ceremonyclient/nekryptology/pkg/ot/extension/kos/kos_test.go

package kos

import (
	"crypto/rand"
	"testing"

	"github.com/stretchr/testify/require"

	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/base/simplest"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/ottest"
)

func TestBinaryMult(t *testing.T) {
	for i := 0; i < 100; i++ {
		temp := make([]byte, 32)
		_, err := rand.Read(temp)
		require.NoError(t, err)
		expected := make([]byte, 32)
		copy(expected, temp)
		// this test is based on Fermat's little theorem.
		// the multiplicative group of units of a finite field has order |F| - 1
		// (in fact, it's necessarily cyclic; see e.g. https://math.stackexchange.com/a/59911, but this test doesn't rely on that fact)
		// thus raising any element to the |F|th power should yield that element itself.
		// this is a good test because it relies on subtle facts about the field structure, and will fail if anything goes wrong.
		for j := 0; j < 256; j++ {
			expected = binaryFieldMul(expected, expected)
		}
		require.Equal(t, temp, expected)
	}
}

func TestCOTExtension(t *testing.T) {
	const (
		// below are the "cryptographic parameters", including computational and statistical,
		// as well as the cOT block size parameters, which depend on these in a pre-defined way.

		// Kappa is the computational security parameter.
		Kappa = 256

		// KappaBytes is same as Kappa // 8, but avoids cpu division.
		KappaBytes = Kappa >> 3

		s = 80 // statistical security parameter.

		// L is the batch size used in the cOT functionality.
		L = 2*Kappa + 2*s

		// COtBlockSizeBytes is same as L // 8, but avoids cpu division.
		COtBlockSizeBytes = L >> 3

		// OtWidth is the number of scalars processed per "slot" of the cOT. by definition of this parameter,
		// for each of the receiver's choice bits, the sender will provide `OTWidth` scalars.
		// in turn, both the sender and receiver will obtain `OTWidth` shares _per_ slot / bit of the cOT.
		// by definition of the cOT, these "vectors of" scalars will add (componentwise) to the sender's original scalars.
		OtWidth = 2

		kappaOT                   = Kappa + s
		lPrime                    = L + kappaOT // length of pseudorandom seed expansion, used within cOT protocol
		cOtExtendedBlockSizeBytes = lPrime >> 3
	)

	curveInstances := []*curves.Curve{
		curves.K256(),
		curves.P256(),
	}
	for _, curve := range curveInstances {
		uniqueSessionId := [simplest.DigestSize]byte{}
		_, err := rand.Read(uniqueSessionId[:])
		require.NoError(t, err)
		baseOtSenderOutput, baseOtReceiverOutput, err := ottest.RunSimplestOT(curve, Kappa, uniqueSessionId)
		require.NoError(t, err)
		for i := 0; i < Kappa; i++ {
			require.Equal(t, baseOtReceiverOutput.OneTimePadDecryptionKey[i], baseOtSenderOutput.OneTimePadEncryptionKeys[i][baseOtReceiverOutput.RandomChoiceBits[i]])
		}

		sender := NewCOtSender(Kappa, s, baseOtReceiverOutput, curve)
		receiver := NewCOtReceiver(Kappa, s, baseOtSenderOutput, curve)
		choice := [COtBlockSizeBytes]byte{} // receiver's input, namely choice vector. just random
		_, err = rand.Read(choice[:])
		require.NoError(t, err)
		input := make([][]curves.Scalar, L) // sender's input, namely integer "sums" in case w_j == 1.
		for i := 0; i < L; i++ {
			input[i] = make([]curves.Scalar, OtWidth)
			for j := 0; j < OtWidth; j++ {
				input[i][j] = curve.Scalar.Random(rand.Reader)
				require.NoError(t, err)
			}
		}
		firstMessage, err := receiver.Round1Initialize(uniqueSessionId, choice[:])
		require.NoError(t, err)
		responseTau, err := sender.Round2Transfer(uniqueSessionId, input, firstMessage)
		require.NoError(t, err)
		err = receiver.Round3Transfer(responseTau)
		require.NoError(t, err)
		for j := 0; j < L; j++ {
			bit := simplest.ExtractBitFromByteVector(choice[:], j) == 1
			for k := 0; k < OtWidth; k++ {
				temp := sender.OutputAdditiveShares[j][k].Add(receiver.OutputAdditiveShares[j][k])
				if bit {
					require.Equal(t, temp, input[j][k])
				} else {
					require.Equal(t, temp, curve.Scalar.Zero())
				}
			}
		}
	}
}

func TestCOTExtensionStreaming(t *testing.T) {
	const (
		// below are the "cryptographic parameters", including computational and statistical,
		// as well as the cOT block size parameters, which depend on these in a pre-defined way.

		// Kappa is the computational security parameter.
		Kappa = 256

		// KappaBytes is same as Kappa // 8, but avoids cpu division.
		KappaBytes = Kappa >> 3

		s = 80 // statistical security parameter.

		// L is the batch size used in the cOT functionality.
		L = 2*Kappa + 2*s

		// COtBlockSizeBytes is same as L // 8, but avoids cpu division.
		COtBlockSizeBytes = L >> 3

		// OtWidth is the number of scalars processed per "slot" of the cOT. by definition of this parameter,
		// for each of the receiver's choice bits, the sender will provide `OTWidth` scalars.
		// in turn, both the sender and receiver will obtain `OTWidth` shares _per_ slot / bit of the cOT.
		// by definition of the cOT, these "vectors of" scalars will add (componentwise) to the sender's original scalars.
		OtWidth = 2

		kappaOT                   = Kappa + s
		lPrime                    = L + kappaOT // length of pseudorandom seed expansion, used within cOT protocol
		cOtExtendedBlockSizeBytes = lPrime >> 3
	)
	curve := curves.K256()
	hashKeySeed := [simplest.DigestSize]byte{}
	_, err := rand.Read(hashKeySeed[:])
	require.NoError(t, err)
	baseOtReceiver, err := simplest.NewReceiver(curve, Kappa, hashKeySeed)
	require.NoError(t, err)
	sender := NewCOtSender(Kappa, s, baseOtReceiver.Output, curve)
	baseOtSender, err := simplest.NewSender(curve, Kappa, hashKeySeed)
	require.NoError(t, err)
	receiver := NewCOtReceiver(Kappa, s, baseOtSender.Output, curve)

	// first run the seed OT
	senderPipe, receiverPipe := simplest.NewPipeWrappers()
	errorsChannel := make(chan error, 2)
	go func() {
		errorsChannel <- simplest.SenderStreamOTRun(baseOtSender, senderPipe)
	}()
	go func() {
		errorsChannel <- simplest.ReceiverStreamOTRun(baseOtReceiver, receiverPipe)
	}()
	for i := 0; i < 2; i++ {
		require.Nil(t, <-errorsChannel)
	}
	for i := 0; i < Kappa; i++ {
		require.Equal(t, baseOtReceiver.Output.OneTimePadDecryptionKey[i], baseOtSender.Output.OneTimePadEncryptionKeys[i][baseOtReceiver.Output.RandomChoiceBits[i]])
	}

	// begin test of cOT extension. first populate both parties' inputs randomly
	choice := make([]byte, COtBlockSizeBytes) // receiver's input, namely choice vector. just random
	_, err = rand.Read(choice[:])
	require.NoError(t, err)
	input := make([][]curves.Scalar, L) // sender's input, namely integer "sums" in case w_j == 1. random for the test
	for i := 0; i < L; i++ {
		input[i] = make([]curves.Scalar, OtWidth)
		for j := 0; j < OtWidth; j++ {
			input[i][j] = curve.Scalar.Random(rand.Reader)
			require.NoError(t, err)
		}
	}

	// now actually run it, stream-wise
	go func() {
		errorsChannel <- SenderStreamCOtRun(sender, hashKeySeed, input, receiverPipe)
	}()
	go func() {
		errorsChannel <- ReceiverStreamCOtRun(receiver, hashKeySeed, choice, senderPipe)
	}()
	for i := 0; i < 2; i++ {
		require.Nil(t, <-errorsChannel)
	}
	for j := 0; j < L; j++ {
		bit := simplest.ExtractBitFromByteVector(choice[:], j) == 1
		for k := 0; k < OtWidth; k++ {
			temp := sender.OutputAdditiveShares[j][k].Add(receiver.OutputAdditiveShares[j][k])
			if bit {
				require.Equal(t, temp, input[j][k])
			} else {
				require.Equal(t, temp, curve.Scalar.Zero())
			}
		}
	}
}