blsful 4.0.0-rc2

BLS signature implementation according to the IETF spec on the BLS12-381 curve.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

use crate::helpers::*;
use crate::impls::inner_types::*;
use crate::traits::{HashToPoint, HashToScalar, Pairing};
use crate::*;
use rand::RngExt;
use sha2::{Digest, Sha256};
use subtle::CtOption;

const SALT: &[u8] = b"TIMELOCK_BLS12381_XOF:HKDF-SHA2-256_";

/// Implement time lock encryption
pub trait BlsTimeCrypt:
    Pairing
    + HashToPoint<Output = Self::Signature>
    + HashToScalar<Output = <Self::Signature as Group>::Scalar>
{
    /// Create a new ciphertext
    fn seal(
        pk: Self::PublicKey,
        message: &[u8],
        id: &[u8],
        dst: &[u8],
    ) -> BlsResult<(Self::PublicKey, [u8; 32], Vec<u8>)> {
        if pk.is_identity().into() {
            return Err(BlsError::InvalidInputs(
                "public key is the identity point".to_string(),
            ));
        }

        // \alpha ← Zq
        let mut rng = get_crypto_rng();
        let alpha = Self::hash_to_scalar(rng.random::<[u8; 32]>(), SALT);
        debug_assert_eq!(alpha.is_zero().unwrap_u8(), 0u8);
        let msg_dst = Sha256::digest(message);
        // r = HZq(\alpha  || M)
        let alpha_bytes = alpha.to_repr();
        let mut r_input = Vec::with_capacity(alpha_bytes.as_ref().len() + msg_dst.len());
        r_input.extend_from_slice(alpha_bytes.as_ref());
        r_input.extend_from_slice(&msg_dst);
        let r = Self::hash_to_scalar(r_input.as_slice(), SALT);
        debug_assert_eq!(r.is_zero().unwrap_u8(), 0u8);

        // K = e(A^r, HG2(ρ))
        let k_rhs = pk * r;
        debug_assert_eq!(k_rhs.is_identity().unwrap_u8(), 0u8);
        let k_lhs = Self::hash_to_point(id, dst);
        debug_assert_eq!(k_lhs.is_identity().unwrap_u8(), 0u8);
        let k = Self::pairing(&[(k_lhs, k_rhs)]);
        debug_assert_eq!(k.is_identity().unwrap_u8(), 0u8);

        // U = P^r
        let u = Self::PublicKey::generator() * r;
        debug_assert_eq!(u.is_identity().unwrap_u8(), 0u8);
        // V = Hℓ(K) ⊕ \alpha
        let v = Self::compute_v(k, alpha.to_repr().as_ref());
        // W = HℓX(\alpha) ⊕ M
        let overhead_bytes = encode_message_with_len(message, 32);
        let w = Self::compute_w(alpha.to_repr().as_ref(), overhead_bytes.as_slice());

        Ok((u, v, w))
    }

    /// Open a ciphertext if the secret can verify the signature
    fn unseal(
        u: Self::PublicKey,
        v: &[u8; 32],
        w: &[u8],
        decryption_key: Self::Signature,
        is_valid: Choice,
    ) -> CtOption<Vec<u8>> {
        let valid_sk = !decryption_key.is_identity() & !u.is_identity();

        let k = Self::pairing(&[(decryption_key, u)]);
        let alpha = Self::compute_v(k, v);
        let plaintext = Self::compute_w(&alpha, w);

        let mut message = vec![];
        if let Some(overhead) = uint_zigzag::Uint::peek(plaintext.as_slice()) {
            let Ok(encoded_len) = uint_zigzag::Uint::try_from(&plaintext[..overhead]) else {
                return CtOption::new(w.to_vec(), 0u8.into());
            };
            let len = encoded_len.0 as usize;
            if len <= plaintext.len() - overhead {
                message = plaintext[overhead..overhead + len].to_vec();
            } else {
                return CtOption::new(w.to_vec(), 0u8.into());
            }
        }

        let msg_dst = Sha256::digest(&message);
        let mut r_input = Vec::with_capacity(alpha.len() + msg_dst.len());
        r_input.extend_from_slice(&alpha);
        r_input.extend_from_slice(&msg_dst);
        let r = Self::hash_to_scalar(r_input.as_slice(), SALT);
        debug_assert_eq!(r.is_zero().unwrap_u8(), 0u8);
        CtOption::new(
            message,
            ((Self::PublicKey::generator() * r) - u).is_identity() & is_valid & valid_sk,
        )
    }

    /// Compute the `V` value
    fn compute_v(k_tick: Self::PairingResult, alpha_or_v: &[u8]) -> [u8; 32] {
        // Hℓ(K)
        let output = Sha256::digest(k_tick.to_bytes().as_ref());
        // V = Hℓ(K') ⊕ \alpha
        let result = byte_xor(alpha_or_v, &output);
        let mut value = [0u8; 32];
        value.copy_from_slice(&result);
        value
    }

    /// Compute the `W` value
    fn compute_w(alpha: &[u8], msg: &[u8]) -> Vec<u8> {
        // W = HℓX(\alpha) ⊕ M
        shake128_xor(alpha, msg)
    }
}