1import unittest, operator
  2load("ipa.sage")
  3
  4# Halo paper: https://eprint.iacr.org/2019/1021.pdf
  5# Bulletproofs paper: https://eprint.iacr.org/2017/1066.pdf
  6
  7# Ethereum elliptic curve
  8p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
  9a = 0
 10b = 7
 11Fp = GF(p)
 12E = EllipticCurve(Fp, [a,b])
 13GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
 14GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
 15g = E(GX,GY)
 16n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
 17h = 1
 18q = g.order()
 19Fq = GF(q)
 20
 21# simplier curve values
 22#  p = 19
 23#  Fp = GF(p)
 24#  E = EllipticCurve(Fp,[0,3])
 25#  g = E(1, 2)
 26#  q = g.order()
 27#  Fq = GF(q)
 28
 29print(E)
 30print(Fq)
 31assert is_prime(p)
 32assert is_prime(q)
 33assert g * q == 0
 34
 35class TestUtils(unittest.TestCase):
 36        def test_vecs(self):
 37            a = [1, 2, 3, 4, 5]
 38            b = [1, 2, 3, 4, 5]
 39
 40            c = vec_scalar_mul_field(a, 10)
 41            assert c == [10, 20, 30, 40, 50]
 42
 43            c = inner_product_field(a, b)
 44            assert c == 55
 45
 46            # check that <a, b> with b = (1, x, x^2, ..., x^{d-1}) is the same
 47            # than evaluating p(x) with coefficients a_i, at x
 48            a = [Fq(1), Fq(2), Fq(3), Fq(4), Fq(5), Fq(6), Fq(7), Fq(8)]
 49            z = Fq(3)
 50            b = powers_of(z, 8)
 51            c = inner_product_field(a, b)
 52
 53            x = PolynomialRing(Fq, 'x').gen()
 54            px = 1 + 2*x + 3*x^2 + 4*x^3 + 5*x^4 + 6*x^5 + 7*x^6 + 8*x^7
 55            assert c == px(x=z)
 56
 57
 58class TestIPA_bulletproofs(unittest.TestCase):
 59        def test_inner_product(self):
 60            d = 8
 61            ipa = IPA_bulletproofs(Fq, E, g, d)
 62
 63            # prover
 64            # p(x) = 1 + 2x + 3x² + 4x³ + 5x⁴ + 6x⁵ + 7x⁶ + 8x⁷
 65            a = [ipa.F(1), ipa.F(2), ipa.F(3), ipa.F(4), ipa.F(5), ipa.F(6), ipa.F(7), ipa.F(8)]
 66            x = ipa.F(3)
 67            b = powers_of(x, ipa.d) # = b
 68            
 69            # prover
 70            P = ipa.commit(a, b)
 71            print("commit", P)
 72            v = ipa.evaluate(a, b)
 73            print("v", v)
 74
 75            # verifier
 76            #  r = int(ipa.F.random_element())
 77
 78            # verifier generate random challenges {uᵢ} ∈ 𝕀 and U ∈ 𝔾
 79            U = ipa.E.random_element()
 80            k = int(math.log(d, 2))
 81            u = [None] * k
 82            for j in reversed(range(0, k)):
 83                u[j] = ipa.F.random_element()
 84                while (u[j] == 0): # prevent u[j] from being 0
 85                    u[j] = ipa.F.random_element()
 86
 87            P = P + int(inner_product_field(a, b)) * U
 88
 89            # prover
 90            a_ipa, b_ipa, G_ipa, H_ipa, L, R = ipa.ipa(a, b, u, U)
 91
 92            # verifier
 93            print("P", P)
 94            print("a_ipa", a_ipa)
 95            verif = ipa.verify(P, a_ipa, v, b, u, U, L, R, b_ipa, G_ipa, H_ipa)
 96            print("Verification:", verif)
 97            assert verif == True
 98
 99
100class TestIPA_halo(unittest.TestCase):
101        def test_homomorphic_property(self):
102            ipa = IPA_halo(Fq, E, g, 5)
103            
104            a = [1, 2, 3, 4, 5]
105            b = [1, 2, 3, 4, 5]
106            c = vec_add(a, b)
107            assert c == [2,4,6,8,10]
108
109            r = int(ipa.F.random_element())
110            s = int(ipa.F.random_element())
111            vc_a = ipa.commit(a, r)
112            vc_b = ipa.commit(b, s)
113            
114            # com(a, r) + com(b, s) == com(a+b, r+s)
115            expected_vc_c = ipa.commit(vec_add(a, b), r+s)
116            vc_c = vc_a + vc_b
117            assert vc_c == expected_vc_c
118
119        def test_inner_product(self):
120            d = 8
121            ipa = IPA_halo(Fq, E, g, d)
122
123            # prover
124            # p(x) = 1 + 2x + 3x² + 4x³ + 5x⁴ + 6x⁵ + 7x⁶ + 8x⁷
125            a = [ipa.F(1), ipa.F(2), ipa.F(3), ipa.F(4), ipa.F(5), ipa.F(6), ipa.F(7), ipa.F(8)]
126            x = ipa.F(3)
127            x_powers = powers_of(x, ipa.d) # = b
128            
129            # verifier
130            r = int(ipa.F.random_element())
131
132            # prover
133            P = ipa.commit(a, r)
134            print("commit", P)
135            v = ipa.evaluate(a, x_powers)
136            print("v", v)
137
138            # verifier generate random challenges {uᵢ} ∈ 𝕀 and U ∈ 𝔾
139            U = ipa.E.random_element()
140            k = int(math.log(ipa.d, 2))
141            u = [None] * k
142            for j in reversed(range(0, k)):
143                u[j] = ipa.F.random_element()
144                while (u[j] == 0): # prevent u[j] from being 0
145                    u[j] = ipa.F.random_element()
146
147            P = P + int(v) * U
148
149            # prover
150            a_ipa, b_ipa, G_ipa, lj, rj, L, R = ipa.ipa(a, x_powers, u, U)
151
152            # verifier
153            print("P", P)
154            print("a_ipa", a_ipa)
155            print("\n Verify:")
156            verif = ipa.verify(P, a_ipa, v, x_powers, r, u, U, lj, rj, L, R, b_ipa, G_ipa)
157            assert verif == True
158
159
160if __name__ == '__main__':
161        unittest.main()