unfinished changes for nym api topology caching and endpoints

* Generate GW moniker if missing

Beside that:
- clear up gw nomenclature
- adjust counting when legacy nodes are present in nym node APIs
- create utils module

* Store gatewy descriptions

* Clippy & version

Cargo.toml

@@ -66,6 +66,7 @@ members = [
     "common/nym-id",
     "common/nym-metrics",
     "common/nym_offline_compact_ecash",
+    "common/nymcoconut",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.49"
+version = "1.1.48"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.49"
+version = "1.1.48"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/bandwidth-controller/src/lib.rs

@@ -105,24 +105,26 @@ impl<C, St: Storage> BandwidthController<C, St> {
     async fn get_aggregate_verification_key(
         &self,
         epoch_id: EpochId,
-        ecash_apis: &mut ApiClientsWrapper<'_, C>,
+        apis: &mut ApiClientsWrapper,
     ) -> Result<VerificationKeyAuth, BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
         get_aggregate_verification_key(&self.storage, epoch_id, ecash_apis).await
     }
 
     async fn get_coin_index_signatures(
         &self,
         epoch_id: EpochId,
-        ecash_apis: &mut ApiClientsWrapper<'_, C>,
+        apis: &mut ApiClientsWrapper,
     ) -> Result<Vec<AnnotatedCoinIndexSignature>, BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
         get_coin_index_signatures(&self.storage, epoch_id, ecash_apis).await
     }
 
@@ -130,12 +132,13 @@ impl<C, St: Storage> BandwidthController<C, St> {
         &self,
         epoch_id: EpochId,
         expiration_date: Date,
-        ecash_apis: &mut ApiClientsWrapper<'_, C>,
+        apis: &mut ApiClientsWrapper,
     ) -> Result<Vec<AnnotatedExpirationDateSignature>, BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
         get_expiration_date_signatures(&self.storage, epoch_id, expiration_date, ecash_apis).await
     }
 
@@ -151,7 +154,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
     {
         let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();
         let expiration_date = retrieved_ticketbook.ticketbook.expiration_date();
-        let mut api_clients = ApiClientsWrapper::new(&self.client, epoch_id);
+        let mut api_clients = Default::default();
 
         let verification_key = self
             .get_aggregate_verification_key(epoch_id, &mut api_clients)

common/bandwidth-controller/src/utils.rs

@@ -21,67 +21,30 @@ use rand::thread_rng;
 use std::fmt::Display;
 use std::future::Future;
 
-pub(crate) trait EcashClientsProvider {
-    async fn try_get_ecash_clients(
-        &mut self,
-    ) -> Result<Vec<EcashApiClient>, BandwidthControllerError>;
-}
+// it really doesn't need the RwLock because it's never moved across tasks,
+// but we need all the Send/Sync action
+#[derive(Default)]
+pub(crate) struct ApiClientsWrapper(Option<Vec<EcashApiClient>>);
 
-impl EcashClientsProvider for Vec<EcashApiClient> {
-    async fn try_get_ecash_clients(
+impl ApiClientsWrapper {
+    pub(crate) async fn get_or_init<C>(
         &mut self,
-    ) -> Result<Vec<EcashApiClient>, BandwidthControllerError> {
-        Ok(self.clone())
-    }
-}
-
-impl<C> EcashClientsProvider for &mut ApiClientsWrapper<'_, C>
-where
-    C: DkgQueryClient + Sync + Send,
-{
-    async fn try_get_ecash_clients(
-        &mut self,
-    ) -> Result<Vec<EcashApiClient>, BandwidthControllerError> {
-        self.clients().await
-    }
-}
-
-pub(crate) enum ApiClientsWrapper<'a, C> {
-    Uninitialised {
-        query_client: &'a C,
         epoch_id: EpochId,
-    },
-    Cached {
-        clients: Vec<EcashApiClient>,
-    },
-}
-
-impl<'a, C> ApiClientsWrapper<'a, C> {
-    pub(crate) fn new(query_client: &'a C, epoch_id: EpochId) -> Self {
-        ApiClientsWrapper::Uninitialised {
-            query_client,
-            epoch_id,
-        }
-    }
-
-    async fn clients(&mut self) -> Result<Vec<EcashApiClient>, BandwidthControllerError>
+        dkg_client: &C,
+    ) -> Result<Vec<EcashApiClient>, BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
     {
-        match self {
-            ApiClientsWrapper::Uninitialised {
-                query_client,
-                epoch_id,
-            } => {
-                let clients = all_ecash_api_clients(*query_client, *epoch_id).await?;
-                *self = ApiClientsWrapper::Cached {
-                    clients: clients.clone(),
-                };
-
-                Ok(clients)
-            }
-            ApiClientsWrapper::Cached { clients } => Ok(clients.clone()),
+        if let Some(cached) = &self.0 {
+            return Ok(cached.clone());
         }
+
+        let clients = all_ecash_api_clients(dkg_client, epoch_id).await?;
+
+        // technically we don't have to be cloning all the clients here, but it's way simpler than
+        // dealing with locking and whatnot given the performance penalty is negligible
+        self.0 = Some(clients.clone());
+        Ok(clients)
     }
 }
 
@@ -113,7 +76,7 @@ where
 pub(crate) async fn get_aggregate_verification_key<St>(
     storage: &St,
     epoch_id: EpochId,
-    mut ecash_apis: impl EcashClientsProvider,
+    ecash_apis: Vec<EcashApiClient>,
 ) -> Result<VerificationKeyAuth, BandwidthControllerError>
 where
     St: Storage,
@@ -127,8 +90,6 @@ where
         return Ok(stored);
     };
 
-    let ecash_apis = ecash_apis.try_get_ecash_clients().await?;
-
     let master_vk = query_random_apis_until_success(
         ecash_apis,
         |api| async move { api.api_client.master_verification_key(Some(epoch_id)).await },
@@ -154,7 +115,7 @@ where
 pub(crate) async fn get_coin_index_signatures<St>(
     storage: &St,
     epoch_id: EpochId,
-    mut ecash_apis: impl EcashClientsProvider,
+    ecash_apis: Vec<EcashApiClient>,
 ) -> Result<Vec<AnnotatedCoinIndexSignature>, BandwidthControllerError>
 where
     St: Storage,
@@ -168,8 +129,6 @@ where
         return Ok(stored);
     };
 
-    let ecash_apis = ecash_apis.try_get_ecash_clients().await?;
-
     let index_sigs = query_random_apis_until_success(
         ecash_apis,
         |api| async move {
@@ -200,7 +159,7 @@ pub(crate) async fn get_expiration_date_signatures<St>(
     storage: &St,
     epoch_id: EpochId,
     expiration_date: Date,
-    mut ecash_apis: impl EcashClientsProvider,
+    ecash_apis: Vec<EcashApiClient>,
 ) -> Result<Vec<AnnotatedExpirationDateSignature>, BandwidthControllerError>
 where
     St: Storage,
@@ -214,8 +173,6 @@ where
         return Ok(stored);
     };
 
-    let ecash_apis = ecash_apis.try_get_ecash_clients().await?;
-
     let expiration_sigs = query_random_apis_until_success(
         ecash_apis,
         |api| async move {

common/client-libs/validator-client/src/client.rs

@@ -497,6 +497,11 @@ impl NymApiClient {
         Ok(nodes)
     }
 
+    /// retrieve basic information for all bonded nodes on the network
+    pub async fn retrieve_basic_nodes_batch(&self, node_ids: Vec<u32>) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        Ok(self.nym_api.retrieve_basic_nodes_batch(&node_ids).await?.nodes)
+    }
+
     pub async fn health(&self) -> Result<ApiHealthResponse, ValidatorClientError> {
         Ok(self.nym_api.health().await?)
     }

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -253,10 +253,10 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
                 "mixnodes",
-                "skimmed",
+                routes::SKIMMED,
             ],
             NO_PARAMS,
         )
@@ -269,10 +269,10 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
                 "gateways",
-                "skimmed",
+                routes::SKIMMED,
             ],
             NO_PARAMS,
         )
@@ -318,9 +318,9 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
-                "skimmed",
+                routes::SKIMMED,
                 "entry-gateways",
                 "all",
             ],
@@ -355,9 +355,9 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
-                "skimmed",
+                routes::SKIMMED,
                 "mixnodes",
                 "active",
             ],
@@ -392,9 +392,9 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
-                "skimmed",
+                routes::SKIMMED,
                 "mixnodes",
                 "all",
             ],
@@ -403,6 +403,31 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    /// Send a Post request with a set of node ids. A successful response will contain descriptors
+    /// for all nodes associated with those node IDs available in the current full topology.
+    ///
+    /// If a provided node ID is not present there will be no descriptor for that node in the response.
+    ///
+    /// If no node IDs are provided the response will contain no descriptors.
+    #[instrument(level = "debug", skip(self))]
+    async fn retrieve_basic_nodes_batch(
+        &self,
+        node_ids: &[NodeId],
+    ) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
+        self.post_json(
+            &[
+                routes::API_VERSION,
+                routes::UNSTABLE,
+                routes::NYM_NODES_ROUTES,
+                routes::SKIMMED,
+                routes::BATCH,
+            ],
+            NO_PARAMS,
+            node_ids,
+        )
+        .await
+    }
+
     #[instrument(level = "debug", skip(self))]
     async fn get_basic_nodes(
         &self,
@@ -427,9 +452,9 @@ pub trait NymApiClientExt: ApiClient {
         self.get_json(
             &[
                 routes::API_VERSION,
-                "unstable",
+                routes::UNSTABLE,
                 routes::NYM_NODES_ROUTES,
-                "skimmed",
+                routes::SKIMMED,
             ],
             &params,
         )

common/client-libs/validator-client/src/nym_api/routes.rs

@@ -70,3 +70,7 @@ pub const SERVICE_PROVIDERS: &str = "services";
 
 pub const DETAILS: &str = "details";
 pub const NETWORK: &str = "network";
+
+pub const UNSTABLE: &str = "unstable";
+pub const SKIMMED: &str = "skimmed";
+pub const BATCH: &str = "batch";

common/http-api-common/Cargo.toml

@@ -20,7 +20,6 @@ mime = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 serde_yaml = { workspace = true }
-subtle.workspace = true
 tower = { workspace = true }
 tracing.workspace = true
 utoipa = { workspace = true, optional = true }

common/http-api-common/src/middleware/bearer_auth.rs

@@ -7,7 +7,6 @@ use axum::{extract::Request, response::Response};
 use futures::future::BoxFuture;
 use std::sync::Arc;
 use std::task::{Context, Poll};
-use subtle::ConstantTimeEq;
 use tower::{Layer, Service};
 use tracing::{debug, instrument, trace};
 use zeroize::Zeroizing;
@@ -77,7 +76,7 @@ impl<S> RequireAuth<S> {
             return Err("`Authorization` header must contain non-empty `Bearer` token");
         }
 
-        if bool::from(self.bearer_token.as_bytes().ct_ne(bearer_token.as_bytes())) {
+        if self.bearer_token.as_str() != bearer_token {
             return Err("`Authorization` header does not contain the correct `Bearer` token");
         }
 

common/nymcoconut/Cargo.toml

@@ -0,0 +1,48 @@
+[package]
+name = "nym-coconut"
+version = "0.5.0"
+authors = ["Jedrzej Stuczynski <andrew@nymtech.net>", "Ania Piotrowska <ania@nymtech.net>"]
+edition = "2021"
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bls12_381 = { workspace = true, default-features = false, features = ["pairings", "alloc", "experimental"] }
+itertools = { workspace = true }
+digest = "0.9"
+rand = { workspace = true }
+thiserror = { workspace = true }
+serde = { workspace = true }
+serde_derive = { workspace = true }
+bs58 = { workspace = true }
+sha2 = "0.9"
+zeroize = { workspace = true, optional = true }
+
+nym-dkg = { path = "../dkg" }
+nym-pemstore = { path = "../pemstore" }
+
+[dependencies.ff]
+workspace = true
+default-features = false
+
+[dependencies.group]
+workspace = true
+default-features = false
+
+[dev-dependencies]
+criterion = { workspace = true, features = ["html_reports"] }
+doc-comment = { workspace = true }
+rand_chacha = { workspace = true }
+
+[[bench]]
+name = "benchmarks"
+harness = false
+
+[features]
+key-zeroize = ["zeroize", "bls12_381/zeroize"]
+default = []
+
+
+[target.'cfg(target_env = "wasm32-unknown-unknown")'.dependencies]
+getrandom = { version="0.2", features=["js"] }

common/nymcoconut/README.md

@@ -0,0 +1 @@
+This project was partially funded through the NGI0 PET Fund, a fund established by NL.net with financial support from the European Commission's NGI programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

common/nymcoconut/benches/benchmarks.rs

@@ -0,0 +1,360 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use bls12_381::{multi_miller_loop, G1Affine, G1Projective, G2Affine, G2Prepared, Scalar};
+use criterion::{criterion_group, criterion_main, Criterion};
+use ff::Field;
+use group::{Curve, Group};
+use nym_coconut::{
+    aggregate_signature_shares_and_verify, aggregate_verification_keys, blind_sign,
+    prepare_blind_sign, prove_bandwidth_credential, random_scalars_refs, setup, ttp_keygen,
+    verify_credential, verify_partial_blind_signature, Attribute, BlindedSignature, Parameters,
+    Signature, SignatureShare, VerificationKey,
+};
+use rand::seq::SliceRandom;
+use std::ops::Neg;
+use std::time::Duration;
+
+#[allow(unused)]
+fn double_pairing(g11: &G1Affine, g21: &G2Affine, g12: &G1Affine, g22: &G2Affine) {
+    let gt1 = bls12_381::pairing(g11, g21);
+    let gt2 = bls12_381::pairing(g12, g22);
+    assert_eq!(gt1, gt2)
+}
+
+#[allow(unused)]
+fn multi_miller_pairing_affine(g11: &G1Affine, g21: &G2Affine, g12: &G1Affine, g22: &G2Affine) {
+    let miller_loop_result = multi_miller_loop(&[
+        (g11, &G2Prepared::from(*g21)),
+        (&g12.neg(), &G2Prepared::from(*g22)),
+    ]);
+    assert!(bool::from(
+        miller_loop_result.final_exponentiation().is_identity()
+    ))
+}
+
+#[allow(unused)]
+fn bench_pairings(c: &mut Criterion) {
+    let mut rng = rand::thread_rng();
+
+    let g1 = G1Affine::generator();
+    let g2 = G2Affine::generator();
+    let r = Scalar::random(&mut rng);
+    let s = Scalar::random(&mut rng);
+
+    let g11 = (g1 * r).to_affine();
+    let g21 = (g2 * s).to_affine();
+    let g21_prep = G2Prepared::from(g21);
+
+    let g12 = (g1 * s).to_affine();
+    let g22 = (g2 * r).to_affine();
+    let g22_prep = G2Prepared::from(g22);
+
+    c.bench_function("double pairing", |b| {
+        b.iter(|| double_pairing(&g11, &g21, &g12, &g22))
+    });
+
+    c.bench_function("multi miller in affine", |b| {
+        b.iter(|| multi_miller_pairing_affine(&g11, &g21, &g12, &g22))
+    });
+
+    c.bench_function("multi miller with prepared g2", |b| {
+        b.iter(|| multi_miller_pairing_with_prepared(&g11, &g21_prep, &g12, &g22_prep))
+    });
+
+    c.bench_function("multi miller with semi-prepared g2", |b| {
+        b.iter(|| multi_miller_pairing_with_semi_prepared(&g11, &g21, &g12, &g22_prep))
+    });
+}
+
+#[allow(unused)]
+fn multi_miller_pairing_with_prepared(
+    g11: &G1Affine,
+    g21: &G2Prepared,
+    g12: &G1Affine,
+    g22: &G2Prepared,
+) {
+    let miller_loop_result = multi_miller_loop(&[(g11, g21), (&g12.neg(), g22)]);
+    assert!(bool::from(
+        miller_loop_result.final_exponentiation().is_identity()
+    ))
+}
+
+// the case of being able to prepare G2 generator
+#[allow(unused)]
+fn multi_miller_pairing_with_semi_prepared(
+    g11: &G1Affine,
+    g21: &G2Affine,
+    g12: &G1Affine,
+    g22: &G2Prepared,
+) {
+    let miller_loop_result =
+        multi_miller_loop(&[(g11, &G2Prepared::from(*g21)), (&g12.neg(), g22)]);
+    assert!(bool::from(
+        miller_loop_result.final_exponentiation().is_identity()
+    ))
+}
+
+#[allow(clippy::too_many_arguments)]
+fn unblind_and_aggregate(
+    params: &Parameters,
+    blinded_signatures: &[BlindedSignature],
+    partial_verification_keys: &[VerificationKey],
+    private_attributes: &[&Attribute],
+    public_attributes: &[&Attribute],
+    commitment_hash: &G1Projective,
+    pedersen_commitments_openings: &[Scalar],
+    verification_key: &VerificationKey,
+) -> Signature {
+    // Unblind all partial signatures
+    let unblinded_signatures: Vec<Signature> = blinded_signatures
+        .iter()
+        .zip(partial_verification_keys.iter())
+        .map(|(signature, partial_verification_key)| {
+            signature
+                .unblind_and_verify(
+                    params,
+                    partial_verification_key,
+                    private_attributes,
+                    public_attributes,
+                    commitment_hash,
+                    pedersen_commitments_openings,
+                )
+                .unwrap()
+        })
+        .collect();
+
+    let unblinded_signature_shares: Vec<SignatureShare> = unblinded_signatures
+        .iter()
+        .enumerate()
+        .map(|(idx, signature)| SignatureShare::new(*signature, (idx + 1) as u64))
+        .collect();
+
+    let mut attributes = vec![];
+    attributes.extend_from_slice(private_attributes);
+    attributes.extend_from_slice(public_attributes);
+    aggregate_signature_shares_and_verify(
+        params,
+        verification_key,
+        &attributes,
+        &unblinded_signature_shares,
+    )
+    .unwrap()
+}
+
+struct BenchCase {
+    num_authorities: u64,
+    threshold_p: f32,
+    num_public_attrs: u32,
+    num_private_attrs: u32,
+}
+
+impl BenchCase {
+    fn threshold(&self) -> u64 {
+        (self.num_authorities as f32 * self.threshold_p).round() as u64
+    }
+
+    fn num_attrs(&self) -> u32 {
+        self.num_public_attrs + self.num_private_attrs
+    }
+}
+
+fn bench_coconut(c: &mut Criterion) {
+    let mut group = c.benchmark_group("benchmark-coconut");
+    group.measurement_time(Duration::from_secs(1000));
+    let case = BenchCase {
+        num_authorities: 100,
+        threshold_p: 0.7,
+        num_public_attrs: 2,
+        num_private_attrs: 2,
+    };
+
+    let params = setup(case.num_public_attrs + case.num_private_attrs).unwrap();
+
+    random_scalars_refs!(public_attributes, params, case.num_public_attrs as usize);
+    let serial_number = params.random_scalar();
+    let binding_number = params.random_scalar();
+    let private_attributes = vec![&serial_number, &binding_number];
+
+    // The prepare blind sign is performed by the user
+    let (pedersen_commitments_openings, blind_sign_request) =
+        prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+    // CLIENT BENCHMARK: Data needed to ask for a credential
+    // Let's benchmark the operations the client has to perform
+    // to ask for a credential
+    group.bench_function(
+        format!(
+            "[Client] prepare_blind_sign_{}_authorities_{}_attributes_{}_threshold",
+            case.num_authorities,
+            case.num_attrs(),
+            case.threshold_p,
+        ),
+        |b| {
+            b.iter(|| prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap())
+        },
+    );
+
+    // keys for the validators
+    let coconut_keypairs = ttp_keygen(&params, case.threshold(), case.num_authorities).unwrap();
+
+    // VALIDATOR BENCHMARK: Issue partial credential
+    // we pick only one key pair, as we want to validate how much does it
+    // take for a single validator to issue a partial credential
+    let mut rng = rand::thread_rng();
+    let keypair = coconut_keypairs.choose(&mut rng).unwrap();
+
+    group.bench_function(
+        format!(
+            "[Validator] compute_single_blind_sign_for_credential_with_{}_attributes",
+            case.num_attrs(),
+        ),
+        |b| {
+            b.iter(|| {
+                blind_sign(
+                    &params,
+                    keypair.secret_key(),
+                    &blind_sign_request,
+                    &public_attributes,
+                )
+                .unwrap()
+            })
+        },
+    );
+
+    // computing all partial credentials
+    // NOTE: in reality, each validator computes only single signature
+    let mut blinded_signatures = Vec::new();
+    for keypair in coconut_keypairs.iter() {
+        let blinded_signature = blind_sign(
+            &params,
+            keypair.secret_key(),
+            &blind_sign_request,
+            &public_attributes,
+        )
+        .unwrap();
+        blinded_signatures.push(blinded_signature)
+    }
+
+    let verification_keys: Vec<VerificationKey> = coconut_keypairs
+        .iter()
+        .map(|keypair| keypair.verification_key().clone())
+        .collect();
+
+    // verify a random partial blind signature
+    let rand_idx = 1;
+    let random_blind_signature = blinded_signatures.get(rand_idx).unwrap();
+    let partial_verification_key = verification_keys.get(rand_idx).unwrap();
+
+    group.bench_function(
+        format!(
+            "verify_partial_blind_signature_{}_private_attributes_{}_public_attributes",
+            case.num_private_attrs, case.num_public_attrs
+        ),
+        |b| {
+            b.iter(|| {
+                verify_partial_blind_signature(
+                    &params,
+                    blind_sign_request.get_private_attributes_pedersen_commitments(),
+                    &public_attributes,
+                    random_blind_signature,
+                    partial_verification_key,
+                )
+            })
+        },
+    );
+
+    // Lets bench worse case, ie aggregating all
+    let indices: Vec<u64> = (1..=case.num_authorities).collect();
+    // aggregate verification keys
+    let aggr_verification_key =
+        aggregate_verification_keys(&verification_keys, Some(&indices)).unwrap();
+
+    // CLIENT OPERATION: Unblind partial singatures and aggregate into single signature
+    let aggregated_signature = unblind_and_aggregate(
+        &params,
+        &blinded_signatures,
+        &verification_keys,
+        &private_attributes,
+        &public_attributes,
+        &blind_sign_request.get_commitment_hash(),
+        &pedersen_commitments_openings,
+        &aggr_verification_key,
+    );
+
+    // CLIENT BENCHMARK: aggregate all partial credentials
+    group.bench_function(
+        format!(
+            "[Client] unblind_and_aggregate_partial_credentials_{}_authorities_{}_attributes_{}_threshold",
+            case.num_authorities,
+            case.num_attrs(),
+            case.threshold_p,
+        ),
+        |b| {
+            b.iter(|| {
+                unblind_and_aggregate(
+                    &params,
+                    &blinded_signatures,
+                    &verification_keys,
+                    &private_attributes,
+                    &public_attributes,
+                    &blind_sign_request.get_commitment_hash(),
+                    &pedersen_commitments_openings,
+                    &aggr_verification_key)
+            })
+        },
+    );
+
+    // CLIENT OPERATION: Randomize credentials and generate any cryptographic material to verify them
+    let theta = prove_bandwidth_credential(
+        &params,
+        &aggr_verification_key,
+        &aggregated_signature,
+        &serial_number,
+        &binding_number,
+    )
+    .unwrap();
+
+    // CLIENT BENCHMARK
+    group.bench_function(
+        format!(
+            "[Client] randomize_and_prove_credential_{}_authorities_{}_attributes_{}_threshold",
+            case.num_authorities,
+            case.num_attrs(),
+            case.threshold_p,
+        ),
+        |b| {
+            b.iter(|| {
+                prove_bandwidth_credential(
+                    &params,
+                    &aggr_verification_key,
+                    &aggregated_signature,
+                    &serial_number,
+                    &binding_number,
+                )
+                .unwrap()
+            })
+        },
+    );
+
+    // VERIFIER OPERATION
+    // Verify credentials
+    verify_credential(&params, &aggr_verification_key, &theta, &public_attributes);
+
+    // VERIFICATION BENCHMARK
+    group.bench_function(
+        format!(
+            "[Verifier] verify_credentials_{}_authorities_{}_attributes_{}_threshold",
+            case.num_authorities,
+            case.num_attrs(),
+            case.threshold_p,
+        ),
+        |b| {
+            b.iter(|| {
+                verify_credential(&params, &aggr_verification_key, &theta, &public_attributes)
+            })
+        },
+    );
+}
+criterion_group!(benches, bench_coconut);
+criterion_main!(benches);

common/nymcoconut/src/elgamal.rs

@@ -0,0 +1,354 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use core::ops::{Deref, Mul};
+
+use bls12_381::{G1Projective, Scalar};
+use group::Curve;
+use serde_derive::{Deserialize, Serialize};
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::setup::Parameters;
+use crate::traits::{Base58, Bytable};
+use crate::utils::{try_deserialize_g1_projective, try_deserialize_scalar};
+use crate::Attribute;
+
+/// Type alias for the ephemeral key generated during ElGamal encryption
+pub type EphemeralKey = Scalar;
+
+/// Two G1 points representing ElGamal ciphertext
+#[derive(Debug)]
+#[cfg_attr(test, derive(PartialEq, Eq))]
+pub struct Ciphertext(pub(crate) G1Projective, pub(crate) G1Projective);
+
+impl TryFrom<&[u8]> for Ciphertext {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<Ciphertext> {
+        if bytes.len() != 96 {
+            return Err(CoconutError::Deserialization(format!(
+                "Ciphertext must be exactly 96 bytes, got {}",
+                bytes.len()
+            )));
+        }
+
+        // safety: we just checked for the length so the unwraps are fine
+        #[allow(clippy::unwrap_used)]
+        let c1_bytes: &[u8; 48] = &bytes[..48].try_into().unwrap();
+        #[allow(clippy::unwrap_used)]
+        let c2_bytes: &[u8; 48] = &bytes[48..].try_into().unwrap();
+
+        let c1 = try_deserialize_g1_projective(
+            c1_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed c1".to_string()),
+        )?;
+        let c2 = try_deserialize_g1_projective(
+            c2_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed c2".to_string()),
+        )?;
+
+        Ok(Ciphertext(c1, c2))
+    }
+}
+
+impl Ciphertext {
+    pub fn c1(&self) -> &G1Projective {
+        &self.0
+    }
+
+    pub fn c2(&self) -> &G1Projective {
+        &self.1
+    }
+
+    pub fn to_bytes(&self) -> [u8; 96] {
+        let mut bytes = [0u8; 96];
+        bytes[..48].copy_from_slice(&self.0.to_affine().to_compressed());
+        bytes[48..].copy_from_slice(&self.1.to_affine().to_compressed());
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Ciphertext> {
+        Ciphertext::try_from(bytes)
+    }
+}
+
+/// PrivateKey used in the ElGamal encryption scheme to recover the plaintext
+#[derive(Debug)]
+#[cfg_attr(test, derive(PartialEq, Eq))]
+pub struct PrivateKey(pub(crate) Scalar);
+
+impl PrivateKey {
+    /// Decrypt takes the ElGamal encryption of a message and returns a point on the G1 curve
+    /// that represents original h^m.
+    pub fn decrypt(&self, ciphertext: &Ciphertext) -> G1Projective {
+        let (c1, c2) = &(ciphertext.0, ciphertext.1);
+
+        // (gamma^k * h^m) / (g1^{d * k})   |   note: gamma = g1^d
+        c2 - c1 * self.0
+    }
+
+    pub fn public_key(&self, params: &Parameters) -> PublicKey {
+        PublicKey(params.gen1() * self.0)
+    }
+
+    pub fn to_bytes(&self) -> [u8; 32] {
+        self.0.to_bytes()
+    }
+
+    pub fn from_bytes(bytes: &[u8; 32]) -> Result<PrivateKey> {
+        try_deserialize_scalar(
+            bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize ElGamal private key - it was not in the canonical form"
+                    .to_string(),
+            ),
+        )
+        .map(PrivateKey)
+    }
+}
+
+impl Bytable for PrivateKey {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        let received = slice.len();
+        let Ok(arr) = slice.try_into() else {
+            return Err(CoconutError::UnexpectedArrayLength {
+                typ: "elgamal::PrivateKey".to_string(),
+                received,
+                expected: 32,
+            });
+        };
+
+        PrivateKey::from_bytes(arr)
+    }
+}
+
+impl Base58 for PrivateKey {}
+
+// TODO: perhaps be more explicit and apart from gamma also store generator and group order?
+/// PublicKey used in the ElGamal encryption scheme to produce the ciphertext
+#[derive(Debug, Clone)]
+#[cfg_attr(test, derive(PartialEq, Eq))]
+pub struct PublicKey(G1Projective);
+
+impl PublicKey {
+    /// Encrypt encrypts the given message in the form of h^m,
+    /// where h is a point on the G1 curve using the given public key.
+    /// The random k is returned alongside the encryption
+    /// as it is required by the Coconut Scheme to create proofs of knowledge.
+    pub fn encrypt(
+        &self,
+        params: &Parameters,
+        h: &G1Projective,
+        msg: &Scalar,
+    ) -> (Ciphertext, EphemeralKey) {
+        let k = params.random_scalar();
+        // c1 = g1^k
+        let c1 = params.gen1() * k;
+        // c2 = gamma^k * h^m
+        let c2 = self.0 * k + h * msg;
+
+        (Ciphertext(c1, c2), k)
+    }
+
+    pub fn to_bytes(&self) -> [u8; 48] {
+        self.0.to_affine().to_compressed()
+    }
+
+    pub fn from_bytes(bytes: &[u8; 48]) -> Result<PublicKey> {
+        try_deserialize_g1_projective(
+            bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize compressed ElGamal public key".to_string(),
+            ),
+        )
+        .map(PublicKey)
+    }
+}
+
+impl Bytable for PublicKey {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().into()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        let received = slice.len();
+        let Ok(arr) = slice.try_into() else {
+            return Err(CoconutError::UnexpectedArrayLength {
+                typ: "elgamal::PublicKey".to_string(),
+                received,
+                expected: 48,
+            });
+        };
+
+        PublicKey::from_bytes(arr)
+    }
+}
+
+impl TryFrom<&[u8]> for PublicKey {
+    type Error = CoconutError;
+
+    fn try_from(slice: &[u8]) -> Result<PublicKey> {
+        PublicKey::try_from_byte_slice(slice)
+    }
+}
+
+impl Base58 for PublicKey {}
+
+impl Deref for PublicKey {
+    type Target = G1Projective;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl<'a> Mul<&'a Scalar> for &PublicKey {
+    type Output = G1Projective;
+
+    fn mul(self, rhs: &'a Scalar) -> Self::Output {
+        self.0 * rhs
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+/// A convenient wrapper for both keys of the ElGamal keypair
+pub struct ElGamalKeyPair {
+    private_key: PrivateKey,
+    public_key: PublicKey,
+}
+
+impl ElGamalKeyPair {
+    pub fn public_key(&self) -> &PublicKey {
+        &self.public_key
+    }
+
+    pub fn private_key(&self) -> &PrivateKey {
+        &self.private_key
+    }
+}
+
+/// Generate a fresh ElGamal keypair using the group generator specified by the provided [Parameters]
+pub fn elgamal_keygen(params: &Parameters) -> ElGamalKeyPair {
+    let private_key = params.random_scalar();
+    let gamma = params.gen1() * private_key;
+
+    ElGamalKeyPair {
+        private_key: PrivateKey(private_key),
+        public_key: PublicKey(gamma),
+    }
+}
+
+pub fn compute_attribute_encryption(
+    params: &Parameters,
+    private_attributes: &[&Attribute],
+    pub_key: &PublicKey,
+    commitment_hash: G1Projective,
+) -> (Vec<Ciphertext>, Vec<EphemeralKey>) {
+    private_attributes
+        .iter()
+        .map(|m| pub_key.encrypt(params, &commitment_hash, m))
+        .unzip()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn keygen() {
+        let params = Parameters::default();
+        let keypair = super::elgamal_keygen(&params);
+
+        let expected = params.gen1() * keypair.private_key.0;
+        let gamma = keypair.public_key.0;
+        assert_eq!(
+            expected, gamma,
+            "Public key, gamma, should be equal to g1^d, where d is the private key"
+        );
+    }
+
+    #[test]
+    fn encryption() {
+        let params = Parameters::default();
+        let keypair = super::elgamal_keygen(&params);
+
+        let r = params.random_scalar();
+        let h = params.gen1() * r;
+        let m = params.random_scalar();
+
+        let (ciphertext, ephemeral_key) = keypair.public_key.encrypt(&params, &h, &m);
+
+        let expected_c1 = params.gen1() * ephemeral_key;
+        assert_eq!(expected_c1, ciphertext.0, "c1 should be equal to g1^k");
+
+        let expected_c2 = keypair.public_key.0 * ephemeral_key + h * m;
+        assert_eq!(
+            expected_c2, ciphertext.1,
+            "c2 should be equal to gamma^k * h^m"
+        );
+    }
+
+    #[test]
+    fn decryption() {
+        let params = Parameters::default();
+        let keypair = super::elgamal_keygen(&params);
+
+        let r = params.random_scalar();
+        let h = params.gen1() * r;
+        let m = params.random_scalar();
+
+        let (ciphertext, _) = keypair.public_key.encrypt(&params, &h, &m);
+        let dec = keypair.private_key.decrypt(&ciphertext);
+
+        let expected = h * m;
+        assert_eq!(
+            expected, dec,
+            "after ElGamal decryption, original h^m should be obtained"
+        );
+    }
+
+    #[test]
+    fn private_key_bytes_roundtrip() {
+        let params = Parameters::default();
+        let private_key = PrivateKey(params.random_scalar());
+        let bytes = private_key.to_bytes();
+
+        // also make sure it is equivalent to the internal scalar's bytes
+        assert_eq!(private_key.0.to_bytes(), bytes);
+        assert_eq!(private_key, PrivateKey::from_bytes(&bytes).unwrap())
+    }
+
+    #[test]
+    fn public_key_bytes_roundtrip() {
+        let params = Parameters::default();
+        let r = params.random_scalar();
+        let public_key = PublicKey(params.gen1() * r);
+        let bytes = public_key.to_bytes();
+
+        // also make sure it is equivalent to the internal g1 compressed bytes
+        assert_eq!(public_key.0.to_affine().to_compressed(), bytes);
+        assert_eq!(public_key, PublicKey::from_bytes(&bytes).unwrap())
+    }
+
+    #[test]
+    fn ciphertext_bytes_roundtrip() {
+        let params = Parameters::default();
+        let r = params.random_scalar();
+        let s = params.random_scalar();
+        let ciphertext = Ciphertext(params.gen1() * r, params.gen1() * s);
+        let bytes = ciphertext.to_bytes();
+
+        // also make sure it is equivalent to the internal g1 compressed bytes concatenated
+        let expected_bytes = [
+            ciphertext.0.to_affine().to_compressed(),
+            ciphertext.1.to_affine().to_compressed(),
+        ]
+        .concat();
+        assert_eq!(expected_bytes, bytes);
+        assert_eq!(ciphertext, Ciphertext::try_from(&bytes[..]).unwrap())
+    }
+}

common/nymcoconut/src/error.rs

@@ -0,0 +1,69 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+
+/// A `Result` alias where the `Err` case is `coconut_rs::Error`.
+pub type Result<T> = std::result::Result<T, CoconutError>;
+
+#[derive(Error, Debug)]
+pub enum CoconutError {
+    #[error("Setup error: {0}")]
+    Setup(String),
+
+    #[error("encountered error during keygen")]
+    Keygen,
+
+    #[error("Issuance related error: {0}")]
+    Issuance(String),
+
+    #[error("Tried to prepare blind sign request for higher than specified number of attributes (max: {}, requested: {})", max, requested)]
+    IssuanceMaxAttributes { max: usize, requested: usize },
+
+    #[error("Interpolation error: {0}")]
+    Interpolation(String),
+
+    #[error("Aggregation error: {0}")]
+    Aggregation(String),
+
+    #[error("Unblind error: {0}")]
+    Unblind(String),
+
+    #[error("Verification error: {0}")]
+    Verification(String),
+
+    #[error("Deserialization error: {0}")]
+    Deserialization(String),
+
+    #[error(
+        "Deserailization error, expected at least {} bytes, got {}",
+        min,
+        actual
+    )]
+    DeserializationMinLength { min: usize, actual: usize },
+
+    #[error("Tried to deserialize {object} with bytes of invalid length. Expected {actual} < {object} or {modulus_target} % {modulus} == 0")]
+    DeserializationInvalidLength {
+        actual: usize,
+        target: usize,
+        modulus_target: usize,
+        modulus: usize,
+        object: String,
+    },
+
+    #[error("received an array of unexpected size for deserialization of {typ}. got {received} but expected {expected}")]
+    UnexpectedArrayLength {
+        typ: String,
+        received: usize,
+        expected: usize,
+    },
+
+    #[error("failed to decode the base58 representation: {0}")]
+    Base58DecodingFailure(#[from] bs58::decode::Error),
+
+    #[error("failed to deserialize scalar from the received bytes - it might not have been canonically encoded")]
+    ScalarDeserializationFailure,
+
+    #[error("failed to deserialize G1Projective point from the received bytes - it might not have been canonically encoded")]
+    G1ProjectiveDeserializationFailure,
+}

common/nymcoconut/src/impls/clone.rs

@@ -0,0 +1,15 @@
+use crate::{BlindSignRequest, BlindedSignature, Bytable, VerifyCredentialRequest};
+
+macro_rules! impl_clone {
+    ($struct:ident) => {
+        impl Clone for $struct {
+            fn clone(&self) -> Self {
+                Self::try_from_byte_slice(&self.to_byte_vec()).unwrap()
+            }
+        }
+    };
+}
+
+impl_clone!(BlindSignRequest);
+impl_clone!(BlindedSignature);
+impl_clone!(VerifyCredentialRequest);

common/nymcoconut/src/impls/mod.rs

@@ -0,0 +1,2 @@
+mod clone;
+mod serde;

common/nymcoconut/src/impls/serde.rs

@@ -0,0 +1,57 @@
+use crate::elgamal::PrivateKey;
+use crate::scheme::SecretKey;
+use crate::{
+    Base58, BlindSignRequest, BlindedSignature, PublicKey, Signature, VerificationKey,
+    VerifyCredentialRequest,
+};
+use serde::de::Unexpected;
+use serde::{de::Error, de::Visitor, Deserialize, Deserializer, Serialize, Serializer};
+use std::fmt;
+
+macro_rules! impl_serde {
+    ($struct:ident, $visitor:ident) => {
+        pub struct $visitor {}
+
+        impl Serialize for $struct {
+            fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+            where
+                S: Serializer,
+            {
+                serializer.serialize_str(&self.to_bs58())
+            }
+        }
+
+        impl<'de> Visitor<'de> for $visitor {
+            type Value = $struct;
+
+            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                write!(formatter, "A base58 encoded struct")
+            }
+
+            fn visit_str<E: Error>(self, s: &str) -> Result<Self::Value, E> {
+                match $struct::try_from_bs58(s) {
+                    Ok(x) => Ok(x),
+                    Err(_) => Err(Error::invalid_value(Unexpected::Str(s), &self)),
+                }
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $struct {
+            fn deserialize<D>(deserializer: D) -> Result<$struct, D::Error>
+            where
+                D: Deserializer<'de>,
+            {
+                deserializer.deserialize_str($visitor {})
+            }
+        }
+    };
+}
+
+impl_serde!(SecretKey, V1);
+impl_serde!(VerificationKey, V2);
+impl_serde!(PublicKey, V3);
+impl_serde!(PrivateKey, V4);
+impl_serde!(BlindSignRequest, V5);
+impl_serde!(BlindedSignature, V6);
+impl_serde!(Signature, V7);
+impl_serde!(VerifyCredentialRequest, V8);

common/nymcoconut/src/lib.rs

@@ -0,0 +1,56 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+
+pub use bls12_381::Scalar;
+pub use elgamal::elgamal_keygen;
+pub use elgamal::ElGamalKeyPair;
+pub use elgamal::PublicKey;
+pub use error::CoconutError;
+pub use scheme::aggregation::aggregate_key_shares;
+pub use scheme::aggregation::aggregate_signature_shares;
+pub use scheme::aggregation::aggregate_signature_shares_and_verify;
+pub use scheme::aggregation::aggregate_verification_keys;
+pub use scheme::issuance::blind_sign;
+pub use scheme::issuance::prepare_blind_sign;
+pub use scheme::issuance::sign;
+pub use scheme::issuance::verify_partial_blind_signature;
+pub use scheme::issuance::BlindSignRequest;
+pub use scheme::keygen::keygen;
+pub use scheme::keygen::ttp_keygen;
+pub use scheme::keygen::KeyPair;
+pub use scheme::keygen::SecretKey;
+pub use scheme::keygen::VerificationKey;
+pub use scheme::keygen::VerificationKeyShare;
+pub use scheme::setup::setup;
+pub use scheme::setup::Parameters;
+pub use scheme::verification::check_vk_pairing;
+pub use scheme::verification::prove_bandwidth_credential;
+pub use scheme::verification::verify;
+pub use scheme::verification::verify_credential;
+pub use scheme::verification::BlindedSerialNumber;
+pub use scheme::verification::VerifyCredentialRequest;
+pub use scheme::BlindedSignature;
+pub use scheme::Signature;
+pub use scheme::SignatureShare;
+pub use scheme::SignerIndex;
+pub use traits::Base58;
+pub use traits::Bytable;
+pub use utils::hash_to_scalar;
+
+pub mod elgamal;
+mod error;
+mod impls;
+mod proofs;
+mod scheme;
+pub mod tests;
+mod traits;
+pub mod utils;
+
+pub type Attribute = bls12_381::Scalar;
+pub type PrivateAttribute = Attribute;
+pub type PublicAttribute = Attribute;
+
+pub use bls12_381::G1Projective;

common/nymcoconut/src/proofs/mod.rs

@@ -0,0 +1,619 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// TODO: look at https://crates.io/crates/merlin to perhaps use it instead?
+
+use std::borrow::Borrow;
+
+use bls12_381::{G1Projective, G2Projective, Scalar};
+use digest::generic_array::typenum::Unsigned;
+use digest::Digest;
+use group::GroupEncoding;
+use itertools::izip;
+use sha2::Sha256;
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::issuance::compute_hash;
+use crate::scheme::setup::Parameters;
+use crate::scheme::VerificationKey;
+use crate::utils::{try_deserialize_scalar, try_deserialize_scalar_vec};
+use crate::Attribute;
+
+// as per the reference python implementation
+type ChallengeDigest = Sha256;
+
+#[derive(Debug)]
+#[cfg_attr(test, derive(PartialEq, Eq))]
+pub struct ProofCmCs {
+    challenge: Scalar,
+    response_opening: Scalar,
+    response_openings: Vec<Scalar>,
+    response_attributes: Vec<Scalar>,
+}
+
+// note: this is slightly different from the reference python implementation
+// as we omit the unnecessary string conversion. Instead we concatenate byte
+// representations together and hash that.
+// note2: G1 and G2 elements are using their compressed representations
+// and as per the bls12-381 library all elements are using big-endian form
+/// Generates a Scalar [or Fp] challenge by hashing a number of elliptic curve points.  
+fn compute_challenge<D, I, B>(iter: I) -> Scalar
+where
+    D: Digest,
+    I: Iterator<Item = B>,
+    B: AsRef<[u8]>,
+{
+    let mut h = D::new();
+    for point_representation in iter {
+        h.update(point_representation);
+    }
+    let digest = h.finalize();
+
+    // TODO: I don't like the 0 padding here (though it's what we've been using before,
+    // but we never had a security audit anyway...)
+    // instead we could maybe use the `from_bytes` variant and adding some suffix
+    // when computing the digest until we produce a valid scalar.
+    let mut bytes = [0u8; 64];
+    let pad_size = 64usize
+        .checked_sub(D::OutputSize::to_usize())
+        .unwrap_or_default();
+
+    bytes[pad_size..].copy_from_slice(&digest);
+
+    Scalar::from_bytes_wide(&bytes)
+}
+
+fn produce_response(witness: &Scalar, challenge: &Scalar, secret: &Scalar) -> Scalar {
+    witness - challenge * secret
+}
+
+// note: it's caller's responsibility to ensure witnesses.len() = secrets.len()
+fn produce_responses<S>(witnesses: &[Scalar], challenge: &Scalar, secrets: &[S]) -> Vec<Scalar>
+where
+    S: Borrow<Scalar>,
+{
+    debug_assert_eq!(witnesses.len(), secrets.len());
+
+    witnesses
+        .iter()
+        .zip(secrets.iter())
+        .map(|(w, x)| produce_response(w, challenge, x.borrow()))
+        .collect()
+}
+
+impl ProofCmCs {
+    /// Construct non-interactive zero-knowledge proof of correctness of the ciphertexts and the commitment
+    /// using the Fiat-Shamir heuristic.
+    pub(crate) fn construct(
+        params: &Parameters,
+        commitment: &G1Projective,
+        commitment_opening: &Scalar,
+        commitments: &[G1Projective],
+        pedersen_commitments_openings: &[Scalar],
+        private_attributes: &[&Attribute],
+        public_attributes: &[&Attribute],
+    ) -> Self {
+        // note: this is only called from `prepare_blind_sign` that already checks
+        // whether private attributes are non-empty and whether we don't have too many
+        // attributes in total to sign.
+        // we also know, due to the single call place, that ephemeral_keys.len() == private_attributes.len()
+
+        // witness creation
+        let witness_commitment_opening = params.random_scalar();
+        let witness_pedersen_commitments_openings =
+            params.n_random_scalars(pedersen_commitments_openings.len());
+        let witness_attributes = params.n_random_scalars(private_attributes.len());
+
+        // recompute h
+        let h = compute_hash(*commitment, public_attributes);
+        let hs_bytes = params
+            .gen_hs()
+            .iter()
+            .map(|h| h.to_bytes())
+            .collect::<Vec<_>>();
+
+        let g1 = params.gen1();
+
+        // compute commitments
+
+        // zkp commitment for the attributes commitment cm
+        // Ccm = (wr * g1) + (wm[0] * hs[0]) + ... + (wm[i] * hs[i])
+        let commitment_attributes = g1 * witness_commitment_opening
+            + witness_attributes
+                .iter()
+                .zip(params.gen_hs().iter())
+                .map(|(wm_i, hs_i)| hs_i * wm_i)
+                .sum::<G1Projective>();
+
+        // zkp commitments for the individual attributes
+        let commitments_attributes = witness_pedersen_commitments_openings
+            .iter()
+            .zip(witness_attributes.iter())
+            .map(|(o_j, m_j)| g1 * o_j + h * m_j)
+            .collect::<Vec<_>>();
+
+        let commitments_bytes = commitments
+            .iter()
+            .map(|cm| cm.to_bytes())
+            .collect::<Vec<_>>();
+
+        let commitments_attributes_bytes = commitments_attributes
+            .iter()
+            .map(|cm| cm.to_bytes())
+            .collect::<Vec<_>>();
+
+        // compute challenge
+        let challenge = compute_challenge::<ChallengeDigest, _, _>(
+            std::iter::once(params.gen1().to_bytes().as_ref())
+                .chain(hs_bytes.iter().map(|hs| hs.as_ref()))
+                .chain(std::iter::once(h.to_bytes().as_ref()))
+                .chain(std::iter::once(commitment.to_bytes().as_ref()))
+                .chain(commitments_bytes.iter().map(|cm| cm.as_ref()))
+                .chain(std::iter::once(commitment_attributes.to_bytes().as_ref()))
+                .chain(commitments_attributes_bytes.iter().map(|cm| cm.as_ref())),
+        );
+
+        // Responses
+        let response_opening =
+            produce_response(&witness_commitment_opening, &challenge, commitment_opening);
+        let response_openings = produce_responses(
+            &witness_pedersen_commitments_openings,
+            &challenge,
+            &pedersen_commitments_openings.iter().collect::<Vec<_>>(),
+        );
+        let response_attributes =
+            produce_responses(&witness_attributes, &challenge, private_attributes);
+
+        ProofCmCs {
+            challenge,
+            response_opening,
+            response_openings,
+            response_attributes,
+        }
+    }
+
+    pub(crate) fn verify(
+        &self,
+        params: &Parameters,
+        commitment: &G1Projective,
+        commitments: &[G1Projective],
+        public_attributes: &[&Attribute],
+    ) -> bool {
+        if self.response_attributes.len() != commitments.len() {
+            return false;
+        }
+
+        // recompute h
+        let h = compute_hash(*commitment, public_attributes);
+        let g1 = params.gen1();
+
+        let hs_bytes = params
+            .gen_hs()
+            .iter()
+            .map(|h| h.to_bytes())
+            .collect::<Vec<_>>();
+
+        // recompute witnesses commitments
+        // Cw = (cm * c) + (rr * g1) + (rm[0] * hs[0]) + ... + (rm[n] * hs[n])
+        let commitment_attributes = (commitment
+            - public_attributes
+                .iter()
+                .zip(params.gen_hs().iter().skip(self.response_attributes.len()))
+                .map(|(&pub_attr, hs)| hs * pub_attr)
+                .sum::<G1Projective>())
+            * self.challenge
+            + g1 * self.response_opening
+            + self
+                .response_attributes
+                .iter()
+                .zip(params.gen_hs().iter())
+                .map(|(res_attr, hs)| hs * res_attr)
+                .sum::<G1Projective>();
+
+        let commitments_attributes = izip!(
+            commitments.iter(),
+            self.response_openings.iter(),
+            self.response_attributes.iter()
+        )
+        .map(|(cm_j, r_o_j, r_m_j)| cm_j * self.challenge + g1 * r_o_j + h * r_m_j)
+        .collect::<Vec<_>>();
+
+        let commitments_bytes = commitments
+            .iter()
+            .map(|cm| cm.to_bytes())
+            .collect::<Vec<_>>();
+
+        let commitments_attributes_bytes = commitments_attributes
+            .iter()
+            .map(|cm| cm.to_bytes())
+            .collect::<Vec<_>>();
+
+        // re-compute the challenge
+        let challenge = compute_challenge::<ChallengeDigest, _, _>(
+            std::iter::once(params.gen1().to_bytes().as_ref())
+                .chain(hs_bytes.iter().map(|hs| hs.as_ref()))
+                .chain(std::iter::once(h.to_bytes().as_ref()))
+                .chain(std::iter::once(commitment.to_bytes().as_ref()))
+                .chain(commitments_bytes.iter().map(|cm| cm.as_ref()))
+                .chain(std::iter::once(commitment_attributes.to_bytes().as_ref()))
+                .chain(commitments_attributes_bytes.iter().map(|cm| cm.as_ref())),
+        );
+
+        challenge == self.challenge
+    }
+
+    // challenge || response opening || openings len || response openings || attributes len ||
+    // response attributes
+    pub(crate) fn to_bytes(&self) -> Vec<u8> {
+        let openings_len = self.response_openings.len() as u64;
+        let attributes_len = self.response_attributes.len() as u64;
+
+        let mut bytes = Vec::with_capacity(16 + (2 + openings_len + attributes_len) as usize * 32);
+
+        bytes.extend_from_slice(&self.challenge.to_bytes());
+        bytes.extend_from_slice(&self.response_opening.to_bytes());
+
+        bytes.extend_from_slice(&openings_len.to_le_bytes());
+        for ro in &self.response_openings {
+            bytes.extend_from_slice(&ro.to_bytes());
+        }
+
+        bytes.extend_from_slice(&attributes_len.to_le_bytes());
+        for rm in &self.response_attributes {
+            bytes.extend_from_slice(&rm.to_bytes());
+        }
+
+        bytes
+    }
+
+    pub(crate) fn from_bytes(bytes: &[u8]) -> Result<Self> {
+        // at the very minimum there must be a single attribute being proven
+        if bytes.len() < 32 * 4 + 16 || (bytes.len() - 16) % 32 != 0 {
+            return Err(CoconutError::Deserialization(
+                "tried to deserialize proof of commitments with bytes of invalid length"
+                    .to_string(),
+            ));
+        }
+
+        let mut idx = 0;
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let challenge_bytes = bytes[idx..idx + 32].try_into().unwrap();
+        idx += 32;
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let response_opening_bytes = bytes[idx..idx + 32].try_into().unwrap();
+        idx += 32;
+
+        let challenge = try_deserialize_scalar(
+            &challenge_bytes,
+            CoconutError::Deserialization("Failed to deserialize challenge".to_string()),
+        )?;
+
+        let response_opening = try_deserialize_scalar(
+            &response_opening_bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize the response to the random".to_string(),
+            ),
+        )?;
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let ro_len = u64::from_le_bytes(bytes[idx..idx + 8].try_into().unwrap());
+        idx += 8;
+        if bytes[idx..].len() < ro_len as usize * 32 + 8 {
+            return Err(
+                CoconutError::Deserialization(
+                    "tried to deserialize proof of ciphertexts and commitment with insufficient number of bytes provided".to_string()),
+            );
+        }
+
+        let ro_end = idx + ro_len as usize * 32;
+        let response_openings = try_deserialize_scalar_vec(
+            ro_len,
+            &bytes[idx..ro_end],
+            CoconutError::Deserialization("Failed to deserialize openings response".to_string()),
+        )?;
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let rm_len = u64::from_le_bytes(bytes[ro_end..ro_end + 8].try_into().unwrap());
+        let response_attributes = try_deserialize_scalar_vec(
+            rm_len,
+            &bytes[ro_end + 8..],
+            CoconutError::Deserialization("Failed to deserialize attributes response".to_string()),
+        )?;
+
+        Ok(ProofCmCs {
+            challenge,
+            response_opening,
+            response_openings,
+            response_attributes,
+        })
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct ProofKappaZeta {
+    // c
+    challenge: Scalar,
+
+    // responses
+    response_serial_number: Scalar,
+    response_binding_number: Scalar,
+    response_blinder: Scalar,
+}
+
+impl ProofKappaZeta {
+    pub(crate) fn construct(
+        params: &Parameters,
+        verification_key: &VerificationKey,
+        serial_number: &Attribute,
+        binding_number: &Attribute,
+        blinding_factor: &Scalar,
+        blinded_message: &G2Projective,
+        blinded_serial_number: &G2Projective,
+    ) -> Self {
+        // create the witnesses
+        let witness_blinder = params.random_scalar();
+        let witness_serial_number = params.random_scalar();
+        let witness_binding_number = params.random_scalar();
+        let witness_attributes = [witness_serial_number, witness_binding_number];
+
+        let beta_bytes = verification_key
+            .beta_g2
+            .iter()
+            .map(|beta_i| beta_i.to_bytes())
+            .collect::<Vec<_>>();
+
+        // witnesses commitments
+        // Aw = g2 * wt + alpha + beta[0] * wm[0] + ... + beta[i] * wm[i]
+        let commitment_kappa = params.gen2() * witness_blinder
+            + verification_key.alpha
+            + witness_attributes
+                .iter()
+                .zip(verification_key.beta_g2.iter())
+                .map(|(wm_i, beta_i)| beta_i * wm_i)
+                .sum::<G2Projective>();
+
+        // zeta is the public value associated with the serial number
+        let commitment_zeta = params.gen2() * witness_serial_number;
+
+        let challenge = compute_challenge::<ChallengeDigest, _, _>(
+            std::iter::once(params.gen2().to_bytes().as_ref())
+                .chain(std::iter::once(blinded_message.to_bytes().as_ref()))
+                .chain(std::iter::once(blinded_serial_number.to_bytes().as_ref()))
+                .chain(std::iter::once(verification_key.alpha.to_bytes().as_ref()))
+                .chain(beta_bytes.iter().map(|b| b.as_ref()))
+                .chain(std::iter::once(commitment_kappa.to_bytes().as_ref()))
+                .chain(std::iter::once(commitment_zeta.to_bytes().as_ref())),
+        );
+
+        // responses
+        let response_blinder = produce_response(&witness_blinder, &challenge, blinding_factor);
+        let response_serial_number =
+            produce_response(&witness_serial_number, &challenge, serial_number);
+        let response_binding_number =
+            produce_response(&witness_binding_number, &challenge, binding_number);
+
+        ProofKappaZeta {
+            challenge,
+            response_serial_number,
+            response_binding_number,
+            response_blinder,
+        }
+    }
+
+    pub(crate) fn private_attributes_len(&self) -> usize {
+        2
+    }
+
+    pub(crate) fn verify(
+        &self,
+        params: &Parameters,
+        verification_key: &VerificationKey,
+        kappa: &G2Projective,
+        zeta: &G2Projective,
+    ) -> bool {
+        let beta_bytes = verification_key
+            .beta_g2
+            .iter()
+            .map(|beta_i| beta_i.to_bytes())
+            .collect::<Vec<_>>();
+
+        let response_attributes = [self.response_serial_number, self.response_binding_number];
+        // re-compute witnesses commitments
+        // Aw = (c * kappa) + (rt * g2) + ((1 - c) * alpha) + (rm[0] * beta[0]) + ... + (rm[i] * beta[i])
+        let commitment_kappa = kappa * self.challenge
+            + params.gen2() * self.response_blinder
+            + verification_key.alpha * (Scalar::one() - self.challenge)
+            + response_attributes
+                .iter()
+                .zip(verification_key.beta_g2.iter())
+                .map(|(priv_attr, beta_i)| beta_i * priv_attr)
+                .sum::<G2Projective>();
+
+        // zeta is the public value associated with the serial number
+        let commitment_zeta = zeta * self.challenge + params.gen2() * self.response_serial_number;
+
+        // compute the challenge
+        let challenge = compute_challenge::<ChallengeDigest, _, _>(
+            std::iter::once(params.gen2().to_bytes().as_ref())
+                .chain(std::iter::once(kappa.to_bytes().as_ref()))
+                .chain(std::iter::once(zeta.to_bytes().as_ref()))
+                .chain(std::iter::once(verification_key.alpha.to_bytes().as_ref()))
+                .chain(beta_bytes.iter().map(|b| b.as_ref()))
+                .chain(std::iter::once(commitment_kappa.to_bytes().as_ref()))
+                .chain(std::iter::once(commitment_zeta.to_bytes().as_ref())),
+        );
+
+        challenge == self.challenge
+    }
+
+    // challenge || response serial number || response binding number || repose blinder
+    pub(crate) fn to_bytes(&self) -> Vec<u8> {
+        let attributes_len = 2; // because we have serial number and the binding number
+        let mut bytes = Vec::with_capacity((1 + attributes_len + 1) as usize * 32);
+
+        bytes.extend_from_slice(&self.challenge.to_bytes());
+        bytes.extend_from_slice(&self.response_serial_number.to_bytes());
+        bytes.extend_from_slice(&self.response_binding_number.to_bytes());
+
+        bytes.extend_from_slice(&self.response_blinder.to_bytes());
+
+        bytes
+    }
+
+    pub(crate) fn from_bytes(bytes: &[u8]) -> Result<Self> {
+        // at the very minimum there must be a single attribute being proven
+        if bytes.len() != 128 {
+            return Err(CoconutError::DeserializationInvalidLength {
+                actual: bytes.len(),
+                modulus_target: bytes.len(),
+                modulus: 32,
+                object: "kappa and zeta".to_string(),
+                target: 32 * 4,
+            });
+        }
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let challenge_bytes = bytes[..32].try_into().unwrap();
+        let challenge = try_deserialize_scalar(
+            &challenge_bytes,
+            CoconutError::Deserialization("Failed to deserialize challenge".to_string()),
+        )?;
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let serial_number_bytes = &bytes[32..64].try_into().unwrap();
+        let response_serial_number = try_deserialize_scalar(
+            serial_number_bytes,
+            CoconutError::Deserialization("failed to deserialize the serial number".to_string()),
+        )?;
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let binding_number_bytes = &bytes[64..96].try_into().unwrap();
+        let response_binding_number = try_deserialize_scalar(
+            binding_number_bytes,
+            CoconutError::Deserialization("failed to deserialize the binding number".to_string()),
+        )?;
+
+        // safety: bound checked + constant offset
+        #[allow(clippy::unwrap_used)]
+        let blinder_bytes = bytes[96..].try_into().unwrap();
+        let response_blinder = try_deserialize_scalar(
+            &blinder_bytes,
+            CoconutError::Deserialization("failed to deserialize the blinder".to_string()),
+        )?;
+
+        Ok(ProofKappaZeta {
+            challenge,
+            response_serial_number,
+            response_binding_number,
+            response_blinder,
+        })
+    }
+}
+
+// proof builder:
+// - commitment
+// - challenge
+// - responses
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::scheme::keygen::keygen;
+    use crate::scheme::setup::setup;
+    use crate::scheme::verification::{compute_kappa, compute_zeta};
+    use crate::tests::helpers::random_scalars_refs;
+    use group::Group;
+    use rand::thread_rng;
+
+    #[test]
+    fn proof_cm_cs_bytes_roundtrip() {
+        let mut rng = thread_rng();
+
+        let params = setup(1).unwrap();
+        let cm = G1Projective::random(&mut rng);
+        let r = params.random_scalar();
+        let cms: [G1Projective; 1] = [G1Projective::random(&mut rng)];
+        let rs = params.n_random_scalars(1);
+        random_scalars_refs!(private_attributes, params, 1);
+
+        // 0 public 1 private
+        let pi_s = ProofCmCs::construct(&params, &cm, &r, &cms, &rs, &private_attributes, &[]);
+
+        let bytes = pi_s.to_bytes();
+        assert_eq!(ProofCmCs::from_bytes(&bytes).unwrap(), pi_s);
+
+        let params = setup(2).unwrap();
+        let cm = G1Projective::random(&mut rng);
+        let r = params.random_scalar();
+        let cms: [G1Projective; 2] = [
+            G1Projective::random(&mut rng),
+            G1Projective::random(&mut rng),
+        ];
+        let rs = params.n_random_scalars(2);
+        random_scalars_refs!(private_attributes, params, 2);
+
+        // 0 public 2 privates
+        let pi_s = ProofCmCs::construct(&params, &cm, &r, &cms, &rs, &private_attributes, &[]);
+
+        let bytes = pi_s.to_bytes();
+        assert_eq!(ProofCmCs::from_bytes(&bytes).unwrap(), pi_s);
+    }
+
+    #[test]
+    fn proof_kappa_zeta_bytes_roundtrip() {
+        let params = setup(4).unwrap();
+
+        let keypair = keygen(&params);
+
+        // we don't care about 'correctness' of the proof. only whether we can correctly recover it from bytes
+        let serial_number = &params.random_scalar();
+        let binding_number = &params.random_scalar();
+        let private_attributes = vec![serial_number, binding_number];
+
+        let r = params.random_scalar();
+        let kappa = compute_kappa(&params, keypair.verification_key(), &private_attributes, r);
+        let zeta = compute_zeta(&params, serial_number);
+
+        // 0 public 2 private
+        let pi_v = ProofKappaZeta::construct(
+            &params,
+            keypair.verification_key(),
+            serial_number,
+            binding_number,
+            &r,
+            &kappa,
+            &zeta,
+        );
+
+        let proof_bytes = pi_v.to_bytes();
+
+        let proof_from_bytes = ProofKappaZeta::from_bytes(&proof_bytes).unwrap();
+        assert_eq!(proof_from_bytes, pi_v);
+
+        // 2 public 2 private
+        let params = setup(4).unwrap();
+        let keypair = keygen(&params);
+
+        let pi_v = ProofKappaZeta::construct(
+            &params,
+            keypair.verification_key(),
+            serial_number,
+            binding_number,
+            &r,
+            &kappa,
+            &zeta,
+        );
+
+        let proof_bytes = pi_v.to_bytes();
+
+        let proof_from_bytes = ProofKappaZeta::from_bytes(&proof_bytes).unwrap();
+        assert_eq!(proof_from_bytes, pi_v);
+    }
+}

common/nymcoconut/src/scheme/aggregation.rs

@@ -0,0 +1,432 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use core::iter::Sum;
+use core::ops::Mul;
+
+use bls12_381::{G2Prepared, G2Projective, Scalar};
+use group::Curve;
+use itertools::Itertools;
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::verification::check_bilinear_pairing;
+use crate::scheme::{PartialSignature, Signature, SignatureShare, SignerIndex, VerificationKey};
+use crate::utils::perform_lagrangian_interpolation_at_origin;
+use crate::{Attribute, Parameters, VerificationKeyShare};
+
+pub(crate) trait Aggregatable: Sized {
+    fn aggregate(aggregatable: &[Self], indices: Option<&[SignerIndex]>) -> Result<Self>;
+
+    fn check_unique_indices(indices: &[SignerIndex]) -> bool {
+        // if aggregation is a threshold one, all indices should be unique
+        indices.iter().unique_by(|&index| index).count() == indices.len()
+    }
+}
+
+// includes `VerificationKey`
+impl<T> Aggregatable for T
+where
+    T: Sum,
+    for<'a> T: Sum<&'a T>,
+    for<'a> &'a T: Mul<Scalar, Output = T>,
+{
+    fn aggregate(aggregatable: &[T], indices: Option<&[u64]>) -> Result<T> {
+        if aggregatable.is_empty() {
+            return Err(CoconutError::Aggregation("Empty set of values".to_string()));
+        }
+
+        if let Some(indices) = indices {
+            if !Self::check_unique_indices(indices) {
+                return Err(CoconutError::Aggregation("Non-unique indices".to_string()));
+            }
+            perform_lagrangian_interpolation_at_origin(indices, aggregatable)
+        } else {
+            // non-threshold
+            Ok(aggregatable.iter().sum())
+        }
+    }
+}
+
+impl Aggregatable for PartialSignature {
+    fn aggregate(sigs: &[PartialSignature], indices: Option<&[u64]>) -> Result<Signature> {
+        let h = sigs
+            .first()
+            .ok_or_else(|| CoconutError::Aggregation("Empty set of signatures".to_string()))?
+            .sig1();
+
+        // TODO: is it possible to avoid this allocation?
+        let sigmas = sigs.iter().map(|sig| *sig.sig2()).collect::<Vec<_>>();
+        let aggr_sigma = Aggregatable::aggregate(&sigmas, indices)?;
+
+        Ok(Signature(*h, aggr_sigma))
+    }
+}
+
+/// Ensures all provided verification keys were generated to verify the same number of attributes.
+fn check_same_key_size(keys: &[VerificationKey]) -> bool {
+    keys.iter().map(|vk| vk.beta_g1.len()).all_equal()
+        && keys.iter().map(|vk| vk.beta_g2.len()).all_equal()
+}
+
+pub fn aggregate_verification_keys(
+    keys: &[VerificationKey],
+    indices: Option<&[SignerIndex]>,
+) -> Result<VerificationKey> {
+    if !check_same_key_size(keys) {
+        return Err(CoconutError::Aggregation(
+            "Verification keys are of different sizes".to_string(),
+        ));
+    }
+    Aggregatable::aggregate(keys, indices)
+}
+
+pub fn aggregate_key_shares(shares: &[VerificationKeyShare]) -> Result<VerificationKey> {
+    let (keys, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (share.key.clone(), share.index))
+        .unzip();
+
+    aggregate_verification_keys(&keys, Some(&indices))
+}
+
+pub fn aggregate_signatures(
+    signatures: &[PartialSignature],
+    indices: Option<&[SignerIndex]>,
+) -> Result<Signature> {
+    Aggregatable::aggregate(signatures, indices)
+}
+
+pub fn aggregate_signatures_and_verify(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    attributes: &[&Attribute],
+    signatures: &[PartialSignature],
+    indices: Option<&[SignerIndex]>,
+) -> Result<Signature> {
+    // aggregate the signature
+    let signature = aggregate_signatures(signatures, indices)?;
+
+    // Verify the signature
+    let alpha = verification_key.alpha;
+
+    let tmp = attributes
+        .iter()
+        .zip(verification_key.beta_g2.iter())
+        .map(|(&attr, beta_i)| beta_i * attr)
+        .sum::<G2Projective>();
+
+    if bool::from(signature.0.is_identity()) {
+        return Err(CoconutError::Aggregation(
+            "Verification of the aggregated signature failed - h is an identity point".to_string(),
+        ));
+    }
+    if !check_bilinear_pairing(
+        &signature.0.to_affine(),
+        &G2Prepared::from((alpha + tmp).to_affine()),
+        &signature.1.to_affine(),
+        params.prepared_miller_g2(),
+    ) {
+        return Err(CoconutError::Aggregation(
+            "Verification of the aggregated signature failed".to_string(),
+        ));
+    }
+    Ok(signature)
+}
+
+pub fn aggregate_signature_shares(shares: &[SignatureShare]) -> Result<Signature> {
+    let (signatures, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (*share.signature(), share.index()))
+        .unzip();
+
+    aggregate_signatures(&signatures, Some(&indices))
+}
+
+pub fn aggregate_signature_shares_and_verify(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    attributes: &[&Attribute],
+    shares: &[SignatureShare],
+) -> Result<Signature> {
+    let (signatures, indices): (Vec<_>, Vec<_>) = shares
+        .iter()
+        .map(|share| (*share.signature(), share.index()))
+        .unzip();
+
+    aggregate_signatures_and_verify(
+        params,
+        verification_key,
+        attributes,
+        &signatures,
+        Some(&indices),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::scheme::issuance::sign;
+    use crate::scheme::keygen::ttp_keygen;
+    use crate::scheme::verification::verify;
+    use crate::tests::helpers::random_scalars_refs;
+    use bls12_381::G1Projective;
+    use group::Group;
+
+    use super::*;
+
+    #[test]
+    fn key_aggregation_works_for_any_subset_of_keys() {
+        let params = Parameters::new(2).unwrap();
+        let keypairs = ttp_keygen(&params, 3, 5).unwrap();
+
+        let vks = keypairs
+            .into_iter()
+            .map(|keypair| keypair.verification_key().clone())
+            .collect::<Vec<_>>();
+
+        let aggr_vk1 = aggregate_verification_keys(&vks[..3], Some(&[1, 2, 3])).unwrap();
+        let aggr_vk2 = aggregate_verification_keys(&vks[2..], Some(&[3, 4, 5])).unwrap();
+
+        assert_eq!(aggr_vk1, aggr_vk2);
+
+        // TODO: should those two actually work or not?
+        // aggregating threshold+1
+        let aggr_more = aggregate_verification_keys(&vks[1..], Some(&[2, 3, 4, 5])).unwrap();
+        assert_eq!(aggr_vk1, aggr_more);
+
+        // aggregating all
+        let aggr_all = aggregate_verification_keys(&vks, Some(&[1, 2, 3, 4, 5])).unwrap();
+        assert_eq!(aggr_all, aggr_vk1);
+
+        // not taking enough points (threshold was 3)
+        let aggr_not_enough = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
+        assert_ne!(aggr_not_enough, aggr_vk1);
+
+        // taking wrong index
+        let aggr_bad = aggregate_verification_keys(&vks[2..], Some(&[42, 123, 100])).unwrap();
+        assert_ne!(aggr_vk1, aggr_bad);
+    }
+
+    #[test]
+    fn key_aggregation_doesnt_work_for_empty_set_of_keys() {
+        let keys: Vec<VerificationKey> = vec![];
+        assert!(aggregate_verification_keys(&keys, None).is_err());
+    }
+
+    #[test]
+    fn key_aggregation_doesnt_work_if_indices_have_invalid_length() {
+        let keys = vec![VerificationKey::identity(3)];
+
+        assert!(aggregate_verification_keys(&keys, Some(&[])).is_err());
+        assert!(aggregate_verification_keys(&keys, Some(&[1, 2])).is_err());
+    }
+
+    #[test]
+    fn key_aggregation_doesnt_work_for_non_unique_indices() {
+        let keys = vec![VerificationKey::identity(3), VerificationKey::identity(3)];
+
+        assert!(aggregate_verification_keys(&keys, Some(&[1, 1])).is_err());
+    }
+
+    #[test]
+    fn key_aggregation_doesnt_work_for_keys_of_different_size() {
+        let keys = vec![VerificationKey::identity(3), VerificationKey::identity(1)];
+
+        assert!(aggregate_verification_keys(&keys, None).is_err())
+    }
+
+    #[test]
+    fn signature_aggregation_works_for_any_subset_of_signatures() {
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(attributes, params, 2);
+
+        let keypairs = ttp_keygen(&params, 3, 5).unwrap();
+
+        let (sks, vks): (Vec<_>, Vec<_>) = keypairs
+            .into_iter()
+            .map(|keypair| {
+                (
+                    keypair.secret_key().clone(),
+                    keypair.verification_key().clone(),
+                )
+            })
+            .unzip();
+
+        let sigs = sks
+            .iter()
+            .map(|sk| sign(sk, &attributes).unwrap())
+            .collect::<Vec<_>>();
+
+        // aggregating (any) threshold works
+        let aggr_vk_1 = aggregate_verification_keys(&vks[..3], Some(&[1, 2, 3])).unwrap();
+        let aggr_sig1 = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_1,
+            &attributes,
+            &sigs[..3],
+            Some(&[1, 2, 3]),
+        )
+        .unwrap();
+
+        let aggr_vk_2 = aggregate_verification_keys(&vks[2..], Some(&[3, 4, 5])).unwrap();
+        let aggr_sig2 = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_1,
+            &attributes,
+            &sigs[2..],
+            Some(&[3, 4, 5]),
+        )
+        .unwrap();
+        assert_eq!(aggr_sig1, aggr_sig2);
+
+        // verify credential for good measure
+        assert!(verify(&params, &aggr_vk_1, &attributes, &aggr_sig1));
+        assert!(verify(&params, &aggr_vk_2, &attributes, &aggr_sig2));
+
+        // aggregating threshold+1 works
+        let aggr_vk_more = aggregate_verification_keys(&vks[1..], Some(&[2, 3, 4, 5])).unwrap();
+        let aggr_more = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_more,
+            &attributes,
+            &sigs[1..],
+            Some(&[2, 3, 4, 5]),
+        )
+        .unwrap();
+        assert_eq!(aggr_sig1, aggr_more);
+
+        // aggregating all
+        let aggr_vk_all = aggregate_verification_keys(&vks, Some(&[1, 2, 3, 4, 5])).unwrap();
+        let aggr_all = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &sigs,
+            Some(&[1, 2, 3, 4, 5]),
+        )
+        .unwrap();
+        assert_eq!(aggr_all, aggr_sig1);
+
+        // not taking enough points (threshold was 3) should fail
+        let aggr_vk_not_enough = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
+        let aggr_not_enough = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_not_enough,
+            &attributes,
+            &sigs[..2],
+            Some(&[1, 2]),
+        )
+        .unwrap();
+        assert_ne!(aggr_not_enough, aggr_sig1);
+
+        // taking wrong index should fail
+        let aggr_vk_bad = aggregate_verification_keys(&vks[2..], Some(&[1, 2, 3])).unwrap();
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_bad,
+            &attributes,
+            &sigs[2..],
+            Some(&[42, 123, 100]),
+        )
+        .is_err());
+    }
+
+    fn random_signature() -> Signature {
+        let mut rng = rand::thread_rng();
+        Signature(
+            G1Projective::random(&mut rng),
+            G1Projective::random(&mut rng),
+        )
+    }
+
+    #[test]
+    fn signature_aggregation_doesnt_work_for_empty_set_of_signatures() {
+        let signatures: Vec<Signature> = vec![];
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(attributes, params, 2);
+        let keypairs = ttp_keygen(&params, 3, 5).unwrap();
+
+        let (_, vks): (Vec<_>, Vec<_>) = keypairs
+            .into_iter()
+            .map(|keypair| {
+                (
+                    keypair.secret_key().clone(),
+                    keypair.verification_key().clone(),
+                )
+            })
+            .unzip();
+
+        let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            None
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn signature_aggregation_doesnt_work_if_indices_have_invalid_length() {
+        let signatures = vec![random_signature()];
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(attributes, params, 2);
+        let keypairs = ttp_keygen(&params, 3, 5).unwrap();
+        let (_, vks): (Vec<_>, Vec<_>) = keypairs
+            .into_iter()
+            .map(|keypair| {
+                (
+                    keypair.secret_key().clone(),
+                    keypair.verification_key().clone(),
+                )
+            })
+            .unzip();
+        let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
+
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            Some(&[])
+        )
+        .is_err());
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            Some(&[1, 2]),
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn signature_aggregation_doesnt_work_for_non_unique_indices() {
+        let signatures = vec![random_signature(), random_signature()];
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(attributes, params, 2);
+        let keypairs = ttp_keygen(&params, 3, 5).unwrap();
+        let (_, vks): (Vec<_>, Vec<_>) = keypairs
+            .into_iter()
+            .map(|keypair| {
+                (
+                    keypair.secret_key().clone(),
+                    keypair.verification_key().clone(),
+                )
+            })
+            .unzip();
+        let aggr_vk_all = aggregate_verification_keys(&vks, None).unwrap();
+
+        assert!(aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk_all,
+            &attributes,
+            &signatures,
+            Some(&[1, 1]),
+        )
+        .is_err());
+    }
+
+    // TODO: test for aggregating non-threshold keys
+}

common/nymcoconut/src/scheme/double_use.rs

@@ -0,0 +1,79 @@
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::{CoconutError, Result};
+use crate::traits::{Base58, Bytable};
+use crate::utils::try_deserialize_g2_projective;
+use bls12_381::{G2Affine, G2Projective};
+use group::Curve;
+
+use std::fmt::{Debug, Formatter};
+use std::ops::Deref;
+
+#[derive(PartialEq, Eq, Clone, Copy)]
+pub struct BlindedSerialNumber(G2Projective);
+
+// use custom Debug implementation to show base58 encoding (rather than raw curve elements)
+impl Debug for BlindedSerialNumber {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        f.debug_tuple("BlindedSerialNumber")
+            .field(&self.to_bs58())
+            .finish()
+    }
+}
+
+impl From<G2Projective> for BlindedSerialNumber {
+    fn from(value: G2Projective) -> Self {
+        BlindedSerialNumber(value)
+    }
+}
+
+impl From<G2Affine> for BlindedSerialNumber {
+    fn from(value: G2Affine) -> Self {
+        BlindedSerialNumber(value.into())
+    }
+}
+
+impl Deref for BlindedSerialNumber {
+    type Target = G2Projective;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl TryFrom<&[u8]> for BlindedSerialNumber {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<Self> {
+        if bytes.len() != 96 {
+            return Err(
+                CoconutError::Deserialization(
+                    format!("Tried to deserialize blinded serial number with incorrect number of bytes, expected 96, got {}", bytes.len()),
+                ));
+        }
+
+        // safety: we've just made a check for 96 bytes
+        #[allow(clippy::unwrap_used)]
+        let inner = try_deserialize_g2_projective(
+            &bytes.try_into().unwrap(),
+            CoconutError::Deserialization(
+                "failed to deserialize the blinded serial number (zeta)".to_string(),
+            ),
+        )?;
+
+        Ok(BlindedSerialNumber(inner))
+    }
+}
+
+impl Bytable for BlindedSerialNumber {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.0.to_affine().to_compressed().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        Self::try_from(slice)
+    }
+}
+
+impl Base58 for BlindedSerialNumber {}

common/nymcoconut/src/scheme/issuance.rs

@@ -0,0 +1,660 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::ops::Neg;
+
+use bls12_381::{multi_miller_loop, G1Affine, G1Projective, G2Prepared, Scalar};
+use group::{Curve, Group, GroupEncoding};
+
+use crate::error::{CoconutError, Result};
+use crate::proofs::ProofCmCs;
+use crate::scheme::keygen::VerificationKey;
+use crate::scheme::setup::Parameters;
+use crate::scheme::BlindedSignature;
+use crate::scheme::SecretKey;
+use crate::Attribute;
+use crate::Signature;
+
+// TODO: possibly completely remove those two functions.
+// They only exist to have a simpler and smaller code snippets to test
+// basic functionalities.
+use crate::traits::{Base58, Bytable};
+use crate::utils::{hash_g1, try_deserialize_g1_projective};
+
+// TODO NAMING: double check this one
+// Lambda
+#[derive(Debug)]
+#[cfg_attr(test, derive(PartialEq, Eq))]
+pub struct BlindSignRequest {
+    // cm
+    commitment: G1Projective,
+    // h
+    commitment_hash: G1Projective,
+    // c
+    private_attributes_commitments: Vec<G1Projective>,
+    // pi_s
+    pi_s: ProofCmCs,
+}
+
+impl TryFrom<&[u8]> for BlindSignRequest {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<BlindSignRequest> {
+        if bytes.len() < 48 + 48 + 8 + 48 {
+            return Err(CoconutError::DeserializationMinLength {
+                min: 48 + 48 + 8 + 48,
+                actual: bytes.len(),
+            });
+        }
+
+        let mut j = 0;
+        let commitment_bytes_len = 48;
+        let commitment_hash_bytes_len = 48;
+
+        // safety: we made bound check and we're using constant offest
+        #[allow(clippy::unwrap_used)]
+        let cm_bytes = bytes[..j + commitment_bytes_len].try_into().unwrap();
+        let commitment = try_deserialize_g1_projective(
+            &cm_bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize compressed commitment".to_string(),
+            ),
+        )?;
+        j += commitment_bytes_len;
+
+        // safety: we made bound check and we're using constant offest
+        #[allow(clippy::unwrap_used)]
+        let cm_hash_bytes = bytes[j..j + commitment_hash_bytes_len].try_into().unwrap();
+        let commitment_hash = try_deserialize_g1_projective(
+            &cm_hash_bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize compressed commitment hash".to_string(),
+            ),
+        )?;
+        j += commitment_hash_bytes_len;
+
+        // safety: we made bound check and we're using constant offest
+        #[allow(clippy::unwrap_used)]
+        let c_len = u64::from_le_bytes(bytes[j..j + 8].try_into().unwrap());
+        j += 8;
+        if bytes[j..].len() < c_len as usize * 48 {
+            return Err(CoconutError::DeserializationMinLength {
+                min: c_len as usize * 48,
+                actual: bytes[56..].len(),
+            });
+        }
+
+        let mut private_attributes_commitments = Vec::with_capacity(c_len as usize);
+        for i in 0..c_len as usize {
+            let start = j + i * 48;
+            let end = start + 48;
+
+            if bytes.len() < end {
+                return Err(CoconutError::Deserialization(
+                    "Failed to deserialize compressed commitment".to_string(),
+                ));
+            }
+
+            // safety: we made bound check and we're using constant offest
+            #[allow(clippy::unwrap_used)]
+            let private_attributes_commitment_bytes = bytes[start..end].try_into().unwrap();
+            let private_attributes_commitment = try_deserialize_g1_projective(
+                &private_attributes_commitment_bytes,
+                CoconutError::Deserialization(
+                    "Failed to deserialize compressed commitment".to_string(),
+                ),
+            )?;
+
+            private_attributes_commitments.push(private_attributes_commitment)
+        }
+
+        let pi_s = ProofCmCs::from_bytes(&bytes[j + c_len as usize * 48..])?;
+
+        Ok(BlindSignRequest {
+            commitment,
+            commitment_hash,
+            private_attributes_commitments,
+            pi_s,
+        })
+    }
+}
+
+impl Bytable for BlindSignRequest {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        let cm_bytes = self.commitment.to_affine().to_compressed();
+        let cm_hash_bytes = self.commitment_hash.to_affine().to_compressed();
+        let c_len = self.private_attributes_commitments.len() as u64;
+        let proof_bytes = self.pi_s.to_bytes();
+
+        let mut bytes = Vec::with_capacity(48 + 48 + 8 + c_len as usize * 48 + proof_bytes.len());
+
+        bytes.extend_from_slice(&cm_bytes);
+        bytes.extend_from_slice(&cm_hash_bytes);
+        bytes.extend_from_slice(&c_len.to_le_bytes());
+        for c in &self.private_attributes_commitments {
+            bytes.extend_from_slice(&c.to_affine().to_compressed());
+        }
+
+        bytes.extend_from_slice(&proof_bytes);
+
+        bytes
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        BlindSignRequest::from_bytes(slice)
+    }
+}
+
+impl Base58 for BlindSignRequest {}
+
+impl BlindSignRequest {
+    fn verify_proof(&self, params: &Parameters, public_attributes: &[&Attribute]) -> bool {
+        self.pi_s.verify(
+            params,
+            &self.commitment,
+            &self.private_attributes_commitments,
+            public_attributes,
+        )
+    }
+
+    pub fn verify_commitment_hash(&self, public_attributes: &[&Attribute]) -> bool {
+        self.commitment_hash == compute_hash(self.commitment, public_attributes)
+    }
+
+    pub fn get_commitment_hash(&self) -> G1Projective {
+        self.commitment_hash
+    }
+
+    pub fn get_private_attributes_pedersen_commitments(&self) -> &[G1Projective] {
+        &self.private_attributes_commitments
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        self.to_byte_vec()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<BlindSignRequest> {
+        BlindSignRequest::try_from(bytes)
+    }
+
+    pub fn num_private_attributes(&self) -> usize {
+        self.private_attributes_commitments.len()
+    }
+}
+
+pub fn compute_attributes_commitment(
+    params: &Parameters,
+    private_attributes: &[&Attribute],
+    public_attributes: &[&Attribute],
+    hs: &[G1Affine],
+) -> (Scalar, G1Projective) {
+    let commitment_opening = params.random_scalar();
+
+    // Produces h0 ^ m0 * h1^m1 * .... * hn^mn
+    // where m0, m1, ...., mn are attributes
+    let attr_cm = private_attributes
+        .iter()
+        .chain(public_attributes.iter())
+        .zip(hs)
+        .map(|(&m, h)| h * m)
+        .sum::<G1Projective>();
+
+    // Produces g1^r * h0 ^ m0 * h1^m1 * .... * hn^mn
+    let commitment = params.gen1() * commitment_opening + attr_cm;
+    (commitment_opening, commitment)
+}
+
+pub fn compute_pedersen_commitments_for_private_attributes(
+    params: &Parameters,
+    private_attributes: &[&Attribute],
+    h: &G1Projective,
+) -> (Vec<Scalar>, Vec<G1Projective>) {
+    // Generate openings for Pedersen commitment for each private attribute
+    let commitments_openings = params.n_random_scalars(private_attributes.len());
+
+    // Compute Pedersen commitment for each private attribute
+    let pedersen_commitments = commitments_openings
+        .iter()
+        .zip(private_attributes.iter())
+        .map(|(o_j, &m_j)| params.gen1() * o_j + h * m_j)
+        .collect::<Vec<_>>();
+
+    (commitments_openings, pedersen_commitments)
+}
+
+pub fn compute_hash(commitment: G1Projective, public_attributes: &[&Attribute]) -> G1Projective {
+    let mut buff = Vec::new();
+    buff.extend_from_slice(commitment.to_bytes().as_ref());
+    for attr in public_attributes {
+        buff.extend_from_slice(attr.to_bytes().as_ref());
+    }
+    hash_g1(buff)
+}
+
+/// Builds cryptographic material required for blind sign.
+pub fn prepare_blind_sign(
+    params: &Parameters,
+    private_attributes: &[&Attribute],
+    public_attributes: &[&Attribute],
+) -> Result<(Vec<Scalar>, BlindSignRequest)> {
+    if private_attributes.is_empty() {
+        return Err(CoconutError::Issuance(
+            "Tried to prepare blind sign request for an empty set of private attributes"
+                .to_string(),
+        ));
+    }
+
+    let hs = params.gen_hs();
+    if private_attributes.len() + public_attributes.len() > hs.len() {
+        return Err(CoconutError::IssuanceMaxAttributes {
+            max: hs.len(),
+            requested: private_attributes.len() + public_attributes.len(),
+        });
+    }
+
+    let mut commitment_hash;
+    let mut commitment;
+    let mut commitment_opening;
+
+    loop {
+        // Compute the attributes commitment
+        let (c_opening, c) =
+            compute_attributes_commitment(params, private_attributes, public_attributes, hs);
+        commitment_opening = c_opening;
+        commitment = c;
+
+        // Compute the commitment hash
+        commitment_hash = compute_hash(commitment, public_attributes);
+
+        // Check if the commitment hash is not the identity point
+        if !bool::from(commitment_hash.is_identity()) {
+            break;
+        }
+    }
+
+    let (pedersen_commitments_openings, pedersen_commitments) =
+        compute_pedersen_commitments_for_private_attributes(
+            params,
+            private_attributes,
+            &commitment_hash,
+        );
+
+    let pi_s = ProofCmCs::construct(
+        params,
+        &commitment,
+        &commitment_opening,
+        &pedersen_commitments,
+        &pedersen_commitments_openings,
+        private_attributes,
+        public_attributes,
+    );
+
+    Ok((
+        pedersen_commitments_openings,
+        BlindSignRequest {
+            commitment,
+            commitment_hash,
+            private_attributes_commitments: pedersen_commitments,
+            pi_s,
+        },
+    ))
+}
+
+pub fn blind_sign(
+    params: &Parameters,
+    signing_secret_key: &SecretKey,
+    blind_sign_request: &BlindSignRequest,
+    public_attributes: &[&Attribute],
+) -> Result<BlindedSignature> {
+    let num_private = blind_sign_request.private_attributes_commitments.len();
+    let hs = params.gen_hs();
+
+    if num_private + public_attributes.len() > hs.len() {
+        return Err(CoconutError::IssuanceMaxAttributes {
+            max: hs.len(),
+            requested: num_private + public_attributes.len(),
+        });
+    }
+
+    // Verify the commitment hash
+    let h = compute_hash(blind_sign_request.commitment, public_attributes);
+    if bool::from(blind_sign_request.commitment_hash.is_identity()) {
+        return Err(CoconutError::Issuance(
+            "Commitment hash should not be an identity point".to_string(),
+        ));
+    }
+    if !(h == blind_sign_request.commitment_hash) {
+        return Err(CoconutError::Issuance(
+            "Failed to verify the commitment hash".to_string(),
+        ));
+    }
+
+    // Verify the ZK proof
+    if !blind_sign_request.verify_proof(params, public_attributes) {
+        return Err(CoconutError::Issuance(
+            "Failed to verify the proof of knowledge".to_string(),
+        ));
+    }
+
+    // in python implementation there are n^2 G1 multiplications, let's do it with a single one instead.
+    // i.e. compute h ^ (pub_m[0] * y[m + 1] + ... + pub_m[n] * y[m + n]) directly (where m is number of PRIVATE attributes)
+    // rather than ((h ^ pub_m[0]) ^ y[m + 1] , (h ^ pub_m[1]) ^ y[m + 2] , ...).sum() separately
+    let signed_public = h * public_attributes
+        .iter()
+        .zip(signing_secret_key.ys.iter().skip(num_private))
+        .map(|(&attr, yi)| attr * yi)
+        .sum::<Scalar>();
+
+    // h ^ x + c[0] ^ y[0] + ... c[m] ^ y[m] + h ^ (pub_m[0] * y[m + 1] + ... + pub_m[n] * y[m + n])
+    let sig = blind_sign_request
+        .private_attributes_commitments
+        .iter()
+        .zip(signing_secret_key.ys.iter())
+        .map(|(c, yi)| c * yi)
+        .chain(std::iter::once(h * signing_secret_key.x))
+        .chain(std::iter::once(signed_public))
+        .sum();
+
+    Ok(BlindedSignature(h, sig))
+}
+
+/// Verifies a partial blind signature using the provided parameters and validator's verification key.
+///
+/// # Arguments
+///
+/// * `params` - A reference to the cryptographic parameters.
+/// * `blind_sign_request` - A reference to the blind signature request signed by the client.
+/// * `public_attributes` - A reference to the public attributes included in the client's request.
+/// * `blind_sig` - A reference to the issued partial blinded signature to be verified.
+/// * `partial_verification_key` - A reference to the validator's partial verification key.
+///
+/// # Returns
+///
+/// A boolean indicating whether the partial blind signature is valid (`true`) or not (`false`).
+///
+/// # Remarks
+///
+/// This function verifies the correctness and validity of a partial blind signature using
+/// the provided cryptographic parameters, blind signature request, blinded signature,
+/// and partial verification key.
+/// It calculates pairings based on the provided values and checks whether the partial blind signature
+/// is consistent with the verification key and commitments in the blind signature request.
+/// The function returns `true` if the partial blind signature is valid, and `false` otherwise.
+pub fn verify_partial_blind_signature(
+    params: &Parameters,
+    private_attribute_commitments: &[G1Projective],
+    public_attributes: &[&Attribute],
+    blind_sig: &BlindedSignature,
+    partial_verification_key: &VerificationKey,
+) -> bool {
+    let num_private_attributes = private_attribute_commitments.len();
+    if num_private_attributes + public_attributes.len() > partial_verification_key.beta_g2.len() {
+        return false;
+    }
+    if bool::from(blind_sig.0.is_identity()) {
+        return false;
+    }
+
+    // TODO: we're losing some memory here due to extra allocation,
+    // but worst-case scenario (given SANE amount of attributes), it's just few kb at most
+    let c_neg = blind_sig.1.to_affine().neg();
+    let g2_prep = params.prepared_miller_g2();
+
+    let mut terms = vec![
+        // (c^{-1}, g2)
+        (c_neg, g2_prep.clone()),
+        // (s, alpha)
+        (
+            blind_sig.0.to_affine(),
+            G2Prepared::from(partial_verification_key.alpha.to_affine()),
+        ),
+    ];
+
+    // for each private attribute, add (cm_i, beta_i) to the miller terms
+    for (private_attr_commit, beta_g2) in private_attribute_commitments
+        .iter()
+        .zip(&partial_verification_key.beta_g2)
+    {
+        // (cm_i, beta_i)
+        terms.push((
+            private_attr_commit.to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // for each public attribute, add (s^pub_j, beta_{priv + j}) to the miller terms
+    for (&pub_attr, beta_g2) in public_attributes.iter().zip(
+        partial_verification_key
+            .beta_g2
+            .iter()
+            .skip(num_private_attributes),
+    ) {
+        // (s^pub_j, beta_j)
+        terms.push((
+            (blind_sig.0 * pub_attr).to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // get the references to all the terms to get the arguments the miller loop expects
+    #[allow(clippy::map_identity)]
+    let terms_refs = terms.iter().map(|(g1, g2)| (g1, g2)).collect::<Vec<_>>();
+
+    // since checking whether e(a, b) == e(c, d)
+    // is equivalent to checking e(a, b) • e(c, d)^{-1} == id
+    // and thus to e(a, b) • e(c^{-1}, d) == id
+    //
+    // compute e(c^{-1}, g2) • e(s, alpha) • e(cm_0, beta_0) • e(cm_i, beta_i) • (s^pub_0, beta_{i+1}) (s^pub_j, beta_{i + j})
+    multi_miller_loop(&terms_refs)
+        .final_exponentiation()
+        .is_identity()
+        .into()
+}
+
+/// Creates a Coconut Signature under a given secret key on a set of public attributes only.
+pub fn sign(secret_key: &SecretKey, public_attributes: &[&Attribute]) -> Result<Signature> {
+    if public_attributes.len() > secret_key.ys.len() {
+        return Err(CoconutError::IssuanceMaxAttributes {
+            max: secret_key.ys.len(),
+            requested: public_attributes.len(),
+        });
+    }
+
+    //Serialize the array structure of the public attributes into a byte array
+    let mut serialized_attributes = Vec::new();
+    //Prepend the length of the entire array (in bytes)
+    let array_len = public_attributes.len() as u64;
+    serialized_attributes.extend_from_slice(&array_len.to_le_bytes());
+    //Serialize each attribute with its length
+    for &attribute in public_attributes.iter() {
+        let attr_bytes = attribute.to_bytes();
+        let attr_len = attr_bytes.len() as u64;
+
+        // Prefix the attribute with its length
+        serialized_attributes.extend_from_slice(&attr_len.to_le_bytes());
+        serialized_attributes.extend_from_slice(&attr_bytes);
+    }
+
+    //Hash the resulting byte array to derive the point H
+    let h = hash_g1(serialized_attributes);
+
+    // x + m0 * y0 + m1 * y1 + ... mn * yn
+    let exponent = secret_key.x
+        + public_attributes
+            .iter()
+            .zip(secret_key.ys.iter())
+            .map(|(&m_i, y_i)| m_i * y_i)
+            .sum::<Scalar>();
+
+    let sig2 = h * exponent;
+    Ok(Signature(h, sig2))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::scheme::keygen::keygen;
+    use crate::tests::helpers::random_scalars_refs;
+
+    #[test]
+    fn blind_sign_request_bytes_roundtrip() {
+        // 0 public and 1 private attribute
+        let params = Parameters::new(1).unwrap();
+        random_scalars_refs!(private_attributes, params, 1);
+        random_scalars_refs!(public_attributes, params, 0);
+
+        let (_commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let bytes = lambda.to_bytes();
+        assert_eq!(
+            BlindSignRequest::try_from(bytes.as_slice()).unwrap(),
+            lambda
+        );
+
+        // 2 public and 2 private attributes
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(private_attributes, params, 2);
+        random_scalars_refs!(public_attributes, params, 2);
+
+        let (_commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let bytes = lambda.to_bytes();
+        assert_eq!(
+            BlindSignRequest::try_from(bytes.as_slice()).unwrap(),
+            lambda
+        );
+    }
+
+    #[test]
+    fn test_prepare_blind_sign_non_identity_commitment_hash() {
+        let params = Parameters::new(1).unwrap();
+        random_scalars_refs!(private_attributes, params, 1);
+        random_scalars_refs!(public_attributes, params, 0);
+
+        // Call the function to prepare the blind sign
+        let result = prepare_blind_sign(&params, &private_attributes, &public_attributes);
+
+        // Ensure the result is Ok
+        assert!(result.is_ok(), "prepare_blind_sign should succeed");
+
+        let (_, blind_sign_request) = result.unwrap();
+
+        // Ensure the commitment_hash is not the identity point
+        assert!(
+            !bool::from(blind_sign_request.commitment_hash.is_identity()),
+            "commitment_hash should not be the identity point"
+        );
+    }
+
+    #[test]
+    fn test_blind_sign_with_identity_commitment_hash() {
+        let params = Parameters::new(1).unwrap();
+        random_scalars_refs!(private_attributes, params, 1);
+        random_scalars_refs!(public_attributes, params, 0);
+
+        // Call the function to prepare the blind sign
+        let (_commitments_openings, blind_sign_request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+        let blind_sign_request = BlindSignRequest {
+            commitment_hash: G1Projective::identity(),
+            ..blind_sign_request // This copies the other fields from the existing instance
+        };
+
+        let signing_secret_key = SecretKey {
+            x: params.random_scalar(),
+            ys: vec![params.random_scalar()],
+        };
+
+        // Call blind_sign and ensure it returns an error due to identity commitment hash
+        let result = blind_sign(
+            &params,
+            &signing_secret_key,
+            &blind_sign_request,
+            &public_attributes,
+        );
+
+        // The result should be an error
+        assert!(
+            result.is_err(),
+            "blind_sign should return an error when commitment_hash is the identity point"
+        );
+    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature() {
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(private_attributes, params, 2);
+        random_scalars_refs!(public_attributes, params, 2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request.private_attributes_commitments,
+            &public_attributes,
+            &blind_sig,
+            validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature_no_public_attributes() {
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(private_attributes, params, 2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig = blind_sign(&params, validator_keypair.secret_key(), &request, &[]).unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request.private_attributes_commitments,
+            &[],
+            &blind_sig,
+            validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn fail_verify_partial_blind_signature_with_wrong_key() {
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(private_attributes, params, 2);
+        random_scalars_refs!(public_attributes, params, 2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let validator2_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        // this assertion should fail, as we try to verify with a wrong validator key
+        assert!(!verify_partial_blind_signature(
+            &params,
+            &request.private_attributes_commitments,
+            &public_attributes,
+            &blind_sig,
+            validator2_keypair.verification_key()
+        ),);
+    }
+}

common/nymcoconut/src/scheme/keygen.rs

@@ -0,0 +1,722 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use core::borrow::Borrow;
+use core::iter::Sum;
+use core::ops::{Add, Mul};
+
+use bls12_381::{G1Projective, G2Projective, Scalar};
+use group::Curve;
+use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
+use serde_derive::{Deserialize, Serialize};
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::aggregation::aggregate_verification_keys;
+use crate::scheme::setup::Parameters;
+use crate::scheme::SignerIndex;
+use crate::traits::Bytable;
+use crate::utils::{
+    try_deserialize_g1_projective, try_deserialize_g2_projective, try_deserialize_scalar,
+    try_deserialize_scalar_vec, Polynomial,
+};
+use crate::Base58;
+
+#[derive(Debug)]
+#[cfg_attr(test, derive(PartialEq, Eq, Clone))]
+#[cfg_attr(
+    feature = "key-zeroize",
+    derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop)
+)]
+pub struct SecretKey {
+    pub(crate) x: Scalar,
+    pub(crate) ys: Vec<Scalar>,
+}
+
+impl PemStorableKey for SecretKey {
+    type Error = CoconutError;
+
+    fn pem_type() -> &'static str {
+        "COCONUT SECRET KEY"
+    }
+
+    fn to_bytes(&self) -> Vec<u8> {
+        self.to_bytes()
+    }
+
+    fn from_bytes(bytes: &[u8]) -> std::result::Result<Self, Self::Error> {
+        Self::from_bytes(bytes)
+    }
+}
+
+impl TryFrom<&[u8]> for SecretKey {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<SecretKey> {
+        // There should be x and at least one y
+        if bytes.len() < 32 * 2 + 8 || (bytes.len() - 8) % 32 != 0 {
+            return Err(CoconutError::DeserializationInvalidLength {
+                actual: bytes.len(),
+                modulus_target: bytes.len() - 8,
+                target: 32 * 2 + 8,
+                modulus: 32,
+                object: "secret key".to_string(),
+            });
+        }
+
+        // this conversion will not fail as we are taking the same length of data
+        #[allow(clippy::unwrap_used)]
+        let x_bytes: [u8; 32] = bytes[..32].try_into().unwrap();
+        #[allow(clippy::unwrap_used)]
+        let ys_len = u64::from_le_bytes(bytes[32..40].try_into().unwrap());
+        let actual_ys_len = (bytes.len() - 40) / 32;
+
+        if ys_len as usize != actual_ys_len {
+            return Err(CoconutError::Deserialization(format!(
+                "Tried to deserialize secret key with inconsistent ys len (expected {ys_len}, got {actual_ys_len})"
+            )));
+        }
+
+        let x = try_deserialize_scalar(
+            &x_bytes,
+            CoconutError::Deserialization("Failed to deserialize secret key scalar".to_string()),
+        )?;
+        let ys = try_deserialize_scalar_vec(
+            ys_len,
+            &bytes[40..],
+            CoconutError::Deserialization("Failed to deserialize secret key scalars".to_string()),
+        )?;
+
+        Ok(SecretKey { x, ys })
+    }
+}
+
+impl SecretKey {
+    /// Following a (distributed) key generation process, scalar values can be obtained
+    /// outside of the normal key generation process.
+    pub fn create_from_raw(x: Scalar, ys: Vec<Scalar>) -> Self {
+        Self { x, ys }
+    }
+
+    /// Extract the Scalar copy of the underlying secrets.
+    /// The caller of this function must exercise extreme care to not misuse the data and ensuring it gets zeroized
+    pub fn hazmat_to_raw(&self) -> (Scalar, Vec<Scalar>) {
+        (self.x, self.ys.clone())
+    }
+
+    pub fn size(&self) -> usize {
+        self.ys.len()
+    }
+
+    /// Derive verification key using this secret key.
+    pub fn verification_key(&self, params: &Parameters) -> VerificationKey {
+        let g1 = params.gen1();
+        let g2 = params.gen2();
+        VerificationKey {
+            alpha: g2 * self.x,
+            beta_g1: self.ys.iter().map(|y| g1 * y).collect(),
+            beta_g2: self.ys.iter().map(|y| g2 * y).collect(),
+        }
+    }
+
+    // x || ys.len() || ys
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let ys_len = self.ys.len();
+        let mut bytes = Vec::with_capacity(8 + (ys_len + 1) * 32);
+
+        bytes.extend_from_slice(&self.x.to_bytes());
+        bytes.extend_from_slice(&ys_len.to_le_bytes());
+        for y in self.ys.iter() {
+            bytes.extend_from_slice(&y.to_bytes())
+        }
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<SecretKey> {
+        SecretKey::try_from(bytes)
+    }
+}
+
+impl Bytable for SecretKey {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        SecretKey::try_from(slice)
+    }
+}
+
+impl Base58 for SecretKey {}
+
+// TODO: perhaps change points to affine representation
+// to make verification slightly more efficient?
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub struct VerificationKey {
+    // TODO add gen2 as per the paper or imply it from the fact library is using bls381?
+    pub(crate) alpha: G2Projective,
+    pub(crate) beta_g1: Vec<G1Projective>,
+    pub(crate) beta_g2: Vec<G2Projective>,
+}
+
+impl PemStorableKey for VerificationKey {
+    type Error = CoconutError;
+
+    fn pem_type() -> &'static str {
+        "COCONUT VERIFICATION KEY"
+    }
+
+    fn to_bytes(&self) -> Vec<u8> {
+        self.to_bytes()
+    }
+
+    fn from_bytes(bytes: &[u8]) -> std::result::Result<Self, Self::Error> {
+        Self::from_bytes(bytes)
+    }
+}
+
+impl TryFrom<&[u8]> for VerificationKey {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<VerificationKey> {
+        // There should be at least alpha, one betaG1 and one betaG2 and their length
+        if bytes.len() < 96 * 2 + 48 + 8 || (bytes.len() - 8 - 96) % (96 + 48) != 0 {
+            return Err(CoconutError::DeserializationInvalidLength {
+                actual: bytes.len(),
+                modulus_target: bytes.len() - 8 - 96,
+                target: 96 * 2 + 48 + 8,
+                modulus: 96 + 48,
+                object: "verification key".to_string(),
+            });
+        }
+
+        // this conversion will not fail as we are taking the same length of data
+        #[allow(clippy::unwrap_used)]
+        let alpha_bytes: [u8; 96] = bytes[..96].try_into().unwrap();
+        #[allow(clippy::unwrap_used)]
+        let betas_len = u64::from_le_bytes(bytes[96..104].try_into().unwrap());
+
+        let actual_betas_len = (bytes.len() - 104) / (96 + 48);
+
+        if betas_len as usize != actual_betas_len {
+            return Err(
+                CoconutError::Deserialization(
+                    format!("Tried to deserialize verification key with inconsistent betas len (expected {betas_len}, got {actual_betas_len})"
+                    )));
+        }
+
+        let alpha = try_deserialize_g2_projective(
+            &alpha_bytes,
+            CoconutError::Deserialization(
+                "Failed to deserialize verification key G2 point (alpha)".to_string(),
+            ),
+        )?;
+
+        let mut beta_g1 = Vec::with_capacity(betas_len as usize);
+        let mut beta_g1_end: u64 = 0;
+        for i in 0..betas_len {
+            let start = (104 + i * 48) as usize;
+            let end = start + 48;
+            // we're using a constant 48 byte offset (which is the size of G1 compressed) so unwrap is fine
+            #[allow(clippy::unwrap_used)]
+            let beta_i_bytes = bytes[start..end].try_into().unwrap();
+            let beta_i = try_deserialize_g1_projective(
+                &beta_i_bytes,
+                CoconutError::Deserialization(
+                    "Failed to deserialize verification key G1 point (beta)".to_string(),
+                ),
+            )?;
+
+            beta_g1_end = end as u64;
+            beta_g1.push(beta_i)
+        }
+
+        let mut beta_g2 = Vec::with_capacity(betas_len as usize);
+        for i in 0..betas_len {
+            let start = (beta_g1_end + i * 96) as usize;
+            let end = start + 96;
+            // we're using a constant 96 byte offset (which is the size of G2 compressed) so unwrap is fine
+            #[allow(clippy::unwrap_used)]
+            let beta_i_bytes = bytes[start..end].try_into().unwrap();
+            let beta_i = try_deserialize_g2_projective(
+                &beta_i_bytes,
+                CoconutError::Deserialization(
+                    "Failed to deserialize verification key G2 point (beta)".to_string(),
+                ),
+            )?;
+
+            beta_g2.push(beta_i)
+        }
+
+        Ok(VerificationKey {
+            alpha,
+            beta_g1,
+            beta_g2,
+        })
+    }
+}
+
+impl<'b> Add<&'b VerificationKey> for VerificationKey {
+    type Output = VerificationKey;
+
+    #[inline]
+    fn add(self, rhs: &'b VerificationKey) -> VerificationKey {
+        // If you're trying to add two keys together that were created
+        // for different number of attributes, just panic as it's a
+        // nonsense operation.
+        assert_eq!(
+            self.beta_g1.len(),
+            rhs.beta_g1.len(),
+            "trying to add verification keys generated for different number of attributes [G1]"
+        );
+
+        assert_eq!(
+            self.beta_g2.len(),
+            rhs.beta_g2.len(),
+            "trying to add verification keys generated for different number of attributes [G2]"
+        );
+
+        assert_eq!(
+            self.beta_g1.len(),
+            self.beta_g2.len(),
+            "this key is incorrect - the number of elements G1 and G2 does not match"
+        );
+
+        assert_eq!(
+            rhs.beta_g1.len(),
+            rhs.beta_g2.len(),
+            "they key you want to add is incorrect - the number of elements G1 and G2 does not match"
+        );
+
+        VerificationKey {
+            alpha: self.alpha + rhs.alpha,
+            beta_g1: self
+                .beta_g1
+                .iter()
+                .zip(rhs.beta_g1.iter())
+                .map(|(self_beta_g1, rhs_beta_g1)| self_beta_g1 + rhs_beta_g1)
+                .collect(),
+            beta_g2: self
+                .beta_g2
+                .iter()
+                .zip(rhs.beta_g2.iter())
+                .map(|(self_beta_g2, rhs_beta_g2)| self_beta_g2 + rhs_beta_g2)
+                .collect(),
+        }
+    }
+}
+
+impl Mul<Scalar> for &VerificationKey {
+    type Output = VerificationKey;
+
+    #[inline]
+    fn mul(self, rhs: Scalar) -> Self::Output {
+        VerificationKey {
+            alpha: self.alpha * rhs,
+            beta_g1: self.beta_g1.iter().map(|b_i| b_i * rhs).collect(),
+            beta_g2: self.beta_g2.iter().map(|b_i| b_i * rhs).collect(),
+        }
+    }
+}
+
+impl<T> Sum<T> for VerificationKey
+where
+    T: Borrow<VerificationKey>,
+{
+    #[inline]
+    fn sum<I>(iter: I) -> Self
+    where
+        I: Iterator<Item = T>,
+    {
+        let mut peekable = iter.peekable();
+        let head_attributes = match peekable.peek() {
+            Some(head) => head.borrow().beta_g2.len(),
+            None => {
+                // TODO: this is a really weird edge case. You're trying to sum an EMPTY iterator
+                // of VerificationKey. So should it panic here or just return some nonsense value?
+                return VerificationKey::identity(0);
+            }
+        };
+
+        peekable.fold(VerificationKey::identity(head_attributes), |acc, item| {
+            acc + item.borrow()
+        })
+    }
+}
+
+impl VerificationKey {
+    /// Create a (kinda) identity verification key using specified
+    /// number of 'beta' elements
+    pub(crate) fn identity(beta_size: usize) -> Self {
+        VerificationKey {
+            alpha: G2Projective::identity(),
+            beta_g1: vec![G1Projective::identity(); beta_size],
+            beta_g2: vec![G2Projective::identity(); beta_size],
+        }
+    }
+
+    pub fn aggregate(sigs: &[Self], indices: Option<&[SignerIndex]>) -> Result<Self> {
+        aggregate_verification_keys(sigs, indices)
+    }
+
+    pub fn alpha(&self) -> &G2Projective {
+        &self.alpha
+    }
+
+    pub fn beta_g1(&self) -> &Vec<G1Projective> {
+        &self.beta_g1
+    }
+
+    pub fn beta_g2(&self) -> &Vec<G2Projective> {
+        &self.beta_g2
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let beta_g1_len = self.beta_g1.len();
+        let beta_g2_len = self.beta_g2.len();
+        let mut bytes = Vec::with_capacity(96 + 8 + beta_g1_len * 48 + beta_g2_len * 96);
+
+        bytes.extend_from_slice(&self.alpha.to_affine().to_compressed());
+
+        bytes.extend_from_slice(&beta_g1_len.to_le_bytes());
+
+        for beta_g1 in self.beta_g1.iter() {
+            bytes.extend_from_slice(&beta_g1.to_affine().to_compressed())
+        }
+
+        for beta_g2 in self.beta_g2.iter() {
+            bytes.extend_from_slice(&beta_g2.to_affine().to_compressed())
+        }
+
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<VerificationKey> {
+        VerificationKey::try_from(bytes)
+    }
+}
+
+impl Bytable for VerificationKey {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        VerificationKey::try_from(slice)
+    }
+}
+
+impl Base58 for VerificationKey {}
+
+#[derive(Debug, Clone)]
+pub struct VerificationKeyShare {
+    pub key: VerificationKey,
+    pub index: SignerIndex,
+}
+
+impl From<(VerificationKey, SignerIndex)> for VerificationKeyShare {
+    fn from(value: (VerificationKey, SignerIndex)) -> Self {
+        VerificationKeyShare {
+            key: value.0,
+            index: value.1,
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[cfg_attr(test, derive(PartialEq, Eq, Clone))]
+pub struct KeyPair {
+    secret_key: SecretKey,
+    verification_key: VerificationKey,
+
+    /// Optional index value specifying polynomial point used during threshold key generation.
+    pub index: Option<SignerIndex>,
+}
+
+impl From<KeyPair> for (SecretKey, VerificationKey) {
+    fn from(value: KeyPair) -> Self {
+        (value.secret_key, value.verification_key)
+    }
+}
+
+impl PemStorableKeyPair for KeyPair {
+    type PrivatePemKey = SecretKey;
+    type PublicPemKey = VerificationKey;
+
+    fn private_key(&self) -> &Self::PrivatePemKey {
+        &self.secret_key
+    }
+
+    fn public_key(&self) -> &Self::PublicPemKey {
+        &self.verification_key
+    }
+
+    fn from_keys(secret_key: Self::PrivatePemKey, verification_key: Self::PublicPemKey) -> Self {
+        Self::from_keys(secret_key, verification_key)
+    }
+}
+
+impl KeyPair {
+    const MARKER_BYTES: &'static [u8] = b"coconutkeypair";
+
+    pub fn from_keys(secret_key: SecretKey, verification_key: VerificationKey) -> Self {
+        Self {
+            secret_key,
+            verification_key,
+            index: None,
+        }
+    }
+
+    pub fn secret_key(&self) -> &SecretKey {
+        &self.secret_key
+    }
+
+    pub fn verification_key(&self) -> &VerificationKey {
+        &self.verification_key
+    }
+
+    pub fn to_verification_key_share(&self) -> Option<VerificationKeyShare> {
+        self.index.map(|index| VerificationKeyShare {
+            key: self.verification_key.clone(),
+            index,
+        })
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        // Schema is coconutkeypair[14]|secret_key_len[8]|secret_key[secret_key_len]|verification_key_len[8]|verification_key[verification_key_len]|signer_index[8] - optional
+        self.to_byte_vec()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self> {
+        KeyPair::try_from_byte_slice(bytes)
+    }
+}
+
+impl Bytable for KeyPair {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        // Schema is coconutkeypair[14]|secret_key_len[8]|secret_key[secret_key_len]|verification_key_len[8]|verification_key[verification_key_len]|signer_index[8] - optional
+        let mut byts = vec![];
+        let secret_key_bytes = self.secret_key.to_bytes();
+        let secret_key_len = (secret_key_bytes.len() as u64).to_le_bytes();
+        let verification_key_bytes = self.verification_key.to_bytes();
+        let verification_key_len = (verification_key_bytes.len() as u64).to_le_bytes();
+        byts.extend_from_slice(Self::MARKER_BYTES);
+        byts.extend_from_slice(&secret_key_len);
+        byts.extend_from_slice(&secret_key_bytes);
+        byts.extend_from_slice(&verification_key_len);
+        byts.extend_from_slice(&verification_key_bytes);
+        if let Some(index) = self.index {
+            byts.extend_from_slice(&index.to_le_bytes())
+        }
+        byts
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        KeyPair::try_from(slice)
+    }
+}
+
+impl Base58 for KeyPair {}
+
+impl TryFrom<&[u8]> for KeyPair {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<KeyPair> {
+        let header_len = Self::MARKER_BYTES.len();
+
+        // we must be able to at the very least read the length of secret key which is past the header
+        // and is 8 bytes long
+        if bytes.len() < header_len + 8 {
+            return Err(CoconutError::DeserializationMinLength {
+                min: header_len + 8,
+                actual: bytes.len(),
+            });
+        }
+
+        // safety: we made bound check and we're using constant offest
+        #[allow(clippy::unwrap_used)]
+        let secret_key_len =
+            u64::from_le_bytes(bytes[header_len..header_len + 8].try_into().unwrap()) as usize;
+        let secret_key_start = header_len + 8;
+
+        let secret_key =
+            SecretKey::try_from(&bytes[secret_key_start..secret_key_start + secret_key_len])?;
+
+        // we must be able to read the length of verification key
+        if bytes.len() < secret_key_start + secret_key_len + 8 {
+            return Err(CoconutError::DeserializationMinLength {
+                min: secret_key_start + secret_key_len + 8,
+                actual: bytes.len(),
+            });
+        }
+
+        // safety: we made bound check
+        #[allow(clippy::unwrap_used)]
+        let verification_key_len = u64::from_le_bytes(
+            bytes[secret_key_start + secret_key_len..secret_key_start + secret_key_len + 8]
+                .try_into()
+                .unwrap(),
+        ) as usize;
+        let verification_key_start = secret_key_start + secret_key_len + 8;
+
+        let verification_key = VerificationKey::try_from(
+            &bytes[verification_key_start..verification_key_start + verification_key_len],
+        )?;
+        let consumed_bytes = verification_key_start + verification_key_len;
+        let index = if consumed_bytes < bytes.len() && [consumed_bytes..].len() == 8 {
+            #[allow(clippy::unwrap_used)]
+            Some(u64::from_le_bytes(
+                bytes[consumed_bytes..consumed_bytes + 8]
+                    .try_into()
+                    .unwrap(),
+            ))
+        } else {
+            None
+        };
+        Ok(KeyPair {
+            secret_key,
+            verification_key,
+            index,
+        })
+    }
+}
+
+/// Generate a single Coconut keypair ((x, y0, y1...), (g2^x, g2^y0, ...)).
+///
+/// It is not suitable for threshold credentials as all subsequent calls to `keygen` generate keys
+/// that are independent of each other.
+pub fn keygen(params: &Parameters) -> KeyPair {
+    let attributes = params.gen_hs().len();
+
+    let x = params.random_scalar();
+    let ys = params.n_random_scalars(attributes);
+
+    let secret_key = SecretKey { x, ys };
+    let verification_key = secret_key.verification_key(params);
+
+    KeyPair {
+        secret_key,
+        verification_key,
+        index: None,
+    }
+}
+
+/// Generate Coconut keypairs.
+///
+/// Generate a set of n Coconut keypairs [((x, y0, y1...), (g2^x, g2^y0, ...)), ...],
+/// such that they support threshold aggregation by `threshold` number of parties.
+/// It is expected that this procedure is executed by a Trusted Third Party.
+pub fn ttp_keygen(
+    params: &Parameters,
+    threshold: u64,
+    num_authorities: u64,
+) -> Result<Vec<KeyPair>> {
+    if threshold == 0 {
+        return Err(CoconutError::Setup(
+            "Tried to generate threshold keys with a 0 threshold value".to_string(),
+        ));
+    }
+
+    if threshold > num_authorities {
+        return Err(
+            CoconutError::Setup(
+                "Tried to generate threshold keys for threshold value being higher than number of the signing authorities".to_string(),
+            ));
+    }
+
+    let attributes = params.gen_hs().len();
+
+    // generate polynomials
+    let v = Polynomial::new_random(params, threshold - 1);
+    let ws = (0..attributes)
+        .map(|_| Polynomial::new_random(params, threshold - 1))
+        .collect::<Vec<_>>();
+
+    // TODO: potentially if we had some known authority identifier we could use that instead
+    // of the increasing (1,2,3,...) sequence
+    let polynomial_indices = (1..=num_authorities).collect::<Vec<_>>();
+
+    // generate polynomial shares
+    let x = polynomial_indices
+        .iter()
+        .map(|&id| v.evaluate(&Scalar::from(id)));
+    let ys = polynomial_indices.iter().map(|&id| {
+        ws.iter()
+            .map(|w| w.evaluate(&Scalar::from(id)))
+            .collect::<Vec<_>>()
+    });
+
+    // finally set the keys
+    let secret_keys = x.zip(ys).map(|(x, ys)| SecretKey { x, ys });
+
+    let keypairs = secret_keys
+        .zip(polynomial_indices.iter())
+        .map(|(secret_key, index)| {
+            let verification_key = secret_key.verification_key(params);
+            KeyPair {
+                secret_key,
+                verification_key,
+                index: Some(*index),
+            }
+        })
+        .collect();
+
+    Ok(keypairs)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::scheme::setup::setup;
+
+    use super::*;
+
+    #[test]
+    fn keypair_bytes_roundtrip() {
+        let params1 = setup(1).unwrap();
+        let params5 = setup(5).unwrap();
+
+        let keypair1 = keygen(&params1);
+        let keypair5 = keygen(&params5);
+
+        let bytes1 = keypair1.to_bytes();
+        let bytes5 = keypair5.to_bytes();
+
+        assert_eq!(KeyPair::from_bytes(&bytes1).unwrap(), keypair1);
+        assert_eq!(KeyPair::from_bytes(&bytes5).unwrap(), keypair5);
+    }
+
+    #[test]
+    fn secret_key_bytes_roundtrip() {
+        let params1 = setup(1).unwrap();
+        let params5 = setup(5).unwrap();
+
+        let keypair1 = keygen(&params1);
+        let keypair5 = keygen(&params5);
+
+        let bytes1 = keypair1.secret_key.to_bytes();
+        let bytes5 = keypair5.secret_key.to_bytes();
+
+        assert_eq!(SecretKey::from_bytes(&bytes1).unwrap(), keypair1.secret_key);
+        assert_eq!(SecretKey::from_bytes(&bytes5).unwrap(), keypair5.secret_key);
+    }
+
+    #[test]
+    fn verification_key_bytes_roundtrip() {
+        let params1 = setup(1).unwrap();
+        let params5 = setup(5).unwrap();
+
+        let keypair1 = &keygen(&params1);
+        let keypair5 = &keygen(&params5);
+
+        let bytes1: Vec<u8> = keypair1.verification_key.to_bytes();
+        let bytes5: Vec<u8> = keypair5.verification_key.to_bytes();
+
+        assert_eq!(
+            VerificationKey::try_from(bytes1.as_slice()).unwrap(),
+            keypair1.verification_key
+        );
+        assert_eq!(
+            VerificationKey::try_from(bytes5.as_slice()).unwrap(),
+            keypair5.verification_key
+        );
+    }
+}

common/nymcoconut/src/scheme/mod.rs

@@ -0,0 +1,672 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// TODO: implement https://crates.io/crates/signature traits?
+
+use bls12_381::{G1Projective, G2Prepared, G2Projective, Scalar};
+use group::Curve;
+
+pub use keygen::{SecretKey, VerificationKey};
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::setup::Parameters;
+use crate::scheme::verification::check_bilinear_pairing;
+use crate::traits::{Base58, Bytable};
+use crate::utils::try_deserialize_g1_projective;
+use crate::Attribute;
+
+pub mod aggregation;
+pub mod double_use;
+pub mod issuance;
+pub mod keygen;
+pub mod setup;
+pub mod verification;
+
+pub type SignerIndex = u64;
+
+// (h, s)
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Signature(pub(crate) G1Projective, pub(crate) G1Projective);
+
+pub type PartialSignature = Signature;
+
+impl TryFrom<&[u8]> for Signature {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<Signature> {
+        if bytes.len() != 96 {
+            return Err(CoconutError::Deserialization(format!(
+                "Signature must be exactly 96 bytes, got {}",
+                bytes.len()
+            )));
+        }
+
+        // safety: we just checked for the length so the unwraps are fine
+        #[allow(clippy::expect_used)]
+        let sig1_bytes: &[u8; 48] = &bytes[..48].try_into().expect("Slice size != 48");
+        #[allow(clippy::expect_used)]
+        let sig2_bytes: &[u8; 48] = &bytes[48..].try_into().expect("Slice size != 48");
+
+        let sig1 = try_deserialize_g1_projective(
+            sig1_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed sig1".to_string()),
+        )?;
+
+        let sig2 = try_deserialize_g1_projective(
+            sig2_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed sig2".to_string()),
+        )?;
+
+        Ok(Signature(sig1, sig2))
+    }
+}
+
+impl Signature {
+    pub(crate) fn sig1(&self) -> &G1Projective {
+        &self.0
+    }
+
+    pub(crate) fn sig2(&self) -> &G1Projective {
+        &self.1
+    }
+
+    pub fn randomise_simple(&self, params: &Parameters) -> Signature {
+        let r = params.random_scalar();
+        Signature(self.0 * r, self.1 * r)
+    }
+
+    pub fn randomise(&self, params: &Parameters) -> (Signature, Scalar) {
+        let r = params.random_scalar();
+        let r_prime = params.random_scalar();
+        let h_prime = self.0 * r_prime;
+        let s_prime = (self.1 * r_prime) + (h_prime * r);
+        (Signature(h_prime, s_prime), r)
+    }
+
+    pub fn to_bytes(self) -> [u8; 96] {
+        let mut bytes = [0u8; 96];
+        bytes[..48].copy_from_slice(&self.0.to_affine().to_compressed());
+        bytes[48..].copy_from_slice(&self.1.to_affine().to_compressed());
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Signature> {
+        Signature::try_from(bytes)
+    }
+
+    pub fn verify(
+        &self,
+        params: &Parameters,
+        partial_verification_key: &VerificationKey,
+        private_attributes: &[&Attribute],
+        public_attributes: &[&Attribute],
+        commitment_hash: &G1Projective,
+    ) -> Result<()> {
+        // Verify the commitment hash
+        if bool::from(self.0.is_identity()) {
+            return Err(CoconutError::Verification(
+                "Commitment hash should not be an identity point".to_string(),
+            ));
+        }
+        if !(commitment_hash == &self.0) {
+            return Err(CoconutError::Verification(
+                "Verification of commitment hash from signature failed".to_string(),
+            ));
+        }
+
+        let alpha = partial_verification_key.alpha;
+
+        let signed_attributes = private_attributes
+            .iter()
+            .chain(public_attributes.iter())
+            .zip(partial_verification_key.beta_g2.iter())
+            .map(|(&attr, beta_i)| beta_i * attr)
+            .sum::<G2Projective>();
+
+        // Verify the signature share
+        if !check_bilinear_pairing(
+            &self.0.to_affine(),
+            &G2Prepared::from((alpha + signed_attributes).to_affine()),
+            &self.1.to_affine(),
+            params.prepared_miller_g2(),
+        ) {
+            return Err(CoconutError::Unblind(
+                "Verification of signature share failed".to_string(),
+            ));
+        }
+
+        Ok(())
+    }
+}
+
+impl Bytable for Signature {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        Signature::from_bytes(slice)
+    }
+}
+
+impl Base58 for Signature {}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct BlindedSignature(G1Projective, G1Projective);
+
+impl Bytable for BlindedSignature {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        Self::from_bytes(slice)
+    }
+}
+
+impl Base58 for BlindedSignature {}
+
+impl TryFrom<&[u8]> for BlindedSignature {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<BlindedSignature> {
+        if bytes.len() != 96 {
+            return Err(CoconutError::Deserialization(format!(
+                "BlindedSignature must be exactly 96 bytes, got {}",
+                bytes.len()
+            )));
+        }
+
+        // safety: we just checked for the length so the unwraps are fine
+        #[allow(clippy::expect_used)]
+        let h_bytes: &[u8; 48] = &bytes[..48].try_into().expect("Slice size != 48");
+        #[allow(clippy::expect_used)]
+        let sig_bytes: &[u8; 48] = &bytes[48..].try_into().expect("Slice size != 48");
+
+        let h = try_deserialize_g1_projective(
+            h_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed h".to_string()),
+        )?;
+        let sig = try_deserialize_g1_projective(
+            sig_bytes,
+            CoconutError::Deserialization("Failed to deserialize compressed sig".to_string()),
+        )?;
+
+        Ok(BlindedSignature(h, sig))
+    }
+}
+
+impl BlindedSignature {
+    pub fn unblind(
+        &self,
+        partial_verification_key: &VerificationKey,
+        pedersen_commitments_openings: &[Scalar],
+    ) -> Signature {
+        // parse the signature
+        let h = &self.0;
+        let c = &self.1;
+        let blinding_removers = partial_verification_key
+            .beta_g1
+            .iter()
+            .zip(pedersen_commitments_openings.iter())
+            .map(|(beta, opening)| beta * opening)
+            .sum::<G1Projective>();
+
+        let unblinded_c = c - blinding_removers;
+
+        Signature(*h, unblinded_c)
+    }
+
+    pub fn unblind_and_verify(
+        &self,
+        params: &Parameters,
+        partial_verification_key: &VerificationKey,
+        private_attributes: &[&Attribute],
+        public_attributes: &[&Attribute],
+        commitment_hash: &G1Projective,
+        pedersen_commitments_openings: &[Scalar],
+    ) -> Result<Signature> {
+        let unblinded = self.unblind(partial_verification_key, pedersen_commitments_openings);
+        unblinded.verify(
+            params,
+            partial_verification_key,
+            private_attributes,
+            public_attributes,
+            commitment_hash,
+        )?;
+        Ok(unblinded)
+    }
+
+    pub fn to_bytes(&self) -> [u8; 96] {
+        let mut bytes = [0u8; 96];
+        bytes[..48].copy_from_slice(&self.0.to_affine().to_compressed());
+        bytes[48..].copy_from_slice(&self.1.to_affine().to_compressed());
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<BlindedSignature> {
+        BlindedSignature::try_from(bytes)
+    }
+}
+
+// perhaps this should take signature by reference? we'll see how it goes
+#[derive(Clone, Copy)]
+pub struct SignatureShare {
+    signature: Signature,
+    index: SignerIndex,
+}
+
+impl From<(Signature, SignerIndex)> for SignatureShare {
+    fn from(value: (Signature, SignerIndex)) -> Self {
+        SignatureShare {
+            signature: value.0,
+            index: value.1,
+        }
+    }
+}
+
+impl SignatureShare {
+    pub fn new(signature: Signature, index: SignerIndex) -> Self {
+        SignatureShare { signature, index }
+    }
+
+    pub fn signature(&self) -> &Signature {
+        &self.signature
+    }
+
+    pub fn index(&self) -> SignerIndex {
+        self.index
+    }
+
+    // pub fn aggregate(shares: &[Self]) -> Result<Signature> {
+    //     aggregate_signature_shares(shares)
+    // }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::hash_to_scalar;
+    use crate::scheme::aggregation::{
+        aggregate_signatures_and_verify, aggregate_verification_keys,
+    };
+    use crate::scheme::issuance::{blind_sign, compute_hash, prepare_blind_sign, sign};
+    use crate::scheme::keygen::{keygen, ttp_keygen};
+    use crate::scheme::verification::{prove_bandwidth_credential, verify, verify_credential};
+    use crate::tests::helpers::random_scalars_refs;
+
+    #[test]
+    fn unblind_returns_error_if_integrity_check_on_commitment_hash_fails() {
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(private_attributes, params, 2);
+
+        let (_commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let keypair1 = keygen(&params);
+
+        let sig1 = blind_sign(&params, keypair1.secret_key(), &lambda, &[]).unwrap();
+
+        let wrong_commitment_opening = params.random_scalar();
+        let wrong_commitment = params.gen1() * wrong_commitment_opening;
+        let fake_commitment_hash = compute_hash(wrong_commitment, &[]);
+        let wrong_commitments_openings = params.n_random_scalars(private_attributes.len());
+
+        assert!(sig1
+            .unblind_and_verify(
+                &params,
+                keypair1.verification_key(),
+                &private_attributes,
+                &[],
+                &fake_commitment_hash,
+                &wrong_commitments_openings,
+            )
+            .is_err());
+    }
+
+    #[test]
+    fn unblind_returns_error_if_signature_verification_fails() {
+        let params = Parameters::new(2).unwrap();
+        let p = [hash_to_scalar("Attribute1"), hash_to_scalar("Attribute2")];
+        let private_attributes = vec![&p[0], &p[1]];
+
+        let p2 = [hash_to_scalar("Attribute3"), hash_to_scalar("Attribute4")];
+        let private_attributes2 = vec![&p2[0], &p2[1]];
+
+        let (commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let keypair1 = keygen(&params);
+
+        let sig1 = blind_sign(&params, keypair1.secret_key(), &lambda, &[]).unwrap();
+
+        assert!(sig1
+            .unblind_and_verify(
+                &params,
+                keypair1.verification_key(),
+                &private_attributes2,
+                &[],
+                &lambda.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .is_err());
+    }
+
+    #[test]
+    fn verification_on_two_private_attributes() {
+        let params = Parameters::new(2).unwrap();
+        let serial_number = params.random_scalar();
+        let binding_number = params.random_scalar();
+        let private_attributes = vec![&serial_number, &binding_number];
+
+        let keypair1 = keygen(&params);
+        let keypair2 = keygen(&params);
+
+        let (commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let sig1 = blind_sign(&params, keypair1.secret_key(), &lambda, &[])
+            .unwrap()
+            .unblind_and_verify(
+                &params,
+                keypair1.verification_key(),
+                &private_attributes,
+                &[],
+                &lambda.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .unwrap();
+
+        let sig2 = blind_sign(&params, keypair2.secret_key(), &lambda, &[])
+            .unwrap()
+            .unblind_and_verify(
+                &params,
+                keypair2.verification_key(),
+                &private_attributes,
+                &[],
+                &lambda.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .unwrap();
+
+        let theta1 = prove_bandwidth_credential(
+            &params,
+            keypair1.verification_key(),
+            &sig1,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        let theta2 = prove_bandwidth_credential(
+            &params,
+            keypair2.verification_key(),
+            &sig2,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        assert!(verify_credential(
+            &params,
+            keypair1.verification_key(),
+            &theta1,
+            &[],
+        ));
+
+        assert!(verify_credential(
+            &params,
+            keypair2.verification_key(),
+            &theta2,
+            &[],
+        ));
+
+        assert!(!verify_credential(
+            &params,
+            keypair1.verification_key(),
+            &theta2,
+            &[],
+        ));
+    }
+
+    #[test]
+    fn verification_on_two_public_attributes() {
+        let params = Parameters::new(2).unwrap();
+        random_scalars_refs!(attributes, params, 2);
+
+        let keypair1 = keygen(&params);
+        let keypair2 = keygen(&params);
+        let sig1 = sign(keypair1.secret_key(), &attributes).unwrap();
+        let sig2 = sign(keypair2.secret_key(), &attributes).unwrap();
+
+        assert!(verify(
+            &params,
+            keypair1.verification_key(),
+            &attributes,
+            &sig1,
+        ));
+
+        assert!(!verify(
+            &params,
+            keypair2.verification_key(),
+            &attributes,
+            &sig1,
+        ));
+
+        assert!(!verify(
+            &params,
+            keypair1.verification_key(),
+            &attributes,
+            &sig2,
+        ));
+    }
+
+    #[test]
+    fn verification_on_two_public_and_two_private_attributes() {
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(public_attributes, params, 2);
+
+        let serial_number = params.random_scalar();
+        let binding_number = params.random_scalar();
+        let private_attributes = vec![&serial_number, &binding_number];
+
+        let keypair1 = keygen(&params);
+        let keypair2 = keygen(&params);
+
+        let (commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let sig1 = blind_sign(&params, keypair1.secret_key(), &lambda, &public_attributes)
+            .unwrap()
+            .unblind_and_verify(
+                &params,
+                keypair1.verification_key(),
+                &private_attributes,
+                &public_attributes,
+                &lambda.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .unwrap();
+
+        let sig2 = blind_sign(&params, keypair2.secret_key(), &lambda, &public_attributes)
+            .unwrap()
+            .unblind_and_verify(
+                &params,
+                keypair2.verification_key(),
+                &private_attributes,
+                &public_attributes,
+                &lambda.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .unwrap();
+
+        let theta1 = prove_bandwidth_credential(
+            &params,
+            keypair1.verification_key(),
+            &sig1,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        let theta2 = prove_bandwidth_credential(
+            &params,
+            keypair2.verification_key(),
+            &sig2,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        assert!(verify_credential(
+            &params,
+            keypair1.verification_key(),
+            &theta1,
+            &public_attributes,
+        ));
+
+        assert!(verify_credential(
+            &params,
+            keypair2.verification_key(),
+            &theta2,
+            &public_attributes,
+        ));
+
+        assert!(!verify_credential(
+            &params,
+            keypair1.verification_key(),
+            &theta2,
+            &public_attributes,
+        ));
+    }
+
+    #[test]
+    fn verification_on_two_public_and_two_private_attributes_from_two_signers() {
+        let params = Parameters::new(4).unwrap();
+        random_scalars_refs!(public_attributes, params, 2);
+
+        let serial_number = params.random_scalar();
+        let binding_number = params.random_scalar();
+        let private_attributes = vec![&serial_number, &binding_number];
+
+        let keypairs = ttp_keygen(&params, 2, 3).unwrap();
+
+        let (commitments_openings, lambda) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let sigs = keypairs
+            .iter()
+            .map(|keypair| {
+                blind_sign(&params, keypair.secret_key(), &lambda, &public_attributes)
+                    .unwrap()
+                    .unblind_and_verify(
+                        &params,
+                        keypair.verification_key(),
+                        &private_attributes,
+                        &public_attributes,
+                        &lambda.get_commitment_hash(),
+                        &commitments_openings,
+                    )
+                    .unwrap()
+            })
+            .collect::<Vec<_>>();
+
+        let vks = keypairs
+            .into_iter()
+            .map(|keypair| keypair.verification_key().clone())
+            .collect::<Vec<_>>();
+
+        let mut attributes = Vec::with_capacity(private_attributes.len() + public_attributes.len());
+        attributes.extend_from_slice(&private_attributes);
+        attributes.extend_from_slice(&public_attributes);
+
+        let aggr_vk = aggregate_verification_keys(&vks[..2], Some(&[1, 2])).unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[..2],
+            Some(&[1, 2]),
+        )
+        .unwrap();
+
+        let theta = prove_bandwidth_credential(
+            &params,
+            &aggr_vk,
+            &aggr_sig,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        assert!(verify_credential(
+            &params,
+            &aggr_vk,
+            &theta,
+            &public_attributes,
+        ));
+
+        // taking different subset of keys and credentials
+        let aggr_vk = aggregate_verification_keys(&vks[1..], Some(&[2, 3])).unwrap();
+        let aggr_sig = aggregate_signatures_and_verify(
+            &params,
+            &aggr_vk,
+            &attributes,
+            &sigs[1..],
+            Some(&[2, 3]),
+        )
+        .unwrap();
+
+        let theta = prove_bandwidth_credential(
+            &params,
+            &aggr_vk,
+            &aggr_sig,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        assert!(verify_credential(
+            &params,
+            &aggr_vk,
+            &theta,
+            &public_attributes,
+        ));
+    }
+
+    #[test]
+    fn signature_bytes_roundtrip() {
+        let params = Parameters::default();
+        let r = params.random_scalar();
+        let s = params.random_scalar();
+        let signature = Signature(params.gen1() * r, params.gen1() * s);
+        let bytes = signature.to_bytes();
+
+        // also make sure it is equivalent to the internal g1 compressed bytes concatenated
+        let expected_bytes = [
+            signature.0.to_affine().to_compressed(),
+            signature.1.to_affine().to_compressed(),
+        ]
+        .concat();
+        assert_eq!(expected_bytes, bytes);
+        assert_eq!(signature, Signature::try_from(&bytes[..]).unwrap())
+    }
+
+    #[test]
+    fn blinded_signature_bytes_roundtrip() {
+        let params = Parameters::default();
+        let r = params.random_scalar();
+        let s = params.random_scalar();
+        let blinded_sig = BlindedSignature(params.gen1() * r, params.gen1() * s);
+        let bytes = blinded_sig.to_bytes();
+
+        // also make sure it is equivalent to the internal g1 compressed bytes concatenated
+        let expected_bytes = [
+            blinded_sig.0.to_affine().to_compressed(),
+            blinded_sig.1.to_affine().to_compressed(),
+        ]
+        .concat();
+        assert_eq!(expected_bytes, bytes);
+        assert_eq!(blinded_sig, BlindedSignature::try_from(&bytes[..]).unwrap())
+    }
+}

common/nymcoconut/src/scheme/setup.rs

@@ -0,0 +1,91 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use bls12_381::{G1Affine, G2Affine, G2Prepared, Scalar};
+use ff::Field;
+use group::Curve;
+use rand::thread_rng;
+
+use crate::error::{CoconutError, Result};
+use crate::utils::hash_g1;
+
+/// System-wide parameters used for the protocol
+#[derive(Clone)]
+pub struct Parameters {
+    /// Generator of the G1 group
+    g1: G1Affine,
+
+    /// Additional generators of the G1 group
+    hs: Vec<G1Affine>,
+
+    /// Generator of the G2 group
+    g2: G2Affine,
+
+    /// Precomputed G2 generator used for the miller loop
+    _g2_prepared_miller: G2Prepared,
+}
+
+impl Parameters {
+    pub fn new(num_attributes: u32) -> Result<Parameters> {
+        if num_attributes == 0 {
+            return Err(CoconutError::Setup(
+                "Tried to setup the scheme for 0 attributes".to_string(),
+            ));
+        }
+
+        let hs = (1..=num_attributes)
+            .map(|i| hash_g1(format!("h{i}")).to_affine())
+            .collect();
+
+        Ok(Parameters {
+            g1: G1Affine::generator(),
+            hs,
+            g2: G2Affine::generator(),
+            _g2_prepared_miller: G2Prepared::from(G2Affine::generator()),
+        })
+    }
+
+    pub fn gen1(&self) -> &G1Affine {
+        &self.g1
+    }
+
+    pub fn gen2(&self) -> &G2Affine {
+        &self.g2
+    }
+
+    pub(crate) fn prepared_miller_g2(&self) -> &G2Prepared {
+        &self._g2_prepared_miller
+    }
+
+    pub fn gen_hs(&self) -> &[G1Affine] {
+        &self.hs
+    }
+
+    pub fn random_scalar(&self) -> Scalar {
+        // lazily-initialized thread-local random number generator, seeded by the system
+        let mut rng = thread_rng();
+        Scalar::random(&mut rng)
+    }
+
+    pub fn n_random_scalars(&self, n: usize) -> Vec<Scalar> {
+        (0..n).map(|_| self.random_scalar()).collect()
+    }
+}
+
+pub fn setup(num_attributes: u32) -> Result<Parameters> {
+    Parameters::new(num_attributes)
+}
+
+// for ease of use in tests requiring params
+// TODO: not sure if this will have to go away when tests require some specific number of generators
+#[cfg(test)]
+impl Default for Parameters {
+    fn default() -> Self {
+        Parameters {
+            g1: G1Affine::generator(),
+            hs: Vec::new(),
+            g2: G2Affine::generator(),
+            _g2_prepared_miller: G2Prepared::from(G2Affine::generator()),
+        }
+    }
+}

common/nymcoconut/src/scheme/verification.rs

@@ -0,0 +1,432 @@
+// Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::{CoconutError, Result};
+use crate::proofs::ProofKappaZeta;
+use crate::scheme::setup::Parameters;
+use crate::scheme::Signature;
+use crate::scheme::VerificationKey;
+use crate::traits::{Base58, Bytable};
+use crate::utils::try_deserialize_g2_projective;
+use crate::Attribute;
+use bls12_381::{multi_miller_loop, G1Affine, G2Prepared, G2Projective, Scalar};
+use core::ops::Neg;
+use group::{Curve, Group};
+
+pub use crate::scheme::double_use::BlindedSerialNumber;
+
+// TODO NAMING: this whole thing
+// Theta
+#[derive(Debug, PartialEq, Eq)]
+pub struct VerifyCredentialRequest {
+    // blinded_message (kappa)
+    pub blinded_message: G2Projective,
+    // blinded serial number (zeta)
+    pub blinded_serial_number: BlindedSerialNumber,
+    // sigma
+    pub credential: Signature,
+    // pi_v
+    pub pi_v: ProofKappaZeta,
+}
+
+impl TryFrom<&[u8]> for VerifyCredentialRequest {
+    type Error = CoconutError;
+
+    fn try_from(bytes: &[u8]) -> Result<VerifyCredentialRequest> {
+        if bytes.len() < 288 {
+            return Err(
+                CoconutError::Deserialization(
+                    format!("Tried to deserialize theta with insufficient number of bytes, expected >= 288, got {}", bytes.len()),
+                ));
+        }
+
+        // safety: we just checked for the length so the unwraps are fine
+        #[allow(clippy::unwrap_used)]
+        let blinded_message_bytes = bytes[..96].try_into().unwrap();
+        let blinded_message = try_deserialize_g2_projective(
+            &blinded_message_bytes,
+            CoconutError::Deserialization(
+                "failed to deserialize the blinded message (kappa)".to_string(),
+            ),
+        )?;
+
+        let blinded_serial_number_bytes = &bytes[96..192];
+        let blinded_serial_number =
+            BlindedSerialNumber::try_from_byte_slice(blinded_serial_number_bytes)?;
+
+        let credential = Signature::try_from(&bytes[192..288])?;
+
+        let pi_v = ProofKappaZeta::from_bytes(&bytes[288..])?;
+
+        Ok(VerifyCredentialRequest {
+            blinded_message,
+            blinded_serial_number,
+            credential,
+            pi_v,
+        })
+    }
+}
+
+impl VerifyCredentialRequest {
+    fn verify_proof(&self, params: &Parameters, verification_key: &VerificationKey) -> bool {
+        self.pi_v.verify(
+            params,
+            verification_key,
+            &self.blinded_message,
+            &self.blinded_serial_number,
+        )
+    }
+
+    pub fn has_blinded_serial_number(&self, blinded_serial_number_bs58: &str) -> Result<bool> {
+        let blinded_serial_number = BlindedSerialNumber::try_from_bs58(blinded_serial_number_bs58)?;
+        let ret = self.blinded_serial_number.eq(&blinded_serial_number);
+        Ok(ret)
+    }
+
+    // blinded message (kappa)  || blinded serial number (zeta) || credential || pi_v
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let blinded_message_bytes = self.blinded_message.to_affine().to_compressed();
+        let blinded_serial_number_bytes = self.blinded_serial_number.to_affine().to_compressed();
+        let credential_bytes = self.credential.to_bytes();
+        let proof_bytes = self.pi_v.to_bytes();
+
+        let mut bytes = Vec::with_capacity(288 + proof_bytes.len());
+        bytes.extend_from_slice(&blinded_message_bytes);
+        bytes.extend_from_slice(&blinded_serial_number_bytes);
+        bytes.extend_from_slice(&credential_bytes);
+        bytes.extend_from_slice(&proof_bytes);
+
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<VerifyCredentialRequest> {
+        VerifyCredentialRequest::try_from(bytes)
+    }
+
+    pub fn blinded_serial_number(&self) -> BlindedSerialNumber {
+        self.blinded_serial_number
+    }
+
+    pub fn blinded_serial_number_bs58(&self) -> String {
+        self.blinded_serial_number.to_bs58()
+    }
+}
+
+impl Bytable for VerifyCredentialRequest {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self> {
+        VerifyCredentialRequest::try_from(slice)
+    }
+}
+
+impl Base58 for VerifyCredentialRequest {}
+
+pub fn compute_kappa(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    private_attributes: &[&Attribute],
+    blinding_factor: Scalar,
+) -> G2Projective {
+    params.gen2() * blinding_factor
+        + verification_key.alpha
+        + private_attributes
+            .iter()
+            .zip(verification_key.beta_g2.iter())
+            .map(|(&priv_attr, beta_i)| beta_i * priv_attr)
+            .sum::<G2Projective>()
+}
+
+pub fn compute_zeta(params: &Parameters, serial_number: &Attribute) -> G2Projective {
+    params.gen2() * serial_number
+}
+
+pub fn prove_bandwidth_credential(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    signature: &Signature,
+    serial_number: &Attribute,
+    binding_number: &Attribute,
+) -> Result<VerifyCredentialRequest> {
+    if verification_key.beta_g2.len() < 2 {
+        return Err(
+            CoconutError::Verification(
+                format!("Tried to prove a credential for higher than supported by the provided verification key number of attributes (max: {}, requested: 2)",
+                        verification_key.beta_g2.len()
+                )));
+    }
+
+    // Randomize the signature
+    let (signature_prime, sign_blinding_factor) = signature.randomise(params);
+
+    // blinded_message : kappa in the paper.
+    // Value kappa is needed since we want to show a signature sigma'.
+    // In order to verify sigma' we need both the verification key vk and the message m.
+    // However, we do not want to reveal m to whomever we are showing the signature.
+    // Thus, we need kappa which allows us to verify sigma'. In particular,
+    // kappa is computed on m as input, but thanks to the use or random value r,
+    // it does not reveal any information about m.
+    let private_attributes = [serial_number, binding_number];
+    let blinded_message = compute_kappa(
+        params,
+        verification_key,
+        &private_attributes,
+        sign_blinding_factor,
+    );
+
+    // zeta is a commitment to the serial number (i.e., a public value associated with the serial number)
+    let blinded_serial_number = compute_zeta(params, serial_number);
+
+    let pi_v = ProofKappaZeta::construct(
+        params,
+        verification_key,
+        serial_number,
+        binding_number,
+        &sign_blinding_factor,
+        &blinded_message,
+        &blinded_serial_number,
+    );
+
+    Ok(VerifyCredentialRequest {
+        blinded_message,
+        blinded_serial_number: blinded_serial_number.into(),
+        credential: signature_prime,
+        pi_v,
+    })
+}
+
+/// Checks whether e(P, Q) * e(-R, S) == id
+pub fn check_bilinear_pairing(p: &G1Affine, q: &G2Prepared, r: &G1Affine, s: &G2Prepared) -> bool {
+    // checking e(P, Q) * e(-R, S) == id
+    // is equivalent to checking e(P, Q) == e(R, S)
+    // but requires only a single final exponentiation rather than two of them
+    // and therefore, as seen via benchmarks.rs, is almost 50% faster
+    // (1.47ms vs 2.45ms, tested on R9 5900X)
+
+    let multi_miller = multi_miller_loop(&[(p, q), (&r.neg(), s)]);
+    multi_miller.final_exponentiation().is_identity().into()
+}
+
+pub fn check_vk_pairing(
+    params: &Parameters,
+    dkg_values: &[G2Projective],
+    vk: &VerificationKey,
+) -> bool {
+    let values_len = dkg_values.len();
+    if values_len == 0 || values_len - 1 != vk.beta_g1.len() || values_len - 1 != vk.beta_g2.len() {
+        return false;
+    }
+
+    // safety: we made an explicit check for if the length of the slice is 0, thus unwrap here is fine
+    #[allow(clippy::unwrap_used)]
+    if &vk.alpha != *dkg_values.first().as_ref().unwrap() {
+        return false;
+    }
+    let dkg_betas = &dkg_values[1..];
+    if dkg_betas
+        .iter()
+        .zip(vk.beta_g2.iter())
+        .any(|(dkg_beta, vk_beta)| dkg_beta != vk_beta)
+    {
+        return false;
+    }
+    if vk.beta_g1.iter().zip(vk.beta_g2.iter()).any(|(g1, g2)| {
+        !check_bilinear_pairing(
+            params.gen1(),
+            &G2Prepared::from(g2.to_affine()),
+            &g1.to_affine(),
+            params.prepared_miller_g2(),
+        )
+    }) {
+        return false;
+    }
+
+    true
+}
+
+pub fn verify_credential(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    theta: &VerifyCredentialRequest,
+    public_attributes: &[&Attribute],
+) -> bool {
+    if public_attributes.len() + theta.pi_v.private_attributes_len()
+        > verification_key.beta_g2.len()
+    {
+        return false;
+    }
+
+    if !theta.verify_proof(params, verification_key) {
+        return false;
+    }
+
+    let kappa = if public_attributes.is_empty() {
+        theta.blinded_message
+    } else {
+        let signed_public_attributes = public_attributes
+            .iter()
+            .zip(
+                verification_key
+                    .beta_g2
+                    .iter()
+                    .skip(theta.pi_v.private_attributes_len()),
+            )
+            .map(|(&pub_attr, beta_i)| beta_i * pub_attr)
+            .sum::<G2Projective>();
+
+        theta.blinded_message + signed_public_attributes
+    };
+
+    check_bilinear_pairing(
+        &theta.credential.0.to_affine(),
+        &G2Prepared::from(kappa.to_affine()),
+        &(theta.credential.1).to_affine(),
+        params.prepared_miller_g2(),
+    ) && !bool::from(theta.credential.0.is_identity())
+}
+
+// Used in tests only
+pub fn verify(
+    params: &Parameters,
+    verification_key: &VerificationKey,
+    public_attributes: &[&Attribute],
+    sig: &Signature,
+) -> bool {
+    let kappa = (verification_key.alpha
+        + public_attributes
+            .iter()
+            .zip(verification_key.beta_g2.iter())
+            .map(|(&m_i, b_i)| b_i * m_i)
+            .sum::<G2Projective>())
+    .to_affine();
+
+    check_bilinear_pairing(
+        &sig.0.to_affine(),
+        &G2Prepared::from(kappa),
+        &sig.1.to_affine(),
+        params.prepared_miller_g2(),
+    ) && !bool::from(sig.0.is_identity())
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::scheme::issuance::sign;
+    use crate::scheme::keygen::keygen;
+    use crate::scheme::setup::setup;
+
+    use super::*;
+
+    #[test]
+    fn vk_pairing() {
+        let params = setup(2).unwrap();
+        let keypair = keygen(&params);
+        let vk = keypair.verification_key();
+
+        let mut dkg_values = vec![vk.alpha];
+        dkg_values.append(&mut vk.beta_g2.clone());
+        assert!(check_vk_pairing(&params, &dkg_values, vk));
+    }
+
+    #[test]
+    fn theta_bytes_roundtrip() {
+        let params = setup(2).unwrap();
+
+        let keypair = keygen(&params);
+        let r = params.random_scalar();
+        let s = params.random_scalar();
+
+        let signature = Signature(params.gen1() * r, params.gen1() * s);
+        let serial_number = params.random_scalar();
+        let binding_number = params.random_scalar();
+
+        let theta = prove_bandwidth_credential(
+            &params,
+            keypair.verification_key(),
+            &signature,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+
+        let bytes = theta.to_bytes();
+        assert_eq!(
+            VerifyCredentialRequest::try_from(bytes.as_slice()).unwrap(),
+            theta
+        );
+    }
+
+    #[test]
+    fn reject_forged_signature_via_linear_combination() {
+        // This test checks if the protocol correctly rejects forged signatures created
+        // by linear combinations of valid signatures. The verification for forged
+        // signatures should fail.
+        let params = Parameters::new(4).unwrap();
+
+        let scalar_2 = Scalar::one() + Scalar::one();
+        let scalar_2_inv = Scalar::invert(&scalar_2).unwrap();
+
+        //#1
+        let a = params.random_scalar();
+        let zero = Scalar::zero();
+        let a_zero = vec![&a, &zero];
+        let zero_a = vec![&zero, &a];
+
+        let validator_keypair = keygen(&params);
+
+        //#2
+        let sig_a_zero = sign(validator_keypair.secret_key(), &a_zero).unwrap();
+        let sig_zero_a = sign(validator_keypair.secret_key(), &zero_a).unwrap();
+
+        assert!(verify(
+            &params,
+            validator_keypair.verification_key(),
+            &a_zero,
+            &sig_a_zero
+        ));
+        assert!(verify(
+            &params,
+            validator_keypair.verification_key(),
+            &zero_a,
+            &sig_zero_a
+        ));
+
+        //#3
+        let h0 = sig_a_zero.0;
+        // Removed unnecessary references
+        let h1 = scalar_2_inv * sig_a_zero.1 + scalar_2_inv * sig_zero_a.1;
+        let forged_signature = Signature(h0, h1);
+        let a_half = a * scalar_2_inv;
+        let new_plaintext = vec![&a_half, &a_half];
+
+        // The forged signature should not pass verification
+        assert!(!verify(
+            &params,
+            validator_keypair.verification_key(),
+            &new_plaintext,
+            &forged_signature
+        ));
+
+        //#4
+        let scalar_3 = Scalar::one() + Scalar::one() + Scalar::one();
+        let scalar_4 = Scalar::one() + Scalar::one() + Scalar::one() + Scalar::one();
+        let scalar_4_inv = Scalar::invert(&scalar_4).unwrap();
+        let scalar_3_over_4 = scalar_3 * scalar_4_inv;
+
+        // Removed unnecessary references
+        let h1_2 = scalar_4_inv * sig_a_zero.1 + scalar_3_over_4 * sig_zero_a.1;
+        let forged_signature_2 = Signature(h0, h1_2);
+        let a_quarter = a * scalar_4_inv;
+        let a_3_over_4 = a * scalar_3_over_4;
+        let new_plaintext_2 = vec![&a_quarter, &a_3_over_4];
+
+        // The second forged signature should also not pass verification
+        assert!(!verify(
+            &params,
+            validator_keypair.verification_key(),
+            &new_plaintext_2,
+            &forged_signature_2
+        ));
+    }
+}

common/nymcoconut/src/tests/e2e.rs

@@ -0,0 +1,84 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::random_scalars_refs;
+use crate::tests::helpers::tests::generate_dkg_keys;
+use crate::{
+    aggregate_verification_keys, setup, tests::helpers::*, ttp_keygen, verify_credential,
+    CoconutError, VerificationKey,
+};
+
+#[test]
+fn keygen() -> Result<(), CoconutError> {
+    let params = setup(5)?;
+    let node_indices = vec![15u64, 248, 33521];
+
+    random_scalars_refs!(public_attributes, params, 2);
+
+    // generate_keys
+    let coconut_keypairs = ttp_keygen(&params, 2, 3)?;
+
+    let verification_keys: Vec<VerificationKey> = coconut_keypairs
+        .iter()
+        .map(|keypair| keypair.verification_key().clone())
+        .collect();
+
+    // aggregate verification keys
+    let verification_key = aggregate_verification_keys(&verification_keys, Some(&node_indices))?;
+
+    // Generate cryptographic material to verify them
+    let theta = theta_from_keys_and_attributes(
+        &params,
+        &coconut_keypairs,
+        &node_indices,
+        &public_attributes,
+    )?;
+
+    // Verify credentials
+    assert!(verify_credential(
+        &params,
+        &verification_key,
+        &theta,
+        &public_attributes,
+    ));
+
+    Ok(())
+}
+
+#[test]
+#[ignore] // expensive test
+fn dkg() -> Result<(), CoconutError> {
+    let params = setup(5)?;
+    let node_indices = vec![15u64, 248, 33521];
+
+    random_scalars_refs!(public_attributes, params, 2);
+
+    // generate_keys
+    let coconut_keypairs = generate_dkg_keys(5, &node_indices);
+
+    let verification_keys: Vec<VerificationKey> = coconut_keypairs
+        .iter()
+        .map(|keypair| keypair.verification_key().clone())
+        .collect();
+
+    // aggregate verification keys
+    let verification_key = aggregate_verification_keys(&verification_keys, Some(&node_indices))?;
+
+    // Generate cryptographic material to verify them
+    let theta = theta_from_keys_and_attributes(
+        &params,
+        &coconut_keypairs,
+        &node_indices,
+        &public_attributes,
+    )?;
+
+    // Verify credentials
+    assert!(verify_credential(
+        &params,
+        &verification_key,
+        &theta,
+        &public_attributes,
+    ));
+
+    Ok(())
+}

common/nymcoconut/src/tests/helpers.rs

@@ -0,0 +1,186 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::*;
+use itertools::izip;
+use std::fmt::Debug;
+
+// unwraps are fine in the test code
+#[allow(clippy::unwrap_used)]
+pub fn theta_from_keys_and_attributes(
+    params: &Parameters,
+    coconut_keypairs: &Vec<KeyPair>,
+    indices: &[scheme::SignerIndex],
+    public_attributes: &[&PublicAttribute],
+) -> Result<VerifyCredentialRequest, CoconutError> {
+    let serial_number = params.random_scalar();
+    let binding_number = params.random_scalar();
+    let private_attributes = vec![&serial_number, &binding_number];
+
+    // generate commitment
+    let (commitments_openings, blind_sign_request) =
+        prepare_blind_sign(params, &private_attributes, public_attributes)?;
+
+    let verification_keys: Vec<VerificationKey> = coconut_keypairs
+        .iter()
+        .map(|keypair| keypair.verification_key().clone())
+        .collect();
+
+    // aggregate verification keys
+    let verification_key = aggregate_verification_keys(&verification_keys, Some(indices))?;
+
+    // generate blinded signatures
+    let mut blinded_signatures = Vec::new();
+
+    for keypair in coconut_keypairs {
+        let blinded_signature = blind_sign(
+            params,
+            keypair.secret_key(),
+            &blind_sign_request,
+            public_attributes,
+        )?;
+        blinded_signatures.push(blinded_signature)
+    }
+
+    // Unblind
+    let unblinded_signatures: Vec<(scheme::SignerIndex, Signature)> = izip!(
+        indices.iter(),
+        blinded_signatures.iter(),
+        verification_keys.iter()
+    )
+    .map(|(idx, s, vk)| {
+        (
+            *idx,
+            s.unblind_and_verify(
+                params,
+                vk,
+                &private_attributes,
+                public_attributes,
+                &blind_sign_request.get_commitment_hash(),
+                &commitments_openings,
+            )
+            .unwrap(),
+        )
+    })
+    .collect();
+
+    // Aggregate signatures
+    let signature_shares: Vec<SignatureShare> = unblinded_signatures
+        .iter()
+        .map(|(idx, signature)| SignatureShare::new(*signature, *idx))
+        .collect();
+
+    let mut attributes = Vec::with_capacity(private_attributes.len() + public_attributes.len());
+    attributes.extend_from_slice(&private_attributes);
+    attributes.extend_from_slice(public_attributes);
+
+    // Randomize credentials and generate any cryptographic material to verify them
+    let signature = aggregate_signature_shares_and_verify(
+        params,
+        &verification_key,
+        &attributes,
+        &signature_shares,
+    )?;
+
+    // Generate cryptographic material to verify them
+    let theta = prove_bandwidth_credential(
+        params,
+        &verification_key,
+        &signature,
+        &serial_number,
+        &binding_number,
+    )?;
+
+    Ok(theta)
+}
+
+// unwraps are fine in the test code
+#[allow(clippy::unwrap_used)]
+pub fn transpose_matrix<T: Debug>(matrix: Vec<Vec<T>>) -> Vec<Vec<T>> {
+    if matrix.is_empty() {
+        return vec![];
+    }
+    let len = matrix[0].len();
+    let mut iters: Vec<_> = matrix.into_iter().map(|d| d.into_iter()).collect();
+    (0..len)
+        .map(|_| {
+            iters
+                .iter_mut()
+                .map(|it| it.next().unwrap())
+                .collect::<Vec<_>>()
+        })
+        .collect::<Vec<_>>()
+}
+
+#[macro_export]
+macro_rules! random_scalars_refs {
+    ( $x: ident, $params: expr, $n: expr ) => {
+        let _vec = $params.n_random_scalars($n);
+        #[allow(clippy::map_identity)]
+        let $x = _vec.iter().collect::<Vec<_>>();
+    };
+}
+
+pub use random_scalars_refs;
+
+#[cfg(test)]
+pub mod tests {
+    use super::*;
+    use bls12_381::Scalar;
+    use nym_dkg::{bte::decrypt_share, combine_shares, Dealing, NodeIndex};
+    use rand_chacha::rand_core::SeedableRng;
+
+    pub fn generate_dkg_secrets(node_indices: &[NodeIndex]) -> Vec<Scalar> {
+        let dummy_seed = [42u8; 32];
+        let mut rng = rand_chacha::ChaCha20Rng::from_seed(dummy_seed);
+        let params = nym_dkg::bte::setup();
+
+        // the simplest possible case
+        let threshold = 2;
+
+        let mut receivers = std::collections::BTreeMap::new();
+        let mut full_keys = Vec::new();
+        for index in node_indices {
+            let (dk, pk) = nym_dkg::bte::keygen(&params, &mut rng);
+            receivers.insert(*index, *pk.public_key());
+            full_keys.push((dk, pk))
+        }
+        let dealings = node_indices
+            .iter()
+            .map(|&dealer_index| {
+                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+            })
+            .collect::<Vec<_>>();
+        let mut derived_secrets = Vec::new();
+        for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+            let shares = dealings
+                .iter()
+                .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
+                .collect();
+
+            let recovered_secret =
+                combine_shares(shares, &receivers.keys().copied().collect::<Vec<_>>()).unwrap();
+
+            derived_secrets.push(recovered_secret)
+        }
+        derived_secrets
+    }
+    pub fn generate_dkg_keys(num_attributes: u32, node_indices: &[NodeIndex]) -> Vec<KeyPair> {
+        let params = Parameters::new(num_attributes).unwrap();
+        let mut all_secrets = vec![];
+        for _ in 0..num_attributes {
+            let secrets = generate_dkg_secrets(node_indices);
+            all_secrets.push(secrets);
+        }
+        let signers = transpose_matrix(all_secrets);
+        signers
+            .into_iter()
+            .map(|mut secrets| {
+                let x = secrets.pop().unwrap();
+                let sk = SecretKey::create_from_raw(x, secrets);
+                let vk = sk.verification_key(&params);
+                KeyPair::from_keys(sk, vk)
+            })
+            .collect()
+    }
+}

common/nymcoconut/src/tests/mod.rs

@@ -0,0 +1,3 @@
+#[cfg(test)]
+mod e2e;
+pub mod helpers;

common/nymcoconut/src/traits.rs

@@ -0,0 +1,88 @@
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+
+use crate::CoconutError;
+use bls12_381::{G1Affine, G1Projective, Scalar};
+use group::GroupEncoding;
+
+pub trait Bytable
+where
+    Self: Sized,
+{
+    fn to_byte_vec(&self) -> Vec<u8>;
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self, CoconutError>;
+}
+
+pub trait Base58
+where
+    Self: Bytable,
+{
+    fn try_from_bs58<S: AsRef<str>>(x: S) -> Result<Self, CoconutError> {
+        let bs58_decoded = &bs58::decode(x.as_ref()).into_vec()?;
+        Self::try_from_byte_slice(bs58_decoded)
+    }
+    fn to_bs58(&self) -> String {
+        bs58::encode(self.to_byte_vec()).into_string()
+    }
+}
+
+impl Bytable for Scalar {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self, CoconutError> {
+        let received = slice.len();
+        let Ok(arr) = slice.try_into() else {
+            return Err(CoconutError::UnexpectedArrayLength {
+                typ: "Scalar".to_string(),
+                received,
+                expected: 32,
+            });
+        };
+
+        let maybe_scalar = Scalar::from_bytes(arr);
+        if maybe_scalar.is_none().into() {
+            Err(CoconutError::ScalarDeserializationFailure)
+        } else {
+            // safety: this unwrap is fine as we've just checked the element is not none
+            #[allow(clippy::unwrap_used)]
+            Ok(maybe_scalar.unwrap())
+        }
+    }
+}
+
+impl Base58 for Scalar {}
+
+impl Bytable for G1Projective {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.to_bytes().as_ref().to_vec()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self, CoconutError> {
+        let received = slice.len();
+        let arr: Result<[u8; 48], _> = slice.try_into();
+        let Ok(bytes) = arr else {
+            return Err(CoconutError::UnexpectedArrayLength {
+                typ: "G1Projective".to_string(),
+                received,
+                expected: 48,
+            });
+        };
+
+        let maybe_g1 = G1Affine::from_compressed(&bytes);
+        if maybe_g1.is_none().into() {
+            Err(CoconutError::G1ProjectiveDeserializationFailure)
+        } else {
+            // safety: this unwrap is fine as we've just checked the element is not none
+            #[allow(clippy::unwrap_used)]
+            Ok(maybe_g1.unwrap().into())
+        }
+    }
+}
+
+impl Base58 for G1Projective {}

common/nymcoconut/src/utils.rs

@@ -0,0 +1,382 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use core::iter::Sum;
+use core::ops::Mul;
+
+use bls12_381::hash_to_curve::{ExpandMsgXmd, HashToCurve, HashToField};
+use bls12_381::{G1Affine, G1Projective, G2Affine, G2Projective, Scalar};
+use ff::Field;
+
+use crate::error::{CoconutError, Result};
+use crate::scheme::setup::Parameters;
+use crate::scheme::SignerIndex;
+
+pub struct Polynomial {
+    coefficients: Vec<Scalar>,
+}
+
+impl Polynomial {
+    // for polynomial of degree n, we generate n+1 values
+    // (for example for degree 1, like y = x + 2, we need [2,1])
+    pub fn new_random(params: &Parameters, degree: u64) -> Self {
+        Polynomial {
+            coefficients: params.n_random_scalars((degree + 1) as usize),
+        }
+    }
+
+    /// Evaluates the polynomial at point x.
+    pub fn evaluate(&self, x: &Scalar) -> Scalar {
+        if self.coefficients.is_empty() {
+            Scalar::zero()
+            // if x is zero then we can ignore most of the expensive computation and
+            // just return the last term of the polynomial
+        } else if x.is_zero().into() {
+            // we checked that coefficients are not empty so unwrap here is fine
+            #[allow(clippy::unwrap_used)]
+            *self.coefficients.first().unwrap()
+        } else {
+            self.coefficients
+                .iter()
+                .enumerate()
+                // coefficient[n] * x ^ n
+                .map(|(i, coefficient)| coefficient * x.pow(&[i as u64, 0, 0, 0]))
+                .sum()
+        }
+    }
+}
+
+#[inline]
+fn generate_lagrangian_coefficients_at_origin(points: &[u64]) -> Vec<Scalar> {
+    let x = Scalar::zero();
+
+    points
+        .iter()
+        .enumerate()
+        .map(|(i, point_i)| {
+            let mut numerator = Scalar::one();
+            let mut denominator = Scalar::one();
+            let xi = Scalar::from(*point_i);
+
+            for (j, point_j) in points.iter().enumerate() {
+                if j != i {
+                    let xj = Scalar::from(*point_j);
+
+                    // numerator = (x - xs[0]) * ... * (x - xs[j]), j != i
+                    numerator *= x - xj;
+
+                    // denominator = (xs[i] - x[0]) * ... * (xs[i] - x[j]), j != i
+                    denominator *= xi - xj;
+                }
+            }
+            // numerator / denominator
+            numerator * denominator.invert().unwrap()
+        })
+        .collect()
+}
+
+/// Performs a Lagrange interpolation at the origin for a polynomial defined by `points` and `values`.
+/// It can be used for Scalars, G1 and G2 points.
+pub(crate) fn perform_lagrangian_interpolation_at_origin<T>(
+    points: &[SignerIndex],
+    values: &[T],
+) -> Result<T>
+where
+    T: Sum,
+    for<'a> &'a T: Mul<Scalar, Output = T>,
+{
+    if points.is_empty() || values.is_empty() {
+        return Err(CoconutError::Interpolation(
+            "Tried to perform lagrangian interpolation for an empty set of coordinates".to_string(),
+        ));
+    }
+
+    if points.len() != values.len() {
+        return Err(CoconutError::Interpolation(
+            "Tried to perform lagrangian interpolation for an incomplete set of coordinates"
+                .to_string(),
+        ));
+    }
+
+    let coefficients = generate_lagrangian_coefficients_at_origin(points);
+
+    Ok(coefficients
+        .into_iter()
+        .zip(values.iter())
+        .map(|(coeff, val)| val * coeff)
+        .sum())
+}
+
+// A temporary way of hashing particular message into G1.
+// Implementation idea was taken from `threshold_crypto`:
+// https://github.com/poanetwork/threshold_crypto/blob/7709462f2df487ada3bb3243060504b5881f2628/src/lib.rs#L691
+// Eventually it should get replaced by, most likely, the osswu map
+// method once ideally it's implemented inside the pairing crate.
+
+// note: I have absolutely no idea what are the correct domains for those. I just used whatever
+// was given in the test vectors of `Hashing to Elliptic Curves draft-irtf-cfrg-hash-to-curve-11`
+
+// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-J.9.1
+const G1_HASH_DOMAIN: &[u8] = b"QUUX-V01-CS02-with-BLS12381G1_XMD:SHA-256_SSWU_RO_";
+
+// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#appendix-K.1
+const SCALAR_HASH_DOMAIN: &[u8] = b"QUUX-V01-CS02-with-expander";
+
+pub fn hash_g1<M: AsRef<[u8]>>(msg: M) -> G1Projective {
+    <G1Projective as HashToCurve<ExpandMsgXmd<sha2::Sha256>>>::hash_to_curve(msg, G1_HASH_DOMAIN)
+}
+
+pub fn hash_to_scalar<M: AsRef<[u8]>>(msg: M) -> Scalar {
+    let mut output = vec![Scalar::zero()];
+
+    Scalar::hash_to_field::<ExpandMsgXmd<sha2::Sha256>>(
+        msg.as_ref(),
+        SCALAR_HASH_DOMAIN,
+        &mut output,
+    );
+    output[0]
+}
+
+pub fn try_deserialize_scalar_vec(
+    expected_len: u64,
+    bytes: &[u8],
+    err: CoconutError,
+) -> Result<Vec<Scalar>> {
+    if bytes.len() != expected_len as usize * 32 {
+        return Err(err);
+    }
+
+    let mut out = Vec::with_capacity(expected_len as usize);
+    for i in 0..expected_len as usize {
+        // we just checked we have exactly the amount of bytes we need and thus the unwrap is fine
+        #[allow(clippy::unwrap_used)]
+        let s_bytes = bytes[i * 32..(i + 1) * 32].try_into().unwrap();
+        let s = match Into::<Option<Scalar>>::into(Scalar::from_bytes(&s_bytes)) {
+            None => return Err(err),
+            Some(scalar) => scalar,
+        };
+        out.push(s)
+    }
+
+    Ok(out)
+}
+
+pub fn try_deserialize_scalar(bytes: &[u8; 32], err: CoconutError) -> Result<Scalar> {
+    Into::<Option<Scalar>>::into(Scalar::from_bytes(bytes)).ok_or(err)
+}
+
+pub fn try_deserialize_g1_projective(bytes: &[u8; 48], err: CoconutError) -> Result<G1Projective> {
+    Into::<Option<G1Affine>>::into(G1Affine::from_compressed(bytes))
+        .ok_or(err)
+        .map(G1Projective::from)
+}
+
+pub fn try_deserialize_g2_projective(bytes: &[u8; 96], err: CoconutError) -> Result<G2Projective> {
+    Into::<Option<G2Affine>>::into(G2Affine::from_compressed(bytes))
+        .ok_or(err)
+        .map(G2Projective::from)
+}
+
+// use core::fmt;
+// #[cfg(feature = "serde")]
+// use serde::de::Visitor;
+// #[cfg(feature = "serde")]
+// use serde::{self, Deserialize, Deserializer, Serialize, Serializer};
+//
+// // #[cfg(feature = "serde")]
+// #[serde(remote = "Scalar")]
+// pub(crate) struct ScalarDef(pub Scalar);
+//
+// // #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+//
+// impl Serialize for ScalarDef {
+//     fn serialize<S>(&self, serializer: S) -> core::result::Result<S::Ok, S::Error>
+//     where
+//         S: Serializer,
+//     {
+//         use serde::ser::SerializeTuple;
+//         let mut tup = serializer.serialize_tuple(32)?;
+//         for byte in self.0.to_bytes().iter() {
+//             tup.serialize_element(byte)?;
+//         }
+//         tup.end()
+//     }
+// }
+//
+// impl<'de> Deserialize<'de> for ScalarDef {
+//     fn deserialize<D>(deserializer: D) -> core::result::Result<Self, D::Error>
+//     where
+//         D: Deserializer<'de>,
+//     {
+//         struct ScalarVisitor;
+//
+//         impl<'de> Visitor<'de> for ScalarVisitor {
+//             type Value = ScalarDef;
+//
+//             fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+//                 formatter.write_str("a 32-byte canonical bls12_381 scalar")
+//             }
+//
+//             fn visit_seq<A>(self, mut seq: A) -> core::result::Result<ScalarDef, A::Error>
+//             where
+//                 A: serde::de::SeqAccess<'de>,
+//             {
+//                 let mut bytes = [0u8; 32];
+//                 for i in 0..32 {
+//                     bytes[i] = seq
+//                         .next_element()?
+//                         .ok_or_else(|| serde::de::Error::invalid_length(i, &"expected 32 bytes"))?;
+//                 }
+//
+//                 let res = Scalar::from_bytes(&bytes);
+//                 if res.is_some().into() {
+//                     Ok(ScalarDef(res.unwrap()))
+//                 } else {
+//                     Err(serde::de::Error::custom(
+//                         &"scalar was not canonically encoded",
+//                     ))
+//                 }
+//             }
+//         }
+//
+//         deserializer.deserialize_tuple(32, ScalarVisitor)
+//     }
+// }
+//
+// #[cfg(feature = "serde")]
+// pub(crate) struct G1ProjectiveSerdeHelper(Scalar);
+//
+// #[cfg(feature = "serde")]
+// pub(crate) struct G2ProjectiveSerdeHelper(Scalar);
+
+#[cfg(test)]
+mod tests {
+    use rand::RngCore;
+
+    use super::*;
+
+    #[test]
+    fn polynomial_evaluation() {
+        // y = 42 (it should be 42 regardless of x)
+        let poly = Polynomial {
+            coefficients: vec![Scalar::from(42)],
+        };
+
+        assert_eq!(Scalar::from(42), poly.evaluate(&Scalar::from(1)));
+        assert_eq!(Scalar::from(42), poly.evaluate(&Scalar::from(0)));
+        assert_eq!(Scalar::from(42), poly.evaluate(&Scalar::from(10)));
+
+        // y = x + 10, at x = 2 (exp: 12)
+        let poly = Polynomial {
+            coefficients: vec![Scalar::from(10), Scalar::from(1)],
+        };
+
+        assert_eq!(Scalar::from(12), poly.evaluate(&Scalar::from(2)));
+
+        // y = x^4 - 5x^2 + 2x - 3, at x = 3 (exp: 39)
+        let poly = Polynomial {
+            coefficients: vec![
+                (-Scalar::from(3)),
+                Scalar::from(2),
+                (-Scalar::from(5)),
+                Scalar::zero(),
+                Scalar::from(1),
+            ],
+        };
+
+        assert_eq!(Scalar::from(39), poly.evaluate(&Scalar::from(3)));
+
+        // empty polynomial
+        let poly = Polynomial {
+            coefficients: vec![],
+        };
+
+        // should always be 0
+        assert_eq!(Scalar::from(0), poly.evaluate(&Scalar::from(1)));
+        assert_eq!(Scalar::from(0), poly.evaluate(&Scalar::from(0)));
+        assert_eq!(Scalar::from(0), poly.evaluate(&Scalar::from(10)));
+    }
+
+    #[test]
+    fn performing_lagrangian_scalar_interpolation_at_origin() {
+        // x^2 + 3
+        // x, f(x):
+        // 1, 4,
+        // 2, 7,
+        // 3, 12,
+        let points = vec![1, 2, 3];
+        let values = vec![Scalar::from(4), Scalar::from(7), Scalar::from(12)];
+
+        assert_eq!(
+            Scalar::from(3),
+            perform_lagrangian_interpolation_at_origin(&points, &values).unwrap()
+        );
+
+        // x^3 + 3x^2 - 5x + 11
+        // x, f(x):
+        // 1, 10
+        // 2, 21
+        // 3, 50
+        // 4, 103
+        let points = vec![1, 2, 3, 4];
+        let values = vec![
+            Scalar::from(10),
+            Scalar::from(21),
+            Scalar::from(50),
+            Scalar::from(103),
+        ];
+
+        assert_eq!(
+            Scalar::from(11),
+            perform_lagrangian_interpolation_at_origin(&points, &values).unwrap()
+        );
+
+        // more points than it is required
+        // x^2 + x + 10
+        // x, f(x)
+        // 1, 12
+        // 2, 16
+        // 3, 22
+        // 4, 30
+        // 5, 40
+        let points = vec![1, 2, 3, 4, 5];
+        let values = vec![
+            Scalar::from(12),
+            Scalar::from(16),
+            Scalar::from(22),
+            Scalar::from(30),
+            Scalar::from(40),
+        ];
+
+        assert_eq!(
+            Scalar::from(10),
+            perform_lagrangian_interpolation_at_origin(&points, &values).unwrap()
+        );
+    }
+
+    #[test]
+    fn hash_g1_sanity_check() {
+        let mut rng = rand::thread_rng();
+        let mut msg1 = [0u8; 1024];
+        rng.fill_bytes(&mut msg1);
+        let mut msg2 = [0u8; 1024];
+        rng.fill_bytes(&mut msg2);
+
+        assert_eq!(hash_g1(msg1), hash_g1(msg1));
+        assert_eq!(hash_g1(msg2), hash_g1(msg2));
+        assert_ne!(hash_g1(msg1), hash_g1(msg2));
+    }
+
+    #[test]
+    fn hash_scalar_sanity_check() {
+        let mut rng = rand::thread_rng();
+        let mut msg1 = [0u8; 1024];
+        rng.fill_bytes(&mut msg1);
+        let mut msg2 = [0u8; 1024];
+        rng.fill_bytes(&mut msg2);
+
+        assert_eq!(hash_to_scalar(msg1), hash_to_scalar(msg1));
+        assert_eq!(hash_to_scalar(msg2), hash_to_scalar(msg2));
+        assert_ne!(hash_to_scalar(msg1), hash_to_scalar(msg2));
+    }
+}

common/nymsphinx/anonymous-replies/src/reply_surb.rs

@@ -19,9 +19,6 @@ use thiserror::Error;
 
 #[derive(Debug, Error)]
 pub enum ReplySurbError {
-    #[error("did not receive enough data to recover a reply SURB")]
-    TooShort,
-
     #[error("tried to use reply SURB with an unpadded message")]
     UnpaddedMessageError,
 
@@ -134,9 +131,7 @@ impl ReplySurb {
     }
 
     pub fn from_bytes(bytes: &[u8]) -> Result<Self, ReplySurbError> {
-        if bytes.len() <= SurbEncryptionKeySize::USIZE {
-            return Err(ReplySurbError::TooShort);
-        }
+        // TODO: introduce bound checks to guard us against out of bound reads
 
         let encryption_key =
             SurbEncryptionKey::try_from_bytes(&bytes[..SurbEncryptionKeySize::USIZE])?;

documentation/docs/vercel.json

@@ -0,0 +1,7 @@
+{
+  "git": {
+    "deploymentEnabled": {
+      "master": false
+    }
+  }
+}

explorer-api/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.47"
+version = "1.1.46"
 edition = "2021"
 license.workspace = true
 

gateway/src/config.rs

@@ -97,9 +97,6 @@ pub struct Debug {
     /// Specifies maximum age of stored messages before they are removed from the storage
     pub stale_messages_max_age: Duration,
 
-    /// The maximum number of client connections the gateway will keep open at once.
-    pub maximum_open_connections: usize,
-
     pub zk_nym_tickets: ZkNymTicketHandlerDebug,
 }
 

gateway/src/node/client_handling/websocket/listener.rs

@@ -7,14 +7,11 @@ use nym_task::TaskClient;
 use rand::rngs::OsRng;
 use std::net::SocketAddr;
 use std::process;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::Arc;
 use tokio::task::JoinHandle;
 use tracing::*;
 
 pub struct Listener {
     address: SocketAddr,
-    maximum_open_connections: usize,
     shared_state: CommonHandlerState,
     shutdown: TaskClient,
 }
@@ -22,13 +19,11 @@ pub struct Listener {
 impl Listener {
     pub(crate) fn new(
         address: SocketAddr,
-        maximum_open_connections: usize,
         shared_state: CommonHandlerState,
         shutdown: TaskClient,
     ) -> Self {
         Listener {
             address,
-            maximum_open_connections,
             shared_state,
             shutdown,
         }
@@ -46,8 +41,6 @@ impl Listener {
             }
         };
 
-        let open_connections = Arc::new(AtomicUsize::new(0));
-
         while !self.shutdown.is_shutdown() {
             tokio::select! {
                 biased;
@@ -59,12 +52,6 @@ impl Listener {
                         Ok((socket, remote_addr)) => {
                             let shutdown = self.shutdown.fork(format!("websocket_handler_{remote_addr}"));
                             trace!("received a socket connection from {remote_addr}");
-
-                            if open_connections.fetch_add(1, Ordering::SeqCst) >= self.maximum_open_connections {
-                                warn!("connection limit exceeded ({}). can't accept request from {remote_addr}", self.maximum_open_connections);
-                                continue;
-                            }
-
                             // TODO: I think we *REALLY* need a mechanism for having a maximum number of connected
                             // clients or spawned tokio tasks -> perhaps a worker system?
                             let handle = FreshHandler::new(
@@ -74,15 +61,12 @@ impl Listener {
                                 remote_addr,
                                 shutdown,
                             );
-                            let open_connections = open_connections.clone();
                             tokio::spawn(async move {
                                 // TODO: refactor it similarly to the mixnet listener on the nym-node
                                 let metrics_ref = handle.shared_state.metrics.clone();
                                 metrics_ref.network.new_ingress_websocket_client();
-                                open_connections.fetch_add(1, Ordering::SeqCst);
                                 handle.start_handling().await;
                                 metrics_ref.network.disconnected_ingress_websocket_client();
-                                open_connections.fetch_sub(1, Ordering::SeqCst);
                             });
                         }
                         Err(err) => warn!("failed to get client: {err}"),

gateway/src/node/mod.rs

@@ -262,7 +262,6 @@ impl GatewayTasksBuilder {
 
         Ok(websocket::Listener::new(
             self.config.gateway.websocket_bind_address,
-            self.config.debug.maximum_open_connections,
             shared_state,
             self.shutdown.fork("websocket"),
         ))

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.51"
+version = "1.1.50"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -105,6 +105,7 @@ nym-mixnet-contract-common = { path = "../common/cosmwasm-smart-contracts/mixnet
 nym-vesting-contract-common = { path = "../common/cosmwasm-smart-contracts/vesting-contract" }
 nym-contracts-common = { path = "../common/cosmwasm-smart-contracts/contracts-common", features = ["naive_float", "utoipa"] }
 nym-multisig-contract-common = { path = "../common/cosmwasm-smart-contracts/multisig-contract" }
+nym-coconut = { path = "../common/nymcoconut", features = ["key-zeroize"] }
 nym-sphinx = { path = "../common/nymsphinx" }
 nym-pemstore = { path = "../common/pemstore" }
 nym-task = { path = "../common/task" }

nym-api/src/ecash/dkg/controller/keys.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 
 use crate::ecash::client::Client;
-use crate::ecash::keys::KeyPairWithEpoch;
+use crate::ecash::keys::{KeyPairWithEpoch, LegacyCoconutKeyWithEpoch};
 use crate::support::{config, nyxd};
 use anyhow::{anyhow, bail, Context};
 use nym_coconut_dkg_common::types::{EpochId, EpochState};
@@ -43,12 +43,24 @@ pub(crate) fn load_ecash_keypair_if_exists(
         return Ok(None);
     }
 
+    // first attempt to load ecash keys directly,
+    // if that fails fallback to coconut keys and perform migration
     if let Ok(ecash_key) =
         nym_pemstore::load_key::<KeyPairWithEpoch, _>(&config.storage_paths.ecash_key_path)
     {
         return Ok(Some(ecash_key));
     }
 
+    if let Ok(legacy_coconut_key) =
+        nym_pemstore::load_key::<LegacyCoconutKeyWithEpoch, _>(&config.storage_paths.ecash_key_path)
+    {
+        let migrated_key: KeyPairWithEpoch = legacy_coconut_key.into();
+        nym_pemstore::store_key(&migrated_key, &config.storage_paths.ecash_key_path)
+            .context("migrated key storage failure")?;
+
+        return Ok(Some(migrated_key));
+    }
+
     bail!("ecash key load failure")
 }
 

nym-api/src/ecash/keys/mod.rs

@@ -24,6 +24,23 @@ pub struct KeyPairWithEpoch {
     pub(crate) issued_for_epoch: EpochId,
 }
 
+impl From<LegacyCoconutKeyWithEpoch> for KeyPairWithEpoch {
+    fn from(value: LegacyCoconutKeyWithEpoch) -> Self {
+        let (x, ys) = value.secret_key.hazmat_to_raw();
+        let sk = nym_compact_ecash::SecretKeyAuth::create_from_raw(x, ys);
+
+        KeyPairWithEpoch {
+            keys: sk.into(),
+            issued_for_epoch: value.issued_for_epoch,
+        }
+    }
+}
+
+pub struct LegacyCoconutKeyWithEpoch {
+    pub(crate) secret_key: nym_coconut::SecretKey,
+    pub(crate) issued_for_epoch: EpochId,
+}
+
 impl KeyPairWithEpoch {
     pub(crate) fn new(keys: nym_compact_ecash::KeyPairAuth, issued_for_epoch: EpochId) -> Self {
         KeyPairWithEpoch {

nym-api/src/ecash/keys/persistence.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use crate::ecash::keys::KeyPairWithEpoch;
+use crate::ecash::keys::{KeyPairWithEpoch, LegacyCoconutKeyWithEpoch};
 use nym_coconut_dkg_common::types::EpochId;
 use nym_compact_ecash::{error::CompactEcashError, scheme::keygen::SecretKeyAuth, KeyPairAuth};
 use nym_pemstore::traits::PemStorableKey;
@@ -41,3 +41,37 @@ impl PemStorableKey for KeyPairWithEpoch {
         })
     }
 }
+
+impl PemStorableKey for LegacyCoconutKeyWithEpoch {
+    // that's not the best error for this, but it felt like an overkill to define a dedicated struct just for this purpose
+    type Error = nym_coconut::CoconutError;
+
+    fn pem_type() -> &'static str {
+        "COCONUT KEY WITH EPOCH"
+    }
+
+    fn to_bytes(&self) -> Vec<u8> {
+        let mut bytes = self.issued_for_epoch.to_be_bytes().to_vec();
+        bytes.append(&mut self.secret_key.to_bytes());
+        bytes
+    }
+
+    fn from_bytes(bytes: &[u8]) -> Result<Self, Self::Error> {
+        if bytes.len() <= mem::size_of::<EpochId>() {
+            return Err(nym_coconut::CoconutError::DeserializationMinLength {
+                min: mem::size_of::<EpochId>(),
+                actual: bytes.len(),
+            });
+        }
+        let epoch_id = EpochId::from_be_bytes([
+            bytes[0], bytes[1], bytes[2], bytes[3], bytes[4], bytes[5], bytes[6], bytes[7],
+        ]);
+
+        let sk = nym_coconut::SecretKey::from_bytes(&bytes[mem::size_of::<EpochId>()..])?;
+
+        Ok(LegacyCoconutKeyWithEpoch {
+            secret_key: sk,
+            issued_for_epoch: epoch_id,
+        })
+    }
+}

nym-api/src/nym_nodes/handlers/mod.rs

@@ -26,6 +26,7 @@ use utoipa::{IntoParams, ToSchema};
 
 pub(crate) mod legacy;
 pub(crate) mod unstable;
+pub(crate) mod topology;
 
 pub(crate) fn nym_node_routes() -> Router<AppState> {
     Router::new()

nym-api/src/nym_nodes/handlers/topology.rs

@@ -0,0 +1,153 @@
+#![warn(missing_docs)]
+#![warn(rustdoc::missing_crate_level_docs)]
+
+use crate::{
+    node_status_api::models::{AxumErrorResponse, AxumResult},
+    support::http::{helpers::NodeIdParam, topology_cache::{TopologyCache, PayloadFormat}},
+};
+
+use axum::{
+    extract::{Path, Query, State},
+    routing::{get, post},
+    Json, Router,
+};
+use nym_mixnet_contract_common::{Interval, NodeId};
+use nym_api_requests::models::RewardedSetResponse;
+use serde::{Deserialize, Serialize};
+
+use std::sync::Arc;
+
+type SkimmedNodes = AxumResult<Json<TopologyResponse>>;
+
+#[derive(Debug, Deserialize, utoipa::IntoParams)]
+#[into_params(parameter_in = Query)]
+struct TopologyParams {
+    #[allow(dead_code)]
+    semver_compatibility: Option<String>,
+
+    // Identifier for the current epoch of the topology state. When sent by a client we can check if
+    // the client already knows about the latest topology state, allowing a `no-updates` response
+    // instead of wasting bandwidth serving an unchanged topology.
+    epoch_id: Option<u32>,
+}
+
+#[allow(deprecated)]
+pub(crate) fn topology_routes() -> Router<Arc<TopologyCache>> {
+    Router::new()
+        .route("layer-assignments", get(layer_assignments))
+        .nest(
+            "/skimmed",
+            Router::new()
+                .route("/", get(nodes_basic_all))
+                .route("batch", post(nodes_basic_batch))
+                .route("/:node_id", get(node_basic)),
+        )
+    // // NOT IMPLEMENTED
+    // .nest(
+    //     "/semi-skimmed",
+    //     Router::new().route("/", get(nodes_expanded_all)),
+    // )
+    // .nest(
+    //     "/full-fat",
+    //     Router::new().route("/", get(nodes_detailed_all)),
+    // )
+}
+
+async fn nodes_basic_all(
+    State(state): State<Arc<TopologyCache>>,
+    Query(query_params): Query<TopologyParams>,
+) -> AxumResult<Json<TopologyResponse>> {
+	Err(AxumErrorResponse::not_implemented())
+}
+
+async fn nodes_basic_batch(
+    State(state): State<Arc<TopologyCache>>,
+    Query(query_params): Query<TopologyParams>,
+    Json(node_ids): Json<Vec<NodeId>>,
+) -> AxumResult<Json<TopologyResponse>> {
+	Err(AxumErrorResponse::not_implemented())
+}
+
+async fn node_basic(
+    Path(NodeIdParam { node_id }): Path<NodeIdParam>,
+    State(state): State<Arc<TopologyCache>>,
+    Query(query_params): Query<TopologyParams>,
+) -> AxumResult<Json<TopologyResponse>> {
+	Err(AxumErrorResponse::not_implemented())
+}
+
+async fn layer_assignments(
+    State(state): State<Arc<TopologyCache>>,
+    Query(query_params): Query<TopologyParams>,
+) -> AxumResult<Json<LayerAssignmentsResponse>> {
+	Err(AxumErrorResponse::not_implemented())
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+struct LayerAssignmentsResponse {
+    pub status: Option<TopologyRequestStatus>,
+
+    pub assignments: RewardedSetResponse,
+
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+struct TopologyResponse {
+    pub status: Option<TopologyRequestStatus>,
+
+    payload: Vec<u8>,
+    payload_format: Option<PayloadFormat>,
+    payload_signature: Option<Vec<u8>>,
+
+    current_topology_hash: Option<Vec<u8>>,
+    topology_signature: Option<Vec<u8>>,
+}
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum TopologyRequestStatus {
+    NoUpdates,
+    Fresh(Interval),
+}
+
+#[cfg(test)]
+mod test {
+    use std::time::Duration;
+
+    use axum_test::TestServer;
+    use nym_topology::NymTopology;
+    use time::OffsetDateTime;
+
+    use crate::support::http::topology_cache::Epoch;
+
+    use super::*;
+
+	fn build_test_topology_cache() -> TopologyCache {
+
+		let current_epoch = Epoch {
+			id: 123,
+			current_epoch_start: OffsetDateTime::now_utc(),
+			epoch_length: Duration::from_secs(120),
+		};
+
+		let topology = NymTopology::default();
+
+		TopologyCache::new(current_epoch, topology);
+		todo!();
+	}
+
+    #[tokio::test]
+    async fn test_topology_basic() -> Result<(), Box<dyn ::std::error::Error>> {
+        let state = Arc::new(build_test_topology_cache());
+        let app = topology_routes().with_state(state);
+
+        let server = TestServer::new(app)?;
+
+        let response = server
+            .get(&"/layer_assignments")
+            .await;
+
+        response.assert_text("hello!");
+		Ok(())
+    }
+}

nym-api/src/nym_nodes/handlers/unstable/mod.rs

@@ -25,11 +25,11 @@ use crate::nym_nodes::handlers::unstable::semi_skimmed::nodes_expanded;
 use crate::nym_nodes::handlers::unstable::skimmed::{
     entry_gateways_basic_active, entry_gateways_basic_all, exit_gateways_basic_active,
     exit_gateways_basic_all, mixnodes_basic_active, mixnodes_basic_all, nodes_basic_active,
-    nodes_basic_all,
+    nodes_basic_all, nodes_basic_batch,
 };
 use crate::support::http::helpers::PaginationRequest;
 use crate::support::http::state::AppState;
-use axum::routing::get;
+use axum::routing::{get, post};
 use axum::Router;
 use nym_api_requests::nym_nodes::NodeRoleQueryParam;
 use serde::Deserialize;
@@ -47,6 +47,7 @@ pub(crate) fn nym_node_routes_unstable() -> Router<AppState> {
             "/skimmed",
             Router::new()
                 .route("/", get(nodes_basic_all))
+                .route("batch", post(nodes_basic_batch))
                 .route("/active", get(nodes_basic_active))
                 .nest(
                     "/mixnodes",

nym-api/src/nym_nodes/handlers/unstable/skimmed.rs

@@ -25,6 +25,7 @@ use tracing::trace;
 use utoipa::ToSchema;
 
 pub type PaginatedSkimmedNodes = AxumResult<Json<PaginatedCachedNodesResponse<SkimmedNode>>>;
+type SkimmedNodes = AxumResult<Json<CachedNodesResponse<SkimmedNode>>>;
 
 /// Given all relevant caches, build part of response for JUST Nym Nodes
 fn build_nym_nodes_response<'a, NI>(
@@ -196,7 +197,7 @@ where
 pub(super) async fn deprecated_gateways_basic(
     state: State<AppState>,
     query_params: Query<NodesParams>,
-) -> AxumResult<Json<CachedNodesResponse<SkimmedNode>>> {
+) -> SkimmedNodes {
     // 1. call '/v1/unstable/skimmed/entry-gateways/all'
     let all_gateways = entry_gateways_basic_all(state, query_params).await?;
 
@@ -223,7 +224,7 @@ pub(super) async fn deprecated_gateways_basic(
 pub(super) async fn deprecated_mixnodes_basic(
     state: State<AppState>,
     query_params: Query<NodesParams>,
-) -> AxumResult<Json<CachedNodesResponse<SkimmedNode>>> {
+) -> SkimmedNodes {
     // 1. call '/v1/unstable/nym-nodes/skimmed/mixnodes/active'
     let active_mixnodes = mixnodes_basic_active(state, query_params).await?;
 
@@ -239,7 +240,7 @@ async fn nodes_basic(
     state: State<AppState>,
     Query(_query_params): Query<NodesParams>,
     active_only: bool,
-) -> PaginatedSkimmedNodes {
+) -> SkimmedNodes {
     // unfortunately we have to build the response semi-manually here as we need to add two sources of legacy nodes
 
     // 1. grab all relevant described nym-nodes
@@ -281,10 +282,10 @@ async fn nodes_basic(
         legacy_gateways.timestamp(),
     ]);
 
-    Ok(Json(PaginatedCachedNodesResponse::new_full(
+    Ok(Json(CachedNodesResponse {
         refreshed_at,
         nodes,
-    )))
+    }))
 }
 
 #[allow(dead_code)] // not dead, used in OpenAPI docs
@@ -329,6 +330,31 @@ pub(super) async fn nodes_basic_all(
     nodes_basic(state, Query(query_params.into()), false).await
 }
 
+/// Post request handler taking a json array of NodeId (u32) values and returning descriptors for
+/// the provided NodeId values. A successful response will contain descriptors for all nodes
+/// associated with those node IDs available in the current full topology.
+///
+/// If a provided node ID is not present in the current topology there will be no descriptor for
+/// that node in the response.
+///
+/// If no node IDs are provided the response will contain no descriptors.
+#[utoipa::path(
+    tag = "Unstable Nym Nodes batch by Node ID",
+    get,
+    params(NodesParamsWithRole),
+    path = "batch",
+    context_path = "/v1/unstable/nym-nodes/skimmed",
+    responses(
+        (status = 200, body = PaginatedCachedNodesResponseSchema)
+    )
+)]
+pub(super) async fn nodes_basic_batch(
+    state: State<AppState>,
+    Query(query_params): Query<NodesParamsWithRole>,
+) -> SkimmedNodes {
+    nodes_basic(state, Query(query_params.into()), false).await
+}
+
 /// Return Nym Nodes and optionally legacy mixnodes/gateways (if `no-legacy` flag is not used)
 /// that are currently bonded and are in the **active set**
 #[utoipa::path(

nym-api/src/support/cli/run.rs

@@ -23,6 +23,7 @@ use crate::support::config::Config;
 use crate::support::http::state::{
     AppState, ForcedRefresh, ShutdownHandles, TASK_MANAGER_TIMEOUT_S,
 };
+use crate::support::http::topology_cache::{Epoch, TopologyCache};
 use crate::support::http::RouterBuilder;
 use crate::support::nyxd;
 use crate::support::storage::runtime_migrations::m001_directory_services_v2_1::migrate_to_directory_services_v2_1;
@@ -35,6 +36,7 @@ use anyhow::{bail, Context};
 use nym_config::defaults::NymNetworkDetails;
 use nym_sphinx::receiver::SphinxMessageReceiver;
 use nym_task::TaskManager;
+use nym_topology::NymTopology;
 use nym_validator_client::nyxd::Coin;
 use std::net::SocketAddr;
 use std::sync::Arc;
@@ -133,8 +135,6 @@ async fn start_nym_api_tasks_axum(config: &Config) -> anyhow::Result<ShutdownHan
     let identity_keypair = config.base.storage_paths.load_identity()?;
     let identity_public_key = *identity_keypair.public_key();
 
-    let router = RouterBuilder::with_default_routes(config.network_monitor.enabled);
-
     let nym_contract_cache_state = NymContractCache::new();
     let node_status_cache_state = NodeStatusCache::new();
     let mix_denom = network_details.network.chain_details.mix_denom.base.clone();
@@ -190,7 +190,16 @@ async fn start_nym_api_tasks_axum(config: &Config) -> anyhow::Result<ShutdownHan
     };
 
     ecash_state.spawn_background_cleaner();
-    let router = router.with_state(AppState {
+
+
+    let epoch = Epoch::from(nym_contract_cache_state.current_interval().await.take());
+    let topology = {
+        todo!("cannot proceed without implementing this.");
+        NymTopology::default()
+    };
+    let topology_cache = TopologyCache::new(epoch, topology);
+
+    let state = AppState {
         forced_refresh: ForcedRefresh::new(
             config.topology_cacher.debug.node_describe_allow_illegal_ips,
         ),
@@ -203,7 +212,11 @@ async fn start_nym_api_tasks_axum(config: &Config) -> anyhow::Result<ShutdownHan
         node_info_cache,
         api_status: ApiStatusState::new(signer_information),
         ecash_state: Arc::new(ecash_state),
-    });
+        topology_cache: Arc::new(topology_cache)
+    };
+
+    let router = RouterBuilder::with_default_routes(&state, config.network_monitor.enabled);
+    let router = router.with_state(state);
 
     // start note describe cache refresher
     // we should be doing the below, but can't due to our current startup structure

nym-api/src/support/http/mod.rs

@@ -6,6 +6,7 @@ pub(crate) mod openapi;
 pub(crate) mod router;
 pub(crate) mod state;
 mod unstable_routes;
+pub(crate) mod topology_cache;
 
 pub(crate) use router::RouterBuilder;
 

nym-api/src/support/http/router.rs

@@ -8,6 +8,7 @@ use crate::node_status_api::handlers::status_routes;
 use crate::nym_contract_cache::handlers::nym_contract_cache_routes;
 use crate::nym_nodes::handlers::legacy::legacy_nym_node_routes;
 use crate::nym_nodes::handlers::nym_node_routes;
+use crate::nym_nodes::handlers::topology::topology_routes;
 use crate::status;
 use crate::support::http::openapi::ApiDoc;
 use crate::support::http::state::AppState;
@@ -38,7 +39,7 @@ pub(crate) struct RouterBuilder {
 impl RouterBuilder {
     /// All routes should be, if possible, added here. Exceptions are e.g.
     /// routes which are added conditionally in other places based on some `if`.
-    pub(crate) fn with_default_routes(network_monitor: bool) -> Self {
+    pub(crate) fn with_default_routes(state: &AppState, network_monitor: bool) -> Self {
         // https://docs.rs/tower-http/0.1.1/tower_http/trace/index.html
         // TODO rocket use tracing instead of env_logger
         // https://github.com/tokio-rs/axum/blob/main/examples/tracing-aka-logging/src/main.rs
@@ -64,7 +65,9 @@ impl RouterBuilder {
                     .nest("/api-status", status::handlers::api_status_routes())
                     .nest("/nym-nodes", nym_node_routes())
                     .nest("/ecash", ecash_routes())
-                    .nest("/unstable", unstable_routes()), // CORS layer needs to be "outside" of routes
+                    .nest("/unstable", unstable_routes())
+                    .nest("/topology", topology_routes().with_state(state.topology_cache.clone())),
+                    // CORS layer needs to be "outside" of routes
             );
 
         Self {

nym-api/src/support/http/state.rs

@@ -12,6 +12,7 @@ use crate::nym_contract_cache::cache::NymContractCache;
 use crate::status::ApiStatusState;
 use crate::support::caching::cache::SharedCache;
 use crate::support::caching::Cache;
+use crate::support::http::topology_cache::TopologyCache;
 use crate::support::storage;
 use axum::extract::FromRef;
 use nym_api_requests::models::{GatewayBondAnnotated, MixNodeBondAnnotated, NodeAnnotation};
@@ -87,6 +88,7 @@ pub(crate) struct AppState {
     pub(crate) api_status: ApiStatusState,
     // todo: refactor it into inner: Arc<EcashStateInner>
     pub(crate) ecash_state: Arc<EcashState>,
+    pub(crate) topology_cache: Arc<TopologyCache>
 }
 
 impl FromRef<AppState> for ApiStatusState {

nym-api/src/support/http/topology_cache.rs

@@ -0,0 +1,60 @@
+#![warn(missing_docs)]
+#![warn(rustdoc::missing_crate_level_docs)]
+
+
+use std::collections::HashMap;
+use nym_topology::NymTopology;
+use serde::{Deserialize, Serialize};
+use nym_mixnet_contract_common::{EpochId, Interval};
+use std::time::Duration;
+use time::OffsetDateTime;
+
+pub struct Epoch {
+	pub id: EpochId,
+	pub current_epoch_start: OffsetDateTime,
+    pub epoch_length: Duration,
+}
+
+impl From<Interval> for Epoch {
+	fn from(value: Interval) -> Self {
+		Self {
+			id: value.current_epoch_id(),
+			current_epoch_start: value.current_epoch_start(),
+			epoch_length: value.epoch_length(),
+		}
+	}
+}
+
+/// Format for 
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum PayloadFormat {
+    Json,
+    BitCode,
+}
+
+pub(crate) struct TopologyCache {
+	current_epoch: Epoch,
+	formats: HashMap<PayloadFormat, SerializedTopology>,
+	cached: NymTopology,
+	hash: Option<Vec<u8>>,
+	signature: Option<Vec<u8>>
+}
+
+pub(crate) struct SerializedTopology{
+	bytes: Vec<u8>,
+	signature: Vec<u8>,
+}
+
+
+impl TopologyCache {
+	pub fn new(current_epoch: Epoch, initial: NymTopology) -> Self {
+		Self {
+			current_epoch,
+			formats: HashMap::new(),
+			cached: initial,
+			hash: None,
+			signature: None
+		}
+	}
+}

nym-credential-proxy/nym-credential-proxy-requests/src/client.rs

@@ -145,4 +145,30 @@ impl NymVpnApiClient for VpnApiClient {
 
         parse_response(res, false).await
     }
+
+    // async fn get_bandwidth_voucher_blinded_shares(
+    //     &self,
+    //     blind_sign_request: BlindSignRequest,
+    // ) -> Result<BandwidthVoucherResponse, VpnApiClientError> {
+    //     let req = self.inner.create_post_request(
+    //         &["/api", "/v1", "/bandwidth-voucher", "/obtain"],
+    //         NO_PARAMS,
+    //         &BandwidthVoucherRequest { blind_sign_request },
+    //     );
+    //
+    //     let fut = req.bearer_auth(&self.bearer_token).send();
+    //
+    //     // the only reason for that target lock is so that I could call this method from an ephemeral test
+    //     // running in non-wasm mode (since I wanted to use tokio)
+    //
+    //     #[cfg(target_arch = "wasm32")]
+    //     let res = wasmtimer::tokio::timeout(std::time::Duration::from_secs(5), fut)
+    //         .await
+    //         .map_err(|_timeout| HttpClientError::RequestTimeout)??;
+    //
+    //     #[cfg(not(target_arch = "wasm32"))]
+    //     let res = fut.await?;
+    //
+    //     parse_response(res, false).await
+    // }
 }

nym-credential-proxy/nym-credential-proxy/src/http/router/api/v1/openapi.rs

@@ -9,6 +9,48 @@ use utoipa::openapi::security::{Http, HttpAuthScheme, SecurityScheme};
 use utoipa::{Modify, OpenApi};
 use utoipa_swagger_ui::SwaggerUi;
 
+/*
+#[derive(OpenApi)]
+#[openapi(
+    info(title = "Nym VPN Api"),
+    paths(
+        api::v1::freepass::generate_freepass,
+        api::v1::bandwidth_voucher::obtain_bandwidth_voucher_shares,
+        api::v1::bandwidth_voucher::obtain_async_bandwidth_voucher_shares,
+        api::v1::bandwidth_voucher::current_deposit,
+        api::v1::bandwidth_voucher::prehashed_public_attributes,
+        api::v1::bandwidth_voucher::partial_verification_keys,
+        api::v1::bandwidth_voucher::master_verification_key,
+        api::v1::bandwidth_voucher::current_epoch,
+        api::v1::bandwidth_voucher::shares::query_for_shares_by_id,
+    ),
+    components(
+        schemas(
+            api::Output,
+            api::OutputParams,
+            api_requests::v1::ErrorResponse,
+            api_requests::v1::freepass::models::FreepassCredentialResponse,
+            api_requests::v1::freepass::models::FreepassQueryParams,
+            api_requests::v1::bandwidth_voucher::models::DepositResponse,
+            api_requests::v1::bandwidth_voucher::models::AttributesResponse,
+            api_requests::v1::bandwidth_voucher::models::BandwidthVoucherResponse,
+            api_requests::v1::bandwidth_voucher::models::BandwidthVoucherAsyncResponse,
+            api_requests::v1::bandwidth_voucher::models::PartialVerificationKeysResponse,
+            api_requests::v1::bandwidth_voucher::models::CurrentEpochResponse,
+            api_requests::v1::bandwidth_voucher::models::CredentialShare,
+            api_requests::v1::bandwidth_voucher::models::PartialVerificationKey,
+            api_requests::v1::bandwidth_voucher::models::MasterVerificationKeyResponse,
+            api_requests::v1::bandwidth_voucher::models::BandwidthVoucherAsyncRequest,
+            api_requests::v1::bandwidth_voucher::models::BandwidthVoucherRequest,
+            api_requests::v1::bandwidth_voucher::models::BlindSignRequestJsonSchemaWrapper
+        ),
+        responses(RequestError),
+    ),
+    modifiers(&SecurityAddon),
+)]
+pub(crate) struct ApiDoc;
+ */
+
 #[derive(OpenApi)]
 #[openapi(
     info(title = "Nym Credential Proxy Api"),

nym-node-status-api/nym-node-status-agent/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node-status-agent"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node-status-api/nym-node-status-agent/run.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 
 set -eu
-export ENVIRONMENT=${ENVIRONMENT:-"sandbox"}
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
 
-probe_git_ref="nym-vpn-core-v1.1.0"
+probe_git_ref="nym-vpn-core-v1.3.2"
 
 crate_root=$(dirname $(realpath "$0"))
 monorepo_root=$(realpath "${crate_root}/../..")
@@ -21,6 +21,7 @@ export NODE_STATUS_AGENT_SERVER_ADDRESS="http://127.0.0.1"
 export NODE_STATUS_AGENT_SERVER_PORT="8000"
 export NODE_STATUS_AGENT_PROBE_PATH="$crate_root/nym-gateway-probe"
 export NODE_STATUS_AGENT_AUTH_KEY="BjyC9SsHAZUzPRkQR4sPTvVrp4GgaquTh5YfSJksvvWT"
+export NODE_STATUS_AGENT_PROBE_EXTRA_ARGS="netstack-download-timeout-sec=30,netstack-num-ping=2,netstack-send-timeout-sec=1,netstack-recv-timeout-sec=1"
 
 workers=${1:-1}
 echo "Running $workers workers in parallel"
@@ -54,7 +55,7 @@ function swarm() {
     echo "All agents completed"
 }
 
-# copy_gw_probe
+copy_gw_probe
 build_agent
 
 swarm $workers

nym-node-status-api/nym-node-status-agent/src/cli/mod.rs

@@ -35,6 +35,13 @@ pub(crate) enum Command {
         /// path of binary to run
         #[arg(long, env = "NODE_STATUS_AGENT_PROBE_PATH")]
         probe_path: String,
+
+        #[arg(
+            long,
+            env = "NODE_STATUS_AGENT_PROBE_EXTRA_ARGS",
+            value_delimiter = ','
+        )]
+        probe_extra_args: Vec<String>,
     },
 
     GenerateKeypair {
@@ -51,11 +58,13 @@ impl Args {
                 server_port,
                 ns_api_auth_key,
                 probe_path,
+                probe_extra_args,
             } => run_probe::run_probe(
                 server_address,
                 server_port.to_owned(),
                 ns_api_auth_key,
                 probe_path,
+                probe_extra_args,
             )
             .await
             .inspect_err(|err| {

nym-node-status-api/nym-node-status-agent/src/cli/run_probe.rs

@@ -7,6 +7,7 @@ pub(crate) async fn run_probe(
     server_port: u16,
     ns_api_auth_key: &str,
     probe_path: &str,
+    probe_extra_args: &Vec<String>,
 ) -> anyhow::Result<()> {
     let auth_key = PrivateKey::from_base58_string(ns_api_auth_key)
         .context("Couldn't parse auth key, exiting")?;
@@ -19,7 +20,7 @@ pub(crate) async fn run_probe(
     tracing::info!("Probe version:\n{}", version);
 
     if let Some(testrun) = ns_api_client.request_testrun().await? {
-        let log = probe.run_and_get_log(&Some(testrun.gateway_identity_key));
+        let log = probe.run_and_get_log(&Some(testrun.gateway_identity_key), probe_extra_args);
 
         ns_api_client
             .submit_results(testrun.testrun_id, log, testrun.assigned_at_utc)

nym-node-status-api/nym-node-status-agent/src/probe.rs

@@ -29,7 +29,11 @@ impl GwProbe {
         }
     }
 
-    pub(crate) fn run_and_get_log(&self, gateway_key: &Option<String>) -> String {
+    pub(crate) fn run_and_get_log(
+        &self,
+        gateway_key: &Option<String>,
+        probe_extra_args: &Vec<String>,
+    ) -> String {
         let mut command = std::process::Command::new(&self.path);
         command.stdout(std::process::Stdio::piped());
 
@@ -37,6 +41,16 @@ impl GwProbe {
             command.arg("--gateway").arg(gateway_id);
         }
 
+        tracing::info!("Extra args for the probe:");
+        for arg in probe_extra_args {
+            let mut split = arg.splitn(2, '=');
+            let name = split.next().unwrap_or_default();
+            let value = split.next().unwrap_or_default();
+            tracing::info!("{} {}", name, value);
+
+            command.arg(format!("--{name}")).arg(value);
+        }
+
         match command.spawn() {
             Ok(child) => {
                 if let Ok(output) = child.wait_with_output() {

nym-node-status-api/nym-node-status-api/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node-status-api"
-version = "1.0.0-rc.8"
+version = "1.0.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -16,11 +16,13 @@ rust-version.workspace = true
 ammonia = { workspace = true }
 anyhow = { workspace = true }
 axum = { workspace = true, features = ["tokio", "macros"] }
+bip39 = { workspace = true }
 chrono = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive", "env", "string"] }
 cosmwasm-std = { workspace = true }
 envy = { workspace = true }
 futures-util = { workspace = true }
+itertools = { workspace = true }
 moka = { workspace = true, features = ["future"] }
 nym-contracts-common = { path = "../../common/cosmwasm-smart-contracts/contracts-common" }
 nym-bin-common = { path = "../../common/bin-common", features = ["models"] }
@@ -33,6 +35,8 @@ nym-statistics-common = { path = "../../common/statistics" }
 nym-validator-client = { path = "../../common/client-libs/validator-client" }
 nym-task = { path = "../../common/task" }
 nym-node-requests = { path = "../../nym-node/nym-node-requests", features = ["openapi"] }
+rand = { workspace = true }
+rand_chacha = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
 serde = { workspace = true, features = ["derive"] }

nym-node-status-api/nym-node-status-api/launch_node_status_api.sh

@@ -3,7 +3,7 @@
 set -e
 
 user_rust_log_preference=$RUST_LOG
-export ENVIRONMENT=${ENVIRONMENT:-"sandbox"}
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
 export NYM_API_CLIENT_TIMEOUT=60
 export EXPLORER_CLIENT_TIMEOUT=60
 export NODE_STATUS_API_TESTRUN_REFRESH_INTERVAL=120

nym-node-status-api/nym-node-status-api/src/cli/mod.rs

@@ -83,9 +83,6 @@ pub(crate) struct Cli {
         env = "NYM_NODE_STATUS_API_MAX_AGENT_COUNT"
     )]
     pub(crate) max_agent_count: i64,
-
-    #[clap(long, default_value = "", env = "NYM_NODE_STATUS_API_HM_URL")]
-    pub(crate) hm_url: String,
 }
 
 fn parse_duration(arg: &str) -> Result<std::time::Duration, std::num::ParseIntError> {

nym-node-status-api/nym-node-status-api/src/db/models.rs

@@ -2,7 +2,7 @@ use std::str::FromStr;
 
 use crate::{
     http::{self, models::SummaryHistory},
-    monitor::NumericalCheckedCast,
+    utils::NumericalCheckedCast,
 };
 use anyhow::Context;
 use nym_contracts_common::Percent;
@@ -16,7 +16,7 @@ use strum_macros::{EnumString, FromRepr};
 use time::{Date, OffsetDateTime};
 use utoipa::ToSchema;
 
-pub(crate) struct GatewayRecord {
+pub(crate) struct GatewayInsertRecord {
     pub(crate) identity_key: String,
     pub(crate) bonded: bool,
     pub(crate) self_described: String,
@@ -360,14 +360,24 @@ impl TryFrom<GatewaySessionsRecord> for http::models::SessionStats {
     }
 }
 
-pub(crate) enum MixingNodeKind {
-    LegacyMixnode,
-    NymNode,
+pub(crate) enum ScrapeNodeKind {
+    LegacyMixnode { mix_id: i64 },
+    MixingNymNode { node_id: i64 },
+    EntryExitNymNode { node_id: i64, identity_key: String },
+}
+
+impl ScrapeNodeKind {
+    pub(crate) fn node_id(&self) -> &i64 {
+        match self {
+            ScrapeNodeKind::LegacyMixnode { mix_id } => mix_id,
+            ScrapeNodeKind::MixingNymNode { node_id } => node_id,
+            ScrapeNodeKind::EntryExitNymNode { node_id, .. } => node_id,
+        }
+    }
 }
 
 pub(crate) struct ScraperNodeInfo {
-    pub node_id: i64,
-    pub node_kind: MixingNodeKind,
+    pub node_kind: ScrapeNodeKind,
     pub hosts: Vec<String>,
     pub http_api_port: i64,
 }
@@ -390,6 +400,10 @@ impl ScraperNodeInfo {
 
         urls
     }
+
+    pub(crate) fn node_id(&self) -> &i64 {
+        self.node_kind.node_id()
+    }
 }
 
 #[derive(sqlx::Decode, Debug)]

nym-node-status-api/nym-node-status-api/src/db/queries/gateways.rs

@@ -1,6 +1,8 @@
+use std::collections::HashSet;
+
 use crate::{
     db::{
-        models::{GatewayDto, GatewayRecord},
+        models::{GatewayDto, GatewayInsertRecord},
         DbPool,
     },
     http::models::Gateway,
@@ -30,7 +32,7 @@ pub(crate) async fn select_gateway_identity(
 
 pub(crate) async fn insert_gateways(
     pool: &DbPool,
-    gateways: Vec<GatewayRecord>,
+    gateways: Vec<GatewayInsertRecord>,
 ) -> anyhow::Result<()> {
     let mut db = pool.acquire().await?;
     for record in gateways {
@@ -98,3 +100,21 @@ pub(crate) async fn get_all_gateways(pool: &DbPool) -> anyhow::Result<Vec<Gatewa
     tracing::trace!("Fetched {} gateways from DB", items.len());
     Ok(items)
 }
+
+pub(crate) async fn get_all_gateway_id_keys(pool: &DbPool) -> anyhow::Result<HashSet<String>> {
+    let mut conn = pool.acquire().await?;
+    let items = sqlx::query!(
+        r#"
+            SELECT gateway_identity_key
+            FROM gateways
+            WHERE bonded = true
+        "#
+    )
+    .fetch_all(&mut *conn)
+    .await?
+    .into_iter()
+    .map(|record| record.gateway_identity_key)
+    .collect::<HashSet<_>>();
+
+    Ok(items)
+}

nym-node-status-api/nym-node-status-api/src/db/queries/mixnodes.rs

@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
 use futures_util::TryStreamExt;
 use tracing::error;
 
@@ -84,7 +86,7 @@ pub(crate) async fn get_all_mixnodes(pool: &DbPool) -> anyhow::Result<Vec<Mixnod
 }
 
 /// `offset` = slides our fixed-day period further into the past by N days
-pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Result<Vec<DailyStats>> {
+pub(crate) async fn get_daily_stats(pool: &DbPool) -> anyhow::Result<Vec<DailyStats>> {
     let mut conn = pool.acquire().await?;
     let items = sqlx::query_as!(
         DailyStats,
@@ -115,11 +117,8 @@ pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Resul
             WHERE nym_node_daily_mixing_stats.node_id IS NULL
         )
         GROUP BY date_utc
-        ORDER BY date_utc DESC
-        LIMIT 30
-        OFFSET ?
+        ORDER BY date_utc ASC
         "#,
-        offset
     )
     .fetch(&mut *conn)
     .try_collect::<Vec<DailyStats>>()
@@ -127,3 +126,21 @@ pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Resul
 
     Ok(items)
 }
+
+pub(crate) async fn get_all_mix_ids(pool: &DbPool) -> anyhow::Result<HashSet<i64>> {
+    let mut conn = pool.acquire().await?;
+    let items = sqlx::query!(
+        r#"
+            SELECT mix_id
+            FROM mixnodes
+            WHERE bonded = true
+        "#
+    )
+    .fetch_all(&mut *conn)
+    .await?
+    .into_iter()
+    .map(|record| record.mix_id)
+    .collect::<HashSet<_>>();
+
+    Ok(items)
+}

nym-node-status-api/nym-node-status-api/src/db/queries/mod.rs

@@ -8,13 +8,15 @@ pub(crate) mod scraper;
 mod summary;
 pub(crate) mod testruns;
 
-pub(crate) use gateways::{get_all_gateways, insert_gateways, select_gateway_identity};
+pub(crate) use gateways::{
+    get_all_gateway_id_keys, get_all_gateways, insert_gateways, select_gateway_identity,
+};
 pub(crate) use gateways_stats::{delete_old_records, get_sessions_stats, insert_session_records};
 pub(crate) use misc::insert_summaries;
-pub(crate) use mixnodes::{get_all_mixnodes, get_daily_stats, insert_mixnodes};
+pub(crate) use mixnodes::{get_all_mix_ids, get_all_mixnodes, get_daily_stats, insert_mixnodes};
 pub(crate) use nym_nodes::{get_nym_nodes, insert_nym_nodes};
 pub(crate) use packet_stats::{
     get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
 };
-pub(crate) use scraper::{get_mixing_nodes_for_scraping, insert_scraped_node_description};
+pub(crate) use scraper::{get_nodes_for_scraping, insert_scraped_node_description};
 pub(crate) use summary::{get_summary, get_summary_history};

nym-node-status-api/nym-node-status-api/src/db/queries/nym_nodes.rs

@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 
+use anyhow::Context;
 use futures_util::TryStreamExt;
 use nym_validator_client::{client::NymNodeDetails, nym_api::SkimmedNode};
 use tracing::instrument;
@@ -9,7 +10,7 @@ use crate::{
         models::{NymNodeDto, NymNodeInsertRecord},
         DbPool,
     },
-    monitor::decimal_to_i64,
+    utils::decimal_to_i64,
 };
 
 pub(crate) async fn get_nym_nodes(pool: &DbPool) -> anyhow::Result<Vec<SkimmedNode>> {
@@ -100,7 +101,8 @@ pub(crate) async fn insert_nym_nodes(
             record.last_updated_utc,
         )
         .execute(&mut *conn)
-        .await?;
+        .await
+        .with_context(|| format!("node_id={}", record.node_id))?;
     }
 
     Ok(())

nym-node-status-api/nym-node-status-api/src/db/queries/packet_stats.rs

@@ -1,27 +1,26 @@
 use crate::db::{
-    models::{MixingNodeKind, NodeStats, ScraperNodeInfo},
+    models::{NodeStats, ScrapeNodeKind, ScraperNodeInfo},
     DbPool,
 };
 use anyhow::Result;
 
 pub(crate) async fn insert_node_packet_stats(
     pool: &DbPool,
-    node_id: i64,
-    node_kind: &MixingNodeKind,
+    node_kind: &ScrapeNodeKind,
     stats: &NodeStats,
     timestamp_utc: i64,
 ) -> Result<()> {
     let mut conn = pool.acquire().await?;
 
     match node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO mixnode_packet_stats_raw (
                     mix_id, timestamp_utc, packets_received, packets_sent, packets_dropped
                 ) VALUES (?, ?, ?, ?, ?)
                 "#,
-                node_id,
+                mix_id,
                 timestamp_utc,
                 stats.packets_received,
                 stats.packets_sent,
@@ -30,7 +29,8 @@ pub(crate) async fn insert_node_packet_stats(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             sqlx::query!(
                 r#"
                 INSERT INTO nym_nodes_packet_stats_raw (
@@ -60,7 +60,7 @@ pub(crate) async fn get_raw_node_stats(
     let packets = match node.node_kind {
         // if no packets are found, it's fine to assume 0 because that's also
         // SQL default value if none provided
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query_as!(
                 NodeStats,
                 r#"
@@ -73,12 +73,13 @@ pub(crate) async fn get_raw_node_stats(
                 ORDER BY timestamp_utc DESC
                 LIMIT 1 OFFSET 1
                 "#,
-                node.node_id
+                mix_id
             )
             .fetch_optional(&mut *conn)
             .await?
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             sqlx::query_as!(
                 NodeStats,
                 r#"
@@ -91,7 +92,7 @@ pub(crate) async fn get_raw_node_stats(
                 ORDER BY timestamp_utc DESC
                 LIMIT 1 OFFSET 1
                 "#,
-                node.node_id
+                node_id
             )
             .fetch_optional(&mut *conn)
             .await?
@@ -110,7 +111,7 @@ pub(crate) async fn insert_daily_node_stats(
     let mut conn = pool.acquire().await?;
 
     match node.node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             let total_stake = sqlx::query_scalar!(
                 r#"
                     SELECT
@@ -118,7 +119,7 @@ pub(crate) async fn insert_daily_node_stats(
                     FROM mixnodes
                     WHERE mix_id = ?
                    "#,
-                node.node_id
+                mix_id
             )
             .fetch_one(&mut *conn)
             .await?;
@@ -136,7 +137,7 @@ pub(crate) async fn insert_daily_node_stats(
                     packets_sent = mixnode_daily_stats.packets_sent + excluded.packets_sent,
                     packets_dropped = mixnode_daily_stats.packets_dropped + excluded.packets_dropped
                 "#,
-                node.node_id,
+                mix_id,
                 date_utc,
                 total_stake,
                 packets.packets_received,
@@ -146,7 +147,8 @@ pub(crate) async fn insert_daily_node_stats(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             let total_stake = sqlx::query_scalar!(
                 r#"
                 SELECT
@@ -154,7 +156,7 @@ pub(crate) async fn insert_daily_node_stats(
                 FROM nym_nodes
                 WHERE node_id = ?
                 "#,
-                node.node_id
+                node_id
             )
             .fetch_one(&mut *conn)
             .await?;
@@ -172,7 +174,7 @@ pub(crate) async fn insert_daily_node_stats(
                     packets_sent = nym_node_daily_mixing_stats.packets_sent + excluded.packets_sent,
                     packets_dropped = nym_node_daily_mixing_stats.packets_dropped + excluded.packets_dropped
                 "#,
-                node.node_id,
+                node_id,
                 date_utc,
                 total_stake,
                 packets.packets_received,

nym-node-status-api/nym-node-status-api/src/db/queries/scraper.rs

@@ -1,6 +1,6 @@
 use crate::{
     db::{
-        models::{MixingNodeKind, ScraperNodeInfo},
+        models::{ScrapeNodeKind, ScraperNodeInfo},
         queries, DbPool,
     },
     mixnet_scraper::helpers::NodeDescriptionResponse,
@@ -8,16 +8,36 @@ use crate::{
 use anyhow::Result;
 use chrono::Utc;
 
-pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperNodeInfo>> {
+pub(crate) async fn get_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperNodeInfo>> {
     let mut nodes_to_scrape = Vec::new();
 
+    let mixnode_ids = queries::get_all_mix_ids(pool).await?;
+    let gateway_keys = queries::get_all_gateway_id_keys(pool).await?;
+
+    let mut entry_exit_nodes = 0;
     queries::get_nym_nodes(pool)
         .await?
         .into_iter()
         .for_each(|node| {
+            // due to polyfilling, Nym nodes table might contain legacy mixnodes
+            // as well. Mark them as such here.
+            let node_kind = if mixnode_ids.contains(&node.node_id.into()) {
+                ScrapeNodeKind::LegacyMixnode {
+                    mix_id: node.node_id.into(),
+                }
+            } else if gateway_keys.contains(&node.ed25519_identity_pubkey.to_base58_string()) {
+                entry_exit_nodes += 1;
+                ScrapeNodeKind::EntryExitNymNode {
+                    node_id: node.node_id.into(),
+                    identity_key: node.ed25519_identity_pubkey.to_base58_string(),
+                }
+            } else {
+                ScrapeNodeKind::MixingNymNode {
+                    node_id: node.node_id.into(),
+                }
+            };
             nodes_to_scrape.push(ScraperNodeInfo {
-                node_id: node.node_id.into(),
-                node_kind: MixingNodeKind::NymNode,
+                node_kind,
                 hosts: node
                     .ip_addresses
                     .into_iter()
@@ -27,7 +47,8 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
             })
         });
 
-    tracing::debug!("Fetched {} 🌟 nym nodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🌟 total nym nodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🚪 entry/exit nodes", entry_exit_nodes);
 
     let mut conn = pool.acquire().await?;
     let mixnodes = sqlx::query!(
@@ -41,7 +62,7 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     .await?;
     drop(conn);
 
-    tracing::debug!("Fetched {} 🦖 mixnodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🦖 mixnodes", mixnodes.len());
 
     let mut duplicates = 0;
     let mut legacy_not_in_nym_node_list = 0;
@@ -49,26 +70,22 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     for mixnode in mixnodes {
         if nodes_to_scrape
             .iter()
-            .all(|node| node.node_id != mixnode.node_id)
+            .all(|node| node.node_id() != &mixnode.node_id)
         {
+            // in case polyfilling on Nym API gets removed, this part ensures
+            // mixnodes are added to the final list of nodes to scrape
+            nodes_to_scrape.push(ScraperNodeInfo {
+                node_kind: ScrapeNodeKind::LegacyMixnode {
+                    mix_id: mixnode.node_id,
+                },
+                hosts: vec![mixnode.host],
+                http_api_port: mixnode.http_api_port,
+            });
+
             legacy_not_in_nym_node_list += 1;
         } else {
             duplicates += 1;
         }
-
-        // technically, mixnodes shouldn't be in nym_nodes table, but it's
-        // possible due to polyfilling on Nym API
-        if nodes_to_scrape
-            .iter()
-            .all(|node| node.node_id != mixnode.node_id)
-        {
-            nodes_to_scrape.push(ScraperNodeInfo {
-                node_id: mixnode.node_id,
-                node_kind: MixingNodeKind::LegacyMixnode,
-                hosts: vec![mixnode.host],
-                http_api_port: mixnode.http_api_port,
-            })
-        }
     }
     tracing::debug!(
         "{}/{} legacy mixnodes already included in nym_node list",
@@ -85,19 +102,16 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     Ok(nodes_to_scrape)
 }
 
-// TODO: add stuff for gateways
-
 pub(crate) async fn insert_scraped_node_description(
     pool: &DbPool,
-    node_kind: &MixingNodeKind,
-    node_id: i64,
+    node_kind: &ScrapeNodeKind,
     description: &NodeDescriptionResponse,
 ) -> Result<()> {
     let timestamp = Utc::now().timestamp();
     let mut conn = pool.acquire().await?;
 
     match node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO mixnode_description (
@@ -110,7 +124,7 @@ pub(crate) async fn insert_scraped_node_description(
                     details = excluded.details,
                     last_updated_utc = excluded.last_updated_utc
                 "#,
-                node_id,
+                mix_id,
                 description.moniker,
                 description.website,
                 description.security_contact,
@@ -120,7 +134,7 @@ pub(crate) async fn insert_scraped_node_description(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO nym_node_descriptions (
@@ -143,6 +157,34 @@ pub(crate) async fn insert_scraped_node_description(
             .execute(&mut *conn)
             .await?;
         }
+        ScrapeNodeKind::EntryExitNymNode { identity_key, .. } => {
+            sqlx::query!(
+                r#"
+            INSERT INTO gateway_description (
+                gateway_identity_key,
+                moniker,
+                website,
+                security_contact,
+                details,
+                last_updated_utc
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            ON CONFLICT (gateway_identity_key) DO UPDATE SET
+                moniker = excluded.moniker,
+                website = excluded.website,
+                security_contact = excluded.security_contact,
+                details = excluded.details,
+                last_updated_utc = excluded.last_updated_utc
+            "#,
+                identity_key,
+                description.moniker,
+                description.website,
+                description.security_contact,
+                description.details,
+                timestamp,
+            )
+            .execute(&mut *conn)
+            .await?;
+        }
     }
 
     Ok(())

nym-node-status-api/nym-node-status-api/src/http/api/mixnodes.rs

@@ -99,7 +99,10 @@ async fn get_stats(
     Query(MixStatsQueryParams { offset }): Query<MixStatsQueryParams>,
     State(state): State<AppState>,
 ) -> HttpResult<Json<Vec<DailyStats>>> {
-    let offset = offset.unwrap_or(0);
+    let offset: usize = offset
+        .unwrap_or(0)
+        .try_into()
+        .map_err(|_| HttpError::invalid_input("Offset must be non-negative"))?;
     let last_30_days = state
         .cache()
         .get_mixnode_stats(state.db_pool(), offset)

nym-node-status-api/nym-node-status-api/src/http/server.rs

@@ -17,18 +17,10 @@ pub(crate) async fn start_http_api(
     nym_http_cache_ttl: u64,
     agent_key_list: Vec<PublicKey>,
     agent_max_count: i64,
-    hm_url: String,
 ) -> anyhow::Result<ShutdownHandles> {
     let router_builder = RouterBuilder::with_default_routes();
 
-    let state = AppState::new(
-        db_pool,
-        nym_http_cache_ttl,
-        agent_key_list,
-        agent_max_count,
-        hm_url,
-    )
-    .await;
+    let state = AppState::new(db_pool, nym_http_cache_ttl, agent_key_list, agent_max_count).await;
     let router = router_builder.with_state(state);
 
     let bind_addr = format!("0.0.0.0:{}", http_port);

nym-node-status-api/nym-node-status-api/src/http/state.rs

@@ -25,11 +25,10 @@ impl AppState {
         cache_ttl: u64,
         agent_key_list: Vec<PublicKey>,
         agent_max_count: i64,
-        hm_url: String,
     ) -> Self {
         Self {
             db_pool,
-            cache: HttpCache::new(cache_ttl, hm_url).await,
+            cache: HttpCache::new(cache_ttl).await,
             agent_key_list,
             agent_max_count,
         }
@@ -52,96 +51,14 @@ impl AppState {
     }
 }
 
-#[derive(Debug, Clone)]
-struct HistoricMixingStats {
-    historic_stats: Vec<DailyStats>,
-}
-
-impl HistoricMixingStats {
-    /// Collect historic stats only on initialization. From this point onwards,
-    /// service will collect its own stats
-    async fn init(hm_url: String) -> Self {
-        tracing::info!("Fetching historic mixnode stats from {}", hm_url);
-
-        let target_url = format!("{}/v2/mixnodes/stats", hm_url);
-        if let Ok(response) = reqwest::get(&target_url)
-            .await
-            .and_then(|res| res.error_for_status())
-            .inspect_err(|err| tracing::error!("Failed to fetch cache from HM: {}", err))
-        {
-            if let Ok(mut daily_stats) = response.json::<Vec<DailyStats>>().await {
-                // sorting required for seamless comparison later (descending, newest first)
-                daily_stats.sort_by(|left, right| right.date_utc.cmp(&left.date_utc));
-
-                tracing::info!(
-                    "Successfully fetched {} historic entries from {}",
-                    daily_stats.len(),
-                    hm_url
-                );
-                return Self {
-                    historic_stats: daily_stats,
-                };
-            }
-        };
-
-        tracing::warn!("Failed to get historic daily stats from {}", hm_url);
-        Self {
-            historic_stats: Vec::new(),
-        }
-    }
-
-    /// polyfill with historical data obtained from Harbour Master
-    fn merge_with_historic_stats(&self, mut new_stats: Vec<DailyStats>) -> Vec<DailyStats> {
-        // newest first
-        new_stats.sort_by(|left, right| right.date_utc.cmp(&left.date_utc));
-
-        // historic stats are only used for dates when we don't have new data
-        let oldest_date_in_new_stats = new_stats
-            .last()
-            .map(|day| day.date_utc.to_owned())
-            .unwrap_or(String::from("1900-01-01"));
-
-        // given 2 arrays
-        // index    historic_stats      new_stats
-        //   0        30-01               31-01
-        //   1        29-01               30-01
-        //   2        28-01
-        //            ...
-        //   N        01-01
-        // cutoff point would be at historic_stats[1]
-        // (first date smaller than oldest we've already got)
-        if let Some(cutoff) = self
-            .historic_stats
-            .iter()
-            .position(|elem| elem.date_utc < oldest_date_in_new_stats)
-        {
-            // missing data = (all historic data) - (however many days we already have)
-            let missing_data = self.historic_stats.iter().skip(cutoff).cloned();
-
-            // extend new data with missing days
-            tracing::debug!(
-                "Polyfilled with {} historic records from {:?} to {:?}",
-                missing_data.len(),
-                self.historic_stats.last(),
-                self.historic_stats.get(cutoff)
-            );
-            new_stats.extend(missing_data);
-
-            // oldest first
-            new_stats.into_iter().rev().collect::<Vec<_>>()
-        } else {
-            // if all historic data is older than what we've got, don't use it
-            new_stats
-        }
-    }
-}
-
 static GATEWAYS_LIST_KEY: &str = "gateways";
 static MIXNODES_LIST_KEY: &str = "mixnodes";
 static MIXSTATS_LIST_KEY: &str = "mixstats";
 static SUMMARY_HISTORY_LIST_KEY: &str = "summary-history";
 static SESSION_STATS_LIST_KEY: &str = "session-stats";
 
+const MIXNODE_STATS_HISTORY_DAYS: usize = 30;
+
 #[derive(Debug, Clone)]
 pub(crate) struct HttpCache {
     gateways: Cache<String, Arc<RwLock<Vec<Gateway>>>>,
@@ -149,11 +66,10 @@ pub(crate) struct HttpCache {
     mixstats: Cache<String, Arc<RwLock<Vec<DailyStats>>>>,
     history: Cache<String, Arc<RwLock<Vec<SummaryHistory>>>>,
     session_stats: Cache<String, Arc<RwLock<Vec<SessionStats>>>>,
-    mixnode_historic_daily_stats: HistoricMixingStats,
 }
 
 impl HttpCache {
-    pub async fn new(ttl_seconds: u64, hm_url: String) -> Self {
+    pub async fn new(ttl_seconds: u64) -> Self {
         HttpCache {
             gateways: Cache::builder()
                 .max_capacity(2)
@@ -175,7 +91,6 @@ impl HttpCache {
                 .max_capacity(2)
                 .time_to_live(Duration::from_secs(ttl_seconds))
                 .build(),
-            mixnode_historic_daily_stats: HistoricMixingStats::init(hm_url).await,
         }
     }
 
@@ -285,26 +200,27 @@ impl HttpCache {
             .await
     }
 
-    pub async fn get_mixnode_stats(&self, db: &DbPool, offset: i64) -> Vec<DailyStats> {
-        match self.mixstats.get(MIXSTATS_LIST_KEY).await {
+    pub async fn get_mixnode_stats(&self, db: &DbPool, offset: usize) -> Vec<DailyStats> {
+        let mut stats = match self.mixstats.get(MIXSTATS_LIST_KEY).await {
             Some(guard) => {
                 let read_lock = guard.read().await;
                 read_lock.to_vec()
             }
             None => {
-                let new_node_stats = crate::db::queries::get_daily_stats(db, offset)
+                let new_node_stats = crate::db::queries::get_daily_stats(db)
                     .await
-                    .unwrap_or_default();
-                // for every day that's missing, fill it with cached historic data
-                let mut mixnode_stats = self
-                    .mixnode_historic_daily_stats
-                    .merge_with_historic_stats(new_node_stats);
-                mixnode_stats.truncate(30);
-
-                self.upsert_mixnode_stats(mixnode_stats.clone()).await;
-                mixnode_stats
+                    .unwrap_or_default()
+                    .into_iter()
+                    .rev()
+                    .collect::<Vec<_>>();
+                // cache result without offset
+                self.upsert_mixnode_stats(new_node_stats.clone()).await;
+                new_node_stats
             }
-        }
+        };
+
+        stats.truncate(MIXNODE_STATS_HISTORY_DAYS + offset);
+        stats.into_iter().skip(offset).rev().collect()
     }
 
     pub async fn get_summary_history(&self, db: &DbPool) -> Vec<SummaryHistory> {

nym-node-status-api/nym-node-status-api/src/logging.rs

@@ -34,6 +34,8 @@ pub(crate) fn setup_tracing_logger() -> anyhow::Result<()> {
         "tower_http",
         "axum",
         "html5ever",
+        "hickory_proto",
+        "hickory_resolver",
     ];
     for crate_name in warn_crates {
         filter = filter.add_directive(directive_checked(format!("{}=warn", crate_name))?);

nym-node-status-api/nym-node-status-api/src/main.rs

@@ -10,6 +10,7 @@ mod mixnet_scraper;
 mod monitor;
 mod node_scraper;
 mod testruns;
+mod utils;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -66,7 +67,6 @@ async fn main() -> anyhow::Result<()> {
         args.nym_http_cache_ttl,
         agent_key_list.to_owned(),
         args.max_agent_count,
-        args.hm_url,
     )
     .await
     .expect("Failed to start server");

nym-node-status-api/nym-node-status-api/src/mixnet_scraper/helpers.rs

@@ -1,12 +1,15 @@
-use crate::db::{
-    models::{NodeStats, ScraperNodeInfo},
-    queries::{
-        get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
-        insert_scraped_node_description,
+use crate::{
+    db::{
+        models::{NodeStats, ScraperNodeInfo},
+        queries::{
+            get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
+            insert_scraped_node_description,
+        },
     },
+    utils::generate_node_name,
 };
 use ammonia::Builder;
-use anyhow::Result;
+use anyhow::{anyhow, Result};
 use chrono::{DateTime, Datelike, Utc};
 use reqwest;
 use serde::{Deserialize, Serialize};
@@ -80,22 +83,33 @@ pub fn build_client() -> Result<reqwest::Client> {
         .map_err(|e| anyhow::anyhow!("Failed to build HTTP client: {}", e))
 }
 
-pub fn sanitize_description(description: NodeDescriptionResponse) -> NodeDescriptionResponse {
+pub fn sanitize_description(
+    description: NodeDescriptionResponse,
+    node_id: i64,
+) -> NodeDescriptionResponse {
     let mut sanitizer = Builder::new();
     sanitizer
         .tags(std::collections::HashSet::new())
         .generic_attributes(std::collections::HashSet::new())
         .url_schemes(std::collections::HashSet::new());
 
+    const UNKNOWN: &str = "N/A";
     let sanitize_field = |opt: Option<String>| -> Option<String> {
         Some(
             opt.filter(|s| !s.trim().is_empty())
-                .map_or_else(|| "N/A".to_string(), |s| sanitizer.clean(&s).to_string()),
+                .map_or_else(|| UNKNOWN.to_string(), |s| sanitizer.clean(&s).to_string()),
         )
     };
 
+    let mut moniker = sanitize_field(description.moniker);
+    if let Some(sanitized) = &moniker {
+        if sanitized == UNKNOWN {
+            moniker = Some(generate_node_name(node_id));
+        }
+    };
+
     NodeDescriptionResponse {
-        moniker: sanitize_field(description.moniker),
+        moniker,
         website: sanitize_field(description.website),
         security_contact: sanitize_field(description.security_contact),
         details: sanitize_field(description.details),
@@ -108,18 +122,26 @@ pub async fn scrape_and_store_description(pool: &SqlitePool, node: &ScraperNodeI
 
     let mut description = None;
     let mut error = None;
+    let mut tried_url_list = Vec::new();
 
     for mut url in urls {
         url = format!("{}{}", url.trim_end_matches('/'), DESCRIPTION_URL);
+        tried_url_list.push(url.clone());
 
-        match client.get(&url).send().await {
+        match client
+            .get(&url)
+            .send()
+            .await
+            // convert 404 and similar to error
+            .and_then(|res| res.error_for_status())
+        {
             Ok(response) => {
                 if let Ok(desc) = response.json::<NodeDescriptionResponse>().await {
                     description = Some(desc);
                     break;
                 }
             }
-            Err(e) => error = Some(e),
+            Err(e) => error = Some(anyhow!("{:?} ({})", tried_url_list, e)),
         }
     }
 
@@ -128,9 +150,8 @@ pub async fn scrape_and_store_description(pool: &SqlitePool, node: &ScraperNodeI
         anyhow::anyhow!("Failed to fetch description from any URL: {}", err_msg)
     })?;
 
-    let sanitized_description = sanitize_description(description);
-    insert_scraped_node_description(pool, &node.node_kind, node.node_id, &sanitized_description)
-        .await?;
+    let sanitized_description = sanitize_description(description, *node.node_id());
+    insert_scraped_node_description(pool, &node.node_kind, &sanitized_description).await?;
 
     Ok(())
 }
@@ -144,9 +165,11 @@ pub async fn scrape_and_store_packet_stats(
 
     let mut stats = None;
     let mut error = None;
+    let mut tried_url_list = Vec::new();
 
     for mut url in urls {
         url = format!("{}{}", url.trim_end_matches('/'), PACKET_STATS_URL);
+        tried_url_list.push(url.clone());
 
         match client.get(&url).send().await {
             Ok(response) => {
@@ -155,18 +178,18 @@ pub async fn scrape_and_store_packet_stats(
                     break;
                 }
             }
-            Err(e) => error = Some(e),
+            Err(e) => error = Some(anyhow!("{:?} ({})", tried_url_list, e)),
         }
     }
 
     let stats = stats.ok_or_else(|| {
         let err_msg = error.map_or_else(|| "Unknown error".to_string(), |e| e.to_string());
-        anyhow::anyhow!("Failed to fetch stats from any URL: {}", err_msg)
+        anyhow::anyhow!("Failed to fetch description from any URL: {}", err_msg)
     })?;
 
     let timestamp = Utc::now();
     let timestamp_utc = timestamp.timestamp();
-    insert_node_packet_stats(pool, node.node_id, &node.node_kind, &stats, timestamp_utc).await?;
+    insert_node_packet_stats(pool, &node.node_kind, &stats, timestamp_utc).await?;
 
     // Update daily stats
     update_daily_stats(pool, node, timestamp, &stats).await?;

nym-node-status-api/nym-node-status-api/src/mixnet_scraper/mod.rs

@@ -8,7 +8,7 @@ use sqlx::SqlitePool;
 use tracing::{debug, error, instrument, warn};
 
 use crate::db::models::ScraperNodeInfo;
-use crate::db::queries::get_mixing_nodes_for_scraping;
+use crate::db::queries::get_nodes_for_scraping;
 
 const DESCRIPTION_SCRAPE_INTERVAL: Duration = Duration::from_secs(60 * 60 * 4);
 const PACKET_SCRAPE_INTERVAL: Duration = Duration::from_secs(60 * 60);
@@ -74,7 +74,7 @@ impl Scraper {
         pool: &SqlitePool,
         queue: Arc<Mutex<Vec<ScraperNodeInfo>>>,
     ) -> Result<()> {
-        let nodes = get_mixing_nodes_for_scraping(pool).await?;
+        let nodes = get_nodes_for_scraping(pool).await?;
         if let Ok(mut queue_lock) = queue.lock() {
             queue_lock.extend(nodes);
         } else {
@@ -82,7 +82,7 @@ impl Scraper {
             return Ok(());
         }
 
-        Self::process_description_queue(pool, queue).await?;
+        Self::process_description_queue(pool, queue).await;
         Ok(())
     }
 
@@ -91,7 +91,7 @@ impl Scraper {
         pool: &SqlitePool,
         queue: Arc<Mutex<Vec<ScraperNodeInfo>>>,
     ) -> Result<()> {
-        let nodes = get_mixing_nodes_for_scraping(pool).await?;
+        let nodes = get_nodes_for_scraping(pool).await?;
         tracing::info!("Querying {} mixing nodes", nodes.len());
         if let Ok(mut queue_lock) = queue.lock() {
             queue_lock.extend(nodes);
@@ -100,14 +100,11 @@ impl Scraper {
             return Ok(());
         }
 
-        Self::process_packet_queue(pool, queue).await?;
+        Self::process_packet_queue(pool, queue).await;
         Ok(())
     }
 
-    async fn process_description_queue(
-        pool: &SqlitePool,
-        queue: Arc<Mutex<Vec<ScraperNodeInfo>>>,
-    ) -> Result<()> {
+    async fn process_description_queue(pool: &SqlitePool, queue: Arc<Mutex<Vec<ScraperNodeInfo>>>) {
         loop {
             let running_tasks = TASK_COUNTER.load(Ordering::Relaxed);
 
@@ -132,12 +129,15 @@ impl Scraper {
                 tokio::spawn(async move {
                     match scrape_and_store_description(&pool, &node).await {
                         Ok(_) => debug!(
-                            "✅ Description task #{} for node {} complete",
-                            task_id, node.node_id
+                            "📝 ✅ Description task #{} for node {} complete",
+                            task_id,
+                            node.node_id()
                         ),
                         Err(e) => debug!(
-                            "❌ Description task #{} for node {} failed: {}",
-                            task_id, node.node_id, e
+                            "📝 ❌ Description task #{} for node {} failed: {}",
+                            task_id,
+                            node.node_id(),
+                            e
                         ),
                     }
                     TASK_COUNTER.fetch_sub(1, Ordering::Relaxed);
@@ -146,13 +146,9 @@ impl Scraper {
                 tokio::time::sleep(QUEUE_CHECK_INTERVAL).await;
             }
         }
-        Ok(())
     }
 
-    async fn process_packet_queue(
-        pool: &SqlitePool,
-        queue: Arc<Mutex<Vec<ScraperNodeInfo>>>,
-    ) -> Result<()> {
+    async fn process_packet_queue(pool: &SqlitePool, queue: Arc<Mutex<Vec<ScraperNodeInfo>>>) {
         loop {
             let running_tasks = TASK_COUNTER.load(Ordering::Relaxed);
 
@@ -177,12 +173,15 @@ impl Scraper {
                 tokio::spawn(async move {
                     match scrape_and_store_packet_stats(&pool, &node).await {
                         Ok(_) => debug!(
-                            "✅ Packet stats task #{} for node {} complete",
-                            task_id, node.node_id
+                            "📊 ✅ Packet stats task #{} for node {} complete",
+                            task_id,
+                            node.node_id()
                         ),
                         Err(e) => debug!(
-                            "❌ Packet stats task #{} for node {} failed: {}",
-                            task_id, node.node_id, e
+                            "📊 ❌ Packet stats task #{} for node {} failed: {}",
+                            task_id,
+                            node.node_id(),
+                            e
                         ),
                     }
                     TASK_COUNTER.fetch_sub(1, Ordering::Relaxed);
@@ -191,6 +190,5 @@ impl Scraper {
                 tokio::time::sleep(QUEUE_CHECK_INTERVAL).await;
             }
         }
-        Ok(())
     }
 }

nym-node-status-api/nym-node-status-api/src/monitor/mod.rs

@@ -1,14 +1,14 @@
 #![allow(deprecated)]
 
 use crate::db::models::{
-    gateway, mixnode, GatewayRecord, MixnodeRecord, NetworkSummary, ASSIGNED_ENTRY_COUNT,
+    gateway, mixnode, GatewayInsertRecord, MixnodeRecord, NetworkSummary, ASSIGNED_ENTRY_COUNT,
     ASSIGNED_EXIT_COUNT, ASSIGNED_MIXING_COUNT, GATEWAYS_BONDED_COUNT, GATEWAYS_HISTORICAL_COUNT,
     MIXNODES_HISTORICAL_COUNT, MIXNODES_LEGACY_COUNT, NYMNODES_DESCRIBED_COUNT, NYMNODE_COUNT,
 };
 use crate::db::{queries, DbPool};
 use crate::monitor::geodata::{Location, NodeGeoData};
+use crate::utils::{decimal_to_i64, LogError, NumericalCheckedCast};
 use anyhow::anyhow;
-use cosmwasm_std::Decimal;
 use moka::future::Cache;
 use nym_network_defaults::NymNetworkDetails;
 use nym_validator_client::client::{NodeId, NymApiClientExt};
@@ -29,7 +29,6 @@ pub(crate) use geodata::IpInfoClient;
 
 mod geodata;
 
-// TODO dz should be configurable
 const FAILURE_RETRY_DELAY: Duration = Duration::from_secs(60);
 
 static DELEGATION_PROGRAM_WALLET: &str = "n1rnxpdpx3kldygsklfft0gech7fhfcux4zst5lw";
@@ -109,7 +108,11 @@ impl Monitor {
 
         let gateways = described_nodes
             .iter()
-            .filter(|node| node.description.declared_role.entry)
+            .filter(|node| {
+                node.description.declared_role.entry
+                    || node.description.declared_role.exit_ipr
+                    || node.description.declared_role.exit_nr
+            })
             .collect::<Vec<_>>();
 
         let bonded_node_info = api_client
@@ -120,6 +123,8 @@ impl Monitor {
             // for faster reads
             .collect::<HashMap<_, _>>();
 
+        tracing::info!("🟣 bonded_nodes: {}", bonded_node_info.len());
+
         let nym_nodes = api_client
             .get_all_basic_nodes()
             .await
@@ -198,10 +203,11 @@ impl Monitor {
         let gateway_records = self.prepare_gateway_data(&gateways, gateway_geodata, &nym_nodes)?;
 
         let pool = self.db_pool.clone();
+        let gateways_count = gateway_records.len();
         queries::insert_gateways(&pool, gateway_records)
             .await
             .map(|_| {
-                tracing::debug!("Gateway info written to DB!");
+                tracing::debug!("{} gateway records written to DB!", gateways_count);
             })?;
 
         let mixnode_records = self.prepare_mixnode_data(
@@ -209,10 +215,11 @@ impl Monitor {
             mixnodes_described,
             delegation_program_members,
         )?;
+        let mixnodes_count = mixnode_records.len();
         queries::insert_mixnodes(&pool, mixnode_records)
             .await
             .map(|_| {
-                tracing::debug!("Mixnode info written to DB!");
+                tracing::debug!("{} mixnode info written to DB!", mixnodes_count);
             })?;
 
         let (all_historical_gateways, all_historical_mixnodes) = calculate_stats(&pool).await?;
@@ -299,13 +306,13 @@ impl Monitor {
 
     fn prepare_gateway_data(
         &self,
-        gateways: &[&NymNodeDescription],
+        described_gateways: &[&NymNodeDescription],
         gateway_geodata: Vec<NodeGeoData>,
         skimmed_gateways: &[SkimmedNode],
-    ) -> anyhow::Result<Vec<GatewayRecord>> {
+    ) -> anyhow::Result<Vec<GatewayInsertRecord>> {
         let mut gateway_records = Vec::new();
 
-        for gateway in gateways {
+        for gateway in described_gateways {
             let identity_key = gateway.ed25519_identity_key().to_base58_string();
             let bonded = true;
             let last_updated_utc = chrono::offset::Utc::now().timestamp();
@@ -329,7 +336,7 @@ impl Monitor {
                 .unwrap_or_default()
                 .round_to_integer();
 
-            gateway_records.push(GatewayRecord {
+            gateway_records.push(GatewayInsertRecord {
                 identity_key: identity_key.to_owned(),
                 bonded,
                 self_described,
@@ -400,33 +407,6 @@ impl Monitor {
     }
 }
 
-// TODO dz is there a common monorepo place this can be put?
-pub trait NumericalCheckedCast<T>
-where
-    T: TryFrom<Self>,
-    <T as TryFrom<Self>>::Error: std::error::Error,
-    Self: std::fmt::Display + Copy,
-{
-    fn cast_checked(self) -> anyhow::Result<T> {
-        T::try_from(self).map_err(|e| {
-            anyhow::anyhow!(
-                "Couldn't cast {} to {}: {}",
-                self,
-                std::any::type_name::<T>(),
-                e
-            )
-        })
-    }
-}
-
-impl<T, U> NumericalCheckedCast<U> for T
-where
-    U: TryFrom<T>,
-    <U as TryFrom<T>>::Error: std::error::Error,
-    T: std::fmt::Display + Copy,
-{
-}
-
 async fn calculate_stats(pool: &DbPool) -> anyhow::Result<(usize, usize)> {
     let mut conn = pool.acquire().await?;
 
@@ -464,39 +444,3 @@ async fn get_delegation_program_details(
 
     Ok(mix_ids)
 }
-
-pub(crate) fn decimal_to_i64(decimal: Decimal) -> i64 {
-    // Convert the underlying Uint128 to a u128
-    let atomics = decimal.atomics().u128();
-    let precision = 1_000_000_000_000_000_000u128;
-
-    // Get the fractional part
-    let fractional = atomics % precision;
-
-    // Get the integer part
-    let integer = atomics / precision;
-
-    // Combine them into a float
-    let float_value = integer as f64 + (fractional as f64 / 1_000_000_000_000_000_000_f64);
-
-    // Limit to 6 decimal places
-    let rounded_value = (float_value * 1_000_000.0).round() / 1_000_000.0;
-
-    rounded_value as i64
-}
-
-trait LogError<T, E> {
-    fn log_error(self, msg: &str) -> Result<T, E>;
-}
-
-impl<T, E> LogError<T, E> for anyhow::Result<T, E>
-where
-    E: std::error::Error,
-{
-    fn log_error(self, msg: &str) -> Result<T, E> {
-        if let Err(e) = &self {
-            tracing::error!("[{msg}]:\t{e}");
-        }
-        self
-    }
-}

nym-node-status-api/nym-node-status-api/src/node_scraper/mod.rs

@@ -17,15 +17,14 @@ use tracing::instrument;
 mod error;
 
 const FAILURE_RETRY_DELAY: Duration = Duration::from_secs(60);
-const REFRESH_INTERVAL: Duration = Duration::from_secs(60 * 60 * 6); //6h, data only update once a day
+const REFRESH_INTERVAL: Duration = Duration::from_secs(60 * 60 * 6);
 const STALE_DURATION: Duration = Duration::from_secs(86400 * 365); //one year
 
-#[instrument(level = "debug", name = "node_scraper", skip_all)]
+#[instrument(level = "info", name = "metrics_scraper", skip_all)]
 pub(crate) async fn spawn_in_background(db_pool: DbPool, nym_api_client_timeout: Duration) {
     let network_defaults = nym_network_defaults::NymNetworkDetails::new_from_env();
 
     loop {
-        //No graceful shutdown?
         tracing::info!("Refreshing node self-described metrics...");
 
         if let Err(e) = run(&db_pool, &network_defaults, nym_api_client_timeout).await {
@@ -123,7 +122,7 @@ impl MetricsScrapingData {
         }
     }
 
-    #[instrument(level = "debug", name = "metrics_scraper", skip_all)]
+    #[instrument(level = "info", name = "metrics_scraper", skip_all)]
     async fn try_scrape_metrics(&self) -> Option<SessionStats> {
         match self.try_get_client().await {
             Ok(client) => {

nym-node-status-api/nym-node-status-api/src/utils.rs

@@ -0,0 +1,104 @@
+use cosmwasm_std::Decimal;
+use itertools::Itertools;
+use rand::prelude::SliceRandom;
+use rand::SeedableRng;
+
+// pub(crate) fn generate_node_name(identity: ed25519::PublicKey) -> String {
+pub(crate) fn generate_node_name(node_id: i64) -> String {
+    let seed = {
+        let node_id_bytes = node_id.to_le_bytes();
+        let mut seed = [0u8; 32];
+        for i in 0..4 {
+            seed[i * 8..(i + 1) * 8].copy_from_slice(&node_id_bytes);
+        }
+        seed
+    };
+    let mut rng = rand_chacha::ChaCha20Rng::from_seed(seed);
+    let words = bip39::Language::English.word_list();
+    words.choose_multiple(&mut rng, 3).join(" ")
+}
+
+#[allow(clippy::items_after_test_module)]
+#[cfg(test)]
+mod test {
+    use rand::Rng;
+
+    use super::*;
+
+    #[test]
+    fn generate_node_name_should_be_deterministic() {
+        let mut rng = rand::thread_rng();
+
+        let node_id: i64 = rng.gen();
+        let different_node_id: i64 = rng.gen();
+
+        let node_name = generate_node_name(node_id);
+        let node_name_different = generate_node_name(different_node_id);
+        assert_ne!(node_name, node_name_different);
+
+        let node_name_same = generate_node_name(node_id);
+        assert_eq!(node_name, node_name_same);
+    }
+}
+
+pub trait NumericalCheckedCast<T>
+where
+    T: TryFrom<Self>,
+    <T as TryFrom<Self>>::Error: std::error::Error,
+    Self: std::fmt::Display + Copy,
+{
+    fn cast_checked(self) -> anyhow::Result<T> {
+        T::try_from(self).map_err(|e| {
+            anyhow::anyhow!(
+                "Couldn't cast {} to {}: {}",
+                self,
+                std::any::type_name::<T>(),
+                e
+            )
+        })
+    }
+}
+
+impl<T, U> NumericalCheckedCast<U> for T
+where
+    U: TryFrom<T>,
+    <U as TryFrom<T>>::Error: std::error::Error,
+    T: std::fmt::Display + Copy,
+{
+}
+
+pub(crate) fn decimal_to_i64(decimal: Decimal) -> i64 {
+    // Convert the underlying Uint128 to a u128
+    let atomics = decimal.atomics().u128();
+    let precision = 1_000_000_000_000_000_000u128;
+
+    // Get the fractional part
+    let fractional = atomics % precision;
+
+    // Get the integer part
+    let integer = atomics / precision;
+
+    // Combine them into a float
+    let float_value = integer as f64 + (fractional as f64 / 1_000_000_000_000_000_000_f64);
+
+    // Limit to 6 decimal places
+    let rounded_value = (float_value * 1_000_000.0).round() / 1_000_000.0;
+
+    rounded_value as i64
+}
+
+pub(crate) trait LogError<T, E> {
+    fn log_error(self, msg: &str) -> Result<T, E>;
+}
+
+impl<T, E> LogError<T, E> for anyhow::Result<T, E>
+where
+    E: std::error::Error,
+{
+    fn log_error(self, msg: &str) -> Result<T, E> {
+        if let Err(e) = &self {
+            tracing::error!("[{msg}]:\t{e}");
+        }
+        self
+    }
+}

nym-node/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node"
-version = "1.6.0"
+version = "1.5.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node/src/config/gateway_tasks.rs

@@ -47,9 +47,6 @@ pub struct Debug {
     /// Number of messages from offline client that can be pulled at once (i.e. with a single SQL query) from the storage.
     pub message_retrieval_limit: i64,
 
-    /// The maximum number of client connections the gateway will keep open at once.
-    pub maximum_open_connections: usize,
-
     pub stale_messages: StaleMessageDebug,
 
     pub client_bandwidth: ClientBandwidthDebug,
@@ -59,14 +56,12 @@ pub struct Debug {
 
 impl Debug {
     const DEFAULT_MESSAGE_RETRIEVAL_LIMIT: i64 = 100;
-    const DEFAULT_MAXIMUM_OPEN_CONNECTIONS: usize = 8192;
 }
 
 impl Default for Debug {
     fn default() -> Self {
         Debug {
             message_retrieval_limit: Self::DEFAULT_MESSAGE_RETRIEVAL_LIMIT,
-            maximum_open_connections: Self::DEFAULT_MAXIMUM_OPEN_CONNECTIONS,
             stale_messages: Default::default(),
             client_bandwidth: Default::default(),
             zk_nym_tickets: Default::default(),

nym-node/src/config/helpers.rs

@@ -40,7 +40,6 @@ fn ephemeral_gateway_config(config: &Config) -> nym_gateway::config::Config {
                 .stale_messages
                 .cleaner_run_interval,
             stale_messages_max_age: config.gateway_tasks.debug.stale_messages.max_age,
-            maximum_open_connections: config.gateway_tasks.debug.maximum_open_connections,
             zk_nym_tickets: nym_gateway::config::ZkNymTicketHandlerDebug {
                 revocation_bandwidth_penalty: config
                     .gateway_tasks

nyx-chain-watcher/build.rs

@@ -1,13 +1,12 @@
 use anyhow::Result;
 use sqlx::{sqlite::SqliteConnectOptions, Connection, SqliteConnection};
+use std::env::var;
 use std::io::Write;
 use std::{collections::HashMap, fs::File, path::PathBuf, str::FromStr};
 
 #[tokio::main]
 async fn main() -> Result<()> {
-    let db_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-        .join(".build")
-        .join("nyx_chain_watcher.sqlite");
+    let db_path = PathBuf::from(var("OUT_DIR").unwrap()).join("nyx_chain_watcher.sqlite");
 
     // Create the database directory if it doesn't exist
     if let Some(parent) = db_path.parent() {

service-providers/network-requester/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.50"
+version = "1.1.49"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.70"

tools/nym-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.49"
+version = "1.1.48"
 authors.workspace = true
 edition = "2021"
 license.workspace = true

tools/nymvisor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.14"
+version = "0.1.13"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

wasm/zknym-lib/Cargo.toml

@@ -31,6 +31,7 @@ rand = { workspace = true }
 
 
 nym-bin-common = { path = "../../common/bin-common" }
+nym-coconut = { path = "../../common/nymcoconut", features = ["key-zeroize"] }
 nym-compact-ecash = { path = "../../common/nym_offline_compact_ecash" }
 nym-credentials = { path = "../../common/credentials" }
 nym-crypto = { path = "../../common/crypto", features = ["asymmetric", "rand"] }

wasm/zknym-lib/src/error.rs

@@ -7,6 +7,12 @@ use wasm_utils::wasm_error;
 
 #[derive(Debug, Error)]
 pub enum ZkNymError {
+    #[error("[coconut] cryptographic failure: {source}")]
+    CoconutFailure {
+        #[from]
+        source: nym_coconut::CoconutError,
+    },
+
     #[error("[ecash] cryptographic failure: {source}")]
     EcashFailure {
         #[from]

wasm/zknym-lib/src/generic_scheme/coconut/mod.rs

@@ -0,0 +1,338 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::coconut::types::{
+    BlindSignRequestData, BlindSignRequestWrapper, BlindedCredentialWrapper,
+    CredentialShareWrapper, CredentialWrapper, KeyPairWrapper, ParametersWrapper, ScalarsWrapper,
+    VerificationKeyShareWrapper, VerificationKeyWrapper, VerifyCredentialRequestWrapper,
+};
+use crate::error::ZkNymError;
+use crate::GLOBAL_COCONUT_PARAMS;
+use nym_coconut::{hash_to_scalar, Parameters, SignerIndex};
+use serde::{Deserialize, Serialize};
+use std::sync::OnceLock;
+use tsify::Tsify;
+use wasm_bindgen::prelude::wasm_bindgen;
+
+pub mod types;
+
+// works under the assumption of having 4 attributes in the underlying credential(s)
+const DEFAULT_ATTRIBUTES: u32 = 4;
+
+pub fn default_bandwidth_credential_params() -> &'static Parameters {
+    static BANDWIDTH_CREDENTIAL_PARAMS: OnceLock<Parameters> = OnceLock::new();
+    BANDWIDTH_CREDENTIAL_PARAMS.get_or_init(|| Parameters::new(DEFAULT_ATTRIBUTES).unwrap())
+}
+
+// attempt to extract appropriate system parameters in the following order:
+// 1. attempt to get explicit provided value
+// 2. then try a globally set value
+// 3. finally fallback to sane default: the bandwidth credential params
+pub(crate) fn get_params(explicit_params: &Option<ParametersWrapper>) -> &Parameters {
+    if let Some(explicit) = explicit_params.as_ref() {
+        return explicit;
+    }
+
+    if let Some(global) = GLOBAL_COCONUT_PARAMS.get() {
+        return global;
+    }
+
+    default_bandwidth_credential_params()
+}
+
+#[derive(Tsify, Debug, Copy, Clone, Serialize, Deserialize, Default)]
+#[tsify(into_wasm_abi, from_wasm_abi)]
+#[serde(rename_all = "camelCase")]
+pub struct SetupOpts {
+    #[tsify(optional)]
+    pub num_attributes: Option<u32>,
+
+    #[tsify(optional)]
+    pub set_global: Option<bool>,
+}
+
+#[wasm_bindgen(js_name = "coconutSetup")]
+pub fn setup(opts: SetupOpts) -> Result<ParametersWrapper, ZkNymError> {
+    let num_attributes = opts.num_attributes.unwrap_or(DEFAULT_ATTRIBUTES);
+
+    let params = nym_coconut::setup(num_attributes)?;
+
+    if let Some(true) = opts.set_global {
+        GLOBAL_COCONUT_PARAMS
+            .set(params.clone())
+            .map_err(|_| ZkNymError::GlobalParamsAlreadySet)?;
+    }
+
+    Ok(params.into())
+}
+
+#[wasm_bindgen(js_name = "coconutKeygen")]
+pub fn keygen(parameters: Option<ParametersWrapper>) -> KeyPairWrapper {
+    let params = get_params(&parameters);
+    nym_coconut::keygen(params).into()
+}
+
+#[derive(Tsify, Debug, Clone, Copy, Serialize, Deserialize)]
+#[tsify(into_wasm_abi, from_wasm_abi)]
+#[serde(rename_all = "camelCase")]
+pub struct TtpKeygenOpts {
+    pub threshold: u64,
+
+    pub authorities: u64,
+}
+
+#[wasm_bindgen(js_name = "coconutTtpKeygen")]
+pub fn ttp_keygen(
+    opts: TtpKeygenOpts,
+    parameters: Option<ParametersWrapper>,
+) -> Result<Vec<KeyPairWrapper>, ZkNymError> {
+    let params = get_params(&parameters);
+
+    let keys = nym_coconut::ttp_keygen(params, opts.threshold, opts.authorities)?;
+    Ok(keys.into_iter().map(Into::into).collect())
+}
+
+#[wasm_bindgen(js_name = "coconutSignSimple")]
+pub fn sign_simple(
+    attributes: Vec<String>,
+    keys: &KeyPairWrapper,
+) -> Result<CredentialWrapper, ZkNymError> {
+    let public_attributes = attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+    nym_coconut::sign(keys.secret_key(), &attributes_ref)
+        .map(Into::into)
+        .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutPrepareBlindSign")]
+pub fn prepare_blind_sign(
+    private_attributes: Vec<String>,
+    public_attributes: Vec<String>,
+    parameters: Option<ParametersWrapper>,
+) -> Result<BlindSignRequestData, ZkNymError> {
+    let params = get_params(&parameters);
+
+    let public_attributes = public_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let public_attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+    let private_attributes = private_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let private_attributes_ref = private_attributes.iter().collect::<Vec<_>>();
+    let (pedersen_commitments_openings, blind_sign_request) =
+        nym_coconut::prepare_blind_sign(params, &private_attributes_ref, &public_attributes_ref)?;
+
+    Ok(BlindSignRequestData {
+        blind_sign_request,
+        pedersen_commitments_openings,
+    })
+}
+
+#[wasm_bindgen(js_name = "coconutBlindSign")]
+pub fn blind_sign(
+    keys: &KeyPairWrapper,
+    blind_sign_request: &BlindSignRequestWrapper,
+    public_attributes: Vec<String>,
+    parameters: Option<ParametersWrapper>,
+) -> Result<BlindedCredentialWrapper, ZkNymError> {
+    let params = get_params(&parameters);
+
+    let public_attributes = public_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let public_attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+    nym_coconut::blind_sign(
+        params,
+        keys.secret_key(),
+        blind_sign_request,
+        &public_attributes_ref,
+    )
+    .map(Into::into)
+    .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutUnblindSignatureShare")]
+pub fn unblind_signature_share(
+    blinded_signature: &BlindedCredentialWrapper,
+    partial_verification_key: &VerificationKeyWrapper,
+    pedersen_commitments_openings: &ScalarsWrapper,
+) -> CredentialWrapper {
+    BlindedCredentialWrapper::unblind(
+        blinded_signature,
+        partial_verification_key,
+        pedersen_commitments_openings,
+    )
+}
+
+#[wasm_bindgen(js_name = "coconutUnblindAndVerifySignatureShare")]
+pub fn unblind_and_verify_signature_share(
+    blinded_signature: &BlindedCredentialWrapper,
+    partial_verification_key: &VerificationKeyWrapper,
+    request: &BlindSignRequestData,
+    private_attributes: Vec<String>,
+    public_attributes: Vec<String>,
+    parameters: Option<ParametersWrapper>,
+) -> Result<CredentialWrapper, ZkNymError> {
+    BlindedCredentialWrapper::unblind_and_verify(
+        blinded_signature,
+        partial_verification_key,
+        request,
+        private_attributes,
+        public_attributes,
+        parameters,
+    )
+}
+
+#[wasm_bindgen(js_name = "coconutAggregateSignatureShares")]
+pub fn aggregate_signature_shares(
+    shares: Vec<CredentialShareWrapper>,
+) -> Result<CredentialWrapper, ZkNymError> {
+    let shares = shares.into_iter().map(Into::into).collect::<Vec<_>>();
+
+    nym_coconut::aggregate_signature_shares(&shares)
+        .map(Into::into)
+        .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutAggregateSignatureSharesAndVerify")]
+pub fn aggregate_signature_shares_and_verify(
+    verification_key: &VerificationKeyWrapper,
+    parameters: Option<ParametersWrapper>,
+    private_attributes: Vec<String>,
+    public_attributes: Vec<String>,
+    shares: Vec<CredentialShareWrapper>,
+) -> Result<CredentialWrapper, ZkNymError> {
+    let params = get_params(&parameters);
+
+    let public_attributes = public_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+
+    let private_attributes = private_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+
+    let attributes = private_attributes
+        .iter()
+        .chain(public_attributes.iter())
+        .collect::<Vec<_>>();
+    let shares = shares.into_iter().map(Into::into).collect::<Vec<_>>();
+
+    nym_coconut::aggregate_signature_shares_and_verify(
+        params,
+        verification_key,
+        &attributes,
+        &shares,
+    )
+    .map(Into::into)
+    .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutAggregateVerificationKeyShares")]
+pub fn aggregate_verification_key_shares(
+    shares: Vec<VerificationKeyShareWrapper>,
+) -> Result<VerificationKeyWrapper, ZkNymError> {
+    let shares = shares.into_iter().map(Into::into).collect::<Vec<_>>();
+
+    nym_coconut::aggregate_key_shares(&shares)
+        .map(Into::into)
+        .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutAggregateVerificationKeys")]
+pub fn aggregate_verification_keys(
+    keys: Vec<VerificationKeyWrapper>,
+    indices: Vec<SignerIndex>,
+) -> Result<VerificationKeyWrapper, ZkNymError> {
+    let keys = keys.into_iter().map(Into::into).collect::<Vec<_>>();
+
+    nym_coconut::aggregate_verification_keys(&keys, Some(&indices))
+        .map(Into::into)
+        .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutProveBandwidthCredential")]
+pub fn prove_bandwidth_credential(
+    verification_key: &VerificationKeyWrapper,
+    credential: &CredentialWrapper,
+    serial_number: String,
+    binding_number: String,
+    parameters: Option<ParametersWrapper>,
+) -> Result<VerifyCredentialRequestWrapper, ZkNymError> {
+    let params = get_params(&parameters);
+
+    nym_coconut::prove_bandwidth_credential(
+        params,
+        verification_key,
+        credential,
+        &hash_to_scalar(serial_number),
+        &hash_to_scalar(binding_number),
+    )
+    .map(Into::into)
+    .map_err(Into::into)
+}
+
+#[wasm_bindgen(js_name = "coconutVerifyCredential")]
+pub fn verify_credential(
+    verification_key: &VerificationKeyWrapper,
+    verification_request: &VerifyCredentialRequestWrapper,
+    public_attributes: Vec<String>,
+    parameters: Option<ParametersWrapper>,
+) -> bool {
+    let params = get_params(&parameters);
+
+    let public_attributes = public_attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+    nym_coconut::verify_credential(
+        params,
+        verification_key,
+        verification_request,
+        &attributes_ref,
+    )
+}
+
+#[wasm_bindgen(js_name = "coconutVerifySimple")]
+pub fn verify_simple(
+    verification_key: &VerificationKeyWrapper,
+    attributes: Vec<String>,
+    credential: &CredentialWrapper,
+    parameters: Option<ParametersWrapper>,
+) -> bool {
+    let params = get_params(&parameters);
+
+    let public_attributes = attributes
+        .into_iter()
+        .map(hash_to_scalar)
+        .collect::<Vec<_>>();
+    let attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+    nym_coconut::verify(params, verification_key, &attributes_ref, credential)
+}
+
+#[wasm_bindgen(js_name = "coconutSimpleRandomiseCredential")]
+pub fn simple_randomise_credential(
+    credential: &CredentialWrapper,
+    parameters: Option<ParametersWrapper>,
+) -> CredentialWrapper {
+    let params = get_params(&parameters);
+
+    CredentialWrapper {
+        inner: credential.inner.randomise_simple(params),
+    }
+}

wasm/zknym-lib/src/generic_scheme/coconut/types.rs

@@ -0,0 +1,158 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::ZkNymError;
+use crate::{data_pointer_clone, wasm_wrapper, wasm_wrapper_bs58};
+use nym_coconut::{
+    hash_to_scalar, Base58, BlindSignRequest, BlindedSignature, KeyPair, Parameters, Scalar,
+    SecretKey, Signature, SignatureShare, SignerIndex, VerificationKey, VerificationKeyShare,
+    VerifyCredentialRequest,
+};
+use serde::{Deserialize, Serialize};
+use std::ops::Deref;
+use std::str::FromStr;
+use tsify::Tsify;
+use wasm_bindgen::prelude::wasm_bindgen;
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+wasm_wrapper!(Parameters, ParametersWrapper);
+wasm_wrapper_bs58!(Signature, CredentialWrapper);
+wasm_wrapper_bs58!(BlindedSignature, BlindedCredentialWrapper);
+wasm_wrapper!(SignatureShare, CredentialShareWrapper);
+wasm_wrapper_bs58!(Scalar, ScalarWrapper);
+
+wasm_wrapper!(KeyPair, KeyPairWrapper);
+wasm_wrapper!(SecretKey, SecretKeyWrapper);
+wasm_wrapper!(BlindSignRequest, BlindSignRequestWrapper);
+wasm_wrapper_bs58!(VerificationKey, VerificationKeyWrapper);
+wasm_wrapper_bs58!(VerifyCredentialRequest, VerifyCredentialRequestWrapper);
+wasm_wrapper!(VerificationKeyShare, VerificationKeyShareWrapper);
+
+data_pointer_clone!(VerificationKeyShareWrapper);
+data_pointer_clone!(CredentialShareWrapper);
+data_pointer_clone!(BlindSignRequestWrapper);
+
+#[wasm_bindgen]
+impl BlindedCredentialWrapper {
+    pub fn unblind(
+        &self,
+        partial_verification_key: &VerificationKeyWrapper,
+        pedersen_commitments_openings: &ScalarsWrapper,
+    ) -> CredentialWrapper {
+        self.inner
+            .unblind(partial_verification_key, pedersen_commitments_openings)
+            .into()
+    }
+
+    #[wasm_bindgen(js_name = "unblindAndVerify")]
+    pub fn unblind_and_verify(
+        &self,
+        partial_verification_key: &VerificationKeyWrapper,
+        request: &BlindSignRequestData,
+        private_attributes: Vec<String>,
+        public_attributes: Vec<String>,
+        parameters: Option<ParametersWrapper>,
+    ) -> Result<CredentialWrapper, ZkNymError> {
+        let params = super::get_params(&parameters);
+
+        let public_attributes = public_attributes
+            .into_iter()
+            .map(hash_to_scalar)
+            .collect::<Vec<_>>();
+        let public_attributes_ref = public_attributes.iter().collect::<Vec<_>>();
+
+        let private_attributes = private_attributes
+            .into_iter()
+            .map(hash_to_scalar)
+            .collect::<Vec<_>>();
+        let private_attributes_ref = private_attributes.iter().collect::<Vec<_>>();
+
+        let unblinded_signature = self.inner.unblind_and_verify(
+            params,
+            partial_verification_key,
+            &private_attributes_ref,
+            &public_attributes_ref,
+            &request.blind_sign_request.get_commitment_hash(),
+            &request.pedersen_commitments_openings,
+        )?;
+
+        Ok(unblinded_signature.into())
+    }
+}
+
+#[wasm_bindgen]
+impl CredentialWrapper {
+    #[wasm_bindgen(js_name = "intoShare")]
+    pub fn into_share(self, index: SignerIndex) -> CredentialShareWrapper {
+        CredentialShareWrapper {
+            inner: SignatureShare::new(self.inner, index),
+        }
+    }
+}
+
+#[wasm_bindgen]
+impl KeyPairWrapper {
+    #[wasm_bindgen(js_name = "verificationKey")]
+    pub fn verification_key(&self) -> VerificationKeyWrapper {
+        self.inner.verification_key().clone().into()
+    }
+
+    pub fn index(&self) -> Option<SignerIndex> {
+        self.inner.index
+    }
+
+    #[wasm_bindgen(js_name = "verificationKeyShare")]
+    pub fn verification_key_share(&self) -> Option<VerificationKeyShareWrapper> {
+        self.inner.to_verification_key_share().map(Into::into)
+    }
+}
+
+#[wasm_bindgen]
+pub struct BlindSignRequestData {
+    pub(crate) blind_sign_request: BlindSignRequest,
+    pub(crate) pedersen_commitments_openings: Vec<Scalar>,
+}
+
+#[wasm_bindgen]
+impl BlindSignRequestData {
+    #[wasm_bindgen(js_name = "blindSignRequest")]
+    pub fn blind_sign_request(&self) -> BlindSignRequestWrapper {
+        self.blind_sign_request.clone().into()
+    }
+
+    #[wasm_bindgen(js_name = "pedersenCommitmentsOpenings")]
+    pub fn pedersen_commitments_openings(&self) -> ScalarsWrapper {
+        ScalarsWrapper(self.pedersen_commitments_openings.clone())
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub struct ScalarsWrapper(pub(crate) Vec<Scalar>);
+
+impl Deref for ScalarsWrapper {
+    type Target = Vec<Scalar>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+#[derive(
+    Tsify, Serialize, Deserialize, Clone, Default, Debug, PartialEq, Eq, Zeroize, ZeroizeOnDrop,
+)]
+#[tsify(into_wasm_abi, from_wasm_abi)]
+#[serde(rename_all = "camelCase")]
+pub struct KeypairWrapper {
+    pub private_key: String,
+    pub public_key: String,
+}
+
+#[derive(Tsify, Serialize, Deserialize, Clone, Default, Debug, PartialEq, Eq)]
+#[tsify(into_wasm_abi, from_wasm_abi)]
+#[serde(rename_all = "camelCase")]
+pub struct UnblindableShare {
+    pub issuer_index: u64,
+    pub issuer_key_bs58: String,
+    pub blinded_share_bs58: String,
+}

wasm/zknym-lib/src/generic_scheme/mod.rs

@@ -1,4 +1,5 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+pub mod coconut;
 pub mod ecash;

wasm/zknym-lib/src/lib.rs

@@ -7,6 +7,8 @@
 // due to the code generated by Tsify
 #![allow(clippy::empty_docs)]
 
+use nym_coconut::Parameters;
+use std::sync::OnceLock;
 use wasm_bindgen::prelude::*;
 
 pub mod bandwidth_voucher;
@@ -20,6 +22,8 @@ pub mod types;
 // I mostly got it, so I could test the whole thing end to end
 pub(crate) mod vpn_api_client;
 
+pub(crate) static GLOBAL_COCONUT_PARAMS: OnceLock<Parameters> = OnceLock::new();
+
 #[wasm_bindgen(start)]
 // #[cfg(target_arch = "wasm32")]
 pub fn main() {

wasm/zknym-lib/src/vpn_api_client/client.rs

@@ -4,9 +4,11 @@
 use super::NymVpnApiClientError;
 use crate::error::ZkNymError;
 use crate::vpn_api_client::types::{
-    AttributesResponse, MasterVerificationKeyResponse, PartialVerificationKeysResponse,
+    AttributesResponse, BandwidthVoucherRequest, BandwidthVoucherResponse,
+    MasterVerificationKeyResponse, PartialVerificationKeysResponse,
 };
 use async_trait::async_trait;
+use nym_coconut::BlindSignRequest;
 pub use nym_http_api_client::Client;
 use nym_http_api_client::{parse_response, ApiClient, PathSegments, NO_PARAMS};
 use reqwest::IntoUrl;
@@ -74,6 +76,11 @@ pub trait NymVpnApiClient {
         ])
         .await
     }
+
+    async fn get_bandwidth_voucher_blinded_shares(
+        &self,
+        blind_sign_request: BlindSignRequest,
+    ) -> Result<BandwidthVoucherResponse, NymVpnApiClientError>;
 }
 
 #[async_trait(?Send)]
@@ -101,4 +108,30 @@ impl NymVpnApiClient for VpnApiClient {
 
         parse_response(res, false).await
     }
+
+    async fn get_bandwidth_voucher_blinded_shares(
+        &self,
+        blind_sign_request: BlindSignRequest,
+    ) -> Result<BandwidthVoucherResponse, NymVpnApiClientError> {
+        let req = self.inner.create_post_request(
+            &["/api", "/v1", "/bandwidth-voucher", "/obtain"],
+            NO_PARAMS,
+            &BandwidthVoucherRequest { blind_sign_request },
+        );
+
+        let fut = req.bearer_auth(&self.bearer_token).send();
+
+        // the only reason for that target lock is so that I could call this method from an ephemeral test
+        // running in non-wasm mode (since I wanted to use tokio)
+
+        #[cfg(target_arch = "wasm32")]
+        let res = wasmtimer::tokio::timeout(std::time::Duration::from_secs(5), fut)
+            .await
+            .map_err(|_timeout| HttpClientError::RequestTimeout)??;
+
+        #[cfg(not(target_arch = "wasm32"))]
+        let res = fut.await?;
+
+        parse_response(res, false).await
+    }
 }

wasm/zknym-lib/src/vpn_api_client/types.rs

@@ -3,11 +3,27 @@
 
 // just copied over from dot com repo
 
+use nym_coconut::BlindSignRequest;
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
 use tsify::Tsify;
 use uuid::Uuid;
 
+#[derive(Serialize, Deserialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct BandwidthVoucherRequest {
+    /// base58 encoded blind sign request
+    pub blind_sign_request: BlindSignRequest,
+}
+
+#[derive(Tsify, Serialize, Deserialize, Clone, Default, Debug, PartialEq, Eq)]
+#[tsify(into_wasm_abi, from_wasm_abi)]
+#[serde(rename_all = "camelCase")]
+pub struct BandwidthVoucherResponse {
+    pub epoch_id: u64,
+    pub shares: Vec<CredentialShare>,
+}
+
 #[derive(Tsify, Serialize, Deserialize, Clone, Default, Debug, PartialEq, Eq)]
 #[tsify(into_wasm_abi, from_wasm_abi)]
 #[serde(rename_all = "camelCase")]