Offer a multi-DLEq proof which simply merges challenges for n underlying proofs

This converts proofs from 2n elements to 1+n.

Moves FROST over to it. Additionally, for FROST's binomial nonces, provides
a single DLEq proof (2, not 1+2 elements) by proving the discrete log equality
of their aggregate (with an appropriate binding factor). This may be split back
up depending on later commentary...

crypto/dleq/src/lib.rs

@@ -177,3 +177,115 @@ impl<G: PrimeGroup> DLEqProof<G> {
     res
   }
 }
+
+#[cfg(feature = "std")]
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct MultiDLEqProof<G: PrimeGroup> {
+  c: G::Scalar,
+  s: Vec<G::Scalar>,
+}
+
+#[cfg(feature = "std")]
+#[allow(non_snake_case)]
+impl<G: PrimeGroup> MultiDLEqProof<G> {
+  pub fn prove<R: RngCore + CryptoRng, T: Transcript>(
+    rng: &mut R,
+    transcript: &mut T,
+    generators: &[Vec<G>],
+    scalars: &[Zeroizing<G::Scalar>],
+  ) -> MultiDLEqProof<G>
+  where
+    G::Scalar: Zeroize,
+  {
+    transcript.domain_separate(b"multi-dleq");
+
+    let mut nonces = vec![];
+    for (i, (scalar, generators)) in scalars.iter().zip(generators).enumerate() {
+      // Delineate between discrete logarithms
+      transcript.append_message(b"discrete_logarithm", i.to_le_bytes());
+
+      let nonce = Zeroizing::new(G::Scalar::random(&mut *rng));
+      for generator in generators {
+        DLEqProof::transcript(
+          transcript,
+          *generator,
+          *generator * nonce.deref(),
+          *generator * scalar.deref(),
+        );
+      }
+      nonces.push(nonce);
+    }
+
+    let c = challenge(transcript);
+
+    let mut s = vec![];
+    for (scalar, nonce) in scalars.iter().zip(nonces) {
+      s.push((c * scalar.deref()) + nonce.deref());
+    }
+
+    MultiDLEqProof { c, s }
+  }
+
+  pub fn verify<T: Transcript>(
+    &self,
+    transcript: &mut T,
+    generators: &[Vec<G>],
+    points: &[Vec<G>],
+  ) -> Result<(), DLEqError> {
+    if points.len() != generators.len() {
+      Err(DLEqError::InvalidProof)?;
+    }
+    if self.s.len() != generators.len() {
+      Err(DLEqError::InvalidProof)?;
+    }
+
+    transcript.domain_separate(b"multi-dleq");
+    for (i, (generators, points)) in generators.iter().zip(points).enumerate() {
+      if points.len() != generators.len() {
+        Err(DLEqError::InvalidProof)?;
+      }
+
+      transcript.append_message(b"discrete_logarithm", i.to_le_bytes());
+      for (generator, point) in generators.iter().zip(points) {
+        DLEqProof::transcript(
+          transcript,
+          *generator,
+          (*generator * self.s[i]) - (*point * self.c),
+          *point,
+        );
+      }
+    }
+
+    if self.c != challenge(transcript) {
+      Err(DLEqError::InvalidProof)?;
+    }
+
+    Ok(())
+  }
+
+  #[cfg(feature = "serialize")]
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    w.write_all(self.c.to_repr().as_ref())?;
+    for s in &self.s {
+      w.write_all(s.to_repr().as_ref())?;
+    }
+    Ok(())
+  }
+
+  #[cfg(feature = "serialize")]
+  pub fn read<R: Read>(r: &mut R, discrete_logs: usize) -> io::Result<MultiDLEqProof<G>> {
+    let c = read_scalar(r)?;
+    let mut s = vec![];
+    for _ in 0 .. discrete_logs {
+      s.push(read_scalar(r)?);
+    }
+    Ok(MultiDLEqProof { c, s })
+  }
+
+  #[cfg(feature = "serialize")]
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut res = vec![];
+    self.write(&mut res).unwrap();
+    res
+  }
+}

crypto/dleq/src/tests/mod.rs

@@ -13,16 +13,13 @@ use k256::{Scalar, ProjectivePoint};
 
 use transcript::{Transcript, RecommendedTranscript};
 
-use crate::DLEqProof;
+use crate::{DLEqProof, MultiDLEqProof};
 
 #[cfg(feature = "experimental")]
 mod cross_group;
 
-#[test]
-fn test_dleq() {
-  let transcript = || RecommendedTranscript::new(b"DLEq Proof Test");
-
-  let generators = [
+fn generators() -> [k256::ProjectivePoint; 5] {
+  [
     ProjectivePoint::GENERATOR,
     ProjectivePoint::from_bytes(
       &(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0").into()),
@@ -41,7 +38,13 @@ fn test_dleq() {
       &(hex!("0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803acb").into()),
     )
     .unwrap(),
-  ];
+  ]
+}
+
+#[test]
+fn test_dleq() {
+  let generators = generators();
+  let transcript = || RecommendedTranscript::new(b"DLEq Proof Test");
 
   for i in 0 .. 5 {
     let key = Zeroizing::new(Scalar::random(&mut OsRng));
@@ -61,6 +64,9 @@ fn test_dleq() {
       )
       .is_err());
 
+    // All of these following tests should effectively be a different challenge and accordingly
+    // pointless. They're still nice to have though
+
     // We could edit these tests to always test with at least two generators
     // Then we don't test proofs with zero/one generator(s)
     // While those are stupid, and pointless, and potentially point to a failure in the caller,
@@ -94,3 +100,53 @@ fn test_dleq() {
     }
   }
 }
+
+#[test]
+fn test_multi_dleq() {
+  let generators = generators();
+  let transcript = || RecommendedTranscript::new(b"MultiDLEq Proof Test");
+
+  // Test up to 3 keys
+  for k in 0 ..= 3 {
+    let mut keys = vec![];
+    let mut these_generators = vec![];
+    let mut pub_keys = vec![];
+    for i in 0 .. k {
+      let key = Zeroizing::new(Scalar::random(&mut OsRng));
+      // For each key, test a variable set of generators
+      // 0: 0
+      // 1: 1, 2
+      // 2: 2, 3, 4
+      let key_generators = generators[i .. (i + i + 1)].to_vec();
+      let mut these_pub_keys = vec![];
+      for generator in &key_generators {
+        these_pub_keys.push(generator * key.deref());
+      }
+      keys.push(key);
+      these_generators.push(key_generators);
+      pub_keys.push(these_pub_keys);
+    }
+
+    let proof = MultiDLEqProof::prove(&mut OsRng, &mut transcript(), &these_generators, &keys);
+
+    proof.verify(&mut transcript(), &these_generators, &pub_keys).unwrap();
+    // Different challenge
+    assert!(proof
+      .verify(&mut RecommendedTranscript::new(b"different challenge"), &these_generators, &pub_keys)
+      .is_err());
+
+    // Test verifying for a different amount of keys fail
+    if k > 0 {
+      assert!(proof.verify(&mut transcript(), &these_generators, &pub_keys[.. k - 1]).is_err());
+    }
+
+    #[cfg(feature = "serialize")]
+    {
+      let mut buf = vec![];
+      proof.write(&mut buf).unwrap();
+      let deserialized =
+        MultiDLEqProof::<ProjectivePoint>::read::<&[u8]>(&mut buf.as_ref(), k).unwrap();
+      assert_eq!(proof, deserialized);
+    }
+  }
+}