libbrandt/smc.c

/* This file is part of libbrandt.
 * Copyright (C) 2016 GNUnet e.V.
 *
 * libbrandt is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 3 of the License, or (at your option) any later
 * version.
 *
 * libbrandt is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 * A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * libbrandt.  If not, see <http://www.gnu.org/licenses/>.
 */

/**
 * @file smc.c
 * @brief Implementation of the smc primitives.
 */

#include <gcrypt.h>

#include "crypto.h"
#include "internals.h"
#include "smc.h"
#include "util.h"

extern gcry_ctx_t       ec_ctx;
extern gcry_mpi_point_t ec_gen;
extern gcry_mpi_point_t ec_zero;
extern gcry_mpi_t       ec_n;


/**
 * smc_sums_partial calculates sums up until the current index and stores them
 * in @a out. @$f\forall i \leq len: out_i=sum_{h=1}^iin_h@$f
 *
 * @param[out] out Where to store the resulting sums. Points may be given
 * uninitialized, but the appropriate amount of memory has to be allocated
 * beforehand.
 * @param[in] in Input points.
 * @param[in] len The length of both @a out and @a in.
 */
static void
smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len)
{
	uint16_t i;

	for (i = 0; i < len; i++)
	{
		out[i] = gcry_mpi_point_new (0);
		gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx);
		brandt_assert (NULL != out[i]);
	}
}


/**
 * smc_sum calculates the sum of all input points. @$fout=sum_{i=1}^{len}in_i@$f
 *
 * @param[out] out Where to store the result
 * @param[in] in Input points.
 * @param[in] len The length of @a in.
 */
static void
smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len)
{
	uint16_t i;

	brandt_assert (NULL != out);
	/**TODO: how to copy a point more efficiently? */
	gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx);
	for (i = 0; i < len; i++)
		gcry_mpi_ec_add (out, out, in[i], ec_ctx);
}


/**
 * smc_compute_pkey calculates the shared public key
 *
 * @param[in,out] ad The struct AuctionData used
 */
void
smc_compute_pkey (struct AuctionData *ad)
{
	ad->Y = gcry_mpi_point_new (0);
	smc_sum (ad->Y, ad->y, ad->n);
}


/**
 * smc_zkp_dl
 *
 * @param v TODO
 * @param g TODO
 * @param x TODO
 * @param a TODO
 * @param c TODO
 * @param r TODO
 */
void
smc_zkp_dl (const gcry_mpi_point_t v,
            const gcry_mpi_point_t g,
            const gcry_mpi_t       x,
            const gcry_mpi_point_t a,
            gcry_mpi_t             c,
            gcry_mpi_t             r)
{
	gcry_mpi_t z = gcry_mpi_new (0);

	brandt_ec_keypair_create_base (a, z, g);

	/* compute challange c */
	/**TODO: generate c from HASH(g,v,a) and don't output it */
	brandt_ec_skey_create (c);
	gcry_mpi_mod (c, c, ec_n);

	gcry_mpi_mulm (r, c, x, ec_n);
	gcry_mpi_addm (r, r, z, ec_n);

	gcry_mpi_release (z);
}


/**
 * smc_zkp_dl_check
 *
 * @param v TODO
 * @param g TODO
 * @param a TODO
 * @param c TODO
 * @param r TODO
 * @return 0 if the proof is correct, something else otherwise
 */
int
smc_zkp_dl_check (const gcry_mpi_point_t v,
                  const gcry_mpi_point_t g,
                  const gcry_mpi_point_t a,
                  const gcry_mpi_t       c,
                  const gcry_mpi_t       r)
{
	int              ret;
	gcry_mpi_point_t left = gcry_mpi_point_new (0);
	gcry_mpi_point_t right = gcry_mpi_point_new (0);

	gcry_mpi_ec_mul (left, r, g, ec_ctx);
	gcry_mpi_ec_mul (right, c, v, ec_ctx);
	gcry_mpi_ec_add (right, a, right, ec_ctx);

	ret = brandt_ec_point_cmp (left, right);
	gcry_mpi_point_release (left);
	gcry_mpi_point_release (right);

	return ret;
}


void
smc_zkp_2dle (const gcry_mpi_point_t v,
              const gcry_mpi_point_t w,
              const gcry_mpi_point_t g1,
              const gcry_mpi_point_t g2,
              const gcry_mpi_t       x,
              gcry_mpi_point_t       a,
              gcry_mpi_point_t       b,
              gcry_mpi_t             c,
              gcry_mpi_t             r)
{
	gcry_mpi_t z = gcry_mpi_new (0);

	brandt_ec_keypair_create_base (a, z, g1);
	gcry_mpi_ec_mul (b, z, g2, ec_ctx);

	/* compute challange c */
	/**TODO: generate c from HASH(g1,g2,v,w,a,b) and don't output it */
	brandt_ec_skey_create (c);
	gcry_mpi_mod (c, c, ec_n);

	gcry_mpi_mulm (r, c, x, ec_n);
	gcry_mpi_addm (r, r, z, ec_n);

	gcry_mpi_release (z);
}


int
smc_zkp_2dle_check (const gcry_mpi_point_t v,
                    const gcry_mpi_point_t w,
                    const gcry_mpi_point_t g1,
                    const gcry_mpi_point_t g2,
                    const gcry_mpi_point_t a,
                    const gcry_mpi_point_t b,
                    const gcry_mpi_t       c,
                    const gcry_mpi_t       r)
{
	int              ret;
	gcry_mpi_point_t left = gcry_mpi_point_new (0);
	gcry_mpi_point_t right = gcry_mpi_point_new (0);

	gcry_mpi_ec_mul (left, r, g1, ec_ctx);
	gcry_mpi_ec_mul (right, c, v, ec_ctx);
	gcry_mpi_ec_add (right, a, right, ec_ctx);
	ret = brandt_ec_point_cmp (left, right);

	gcry_mpi_ec_mul (left, r, g2, ec_ctx);
	gcry_mpi_ec_mul (right, c, w, ec_ctx);
	gcry_mpi_ec_add (right, b, right, ec_ctx);
	ret |= brandt_ec_point_cmp (left, right);

	gcry_mpi_point_release (left);
	gcry_mpi_point_release (right);

	return ret;
}


void
smc_zkp_0og (gcry_mpi_point_t       alpha,
             const gcry_mpi_point_t m,
             const gcry_mpi_point_t y,
             gcry_mpi_point_t       beta,
             gcry_mpi_point_t       a1,
             gcry_mpi_point_t       a2,
             gcry_mpi_point_t       b1,
             gcry_mpi_point_t       b2,
             gcry_mpi_t             c,
             gcry_mpi_t             d1,
             gcry_mpi_t             d2,
             gcry_mpi_t             r1,
             gcry_mpi_t             r2)
{
	gcry_mpi_t r = gcry_mpi_new (0);
	gcry_mpi_t w = gcry_mpi_new (0);
	int        eq0 = !brandt_ec_point_cmp (m, ec_zero);
	int        eqg = !brandt_ec_point_cmp (m, ec_gen);

	if (!(eq0 ^ eqg))
		eprintf ("zero knowledge proof: m is neither 0 nor g");

	/* beta = r*g */
	brandt_ec_keypair_create (beta, r);
	gcry_mpi_mod (r, r, ec_n);

	/* alpha = m + r*y */
	gcry_mpi_ec_mul (alpha, r, y, ec_ctx);
	gcry_mpi_ec_add (alpha, m, alpha, ec_ctx);

	if (eq0)
	{   /* m == 0 */
		brandt_ec_keypair_create_base (a1, d1, beta);
		gcry_mpi_mod (d1, d1, ec_n);
		brandt_ec_keypair_create_base (b1, r1, y);
		gcry_mpi_mod (r1, r1, ec_n);

		/* a1 = r1*g + d1*beta */
		gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx);
		gcry_mpi_ec_add (a1, a2, a1, ec_ctx);

		/* b1 = r1*y + d1*(alpha-g) */
		gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx);
		gcry_mpi_ec_mul (a2, d1, b2, ec_ctx);
		gcry_mpi_ec_add (b1, b1, a2, ec_ctx);

		/* a2 = w * g */
		brandt_ec_keypair_create_base (a2, w, ec_gen);
		gcry_mpi_mod (w, w, ec_n);

		/* b2 = w * y */
		gcry_mpi_ec_mul (b2, w, y, ec_ctx);

		/* compute challange c */
		/**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */
		brandt_ec_skey_create (c);
		gcry_mpi_mod (c, c, ec_n);

		/* d2 = c - d1 */
		gcry_mpi_subm (d2, c, d1, ec_n);

		/* r2 = w - r*d2 */
		gcry_mpi_mulm (r2, r, d2, ec_n);
		gcry_mpi_subm (r2, w, r2, ec_n);
	}
	else
	{   /* m == g */
		brandt_ec_keypair_create_base (a2, d2, beta);
		gcry_mpi_mod (d2, d2, ec_n);
		brandt_ec_keypair_create_base (b2, r2, y);
		gcry_mpi_mod (r2, r2, ec_n);

		/* a2 = r2*g + d2*beta */
		gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx);
		gcry_mpi_ec_add (a2, a1, a2, ec_ctx);

		/* b2 = r2*y + d2*(alpha-0) */
		/* useless subtraction to have same amount of operations as in m == 0 */
		gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx);
		gcry_mpi_ec_mul (a1, d2, b1, ec_ctx);
		gcry_mpi_ec_add (b2, b2, a1, ec_ctx);

		/* a1 = w * g */
		brandt_ec_keypair_create_base (a1, w, ec_gen);
		gcry_mpi_mod (w, w, ec_n);

		/* b1 = w * y */
		gcry_mpi_ec_mul (b1, w, y, ec_ctx);

		/* compute challange c */
		/**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */
		brandt_ec_skey_create (c);
		gcry_mpi_mod (c, c, ec_n);

		/* d1 = c - d2 */
		gcry_mpi_subm (d1, c, d2, ec_n);

		/* r1 = w - r*d1 */
		gcry_mpi_mulm (r1, r, d1, ec_n);
		gcry_mpi_subm (r1, w, r1, ec_n);
	}

	gcry_mpi_release (r);
	gcry_mpi_release (w);
}


int
smc_zkp_0og_check (const gcry_mpi_point_t alpha,
                   const gcry_mpi_point_t y,
                   const gcry_mpi_point_t beta,
                   const gcry_mpi_point_t a1,
                   const gcry_mpi_point_t a2,
                   const gcry_mpi_point_t b1,
                   const gcry_mpi_point_t b2,
                   const gcry_mpi_t       c,
                   const gcry_mpi_t       d1,
                   const gcry_mpi_t       d2,
                   const gcry_mpi_t       r1,
                   const gcry_mpi_t       r2)
{
	int              ret;
	gcry_mpi_t       sum = gcry_mpi_new (0);
	gcry_mpi_point_t right = gcry_mpi_point_new (0);
	gcry_mpi_point_t tmp = gcry_mpi_point_new (0);

	/* c == d1 + d2 */
	gcry_mpi_addm (sum, d1, d2, ec_n);
	ret = gcry_mpi_cmp (c, sum);

	/* a1 == r1*g + d1*beta */
	gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx);
	gcry_mpi_ec_mul (right, d1, beta, ec_ctx);
	gcry_mpi_ec_add (right, tmp, right, ec_ctx);
	ret |= brandt_ec_point_cmp (a1, right) << 1;

	/* b1 == r1*y + d1*(alpha-g) */
	gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx);
	gcry_mpi_ec_mul (tmp, d1, right, ec_ctx);
	gcry_mpi_ec_mul (right, r1, y, ec_ctx);
	gcry_mpi_ec_add (right, right, tmp, ec_ctx);
	ret |= brandt_ec_point_cmp (b1, right) << 2;

	/* a2 == r2*g + d2*beta */
	gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx);
	gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx);
	gcry_mpi_ec_add (right, right, tmp, ec_ctx);
	ret |= brandt_ec_point_cmp (a2, right) << 3;

	/* b2 == r2*y + d2*alpha */
	gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx);
	gcry_mpi_ec_mul (right, r2, y, ec_ctx);
	gcry_mpi_ec_add (right, right, tmp, ec_ctx);
	ret |= brandt_ec_point_cmp (b2, right) << 4;

	gcry_mpi_release (sum);
	gcry_mpi_point_release (right);
	gcry_mpi_point_release (tmp);

	if (ret)
		weprintf ("ret: 0x%x", ret);
	return ret;
}


//GEN
//smc_hextodec (const char *s)
//{
//	size_t i;
//	char c;
//	pari_sp ltop = avma;
//	GEN ret = gen_0;
//
//	for (i = 0; i < strlen (s); i++)
//	{
//		errno = 0;
//		if (1 != sscanf (&s[i], "%1hhx", &c))
//		{
//			brandt_eprintf ("failed to parse hex (\"%s\") to decimal:", s);
//			return NULL;
//		}
//		ret = addis (shifti (ret, 4), c);
//	}
//	return gerepilecopy (ltop, ret);
//}