mirror of
https://github.com/arnaucube/go-snark-study.git
synced 2026-02-03 01:36:41 +01:00
e(Vb, piB) == e(piB', g2) proof
This commit is contained in:
arnaucube
113
zk/zk.go
113
zk/zk.go
@@ -6,13 +6,16 @@ import (
|
||||
"math/big"
|
||||
|
||||
"github.com/arnaucube/go-snark/bn128"
|
||||
"github.com/arnaucube/go-snark/fields"
|
||||
)
|
||||
|
||||
type Setup struct {
|
||||
T *big.Int // trusted setup secret
|
||||
Ka *big.Int // trusted setup
|
||||
Kb *big.Int // trusted setup
|
||||
Kc *big.Int // trusted setup
|
||||
Toxic struct {
|
||||
T *big.Int // trusted setup secret
|
||||
Ka *big.Int // prover
|
||||
Kb *big.Int // prover
|
||||
Kc *big.Int // prover
|
||||
}
|
||||
|
||||
// public
|
||||
G1T [][3]*big.Int // t encrypted in G1 curve
|
||||
@@ -22,12 +25,12 @@ type Proof struct {
|
||||
PiA [3]*big.Int
|
||||
PiAp [3]*big.Int
|
||||
PiB [3][2]*big.Int
|
||||
PiBp [3][2]*big.Int
|
||||
PiBp [3]*big.Int
|
||||
PiC [3]*big.Int
|
||||
PiCp [3]*big.Int
|
||||
PiH [3]*big.Int
|
||||
Va [3][2]*big.Int
|
||||
Vb [3][2]*big.Int
|
||||
Vb [3]*big.Int
|
||||
Vc [3][2]*big.Int
|
||||
Vz [3][2]*big.Int
|
||||
}
|
||||
@@ -38,18 +41,18 @@ func GenerateTrustedSetup(bn bn128.Bn128, pollength int) (Setup, error) {
|
||||
var setup Setup
|
||||
var err error
|
||||
// generate random t value
|
||||
setup.T, err = rand.Prime(rand.Reader, bits)
|
||||
setup.Toxic.T, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Setup{}, err
|
||||
}
|
||||
fmt.Print("trusted t: ")
|
||||
fmt.Println(setup.T)
|
||||
fmt.Println(setup.Toxic.T)
|
||||
|
||||
// encrypt t values with curve generators
|
||||
var gt1 [][3]*big.Int
|
||||
var gt2 [][3][2]*big.Int
|
||||
for i := 0; i < pollength; i++ {
|
||||
tPow := bn.Fq1.Exp(setup.T, big.NewInt(int64(i)))
|
||||
tPow := bn.Fq1.Exp(setup.Toxic.T, big.NewInt(int64(i)))
|
||||
tEncr1 := bn.G1.MulScalar(bn.G1.G, tPow)
|
||||
gt1 = append(gt1, tEncr1)
|
||||
tEncr2 := bn.G2.MulScalar(bn.G2.G, tPow)
|
||||
@@ -60,67 +63,73 @@ func GenerateTrustedSetup(bn bn128.Bn128, pollength int) (Setup, error) {
|
||||
setup.G1T = gt1
|
||||
setup.G2T = gt2
|
||||
|
||||
// k for pi'
|
||||
setup.Ka, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Setup{}, err
|
||||
}
|
||||
setup.Kb, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Setup{}, err
|
||||
}
|
||||
setup.Kc, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Setup{}, err
|
||||
}
|
||||
|
||||
return setup, nil
|
||||
}
|
||||
|
||||
func GenerateProofs(bn bn128.Bn128, setup Setup, ax, bx, cx, hx, zx []*big.Int) Proof {
|
||||
func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, ax, bx, cx, hx, zx []*big.Int) (Proof, error) {
|
||||
var proof Proof
|
||||
var err error
|
||||
|
||||
// g1*A(x)
|
||||
// k for calculating pi' and Vk
|
||||
setup.Toxic.Ka, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Proof{}, err
|
||||
}
|
||||
setup.Toxic.Kb, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Proof{}, err
|
||||
}
|
||||
setup.Toxic.Kc, err = rand.Prime(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return Proof{}, err
|
||||
}
|
||||
|
||||
// g1*A(t)
|
||||
proof.PiA = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
|
||||
for i := 0; i < len(ax); i++ {
|
||||
m := bn.G1.MulScalar(setup.G1T[i], ax[i])
|
||||
proof.PiA = bn.G1.Add(proof.PiA, m)
|
||||
}
|
||||
proof.PiAp = bn.G1.MulScalar(proof.PiA, setup.Ka)
|
||||
proof.PiAp = bn.G1.MulScalar(proof.PiA, setup.Toxic.Ka)
|
||||
|
||||
// g1*B(x)
|
||||
// g2*B(t)
|
||||
proof.PiB = bn.Fq6.Zero()
|
||||
// g1*B(t)
|
||||
pib1 := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
|
||||
for i := 0; i < len(bx); i++ {
|
||||
m := bn.G2.MulScalar(setup.G2T[i], bx[i])
|
||||
proof.PiB = bn.G2.Add(proof.PiB, m)
|
||||
m1 := bn.G1.MulScalar(setup.G1T[i], bx[i])
|
||||
pib1 = bn.G1.Add(pib1, m1)
|
||||
}
|
||||
proof.PiBp = bn.G2.MulScalar(proof.PiB, setup.Kb)
|
||||
proof.PiBp = bn.G1.MulScalar(pib1, setup.Toxic.Kb)
|
||||
|
||||
// g1*C(x)
|
||||
// g1*C(t)
|
||||
proof.PiC = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
|
||||
for i := 0; i < len(cx); i++ {
|
||||
m := bn.G1.MulScalar(setup.G1T[i], cx[i])
|
||||
proof.PiC = bn.G1.Add(proof.PiC, m)
|
||||
}
|
||||
proof.PiCp = bn.G1.MulScalar(proof.PiC, setup.Kc)
|
||||
proof.PiCp = bn.G1.MulScalar(proof.PiC, setup.Toxic.Kc)
|
||||
|
||||
g1Ht := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
|
||||
// g1*H(t)
|
||||
proof.PiH = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
|
||||
for i := 0; i < len(hx); i++ {
|
||||
m := bn.G1.MulScalar(setup.G1T[i], hx[i])
|
||||
g1Ht = bn.G1.Add(g1Ht, m)
|
||||
proof.PiH = bn.G1.Add(proof.PiH, m)
|
||||
}
|
||||
|
||||
g2Zt := bn.Fq6.Zero()
|
||||
for i := 0; i < len(bx); i++ {
|
||||
m := bn.G2.MulScalar(setup.G2T[i], zx[i])
|
||||
g2Zt = bn.G2.Add(g2Zt, m)
|
||||
}
|
||||
proof.PiH = g1Ht
|
||||
proof.Vz = g2Zt
|
||||
proof.Va = bn.G2.MulScalar(bn.G2.G, setup.Ka)
|
||||
proof.Vb = bn.G2.MulScalar(bn.G2.G, setup.Kb)
|
||||
proof.Vc = bn.G2.MulScalar(bn.G2.G, setup.Kc)
|
||||
proof.Va = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Ka)
|
||||
proof.Vb = bn.G1.MulScalar(bn.G1.G, setup.Toxic.Kb)
|
||||
proof.Vc = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kc)
|
||||
|
||||
return proof
|
||||
return proof, nil
|
||||
}
|
||||
|
||||
func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
|
||||
@@ -138,7 +147,18 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// e(piB, Vb) == e(piB', g2)
|
||||
// e(Vb, piB) == e(piB', g2)
|
||||
pairingVbPib, err := bn.Pairing(proof.Vb, proof.PiB)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
pairingPibpG2, err := bn.Pairing(proof.PiBp, bn.G2.G)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
if !bn.Fq12.Equal(pairingVbPib, pairingPibpG2) {
|
||||
return false
|
||||
}
|
||||
|
||||
// e(piC, Vc) == e(piC', g2)
|
||||
pairingPicVc, err := bn.Pairing(proof.PiC, proof.Vc)
|
||||
@@ -153,7 +173,22 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
//
|
||||
// e(piA, piB) == e(piH, Vz) * e(piC, g2)
|
||||
// pairingPiaPib, err := bn.Pairing(proof.PiA, proof.PiB)
|
||||
// if err != nil {
|
||||
// return false
|
||||
// }
|
||||
// pairingPihVz, err := bn.Pairing(proof.PiH, proof.Vz)
|
||||
// if err != nil {
|
||||
// return false
|
||||
// }
|
||||
// pairingPicG2, err := bn.Pairing(proof.PiC, bn.G2.G)
|
||||
// if err != nil {
|
||||
// return false
|
||||
// }
|
||||
// if !bn.Fq12.Equal(pairingPiaPib, bn.Fq12.Mul(pairingPihVz, pairingPicG2)) {
|
||||
// return false
|
||||
// }
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
@@ -71,7 +71,8 @@ func TestZk(t *testing.T) {
|
||||
fmt.Println(setup.G2T)
|
||||
|
||||
// piA = g1 * A(t), piB = g2 * B(t), piC = g1 * C(t), piH = g1 * H(t)
|
||||
proof := GenerateProofs(bn, setup, ax, bx, cx, hx, zx)
|
||||
proof, err := GenerateProofs(bn, f, setup, ax, bx, cx, hx, zx)
|
||||
assert.Nil(t, err)
|
||||
fmt.Println("proofs:")
|
||||
fmt.Println(proof.PiA)
|
||||
fmt.Println(proof.PiB)
|
||||
@@ -79,5 +80,10 @@ func TestZk(t *testing.T) {
|
||||
fmt.Println(proof.PiH)
|
||||
fmt.Println(proof.Vz)
|
||||
|
||||
assert.True(t, VerifyProof(bn, setup, proof))
|
||||
publicSetup := Setup{
|
||||
G1T: setup.G1T,
|
||||
G2T: setup.G2T,
|
||||
}
|
||||
|
||||
assert.True(t, VerifyProof(bn, publicSetup, proof))
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user