diff --git a/common/nym-compact-ecash/src/proofs/proof_spend.rs b/common/nym-compact-ecash/src/proofs/proof_spend.rs index a6201d32ab..d24f16641c 100644 --- a/common/nym-compact-ecash/src/proofs/proof_spend.rs +++ b/common/nym-compact-ecash/src/proofs/proof_spend.rs @@ -5,7 +5,7 @@ use bls12_381::{G1Projective, G2Projective, Scalar}; use group::{Curve, Group, GroupEncoding}; use crate::error::{CompactEcashError, Result}; -use crate::proofs::{compute_challenge, produce_response, produce_responses, ChallengeDigest}; +use crate::proofs::{ChallengeDigest, compute_challenge, produce_response, produce_responses}; use crate::scheme::keygen::{SecretKeyUser, VerificationKeyAuth}; use crate::scheme::setup::{GroupParameters, Parameters}; use crate::utils::{try_deserialize_g1_projective, try_deserialize_g2_projective}; @@ -14,11 +14,11 @@ use crate::utils::{try_deserialize_g1_projective, try_deserialize_g2_projective} #[cfg_attr(test, derive(PartialEq))] pub struct SpendInstance { pub kappa: G2Projective, - pub A: G1Projective, - pub C: G1Projective, - pub D: G1Projective, - pub S: G1Projective, - pub T: G1Projective, + pub aa: G1Projective, + pub cc: G1Projective, + pub dd: G1Projective, + pub ss: G1Projective, + pub tt: G1Projective, pub kappa_l: G2Projective, } @@ -41,29 +41,29 @@ impl TryFrom<&[u8]> for SpendInstance { &kappa_bytes, CompactEcashError::Deserialization("Failed to deserialize kappa".to_string()), )?; - let A_bytes = bytes[96..144].try_into().unwrap(); - let A = try_deserialize_g1_projective( - &A_bytes, + let aa_bytes = bytes[96..144].try_into().unwrap(); + let aa = try_deserialize_g1_projective( + &aa_bytes, CompactEcashError::Deserialization("Failed to deserialize A".to_string()), )?; - let C_bytes = bytes[144..192].try_into().unwrap(); - let C = try_deserialize_g1_projective( - &C_bytes, + let cc_bytes = bytes[144..192].try_into().unwrap(); + let cc = try_deserialize_g1_projective( + &cc_bytes, CompactEcashError::Deserialization("Failed to deserialize C".to_string()), )?; - let D_bytes = bytes[192..240].try_into().unwrap(); - let D = try_deserialize_g1_projective( - &D_bytes, + let dd_bytes = bytes[192..240].try_into().unwrap(); + let dd = try_deserialize_g1_projective( + &dd_bytes, CompactEcashError::Deserialization("Failed to deserialize D".to_string()), )?; - let S_bytes = bytes[240..288].try_into().unwrap(); - let S = try_deserialize_g1_projective( - &S_bytes, + let ss_bytes = bytes[240..288].try_into().unwrap(); + let ss = try_deserialize_g1_projective( + &ss_bytes, CompactEcashError::Deserialization("Failed to deserialize S".to_string()), )?; - let T_bytes = bytes[288..336].try_into().unwrap(); - let T = try_deserialize_g1_projective( - &T_bytes, + let tt_bytes = bytes[288..336].try_into().unwrap(); + let tt = try_deserialize_g1_projective( + &tt_bytes, CompactEcashError::Deserialization("Failed to deserialize T".to_string()), )?; let kappa_l_bytes = bytes[336..432].try_into().unwrap(); @@ -74,11 +74,11 @@ impl TryFrom<&[u8]> for SpendInstance { Ok(SpendInstance { kappa, - A, - C, - D, - S, - T, + aa, + cc, + dd, + ss, + tt, kappa_l, }) } @@ -88,11 +88,11 @@ impl SpendInstance { pub(crate) fn to_bytes(&self) -> Vec { let mut bytes = Vec::with_capacity(2 * 96 + 5 * 48); bytes.extend_from_slice(self.kappa.to_bytes().as_ref()); - bytes.extend_from_slice(self.A.to_bytes().as_ref()); - bytes.extend_from_slice(self.C.to_bytes().as_ref()); - bytes.extend_from_slice(self.D.to_bytes().as_ref()); - bytes.extend_from_slice(self.S.to_bytes().as_ref()); - bytes.extend_from_slice(self.T.to_bytes().as_ref()); + bytes.extend_from_slice(self.aa.to_bytes().as_ref()); + bytes.extend_from_slice(self.cc.to_bytes().as_ref()); + bytes.extend_from_slice(self.dd.to_bytes().as_ref()); + bytes.extend_from_slice(self.ss.to_bytes().as_ref()); + bytes.extend_from_slice(self.tt.to_bytes().as_ref()); bytes.extend_from_slice(self.kappa_l.to_bytes().as_ref()); bytes } @@ -167,18 +167,18 @@ impl SpendProof { let zkcm_kappa = grparams.gen2() * r_r + verification_key.alpha + r_attributes - .iter() - .zip(verification_key.beta_g2.iter()) - .map(|(attr, beta_i)| beta_i * attr) - .sum::(); + .iter() + .zip(verification_key.beta_g2.iter()) + .map(|(attr, beta_i)| beta_i * attr) + .sum::(); let zkcm_A = g1 * r_o_a + gamma1 * r_l; let zkcm_C = g1 * r_o_c + gamma1 * r_v; let zkcm_D = g1 * r_o_d + gamma1 * r_t; let zkcm_S = g1 * r_mu; - let zkcm_gamma11 = (instance.A + instance.C + gamma1) * r_mu + g1 * r_o_mu; + let zkcm_gamma11 = (instance.aa + instance.cc + gamma1) * r_mu + g1 * r_o_mu; let zkcm_T = g1 * r_sk + (g1 * R) * r_lambda; - let zkcm_gamma12 = (instance.A + instance.D + gamma1) * r_lambda + g1 * r_o_lambda; + let zkcm_gamma12 = (instance.aa + instance.dd + gamma1) * r_lambda + g1 * r_o_lambda; let zkcm_kappa_l = grparams.gen2() * r_r_l + params.pkRP().alpha + params.pkRP().beta * r_l; // compute the challenge @@ -257,28 +257,28 @@ impl SpendProof { + grparams.gen2() * self.response_r + verification_key.alpha * (Scalar::one() - self.challenge) + self - .response_attributes - .iter() - .zip(verification_key.beta_g2.iter()) - .map(|(attr, beta_i)| beta_i * attr) - .sum::(); + .response_attributes + .iter() + .zip(verification_key.beta_g2.iter()) + .map(|(attr, beta_i)| beta_i * attr) + .sum::(); let zkcm_A = - g1 * self.response_o_a + gamma1 * self.response_l + instance.A * self.challenge; + g1 * self.response_o_a + gamma1 * self.response_l + instance.aa * self.challenge; let zkcm_C = g1 * self.response_o_c + gamma1 * self.response_attributes[1] - + instance.C * self.challenge; + + instance.cc * self.challenge; let zkcm_D = g1 * self.response_o_d + gamma1 * self.response_attributes[2] - + instance.D * self.challenge; - let zkcm_S = g1 * self.response_mu + instance.S * self.challenge; - let zkcm_gamma11 = (instance.A + instance.C + gamma1) * self.response_mu + + instance.dd * self.challenge; + let zkcm_S = g1 * self.response_mu + instance.ss * self.challenge; + let zkcm_gamma11 = (instance.aa + instance.cc + gamma1) * self.response_mu + g1 * self.response_o_mu + gamma1 * self.challenge; let zkcm_T = g1 * self.response_attributes[0] + (g1 * R) * self.response_lambda - + instance.T * self.challenge; - let zkcm_gamma12 = (instance.A + instance.D + gamma1) * self.response_lambda + + instance.tt * self.challenge; + let zkcm_gamma12 = (instance.aa + instance.dd + gamma1) * self.response_lambda + g1 * self.response_o_lambda + gamma1 * self.challenge; @@ -317,14 +317,14 @@ impl SpendProof { mod tests { use bls12_381::{G1Projective, G2Projective, Scalar}; use group::Curve; - use rand::{thread_rng, Rng}; + use rand::{Rng, thread_rng}; use crate::proofs::proof_spend::{SpendInstance, SpendProof, SpendWitness}; - use crate::scheme::aggregation::aggregate_verification_keys; - use crate::scheme::keygen::{ttp_keygen, PublicKeyUser, VerificationKeyAuth}; - use crate::scheme::setup::{setup, GroupParameters}; - use crate::scheme::PayInfo; use crate::scheme::{pseudorandom_fgt, pseudorandom_fgv}; + use crate::scheme::aggregation::aggregate_verification_keys; + use crate::scheme::keygen::{PublicKeyUser, ttp_keygen, VerificationKeyAuth}; + use crate::scheme::PayInfo; + use crate::scheme::setup::{GroupParameters, setup}; use crate::utils::hash_to_scalar; #[test] @@ -357,27 +357,27 @@ mod tests { let kappa = grparams.gen2() * r + verification_key.alpha + attributes - .iter() - .zip(verification_key.beta_g2.iter()) - .map(|(priv_attr, beta_i)| beta_i * priv_attr) - .sum::(); + .iter() + .zip(verification_key.beta_g2.iter()) + .map(|(priv_attr, beta_i)| beta_i * priv_attr) + .sum::(); let o_a = grparams.random_scalar(); let o_c = grparams.random_scalar(); let o_d = grparams.random_scalar(); // compute commitments A, C, D - let A = g1 * o_a + gamma1 * Scalar::from(l); - let C = g1 * o_c + gamma1 * v; - let D = g1 * o_d + gamma1 * t; + let aa = g1 * o_a + gamma1 * Scalar::from(l); + let cc = g1 * o_c + gamma1 * v; + let dd = g1 * o_d + gamma1 * t; // compute hash of the payment info let payInfo = PayInfo { info: [37u8; 32] }; - let R = hash_to_scalar(payInfo.info); + let rr = hash_to_scalar(payInfo.info); // evaluate the pseudorandom functions - let S = pseudorandom_fgv(&grparams, v, l); - let T = g1 * sk + pseudorandom_fgt(&grparams, t, l) * R; + let ss = pseudorandom_fgv(&grparams, v, l); + let tt = g1 * sk + pseudorandom_fgt(&grparams, t, l) * rr; // compute values mu, o_mu, lambda, o_lambda let mu: Scalar = (v + Scalar::from(l) + Scalar::from(1)).invert().unwrap(); @@ -395,11 +395,11 @@ mod tests { let instance = SpendInstance { kappa, - A, - C, - D, - S, - T, + aa, + cc, + dd, + ss, + tt, kappa_l, }; @@ -416,7 +416,7 @@ mod tests { o_mu, o_lambda, }; - let zk_proof = SpendProof::construct(¶ms, &instance, &witness, &verification_key, R); - assert!(zk_proof.verify(¶ms, &instance, &verification_key, R)) + let zk_proof = SpendProof::construct(¶ms, &instance, &witness, &verification_key, rr); + assert!(zk_proof.verify(¶ms, &instance, &verification_key, rr)) } } diff --git a/common/nym-compact-ecash/src/scheme/identify.rs b/common/nym-compact-ecash/src/scheme/identify.rs index 800188dc7d..6682c3bd70 100644 --- a/common/nym-compact-ecash/src/scheme/identify.rs +++ b/common/nym-compact-ecash/src/scheme/identify.rs @@ -4,6 +4,6 @@ use crate::scheme::Payment; pub fn identify(pay1: Payment, pay2: Payment) -> Result { // TODO: We should include here the check for S and payInfo - let pkUser = (pay2.T * pay1.R - pay1.T * pay2.R) * ((pay1.R - pay2.R).invert().unwrap()); + let pkUser = (pay2.tt * pay1.rr - pay1.tt * pay2.rr) * ((pay1.rr - pay2.rr).invert().unwrap()); Ok(PublicKeyUser { pk: pkUser }) } diff --git a/common/nym-compact-ecash/src/scheme/mod.rs b/common/nym-compact-ecash/src/scheme/mod.rs index e5bd15f232..266d3e4ad8 100644 --- a/common/nym-compact-ecash/src/scheme/mod.rs +++ b/common/nym-compact-ecash/src/scheme/mod.rs @@ -5,14 +5,14 @@ use std::convert::TryInto; use bls12_381::{G1Projective, G2Prepared, G2Projective, Scalar}; use group::{Curve, Group}; +use crate::Attribute; use crate::error::{CompactEcashError, Result}; use crate::proofs::proof_spend::{SpendInstance, SpendProof, SpendWitness}; use crate::scheme::keygen::{SecretKeyUser, VerificationKeyAuth}; use crate::scheme::setup::{GroupParameters, Parameters}; use crate::utils::{ - check_bilinear_pairing, hash_to_scalar, try_deserialize_g1_projective, Signature, SignerIndex, + check_bilinear_pairing, hash_to_scalar, Signature, SignerIndex, try_deserialize_g1_projective, }; -use crate::Attribute; pub mod aggregation; pub mod identify; @@ -99,16 +99,16 @@ impl Wallet { let o_d = grparams.random_scalar(); // compute commitments A, C, D - let A = grparams.gen1() * o_a + grparams.gamma1() * Scalar::from(self.l()); - let C = grparams.gen1() * o_c + grparams.gamma1() * self.v(); - let D = grparams.gen1() * o_d + grparams.gamma1() * self.t(); + let aa = grparams.gen1() * o_a + grparams.gamma1() * Scalar::from(self.l()); + let cc = grparams.gen1() * o_c + grparams.gamma1() * self.v(); + let dd = grparams.gen1() * o_d + grparams.gamma1() * self.t(); // compute hash of the payment info - let R = hash_to_scalar(payInfo.info); + let rr = hash_to_scalar(payInfo.info); // evaluate the pseudorandom functions - let S = pseudorandom_fgv(&grparams, self.v(), self.l()); - let T = grparams.gen1() * skUser.sk + pseudorandom_fgt(&grparams, self.t(), self.l()) * R; + let ss = pseudorandom_fgv(&grparams, self.v(), self.l()); + let tt = grparams.gen1() * skUser.sk + pseudorandom_fgt(&grparams, self.t(), self.l()) * rr; // compute values mu, o_mu, lambda, o_lambda let mu: Scalar = (self.v() + Scalar::from(self.l()) + Scalar::from(1)) @@ -132,11 +132,11 @@ impl Wallet { // construct the zkp proof let spendInstance = SpendInstance { kappa, - A, - C, - D, - S, - T, + aa, + cc, + dd, + ss, + tt, kappa_l, }; let spendWitness = SpendWitness { @@ -153,18 +153,18 @@ impl Wallet { o_lambda, }; let zk_proof = - SpendProof::construct(¶ms, &spendInstance, &spendWitness, &verification_key, R); + SpendProof::construct(¶ms, &spendInstance, &spendWitness, &verification_key, rr); // output pay and updated wallet let pay = Payment { kappa, sig: signature_prime, - S, - T, - A, - C, - D, - R, + ss: ss, + tt: tt, + aa: aa, + cc: cc, + dd: dd, + rr: rr, kappa_l, sig_l: sign_l_prime, zk_proof, @@ -195,10 +195,10 @@ pub fn compute_kappa( params.gen2() * blinding_factor + verification_key.alpha + attributes - .iter() - .zip(verification_key.beta_g2.iter()) - .map(|(priv_attr, beta_i)| beta_i * priv_attr) - .sum::() + .iter() + .zip(verification_key.beta_g2.iter()) + .map(|(priv_attr, beta_i)| beta_i * priv_attr) + .sum::() } pub struct PayInfo { @@ -209,12 +209,12 @@ pub struct PayInfo { pub struct Payment { pub kappa: G2Projective, pub sig: Signature, - pub S: G1Projective, - pub T: G1Projective, - pub A: G1Projective, - pub C: G1Projective, - pub D: G1Projective, - pub R: Scalar, + pub ss: G1Projective, + pub tt: G1Projective, + pub aa: G1Projective, + pub cc: G1Projective, + pub dd: G1Projective, + pub rr: Scalar, pub kappa_l: G2Projective, pub sig_l: Signature, pub zk_proof: SpendProof, @@ -245,7 +245,7 @@ impl Payment { } // verify integrity of R - if !(self.R == hash_to_scalar(payinfo.info)) { + if !(self.rr == hash_to_scalar(payinfo.info)) { return Err(CompactEcashError::Spend( "Integrity of R does not hold".to_string(), )); @@ -256,17 +256,17 @@ impl Payment { // verify the zk proof let instance = SpendInstance { kappa: self.kappa, - A: self.A, - C: self.C, - D: self.D, - S: self.S, - T: self.T, + aa: self.aa, + cc: self.cc, + dd: self.dd, + ss: self.ss, + tt: self.tt, kappa_l: self.kappa_l, }; if !self .zk_proof - .verify(¶ms, &instance, &verification_key, self.R) + .verify(¶ms, &instance, &verification_key, self.rr) { return Err(CompactEcashError::Spend( "ZkProof verification failed".to_string(), diff --git a/common/nym-compact-ecash/src/tests/e2e.rs b/common/nym-compact-ecash/src/tests/e2e.rs index 520b404372..d9522340e5 100644 --- a/common/nym-compact-ecash/src/tests/e2e.rs +++ b/common/nym-compact-ecash/src/tests/e2e.rs @@ -1,17 +1,17 @@ use itertools::izip; use crate::error::CompactEcashError; +use crate::scheme::{PartialWallet, Payment, pseudorandom_fgt}; use crate::scheme::aggregation::{ aggregate_signature_shares, aggregate_verification_keys, aggregate_wallets, }; use crate::scheme::identify::identify; use crate::scheme::keygen::{ - generate_keypair_user, ttp_keygen, PublicKeyUser, SecretKeyUser, VerificationKeyAuth, + generate_keypair_user, PublicKeyUser, SecretKeyUser, ttp_keygen, VerificationKeyAuth, }; -use crate::scheme::setup::{setup, GroupParameters, Parameters}; -use crate::scheme::withdrawal::{issue_verify, issue_wallet, withdrawal_request}; use crate::scheme::PayInfo; -use crate::scheme::{pseudorandom_fgt, PartialWallet, Payment}; +use crate::scheme::setup::{GroupParameters, Parameters, setup}; +use crate::scheme::withdrawal::{issue_verify, issue_wallet, withdrawal_request}; use crate::utils::{hash_to_scalar, SignatureShare}; #[test] @@ -45,8 +45,8 @@ fn main() -> Result<(), CompactEcashError> { wallet_blinded_signatures.iter(), verification_keys_auth.iter() ) - .map(|(w, vk)| issue_verify(&grparams, vk, &user_keypair.secret_key(), w, &req_info).unwrap()) - .collect(); + .map(|(w, vk)| issue_verify(&grparams, vk, &user_keypair.secret_key(), w, &req_info).unwrap()) + .collect(); // Aggregate partial wallets let aggr_wallet = aggregate_wallets( @@ -79,13 +79,13 @@ fn main() -> Result<(), CompactEcashError> { let payment2 = Payment { kappa: payment1.kappa.clone(), sig: payment1.sig.clone(), - S: payment1.S.clone(), - T: grparams.gen1() * user_keypair.secret_key().sk + ss: payment1.ss.clone(), + tt: grparams.gen1() * user_keypair.secret_key().sk + pseudorandom_fgt(&grparams, aggr_wallet.t(), l2) * R2, - A: payment1.A.clone(), - C: payment1.C.clone(), - D: payment1.D.clone(), - R: R2, + aa: payment1.aa.clone(), + cc: payment1.cc.clone(), + dd: payment1.dd.clone(), + rr: R2, kappa_l: payment1.kappa_l.clone(), sig_l: payment1.sig_l.clone(), zk_proof: payment1.zk_proof.clone(),