1//! Module for PolyIOP transcript.
  2//! TODO(ZZ): move this module to HyperPlonk where the transcript will also be
  3//! useful.
  4//! TODO(ZZ): decide which APIs need to be public.
  5
  6mod errors;
  7pub use errors::TranscriptErrors;
  8
  9use ark_ff::PrimeField;
 10use ark_serialize::CanonicalSerialize;
 11use merlin::Transcript;
 12use std::marker::PhantomData;
 13
 14/// An IOP transcript consists of a Merlin transcript and a flag `is_empty` to
 15/// indicate that if the transcript is empty.
 16///
 17/// It is associated with a prime field `F` for which challenges are generated
 18/// over.
 19///
 20/// The `is_empty` flag is useful in the case where a protocol is initiated by
 21/// the verifier, in which case the prover should start its phase by receiving a
 22/// `non-empty` transcript.
 23#[derive(Clone)]
 24pub struct IOPTranscript<F: PrimeField> {
 25    transcript: Transcript,
 26    is_empty: bool,
 27    #[doc(hidden)]
 28    phantom: PhantomData<F>,
 29}
 30
 31// TODO: Make this into a Trait
 32impl<F: PrimeField> IOPTranscript<F> {
 33    /// Create a new IOP transcript.
 34    pub fn new(label: &'static [u8]) -> Self {
 35        Self {
 36            transcript: Transcript::new(label),
 37            is_empty: true,
 38            phantom: PhantomData::default(),
 39        }
 40    }
 41
 42    // Append the message to the transcript.
 43    pub fn append_message(
 44        &mut self,
 45        label: &'static [u8],
 46        msg: &[u8],
 47    ) -> Result<(), TranscriptErrors> {
 48        self.transcript.append_message(label, msg);
 49        self.is_empty = false;
 50        Ok(())
 51    }
 52
 53    // Append the message to the transcript.
 54    pub fn append_field_element(
 55        &mut self,
 56        label: &'static [u8],
 57        field_elem: &F,
 58    ) -> Result<(), TranscriptErrors> {
 59        self.append_message(label, &to_bytes!(field_elem)?)
 60    }
 61
 62    // Append the message to the transcript.
 63    pub fn append_serializable_element<S: CanonicalSerialize>(
 64        &mut self,
 65        label: &'static [u8],
 66        group_elem: &S,
 67    ) -> Result<(), TranscriptErrors> {
 68        self.append_message(label, &to_bytes!(group_elem)?)
 69    }
 70
 71    // Generate the challenge from the current transcript
 72    // and append it to the transcript.
 73    //
 74    // The output field element is statistical uniform as long
 75    // as the field has a size less than 2^384.
 76    pub fn get_and_append_challenge(
 77        &mut self,
 78        label: &'static [u8],
 79    ) -> Result<F, TranscriptErrors> {
 80        //  we need to reject when transcript is empty
 81        if self.is_empty {
 82            return Err(TranscriptErrors::InvalidTranscript(
 83                "transcript is empty".to_string(),
 84            ));
 85        }
 86
 87        let mut buf = [0u8; 64];
 88        self.transcript.challenge_bytes(label, &mut buf);
 89        let challenge = F::from_le_bytes_mod_order(&buf);
 90        self.append_serializable_element(label, &challenge)?;
 91        Ok(challenge)
 92    }
 93
 94    // Generate a list of challenges from the current transcript
 95    // and append them to the transcript.
 96    //
 97    // The output field element are statistical uniform as long
 98    // as the field has a size less than 2^384.
 99    pub fn get_and_append_challenge_vectors(
100        &mut self,
101        label: &'static [u8],
102        len: usize,
103    ) -> Result<Vec<F>, TranscriptErrors> {
104        //  we need to reject when transcript is empty
105        if self.is_empty {
106            return Err(TranscriptErrors::InvalidTranscript(
107                "transcript is empty".to_string(),
108            ));
109        }
110
111        let mut res = vec![];
112        for _ in 0..len {
113            res.push(self.get_and_append_challenge(label)?)
114        }
115        Ok(res)
116    }
117}
118
119/// Takes as input a struct, and converts them to a series of bytes. All traits
120/// that implement `CanonicalSerialize` can be automatically converted to bytes
121/// in this manner.
122#[macro_export]
123macro_rules! to_bytes {
124    ($x:expr) => {{
125        let mut buf = ark_std::vec![];
126        ark_serialize::CanonicalSerialize::serialize($x, &mut buf).map(|_| buf)
127    }};
128}