1# toy implementation of BLS signatures in Sage
 2#
 3# Scheme overview: https://arnaucube.com/blog/kzg-commitments.html
 4# Go implementation: https://github.com/arnaucube/kzg-commitments-study
 5
 6load("bls12-381.sage")
 7
 8e = Pairing()
 9
10def new_ts(l):
11    Fr = GF(e.r)
12    s = Fr.random_element()
13    print("s", s)
14    tauG1 = [None] * l
15    tauG2 = [None] * l
16    for i in range(0, l): # TODO probably duplicate G1 & G2 instead of first powering s^i and then * G_j
17        sPow = Integer(s)^i
18        tauG1[i] = sPow * e.G1
19        tauG2[i] = sPow * e.G2
20
21    return (tauG1, tauG2)
22
23def commit(taus, p):
24    return evaluate_at_tau(p, taus)
25
26# evaluates p at tau
27def evaluate_at_tau(p, taus):
28    e = 0
29    for i in range(0, len(p.list())):
30        e = e + p[i] * taus[i]
31    return e
32
33def evaluation_proof(tau, p, z, y):
34    # (p - y)
35    n = p - y
36    # (t - z)
37    d = (t-z)
38    # q, rem = n / d
39    q = n / d
40    print("q", q)
41    q = q.numerator()
42    den = q.denominator()
43    print("q", q)
44    print("den", den)
45    # check that den = 1
46    assert(den==1) # rem=0
47    # proof: e = [q(t)]₁
48    return evaluate_at_tau(q, tau)
49
50def verify(tau, c, proof, z, y):
51    # [t]₂ - [z]₂
52    sz = tau[1] - z*e.G2
53
54    # c - [y]₁
55    cy = c - y*e.G1
56
57    print("proof", proof)
58    print("sz", sz)
59    print("cy", cy)
60    lhs = e.pair(proof, sz)
61    rhs = e.pair(cy, e.G2)
62    print("lhs", lhs)
63    print("rhs", rhs)
64    return lhs == rhs
65
66
67(tauG1, tauG2) = new_ts(5)
68
69R.<t> = PolynomialRing(e.F1)
70p = t^3 + t + 5
71
72c = commit(tauG1, p)
73
74z = 3
75y = p(z) # = 35
76
77proof = evaluation_proof(tauG1, p, z, y)
78print("proof", proof)
79
80v = verify(tauG2, c, proof, z, y)
81print(v)
82assert(v)