1#![allow(non_snake_case)]
  2#![allow(clippy::many_single_char_names)]
  3
  4// #[cfg(feature="r1cs")]
  5pub mod constraints;
  6
  7use ark_ec::{models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve};
  8
  9use ark_ff::{to_bytes, BigInteger256, Field, FpParameters, PrimeField};
 10
 11use ark_std::marker::PhantomData;
 12use ark_std::{rand::Rng, UniformRand};
 13use derivative::Derivative;
 14
 15// hash
 16use arkworks_native_gadgets::poseidon;
 17use arkworks_native_gadgets::poseidon::FieldHasher;
 18use arkworks_utils::{
 19    bytes_matrix_to_f, bytes_vec_to_f, poseidon_params::setup_poseidon_params, Curve,
 20};
 21
 22// WIP
 23use ark_ed_on_bn254::{EdwardsAffine, EdwardsParameters};
 24
 25pub type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
 26pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
 27pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
 28pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
 29
 30// #[derive(Derivative)]
 31#[derive(Clone, Default, Debug)]
 32pub struct Signature<C: ProjectiveCurve> {
 33    s: C::ScalarField, // ScalarField == Fr
 34    r: <C as ProjectiveCurve>::Affine,
 35}
 36
 37#[derive(Clone, Default, Debug)]
 38pub struct UserSecretData<C: ProjectiveCurve> {
 39    a: C::ScalarField,
 40    b: C::ScalarField,
 41    r: C::Affine,
 42}
 43impl<C: ProjectiveCurve> UserSecretData<C> {
 44    fn new_empty(parameters: &Parameters<C>) -> Self {
 45        UserSecretData {
 46            a: C::ScalarField::from(0_u32),
 47            b: C::ScalarField::from(0_u32),
 48            r: parameters.generator, // WIP
 49        }
 50    }
 51}
 52
 53#[derive(Derivative)]
 54#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
 55pub struct Parameters<C: ProjectiveCurve> {
 56    pub generator: C::Affine,
 57}
 58
 59pub struct BlindSigScheme<C: ProjectiveCurve> {
 60    _group: PhantomData<C>,
 61}
 62
 63impl<C: ProjectiveCurve> BlindSigScheme<C>
 64where
 65    C::ScalarField: PrimeField,
 66    GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
 67{
 68    pub fn setup() -> Parameters<C> {
 69        let generator = C::prime_subgroup_generator().into();
 70        Parameters { generator }
 71    }
 72
 73    // signer
 74    pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
 75        let secret_key = C::ScalarField::rand(rng);
 76        let public_key = parameters.generator.mul(secret_key).into();
 77        (public_key, secret_key)
 78    }
 79
 80    pub fn new_request_params<R: Rng>(
 81        parameters: &Parameters<C>,
 82        rng: &mut R,
 83    ) -> (C::ScalarField, C::Affine) {
 84        let k = C::ScalarField::rand(rng);
 85        let R = parameters.generator.mul(k).into();
 86        (k, R)
 87    }
 88
 89    pub fn blind_sign(
 90        sk: SecretKey<C>,
 91        k: C::ScalarField,
 92        m_blinded: C::ScalarField,
 93    ) -> BlindedSignature<C> {
 94        sk * m_blinded + k
 95    }
 96
 97    // new_k_and_R returns a new k \in Fr, and R=k * G, such that R.x \in Fr
 98    fn new_k_and_R<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (C::ScalarField, C::Affine)
 99    where
100        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
101    {
102        let k = C::ScalarField::rand(rng);
103
104        let R: C::Affine = parameters.generator.mul(k.into_repr()).into();
105        let r = EdwardsAffine::from(R); // WIP
106
107        let one = BigInteger256::from(1u64);
108        let x_repr = r.x.into_repr();
109        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
110        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
111
112        if !(x_repr >= one && x_repr < modulus_repr) {
113            // TODO maybe add a counter of attempts with a limit
114            return Self::new_k_and_R(parameters, rng);
115        }
116
117        (k, R)
118    }
119
120    // non_blind_sign performs a non-blind signature, which can be verified with the same check
121    // than a blind-signature
122    pub fn non_blind_sign<R: Rng>(
123        parameters: &Parameters<C>,
124        rng: &mut R,
125        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
126        sk: SecretKey<C>,
127        m: &[ConstraintF<C>],
128    ) -> Result<Signature<C>, ark_crypto_primitives::Error>
129    where
130        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
131    {
132        let (k, R) = Self::new_k_and_R(parameters, rng);
133        let r = EdwardsAffine::from(R); // WIP
134        let x_fr = C::ScalarField::from(r.x.into_repr());
135
136        let hm = poseidon_hash.hash(m)?;
137        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm)?); // WIP TMP
138
139        let s = k + (x_fr * hm_fr) * sk;
140        Ok(Signature { s, r: R })
141    }
142
143    // requester
144    pub fn new_blind_params<R: Rng>(
145        parameters: &Parameters<C>,
146        rng: &mut R,
147        signer_r: C::Affine,
148    ) -> UserSecretData<C>
149    where
150        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
151    {
152        let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
153        u.a = C::ScalarField::rand(rng);
154        u.b = C::ScalarField::rand(rng);
155
156        // R = aR' + bG
157        let aR = signer_r.mul(u.a.into_repr());
158        let bG = parameters.generator.mul(u.b.into_repr());
159        u.r = aR.into_affine() + bG.into_affine();
160
161        let r = EdwardsAffine::from(u.r); // WIP
162        let one = BigInteger256::from(1u64);
163        let x_repr = r.x.into_repr();
164        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
165        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
166
167        if !(x_repr >= one && x_repr < modulus_repr) {
168            // TODO maybe add a counter of attempts with a limit
169            return Self::new_blind_params(parameters, rng, signer_r);
170        }
171        u
172    }
173
174    pub fn blind<R: Rng>(
175        parameters: &Parameters<C>,
176        rng: &mut R,
177        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
178        m: &[ConstraintF<C>],
179        signer_r: C::Affine,
180    ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
181    where
182        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
183    {
184        let u = Self::new_blind_params(parameters, rng, signer_r);
185
186        // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
187        // will not overflow (giving None)
188        let r = EdwardsAffine::from(u.r); // WIP
189        let x_fr = C::ScalarField::from(r.x.into_repr());
190
191        // m' = a^-1 rx h(m)
192        // TODO hash(m) must be \in Fr
193        let hm = poseidon_hash.hash(m)?;
194        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
195        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm)?); // WIP TMP
196        let m_blinded = u.a.inverse().unwrap() * x_fr * hm_fr;
197        // let m_blinded = C::ScalarField::from(u.a.inverse().unwrap() * x_fr) * hm_fr;
198
199        Ok((m_blinded, u))
200    }
201
202    pub fn unblind(s_blinded: C::ScalarField, u: &UserSecretData<C>) -> Signature<C> {
203        // s = a s' + b
204        let s = u.a * s_blinded + u.b;
205        Signature { s, r: u.r }
206    }
207
208    pub fn verify(
209        parameters: &Parameters<C>,
210        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
211        m: &[ConstraintF<C>],
212        s: Signature<C>,
213        q: PublicKey<C>,
214    ) -> bool
215    where
216        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
217    {
218        let sG = parameters.generator.mul(s.s.into_repr());
219
220        // TODO the output of hash(m) must be \in Fr
221        let hm = poseidon_hash.hash(m).unwrap();
222        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
223        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm).unwrap()); // WIP TMP
224
225        // check that s.R.x is in Fr
226        let r = EdwardsAffine::from(s.r); // WIP
227        let one = BigInteger256::from(1u64);
228        let x_repr = r.x.into_repr();
229        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
230        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
231        if !(x_repr >= one && x_repr < modulus_repr) {
232            return false;
233        }
234        // get s.R.x
235        let x_fr = C::ScalarField::from(r.x.into_repr());
236        let right = s.r + q.mul((x_fr * hm_fr).into_repr()).into_affine();
237
238        sG.into_affine() == right
239    }
240}
241
242// poseidon
243pub fn poseidon_setup_params<F: PrimeField>(
244    curve: Curve,
245    exp: i8,
246    width: u8,
247) -> poseidon::PoseidonParameters<F> {
248    let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
249
250    let mds_f = bytes_matrix_to_f(&pos_data.mds);
251    let rounds_f = bytes_vec_to_f(&pos_data.rounds);
252
253    poseidon::PoseidonParameters {
254        mds_matrix: mds_f,
255        round_keys: rounds_f,
256        full_rounds: pos_data.full_rounds,
257        partial_rounds: pos_data.partial_rounds,
258        sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
259        width: pos_data.width,
260    }
261}
262
263#[cfg(test)]
264mod tests {
265    use super::*;
266    use ark_ed_on_bn254::EdwardsProjective;
267    pub type Fq = ark_ed_on_bn254::Fq; // base field
268                                       // pub type Fr = ark_ed_on_bn254::Fr; // scalar field
269
270    #[test]
271    fn test_blind_signature_flow_native() {
272        type S = BlindSigScheme<EdwardsProjective>;
273
274        let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
275        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
276
277        let mut rng = ark_std::test_rng();
278
279        let params = S::setup();
280        let (pk, sk) = S::keygen(&params, &mut rng);
281
282        let (k, signer_r) = S::new_request_params(&params, &mut rng);
283        let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
284
285        let (m_blinded, u) = S::blind(&params, &mut rng, &poseidon_hash, &m, signer_r).unwrap();
286
287        let s_blinded = S::blind_sign(sk, k, m_blinded);
288
289        let s = S::unblind(s_blinded, &u);
290
291        let verified = S::verify(&params, &poseidon_hash, &m, s, pk);
292        assert!(verified);
293    }
294
295    #[test]
296    fn test_non_blind_signature() {
297        type S = BlindSigScheme<EdwardsProjective>;
298
299        let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
300        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
301
302        let mut rng = ark_std::test_rng();
303
304        let params = S::setup();
305        let (pk, sk) = S::keygen(&params, &mut rng);
306
307        let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
308        let s = S::non_blind_sign(&params, &mut rng, &poseidon_hash, sk, &m).unwrap();
309
310        // verify using the same verification method used for blind-signatures
311        let verified = S::verify(&params, &poseidon_hash, &m, s, pk);
312        assert!(verified);
313    }
314}