ceremonyclient/nekryptology/pkg/zkp/schnorr/schnorr.go

153 lines
5.5 KiB
Go
Raw Normal View History

2023-07-05 05:32:28 +00:00
//
// Copyright Coinbase, Inc. All Rights Reserved.
// Copyright Quilibrium, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//
// Package schnorr implements a Schnorr proof, slightly varied from as described and used in
// Doerner, et al. https://eprint.iacr.org/2018/499.pdf see Functionalities 6. it also
// implements a "committed" version, as described in Functionality 7. The variance is that
// we employ a hash-to-curve functionality of the given curve rather than setting raw bytes
// from a hash. This results in a double-hash, which is not ideal future work involves
// exposing the hash functionality of the hash-to-curve so that it is consistently the
// designated hash method chosen for the curve rather than sha3 + curve-defined hash.
package schnorr
import (
"crypto/rand"
"crypto/subtle"
"fmt"
"hash"
"github.com/pkg/errors"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
)
type Commitment = []byte
type Prover struct {
curve *curves.Curve
basePoint curves.Point
hash hash.Hash
uniqueSessionId []byte
}
// Proof contains the (c, s) schnorr proof. `Statement` is the curve point you're proving knowledge of discrete log of,
// with respect to the base point.
type Proof struct {
C curves.Scalar
S curves.Scalar
Statement curves.Point
}
// NewProver generates a `Prover` object, ready to generate Schnorr proofs on any given point.
// We allow the option `basePoint == nil`, in which case `basePoint` is auto-assigned to be the "default" generator for the group.
func NewProver(curve *curves.Curve, basepoint curves.Point, hash hash.Hash, uniqueSessionId []byte) *Prover {
if basepoint == nil {
basepoint = curve.NewGeneratorPoint()
}
return &Prover{
curve: curve,
basePoint: basepoint,
uniqueSessionId: uniqueSessionId,
hash: hash,
}
}
// Prove generates and returns a Schnorr proof, given the scalar witness `x`.
// in the process, it will actually also construct the statement (just one curve mult in this case)
func (p *Prover) Prove(x curves.Scalar) (*Proof, error) {
// assumes that params, and pub are already populated. populates the fields c and s...
var err error
result := &Proof{}
result.Statement = p.basePoint.Mul(x)
k := p.curve.Scalar.Random(rand.Reader)
random := p.basePoint.Mul(k)
p.hash.Reset()
if _, err = p.hash.Write(p.uniqueSessionId); err != nil {
return nil, errors.Wrap(err, "writing salt to hash in schnorr prove")
}
if _, err = p.hash.Write(p.basePoint.ToAffineCompressed()); err != nil {
return nil, errors.Wrap(err, "writing basePoint to hash in schnorr prove")
}
if _, err = p.hash.Write(result.Statement.ToAffineCompressed()); err != nil {
return nil, errors.Wrap(err, "writing statement to hash in schnorr prove")
}
if _, err = p.hash.Write(random.ToAffineCompressed()); err != nil {
return nil, errors.Wrap(err, "writing point K to hash in schnorr prove")
}
result.C = p.curve.Scalar.Hash(p.hash.Sum(nil))
if result.C == nil {
return nil, errors.New("writing point K to hash in schnorr prove")
}
result.S = result.C.Mul(x).Add(k)
return result, nil
}
// Verify verifies the `proof`, given the prover parameters `scalar` and `curve`.
// As for the prover, we allow `basePoint == nil`, in this case, it's auto-assigned to be the group's default generator.
func Verify(proof *Proof, curve *curves.Curve, basepoint curves.Point, hash hash.Hash, uniqueSessionId []byte) error {
if basepoint == nil {
basepoint = curve.NewGeneratorPoint()
}
hash.Reset()
gs := basepoint.Mul(proof.S)
xc := proof.Statement.Mul(proof.C.Neg())
random := gs.Add(xc)
if _, err := hash.Write(uniqueSessionId); err != nil {
return errors.Wrap(err, "writing salt to hash in schnorr verify")
}
if _, err := hash.Write(basepoint.ToAffineCompressed()); err != nil {
return errors.Wrap(err, "writing basePoint to hash in schnorr verify")
}
if _, err := hash.Write(proof.Statement.ToAffineCompressed()); err != nil {
return errors.Wrap(err, "writing statement to hash in schnorr verify")
}
if _, err := hash.Write(random.ToAffineCompressed()); err != nil {
return errors.Wrap(err, "writing point K to hash in schnorr verify")
}
hashPoint := curve.Scalar.Hash(hash.Sum(nil))
if hashPoint == nil || subtle.ConstantTimeCompare(proof.C.Bytes(), hashPoint.Bytes()) != 1 {
return fmt.Errorf("schnorr verification failed")
}
return nil
}
// ProveCommit generates _and_ commits to a schnorr proof which is later revealed; see Functionality 7.
// returns the Proof and Commitment.
func (p *Prover) ProveCommit(x curves.Scalar) (*Proof, Commitment, error) {
proof, err := p.Prove(x)
p.hash.Reset()
if err != nil {
return nil, nil, err
}
if _, err = p.hash.Write(proof.C.Bytes()); err != nil {
return nil, nil, err
}
if _, err = p.hash.Write(proof.S.Bytes()); err != nil {
return nil, nil, err
}
return proof, p.hash.Sum(nil), nil
}
// DecommitVerify receives a `Proof` and a `Commitment`; it first checks that the proof actually opens the commitment;
// then it verifies the proof. returns and error if either on eof thse fail.
func DecommitVerify(proof *Proof, commitment Commitment, curve *curves.Curve, hash hash.Hash, basepoint curves.Point, uniqueSessionId []byte) error {
hash.Reset()
if _, err := hash.Write(proof.C.Bytes()); err != nil {
return err
}
if _, err := hash.Write(proof.S.Bytes()); err != nil {
return err
}
if subtle.ConstantTimeCompare(hash.Sum(nil), commitment) != 1 {
return fmt.Errorf("initial hash decommitment failed")
}
return Verify(proof, curve, basepoint, hash, uniqueSessionId)
}