Struct DLogProof 

pub struct DLogProof<C: DklsCurve> {
    pub point: C::AffinePoint,
    pub rand_commitments: Vec<C::AffinePoint>,
    pub proofs: Vec<InteractiveDLogProof<C>>,
}

Schnorr’s protocol (non-interactive via randomized Fischlin transform).

In order to remove interaction, we employ the “randomized Fischlin transform” described in Figure 9 of https://eprint.iacr.org/2022/393.pdf. However, we will follow the approach in Figure 27 of https://eprint.iacr.org/2022/1525.pdf. It seems to come from Section 5.1 of the first paper.

There are some errors in this description (for example, xi_i and xi_{i+r/2} are always the empty set), and thus we adapt Figure 9 of the first article. There is still a problem: the paper says to choose r and l such that, in particular, rl = 2^lambda. If lambda = 256, then r or l are astronomically large and the protocol becomes computationally infeasible. We will use instead the condition rl = lambda. We believe this is what the authors wanted, since this condition appears in most of the rest of the first paper.

With lambda = 256, we chose r = 64 and l = 4 (higher values of l were too slow). In this case, the constant t from the paper is equal to 32.

Fields

point: C::AffinePoint

rand_commitments: Vec<C::AffinePoint>

proofs: Vec<InteractiveDLogProof<C>>

Implementations

impl<C: DklsCurve> DLogProof<C>

pub fn prove( scalar: &C::Scalar, session_id: &[u8], ) -> Result<DLogProof<C>, ProofSearchExhausted>

Computes a proof for the witness scalar.

Returns an error if the Fischlin proof-of-work search is exhausted without finding all required hash collisions. This is astronomically unlikely with a correct RNG but must not be silently ignored.

pub fn verify(proof: &DLogProof<C>, session_id: &[u8]) -> bool

Verification of a proof of discrete logarithm.

Note that the point to be verified is in proof.

pub fn prove_commit( scalar: &C::Scalar, session_id: &[u8], ) -> Result<(DLogProof<C>, HashOutput), ProofSearchExhausted>

Produces an instance of DLogProof (for the witness scalar) together with a commitment (its hash).

The commitment is transmitted first and the proof is sent later when needed. Computes a proof with a commitment, propagating proof generation errors.

pub fn decommit_verify( proof: &DLogProof<C>, commitment: &HashOutput, session_id: &[u8], ) -> bool

Verifies a proof and checks it against the commitment.

Trait Implementations

impl<C: Clone + DklsCurve> Clone for DLogProof<C>

where C::AffinePoint: Clone,

fn clone(&self) -> DLogProof<C>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<C: Debug + DklsCurve> Debug for DLogProof<C>

where C::AffinePoint: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, C: DklsCurve> Deserialize<'de> for DLogProof<C>

where C::AffinePoint: Deserialize<'de>, C::Scalar: Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<C: DklsCurve> Serialize for DLogProof<C>

where C::AffinePoint: Serialize, C::Scalar: Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.