diff options
Diffstat (limited to 'nizk/stage1.go')
| -rw-r--r-- | nizk/stage1.go | 59 |
1 files changed, 34 insertions, 25 deletions
diff --git a/nizk/stage1.go b/nizk/stage1.go index 21d63c6..fe75afd 100644 --- a/nizk/stage1.go +++ b/nizk/stage1.go @@ -6,7 +6,9 @@ type Stage struct { x *Scalar r *Scalar - com *StageCommitment + com *StageCommitment + rev *StageReveal + prf1 *Stage1Proof prf2 *Stage2Proof @@ -16,8 +18,11 @@ type Stage struct { type StageCommitment struct { R *Point X *Point - Y *Point +} + +type StageReveal struct { Z *Point + Y *Point } // Represents the proof of statements of the following form: @@ -40,39 +45,30 @@ func (b *Bit) stage(x, r *Scalar) *Stage { } } -func (b *Bit) CommitStage1(Xs ...*Point) (c *Stage, s *StageCommitment, p *Stage1Proof) { +func (b *Bit) CommitStage1(Xs ...*Point) (c *Stage, s *StageCommitment) { x := Curve.RandomScalar() r := Curve.RandomScalar() return b.CommitStage1FromScalars(x, r, Xs...) } -func (b *Bit) CommitStage1FromScalars(x, r *Scalar, Xs ...*Point) (s *Stage, c *StageCommitment, p *Stage1Proof) { +func (b *Bit) CommitStage1FromScalars(x, r *Scalar, Xs ...*Point) (s *Stage, c *StageCommitment) { s = b.stage(x, r) - return s, s.commit(false, Xs...), s.proof1() + return s, s.commit(false, Xs...) } func (s *Stage) commit(lost bool, Xs ...*Point) *StageCommitment { if s.com != nil { return s.com } - var Y, Z *Point - Y = G // TODO! BUG! THIS HAS TO BE Pj<i(X_j)/Pj>i(X_j) - if !lost && s.bit.IsSet() { - Z = G.Exp(s.x.Mul(s.r)) - } else { - Z = Y.Exp(s.x) - } s.com = &StageCommitment{ - Z: Z, X: G.Exp(s.x), - Y: Y, R: G.Exp(s.r), } return s.com } -func (s *Stage) proof1() *Stage1Proof { +func (s *Stage) RevealStage1(Xs ...*Point) (rev *StageReveal, pr *Stage1Proof) { var ε [2][4]*Point var r1, r2, ρ1, ρ2, ω *Scalar for _, s := range []**Scalar{&r1, &r2, &ρ1, &ρ2, &ω} { @@ -81,10 +77,22 @@ func (s *Stage) proof1() *Stage1Proof { c := s.commit(false) bc := s.bit.com + // TODO: Calculate Y based on the Xs and our own X_i + // as Π_(i<k) X_k / Π_(i>k) X_k + // For now: + Y := G.Exp(Curve.RandomScalar()) + + rev = &StageReveal{Y: Y} + if s.bit.IsSet() { + rev.Z = c.R.Exp(s.x) + } else { + rev.Z = rev.Y.Exp(s.x) + } + if s.bit.IsSet() { ε[0][0] = G.Exp(r1).Mul(c.X.Exp(ω)) ε[0][1] = G.Exp(r2).Mul(bc.A.Exp(ω)) - ε[0][2] = c.Y.Exp(r1).Mul(c.Z.Exp(ω)) + ε[0][2] = rev.Y.Exp(r1).Mul(rev.Z.Exp(ω)) ε[0][3] = bc.B.Exp(r2).Mul(bc.C.Exp(ω)) ε[1][0] = G.Exp(ρ1) ε[1][1] = G.Exp(ρ2) @@ -93,15 +101,15 @@ func (s *Stage) proof1() *Stage1Proof { } else { ε[0][0] = G.Exp(r1) ε[0][1] = G.Exp(r2) - ε[0][2] = c.Y.Exp(r1) + ε[0][2] = rev.Y.Exp(r1) ε[0][3] = bc.B.Exp(r2) ε[1][0] = G.Exp(ρ1).Mul(c.X.Exp(ω)) ε[1][1] = G.Exp(ρ2).Mul(bc.A.Exp(ω)) - ε[1][2] = c.R.Exp(ρ1).Mul(c.Z.Exp(ω)) + ε[1][2] = c.R.Exp(ρ1).Mul(rev.Z.Exp(ω)) ε[1][3] = bc.B.Exp(ρ2).Mul(bc.C.Div(G).Exp(ω)) } - p := []Bytes{G, bc.A, bc.B, bc.C, c.R, c.X, c.Y, c.Z} + p := []Bytes{G, bc.A, bc.B, bc.C, c.R, c.X, rev.Y, rev.Z} for _, e := range ε[0] { p = append(p, e) } @@ -110,7 +118,7 @@ func (s *Stage) proof1() *Stage1Proof { } ch := Challenge(p...) - pr := &Stage1Proof{} + pr = &Stage1Proof{} α, _ := s.bit.Scalars() if s.bit.IsSet() { @@ -129,23 +137,24 @@ func (s *Stage) proof1() *Stage1Proof { pr.Rho[1][1] = ρ2 } + s.rev = rev s.prf1 = pr - return pr + return rev, pr } -func (c *Commitment) VerifyStage1(sc *StageCommitment, p *Stage1Proof) bool { +func (c *Commitment) VerifyStage1(sc *StageCommitment, r *StageReveal, p *Stage1Proof) bool { var ε [2][4]*Point ε[0][0] = G.Exp(p.Rho[0][0]).Mul(sc.X.Exp(p.Ch[0])) ε[0][1] = G.Exp(p.Rho[0][1]).Mul(c.A.Exp(p.Ch[0])) - ε[0][2] = sc.Y.Exp(p.Rho[0][0]).Mul(sc.Z.Exp(p.Ch[0])) + ε[0][2] = r.Y.Exp(p.Rho[0][0]).Mul(r.Z.Exp(p.Ch[0])) ε[0][3] = c.B.Exp(p.Rho[0][1]).Mul(c.C.Exp(p.Ch[0])) ε[1][0] = G.Exp(p.Rho[1][0]).Mul(sc.X.Exp(p.Ch[1])) ε[1][1] = G.Exp(p.Rho[1][1]).Mul(c.A.Exp(p.Ch[1])) - ε[1][2] = sc.R.Exp(p.Rho[1][0]).Mul(sc.Z.Exp(p.Ch[1])) + ε[1][2] = sc.R.Exp(p.Rho[1][0]).Mul(r.Z.Exp(p.Ch[1])) ε[1][3] = c.B.Exp(p.Rho[1][1]).Mul(c.C.Div(G).Exp(p.Ch[1])) - points := []Bytes{G, c.A, c.B, c.C, sc.R, sc.X, sc.Y, sc.Z} + points := []Bytes{G, c.A, c.B, c.C, sc.R, sc.X, r.Y, r.Z} for _, e := range ε[0] { points = append(points, e) } |