ceremonyclient/nekryptology/pkg/signatures/bbs/pok_signature_proof.go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//

package bbs

import (
	"errors"
	"fmt"

	"github.com/gtank/merlin"

	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/signatures/common"
)

// PokSignatureProof is the actual proof sent from a prover
// to a verifier that contains a proof of knowledge of a signature
// and the selective disclosure proof
type PokSignatureProof struct {
	aPrime, aBar, d curves.PairingPoint
	proof1, proof2  []curves.Scalar
}

// Init creates an empty proof to a specific curve
// which should be followed by UnmarshalBinary
func (pok *PokSignatureProof) Init(curve *curves.PairingCurve) *PokSignatureProof {
	pok.aPrime = curve.Scalar.Point().(curves.PairingPoint).OtherGroup()
	pok.aBar = pok.aPrime
	pok.d = pok.aPrime
	pok.proof1 = []curves.Scalar{
		curve.Scalar.Zero(),
		curve.Scalar.Zero(),
	}
	pok.proof2 = make([]curves.Scalar, 0)
	return pok
}

func (pok *PokSignatureProof) MarshalBinary() ([]byte, error) {
	data := append(pok.aPrime.ToAffineCompressed(), pok.aBar.ToAffineCompressed()...)
	data = append(data, pok.d.ToAffineCompressed()...)
	for _, p := range pok.proof1 {
		data = append(data, p.Bytes()...)
	}
	for _, p := range pok.proof2 {
		data = append(data, p.Bytes()...)
	}
	return data, nil
}

func (pok *PokSignatureProof) UnmarshalBinary(in []byte) error {
	scSize := len(pok.proof1[0].Bytes())
	ptSize := len(pok.aPrime.ToAffineCompressed())
	minSize := scSize*4 + ptSize*3
	inSize := len(in)
	if inSize < minSize {
		return fmt.Errorf("invalid byte sequence")
	}
	if (inSize-ptSize)%scSize != 0 {
		return fmt.Errorf("invalid byte sequence")
	}
	secretCnt := ((inSize - ptSize*3) / scSize) - 2
	offset := 0
	end := ptSize

	aPrime, err := pok.aPrime.FromAffineCompressed(in[offset:end])
	if err != nil {
		return err
	}
	offset = end
	end += ptSize
	aBar, err := pok.aBar.FromAffineCompressed(in[offset:end])
	if err != nil {
		return err
	}
	offset = end
	end += ptSize
	d, err := pok.d.FromAffineCompressed(in[offset:end])
	if err != nil {
		return err
	}
	offset = end
	end += scSize
	proof1i0, err := pok.proof1[0].SetBytes(in[offset:end])
	if err != nil {
		return err
	}
	offset = end
	end += scSize
	proof1i1, err := pok.proof1[1].SetBytes(in[offset:end])
	if err != nil {
		return err
	}
	proof2 := make([]curves.Scalar, secretCnt)
	for i := 0; i < secretCnt; i++ {
		offset = end
		end += scSize
		proof2[i], err = pok.proof1[0].SetBytes(in[offset:end])
		if err != nil {
			return err
		}
	}

	var ok bool
	pok.aPrime, ok = aPrime.(curves.PairingPoint)
	if !ok {
		return errors.New("incorrect type conversion")
	}
	pok.aBar, ok = aBar.(curves.PairingPoint)
	if !ok {
		return errors.New("incorrect type conversion")
	}
	pok.d, ok = d.(curves.PairingPoint)
	if !ok {
		return errors.New("incorrect type conversion")
	}
	pok.proof1[0] = proof1i0
	pok.proof1[1] = proof1i1
	pok.proof2 = proof2
	return nil
}

// GetChallengeContribution converts the committed values to bytes
// for the Fiat-Shamir challenge
func (pok PokSignatureProof) GetChallengeContribution(
	generators *MessageGenerators,
	revealedMessages map[int]curves.Scalar,
	challenge common.Challenge,
	transcript *merlin.Transcript,
) {
	transcript.AppendMessage([]byte("A'"), pok.aPrime.ToAffineCompressed())
	transcript.AppendMessage([]byte("Abar"), pok.aBar.ToAffineCompressed())
	transcript.AppendMessage([]byte("D"), pok.d.ToAffineCompressed())

	proof1Points := []curves.Point{pok.aBar.Sub(pok.d), pok.aPrime, generators.h0}
	proof1Scalars := []curves.Scalar{challenge, pok.proof1[0], pok.proof1[1]}
	commitmentProof1 := pok.aPrime.SumOfProducts(proof1Points, proof1Scalars)
	transcript.AppendMessage([]byte("Proof1"), commitmentProof1.ToAffineCompressed())

	rPoints := make([]curves.Point, 1, len(revealedMessages)+1)
	rScalars := make([]curves.Scalar, 1, len(revealedMessages)+1)

	rPoints[0] = pok.aPrime.Generator()
	rScalars[0] = pok.proof1[0].One()

	for idx, msg := range revealedMessages {
		rPoints = append(rPoints, generators.Get(idx+1))
		rScalars = append(rScalars, msg)
	}

	r := pok.aPrime.SumOfProducts(rPoints, rScalars)

	pts := 3 + generators.length - len(revealedMessages)
	proof2Points := make([]curves.Point, 3, pts)
	proof2Scalars := make([]curves.Scalar, 3, pts)

	// R * c
	proof2Points[0] = r
	proof2Scalars[0] = challenge

	// D * -r3Hat
	proof2Points[1] = pok.d.Neg()
	proof2Scalars[1] = pok.proof2[0]

	// H0 * s'Hat
	proof2Points[2] = generators.h0
	proof2Scalars[2] = pok.proof2[1]

	j := 2
	for i := 0; i < generators.length; i++ {
		if _, contains := revealedMessages[i]; contains {
			continue
		}
		proof2Points = append(proof2Points, generators.Get(i+1))
		proof2Scalars = append(proof2Scalars, pok.proof2[j])
		j++
	}
	commitmentProof2 := r.SumOfProducts(proof2Points, proof2Scalars)

	transcript.AppendMessage([]byte("Proof2"), commitmentProof2.ToAffineCompressed())
}

// VerifySigPok only validates the signature proof,
// the selective disclosure proof is checked by
// verifying
// pok.challenge == computedChallenge
func (pok PokSignatureProof) VerifySigPok(pk *PublicKey) bool {
	return !pk.value.IsIdentity() &&
		!pok.aPrime.IsIdentity() &&
		!pok.aBar.IsIdentity() &&
		pok.aPrime.MultiPairing(pok.aPrime, pk.value, pok.aBar, pk.value.Generator().Neg().(curves.PairingPoint)).IsOne()
}

// Verify checks a signature proof of knowledge and selective disclosure proof
func (pok PokSignatureProof) Verify(
	revealedMsgs map[int]curves.Scalar,
	pk *PublicKey,
	generators *MessageGenerators,
	nonce common.Nonce,
	challenge common.Challenge,
	transcript *merlin.Transcript,
) bool {
	pok.GetChallengeContribution(generators, revealedMsgs, challenge, transcript)
	transcript.AppendMessage([]byte("nonce"), nonce.Bytes())
	okm := transcript.ExtractBytes([]byte("signature proof of knowledge"), 64)
	vChallenge, err := pok.proof1[0].SetBytesWide(okm)
	if err != nil {
		return false
	}
	return pok.VerifySigPok(pk) && challenge.Cmp(vChallenge) == 0
}