proofofshuffleofcommitments.cpp

Go to the documentation of this file.

#include "proofofshuffleofcommitments.hpp"



using namespace proofs;


ProofOfShuffleOfCommitments::ProofOfShuffleOfCommitments(
        bool &readingWasOK,
        XmlConfig * config,
        std::vector<uint8_t> prefix,
        unsigned int nZero,
        arithm::ArrayOfElmts pedersen,
        verifierUtils::ByteTree * commitmentFSproof,
        verifierUtils::ByteTree * replyFSproof) :
        Verification(config,prefix,nZero)
{
        readingWasOK = true;
        
        u = pedersen;
        if (u.size() != n0)
        {
                std::cout<<"ERROR: in ProofOfShuffleOfCommitments:"
                         <<"u is not of the correct size."
                         <<"u->getSize()="<<u.size()
                         <<"n0="<<n0<<std::endl;
                readingWasOK = false;;
        }
        
        tau = commitmentFSproof;
        if ((tau->size()<5) || (!tau->isNode()))
        {
                std::cout<<"ERROR: in ProofOfShuffleOfCommitments:"
                         <<"tau is not valid.\ntau="<<std::endl;
                tau->prettyPrint("");
                std::cout<<std::endl;
                readingWasOK = false;
        }
        
        sigma = replyFSproof;
        if ((sigma->size()<5) || (!sigma->isNode())
            || (!sigma->getChild(0)->isLeaf())
            || (!sigma->getChild(1)->isNode()) || (sigma->getChild(1)->size() != n0)
            || (!sigma->getChild(2)->isLeaf())
            || (!sigma->getChild(3)->isLeaf())
            || (!sigma->getChild(4)->isNode()) || (sigma->getChild(4)->size() != n0)
                )
        {
                std::cout<<"ERROR: in ProofOfShuffleOfCommitments:"
                         <<"sigma is not valid.\nsigma="<<std::endl;
                sigma->prettyPrint("");
                std::cout<<std::endl;
                readingWasOK = false;;
        }
}


bool ProofOfShuffleOfCommitments::isEverythingOK()
{
        // 1-a Initializing the G_q elements from tau
        arithm::Elmt
                Aprime = gq->getElmt(tau->getChild(1)),
                Cprime = gq->getElmt(tau->getChild(3)),
                Dprime = gq->getElmt(tau->getChild(4));
        arithm::ArrayOfElmts
                B      = gq->getArray(tau->getChild(0)),
                Bprime = gq->getArray(tau->getChild(2));


        // 1-b Initializing the elements of zq from sigma
        arithm::Elmt
                kA = zq->getElmt(sigma->getChild(0)),
                kC = zq->getElmt(sigma->getChild(2)),
                kD = zq->getElmt(sigma->getChild(3));
        arithm::ArrayOfElmts
                kB = zq->getArray(sigma->getChild(1)),
                kE = zq->getArray(sigma->getChild(4));


        // 2- computing a seed
        std::vector<uint8_t> s;
        verifierUtils::ByteTree * bts = new verifierUtils::Node();
        bts->addChild(gq->getGenerator().toByteTree());
        bts->addChild(h.toByteTree());
        bts->addChild(u.toByteTree());
        arithm::ArrayOfElmts e = randomExponents(bts,s);
        

        // 3- computing A
        arithm::Elmt A = gq->expProduct(u,e);


        // 4- computing a challenge
        arithm::Elmt v = getChallenge(s);

        
        // 5- Compute C and D
        arithm::Elmt
                C = gq->multiplication(
                        gq->product(u),
                        gq->multInverse(gq->product(h))
                        ),
                D = gq->multiplication(
                        B.getElmt(n0-1),
                        gq->multInverse(
                                gq->exponentiation(
                                        h.getElmt(0),
                                        zq->product(e)))
                        );

        // First verification (on A and the likes)
        arithm::Elmt
                lhs = gq->multiplication(
                        gq->exponentiation(A,v),
                        Aprime
                        ),
                rhs = gq->multiplication(
                        gq->exponentiation(gq->getGenerator(),kA),
                        gq->expProduct(h,kE)
                        );
        if (! gq->compare(lhs,rhs) )
        {
                std::cout<<"In ProofOfShuffleOfCommitments, $A^vA'$ "
                         <<"does not equal $h_0\\prod_{i=1}^{N_0-1}"
                         <<"h_i^{k_{E,i}}$."<<std::endl;
                return false;
        }


        // Second verification (on B and the likes)
        for (unsigned int i=0; i<n0; i++)
        {
                rhs = gq->multiplication(
                        gq->exponentiation(B.getElmt(i),v),
                        Bprime.getElmt(i)
                        );
                arithm::Elmt BMinusOne = (i==0) ?
                        h.getElmt(0) : B.getElmt(i-1);
                lhs = gq->multiplication(
                                gq->exponentiation(
                                        gq->getGenerator(),
                                        kB.getElmt(i)
                                        ),
                                gq->exponentiation(
                                        BMinusOne,
                                        kE.getElmt(i)
                                        )
                        );
                if (! gq->compare(lhs, rhs) )
                {
                        std::cout<<"In ProofOfShuffleOfCommitments, $B_"<<i
                                 <<"^vB_"<<i<<"'$ does not equal $g^{k_{B,"<<i
                                 <<"}}B_{"<<i<<"-1}^"<<"{k_{E,"<<i<<"}}$."
                                 <<std::endl;
                        return false;
                }
        }
        
        // Third verification (on C and the likes)
        lhs = gq->multiplication(
                gq->exponentiation(C,v),
                Cprime
                );
        rhs = gq->exponentiation(
                gq->getGenerator(),
                kC);
        if (! gq->compare(lhs, rhs) )
        {
                std::cout<<"In ProofOfShuffleOfCommitments, $C^vC'$ "
                         <<"does not equal $g^{k_C}$" <<std::endl;
                return false;
        }
        
        // Fourth verification (on D and the likes)
        lhs = gq->multiplication(
                gq->exponentiation(D,v),
                Dprime
                );
        rhs = gq->exponentiation(
                gq->getGenerator(),
                kD);
        if (! gq->compare(lhs, rhs) )
        {
                std::cout<<"In ProofOfShuffleOfCommitments, $D^vD'$ "
                         <<"does not equal $g^{k_D}$" <<std::endl;
                return false;
        }
        
        // if this point is reached, then the proof is valid
        return true;
}