Generate keys for encryption and decryption. The parameters `g_i`, `delta_g` and `gamma_g` are shared with the SNARK SRS.
(
rng: &mut R,
chunk_bit_size: u8,
gens: &EncryptionGens<E>,
g_i: &[E::G1Affine],
delta_g: &E::G1Affine,
gamma_g: &E::G1Affine,
)
| 237 | /// Generate keys for encryption and decryption. The parameters `g_i`, `delta_g` and `gamma_g` are |
| 238 | /// shared with the SNARK SRS. |
| 239 | pub fn keygen<R: RngCore, E: Pairing>( |
| 240 | rng: &mut R, |
| 241 | chunk_bit_size: u8, |
| 242 | gens: &EncryptionGens<E>, |
| 243 | g_i: &[E::G1Affine], |
| 244 | delta_g: &E::G1Affine, |
| 245 | gamma_g: &E::G1Affine, |
| 246 | ) -> crate::Result<( |
| 247 | SecretKey<E::ScalarField>, |
| 248 | EncryptionKey<E>, |
| 249 | DecryptionKey<E>, |
| 250 | )> { |
| 251 | let n = chunks_count::<E::ScalarField>(chunk_bit_size) as usize; |
| 252 | if n > g_i.len() { |
| 253 | return Err(SaverError::VectorShorterThanExpected(g_i.len(), n)); |
| 254 | } |
| 255 | |
| 256 | let rho = E::ScalarField::rand(rng); |
| 257 | let s = (0..n) |
| 258 | .map(|_| E::ScalarField::rand(rng)) |
| 259 | .collect::<Vec<_>>(); |
| 260 | let t = (0..=n) |
| 261 | .map(|_| E::ScalarField::rand(rng)) |
| 262 | .collect::<Vec<_>>(); |
| 263 | let v = (0..n) |
| 264 | .map(|_| E::ScalarField::rand(rng)) |
| 265 | .collect::<Vec<_>>(); |
| 266 | |
| 267 | let delta_g_proj = delta_g.into_group(); |
| 268 | let t_repr = cfg_iter!(t).map(|t| t.into_bigint()).collect::<Vec<_>>(); |
| 269 | |
| 270 | let X = multiply_field_elems_with_same_group_elem(delta_g_proj, &s); |
| 271 | let Y = (0..n) |
| 272 | .map(|i| g_i[i].mul_bigint(t_repr[i + 1])) |
| 273 | .collect::<Vec<_>>(); |
| 274 | let Z = multiply_field_elems_with_same_group_elem(gens.H.into_group(), &t); |
| 275 | |
| 276 | // P_1 = G*delta * (t_0 + \sum_{j in 0..n}(s_j * t_{j+1})) |
| 277 | let P_1 = delta_g_proj |
| 278 | .mul_bigint((t[0] + (0..n).map(|j| s[j] * t[j + 1]).sum::<E::ScalarField>()).into_bigint()); |
| 279 | |
| 280 | let ek = EncryptionKey { |
| 281 | X_0: *delta_g, |
| 282 | X: E::G1::normalize_batch(&X), |
| 283 | Y: E::G1::normalize_batch(&Y), |
| 284 | Z: E::G2::normalize_batch(&Z), |
| 285 | P_1: P_1.into_affine(), |
| 286 | P_2: gamma_g |
| 287 | .mul_bigint((E::ScalarField::one() + s.iter().sum::<E::ScalarField>()).into_bigint()) |
| 288 | .into_affine(), |
| 289 | }; |
| 290 | let V_0 = gens.H.mul_bigint(rho.into_bigint()); |
| 291 | let V_2 = multiply_field_elems_with_same_group_elem(V_0, &v); |
| 292 | let V_1 = multiply_field_elems_with_same_group_elem( |
| 293 | gens.H.into_group(), |
| 294 | &s.into_iter() |
| 295 | .zip(v.into_iter()) |
| 296 | .map(|(s_i, v_i)| s_i * v_i) |