You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

150 lines
3.8 KiB

  1. from hashlib import sha256
  2. # Ring Signatures
  3. # bLSAG: Back’s Linkable Spontaneous Anonymous Group signatures
  4. #
  5. # A Rust implementation of this scheme can be found at:
  6. # https://github.com/arnaucube/ring-signatures-rs
  7. def hashToPoint(a):
  8. # TODO use a proper hash-to-point
  9. h = sha256((str(a)).encode('utf-8'))
  10. r = int(h.hexdigest(), 16) * g
  11. return r
  12. def hash(R, m, A, B, q):
  13. h = sha256((
  14. str(R) + str(m) + str(A) + str(B)
  15. ).encode('utf-8'))
  16. r = int(h.hexdigest(), 16)
  17. return int(mod(r, q))
  18. def print_ring(a):
  19. print("ring of c's:")
  20. for i in range(len(a)):
  21. print(i, a[i])
  22. print("")
  23. class Prover:
  24. def __init__(self, F, g):
  25. self.F = F # Z_p
  26. self.g = g # elliptic curve generator
  27. self.q = self.g.order() # order of group
  28. def new_key(self):
  29. self.w = int(self.F.random_element())
  30. self.K = self.g * self.w
  31. return self.K
  32. def sign(self, m, R):
  33. # determine pi (the position of signer's public key in R
  34. pi = -1
  35. for i in range(len(R)):
  36. if self.K == R[i]:
  37. pi = i
  38. break
  39. assert pi>=0
  40. a = int(self.F.random_element())
  41. r = [None] * len(R)
  42. # for i \in {1, 2, ..., n} \ {i=pi}
  43. for i in range(0, len(R)):
  44. if i==pi:
  45. continue
  46. r[i] = int(mod(int(self.F.random_element()), self.q))
  47. c = [None] * len(R)
  48. # c_{pi+1}
  49. pi1 = mod(pi + 1, len(R))
  50. c[pi1] = hash(R, m, a * self.g, hashToPoint(R[pi]) * a, self.q)
  51. key_image = self.w * hashToPoint(self.K)
  52. # do c_{i+1} from i=pi+1 to pi-1:
  53. for j in range(0, len(R)-1):
  54. i = mod(pi1+j, len(R))
  55. i1 = mod(pi1+j +1, len(R))
  56. c[i1] = hash(R, m, r[i] * self.g + c[i] * R[i], r[i] * hashToPoint(R[i]) + c[i] * key_image, self.q)
  57. # compute r_pi
  58. r[pi] = int(mod(a - c[pi] * self.w, self.q))
  59. print_ring(c)
  60. return [c[0], r]
  61. def verify(g, R, m, key_image, sig):
  62. q = g.order()
  63. c1 = sig[0]
  64. r = sig[1]
  65. assert len(R) == len(r)
  66. # check that key_image \in G (EC), by l * key_image == 0
  67. assert q * key_image == 0 # in sage 0 EC point is represented as (0:1:0)
  68. # for i \in 1,2,...,n
  69. c = [None] * len(R)
  70. c[0] = c1
  71. for j in range(0, len(R)):
  72. i = mod(j, len(R))
  73. i1 = mod(j+1, len(R))
  74. c[i1] = hash(R, m, r[i] * g + c[i] * R[i], r[i] * hashToPoint(R[i]) + c[i] * key_image, q)
  75. print_ring(c)
  76. assert c1 == c[0]
  77. # Tests
  78. import unittest, operator
  79. # ethereum elliptic curve
  80. p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
  81. a = 0
  82. b = 7
  83. F = GF(p)
  84. E = EllipticCurve(F, [a,b])
  85. GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
  86. GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
  87. g = E(GX,GY)
  88. n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
  89. h = 1
  90. q = g.order()
  91. assert is_prime(p)
  92. assert is_prime(q)
  93. assert g * q == 0
  94. class TestRingSignatures(unittest.TestCase):
  95. def test_bLSAG_ring_of_5(self):
  96. test_bLSAG(5, 3)
  97. def test_bLSAG_ring_of_20(self):
  98. test_bLSAG(20, 14)
  99. def test_bLSAG(ring_size, pi):
  100. print(f"[bLSAG] Testing with a ring of {ring_size} keys")
  101. prover = Prover(F, g)
  102. n = ring_size
  103. R = [None] * n
  104. # generate prover's key pair
  105. K_pi = prover.new_key()
  106. # generate other n public keys
  107. for i in range(0, n):
  108. R[i] = g * i
  109. # set K_pi
  110. R[pi] = K_pi
  111. # sign m
  112. m = 1234
  113. print("sign")
  114. sig = prover.sign(m, R)
  115. print("verify")
  116. key_image = prover.w * hashToPoint(prover.K)
  117. verify(g, R, m, key_image, sig)
  118. if __name__ == '__main__':
  119. unittest.main()