1use plonky2::hash::poseidon::PoseidonHash;
  2use plonky2::field::goldilocks_field::GoldilocksField;
  3use plonky2::field::types::Field;
  4use plonky2::plonk::config::Hasher;
  5use plonky2::field::types::PrimeField64;
  6use rand;
  7use rand::Rng;
  8
  9const BIG_GROUP_GEN: GoldilocksField = GoldilocksField(14293326489335486720);
 10
 11// No ZK here.
 12// This is just a simple implementation of Schnorr signatures:
 13// keygen, sign, and verify.
 14
 15// 8-bit security (i.e. totally insecure, DO NOT USE if you want any security at all)
 16// because it uses the multiplicative group of the Goldilocks field
 17
 18#[derive(Copy, Clone, Debug)]
 19pub struct SchnorrSigner {
 20    PRIME_GROUP_GEN: GoldilocksField,
 21    PRIME_GROUP_ORDER: u64,
 22}
 23
 24#[derive(Copy, Clone, Debug)]
 25
 26pub struct SchnorrSecretKey {
 27    pub sk: u64,
 28}
 29
 30#[derive(Copy, Clone, Debug)]
 31pub struct SchnorrPublicKey {
 32    pub pk: GoldilocksField,
 33}
 34
 35#[derive(Copy, Clone, Debug)]
 36pub struct SchnorrSignature {
 37    pub s: u64,
 38    pub e: u64,
 39}
 40
 41impl SchnorrSigner{
 42    pub fn new() -> Self {
 43        let quotient_order: u64 = (1 << 48) - (1 << 32);
 44        let PRIME_GROUP_GEN: GoldilocksField = Self::pow(BIG_GROUP_GEN, quotient_order);
 45        let PRIME_GROUP_ORDER: u64 = (1 << 16) + 1;
 46        SchnorrSigner{PRIME_GROUP_GEN, PRIME_GROUP_ORDER}
 47    }
 48
 49    fn pow(x: GoldilocksField, a: u64) -> GoldilocksField {
 50        let mut a_copy = a;
 51        let mut res = GoldilocksField(1);
 52        let mut x_pow_2n = x.clone();
 53        while (a_copy > 0) {
 54            if (a_copy % 2 != 0) {
 55                res *= x_pow_2n;
 56            }
 57            a_copy /= 2;
 58            x_pow_2n *= x_pow_2n;
 59        }
 60        res
 61    }
 62
 63    pub fn keygen(&self, sk: &SchnorrSecretKey) -> SchnorrPublicKey {
 64        let pk: GoldilocksField = Self::pow(self.PRIME_GROUP_GEN, sk.sk).inverse();
 65        // self.PRIME_GROUP_GEN is 6612579038192137166
 66        SchnorrPublicKey{pk: pk}
 67    }
 68
 69    fn hash_insecure(&self, r: &GoldilocksField, msg: &Vec<GoldilocksField>) -> u64 {
 70        let poseidon_input: Vec<GoldilocksField> = std::iter::once(r)
 71            .chain(msg.iter())
 72            .copied()
 73            .collect();
 74
 75        let h = PoseidonHash::hash_no_pad(&poseidon_input);
 76        h.elements[0].to_canonical_u64() % self.PRIME_GROUP_ORDER
 77    }
 78
 79    fn rand_group_multiplier(&self, rng: &mut rand::rngs::ThreadRng) -> u64 {
 80        let group_order: u64 = (1 << 16) + 1;
 81        rng.gen_range(0..group_order)
 82    }
 83
 84    pub fn u64_into_goldilocks_vec(&self, msg: Vec<u64>) -> Vec<GoldilocksField> {
 85        msg.into_iter()
 86            .map(|x| GoldilocksField::from_noncanonical_u64(x))
 87            .collect()
 88    }
 89
 90    pub fn sign(&self, msg: &Vec<GoldilocksField>, sk: &SchnorrSecretKey, rng: &mut rand::rngs::ThreadRng) -> SchnorrSignature {
 91        let k: u64 = self.rand_group_multiplier(rng);
 92        let r: GoldilocksField = Self::pow(self.PRIME_GROUP_GEN, k);
 93        let e: u64 = self.hash_insecure(&r, msg);
 94        assert!(k < self.PRIME_GROUP_ORDER);
 95        assert!(sk.sk < self.PRIME_GROUP_ORDER);
 96        assert!(e < self.PRIME_GROUP_ORDER);
 97        let mut s128: u128 = ((k as u128) + (sk.sk as u128) * (e as u128));
 98        s128 %= self.PRIME_GROUP_ORDER as u128;
 99        let s: u64 = s128 as u64;
100        SchnorrSignature{e, s}
101    }
102
103    pub fn verify(&self, sig: &SchnorrSignature, msg: &Vec<GoldilocksField>, pk: &SchnorrPublicKey) -> bool {
104        let r: GoldilocksField = Self::pow(self.PRIME_GROUP_GEN, sig.s)
105            * Self::pow(pk.pk, sig.e);
106        let e_v: u64 = self.hash_insecure(&r, msg);
107        e_v == sig.e
108    }
109}
110
111#[cfg(test)]
112mod tests {
113    use plonky2::field::goldilocks_field::GoldilocksField;
114
115    use crate::schnorr::{SchnorrPublicKey, SchnorrSecretKey, SchnorrSigner, SchnorrSignature};
116
117    #[test]
118    fn test_pow() {
119        let g = GoldilocksField(3);
120        let res = GoldilocksField(16305451354880172407);
121        assert_eq!(res, SchnorrSigner::pow(g, 1234567));
122    }
123
124    #[test]
125    fn test_sig() {
126        let mut rng: rand::rngs::ThreadRng = rand::thread_rng();
127        let ss = SchnorrSigner::new();
128        let sk: SchnorrSecretKey = SchnorrSecretKey{ sk: 1422 };
129        let pk: SchnorrPublicKey = ss.keygen(&sk);
130
131        let msg0_u64: Vec<u64> = vec![17, 123985, 3, 12];
132        let msg0: Vec<GoldilocksField> = ss.u64_into_goldilocks_vec(msg0_u64);
133        let sig: SchnorrSignature = ss.sign(&msg0, &sk, &mut rng);
134        let res: bool = ss.verify(&sig, &msg0, &pk);
135        println!("Trying to verify:");
136        println!("Secret key: {:?}", sk);
137        println!("Public key: {:?}", pk);
138        println!("Signature: {:?}", sig);
139        assert!(res);
140    }
141}