Module sigma_fun::ext::dl_secp256k1_ed25519_eq[−][src]

Cross curve proof of Discrete Log equality between secp256k1 and ed25519.

Here “equality” means the two secret scalars have the same 252-bit representaion. To prove they have the same representation we make two sets of 252 pedersen commiments and show that:

  1. For i=0..252 we show the ith commitment is either to 0 or 2^i
  2. That the commiments are the same value for both sets.
  3. The sum of the commitments equals to the claimed public keys on each curve.

CrossCurveDLEQ is the main prover/verifier. The underlying Sigma protocol it uses is in CoreProof.

This was partially inspired by MRL-0010 but it re-imagines it as a Sigma protocol.

Example

Structs

CrossCurveDLEQ

The proof system which prepares the high level statement to be proved/verified with CoreProof.

CrossCurveDLEQProof

The proof the a public key on secp256k1 and ed25519 have the same 252-bit secret key.

Type Definitions

CoreProof

The underlying sigma protocol we will use to prove the relationship between the two sets of commitments.