Method verify_common

kvac/src/bbs_sharp/proof.rs:547–606

Verify Schnorr proofs and proof of knowledge of public key if designated verifier proof

(
        &self,
        revealed_msgs: &BTreeMap<usize, G::ScalarField>,
        challenge: &G::ScalarField,
        params: &MACParams<G>,
        verifier_pub_key: Option<&G>,
    )

    /// Verify Schnorr proofs and proof of knowledge of public key if designated verifier proof
    pub fn verify_common(
        &self,
        revealed_msgs: &BTreeMap<usize, G::ScalarField>,
        challenge: &G::ScalarField,
        params: &MACParams<G>,
        verifier_pub_key: Option<&G>,
    ) -> Result<(), KVACError> {
        // Adjust challenge if designated verifier proof provided
        let chal = if let Some(dvp) = &self.designated_verifier_pk_proof {
            if let Some(vpk) = verifier_pub_key {
                dvp.verify(vpk, &params.g_tilde)?;
                *challenge - dvp.challenge
            } else {
                return Err(KVACError::MissingVerifierPubKeyForDesignatedVerifierProof);
            }
        } else {
            *challenge
        };
        if !self
            .sc_B_bar
            .verify(&self.B_bar, &self.A_hat, &self.D, &chal)
        {
            return Err(KVACError::InvalidSchnorrProof);
        }
        let mut bases = Vec::with_capacity(2 + params.g_vec.len() - revealed_msgs.len());
        let mut bases_revealed = Vec::with_capacity(revealed_msgs.len());
        let mut exponents = Vec::with_capacity(revealed_msgs.len());
        for i in 0..params.g_vec.len() {
            if revealed_msgs.contains_key(&i) {
                let message = revealed_msgs.get(&i).unwrap();
                bases_revealed.push(params.g_vec[i]);
                exponents.push(*message);
            } else {
                bases.push(params.g_vec[i]);
            }
        }
        bases.push(self.D);
        let y = match self.hw_sig_type {
            HardwareSignatureType::Schnorr => {
                bases.push(params.g);
                -(G::Group::msm_unchecked(&bases_revealed, &exponents)
                    + params.g_0
                    + self.blinded_pk)
            }
            HardwareSignatureType::Ecdsa => {
                // As described in the paper
                // let F = (G::Group::msm_unchecked(&bases_revealed, &exponents) + params.g_0).into_affine();
                // bases.push(F);
                // self.blinded_pk.into_group().neg()

                // An optimized approach with other benefits. See more details in comments in the proof generation code
                bases.push(self.blinded_pk);
                -(G::Group::msm_unchecked(&bases_revealed, &exponents) + params.g_0)
            }
        };

        self.sc_resp_msgs
            .is_valid(&bases, &y.into(), &self.t_msgs, &chal)?;