|
| 1 | +use crate::{ |
| 2 | + bbs_sharp::setup::{MACParams, PublicKey, SecretKey}, |
| 3 | + error::KVACError, |
| 4 | +}; |
| 5 | +use ark_ec::{AffineRepr, CurveGroup}; |
| 6 | +use ark_ff::{Field, Zero}; |
| 7 | +use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; |
| 8 | +use ark_std::{ops::Neg, rand::RngCore, vec, vec::Vec, UniformRand}; |
| 9 | +use digest::Digest; |
| 10 | +use dock_crypto_utils::{ |
| 11 | + expect_equality, serde_utils::ArkObjectBytes, signature::MultiMessageSignatureParams, |
| 12 | +}; |
| 13 | +use schnorr_pok::{ |
| 14 | + compute_random_oracle_challenge, |
| 15 | + discrete_log::{PokDiscreteLog, PokDiscreteLogProtocol}, |
| 16 | +}; |
| 17 | +use serde::{Deserialize, Serialize}; |
| 18 | +use serde_with::serde_as; |
| 19 | +use zeroize::{Zeroize, ZeroizeOnDrop}; |
| 20 | + |
| 21 | +#[serde_as] |
| 22 | +#[derive( |
| 23 | + Clone, |
| 24 | + PartialEq, |
| 25 | + Eq, |
| 26 | + Debug, |
| 27 | + CanonicalSerialize, |
| 28 | + CanonicalDeserialize, |
| 29 | + Serialize, |
| 30 | + Deserialize, |
| 31 | + Zeroize, |
| 32 | + ZeroizeOnDrop, |
| 33 | +)] |
| 34 | +pub struct MAC<G: AffineRepr> { |
| 35 | + #[serde_as(as = "ArkObjectBytes")] |
| 36 | + pub A: G, |
| 37 | + #[serde_as(as = "ArkObjectBytes")] |
| 38 | + pub e: G::ScalarField, |
| 39 | +} |
| 40 | + |
| 41 | +/// A proof corresponding to a MAC that it is correctly created, i.e. can be verified successfully by someone possessing |
| 42 | +/// the secret key. Verifying the proof does not require the secret key. |
| 43 | +/// Consists of 2 protocols for discrete log relations, and both have the same discrete log |
| 44 | +/// |
| 45 | +#[serde_as] |
| 46 | +#[derive( |
| 47 | + Clone, PartialEq, Eq, Debug, CanonicalSerialize, CanonicalDeserialize, Serialize, Deserialize, |
| 48 | +)] |
| 49 | +pub struct ProofOfValidityOfMAC<G: AffineRepr> { |
| 50 | + /// For proving `B = A * sk` where `sk` is the secret key and `B = g_0 + signer_pk + g_1 * m_1 + g_2 * m_2 + ... g_n * m_n` |
| 51 | + pub sc_B: PokDiscreteLog<G>, |
| 52 | + /// For proving knowledge of secret key, i.e. `pk = g * sk` |
| 53 | + pub sc_pk: PokDiscreteLog<G>, |
| 54 | +} |
| 55 | + |
| 56 | +impl<G: AffineRepr> MAC<G> { |
| 57 | + pub fn new<R: RngCore>( |
| 58 | + rng: &mut R, |
| 59 | + messages: &[G::ScalarField], |
| 60 | + user_public_key: &PublicKey<G>, |
| 61 | + signer_secret_key: &SecretKey<G::ScalarField>, |
| 62 | + params: impl AsRef<MACParams<G>>, |
| 63 | + ) -> Result<Self, KVACError> { |
| 64 | + if messages.is_empty() { |
| 65 | + return Err(KVACError::NoMessageGiven); |
| 66 | + } |
| 67 | + let params = params.as_ref(); |
| 68 | + expect_equality!( |
| 69 | + messages.len(), |
| 70 | + params.supported_message_count(), |
| 71 | + KVACError::MessageCountIncompatibleWithMACParams |
| 72 | + ); |
| 73 | + let mut e = G::ScalarField::rand(rng); |
| 74 | + while (e + signer_secret_key.0).is_zero() { |
| 75 | + e = G::ScalarField::rand(rng) |
| 76 | + } |
| 77 | + // 1/(e+x) |
| 78 | + let e_plus_x_inv = (e + signer_secret_key.0).inverse().unwrap(); |
| 79 | + let A = params.b(messages.iter().enumerate(), user_public_key)? * e_plus_x_inv; |
| 80 | + Ok(Self { |
| 81 | + A: A.into_affine(), |
| 82 | + e, |
| 83 | + }) |
| 84 | + } |
| 85 | + |
| 86 | + pub fn verify( |
| 87 | + &self, |
| 88 | + messages: &[G::ScalarField], |
| 89 | + user_public_key: &PublicKey<G>, |
| 90 | + sk: impl AsRef<G::ScalarField>, |
| 91 | + params: impl AsRef<MACParams<G>>, |
| 92 | + ) -> Result<(), KVACError> { |
| 93 | + if messages.is_empty() { |
| 94 | + return Err(KVACError::NoMessageGiven); |
| 95 | + } |
| 96 | + let params = params.as_ref(); |
| 97 | + expect_equality!( |
| 98 | + messages.len(), |
| 99 | + params.supported_message_count(), |
| 100 | + KVACError::MessageCountIncompatibleWithMACParams |
| 101 | + ); |
| 102 | + let b = params.b(messages.iter().enumerate(), user_public_key)?; |
| 103 | + let e_plus_x_inv = (self.e + sk.as_ref()) |
| 104 | + .inverse() |
| 105 | + .ok_or(KVACError::CannotInvert0)?; |
| 106 | + if (b * e_plus_x_inv).into_affine() != self.A { |
| 107 | + return Err(KVACError::InvalidMAC); |
| 108 | + } |
| 109 | + Ok(()) |
| 110 | + } |
| 111 | +} |
| 112 | + |
| 113 | +impl<G: AffineRepr> ProofOfValidityOfMAC<G> { |
| 114 | + pub fn new<R: RngCore, D: Digest>( |
| 115 | + rng: &mut R, |
| 116 | + mac: &MAC<G>, |
| 117 | + secret_key: &SecretKey<G::ScalarField>, |
| 118 | + public_key: &PublicKey<G>, |
| 119 | + params: impl AsRef<MACParams<G>>, |
| 120 | + ) -> Self { |
| 121 | + let witness = secret_key.0; |
| 122 | + let blinding = G::ScalarField::rand(rng); |
| 123 | + let B = (mac.A * witness).into_affine(); |
| 124 | + let params = params.as_ref(); |
| 125 | + let mut challenge_bytes = vec![]; |
| 126 | + // As witness has to be proven same in both protocols. |
| 127 | + let p1 = PokDiscreteLogProtocol::init(witness, blinding, &mac.A); |
| 128 | + let p2 = PokDiscreteLogProtocol::init(witness, blinding, ¶ms.g); |
| 129 | + p1.challenge_contribution(&mac.A, &B, &mut challenge_bytes) |
| 130 | + .unwrap(); |
| 131 | + p2.challenge_contribution(¶ms.g, &public_key.0, &mut challenge_bytes) |
| 132 | + .unwrap(); |
| 133 | + let challenge = compute_random_oracle_challenge::<G::ScalarField, D>(&challenge_bytes); |
| 134 | + Self { |
| 135 | + sc_B: p1.gen_proof(&challenge), |
| 136 | + sc_pk: p2.gen_proof(&challenge), |
| 137 | + } |
| 138 | + } |
| 139 | + |
| 140 | + pub fn verify<D: Digest>( |
| 141 | + &self, |
| 142 | + mac: &MAC<G>, |
| 143 | + messages: &[G::ScalarField], |
| 144 | + user_public_key: &PublicKey<G>, |
| 145 | + signer_public_key: &PublicKey<G>, |
| 146 | + params: impl AsRef<MACParams<G>>, |
| 147 | + ) -> Result<(), KVACError> { |
| 148 | + if self.sc_B.response != self.sc_pk.response { |
| 149 | + return Err(KVACError::InvalidMACProof); |
| 150 | + } |
| 151 | + let params = params.as_ref(); |
| 152 | + // B = g_0 + user_pk + g_1 * m_1 + g_2 * m_2 + ... g_n * m_n - A * e |
| 153 | + let B = (params.b(messages.iter().enumerate(), user_public_key)? + mac.A * mac.e.neg()) |
| 154 | + .into_affine(); |
| 155 | + |
| 156 | + let mut challenge_bytes = vec![]; |
| 157 | + self.sc_B |
| 158 | + .challenge_contribution(&mac.A, &B, &mut challenge_bytes) |
| 159 | + .unwrap(); |
| 160 | + self.sc_pk |
| 161 | + .challenge_contribution(¶ms.g, &signer_public_key.0, &mut challenge_bytes) |
| 162 | + .unwrap(); |
| 163 | + let challenge = compute_random_oracle_challenge::<G::ScalarField, D>(&challenge_bytes); |
| 164 | + if !self.sc_B.verify(&B, &mac.A, &challenge) { |
| 165 | + return Err(KVACError::InvalidMACProof); |
| 166 | + } |
| 167 | + if !self |
| 168 | + .sc_pk |
| 169 | + .verify(&signer_public_key.0, ¶ms.g, &challenge) |
| 170 | + { |
| 171 | + return Err(KVACError::InvalidMACProof); |
| 172 | + } |
| 173 | + Ok(()) |
| 174 | + } |
| 175 | +} |
| 176 | + |
| 177 | +#[cfg(test)] |
| 178 | +mod tests { |
| 179 | + use super::*; |
| 180 | + use ark_secp256r1::{Affine, Fr}; |
| 181 | + use ark_std::rand::{prelude::StdRng, SeedableRng}; |
| 182 | + use sha2::Sha256; |
| 183 | + |
| 184 | + #[test] |
| 185 | + fn mac_verification() { |
| 186 | + let mut rng = StdRng::seed_from_u64(0u64); |
| 187 | + let message_count = 10; |
| 188 | + let messages = (0..message_count) |
| 189 | + .map(|_| Fr::rand(&mut rng)) |
| 190 | + .collect::<Vec<_>>(); |
| 191 | + let params = MACParams::<Affine>::new::<Sha256>(b"test", message_count); |
| 192 | + let signer_sk = SecretKey::new(&mut rng); |
| 193 | + let signer_pk = PublicKey::new(&signer_sk, ¶ms.g); |
| 194 | + |
| 195 | + let user_sk = SecretKey::new(&mut rng); |
| 196 | + let user_pk = PublicKey::new(&user_sk, ¶ms.g); |
| 197 | + |
| 198 | + // Signer sends the following 2 items to the user |
| 199 | + let mac = MAC::new(&mut rng, &messages, &user_pk, &signer_sk, ¶ms).unwrap(); |
| 200 | + let proof = |
| 201 | + ProofOfValidityOfMAC::new::<_, Sha256>(&mut rng, &mac, &signer_sk, &signer_pk, ¶ms); |
| 202 | + |
| 203 | + // User verifies both |
| 204 | + mac.verify(&messages, &user_pk, &signer_sk, ¶ms) |
| 205 | + .unwrap(); |
| 206 | + proof |
| 207 | + .verify::<Sha256>(&mac, &messages, &user_pk, &signer_pk, params) |
| 208 | + .unwrap(); |
| 209 | + } |
| 210 | +} |
0 commit comments