>(&self) -> Poly {
328 | let commits = self
329 | .0
330 | .iter()
331 | .map(|c| {
332 | let mut commitment = P::one();
333 | commitment.mul(c);
334 | commitment
335 | })
336 | .collect::>();
337 |
338 | Poly::::from(commits)
339 | }
340 | }
341 |
342 | impl fmt::Display for Poly {
343 | fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
344 | let s = self
345 | .0
346 | .iter()
347 | .enumerate()
348 | .map(|(i, c)| format!("{}: {}", i, c))
349 | .collect::>()
350 | .join(", ");
351 | write!(f, "[deg: {}, coeffs: [{}]]", self.degree(), s)
352 | }
353 | }
354 |
355 | #[cfg(feature = "bls12_381")]
356 | #[cfg(test)]
357 | pub mod tests {
358 | use super::*;
359 | use crate::curve::bls12381::Scalar as Sc;
360 | use crate::curve::bls12381::G1;
361 | use rand::prelude::*;
362 |
363 | #[test]
364 | fn poly_degree() {
365 | let s = 5;
366 | let p = Poly::::new(s);
367 | assert_eq!(p.0.len(), s + 1);
368 | assert_eq!(p.degree(), s);
369 | }
370 |
371 | #[test]
372 | fn add_zero() {
373 | let p1 = Poly::::new(3);
374 | let p2 = Poly::::zero();
375 | let mut res = p1.clone();
376 | res.add(&p2);
377 | assert_eq!(res, p1);
378 |
379 | let p1 = Poly::::zero();
380 | let p2 = Poly::::new(3);
381 | let mut res = p1;
382 | res.add(&p2);
383 | assert_eq!(res, p2);
384 | }
385 |
386 | #[test]
387 | fn mul_by_zero() {
388 | let p1 = Poly::::new(3);
389 | let p2 = Poly::::zero();
390 | let mut res = p1;
391 | res.mul(&p2);
392 | assert_eq!(res, Poly::::zero());
393 |
394 | let p1 = Poly::::zero();
395 | let p2 = Poly::::new(3);
396 | let mut res = p1;
397 | res.mul(&p2);
398 | assert_eq!(res, Poly::::zero());
399 | }
400 |
401 | use proptest::prelude::*;
402 |
403 | proptest! {
404 |
405 | // the coefficients up to the smaller polynomial's degree should be summed up,
406 | // after that they should be the same as the largest one
407 | #[test]
408 | fn addition(deg1 in 0..100usize, deg2 in 0..100usize) {
409 | dbg!(deg1, deg2);
410 | let p1 = Poly::::new(deg1);
411 | let p2 = Poly::::new(deg2);
412 | let mut res = p1.clone();
413 | res.add(&p2);
414 |
415 | let (larger, smaller) = if p1.degree() > p2.degree() {
416 | (&p1, &p2)
417 | } else {
418 | (&p2, &p1)
419 | };
420 |
421 | for i in 0..larger.len() {
422 | if i < smaller.len() {
423 | let mut coeff_sum = p1.0[i];
424 | coeff_sum.add(&p2.0[i]);
425 | assert_eq!(res.0[i], coeff_sum);
426 | } else {
427 | // (this code branch will never get hit when p1.length = p2.length)
428 | assert_eq!(res.0[i], larger.0[i]);
429 | }
430 | }
431 |
432 | // the result has the largest degree
433 | assert_eq!(res.degree(), larger.degree());
434 | }
435 |
436 |
437 | #[test]
438 | fn interpolation(degree in 0..100usize, num_evals in 0..100usize) {
439 | let poly = Poly::::new(degree);
440 | let expected = poly.0[0];
441 |
442 | let shares = (0..num_evals)
443 | .map(|i| poly.eval(i as Idx))
444 | .collect::>();
445 |
446 | let recovered_poly = Poly::::full_recover(num_evals, shares.clone()).unwrap();
447 | let computed = recovered_poly.0[0];
448 |
449 | let recovered_constant = Poly::::recover(num_evals, shares).unwrap();
450 |
451 | // if we had enough evaluations we must get the correct term
452 | if num_evals > degree {
453 | assert_eq!(expected, computed);
454 | assert_eq!(expected, recovered_constant);
455 | } else {
456 | // if there were not enough evaluations, then the call will still succeed
457 | // but will return a mismatching recovered term
458 | assert_ne!(expected, computed);
459 | assert_ne!(expected, recovered_constant);
460 | }
461 | }
462 |
463 | #[test]
464 | fn eval(d in 0..100usize, idx in 0..(100 as Idx)) {
465 | let mut x = Sc::new();
466 | x.set_int(idx as u64 + 1);
467 |
468 | let p1 = Poly::::new(d);
469 | let evaluation = p1.eval(idx).value;
470 |
471 | // Naively calculate \sum c_i * x^i
472 | let coeffs = p1.0;
473 | let mut sum = coeffs[0];
474 | for (i, coeff) in coeffs.into_iter().enumerate().take(d + 1).skip(1) {
475 | let xi = pow(x, i);
476 | let mut var = coeff;
477 | var.mul(&xi);
478 | sum.add(&var);
479 | }
480 |
481 | assert_eq!(sum, evaluation);
482 |
483 | // helper to calculate the power of x
484 | fn pow(base: Sc, pow: usize) -> Sc {
485 | let mut res = Sc::one();
486 | for _ in 0..pow {
487 | res.mul(&base)
488 | }
489 | res
490 | }
491 | }
492 |
493 | }
494 |
495 | #[test]
496 | fn interpolation_insufficient_shares() {
497 | let degree = 4;
498 | let threshold = degree + 1;
499 | let poly = Poly::::new(degree);
500 |
501 | // insufficient shares gathered
502 | let shares = (0..threshold - 1)
503 | .map(|i| poly.eval(i as Idx))
504 | .collect::>();
505 |
506 | Poly::::recover(threshold, shares.clone()).unwrap_err();
507 | Poly::::full_recover(threshold, shares).unwrap_err();
508 | }
509 |
510 | #[test]
511 | fn benchy() {
512 | use std::time::SystemTime;
513 | let degree = 49;
514 | let threshold = degree + 1;
515 | let poly = Poly::::new(degree);
516 | let shares = (0..threshold)
517 | .map(|i| poly.eval(i as Idx))
518 | .collect::>>();
519 | let now = SystemTime::now();
520 | Poly::::recover(threshold as usize, shares).unwrap();
521 | match now.elapsed() {
522 | Ok(e) => println!("single recover: time elapsed {:?}", e),
523 | Err(e) => panic!("{}", e),
524 | }
525 | let shares = (0..threshold)
526 | .map(|i| poly.eval(i as Idx))
527 | .collect::>>();
528 |
529 | let now = SystemTime::now();
530 | Poly::::full_recover(threshold as usize, shares).unwrap();
531 | match now.elapsed() {
532 | Ok(e) => println!("full_recover: time elapsed {:?}", e),
533 | Err(e) => panic!("{}", e),
534 | }
535 | }
536 |
537 | #[test]
538 | fn mul() {
539 | let d = 1;
540 | let p1 = Poly::::new(d);
541 | let p2 = Poly::::new(d);
542 | let mut p3 = p1.clone();
543 | p3.mul(&p2);
544 | assert_eq!(p3.degree(), d + d);
545 | // f1 = c0 + c1 * x
546 | // f2 = d0 + d1 * x
547 | // l1 l2 l3
548 | // f3 = f1 * f2 = (c0*d0) + (c0*d1 + d0*c1) * x + (c1*d1) * x^2
549 |
550 | // f3(1) = l1 + l2 + l3
551 | let mut l1 = p1.0[0];
552 | l1.mul(&p2.0[0]);
553 |
554 | // c0 * d1
555 | let mut l21 = p1.0[0];
556 | l21.mul(&p2.0[1]);
557 |
558 | // d0 * c1
559 | let mut l22 = p1.0[1];
560 | l22.mul(&p2.0[0]);
561 | let mut l2 = Sc::new();
562 | l2.add(&l21);
563 | l2.add(&l22);
564 | let mut l3 = p1.0[1];
565 | l3.mul(&p2.0[1]);
566 |
567 | let mut total = Sc::new();
568 | total.add(&l1);
569 | total.add(&l2);
570 | total.add(&l3);
571 | let res = p3.eval(0);
572 | assert_eq!(total, res.value);
573 | }
574 |
575 | #[test]
576 | fn new_neg_constant() {
577 | let mut constant = Sc::rand(&mut thread_rng());
578 | let p = Poly::::new_neg_constant(constant);
579 |
580 | constant.negate();
581 | let v = vec![constant, Sc::one()];
582 | let res = Poly::from(v);
583 |
584 | assert_eq!(res, p);
585 | }
586 |
587 | #[test]
588 | fn commit() {
589 | let secret = Poly::::new(5);
590 |
591 | let coeffs = secret.0.clone();
592 | let commitment = coeffs
593 | .iter()
594 | .map(|coeff| {
595 | let mut p = G1::one();
596 | p.mul(coeff);
597 | p
598 | })
599 | .collect::>();
600 | let commitment = Poly::from(commitment);
601 |
602 | assert_eq!(commitment, secret.commit::());
603 | }
604 | }
605 |
--------------------------------------------------------------------------------
/crates/threshold-bls/src/sig/blind.rs:
--------------------------------------------------------------------------------
1 | use crate::group::{Element, Point, Scalar};
2 | use crate::sig::bls::{common::BLSScheme, BLSError};
3 | use crate::sig::{BlindScheme, Scheme};
4 | use rand::RngCore;
5 | use serde::{Deserialize, Serialize};
6 | use thiserror::Error;
7 |
8 | /// BlindError are errors which may be returned from a blind signature scheme
9 | #[derive(Debug, Error)]
10 | pub enum BlindError {
11 | /// InvalidToken is thrown out when the token used to unblind can not be
12 | /// inversed. This error should not happen if you use the Token that was
13 | /// returned by the blind operation.
14 | #[error("invalid token")]
15 | InvalidToken,
16 |
17 | /// Raised when (de)serialization fails
18 | #[error("could not deserialize: {0}")]
19 | BincodeError(#[from] bincode::Error),
20 |
21 | #[error("invalid signature verification: {0}")]
22 | SignatureError(#[from] BLSError),
23 | }
24 |
25 | /// Blinding a message before requesting a signature requires the usage of a
26 | /// private blinding factor that is called a Token. To unblind the signature
27 | /// afterwards, one needs the same token as what the blinding method returned.
28 | /// In this blind signature scheme, the token is simply a field element.
29 | #[derive(Clone, Debug, Serialize, Deserialize)]
30 | #[serde(bound = "S: Serialize + serde::de::DeserializeOwned")]
31 | pub struct Token(S);
32 |
33 | impl Default for Token {
34 | fn default() -> Self {
35 | Self::new()
36 | }
37 | }
38 |
39 | impl Token