ark-ec-blind-signatures/src/schnorr_blind/mod.rs
src/schnorr_blind/mod.rsRaw
1#![allow(non_snake_case)]
2#![allow(clippy::many_single_char_names)]
3
4// #[cfg(feature="r1cs")]
5// pub mod constraints;
6
7use ark_ec::{models::twisted_edwards_extended::GroupAffine, AffineCurve, ProjectiveCurve};
8
9use ark_ff::{to_bytes, BigInteger256, Field, Fp256, FpParameters, PrimeField};
10
11use ark_std::marker::PhantomData;
12use ark_std::{rand::Rng, UniformRand};
13use derivative::Derivative;
14
15// hash
16use arkworks_native_gadgets::poseidon;
17use arkworks_native_gadgets::poseidon::FieldHasher;
18use arkworks_utils::{
19 bytes_matrix_to_f, bytes_vec_to_f, poseidon_params::setup_poseidon_params, Curve,
20};
21
22// WIP
23use ark_ed_on_bn254::{EdwardsAffine, EdwardsParameters, FqParameters};
24
25pub type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
26pub type SecretKey<C> = <C as ProjectiveCurve>::ScalarField;
27pub type PublicKey<C> = <C as ProjectiveCurve>::Affine;
28pub type BlindedSignature<C> = <C as ProjectiveCurve>::ScalarField;
29
30// #[derive(Derivative)]
31#[derive(Clone, Default, Debug)]
32pub struct Signature<C: ProjectiveCurve> {
33 s: C::ScalarField, // ScalarField == Fr
34 r: <C as ProjectiveCurve>::Affine,
35}
36
37#[derive(Clone, Default, Debug)]
38pub struct UserSecretData<C: ProjectiveCurve> {
39 alpha: C::ScalarField,
40 beta: C::ScalarField,
41 R: C::Affine,
42}
43impl<C: ProjectiveCurve> UserSecretData<C> {
44 fn new_empty(parameters: &Parameters<C>) -> Self {
45 UserSecretData {
46 alpha: C::ScalarField::from(0_u32),
47 beta: C::ScalarField::from(0_u32),
48 R: parameters.generator, // WIP
49 }
50 }
51}
52
53#[derive(Derivative)]
54#[derivative(Clone(bound = "C: ProjectiveCurve"), Debug)]
55pub struct Parameters<C: ProjectiveCurve> {
56 pub generator: C::Affine,
57}
58
59pub struct BlindSigScheme<C: ProjectiveCurve> {
60 _group: PhantomData<C>,
61}
62
63impl<C: ProjectiveCurve> BlindSigScheme<C>
64where
65 C::ScalarField: PrimeField,
66 GroupAffine<EdwardsParameters>: From<<C as ProjectiveCurve>::Affine>, // WIP
67{
68 pub fn setup() -> Parameters<C> {
69 let generator = C::prime_subgroup_generator().into();
70 Parameters { generator }
71 }
72
73 // signer
74 pub fn keygen<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (PublicKey<C>, SecretKey<C>) {
75 let secret_key = C::ScalarField::rand(rng);
76 let public_key = parameters.generator.mul(secret_key).into();
77 (public_key, secret_key)
78 }
79
80 pub fn new_request_params<R: Rng>(
81 parameters: &Parameters<C>,
82 rng: &mut R,
83 ) -> (C::ScalarField, C::Affine) {
84 let r = C::ScalarField::rand(rng);
85 let R_ = parameters.generator.mul(r).into();
86 (r, R_)
87 }
88
89 pub fn blind_sign(
90 sk: SecretKey<C>,
91 r: C::ScalarField,
92 m_blinded: C::ScalarField,
93 ) -> BlindedSignature<C> {
94 r + m_blinded * sk
95 }
96
97 // new_k_and_R returns a new k \in Fr, and R=k * G, such that R.x \in Fr
98 fn new_k_and_R<R: Rng>(parameters: &Parameters<C>, rng: &mut R) -> (C::ScalarField, C::Affine)
99 where
100 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
101 {
102 // TODO, for schorr, the H(R, m) needs to be \in Fr, not R.x
103 let k = C::ScalarField::rand(rng);
104
105 let R: C::Affine = parameters.generator.mul(k.into_repr()).into();
106 let r = EdwardsAffine::from(R); // WIP
107
108 let one = BigInteger256::from(1u64);
109 let x_repr = r.x.into_repr();
110 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
111 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
112
113 if !(x_repr >= one && x_repr < modulus_repr) {
114 // TODO maybe add a counter of attempts with a limit
115 return Self::new_k_and_R(parameters, rng);
116 }
117
118 (k, R)
119 }
120
121 // non_blind_sign performs a non-blind signature, which can be verified with the same check
122 // than a blind-signature
123 pub fn non_blind_sign<R: Rng>(
124 parameters: &Parameters<C>,
125 rng: &mut R,
126 poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
127 sk: SecretKey<C>,
128 m: &[ConstraintF<C>],
129 ) -> Result<Signature<C>, ark_crypto_primitives::Error>
130 where
131 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
132 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
133 {
134 let (r, R) = Self::new_k_and_R(parameters, rng);
135 let R_ed = EdwardsAffine::from(R); // WIP
136
137 let hm = poseidon_hash.hash(m)?;
138 let to_hash: [ConstraintF<C>; 3] = [R_ed.x.into(), R_ed.y.into(), hm];
139 let h = poseidon_hash.hash(&to_hash)?;
140 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h)?); // WIP TMP
141
142 let s = r + h_fr * sk;
143 Ok(Signature { s, r: R })
144 }
145
146 // requester
147 pub fn new_blind_params<R: Rng>(
148 parameters: &Parameters<C>,
149 rng: &mut R,
150 signer_pk: PublicKey<C>,
151 signer_r: C::Affine,
152 ) -> UserSecretData<C>
153 where
154 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
155 {
156 let mut u: UserSecretData<C> = UserSecretData::new_empty(parameters);
157 u.alpha = C::ScalarField::rand(rng);
158 u.beta = C::ScalarField::rand(rng);
159
160 // R = R' + alpha * G + beta * X
161 let alphaG = parameters.generator.mul(u.alpha.into_repr());
162 let betaPk = signer_pk.mul(u.beta.into_repr());
163 u.R = signer_r + alphaG.into_affine() + betaPk.into_affine();
164
165 let R = EdwardsAffine::from(u.R); // WIP
166 let one = BigInteger256::from(1u64);
167 let x_repr = R.x.into_repr();
168 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
169 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
170
171 if !(x_repr >= one && x_repr < modulus_repr) {
172 // TODO maybe add a counter of attempts with a limit
173 return Self::new_blind_params(parameters, rng, signer_pk, signer_r);
174 }
175 u
176 }
177
178 pub fn blind<R: Rng>(
179 parameters: &Parameters<C>,
180 rng: &mut R,
181 poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
182 m: &[ConstraintF<C>],
183 signer_pk: PublicKey<C>,
184 signer_r: C::Affine,
185 ) -> Result<(C::ScalarField, UserSecretData<C>), ark_crypto_primitives::Error>
186 where
187 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
188 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
189 {
190 let u = Self::new_blind_params(parameters, rng, signer_pk, signer_r);
191
192 // get X coordinate, as in new_blind_params we already checked that R.x is inside Fr and
193 // will not overflow (giving None)
194 let r = EdwardsAffine::from(u.R); // WIP
195
196 // m' = H(R, m) + beta
197 // TODO hash(R, m) must be \in Fr
198 let hm_0 = poseidon_hash.hash(m)?;
199 let to_hash: [ConstraintF<C>; 3] = [r.x.into(), r.y.into(), hm_0];
200 let h = poseidon_hash.hash(&to_hash)?;
201 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h)?); // WIP TMP
202 let m_blinded = h_fr + u.beta;
203
204 Ok((m_blinded, u))
205 }
206
207 pub fn unblind(s_blinded: C::ScalarField, u: &UserSecretData<C>) -> Signature<C> {
208 // s = s' + alpha
209 let s = s_blinded + u.alpha;
210 Signature { s, r: u.R }
211 }
212
213 pub fn verify(
214 parameters: &Parameters<C>,
215 poseidon_hash: &poseidon::Poseidon<ConstraintF<C>>,
216 m: &[ConstraintF<C>],
217 s: Signature<C>,
218 q: PublicKey<C>,
219 ) -> bool
220 where
221 <C as ProjectiveCurve>::ScalarField: From<BigInteger256>,
222 <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField: From<Fp256<FqParameters>>,
223 {
224 let sG = parameters.generator.mul(s.s.into_repr());
225
226 let r = EdwardsAffine::from(s.r); // WIP
227
228 // TODO the output of hash(R, m) must be \in Fr
229 let hm_0 = poseidon_hash.hash(m).unwrap();
230 let to_hash: [ConstraintF<C>; 3] = [r.x.into(), r.y.into(), hm_0];
231 let h = poseidon_hash.hash(&to_hash).unwrap();
232 let h_fr = C::ScalarField::from_le_bytes_mod_order(&to_bytes!(h).unwrap()); // WIP TMP
233
234 // TODO the output of hash(R, m) must be \in Fr
235 let one = BigInteger256::from(1u64);
236 let x_repr = r.x.into_repr();
237 let modulus = <<C::ScalarField as PrimeField>::Params as FpParameters>::MODULUS;
238 let modulus_repr = BigInteger256::try_from(modulus.into()).unwrap();
239 if !(x_repr >= one && x_repr < modulus_repr) {
240 return false;
241 }
242 let right = s.r + q.mul(h_fr.into_repr()).into_affine();
243
244 sG.into_affine() == right
245 }
246}
247
248// poseidon
249pub fn poseidon_setup_params<F: PrimeField>(
250 curve: Curve,
251 exp: i8,
252 width: u8,
253) -> poseidon::PoseidonParameters<F> {
254 let pos_data = setup_poseidon_params(curve, exp, width).unwrap();
255
256 let mds_f = bytes_matrix_to_f(&pos_data.mds);
257 let rounds_f = bytes_vec_to_f(&pos_data.rounds);
258
259 poseidon::PoseidonParameters {
260 mds_matrix: mds_f,
261 round_keys: rounds_f,
262 full_rounds: pos_data.full_rounds,
263 partial_rounds: pos_data.partial_rounds,
264 sbox: poseidon::sbox::PoseidonSbox(pos_data.exp),
265 width: pos_data.width,
266 }
267}
268
269#[cfg(test)]
270mod tests {
271 use super::*;
272 use ark_ed_on_bn254::EdwardsProjective;
273 pub type Fq = ark_ed_on_bn254::Fq; // base field
274 // pub type Fr = ark_ed_on_bn254::Fr; // scalar field
275
276 #[test]
277 fn test_blind_signature_flow_native() {
278 type S = BlindSigScheme<EdwardsProjective>;
279
280 let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
281 let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
282
283 let mut rng = ark_std::test_rng();
284
285 let params = S::setup();
286 let (pk, sk) = S::keygen(¶ms, &mut rng);
287
288 let (r, signer_r) = S::new_request_params(¶ms, &mut rng);
289 let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
290
291 let (m_blinded, u) = S::blind(¶ms, &mut rng, &poseidon_hash, &m, pk, signer_r).unwrap();
292
293 let s_blinded = S::blind_sign(sk, r, m_blinded);
294
295 let s = S::unblind(s_blinded, &u);
296
297 let verified = S::verify(¶ms, &poseidon_hash, &m, s, pk);
298 assert!(verified);
299 }
300
301 #[test]
302 fn test_non_blind_signature() {
303 type S = BlindSigScheme<EdwardsProjective>;
304
305 let poseidon_params = poseidon_setup_params::<Fq>(Curve::Bn254, 5, 4);
306 let poseidon_hash = poseidon::Poseidon::new(poseidon_params);
307
308 let mut rng = ark_std::test_rng();
309
310 let params = S::setup();
311 let (pk, sk) = S::keygen(¶ms, &mut rng);
312
313 let m = [Fq::from(1234), Fq::from(5689), Fq::from(3456)];
314 let s = S::non_blind_sign(¶ms, &mut rng, &poseidon_hash, sk, &m).unwrap();
315
316 // verify using the same verification method used for blind-signatures
317 let verified = S::verify(¶ms, &poseidon_hash, &m, s, pk);
318 assert!(verified);
319 }
320}