1#![allow(non_snake_case)]
  2#![allow(clippy::many_single_char_names)]
  3
  4// #[cfg(feature="r1cs")]
  5pub mod constraints;
  6
  7use ark_ec::{
  8    models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve, TEModelParameters,
  9};
 10
 11use ark_ff::{
 12    to_bytes, BigInteger, BigInteger256, Field, Fp256, FpParameters, FromBytes, One, PrimeField,
 13    Zero,
 14};
 15
 16use ark_std::marker::PhantomData;
 17use ark_std::rand::{CryptoRng, RngCore};
 18use ark_std::{ops::Mul, rand::Rng, UniformRand};
 19use derivative::Derivative;
 20
 21// hash
 22use arkworks_native_gadgets::poseidon;
 23use arkworks_native_gadgets::poseidon::FieldHasher;
 24use arkworks_utils::{
 25    bytes_matrix_to_f, bytes_vec_to_f, parse_vec, poseidon_params::setup_poseidon_params, Curve,
 26};
 27
 28// WIP
 29use ark_ed_on_bn254::{
 30    EdwardsAffine, EdwardsParameters, EdwardsProjective, FqParameters, Fr, FrParameters,
 31};
 32
 33pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
 34pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
 35pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
 36
 37// #[derive(Derivative)]
 38#[derive(Clone, Default, Debug)]
 39pub struct Signature<C: ProjectiveCurve> {
 40    s: C::ScalarField, // ScalarField == Fr
 41    r: <C as ProjectiveCurve>::Affine,
 42}
 43
 44#[derive(Debug)]
 45pub struct UserSecretData<C: ProjectiveCurve> {
 46    a: C::ScalarField,
 47    b: C::ScalarField,
 48    r: C::Affine,
 49}
 50impl<C: ProjectiveCurve> UserSecretData<C> {
 51    fn new_empty(parameters: &Parameters<C>) -> Self {
 52        UserSecretData {
 53            a: C::ScalarField::from(0 as u32),
 54            b: C::ScalarField::from(0 as u32),
 55            r: parameters.generator, // WIP
 56        }
 57    }
 58}
 59
 60#[derive(Derivative)]
 61#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
 62pub struct Parameters<C: ProjectiveCurve> {
 63    pub generator: C::Affine,
 64}
 65
 66pub struct BlindSigScheme<C: ProjectiveCurve> {
 67    _group: PhantomData<C>,
 68}
 69
 70impl<C: ProjectiveCurve> BlindSigScheme<C>
 71where
 72    C::ScalarField: PrimeField,
 73    GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
 74{
 75    pub fn setup() -> Parameters<C> {
 76        let generator = C::prime_subgroup_generator().into();
 77        Parameters { generator }
 78    }
 79
 80    // signer
 81    pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
 82        let secret_key = C::ScalarField::rand(rng);
 83        let public_key = parameters.generator.mul(secret_key).into();
 84        (public_key, secret_key)
 85    }
 86
 87    pub fn new_request_params<R: Rng>(
 88        parameters: &Parameters<C>,
 89        rng: &mut R,
 90    ) -> (C::ScalarField, C::Affine) {
 91        let k = C::ScalarField::rand(rng);
 92        let R = parameters.generator.mul(k).into();
 93        (k, R)
 94    }
 95
 96    pub fn blind_sign(
 97        sk: SecretKey<C>,
 98        k: C::ScalarField,
 99        m_blinded: C::ScalarField,
100    ) -> BlindedSignature<C> {
101        sk * m_blinded + k
102    }
103
104    // requester
105    pub fn new_blind_params<R: Rng>(
106        parameters: &Parameters<C>,
107        rng: &mut R,
108        signer_r: C::Affine,
109    ) -> UserSecretData<C>
110    where
111        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
112    {
113        let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
114        u.a = C::ScalarField::rand(rng);
115        u.b = C::ScalarField::rand(rng);
116
117        // R = aR' + bG
118        let aR = signer_r.mul(u.a.into_repr());
119        let bG = parameters.generator.mul(u.b.into_repr());
120        u.r = aR.into_affine() + bG.into_affine();
121
122        let r = EdwardsAffine::from(u.r); // WIP
123        let one = BigInteger256::from(1u64);
124        let x_repr = r.x.into_repr();
125        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
126        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
127
128        if !(x_repr >= one && x_repr < modulus_repr) {
129            return Self::new_blind_params(parameters, rng, signer_r);
130        }
131        u
132    }
133
134    pub fn blind<R: Rng>(
135        parameters: &Parameters<C>,
136        rng: &mut R,
137        poseidon_hash: &poseidon::Poseidon<C::ScalarField>,
138        m: C::ScalarField,
139        signer_r: C::Affine,
140    ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
141    where
142        <C as ProjectiveCurve>::ScalarField: Mul<Fp256<FrParameters>>,
143        <C as ProjectiveCurve>::ScalarField:
144            From<<<C as ProjectiveCurve>::ScalarField as Mul<Fp256<FrParameters>>>::Output>,
145        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
146    {
147        let u = Self::new_blind_params(parameters, rng, signer_r);
148        // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
149        // will not give None
150        let r = EdwardsAffine::from(u.r); // WIP
151        let x_fr = C::ScalarField::from(r.x.into_repr());
152
153        // m' = a^-1 rx h(m)
154        let h_m = poseidon_hash.hash(&[m])?;
155        let m_blinded = C::ScalarField::from(u.a.inverse().unwrap() * x_fr) * h_m;
156
157        Ok((m_blinded, u))
158    }
159
160    pub fn unblind(s_blinded: C::ScalarField, u: UserSecretData<C>) -> Signature<C> {
161        // s = a s' + b
162        let s = u.a * s_blinded + u.b;
163        Signature { s, r: u.r }
164    }
165
166    pub fn verify(
167        parameters: &Parameters<C>,
168        poseidon_hash: &poseidon::Poseidon<C::ScalarField>,
169        m: C::ScalarField,
170        s: Signature<C>,
171        q: PublicKey<C>,
172    ) -> bool
173    where
174        <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
175    {
176        let sG = parameters.generator.mul(s.s.into_repr());
177
178        let h_m = poseidon_hash.hash(&[m]).unwrap();
179
180        // check that s.R.x is in Fr
181        let r = EdwardsAffine::from(s.r); // WIP
182        let one = BigInteger256::from(1u64);
183        let x_repr = r.x.into_repr();
184        let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
185        let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
186        if !(x_repr >= one && x_repr < modulus_repr) {
187            return false;
188        }
189        // get s.R.x
190        let x_fr = C::ScalarField::from(r.x.into_repr());
191        let right = s.r + q.mul((x_fr * h_m).into_repr()).into_affine();
192
193        sG.into_affine() == right
194    }
195}
196
197// poseidon
198pub fn poseidon_setup_params<F: PrimeField>(
199    curve: Curve,
200    exp: i8,
201    width: u8,
202) -> poseidon::PoseidonParameters<F> {
203    let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
204
205    let mds_f = bytes_matrix_to_f(&pos_data.mds);
206    let rounds_f = bytes_vec_to_f(&pos_data.rounds);
207
208    poseidon::PoseidonParameters {
209        mds_matrix: mds_f,
210        round_keys: rounds_f,
211        full_rounds: pos_data.full_rounds,
212        partial_rounds: pos_data.partial_rounds,
213        sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
214        width: pos_data.width,
215    }
216}
217
218#[cfg(test)]
219mod tests {
220    use super::*;
221    pub type ConstraintF = ark_ed_on_bn254::Fr; // scalar field
222
223    #[test]
224    fn test_blind() {
225        let poseidon_params = poseidon_setup_params::<ConstraintF>(Curve::Bn254, 5, 3);
226        let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
227
228        let mut rng = ark_std::test_rng();
229
230        let params = BlindSigScheme::<EdwardsProjective>::setup();
231        let (pk, sk) = BlindSigScheme::<EdwardsProjective>::keygen(&params, &mut rng);
232
233        let (k, signer_r) =
234            BlindSigScheme::<EdwardsProjective>::new_request_params(&params, &mut rng);
235        let m = ConstraintF::from(1234);
236
237        let (m_blinded, u) = BlindSigScheme::<EdwardsProjective>::blind(
238            &params,
239            &mut rng,
240            &poseidon_hash,
241            m,
242            signer_r,
243        )
244        .unwrap();
245
246        let s_blinded = BlindSigScheme::<EdwardsProjective>::blind_sign(sk, k, m_blinded);
247
248        let s = BlindSigScheme::<EdwardsProjective>::unblind(s_blinded, u);
249
250        let verified =
251            BlindSigScheme::<EdwardsProjective>::verify(&params, &poseidon_hash, m, s, pk);
252        assert!(verified);
253    }
254}