ceremonyclient/node/crypto/kzg_inclusion_prover.go

package crypto

import (
	"github.com/pkg/errors"
	"go.uber.org/zap"
	"golang.org/x/crypto/sha3"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
	"source.quilibrium.com/quilibrium/monorepo/node/crypto/kzg"
	"source.quilibrium.com/quilibrium/monorepo/node/protobufs"
)

type KZGInclusionProver struct {
	prover *kzg.KZGProver
	logger *zap.Logger
}

func NewKZGInclusionProver(logger *zap.Logger) *KZGInclusionProver {
	return &KZGInclusionProver{
		prover: kzg.DefaultKZGProver(),
		logger: logger,
	}
}

// Commit implements InclusionProver.
func (k *KZGInclusionProver) Commit(
	data []byte,
	typeUrl string,
) (*InclusionCommitment, error) {
	if typeUrl == protobufs.IntrinsicExecutionOutputType {
		digest := sha3.NewShake256()
		_, err := digest.Write(data)
		if err != nil {
			k.logger.Error(
				"error converting key bundle to polynomial",
				zap.Error(err),
			)
			return nil, errors.Wrap(err, "prove aggregate")
		}

		expand := make([]byte, 1024)
		_, err = digest.Read(expand)
		if err != nil {
			k.logger.Error(
				"error converting key bundle to polynomial",
				zap.Error(err),
			)
			return nil, errors.Wrap(err, "prove aggregate")
		}

		poly, err := k.prover.BytesToPolynomial(expand)
		if err != nil {
			return nil, errors.Wrap(err, "commit")
		}

		k.logger.Debug("proving execution output for inclusion")
		polys, err := kzg.FFT(
			poly,
			*curves.BLS48581(
				curves.BLS48581G1().NewGeneratorPoint(),
			),
			16,
			false,
		)
		if err != nil {
			return nil, errors.Wrap(err, "prove")
		}

		k.logger.Debug("converted execution output chunk to evaluation form")

		k.logger.Debug("creating kzg commitment")
		points, err := k.prover.Commit(polys)
		if err != nil {
			return nil, errors.Wrap(err, "prove")
		}

		return &InclusionCommitment{
			TypeUrl:    typeUrl,
			Data:       data,
			Commitment: points.ToAffineCompressed(),
		}, nil
	}

	poly, err := k.prover.BytesToPolynomial(data)
	if err != nil {
		return nil, errors.Wrap(err, "commit")
	}

	points, err := k.prover.Commit(poly)
	if err != nil {
		return nil, errors.Wrap(err, "commit")
	}

	return &InclusionCommitment{
		TypeUrl:    typeUrl,
		Data:       data,
		Commitment: points.ToAffineCompressed(),
	}, nil
}

// ProveAggregate implements InclusionProver.
func (k *KZGInclusionProver) ProveAggregate(
	commits []*InclusionCommitment,
) (*InclusionAggregateProof, error) {
	polys := [][]curves.PairingScalar{}
	commitPoints := []curves.PairingPoint{}
	for _, commit := range commits {
		switch commit.TypeUrl {
		case protobufs.IntrinsicExecutionOutputType:
			k.logger.Debug("confirming inclusion in aggregate")
			digest := sha3.NewShake256()
			_, err := digest.Write(commit.Data)
			if err != nil {
				k.logger.Error(
					"error converting key bundle to polynomial",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}

			expand := make([]byte, 1024)
			_, err = digest.Read(expand)
			if err != nil {
				k.logger.Error(
					"error converting key bundle to polynomial",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}

			poly, err := k.prover.BytesToPolynomial(expand)
			if err != nil {
				k.logger.Error(
					"error converting key bundle to polynomial",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}

			evalPoly, err := kzg.FFT(
				poly,
				*curves.BLS48581(
					curves.BLS48581G1().NewGeneratorPoint(),
				),
				16,
				false,
			)
			if err != nil {
				k.logger.Error(
					"error performing fast fourier transform on key bundle",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}
			k.logger.Debug(
				"created fft of polynomial",
				zap.Int("poly_size", len(evalPoly)),
			)

			polys = append(polys, evalPoly)

			c, err := curves.BLS48581G1().NewGeneratorPoint().FromAffineCompressed(
				commit.Commitment,
			)
			if err != nil {
				return nil, errors.Wrap(err, "prove aggregate")
			}
			commitPoints = append(commitPoints, c.(curves.PairingPoint))
		default:
			k.logger.Debug("confirming inclusion in aggregate")
			poly, err := k.prover.BytesToPolynomial(commit.Data)
			if err != nil {
				k.logger.Error(
					"error converting key bundle to polynomial",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}

			for i := 0; i < 128-len(poly); i++ {
				poly = append(
					poly,
					curves.BLS48581G1().Scalar.Zero().(curves.PairingScalar),
				)
			}

			evalPoly, err := kzg.FFT(
				poly,
				*curves.BLS48581(
					curves.BLS48581G1().NewGeneratorPoint(),
				),
				128,
				false,
			)
			if err != nil {
				k.logger.Error(
					"error performing fast fourier transform on key bundle",
					zap.Error(err),
				)
				return nil, errors.Wrap(err, "prove aggregate")
			}
			k.logger.Debug(
				"created fft of polynomial",
				zap.Int("poly_size", len(evalPoly)),
			)

			polys = append(polys, evalPoly)

			c, err := curves.BLS48581G1().NewGeneratorPoint().FromAffineCompressed(
				commit.Commitment,
			)
			if err != nil {
				k.logger.Error("could not verify clock frame", zap.Error(err))
				return nil, errors.Wrap(err, "prove aggregate")
			}
			commitPoints = append(commitPoints, c.(curves.PairingPoint))
		}
	}

	proof, commitment, err := k.prover.ProveAggregate(
		polys,
		commitPoints,
	)
	if err != nil {
		return nil, errors.Wrap(err, "prove aggregate")
	}

	if proof.IsIdentity() {
		return nil, errors.Wrap(errors.New("invalid proof"), "prove aggregate")
	}

	return &InclusionAggregateProof{
		InclusionCommitments: commits,
		AggregateCommitment:  commitment.ToAffineCompressed(),
		Proof:                proof.ToAffineCompressed(),
	}, nil
}

// VerifyAggregate implements InclusionProver.
func (k *KZGInclusionProver) VerifyAggregate(
	proof *InclusionAggregateProof,
) (bool, error) {
	polys := [][]curves.PairingScalar{}
	commitPoints := []curves.PairingPoint{}
	for _, commit := range proof.InclusionCommitments {
		poly, err := k.prover.BytesToPolynomial(commit.Data)
		if err != nil {
			return false, errors.Wrap(err, "verify aggregate")
		}

		polys = append(polys, poly)

		point, err := curves.BLS48581G1().Point.FromAffineCompressed(
			commit.Commitment,
		)
		if err != nil {
			return false, errors.Wrap(err, "verify aggregate")
		}

		commitPoints = append(commitPoints, point.(curves.PairingPoint))
	}

	aggregate, err := curves.BLS48581G1().Point.FromAffineCompressed(
		proof.AggregateCommitment,
	)
	if err != nil {
		return false, errors.Wrap(err, "verify aggregate")
	}

	proofPoint, err := curves.BLS48581G1().Point.FromAffineCompressed(
		proof.Proof,
	)
	if err != nil {
		return false, errors.Wrap(err, "verify aggregate")
	}

	verify, err := k.prover.VerifyAggregateProof(
		polys,
		commitPoints,
		aggregate.(curves.PairingPoint),
		proofPoint.(curves.PairingPoint),
	)
	return verify, errors.Wrap(err, "verify aggregate")
}

func (k *KZGInclusionProver) VerifyFrame(
	frame *protobufs.ClockFrame,
) error {
	aggregateCommitments := []curves.PairingPoint{}
	for i := 0; i < (len(frame.Input)-516)/74; i++ {
		c, err := curves.BLS48581G1().NewGeneratorPoint().FromAffineCompressed(
			frame.Input[516+(i*74) : 516+(i*74)+74],
		)
		if err != nil {
			k.logger.Error("could not verify clock frame", zap.Error(err))
			return errors.Wrap(err, "verify frame")
		}
		aggregateCommitments = append(aggregateCommitments, c.(curves.PairingPoint))
	}

	if len(aggregateCommitments) != len(frame.AggregateProofs) {
		k.logger.Error(
			"commit length mismatched proof for frame",
			zap.Int("commit_length", len(aggregateCommitments)),
			zap.Int("proof_length", len(frame.AggregateProofs)),
		)
		return errors.Wrap(
			errors.New("commit length mismatched proof for frame"),
			"verify frame",
		)
	}

	for i, proof := range frame.AggregateProofs {
		aggregatePoly := [][]curves.PairingScalar{}
		commitments := []curves.PairingPoint{}

		for _, commit := range proof.GetInclusionCommitments() {
			switch commit.TypeUrl {
			case protobufs.IntrinsicExecutionOutputType:
				k.logger.Debug("confirming inclusion in aggregate")
				digest := sha3.NewShake256()
				_, err := digest.Write(commit.Data)
				if err != nil {
					k.logger.Error(
						"error converting key bundle to polynomial",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}

				expand := make([]byte, 1024)
				_, err = digest.Read(expand)
				if err != nil {
					k.logger.Error(
						"error converting key bundle to polynomial",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}

				poly, err := k.prover.BytesToPolynomial(expand)
				if err != nil {
					k.logger.Error(
						"error converting key bundle to polynomial",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}

				evalPoly, err := kzg.FFT(
					poly,
					*curves.BLS48581(
						curves.BLS48581G1().NewGeneratorPoint(),
					),
					16,
					false,
				)
				if err != nil {
					k.logger.Error(
						"error performing fast fourier transform on key bundle",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}
				k.logger.Debug(
					"created fft of polynomial",
					zap.Int("poly_size", len(evalPoly)),
				)

				aggregatePoly = append(aggregatePoly, evalPoly)

				c, err := curves.BLS48581G1().NewGeneratorPoint().FromAffineCompressed(
					commit.Commitment,
				)
				if err != nil {
					k.logger.Error("could not verify clock frame", zap.Error(err))
					return errors.Wrap(err, "verify frame")
				}
				commitments = append(commitments, c.(curves.PairingPoint))
			default:
				k.logger.Debug("confirming inclusion in aggregate")
				poly, err := k.prover.BytesToPolynomial(commit.Data)
				if err != nil {
					k.logger.Error(
						"error converting key bundle to polynomial",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}

				for i := 0; i < 128-len(poly); i++ {
					poly = append(
						poly,
						curves.BLS48581G1().Scalar.Zero().(curves.PairingScalar),
					)
				}

				evalPoly, err := kzg.FFT(
					poly,
					*curves.BLS48581(
						curves.BLS48581G1().NewGeneratorPoint(),
					),
					128,
					false,
				)
				if err != nil {
					k.logger.Error(
						"error performing fast fourier transform on key bundle",
						zap.Error(err),
					)
					return errors.Wrap(err, "verify frame")
				}
				k.logger.Debug(
					"created fft of polynomial",
					zap.Int("poly_size", len(evalPoly)),
				)

				aggregatePoly = append(aggregatePoly, evalPoly)

				c, err := curves.BLS48581G1().NewGeneratorPoint().FromAffineCompressed(
					commit.Commitment,
				)
				if err != nil {
					k.logger.Error("could not verify clock frame", zap.Error(err))
					return errors.Wrap(err, "verify frame")
				}
				commitments = append(commitments, c.(curves.PairingPoint))
			}
		}

		p, err := curves.BLS48581G1().Point.FromAffineCompressed(
			proof.Proof,
		)
		if err != nil {
			k.logger.Error("could not verify clock frame", zap.Error(err))
			return errors.Wrap(err, "verify frame")
		}

		result, err := k.prover.VerifyAggregateProof(
			aggregatePoly,
			commitments,
			aggregateCommitments[i],
			p.(curves.PairingPoint),
		)
		if err != nil {
			k.logger.Error(
				"could not verify clock frame",
				zap.Error(err),
			)
			return errors.Wrap(err, "verify frame")
		}

		if !result {
			k.logger.Error("could not verify clock frame", zap.Error(err))
			return errors.Wrap(
				errors.New("invalid proof"),
				"verify frame",
			)
		}
	}

	return nil
}

var _ InclusionProver = (*KZGInclusionProver)(nil)