feat: new protocol for zk discrete log with El-Gamal commitment #4

jfdreis · 2024-11-25T17:06:05Z

No description provided.

manel1874 · 2025-01-09T11:52:57Z

src/dlog_with_el_gamal_commitment.rs

+//!
+//! //! ## Description
+//!
+//! A party P has `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y`,


Suggested change

//! A party P has `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y`,

//! A party P has `L = g ^ lambda`, `M = (g ^ y) * (X ^ lambda)`, and `Y = h ^ y`,

manel1874 · 2025-01-09T11:54:11Z

src/dlog_with_el_gamal_commitment.rs

+//! with g being a generator of curve `E`, h is a point of the curve 
+//! and X is a public key (and a point of the curve).


Suggested change

//! with g being a generator of curve `E`, h is a point of the curve

//! and X is a public key (and a point of the curve).

//! with g being a generator of curve `E`, h is a point on the curve

//! and X is a public key (and a point on the curve).

manel1874 · 2025-01-09T12:27:14Z

src/dlog_with_el_gamal_commitment.rs

+//!
+//! Given:
+//! - Curve `E`
+//! - `X` - public key, point of the curve


Suggested change

//! - `X` - public key, point of the curve

//! - `X` - public key, point on the curve

manel1874 · 2025-01-09T12:27:36Z

src/dlog_with_el_gamal_commitment.rs

+//! Given:
+//! - Curve `E`
+//! - `X` - public key, point of the curve
+//! - `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y` - data to obtain proof about


Suggested change

//! - `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y` - data to obtain proof about

//! - `L = g * lambda`, `M = (g ^ y) * (X ^ lambda)`, and `Y = h ^ y` - data to obtain proof about

manel1874 · 2025-01-09T12:28:14Z

src/dlog_with_el_gamal_commitment.rs

+//! - `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y` - data to obtain proof about
+//!
+//! Prove:
+//! - `logarithm base h of Y= lambda`


Suggested change

//! - `logarithm base h of Y= lambda`

//! - `logarithm base h of Y= y`

Right?

manel1874 · 2025-01-09T12:29:55Z

src/dlog_with_el_gamal_commitment.rs

+//!
+//! // 1. Setup: prover prepares the public key X
+//!
+//! // X in paper is a point of the Curve E


Suggested change

//! // X in paper is a point of the Curve E

//! // X in paper is a point on the Curve E

manel1874 · 2025-01-09T12:30:18Z

src/dlog_with_el_gamal_commitment.rs

+//! // X in paper is a point of the Curve E
+//! let x = Point::<E>::generator() * Scalar::random(&mut rng);
+//! 
+//! // h in paper is a point of the Curve E


Suggested change

//! // h in paper is a point of the Curve E

//! // h in paper is a point on the Curve E

manel1874 · 2025-01-09T12:33:37Z

src/dlog_with_el_gamal_commitment.rs

+//! // y in paper
+//! let y = Integer::from_rng_pm(&security.q,&mut rng);
+//! // lambda in paper
+//! let lambda = Integer::from_rng_pm(&security.q,&mut rng);
+//!
+//! // 3. Setup: prover encrypts everything on correct keys
+//!
+//! // L in paper
+//! let l = Point::<C>::generator() * lambda.to_scalar();
+//! // M in paper
+//! let m = Point::<C>::generator() * y.to_scalar() + x * lambda.to_scalar();
+//! // Y in paper
+//! let h_to_y = h * y.to_scalar();


Suggested change

//! // y in paper

//! let y = Integer::from_rng_pm(&security.q,&mut rng);

//! // lambda in paper

//! let lambda = Integer::from_rng_pm(&security.q,&mut rng);

//!

//! // 3. Setup: prover encrypts everything on correct keys

//!

//! // L in paper

//! let l = Point::<C>::generator() * lambda.to_scalar();

//! // M in paper

//! let m = Point::<C>::generator() * y.to_scalar() + x * lambda.to_scalar();

//! // Y in paper

//! let h_to_y = h * y.to_scalar();

//! // y in paper

//! let plaintext_y = Integer::from_rng_pm(&security.q,&mut rng);

//! // lambda in paper

//! let plaintext_lambda = Integer::from_rng_pm(&security.q,&mut rng);

//!

//! // 3. Setup: prover encrypts everything on correct keys

//!

//! // L in paper

//! let ciphertext_l = Point::<C>::generator() * plaintext_lambda.to_scalar();

//! // M in paper

//! let ciphertext_m = Point::<C>::generator() * plaintext_y.to_scalar() + x * plaintext_lambda.to_scalar();

//! // Y in paper

//! let ciphertext_h_to_y = h * plaintext_y.to_scalar();

manel1874 · 2025-01-09T12:34:43Z

src/dlog_with_el_gamal_commitment.rs

+//! //    and lambda are the same
+//!
+//! let data = p::Data {
+//!     key0: &key0,


Suggested change

//! key0: &key0,

I don't believe we are using a key0.

manel1874 · 2025-01-09T12:37:28Z

src/dlog_with_el_gamal_commitment.rs

+//!     l: &l,
+//!     m: &m,
+//!     x: &x,
+//!     h_to_y: &h_to_y,


Suggested change

//! l: &l,

//! m: &m,

//! x: &x,

//! h_to_y: &h_to_y,

//! l: &ciphertext_l,

//! m: &ciphertext_m,

//! x: &x,

//! h_to_y: &ciphertext_h_to_y,

manel1874 · 2025-01-09T12:37:53Z

src/dlog_with_el_gamal_commitment.rs

+//!     y: &y,
+//!     lambda: &lambda,


Suggested change

//! y: &y,

//! lambda: &lambda,

//! y: &plaintext_y,

//! lambda: &plaintext_lambda,

manel1874 · 2025-01-09T12:43:04Z

src/dlog_with_el_gamal_commitment.rs

+    pub lambda: &'a Integer,
+}
+
+// As described in cggmp21 at page 35


Suggested change

// As described in cggmp21 at page 35

// As described in cggmp24 at page 57

manel1874 · 2025-01-09T12:44:36Z

src/dlog_with_el_gamal_commitment.rs

+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize), serde(bound = ""))]
+pub struct Commitment<C: Curve> {
+    pub a: Point<C>,
+    pub cap_n: Point<C>,


cap_n stands for capital n? Why are the others (a, b) not following the same naming?

manel1874 · 2025-01-09T12:46:35Z

src/dlog_with_el_gamal_commitment.rs

+        let alpha = Integer::gen_invertible(&Integer::curve_order::<C>(), &mut rng);
+        let m = Integer::gen_invertible(&Integer::curve_order::<C>(), &mut rng);
+
+


Suggested change

manel1874 · 2025-01-09T12:49:30Z

src/dlog_with_el_gamal_commitment.rs

+
+
+        let a= Point::<C>::generator() * alpha.to_scalar();
+        let enne= Point::<C>::generator() * m.to_scalar() + data.x * alpha.to_scalar();


Why not cap_n?

manel1874 · 2025-01-09T12:52:22Z

src/dlog_with_el_gamal_commitment.rs

+        challenge: &Challenge,
+        proof: &Proof,
+    ) -> Result<(), InvalidProof> {
+        // Three equality checks and two range checks


Suggested change

// Three equality checks and two range checks

// Three equality checks

manel1874 · 2025-01-09T13:34:39Z

src/dlog_with_el_gamal_commitment.rs

+        let security = super::SecurityParams {
+            q: (Integer::ONE << 128_u32).into(),
+        };
+        let y =         Integer::from_rng_pm(&security.q,&mut rng);


Suggested change

let y = Integer::from_rng_pm(&security.q,&mut rng);

let y = Integer::from_rng_pm(&security.q,&mut rng);

manel1874 · 2025-01-09T13:35:16Z

src/dlog_with_el_gamal_commitment.rs

+        let security = super::SecurityParams {
+            q: (Integer::ONE << 128_u32).into(),
+        };
+        let y =         Integer::from_rng_pm(&security.q,&mut rng);


Suggested change

let y = Integer::from_rng_pm(&security.q,&mut rng);

let y = Integer::from_rng_pm(&security.q, &mut rng);

manel1874 · 2025-01-09T13:36:05Z

src/dlog_with_el_gamal_commitment.rs

+        let lambda = Integer::from_rng_pm(&security.q,&mut rng);
+        let false_lambda = Integer::from_rng_pm(&security.q,&mut rng);


Suggested change

let lambda = Integer::from_rng_pm(&security.q,&mut rng);

let false_lambda = Integer::from_rng_pm(&security.q,&mut rng);

let lambda = Integer::from_rng_pm(&security.q, &mut rng);

let false_lambda = Integer::from_rng_pm(&security.q, &mut rng);

manel1874 · 2025-01-09T13:37:10Z

src/dlog_with_el_gamal_commitment.rs

+        let y =         Integer::from_rng_pm(&security.q,&mut rng);
+        let lambda = Integer::from_rng_pm(&security.q,&mut rng);
+        let false_y =         Integer::from_rng_pm(&security.q,&mut rng);


Suggested change

let y = Integer::from_rng_pm(&security.q,&mut rng);

let lambda = Integer::from_rng_pm(&security.q,&mut rng);

let false_y = Integer::from_rng_pm(&security.q,&mut rng);

let y = Integer::from_rng_pm(&security.q, &mut rng);

let lambda = Integer::from_rng_pm(&security.q, &mut rng);

let false_y = Integer::from_rng_pm(&security.q, &mut rng);

manel1874

Can you run cargo fmt?

It seems good to go!

feat: new protocol for zk discrete log with El-Gamal commitment

7372d7d

jfdreis requested a review from manel1874 November 25, 2024 17:06

manel1874 reviewed Jan 9, 2025

View reviewed changes

manel1874 approved these changes Jan 9, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: new protocol for zk discrete log with El-Gamal commitment #4

feat: new protocol for zk discrete log with El-Gamal commitment #4

jfdreis commented Nov 25, 2024

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025 •

edited

Loading

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025 •

edited

Loading

manel1874 Jan 9, 2025

manel1874 Jan 9, 2025

manel1874 left a comment

	//! A party P has `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y`,
	//! A party P has `L = g ^ lambda`, `M = (g ^ y) * (X ^ lambda)`, and `Y = h ^ y`,

		//! with g being a generator of curve `E`, h is a point of the curve
		//! and X is a public key (and a point of the curve).

	//! - `X` - public key, point of the curve
	//! - `X` - public key, point on the curve

	//! - `L = g * lambda`, `M = (g * y) (X * lambda)`, and `Y = h * y` - data to obtain proof about
	//! - `L = g * lambda`, `M = (g ^ y) * (X ^ lambda)`, and `Y = h ^ y` - data to obtain proof about

	//! - `logarithm base h of Y= lambda`
	//! - `logarithm base h of Y= y`

	//! // X in paper is a point of the Curve E
	//! // X in paper is a point on the Curve E

	//! // h in paper is a point of the Curve E
	//! // h in paper is a point on the Curve E

	// As described in cggmp21 at page 35
	// As described in cggmp24 at page 57

		let alpha = Integer::gen_invertible(&Integer::curve_order::<C>(), &mut rng);
		let m = Integer::gen_invertible(&Integer::curve_order::<C>(), &mut rng);



		let a= Point::<C>::generator() * alpha.to_scalar();
		let enne= Point::<C>::generator() * m.to_scalar() + data.x * alpha.to_scalar();

	// Three equality checks and two range checks
	// Three equality checks

	let y = Integer::from_rng_pm(&security.q,&mut rng);
	let y = Integer::from_rng_pm(&security.q,&mut rng);

		let lambda = Integer::from_rng_pm(&security.q,&mut rng);
		let false_lambda = Integer::from_rng_pm(&security.q,&mut rng);

feat: new protocol for zk discrete log with El-Gamal commitment #4

Are you sure you want to change the base?

feat: new protocol for zk discrete log with El-Gamal commitment #4

Conversation

jfdreis commented Nov 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

manel1874 Jan 9, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

manel1874 Jan 9, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

manel1874 left a comment

Choose a reason for hiding this comment

manel1874 Jan 9, 2025 •

edited

Loading

manel1874 Jan 9, 2025 •

edited

Loading