1#![allow(non_snake_case)]
  2#![allow(clippy::many_single_char_names)]
  3
  4// #[cfg(feature="r1cs")]
  5pub mod constraints;
  6
  7use ark_ec::{
  8    models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve, TEModelParameters,
  9};
 10
 11use ark_ff::{
 12    to_bytes, BigInteger, BigInteger256, Field, Fp256, FpParameters, FromBytes, One, PrimeField,
 13    Zero,
 14};
 15
 16use ark_std::marker::PhantomData;
 17use ark_std::rand::{CryptoRng, RngCore};
 18use ark_std::{ops::Mul, rand::Rng, UniformRand};
 19use derivative::Derivative;
 20
 21// hash
 22use arkworks_native_gadgets::poseidon;
 23use arkworks_native_gadgets::poseidon::FieldHasher;
 24use arkworks_utils::{
 25    bytes_matrix_to_f, bytes_vec_to_f, parse_vec, poseidon_params::setup_poseidon_params, Curve,
 26};
 27
 28// WIP
 29use ark_ed_on_bn254::{
 30    EdwardsAffine, EdwardsParameters, EdwardsProjective, FqParameters, Fr, FrParameters,
 31};
 32
 33pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
 34pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
 35pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
 36
 37// #[derive(Derivative)]
 38#[derive(Clone, Default, Debug)]
 39pub struct Signature<C: ProjectiveCurve> {
 40    s: C::ScalarField, // ScalarField == Fr
 41    r: <C as ProjectiveCurve>::Affine,
 42}
 43
 44#[derive(Debug)]
 45pub struct UserSecretData<C: ProjectiveCurve> {
 46    a: C::ScalarField,
 47    b: C::ScalarField,
 48    r: C::Affine,
 49}
 50impl<C: ProjectiveCurve> UserSecretData<C> {
 51    fn new_empty(parameters: &Parameters<C>) -> Self {
 52        UserSecretData {
 53            a: C::ScalarField::from(0 as u32),
 54            b: C::ScalarField::from(0 as u32),
 55            r: parameters.generator, // WIP
 56        }
 57    }
 58}
 59
 60#[derive(Derivative)]
 61#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
 62pub struct Parameters<C: ProjectiveCurve> {
 63    pub generator: C::Affine,
 64}
 65
 66pub struct BlindSigScheme<C: ProjectiveCurve> {
 67    _group: PhantomData<C>,
 68}
 69
 70impl<C: ProjectiveCurve> BlindSigScheme<C>
 71where
 72    C::ScalarField: PrimeField,
 73    GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
 74{
 75    pub fn setup() -> Parameters<C> {
 76        let generator = C::prime_subgroup_generator().into();
 77        Parameters { generator }
 78    }
 79
 80    // signer
 81    pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
 82        let secret_key = C::ScalarField::rand(rng);
 83        let public_key = parameters.generator.mul(secret_key).into();
 84        (public_key, secret_key)
 85    }
 86
 87    pub fn new_request_params<R: Rng>(
 88        parameters: &Parameters<C>,
 89        rng: &mut R,
 90    ) -> (C::ScalarField, C::Affine) {
 91        let k = C::ScalarField::rand(rng);
 92        let R = parameters.generator.mul(k).into();
 93        (k, R)
 94    }
 95
 96    pub fn blind_sign(
 97        sk: SecretKey<C>,
 98        k: C::ScalarField,
 99        m_blinded: C::ScalarField,
100    ) -> BlindedSignature<C> {
101        sk * m_blinded + k
102    }
103
104    // requester
105    pub fn new_blind_params<R: Rng>(
106        parameters: &Parameters<C>,
107        rng: &mut R,
108        signer_r: C::Affine,
109    ) -> UserSecretData<C>
110    where
111        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
112    {
113        let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
114        u.a = C::ScalarField::rand(rng);
115        u.b = C::ScalarField::rand(rng);
116
117        // R = aR' + bG
118        let aR = signer_r.mul(u.a.into_repr());
119        let bG = parameters.generator.mul(u.b.into_repr());
120        u.r = aR.into_affine() + bG.into_affine();
121
122        let r = EdwardsAffine::from(u.r); // WIP
123        let one = BigInteger256::from(1u64);
124        let x_repr = r.x.into_repr();
125        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
126        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
127
128        if !(x_repr >= one && x_repr < modulus_repr) {
129            // TODO maybe add a counter of attempts with a limit
130            return Self::new_blind_params(parameters, rng, signer_r);
131        }
132        u
133    }
134
135    pub fn blind<R: Rng>(
136        parameters: &Parameters<C>,
137        rng: &mut R,
138        poseidon_hash: &poseidon::Poseidon<C::ScalarField>,
139        m: C::ScalarField,
140        signer_r: C::Affine,
141    ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
142    where
143        <C as ProjectiveCurve>::ScalarField: Mul<Fp256<FrParameters>>,
144        <C as ProjectiveCurve>::ScalarField:
145            From<<<C as ProjectiveCurve>::ScalarField as Mul<Fp256<FrParameters>>>::Output>,
146        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
147    {
148        let u = Self::new_blind_params(parameters, rng, signer_r);
149        // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
150        // will not give None
151        let r = EdwardsAffine::from(u.r); // WIP
152        let x_fr = C::ScalarField::from(r.x.into_repr());
153
154        // m' = a^-1 rx h(m)
155        let h_m = poseidon_hash.hash(&[m])?;
156        let m_blinded = C::ScalarField::from(u.a.inverse().unwrap() * x_fr) * h_m;
157
158        Ok((m_blinded, u))
159    }
160
161    pub fn unblind(s_blinded: C::ScalarField, u: UserSecretData<C>) -> Signature<C> {
162        // s = a s' + b
163        let s = u.a * s_blinded + u.b;
164        Signature { s, r: u.r }
165    }
166
167    pub fn verify(
168        parameters: &Parameters<C>,
169        poseidon_hash: &poseidon::Poseidon<C::ScalarField>,
170        m: C::ScalarField,
171        s: Signature<C>,
172        q: PublicKey<C>,
173    ) -> bool
174    where
175        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
176    {
177        let sG = parameters.generator.mul(s.s.into_repr());
178
179        let h_m = poseidon_hash.hash(&[m]).unwrap();
180
181        // check that s.R.x is in Fr
182        let r = EdwardsAffine::from(s.r); // WIP
183        let one = BigInteger256::from(1u64);
184        let x_repr = r.x.into_repr();
185        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
186        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
187        if !(x_repr >= one && x_repr < modulus_repr) {
188            return false;
189        }
190        // get s.R.x
191        let x_fr = C::ScalarField::from(r.x.into_repr());
192        let right = s.r + q.mul((x_fr * h_m).into_repr()).into_affine();
193
194        sG.into_affine() == right
195    }
196}
197
198// poseidon
199pub fn poseidon_setup_params<F: PrimeField>(
200    curve: Curve,
201    exp: i8,
202    width: u8,
203) -> poseidon::PoseidonParameters<F> {
204    let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
205
206    let mds_f = bytes_matrix_to_f(&pos_data.mds);
207    let rounds_f = bytes_vec_to_f(&pos_data.rounds);
208
209    poseidon::PoseidonParameters {
210        mds_matrix: mds_f,
211        round_keys: rounds_f,
212        full_rounds: pos_data.full_rounds,
213        partial_rounds: pos_data.partial_rounds,
214        sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
215        width: pos_data.width,
216    }
217}
218
219#[cfg(test)]
220mod tests {
221    use super::*;
222    pub type ConstraintF = ark_ed_on_bn254::Fr; // scalar field
223
224    #[test]
225    fn test_blind() {
226        type S = BlindSigScheme<EdwardsProjective>;
227
228        let poseidon_params = poseidon_setup_params::<ConstraintF>(Curve::Bn254, 5, 3);
229        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
230
231        let mut rng = ark_std::test_rng();
232
233        let params = S::setup();
234        let (pk, sk) = S::keygen(&params, &mut rng);
235
236        let (k, signer_r) = S::new_request_params(&params, &mut rng);
237        let m = ConstraintF::from(1234);
238
239        let (m_blinded, u) = S::blind(&params, &mut rng, &poseidon_hash, m, signer_r).unwrap();
240
241        let s_blinded = S::blind_sign(sk, k, m_blinded);
242
243        let s = S::unblind(s_blinded, u);
244
245        let verified = S::verify(&params, &poseidon_hash, m, s, pk);
246        assert!(verified);
247    }
248}