void miller(element_t z, element_t PR, element_t R, element_t P, element_t Q)
{
int m = mpz_sizeinbase(order, 2) - 2;
element_t Z;
element_t z1;
element_t x1;
element_init_same_as(Z, PR);
element_set(Z, P);
element_set1(z);
element_init_same_as(z1, z);
element_init_same_as(x1, z);
do_vert(x1, PR, Q);
element_printf("vert(P+R) %B\n", x1);
do_line(z1, P, R, Q);
element_printf("line(P,R) %B\n", z1);
element_div(x1, x1, z1);
element_printf("x1 %B\n", x1);
element_set(z, x1);
for (;;) {
printf("iteration %d: %d\n", m, mpz_tstbit(order,m));
element_square(z, z);
element_printf("squared: %B\n", z);
do_tangent(z1, Z, Q);
element_mul(z, z, z1);
element_double(Z, Z);
do_vert(z1, Z, Q);
element_div(z, z, z1);
element_printf("pre-if: %B\n", z);
if (mpz_tstbit(order, m)) {
element_mul(z, z, x1);
do_vert(z1, P, Q);
element_mul(z, z, z1);
element_printf("done %B\n", z);
/*
do_line(z1, Z, P, Q);
element_mul(z, z, z1);
element_add(Z, Z, P);
do_vert(z1, Z, Q);
element_div(z, z, z1);
*/
}
if (!m) break;
m--;
}
element_clear(x1);
element_clear(z1);
}
void weil(element_t w, element_t g, element_t h)
{
element_t gr;
element_t hs;
element_t r;
element_t s;
element_t z, z0, z1;
element_init(z, Fq2);
element_init(z0, Fq2);
element_init(z1, Fq2);
element_init_same_as(gr, g);
element_init_same_as(hs, h);
element_init_same_as(r, g);
element_init_same_as(s, h);
element_random(r);
element_random(s);
//point_random always takes the same square root
//why not take the other one for once?
element_neg(r, r);
element_set_str(r, "[[40,0],[54,0]]", 0);
element_set_str(s, "[[48,55],[28,51]]", 0);
element_printf("chose R = %B\n", r);
element_printf("chose S = %B\n", s);
element_add(gr, g, r);
element_add(hs, h, s);
element_printf("P+R = %B\n", gr);
element_printf("Q+S = %B\n", hs);
miller(z, gr, r, g, hs);
miller(z0, gr, r, g, s);
element_div(z1, z, z0);
element_printf("num: %B\n", z1);
miller(z, hs, s, h, gr);
miller(z0, hs, s, h, r);
element_div(w, z, z0);
element_printf("denom: %B\n", w);
element_div(w, z1, w);
element_clear(gr);
element_clear(r);
element_clear(hs);
element_clear(s);
element_clear(z);
element_clear(z0);
element_clear(z1);
}
/**
* @param witness gets modified
*/
void
pbgp_witness_update(setup_params_t *setup,
store_t *added, store_t *revoked,
uint32_t id, element_t witness)
{
element_t num, den, witt;
element_init_G1(num, setup->pairing);
element_init_G1(den, setup->pairing);
element_init_G1(witt, setup->pairing);
_witness_set_product(setup, added, id, num);
_witness_set_product(setup, revoked, id, den);
// Multiply
//
// g[np1 - j + i] added
// w *= ---------------------
// g[np1 - j + i] revoked
//
// asnum(s) during last epoch
element_div(witt, num, den);
element_mul(witness, witness, witt);
element_clear(num);
element_clear(den);
element_clear(witt);
}
viennacl::vector<T>
element_div(vector_base<T> const & v1, vector_expression<const V2, const V3, OP> const & proxy)
{
viennacl::vector<T> temp = proxy;
temp = element_div(v1, temp);
return temp;
}
viennacl::vector<T>
element_div(vector_expression<const V1, const V2, OP> const & proxy, vector_base<T> const & v2)
{
viennacl::vector<T> temp = proxy;
temp = element_div(temp, v2);
return temp;
}
void tate(element_t z, element_t P, element_t Q)
{
mpz_t q1r;
mpz_init(q1r);
mpz_set_ui(q1r, 696);
/*
millertate(z, P, Q);
element_printf("prepow: z = %B\n", z);
element_pow_mpz(z, z, q1r);
*/
{
element_t R, QR;
element_t z0;
element_init_same_as(R, P);
element_init_same_as(QR, P);
element_init_same_as(z0, z);
element_random(R);
element_add(QR, Q, R);
millertate(z, P, QR);
millertate(z0, P, R);
element_div(z, z, z0);
element_pow_mpz(z, z, q1r);
element_clear(R);
element_clear(QR);
}
mpz_clear(q1r);
}
void millertate(element_t z, element_t P, element_t Q)
{
element_t Z;
element_t z0;
element_init_same_as(Z, P);
element_init_same_as(z0, z);
element_set(Z, P);
do_tangent(z, Z, Q);
element_double(Z, Z);
do_vert(z0, Z, Q);
element_div(z, z, z0);
element_printf("presquare: z = %B\n", z);
element_square(z, z);
element_printf("square: z = %B\n", z);
do_tangent(z0, Z, Q);
element_mul(z, z, z0);
element_clear(z0);
element_clear(Z);
}
void CipherText::langrange(element_t* ys, int index, int k, int num){
element_t delta;
element_t numerator;
element_t denominator;
element_t temp;
element_init_Zr(delta, *(this->p));
element_init_Zr(numerator, *(this->p));
element_init_Zr(denominator, *(this->p));
element_init_Zr(temp, *(this->p));
element_init_Zr(ys[index], *(this->p));
element_set0(ys[index]);
int i, j;
for(i = 0; i < k; i++){
//compute the langrange coefficent l
element_set1(delta);
for(j = 0; j < k; j++){
if( j != i){
element_set_si(numerator, index - j);
element_set_si(denominator, i - j);
element_div(numerator, numerator, denominator);
element_mul(delta, delta, numerator);
}
}
element_mul(temp, ys[i], delta);
element_add(ys[index], ys[index], temp);
}
}
viennacl::vector<typename viennacl::result_of::cpu_value_type<V1>::type>
element_div(vector_expression<const V1, const V2, OP1> const & proxy1,
vector_expression<const V3, const V4, OP2> const & proxy2)
{
typedef vector<typename viennacl::result_of::cpu_value_type<V1>::type> VectorType;
VectorType temp1 = proxy1;
VectorType temp2 = proxy2;
temp1 = element_div(temp1, temp2);
return temp1;
}
static void do_line(element_ptr z, element_ptr V, element_ptr P, element_ptr Q)
{
element_ptr Vx = curve_x_coord(V);
element_ptr Vy = curve_y_coord(V);
element_ptr Px = curve_x_coord(P);
element_ptr Py = curve_y_coord(P);
element_ptr Qx = curve_x_coord(Q);
element_ptr Qy = curve_y_coord(Q);
element_t a, b, c, e0;
element_init_same_as(a, Vx);
element_init_same_as(b, Vx);
element_init_same_as(c, Vx);
element_init_same_as(e0, Vx);
//a = -(B.y - A.y) / (B.x - A.x);
//b = 1;
//c = -(A.y + a * A.x);
element_sub(a, Py, Vy);
element_sub(b, Vx, Px);
element_div(a, a, b);
element_set1(b);
element_mul(c, a, Vx);
element_add(c, c, Vy);
element_neg(c, c);
/*
//but we could multiply by B.x - A.x to avoid division, so
//a = -(By - Ay)
//b = Bx - Ax
//c = -(Ay b + a Ax);
element_sub(a, Vy, Py);
element_sub(b, Px, Vx);
element_mul(c, Vx, Py);
element_mul(e0, Vy, Px);
element_sub(c, c, e0);
//
//actually no, since fasterweil won't work if we do this
*/
element_printf("line at %B: %B %B %B\n", V, a, b, c);
element_mul(a, a, Qx);
element_mul(b, b, Qy);
element_add(c, c, a);
element_add(z, c, b);
element_printf(" = %B\n", z);
element_clear(a);
element_clear(b);
element_clear(c);
element_clear(e0);
}
void fasterweil(element_t w, element_t g, element_t h)
{
element_t hs;
element_t s;
element_t z, z0, z1;
element_init(z, Fq2);
element_init(z0, Fq2);
element_init(z1, Fq2);
element_init_same_as(hs, h);
element_init_same_as(s, h);
element_random(s);
//point_random always takes the same square root
//why not take the other one for once?
element_set_str(s, "[[48,55],[28,51]]", 0);
element_printf("chose S = %B\n", s);
element_add(hs, h, s);
element_printf("Q+S = %B\n", hs);
millertate(z, g, hs);
millertate(z0, g, s);
element_div(z1, z, z0);
element_printf("num: %B\n", z1);
miller(w, hs, s, h, g);
element_printf("denom: %B\n", w);
element_div(w, z1, w);
element_clear(z);
element_clear(z0);
element_clear(z1);
element_clear(hs);
element_clear(s);
}
void fasterweil2(element_t w, element_t g, element_t h)
{
element_t gr;
element_t r;
element_t z, z0, z1;
element_init(z, Fq2);
element_init(z0, Fq2);
element_init(z1, Fq2);
element_init_same_as(gr, g);
element_init_same_as(r, g);
element_random(r);
//point_random always takes the same square root
//why not take the other one for once?
element_set_str(r, "[[48,55],[28,51]]", 0);
element_printf("chose R = %B\n", r);
element_add(gr, g, r);
element_printf("P+R = %B\n", gr);
miller(w, gr, r, g, h);
element_printf("num: %B\n", w);
millertate(z, h, gr);
millertate(z0, h, r);
element_div(z1, z, z0);
element_printf("denom: %B\n", z1);
element_div(w, w, z1);
element_clear(z);
element_clear(z0);
element_clear(z1);
element_clear(gr);
element_clear(r);
}
static void do_tangent(element_ptr z, element_ptr V, element_ptr Q)
{
element_ptr Vx = curve_x_coord(V);
element_ptr Vy = curve_y_coord(V);
element_ptr Qx = curve_x_coord(Q);
element_ptr Qy = curve_y_coord(Q);
element_t a, b, c;
element_init_same_as(a, Vx);
element_init_same_as(b, Vx);
element_init_same_as(c, Vx);
//a = -slope_tangent(V.x, V.y);
//b = 1;
//c = -(V.y + aV.x);
/*
//we could multiply by -2*V.y to avoid division so:
//a = -(3 Vx^2 + cc->a)
//b = 2 * Vy
//c = -(2 Vy^2 + a Vx);
//
//actually no, since fasterweil won't work if we do this
*/
element_square(a, Vx);
//element_mul_si(a, a, 3);
element_add(b, a, a);
element_add(a, b, a);
element_set1(b);
element_add(a, a, b);
element_neg(a, a);
element_double(b, Vy);
element_div(a, a, b);
element_set1(b);
element_mul(c, a, Vx);
element_add(c, c, Vy);
element_neg(c, c);
element_printf("tan at %B: %B %B %B\n", V, a, b, c);
element_mul(a, a, Qx);
element_mul(b, b, Qy);
element_add(c, c, a);
element_add(z, c, b);
element_printf("tan eval = %B\n", z);
element_clear(a);
element_clear(b);
element_clear(c);
}
typename SolverUnconstrained<Data,Problem>::value_type
SolverUnconstrained<Data,Problem>::xi( vector_type const& __s,
vector_type const& __d,
value_type const& _xi1 )
{
vector_type __frac = - element_div ( __s, __d );
namespace lambda = boost::lambda;
value_type __xi = _xi1;
std::for_each( __frac.begin(), __frac.end(),
lambda::if_then( lambda::_1 > 0 && lambda::_1 < lambda::var( __xi ),
lambda::var( __xi ) = lambda::_1 ) );
return __xi;
}
static int curve_cmp(element_ptr a, element_ptr b) {
if (a == b) {
return 0;
} else {
// If we're working with a quotient group we must account for different
// representatives of the same coset.
curve_data_ptr cdp = (curve_data_ptr)a->field->data;
if (cdp->quotient_cmp) {
element_t e;
element_init_same_as(e, a);
element_div(e, a, b);
element_pow_mpz(e, e, cdp->quotient_cmp);
int result = !element_is1(e);
element_clear(e);
return result;
}
return point_cmp((point_ptr)a->data, (point_ptr)b->data);
}
}
void apply(viennacl::vector<ScalarType, ALIGNMENT> & vec) const
{
assert(viennacl::traits::size(diag_M) == viennacl::traits::size(vec) && bool("Size mismatch"));
vec = element_div(vec, diag_M);
}
void shipseystange(element_t z, element_t P, element_t Q)
{
mpz_t q1r;
mpz_init(q1r);
mpz_set_ui(q1r, 696);
element_ptr x = curve_x_coord(P);
element_ptr y = curve_y_coord(P);
element_ptr x2 = curve_x_coord(Q);
element_ptr y2 = curve_y_coord(Q);
element_t v0m1, v0m2, v0m3;
element_t v00, v01, v02, v03, v04;
element_t v1m1, v10, v11;
element_t t0, t1, t2;
element_t W20inv;
element_t Wm11inv;
element_t W2m1inv;
element_t sm2, sm1, s0, s1, s2, s3;
element_t pm2, pm1, p0, p1, p2, p3;
element_init_same_as(sm2, z);
element_init_same_as(sm1, z);
element_init_same_as(s0, z);
element_init_same_as(s1, z);
element_init_same_as(s2, z);
element_init_same_as(s3, z);
element_init_same_as(pm2, z);
element_init_same_as(pm1, z);
element_init_same_as(p0, z);
element_init_same_as(p1, z);
element_init_same_as(p2, z);
element_init_same_as(p3, z);
element_init_same_as(v0m3, z);
element_init_same_as(v0m2, z);
element_init_same_as(v0m1, z);
element_init_same_as(v00, z);
element_init_same_as(v01, z);
element_init_same_as(v02, z);
element_init_same_as(v03, z);
element_init_same_as(v04, z);
element_init_same_as(v1m1, z);
element_init_same_as(v10, z);
element_init_same_as(v11, z);
element_init_same_as(W20inv, z);
element_init_same_as(Wm11inv, z);
element_init_same_as(W2m1inv, z);
element_init_same_as(t0, z);
element_init_same_as(t1, z);
element_init_same_as(t2, z);
element_set0(v0m1);
element_set1(v00);
element_neg(v0m2, v00);
element_double(v01, y);
element_neg(v0m3, v01);
element_invert(W20inv, v01);
element_sub(Wm11inv, x, x2);
element_square(t1, Wm11inv);
element_invert(Wm11inv, Wm11inv);
element_double(t0, x);
element_add(t0, t0, x2);
element_mul(t1, t0, t1);
element_add(t0, y, y2);
element_square(t0, t0);
element_sub(t0, t0, t1);
element_invert(W2m1inv, t0);
/* Let P=(x,y) since A=1, B=0 we have:
* W(3,0) = 3x^4 + 6x^2 - 1
* W(4,0) = 4y(x^6 + 5x^4 - 5x^2 - 1)
*/
//t0 = x^2
element_square(t0, x);
//t1 = x^4
element_square(t1, t0);
//t2 = x^4 + 2 x^2
element_double(t2, t0);
element_add(t2, t2, t1);
//v02 = W(3,0)
element_double(v02, t2);
element_add(v02, v02, t2);
element_add(v02, v02, v0m2);
//t2 = x^4 - x^2
element_sub(t2, t1, t0);
//v03 = 5(x^4 - x^2)
element_double(v03, t2);
element_double(v03, v03);
element_add(v03, v03, t2);
//t2 = x^6
element_mul(t2, t0, t1);
//v03 = W(4,0)
element_add(v03, v03, t2);
element_add(v03, v03, v0m2);
element_double(v03, v03);
element_double(v03, v03);
element_mul(v03, v03, y);
//v04 = W(5,0) = W(2,0)^3 W(4,0) - W(3,0)^3
element_square(t0, v01);
element_mul(t0, t0, v01);
element_mul(v04, t0, v03);
element_square(t0, v02);
element_mul(t0, t0, v02);
element_sub(v04, v04, t0);
element_set1(v1m1);
element_set1(v10);
element_printf("x y: %B %B\n", x, y);
element_printf("x2 y2: %B %B\n", x2, y2);
element_sub(t0, x2, x);
element_sub(t1, y2, y);
element_div(t0, t1, t0);
element_square(t0, t0);
element_double(v11, x);
element_add(v11, v11, x2);
element_sub(v11, v11, t0);
element_printf("VEC1: %B %B %B\n", v1m1, v10, v11);
element_printf("VEC0: %B %B %B %B %B %B %B %B\n",
v0m3, v0m2, v0m1, v00, v01, v02, v03, v04);
//Double
element_square(sm2, v0m2);
element_square(sm1, v0m1);
element_square(s0, v00);
element_square(s1, v01);
element_square(s2, v02);
element_square(s3, v03);
element_mul(pm2, v0m3, v0m1);
element_mul(pm1, v0m2, v00);
element_mul(p0, v0m1, v01);
element_mul(p1, v00, v02);
element_mul(p2, v01, v03);
element_mul(p3, v02, v04);
element_mul(t0, pm1, sm2);
element_mul(t1, pm2, sm1);
element_sub(v0m3, t0, t1);
element_mul(t1, pm2, s0);
element_mul(t0, p0, sm2);
element_sub(v0m2, t0, t1);
element_mul(v0m2, v0m2, W20inv);
element_mul(t0, p0, sm1);
element_mul(t1, pm1, s0);
element_sub(v0m1, t0, t1);
element_mul(t1, pm1, s1);
element_mul(t0, p1, sm1);
element_sub(v00, t0, t1);
element_mul(v00, v00, W20inv);
element_mul(t0, p1, s0);
element_mul(t1, p0, s1);
element_sub(v01, t0, t1);
element_mul(t1, p0, s2);
element_mul(t0, p2, s0);
element_sub(v02, t0, t1);
element_mul(v02, v02, W20inv);
element_mul(t0, p2, s1);
element_mul(t1, p1, s2);
element_sub(v03, t0, t1);
element_mul(t1, p1, s3);
element_mul(t0, p3, s1);
element_sub(v04, t0, t1);
element_mul(v04, v04, W20inv);
element_square(t0, v10);
element_mul(t1, v1m1, v11);
element_mul(t2, pm1, t0);
element_mul(v1m1, t1, sm1);
element_sub(v1m1, v1m1, t2);
element_mul(t2, p0, t0);
element_mul(v10, t1, s0);
element_sub(v10, v10, t2);
element_mul(t2, p1, t0);
element_mul(v11, t1, s1);
element_sub(v11, v11, t2);
element_mul(v11, v11, Wm11inv);
element_printf("VEC1: %B %B %B\n", v1m1, v10, v11);
element_printf("VEC0: %B %B %B %B %B %B %B %B\n",
v0m3, v0m2, v0m1, v00, v01, v02, v03, v04);
//DoubleAdd
element_square(sm2, v0m2);
element_square(sm1, v0m1);
element_square(s0, v00);
element_square(s1, v01);
element_square(s2, v02);
element_square(s3, v03);
element_mul(pm2, v0m3, v0m1);
element_mul(pm1, v0m2, v00);
element_mul(p0, v0m1, v01);
element_mul(p1, v00, v02);
element_mul(p2, v01, v03);
element_mul(p3, v02, v04);
element_mul(t1, pm2, s0);
element_mul(t0, p0, sm2);
element_sub(v0m3, t0, t1);
element_mul(v0m3, v0m3, W20inv);
element_mul(t0, p0, sm1);
element_mul(t1, pm1, s0);
element_sub(v0m2, t0, t1);
element_mul(t1, pm1, s1);
element_mul(t0, p1, sm1);
element_sub(v0m1, t0, t1);
element_mul(v0m1, v0m1, W20inv);
element_mul(t0, p1, s0);
element_mul(t1, p0, s1);
element_sub(v00, t0, t1);
element_mul(t1, p0, s2);
element_mul(t0, p2, s0);
element_sub(v01, t0, t1);
element_mul(v01, v01, W20inv);
element_mul(t0, p2, s1);
element_mul(t1, p1, s2);
element_sub(v02, t0, t1);
element_mul(t1, p1, s3);
element_mul(t0, p3, s1);
element_sub(v03, t0, t1);
element_mul(v03, v03, W20inv);
element_mul(t0, p3, s2);
element_mul(t1, p2, s3);
element_sub(v04, t0, t1);
element_square(t0, v10);
element_mul(t1, v1m1, v11);
element_mul(t2, p0, t0);
element_mul(v1m1, t1, s0);
element_sub(v1m1, v1m1, t2);
element_mul(t2, p1, t0);
element_mul(v10, t1, s1);
element_sub(v10, v10, t2);
element_mul(v10, v10, Wm11inv);
element_mul(t2, t1, s2);
element_mul(v11, p2, t0);
element_sub(v11, v11, t2);
element_mul(v11, v11, W2m1inv);
element_printf("VEC1: %B %B %B\n", v1m1, v10, v11);
element_printf("VEC0: %B %B %B %B %B %B %B %B\n",
v0m3, v0m2, v0m1, v00, v01, v02, v03, v04);
element_div(z, v11, v01);
element_printf("prepow: %B\n", z);
element_pow_mpz(z, z, q1r);
mpz_clear(q1r);
}
static void mulg_div(element_ptr x, element_t a, element_t b) {
element_div(x->data, a->data, b->data);
}
bool Manager::Verification(string signature, char*mes, int len_mes)
{
//compare variables
bool cmp_value_1=0;
bool cmp_value_2=0;
//elements
element_t T1,T2,T3,T4;
element_t T5, T6, T7;
element_t c_H;
element_t H;
element_t Sp;
element_t Sm;
element_t Sv;
//init
element_init_GT(T1, pairing);
element_init_GT(T2, pairing);
element_init_GT(T3, pairing);
element_init_GT(T4, pairing);
element_init_G1(T5, pairing);
element_init_G1(T6, pairing);
element_init_G1(T7, pairing);
element_init_Zr(Sp,pairing);
element_init_Zr(Sm,pairing);
element_init_Zr(Sv,pairing);
element_init_Zr(H, pairing);
element_init_Zr(c_H, pairing);
SignatureFromString(signature, c_H,Sp,Sm,Sv,T1,T2,T3,T4,T5,T6,T7);
//heshing
Helper::Hash_T1_T2_T3(H,T1,T2,T3);
//compute R1'
element_t tmp_1;
element_t tmp_2;
element_t tmp_3;
element_t R1_;
element_init_GT(R1_, pairing);
element_init_GT(tmp_1, pairing);
element_init_GT(tmp_2, pairing);
element_init_GT(tmp_3, pairing);
element_pairing(tmp_1, g, T7);
element_pow_zn(tmp_2, tmp_1, Sp);
element_pairing(tmp_1, X, T6);
element_pow_zn(tmp_3, tmp_1, Sm);
element_div(R1_, tmp_2, tmp_3);
element_pairing(tmp_3, X, T5);
element_pow_zn(tmp_3, tmp_3, c_H);
element_div(R1_, R1_, tmp_3);
//compute R2'
element_t R2_;
element_init_GT(R2_, pairing);
element_pow_zn(R2_, gt, Sv);
element_pow_zn(tmp_1, T1, c_H);
element_div(R2_, R2_, tmp_1);
//compute R3'
element_t R3_;
element_init_GT(R3_, pairing);
element_pow_zn(tmp_1, h, Sv);
element_pow_zn(tmp_2, T2, c_H);
element_sub(R3_, tmp_1, tmp_2);
//compute R4'
element_t R4_;
element_init_GT(R4_, pairing);
element_pow_zn(tmp_1, y1, Sv);
element_pow_zn(tmp_2, gt, Sm);
element_mul(tmp_3, tmp_1, tmp_2);
element_pow_zn(tmp_1,T3, c_H);
element_sub(R4_, tmp_3, tmp_1);
//compute R5'
element_t R5_;
element_init_GT(R5_, pairing);
element_t tmp_pow;
element_init_Zr(tmp_pow, pairing);
element_t tmp_div;
element_init_GT(tmp_div, pairing);
element_pow_zn(R5_, y2, Sv);
element_pow_zn(tmp_div,y3,H);
element_pow_zn(tmp_div,tmp_div,Sv);
element_mul(R5_,R5_,tmp_div);
element_pow_zn(tmp_div,T4, c_H);
element_div(R5_, R5_, tmp_div);
//check c_H == c_H'
element_t check_c_H;
element_init_Zr(check_c_H, pairing);
Helper::Hash_C(check_c_H,R1_,R2_,R3_,R4_,R5_,g,gt,X,Y,h,y1,y2,y3,mes,len_mes);
//check e(T 5 , Y ) == e(g, T 6 )
element_t check_1;
element_init_GT(check_1, pairing);
element_t check_2;
element_init_GT(check_2, pairing);
element_pairing(check_1, T5,Y);
element_pairing(check_2, g,T6);
//cmp_value_1
cmp_value_1=element_cmp(check_c_H,c_H);//0==ok
//cmp_value_2
cmp_value_2=element_cmp(check_1,check_2);//0==ok
//clear elements
element_clear(T1);
element_clear(T2);
element_clear(T3);
element_clear(T4);
element_clear(T5);
element_clear(T6);
element_clear(T7);
element_clear(Sp);
element_clear(Sm);
element_clear(Sv);
element_clear(H);
element_clear(c_H);
element_clear(R1_);
element_clear(R2_);
element_clear(R3_);
element_clear(R4_);
element_clear(R5_);
element_clear(tmp_1);
element_clear(tmp_2);
element_clear(tmp_3);
element_clear(tmp_pow);
element_clear(tmp_div);
element_clear(check_c_H);
element_clear(check_1);
element_clear(check_2);
if(cmp_value_1||cmp_value_2)
return 0;
else
return 1;
}
int Manager::Open(string sign, char*mes, int len_mes)
{
int ret;
if(Verification(sign, mes, len_mes)!=true)
return -1;
//compare variable
bool cmp_var=0;
//elements
element_t T1,T2,T3,T4;
element_t T5, T6, T7;
element_t H;
element_t Sp;
element_t Sm;
element_t Sv;
element_t c_H;
element_t tmp_pow;
element_t check_T4;
element_t tmp_T2;
element_init_GT(T1, pairing);
element_init_GT(T2, pairing);
element_init_GT(T3, pairing);
element_init_GT(T4, pairing);
element_init_G1(T5, pairing);
element_init_G1(T6, pairing);
element_init_G1(T7, pairing);
element_init_Zr(H, pairing);
element_init_Zr(Sp,pairing);
element_init_Zr(Sm,pairing);
element_init_Zr(Sv,pairing);
element_init_Zr(c_H, pairing);
element_init_Zr(tmp_pow, pairing);
element_init_GT(check_T4, pairing);
element_init_GT(tmp_T2, pairing);
//read sign
SignatureFromString(sign, c_H, Sp, Sm, Sv, T1, T2, T3, T4, T5, T6, T7);
//add verify sign
Helper::Hash_T1_T2_T3(H,T1,T2,T3);
//T4 check
element_mul(tmp_pow, x5,H);
element_add(tmp_pow, tmp_pow,x3);
element_pow_zn(check_T4, T1, tmp_pow);
element_pow_zn(tmp_T2, T2, x4);
element_mul(check_T4, check_T4,tmp_T2);
cmp_var=element_cmp(check_T4,T4);//0==ok
//compute Pi2
element_t check_Pi2;
element_init_GT(check_Pi2, pairing);
element_pow_zn(tmp_T2, T1, x1);
element_pow_zn(check_Pi2, T2, x2);
element_mul(tmp_T2, tmp_T2,check_Pi2);
element_div(check_Pi2, T3,tmp_T2);
//find Pi2 in reg list
if(cmp_var)
ret=-1;
else
ret=SearchInRegistrationList(check_Pi2);
//clear elements
element_clear(T1);
element_clear(T2);
element_clear(T3);
element_clear(T4);
element_clear(T5);
element_clear(T6);
element_clear(T7);
element_clear(H);
element_clear(c_H);
element_clear(Sp);
element_clear(Sm);
element_clear(Sv);
element_clear(tmp_pow);
element_clear(check_T4);
element_clear(tmp_T2);
return ret;
}
bool Manager::JoinMember(string request, string & respond)
{
//elements
element_t Pi1;
element_t Pi2;
element_t Sk;
element_t R;
element_init_G1(Pi1,pairing);
element_init_GT(Pi2, pairing);
element_init_Zr(Sk, pairing);
element_init_G1(R,pairing);
//read & check SoK
string hash;
string hash_check;
RequestFromString(request,hash,Sk,Pi1);
//check Pi1 is point of curve
if(element_item_count(Pi1)!=2)
{
element_clear(Pi1);
element_clear(Pi2);
element_clear(Sk);
element_clear(R);
return 1;//failure
}
element_t tmp1, tmp2;
element_t c_Hsok;
element_init_G1(tmp1, pairing);
element_init_G1(tmp2, pairing);
element_init_Zr(c_Hsok, pairing);
element_from_hash(c_Hsok,(void*)hash.c_str(),hash.length());
element_pow_zn(tmp1,g,Sk);
element_pow_zn(tmp2,Pi1,c_Hsok);
element_div(R,tmp1,tmp2);
hash_check=Helper::Hash_g_R(g,R);
if(hash.compare(hash_check))
{
element_clear(Pi1);
element_clear(Pi2);
element_clear(Sk);
element_clear(R);
element_clear(tmp1);
element_clear(tmp2);
element_clear(c_Hsok);
return 1;//failure
}
//generate r_issuer
element_t issuer_r;
element_init_Zr(issuer_r, pairing);
element_random(issuer_r);
//create a b c
element_t ai;
element_t bi;
element_t ci;
element_t temp_ci1;
element_t temp_ci2;
//init
element_init_G1(ai, pairing);
element_init_G1(bi, pairing);
element_init_G1(ci, pairing);
element_init_G1(temp_ci1, pairing);
element_init_G1(temp_ci2, pairing);
//compute ai bi ci
element_pow_zn(ai,g,issuer_r);//ai
element_pow_zn(bi,ai,y);//bi
element_pow_zn(temp_ci1,ai,x);
element_pow_zn(temp_ci2,Pi1,issuer_r);
element_pow_zn(temp_ci2,temp_ci2,x);
element_pow_zn(temp_ci2,temp_ci2,y);
element_mul(ci,temp_ci1,temp_ci2);//ci
//create RESPOND
respond=MemberSecretToString(ai,bi,ci);
//compute Pi2
element_pairing(Pi2,Pi1,g);
//Write_to_reg_list
AddToRegistrationList(Pi1, Pi2);
//clear elements
element_clear(issuer_r);
element_clear(Pi1);
element_clear(Pi2);
element_clear(temp_ci1);
element_clear(temp_ci2);
element_clear(tmp1);
element_clear(tmp2);
element_clear(c_Hsok);
element_clear(Sk);
element_clear(R);
element_clear(ai);
element_clear(bi);
element_clear(ci);
return 0;//success
}
// x in Z_r, g, h in some group of order r
// finds x such that g^x = h
void element_dlog_pollard_rho(element_t x, element_t g, element_t h) {
// see Blake, Seroussi and Smart
// only one snark for this implementation
int i, s = 20;
field_ptr Zr = x->field, G = g->field;
element_t asum;
element_t bsum;
element_t a[s];
element_t b[s];
element_t m[s];
element_t g0, snark;
darray_t hole;
int interval = 5;
mpz_t counter;
int found = 0;
mpz_init(counter);
element_init(g0, G);
element_init(snark, G);
element_init(asum, Zr);
element_init(bsum, Zr);
darray_init(hole);
//set up multipliers
for (i = 0; i < s; i++) {
element_init(a[i], Zr);
element_init(b[i], Zr);
element_init(m[i], G);
element_random(a[i]);
element_random(b[i]);
element_pow_zn(g0, g, a[i]);
element_pow_zn(m[i], h, b[i]);
element_mul(m[i], m[i], g0);
}
element_random(asum);
element_random(bsum);
element_pow_zn(g0, g, asum);
element_pow_zn(snark, h, bsum);
element_mul(snark, snark, g0);
record(asum, bsum, snark, hole, counter);
for (;;) {
int len = element_length_in_bytes(snark);
unsigned char *buf = pbc_malloc(len);
unsigned char hash = 0;
element_to_bytes(buf, snark);
for (i = 0; i < len; i++) {
hash += buf[i];
}
i = hash % s;
pbc_free(buf);
element_mul(snark, snark, m[i]);
element_add(asum, asum, a[i]);
element_add(bsum, bsum, b[i]);
for (i = 0; i < hole->count; i++) {
snapshot_ptr ss = hole->item[i];
if (!element_cmp(snark, ss->snark)) {
element_sub(bsum, bsum, ss->b);
element_sub(asum, ss->a, asum);
//answer is x such that x * bsum = asum
//complications arise if gcd(bsum, r) > 1
//which can happen if r is not prime
if (!mpz_probab_prime_p(Zr->order, 10)) {
mpz_t za, zb, zd, zm;
mpz_init(za);
mpz_init(zb);
mpz_init(zd);
mpz_init(zm);
element_to_mpz(za, asum);
element_to_mpz(zb, bsum);
mpz_gcd(zd, zb, Zr->order);
mpz_divexact(zm, Zr->order, zd);
mpz_divexact(zb, zb, zd);
//if zd does not divide za there is no solution
mpz_divexact(za, za, zd);
mpz_invert(zb, zb, zm);
mpz_mul(zb, za, zb);
mpz_mod(zb, zb, zm);
do {
element_pow_mpz(g0, g, zb);
if (!element_cmp(g0, h)) {
element_set_mpz(x, zb);
break;
}
mpz_add(zb, zb, zm);
mpz_sub_ui(zd, zd, 1);
} while (mpz_sgn(zd));
mpz_clear(zm);
mpz_clear(za);
mpz_clear(zb);
mpz_clear(zd);
} else {
element_div(x, asum, bsum);
}
found = 1;
break;
}
}
if (found) break;
mpz_add_ui(counter, counter, 1);
if (mpz_tstbit(counter, interval)) {
record(asum, bsum, snark, hole, counter);
interval++;
}
}
for (i = 0; i < s; i++) {
element_clear(a[i]);
element_clear(b[i]);
element_clear(m[i]);
}
element_clear(g0);
element_clear(snark);
for (i = 0; i < hole->count; i++) {
snapshot_ptr ss = hole->item[i];
element_clear(ss->a);
element_clear(ss->b);
element_clear(ss->snark);
pbc_free(ss);
}
darray_clear(hole);
element_clear(asum);
element_clear(bsum);
mpz_clear(counter);
}
// Requires cofactor is even. TODO: This seems to contradict a comment below.
// Requires in != out.
// Mangles in.
static void lucas_even(element_ptr out, element_ptr in, mpz_t cofactor) {
if (element_is1(in)) {
element_set(out, in);
return;
}
element_t temp;
element_init_same_as(temp, out);
element_ptr in0 = element_x(in);
element_ptr in1 = element_y(in);
element_ptr v0 = element_x(out);
element_ptr v1 = element_y(out);
element_ptr t0 = element_x(temp);
element_ptr t1 = element_y(temp);
size_t j;
element_set_si(t0, 2);
element_double(t1, in0);
element_set(v0, t0);
element_set(v1, t1);
j = mpz_sizeinbase(cofactor, 2) - 1;
for (;;) {
if (!j) {
element_mul(v1, v0, v1);
element_sub(v1, v1, t1);
element_square(v0, v0);
element_sub(v0, v0, t0);
break;
}
if (mpz_tstbit(cofactor, j)) {
element_mul(v0, v0, v1);
element_sub(v0, v0, t1);
element_square(v1, v1);
element_sub(v1, v1, t0);
} else {
element_mul(v1, v0, v1);
element_sub(v1, v1, t1);
element_square(v0, v0);
element_sub(v0, v0, t0);
}
j--;
}
// Assume cofactor = (q^2 - q + 1) / r is odd
// thus v1 = V_k, v0 = V_{k-1}
// U = (P v1 - 2 v0) / (P^2 - 4)
element_double(v0, v0);
element_mul(in0, t1, v1);
element_sub(in0, in0, v0);
element_square(t1, t1);
element_sub(t1, t1, t0);
element_sub(t1, t1, t0);
element_halve(v0, v1);
element_div(v1, in0, t1);
element_mul(v1, v1, in1);
element_clear(temp);
}
