Verify that ciphertext can be correctly decrypted to the given message chunks. This is "Verify_Dec" from algorithm 2 in the paper.
(
messages: &[CHUNK_TYPE],
c_0: &E::G1Affine,
c: &[E::G1Affine],
nu: &E::G1Affine,
dk: impl Into<PreparedDecryptionKey<E>>,
g_i: &[E::G1Affine],
| 423 | |
| 424 | /// Verify that ciphertext can be correctly decrypted to the given message chunks. This is "Verify_Dec" from algorithm 2 in the paper. |
| 425 | pub fn verify_decryption( |
| 426 | messages: &[CHUNK_TYPE], |
| 427 | c_0: &E::G1Affine, |
| 428 | c: &[E::G1Affine], |
| 429 | nu: &E::G1Affine, |
| 430 | dk: impl Into<PreparedDecryptionKey<E>>, |
| 431 | g_i: &[E::G1Affine], |
| 432 | gens: impl Into<PreparedEncryptionGens<E>>, |
| 433 | ) -> crate::Result<()> { |
| 434 | let dk = dk.into(); |
| 435 | let gens = gens.into(); |
| 436 | if messages.len() != dk.supported_chunks_count()? as usize { |
| 437 | return Err(SaverError::IncompatibleDecryptionKey( |
| 438 | messages.len(), |
| 439 | dk.supported_chunks_count()? as usize, |
| 440 | )); |
| 441 | } |
| 442 | if messages.len() > g_i.len() { |
| 443 | return Err(SaverError::VectorShorterThanExpected( |
| 444 | messages.len(), |
| 445 | g_i.len(), |
| 446 | )); |
| 447 | } |
| 448 | |
| 449 | let nu_prepared = E::G1Prepared::from(*nu); |
| 450 | let minus_nu_prepared = E::G1Prepared::from(nu.into_group().neg()); |
| 451 | if !E::multi_pairing([minus_nu_prepared, (*c_0).into()], [gens.H, dk.V_0.clone()]).is_zero() |
| 452 | { |
| 453 | return Err(SaverError::InvalidDecryption); |
| 454 | } |
| 455 | for i in 0..messages.len() { |
| 456 | let g_i_m_i = g_i[i].mul(E::ScalarField::from(messages[i] as u64)); |
| 457 | // e(g_i * m_i, dk.V_2_i) * e(-c_i, dk.V_2_i) = e(g_i * m_i - c_i, dk.V_2_i) |
| 458 | let g_i_m_i_c_i = g_i_m_i.sub(&c[i]); |
| 459 | if !E::multi_pairing( |
| 460 | [g_i_m_i_c_i.into_affine().into(), nu_prepared.clone()], |
| 461 | [dk.V_2[i].clone(), dk.V_1[i].clone()], |
| 462 | ) |
| 463 | .is_zero() |
| 464 | { |
| 465 | return Err(SaverError::InvalidDecryption); |
| 466 | } |
| 467 | } |
| 468 | Ok(()) |
| 469 | } |
| 470 | |
| 471 | /// Same as `Self::verify_decryption` but used randomized pairing checker |
| 472 | pub fn verify_decryption_with_randomized_pairing_checker( |