def verify_inner_product_one_known(comm, iprod, b_vec, proof, crs=None):
def recursive_verify(g_vec, b_vec, u, proof, n, P, transcript):
if n == 1:
a, b = proof[0][0], b_vec[0]
return P == g_vec[0]**a * u**(a * b)
if n % 2 == 1:
[na, L, R] = proof[-1]
P *= g_vec[-1]**(na) * u**(na * b_vec[-1])
else:
[L, R] = proof[-1]
#transcript += pickle.dumps([g_vec, u, P, L, R])
transcript += pickle.dumps(hashg1list(g_vec + [u, P, L, R]))
x = ZR.hash(transcript)
xi = x**-1
n_p = n // 2
g_vec_p = []
b_vec_p = []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i]**xi * g_vec[n_p:][i]**x)
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
P_p = L**(x * x) * P * R**(xi * xi)
return recursive_verify(g_vec_p, b_vec_p, u, proof[:-1], n_p, P_p,
transcript)
n = proof[0]
iproof = proof[1:]
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, u] = crs
g_vec = g_vec[:n]
P = comm * u**iprod
transcript = b""
return recursive_verify(g_vec, b_vec, u, iproof, n, P, transcript)
def set_up_params(self, n, P, crs=None):
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
h_vec = G1.hash_many(b"honeybadgerh", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, h_vec, u] = crs
return (g_vec, h_vec, u, n, P)
def __init__(self, crs=None, degree_max=33):
if crs is None:
n = degree_max + 1
self.gs = G1.hash_many(b"honeybadgerg", n)
self.h = G1.hash(b"honeybadgerh")
self.u = G1.hash(b"honeybadgeru")
else:
assert len(crs) == 3
[self.gs, self.h, self.u] = crs
self.y_vecs = []
def double_batch_create_witness(self, phis, r, n=None):
t = len(phis[0].coeffs) - 1
numpolys = len(phis)
if n is None:
n = 3 * t + 1
numverifiers = n
if len(self.y_vecs) < numverifiers:
i = len(self.y_vecs)
while i < numverifiers:
self.y_vecs.append([ZR(i + 1)**j for j in range(t + 1)])
i += 1
# length t
s_vec = [ZR.random() for _ in range(t + 1)]
sy_prods = [ZR(0) for _ in range(numverifiers)]
S = G1.identity()
T_vec = [None] * numverifiers
witnesses = [[] for _ in range(numverifiers)]
for i in range(t + 1):
S *= self.gs[i].pow(s_vec[i])
for j in range(numverifiers):
for i in range(t + 1):
sy_prods[j] += s_vec[i] * self.y_vecs[j][i]
T_vec[j] = self.gs[0].pow(sy_prods[j])
rho = ZR.random()
S *= self.h**rho
# Fiat Shamir
tree = MerkleTree()
for j in range(numverifiers):
tree.append(pickle.dumps(T_vec[j]))
roothash = tree.get_root_hash()
for j in range(numverifiers):
branch = tree.get_branch(j)
witnesses[j].append(roothash)
witnesses[j].append(branch)
challenge = ZR.hash(
pickle.dumps([roothash, self.gs, self.h, self.u, S]))
d_vecs = []
for i in range(len(phis)):
d_vecs.append([
phis[i].coeffs[j] + s_vec[j] * challenge for j in range(t + 1)
])
Ds = [G1.identity() for _ in range(len(phis))]
_ = [[
Ds[i].__imul__(self.gs[j].pow(d_vecs[i][j])) for j in range(t + 1)
] for i in range(len(phis))]
mu = r + rho * challenge
comms, t_hats, iproofs = prove_double_batch_inner_product_one_known_but_differenter(
d_vecs, self.y_vecs, crs=[self.gs, self.u])
for j in range(numverifiers):
witnesses[j] += [t, S, T_vec[j], Ds, mu, t_hats[j], iproofs[j]]
return witnesses
def commit(self, phi, aux=None):
c = G1.identity()
i = 0
for item in self.gs:
c *= item**phi.coeffs[i]
i += 1
# c should equal g **(phi(alpha))
return c
def create_witness(self, phi, i):
poly = polynomials_over(self.field)
div = poly([-1 * i, 1])
psi = (phi - poly([phi(i)])) / div
witness = G1.identity()
j = 0
for item in self.gs[:-1]:
witness *= item**psi.coeffs[j]
j += 1
return witness
def recursive_proof(g_vec, h_vec, u, a_vec, b_vec, n, P, transcript):
if n == 1:
proof = []
proof.append([a_vec[0], b_vec[0]])
return proof
proofstep = []
if n % 2 == 1:
na, nb = a_vec[-1] * -1, b_vec[-1] * -1
P *= g_vec[-1]**(na) * h_vec[-1]**(nb) * u**(-na * nb)
proofstep.append(na)
proofstep.append(nb)
n_p = n // 2
cl = ZR(0)
cr = ZR(0)
L = G1.identity()
R = G1.identity()
for i in range(n_p):
cl += a_vec[:n_p][i] * b_vec[n_p:][i]
cr += a_vec[n_p:][i] * b_vec[:n_p][i]
L *= g_vec[n_p:][i]**a_vec[:n_p][i] * h_vec[:n_p][i]**b_vec[n_p:][i]
R *= g_vec[:n_p][i]**a_vec[n_p:][i] * h_vec[n_p:][i]**b_vec[:n_p][i]
L *= u**cl
R *= u**cr
# Fiat Shamir L, R, state...
#transcript += pickle.dumps([g_vec, h_vec, u, P, L, R])
transcript += pickle.dumps(hashg1list(g_vec + h_vec + [u, P, L, R]))
x = ZR.hash(transcript)
xi = x**-1
# this part must come after the challenge is generated, which must
# come after L and R are calculated. Don't try to condense the loops
g_vec_p, h_vec_p, a_vec_p, b_vec_p = [], [], [], []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i]**xi * g_vec[n_p:][i]**x)
h_vec_p.append(h_vec[:n_p][i]**x * h_vec[n_p:][i]**xi)
a_vec_p.append(a_vec[:n_p][i] * x + a_vec[n_p:][i] * xi)
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
P_p = L**(x * x) * P * R**(xi * xi)
proof = recursive_proof(g_vec_p, h_vec_p, u, a_vec_p, b_vec_p, n_p,
P_p, transcript)
proofstep.append(L)
proofstep.append(R)
proof.append(proofstep)
return proof
def batch_create_witness(self, phi, r, n=None):
t = len(phi.coeffs) - 1
if n is None:
n = 3 * t + 1
if len(self.y_vecs) < n:
i = len(self.y_vecs)
while i < n:
self.y_vecs.append([ZR(i + 1)**j for j in range(t + 1)])
i += 1
s_vec = [ZR.random() for _ in range(t + 1)]
sy_prods = [ZR(0) for _ in range(n)]
S = G1.identity()
T_vec = [None] * n
witnesses = [[] for _ in range(n)]
for i in range(t + 1):
S *= self.gs[i]**s_vec[i]
for j in range(n):
for i in range(t + 1):
sy_prods[j] += s_vec[i] * self.y_vecs[j][i]
T_vec[j] = self.gs[0]**sy_prods[j]
rho = ZR.random()
S *= self.h**rho
# Fiat Shamir
tree = MerkleTree()
for j in range(n):
tree.append(pickle.dumps(T_vec[j]))
roothash = tree.get_root_hash()
for j in range(n):
branch = tree.get_branch(j)
witnesses[j].append(roothash)
witnesses[j].append(branch)
challenge = ZR.hash(
pickle.dumps([roothash, self.gs, self.h, self.u, S]))
d_vec = [phi.coeffs[j] + s_vec[j] * challenge for j in range(t + 1)]
D = G1.identity()
for j in range(t + 1):
D *= self.gs[j]**d_vec[j]
mu = r + rho * challenge
comm, t_hats, iproofs = prove_batch_inner_product_one_known(
d_vec, self.y_vecs, crs=[self.gs, self.u])
for j in range(len(witnesses)):
witnesses[j] += [S, T_vec[j], D, mu, t_hats[j], iproofs[j]]
return witnesses
def test_merkle_tree():
import pickle
leaves = [b"Cravings", b"is", b"best", b"restaurant"]
t = MerkleTree(leaves)
rh = t.get_root_hash()
br = t.get_branch(0)
assert MerkleTree.verify_membership(b"Cravings", br, rh)
assert not MerkleTree.verify_membership(b"Chipotle", br, rh)
t2 = MerkleTree()
vec = [pickle.dumps(G1.rand()) for _ in range(12)]
t2.append(vec[0])
t2.append_many(vec[1:])
rh2 = t2.get_root_hash()
br2 = t2.get_branch(7)
assert MerkleTree.verify_membership(vec[7], br2, rh2)
# If this fails, buy a lottery ticket... or check that G1.rand() is actually random
assert not MerkleTree.verify_membership(pickle.dumps(G1.rand()), br2, rh2)
assert not MerkleTree.verify_membership(vec[6], br2, rh)
async def recursive_prove(self, g_vec, h_vec, u, a_vec, b_vec, n, P):
if n == 1:
await self.send_queue.put([a_vec[0], b_vec[0]])
return
proofStep = []
if n % 2 == 1:
na, nb = a_vec[-1] * -1, b_vec[-1] * -1
P *= g_vec[-1]**(na) * h_vec[-1]**(nb) * u**(-na * nb)
proofStep.append(na)
proofStep.append(nb)
n_p = n // 2
cl = ZR(0)
cr = ZR(0)
L = G1.identity()
R = G1.identity()
for i in range(n_p):
cl += a_vec[:n_p][i] * b_vec[n_p:][i]
cr += a_vec[n_p:][i] * b_vec[:n_p][i]
L *= g_vec[n_p:][i]**a_vec[:n_p][i] * h_vec[:n_p][i]**b_vec[n_p:][i]
R *= g_vec[:n_p][i]**a_vec[n_p:][i] * h_vec[n_p:][i]**b_vec[:n_p][i]
L *= u**cl
R *= u**cr
proofStep.append(L)
proofStep.append(R)
await self.send_queue.put(proofStep)
x = await self.receive_queue.get()
xi = x**-1
g_vec_p, h_vec_p, a_vec_p, b_vec_p = [], [], [], []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i]**xi * g_vec[n_p:][i]**x)
h_vec_p.append(h_vec[:n_p][i]**x * h_vec[n_p:][i]**xi)
a_vec_p.append(a_vec[:n_p][i] * x + a_vec[n_p:][i] * xi)
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
P_p = L**(x * x) * P * R**(xi * xi)
await self.recursive_prove(g_vec_p, h_vec_p, u, a_vec_p, b_vec_p, n_p,
P_p)
return
def test_pc_log(t):
pc = PolyCommitLog()
phi = polynomials_over(ZR).random(t)
# ToDo: see if other polycommits return the commit randomness
# rather than expecting it as arg
r = ZR.random()
c = pc.commit(phi, r)
witness = pc.create_witness(phi, r, 3)
assert pc.verify_eval(c, 3, phi(3), witness)
assert not pc.verify_eval(c, 4, phi(3), witness)
assert not pc.verify_eval(G1.rand(), 3, phi(3), witness)
def test_batch_inner_product_proof_one_known():
n = 13
a = [ZR.random() for i in range(n)]
bs = [[ZR.random() for j in range(n)] for i in range(3 * n)]
comm, iprods, proofs = prove_batch_inner_product_one_known(a, bs)
assert verify_batch_inner_product_one_known(comm, iprods[2], bs[2],
proofs[2])
comm, iprods, badproofs = prove_batch_inner_product_one_known(
a, bs, comm=G1.rand())
assert not verify_batch_inner_product_one_known(comm, iprods[2], bs[2],
badproofs[2])
def create_witness(self, phi, i):
if self.evaltree is None:
self.evaltree = gen_multipoint_eval_tree(phi, self.acctree)
if self.comevaltree is None:
self.comevaltree = commit_eval_tree(self.evaltree, self.g1s)
branch = get_tree_branch(self.comevaltree,
bit_reverse(i, ceil(log(self.n, 2))))
#if n is bigger than the length of the polynomial, the witness will end up having unneeded elements
while branch[-1] == G1.identity():
branch = branch[:-1]
return branch
def test_inner_product_proof_one_known():
n = 15
a = [ZR.random() for i in range(n)]
b = [ZR.random() for i in range(n)]
iprod = ZR(0)
for i in range(n):
iprod += a[i] * b[i]
comm, iprod, proof = prove_inner_product_one_known(a, b)
assert verify_inner_product_one_known(comm, iprod, b, proof)
comm, iprod, badproof = prove_inner_product_one_known(a, b, comm=G1.rand())
assert not verify_inner_product_one_known(comm, iprod, b, badproof)
def commit_eval_tree(evaltree, g1s):
numlevels = len(evaltree)
committree = [2**i * [None] for i in reversed(range(numlevels))]
for k in range(len(evaltree)):
for i in range(len(evaltree[k])):
qpoly = evaltree[k][i][0]
c = G1.identity()
#this is a multiexponentiation
for j in range(len(qpoly.coeffs)):
c *= g1s[j]**qpoly.coeffs[j]
committree[k][i] = c
return committree
def verify_eval(self, c, i, phi_at_omega_i, witness):
valcom = self.g1s[0]**phi_at_omega_i
valcom.negate()
lhs = pair(c * valcom, self.g2s[0])
rhs = pair(G1.identity(), G2.identity())
acc_branch = get_tree_branch(self.comacctree,
bit_reverse(i, ceil(log(self.n, 2))))
#if witness is shorter (due to more than degree + 1 recipients), it will only
#check as many entries as are in witness, which is what we want
for items in zip(witness, acc_branch):
rhs = rhs * pair(items[0], items[1])
return lhs == rhs
def test_inner_product_proof():
n = 10
a = [ZR.random() for i in range(n)]
b = [ZR.random() for i in range(n)]
iprod = ZR(0)
for i in range(n):
iprod += a[i] * b[i]
comm, iprod, proof = prove_inner_product(a, b)
assert verify_inner_product(comm, iprod, proof)
comm, iprod, proof2 = prove_inner_product(a, b, comm=comm)
assert verify_inner_product(comm, iprod, proof2)
comm, iprod, badproof = prove_inner_product(a, b, comm=G1.rand())
assert not verify_inner_product(comm, iprod, badproof)
def set_up_params(self, a_vec, b_vec, comm=None, crs=None):
n = len(a_vec)
assert len(b_vec) == n
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
h_vec = G1.hash_many(b"honeybadgerh", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, h_vec, u] = crs
g_vec = g_vec[:n]
h_vec = h_vec[:n]
if comm is not None:
P = comm * G1.identity()
else:
comm = G1.identity()
for i in range(n):
comm *= g_vec[i]**a_vec[i] * h_vec[i]**b_vec[i]
iprod = ZR(0)
for i in range(n):
iprod += a_vec[i] * b_vec[i]
P = comm * u**iprod
return (comm, iprod, g_vec, h_vec, u, a_vec, b_vec, n, P)
def create_witness(self, phi, r, i):
t = len(phi.coeffs) - 1
y_vec = [ZR(i)**j for j in range(t + 1)]
s_vec = [ZR.random() for _ in range(t + 1)]
sy_prod = ZR(0)
S = G1.identity()
for j in range(t + 1):
S *= self.gs[j]**s_vec[j]
sy_prod += s_vec[j] * y_vec[j]
T = self.gs[0]**sy_prod
rho = ZR.random()
S *= self.h**rho
# Fiat Shamir
challenge = ZR.hash(pickle.dumps([self.gs, self.h, self.u, S, T]))
d_vec = [phi.coeffs[j] + s_vec[j] * challenge for j in range(t + 1)]
D = G1.identity()
for j in range(t + 1):
D *= self.gs[j]**d_vec[j]
mu = r + rho * challenge
comm, t_hat, iproof = prove_inner_product_one_known(
d_vec, y_vec, crs=[self.gs, self.u])
return [S, T, D, mu, t_hat, iproof]
def gen_crs(degree_max=32, alpha=None):
if alpha is None:
alpha = ZR.rand()
g1g = G1.hash(b"honeybadgerg1g")
g2g = G2.hash(b"honeybadgerg2g")
exp = ZR(1)
g1s = [g1g]
g2s = [g2g]
for i in range(degree_max):
exp *= alpha
g1s.append(g1g**exp)
g2s.append(g2g**exp)
return [g1s, g2s]
def batch_create_witness(self, phi):
if self.evaltree is None:
self.evaltree = gen_multipoint_eval_tree(phi, self.acctree)
if self.comevaltree is None:
self.comevaltree = commit_eval_tree(self.evaltree, self.g1s)
branches = [
get_tree_branch(self.comevaltree,
bit_reverse(i, ceil(log(self.n, 2))))
for i in range(self.n)
]
for i in range(len(branches)):
while branches[i][-1] == G1.identity():
branches[i] = branches[i][:-1]
return branches
def verify_batch_inner_product_one_known(comm, iprod, b_vec, proof, crs=None):
def recursive_verify(g_vec, b_vec, u, proof, n, P, transcript):
if n == 1:
a, b = proof[0][0], b_vec[0]
return P == g_vec[0]**a * u.pow(a * b)
if n % 2 == 1:
[na, roothash, branch, L, R] = proof[-1]
P *= g_vec[-1]**(na) * u.pow(na * b_vec[-1])
else:
[roothash, branch, L, R] = proof[-1]
leaf = hash_list_to_bytes([hashzrlist(b_vec), hashg1list([P, L, R])])
if not MerkleTree.verify_membership(leaf, branch, roothash):
return False
transcript += pickle.dumps([hashg1list(g_vec), roothash])
x = ZR.hash(transcript)
xi = x**-1
n_p = n // 2
g_vec_p = []
b_vec_p = []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i].pow(xi) * g_vec[n_p:][i].pow(x))
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
P_p = L**(x * x) * P * R**(xi * xi)
return recursive_verify(g_vec_p, b_vec_p, u, proof[:-1], n_p, P_p,
transcript)
n = proof[0]
iproof = proof[1:]
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, u] = crs
g_vec = g_vec[:n]
P = comm * u.pow(iprod)
transcript = pickle.dumps(u)
return recursive_verify(g_vec, b_vec, u, iproof, n, P, transcript)
def test_inner_product_interactive_proof():
loop = asyncio.get_event_loop()
pr_queue = asyncio.Queue(loop=loop)
vr_queue = asyncio.Queue(loop=loop)
prover = inner_product_prover(vr_queue, pr_queue)
verifier = inner_product_verifier(pr_queue, vr_queue)
n = 10
a = [ZR.random() for i in range(n)]
b = [ZR.random() for i in range(n)]
iprod = ZR(0)
for i in range(n):
iprod += a[i] * b[i]
(comm1, iprod1, g_vec1, h_vec1, u1, a_vec1, b_vec1, n1,
P1) = prover.set_up_params(a, b)
(g_vec2, h_vec2, u2, n2, P2) = verifier.set_up_params(n1, P1)
prover_coro = prover.recursive_prove(g_vec1, h_vec1, u1, a_vec1, b_vec1,
n1, P1)
verifier_coro = verifier.recursive_verify(g_vec2, h_vec2, u2, n2, P2)
_, ret = loop.run_until_complete(asyncio.gather(prover_coro,
verifier_coro))
assert ret == True
(_, _, g_vec1, h_vec1, u1, a_vec1, b_vec1, n1,
P1) = prover.set_up_params(a, b, comm=comm1)
(g_vec2, h_vec2, u2, n2, P2) = verifier.set_up_params(n1, P1)
prover_coro = prover.recursive_prove(g_vec1, h_vec1, u1, a_vec1, b_vec1,
n1, P1)
verifier_coro = verifier.recursive_verify(g_vec2, h_vec2, u2, n2, P2)
_, ret = loop.run_until_complete(asyncio.gather(prover_coro,
verifier_coro))
assert ret == True
(comm1, iprod1, g_vec1, h_vec1, u1, a_vec1, b_vec1, n1,
P1) = prover.set_up_params(a, b, comm=G1.rand())
(g_vec2, h_vec2, u2, n2, P2) = verifier.set_up_params(n1, P1)
prover_coro = prover.recursive_prove(g_vec1, h_vec1, u1, a_vec1, b_vec1,
n1, P1)
verifier_coro = verifier.recursive_verify(g_vec2, h_vec2, u2, n2, P2)
_, ret = loop.run_until_complete(asyncio.gather(prover_coro,
verifier_coro))
assert ret == False
loop.close()
def interpolate_g1_at_x(coords, x, order=-1):
if isinstance(coords[0][1], SimulatedPclProof):
out = SimulatedPclProof(1)
return out
elif isinstance(coords[0][1], SimulatedPclCom):
out = SimulatedPclCom()
return out
if order == -1:
order = len(coords)
xs = []
sortedcoords = sorted(coords, key=lambda x: x[0])
for coord in sortedcoords:
xs.append(coord[0])
s = set(xs[0:order])
out = G1.identity()
for i in range(order):
out *= (sortedcoords[i][1]**(lagrange_at_x(s, xs[i], x)))
return out
def gen_pc_const_dl_crs(t, alpha=None, g=None, ghat=None, ZR=ZR, G1=G1, G2=G2):
nonetype = type(None)
assert type(t) is int
assert type(alpha) in (ZR, int, nonetype)
assert type(g) in (G1, nonetype)
assert type(ghat) in (G2, nonetype)
if alpha is None:
alpha = ZR.random()
if g is None:
g = G1.rand()
if ghat is None:
ghat = G2.rand()
(gs, ghats) = ([], [])
for i in range(t + 1):
gs.append(g**(alpha**i))
for i in range(2):
ghats.append(ghat**(alpha**i))
crs = [gs, ghats]
return crs
def recursive_proofs(g_vec, a_vecs, b_vecs, u, n, P_vec, transcript):
numverifiers = len(b_vecs)
numpolys = len(a_vecs)
numproofs = numverifiers * numpolys
_ = [g.preprocess(5) for g in g_vec]
if n == 1:
treeparts = [[] for j in range(numverifiers)]
proofs = [[[[a_vecs[i][0]]] for i in range(numpolys)]
for _ in range(numverifiers)]
return [proofs, treeparts]
proofsteps = [[[] for _ in range(numpolys)]
for _ in range(numverifiers)]
nas = None
if n % 2 == 1:
for i in range(numpolys):
na = a_vecs[i][-1] * -1
gtail = g_vec[-1].pow(na)
for j in range(numverifiers):
P_vec[j][i] *= gtail * u.pow(na * b_vecs[j][-1])
# proofsteps[j][i].append(na)
nas = [a_vecs[i][-1] * -1 for i in range(numpolys)]
proofsteps = [[[nas[i]] for i in range(numpolys)]
for j in range(numverifiers)]
n_p = n // 2
#cl_vec = [ [ 0 for _ in range(numpolys)] for _ in range(numverifiers)]
#cr_vec = [ [ 0 for _ in range(numpolys)] for _ in range(numverifiers)]
#L_vec = [ [ [] for _ in range(numpolys)] for _ in range(numverifiers)]
#R_vec = [ [ [] for _ in range(numpolys)] for _ in range(numverifiers)]
Las = [G1.identity() for _ in range(len(a_vecs))]
Ras = [G1.identity() for _ in range(len(a_vecs))]
for j in range(len(a_vecs)):
for i in range(n_p):
Las[j] *= g_vec[n_p:][i].pow(a_vecs[j][:n_p][i])
Ras[j] *= g_vec[:n_p][i].pow(a_vecs[j][n_p:][i])
#for i in range(numpolys):
# for j in range(numverifiers):
# cl_vec[j][i] = inner_product(a_vecs[i][:n_p], b_vecs[j][n_p:2*n_p])
# cr_vec[j][i] = inner_product(a_vecs[i][n_p:2*n_p], b_vecs[j][:n_p])
# L_vec[j][i] = Las[i] * (u.pow(cl_vec[j][i]))
# R_vec[j][i] = Ras[i] * (u.pow(cr_vec[j][i]))
cl_vec = [[
inner_product(a_vecs[i][:n_p], b_vecs[j][n_p:2 * n_p])
for i in range(numpolys)
] for j in range(numverifiers)]
cr_vec = [[
inner_product(a_vecs[i][n_p:2 * n_p], b_vecs[j][:n_p])
for i in range(numpolys)
] for j in range(numverifiers)]
L_vec = [[Las[i] * (u.pow(cl_vec[j][i])) for i in range(numpolys)]
for j in range(numverifiers)]
R_vec = [[Ras[i] * (u.pow(cr_vec[j][i])) for i in range(numpolys)]
for j in range(numverifiers)]
# Fiat Shamir
# Make a merkle tree over everything that varies between verifiers
# TODO: na should be in the transcript
tree = MerkleTree()
if nas is None:
zr_hashes = [hashzrlist(b_vecs[i]) for i in range(len(b_vecs))]
else:
zr_hashes = [
hashzrlist(b_vecs[i] + nas) for i in range(len(b_vecs))
]
g1lists = [[] for j in range(numverifiers)]
for j in range(numverifiers):
#smash each list of lists into a single list (list() causes the map operation to execute)
_ = list(map(g1lists[j].extend, [P_vec[j], L_vec[j], R_vec[j]]))
leaves = [
pickle.dumps([zr_hashes[j], hashg1listbn(g1lists[j])])
for j in range(numverifiers)
]
tree.append_many(leaves)
roothash = tree.get_root_hash()
treesteps = [[roothash, tree.get_branch(j)]
for j in range(numverifiers)]
transcript += pickle.dumps([hashg1list(g_vec), roothash])
x = ZR.hash(transcript)
xi = x**-1
# this part must come after the challenge is generated, which must
# come after L and R are calculated. Don't try to condense the loops
g_vec_p, a_vecs_p = [], []
b_vecs_p = [[] for _ in range(len(b_vecs))]
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i].pow(xi) * g_vec[n_p:][i].pow(x))
for k in range(len(a_vecs)):
a_vecs_p.append([])
for i in range(n_p):
a_vecs_p[k].append(a_vecs[k][:n_p][i] * x +
a_vecs[k][n_p:][i] * xi)
for j in range(len(b_vecs)):
b_vecs_p[j] = [
b_vecs[j][:n_p][i] * xi + b_vecs[j][n_p:][i] * x
for i in range(n_p)
]
x2, xi2 = x * x, xi * xi
Lax2Raxi2s = [
Las[i].pow(x2) * Ras[i].pow(xi2) for i in range(len(a_vecs))
]
xil = [x2, xi2]
# the following line is equivalent to:
# for i in range(numpolys):
# for j in range(numverifiers):
# upow = inner_product(xil, [cl_vec[j][i], cr_vec[j][i]])
# P_vec[j][i] *= Lax2Raxi2s[i] * u.pow(upow)
_ = [[
P_vec[j][i].__imul__(
Lax2Raxi2s[i] *
u.pow(inner_product(xil, [cl_vec[j][i], cr_vec[j][i]])))
for i in range(numpolys)
] for j in range(numverifiers)]
proofs, treeparts = recursive_proofs(g_vec_p, a_vecs_p, b_vecs_p, u,
n_p, P_vec, transcript)
for j in range(len(proofs)):
treeparts[j].append(treesteps[j])
#for i in range(len(proofs[0])):
# proofs[j][i].append(proofsteps[j][i] + [L_vec[j][i]] + [R_vec[j][i]])
_ = [[
proofs[j][i].append(proofsteps[j][i] + [L_vec[j][i]] +
[R_vec[j][i]]) for i in range(numpolys)
] for j in range(numverifiers)]
return [proofs, treeparts]
def prove_inner_product(a_vec, b_vec, comm=None, crs=None):
def recursive_proof(g_vec, h_vec, u, a_vec, b_vec, n, P, transcript):
if n == 1:
proof = []
proof.append([a_vec[0], b_vec[0]])
return proof
proofstep = []
if n % 2 == 1:
na, nb = a_vec[-1] * -1, b_vec[-1] * -1
P *= g_vec[-1]**(na) * h_vec[-1]**(nb) * u**(-na * nb)
proofstep.append(na)
proofstep.append(nb)
n_p = n // 2
cl = ZR(0)
cr = ZR(0)
L = G1.identity()
R = G1.identity()
for i in range(n_p):
cl += a_vec[:n_p][i] * b_vec[n_p:][i]
cr += a_vec[n_p:][i] * b_vec[:n_p][i]
L *= g_vec[n_p:][i]**a_vec[:n_p][i] * h_vec[:n_p][i]**b_vec[n_p:][i]
R *= g_vec[:n_p][i]**a_vec[n_p:][i] * h_vec[n_p:][i]**b_vec[:n_p][i]
L *= u**cl
R *= u**cr
# Fiat Shamir L, R, state...
#transcript += pickle.dumps([g_vec, h_vec, u, P, L, R])
transcript += pickle.dumps(hashg1list(g_vec + h_vec + [u, P, L, R]))
x = ZR.hash(transcript)
xi = x**-1
# this part must come after the challenge is generated, which must
# come after L and R are calculated. Don't try to condense the loops
g_vec_p, h_vec_p, a_vec_p, b_vec_p = [], [], [], []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i]**xi * g_vec[n_p:][i]**x)
h_vec_p.append(h_vec[:n_p][i]**x * h_vec[n_p:][i]**xi)
a_vec_p.append(a_vec[:n_p][i] * x + a_vec[n_p:][i] * xi)
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
P_p = L**(x * x) * P * R**(xi * xi)
proof = recursive_proof(g_vec_p, h_vec_p, u, a_vec_p, b_vec_p, n_p,
P_p, transcript)
proofstep.append(L)
proofstep.append(R)
proof.append(proofstep)
return proof
n = len(a_vec)
assert len(b_vec) == n
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
h_vec = G1.hash_many(b"honeybadgerh", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, h_vec, u] = crs
g_vec = g_vec[:n]
h_vec = h_vec[:n]
if comm is not None:
P = comm * G1.identity()
else:
comm = G1.identity()
for i in range(n):
comm *= g_vec[i]**a_vec[i] * h_vec[i]**b_vec[i]
iprod = ZR(0)
for i in range(n):
iprod += a_vec[i] * b_vec[i]
P = comm * u**iprod
transcript = b""
return [
comm,
iprod,
[n] + recursive_proof(g_vec, h_vec, u, a_vec, b_vec, n, P, transcript),
]
def recursive_proofs(g_vec, a_vecs, b_vecs, u, n, P_vec, transcript):
#row_length = len(b_vecs)//len(a_vecs)
numproofs = len(a_vecs) * len(b_vecs)
row_length = numproofs // len(a_vecs)
col_length = numproofs // len(b_vecs)
numverifiers = len(b_vecs)
numpolys = len(a_vecs)
_ = [g.preprocess(5) for g in g_vec]
if n == 1:
#proofs = [None] * numproofs
#for i in range(len(proofs) // row_length):
# for j in range(row_length):
# abs_idx = i * row_length + j
# proofs[abs_idx] = [[a_vecs[i][0]]]
#return proofs
proofs = [[[] for _ in range(numpolys)]
for _ in range(numverifiers)]
for i in range(numpolys):
for j in range(numverifiers):
proofs[j][i] = [[a_vecs[i][0]]]
#proofs = [[a_vecs[:][0]]] * numverifiers
return proofs
#proofsteps = [[] for _ in range(numproofs)]
proofsteps = [[[] for _ in range(numpolys)]
for _ in range(numverifiers)]
if n % 2 == 1:
for i in range(numpolys):
na = a_vecs[i][-1] * -1
gtail = g_vec[-1].pow(na)
for j in range(numverifiers):
#abs_idx = i * row_length + j
#P_vec[abs_idx] *= gtail * u.pow(na * b_vecs[j][-1])
P_vec[j][i] *= gtail * u.pow(na * b_vecs[j][-1])
#proofsteps[abs_idx].append(na)
proofsteps[j][i].append(na)
n_p = n // 2
#cl_vec = [0 for _ in range(len(P_vecs))]
#cr_vec = [0 for _ in range(len(P_vecs))]
#L_vec = [None] * len(P_vecs)
#R_vec = [None] * len(P_vecs)
cl_vec = [[0 for _ in range(numpolys)] for _ in range(numverifiers)]
cr_vec = [[0 for _ in range(numpolys)] for _ in range(numverifiers)]
L_vec = [[[] for _ in range(numpolys)] for _ in range(numverifiers)]
R_vec = [[[] for _ in range(numpolys)] for _ in range(numverifiers)]
Las = [G1.identity() for _ in range(len(a_vecs))]
Ras = [G1.identity() for _ in range(len(a_vecs))]
for j in range(len(a_vecs)):
for i in range(n_p):
Las[j] *= g_vec[n_p:][i].pow(a_vecs[j][:n_p][i])
Ras[j] *= g_vec[:n_p][i].pow(a_vecs[j][n_p:][i])
for i in range(numpolys):
for j in range(numverifiers):
#abs_idx = i * numverifiers + j
#cl_vec[abs_idx] = inner_product(a_vecs[i][:n_p], b_vecs[j][n_p:2*n_p])
#cr_vec[abs_idx] = inner_product(a_vecs[i][n_p:2*n_p], b_vecs[j][:n_p])
#L_vec[abs_idx] = Las[i] * (u.pow(cl_vec[abs_idx]))
#R_vec[abs_idx] = Ras[i] * (u.pow(cr_vec[abs_idx]))
cl_vec[j][i] = inner_product(a_vecs[i][:n_p],
b_vecs[j][n_p:2 * n_p])
cr_vec[j][i] = inner_product(a_vecs[i][n_p:2 * n_p],
b_vecs[j][:n_p])
L_vec[j][i] = Las[i] * (u.pow(cl_vec[j][i]))
R_vec[j][i] = Ras[i] * (u.pow(cr_vec[j][i]))
# Fiat Shamir
# Make a merkle tree over everything that varies between verifiers
# TODO: na should be in the transcript
tree = MerkleTree()
b_hashes = [hashzrlist(b_vecs[i]) for i in range(len(b_vecs))]
leaves = [
hash_list_to_bytes(
#[b_hashes[j%len(b_vecs)], hashg1list([P_vec[j], L_vec[j], R_vec[j]])]
[
b_hashes[j % len(b_vecs)],
hashg1list([
P_vec[j % numverifiers][j // numverifiers],
L_vec[j % numverifiers][j // numverifiers],
R_vec[j % numverifiers][j // numverifiers]
])
]) for j in range(numproofs)
]
tree.append_many(leaves)
roothash = tree.get_root_hash()
#for j in range(len(P_vecs)):
# branch = tree.get_branch(j)
# proofsteps[j].append(roothash)
# proofsteps[j].append(branch)
for i in range(numpolys):
for j in range(numverifiers):
branch = tree.get_branch(i * numverifiers + j)
proofsteps[j][i].append(roothash)
proofsteps[j][i].append(branch)
transcript += pickle.dumps([hashg1list(g_vec), roothash])
x = ZR.hash(transcript)
xi = x**-1
# this part must come after the challenge is generated, which must
# come after L and R are calculated. Don't try to condense the loops
g_vec_p, a_vecs_p = [], []
b_vecs_p = [[] for _ in range(len(b_vecs))]
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i].pow(xi) * g_vec[n_p:][i].pow(x))
for k in range(len(a_vecs)):
a_vecs_p.append([])
for i in range(n_p):
a_vecs_p[k].append(a_vecs[k][:n_p][i] * x +
a_vecs[k][n_p:][i] * xi)
for j in range(len(b_vecs)):
#for i in range(n_p):
# b_vecs_p[j].append(b_vecs[j][:n_p][i] * xi + b_vecs[j][n_p:][i] * x)
b_vecs_p[j] = [
b_vecs[j][:n_p][i] * xi + b_vecs[j][n_p:][i] * x
for i in range(n_p)
]
x2, xi2 = x * x, xi * xi
Lax2Raxi2s = [
Las[i].pow(x2) * Ras[i].pow(xi2) for i in range(len(a_vecs))
]
#for i in range(numproofs // row_length):
# for j in range(row_length):
# abs_idx = i * row_length + j
# P_vec[abs_idx] *= Lax2Raxi2s[i] * u ** (x2 * cl_vec[abs_idx] + xi2 * cr_vec[abs_idx])
xil = [x2, xi2]
#for i in range(numproofs):
# upow = inner_product(xil, [cl_vec[i], cr_vec[i]])
# P_vec[i] *= Lax2Raxi2s[i//row_length] * u.pow(upow)
for i in range(numpolys):
for j in range(numverifiers):
upow = inner_product(xil, [cl_vec[j][i], cr_vec[j][i]])
P_vec[j][i] *= Lax2Raxi2s[i] * u.pow(upow)
proofs = recursive_proofs(g_vec_p, a_vecs_p, b_vecs_p, u, n_p, P_vec,
transcript)
#for j in range(len(proofs)):
# proofsteps[j].append(L_vec[j])
# proofsteps[j].append(R_vec[j])
# proofs[j].append(proofsteps[j])
for j in range(len(proofs)):
for i in range(len(proofs[0])):
proofsteps[j][i].append(L_vec[j][i])
proofsteps[j][i].append(R_vec[j][i])
proofs[j][i].append(proofsteps[j][i])
return proofs
def verify_double_batch_inner_product_one_known(comms,
iprods,
b_vec,
proofs,
crs=None):
def recursive_verify(g_vec, b_vec, u, proofs, n, Ps, transcript):
if n == 1:
ret = True
for i in range(len(proofs)):
a, b = proofs[i][0][0], b_vec[0]
ret &= Ps[i] == g_vec[0].pow(a) * u.pow(a * b)
return ret
Ls = []
Rs = []
branches = []
last_roothash = None
if n % 2 == 1:
for i in range(len(proofs)):
[na, roothash, branch, L, R] = proofs[i][-1]
Ps[i] *= g_vec[-1].pow(na) * u.pow(na * b_vec[-1])
Ls.append(L)
Rs.append(R)
branches.append(branch)
if i != 0:
assert last_roothash == roothash
else:
last_roothash = roothash
else:
for i in range(len(proofs)):
[roothash, branch, L, R] = proofs[i][-1]
Ls.append(L)
Rs.append(R)
branches.append(branch)
if i != 0:
assert last_roothash == roothash
else:
last_roothash = roothash
for i in range(len(proofs)):
leafi = hash_list_to_bytes(
[hashzrlist(b_vec),
hashg1list([Ps[i], Ls[i], Rs[i]])])
if not MerkleTree.verify_membership(leafi, branches[i],
last_roothash):
return False
transcript += pickle.dumps([hashg1list(g_vec), last_roothash])
x = ZR.hash(transcript)
xi = x**-1
x2 = x * x
xi2 = xi * xi
n_p = n // 2
g_vec_p = []
b_vec_p = []
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i].pow(xi) * g_vec[n_p:][i].pow(x))
b_vec_p.append(b_vec[:n_p][i] * xi + b_vec[n_p:][i] * x)
Ps_p = []
for i in range(len(proofs)):
Ps_p.append(Ls[i]**(x2) * Ps[i] * Rs[i]**(xi2))
proofs_p = []
for i in range(len(proofs)):
proofs_p.append(proofs[i][:-1])
return recursive_verify(g_vec_p, b_vec_p, u, proofs_p, n_p, Ps_p,
transcript)
n = proofs[0][0]
iproofs = []
for i in range(len(proofs)):
iproofs.append(proofs[i][1:])
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, u] = crs
g_vec = g_vec[:n]
Ps = []
for i in range(len(comms)):
Ps.append(comms[i] * u.pow(iprods[i]))
transcript = pickle.dumps(u)
return recursive_verify(g_vec, b_vec, u, iproofs, n, Ps, transcript)
def prove_double_batch_inner_product_one_known(a_vecs,
b_vecs,
comms=None,
crs=None):
#@profile
def recursive_proofs(g_vec, a_vecs, b_vecs, u, n, P_vec, transcript):
#row_length = len(b_vecs)//len(a_vecs)
numproofs = len(P_vec)
row_length = numproofs // len(a_vecs)
col_length = numproofs // len(b_vecs)
numverifiers = row_length
_ = [g.preprocess(5) for g in g_vec]
if n == 1:
proofs = [None] * numproofs
for i in range(len(proofs) // row_length):
for j in range(row_length):
abs_idx = i * row_length + j
proofs[abs_idx] = [[a_vecs[i][0]]]
return proofs
proofsteps = [[] for _ in range(numproofs)]
if n % 2 == 1:
for i in range(numproofs // row_length):
na = a_vecs[i][-1] * -1
gtail = g_vec[-1].pow(na)
for j in range(row_length):
abs_idx = i * row_length + j
P_vec[abs_idx] *= gtail * u.pow(na * b_vecs[j][-1])
proofsteps[abs_idx].append(na)
n_p = n // 2
cl_vec = [0 for _ in range(len(P_vecs))]
cr_vec = [0 for _ in range(len(P_vecs))]
L_vec = [None] * len(P_vecs)
R_vec = [None] * len(P_vecs)
Las = [G1.identity() for _ in range(len(a_vecs))]
Ras = [G1.identity() for _ in range(len(a_vecs))]
for j in range(len(a_vecs)):
for i in range(n_p):
Las[j] *= g_vec[n_p:][i].pow(a_vecs[j][:n_p][i])
Ras[j] *= g_vec[:n_p][i].pow(a_vecs[j][n_p:][i])
for i in range(numproofs // row_length):
for j in range(row_length):
abs_idx = i * row_length + j
cl_vec[abs_idx] = inner_product(a_vecs[i][:n_p],
b_vecs[j][n_p:2 * n_p])
cr_vec[abs_idx] = inner_product(a_vecs[i][n_p:2 * n_p],
b_vecs[j][:n_p])
L_vec[abs_idx] = Las[i] * (u.pow(cl_vec[abs_idx]))
R_vec[abs_idx] = Ras[i] * (u.pow(cr_vec[abs_idx]))
# Fiat Shamir
# Make a merkle tree over everything that varies between verifiers
# TODO: na should be in the transcript
tree = MerkleTree()
b_hashes = [hashzrlist(b_vecs[i]) for i in range(len(b_vecs))]
leaves = [
hash_list_to_bytes([
b_hashes[j % len(b_vecs)],
hashg1list([P_vec[j], L_vec[j], R_vec[j]])
]) for j in range(numproofs)
]
tree.append_many(leaves)
roothash = tree.get_root_hash()
#for h in range(numverifiers):
for j in range(len(P_vecs)):
branch = tree.get_branch(j)
proofsteps[j].append(roothash)
proofsteps[j].append(branch)
transcript += pickle.dumps([hashg1list(g_vec), roothash])
x = ZR.hash(transcript)
xi = x**-1
# this part must come after the challenge is generated, which must
# come after L and R are calculated. Don't try to condense the loops
g_vec_p, a_vecs_p = [], []
b_vecs_p = [[] for _ in range(len(b_vecs))]
for i in range(n_p):
g_vec_p.append(g_vec[:n_p][i].pow(xi) * g_vec[n_p:][i].pow(x))
for k in range(len(a_vecs)):
a_vecs_p.append([])
for i in range(n_p):
a_vecs_p[k].append(a_vecs[k][:n_p][i] * x +
a_vecs[k][n_p:][i] * xi)
for j in range(len(b_vecs)):
#for i in range(n_p):
# b_vecs_p[j].append(b_vecs[j][:n_p][i] * xi + b_vecs[j][n_p:][i] * x)
b_vecs_p[j] = [
b_vecs[j][:n_p][i] * xi + b_vecs[j][n_p:][i] * x
for i in range(n_p)
]
x2, xi2 = x * x, xi * xi
Lax2Raxi2s = [
Las[i].pow(x2) * Ras[i].pow(xi2) for i in range(len(a_vecs))
]
#for i in range(numproofs // row_length):
# for j in range(row_length):
# abs_idx = i * row_length + j
# P_vec[abs_idx] *= Lax2Raxi2s[i] * u ** (x2 * cl_vec[abs_idx] + xi2 * cr_vec[abs_idx])
xil = [x2, xi2]
for i in range(numproofs):
upow = inner_product(xil, [cl_vec[i], cr_vec[i]])
P_vec[i] *= Lax2Raxi2s[i // row_length] * u.pow(upow)
proofs = recursive_proofs(g_vec_p, a_vecs_p, b_vecs_p, u, n_p, P_vec,
transcript)
for j in range(len(proofs)):
proofsteps[j].append(L_vec[j])
proofsteps[j].append(R_vec[j])
proofs[j].append(proofsteps[j])
return proofs
t = len(a_vecs[0])
if crs is None:
g_vec = G1.hash_many(b"honeybadgerg", n)
u = G1.hash(b"honeybadgeru")
else:
[g_vec, u] = crs
g_vec = g_vec[:t]
if comms is None:
comms = []
for j in range(len(a_vecs)):
comms.append(G1.identity())
for i in range(t):
comms[j] *= g_vec[i].pow(a_vecs[j][i])
iprods = [ZR(0) for _ in range(len(b_vecs) * len(a_vecs))]
P_vecs = [None] * (len(b_vecs) * len(a_vecs))
row_length = len(b_vecs)
for i in range(len(a_vecs)):
for j in range(len(b_vecs)):
abs_idx = i * row_length + j
#for k in range(t):
# iprods[abs_idx] += a_vecs[i][k] * b_vecs[j][k]
iprods[abs_idx] = inner_product(a_vecs[i], b_vecs[j])
P_vecs[abs_idx] = comms[i] * u.pow(iprods[abs_idx])
transcript = pickle.dumps(u)
proofsize = len(a_vecs) * len(b_vecs)
i = 0
proofs = recursive_proofs(g_vec, a_vecs, b_vecs, u, t, P_vecs, transcript)
for j in range(len(proofs)):
proofs[j].insert(0, t)
# Transform the proofs into a list of lists
proofs_p = []
for i in range(len(a_vecs)):
proofs_p.append([])
for j in range(len(proofs) // len(a_vecs)):
proofs_p[i].append(proofs[i * (len(proofs) // len(a_vecs)) + j])
return [comms, iprods, proofs_p]
