sigma-protocols 0.5.1

//! Discrete Logarithm Equality (DLEQ) proof.
//!
//! Proves that two points share the same discrete logarithm with respect to different bases.
//! Specifically, proves knowledge of α such that X = α * G and Y = α * H.

use curve25519_dalek::ristretto::RistrettoPoint;
use curve25519_dalek::scalar::Scalar;

use crate::error::{Error, Result};
use crate::sigma::{MultiPointCommitment, ScalarChallenge, ScalarResponse, SigmaProtocol};
use crate::utils::{random_scalar, scalar_from_state};

/// Public statement for DLEQ proof.
///
/// Contains two base points (g, h) and two result points (x, y).
#[derive(Clone, Debug)]
pub struct DLEQStatement {
    pub g: RistrettoPoint,
    pub h: RistrettoPoint,
    pub x: RistrettoPoint,
    pub y: RistrettoPoint,
}

/// Private witness for DLEQ proof: the common discrete logarithm.
#[derive(Clone, Debug)]
pub struct DLEQWitness {
    pub alpha: Scalar,
}

/// DLEQ proof implementation.
///
/// Proves that log_g(x) = log_h(y) without revealing the common logarithm.
pub struct DLEQProof;

impl SigmaProtocol for DLEQProof {
    type Statement = DLEQStatement;
    type Witness = DLEQWitness;
    type Commitment = MultiPointCommitment;
    type Challenge = ScalarChallenge;
    type Response = ScalarResponse;

    fn prover_commit(
        statement: &Self::Statement,
        _witness: &Self::Witness,
    ) -> (Self::Commitment, Vec<u8>) {
        let r = random_scalar();
        let a = r * statement.g;
        let b = r * statement.h;
        (MultiPointCommitment(vec![a, b]), r.to_bytes().to_vec())
    }

    fn prover_response(
        _statement: &Self::Statement,
        witness: &Self::Witness,
        state: &[u8],
        challenge: &Self::Challenge,
    ) -> Result<Self::Response> {
        let r = scalar_from_state(state)?;
        let response = r + challenge.0 * witness.alpha;
        Ok(ScalarResponse(response))
    }

    fn verifier(
        statement: &Self::Statement,
        commitment: &Self::Commitment,
        challenge: &Self::Challenge,
        response: &Self::Response,
    ) -> Result<()> {
        if commitment.0.len() != 2 {
            return Err(Error::InvalidCommitment);
        }

        let a = commitment.0[0];
        let b = commitment.0[1];

        let lhs_g = response.0 * statement.g;
        let rhs_g = a + challenge.0 * statement.x;

        let lhs_h = response.0 * statement.h;
        let rhs_h = b + challenge.0 * statement.y;

        if lhs_g == rhs_g && lhs_h == rhs_h {
            Ok(())
        } else {
            Err(Error::InvalidProof)
        }
    }
}