introduced step reveal for stage1, taking paramater for other bidders; simple tests pass

1 files changed, 34 insertions, 25 deletions

diff --git a/nizk/stage1.go b/nizk/stage1.go
index 21d63c6..fe75afd 100644
--- a/nizk/stage1.go
+++ b/nizk/stage1.go
@@ -6,7 +6,9 @@ type Stage struct {
 	x *Scalar
 	r *Scalar
 
-	com  *StageCommitment
+	com *StageCommitment
+	rev *StageReveal
+
 	prf1 *Stage1Proof
 	prf2 *Stage2Proof
 
@@ -16,8 +18,11 @@ type Stage struct {
 type StageCommitment struct {
 	R *Point
 	X *Point
-	Y *Point
+}
+
+type StageReveal struct {
 	Z *Point
+	Y *Point
 }
 
 // Represents the proof of statements of the following form:
@@ -40,39 +45,30 @@ func (b *Bit) stage(x, r *Scalar) *Stage {
 	}
 }
 
-func (b *Bit) CommitStage1(Xs ...*Point) (c *Stage, s *StageCommitment, p *Stage1Proof) {
+func (b *Bit) CommitStage1(Xs ...*Point) (c *Stage, s *StageCommitment) {
 	x := Curve.RandomScalar()
 	r := Curve.RandomScalar()
 	return b.CommitStage1FromScalars(x, r, Xs...)
 }
 
-func (b *Bit) CommitStage1FromScalars(x, r *Scalar, Xs ...*Point) (s *Stage, c *StageCommitment, p *Stage1Proof) {
+func (b *Bit) CommitStage1FromScalars(x, r *Scalar, Xs ...*Point) (s *Stage, c *StageCommitment) {
 	s = b.stage(x, r)
-	return s, s.commit(false, Xs...), s.proof1()
+	return s, s.commit(false, Xs...)
 }
 
 func (s *Stage) commit(lost bool, Xs ...*Point) *StageCommitment {
 	if s.com != nil {
 		return s.com
 	}
-	var Y, Z *Point
-	Y = G // TODO! BUG! THIS HAS TO BE Pj<i(X_j)/Pj>i(X_j)
-	if !lost && s.bit.IsSet() {
-		Z = G.Exp(s.x.Mul(s.r))
-	} else {
-		Z = Y.Exp(s.x)
-	}
 
 	s.com = &StageCommitment{
-		Z: Z,
 		X: G.Exp(s.x),
-		Y: Y,
 		R: G.Exp(s.r),
 	}
 	return s.com
 }
 
-func (s *Stage) proof1() *Stage1Proof {
+func (s *Stage) RevealStage1(Xs ...*Point) (rev *StageReveal, pr *Stage1Proof) {
 	var ε [2][4]*Point
 	var r1, r2, ρ1, ρ2, ω *Scalar
 	for _, s := range []**Scalar{&r1, &r2, &ρ1, &ρ2, &ω} {
@@ -81,10 +77,22 @@ func (s *Stage) proof1() *Stage1Proof {
 	c := s.commit(false)
 	bc := s.bit.com
 
+	// TODO: Calculate Y based on the Xs and our own X_i
+	// as Π_(i<k) X_k / Π_(i>k) X_k
+	// For now:
+	Y := G.Exp(Curve.RandomScalar())
+
+	rev = &StageReveal{Y: Y}
+	if s.bit.IsSet() {
+		rev.Z = c.R.Exp(s.x)
+	} else {
+		rev.Z = rev.Y.Exp(s.x)
+	}
+
 	if s.bit.IsSet() {
 		ε[0][0] = G.Exp(r1).Mul(c.X.Exp(ω))
 		ε[0][1] = G.Exp(r2).Mul(bc.A.Exp(ω))
-		ε[0][2] = c.Y.Exp(r1).Mul(c.Z.Exp(ω))
+		ε[0][2] = rev.Y.Exp(r1).Mul(rev.Z.Exp(ω))
 		ε[0][3] = bc.B.Exp(r2).Mul(bc.C.Exp(ω))
 		ε[1][0] = G.Exp(ρ1)
 		ε[1][1] = G.Exp(ρ2)
@@ -93,15 +101,15 @@ func (s *Stage) proof1() *Stage1Proof {
 	} else {
 		ε[0][0] = G.Exp(r1)
 		ε[0][1] = G.Exp(r2)
-		ε[0][2] = c.Y.Exp(r1)
+		ε[0][2] = rev.Y.Exp(r1)
 		ε[0][3] = bc.B.Exp(r2)
 		ε[1][0] = G.Exp(ρ1).Mul(c.X.Exp(ω))
 		ε[1][1] = G.Exp(ρ2).Mul(bc.A.Exp(ω))
-		ε[1][2] = c.R.Exp(ρ1).Mul(c.Z.Exp(ω))
+		ε[1][2] = c.R.Exp(ρ1).Mul(rev.Z.Exp(ω))
 		ε[1][3] = bc.B.Exp(ρ2).Mul(bc.C.Div(G).Exp(ω))
 	}
 
-	p := []Bytes{G, bc.A, bc.B, bc.C, c.R, c.X, c.Y, c.Z}
+	p := []Bytes{G, bc.A, bc.B, bc.C, c.R, c.X, rev.Y, rev.Z}
 	for _, e := range ε[0] {
 		p = append(p, e)
 	}
@@ -110,7 +118,7 @@ func (s *Stage) proof1() *Stage1Proof {
 	}
 
 	ch := Challenge(p...)
-	pr := &Stage1Proof{}
+	pr = &Stage1Proof{}
 	α, _ := s.bit.Scalars()
 
 	if s.bit.IsSet() {
@@ -129,23 +137,24 @@ func (s *Stage) proof1() *Stage1Proof {
 		pr.Rho[1][1] = ρ2
 	}
 
+	s.rev = rev
 	s.prf1 = pr
-	return pr
+	return rev, pr
 }
 
-func (c *Commitment) VerifyStage1(sc *StageCommitment, p *Stage1Proof) bool {
+func (c *Commitment) VerifyStage1(sc *StageCommitment, r *StageReveal, p *Stage1Proof) bool {
 	var ε [2][4]*Point
 
 	ε[0][0] = G.Exp(p.Rho[0][0]).Mul(sc.X.Exp(p.Ch[0]))
 	ε[0][1] = G.Exp(p.Rho[0][1]).Mul(c.A.Exp(p.Ch[0]))
-	ε[0][2] = sc.Y.Exp(p.Rho[0][0]).Mul(sc.Z.Exp(p.Ch[0]))
+	ε[0][2] = r.Y.Exp(p.Rho[0][0]).Mul(r.Z.Exp(p.Ch[0]))
 	ε[0][3] = c.B.Exp(p.Rho[0][1]).Mul(c.C.Exp(p.Ch[0]))
 	ε[1][0] = G.Exp(p.Rho[1][0]).Mul(sc.X.Exp(p.Ch[1]))
 	ε[1][1] = G.Exp(p.Rho[1][1]).Mul(c.A.Exp(p.Ch[1]))
-	ε[1][2] = sc.R.Exp(p.Rho[1][0]).Mul(sc.Z.Exp(p.Ch[1]))
+	ε[1][2] = sc.R.Exp(p.Rho[1][0]).Mul(r.Z.Exp(p.Ch[1]))
 	ε[1][3] = c.B.Exp(p.Rho[1][1]).Mul(c.C.Div(G).Exp(p.Ch[1]))
 
-	points := []Bytes{G, c.A, c.B, c.C, sc.R, sc.X, sc.Y, sc.Z}
+	points := []Bytes{G, c.A, c.B, c.C, sc.R, sc.X, r.Y, r.Z}
 	for _, e := range ε[0] {
 		points = append(points, e)
 	}