unzip();
|
||||
|
||||
let addendum = params.algorithm.preprocess_addendum(rng, ¶ms.view);
|
||||
serialized.extend(&addendum);
|
||||
@@ -139,7 +143,7 @@ fn preprocess<R: RngCore + CryptoRng, C: Curve, A: Algorithm<C>>(
|
||||
fn read_D_E<Re: Read, C: Curve>(cursor: &mut Re, l: u16) -> Result<[C::G; 2], FrostError> {
|
||||
Ok([
|
||||
C::read_G(cursor).map_err(|_| FrostError::InvalidCommitment(l))?,
|
||||
C::read_G(cursor).map_err(|_| FrostError::InvalidCommitment(l))?
|
||||
C::read_G(cursor).map_err(|_| FrostError::InvalidCommitment(l))?,
|
||||
])
|
||||
}
|
||||
|
||||
@@ -197,7 +201,7 @@ fn sign_with_share<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
params.algorithm.process_addendum(
|
||||
¶ms.view,
|
||||
*l,
|
||||
&mut Cursor::new(our_preprocess.addendum.clone())
|
||||
&mut Cursor::new(our_preprocess.addendum.clone()),
|
||||
)?;
|
||||
} else {
|
||||
let mut cursor = commitments.remove(l).unwrap();
|
||||
@@ -213,13 +217,14 @@ fn sign_with_share<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
if nonce_generators.len() >= 2 {
|
||||
let mut transcript = nonce_transcript::<A::Transcript>();
|
||||
for de in 0 .. 2 {
|
||||
DLEqProof::deserialize(
|
||||
&mut cursor
|
||||
).map_err(|_| FrostError::InvalidCommitment(*l))?.verify(
|
||||
&mut transcript,
|
||||
&nonce_generators,
|
||||
&commitments[n].iter().map(|commitments| commitments[de]).collect::<Vec<_>>(),
|
||||
).map_err(|_| FrostError::InvalidCommitment(*l))?;
|
||||
DLEqProof::deserialize(&mut cursor)
|
||||
.map_err(|_| FrostError::InvalidCommitment(*l))?
|
||||
.verify(
|
||||
&mut transcript,
|
||||
&nonce_generators,
|
||||
&commitments[n].iter().map(|commitments| commitments[de]).collect::<Vec<_>>(),
|
||||
)
|
||||
.map_err(|_| FrostError::InvalidCommitment(*l))?;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -236,7 +241,7 @@ fn sign_with_share<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
// protocol
|
||||
rho_transcript.append_message(
|
||||
b"commitments",
|
||||
&C::hash_msg(params.algorithm.transcript().challenge(b"commitments").as_ref())
|
||||
&C::hash_msg(params.algorithm.transcript().challenge(b"commitments").as_ref()),
|
||||
);
|
||||
// Include the offset, if one exists
|
||||
// While this isn't part of the FROST-expected rho transcript, the offset being here coincides
|
||||
@@ -254,10 +259,10 @@ fn sign_with_share<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
|
||||
// Merge the rho transcript back into the global one to ensure its advanced while committing to
|
||||
// everything
|
||||
params.algorithm.transcript().append_message(
|
||||
b"rho_transcript",
|
||||
rho_transcript.challenge(b"merge").as_ref()
|
||||
);
|
||||
params
|
||||
.algorithm
|
||||
.transcript()
|
||||
.append_message(b"rho_transcript", rho_transcript.challenge(b"merge").as_ref());
|
||||
}
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
@@ -280,10 +285,12 @@ fn sign_with_share<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
let share = params.algorithm.sign_share(
|
||||
¶ms.view,
|
||||
&Rs,
|
||||
&our_preprocess.nonces.iter().map(
|
||||
|nonces| nonces[0] + (nonces[1] * B[¶ms.keys.params.i()].1)
|
||||
).collect::<Vec<_>>(),
|
||||
msg
|
||||
&our_preprocess
|
||||
.nonces
|
||||
.iter()
|
||||
.map(|nonces| nonces[0] + (nonces[1] * B[¶ms.keys.params.i()].1))
|
||||
.collect::<Vec<_>>(),
|
||||
msg,
|
||||
);
|
||||
Ok((Package { B, Rs, share }, share.to_repr().as_ref().to_vec()))
|
||||
}
|
||||
@@ -321,21 +328,21 @@ fn complete<Re: Read, C: Curve, A: Algorithm<C>>(
|
||||
for l in &sign_params.view.included {
|
||||
if !sign_params.algorithm.verify_share(
|
||||
sign_params.view.verification_share(*l),
|
||||
&sign.B[l].0.iter().map(
|
||||
|nonces| nonces.iter().map(
|
||||
|commitments| commitments[0] + (commitments[1] * sign.B[l].1)
|
||||
).collect()
|
||||
).collect::<Vec<_>>(),
|
||||
responses[l]
|
||||
&sign.B[l]
|
||||
.0
|
||||
.iter()
|
||||
.map(|nonces| {
|
||||
nonces.iter().map(|commitments| commitments[0] + (commitments[1] * sign.B[l].1)).collect()
|
||||
})
|
||||
.collect::<Vec<_>>(),
|
||||
responses[l],
|
||||
) {
|
||||
Err(FrostError::InvalidShare(*l))?;
|
||||
}
|
||||
}
|
||||
|
||||
// If everyone has a valid share and there were enough participants, this should've worked
|
||||
Err(
|
||||
FrostError::InternalError("everyone had a valid share yet the signature was still invalid")
|
||||
)
|
||||
Err(FrostError::InternalError("everyone had a valid share yet the signature was still invalid"))
|
||||
}
|
||||
|
||||
pub trait PreprocessMachine {
|
||||
@@ -345,10 +352,7 @@ pub trait PreprocessMachine {
|
||||
/// Perform the preprocessing round required in order to sign
|
||||
/// Returns a byte vector which must be transmitted to all parties selected for this signing
|
||||
/// process, over an authenticated channel
|
||||
fn preprocess<R: RngCore + CryptoRng>(
|
||||
self,
|
||||
rng: &mut R
|
||||
) -> (Self::SignMachine, Vec<u8>);
|
||||
fn preprocess<R: RngCore + CryptoRng>(self, rng: &mut R) -> (Self::SignMachine, Vec<u8>);
|
||||
}
|
||||
|
||||
pub trait SignMachine<S> {
|
||||
@@ -376,7 +380,7 @@ pub trait SignatureMachine<S> {
|
||||
|
||||
/// State machine which manages signing for an arbitrary signature algorithm
|
||||
pub struct AlgorithmMachine<C: Curve, A: Algorithm<C>> {
|
||||
params: Params<C, A>
|
||||
params: Params<C, A>,
|
||||
}
|
||||
|
||||
pub struct AlgorithmSignMachine<C: Curve, A: Algorithm<C>> {
|
||||
@@ -401,7 +405,7 @@ impl<C: Curve, A: Algorithm<C>> AlgorithmMachine<C, A> {
|
||||
|
||||
pub(crate) fn unsafe_override_preprocess(
|
||||
self,
|
||||
preprocess: PreprocessPackage<C>
|
||||
preprocess: PreprocessPackage<C>,
|
||||
) -> AlgorithmSignMachine<C, A> {
|
||||
AlgorithmSignMachine { params: self.params, preprocess }
|
||||
}
|
||||
@@ -411,10 +415,7 @@ impl<C: Curve, A: Algorithm<C>> PreprocessMachine for AlgorithmMachine<C, A> {
|
||||
type Signature = A::Signature;
|
||||
type SignMachine = AlgorithmSignMachine<C, A>;
|
||||
|
||||
fn preprocess<R: RngCore + CryptoRng>(
|
||||
self,
|
||||
rng: &mut R
|
||||
) -> (Self::SignMachine, Vec<u8>) {
|
||||
fn preprocess<R: RngCore + CryptoRng>(self, rng: &mut R) -> (Self::SignMachine, Vec<u8>) {
|
||||
let mut params = self.params;
|
||||
let (preprocess, serialized) = preprocess::<R, C, A>(rng, &mut params);
|
||||
(AlgorithmSignMachine { params, preprocess }, serialized)
|
||||
@@ -427,7 +428,7 @@ impl<C: Curve, A: Algorithm<C>> SignMachine<A::Signature> for AlgorithmSignMachi
|
||||
fn sign<Re: Read>(
|
||||
self,
|
||||
commitments: HashMap<u16, Re>,
|
||||
msg: &[u8]
|
||||
msg: &[u8],
|
||||
) -> Result<(Self::SignatureMachine, Vec<u8>), FrostError> {
|
||||
let mut params = self.params;
|
||||
let (sign, serialized) = sign_with_share(&mut params, self.preprocess, commitments, msg)?;
|
||||
@@ -435,10 +436,7 @@ impl<C: Curve, A: Algorithm<C>> SignMachine<A::Signature> for AlgorithmSignMachi
|
||||
}
|
||||
}
|
||||
|
||||
impl<
|
||||
C: Curve,
|
||||
A: Algorithm<C>
|
||||
> SignatureMachine<A::Signature> for AlgorithmSignatureMachine<C, A> {
|
||||
impl<C: Curve, A: Algorithm<C>> SignatureMachine<A::Signature> for AlgorithmSignatureMachine<C, A> {
|
||||
fn complete<Re: Read>(self, shares: HashMap<u16, Re>) -> Result<A::Signature, FrostError> {
|
||||
complete(&self.params, self.sign, shares)
|
||||
}
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
use rand::rngs::OsRng;
|
||||
|
||||
use crate::{curve, tests::vectors::{Vectors, test_with_vectors}};
|
||||
use crate::{
|
||||
curve,
|
||||
tests::vectors::{Vectors, test_with_vectors},
|
||||
};
|
||||
|
||||
#[cfg(any(test, feature = "ristretto"))]
|
||||
#[test]
|
||||
@@ -12,7 +15,7 @@ fn ristretto_vectors() {
|
||||
shares: &[
|
||||
"5c3430d391552f6e60ecdc093ff9f6f4488756aa6cebdbad75a768010b8f830e",
|
||||
"b06fc5eac20b4f6e1b271d9df2343d843e1e1fb03c4cbb673f2872d459ce6f01",
|
||||
"f17e505f0e2581c6acfe54d3846a622834b5e7b50cad9a2109a97ba7a80d5c04"
|
||||
"f17e505f0e2581c6acfe54d3846a622834b5e7b50cad9a2109a97ba7a80d5c04",
|
||||
],
|
||||
group_secret: "1b25a55e463cfd15cf14a5d3acc3d15053f08da49c8afcf3ab265f2ebc4f970b",
|
||||
group_key: "e2a62f39eede11269e3bd5a7d97554f5ca384f9f6d3dd9c3c0d05083c7254f57",
|
||||
@@ -22,20 +25,20 @@ fn ristretto_vectors() {
|
||||
nonces: &[
|
||||
[
|
||||
"eb0dc12ae7b746d36e3f2de46ce3833a05b9d4af5434eeb8cafaefda76906d00",
|
||||
"491e91aa9df514ef598d5e0c7c5cdd088fbde4965b96069d546c0f04f1822b03"
|
||||
"491e91aa9df514ef598d5e0c7c5cdd088fbde4965b96069d546c0f04f1822b03",
|
||||
],
|
||||
[
|
||||
"abd12b8e6f255ee1e540eab029003a6e956567617720f61115f0941615892209",
|
||||
"218e22625f93f262f025bd2d13c46ba722aa29fe585ceed66ff442d98fe4e509"
|
||||
]
|
||||
"218e22625f93f262f025bd2d13c46ba722aa29fe585ceed66ff442d98fe4e509",
|
||||
],
|
||||
],
|
||||
sig_shares: &[
|
||||
"efae3a83437fa8cd96194aacc56a7eb841630c280da99e7764a81d1340323306",
|
||||
"96ddc4582e45eabce46f07b9e9375f8b49d35d1510fd34ac02b1e79d6100a602"
|
||||
"96ddc4582e45eabce46f07b9e9375f8b49d35d1510fd34ac02b1e79d6100a602",
|
||||
],
|
||||
sig: "7ec584cef9a383afb43883b73bcaa6313afe878bd5fe75a608311b866a76ec67".to_owned() +
|
||||
"858cffdb71c4928a7b895165afa2dd438b366a3d1da6d323675905b1a132d908"
|
||||
}
|
||||
"858cffdb71c4928a7b895165afa2dd438b366a3d1da6d323675905b1a132d908",
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
@@ -49,7 +52,7 @@ fn ed25519_vectors() {
|
||||
shares: &[
|
||||
"929dcc590407aae7d388761cddb0c0db6f5627aea8e217f4a033f2ec83d93509",
|
||||
"a91e66e012e4364ac9aaa405fcafd370402d9859f7b6685c07eed76bf409e80d",
|
||||
"d3cb090a075eb154e82fdb4b3cb507f110040905468bb9c46da8bdea643a9a02"
|
||||
"d3cb090a075eb154e82fdb4b3cb507f110040905468bb9c46da8bdea643a9a02",
|
||||
],
|
||||
group_secret: "7b1c33d3f5291d85de664833beb1ad469f7fb6025a0ec78b3a790c6e13a98304",
|
||||
group_key: "15d21ccd7ee42959562fc8aa63224c8851fb3ec85a3faf66040d380fb9738673",
|
||||
@@ -59,19 +62,19 @@ fn ed25519_vectors() {
|
||||
nonces: &[
|
||||
[
|
||||
"d9aad97e1a1127bb87702ce8d81d8c07c7cbca89e784868d8e3876ff6b459700",
|
||||
"5063be2774520d08a5ccd7f1213fb1179a5fa292bf13bc91cb28e7bd4d4a690c"
|
||||
"5063be2774520d08a5ccd7f1213fb1179a5fa292bf13bc91cb28e7bd4d4a690c",
|
||||
],
|
||||
[
|
||||
"86961f3a429ac0c5696f49e6d796817ff653f83c07f34e9e1f4d4c8c515b7900",
|
||||
"72225ec11c1315d9f1ea0e78b1160ed95800fadd0191d23fd2f2c90ac96cb307"
|
||||
]
|
||||
"72225ec11c1315d9f1ea0e78b1160ed95800fadd0191d23fd2f2c90ac96cb307",
|
||||
],
|
||||
],
|
||||
sig_shares: &[
|
||||
"caae171b83bff0c2c6f56a1276892918ba228146f6344b85d2ec6efeb6f16d0d",
|
||||
"ea6fdbf61683cf5f1f742e1b91583f0f667f0369efd2e33399b96d5a3ff0300d"
|
||||
"ea6fdbf61683cf5f1f742e1b91583f0f667f0369efd2e33399b96d5a3ff0300d",
|
||||
],
|
||||
sig: "5da10008c13c04dd72328ba8e0f72b63cad43c3bf4b7eaada1c78225afbd977e".to_owned() +
|
||||
"c74afdb47fdfadca0fcda18a28e8891220a284afe5072fb96ba6dc58f6e19e0a"
|
||||
}
|
||||
"c74afdb47fdfadca0fcda18a28e8891220a284afe5072fb96ba6dc58f6e19e0a",
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
@@ -19,7 +19,7 @@ fn secp256k1_non_ietf() {
|
||||
shares: &[
|
||||
"08f89ffe80ac94dcb920c26f3f46140bfc7f95b493f8310f5fc1ea2b01f4254c",
|
||||
"04f0feac2edcedc6ce1253b7fab8c86b856a797f44d83d82a385554e6e401984",
|
||||
"00e95d59dd0d46b0e303e500b62b7ccb0e555d49f5b849f5e748c071da8c0dbc"
|
||||
"00e95d59dd0d46b0e303e500b62b7ccb0e555d49f5b849f5e748c071da8c0dbc",
|
||||
],
|
||||
group_secret: "0d004150d27c3bf2a42f312683d35fac7394b1e9e318249c1bfe7f0795a83114",
|
||||
group_key: "02f37c34b66ced1fb51c34a90bdae006901f10625cc06c4f64663b0eae87d87b4f",
|
||||
@@ -29,20 +29,20 @@ fn secp256k1_non_ietf() {
|
||||
nonces: &[
|
||||
[
|
||||
"31c3c1b76b76664569859b9251fbabed9d4d432c6f5aaa03ed41f9c231935798",
|
||||
"206f4ffaeb602ccb57cbe50e146ac690e6d7317d4b93377061d9d1b4caf78a26"
|
||||
"206f4ffaeb602ccb57cbe50e146ac690e6d7317d4b93377061d9d1b4caf78a26",
|
||||
],
|
||||
[
|
||||
"0d3945bc1553676a5dd910cb4f14437d99ed421516b2617357b984820fdca520",
|
||||
"635e0fd90caaf40b5e986d0ee0f58778e4d88731bc6ac70350ef702ffe20a21b"
|
||||
]
|
||||
"635e0fd90caaf40b5e986d0ee0f58778e4d88731bc6ac70350ef702ffe20a21b",
|
||||
],
|
||||
],
|
||||
sig_shares: &[
|
||||
"18b71e284c5d008896ed8847b234ec829eda376d6208838ee7faf2ce21b154c1",
|
||||
"a452a49c8116124d0a283f3589a96b704894b43246e47e59d376353bcc638311"
|
||||
"a452a49c8116124d0a283f3589a96b704894b43246e47e59d376353bcc638311",
|
||||
],
|
||||
sig: "03dafb28ee7ad033fd15ed470d07156617260d74a9d76a15d371d7b613d2b111e".to_owned() +
|
||||
"7bd09c2c4cd7312d5a115c77d3bde57f2e76eeb9fa8ed01e8bb712809ee14d7d2"
|
||||
}
|
||||
"7bd09c2c4cd7312d5a115c77d3bde57f2e76eeb9fa8ed01e8bb712809ee14d7d2",
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
@@ -56,7 +56,7 @@ fn p256_vectors() {
|
||||
shares: &[
|
||||
"0c9c1a0fe806c184add50bbdcac913dda73e482daf95dcb9f35dbb0d8a9f7731",
|
||||
"8d8e787bef0ff6c2f494ca45f4dad198c6bee01212d6c84067159c52e1863ad5",
|
||||
"0e80d6e8f6192c003b5488ce1eec8f5429587d48cf001541e713b2d53c09d928"
|
||||
"0e80d6e8f6192c003b5488ce1eec8f5429587d48cf001541e713b2d53c09d928",
|
||||
],
|
||||
group_secret: "8ba9bba2e0fd8c4767154d35a0b7562244a4aaf6f36c8fb8735fa48b301bd8de",
|
||||
group_key: "023a309ad94e9fe8a7ba45dfc58f38bf091959d3c99cfbd02b4dc00585ec45ab70",
|
||||
@@ -66,19 +66,19 @@ fn p256_vectors() {
|
||||
nonces: &[
|
||||
[
|
||||
"33a519cf070a166f9ef41a798d03423743f3e7d0b0efd5d0d963773c4c53205e",
|
||||
"307d208d0c5728f323ae374f1ebd7f14a1a49b77d9d4bc1eab222218a17765ff"
|
||||
"307d208d0c5728f323ae374f1ebd7f14a1a49b77d9d4bc1eab222218a17765ff",
|
||||
],
|
||||
[
|
||||
"a614eadb972dc37b88aeceb6e899903f3104742d13f379a0e014541decbea4a4",
|
||||
"e509791018504c5bb87edaf0f44761cc840888507c4cd80237971d78e65f70f2"
|
||||
]
|
||||
"e509791018504c5bb87edaf0f44761cc840888507c4cd80237971d78e65f70f2",
|
||||
],
|
||||
],
|
||||
sig_shares: &[
|
||||
"61e8b9c474df2e66ad19fd80a6e6cec1c6fe43c0a1cffd2d1c28299e93e1bbdb",
|
||||
"9651d355ca1dea2557ba1f73e38a9f4ff1f1afc565323ef27f88a9d14df8370e"
|
||||
"9651d355ca1dea2557ba1f73e38a9f4ff1f1afc565323ef27f88a9d14df8370e",
|
||||
],
|
||||
sig: "02dfba781e17b830229ae4ed22ebe402873683d9dfd945d01762217fb3172c2a7".to_owned() +
|
||||
"1f83a8d1a3efd188c04d41cf48a716e11b8eff38607023c1f9bb0d36fe1d9f2e9"
|
||||
}
|
||||
"1f83a8d1a3efd188c04d41cf48a716e11b8eff38607023c1f9bb0d36fe1d9f2e9",
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
@@ -5,12 +5,10 @@ use rand_core::{RngCore, CryptoRng};
|
||||
use group::ff::Field;
|
||||
|
||||
use crate::{
|
||||
Curve,
|
||||
FrostParams, FrostKeys,
|
||||
lagrange,
|
||||
Curve, FrostParams, FrostKeys, lagrange,
|
||||
key_gen::KeyGenMachine,
|
||||
algorithm::Algorithm,
|
||||
sign::{PreprocessMachine, SignMachine, SignatureMachine, AlgorithmMachine}
|
||||
sign::{PreprocessMachine, SignMachine, SignatureMachine, AlgorithmMachine},
|
||||
};
|
||||
|
||||
// Test suites for public usage
|
||||
@@ -27,22 +25,20 @@ pub const THRESHOLD: u16 = ((PARTICIPANTS / 3) * 2) + 1;
|
||||
|
||||
pub fn clone_without<K: Clone + std::cmp::Eq + std::hash::Hash, V: Clone>(
|
||||
map: &HashMap<K, V>,
|
||||
without: &K
|
||||
without: &K,
|
||||
) -> HashMap<K, V> {
|
||||
let mut res = map.clone();
|
||||
res.remove(without).unwrap();
|
||||
res
|
||||
}
|
||||
|
||||
pub fn key_gen<R: RngCore + CryptoRng, C: Curve>(
|
||||
rng: &mut R
|
||||
) -> HashMap<u16, Arc<FrostKeys<C>>> {
|
||||
pub fn key_gen<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) -> HashMap<u16, Arc<FrostKeys<C>>> {
|
||||
let mut machines = HashMap::new();
|
||||
let mut commitments = HashMap::new();
|
||||
for i in 1 ..= PARTICIPANTS {
|
||||
let machine = KeyGenMachine::<C>::new(
|
||||
FrostParams::new(THRESHOLD, PARTICIPANTS, i).unwrap(),
|
||||
"FROST Test key_gen".to_string()
|
||||
"FROST Test key_gen".to_string(),
|
||||
);
|
||||
let (machine, these_commitments) = machine.generate_coefficients(rng);
|
||||
machines.insert(i, machine);
|
||||
@@ -50,41 +46,45 @@ pub fn key_gen<R: RngCore + CryptoRng, C: Curve>(
|
||||
}
|
||||
|
||||
let mut secret_shares = HashMap::new();
|
||||
let mut machines = machines.drain().map(|(l, machine)| {
|
||||
let (machine, shares) = machine.generate_secret_shares(
|
||||
rng,
|
||||
clone_without(&commitments, &l)
|
||||
).unwrap();
|
||||
secret_shares.insert(l, shares);
|
||||
(l, machine)
|
||||
}).collect::<HashMap<_, _>>();
|
||||
let mut machines = machines
|
||||
.drain()
|
||||
.map(|(l, machine)| {
|
||||
let (machine, shares) =
|
||||
machine.generate_secret_shares(rng, clone_without(&commitments, &l)).unwrap();
|
||||
secret_shares.insert(l, shares);
|
||||
(l, machine)
|
||||
})
|
||||
.collect::<HashMap<_, _>>();
|
||||
|
||||
let mut verification_shares = None;
|
||||
let mut group_key = None;
|
||||
machines.drain().map(|(i, machine)| {
|
||||
let mut our_secret_shares = HashMap::new();
|
||||
for (l, shares) in &secret_shares {
|
||||
if i == *l {
|
||||
continue;
|
||||
machines
|
||||
.drain()
|
||||
.map(|(i, machine)| {
|
||||
let mut our_secret_shares = HashMap::new();
|
||||
for (l, shares) in &secret_shares {
|
||||
if i == *l {
|
||||
continue;
|
||||
}
|
||||
our_secret_shares.insert(*l, Cursor::new(shares[&i].clone()));
|
||||
}
|
||||
our_secret_shares.insert(*l, Cursor::new(shares[&i].clone()));
|
||||
}
|
||||
let these_keys = machine.complete(rng, our_secret_shares).unwrap();
|
||||
let these_keys = machine.complete(rng, our_secret_shares).unwrap();
|
||||
|
||||
// Verify the verification_shares are agreed upon
|
||||
if verification_shares.is_none() {
|
||||
verification_shares = Some(these_keys.verification_shares());
|
||||
}
|
||||
assert_eq!(verification_shares.as_ref().unwrap(), &these_keys.verification_shares());
|
||||
// Verify the verification_shares are agreed upon
|
||||
if verification_shares.is_none() {
|
||||
verification_shares = Some(these_keys.verification_shares());
|
||||
}
|
||||
assert_eq!(verification_shares.as_ref().unwrap(), &these_keys.verification_shares());
|
||||
|
||||
// Verify the group keys are agreed upon
|
||||
if group_key.is_none() {
|
||||
group_key = Some(these_keys.group_key());
|
||||
}
|
||||
assert_eq!(group_key.unwrap(), these_keys.group_key());
|
||||
// Verify the group keys are agreed upon
|
||||
if group_key.is_none() {
|
||||
group_key = Some(these_keys.group_key());
|
||||
}
|
||||
assert_eq!(group_key.unwrap(), these_keys.group_key());
|
||||
|
||||
(i, Arc::new(these_keys))
|
||||
}).collect::<HashMap<_, _>>()
|
||||
(i, Arc::new(these_keys))
|
||||
})
|
||||
.collect::<HashMap<_, _>>()
|
||||
}
|
||||
|
||||
pub fn recover<C: Curve>(keys: &HashMap<u16, FrostKeys<C>>) -> C::F {
|
||||
@@ -92,10 +92,9 @@ pub fn recover<C: Curve>(keys: &HashMap<u16, FrostKeys<C>>) -> C::F {
|
||||
assert!(keys.len() >= first.params().t().into(), "not enough keys provided");
|
||||
let included = keys.keys().cloned().collect::<Vec<_>>();
|
||||
|
||||
let group_private = keys.iter().fold(
|
||||
C::F::zero(),
|
||||
|accum, (i, keys)| accum + (keys.secret_share() * lagrange::<C::F>(*i, &included))
|
||||
);
|
||||
let group_private = keys.iter().fold(C::F::zero(), |accum, (i, keys)| {
|
||||
accum + (keys.secret_share() * lagrange::<C::F>(*i, &included))
|
||||
});
|
||||
assert_eq!(C::GENERATOR * group_private, first.group_key(), "failed to recover keys");
|
||||
group_private
|
||||
}
|
||||
@@ -114,40 +113,45 @@ pub fn algorithm_machines<R: RngCore, C: Curve, A: Algorithm<C>>(
|
||||
included.push(n);
|
||||
}
|
||||
|
||||
keys.iter().filter_map(
|
||||
|(i, keys)| if included.contains(&i) {
|
||||
Some((
|
||||
*i,
|
||||
AlgorithmMachine::new(
|
||||
algorithm.clone(),
|
||||
keys.clone(),
|
||||
&included.clone()
|
||||
).unwrap()
|
||||
))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
).collect()
|
||||
keys
|
||||
.iter()
|
||||
.filter_map(|(i, keys)| {
|
||||
if included.contains(&i) {
|
||||
Some((
|
||||
*i,
|
||||
AlgorithmMachine::new(algorithm.clone(), keys.clone(), &included.clone()).unwrap(),
|
||||
))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
pub fn sign<R: RngCore + CryptoRng, M: PreprocessMachine>(
|
||||
rng: &mut R,
|
||||
mut machines: HashMap<u16, M>,
|
||||
msg: &[u8]
|
||||
msg: &[u8],
|
||||
) -> M::Signature {
|
||||
let mut commitments = HashMap::new();
|
||||
let mut machines = machines.drain().map(|(i, machine)| {
|
||||
let (machine, preprocess) = machine.preprocess(rng);
|
||||
commitments.insert(i, Cursor::new(preprocess));
|
||||
(i, machine)
|
||||
}).collect::<HashMap<_, _>>();
|
||||
let mut machines = machines
|
||||
.drain()
|
||||
.map(|(i, machine)| {
|
||||
let (machine, preprocess) = machine.preprocess(rng);
|
||||
commitments.insert(i, Cursor::new(preprocess));
|
||||
(i, machine)
|
||||
})
|
||||
.collect::<HashMap<_, _>>();
|
||||
|
||||
let mut shares = HashMap::new();
|
||||
let mut machines = machines.drain().map(|(i, machine)| {
|
||||
let (machine, share) = machine.sign(clone_without(&commitments, &i), msg).unwrap();
|
||||
shares.insert(i, Cursor::new(share));
|
||||
(i, machine)
|
||||
}).collect::<HashMap<_, _>>();
|
||||
let mut machines = machines
|
||||
.drain()
|
||||
.map(|(i, machine)| {
|
||||
let (machine, share) = machine.sign(clone_without(&commitments, &i), msg).unwrap();
|
||||
shares.insert(i, Cursor::new(share));
|
||||
(i, machine)
|
||||
})
|
||||
.collect::<HashMap<_, _>>();
|
||||
|
||||
let mut signature = None;
|
||||
for (i, machine) in machines.drain() {
|
||||
|
||||
@@ -5,34 +5,32 @@ use rand_core::{RngCore, CryptoRng};
|
||||
use group::{ff::Field, GroupEncoding};
|
||||
|
||||
use crate::{
|
||||
Curve, FrostKeys, schnorr::{self, SchnorrSignature}, algorithm::{Hram, Schnorr},
|
||||
tests::{key_gen, algorithm_machines, sign as sign_test}
|
||||
Curve, FrostKeys,
|
||||
schnorr::{self, SchnorrSignature},
|
||||
algorithm::{Hram, Schnorr},
|
||||
tests::{key_gen, algorithm_machines, sign as sign_test},
|
||||
};
|
||||
|
||||
pub(crate) fn core_sign<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
|
||||
let private_key = C::F::random(&mut *rng);
|
||||
let nonce = C::F::random(&mut *rng);
|
||||
let challenge = C::F::random(rng); // Doesn't bother to craft an HRAM
|
||||
assert!(
|
||||
schnorr::verify::<C>(
|
||||
C::GENERATOR * private_key,
|
||||
challenge,
|
||||
&schnorr::sign(private_key, nonce, challenge)
|
||||
)
|
||||
);
|
||||
assert!(schnorr::verify::<C>(
|
||||
C::GENERATOR * private_key,
|
||||
challenge,
|
||||
&schnorr::sign(private_key, nonce, challenge)
|
||||
));
|
||||
}
|
||||
|
||||
// The above sign function verifies signing works
|
||||
// This verifies invalid signatures don't pass, using zero signatures, which should effectively be
|
||||
// random
|
||||
pub(crate) fn core_verify<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
|
||||
assert!(
|
||||
!schnorr::verify::<C>(
|
||||
C::GENERATOR * C::F::random(&mut *rng),
|
||||
C::F::random(rng),
|
||||
&SchnorrSignature { R: C::GENERATOR * C::F::zero(), s: C::F::zero() }
|
||||
)
|
||||
);
|
||||
assert!(!schnorr::verify::<C>(
|
||||
C::GENERATOR * C::F::random(&mut *rng),
|
||||
C::F::random(rng),
|
||||
&SchnorrSignature { R: C::GENERATOR * C::F::zero(), s: C::F::zero() }
|
||||
));
|
||||
}
|
||||
|
||||
pub(crate) fn core_batch_verify<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
|
||||
@@ -47,9 +45,9 @@ pub(crate) fn core_batch_verify<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
|
||||
}
|
||||
|
||||
// Batch verify
|
||||
let triplets = (0 .. 5).map(
|
||||
|i| (u16::try_from(i + 1).unwrap(), C::GENERATOR * keys[i], challenges[i], sigs[i])
|
||||
).collect::<Vec<_>>();
|
||||
let triplets = (0 .. 5)
|
||||
.map(|i| (u16::try_from(i + 1).unwrap(), C::GENERATOR * keys[i], challenges[i], sigs[i]))
|
||||
.collect::<Vec<_>>();
|
||||
schnorr::batch_verify(rng, &triplets).unwrap();
|
||||
|
||||
// Shift 1 from s from one to another and verify it fails
|
||||
@@ -80,7 +78,7 @@ pub(crate) fn core_batch_verify<R: RngCore + CryptoRng, C: Curve>(rng: &mut R) {
|
||||
fn sign_core<R: RngCore + CryptoRng, C: Curve>(
|
||||
rng: &mut R,
|
||||
group_key: C::G,
|
||||
keys: &HashMap<u16, Arc<FrostKeys<C>>>
|
||||
keys: &HashMap<u16, Arc<FrostKeys<C>>>,
|
||||
) {
|
||||
const MESSAGE: &'static [u8] = b"Hello, World!";
|
||||
|
||||
@@ -91,7 +89,7 @@ fn sign_core<R: RngCore + CryptoRng, C: Curve>(
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct TestHram<C: Curve> {
|
||||
_curve: PhantomData<C>
|
||||
_curve: PhantomData<C>,
|
||||
}
|
||||
impl<C: Curve> Hram<C> for TestHram<C> {
|
||||
#[allow(non_snake_case)]
|
||||
|
||||
@@ -5,10 +5,11 @@ use rand_core::{RngCore, CryptoRng};
|
||||
use group::{ff::PrimeField, GroupEncoding};
|
||||
|
||||
use crate::{
|
||||
curve::Curve, FrostKeys,
|
||||
curve::Curve,
|
||||
FrostKeys,
|
||||
algorithm::{Schnorr, Hram},
|
||||
sign::{PreprocessPackage, SignMachine, SignatureMachine, AlgorithmMachine},
|
||||
tests::{clone_without, curve::test_curve, schnorr::test_schnorr, recover}
|
||||
tests::{clone_without, curve::test_curve, schnorr::test_schnorr, recover},
|
||||
};
|
||||
|
||||
pub struct Vectors {
|
||||
@@ -21,17 +22,17 @@ pub struct Vectors {
|
||||
pub included: &'static [u16],
|
||||
pub nonces: &'static [[&'static str; 2]],
|
||||
pub sig_shares: &'static [&'static str],
|
||||
pub sig: String
|
||||
pub sig: String,
|
||||
}
|
||||
|
||||
// Load these vectors into FrostKeys using a custom serialization it'll deserialize
|
||||
fn vectors_to_multisig_keys<C: Curve>(vectors: &Vectors) -> HashMap<u16, FrostKeys<C>> {
|
||||
let shares = vectors.shares.iter().map(
|
||||
|secret| C::read_F(&mut Cursor::new(hex::decode(secret).unwrap())).unwrap()
|
||||
).collect::<Vec<_>>();
|
||||
let verification_shares = shares.iter().map(
|
||||
|secret| C::GENERATOR * secret
|
||||
).collect::<Vec<_>>();
|
||||
let shares = vectors
|
||||
.shares
|
||||
.iter()
|
||||
.map(|secret| C::read_F(&mut Cursor::new(hex::decode(secret).unwrap())).unwrap())
|
||||
.collect::<Vec<_>>();
|
||||
let verification_shares = shares.iter().map(|secret| C::GENERATOR * secret).collect::<Vec<_>>();
|
||||
|
||||
let mut keys = HashMap::new();
|
||||
for i in 1 ..= u16::try_from(shares.len()).unwrap() {
|
||||
@@ -59,11 +60,10 @@ fn vectors_to_multisig_keys<C: Curve>(vectors: &Vectors) -> HashMap<u16, FrostKe
|
||||
keys
|
||||
}
|
||||
|
||||
pub fn test_with_vectors<
|
||||
R: RngCore + CryptoRng,
|
||||
C: Curve,
|
||||
H: Hram<C>
|
||||
>(rng: &mut R, vectors: Vectors) {
|
||||
pub fn test_with_vectors<R: RngCore + CryptoRng, C: Curve, H: Hram<C>>(
|
||||
rng: &mut R,
|
||||
vectors: Vectors,
|
||||
) {
|
||||
// Do basic tests before trying the vectors
|
||||
test_curve::<_, C>(&mut *rng);
|
||||
test_schnorr::<_, C>(rng);
|
||||
@@ -87,54 +87,59 @@ pub fn test_with_vectors<
|
||||
AlgorithmMachine::new(
|
||||
Schnorr::<C, H>::new(),
|
||||
Arc::new(keys[i].clone()),
|
||||
vectors.included.clone()
|
||||
).unwrap()
|
||||
vectors.included.clone(),
|
||||
)
|
||||
.unwrap(),
|
||||
));
|
||||
}
|
||||
|
||||
let mut commitments = HashMap::new();
|
||||
let mut c = 0;
|
||||
let mut machines = machines.drain(..).map(|(i, machine)| {
|
||||
let nonces = [
|
||||
C::read_F(&mut Cursor::new(hex::decode(vectors.nonces[c][0]).unwrap())).unwrap(),
|
||||
C::read_F(&mut Cursor::new(hex::decode(vectors.nonces[c][1]).unwrap())).unwrap()
|
||||
];
|
||||
c += 1;
|
||||
let these_commitments = vec![[C::GENERATOR * nonces[0], C::GENERATOR * nonces[1]]];
|
||||
let machine = machine.unsafe_override_preprocess(
|
||||
PreprocessPackage {
|
||||
let mut machines = machines
|
||||
.drain(..)
|
||||
.map(|(i, machine)| {
|
||||
let nonces = [
|
||||
C::read_F(&mut Cursor::new(hex::decode(vectors.nonces[c][0]).unwrap())).unwrap(),
|
||||
C::read_F(&mut Cursor::new(hex::decode(vectors.nonces[c][1]).unwrap())).unwrap(),
|
||||
];
|
||||
c += 1;
|
||||
let these_commitments = vec![[C::GENERATOR * nonces[0], C::GENERATOR * nonces[1]]];
|
||||
let machine = machine.unsafe_override_preprocess(PreprocessPackage {
|
||||
nonces: vec![nonces],
|
||||
commitments: vec![these_commitments.clone()],
|
||||
addendum: vec![]
|
||||
}
|
||||
);
|
||||
addendum: vec![],
|
||||
});
|
||||
|
||||
commitments.insert(
|
||||
i,
|
||||
Cursor::new(
|
||||
[
|
||||
these_commitments[0][0].to_bytes().as_ref(),
|
||||
these_commitments[0][1].to_bytes().as_ref()
|
||||
].concat().to_vec()
|
||||
)
|
||||
);
|
||||
(i, machine)
|
||||
}).collect::<Vec<_>>();
|
||||
commitments.insert(
|
||||
i,
|
||||
Cursor::new(
|
||||
[
|
||||
these_commitments[0][0].to_bytes().as_ref(),
|
||||
these_commitments[0][1].to_bytes().as_ref(),
|
||||
]
|
||||
.concat()
|
||||
.to_vec(),
|
||||
),
|
||||
);
|
||||
(i, machine)
|
||||
})
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
let mut shares = HashMap::new();
|
||||
c = 0;
|
||||
let mut machines = machines.drain(..).map(|(i, machine)| {
|
||||
let (machine, share) = machine.sign(
|
||||
clone_without(&commitments, &i),
|
||||
&hex::decode(vectors.msg).unwrap()
|
||||
).unwrap();
|
||||
let mut machines = machines
|
||||
.drain(..)
|
||||
.map(|(i, machine)| {
|
||||
let (machine, share) =
|
||||
machine.sign(clone_without(&commitments, &i), &hex::decode(vectors.msg).unwrap()).unwrap();
|
||||
|
||||
assert_eq!(share, hex::decode(vectors.sig_shares[c]).unwrap());
|
||||
c += 1;
|
||||
assert_eq!(share, hex::decode(vectors.sig_shares[c]).unwrap());
|
||||
c += 1;
|
||||
|
||||
shares.insert(i, Cursor::new(share));
|
||||
(i, machine)
|
||||
}).collect::<HashMap<_, _>>();
|
||||
shares.insert(i, Cursor::new(share));
|
||||
(i, machine)
|
||||
})
|
||||
.collect::<HashMap<_, _>>();
|
||||
|
||||
for (i, machine) in machines.drain() {
|
||||
let sig = machine.complete(clone_without(&shares, &i)).unwrap();
|
||||
|
||||
@@ -9,15 +9,20 @@ use crate::{multiexp, multiexp_vartime};
|
||||
pub struct BatchVerifier<Id: Copy, G: Group>(Vec<(Id, Vec<(G::Scalar, G)>)>);
|
||||
|
||||
#[cfg(feature = "batch")]
|
||||
impl<Id: Copy, G: Group> BatchVerifier<Id, G> where <G as Group>::Scalar: PrimeFieldBits {
|
||||
impl<Id: Copy, G: Group> BatchVerifier<Id, G>
|
||||
where
|
||||
<G as Group>::Scalar: PrimeFieldBits,
|
||||
{
|
||||
pub fn new(capacity: usize) -> BatchVerifier<Id, G> {
|
||||
BatchVerifier(Vec::with_capacity(capacity))
|
||||
}
|
||||
|
||||
pub fn queue<
|
||||
R: RngCore + CryptoRng,
|
||||
I: IntoIterator<Item = (G::Scalar, G)>
|
||||
>(&mut self, rng: &mut R, id: Id, pairs: I) {
|
||||
pub fn queue<R: RngCore + CryptoRng, I: IntoIterator<Item = (G::Scalar, G)>>(
|
||||
&mut self,
|
||||
rng: &mut R,
|
||||
id: Id,
|
||||
pairs: I,
|
||||
) {
|
||||
// Define a unique scalar factor for this set of variables so individual items can't overlap
|
||||
let u = if self.0.len() == 0 {
|
||||
G::Scalar::one()
|
||||
@@ -35,16 +40,16 @@ impl<Id: Copy, G: Group> BatchVerifier<Id, G> where <G as Group>::Scalar: PrimeF
|
||||
|
||||
#[must_use]
|
||||
pub fn verify(&self) -> bool {
|
||||
multiexp(
|
||||
&self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>()
|
||||
).is_identity().into()
|
||||
multiexp(&self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>())
|
||||
.is_identity()
|
||||
.into()
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn verify_vartime(&self) -> bool {
|
||||
multiexp_vartime(
|
||||
&self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>()
|
||||
).is_identity().into()
|
||||
multiexp_vartime(&self.0.iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>())
|
||||
.is_identity()
|
||||
.into()
|
||||
}
|
||||
|
||||
// A constant time variant may be beneficial for robust protocols
|
||||
@@ -53,17 +58,21 @@ impl<Id: Copy, G: Group> BatchVerifier<Id, G> where <G as Group>::Scalar: PrimeF
|
||||
while slice.len() > 1 {
|
||||
let split = slice.len() / 2;
|
||||
if multiexp_vartime(
|
||||
&slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>()
|
||||
).is_identity().into() {
|
||||
&slice[.. split].iter().flat_map(|pairs| pairs.1.iter()).cloned().collect::<Vec<_>>(),
|
||||
)
|
||||
.is_identity()
|
||||
.into()
|
||||
{
|
||||
slice = &slice[split ..];
|
||||
} else {
|
||||
slice = &slice[.. split];
|
||||
}
|
||||
}
|
||||
|
||||
slice.get(0).filter(
|
||||
|(_, value)| !bool::from(multiexp_vartime(value).is_identity())
|
||||
).map(|(id, _)| *id)
|
||||
slice
|
||||
.get(0)
|
||||
.filter(|(_, value)| !bool::from(multiexp_vartime(value).is_identity()))
|
||||
.map(|(id, _)| *id)
|
||||
}
|
||||
|
||||
pub fn verify_with_vartime_blame(&self) -> Result<(), Id> {
|
||||
|
||||
@@ -15,10 +15,10 @@ pub use batch::BatchVerifier;
|
||||
#[cfg(test)]
|
||||
mod tests;
|
||||
|
||||
pub(crate) fn prep_bits<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> Vec<Vec<u8>> where G::Scalar: PrimeFieldBits {
|
||||
pub(crate) fn prep_bits<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> Vec<Vec<u8>>
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let w_usize = usize::from(window);
|
||||
|
||||
let mut groupings = vec![];
|
||||
@@ -37,10 +37,7 @@ pub(crate) fn prep_bits<G: Group>(
|
||||
groupings
|
||||
}
|
||||
|
||||
pub(crate) fn prep_tables<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> Vec<Vec<G>> {
|
||||
pub(crate) fn prep_tables<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> Vec<Vec<G>> {
|
||||
let mut tables = Vec::with_capacity(pairs.len());
|
||||
for pair in pairs {
|
||||
let p = tables.len();
|
||||
@@ -59,7 +56,7 @@ enum Algorithm {
|
||||
Null,
|
||||
Single,
|
||||
Straus(u8),
|
||||
Pippenger(u8)
|
||||
Pippenger(u8),
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -157,20 +154,26 @@ fn algorithm(len: usize) -> Algorithm {
|
||||
}
|
||||
|
||||
// Performs a multiexp, automatically selecting the optimal algorithm based on amount of pairs
|
||||
pub fn multiexp<G: Group>(pairs: &[(G::Scalar, G)]) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub fn multiexp<G: Group>(pairs: &[(G::Scalar, G)]) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
match algorithm(pairs.len()) {
|
||||
Algorithm::Null => Group::identity(),
|
||||
Algorithm::Single => pairs[0].1 * pairs[0].0,
|
||||
Algorithm::Straus(window) => straus(pairs, window),
|
||||
Algorithm::Pippenger(window) => pippenger(pairs, window)
|
||||
Algorithm::Pippenger(window) => pippenger(pairs, window),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn multiexp_vartime<G: Group>(pairs: &[(G::Scalar, G)]) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub fn multiexp_vartime<G: Group>(pairs: &[(G::Scalar, G)]) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
match algorithm(pairs.len()) {
|
||||
Algorithm::Null => Group::identity(),
|
||||
Algorithm::Single => pairs[0].1 * pairs[0].0,
|
||||
Algorithm::Straus(window) => straus_vartime(pairs, window),
|
||||
Algorithm::Pippenger(window) => pippenger_vartime(pairs, window)
|
||||
Algorithm::Pippenger(window) => pippenger_vartime(pairs, window),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,10 +3,10 @@ use group::Group;
|
||||
|
||||
use crate::prep_bits;
|
||||
|
||||
pub(crate) fn pippenger<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub(crate) fn pippenger<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let bits = prep_bits(pairs, window);
|
||||
|
||||
let mut res = G::identity();
|
||||
@@ -30,10 +30,10 @@ pub(crate) fn pippenger<G: Group>(
|
||||
res
|
||||
}
|
||||
|
||||
pub(crate) fn pippenger_vartime<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub(crate) fn pippenger_vartime<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let bits = prep_bits(pairs, window);
|
||||
|
||||
let mut res = G::identity();
|
||||
|
||||
@@ -3,10 +3,10 @@ use group::Group;
|
||||
|
||||
use crate::{prep_bits, prep_tables};
|
||||
|
||||
pub(crate) fn straus<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub(crate) fn straus<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let groupings = prep_bits(pairs, window);
|
||||
let tables = prep_tables(pairs, window);
|
||||
|
||||
@@ -23,10 +23,10 @@ pub(crate) fn straus<G: Group>(
|
||||
res
|
||||
}
|
||||
|
||||
pub(crate) fn straus_vartime<G: Group>(
|
||||
pairs: &[(G::Scalar, G)],
|
||||
window: u8
|
||||
) -> G where G::Scalar: PrimeFieldBits {
|
||||
pub(crate) fn straus_vartime<G: Group>(pairs: &[(G::Scalar, G)], window: u8) -> G
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let groupings = prep_bits(pairs, window);
|
||||
let tables = prep_tables(pairs, window);
|
||||
|
||||
|
||||
@@ -11,7 +11,10 @@ use dalek_ff_group::EdwardsPoint;
|
||||
use crate::{straus, pippenger, multiexp, multiexp_vartime};
|
||||
|
||||
#[allow(dead_code)]
|
||||
fn benchmark_internal<G: Group>(straus_bool: bool) where G::Scalar: PrimeFieldBits {
|
||||
fn benchmark_internal<G: Group>(straus_bool: bool)
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let runs: usize = 20;
|
||||
|
||||
let mut start = 0;
|
||||
@@ -64,7 +67,10 @@ fn benchmark_internal<G: Group>(straus_bool: bool) where G::Scalar: PrimeFieldBi
|
||||
current += 1;
|
||||
println!(
|
||||
"{} {} is more efficient at {} with {}µs per",
|
||||
if straus_bool { "Straus" } else { "Pippenger" }, current, pairs.len(), next_per
|
||||
if straus_bool { "Straus" } else { "Pippenger" },
|
||||
current,
|
||||
pairs.len(),
|
||||
next_per
|
||||
);
|
||||
if current >= 8 {
|
||||
return;
|
||||
@@ -73,7 +79,10 @@ fn benchmark_internal<G: Group>(straus_bool: bool) where G::Scalar: PrimeFieldBi
|
||||
}
|
||||
}
|
||||
|
||||
fn test_multiexp<G: Group>() where G::Scalar: PrimeFieldBits {
|
||||
fn test_multiexp<G: Group>()
|
||||
where
|
||||
G::Scalar: PrimeFieldBits,
|
||||
{
|
||||
let mut pairs = Vec::with_capacity(1000);
|
||||
let mut sum = G::identity();
|
||||
for _ in 0 .. 10 {
|
||||
|
||||
@@ -34,7 +34,7 @@ enum DigestTranscriptMember {
|
||||
Domain,
|
||||
Label,
|
||||
Value,
|
||||
Challenge
|
||||
Challenge,
|
||||
}
|
||||
|
||||
impl DigestTranscriptMember {
|
||||
@@ -44,7 +44,7 @@ impl DigestTranscriptMember {
|
||||
DigestTranscriptMember::Domain => 1,
|
||||
DigestTranscriptMember::Label => 2,
|
||||
DigestTranscriptMember::Value => 3,
|
||||
DigestTranscriptMember::Challenge => 4
|
||||
DigestTranscriptMember::Challenge => 4,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,7 +6,9 @@ use crate::Transcript;
|
||||
pub struct MerlinTranscript(pub merlin::Transcript);
|
||||
// Merlin doesn't implement Debug so provide a stub which won't panic
|
||||
impl Debug for MerlinTranscript {
|
||||
fn fmt(&self, _: &mut Formatter<'_>) -> Result<(), core::fmt::Error> { Ok(()) }
|
||||
fn fmt(&self, _: &mut Formatter<'_>) -> Result<(), core::fmt::Error> {
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
impl Transcript for MerlinTranscript {
|
||||
|
||||
Reference in New Issue
Block a user