1#![allow(non_snake_case)]
  2#![allow(clippy::many_single_char_names)]
  3
  4// #[cfg(feature="r1cs")]
  5pub mod constraints;
  6
  7use ark_ec::{models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve};
  8
  9use ark_ff::{to_bytes, BigInteger256, Field, FpParameters, PrimeField};
 10
 11use ark_std::marker::PhantomData;
 12use ark_std::{rand::Rng, UniformRand};
 13use derivative::Derivative;
 14
 15// hash
 16use arkworks_native_gadgets::poseidon;
 17use arkworks_native_gadgets::poseidon::FieldHasher;
 18use arkworks_utils::{
 19    bytes_matrix_to_f, bytes_vec_to_f, poseidon_params::setup_poseidon_params, Curve,
 20};
 21
 22// WIP
 23use ark_ed_on_bn254::{EdwardsAffine, EdwardsParameters};
 24
 25pub type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
 26pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
 27pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
 28pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
 29
 30// #[derive(Derivative)]
 31#[derive(Clone, Default, Debug)]
 32pub struct Signature<C: ProjectiveCurve> {
 33    s: C::ScalarField, // ScalarField == Fr
 34    r: <C as ProjectiveCurve>::Affine,
 35}
 36
 37#[derive(Debug)]
 38pub struct UserSecretData<C: ProjectiveCurve> {
 39    a: C::ScalarField,
 40    b: C::ScalarField,
 41    r: C::Affine,
 42}
 43impl<C: ProjectiveCurve> UserSecretData<C> {
 44    fn new_empty(parameters: &Parameters<C>) -> Self {
 45        UserSecretData {
 46            a: C::ScalarField::from(0_u32),
 47            b: C::ScalarField::from(0_u32),
 48            r: parameters.generator, // WIP
 49        }
 50    }
 51}
 52
 53#[derive(Derivative)]
 54#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
 55pub struct Parameters<C: ProjectiveCurve> {
 56    pub generator: C::Affine,
 57}
 58
 59pub struct BlindSigScheme<C: ProjectiveCurve> {
 60    _group: PhantomData<C>,
 61}
 62
 63impl<C: ProjectiveCurve> BlindSigScheme<C>
 64where
 65    C::ScalarField: PrimeField,
 66    GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
 67{
 68    pub fn setup() -> Parameters<C> {
 69        let generator = C::prime_subgroup_generator().into();
 70        Parameters { generator }
 71    }
 72
 73    // signer
 74    pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
 75        let secret_key = C::ScalarField::rand(rng);
 76        let public_key = parameters.generator.mul(secret_key).into();
 77        (public_key, secret_key)
 78    }
 79
 80    pub fn new_request_params<R: Rng>(
 81        parameters: &Parameters<C>,
 82        rng: &mut R,
 83    ) -> (C::ScalarField, C::Affine) {
 84        let k = C::ScalarField::rand(rng);
 85        let R = parameters.generator.mul(k).into();
 86        (k, R)
 87    }
 88
 89    pub fn blind_sign(
 90        sk: SecretKey<C>,
 91        k: C::ScalarField,
 92        m_blinded: C::ScalarField,
 93    ) -> BlindedSignature<C> {
 94        sk * m_blinded + k
 95    }
 96
 97    // requester
 98    pub fn new_blind_params<R: Rng>(
 99        parameters: &Parameters<C>,
100        rng: &mut R,
101        signer_r: C::Affine,
102    ) -> UserSecretData<C>
103    where
104        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
105    {
106        let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
107        u.a = C::ScalarField::rand(rng);
108        u.b = C::ScalarField::rand(rng);
109
110        // R = aR' + bG
111        let aR = signer_r.mul(u.a.into_repr());
112        let bG = parameters.generator.mul(u.b.into_repr());
113        u.r = aR.into_affine() + bG.into_affine();
114
115        let r = EdwardsAffine::from(u.r); // WIP
116        let one = BigInteger256::from(1u64);
117        let x_repr = r.x.into_repr();
118        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
119        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
120
121        if !(x_repr >= one && x_repr < modulus_repr) {
122            // TODO maybe add a counter of attempts with a limit
123            return Self::new_blind_params(parameters, rng, signer_r);
124        }
125        u
126    }
127
128    pub fn blind<R: Rng>(
129        parameters: &Parameters<C>,
130        rng: &mut R,
131        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
132        m: &[ConstraintF<C>],
133        signer_r: C::Affine,
134    ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
135    where
136        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
137    {
138        let u = Self::new_blind_params(parameters, rng, signer_r);
139
140        // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
141        // will not overflow (giving None)
142        let r = EdwardsAffine::from(u.r); // WIP
143        let x_fr = C::ScalarField::from(r.x.into_repr());
144
145        // m' = a^-1 rx h(m)
146        // TODO hash(m) must be \in Fr
147        let hm = poseidon_hash.hash(m)?;
148        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
149        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm)?); // WIP TMP
150        let m_blinded = u.a.inverse().unwrap() * x_fr * hm_fr;
151        // let m_blinded = C::ScalarField::from(u.a.inverse().unwrap() * x_fr) * hm_fr;
152
153        Ok((m_blinded, u))
154    }
155
156    pub fn unblind(s_blinded: C::ScalarField, u: UserSecretData<C>) -> Signature<C> {
157        // s = a s' + b
158        let s = u.a * s_blinded + u.b;
159        Signature { s, r: u.r }
160    }
161
162    pub fn verify(
163        parameters: &Parameters<C>,
164        poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
165        m: &[ConstraintF<C>],
166        s: Signature<C>,
167        q: PublicKey<C>,
168    ) -> bool
169    where
170        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
171    {
172        let sG = parameters.generator.mul(s.s.into_repr());
173
174        // TODO the output of hash(m) must be \in Fr
175        let hm = poseidon_hash.hash(m).unwrap();
176        // let hm_fr = C::ScalarField::from_repr(hm.into_repr()).unwrap();
177        let hm_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(hm).unwrap()); // WIP TMP
178
179        // check that s.R.x is in Fr
180        let r = EdwardsAffine::from(s.r); // WIP
181        let one = BigInteger256::from(1u64);
182        let x_repr = r.x.into_repr();
183        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
184        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
185        if !(x_repr >= one && x_repr < modulus_repr) {
186            return false;
187        }
188        // get s.R.x
189        let x_fr = C::ScalarField::from(r.x.into_repr());
190        let right = s.r + q.mul((x_fr * hm_fr).into_repr()).into_affine();
191
192        sG.into_affine() == right
193    }
194}
195
196// poseidon
197pub fn poseidon_setup_params<F: PrimeField>(
198    curve: Curve,
199    exp: i8,
200    width: u8,
201) -> poseidon::PoseidonParameters<F> {
202    let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
203
204    let mds_f = bytes_matrix_to_f(&pos_data.mds);
205    let rounds_f = bytes_vec_to_f(&pos_data.rounds);
206
207    poseidon::PoseidonParameters {
208        mds_matrix: mds_f,
209        round_keys: rounds_f,
210        full_rounds: pos_data.full_rounds,
211        partial_rounds: pos_data.partial_rounds,
212        sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
213        width: pos_data.width,
214    }
215}
216
217#[cfg(test)]
218mod tests {
219    use super::*;
220    use ark_ed_on_bn254::EdwardsProjective;
221    pub type Fq = ark_ed_on_bn254::Fq; // base field
222                                       // pub type Fr = ark_ed_on_bn254::Fr; // scalar field
223
224    #[test]
225    fn test_blind_signature_flow_native() {
226        type S = BlindSigScheme<EdwardsProjective>;
227
228        let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
229        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
230
231        let mut rng = ark_std::test_rng();
232
233        let params = S::setup();
234        let (pk, sk) = S::keygen(&params, &mut rng);
235
236        let (k, signer_r) = S::new_request_params(&params, &mut rng);
237        let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
238
239        let (m_blinded, u) = S::blind(&params, &mut rng, &poseidon_hash, &m, signer_r).unwrap();
240
241        let s_blinded = S::blind_sign(sk, k, m_blinded);
242
243        let s = S::unblind(s_blinded, u);
244
245        let verified = S::verify(&params, &poseidon_hash, &m, s, pk);
246        assert!(verified);
247    }
248}