Prefer the Pow trait #179

dvdplm · 2025-01-23T14:48:16Z

This PR removes the Exponentiable trait and its implementations for SecretSigned, SecretUnsigned and PublicSigned. It's up for debate whether this is actually better, but I think it's a little bit cleaner and may be helpful for tricks like "exponentiation with known totient"? The downside is that now the wrapper types are public.

EDIT: Rebased this on top of #173 t to be able to check for regressions (looks good).

group                                      no-exponentiable
-----                                      ----------------
AffG proof/prove                           1.00     90.5±0.36ms        ? ?/sec
AffG proof/verify                          1.00     68.0±4.82ms        ? ?/sec
Dec proof/prove                            1.00     39.5±1.03ms        ? ?/sec
Dec proof/verify                           1.00     33.3±6.40ms        ? ?/sec
Enc proof/prove                            1.00     35.8±1.72ms        ? ?/sec
Enc proof/verify                           1.00     31.6±6.75ms        ? ?/sec
LogStar proof/prove                        1.00     36.1±1.14ms        ? ?/sec
LogStar proof/verify                       1.00     30.7±6.52ms        ? ?/sec
MulStar proof/prove                        1.00     51.4±1.44ms        ? ?/sec
MulStar proof/verify                       1.00     36.4±6.38ms        ? ?/sec
Paillier multiplication proof/prove        1.00     49.0±1.19ms        ? ?/sec
Paillier multiplication proof/verify       1.00     52.5±7.58ms        ? ?/sec
Paillier-Blum modulus proof/prove          1.00    627.7±1.18ms        ? ?/sec
Paillier-Blum modulus proof/verify         1.00    278.6±0.71ms        ? ?/sec
Pedersen Ring params (prm) proof/prove     1.00    274.2±1.61ms        ? ?/sec
Pedersen Ring params (prm) proof/verify    1.00    274.2±1.05ms        ? ?/sec
Schnorr (sch) proof/prove                  1.00      7.8±0.02µs        ? ?/sec
Schnorr (sch) proof/verify                 1.00     62.7±0.06µs        ? ?/sec
fac proof/prove                            1.00     59.3±0.30ms        ? ?/sec
fac proof/verify                           1.00     47.6±3.49ms        ? ?/sec

…-clippy#13885)

codecov · 2025-01-23T14:51:05Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.47%. Comparing base (a3bbfc6) to head (dc4ed8a).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #179      +/-   ##
==========================================
+ Coverage   92.46%   92.47%   +0.01%     
==========================================
  Files          35       35              
  Lines        7030     7031       +1     
==========================================
+ Hits         6500     6502       +2     
+ Misses        530      529       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

dvdplm · 2025-01-23T14:53:45Z

synedrion/src/paillier/params.rs

+        + Pow<SecretUnsigned<Self::Uint>>
+        + Pow<PublicSigned<Self::Uint>>
+        + Pow<PublicSigned<Self::WideUint>>
+        + Pow<PublicSigned<Self::ExtraWideUint>>
+        + Pow<SecretSigned<Self::Uint>>
+        + Pow<SecretSigned<Self::WideUint>>
+        + Pow<SecretSigned<Self::ExtraWideUint>>


This is a bit nasty. :/

dvdplm · 2025-01-23T14:54:19Z

synedrion/src/tools/secret.rs

@@ -23,7 +23,7 @@ use crate::{
 /// - Safe `Clone` implementation (without needing to impl `CloneableSecret`)
 /// - Safe `Debug` implementation
 /// - Safe serialization/deserialization (down to `serde` API; what happens there we cannot control)
-pub(crate) struct Secret<T: Zeroize>(SecretBox<T>);
+pub struct Secret<T: Zeroize>(SecretBox<T>);


Having to make the wrapper types pub is unfortunate.

fjarri · 2025-01-24T06:14:44Z

synedrion/src/paillier/encryption.rs

@@ -294,7 +294,9 @@ impl<P: PaillierParams> Ciphertext<P> {
        // To isolate `rho`, calculate `(rho^N)^(N^(-1)) mod N`.
        // The order of `Z_N` is `phi(N)`, so the inversion in the exponent is modulo `phi(N)`.
        let sk_inv_modulus = sk.inv_modulus();
-        let randomizer_mod = Secret::init_with(|| ciphertext_mod_n.pow(sk_inv_modulus));
+        let randomizer_mod = Secret::init_with(|| {
+            ciphertext_mod_n.pow_bounded_exp(sk_inv_modulus.expose_secret(), sk_inv_modulus.bound())


Shouldn't pow() work here?

It should, good catch. This was a left-over from early experimentation.

fjarri · 2025-01-24T06:17:35Z

and may be helpful for tricks like "exponentiation with known totient"?

Is it actually helpful? I think that's the crucial thing here. I would say that using macros and making internal types public is a downside, so what are we getting for it?

dvdplm · 2025-01-24T08:05:48Z

Is it actually helpful? I think that's the crucial thing here. I would say that using macros and making internal types public is a downside, so what are we getting for it?

Indeed, I'm not convinced myself. I think it is useful (or even required) to have this to make using the MultiExponentiate feature possible/easier.

I'll put this back as draft and collect some more info on how/if it's useful.

dvdplm added 19 commits January 8, 2025 10:22

Synthetic benchmark for exponentiation with known totient

bf9acac

Initial benchmark for Fac proof

a6e4168

Init tracing for FacProof benches

936fceb

Add test that exercise the ser-/deserialization of FacProof

3d8ebf0

Add benchmark for AffG

72355d1

mod.rs is not allowed and other clippy fixes

e225fb2

Allow formatting args in string literals

0c78a5c

Benchmark for DecProof construction and verification

0d748b7

Add Enc proof

0e9b77c

Add Paillier Mul proof benchmark

c310e31

Clippy fixes

b6c79c9

moar clippy crap

6f88bef

Add benches for Prm and Sch proofs

7cf86ec

Remove workaround for broken/quirky clippy on nightly (rust-lang/rust…

30cc953

…-clippy#13885)

Prm proofs are broken for now

5eedb88

Appease clippy

d45d19c

Don't use a PublicSigned for PrmProof

05d714b

Merge branch 'master' into dp-zk-proof-benches

6ad3132

Re-enable Prm benchmark

58d9fb4

dvdplm self-assigned this Jan 23, 2025

dvdplm requested a review from fjarri January 23, 2025 14:52

dvdplm commented Jan 23, 2025

View reviewed changes

fjarri reviewed Jan 24, 2025

View reviewed changes

dvdplm marked this pull request as draft January 24, 2025 08:07

dvdplm and others added 2 commits January 27, 2025 14:17

Upgrade to crypto-bigint rc.8 (#177)

c5bde71

Add a changelog reference

1acdee2

dvdplm added 4 commits January 27, 2025 14:17

Replace the Exponentiable trait with Pow

f003eaa

Move impls into a macro, make the wrapper types pub

8842d50

cleanup

8dfe504

Prefer pow()

43d6bf7

dvdplm force-pushed the dp-remove-exponentiable-trait branch from dc4ed8a to 43d6bf7 Compare January 27, 2025 13:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prefer the Pow trait #179

Prefer the Pow trait #179

dvdplm commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading

dvdplm Jan 23, 2025

dvdplm Jan 23, 2025

fjarri Jan 24, 2025

dvdplm Jan 24, 2025

fjarri commented Jan 24, 2025

dvdplm commented Jan 24, 2025

Prefer the Pow trait #179

Are you sure you want to change the base?

Prefer the Pow trait #179

Conversation

dvdplm commented Jan 23, 2025 • edited Loading

codecov bot commented Jan 23, 2025 • edited Loading

Codecov Report

dvdplm Jan 23, 2025

Choose a reason for hiding this comment

dvdplm Jan 23, 2025

Choose a reason for hiding this comment

fjarri Jan 24, 2025

Choose a reason for hiding this comment

dvdplm Jan 24, 2025

Choose a reason for hiding this comment

fjarri commented Jan 24, 2025

dvdplm commented Jan 24, 2025

dvdplm commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading