def aggregate_verify(pks, msgs, sig, ciphersuite):
assert len(pks) == len(
msgs), "FAIL: aggregate_verify needs same number of sigs and msgs"
if not subgroup_check_g2(sig):
return False
Qs = [None] * (1 + len(msgs))
for (idx, (msg, pk)) in enumerate(zip(msgs, pks)):
if not subgroup_check_g1(pk):
return False
Qs[idx] = map2curve_osswu2(msg, ciphersuite)
Qs[-1] = sig
Ps = chain(pks, (point_neg(g1gen), ))
return multi_pairing(Ps, Qs) == 1
def pop_verify(pk, proof, ciphersuite):
pk_bytes = serialize(pk, True) # serialize in compressed form
P = map2curve_osswu2(pk_bytes, ciphersuite)
if not (subgroup_check_g1(pk) and subgroup_check_g2(proof)):
return False
return multi_pairing((pk, point_neg(g1gen)), (P, proof)) == 1
def pop_prove(x_prime, pk, ciphersuite):
pk_bytes = serialize(pk, True) # serialize in compressed form
P = map2curve_osswu2(pk_bytes, ciphersuite)
return point_mul(x_prime, P)
def verify(pk, sig, msg, ciphersuite):
P = map2curve_osswu2(msg, ciphersuite)
return multi_pairing((pk, point_neg(g1gen)), (P, sig)) == 1
def sign(x_prime, msg, ciphersuite):
P = map2curve_osswu2(msg, ciphersuite)
return point_mul(x_prime, P)
def pop_verify(pk, proof, ciphersuite):
pk_bytes = serialize(pk, True) # serialize in compressed form
P = map2curve_osswu2(pk_bytes, ciphersuite)
pk_ok = subgroup_check_g1(pk)
proof_ok = multi_pairing((pk, point_neg(g1gen)), (P, proof)) == 1
return pk_ok and proof_ok
def verify(pk, sig, msg, ciphersuite):
P = map2curve_osswu2(msg, ciphersuite)
if not (subgroup_check_g1(pk) and subgroup_check_g2(sig)):
return False
return multi_pairing((pk, point_neg(g1gen)), (P, sig)) == 1
d = 32
# extract the secret m
m = hkdf.hkdf_extract(salt=DOM_SEP_PARAM_GEN,
input_key_material=seed,
hash=hashlib.sha512)
# generate h using hash_to_group
info = bytes("H2G_h", "ascii")
# expand the secret
key = hkdf.hkdf_expand(pseudo_random_key=m,
info=info,
length=32,
hash=hashlib.sha512)
# hash to G2
h = map2curve_osswu2(key, ciphersuite)
# generate hlistusing hash_to_group
hlist = []
for i in range(d + 1):
info = b"H2G_h" + I2OSP(i, 1)
# expand the secret
key = hkdf.hkdf_expand(pseudo_random_key=m,
info=info,
length=32,
hash=hashlib.sha512)
# hash to G2
hi = map2curve_osswu2(key, ciphersuite)
hlist.append(hi)
default_param = (g1gen, h, hlist)