bool CommitmentProofOfKnowledge::Verify(const Bignum& A, const Bignum& B) const
{
// TODO: First verify that the values
// S1, S2 and S3 and "challenge" are in the correct ranges
if((this->challenge < Bignum(0)) || (this->challenge > (Bignum(2).pow(256) - Bignum(1)))){
return false;
}
// Compute T1 = g1^S1 * h1^S2 * inverse(A^{challenge}) mod p1
Bignum T1 = A.pow_mod(this->challenge, ap->modulus).inverse(ap->modulus).mul_mod(
(ap->g.pow_mod(S1, ap->modulus).mul_mod(ap->h.pow_mod(S2, ap->modulus), ap->modulus)),
ap->modulus);
// Compute T2 = g2^S1 * h2^S3 * inverse(B^{challenge}) mod p2
Bignum T2 = B.pow_mod(this->challenge, bp->modulus).inverse(bp->modulus).mul_mod(
(bp->g.pow_mod(S1, bp->modulus).mul_mod(bp->h.pow_mod(S3, bp->modulus), bp->modulus)),
bp->modulus);
// Hash T1 and T2 along with all of the public parameters
Bignum computedChallenge = calculateChallenge(A, B, T1, T2);
// Return success if the computed challenge matches the incoming challenge
if(computedChallenge == this->challenge){
return true;
}
// Otherwise return failure
return false;
}
/** Verifies that a commitment c is accumulated in accumulator a
*/
bool AccumulatorProofOfKnowledge:: Verify(const Accumulator& a, const Bignum& valueOfCommitmentToCoin) const {
Bignum sg = params->accumulatorPoKCommitmentGroup.g;
Bignum sh = params->accumulatorPoKCommitmentGroup.h;
Bignum g_n = params->accumulatorQRNCommitmentGroup.g;
Bignum h_n = params->accumulatorQRNCommitmentGroup.h;
//According to the proof, this hash should be of length k_prime bits. It is currently greater than that, which should not be a problem, but we should check this.
CHashWriter hasher(0,0);
hasher << *params << sg << sh << g_n << h_n << valueOfCommitmentToCoin << C_e << C_u << C_r << st_1 << st_2 << st_3 << t_1 << t_2 << t_3 << t_4;
Bignum c = Bignum(hasher.GetHash()); //this hash should be of length k_prime bits
Bignum st_1_prime = (valueOfCommitmentToCoin.pow_mod(c, params->accumulatorPoKCommitmentGroup.modulus) * sg.pow_mod(s_alpha, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(s_phi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
Bignum st_2_prime = (sg.pow_mod(c, params->accumulatorPoKCommitmentGroup.modulus) * ((valueOfCommitmentToCoin * sg.inverse(params->accumulatorPoKCommitmentGroup.modulus)).pow_mod(s_gamma, params->accumulatorPoKCommitmentGroup.modulus)) * sh.pow_mod(s_psi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
Bignum st_3_prime = (sg.pow_mod(c, params->accumulatorPoKCommitmentGroup.modulus) * (sg * valueOfCommitmentToCoin).pow_mod(s_sigma, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(s_xi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
Bignum t_1_prime = (C_r.pow_mod(c, params->accumulatorModulus) * h_n.pow_mod(s_zeta, params->accumulatorModulus) * g_n.pow_mod(s_epsilon, params->accumulatorModulus)) % params->accumulatorModulus;
Bignum t_2_prime = (C_e.pow_mod(c, params->accumulatorModulus) * h_n.pow_mod(s_eta, params->accumulatorModulus) * g_n.pow_mod(s_alpha, params->accumulatorModulus)) % params->accumulatorModulus;
Bignum t_3_prime = ((a.getValue()).pow_mod(c, params->accumulatorModulus) * C_u.pow_mod(s_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(s_beta, params->accumulatorModulus))) % params->accumulatorModulus;
Bignum t_4_prime = (C_r.pow_mod(s_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(s_delta, params->accumulatorModulus)) * ((g_n.inverse(params->accumulatorModulus)).pow_mod(s_beta, params->accumulatorModulus))) % params->accumulatorModulus;
bool result = false;
bool result_st1 = (st_1 == st_1_prime);
bool result_st2 = (st_2 == st_2_prime);
bool result_st3 = (st_3 == st_3_prime);
bool result_t1 = (t_1 == t_1_prime);
bool result_t2 = (t_2 == t_2_prime);
bool result_t3 = (t_3 == t_3_prime);
bool result_t4 = (t_4 == t_4_prime);
bool result_range = ((s_alpha >= -(params->maxCoinValue * Bignum(2).pow(params->k_prime + params->k_dprime + 1))) && (s_alpha <= (params->maxCoinValue * Bignum(2).pow(params->k_prime + params->k_dprime + 1))));
result = result_st1 && result_st2 && result_st3 && result_t1 && result_t2 && result_t3 && result_t4 && result_range;
return result;
}
AccumulatorProofOfKnowledge::AccumulatorProofOfKnowledge(const AccumulatorAndProofParams* p,
const Commitment& commitmentToCoin, const AccumulatorWitness& witness,
Accumulator& a): params(p) {
Bignum sg = params->accumulatorPoKCommitmentGroup.g;
Bignum sh = params->accumulatorPoKCommitmentGroup.h;
Bignum g_n = params->accumulatorQRNCommitmentGroup.g;
Bignum h_n = params->accumulatorQRNCommitmentGroup.h;
Bignum e = commitmentToCoin.getContents();
Bignum r = commitmentToCoin.getRandomness();
Bignum r_1 = Bignum::randBignum(params->accumulatorModulus/4);
Bignum r_2 = Bignum::randBignum(params->accumulatorModulus/4);
Bignum r_3 = Bignum::randBignum(params->accumulatorModulus/4);
this->C_e = g_n.pow_mod(e, params->accumulatorModulus) * h_n.pow_mod(r_1, params->accumulatorModulus);
this->C_u = witness.getValue() * h_n.pow_mod(r_2, params->accumulatorModulus);
this->C_r = g_n.pow_mod(r_2, params->accumulatorModulus) * h_n.pow_mod(r_3, params->accumulatorModulus);
Bignum r_alpha = Bignum::randBignum(params->maxCoinValue * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_alpha = 0-r_alpha;
}
Bignum r_gamma = Bignum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
Bignum r_phi = Bignum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
Bignum r_psi = Bignum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
Bignum r_sigma = Bignum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
Bignum r_xi = Bignum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
Bignum r_epsilon = Bignum::randBignum((params->accumulatorModulus/4) * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_epsilon = 0-r_epsilon;
}
Bignum r_eta = Bignum::randBignum((params->accumulatorModulus/4) * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_eta = 0-r_eta;
}
Bignum r_zeta = Bignum::randBignum((params->accumulatorModulus/4) * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_zeta = 0-r_zeta;
}
Bignum r_beta = Bignum::randBignum((params->accumulatorModulus/4) * params->accumulatorPoKCommitmentGroup.modulus * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_beta = 0-r_beta;
}
Bignum r_delta = Bignum::randBignum((params->accumulatorModulus/4) * params->accumulatorPoKCommitmentGroup.modulus * Bignum(2).pow(params->k_prime + params->k_dprime));
if(!(Bignum::randBignum(Bignum(3)) % 2)) {
r_delta = 0-r_delta;
}
this->st_1 = (sg.pow_mod(r_alpha, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_phi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
this->st_2 = (((commitmentToCoin.getCommitmentValue() * sg.inverse(params->accumulatorPoKCommitmentGroup.modulus)).pow_mod(r_gamma, params->accumulatorPoKCommitmentGroup.modulus)) * sh.pow_mod(r_psi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
this->st_3 = ((sg * commitmentToCoin.getCommitmentValue()).pow_mod(r_sigma, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_xi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
this->t_1 = (h_n.pow_mod(r_zeta, params->accumulatorModulus) * g_n.pow_mod(r_epsilon, params->accumulatorModulus)) % params->accumulatorModulus;
this->t_2 = (h_n.pow_mod(r_eta, params->accumulatorModulus) * g_n.pow_mod(r_alpha, params->accumulatorModulus)) % params->accumulatorModulus;
this->t_3 = (C_u.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;
this->t_4 = (C_r.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_delta, params->accumulatorModulus)) * ((g_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;
CHashWriter hasher(0,0);
hasher << *params << sg << sh << g_n << h_n << commitmentToCoin.getCommitmentValue() << C_e << C_u << C_r << st_1 << st_2 << st_3 << t_1 << t_2 << t_3 << t_4;
//According to the proof, this hash should be of length k_prime bits. It is currently greater than that, which should not be a problem, but we should check this.
Bignum c = Bignum(hasher.GetHash());
this->s_alpha = r_alpha - c*e;
this->s_beta = r_beta - c*r_2*e;
this->s_zeta = r_zeta - c*r_3;
this->s_sigma = r_sigma - c*((e+1).inverse(params->accumulatorPoKCommitmentGroup.groupOrder));
this->s_eta = r_eta - c*r_1;
this->s_epsilon = r_epsilon - c*r_2;
this->s_delta = r_delta - c*r_3*e;
this->s_xi = r_xi + c*r*((e+1).inverse(params->accumulatorPoKCommitmentGroup.groupOrder));
this->s_phi = (r_phi - c*r) % params->accumulatorPoKCommitmentGroup.groupOrder;
this->s_gamma = r_gamma - c*((e-1).inverse(params->accumulatorPoKCommitmentGroup.groupOrder));
this->s_psi = r_psi + c*r*((e-1).inverse(params->accumulatorPoKCommitmentGroup.groupOrder));
}
Bignum
generateRandomPrime(uint32_t primeBitLen, uint256 in_seed, uint256 *out_seed,
uint32_t *prime_gen_counter)
{
// Verify that primeBitLen is not too small
if (primeBitLen < 2) {
throw ZerocoinException("Prime length is too short");
}
// If primeBitLen < 33 bits, perform the base case.
if (primeBitLen < 33) {
Bignum result(0);
// Set prime_seed = in_seed, prime_gen_counter = 0.
uint256 prime_seed = in_seed;
(*prime_gen_counter) = 0;
// Loop up to "4 * primeBitLen" iterations.
while ((*prime_gen_counter) < (4 * primeBitLen)) {
// Generate a pseudorandom integer "c" of length primeBitLength bits
uint32_t iteration_count;
Bignum c = generateIntegerFromSeed(primeBitLen, prime_seed, &iteration_count);
#ifdef ZEROCOIN_DEBUG
cout << "generateRandomPrime: primeBitLen = " << primeBitLen << endl;
cout << "Generated c = " << c << endl;
#endif
prime_seed += (iteration_count + 1);
(*prime_gen_counter)++;
// Set "intc" to be the least odd integer >= "c" we just generated
uint32_t intc = c.getulong();
intc = (2 * floor(intc / 2.0)) + 1;
#ifdef ZEROCOIN_DEBUG
cout << "Should be odd. c = " << intc << endl;
cout << "The big num is: c = " << c << endl;
#endif
// Perform trial division on this (relatively small) integer to determine if "intc"
// is prime. If so, return success.
if (primalityTestByTrialDivision(intc)) {
// Return "intc" converted back into a Bignum and "prime_seed". We also updated
// the variable "prime_gen_counter" in previous statements.
result = intc;
*out_seed = prime_seed;
// Success
return result;
}
} // while()
// If we reached this point there was an error finding a candidate prime
// so throw an exception.
throw ZerocoinException("Unable to find prime in Shawe-Taylor algorithm");
// END OF BASE CASE
}
// If primeBitLen >= 33 bits, perform the recursive case.
else {
// Recurse to find a new random prime of roughly half the size
uint32_t newLength = ceil((double)primeBitLen / 2.0) + 1;
Bignum c0 = generateRandomPrime(newLength, in_seed, out_seed, prime_gen_counter);
// Generate a random integer "x" of primeBitLen bits using the output
// of the previous call.
uint32_t numIterations;
Bignum x = generateIntegerFromSeed(primeBitLen, *out_seed, &numIterations);
(*out_seed) += numIterations + 1;
// Compute "t" = ⎡x / (2 * c0⎤
// TODO no Ceiling call
Bignum t = x / (Bignum(2) * c0);
// Repeat the following procedure until we find a prime (or time out)
for (uint32_t testNum = 0; testNum < MAX_PRIMEGEN_ATTEMPTS; testNum++) {
// If ((2 * t * c0) + 1 > 2^{primeBitLen}),
// then t = ⎡2^{primeBitLen} – 1 / (2 * c0)⎤.
if ((Bignum(2) * t * c0) > (Bignum(2).pow(Bignum(primeBitLen)))) {
t = ((Bignum(2).pow(Bignum(primeBitLen))) - Bignum(1)) / (Bignum(2) * c0);
}
// Set c = (2 * t * c0) + 1
Bignum c = (Bignum(2) * t * c0) + Bignum(1);
// Increment prime_gen_counter
(*prime_gen_counter)++;
// Test "c" for primality as follows:
// 1. First pick an integer "a" in between 2 and (c - 2)
Bignum a = generateIntegerFromSeed(c.bitSize(), (*out_seed), &numIterations);
a = Bignum(2) + (a % (c - Bignum(3)));
(*out_seed) += (numIterations + 1);
// 2. Compute "z" = a^{2*t} mod c
Bignum z = a.pow_mod(Bignum(2) * t, c);
// 3. Check if "c" is prime.
// Specifically, verify that gcd((z-1), c) == 1 AND (z^c0 mod c) == 1
// If so we return "c" as our result.
if (c.gcd(z - Bignum(1)).isOne() && z.pow_mod(c0, c).isOne()) {
// Return "c", out_seed and prime_gen_counter
// (the latter two of which were already updated)
return c;
}
// 4. If the test did not succeed, increment "t" and loop
t = t + Bignum(1);
} // end of test loop
}
// We only reach this point if the test loop has iterated MAX_PRIMEGEN_ATTEMPTS
// and failed to identify a valid prime. Throw an exception.
throw ZerocoinException("Unable to generate random prime (too many tests)");
}
void
calculateGroupModulusAndOrder(uint256 seed, uint32_t pLen, uint32_t qLen,
Bignum *resultModulus, Bignum *resultGroupOrder,
uint256 *resultPseed, uint256 *resultQseed)
{
// Verify that the seed length is >= qLen
if (qLen > (sizeof(seed)) * 8) {
// TODO: The use of 256-bit seeds limits us to 256-bit group orders. We should probably change this.
// throw ZerocoinException("Seed is too short to support the required security level.");
}
#ifdef ZEROCOIN_DEBUG
cout << "calculateGroupModulusAndOrder: pLen = " << pLen << endl;
#endif
// Generate a random prime for the group order.
// This may throw an exception, which we'll pass upwards.
// Result is the value "resultGroupOrder", "qseed" and "qgen_counter".
uint256 qseed;
uint32_t qgen_counter;
*resultGroupOrder = generateRandomPrime(qLen, seed, &qseed, &qgen_counter);
// Using ⎡pLen / 2 + 1⎤ as the length and qseed as the input_seed, use the random prime
// routine to obtain p0 , pseed, and pgen_counter. We pass exceptions upward.
uint32_t p0len = ceil((pLen / 2.0) + 1);
uint256 pseed;
uint32_t pgen_counter;
Bignum p0 = generateRandomPrime(p0len, qseed, &pseed, &pgen_counter);
// Set x = 0, old_counter = pgen_counter
uint32_t old_counter = pgen_counter;
// Generate a random integer "x" of pLen bits
uint32_t iterations;
Bignum x = generateIntegerFromSeed(pLen, pseed, &iterations);
pseed += (iterations + 1);
// Set x = 2^{pLen−1} + (x mod 2^{pLen–1}).
Bignum powerOfTwo = Bignum(2).pow(pLen-1);
x = powerOfTwo + (x % powerOfTwo);
// t = ⎡x / (2 * resultGroupOrder * p0)⎤.
// TODO: we don't have a ceiling function
Bignum t = x / (Bignum(2) * (*resultGroupOrder) * p0);
// Now loop until we find a valid prime "p" or we fail due to
// pgen_counter exceeding ((4*pLen) + old_counter).
for ( ; pgen_counter <= ((4*pLen) + old_counter) ; pgen_counter++) {
// If (2 * t * resultGroupOrder * p0 + 1) > 2^{pLen}, then
// t = ⎡2^{pLen−1} / (2 * resultGroupOrder * p0)⎤.
powerOfTwo = Bignum(2).pow(pLen);
Bignum prod = (Bignum(2) * t * (*resultGroupOrder) * p0) + Bignum(1);
if (prod > powerOfTwo) {
// TODO: implement a ceil function
t = Bignum(2).pow(pLen-1) / (Bignum(2) * (*resultGroupOrder) * p0);
}
// Compute a candidate prime resultModulus = 2tqp0 + 1.
*resultModulus = (Bignum(2) * t * (*resultGroupOrder) * p0) + Bignum(1);
// Verify that resultModulus is prime. First generate a pseudorandom integer "a".
Bignum a = generateIntegerFromSeed(pLen, pseed, &iterations);
pseed += iterations + 1;
// Set a = 2 + (a mod (resultModulus–3)).
a = Bignum(2) + (a % ((*resultModulus) - Bignum(3)));
// Set z = a^{2 * t * resultGroupOrder} mod resultModulus
Bignum z = a.pow_mod(Bignum(2) * t * (*resultGroupOrder), (*resultModulus));
// If GCD(z–1, resultModulus) == 1 AND (z^{p0} mod resultModulus == 1)
// then we have found our result. Return.
if ((resultModulus->gcd(z - Bignum(1))).isOne() &&
(z.pow_mod(p0, (*resultModulus))).isOne()) {
// Success! Return the seeds and primes.
*resultPseed = pseed;
*resultQseed = qseed;
return;
}
// This prime did not work out. Increment "t" and try again.
t = t + Bignum(1);
} // loop continues until pgen_counter exceeds a limit
// We reach this point only if we exceeded our maximum iteration count.
// Throw an exception.
throw ZerocoinException("Unable to generate a prime modulus for the group");
}
