diff --git a/cggmp24/src/lib.rs b/cggmp24/src/lib.rs index bad3222a..381eb719 100644 --- a/cggmp24/src/lib.rs +++ b/cggmp24/src/lib.rs @@ -295,7 +295,7 @@ )] #![forbid(clippy::disallowed_methods, missing_docs, unsafe_code)] #![cfg_attr(not(test), forbid(unused_crate_dependencies))] -#![cfg_attr(docsrs, feature(doc_auto_cfg))] +#![cfg_attr(docsrs, feature(doc_cfg))] #[cfg(feature = "hd-wallet")] pub use hd_wallet; diff --git a/cggmp24/src/signing.rs b/cggmp24/src/signing.rs index 37cf4824..d6e1f746 100644 --- a/cggmp24/src/signing.rs +++ b/cggmp24/src/signing.rs @@ -1039,8 +1039,8 @@ where }, &R_j.into(), pi_aff::Data { - key_j: enc_j, - key_i: &dec_i, + n_j: enc_j, + n_i: &dec_i, c: &ciphertext_j.K, d: &D_ji, y: &F_ji, @@ -1049,8 +1049,8 @@ where pi_aff::PrivateData { x: &utils::scalar_to_pm_bignumber(&gamma_i), y: &(-&beta_ij).complete(), - nonce: &s_ij, - nonce_y: &r_ij, + rho: &s_ij, + rho_y: &r_ij, }, &security_params.pi_aff, &mut *rng, @@ -1067,8 +1067,8 @@ where }, &R_j.into(), pi_aff::Data { - key_j: enc_j, - key_i: &dec_i, + n_j: enc_j, + n_i: &dec_i, c: &ciphertext_j.K, d: &hat_D_ji, y: &hat_F_ji, @@ -1077,8 +1077,8 @@ where pi_aff::PrivateData { x: &utils::scalar_to_pm_bignumber(x_i), y: &(-&hat_beta_ij).complete(), - nonce: &hat_s_ij, - nonce_y: &hat_r_ij, + rho: &hat_s_ij, + rho_y: &hat_r_ij, }, &security_params.pi_aff, &mut *rng, @@ -1153,8 +1153,8 @@ where }, &R_i.into(), pi_aff::Data { - key_j: &dec_i, - key_i: enc_j, + n_j: &dec_i, + n_i: enc_j, c: &K_i, d: &msg.D, y: &msg.F, @@ -1174,8 +1174,8 @@ where }, &R_i.into(), pi_aff::Data { - key_j: &dec_i, - key_i: enc_j, + n_j: &dec_i, + n_i: enc_j, c: &K_i, d: &msg.hat_D, y: &msg.hat_F, diff --git a/cggmp24/src/utils.rs b/cggmp24/src/utils.rs index 2138c1be..259afac0 100644 --- a/cggmp24/src/utils.rs +++ b/cggmp24/src/utils.rs @@ -33,8 +33,8 @@ impl SecurityParams { pub fn new() -> Self { Self { pi_aff: pi_aff::SecurityParams { - l_x: L::ELL, - l_y: L::ELL_PRIME, + l: L::ELL, + l_prime: L::ELL_PRIME, epsilon: L::EPSILON, }, pi_enc_elg: pi_enc_elg::SecurityParams { diff --git a/key-share/src/lib.rs b/key-share/src/lib.rs index 7352ce20..0c65ef09 100644 --- a/key-share/src/lib.rs +++ b/key-share/src/lib.rs @@ -14,7 +14,7 @@ #![allow(non_snake_case)] #![deny(missing_docs, clippy::unwrap_used, clippy::expect_used, clippy::panic)] #![forbid(unused_crate_dependencies)] -#![cfg_attr(docsrs, feature(doc_auto_cfg))] +#![cfg_attr(docsrs, feature(doc_cfg))] #![no_std] #[cfg(feature = "std")] diff --git a/paillier-zk/src/curve.rs b/paillier-zk/src/curve.rs index 192accc5..54bddec7 100644 --- a/paillier-zk/src/curve.rs +++ b/paillier-zk/src/curve.rs @@ -260,9 +260,9 @@ impl generic_ec::core::IntegerEncoding for Scalar { } #[derive(Debug, PartialEq, Eq, Clone, Copy, Hash, PartialOrd, Ord, Default)] -pub struct C; +pub struct E; -impl generic_ec::Curve for C { +impl generic_ec::Curve for E { const CURVE_NAME: &'static str = "test curve Z/1000000007"; type Point = MillionRing; type Scalar = Scalar; diff --git a/paillier-zk/src/dlog_with_el_gamal_commitment.rs b/paillier-zk/src/dlog_with_el_gamal_commitment.rs index 0219022e..73723e9d 100644 --- a/paillier-zk/src/dlog_with_el_gamal_commitment.rs +++ b/paillier-zk/src/dlog_with_el_gamal_commitment.rs @@ -377,7 +377,7 @@ mod test { #[test] fn passing_million() { - passing_test::() + passing_test::() } #[test] fn failing_check_1_p256() { @@ -386,7 +386,7 @@ mod test { #[test] fn failing_check_1_million() { - failing_check_lambda_::() + failing_check_lambda_::() } #[test] fn failing_check_2_p256() { @@ -395,6 +395,6 @@ mod test { #[test] fn failing_check_2_million() { - failing_check_y_::() + failing_check_y_::() } } diff --git a/paillier-zk/src/paillier_affine_operation_in_range.rs b/paillier-zk/src/paillier_affine_operation_in_range.rs index 99b4722b..704d0733 100644 --- a/paillier-zk/src/paillier_affine_operation_in_range.rs +++ b/paillier-zk/src/paillier_affine_operation_in_range.rs @@ -11,18 +11,18 @@ //! Given: //! - `key0`, `pkey0`, `key1`, `pkey1` - pairs of public and private keys in //! paillier cryptosystem -//! - `nonce_y`, `nonce` - nonces in paillier encryption +//! - `rho_y`, `rho` - nonces in paillier encryption //! - `x`, `y` - some numbers //! - `q`, `g` such that ` = Zq*` - prime order group //! - `C` is some ciphertext encrypted by `key0` -//! - `Y = key1.encrypt(y, nonce_y)` +//! - `Y = key1.encrypt(y, rho_y)` //! - `X = g * x` -//! - `D = oadd(enc(y, nonce), omul(x, C))` where `enc`, `oadd` and `omul` are +//! - `D = oadd(enc(y, rho), omul(x, C))` where `enc`, `oadd` and `omul` are //! paillier encryption, homomorphic addition and multiplication with `key0` //! //! Prove: -//! - `bitsize(abs(x)) <= l_x` -//! - `bitsize(abs(y)) <= l_y` +//! - `bitsize(abs(x)) <= l` +//! - `bitsize(abs(y)) <= l_prime` //! //! Disclosing only: `key0`, `key1`, `C`, `D`, `Y`, `X` //! @@ -52,32 +52,32 @@ //! //! let aux: p::Aux = pregenerated::verifier_aux(); //! let security = p::SecurityParams { -//! l_x: 256, -//! l_y: 256 * 5, +//! l: 256, +//! l_prime: 256 * 5, //! epsilon: 256 * 2, //! }; //! //! // 1. Setup: prover prepares the paillier keys //! //! // C and D are encrypted by this key -//! let key_j: fast_paillier::EncryptionKey = pregenerated::someone_encryption_key0(); +//! let n_j: fast_paillier::EncryptionKey = pregenerated::someone_encryption_key0(); //! // Y is encrypted using this key -//! let key_i: fast_paillier::EncryptionKey = pregenerated::someone_encryption_key1(); +//! let n_i: fast_paillier::EncryptionKey = pregenerated::someone_encryption_key1(); //! -//! // C is some number encrypted using key_j. Neither of parties +//! // C is some number encrypted using n_j. Neither of parties //! // need to know the plaintext -//! let ciphertext_c = Integer::gen_invertible(&key_j.nn(), &mut rng); +//! let ciphertext_c = Integer::gen_invertible(&n_j.nn(), &mut rng); //! //! // 2. Setup: prover prepares all plaintexts //! //! // x in paper //! let plaintext_x = Integer::from_rng_half_pm( -//! &(Integer::ONE << security.l_x).complete(), +//! &(Integer::ONE << security.l).complete(), //! &mut rng, //! ); //! // y in paper //! let plaintext_y = Integer::from_rng_half_pm( -//! &(Integer::ONE << security.l_y).complete(), +//! &(Integer::ONE << security.l_prime).complete(), //! &mut rng, //! ); //! @@ -86,28 +86,28 @@ //! // X in paper //! let ciphertext_x = Point::::generator() * plaintext_x.to_scalar(); //! // Y and ρ_y in paper -//! let (ciphertext_y, nonce_y) = key_i.encrypt_with_random( +//! let (ciphertext_y, rho_y) = n_i.encrypt_with_random( //! &mut rng, //! &(plaintext_y), //! )?; -//! // nonce is ρ in paper -//! let (ciphertext_y_by_key_j, nonce) = key_j.encrypt_with_random( +//! // ρ in paper +//! let (ciphertext_y_by_n_j, rho) = n_j.encrypt_with_random( //! &mut rng, //! &(plaintext_y) //! )?; //! // D in paper -//! let ciphertext_d = key_j +//! let ciphertext_d = n_j //! .oadd( -//! &key_j.omul(&plaintext_x, &ciphertext_c)?, -//! &ciphertext_y_by_key_j, +//! &n_j.omul(&plaintext_x, &ciphertext_c)?, +//! &ciphertext_y_by_n_j, //! )?; //! //! // 4. Prover computes a non-interactive proof that plaintext_x and -//! // plaintext_y are at most `l_x` and `l_y` bits +//! // plaintext_y are at most `l` and `l_prime` bits //! //! let data = p::Data { -//! key_j: &key_j, -//! key_i: &key_i, +//! n_j: &n_j, +//! n_i: &n_i, //! c: &ciphertext_c, //! d: &ciphertext_d, //! x: &ciphertext_x, @@ -116,8 +116,8 @@ //! let pdata = p::PrivateData { //! x: &plaintext_x, //! y: &plaintext_y, -//! nonce: &nonce, -//! nonce_y: &nonce_y, +//! rho: &rho, +//! rho_y: &rho_y, //! }; //! let proof = //! p::non_interactive::prove::( @@ -167,9 +167,9 @@ pub use crate::common::{Aux, InvalidProof}; #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))] pub struct SecurityParams { /// l in paper, bit size of +-x - pub l_x: usize, + pub l: usize, /// l' in paper, bit size of +-y - pub l_y: usize, + pub l_prime: usize, /// Epsilon in paper, slackness parameter pub epsilon: usize, } @@ -177,13 +177,13 @@ pub struct SecurityParams { /// Public data that both parties know #[derive(Debug, Clone, Copy, udigest::Digestable)] #[udigest(bound = "")] -pub struct Data<'a, C: Curve> { - /// Nj in the spec, public key that C was encrypted on +pub struct Data<'a, E: Curve> { + /// N_j in the spec, public key that C was encrypted on #[udigest(as = crate::common::encoding::AnyEncryptionKey)] - pub key_j: &'a dyn AnyEncryptionKey, + pub n_j: &'a dyn AnyEncryptionKey, /// Ni in the spec, public key that y -> Y was encrypted on #[udigest(as = crate::common::encoding::AnyEncryptionKey)] - pub key_i: &'a dyn AnyEncryptionKey, + pub n_i: &'a dyn AnyEncryptionKey, /// C in the spec, some data encrypted on Nj #[udigest(as = &crate::common::encoding::Integer)] pub c: &'a Ciphertext, @@ -194,7 +194,7 @@ pub struct Data<'a, C: Curve> { #[udigest(as = &crate::common::encoding::Integer)] pub y: &'a Ciphertext, /// X in the spec, obtained as `x G` - pub x: &'a Point, + pub x: &'a Point, } /// Private data of prover @@ -205,19 +205,19 @@ pub struct PrivateData<'a> { /// y in the spec, preimage of Y pub y: &'a Integer, /// rho in the spec, nonce in encryption of y for additive action - pub nonce: &'a Nonce, + pub rho: &'a Nonce, /// rho_y in the spec, nonce in encryption of y to obtain Y - pub nonce_y: &'a Nonce, + pub rho_y: &'a Nonce, } /// Prover's first message, obtained by [`interactive::commit`] #[derive(Debug, Clone, udigest::Digestable)] #[udigest(bound = "")] #[cfg_attr(feature = "serde", derive(Serialize, Deserialize), serde(bound = ""))] -pub struct Commitment { +pub struct Commitment { #[udigest(as = crate::common::encoding::Integer)] pub a: Integer, - pub b_x: Point, + pub b_x: Point, #[udigest(as = crate::common::encoding::Integer)] pub b_y: Integer, #[udigest(as = crate::common::encoding::Integer)] @@ -265,8 +265,8 @@ pub struct Proof { #[derive(Debug, Clone)] #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))] #[cfg_attr(feature = "serde", serde(bound = ""))] -pub struct NiProof { - pub commitment: Commitment, +pub struct NiProof { + pub commitment: Commitment, pub proof: Proof, } @@ -284,23 +284,23 @@ pub mod interactive { use super::*; /// Create random commitment - pub fn commit( + pub fn commit( aux: &Aux, - data: Data, + data: Data, pdata: PrivateData, security: &SecurityParams, mut rng: R, - ) -> Result<(Commitment, PrivateCommitment), Error> { - let two_to_l = (Integer::ONE << security.l_x).complete(); - let two_to_l_e = (Integer::ONE << (security.l_x + security.epsilon)).complete(); - let two_to_l_prime_e = (Integer::ONE << (security.l_y + security.epsilon)).complete(); + ) -> Result<(Commitment, PrivateCommitment), Error> { + let two_to_l = (Integer::ONE << security.l).complete(); + let two_to_l_e = (Integer::ONE << (security.l + security.epsilon)).complete(); + let two_to_l_prime_e = (Integer::ONE << (security.l_prime + security.epsilon)).complete(); let hat_n_at_two_to_l_e = (&aux.rsa_modulo * &two_to_l_e).complete(); let hat_n_at_two_to_l = (&aux.rsa_modulo * &two_to_l).complete(); let alpha = Integer::from_rng_half_pm(&two_to_l_e, &mut rng); let beta = Integer::from_rng_half_pm(&two_to_l_prime_e, &mut rng); - let r = Integer::gen_invertible(data.key_j.n(), &mut rng); - let r_y = Integer::gen_invertible(data.key_i.n(), &mut rng); + let r = Integer::gen_invertible(data.n_j.n(), &mut rng); + let r_y = Integer::gen_invertible(data.n_i.n(), &mut rng); let gamma = Integer::from_rng_half_pm(&hat_n_at_two_to_l_e, &mut rng); let delta = Integer::from_rng_half_pm(&hat_n_at_two_to_l_e, &mut rng); let m = Integer::from_rng_half_pm(&hat_n_at_two_to_l, &mut rng); @@ -308,12 +308,12 @@ pub mod interactive { let commitment = Commitment { a: { - let beta_enc_key0 = data.key_j.encrypt_with(&beta, &r)?; - let alpha_at_c = data.key_j.omul(&alpha, data.c)?; - data.key_j.oadd(&alpha_at_c, &beta_enc_key0)? + let beta_enc_key0 = data.n_j.encrypt_with(&beta, &r)?; + let alpha_at_c = data.n_j.omul(&alpha, data.c)?; + data.n_j.oadd(&alpha_at_c, &beta_enc_key0)? }, - b_x: Point::::generator() * alpha.to_scalar(), - b_y: data.key_i.encrypt_with(&beta, &r_y)?, + b_x: Point::::generator() * alpha.to_scalar(), + b_y: data.n_i.encrypt_with(&beta, &r_y)?, e: aux.combine(&alpha, &gamma)?, s: aux.combine(pdata.x, &m)?, f: aux.combine(&beta, &delta)?, @@ -333,8 +333,8 @@ pub mod interactive { } /// Compute proof for given data and prior protocol values - pub fn prove( - data: Data, + pub fn prove( + data: Data, pdata: PrivateData, pcomm: &PrivateCommitment, challenge: &Challenge, @@ -345,22 +345,22 @@ pub mod interactive { z3: (&pcomm.gamma + challenge * &pcomm.m).complete(), z4: (&pcomm.delta + challenge * &pcomm.mu).complete(), w: data - .key_j + .n_j .n() - .combine(&pcomm.r, Integer::ONE, pdata.nonce, challenge)?, - // TODO: this can be optimized as prover knows key_i factorization + .combine(&pcomm.r, Integer::ONE, pdata.rho, challenge)?, + // TODO: this can be optimized as prover knows n_i factorization w_y: data - .key_i + .n_i .n() - .combine(&pcomm.r_y, Integer::ONE, pdata.nonce_y, challenge)?, + .combine(&pcomm.r_y, Integer::ONE, pdata.rho_y, challenge)?, }) } /// Verify the proof - pub fn verify( + pub fn verify( aux: &Aux, - data: Data, - commitment: &Commitment, + data: Data, + commitment: &Commitment, security: &SecurityParams, challenge: &Challenge, proof: &Proof, @@ -368,48 +368,48 @@ pub mod interactive { // Five equality checks and two range checks { let lhs = { + let challenge_at_d = data + .n_j + .omul(challenge, data.d) + .map_err(|_| InvalidProofReason::PaillierOp)?; + data.n_j + .oadd(&commitment.a, &challenge_at_d) + .map_err(|_| InvalidProofReason::PaillierOp)? + }; + let rhs = { let z1_at_c = data - .key_j + .n_j .omul(&proof.z1, data.c) .map_err(|_| InvalidProofReason::PaillierOp)?; let enc = data - .key_j + .n_j .encrypt_with(&proof.z2, &proof.w) .map_err(|_| InvalidProofReason::PaillierEnc)?; - data.key_j + data.n_j .oadd(&z1_at_c, &enc) .map_err(|_| InvalidProofReason::PaillierOp)? }; - let rhs = { - let e_at_d = data - .key_j - .omul(challenge, data.d) - .map_err(|_| InvalidProofReason::PaillierOp)?; - data.key_j - .oadd(&commitment.a, &e_at_d) - .map_err(|_| InvalidProofReason::PaillierOp)? - }; fail_if_ne(InvalidProofReason::EqualityCheck(1), lhs, rhs)?; } { - let lhs = Point::::generator() * proof.z1.to_scalar(); + let lhs = Point::::generator() * proof.z1.to_scalar(); let rhs = commitment.b_x + data.x * challenge.to_scalar(); fail_if_ne(InvalidProofReason::EqualityCheck(2), lhs, rhs)?; } { - let lhs = data - .key_i - .encrypt_with(&proof.z2, &proof.w_y) - .map_err(|_| InvalidProofReason::PaillierEnc)?; - let rhs = { - let e_at_y = data - .key_i + let lhs = { + let challenge_at_y = data + .n_i .omul(challenge, data.y) .map_err(|_| InvalidProofReason::PaillierOp)?; - data.key_i - .oadd(&commitment.b_y, &e_at_y) + data.n_i + .oadd(&commitment.b_y, &challenge_at_y) .map_err(|_| InvalidProofReason::PaillierOp)? }; + let rhs = data + .n_i + .encrypt_with(&proof.z2, &proof.w_y) + .map_err(|_| InvalidProofReason::PaillierEnc)?; fail_if_ne(InvalidProofReason::EqualityCheck(3), lhs, rhs)?; } { @@ -428,20 +428,20 @@ pub mod interactive { InvalidProofReason::RangeCheck(6), proof .z1 - .is_in_half_pm(&(Integer::ONE << (security.l_x + security.epsilon)).complete()), + .is_in_half_pm(&(Integer::ONE << (security.l + security.epsilon)).complete()), )?; fail_if( InvalidProofReason::RangeCheck(7), proof .z2 - .is_in_half_pm(&(Integer::ONE << (security.l_y + security.epsilon)).complete()), + .is_in_half_pm(&(Integer::ONE << (security.l_prime + security.epsilon)).complete()), )?; Ok(()) } /// Generate random challenge - pub fn challenge(rng: &mut impl rand_core::RngCore) -> Integer { - let q = Integer::curve_order::(); + pub fn challenge(rng: &mut impl rand_core::RngCore) -> Integer { + let q = Integer::curve_order::(); Integer::from_rng_half_pm(&q, rng) } } @@ -460,29 +460,29 @@ pub mod non_interactive { /// deriving determenistic challenge. /// /// Obtained from the above interactive proof via Fiat-Shamir heuristic. - pub fn prove( + pub fn prove( shared_state: &impl udigest::Digestable, aux: &Aux, - data: Data, + data: Data, pdata: PrivateData, security: &SecurityParams, rng: &mut impl rand_core::RngCore, - ) -> Result, Error> { + ) -> Result, Error> { let (commitment, pcomm) = super::interactive::commit(aux, data, pdata, security, rng)?; - let challenge = challenge::(shared_state, aux, data, &commitment, security); + let challenge = challenge::(shared_state, aux, data, &commitment, security); let proof = super::interactive::prove(data, pdata, &pcomm, &challenge)?; Ok(NiProof { commitment, proof }) } /// Verify the proof, deriving challenge independently from same data - pub fn verify( + pub fn verify( shared_state: &impl udigest::Digestable, aux: &Aux, - data: Data, + data: Data, security: &SecurityParams, - proof: &NiProof, + proof: &NiProof, ) -> Result<(), InvalidProof> { - let challenge = challenge::(shared_state, aux, data, &proof.commitment, security); + let challenge = challenge::(shared_state, aux, data, &proof.commitment, security); super::interactive::verify( aux, data, @@ -494,11 +494,11 @@ pub mod non_interactive { } /// Deterministically compute challenge based on prior known values in protocol - pub fn challenge( + pub fn challenge( shared_state: &impl udigest::Digestable, aux: &Aux, - data: Data, - commitment: &Commitment, + data: Data, + commitment: &Commitment, security: &SecurityParams, ) -> Challenge { let tag = "paillier_zk.paillier_affine_operation_in_range.ni_challenge"; @@ -511,7 +511,7 @@ pub mod non_interactive { commitment, }); let mut rng = rand_hash::HashRng::::from_seed(seed); - super::interactive::challenge::(&mut rng) + super::interactive::challenge::(&mut rng) } } @@ -524,7 +524,7 @@ mod test { use crate::common::test::random_key; use crate::common::{IntegerExt, InvalidProofReason}; - fn run( + fn run( rng: &mut R, security: super::SecurityParams, x: Integer, @@ -547,18 +547,18 @@ mod test { let d = ek0.oadd(&x_at_c, &y_enc_ek0).unwrap(); let data = super::Data { - key_j: &ek0, - key_i: &ek1, + n_j: &ek0, + n_i: &ek1, c: &c, d: &d, y: &y_enc_ek1, - x: &(x.to_scalar::() * Point::generator()), + x: &(x.to_scalar::() * Point::generator()), }; let pdata = super::PrivateData { x: &x, y: &y, - nonce: &rho, - nonce_y: &rho_y, + rho: &rho, + rho_y: &rho_y, }; let aux = crate::common::test::aux(rng); @@ -566,49 +566,49 @@ mod test { let shared_state = "shared state"; let proof = - super::non_interactive::prove::(&shared_state, &aux, data, pdata, &security, rng) + super::non_interactive::prove::(&shared_state, &aux, data, pdata, &security, rng) .unwrap(); - super::non_interactive::verify::(&shared_state, &aux, data, &security, &proof) + super::non_interactive::verify::(&shared_state, &aux, data, &security, &proof) } - fn passing_test() { + fn passing_test() { let mut rng = rand_dev::DevRng::new(); let security = super::SecurityParams { - l_x: 1024, - l_y: 1024, + l: 1024, + l_prime: 1024, epsilon: 300, }; - let x = Integer::from_rng_half_pm(&(Integer::ONE << security.l_x).complete(), &mut rng); - let y = Integer::from_rng_half_pm(&(Integer::ONE << security.l_y).complete(), &mut rng); - run::<_, C, D>(&mut rng, security, x, y).expect("proof failed"); + let x = Integer::from_rng_half_pm(&(Integer::ONE << security.l).complete(), &mut rng); + let y = Integer::from_rng_half_pm(&(Integer::ONE << security.l_prime).complete(), &mut rng); + run::<_, E, D>(&mut rng, security, x, y).expect("proof failed"); } - fn failing_on_additive() { + fn failing_on_additive() { let mut rng = rand_dev::DevRng::new(); let security = super::SecurityParams { - l_x: 1024, - l_y: 1024, + l: 1024, + l_prime: 1024, epsilon: 300, }; - let x = Integer::from_rng_half_pm(&(Integer::ONE << security.l_x).complete(), &mut rng); - let y = (Integer::ONE << (security.l_y + security.epsilon - 1)).complete() + 1; - let r = run::<_, C, D>(&mut rng, security, x, y).expect_err("proof should not pass"); + let x = Integer::from_rng_half_pm(&(Integer::ONE << security.l).complete(), &mut rng); + let y = (Integer::ONE << (security.l_prime + security.epsilon - 1)).complete() + 1; + let r = run::<_, E, D>(&mut rng, security, x, y).expect_err("proof should not pass"); match r.reason() { InvalidProofReason::RangeCheck(7) => (), e => panic!("proof should not fail with: {e:?}"), } } - fn failing_on_multiplicative() { + fn failing_on_multiplicative() { let mut rng = rand_dev::DevRng::new(); let security = super::SecurityParams { - l_x: 1024, - l_y: 1024, + l: 1024, + l_prime: 1024, epsilon: 300, }; - let x = (Integer::ONE << (security.l_x + security.epsilon - 1)).complete() + 1; - let y = Integer::from_rng_half_pm(&(Integer::ONE << security.l_y).complete(), &mut rng); - let r = run::<_, C, D>(&mut rng, security, x, y).expect_err("proof should not pass"); + let x = (Integer::ONE << (security.l + security.epsilon - 1)).complete() + 1; + let y = Integer::from_rng_half_pm(&(Integer::ONE << security.l_prime).complete(), &mut rng); + let r = run::<_, E, D>(&mut rng, security, x, y).expect_err("proof should not pass"); match r.reason() { InvalidProofReason::RangeCheck(6) => (), e => panic!("proof should not fail with: {e:?}"), @@ -630,14 +630,14 @@ mod test { #[test] fn passing_million() { - passing_test::() + passing_test::() } #[test] fn failing_million_add() { - failing_on_additive::() + failing_on_additive::() } #[test] fn failing_million_mul() { - failing_on_multiplicative::() + failing_on_multiplicative::() } } diff --git a/paillier-zk/src/paillier_encryption_in_range_with_el_gamal.rs b/paillier-zk/src/paillier_encryption_in_range_with_el_gamal.rs index b6ffdee6..f3f95b60 100644 --- a/paillier-zk/src/paillier_encryption_in_range_with_el_gamal.rs +++ b/paillier-zk/src/paillier_encryption_in_range_with_el_gamal.rs @@ -476,10 +476,10 @@ mod test { #[test] fn passing_million() { - passing_test::() + passing_test::() } #[test] fn failing_million_add() { - failing_test::() + failing_test::() } } diff --git a/spec/main.tex b/spec/main.tex index c6b3eba6..01d5f75f 100644 --- a/spec/main.tex +++ b/spec/main.tex @@ -464,7 +464,7 @@ \subsubsection{Interactive Version of the Proof} \algoName{$\commit{enc}^L(R_j, N_i; k, [, \sk_i]) \to ((S, A, C); (\alpha, \mu, r, \gamma))$} \algoInputsList{ \item security level $L = (\ell, \varepsilon, \dots)$ - \item auxilary data $R_j = (N_j, s_j, t_j) \in (\Z, \Z, \Z)$ + \item auxiliary data $R_j = (N_j, s_j, t_j) \in (\Z, \Z, \Z)$ \item public encryption key $N_i \in \Z$ and, if known, corresponding secret key $\sk_i$ \item secret plaintext $k \in \Z$ } @@ -545,7 +545,7 @@ \subsubsection{Non-Interactive Version of the Proof} \algoInputsList{ \item security level $L = (Q, \dots)$, \item shared state $\state \in \Byte^*$, - \item auxilary data $R_j$, + \item auxiliary data $R_j$, \item public encryption key $N_i \in \Z$ and, if known, corresponding secret key $\sk_i$, \item public ciphertext $K \in \Z$, \item secret plaintext $k \in \Z$ and secret nonce $\rho \in \Z$ @@ -570,7 +570,7 @@ \subsubsection{Non-Interactive Version of the Proof} \algoInputsList{ \item security level $L = (Q, \dots)$, \item shared state $\state \in \Byte^*$, - \item auxilary data $R_j$, + \item auxiliary data $R_j$, \item public data: \begin{itemize} \item encryption key $N_i \in \Z$, @@ -628,13 +628,13 @@ \subsubsection{Interactive Version of the Proof} )$} \algoInputsList{ \item security level $L = (\ell, \varepsilon, \dots)$, - \item auxilary data $R_j = (N_j, s_j, t_j) \in (\Z, \Z, \Z)$, - \item public data $N_i, C \in \Z, \Z$ - \item secret data $x, y \in \Z, \Z$ + \item auxiliary data $R_j = (N_j, s_j, t_j) \in \Z^3$, + \item public data $(N_i, C) \in \Z^2$, + \item secret data $(x, y) \in \Z^2$ } \algoOutputsList{ \item public commitment $(A, B_x, B_y, E, S, F, T) \in (\Z, \E, \Z, \Z, \Z, \Z, \Z)$, - \item proof $(\alpha, \beta, r, r_y, \gamma, \delta, m, \mu) \in \Z^8$ + \item secret commitment nonce $(\alpha, \beta, r, r_y, \gamma, \delta, m, \mu) \in \Z^8$ } \begin{algorithmic}[1] \State Sample: @@ -674,9 +674,9 @@ \subsubsection{Interactive Version of the Proof} (\alpha, \beta, r, r_y, \gamma, \delta, m, \mu) ) \to (z_1, z_2, z_3, z_4, w, w_y)$} \algoInputsList{ - \item public data $(N_j, N_i, C, D, Y, X) \in (\Z, \Z, \Z, \Z, \Z, \E)$ - \item challenge $e \in \Z$ - \item secret data $(x, y, \rho, \rho_y) \in \Z^4$ + \item public data $(N_j, N_i, C, D, Y, X) \in (\Z, \Z, \Z, \Z, \Z, \E)$, + \item challenge $e \in \Z$, + \item secret data $(x, y, \rho, \rho_y) \in \Z^4$, \item secret commitment nonce $(\alpha, \beta, r, r_y, \gamma, \delta, m, \mu) \in \Z^8$ } \algoOutputs{proof $(z_1, z_2, z_3, z_4, w, w_y) \in \Z^6$} @@ -703,7 +703,7 @@ \subsubsection{Interactive Version of the Proof} )$} \algoInputsList{ \item security level $L = (\ell, \ell', \varepsilon, \dots)$ - \item auxilary data $R_j = (s, t, \dots) \in (\Z, \Z, \dots)$ + \item auxiliary data $R_j = (s, t, \dots) \in (\Z, \Z, \dots)$ \item public data $(N_j, N_i, C, D, Y, X) \in (\Z, \Z, \Z, \Z, \Z, \E)$ \item commiment $(A, B_x, B_y, E, S, F, T) \in (\Z, \E, \Z, \Z, \Z, \Z, \Z)$ \item challenge $e \in \Z$ @@ -1385,7 +1385,7 @@ \subsubsection{Interactive Version of the Proof} \item \begin{inlineAlgorithm} \algoName{$\challenge{elog}() \to e$} -\algoOutputs{challenge $q \in \Z_q$} +\algoOutputs{challenge $e \in \Z_q$} \begin{algorithmic}[1] \State $e \gets \Z_q$ \State \Return $e$ @@ -1479,7 +1479,7 @@ \subsection{$\proof{enc\mbox{-}elg}$: Range Proof with El-Gamal Commitment} Common (public) input: security level $L = (\ell, \varepsilon, \dots)$, - verifier's auxilary data $R_j = (N_j, s_j, t_j) \in (\Z, \Z^*_{N_j}, \Z^*_{N_j})$, + verifier's auxiliary data $R_j = (N_j, s_j, t_j) \in (\Z, \Z^*_{N_j}, \Z^*_{N_j})$, curve $\E$ with generator $G$ of prime order $q$, Paillier public key $N_0 \in \Z$, Paillier ciphertext $C \in \Z^*_{N_0^2}$, @@ -2218,4 +2218,4 @@ \section{Further Optimizations} \bibliographystyle{plain} \bibliography{ref} -\end{document} +\end{document} \ No newline at end of file