1//! This module provides an implementation of TranscriptEngineTrait using keccak256
  2use crate::traits::PrimeFieldExt;
  3use crate::{
  4  errors::NovaError,
  5  traits::{Group, TranscriptEngineTrait},
  6};
  7use core::marker::PhantomData;
  8use sha3::{Digest, Keccak256};
  9
 10const PERSONA_TAG: &[u8] = b"NovaTranscript";
 11const DOM_SEP_TAG: &[u8] = b"NovaRound";
 12const KECCAK256_STATE_SIZE: usize = 64;
 13const KECCAK256_PREFIX_CHALLENGE_LO: u8 = 0;
 14const KECCAK256_PREFIX_CHALLENGE_HI: u8 = 1;
 15
 16/// Provides an implementation of TranscriptEngine
 17#[derive(Debug, Clone)]
 18pub struct Keccak256Transcript<G: Group> {
 19  round: u16,
 20  state: [u8; KECCAK256_STATE_SIZE],
 21  transcript: Vec<u8>,
 22  _p: PhantomData<G>,
 23}
 24
 25fn compute_updated_state(input: &[u8]) -> [u8; KECCAK256_STATE_SIZE] {
 26  let input_lo = [input, &[KECCAK256_PREFIX_CHALLENGE_LO]].concat();
 27  let input_hi = [input, &[KECCAK256_PREFIX_CHALLENGE_HI]].concat();
 28
 29  let mut hasher_lo = Keccak256::new();
 30  let mut hasher_hi = Keccak256::new();
 31
 32  hasher_lo.input(&input_lo);
 33  hasher_hi.input(&input_hi);
 34
 35  let output_lo = hasher_lo.result();
 36  let output_hi = hasher_hi.result();
 37
 38  [output_lo, output_hi]
 39    .concat()
 40    .as_slice()
 41    .try_into()
 42    .unwrap()
 43}
 44
 45impl<G: Group> TranscriptEngineTrait<G> for Keccak256Transcript<G> {
 46  fn new(label: &'static [u8]) -> Self {
 47    let input = [PERSONA_TAG, label].concat();
 48    let output = compute_updated_state(&input);
 49
 50    Self {
 51      round: 0u16,
 52      state: output,
 53      transcript: vec![],
 54      _p: Default::default(),
 55    }
 56  }
 57
 58  fn squeeze_scalar(&mut self, label: &'static [u8]) -> Result<G::Scalar, NovaError> {
 59    let input = [
 60      DOM_SEP_TAG,
 61      self.round.to_le_bytes().as_ref(),
 62      self.state.as_ref(),
 63      self.transcript.as_ref(),
 64      label,
 65    ]
 66    .concat();
 67    let output = compute_updated_state(&input);
 68
 69    // update state
 70    self.round = {
 71      if let Some(v) = self.round.checked_add(1) {
 72        v
 73      } else {
 74        return Err(NovaError::InternalTranscriptError);
 75      }
 76    };
 77    self.state.copy_from_slice(&output);
 78    self.transcript = vec![];
 79
 80    // squeeze out a challenge
 81    Ok(G::Scalar::from_uniform(&output))
 82  }
 83
 84  fn absorb_bytes(&mut self, label: &'static [u8], bytes: &[u8]) {
 85    self.transcript.extend_from_slice(label);
 86    self.transcript.extend_from_slice(bytes);
 87  }
 88}
 89
 90#[cfg(test)]
 91mod tests {
 92  use crate::{
 93    provider::keccak::Keccak256Transcript,
 94    traits::{AppendToTranscriptTrait, ChallengeTrait, Group, TranscriptEngineTrait},
 95  };
 96  use ff::PrimeField;
 97  use sha3::{Digest, Keccak256};
 98
 99  type G = pasta_curves::pallas::Point;
100
101  #[test]
102  fn test_keccak_transcript() {
103    let mut transcript = Keccak256Transcript::new(b"test");
104
105    // two scalars
106    let s1 = <G as Group>::Scalar::from(2u64);
107    let s2 = <G as Group>::Scalar::from(5u64);
108
109    // add the scalars to the transcript
110    <<G as Group>::Scalar as AppendToTranscriptTrait<G>>::append_to_transcript(
111      &s1,
112      b"s1",
113      &mut transcript,
114    );
115    <<G as Group>::Scalar as AppendToTranscriptTrait<G>>::append_to_transcript(
116      &s2,
117      b"s2",
118      &mut transcript,
119    );
120
121    // make a challenge
122    let c1 =
123      <<G as Group>::Scalar as ChallengeTrait<G>>::challenge(b"challenge_c1", &mut transcript)
124        .unwrap();
125    assert_eq!(
126      hex::encode(c1.to_repr().as_ref()),
127      "51648083af5387a04a7aa2aec789ee78fdabe45dc1391d270a38fcb576447c01"
128    );
129
130    // a scalar
131    let s3 = <G as Group>::Scalar::from(128u64);
132
133    // add the scalar to the transcript
134    <<G as Group>::Scalar as AppendToTranscriptTrait<G>>::append_to_transcript(
135      &s3,
136      b"s3",
137      &mut transcript,
138    );
139
140    // make a challenge
141    let c2 =
142      <<G as Group>::Scalar as ChallengeTrait<G>>::challenge(b"challenge_c2", &mut transcript)
143        .unwrap();
144    assert_eq!(
145      hex::encode(c2.to_repr().as_ref()),
146      "9773f3349f7308153f6012e72b97fc304e48372bbd28bd122b37a8e46855d50f"
147    );
148  }
149
150  #[test]
151  fn test_keccak_example() {
152    let mut hasher = Keccak256::new();
153    hasher.input(0xffffffff_u32.to_le_bytes());
154    let output: [u8; 32] = hasher.result().try_into().unwrap();
155    assert_eq!(
156      hex::encode(output),
157      "29045a592007d0c246ef02c2223570da9522d0cf0f73282c79a1bc8f0bb2c238"
158    );
159  }
160}