math/ring-signatures.sage

from hashlib import sha256

# Ring Signatures
# bLSAG: Back’s Linkable Spontaneous Anonymous Group signatures
#
# A Rust implementation of this scheme can be found at:
# https://github.com/arnaucube/ring-signatures-rs

def hashToPoint(a):
    # TODO use a proper hash-to-point
    h = sha256((str(a)).encode('utf-8'))
    r = int(h.hexdigest(), 16) * g
    return r

def hash(R, m, A, B, q):
    h = sha256((
        str(R) + str(m) + str(A) + str(B)
        ).encode('utf-8'))
    r = int(h.hexdigest(), 16)
    return int(mod(r, q))

def print_ring(a):
    print("ring of c's:")
    for i in range(len(a)):
        print(i, a[i])
    print("")

class Prover:
    def __init__(self, F, g):
        self.F = F # Z_p
        self.g = g # elliptic curve generator
        self.q = self.g.order() # order of group

    def new_key(self):
        self.w = int(self.F.random_element())
        self.K = self.g * self.w
        return self.K

    def sign(self, m, R):
        # determine pi (the position of signer's public key in R
        pi = -1
        for i in range(len(R)):
            if self.K == R[i]:
                pi = i
                break
        assert pi>=0

        a = int(self.F.random_element())
        r = [None] * len(R)
        # for i \in {1, 2, ..., n} \ {i=pi}
        for i in range(0, len(R)):
            if i==pi:
                continue

            r[i] = int(mod(int(self.F.random_element()), self.q))

        c = [None] * len(R)
        # c_{pi+1}
        pi1 = mod(pi + 1, len(R))
        c[pi1] = hash(R, m, a * self.g, hashToPoint(R[pi]) * a, self.q)

        key_image = self.w * hashToPoint(self.K)

        # do c_{i+1} from i=pi+1 to pi-1:
        for j in range(0, len(R)-1):
            i = mod(pi1+j, len(R))
            i1 = mod(pi1+j +1, len(R))

            c[i1] = hash(R, m, r[i] * self.g + c[i] * R[i], r[i] * hashToPoint(R[i]) + c[i] * key_image, self.q)

        # compute r_pi
        r[pi] = int(mod(a - c[pi] * self.w, self.q))
        print_ring(c)

        return [c[0], r]

def verify(g, R, m, key_image, sig):
    q = g.order()
    c1 = sig[0]
    r = sig[1]
    assert len(R) == len(r)

    # check that key_image \in G (EC), by l * key_image == 0
    assert q * key_image == 0 # in sage 0 EC point is represented as (0:1:0)


    # for i \in 1,2,...,n
    c = [None] * len(R)
    c[0] = c1
    for j in range(0, len(R)):
        i = mod(j, len(R))
        i1 = mod(j+1, len(R))
        c[i1] = hash(R, m, r[i] * g + c[i] * R[i], r[i] * hashToPoint(R[i]) + c[i] * key_image, q)

    print_ring(c)
    assert c1 == c[0]

# Tests
import unittest, operator

# ethereum elliptic curve
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
a = 0
b = 7
F = GF(p)
E = EllipticCurve(F, [a,b])
GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
g = E(GX,GY)
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
h = 1
q = g.order()
assert is_prime(p)
assert is_prime(q)
assert g * q == 0


class TestRingSignatures(unittest.TestCase):
        def test_bLSAG_ring_of_5(self):
                test_bLSAG(5, 3)
        def test_bLSAG_ring_of_20(self):
                test_bLSAG(20, 14)

def test_bLSAG(ring_size, pi):
        print(f"[bLSAG] Testing with a ring of {ring_size} keys")
        prover = Prover(F, g)
        n = ring_size
        R = [None] * n

        # generate prover's key pair
        K_pi = prover.new_key()

        # generate other n public keys
        for i in range(0, n):
            R[i] = g * i

        # set K_pi
        R[pi] = K_pi

        # sign m
        m = 1234
        print("sign")
        sig = prover.sign(m, R)

        print("verify")
        key_image = prover.w * hashToPoint(prover.K)
        verify(g, R, m, key_image, sig)

if __name__ == '__main__':
        unittest.main()