si-commitment-scheme 0.1.0

Pedersen commitments, Blake3-based polynomial commitments, batch opening/verification with binding and hiding properties
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

//! Statistical hiding property verification.
//!
//! The hiding property ensures that a commitment reveals nothing about
//! the committed value. For Pedersen commitments with proper randomness,
//! the commitment distribution is uniform regardless of the value.

use crate::pedersen::{PedersenCommitment, PedersenParams};
use curve25519_dalek::scalar::Scalar;

/// Verifier for the hiding property of commitments.
#[derive(Debug, Clone)]
pub struct HidingVerifier {
    /// Number of commitment samples per value.
    pub samples: usize,
}

impl HidingVerifier {
    /// Create a new verifier with the given sample count.
    pub fn new(samples: usize) -> Self {
        Self { samples }
    }

    /// Test that commitments to the same value produce different outputs.
    ///
    /// This confirms that randomness is being used properly.
    pub fn test_unique_commitments(&self, params: &PedersenParams, value: u64) -> bool {
        let scalar = Scalar::from(value);
        let mut seen = std::collections::HashSet::new();
        for _ in 0..self.samples {
            let (comm, _) = PedersenCommitment::commit(params, &scalar);
            let bytes = comm.compressed.to_bytes();
            if seen.contains(&bytes) {
                return false;
            }
            seen.insert(bytes);
        }
        seen.len() == self.samples
    }

    /// Test that commitments to different values are indistinguishable.
    ///
    /// Verifies that the commitment set for value A overlaps with the
    /// commitment set for value B at most minimally (statistical check).
    pub fn test_indistinguishability(
        &self,
        params: &PedersenParams,
        value_a: u64,
        value_b: u64,
    ) -> bool {
        let scalar_a = Scalar::from(value_a);
        let scalar_b = Scalar::from(value_b);
        let mut set_a = std::collections::HashSet::new();
        for _ in 0..self.samples {
            let (comm, _) = PedersenCommitment::commit(params, &scalar_a);
            set_a.insert(comm.compressed.to_bytes());
        }
        // No commitment to B should match any commitment to A
        for _ in 0..self.samples {
            let (comm, _) = PedersenCommitment::commit(params, &scalar_b);
            if set_a.contains(&comm.compressed.to_bytes()) {
                return false;
            }
        }
        true
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn unique_commitments() {
        let params = PedersenParams::default();
        let verifier = HidingVerifier::new(50);
        assert!(verifier.test_unique_commitments(&params, 42));
    }

    #[test]
    fn indistinguishability() {
        let params = PedersenParams::default();
        let verifier = HidingVerifier::new(50);
        assert!(verifier.test_indistinguishability(&params, 0, 1));
    }

    #[test]
    fn hiding_different_values() {
        let params = PedersenParams::default();
        let verifier = HidingVerifier::new(30);
        assert!(verifier.test_indistinguishability(&params, 100, 200));
    }
}