sigma-protocols 0.5.0

SIGMA zero-knowledge proof protocols
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

//! Pedersen commitment opening proof.
//!
//! Proves knowledge of the opening (value and randomness) of a Pedersen commitment.
//! Specifically, proves knowledge of (v, r) such that C = v * G + r * H.

use curve25519_dalek::ristretto::RistrettoPoint;
use curve25519_dalek::scalar::Scalar;
use rand::rngs::OsRng;
use rand::TryRngCore;

use crate::error::{Error, Result};
use crate::sigma::{MultiScalarResponse, PointCommitment, ScalarChallenge, SigmaProtocol};

/// Public statement for Pedersen commitment proof.
///
/// Contains the two base points and the commitment.
#[derive(Clone, Debug)]
pub struct PedersenStatement {
    pub g: RistrettoPoint,
    pub h: RistrettoPoint,
    pub commitment: RistrettoPoint,
}

/// Private witness for Pedersen commitment proof.
///
/// Contains the committed value and the randomness used.
#[derive(Clone, Debug)]
pub struct PedersenWitness {
    pub value: Scalar,
    pub randomness: Scalar,
}

/// Pedersen commitment opening proof implementation.
///
/// Proves knowledge of (v, r) such that C = v * G + r * H.
pub struct PedersenProof;

impl SigmaProtocol for PedersenProof {
    type Statement = PedersenStatement;
    type Witness = PedersenWitness;
    type Commitment = PointCommitment;
    type Challenge = ScalarChallenge;
    type Response = MultiScalarResponse;

    fn prover_commit(
        statement: &Self::Statement,
        _witness: &Self::Witness,
    ) -> (Self::Commitment, Vec<u8>) {
        let mut r_v_bytes = [0u8; 32];
        OsRng
            .try_fill_bytes(&mut r_v_bytes)
            .expect("Failed to generate random bytes");
        let r_v = Scalar::from_bytes_mod_order(r_v_bytes);
        let mut r_r_bytes = [0u8; 32];
        OsRng
            .try_fill_bytes(&mut r_r_bytes)
            .expect("Failed to generate random bytes");
        let r_r = Scalar::from_bytes_mod_order(r_r_bytes);

        let commitment = r_v * statement.g + r_r * statement.h;

        let mut state = Vec::with_capacity(64);
        state.extend_from_slice(&r_v.to_bytes());
        state.extend_from_slice(&r_r.to_bytes());

        (PointCommitment(commitment), state)
    }

    fn prover_response(
        _statement: &Self::Statement,
        witness: &Self::Witness,
        state: &[u8],
        challenge: &Self::Challenge,
    ) -> Result<Self::Response> {
        if state.len() != 64 {
            return Err(Error::InvalidProof);
        }

        let mut r_v_bytes = [0u8; 32];
        let mut r_r_bytes = [0u8; 32];
        r_v_bytes.copy_from_slice(&state[0..32]);
        r_r_bytes.copy_from_slice(&state[32..64]);

        let r_v_option = Scalar::from_canonical_bytes(r_v_bytes);
        let r_r_option = Scalar::from_canonical_bytes(r_r_bytes);

        let r_v = if r_v_option.is_some().unwrap_u8() == 1 {
            r_v_option.unwrap()
        } else {
            return Err(Error::InvalidScalar);
        };

        let r_r = if r_r_option.is_some().unwrap_u8() == 1 {
            r_r_option.unwrap()
        } else {
            return Err(Error::InvalidScalar);
        };

        let s_v = r_v + challenge.0 * witness.value;
        let s_r = r_r + challenge.0 * witness.randomness;

        Ok(MultiScalarResponse(vec![s_v, s_r]))
    }

    fn verifier(
        statement: &Self::Statement,
        commitment: &Self::Commitment,
        challenge: &Self::Challenge,
        response: &Self::Response,
    ) -> Result<()> {
        if response.0.len() != 2 {
            return Err(Error::InvalidResponse);
        }

        let s_v = response.0[0];
        let s_r = response.0[1];

        let lhs = s_v * statement.g + s_r * statement.h;

        let rhs = commitment.0 + challenge.0 * statement.commitment;

        if lhs == rhs {
            Ok(())
        } else {
            Err(Error::InvalidProof)
        }
    }
}