|
|
@@ -0,0 +1,270 @@
|
|
|
+'''
|
|
|
+bulletproof protocol 2 with multi-exponentiation.
|
|
|
+'''
|
|
|
+load('../mpc/curve.sage')
|
|
|
+load('../mpc/ec_share.sage')
|
|
|
+load('../mpc/share.sage')
|
|
|
+load('../mpc/beaver.sage')
|
|
|
+load('utils.sage')
|
|
|
+
|
|
|
+class MpcProof(object):
|
|
|
+ def __init__(self, transcript, Q, G_factors, H_factors, G, H, a_shares, b_shares, source, party_id):
|
|
|
+ '''
|
|
|
+ create inner product proof
|
|
|
+ '''
|
|
|
+ self.n = len(G)
|
|
|
+ self.m = self.n
|
|
|
+ assert (self.n == len(H) == len(H_factors) == len(a_shares) == len(b_shares))
|
|
|
+ self.source = source
|
|
|
+ self.party_id=party_id
|
|
|
+ self.Q = Q
|
|
|
+ self.G = G
|
|
|
+ self.H = H
|
|
|
+ self.G_factors = G_factors
|
|
|
+ self.H_factors = H_factors
|
|
|
+ self.transcript = transcript
|
|
|
+ self.L = []
|
|
|
+ self.R = []
|
|
|
+ L_l = []
|
|
|
+ R_l = []
|
|
|
+ self.c_l = []
|
|
|
+ self.c_r = []
|
|
|
+ self.a_shares_l = []
|
|
|
+ self.a_shares_r = []
|
|
|
+ self.b_shares_l = []
|
|
|
+ self.b_shares_r = []
|
|
|
+ self.G_hist = []
|
|
|
+ self.H_hist = []
|
|
|
+ if self.n!=1:
|
|
|
+ self.n /=2
|
|
|
+ a_shares_l, a_shares_r = a_shares[0:self.n], a_shares[self.n:]
|
|
|
+ b_shares_l, b_shares_r = b_shares[0:self.n], b_shares[self.n:]
|
|
|
+ self.a_shares_l += [a_shares_l.copy()]
|
|
|
+ self.a_shares_r += [a_shares_r.copy()]
|
|
|
+ self.b_shares_l += [b_shares_l.copy()]
|
|
|
+ self.b_shares_r += [b_shares_r.copy()]
|
|
|
+ G_l, G_r = G[0:self.n], G[self.n:]
|
|
|
+ H_l, H_r = H[0:self.n], H[self.n:]
|
|
|
+ self.G_hist+=[[G_l, G_r]]
|
|
|
+ self.H_hist+=[[H_l, H_r]]
|
|
|
+ # authenticated inner product
|
|
|
+ #TODO multiplication
|
|
|
+ c_shares_l = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip(a_shares_l, b_shares_r)]
|
|
|
+ c_shares_r = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip(a_shares_r, b_shares_l)]
|
|
|
+ self.c_l += [c_shares_l]
|
|
|
+ self.c_r += [c_shares_r]
|
|
|
+ u = K(1)
|
|
|
+ u_inv = 1/u
|
|
|
+
|
|
|
+ for i in range(self.n):
|
|
|
+ # a_prime
|
|
|
+ a_shares_l[i] = a_shares_l[i].mul_scalar(u) + a_shares_r[i].mul_scalar(u_inv)
|
|
|
+ # p_prime
|
|
|
+ b_shares_l[i] = b_shares_l[i].mul_scalar(u_inv) + b_shares_r[i].mul_scalar(u)
|
|
|
+ #TODO (research) get pt from share.
|
|
|
+ # G_prime
|
|
|
+ G_l[i] = to_ec_shares(CurvePoint.msm([G_l[i].share, G_r[i].share], [u_inv * G_factors[i], u * G_factors[self.n+i]]))
|
|
|
+ # H_prime
|
|
|
+ H_l[i] = to_ec_shares(CurvePoint.msm([H_l[i].share, H_r[i].share], [u * H_factors[i], u_inv * H_factors[self.n+i]]))
|
|
|
+
|
|
|
+ a_shares = a_shares_l # a is a_prime
|
|
|
+ b_shares = b_shares_l # b is b_prime
|
|
|
+ G = G_l # G is G_prime
|
|
|
+ H = H_l # H is H_prime
|
|
|
+
|
|
|
+ while self.n!=1:
|
|
|
+ self.n /=2
|
|
|
+ a_shares_l, a_shares_r = a_shares[0:self.n], a_shares[self.n:] # a_prime_l, a_prime_r
|
|
|
+ b_shares_l, b_shares_r = b_shares[0:self.n], b_shares[self.n:] # b_prime_l, b_prime_r
|
|
|
+ self.a_shares_l += [a_shares_l.copy()]
|
|
|
+ self.a_shares_r += [a_shares_r.copy()]
|
|
|
+ self.b_shares_l += [b_shares_l.copy()]
|
|
|
+ self.b_shares_r += [b_shares_r.copy()]
|
|
|
+ G_l, G_r = G[0:self.n], G[self.n:] # G_prime_l, G_prime_r
|
|
|
+ H_l, H_r = H[0:self.n], H[self.n:] # H_prime_l, H_prime_r
|
|
|
+ self.G_hist+=[[G_l, G_r]]
|
|
|
+ self.H_hist+=[[H_l, H_r]]
|
|
|
+ c_shares_l = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for (a_share,b_share) in zip(a_shares_l, b_shares_r)] # c_prime_l
|
|
|
+ c_shares_r = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for (a_share,b_share) in zip(a_shares_r, b_shares_l)] # c_prime_r
|
|
|
+ self.c_l += [c_shares_l]
|
|
|
+ self.c_r += [c_shares_r]
|
|
|
+ u = K(1)
|
|
|
+ u_inv = 1/u
|
|
|
+ for i in range(self.n):
|
|
|
+ # u * a_prime_l + u^{-1} * a_prime_r
|
|
|
+ a_shares_l[i] = a_shares_l[i].mul_scalar(u) + a_shares_r[i].mul_scalar(u_inv)
|
|
|
+ # u^{-1} * b_prime_l + u * b_prime_r
|
|
|
+ b_shares_l[i] = b_shares_l[i].mul_scalar(u_inv) + b_shares_r[i].mul_scalar(u)
|
|
|
+ # G_l_prime
|
|
|
+ G_l[i] = to_ec_shares(CurvePoint.msm([G_l[i].share, G_r[i].share], [u_inv, u]))
|
|
|
+ # H_l_prime
|
|
|
+ H_l[i] = to_ec_shares(CurvePoint.msm([H_l[i].share, H_r[i].share], [u, u_inv]))
|
|
|
+ a_shares = a_shares_l
|
|
|
+ b_shares = b_shares_l
|
|
|
+ G = G_l
|
|
|
+ H = H_l
|
|
|
+ self.a_shares = a_shares[0]
|
|
|
+ self.b_shares = b_shares[0]
|
|
|
+ self.G = G
|
|
|
+ self.H = H
|
|
|
+
|
|
|
+ def create(self, their_c_l_shares, their_c_r_shares):
|
|
|
+ '''
|
|
|
+ create inner product proof
|
|
|
+ '''
|
|
|
+
|
|
|
+ self.c_l = [[my_c_l[i].mul(their_c_l[i].d, their_c_l[i].e) for i in range(len(my_c_l))] for my_c_l, their_c_l in zip(self.c_l, their_c_l_shares)]
|
|
|
+ self.c_r = [[my_c_r[i].mul(their_c_r[i].d, their_c_r[i].e) for i in range(len(my_c_r))] for my_c_r, their_c_r in zip(self.c_r, their_c_r_shares)]
|
|
|
+
|
|
|
+ print('c_l: {}'.format(self.c_l))
|
|
|
+ print('c_r: {}'.format(self.c_r))
|
|
|
+ print('c: {}'.format(sum([c_l[i].authenticated_open(c_r[i]) for i in range(len(self.c_l[0])) for c_l, c_r in zip(self.c_l, self.c_r)])))
|
|
|
+ # create L,R for proof validation
|
|
|
+ L_l = []
|
|
|
+ R_l = []
|
|
|
+ counter = 0
|
|
|
+ if self.m!=1:
|
|
|
+ self.m /= 2
|
|
|
+ al_share_g = [al_share.mul_scalar(g) for al_share, g in zip(self.a_shares_l[counter], self.G_factors[self.m:2*self.m])]
|
|
|
+ br_share_h = [br_share.mul_scalar(h) for br_share, h in zip(self.b_shares_r[counter], self.H_factors[0:self.m])]
|
|
|
+ L_gr_al_g_share = MSM(self.G_hist[counter][1], al_share_g, self.source, self.party_id)
|
|
|
+ L_hl_br_h_share = MSM(self.H_hist[counter][0], br_share_h, self.source, self.party_id)
|
|
|
+ L_q_cl_share = MSM(self.Q, self.c_l[counter], self.source, self.party_id)
|
|
|
+ # L, R
|
|
|
+ # note that P = L*R
|
|
|
+ L_shares = [L_gr_al_g_share, L_hl_br_h_share , L_q_cl_share]
|
|
|
+
|
|
|
+ ar_share_g = [ar_share.mul_scalar(g) for ar_share, g in zip(self.a_shares_r[counter], G_factors[0:self.m])]
|
|
|
+ bl_share_g = [bl_share.mul_scalar(h) for bl_share, h in zip(self.b_shares_l[counter], H_factors[self.m:2*self.m])]
|
|
|
+ R_gl_ar_g_share = MSM(self.G_hist[counter][0], ar_share_g, self.source, self.party_id)
|
|
|
+ R_hr_bl_h_share = MSM(self.H_hist[counter][1], bl_share_g, self.source, self.party_id)
|
|
|
+ R_q_cr_share = MSM(Q, self.c_r[counter], self.source, self.party_id)
|
|
|
+ R_shares = [R_gl_ar_g_share, R_hr_bl_h_share, R_q_cr_share]
|
|
|
+ L_l += [L_shares]
|
|
|
+ R_l += [R_shares]
|
|
|
+
|
|
|
+ counter +=1
|
|
|
+ while self.m!=1:
|
|
|
+ self.m /=2
|
|
|
+ # L_prime
|
|
|
+ L_gr_al_share = MSM(self.G_hist[counter][1], self.a_shares_l[counter], self.source, self.party_id)
|
|
|
+ L_hl_br_share = MSM(self.H_hist[counter][0], self.b_shares_r[counter], self.source, self.party_id)
|
|
|
+ L_q_cl_share = MSM(self.Q, self.c_l[counter], self.source, self.party_id)
|
|
|
+ L_shares = [L_gr_al_share, L_hl_br_share, L_q_cl_share]
|
|
|
+
|
|
|
+ # R_prime
|
|
|
+ R_gl_ar_share = MSM(self.G_hist[counter][0], a_shares_r, self.source, self.party_id)
|
|
|
+ R_hr_bl_share = MSM(self.H_hist[counter][1], b_shares_l, self.source, self.party_id)
|
|
|
+ R_q_cr_share = MSM(Q, self.c_r[counter], self.source, self.party_id)
|
|
|
+ R_shares = [R_gl_ar_share, R_hr_bl_share, R_q_cr_share]
|
|
|
+
|
|
|
+ L_l += [L_shares]
|
|
|
+ R_l += [R_shares]
|
|
|
+
|
|
|
+ counter +=1
|
|
|
+ #
|
|
|
+ self.lhs = L_l
|
|
|
+ self.rhs = R_l
|
|
|
+
|
|
|
+ def challenges(self, n, verifier):
|
|
|
+ challenges = []
|
|
|
+ challenges_inv = []
|
|
|
+ lg_n = len(self.lhs)
|
|
|
+ for L, R in zip(self.lhs, self.rhs):
|
|
|
+ #verifier.append_message(b'L', bytes(''.join([l.__str__() for l in [L]]), encoding='utf-8'))
|
|
|
+ #verifier.append_message(b'R', bytes(''.join([r.__str__() for r in [R]]), encoding='utf-8'))
|
|
|
+ #u = K(verifier.challenge_bytes(b'u'))
|
|
|
+ u = K(1)
|
|
|
+ u_inv = 1/u
|
|
|
+ challenges += [u]
|
|
|
+ challenges_inv += [u_inv]
|
|
|
+ inv_prod = K(1)
|
|
|
+ for u_inv in challenges_inv:
|
|
|
+ inv_prod *=K(1)
|
|
|
+ challenges_sq = [i*i for i in challenges]
|
|
|
+ challenges_inv_sq = [i*i for i in challenges_inv]
|
|
|
+ mul_inv = K(1)
|
|
|
+ for i in challenges_inv:
|
|
|
+ mul_inv *=i
|
|
|
+ S = [mul_inv]
|
|
|
+ for i in range(1,n):
|
|
|
+ lg_i = 32 - 1 - countZeros(i)
|
|
|
+ k = 1 << lg_i
|
|
|
+ u_lg_i_sq = challenges_sq[(lg_n -1) - lg_i]
|
|
|
+ S += [S[i-k] * u_lg_i_sq]
|
|
|
+ return challenges_sq, challenges_inv_sq, S
|
|
|
+
|
|
|
+ def calculate_c_shares(self, n, verifier, G_factors, H_factors):
|
|
|
+ self.u_sq, self.u_inv_sq, self.s = self.challenges(n, verifier)
|
|
|
+ self.gas_shares = [self.a_shares.mul_scalar(s_i * g_i) for g_i, s_i in zip(G_factors, self.s)][:n]
|
|
|
+ # inverse of count is reverse
|
|
|
+ self.inv_s = reversed(self.s)
|
|
|
+ self.hbs_shares = [self.b_shares.mul_scalar(s_i_inv * h_i) for h_i, s_i_inv in zip(H_factors, self.inv_s)]
|
|
|
+ #TODO (fix) this should be shares, this is fake shares!
|
|
|
+ self.neg_u_sq = [i*K(-1) for i in self.u_sq]
|
|
|
+ self.neg_u_inv_sq = [i*K(-1) for i in self.u_inv_sq]
|
|
|
+ # P
|
|
|
+ ## u^c
|
|
|
+ self.my_c_shares = [MultiplicationAuthenticatedShares(a_share, b_share, self.source.triplet(self.party_id), self.party_id) for a_share, b_share in zip([self.a_shares], [self.b_shares])]
|
|
|
+
|
|
|
+ def open_lr(self, Q, G, H, their_c_shares_de, peer_lhs, peer_rhs):
|
|
|
+ c_shares = [my_c_share.mul(their_c_shares_de[i][0], their_c_shares_de[i][1]) for i, my_c_share in enumerate(self.my_c_shares)]
|
|
|
+
|
|
|
+ self.res_p_1 = MSM(Q, c_shares, self.source, self.party_id)
|
|
|
+ ## g^{g_factor_a_s}
|
|
|
+ self.res_p_2 = MSM(G, self.gas_shares, self.source, self.party_id)
|
|
|
+ ## h^{h_factor_b_s}
|
|
|
+ self.res_p_3 = MSM(H, self.hbs_shares, self.source, self.party_id)
|
|
|
+ ## L
|
|
|
+ for my_lhs, their_lhs in zip(self.lhs, peer_lhs):
|
|
|
+ L_triad = []
|
|
|
+ for my_lhs_i, their_lhs_i in zip(my_lhs, their_lhs):
|
|
|
+ my_lhs_i_de = [[ps.d, ps.e] for ps in my_lhs_i.point_scalars]
|
|
|
+ #print("lhs point scalars: {}".format(their_lhs_i.point_scalars))
|
|
|
+ their_lhs_i_de = [[ps.d, ps.e] for ps in their_lhs_i.point_scalars]
|
|
|
+ #my_lhs_i_share = my_lhs_i.msm(their_lhs_i_de)
|
|
|
+ #their_rhs_i_share = their_lhs_i.msm(my_lhs_i_de)
|
|
|
+ #L_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
|
+ #L_triad += [lhs_i]
|
|
|
+ lhs_i_share = my_lhs_i.msm(their_lhs_i_de)
|
|
|
+ #L_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
|
+ L_triad += [lhs_i_share]
|
|
|
+ #L += [sum_shares(L_triad, self.source, self.party_id)]
|
|
|
+ self.L += [sum_shares(L_triad, self.source, self.party_id)]
|
|
|
+ ## R
|
|
|
+ for my_rhs, their_rhs in zip(self.rhs, peer_rhs):
|
|
|
+ R_triad = []
|
|
|
+ for my_rhs_i, their_rhs_i in zip(my_rhs, their_rhs):
|
|
|
+ my_rhs_i_de = [[ps.d, ps.e] for ps in my_rhs_i.point_scalars]
|
|
|
+ their_rhs_i_de = [[ps.d, ps.e] for ps in their_rhs_i.point_scalars]
|
|
|
+ #my_rhs_i_share = my_rhs_i.msm(their_rhs_i_de)
|
|
|
+ #their_rhs_i_share = their_rhs_i.msm(my_rhs_i_de)
|
|
|
+ #R_triad += [ECAuthenticatedShare(my_lhs_i_share.authenticated_open(their_rhs_i_share))]
|
|
|
+ rhs_i_share = my_rhs_i.msm(their_rhs_i_de)
|
|
|
+ R_triad += [rhs_i_share]
|
|
|
+ #R_triad += [rhs_i]
|
|
|
+ #R += [sum_shares(R_triad, self.source, self.party_id)]
|
|
|
+ self.R += [sum_shares(R_triad, self.source, self.party_id)]
|
|
|
+ # L^(u^2)
|
|
|
+ #temp = K(random.randint(0,p))
|
|
|
+ temp = K(0)
|
|
|
+ self.res_p_4 = MSM(self.L, [AuthenticatedShare(temp, self.source, self.party_id) if self.party_id==0 else AuthenticatedShare(neg_u_sq_i-temp, self.source, self.party_id) for neg_u_sq_i in self.neg_u_sq], self.source, self.party_id)
|
|
|
+ # R^(u^-2)
|
|
|
+ self.res_p_5 = MSM(self.R, [AuthenticatedShare(temp, self.source, self.party_id) if self.party_id==0 else AuthenticatedShare(neg_u_inv_sq_i-temp, self.source, self.party_id) for neg_u_inv_sq_i in self.neg_u_inv_sq], self.source, self.party_id)
|
|
|
+ # P prime = L^{u^2} * P * R^{u^{-1}}
|
|
|
+ self.res_p = [self.res_p_1, self.res_p_2, self.res_p_3, self.res_p_4, self.res_p_5]
|
|
|
+
|
|
|
+ def open_and_validate_P(self, res_p, P):
|
|
|
+ P_msm_parts = []
|
|
|
+ for my_res_p, their_res_p in zip(self.res_p, res_p):
|
|
|
+ my_res_de = [[ps.d, ps.e] for ps in my_res_p.point_scalars]
|
|
|
+ their_res_de = [[ps.d, ps.e] for ps in their_res_p.point_scalars]
|
|
|
+ lhs = my_res_p.msm(their_res_de)
|
|
|
+ rhs = their_res_p.msm(my_res_de)
|
|
|
+ p_part = lhs.authenticated_open(rhs)
|
|
|
+ print('p_part: {}'.format(p_part))
|
|
|
+ P_msm_parts += [p_part]
|
|
|
+
|
|
|
+ # P prime == H(u^{-1} * a_prime_r, u * a_prime_l, u * b_prime_r, u ^ {-1} * b_prime_l, c_prime)
|
|
|
+ my_P = sum(P_msm_parts)
|
|
|
+ assert (my_P == P), 'P: {}, expected: {}'.format(my_P, P)
|
ertosns