forked from cwtch.im/tapir
92 lines
3.0 KiB
Go
92 lines
3.0 KiB
Go
package core
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/bwesterb/go-ristretto"
|
|
"golang.org/x/crypto/sha3"
|
|
"hash"
|
|
"io"
|
|
)
|
|
|
|
// Transcript implements a transcript of a public coin argument.
|
|
//
|
|
// We have the following goals:
|
|
// - Provide a consisted transcript API for our zero knowledge protocols
|
|
// - Allow sequential proofs over a common transcript (ensuring a single proof cannot be extracted standalone)
|
|
// - produce an auditable human-readable transcript.
|
|
//
|
|
// The design of this API was inspired by Merlin: https://docs.rs/crate/merlin/
|
|
//
|
|
// At some point we might want to extend this to be compatible with Merlin transcripts, built on STROBE
|
|
type Transcript struct {
|
|
hash hash.Hash
|
|
transcript string
|
|
}
|
|
|
|
// NewTranscript creates a new Transcript with the given Label, the label should be unique to the application
|
|
func NewTranscript(label string) *Transcript {
|
|
transcript := new(Transcript)
|
|
transcript.hash = sha3.New256()
|
|
transcript.AddToTranscript("protocol", []byte(label))
|
|
return transcript
|
|
}
|
|
|
|
// AddToTranscript appends a value to the transcript with the given label
|
|
// This binds the given data to the label.
|
|
func (t *Transcript) AddToTranscript(label string, b []byte) {
|
|
op := fmt.Sprintf("%s (%d) %x;", label, len(b), b)
|
|
t.transcript = fmt.Sprintf("%v\n%v", t.transcript, op)
|
|
t.hash.Write([]byte(op))
|
|
}
|
|
|
|
// OutputTranscriptToAudit outputs a human-readable copy of the transcript so far.
|
|
func (t Transcript) OutputTranscriptToAudit() string {
|
|
return t.transcript
|
|
}
|
|
|
|
// NewProtocol provides explicit protocol separation in a transcript (more readable audit scripts and even more explicit
|
|
// binding of committed values to a given context)
|
|
func (t *Transcript) NewProtocol(label string) {
|
|
op := fmt.Sprintf("---- new-protcol: %s ----", label)
|
|
t.transcript = fmt.Sprintf("%v\n%v", t.transcript, op)
|
|
t.hash.Write([]byte(op))
|
|
}
|
|
|
|
// CommitToTranscript generates a challenge based on the current transcript, it also commits the challenge to the transcript.
|
|
func (t *Transcript) CommitToTranscript(label string) []byte {
|
|
t.AddToTranscript("commit", []byte(label))
|
|
b := t.hash.Sum([]byte{})
|
|
t.AddToTranscript(label, b)
|
|
return b
|
|
}
|
|
|
|
// PRNG defines a psuedorandom number generator
|
|
type PRNG struct {
|
|
prng io.Reader
|
|
}
|
|
|
|
// Next returns the next "random" scalar from the PRNG
|
|
func (prng *PRNG) Next() *ristretto.Scalar {
|
|
buf := [32]byte{}
|
|
io.ReadFull(prng.prng, buf[:])
|
|
return new(ristretto.Scalar).SetBytes(&buf)
|
|
}
|
|
|
|
// CommitToPRNG commits the label to the transcript and derives a PRNG from the transcript.
|
|
func (t *Transcript) CommitToPRNG(label string) PRNG {
|
|
t.AddToTranscript("commit-prng", []byte(label))
|
|
b := t.hash.Sum([]byte{})
|
|
t.AddToTranscript(label, b)
|
|
prng := sha3.NewShake256()
|
|
prng.Write(b)
|
|
return PRNG{prng: prng}
|
|
}
|
|
|
|
// CommitToTranscriptScalar is a convenience method for CommitToTranscript which returns a ristretto Scalar
|
|
func (t *Transcript) CommitToTranscriptScalar(label string) *ristretto.Scalar {
|
|
c := t.CommitToTranscript(label)
|
|
cs := [32]byte{}
|
|
copy(cs[:], c[:])
|
|
return new(ristretto.Scalar).SetBytes(&cs)
|
|
}
|