mirror of
https://github.com/darkrenaissance/darkfi.git
synced 2026-01-09 14:48:08 -05:00
271 lines
14 KiB
Python
271 lines
14 KiB
Python
'''
|
|
bulletproof protocol 2 with multi-exponentiation.
|
|
'''
|
|
load('../mpc/curve.sage')
|
|
load('../mpc/ec_share.sage')
|
|
load('../mpc/share.sage')
|
|
load('../mpc/beaver.sage')
|
|
load('utils.sage')
|
|
|
|
class MpcProof(object):
|
|
def __init__(self, transcript, Q, G_factors, H_factors, G, H, a_shares, b_shares, source, party_id):
|
|
'''
|
|
create inner product proof
|
|
'''
|
|
self.n = len(G)
|
|
self.m = self.n
|
|
assert (self.n == len(H) == len(H_factors) == len(a_shares) == len(b_shares))
|
|
self.source = source
|
|
self.party_id=party_id
|
|
self.Q = Q
|
|
self.G = G
|
|
self.H = H
|
|
self.G_factors = G_factors
|
|
self.H_factors = H_factors
|
|
self.transcript = transcript
|
|
self.L = []
|
|
self.R = []
|
|
L_l = []
|
|
R_l = []
|
|
self.c_l = []
|
|
self.c_r = []
|
|
self.a_shares_l = []
|
|
self.a_shares_r = []
|
|
self.b_shares_l = []
|
|
self.b_shares_r = []
|
|
self.G_hist = []
|
|
self.H_hist = []
|
|
if self.n!=1:
|
|
self.n /=2
|
|
a_shares_l, a_shares_r = a_shares[0:self.n], a_shares[self.n:]
|
|
b_shares_l, b_shares_r = b_shares[0:self.n], b_shares[self.n:]
|
|
self.a_shares_l += [a_shares_l.copy()]
|
|
self.a_shares_r += [a_shares_r.copy()]
|
|
self.b_shares_l += [b_shares_l.copy()]
|
|
self.b_shares_r += [b_shares_r.copy()]
|
|
G_l, G_r = G[0:self.n], G[self.n:]
|
|
H_l, H_r = H[0:self.n], H[self.n:]
|
|
self.G_hist+=[[G_l, G_r]]
|
|
self.H_hist+=[[H_l, H_r]]
|
|
# authenticated inner product
|
|
#TODO multiplication
|
|
c_shares_l = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip(a_shares_l, b_shares_r)]
|
|
c_shares_r = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip(a_shares_r, b_shares_l)]
|
|
self.c_l += [c_shares_l]
|
|
self.c_r += [c_shares_r]
|
|
u = K(1)
|
|
u_inv = 1/u
|
|
|
|
for i in range(self.n):
|
|
# a_prime
|
|
a_shares_l[i] = a_shares_l[i].mul_scalar(u) + a_shares_r[i].mul_scalar(u_inv)
|
|
# p_prime
|
|
b_shares_l[i] = b_shares_l[i].mul_scalar(u_inv) + b_shares_r[i].mul_scalar(u)
|
|
#TODO (research) get pt from share.
|
|
# G_prime
|
|
G_l[i] = to_ec_shares(CurvePoint.msm([G_l[i].share, G_r[i].share], [u_inv * G_factors[i], u * G_factors[self.n+i]]))
|
|
# H_prime
|
|
H_l[i] = to_ec_shares(CurvePoint.msm([H_l[i].share, H_r[i].share], [u * H_factors[i], u_inv * H_factors[self.n+i]]))
|
|
|
|
a_shares = a_shares_l # a is a_prime
|
|
b_shares = b_shares_l # b is b_prime
|
|
G = G_l # G is G_prime
|
|
H = H_l # H is H_prime
|
|
|
|
while self.n!=1:
|
|
self.n /=2
|
|
a_shares_l, a_shares_r = a_shares[0:self.n], a_shares[self.n:] # a_prime_l, a_prime_r
|
|
b_shares_l, b_shares_r = b_shares[0:self.n], b_shares[self.n:] # b_prime_l, b_prime_r
|
|
self.a_shares_l += [a_shares_l.copy()]
|
|
self.a_shares_r += [a_shares_r.copy()]
|
|
self.b_shares_l += [b_shares_l.copy()]
|
|
self.b_shares_r += [b_shares_r.copy()]
|
|
G_l, G_r = G[0:self.n], G[self.n:] # G_prime_l, G_prime_r
|
|
H_l, H_r = H[0:self.n], H[self.n:] # H_prime_l, H_prime_r
|
|
self.G_hist+=[[G_l, G_r]]
|
|
self.H_hist+=[[H_l, H_r]]
|
|
c_shares_l = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for (a_share,b_share) in zip(a_shares_l, b_shares_r)] # c_prime_l
|
|
c_shares_r = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for (a_share,b_share) in zip(a_shares_r, b_shares_l)] # c_prime_r
|
|
self.c_l += [c_shares_l]
|
|
self.c_r += [c_shares_r]
|
|
u = K(1)
|
|
u_inv = 1/u
|
|
for i in range(self.n):
|
|
# u * a_prime_l + u^{-1} * a_prime_r
|
|
a_shares_l[i] = a_shares_l[i].mul_scalar(u) + a_shares_r[i].mul_scalar(u_inv)
|
|
# u^{-1} * b_prime_l + u * b_prime_r
|
|
b_shares_l[i] = b_shares_l[i].mul_scalar(u_inv) + b_shares_r[i].mul_scalar(u)
|
|
# G_l_prime
|
|
G_l[i] = to_ec_shares(CurvePoint.msm([G_l[i].share, G_r[i].share], [u_inv, u]))
|
|
# H_l_prime
|
|
H_l[i] = to_ec_shares(CurvePoint.msm([H_l[i].share, H_r[i].share], [u, u_inv]))
|
|
a_shares = a_shares_l
|
|
b_shares = b_shares_l
|
|
G = G_l
|
|
H = H_l
|
|
self.a_shares = a_shares[0]
|
|
self.b_shares = b_shares[0]
|
|
self.G = G
|
|
self.H = H
|
|
|
|
def create(self, their_c_l_shares, their_c_r_shares):
|
|
'''
|
|
create inner product proof
|
|
'''
|
|
|
|
self.c_l = [[my_c_l[i].mul(their_c_l[i].d, their_c_l[i].e) for i in range(len(my_c_l))] for my_c_l, their_c_l in zip(self.c_l, their_c_l_shares)]
|
|
self.c_r = [[my_c_r[i].mul(their_c_r[i].d, their_c_r[i].e) for i in range(len(my_c_r))] for my_c_r, their_c_r in zip(self.c_r, their_c_r_shares)]
|
|
|
|
print('c_l: {}'.format(self.c_l))
|
|
print('c_r: {}'.format(self.c_r))
|
|
print('c: {}'.format(sum([c_l[i].authenticated_open(c_r[i]) for i in range(len(self.c_l[0])) for c_l, c_r in zip(self.c_l, self.c_r)])))
|
|
# create L,R for proof validation
|
|
L_l = []
|
|
R_l = []
|
|
counter = 0
|
|
if self.m!=1:
|
|
self.m /= 2
|
|
al_share_g = [al_share.mul_scalar(g) for al_share, g in zip(self.a_shares_l[counter], self.G_factors[self.m:2*self.m])]
|
|
br_share_h = [br_share.mul_scalar(h) for br_share, h in zip(self.b_shares_r[counter], self.H_factors[0:self.m])]
|
|
L_gr_al_g_share = MSM(self.G_hist[counter][1], al_share_g, self.source, self.party_id)
|
|
L_hl_br_h_share = MSM(self.H_hist[counter][0], br_share_h, self.source, self.party_id)
|
|
L_q_cl_share = MSM(self.Q, self.c_l[counter], self.source, self.party_id)
|
|
# L, R
|
|
# note that P = L*R
|
|
L_shares = [L_gr_al_g_share, L_hl_br_h_share , L_q_cl_share]
|
|
|
|
ar_share_g = [ar_share.mul_scalar(g) for ar_share, g in zip(self.a_shares_r[counter], G_factors[0:self.m])]
|
|
bl_share_g = [bl_share.mul_scalar(h) for bl_share, h in zip(self.b_shares_l[counter], H_factors[self.m:2*self.m])]
|
|
R_gl_ar_g_share = MSM(self.G_hist[counter][0], ar_share_g, self.source, self.party_id)
|
|
R_hr_bl_h_share = MSM(self.H_hist[counter][1], bl_share_g, self.source, self.party_id)
|
|
R_q_cr_share = MSM(Q, self.c_r[counter], self.source, self.party_id)
|
|
R_shares = [R_gl_ar_g_share, R_hr_bl_h_share, R_q_cr_share]
|
|
L_l += [L_shares]
|
|
R_l += [R_shares]
|
|
|
|
counter +=1
|
|
while self.m!=1:
|
|
self.m /=2
|
|
# L_prime
|
|
L_gr_al_share = MSM(self.G_hist[counter][1], self.a_shares_l[counter], self.source, self.party_id)
|
|
L_hl_br_share = MSM(self.H_hist[counter][0], self.b_shares_r[counter], self.source, self.party_id)
|
|
L_q_cl_share = MSM(self.Q, self.c_l[counter], self.source, self.party_id)
|
|
L_shares = [L_gr_al_share, L_hl_br_share, L_q_cl_share]
|
|
|
|
# R_prime
|
|
R_gl_ar_share = MSM(self.G_hist[counter][0], a_shares_r, self.source, self.party_id)
|
|
R_hr_bl_share = MSM(self.H_hist[counter][1], b_shares_l, self.source, self.party_id)
|
|
R_q_cr_share = MSM(Q, self.c_r[counter], self.source, self.party_id)
|
|
R_shares = [R_gl_ar_share, R_hr_bl_share, R_q_cr_share]
|
|
|
|
L_l += [L_shares]
|
|
R_l += [R_shares]
|
|
|
|
counter +=1
|
|
#
|
|
self.lhs = L_l
|
|
self.rhs = R_l
|
|
|
|
def challenges(self, n, verifier):
|
|
challenges = []
|
|
challenges_inv = []
|
|
lg_n = len(self.lhs)
|
|
for L, R in zip(self.lhs, self.rhs):
|
|
#verifier.append_message(b'L', bytes(''.join([l.__str__() for l in [L]]), encoding='utf-8'))
|
|
#verifier.append_message(b'R', bytes(''.join([r.__str__() for r in [R]]), encoding='utf-8'))
|
|
#u = K(verifier.challenge_bytes(b'u'))
|
|
u = K(1)
|
|
u_inv = 1/u
|
|
challenges += [u]
|
|
challenges_inv += [u_inv]
|
|
inv_prod = K(1)
|
|
for u_inv in challenges_inv:
|
|
inv_prod *=K(1)
|
|
challenges_sq = [i*i for i in challenges]
|
|
challenges_inv_sq = [i*i for i in challenges_inv]
|
|
mul_inv = K(1)
|
|
for i in challenges_inv:
|
|
mul_inv *=i
|
|
S = [mul_inv]
|
|
for i in range(1,n):
|
|
lg_i = 32 - 1 - countZeros(i)
|
|
k = 1 << lg_i
|
|
u_lg_i_sq = challenges_sq[(lg_n -1) - lg_i]
|
|
S += [S[i-k] * u_lg_i_sq]
|
|
return challenges_sq, challenges_inv_sq, S
|
|
|
|
def calculate_c_shares(self, n, verifier, G_factors, H_factors):
|
|
self.u_sq, self.u_inv_sq, self.s = self.challenges(n, verifier)
|
|
self.gas_shares = [self.a_shares.mul_scalar(s_i * g_i) for g_i, s_i in zip(G_factors, self.s)][:n]
|
|
# inverse of count is reverse
|
|
self.inv_s = reversed(self.s)
|
|
self.hbs_shares = [self.b_shares.mul_scalar(s_i_inv * h_i) for h_i, s_i_inv in zip(H_factors, self.inv_s)]
|
|
#TODO (fix) this should be shares, this is fake shares!
|
|
self.neg_u_sq = [i*K(-1) for i in self.u_sq]
|
|
self.neg_u_inv_sq = [i*K(-1) for i in self.u_inv_sq]
|
|
# P
|
|
## u^c
|
|
self.my_c_shares = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip([self.a_shares], [self.b_shares])]
|
|
|
|
def open_lr(self, Q, G, H, their_c_shares_de, peer_lhs, peer_rhs):
|
|
c_shares = [my_c_share.mul(their_c_shares_de[i][0], their_c_shares_de[i][1]) for i, my_c_share in enumerate(self.my_c_shares)]
|
|
|
|
self.res_p_1 = MSM(Q, c_shares, self.source, self.party_id)
|
|
## g^{g_factor_a_s}
|
|
self.res_p_2 = MSM(G, self.gas_shares, self.source, self.party_id)
|
|
## h^{h_factor_b_s}
|
|
self.res_p_3 = MSM(H, self.hbs_shares, self.source, self.party_id)
|
|
## L
|
|
for my_lhs, their_lhs in zip(self.lhs, peer_lhs):
|
|
L_triad = []
|
|
for my_lhs_i, their_lhs_i in zip(my_lhs, their_lhs):
|
|
my_lhs_i_de = [[ps.d, ps.e] for ps in my_lhs_i.point_scalars]
|
|
#print("lhs point scalars: {}".format(their_lhs_i.point_scalars))
|
|
their_lhs_i_de = [[ps.d, ps.e] for ps in their_lhs_i.point_scalars]
|
|
#my_lhs_i_share = my_lhs_i.msm(their_lhs_i_de)
|
|
#their_rhs_i_share = their_lhs_i.msm(my_lhs_i_de)
|
|
#L_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
#L_triad += [lhs_i]
|
|
lhs_i_share = my_lhs_i.msm(their_lhs_i_de)
|
|
#L_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
L_triad += [lhs_i_share]
|
|
#L += [sum_shares(L_triad, self.source, self.party_id)]
|
|
self.L += [sum_shares(L_triad, self.source, self.party_id)]
|
|
## R
|
|
for my_rhs, their_rhs in zip(self.rhs, peer_rhs):
|
|
R_triad = []
|
|
for my_rhs_i, their_rhs_i in zip(my_rhs, their_rhs):
|
|
my_rhs_i_de = [[ps.d, ps.e] for ps in my_rhs_i.point_scalars]
|
|
their_rhs_i_de = [[ps.d, ps.e] for ps in their_rhs_i.point_scalars]
|
|
#my_rhs_i_share = my_rhs_i.msm(their_rhs_i_de)
|
|
#their_rhs_i_share = their_rhs_i.msm(my_rhs_i_de)
|
|
#R_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
rhs_i_share = my_rhs_i.msm(their_rhs_i_de)
|
|
R_triad += [rhs_i_share]
|
|
#R_triad += [rhs_i]
|
|
#R += [sum_shares(R_triad, self.source, self.party_id)]
|
|
self.R += [sum_shares(R_triad, self.source, self.party_id)]
|
|
# L^(u^2)
|
|
#temp = K(random.randint(0,p))
|
|
temp = K(0)
|
|
self.res_p_4 = MSM(self.L, [AuthenticatedShare(temp, self.source, self.party_id) if self.party_id==0 else AuthenticatedShare(neg_u_sq_i-temp, self.source, self.party_id) for neg_u_sq_i in self.neg_u_sq], self.source, self.party_id)
|
|
# R^(u^-2)
|
|
self.res_p_5 = MSM(self.R, [AuthenticatedShare(temp, self.source, self.party_id) if self.party_id==0 else AuthenticatedShare(neg_u_inv_sq_i-temp, self.source, self.party_id) for neg_u_inv_sq_i in self.neg_u_inv_sq], self.source, self.party_id)
|
|
# P prime = L^{u^2} * P * R^{u^{-1}}
|
|
self.res_p = [self.res_p_1, self.res_p_2, self.res_p_3, self.res_p_4, self.res_p_5]
|
|
|
|
def open_and_validate_P(self, res_p, P):
|
|
P_msm_parts = []
|
|
for my_res_p, their_res_p in zip(self.res_p, res_p):
|
|
my_res_de = [[ps.d, ps.e] for ps in my_res_p.point_scalars]
|
|
their_res_de = [[ps.d, ps.e] for ps in their_res_p.point_scalars]
|
|
lhs = my_res_p.msm(their_res_de)
|
|
rhs = their_res_p.msm(my_res_de)
|
|
p_part = lhs.authenticated_open(rhs)
|
|
print('p_part: {}'.format(p_part))
|
|
P_msm_parts += [p_part]
|
|
|
|
# P prime == H(u^{-1} * a_prime_r, u * a_prime_l, u * b_prime_r, u ^ {-1} * b_prime_l, c_prime)
|
|
my_P = sum(P_msm_parts)
|
|
assert (my_P == P), 'P: {}, expected: {}'.format(my_P, P)
|