add outcome decryption plus test

1 files changed, 108 insertions, 2 deletions

diff --git a/crypto.c b/crypto.c
index bdc5842..f46c5df 100644
--- a/crypto.c
+++ b/crypto.c
@@ -820,7 +820,7 @@ smc_compute_outcome (struct AuctionData *ad, size_t *buflen)
 
 	brandt_assert (ad && buflen);
 
-	*buflen = (ad->n * ad->k *                       /* nk * (gamma, delta, proof2) */
+	*buflen = (ad->n * ad->k *                 /* nk * (gamma, delta, proof2) */
 	           (sizeof (*gamma) + sizeof (*delta) + sizeof (*proof2)));
 	if (NULL == (cur = (ret = calloc (1, *buflen))) ||
 	    NULL == (ad->gamma = smc_init3 (ad->n, ad->n, ad->k)) ||
@@ -963,7 +963,7 @@ smc_recv_outcome (struct AuctionData *ad,
 	if (buflen != (ad->n * ad->k *
 	               (2 * sizeof (struct ec_mpi) + sizeof (*proof2))))
 	{
-		weprintf ("wrong size of received encrypted bid");
+		weprintf ("wrong size of received outcome");
 		goto quit;
 	}
 
@@ -998,6 +998,112 @@ quit:
 
 
 /**
+ * smc_decrypt_outcome \todo
+ *
+ * @param ad TODO
+ * @param buflen TODO
+ */
+unsigned char *
+smc_decrypt_outcome (struct AuctionData *ad, size_t *buflen)
+{
+	unsigned char     *ret;
+	unsigned char     *cur;
+	gcry_mpi_point_t  tmp = gcry_mpi_point_new (0);
+	struct ec_mpi     *phi;
+	struct proof_2dle *proof2;
+
+	brandt_assert (ad && buflen);
+
+	*buflen = (ad->n * ad->k * (sizeof (*phi) + sizeof (*proof2)));
+	if (NULL == (cur = (ret = calloc (1, *buflen))) ||
+	    NULL == (ad->phi = smc_init3 (ad->n, ad->n, ad->k)))
+	{
+		weprintf ("unable to alloc memory for first price outcome decryption");
+		return NULL;
+	}
+
+	for (uint16_t i = 0; i < ad->n; i++)
+	{
+		for (uint16_t j = 0; j < ad->k; j++)
+		{
+			phi = (struct ec_mpi *)cur;
+			proof2 = (struct proof_2dle *)(cur + sizeof (*phi));
+
+			smc_sum (tmp, &ad->delta[0][i][j], ad->n, ad->n * ad->k);
+
+			/* copy still encrypted outcome to all other bidder layers so they
+			 * don't have to be recomputed to check the ZK proof_2dle's from
+			 * other bidders when receiving their outcome decryption messages */
+			for (uint16_t a = 0; a < ad->n; a++)
+				/**\todo: how to copy a point more efficiently? */
+				gcry_mpi_ec_add (ad->phi[a][i][j], ec_zero, tmp, ec_ctx);
+
+			/* decrypt outcome component and prove the correct key was used */
+			smc_zkp_2dle (ad->phi[ad->i][i][j],
+			              NULL,
+			              tmp,
+			              ec_gen,
+			              ad->x,
+			              proof2);
+
+			ec_point_serialize (phi, ad->phi[ad->i][i][j]);
+
+			cur += sizeof (*phi) + sizeof (*proof2);
+		}
+	}
+
+	gcry_mpi_point_release (tmp);
+	return ret;
+}
+
+
+int
+smc_recv_decryption (struct AuctionData *ad,
+                     unsigned char      *buf,
+                     size_t             buflen,
+                     uint16_t           sender)
+{
+	int               ret = 0;
+	unsigned char     *cur = buf;
+	struct proof_2dle *proof2;
+	gcry_mpi_point_t  phi = gcry_mpi_point_new (0);
+
+	brandt_assert (ad && buf);
+
+	if (buflen != (ad->n * ad->k * (sizeof (struct ec_mpi) + sizeof (*proof2))))
+	{
+		weprintf ("wrong size of received outcome decryption");
+		goto quit;
+	}
+
+	for (uint16_t i = 0; i < ad->n; i++)
+	{
+		for (uint16_t j = 0; j < ad->k; j++)
+		{
+			ec_point_parse (phi, (struct ec_mpi *)cur);
+			proof2 = (struct proof_2dle *)(cur + sizeof (struct ec_mpi));
+			if (smc_zkp_2dle_check (phi,
+			                        ad->y[sender],
+			                        ad->phi[sender][i][j],
+			                        ec_gen,
+			                        proof2))
+			{
+				weprintf ("wrong zkp2 for phi, y received");
+				goto quit;
+			}
+			gcry_mpi_ec_add (ad->phi[sender][i][j], phi, ec_zero, ec_ctx);
+			cur += sizeof (struct ec_mpi) + sizeof (*proof2);
+		}
+	}
+
+	ret = 1;
+quit:
+	gcry_mpi_point_release (phi);
+	return ret;
+}
+
+
+/**
  * smc_zkp_dl creates a proof of knowledge of @a x with \f$v = xg\f$ where
  * \f$g\f$ is the base point on Ed25519.
  *