diff --git a/common/nym-compact-ecash/src/proofs/proof_spend.rs b/common/nym-compact-ecash/src/proofs/proof_spend.rs index a78b752a05..0ac19e86a7 100644 --- a/common/nym-compact-ecash/src/proofs/proof_spend.rs +++ b/common/nym-compact-ecash/src/proofs/proof_spend.rs @@ -136,7 +136,7 @@ impl SpendProof { instance: &SpendInstance, witness: &SpendWitness, verification_key: &VerificationKeyAuth, - R: Scalar, + rr: Scalar, ) -> Self { let grparams = params.grp(); // generate random values to replace each witness @@ -172,12 +172,12 @@ impl SpendProof { .map(|(attr, beta_i)| beta_i * attr) .sum::(); - let zkcm_A = g1 * r_o_a + gamma1 * r_l; - let zkcm_C = g1 * r_o_c + gamma1 * r_v; - let zkcm_D = g1 * r_o_d + gamma1 * r_t; - let zkcm_S = g1 * r_mu; + let zkcm_aa = g1 * r_o_a + gamma1 * r_l; + let zkcm_cc = g1 * r_o_c + gamma1 * r_v; + let zkcm_dd = g1 * r_o_d + gamma1 * r_t; + let zkcm_ss = g1 * r_mu; let zkcm_gamma11 = (instance.aa + instance.cc + gamma1) * r_mu + g1 * r_o_mu; - let zkcm_T = g1 * r_sk + (g1 * R) * r_lambda; + let zkcm_tt = g1 * r_sk + (g1 * rr) * r_lambda; let zkcm_gamma12 = (instance.aa + instance.dd + gamma1) * r_lambda + g1 * r_o_lambda; let zkcm_kappa_l = grparams.gen2() * r_r_l + params.pkRP().alpha + params.pkRP().beta * r_l; @@ -189,15 +189,15 @@ impl SpendProof { .chain(beta2_bytes.iter().map(|b| b.as_ref())) .chain(std::iter::once(instance.to_bytes().as_ref())) .chain(std::iter::once(zkcm_kappa.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_A.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_C.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_D.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_S.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_aa.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_cc.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_dd.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_ss.to_bytes().as_ref())) .chain(std::iter::once(zkcm_kappa_l.to_bytes().as_ref())) .chain(std::iter::once( zkcm_gamma11.to_affine().to_bytes().as_ref(), )) - .chain(std::iter::once(zkcm_T.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_tt.to_bytes().as_ref())) .chain(std::iter::once( zkcm_gamma12.to_affine().to_bytes().as_ref(), )), @@ -241,7 +241,7 @@ impl SpendProof { params: &Parameters, instance: &SpendInstance, verification_key: &VerificationKeyAuth, - R: Scalar, + rr: Scalar, ) -> bool { let grparams = params.grp(); let g1 = *grparams.gen1(); @@ -263,20 +263,20 @@ impl SpendProof { .map(|(attr, beta_i)| beta_i * attr) .sum::(); - let zkcm_A = + let zkcm_aa = g1 * self.response_o_a + gamma1 * self.response_l + instance.aa * self.challenge; - let zkcm_C = g1 * self.response_o_c + let zkcm_cc = g1 * self.response_o_c + gamma1 * self.response_attributes[1] + instance.cc * self.challenge; - let zkcm_D = g1 * self.response_o_d + let zkcm_dd = g1 * self.response_o_d + gamma1 * self.response_attributes[2] + instance.dd * self.challenge; - let zkcm_S = g1 * self.response_mu + instance.ss * self.challenge; + let zkcm_ss = g1 * self.response_mu + instance.ss * self.challenge; let zkcm_gamma11 = (instance.aa + instance.cc + gamma1) * self.response_mu + g1 * self.response_o_mu + gamma1 * self.challenge; - let zkcm_T = g1 * self.response_attributes[0] - + (g1 * R) * self.response_lambda + let zkcm_tt = g1 * self.response_attributes[0] + + (g1 * rr) * self.response_lambda + instance.tt * self.challenge; let zkcm_gamma12 = (instance.aa + instance.dd + gamma1) * self.response_lambda + g1 * self.response_o_lambda @@ -295,15 +295,15 @@ impl SpendProof { .chain(beta2_bytes.iter().map(|b| b.as_ref())) .chain(std::iter::once(instance.to_bytes().as_ref())) .chain(std::iter::once(zkcm_kappa.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_A.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_C.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_D.to_bytes().as_ref())) - .chain(std::iter::once(zkcm_S.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_aa.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_cc.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_dd.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_ss.to_bytes().as_ref())) .chain(std::iter::once(zkcm_kappa_l.to_bytes().as_ref())) .chain(std::iter::once( zkcm_gamma11.to_affine().to_bytes().as_ref(), )) - .chain(std::iter::once(zkcm_T.to_bytes().as_ref())) + .chain(std::iter::once(zkcm_tt.to_bytes().as_ref())) .chain(std::iter::once( zkcm_gamma12.to_affine().to_bytes().as_ref(), )), diff --git a/common/nym-compact-ecash/src/scheme/aggregation.rs b/common/nym-compact-ecash/src/scheme/aggregation.rs index 1a0660f184..d6f473ec43 100644 --- a/common/nym-compact-ecash/src/scheme/aggregation.rs +++ b/common/nym-compact-ecash/src/scheme/aggregation.rs @@ -145,9 +145,9 @@ pub fn aggregate_signatures( pub fn aggregate_wallets( params: &GroupParameters, verification_key: &VerificationKeyAuth, - skUser: &SecretKeyUser, + sk_user: &SecretKeyUser, wallets: &[PartialWallet], - reqInfo: &RequestInfo, + req_info: &RequestInfo, ) -> Result { // Aggregate partial wallets let signature_shares: Vec = wallets @@ -156,14 +156,14 @@ pub fn aggregate_wallets( .map(|(idx, wallet)| SignatureShare::new(*wallet.signature(), (idx + 1) as u64)) .collect(); - let attributes = vec![skUser.sk, reqInfo.get_v(), reqInfo.get_t()]; + let attributes = vec![sk_user.sk, req_info.get_v(), req_info.get_t()]; let aggregated_signature = aggregate_signature_shares(¶ms, &verification_key, &attributes, &signature_shares)?; Ok(Wallet { sig: aggregated_signature, - v: reqInfo.get_v(), - t: reqInfo.get_t(), + v: req_info.get_v(), + t: req_info.get_t(), l: Cell::new(0), }) } diff --git a/common/nym-compact-ecash/src/scheme/identify.rs b/common/nym-compact-ecash/src/scheme/identify.rs index 6682c3bd70..eaf3931150 100644 --- a/common/nym-compact-ecash/src/scheme/identify.rs +++ b/common/nym-compact-ecash/src/scheme/identify.rs @@ -4,6 +4,6 @@ use crate::scheme::Payment; pub fn identify(pay1: Payment, pay2: Payment) -> Result { // TODO: We should include here the check for S and payInfo - let pkUser = (pay2.tt * pay1.rr - pay1.tt * pay2.rr) * ((pay1.rr - pay2.rr).invert().unwrap()); - Ok(PublicKeyUser { pk: pkUser }) + let pk_user = (pay2.tt * pay1.rr - pay1.tt * pay2.rr) * ((pay1.rr - pay2.rr).invert().unwrap()); + Ok(PublicKeyUser { pk: pk_user }) } diff --git a/common/nym-compact-ecash/src/scheme/mod.rs b/common/nym-compact-ecash/src/scheme/mod.rs index f0e56b1a4f..c88a8f2637 100644 --- a/common/nym-compact-ecash/src/scheme/mod.rs +++ b/common/nym-compact-ecash/src/scheme/mod.rs @@ -71,8 +71,8 @@ impl Wallet { &self, params: &Parameters, verification_key: &VerificationKeyAuth, - skUser: &SecretKeyUser, - payInfo: &PayInfo, + sk_user: &SecretKeyUser, + pay_info: &PayInfo, ) -> Result<(Payment, &Self)> { if self.l() > params.L() { return Err(CompactEcashError::Spend( @@ -84,7 +84,7 @@ impl Wallet { // randomize signature in the wallet let (signature_prime, sign_blinding_factor) = self.signature().randomise(grparams); // construct kappa i.e., blinded attributes for show - let attributes = vec![skUser.sk, self.v(), self.t()]; + let attributes = vec![sk_user.sk, self.v(), self.t()]; // compute kappa let kappa = compute_kappa( &grparams, @@ -104,11 +104,11 @@ impl Wallet { let dd = grparams.gen1() * o_d + grparams.gamma1() * self.t(); // compute hash of the payment info - let rr = hash_to_scalar(payInfo.info); + let rr = hash_to_scalar(pay_info.info); // evaluate the pseudorandom functions let ss = pseudorandom_fgv(&grparams, self.v(), self.l()); - let tt = grparams.gen1() * skUser.sk + pseudorandom_fgt(&grparams, self.t(), self.l()) * rr; + let tt = grparams.gen1() * sk_user.sk + pseudorandom_fgt(&grparams, self.t(), self.l()) * rr; // compute values mu, o_mu, lambda, o_lambda let mu: Scalar = (self.v() + Scalar::from(self.l()) + Scalar::from(1)) @@ -130,7 +130,7 @@ impl Wallet { + params.pkRP().beta * Scalar::from(self.l()); // construct the zkp proof - let spendInstance = SpendInstance { + let spend_instance = SpendInstance { kappa, aa, cc, @@ -139,7 +139,7 @@ impl Wallet { tt, kappa_l, }; - let spendWitness = SpendWitness { + let spend_witness = SpendWitness { attributes, r: sign_blinding_factor, r_l: sign_l_blinding_factor, @@ -154,8 +154,8 @@ impl Wallet { }; let zk_proof = SpendProof::construct( ¶ms, - &spendInstance, - &spendWitness, + &spend_instance, + &spend_witness, &verification_key, rr, ); @@ -164,12 +164,12 @@ impl Wallet { let pay = Payment { kappa, sig: signature_prime, - ss: ss, - tt: tt, - aa: aa, - cc: cc, - dd: dd, - rr: rr, + ss, + tt, + aa, + cc, + dd, + rr, kappa_l, sig_l: sign_l_prime, zk_proof, @@ -230,7 +230,7 @@ impl Payment { &self, params: &Parameters, verification_key: &VerificationKeyAuth, - payinfo: &PayInfo, + pay_info: &PayInfo, ) -> Result { if bool::from(self.sig.0.is_identity()) { return Err(CompactEcashError::Spend( @@ -249,8 +249,26 @@ impl Payment { )); } + if bool::from(self.sig_l.0.is_identity()) { + return Err(CompactEcashError::Spend( + "The element h of the signature on l equals the identity".to_string(), + )); + } + + if !check_bilinear_pairing( + &self.sig_l.0.to_affine(), + &G2Prepared::from(self.kappa_l.to_affine()), + &self.sig_l.1.to_affine(), + params.grp().prepared_miller_g2(), + ) { + return Err(CompactEcashError::Spend( + "The bilinear check for kappa_l failed".to_string(), + )); + } + + // verify integrity of R - if !(self.rr == hash_to_scalar(payinfo.info)) { + if !(self.rr == hash_to_scalar(pay_info.info)) { return Err(CompactEcashError::Spend( "Integrity of R does not hold".to_string(), ));