SIGMA Proofs

A Rust implementation of SIGMA (Σ) zero-knowledge proof protocols and the Fiat-Shamir transform, following the IRTF CFRG specifications:

• draft-irtf-cfrg-sigma-protocols
• draft-irtf-cfrg-fiat-shamir

Features

Implemented Protocols

1. Schnorr Proof: Proves knowledge of a discrete logarithm
2. DLEQ Proof: Proves equality of discrete logarithms across different generators
3. Pedersen Commitment Proof: Proves knowledge of a Pedersen commitment opening

Core Components

• Fiat-Shamir Transform: Converts interactive protocols to non-interactive
• Duplex Sponge Construction: Based on SHAKE128 for challenge generation
• Transcript Management: Secure transcript handling with domain separation

Usage

Schnorr Proof Example

use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
use curve25519_dalek::scalar::Scalar;
use rand::rngs::OsRng;
use rand::TryRngCore;
use sigma_protocols::protocols::schnorr::{SchnorrProof, SchnorrStatement, SchnorrWitness};
use sigma_protocols::sigma::{SigmaProtocol, ScalarChallenge};

// Generate keys
let mut secret_bytes = [0u8; 32];
OsRng.try_fill_bytes(&mut secret_bytes).expect("Failed to generate random bytes");
let secret_key = Scalar::from_bytes_mod_order(secret_bytes);
let public_key = secret_key * RISTRETTO_BASEPOINT_POINT;

// Create statement and witness
let statement = SchnorrStatement { public_key };
let witness = SchnorrWitness { secret_key };

// Generate proof (interactive)
let (commitment, state) = SchnorrProof::prover_commit(&statement, &witness);
let mut challenge_bytes = [0u8; 32];
OsRng.try_fill_bytes(&mut challenge_bytes).expect("Failed to generate random bytes");
let challenge = ScalarChallenge(Scalar::from_bytes_mod_order(challenge_bytes));
let response = SchnorrProof::prover_response(&statement, &witness, &state, &challenge)?;

// Verify proof
SchnorrProof::verifier(&statement, &commitment, &challenge, &response)?;

Non-Interactive Proof with Fiat-Shamir

use sigma_protocols::fiat_shamir::FiatShamirTransform;
use sigma_protocols::sigma::{Challenge, Commitment, Response};

// Create Fiat-Shamir transform
let mut fs = FiatShamirTransform::new(
    b"schnorr-proof",
    b"my-protocol",
    b"session-123",
);

// Generate non-interactive proof
let (commitment, state) = SchnorrProof::prover_commit(&statement, &witness);
fs.absorb_commitment(&commitment.to_bytes());
let challenge_bytes = fs.generate_challenge(32);
let challenge = ScalarChallenge::from_bytes(&challenge_bytes)?;
let response = SchnorrProof::prover_response(&statement, &witness, &state, &challenge)?;

// Verify non-interactive proof
let mut verifier_fs = FiatShamirTransform::new(
    b"schnorr-proof",
    b"my-protocol",
    b"session-123",
);
verifier_fs.verify_transcript(
    &commitment.to_bytes(),
    &challenge_bytes,
    &response.to_bytes()
)?;

Security

• Elliptic Curve: Uses curve25519-dalek with Ristretto group for prime-order group operations
• Hash Function: SHAKE128 provides 128-bit security for challenge generation
• Constant-Time: Operations use the subtle crate to prevent timing attacks
• Random Generation: Cryptographically secure randomness via rand::OsRng
• Security Level: 128-bit computational security (not quantum-resistant for soundness)

Testing

Run tests with:

cargo test

Additional Examples

DLEQ (Discrete Log Equality) Proof

use sigma_protocols::protocols::dleq::{DLEQProof, DLEQStatement, DLEQWitness};

// Prove that log_g(x) = log_h(y)
let alpha = Scalar::from_bytes_mod_order(secret_bytes);
let x = alpha * g;
let y = alpha * h;

let statement = DLEQStatement { g, h, x, y };
let witness = DLEQWitness { alpha };

Pedersen Commitment Proof

use sigma_protocols::protocols::pedersen::{PedersenProof, PedersenStatement, PedersenWitness};

// Prove knowledge of commitment opening: C = v*G + r*H
let commitment = value * g + randomness * h;

let statement = PedersenStatement { g, h, commitment };
let witness = PedersenWitness { value, randomness };