Initialize 3 Schnorr proof of knowledge protocols to prove the knowledge of committed value in ciphertext
(
&mut self,
rng: &mut R,
ck_comm_ct: &'a [E::G1Affine],
ck_comm_chunks: &'a [E::G1Affine],
ck_comm_combined: &'a [E::G1Affine],
message: E::ScalarField
| 490 | /// Initialize 3 Schnorr proof of knowledge protocols to prove the knowledge of committed value |
| 491 | /// in ciphertext |
| 492 | fn init_schnorr_protocols<R: RngCore>( |
| 493 | &mut self, |
| 494 | rng: &mut R, |
| 495 | ck_comm_ct: &'a [E::G1Affine], |
| 496 | ck_comm_chunks: &'a [E::G1Affine], |
| 497 | ck_comm_combined: &'a [E::G1Affine], |
| 498 | message: E::ScalarField, |
| 499 | blinding_combined_message: Option<E::ScalarField>, |
| 500 | ciphertext: Ciphertext<E>, |
| 501 | randomness_enc: E::ScalarField, |
| 502 | proof: ark_groth16::Proof<E>, |
| 503 | ) -> Result<(), ProofSystemError> { |
| 504 | // blinding used for `H` in both commitments |
| 505 | let h_blinding = E::ScalarField::rand(rng); |
| 506 | |
| 507 | // blinding used to prove knowledge of message in `comm_combined`. The caller of this method ensures |
| 508 | // that this will be same as the one used proving knowledge of the corresponding message in BBS+ |
| 509 | // signature, thus allowing them to be proved equal. |
| 510 | let blinding_combined_message = if blinding_combined_message.is_none() { |
| 511 | E::ScalarField::rand(rng) |
| 512 | } else { |
| 513 | blinding_combined_message.unwrap() |
| 514 | }; |
| 515 | |
| 516 | // Initialize the 3 Schnorr protocols |
| 517 | |
| 518 | let comm_combined = self |
| 519 | .chunked_commitment_gens |
| 520 | .G |
| 521 | .mul_bigint(message.into_bigint()) |
| 522 | .add( |
| 523 | &(self |
| 524 | .chunked_commitment_gens |
| 525 | .H |
| 526 | .mul_bigint(h_blinding.into_bigint())), |
| 527 | ) |
| 528 | .into_affine(); |
| 529 | let comm_chunks = ChunkedCommitment::<E::G1Affine>::get_commitment_given_commitment_key( |
| 530 | &message, |
| 531 | &h_blinding, |
| 532 | self.chunk_bit_size, |
| 533 | ck_comm_chunks, |
| 534 | )?; |
| 535 | |
| 536 | let message_chunks = decompose(&message, self.chunk_bit_size)? |
| 537 | .into_iter() |
| 538 | .map(|m| E::ScalarField::from(m as u64)) |
| 539 | .collect::<Vec<_>>(); |
| 540 | |
| 541 | // NOTE: value of id is dummy |
| 542 | let mut sp_ciphertext = SchnorrProtocol::new(10000, ck_comm_ct, ciphertext.commitment); |
| 543 | let mut sp_chunks = SchnorrProtocol::new(10000, ck_comm_chunks, comm_chunks); |
| 544 | let mut sp_combined = SchnorrProtocol::new(10000, ck_comm_combined, comm_combined); |
| 545 | |
| 546 | let blindings_chunks = (0..message_chunks.len()) |
| 547 | .map(|i| (i, E::ScalarField::rand(rng))) |
| 548 | .collect::<BTreeMap<usize, E::ScalarField>>(); |
| 549 | let mut sp_ciphertext_wit = message_chunks.clone(); |