babyjubjub-ark/src/lib.rs
src/lib.rsRaw
1// For LICENSE check https://github.com/arnaucube/babyjubjub-rs
2
3extern crate rand;
4#[macro_use]
5extern crate ff;
6use ff::*;
7
8use poseidon_rs::Poseidon;
9pub type Fr = poseidon_rs::Fr; // alias
10
11#[macro_use]
12extern crate arrayref;
13extern crate generic_array;
14extern crate num;
15extern crate num_bigint;
16extern crate num_traits;
17
18extern crate rand6;
19use rand6::Rng;
20
21// use blake2::{Blake2b, Digest};
22
23#[cfg(feature = "default")]
24extern crate blake_hash; // compatible version with Blake used at circomlib
25#[cfg(feature = "default")]
26#[macro_use]
27use blake_hash::Digest;
28
29#[cfg(feature = "aarch64")]
30extern crate blake; // compatible version with Blake used at circomlib
31
32use std::cmp::min;
33
34use num_bigint::{BigInt, RandBigInt, Sign, ToBigInt};
35use num_traits::One;
36
37use generic_array::GenericArray;
38
39pub mod utils;
40
41#[macro_use]
42extern crate lazy_static;
43
44lazy_static! {
45 static ref D: Fr = Fr::from_str("168696").unwrap();
46 static ref D_big: BigInt = BigInt::parse_bytes(b"168696", 10).unwrap();
47 static ref A: Fr = Fr::from_str("168700").unwrap();
48 static ref A_big: BigInt = BigInt::parse_bytes(b"168700", 10).unwrap();
49 pub static ref Q: BigInt = BigInt::parse_bytes(
50 b"21888242871839275222246405745257275088548364400416034343698204186575808495617",10
51 )
52 .unwrap();
53 static ref B8: Point = Point {
54 x: Fr::from_str(
55 "5299619240641551281634865583518297030282874472190772894086521144482721001553",
56 )
57 .unwrap(),
58 y: Fr::from_str(
59 "16950150798460657717958625567821834550301663161624707787222815936182638968203",
60 )
61 .unwrap(),
62 };
63 static ref ORDER: Fr = Fr::from_str(
64 "21888242871839275222246405745257275088614511777268538073601725287587578984328",
65 )
66 .unwrap();
67
68 // SUBORDER = ORDER >> 3
69 static ref SUBORDER: BigInt = &BigInt::parse_bytes(
70 b"21888242871839275222246405745257275088614511777268538073601725287587578984328",
71 10,
72 )
73 .unwrap()
74 >> 3;
75 static ref poseidon: poseidon_rs::Poseidon = Poseidon::new();
76}
77
78#[derive(Clone, Debug)]
79pub struct PointProjective {
80 pub x: Fr,
81 pub y: Fr,
82 pub z: Fr,
83}
84
85impl PointProjective {
86 pub fn affine(&self) -> Point {
87 if self.z.is_zero() {
88 return Point {
89 x: Fr::zero(),
90 y: Fr::zero(),
91 };
92 }
93
94 let zinv = self.z.inverse().unwrap();
95 let mut x = self.x;
96 x.mul_assign(&zinv);
97 let mut y = self.y;
98 y.mul_assign(&zinv);
99
100 Point {
101 x: x.clone(),
102 y: y.clone(),
103 }
104 }
105 pub fn add(&self, q: &PointProjective) -> PointProjective {
106 // add-2008-bbjlp https://hyperelliptic.org/EFD/g1p/auto-twisted-projective.html#doubling-dbl-2008-bbjlp
107 let mut a = self.z;
108 a.mul_assign(&q.z);
109 let mut b = a;
110 b.square();
111 let mut c = self.x;
112 c.mul_assign(&q.x);
113 let mut d = self.y;
114 d.mul_assign(&q.y);
115 let mut e = D.clone();
116 e.mul_assign(&c);
117 e.mul_assign(&d);
118 let mut f = b;
119 f.sub_assign(&e);
120 let mut g = b;
121 g.add_assign(&e);
122 let mut x1y1 = self.x;
123 x1y1.add_assign(&self.y);
124 let mut x2y2 = q.x;
125 x2y2.add_assign(&q.y);
126 let mut aux = x1y1;
127 aux.mul_assign(&x2y2);
128 aux.sub_assign(&c);
129 aux.sub_assign(&d);
130 let mut x3 = a;
131 x3.mul_assign(&f);
132 x3.mul_assign(&aux);
133 let mut ac = A.clone();
134 ac.mul_assign(&c);
135 let mut dac = d;
136 dac.sub_assign(&ac);
137 let mut y3 = a;
138 y3.mul_assign(&g);
139 y3.mul_assign(&dac);
140 let mut z3 = f;
141 z3.mul_assign(&g);
142
143 PointProjective {
144 x: x3.clone(),
145 y: y3.clone(),
146 z: z3.clone(),
147 }
148 }
149}
150
151#[derive(Clone, Debug)]
152pub struct Point {
153 pub x: Fr,
154 pub y: Fr,
155}
156
157impl Point {
158 pub fn projective(&self) -> PointProjective {
159 PointProjective {
160 x: self.x.clone(),
161 y: self.y.clone(),
162 z: Fr::one(),
163 }
164 }
165
166 pub fn mul_scalar(&self, n: &BigInt) -> Point {
167 let mut r: PointProjective = PointProjective {
168 x: Fr::zero(),
169 y: Fr::one(),
170 z: Fr::one(),
171 };
172 let mut exp: PointProjective = self.projective();
173 let (_, b) = n.to_bytes_le();
174 for i in 0..n.bits() {
175 if test_bit(&b, i) {
176 r = r.add(&exp);
177 }
178 exp = exp.add(&exp);
179 }
180 r.affine()
181 }
182
183 pub fn compress(&self) -> [u8; 32] {
184 let p = &self;
185 let mut r: [u8; 32] = [0; 32];
186 let x_big = BigInt::parse_bytes(to_hex(&p.x).as_bytes(), 16).unwrap();
187 let y_big = BigInt::parse_bytes(to_hex(&p.y).as_bytes(), 16).unwrap();
188 let (_, y_bytes) = y_big.to_bytes_le();
189 let len = min(y_bytes.len(), r.len());
190 r[..len].copy_from_slice(&y_bytes[..len]);
191 if &x_big > &(&Q.clone() >> 1) {
192 r[31] = r[31] | 0x80;
193 }
194 r
195 }
196
197 pub fn equals(&self, p: Point) -> bool {
198 if self.x == p.x && self.y == p.y {
199 return true;
200 }
201 false
202 }
203}
204
205pub fn test_bit(b: &Vec<u8>, i: usize) -> bool {
206 return b[i / 8] & (1 << (i % 8)) != 0;
207}
208
209pub fn decompress_point(bb: [u8; 32]) -> Result<Point, String> {
210 // https://tools.ietf.org/html/rfc8032#section-5.2.3
211 let mut sign: bool = false;
212 let mut b = bb.clone();
213 if b[31] & 0x80 != 0x00 {
214 sign = true;
215 b[31] = b[31] & 0x7F;
216 }
217 let y: BigInt = BigInt::from_bytes_le(Sign::Plus, &b[..]);
218 if y >= Q.clone() {
219 return Err("y outside the Finite Field over R".to_string());
220 }
221 let one: BigInt = One::one();
222
223 // x^2 = (1 - y^2) / (a - d * y^2) (mod p)
224 let den = utils::modinv(
225 &utils::modulus(
226 &(&A_big.clone() - utils::modulus(&(&D_big.clone() * (&y * &y)), &Q)),
227 &Q,
228 ),
229 &Q,
230 )?;
231 let mut x: BigInt = utils::modulus(&((one - utils::modulus(&(&y * &y), &Q)) * den), &Q);
232 x = utils::modsqrt(&x, &Q)?;
233
234 if sign && !(&x > &(&Q.clone() >> 1)) || (!sign && (&x > &(&Q.clone() >> 1))) {
235 x = x * -1.to_bigint().unwrap();
236 }
237 x = utils::modulus(&x, &Q);
238 let x_fr: Fr = Fr::from_str(&x.to_string()).unwrap();
239 let y_fr: Fr = Fr::from_str(&y.to_string()).unwrap();
240 Ok(Point { x: x_fr, y: y_fr })
241}
242
243#[cfg(feature = "default")]
244fn blh(b: &Vec<u8>) -> Vec<u8> {
245 let hash = blake_hash::Blake512::digest(&b);
246 hash.to_vec()
247}
248
249#[cfg(feature = "aarch64")]
250fn blh(b: &Vec<u8>) -> Vec<u8> {
251 let mut hash = [0; 64];
252 blake::hash(512, b, &mut hash).unwrap();
253 hash.to_vec()
254}
255
256#[derive(Debug, Clone)]
257pub struct Signature {
258 r_b8: Point,
259 s: BigInt,
260}
261
262impl Signature {
263 pub fn compress(&self) -> [u8; 64] {
264 let mut b: Vec<u8> = Vec::new();
265 b.append(&mut self.r_b8.compress().to_vec());
266 let (_, s_bytes) = self.s.to_bytes_le();
267 let mut s_32bytes: [u8; 32] = [0; 32];
268 let len = min(s_bytes.len(), s_32bytes.len());
269 s_32bytes[..len].copy_from_slice(&s_bytes[..len]);
270 b.append(&mut s_32bytes.to_vec());
271 let mut r: [u8; 64] = [0; 64];
272 r[..].copy_from_slice(&b[..]);
273 r
274 }
275}
276
277pub fn decompress_signature(b: &[u8; 64]) -> Result<Signature, String> {
278 let r_b8_bytes: [u8; 32] = *array_ref!(b[..32], 0, 32);
279 let s: BigInt = BigInt::from_bytes_le(Sign::Plus, &b[32..]);
280 let r_b8 = decompress_point(r_b8_bytes);
281 match r_b8 {
282 Result::Err(err) => return Err(err.to_string()),
283 Result::Ok(res) => Ok(Signature {
284 r_b8: res.clone(),
285 s: s,
286 }),
287 }
288}
289
290pub struct PrivateKey {
291 key: [u8; 32],
292}
293
294impl PrivateKey {
295 pub fn import(b: Vec<u8>) -> Result<PrivateKey, String> {
296 if b.len() != 32 {
297 return Err(String::from("imported key can not be bigger than 32 bytes"));
298 }
299 let mut sk: [u8; 32] = [0; 32];
300 sk.copy_from_slice(&b[..32]);
301 Ok(PrivateKey { key: sk })
302 }
303
304 pub fn scalar_key(&self) -> BigInt {
305 // not-compatible with circomlib implementation, but using Blake2b
306 // let mut hasher = Blake2b::new();
307 // hasher.update(sk_raw_bytes);
308 // let mut h = hasher.finalize();
309
310 // compatible with circomlib implementation
311 let mut hash: Vec<u8> = blh(&self.key.to_vec());
312 let mut h: Vec<u8> = hash[..32].to_vec();
313
314 h[0] = h[0] & 0xF8;
315 h[31] = h[31] & 0x7F;
316 h[31] = h[31] | 0x40;
317
318 let sk = BigInt::from_bytes_le(Sign::Plus, &h[..]);
319 sk >> 3
320 }
321
322 pub fn public(&self) -> Point {
323 // https://tools.ietf.org/html/rfc8032#section-5.1.5
324 let pk = B8.mul_scalar(&self.scalar_key());
325 pk.clone()
326 }
327
328 pub fn sign(&self, msg: BigInt) -> Result<Signature, String> {
329 if msg > Q.clone() {
330 return Err("msg outside the Finite Field".to_string());
331 }
332 // let (_, sk_bytes) = self.key.to_bytes_le();
333 // let mut hasher = Blake2b::new();
334 // hasher.update(sk_bytes);
335 // let mut h = hasher.finalize(); // h: hash(sk), s: h[32:64]
336 let mut h: Vec<u8> = blh(&self.key.to_vec());
337
338 let (_, msg_bytes) = msg.to_bytes_le();
339 let mut msg32: [u8; 32] = [0; 32];
340 msg32[..msg_bytes.len()].copy_from_slice(&msg_bytes[..]);
341 let msg_fr: Fr = Fr::from_str(&msg.to_string()).unwrap();
342
343 // https://tools.ietf.org/html/rfc8032#section-5.1.6
344 let s = GenericArray::<u8, generic_array::typenum::U32>::from_mut_slice(&mut h[32..64]);
345 let r_bytes = utils::concatenate_arrays(s, &msg32);
346 let r_hashed: Vec<u8> = blh(&r_bytes);
347 let mut r = BigInt::from_bytes_le(Sign::Plus, &r_hashed[..]);
348 r = utils::modulus(&r, &SUBORDER);
349 let r8: Point = B8.mul_scalar(&r);
350 let a = &self.public();
351
352 let hm_input = vec![r8.x.clone(), r8.y.clone(), a.x.clone(), a.y.clone(), msg_fr];
353 let hm = poseidon.hash(hm_input)?;
354
355 let mut s = &self.scalar_key() << 3;
356 let hm_b = BigInt::parse_bytes(to_hex(&hm).as_bytes(), 16).unwrap();
357 s = hm_b * s;
358 s = r + s;
359 s = s % &SUBORDER.clone();
360
361 Ok(Signature {
362 r_b8: r8.clone(),
363 s: s,
364 })
365 }
366
367 pub fn sign_schnorr(&self, m: BigInt) -> Result<(Point, BigInt), String> {
368 // random r
369 let mut rng = rand6::thread_rng();
370 let k = rng.gen_biguint(1024).to_bigint().unwrap();
371
372 // r = k·G
373 let r = B8.mul_scalar(&k);
374
375 // h = H(x, r, m)
376 let pk = &self.public();
377 let h = schnorr_hash(&pk, m, &r)?;
378
379 // s= k+x·h
380 let sk_scalar = self.scalar_key();
381 let s = k + &sk_scalar * &h;
382 Ok((r, s))
383 }
384}
385
386pub fn schnorr_hash(pk: &Point, msg: BigInt, c: &Point) -> Result<BigInt, String> {
387 if msg > Q.clone() {
388 return Err("msg outside the Finite Field".to_string());
389 }
390 let msg_fr: Fr = Fr::from_str(&msg.to_string()).unwrap();
391 let hm_input = vec![pk.x.clone(), pk.y.clone(), c.x.clone(), c.y.clone(), msg_fr];
392 let h = poseidon.hash(hm_input)?;
393 let h_b = BigInt::parse_bytes(to_hex(&h).as_bytes(), 16).unwrap();
394 Ok(h_b)
395}
396
397pub fn verify_schnorr(pk: Point, m: BigInt, r: Point, s: BigInt) -> Result<bool, String> {
398 // sG = s·G
399 let sg = B8.mul_scalar(&s);
400
401 // r + h · x
402 let h = schnorr_hash(&pk, m, &r)?;
403 let pk_h = pk.mul_scalar(&h);
404 let right = r.projective().add(&pk_h.projective());
405
406 Ok(sg.equals(right.affine()))
407}
408
409pub fn new_key() -> PrivateKey {
410 // https://tools.ietf.org/html/rfc8032#section-5.1.5
411 let mut rng = rand6::thread_rng();
412 let sk_raw = rng.gen_biguint(1024).to_bigint().unwrap();
413 let (_, sk_raw_bytes) = sk_raw.to_bytes_be();
414 PrivateKey::import(sk_raw_bytes[..32].to_vec()).unwrap()
415}
416
417pub fn verify(pk: Point, sig: Signature, msg: BigInt) -> bool {
418 if msg > Q.clone() {
419 return false;
420 }
421 let msg_fr: Fr = Fr::from_str(&msg.to_string()).unwrap();
422 let hm_input = vec![
423 sig.r_b8.x.clone(),
424 sig.r_b8.y.clone(),
425 pk.x.clone(),
426 pk.y.clone(),
427 msg_fr,
428 ];
429 let hm = match poseidon.hash(hm_input) {
430 Result::Err(_) => return false,
431 Result::Ok(hm) => hm,
432 };
433 let l = B8.mul_scalar(&sig.s);
434 let hm_b = BigInt::parse_bytes(to_hex(&hm).as_bytes(), 16).unwrap();
435 let r = sig
436 .r_b8
437 .projective()
438 .add(&pk.mul_scalar(&(8.to_bigint().unwrap() * hm_b)).projective());
439 l.equals(r.affine())
440}
441
442#[cfg(test)]
443mod tests {
444 use super::*;
445 extern crate rustc_hex;
446 use rustc_hex::{FromHex, ToHex};
447
448 #[test]
449 fn test_add_same_point() {
450 let p: PointProjective = PointProjective {
451 x: Fr::from_str(
452 "17777552123799933955779906779655732241715742912184938656739573121738514868268",
453 )
454 .unwrap(),
455 y: Fr::from_str(
456 "2626589144620713026669568689430873010625803728049924121243784502389097019475",
457 )
458 .unwrap(),
459 z: Fr::one(),
460 };
461 let q: PointProjective = PointProjective {
462 x: Fr::from_str(
463 "17777552123799933955779906779655732241715742912184938656739573121738514868268",
464 )
465 .unwrap(),
466 y: Fr::from_str(
467 "2626589144620713026669568689430873010625803728049924121243784502389097019475",
468 )
469 .unwrap(),
470 z: Fr::one(),
471 };
472 let res = p.add(&q).affine();
473 assert_eq!(
474 res.x,
475 Fr::from_str(
476 "6890855772600357754907169075114257697580319025794532037257385534741338397365"
477 )
478 .unwrap()
479 );
480 assert_eq!(
481 res.y,
482 Fr::from_str(
483 "4338620300185947561074059802482547481416142213883829469920100239455078257889"
484 )
485 .unwrap()
486 );
487 }
488 #[test]
489 fn test_add_different_points() {
490 let p: PointProjective = PointProjective {
491 x: Fr::from_str(
492 "17777552123799933955779906779655732241715742912184938656739573121738514868268",
493 )
494 .unwrap(),
495 y: Fr::from_str(
496 "2626589144620713026669568689430873010625803728049924121243784502389097019475",
497 )
498 .unwrap(),
499 z: Fr::one(),
500 };
501 let q: PointProjective = PointProjective {
502 x: Fr::from_str(
503 "16540640123574156134436876038791482806971768689494387082833631921987005038935",
504 )
505 .unwrap(),
506 y: Fr::from_str(
507 "20819045374670962167435360035096875258406992893633759881276124905556507972311",
508 )
509 .unwrap(),
510 z: Fr::one(),
511 };
512 let res = p.add(&q).affine();
513 assert_eq!(
514 res.x,
515 Fr::from_str(
516 "7916061937171219682591368294088513039687205273691143098332585753343424131937"
517 )
518 .unwrap()
519 );
520 assert_eq!(
521 res.y,
522 Fr::from_str(
523 "14035240266687799601661095864649209771790948434046947201833777492504781204499"
524 )
525 .unwrap()
526 );
527 }
528
529 #[test]
530 fn test_mul_scalar() {
531 let p: Point = Point {
532 x: Fr::from_str(
533 "17777552123799933955779906779655732241715742912184938656739573121738514868268",
534 )
535 .unwrap(),
536 y: Fr::from_str(
537 "2626589144620713026669568689430873010625803728049924121243784502389097019475",
538 )
539 .unwrap(),
540 };
541 let res_m = p.mul_scalar(&3.to_bigint().unwrap());
542 let res_a = p.projective().add(&p.projective());
543 let res_a = res_a.add(&p.projective()).affine();
544 assert_eq!(res_m.x, res_a.x);
545 assert_eq!(
546 res_m.x,
547 Fr::from_str(
548 "19372461775513343691590086534037741906533799473648040012278229434133483800898"
549 )
550 .unwrap()
551 );
552 assert_eq!(
553 res_m.y,
554 Fr::from_str(
555 "9458658722007214007257525444427903161243386465067105737478306991484593958249"
556 )
557 .unwrap()
558 );
559
560 let n = BigInt::parse_bytes(
561 b"14035240266687799601661095864649209771790948434046947201833777492504781204499",
562 10,
563 )
564 .unwrap();
565 let res2 = p.mul_scalar(&n);
566 assert_eq!(
567 res2.x,
568 Fr::from_str(
569 "17070357974431721403481313912716834497662307308519659060910483826664480189605"
570 )
571 .unwrap()
572 );
573 assert_eq!(
574 res2.y,
575 Fr::from_str(
576 "4014745322800118607127020275658861516666525056516280575712425373174125159339"
577 )
578 .unwrap()
579 );
580 }
581
582 #[test]
583 fn test_new_key_sign_verify_0() {
584 let sk = new_key();
585 let pk = sk.public();
586 let msg = 5.to_bigint().unwrap();
587 let sig = sk.sign(msg.clone()).unwrap();
588 let v = verify(pk, sig, msg);
589 assert_eq!(v, true);
590 }
591
592 #[test]
593 fn test_new_key_sign_verify_1() {
594 let sk = new_key();
595 let pk = sk.public();
596 let msg = BigInt::parse_bytes(b"123456789012345678901234567890", 10).unwrap();
597 let sig = sk.sign(msg.clone()).unwrap();
598 let v = verify(pk, sig, msg);
599 assert_eq!(v, true);
600 }
601
602 #[test]
603 fn test_point_compress_decompress() {
604 let p: Point = Point {
605 x: Fr::from_str(
606 "17777552123799933955779906779655732241715742912184938656739573121738514868268",
607 )
608 .unwrap(),
609 y: Fr::from_str(
610 "2626589144620713026669568689430873010625803728049924121243784502389097019475",
611 )
612 .unwrap(),
613 };
614 let p_comp = p.compress();
615 assert_eq!(
616 p_comp[..].to_hex(),
617 "53b81ed5bffe9545b54016234682e7b2f699bd42a5e9eae27ff4051bc698ce85"
618 );
619 let p2 = decompress_point(p_comp).unwrap();
620 assert_eq!(p.x, p2.x);
621 assert_eq!(p.y, p2.y);
622 }
623
624 #[test]
625 fn test_point_decompress0() {
626 let y_bytes_raw = "b5328f8791d48f20bec6e481d91c7ada235f1facf22547901c18656b6c3e042f"
627 .from_hex()
628 .unwrap();
629 let mut y_bytes: [u8; 32] = [0; 32];
630 y_bytes.copy_from_slice(&y_bytes_raw);
631 let p = decompress_point(y_bytes).unwrap();
632
633 let expected_px_raw = "b86cc8d9c97daef0afe1a4753c54fb2d8a530dc74c7eee4e72b3fdf2496d2113"
634 .from_hex()
635 .unwrap();
636 let mut e_px_bytes: [u8; 32] = [0; 32];
637 e_px_bytes.copy_from_slice(&expected_px_raw);
638 let expected_px: Fr =
639 Fr::from_str(&BigInt::from_bytes_le(Sign::Plus, &e_px_bytes).to_string()).unwrap();
640 assert_eq!(&p.x, &expected_px);
641 }
642
643 #[test]
644 fn test_point_decompress1() {
645 let y_bytes_raw = "70552d3ff548e09266ded29b33ce75139672b062b02aa66bb0d9247ffecf1d0b"
646 .from_hex()
647 .unwrap();
648 let mut y_bytes: [u8; 32] = [0; 32];
649 y_bytes.copy_from_slice(&y_bytes_raw);
650 let p = decompress_point(y_bytes).unwrap();
651
652 let expected_px_raw = "30f1635ba7d56f9cb32c3ffbe6dca508a68c7f43936af11a23c785ce98cb3404"
653 .from_hex()
654 .unwrap();
655 let mut e_px_bytes: [u8; 32] = [0; 32];
656 e_px_bytes.copy_from_slice(&expected_px_raw);
657 let expected_px: Fr =
658 Fr::from_str(&BigInt::from_bytes_le(Sign::Plus, &e_px_bytes).to_string()).unwrap();
659 assert_eq!(&p.x, &expected_px);
660 }
661
662 #[test]
663 fn test_point_decompress_loop() {
664 for _ in 0..5 {
665 let random_bytes = rand6::thread_rng().gen::<[u8; 32]>();
666 let sk_raw: BigInt = BigInt::from_bytes_le(Sign::Plus, &random_bytes[..]);
667 let (_, sk_raw_bytes) = sk_raw.to_bytes_be();
668 let mut h: Vec<u8> = blh(&sk_raw_bytes);
669
670 h[0] = h[0] & 0xF8;
671 h[31] = h[31] & 0x7F;
672 h[31] = h[31] | 0x40;
673
674 let sk = BigInt::from_bytes_le(Sign::Plus, &h[..]);
675 let point = B8.mul_scalar(&sk);
676 let cmp_point = point.compress();
677 let dcmp_point = decompress_point(cmp_point).unwrap();
678
679 assert_eq!(&point.x, &dcmp_point.x);
680 assert_eq!(&point.y, &dcmp_point.y);
681 }
682 }
683
684 #[test]
685 fn test_signature_compress_decompress() {
686 let sk = new_key();
687 let pk = sk.public();
688
689 for i in 0..5 {
690 let msg_raw = "123456".to_owned() + &i.to_string();
691 let msg = BigInt::parse_bytes(msg_raw.as_bytes(), 10).unwrap();
692 let sig = sk.sign(msg.clone()).unwrap();
693
694 let compressed_sig = sig.compress();
695 let decompressed_sig = decompress_signature(&compressed_sig).unwrap();
696 assert_eq!(&sig.r_b8.x, &decompressed_sig.r_b8.x);
697 assert_eq!(&sig.r_b8.y, &decompressed_sig.r_b8.y);
698 assert_eq!(&sig.s, &decompressed_sig.s);
699
700 let v = verify(pk.clone(), decompressed_sig, msg);
701 assert_eq!(v, true);
702 }
703 }
704
705 #[test]
706 fn test_schnorr_signature() {
707 let sk = new_key();
708 let pk = sk.public();
709
710 let msg = BigInt::parse_bytes(b"123456789012345678901234567890", 10).unwrap();
711 let (s, e) = sk.sign_schnorr(msg.clone()).unwrap();
712 let verification = verify_schnorr(pk, msg, s, e).unwrap();
713 assert_eq!(true, verification);
714 }
715
716 #[test]
717 fn test_circomlib_testvector() {
718 let sk_raw_bytes =
719 hex::decode("0001020304050607080900010203040506070809000102030405060708090001")
720 .unwrap();
721
722 // test blake compatible with circomlib implementation
723 let mut h: Vec<u8> = blh(&sk_raw_bytes);
724 assert_eq!(h.to_hex(), "c992db23d6290c70ffcc02f7abeb00b9d00fa8b43e55d7949c28ba6be7545d3253882a61bd004a236ef1cdba01b27ba0aedfb08eefdbfb7c19657c880b43ddf1");
725
726 // test private key
727 let sk = PrivateKey::import(
728 hex::decode("0001020304050607080900010203040506070809000102030405060708090001")
729 .unwrap(),
730 )
731 .unwrap();
732 assert_eq!(
733 sk.scalar_key().to_string(),
734 "6466070937662820620902051049739362987537906109895538826186780010858059362905"
735 );
736
737 // test public key
738 let pk = sk.public();
739 assert_eq!(
740 pk.x.to_string(),
741 "Fr(0x1d5ac1f31407018b7d413a4f52c8f74463b30e6ac2238220ad8b254de4eaa3a2)"
742 );
743 assert_eq!(
744 pk.y.to_string(),
745 "Fr(0x1e1de8a908826c3f9ac2e0ceee929ecd0caf3b99b3ef24523aaab796a6f733c4)"
746 );
747
748 // test signature & verification
749 let msg = BigInt::from_bytes_le(Sign::Plus, &hex::decode("00010203040506070809").unwrap());
750 println!("msg {:?}", msg.to_string());
751 let sig = sk.sign(msg.clone()).unwrap();
752 assert_eq!(
753 sig.r_b8.x.to_string(),
754 "Fr(0x192b4e51adf302c8139d356d0e08e2404b5ace440ef41fc78f5c4f2428df0765)"
755 );
756 assert_eq!(
757 sig.r_b8.y.to_string(),
758 "Fr(0x2202bebcf57b820863e0acc88970b6ca7d987a0d513c2ddeb42e3f5d31b4eddf)"
759 );
760 assert_eq!(
761 sig.s.to_string(),
762 "1672775540645840396591609181675628451599263765380031905495115170613215233181"
763 );
764 let v = verify(pk, sig, msg);
765 assert_eq!(v, true);
766 }
767}