ark-ec-blind-signatures/src/schnorr_blind/mod.rs
src/schnorr_blind/mod.rsRaw
1#![allow(non_snake_case)]
2#![allow(clippy::many_single_char_names)]
3
4use crate::BlindSignatureScheme;
5
6// #[cfg(feature="r1cs")]
7pub mod constraints;
8
9use ark_ec::{models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve};
10
11use ark_ff::{to_bytes, BigInteger256, Field, Fp256, FpParameters, PrimeField};
12
13use ark_std::marker::PhantomData;
14use ark_std::{rand::Rng, UniformRand};
15use derivative::Derivative;
16
17// hash
18use arkworks_native_gadgets::poseidon;
19use arkworks_native_gadgets::poseidon::FieldHasher;
20use arkworks_utils::{
21 bytes_matrix_to_f, bytes_vec_to_f, poseidon_params::setup_poseidon_params, Curve,
22};
23
24// WIP
25use ark_ed_on_bn254::{EdwardsAffine, EdwardsParameters, FqParameters};
26
27pub type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
28pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
29pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
30pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
31
32#[derive(Clone, Debug)]
33pub struct Msg<const MSG_LEN: usize, C: ProjectiveCurve>(pub [ConstraintF<C>; MSG_LEN]);
34
35#[derive(Clone, Default, Debug)]
36pub struct Signature<C: ProjectiveCurve> {
37 s: C::ScalarField, // ScalarField == Fr
38 r: <C as ProjectiveCurve>::Affine,
39}
40
41#[derive(Clone, Default, Debug)]
42pub struct UserSecretData<C: ProjectiveCurve> {
43 alpha: C::ScalarField,
44 beta: C::ScalarField,
45 R: C::Affine,
46}
47impl<C: ProjectiveCurve> UserSecretData<C> {
48 fn new_empty(parameters: &Parameters<C>) -> Self {
49 UserSecretData {
50 alpha: C::ScalarField::from(0_u32),
51 beta: C::ScalarField::from(0_u32),
52 R: parameters.generator, // WIP
53 }
54 }
55}
56
57#[derive(Derivative)]
58#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
59pub struct Parameters<C: ProjectiveCurve> {
60 pub generator: C::Affine,
61 pub poseidon_hash: poseidon::Poseidon<ConstraintF<C>>,
62 // pub poseidon_hash: Box<dyn FieldHasher<ConstraintF<C>>>, // WIP
63}
64
65pub struct SchnorrBlindSig<C: ProjectiveCurve> {
66 _group: PhantomData<C>,
67}
68
69impl<C: ProjectiveCurve> BlindSignatureScheme for SchnorrBlindSig<C>
70where
71 C::ScalarField: PrimeField,
72 GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
73 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
74 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
75{
76 type Parameters = Parameters<C>;
77 type Fq = C::BaseField;
78 type Fr = C::ScalarField;
79 type ConstraintF = ConstraintF<C>; // WIP merge it with Fq
80 type PointAffine = C::Affine;
81 type SecretKey = SecretKey<C>;
82 type PublicKey = PublicKey<C>;
83 // type Msg = Msg<MSG_LEN, C>;
84 type BlindedSignature = BlindedSignature<C>;
85 type Signature = Signature<C>;
86 type UserSecretData = UserSecretData<C>;
87
88 fn setup(poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>) -> Self::Parameters {
89 let generator = C::prime_subgroup_generator().into();
90 Parameters {
91 generator,
92 poseidon_hash: poseidon_hash.clone(), // WIP
93 }
94 }
95
96 // signer
97 fn keygen<R: Rng>(
98 parameters: &Self::Parameters,
99 rng: &mut R,
100 ) -> (Self::PublicKey, Self::SecretKey) {
101 let secret_key = C::ScalarField::rand(rng);
102 let public_key = parameters.generator.mul(secret_key).into();
103 (public_key, secret_key)
104 }
105
106 fn new_request_params<R: Rng>(
107 parameters: &Self::Parameters,
108 rng: &mut R,
109 ) -> (Self::Fr, Self::PointAffine) {
110 let r = C::ScalarField::rand(rng);
111 let R_ = parameters.generator.mul(r).into();
112 (r, R_)
113 }
114
115 fn blind_sign(sk: SecretKey<C>, r: Self::Fr, m_blinded: Self::Fr) -> Self::BlindedSignature {
116 r + m_blinded * sk
117 }
118
119 // non_blind_sign performs a non-blind signature, which can be verified with the same check
120 // than a blind-signature
121 fn non_blind_sign<R: Rng>(
122 parameters: &Self::Parameters,
123 rng: &mut R,
124 sk: Self::SecretKey,
125 m: &[ConstraintF<C>],
126 ) -> Result<Signature<C>, ark_crypto_primitives::Error>
127 where
128 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
129 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
130 {
131 let (r, R) = Self::new_k_and_R(parameters, rng);
132 let R_ed = EdwardsAffine::from(R); // WIP
133
134 let hm = parameters.poseidon_hash.hash(m)?;
135 let to_hash: [ConstraintF<C>; 3] = [R_ed.x.into(), R_ed.y.into(), hm];
136 let h = parameters.poseidon_hash.hash(&to_hash)?;
137 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h)?); // WIP TMP
138
139 let s = r + h_fr * sk;
140 Ok(Signature { s, r: R })
141 }
142
143 fn blind<R: Rng>(
144 parameters: &Self::Parameters,
145 rng: &mut R,
146 m: &[Self::ConstraintF],
147 signer_pk: Self::PublicKey,
148 signer_r: Self::PointAffine,
149 ) -> Result<(Self::Fr, Self::UserSecretData), ark_crypto_primitives::Error>
150 where
151 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
152 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
153 {
154 let u = Self::new_blind_params(parameters, rng, signer_pk, signer_r);
155
156 // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
157 // will not overflow (giving None)
158 let r = EdwardsAffine::from(u.R); // WIP
159
160 // m' = H(R, m) + beta
161 // TODO hash(R, m) must be \in Fr
162 let hm_0 = parameters.poseidon_hash.hash(m)?;
163 let to_hash: [ConstraintF<C>; 3] = [r.x.into(), r.y.into(), hm_0];
164 let h = parameters.poseidon_hash.hash(&to_hash)?;
165 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h)?); // WIP TMP
166 let m_blinded = h_fr + u.beta;
167
168 Ok((m_blinded, u))
169 }
170
171 fn unblind(s_blinded: Self::Fr, u: &Self::UserSecretData) -> Self::Signature {
172 // s = s' + alpha
173 let s = s_blinded + u.alpha;
174 Signature { s, r: u.R }
175 }
176
177 fn verify(
178 parameters: &Self::Parameters,
179 m: &[Self::ConstraintF],
180 s: Self::Signature,
181 q: Self::PublicKey,
182 ) -> bool
183 where
184 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
185 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
186 {
187 let sG = parameters.generator.mul(s.s.into_repr());
188
189 let r = EdwardsAffine::from(s.r); // WIP: let r = s.r.into_affine();
190
191 // TODO the output of hash(R, m) must be \in Fr
192 let hm_0 = parameters.poseidon_hash.hash(m).unwrap();
193 let to_hash: [ConstraintF<C>; 3] = [r.x.into(), r.y.into(), hm_0];
194 let h = parameters.poseidon_hash.hash(&to_hash).unwrap();
195 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h).unwrap()); // WIP TMP
196
197 // TODO the output of hash(R, m) must be \in Fr
198 let one = BigInteger256::from(1u64);
199 let x_repr = r.x.into_repr();
200 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
201 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
202 if !(x_repr >= one && x_repr < modulus_repr) {
203 return false;
204 }
205 let right = s.r + q.mul(h_fr.into_repr()).into_affine();
206
207 sG.into_affine() == right
208 }
209}
210
211impl<C: ProjectiveCurve> SchnorrBlindSig<C>
212where
213 C::ScalarField: PrimeField,
214 GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
215{
216 // new_k_and_R returns a new k \in Fr, and R=k * G, such that R.x \in Fr
217 fn new_k_and_R<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (C::ScalarField, C::Affine)
218 where
219 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
220 {
221 // TODO, for Schnorr, the H(R, m) needs to be \in Fr, not R.x
222 let k = C::ScalarField::rand(rng);
223
224 let R: C::Affine = parameters.generator.mul(k.into_repr()).into();
225 let r = EdwardsAffine::from(R); // WIP
226
227 let one = BigInteger256::from(1u64);
228 let x_repr = r.x.into_repr();
229 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
230 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
231
232 if !(x_repr >= one && x_repr < modulus_repr) {
233 // TODO maybe add a counter of attempts with a limit
234 return Self::new_k_and_R(parameters, rng);
235 }
236
237 (k, R)
238 }
239
240 // requester
241 fn new_blind_params<R: Rng>(
242 parameters: &Parameters<C>,
243 rng: &mut R,
244 signer_pk: PublicKey<C>,
245 signer_r: C::Affine,
246 ) -> UserSecretData<C>
247 where
248 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
249 {
250 let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
251 u.alpha = C::ScalarField::rand(rng);
252 u.beta = C::ScalarField::rand(rng);
253
254 // R = R' + alpha * G + beta * X
255 let alphaG = parameters.generator.mul(u.alpha.into_repr());
256 let betaPk = signer_pk.mul(u.beta.into_repr());
257 u.R = signer_r + alphaG.into_affine() + betaPk.into_affine();
258
259 let R = EdwardsAffine::from(u.R); // WIP
260 let one = BigInteger256::from(1u64);
261 let x_repr = R.x.into_repr();
262 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
263 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
264
265 if !(x_repr >= one && x_repr < modulus_repr) {
266 // TODO maybe add a counter of attempts with a limit
267 return Self::new_blind_params(parameters, rng, signer_pk, signer_r);
268 }
269 u
270 }
271}
272
273// poseidon
274pub fn poseidon_setup_params<F: PrimeField>(
275 curve: Curve,
276 exp: i8,
277 width: u8,
278) -> poseidon::PoseidonParameters<F> {
279 let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
280
281 let mds_f = bytes_matrix_to_f(&pos_data.mds);
282 let rounds_f = bytes_vec_to_f(&pos_data.rounds);
283
284 poseidon::PoseidonParameters {
285 mds_matrix: mds_f,
286 round_keys: rounds_f,
287 full_rounds: pos_data.full_rounds,
288 partial_rounds: pos_data.partial_rounds,
289 sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
290 width: pos_data.width,
291 }
292}
293
294#[cfg(test)]
295mod tests {
296 use super::*;
297 use ark_ed_on_bn254::EdwardsProjective;
298 pub type Fq = ark_ed_on_bn254::Fq; // base field
299 // pub type Fr = ark_ed_on_bn254::Fr; // scalar field
300
301 #[test]
302 fn test_blind_signature_flow_native() {
303 type S = SchnorrBlindSig<EdwardsProjective>;
304
305 let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
306 let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
307
308 let mut rng = ark_std::test_rng();
309
310 let params = S::setup(&poseidon_hash);
311 let (pk, sk) = S::keygen(¶ms, &mut rng);
312
313 let (r, signer_R) = S::new_request_params(¶ms, &mut rng);
314 let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
315
316 let (m_blinded, u) = S::blind(¶ms, &mut rng, &m, pk, signer_R).unwrap();
317
318 let s_blinded = S::blind_sign(sk, r, m_blinded);
319
320 let s = S::unblind(s_blinded, &u);
321
322 let verified = S::verify(¶ms, &m, s, pk);
323 assert!(verified);
324 }
325
326 #[test]
327 fn test_non_blind_signature() {
328 type S = SchnorrBlindSig<EdwardsProjective>;
329
330 let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
331 let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
332
333 let mut rng = ark_std::test_rng();
334
335 let params = S::setup(&poseidon_hash);
336 let (pk, sk) = S::keygen(¶ms, &mut rng);
337
338 let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
339 let s = S::non_blind_sign(¶ms, &mut rng, sk, &m).unwrap();
340
341 // verify using the same verification method used for blind-signatures
342 let verified = S::verify(¶ms, &m, s, pk);
343 assert!(verified);
344 }
345}