1#![allow(non_snake_case)]
  2#![allow(clippy::many_single_char_names)]
  3
  4// #[cfg(feature="r1cs")]
  5pub mod constraints;
  6
  7use ark_ec::{models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve};
  8
  9use ark_ff::{to_bytes, BigInteger256, Field, FpParameters, PrimeField};
 10
 11use ark_std::marker::PhantomData;
 12use ark_std::{rand::Rng, UniformRand};
 13use derivative::Derivative;
 14
 15// hash
 16use arkworks_native_gadgets::poseidon;
 17use arkworks_native_gadgets::poseidon::FieldHasher;
 18use arkworks_utils::{
 19    bytes_matrix_to_f, bytes_vec_to_f, poseidon_params::setup_poseidon_params, Curve,
 20};
 21
 22// WIP
 23use ark_ed_on_bn254::{EdwardsAffine, EdwardsParameters};
 24
 25pub type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
 26pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
 27pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
 28pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
 29
 30// #[derive(Derivative)]
 31#[derive(Clone, Default, Debug)]
 32pub struct Signature<C: ProjectiveCurve> {
 33    s: C::ScalarField, // ScalarField == Fr
 34    r: <C as ProjectiveCurve>::Affine,
 35}
 36
 37#[derive(Debug)]
 38pub struct UserSecretData<C: ProjectiveCurve> {
 39    a: C::ScalarField,
 40    b: C::ScalarField,
 41    r: C::Affine,
 42}
 43impl<C: ProjectiveCurve> UserSecretData<C> {
 44    fn new_empty(parameters: &Parameters<C>) -> Self {
 45        UserSecretData {
 46            a: C::ScalarField::from(0_u32),
 47            b: C::ScalarField::from(0_u32),
 48            r: parameters.generator, // WIP
 49        }
 50    }
 51}
 52
 53#[derive(Derivative)]
 54#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
 55pub struct Parameters<C: ProjectiveCurve> {
 56    pub generator: C::Affine,
 57}
 58
 59pub struct BlindSigScheme<C: ProjectiveCurve> {
 60    _group: PhantomData<C>,
 61}
 62
 63impl<C: ProjectiveCurve> BlindSigScheme<C>
 64where
 65    C::ScalarField: PrimeField,
 66    GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
 67{
 68    pub fn setup() -> Parameters<C> {
 69        let generator = C::prime_subgroup_generator().into();
 70        Parameters { generator }
 71    }
 72
 73    // signer
 74    pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
 75        let secret_key = C::ScalarField::rand(rng);
 76        let public_key = parameters.generator.mul(secret_key).into();
 77        (public_key, secret_key)
 78    }
 79
 80    pub fn new_request_params<R: Rng>(
 81        parameters: &Parameters<C>,
 82        rng: &mut R,
 83    ) -> (C::ScalarField, C::Affine) {
 84        let k = C::ScalarField::rand(rng);
 85        let R = parameters.generator.mul(k).into();
 86        (k, R)
 87    }
 88
 89    pub fn blind_sign(
 90        sk: SecretKey<C>,
 91        k: C::ScalarField,
 92        m_blinded: C::ScalarField,
 93    ) -> BlindedSignature<C> {
 94        sk * m_blinded + k
 95    }
 96
 97    // requester
 98    pub fn new_blind_params<R: Rng>(
 99        parameters: &Parameters<C>,
100        rng: &mut R,
101        signer_r: C::Affine,
102    ) -> UserSecretData<C>
103    where
104        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
105    {
106        let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
107        u.a = C::ScalarField::rand(rng);
108        u.b = C::ScalarField::rand(rng);
109
110        // R = aR' + bG
111        let aR = signer_r.mul(u.a.into_repr());
112        let bG = parameters.generator.mul(u.b.into_repr());
113        u.r = aR.into_affine() + bG.into_affine();
114
115        let r = EdwardsAffine::from(u.r); // WIP
116        let one = BigInteger256::from(1u64);
117        let x_repr = r.x.into_repr();
118        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
119        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
120
121        if !(x_repr >= one && x_repr < modulus_repr) {
122            // TODO maybe add a counter of attempts with a limit
123            return Self::new_blind_params(parameters, rng, signer_r);
124        }
125        u
126    }
127
128    pub fn blind<R: Rng>(
129        parameters: &Parameters<C>,
130        rng: &mut R,
131        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
132        m: ConstraintF<C>,
133        signer_r: C::Affine,
134    ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
135    where
136        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
137    {
138        let u = Self::new_blind_params(parameters, rng, signer_r);
139        // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
140        // will not give None
141        let r = EdwardsAffine::from(u.r); // WIP
142        let x_fr = C::ScalarField::from(r.x.into_repr());
143
144        // m' = a^-1 rx h(m)
145        // TODO hash(m) must be \in Fr
146        let hm = poseidon_hash.hash(&[m])?;
147        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
148        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm)?); // WIP TMP
149        let m_blinded = u.a.inverse().unwrap() * x_fr * hm_fr;
150        // let m_blinded = C::ScalarField::from(u.a.inverse().unwrap() * x_fr) * hm_fr;
151
152        Ok((m_blinded, u))
153    }
154
155    pub fn unblind(s_blinded: C::ScalarField, u: UserSecretData<C>) -> Signature<C> {
156        // s = a s' + b
157        let s = u.a * s_blinded + u.b;
158        Signature { s, r: u.r }
159    }
160
161    pub fn verify(
162        parameters: &Parameters<C>,
163        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
164        m: ConstraintF<C>,
165        s: Signature<C>,
166        q: PublicKey<C>,
167    ) -> bool
168    where
169        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
170    {
171        let sG = parameters.generator.mul(s.s.into_repr());
172
173        // TODO the output of hash(m) must be \in Fr
174        let hm = poseidon_hash.hash(&[m]).unwrap();
175        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
176        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm).unwrap()); // WIP TMP
177
178        // check that s.R.x is in Fr
179        let r = EdwardsAffine::from(s.r); // WIP
180        let one = BigInteger256::from(1u64);
181        let x_repr = r.x.into_repr();
182        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
183        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
184        if !(x_repr >= one && x_repr < modulus_repr) {
185            return false;
186        }
187        // get s.R.x
188        let x_fr = C::ScalarField::from(r.x.into_repr());
189        let right = s.r + q.mul((x_fr * hm_fr).into_repr()).into_affine();
190
191        sG.into_affine() == right
192    }
193}
194
195// poseidon
196pub fn poseidon_setup_params<F: PrimeField>(
197    curve: Curve,
198    exp: i8,
199    width: u8,
200) -> poseidon::PoseidonParameters<F> {
201    let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
202
203    let mds_f = bytes_matrix_to_f(&pos_data.mds);
204    let rounds_f = bytes_vec_to_f(&pos_data.rounds);
205
206    poseidon::PoseidonParameters {
207        mds_matrix: mds_f,
208        round_keys: rounds_f,
209        full_rounds: pos_data.full_rounds,
210        partial_rounds: pos_data.partial_rounds,
211        sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
212        width: pos_data.width,
213    }
214}
215
216#[cfg(test)]
217mod tests {
218    use super::*;
219    use ark_ed_on_bn254::EdwardsProjective;
220    pub type Fq = ark_ed_on_bn254::Fq; // base field
221                                       // pub type Fr = ark_ed_on_bn254::Fr; // scalar field
222
223    #[test]
224    fn test_blind_signature_flow_native() {
225        type S = BlindSigScheme<EdwardsProjective>;
226
227        let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 3);
228        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
229
230        let mut rng = ark_std::test_rng();
231
232        let params = S::setup();
233        let (pk, sk) = S::keygen(&params, &mut rng);
234
235        let (k, signer_r) = S::new_request_params(&params, &mut rng);
236        let m = Fq::from(1234);
237
238        let (m_blinded, u) = S::blind(&params, &mut rng, &poseidon_hash, m, signer_r).unwrap();
239
240        let s_blinded = S::blind_sign(sk, k, m_blinded);
241
242        let s = S::unblind(s_blinded, u);
243
244        let verified = S::verify(&params, &poseidon_hash, m, s, pk);
245        assert!(verified);
246    }
247}