| 326 | |
| 327 | impl<E: Pairing> PseudonymProof<E> { |
| 328 | pub fn verify( |
| 329 | &self, |
| 330 | challenge: &E::ScalarField, |
| 331 | Z: E::G1Affine, |
| 332 | issuer_pk: PreparedIssuerPublicKey<E>, |
| 333 | params: impl Into<PreparedSetupParams<E>>, |
| 334 | ) -> Result<(), SyraError> { |
| 335 | let params = params.into(); |
| 336 | let z_prepared = E::G1Prepared::from(Z); |
| 337 | let C2_prepared = E::G1Prepared::from(self.C.encrypted); |
| 338 | let C2_hat_prepared = E::G2Prepared::from(self.C_hat.encrypted); |
| 339 | let A = E::pairing(z_prepared.clone(), issuer_pk.w_hat_prepared.clone()); |
| 340 | let B = E::pairing(z_prepared.clone(), C2_hat_prepared.clone()) - self.T; |
| 341 | let E = E::pairing(C2_prepared.clone(), params.g_hat_prepared.clone()) |
| 342 | - E::pairing(E::G1Prepared::from(params.g), C2_hat_prepared); |
| 343 | let H = E::pairing(C2_prepared, issuer_pk.vk_prepared) - params.pairing; |
| 344 | // e(C2, -g_hat) = e(-C2, g_hat) |
| 345 | let J = E::pairing( |
| 346 | E::G1Prepared::from(self.C.encrypted.into_group().neg()), |
| 347 | params.g_hat_prepared, |
| 348 | ); |
| 349 | // F , G, I are part of the precomputed public params |
| 350 | let F = issuer_pk.w_g_hat; |
| 351 | let G = issuer_pk.minus_g_w_hat; |
| 352 | let I = issuer_pk.w_vk; |
| 353 | let minus_challenge = challenge.neg(); |
| 354 | |
| 355 | // Verify each response |
| 356 | if self.t_C1 != (params.g * self.resp_beta + self.C.eph_pk * minus_challenge).into() { |
| 357 | return Err(SyraError::InvalidProof); |
| 358 | } |
| 359 | if self.t_C1_hat |
| 360 | != (params.g_hat * self.resp_alpha + self.C_hat.eph_pk * minus_challenge).into() |
| 361 | { |
| 362 | return Err(SyraError::InvalidProof); |
| 363 | } |
| 364 | if self.t_B != A * self.resp_alpha + B * minus_challenge { |
| 365 | return Err(SyraError::InvalidProof); |
| 366 | } |
| 367 | if self.t_E != F * self.resp_beta + G * self.resp_alpha + E * minus_challenge { |
| 368 | return Err(SyraError::InvalidProof); |
| 369 | } |
| 370 | let F_bs = F * self.resp_beta_times_s; |
| 371 | if self.t_H != I * self.resp_beta + F_bs + J * self.resp_s + H * minus_challenge { |
| 372 | return Err(SyraError::InvalidProof); |
| 373 | } |
| 374 | if self.t_K1 != F * self.resp_s + G * self.resp_r1 + self.K1 * minus_challenge { |
| 375 | return Err(SyraError::InvalidProof); |
| 376 | } |
| 377 | let K2_c = self.K2 * minus_challenge; |
| 378 | if self.t_K2 != F_bs + G * self.resp_r2 + K2_c { |
| 379 | return Err(SyraError::InvalidProof); |
| 380 | } |
| 381 | if self.t_K2_product != E * self.resp_s + G * self.resp_r3 + K2_c { |
| 382 | return Err(SyraError::InvalidProof); |
| 383 | } |
| 384 | Ok(()) |
| 385 | } |