Struct Nizk 

pub struct Nizk<P>
where
    P: SigmaProtocol,
    P::Challenge: PartialEq,
{
    pub session_id: Vec<u8>,
    pub interactive_proof: P,
}

A Fiat-Shamir transformation of a SigmaProtocol into a non-interactive proof.

Nizk wraps an interactive Sigma protocol P to produce non-interactive proofs by deriving verifier challenges from a cryptographic sponge state.

Type Parameters

• P: the Sigma protocol implementation.

Fields

session_id: Vec<u8>

interactive_proof: P

Underlying interactive proof.

Implementations

impl<P> Nizk<P>

where P: SigmaProtocol, P::Challenge: PartialEq, P::Commitment: NargSerialize + NargDeserialize + Encoding, P::Response: NargSerialize + NargDeserialize + Encoding,

pub fn new(session_identifier: &[u8], interactive_proof: P) -> Self

Constructs a new Nizk instance.

Parameters

• iv: Domain separation tag for the hash function (e.g., protocol name or context).
• instance: An instance of the interactive Sigma protocol.

Returns

A new Nizk that can generate and verify non-interactive proofs.

pub fn prove_batchable( &self, witness: &P::Witness, rng: &mut impl ScalarRng, ) -> Result<Vec<u8>, Error>

Generates a batchable, serialized non-interactive proof.

Parameters

• witness: The secret witness.
• rng: A cryptographically secure random number generator.

Returns

A serialized proof suitable for batch verification.

Panics

Panics if serialization fails (should not happen under correct implementation).

Examples found in repository

examples/schnorr.rs (line 38)

fn prove(x: Scalar, P: RistrettoPoint) -> ProofResult<Vec<u8>> {
    let nizk = create_relation(P).into_nizk(b"sigma-proofs-example");
    nizk?.prove_batchable(&vec![x], &mut OsRng)
}

examples/simple_composition.rs (line 60)

fn prove(P1: G, x2: Scalar, H: G) -> ProofResult<Vec<u8>> {
    // Compute public values
    let P2 = G::generator() * x2;
    let Q = H * x2;

    let instance = create_relation(P1, P2, Q, H);
    // Create OR witness with branch 1 being the real one (index 1)
    let witness = ComposedWitness::Or(vec![
        ComposedWitness::Simple(vec![Scalar::from(0u64)]),
        ComposedWitness::Simple(vec![x2]),
    ]);
    let nizk = instance.into_nizk(b"or_proof_example");

    nizk.prove_batchable(&witness, &mut OsRng)
}

pub fn verify_batchable(&self, narg_string: &[u8]) -> Result<(), Error>

Verifies a batchable non-interactive proof.

Parameters

• proof: A serialized batchable proof.

Returns

• Ok(()) if the proof is valid.
• Err(Error) if deserialization or verification fails.

Errors

• Returns Error::VerificationFailure if:
  • The challenge doesn’t match the recomputed one from the commitment.
  • The response fails verification under the Sigma protocol.

Examples found in repository

examples/schnorr.rs (line 45)

fn verify(P: RistrettoPoint, proof: &[u8]) -> ProofResult<()> {
    let nizk = create_relation(P).into_nizk(b"sigma-proofs-example");
    nizk?.verify_batchable(proof)
}

examples/simple_composition.rs (line 69)

fn verify(P1: G, P2: G, Q: G, H: G, proof: &[u8]) -> ProofResult<()> {
    let protocol = create_relation(P1, P2, Q, H);
    let nizk = protocol.into_nizk(b"or_proof_example");

    nizk.verify_batchable(proof)
}

impl<P> Nizk<P>

where P: SigmaProtocol + SigmaProtocolSimulator, P::Challenge: PartialEq + NargDeserialize + NargSerialize,

pub fn prove_compact( &self, witness: &P::Witness, rng: &mut impl ScalarRng, ) -> Result<Vec<u8>, Error>

Generates a compact serialized proof.

Uses a more space-efficient representation compared to batchable proofs.

Parameters

• witness: The secret witness.
• rng: A cryptographically secure random number generator.

Returns

A compact, serialized proof.

Panics

Panics if serialization fails.

pub fn verify_compact(&self, proof: &[u8]) -> Result<(), Error>

Verifies a compact proof.

Recomputes the commitment from the challenge and response, then verifies it.

Parameters

• proof: A compact serialized proof.

Returns

• Ok(()) if the proof is valid.
• Err(Error) if deserialization or verification fails.

Errors

• Returns Error::VerificationFailure if:
  • Deserialization fails.
  • The recomputed commitment or response is invalid under the Sigma protocol.

Trait Implementations

impl<P> Debug for Nizk<P>

where P: SigmaProtocol + Debug, P::Challenge: PartialEq,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.