diff options
Diffstat (limited to 'nizk/stage2.go')
| -rw-r--r-- | nizk/stage2.go | 221 |
1 files changed, 0 insertions, 221 deletions
diff --git a/nizk/stage2.go b/nizk/stage2.go deleted file mode 100644 index d5e8070..0000000 --- a/nizk/stage2.go +++ /dev/null @@ -1,221 +0,0 @@ -package nizk - -import ( - . "kesim.org/seal/common" -) - -// Represents the proof of a statement of the following form: -// -// ( Z=g^(x*y) && X=g^x && Y=g^y && Z_=g^(x_*y_) && X_=g^x_ && Y_=g^y_ ) // case "lost" -// || ( Z=g^(x*y) && X=g^x && Y=g^y && Z_=g^(x_*r_) && X_=g^x_ && R_=g^r_ && C=g^(a*b) && A=g^a && B=g^b ) // case "unset" -// || ( Z=g^(x*r) && X=g^x && R=g^r && Z_=g^(x_*r_) && X_=g^x_ && R_=g^r_ && C=g^(a*b+1) && A=g^a && B=g^b ) // case "set" -// -// for given A, B, C, R, X, Y, Z, R_, X_, Y_, Z_ on the curve -type Stage2Proof struct { - Ch [3]*Scalar - R1 [3]*Scalar - R2 [3]*Scalar - R3 [2]*Scalar -} - -func (b *Bit) RevealStage2(lost bool, prev *Bit, Xs ...*Point) (rv2 *StageReveal, pr *Stage2Proof) { - if b.Stage == nil { - b.StageCommit() - } - s := b.Stage - - var ( - ε1, ε1_ [3]Bytes - ε2, ε2_ [3]Bytes - ε3, ε3_ [2]Bytes - - ρ1, ρ2 [3]*Scalar - ρ3 [2]*Scalar - ω [2]*Scalar - ) - - for _, s := range [][]*Scalar{ρ1[:], ρ2[:], ρ3[:], ω[:]} { - for i := range s { - s[i] = Curve.RandomScalar() - } - } - - c1 := prev.StageCommitment - c2 := s.StageCommitment - rv1 := prev.StageReveal - b.StageReveal = b.reveal(prev.Sent, Xs...) - rv2 = b.StageReveal - - if lost { - ε1[0] = G.Exp(ρ1[0]).Mul(c2.X.Exp(ω[0])) - ε1[1] = G.Exp(ρ1[1]).Mul(c1.X.Exp(ω[0])) - ε1[2] = G.Exp(ρ1[2]).Mul(b.A.Exp(ω[0])) - - ε1_[0] = c2.R.Exp(ρ1[0]).Mul(rv2.Z.Exp(ω[0])) - ε1_[1] = c1.R.Exp(ρ1[1]).Mul(rv1.Z.Exp(ω[0])) - ε1_[2] = b.B.Exp(ρ1[2]).Mul(b.C.Div(G).Exp(ω[0])) - - ε2[0] = G.Exp(ρ2[0]).Mul(c2.X.Exp(ω[1])) - ε2[1] = G.Exp(ρ2[1]).Mul(c1.X.Exp(ω[1])) - ε2[2] = G.Exp(ρ2[2]).Mul(b.A.Exp(ω[1])) - - ε2_[0] = rv2.Y.Exp(ρ2[0]).Mul(rv2.Z.Exp(ω[1])) - ε2_[1] = c1.R.Exp(ρ2[1]).Mul(rv1.Z.Exp(ω[1])) - ε2_[2] = b.B.Exp(ρ2[2]).Mul(b.C.Exp(ω[1])) - - ε3[0] = G.Exp(ρ3[0]) - ε3[1] = G.Exp(ρ3[1]) - - ε3_[0] = rv2.Y.Exp(ρ3[0]) - ε3_[1] = rv1.Y.Exp(ρ3[1]) - } else { - if b.IsSet() { - ε1[0] = G.Exp(ρ1[0]) - ε1[1] = G.Exp(ρ1[1]) - ε1[2] = G.Exp(ρ1[2]) - - ε1_[0] = c2.R.Exp(ρ1[0]) - ε1_[1] = c1.R.Exp(ρ1[1]) - ε1_[2] = b.B.Exp(ρ1[2]) - - ε2[0] = G.Exp(ρ2[0]).Mul(c2.X.Exp(ω[0])) - ε2[1] = G.Exp(ρ2[1]).Mul(c1.X.Exp(ω[0])) - ε2[2] = G.Exp(ρ2[2]).Mul(b.A.Exp(ω[0])) - - ε2_[0] = rv2.Y.Exp(ρ2[0]).Mul(rv2.Z.Exp(ω[0])) - ε2_[1] = c1.R.Exp(ρ2[1]).Mul(rv1.Z.Exp(ω[0])) - ε2_[2] = b.B.Exp(ρ2[2]).Mul(b.C.Exp(ω[0])) - - ε3[0] = G.Exp(ρ3[0]).Mul(c2.X.Exp(ω[1])) - ε3[1] = G.Exp(ρ3[1]).Mul(c1.X.Exp(ω[1])) - - ε3_[0] = rv2.Y.Exp(ρ3[0]).Mul(rv2.Z.Exp(ω[1])) - ε3_[1] = rv1.Y.Exp(ρ3[1]).Mul(rv1.Z.Exp(ω[1])) - } else { - ε1[0] = G.Exp(ρ1[0]).Mul(c2.X.Exp(ω[0])) - ε1[1] = G.Exp(ρ1[1]).Mul(c1.X.Exp(ω[0])) - ε1[2] = G.Exp(ρ1[2]).Mul(b.A.Exp(ω[0])) - - ε1_[0] = c2.R.Exp(ρ1[0]).Mul(rv2.Z.Exp(ω[0])) - ε1_[1] = c1.R.Exp(ρ1[1]).Mul(rv1.Z.Exp(ω[0])) - ε1_[2] = b.B.Exp(ρ1[2]).Mul(b.C.Div(G).Exp(ω[0])) - - ε2[0] = G.Exp(ρ2[0]) - ε2[1] = G.Exp(ρ2[1]) - ε2[2] = G.Exp(ρ2[2]) - - ε2_[0] = rv2.Y.Exp(ρ2[0]) - ε2_[1] = c1.R.Exp(ρ2[1]) - ε2_[2] = b.B.Exp(ρ2[2]) - - ε3[0] = G.Exp(ρ3[0]).Mul(c2.X.Exp(ω[1])) - ε3[1] = G.Exp(ρ3[1]).Mul(c1.X.Exp(ω[1])) - - ε3_[0] = rv2.Y.Exp(ρ3[0]).Mul(rv2.Z.Exp(ω[1])) - ε3_[1] = rv1.Y.Exp(ρ3[1]).Mul(rv1.Z.Exp(ω[1])) - } - } - - points := []Bytes{G, b.A, b.B, b.C, c2.R, c2.X, rv2.Y, rv2.Z, c1.R, c1.X, rv1.Y, rv1.Z} - points = append(points, ε1[:]...) - points = append(points, ε2[:]...) - points = append(points, ε3[:]...) - points = append(points, ε1_[:]...) - points = append(points, ε2_[:]...) - points = append(points, ε3_[:]...) - - ch := Challenge(points...) - pr = &Stage2Proof{} - - if lost { - pr.Ch[0] = ω[0] - pr.Ch[1] = ω[1] - pr.Ch[2] = ch.Sub(ω[0]).Sub(ω[1]) - - pr.R1[0] = ρ1[0] - pr.R1[1] = ρ1[1] - pr.R1[2] = ρ1[2] - - pr.R2[0] = ρ2[0] - pr.R2[1] = ρ2[1] - pr.R2[2] = ρ2[2] - - pr.R3[0] = ρ3[0].Sub(s.x.Mul(pr.Ch[2])) - pr.R3[1] = ρ3[1].Sub(prev.x.Mul(pr.Ch[2])) - } else { - if b.IsSet() { - pr.Ch[0] = ch.Sub(ω[0]).Sub(ω[1]) - pr.Ch[1] = ω[0] - pr.Ch[2] = ω[1] - - pr.R1[0] = ρ1[0].Sub(s.x.Mul(pr.Ch[0])) - pr.R1[1] = ρ1[1].Sub(prev.x.Mul(pr.Ch[0])) - pr.R1[2] = ρ1[2].Sub(b.α.Mul(pr.Ch[0])) - - pr.R2[0] = ρ2[0] - pr.R2[1] = ρ2[1] - pr.R2[2] = ρ2[2] - - pr.R3[0] = ρ3[0] - pr.R3[1] = ρ3[1] - } else { - pr.Ch[0] = ω[0] - pr.Ch[1] = ch.Sub(ω[0]).Sub(ω[1]) - pr.Ch[2] = ω[1] - - pr.R1[0] = ρ1[0] - pr.R1[1] = ρ1[1] - pr.R1[2] = ρ1[2] - - pr.R2[0] = ρ2[0].Sub(s.x.Mul(pr.Ch[1])) - pr.R2[1] = ρ2[1].Sub(prev.x.Mul(pr.Ch[1])) - pr.R2[2] = ρ2[2].Sub(b.α.Mul(pr.Ch[1])) - - pr.R3[0] = ρ3[0] - pr.R3[1] = ρ3[1] - } - } - - return rv2, pr -} - -func (c *Commitment) VerifyStage2(c1, c2 *StageCommitment, r1, r2 *StageReveal, p *Stage2Proof) bool { - var ( - e1, e1_ [3]Bytes - e2, e2_ [3]Bytes - e3, e3_ [2]Bytes - ) - e1[0] = G.Exp(p.R1[0]).Mul(c2.X.Exp(p.Ch[0])) - e1[1] = G.Exp(p.R1[1]).Mul(c1.X.Exp(p.Ch[0])) - e1[2] = G.Exp(p.R1[2]).Mul(c.A.Exp(p.Ch[0])) - - e1_[0] = c2.R.Exp(p.R1[0]).Mul(r2.Z.Exp(p.Ch[0])) - e1_[1] = c1.R.Exp(p.R1[1]).Mul(r1.Z.Exp(p.Ch[0])) - e1_[2] = c.B.Exp(p.R1[2]).Mul(c.C.Div(G).Exp(p.Ch[0])) - - e2[0] = G.Exp(p.R2[0]).Mul(c2.X.Exp(p.Ch[1])) - e2[1] = G.Exp(p.R2[1]).Mul(c1.X.Exp(p.Ch[1])) - e2[2] = G.Exp(p.R2[2]).Mul(c.A.Exp(p.Ch[1])) - - e2_[0] = r2.Y.Exp(p.R2[0]).Mul(r2.Z.Exp(p.Ch[1])) - e2_[1] = c1.R.Exp(p.R2[1]).Mul(r1.Z.Exp(p.Ch[1])) - e2_[2] = c.B.Exp(p.R2[2]).Mul(c.C.Exp(p.Ch[1])) - - e3[0] = G.Exp(p.R3[0]).Mul(c2.X.Exp(p.Ch[2])) - e3[1] = G.Exp(p.R3[1]).Mul(c1.X.Exp(p.Ch[2])) - - e3_[0] = r2.Y.Exp(p.R3[0]).Mul(r2.Z.Exp(p.Ch[2])) - e3_[1] = r1.Y.Exp(p.R3[1]).Mul(r1.Z.Exp(p.Ch[2])) - - points := []Bytes{G, c.A, c.B, c.C, c2.R, c2.X, r2.Y, r2.Z, c1.R, c1.X, r1.Y, r1.Z} - points = append(points, e1[:]...) - points = append(points, e2[:]...) - points = append(points, e3[:]...) - points = append(points, e1_[:]...) - points = append(points, e2_[:]...) - points = append(points, e3_[:]...) - - ch := Challenge(points...) - - return p.Ch[0].Add(p.Ch[1]).Add(p.Ch[2]).Equal(ch) -} |