ceremonyclient/nekryptology/pkg/signatures/bbs/pok_signature.go

160 lines
4.3 KiB
Go
Raw Normal View History

2023-07-05 05:32:28 +00:00
//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//
package bbs
import (
"fmt"
"io"
"github.com/gtank/merlin"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/signatures/common"
)
// PokSignature a.k.a. Proof of Knowledge of a Signature
// is used by the prover to convince a verifier
// that they possess a valid signature and
// can selectively disclose a set of signed messages
type PokSignature struct {
// These values correspond to values with the same name
// as section 4.5 in <https://eprint.iacr.org/2016/663.pdf>
aPrime, aBar, d curves.PairingPoint
// proof1 for proving signature
// proof2 for selective disclosure
proof1, proof2 *common.ProofCommittedBuilder
// secrets1 for proving signature
// secrets2 for proving relation
// g1 * h1^m1 * h2^m2.... for all disclosed messages
// m_i == d^r3 * h_0^{-s_prime} * h1^-m1 * h2^-m2.... for all undisclosed messages m_i
secrets1, secrets2 []curves.Scalar
}
// NewPokSignature creates the initial proof data before a Fiat-Shamir calculation
func NewPokSignature(sig *Signature,
generators *MessageGenerators,
msgs []common.ProofMessage,
reader io.Reader) (*PokSignature, error) {
if len(msgs) != generators.length {
return nil, fmt.Errorf("mismatch messages and generators")
}
r1 := getNonZeroScalar(sig.s, reader)
r2 := getNonZeroScalar(sig.s, reader)
r3, err := r1.Invert()
if err != nil {
return nil, err
}
sigMsgs := make([]curves.Scalar, len(msgs))
for i, m := range msgs {
sigMsgs[i] = m.GetMessage()
}
b := computeB(sig.s, sigMsgs, generators)
aPrime, ok := sig.a.Mul(r1).(curves.PairingPoint)
if !ok {
return nil, fmt.Errorf("invalid point")
}
aBar, ok := b.Mul(r1).Sub(aPrime.Mul(sig.e)).(curves.PairingPoint)
if !ok {
return nil, fmt.Errorf("invalid point")
}
// d = b * r1 + h0 * r2
d, ok := aPrime.SumOfProducts([]curves.Point{b, generators.h0}, []curves.Scalar{r1, r2}).(curves.PairingPoint)
if !ok {
return nil, fmt.Errorf("invalid point")
}
// s' = s + r2r3
sPrime := sig.s.Add(r2.Mul(r3))
// For proving relation aBar - d = aPrime * -e + h0 * r2
curve := curves.Curve{
Scalar: sig.s.Zero(),
Point: sig.a.Identity(),
}
proof1 := common.NewProofCommittedBuilder(&curve)
// For aPrime * -e
err = proof1.CommitRandom(aPrime, reader)
if err != nil {
return nil, err
}
err = proof1.CommitRandom(generators.h0, reader)
if err != nil {
return nil, err
}
secrets1 := []curves.Scalar{sig.e, r2}
// For selective disclosure
proof2 := common.NewProofCommittedBuilder(&curve)
// For d * -r3
err = proof2.CommitRandom(d.Neg(), reader)
if err != nil {
return nil, err
}
// For h0 * s'
err = proof2.CommitRandom(generators.h0, reader)
if err != nil {
return nil, err
}
secrets2 := make([]curves.Scalar, 0, len(msgs)+2)
secrets2 = append(secrets2, r3)
secrets2 = append(secrets2, sPrime)
for i, m := range msgs {
if m.IsHidden() {
err = proof2.Commit(generators.Get(i+1), m.GetBlinding(reader))
if err != nil {
return nil, err
}
secrets2 = append(secrets2, m.GetMessage())
}
}
return &PokSignature{
aPrime,
aBar,
d,
proof1,
proof2,
secrets1,
secrets2,
}, nil
}
// GetChallengeContribution returns the bytes that should be added to
// a sigma protocol transcript for generating the challenge
func (pok *PokSignature) GetChallengeContribution(transcript *merlin.Transcript) {
transcript.AppendMessage([]byte("A'"), pok.aPrime.ToAffineCompressed())
transcript.AppendMessage([]byte("Abar"), pok.aBar.ToAffineCompressed())
transcript.AppendMessage([]byte("D"), pok.d.ToAffineCompressed())
transcript.AppendMessage([]byte("Proof1"), pok.proof1.GetChallengeContribution())
transcript.AppendMessage([]byte("Proof2"), pok.proof2.GetChallengeContribution())
}
// GenerateProof converts the blinding factors and secrets into Schnorr proofs
func (pok *PokSignature) GenerateProof(challenge curves.Scalar) (*PokSignatureProof, error) {
proof1, err := pok.proof1.GenerateProof(challenge, pok.secrets1)
if err != nil {
return nil, err
}
proof2, err := pok.proof2.GenerateProof(challenge, pok.secrets2)
if err != nil {
return nil, err
}
return &PokSignatureProof{
aPrime: pok.aPrime,
aBar: pok.aBar,
d: pok.d,
proof1: proof1,
proof2: proof2,
}, nil
}