ceremonyclient/node/execution/ceremony/application/ceremony_application_validating.go

235 lines
6.0 KiB
Go
Raw Normal View History

2023-09-25 02:43:35 +00:00
package application
import (
"bytes"
2024-01-03 07:31:42 +00:00
"crypto/rand"
2023-09-25 02:43:35 +00:00
"github.com/pkg/errors"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
"source.quilibrium.com/quilibrium/monorepo/node/protobufs"
)
func (a *CeremonyApplication) applyTranscript(
transcript *protobufs.CeremonyTranscript,
) error {
if len(a.UpdatedTranscript.G1Powers) != len(transcript.G1Powers) {
return errors.Wrap(errors.New("invalid g1s"), "apply transcript")
}
if len(a.UpdatedTranscript.G2Powers) != len(transcript.G2Powers) {
return errors.Wrap(errors.New("invalid g2s"), "apply transcript")
}
if len(a.UpdatedTranscript.RunningG1_256Witnesses) !=
len(transcript.RunningG1_256Witnesses) ||
len(transcript.RunningG1_256Witnesses) !=
len(a.LatestTranscript.RunningG1_256Witnesses)+1 {
return errors.Wrap(
errors.New("invalid witnesses"),
"apply transcript",
)
}
if len(a.UpdatedTranscript.RunningG2_256Powers) !=
len(transcript.RunningG2_256Powers) ||
len(transcript.RunningG2_256Powers) !=
len(a.LatestTranscript.RunningG2_256Powers)+1 {
return errors.Wrap(
errors.New("invalid g2^256 powers"),
"apply transcript",
)
}
2024-01-03 07:31:42 +00:00
g1s := make([]curves.Point, len(a.UpdatedTranscript.G1Powers))
2023-09-25 02:43:35 +00:00
for i := range a.UpdatedTranscript.G1Powers {
i := i
2024-01-03 07:31:42 +00:00
if !bytes.Equal(
a.UpdatedTranscript.G1Powers[i].KeyValue,
transcript.G1Powers[i].KeyValue,
) {
return errors.Wrap(errors.New("invalid g1s"), "apply transcript")
}
2023-09-25 02:43:35 +00:00
2024-01-03 07:31:42 +00:00
g1 := &curves.PointBls48581G1{}
x, err := g1.FromAffineCompressed(
a.UpdatedTranscript.G1Powers[i].KeyValue,
)
if err != nil {
return errors.Wrap(err, "apply transcript")
}
2024-01-03 07:31:42 +00:00
g1s[i] = x
2023-09-25 02:43:35 +00:00
}
2024-01-03 07:31:42 +00:00
g2s := make([]curves.Point, len(a.UpdatedTranscript.G2Powers))
2023-09-25 02:43:35 +00:00
for i := range a.UpdatedTranscript.G2Powers {
i := i
2024-01-03 07:31:42 +00:00
if !bytes.Equal(
a.UpdatedTranscript.G2Powers[i].KeyValue,
transcript.G2Powers[i].KeyValue,
) {
return errors.Wrap(errors.New("invalid g2s"), "apply transcript")
}
2024-01-03 07:31:42 +00:00
g2 := &curves.PointBls48581G2{}
x, err := g2.FromAffineCompressed(
a.UpdatedTranscript.G2Powers[i].KeyValue,
)
if err != nil {
return errors.Wrap(err, "apply transcript")
}
2023-09-25 02:43:35 +00:00
2024-01-03 07:31:42 +00:00
g2s[i] = x
2023-09-25 02:43:35 +00:00
}
g1Witnesses := []*curves.PointBls48581G1{}
for i := range a.UpdatedTranscript.RunningG1_256Witnesses {
if !bytes.Equal(
a.UpdatedTranscript.RunningG1_256Witnesses[i].KeyValue,
transcript.RunningG1_256Witnesses[i].KeyValue,
) {
return errors.Wrap(errors.New("invalid g1 witnesses"), "apply transcript")
}
g1w := &curves.PointBls48581G1{}
w, err := g1w.FromAffineCompressed(
a.UpdatedTranscript.RunningG1_256Witnesses[i].KeyValue,
)
if err != nil {
return errors.Wrap(err, "apply transcript")
}
g1w, _ = w.(*curves.PointBls48581G1)
g1Witnesses = append(g1Witnesses, g1w)
}
g2Powers := []*curves.PointBls48581G2{}
for i := range a.UpdatedTranscript.RunningG2_256Powers {
if !bytes.Equal(
a.UpdatedTranscript.RunningG2_256Powers[i].KeyValue,
transcript.RunningG2_256Powers[i].KeyValue,
) {
return errors.Wrap(
errors.New("invalid g2^256 powers"),
"apply transcript",
)
}
g2w := &curves.PointBls48581G2{}
w, err := g2w.FromAffineCompressed(
a.UpdatedTranscript.RunningG2_256Powers[i].KeyValue,
)
if err != nil {
return errors.Wrap(err, "apply transcript")
}
g2w, _ = w.(*curves.PointBls48581G2)
g2Powers = append(g2Powers, g2w)
}
if !g2Powers[len(g2Powers)-1].Equal(g2s[len(g2s)-1]) {
return errors.Wrap(
errors.New("invalid running g2^256 power"),
"apply transcript",
)
}
for i := 0; i < len(a.LatestTranscript.RunningG1_256Witnesses); i++ {
if !bytes.Equal(
a.LatestTranscript.RunningG1_256Witnesses[i].KeyValue,
a.UpdatedTranscript.RunningG1_256Witnesses[i].KeyValue,
) {
return errors.Wrap(
errors.New("running witness mismatch"),
"apply transcript",
)
}
}
for i := 0; i < len(a.LatestTranscript.RunningG2_256Powers); i++ {
if !bytes.Equal(
a.LatestTranscript.RunningG2_256Powers[i].KeyValue,
a.UpdatedTranscript.RunningG2_256Powers[i].KeyValue,
) {
return errors.Wrap(
errors.New("running g2^256 power mismatch"),
"apply transcript",
)
}
}
mpg2 := curves.BLS48581G2().Point.Generator().(curves.PairingPoint)
mpg2n := g2s[1].Neg().(curves.PairingPoint)
mpg1 := curves.BLS48581G1().Point.Generator().(curves.PairingPoint)
mpg1n := g1s[1].Neg().(curves.PairingPoint)
2024-01-03 07:31:42 +00:00
randoms := []curves.Scalar{}
sum := curves.BLS48581G1().Scalar.Zero()
for i := 0; i < len(g1s)-1; i++ {
randoms = append(randoms, curves.BLS48581G1().Scalar.Random(rand.Reader))
sum = sum.Add(randoms[i])
2023-09-25 02:43:35 +00:00
}
2024-01-03 07:31:42 +00:00
g1CheckR := g1s[0].SumOfProducts(g1s[1:], randoms)
g1CheckL := g1s[0].SumOfProducts(g1s[:len(g1s)-1], randoms)
if !mpg2.MultiPairing(
g1CheckL.(curves.PairingPoint),
mpg2n.Mul(sum).(curves.PairingPoint),
g1CheckR.(curves.PairingPoint),
mpg2.Mul(sum).(curves.PairingPoint),
).IsOne() {
2023-09-25 02:43:35 +00:00
return errors.Wrap(
errors.New("pairing check failed for g1s"),
"apply transcript",
)
}
2024-01-03 07:31:42 +00:00
var g2CheckL, g2CheckR curves.Point
g2Sum := curves.BLS48581G1().Scalar.Zero()
for i := 0; i < len(g2s)-1; i++ {
g2Sum = g2Sum.Add(randoms[i])
if g2CheckL == nil {
g2CheckL = g2s[0].Mul(randoms[0])
g2CheckR = g2s[1].Mul(randoms[0])
} else {
g2CheckL = g2CheckL.Add(g2s[i].Mul(randoms[i]))
g2CheckR = g2CheckR.Add(g2s[i+1].Mul(randoms[i]))
}
}
if !mpg2.MultiPairing(
mpg1n.Mul(g2Sum).(curves.PairingPoint),
g2CheckL.(curves.PairingPoint),
mpg1.Mul(g2Sum).(curves.PairingPoint),
g2CheckR.(curves.PairingPoint),
).IsOne() {
2023-09-25 02:43:35 +00:00
return errors.Wrap(
errors.New("pairing check failed for g2s"),
"apply transcript",
)
}
2024-01-03 07:31:42 +00:00
mp3 := make([]curves.PairingPoint, (len(g2Powers)-1)*4)
2023-09-25 02:43:35 +00:00
for i := 0; i < len(g2Powers)-1; i++ {
2024-01-03 07:31:42 +00:00
i := i
mp3[i*4+0] = g1Witnesses[i+1].Neg().(curves.PairingPoint)
mp3[i*4+1] = g2Powers[i]
mp3[i*4+2] = mpg1
mp3[i*4+3] = g2Powers[i+1]
2023-09-25 02:43:35 +00:00
}
2024-01-03 07:31:42 +00:00
l := mp3[0].MultiPairing(mp3...)
2023-09-25 02:43:35 +00:00
if !l.IsOne() {
return errors.Wrap(
errors.New("pairing check failed for witnesses"),
"apply transcript",
)
}
a.LatestTranscript = a.UpdatedTranscript
a.UpdatedTranscript = nil
return nil
}