sigmaprotocol.py 51.7 KB
Newer Older
root's avatar
root committed
1
"""
Aditya Damodaran's avatar
Aditya Damodaran committed
2
3
4
SPDX-FileCopyrightText: 2021 University of Luxembourg
SPDX-License-Identifier: GPL-3.0-or-later
SPDXVersion: SPDX-2.2
Aditya Damodaran's avatar
Aditya Damodaran committed
5

Aditya Damodaran's avatar
Aditya Damodaran committed
6
7
8
Authors: 
       Aditya Damodaran, aditya.damodaran@uni.lu
       Alfredo Rial, alfredo.rial@uni.lu
root's avatar
root committed
9
"""
Aditya Damodaran's avatar
Aditya Damodaran committed
10

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
11
import json
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
12
from collections import namedtuple
Aditya Damodaran's avatar
Aditya Damodaran committed
13

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
14
from charm.core.engine.util import objectToBytes, bytesToObject
root's avatar
root committed
15
from charm.toolbox.pairinggroup import PairingGroup, pair, ZR, G2
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
from charm.toolbox.integergroup import RSAGroup
from charm.core.engine.util import serializeList
from charm.core.math.integer import integer

from uuhd.jsonobjects import (
    ZKWitness,
    ZKInstance,
    SubWitnessRecord,
    dict_from_class,
)
from uuhd.primitives import DSA, PaillierEncryption, SHA256, IntegerCommitment

pairing_group = PairingGroup("BN256")


def get_record_by_index(index, list):
    for item in list:
        if item["index"] == index:
            return item

root's avatar
root committed
36
37
38
39
def get_record_by_i(index, list):
    for item in list:
        if item["i"] == index:
            return item
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
40
41
42
43
44
45
46

def generate_n_random_exponents(n):
    exponents = []
    for i in range(0, n):
        exponents.append(pairing_group.random(ZR))
    return exponents

root's avatar
root committed
47
48
49
50
def num_to_str(num, length):
    str_num = str(num)
    if len(str_num) < length:
        str_num = "0" * (length - len(str_num)) + str_num
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
51

root's avatar
root committed
52
    return str_num
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
53
54


root's avatar
root committed
55
def sign_u(i, g, x):
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
56
57
    return g ** ((x + i) ** -1)

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
58
59
60
61
62
63
64
65
66
67
68
69

class SigmaProtocol:
    def __init__(self, instance, pairing_group_string, keylength):

        self.r_d, self.s_d, self.t_d = (
            instance["bsig"]["Rd"],
            instance["bsig"]["Sd"],
            instance["bsig"]["Td"],
        )

        public_key = instance["pk"]

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
70
        self.v, self.w_1, self.w_2, self.z, self.u_1 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
71
72
73
74
75
76
            public_key["V"],
            public_key["W"][1],
            public_key["W"][2],
            public_key["Z"],
            public_key["U"][1],
        )
Aditya Damodaran's avatar
Aditya Damodaran committed
77

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
        self.keylength = keylength

        self.one = 1

        self.g, self.gt = instance["par"]["g"], instance["par"]["h"]
        self.h, self.ht = instance["bh"], instance["bht"]

        self.vcomd, self.comd = instance["vcomd"], instance["comd"]

        self.ped_h, self.ped_g = (
            instance["par_c"]["h"],
            instance["par_c"]["g"],
        )  # self.g

        self.sid = instance["sid"]

        self.instance = instance

        dsa_p = integer(
            156053402631691285300957066846581395905893621007563090607988086498527791650834395958624527746916581251903190331297268907675919283232442999706619659475326192111220545726433895802392432934926242553363253333261282122117343404703514696108330984423475697798156574052962658373571332699002716083130212467463571362679
        )

        dsa_q = integer(
            78026701315845642650478533423290697952946810503781545303994043249263895825417197979312263873458290625951595165648634453837959641616221499853309829737663096055610272863216947901196216467463121276681626666630641061058671702351757348054165492211737848899078287026481329186785666349501358041565106233731785681339
        )

Aditya Damodaran's avatar
Aditya Damodaran committed
104
        self.dsa = DSA(dsa_p, dsa_q)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
105
106
107
108
109
110
111
112
113
114
115
116
117
118
        self.dsa_keys = self.dsa.generate_keys(keylength)

        rsa_group = RSAGroup()

        self.paillier_encryption = PaillierEncryption(rsa_group)
        (self.public_key, self.secret_key) = self.paillier_encryption.keygen(
            self.keylength
        )
        ic_p = integer(
            333437049425486136095925931727629203622119239282802038455917646172563395024265917241890473852501318262109839243221497854682815506880304349748481648877420618747530394310060738051284980323398797638078562462943477904211178707988798971266777314022673227003284335883622084916018185539789562312940907090712386355299
        )
        ic_q = integer(
            294092988306368388636535355362351220952777074915662080329740789451817968606482246364359892865057621298389179478994706465098262699509935804409002480293234947971872131356003427444279672200378079370695651721652248116723483318427208508192689675310517884904089979454005634358395042846262967137935407297336359215239
        )
Aditya Damodaran's avatar
Aditya Damodaran committed
119
120

        self.integer_commitment = IntegerCommitment(ic_p, ic_q, self.keylength)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
121
122
123

        self.par_ic = self.integer_commitment.setup()

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
124
    def compute_ppe_1(self, d_1, d_2, d_3, d_4, side):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
125
126
127
128
        if side == "lhs":
            return (
                (pair(self.r_d, self.v) ** self.one)
                * (pair(self.s_d, self.gt) ** self.one)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
129
130
                * (pair(self.vcomd, self.w_1) ** self.one)
                * (pair(self.comd, self.w_2) ** self.one)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
131
132
133
134
                * (pair(self.g, self.z) ** -1)
            )
        else:
            return (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
135
136
137
138
                (pair(self.h, self.v) ** d_1)
                * (pair(self.h, self.gt) ** d_2)
                * (pair(self.g, self.w_1) ** d_3)
                * (pair(self.ped_h, self.w_2) ** d_4)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
139
140
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
141
    def compute_ppe_2(self, d_1, d_5, side):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
142
143
144
        if side == "lhs":
            return (
                (pair(self.r_d, self.t_d) ** self.one)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
145
                * (pair(self.u_1, (self.gt ** self.sid)) ** self.one)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
146
                * (pair(self.g, self.gt) ** -1)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
147
                * (pair(self.h, self.ht) ** (d_1 * d_5))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
148
149
            )
        else:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
150
151
            return (pair(self.r_d, self.ht) ** d_5) * (
                pair(self.h, self.t_d) ** d_1
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
            )

    def compute_ppe_3(self, index, i, copen_i, side):
        record = get_record_by_index(index, self.instance["ins_i"])
        if side == "lhs":
            return pair(record["ccom_i"], self.gt) ** self.one
        else:
            return (pair(self.ped_g, self.gt) ** i) * (
                pair(self.ped_h, self.gt) ** copen_i
            )

    def compute_ppe_4(self, index, vr, copen_ri, side):
        record = get_record_by_index(index, self.instance["ins_i"])
        if side == "lhs":
            return pair(record["ccom_ri"], self.gt) ** self.one
        else:
            return (pair(self.ped_g, self.gt) ** vr) * (
                pair(self.ped_h, self.gt) ** copen_ri
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
172
    def compute_ppe_5(self, index, d_i_1, d_i_2, i, side):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
173
174
175
176
177
        record = get_record_by_index(index, self.instance["ins_i"])
        if side == "lhs":
            return (
                (pair(record["sig"]["R_id"], self.v) ** self.one)
                * (pair(record["sig"]["S_id"], self.gt) ** self.one)
root's avatar
root committed
178
                * (pair(self.g ** self.sid, self.w_2) ** self.one)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
179
180
181
182
                * (pair(self.g, self.z) ** -1)
            )
        else:
            return (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
183
184
                (pair(self.h, self.v) ** d_i_1)
                * (pair(self.h, self.gt) ** d_i_2)
root's avatar
root committed
185
                * (pair(self.g, self.w_1) ** -i)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
186
187
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
188
    def compute_ppe_6(self, index, d_i_1, d_i_3, d_i_4, side):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
189
190
191
192
193
194
195
        record = get_record_by_index(index, self.instance["ins_i"])
        if side == "lhs":
            return (
                (
                    pair(record["sig"]["R_id"], record["sig"]["T_id"])
                    ** self.one
                )
root's avatar
root committed
196
                * (pair(self.u_1, record["phd_i"]) ** self.one)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
197
                * (pair(self.h, self.ht) ** (d_i_1 * d_i_3))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
198
199
200
201
202
                * (pair(self.g, self.gt) ** -1)
            )

        else:
            return (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
203
204
                (pair(record["sig"]["R_id"], self.ht) ** d_i_3)
                * (pair(self.h, record["sig"]["T_id"]) ** d_i_1)
root's avatar
root committed
205
                * (pair(self.u_1, self.ht) ** d_i_4)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
206
207
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
208
    def compute_ppe_7(self, index, d_i_4, d_i_5, vr, side):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
209
210
211
212
213
214
215
        record = get_record_by_index(index, self.instance["ins_i"])
        if side == "lhs":
            return (pair(self.vcomd, record["phd_i"]) ** 1) * (
                pair(record["witd_i"], self.gt) ** -self.one
            )
        else:
            return (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
216
217
                (pair(self.vcomd, self.ht) ** d_i_4)
                * (pair(self.h, self.gt) ** -d_i_5)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
218
219
220
221
222
223
224
225
226
227
228
                * (
                    pair(
                        self.instance["par"]["par_g"][1],
                        self.instance["par"]["par_h"][
                            len(self.instance["par"]["par_h"]) - 1
                        ],
                    )
                    ** vr
                )
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
229
230
231
232
233
234
235
236
    def compute_s(
        self,
        random_witness,
        c,
        witness,
        random_integer_openings,
        witness_integer_openings,
    ):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
237
238
239
        s_j = ZKWitness()
        hashes_j = ZKWitness()

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
240
        r_1, r_2, r_3, r_4, r_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
241
242
243
244
245
246
            random_witness["d1"],
            random_witness["d2"],
            random_witness["d3"],
            random_witness["d4"],
            random_witness["d5"],
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
247
248
249
250
251
252
        hash_r_1, hash_r_2, hash_r_3, hash_r_4, hash_r_5 = (
            integer(SHA256(bytes(str(r_1), "utf-8"))),
            integer(SHA256(bytes(str(r_2), "utf-8"))),
            integer(SHA256(bytes(str(r_3), "utf-8"))),
            integer(SHA256(bytes(str(r_4), "utf-8"))),
            integer(SHA256(bytes(str(r_5), "utf-8"))),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
253
254
        )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
255
        d_1, d_2, d_3, d_4, d_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
256
257
258
259
260
261
            witness["d1"],
            witness["d2"],
            witness["d3"],
            witness["d4"],
            witness["d5"],
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
262
263
264
265
266
267
        hash_d_1, hash_d_2, hash_d_3, hash_d_4, hash_d_5 = (
            integer(SHA256(bytes(str(d_1), "utf-8"))),
            integer(SHA256(bytes(str(d_2), "utf-8"))),
            integer(SHA256(bytes(str(d_3), "utf-8"))),
            integer(SHA256(bytes(str(d_4), "utf-8"))),
            integer(SHA256(bytes(str(d_5), "utf-8"))),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
268
269
270
271
272
        )

        hash_c = integer(SHA256(bytes(str(c), "utf-8")))

        s_j.set_d(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
273
274
275
276
277
            r_1 + (c * d_1),
            r_2 + (c * d_2),
            r_3 + (c * d_3),
            r_4 + (c * d_4),
            r_5 + (c * d_5),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
278
279
280
        )

        hashes_j.set_d(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
281
282
283
284
285
            hash_r_1 + (hash_c * hash_d_1),
            hash_r_2 + (hash_c * hash_d_2),
            hash_r_3 + (hash_c * hash_d_3),
            hash_r_4 + (hash_c * hash_d_4),
            hash_r_5 + (hash_c * hash_d_5),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
286
287
288
289
290
291
292
        )

        for subwitness in witness["wit_i"]:
            random_subwitness_record = get_record_by_index(
                subwitness["index"], random_witness["wit_i"]
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
293
            d_i_1, d_i_2, d_i_3, d_i_4, d_i_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
294
295
296
297
298
299
300
                subwitness["di_1"],
                subwitness["di_2"],
                subwitness["di_3"],
                subwitness["di_4"],
                subwitness["di_5"],
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
301
302
303
304
305
306
            hash_d_i_1, hash_d_i_2, hash_d_i_3, hash_d_i_4, hash_d_i_5 = (
                integer(SHA256(bytes(str(d_i_1), "utf-8"))),
                integer(SHA256(bytes(str(d_i_2), "utf-8"))),
                integer(SHA256(bytes(str(d_i_3), "utf-8"))),
                integer(SHA256(bytes(str(d_i_4), "utf-8"))),
                integer(SHA256(bytes(str(d_i_5), "utf-8"))),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
307
308
309
310
311
312
313
314
315
            )

            i, vr, copen_i, copen_ri = (
                subwitness["i"],
                subwitness["vr"],
                subwitness["copen_i"],
                subwitness["copen_ri"],
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
316
            hash_i, hash_vr, hash_copen_i, hash_copen_ri = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
317
318
319
320
321
322
                integer(subwitness["i"]),
                integer(subwitness["vr"]),
                integer(SHA256(bytes(str(subwitness["copen_i"]), "utf-8"))),
                integer(SHA256(bytes(str(subwitness["copen_ri"]), "utf-8"))),
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
323
            r_i_1, r_i_2, r_i_3, r_i_4, r_i_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
324
325
326
327
328
329
330
                random_subwitness_record["di_1"],
                random_subwitness_record["di_2"],
                random_subwitness_record["di_3"],
                random_subwitness_record["di_4"],
                random_subwitness_record["di_5"],
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
331
            random_i, random_vr, random_copen_i, random_copen_ri = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
332
333
334
335
336
337
                random_subwitness_record["i"],
                random_subwitness_record["vr"],
                random_subwitness_record["copen_i"],
                random_subwitness_record["copen_ri"],
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
338
            hash_r_i_1, hash_r_i_2, hash_r_i_3, hash_r_i_4, hash_r_i_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
                integer(
                    SHA256(
                        bytes(str(random_subwitness_record["di_1"]), "utf-8")
                    )
                ),
                integer(
                    SHA256(
                        bytes(str(random_subwitness_record["di_2"]), "utf-8")
                    )
                ),
                integer(
                    SHA256(
                        bytes(str(random_subwitness_record["di_3"]), "utf-8")
                    )
                ),
                integer(
                    SHA256(
                        bytes(str(random_subwitness_record["di_4"]), "utf-8")
                    )
                ),
                integer(
                    SHA256(
                        bytes(str(random_subwitness_record["di_5"]), "utf-8")
                    )
                ),
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
366
            hash_random_i, hash_random_vr, hash_random_copen_i, hash_random_copen_ri = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
                integer(
                    SHA256(bytes(str(random_subwitness_record["i"]), "utf-8"))
                ),
                integer(
                    SHA256(bytes(str(random_subwitness_record["vr"]), "utf-8"))
                ),
                integer(
                    SHA256(
                        bytes(
                            str(random_subwitness_record["copen_i"]), "utf-8"
                        )
                    )
                ),
                integer(
                    SHA256(
                        bytes(
                            str(random_subwitness_record["copen_ri"]), "utf-8"
                        )
                    )
                ),
            )

            temp_s_j_i = SubWitnessRecord(
                subwitness["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
391
392
393
394
395
396
397
398
399
                random_i + (c * i),
                random_vr + (c * vr),
                random_copen_i + (c * copen_i),
                random_copen_ri + (c * copen_ri),
                r_i_1 + (c * d_i_1),
                r_i_2 + (c * d_i_2),
                r_i_3 + (c * d_i_3),
                r_i_4 + (c * d_i_4),
                r_i_5 + (c * d_i_5),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
400
401
402
403
            )

            temp_hashes_j_i = SubWitnessRecord(
                subwitness["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
404
405
406
407
408
409
410
411
412
                hash_random_i + (hash_c * hash_i),
                hash_random_vr + (hash_c * hash_vr),
                hash_random_copen_i + (hash_c * hash_copen_i),
                hash_random_copen_ri + (hash_c * hash_copen_ri),
                hash_r_i_1 + (hash_c * hash_d_i_1),
                hash_r_i_2 + (hash_c * hash_d_i_2),
                hash_r_i_3 + (hash_c * hash_d_i_3),
                hash_r_i_4 + (hash_c * hash_d_i_4),
                hash_r_i_5 + (hash_c * hash_d_i_5),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
413
414
415
416
417
418
419
            )

            s_j.append_subwitnesses(temp_s_j_i)
            hashes_j.append_subwitnesses(temp_hashes_j_i)

        s_o_j = ZKWitness()

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
420
421
422
423
424
425
        random_opening_1, random_opening_2, random_opening_3, random_opening_4, random_opening_5 = (
            random_integer_openings["d1"],
            random_integer_openings["d2"],
            random_integer_openings["d3"],
            random_integer_openings["d4"],
            random_integer_openings["d5"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
426
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
427
428
429
430
431
432
        opening_1, opening_2, opening_3, opening_4, opening_5 = (
            witness_integer_openings["d1"],
            witness_integer_openings["d2"],
            witness_integer_openings["d3"],
            witness_integer_openings["d4"],
            witness_integer_openings["d5"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
433
434
435
        )

        s_o_j.set_d(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
436
437
438
439
440
            random_opening_1 + (hash_c * opening_1),
            random_opening_2 + (hash_c * opening_2),
            random_opening_3 + (hash_c * opening_3),
            random_opening_4 + (hash_c * opening_4),
            random_opening_5 + (hash_c * opening_5),
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
441
442
        )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
443
444
445
446
447
448
        for subwitness_integer_opening_record in witness_integer_openings[
            "wit_i"
        ]:
            random_integer_opening_record = get_record_by_index(
                subwitness_integer_opening_record["index"],
                random_integer_openings["wit_i"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
449
450
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
451
452
453
454
455
456
            d_i_1, d_i_2, d_i_3, d_i_4, d_i_5 = (
                subwitness_integer_opening_record["di_1"],
                subwitness_integer_opening_record["di_2"],
                subwitness_integer_opening_record["di_3"],
                subwitness_integer_opening_record["di_4"],
                subwitness_integer_opening_record["di_5"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
457
458
459
            )

            i, vr, copen_i, copen_ri = (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
460
461
462
463
                subwitness_integer_opening_record["i"],
                subwitness_integer_opening_record["vr"],
                subwitness_integer_opening_record["copen_i"],
                subwitness_integer_opening_record["copen_ri"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
464
465
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
466
467
468
469
470
471
            r_i_1, r_i_2, r_i_3, r_i_4, r_i_5 = (
                random_integer_opening_record["di_1"],
                random_integer_opening_record["di_2"],
                random_integer_opening_record["di_3"],
                random_integer_opening_record["di_4"],
                random_integer_opening_record["di_5"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
472
473
            )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
474
475
476
477
478
            random_i, random_vr, random_copen_i, random_copen_ri = (
                random_integer_opening_record["i"],
                random_integer_opening_record["vr"],
                random_integer_opening_record["copen_i"],
                random_integer_opening_record["copen_ri"],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
479
480
481
            )

            temp_s_j_i = SubWitnessRecord(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
482
483
484
485
486
487
488
489
490
491
                subwitness_integer_opening_record["index"],
                random_i + (hash_c * i),
                random_vr + (hash_c * vr),
                random_copen_i + (hash_c * copen_i),
                random_copen_ri + (hash_c * copen_ri),
                r_i_1 + (hash_c * d_i_1),
                r_i_2 + (hash_c * d_i_2),
                r_i_3 + (hash_c * d_i_3),
                r_i_4 + (hash_c * d_i_4),
                r_i_5 + (hash_c * d_i_5),
Aditya Damodaran's avatar
Aditya Damodaran committed
492
            )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
493
494
495
496
            s_o_j.append_subwitnesses(temp_s_j_i)

        return s_j, hashes_j, hash_c

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
497
498
499
500
501
502
503
504
    def pe_check(
        self,
        index,
        hashes_j,
        random_paillier_ciphertexts,
        witness_paillier_ciphertexts,
        hash_c,
    ):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
505
506
507
508
509
        g, n, n2 = (
            self.public_key["g"],
            self.public_key["n"],
            self.public_key["n2"],
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
510
511
512
        temp_paillier_ciphertext = {
            "c": random_paillier_ciphertexts[index][0]["c"]
            * (witness_paillier_ciphertexts[index][0]["c"] ** hash_c)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
513
        }
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
514
        return (temp_paillier_ciphertext["c"] % n2) == (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
515
516
517
518
            (
                ((g % n2) ** (hashes_j[index]))
                * (
                    (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
519
520
                        random_paillier_ciphertexts[index][1]
                        * (witness_paillier_ciphertexts[index][1] ** hash_c)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
521
522
523
524
525
526
527
528
529
                        % n2
                    )
                    ** n
                )
            )
            % n2
        )

    def pe_sub_check(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
530
531
532
533
534
535
536
        self,
        subindex,
        index,
        hashes_j,
        random_paillier_ciphertexts,
        witness_paillier_ciphertexts,
        hash_c,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
537
538
539
540
541
542
543
544
    ):

        g, n, n2 = (
            self.public_key["g"],
            self.public_key["n"],
            self.public_key["n2"],
        )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
545
546
547
548
549
550
        random_ciphertext_record = get_record_by_index(
            subindex, random_paillier_ciphertexts["wit_i"]
        )
        witness_ciphertext_record = get_record_by_index(
            subindex, witness_paillier_ciphertexts["wit_i"]
        )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
551
        hash_record = get_record_by_index(subindex, hashes_j["wit_i"])
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
552
553
554
        temp_paillier_ciphertext = {
            "c": random_ciphertext_record[index][0]["c"]
            * (witness_ciphertext_record[index][0]["c"] ** hash_c)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
555
        }
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
556
        return (temp_paillier_ciphertext["c"] % n2) == (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
557
558
559
560
            (
                ((g % n2) ** (hash_record[index]))
                * (
                    (
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
561
562
                        random_ciphertext_record[index][1]
                        * (witness_ciphertext_record[index][1] ** hash_c)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
                        % n2
                    )
                    ** n
                )
            )
            % n2
        )

    def verify_paillier_ciphertexts(
        self,
        hash_c,
        random_paillier_ciphertexts,
        witness_paillier_ciphertexts,
        hashes_j,
    ):

        if (
            not (
                self.pe_check(
                    "d1",
                    hashes_j,
                    random_paillier_ciphertexts,
                    witness_paillier_ciphertexts,
                    hash_c,
                )
            )
            or not (
                self.pe_check(
                    "d2",
                    hashes_j,
                    random_paillier_ciphertexts,
                    witness_paillier_ciphertexts,
                    hash_c,
                )
            )
            or not (
                self.pe_check(
                    "d3",
                    hashes_j,
                    random_paillier_ciphertexts,
                    witness_paillier_ciphertexts,
                    hash_c,
                )
            )
            or not (
                self.pe_check(
                    "d4",
                    hashes_j,
                    random_paillier_ciphertexts,
                    witness_paillier_ciphertexts,
                    hash_c,
                )
            )
            or not (
                self.pe_check(
                    "d5",
                    hashes_j,
                    random_paillier_ciphertexts,
                    witness_paillier_ciphertexts,
                    hash_c,
                )
            )
        ):
Aditya Damodaran's avatar
Aditya Damodaran committed
626
627
628
            print(
                "Abort: (Sigma Protocol) Paillier ciphertext verification failed."
            )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
            exit()
        for subwitness in witness_paillier_ciphertexts["wit_i"]:
            if (
                not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "di_1",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "di_2",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "di_3",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "di_4",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
            ):
Aditya Damodaran's avatar
Aditya Damodaran committed
673
674
675
                print(
                    "Abort: (Sigma Protocol) Paillier ciphertext verification failed."
                )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
                exit()
            if (
                not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "di_5",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "i",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "vr",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "copen_i",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
                or not (
                    self.pe_sub_check(
                        subwitness["index"],
                        "copen_ri",
                        hashes_j,
                        random_paillier_ciphertexts,
                        witness_paillier_ciphertexts,
                        hash_c,
                    )
                )
            ):
Aditya Damodaran's avatar
Aditya Damodaran committed
729
730
731
                print(
                    "Abort: (Sigma Protocol) Paillier ciphertext verification failed."
                )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
                exit()
        return 1

    def verify_integer_commitments(
        self,
        hash_c,
        random_integer_openings,
        witness_integer_openings,
        random_integer_commitments,
        witness_integer_commitments,
        hashes_j,
        par_ic,
    ):

        if (
            not (
                random_integer_commitments["d1"]
                * (witness_integer_commitments["d1"] ** hash_c)
                == (
                    (
                        (par_ic["g"] ** hashes_j["d1"])
                        * (
                            par_ic["h"]
                            ** (
                                random_integer_openings["d1"]
                                + (hash_c * witness_integer_openings["d1"])
                            )
                        )
                    )
                    % self.integer_commitment.n
                )
            )
            or not (
                random_integer_commitments["d2"]
                * (witness_integer_commitments["d2"] ** hash_c)
                == (
                    (
                        (par_ic["g"] ** hashes_j["d2"])
                        * (
                            par_ic["h"]
                            ** (
                                random_integer_openings["d2"]
                                + (hash_c * witness_integer_openings["d2"])
                            )
                        )
                    )
                    % self.integer_commitment.n
                )
            )
            or not (
                random_integer_commitments["d3"]
                * (witness_integer_commitments["d3"] ** hash_c)
                == (
                    (
                        (par_ic["g"] ** hashes_j["d3"])
                        * (
                            par_ic["h"]
                            ** (
                                random_integer_openings["d3"]
                                + (hash_c * witness_integer_openings["d3"])
                            )
                        )
                    )
                    % self.integer_commitment.n
                )
            )
            or not (
                random_integer_commitments["d4"]
                * (witness_integer_commitments["d4"] ** hash_c)
                == (
                    (
                        (par_ic["g"] ** hashes_j["d4"])
                        * (
                            par_ic["h"]
                            ** (
                                random_integer_openings["d4"]
                                + (hash_c * witness_integer_openings["d4"])
                            )
                        )
                    )
                    % self.integer_commitment.n
                )
            )
            or not (
                random_integer_commitments["d5"]
                * (witness_integer_commitments["d5"] ** hash_c)
                == (
                    (
                        (par_ic["g"] ** hashes_j["d5"])
                        * (
                            par_ic["h"]
                            ** (
                                random_integer_openings["d5"]
                                + (hash_c * witness_integer_openings["d5"])
                            )
                        )
                    )
                    % self.integer_commitment.n
                )
            )
        ):
            print("Abort: (Sigma Protocol) Integer commitment check failed.")
        for subwitness in witness_integer_commitments["wit_i"]:
            random_ic_record = get_record_by_index(
                subwitness["index"], random_integer_commitments["wit_i"]
            )
            random_ic_opening_record = get_record_by_index(
                subwitness["index"], random_integer_openings["wit_i"]
            )
            witnessopenrecord = get_record_by_index(
                subwitness["index"], witness_integer_openings["wit_i"]
            )
            hashrecord = get_record_by_index(
                subwitness["index"], hashes_j["wit_i"]
            )

            if (
                not (
                    random_ic_record["di_1"] * (subwitness["di_1"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["di_1"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["di_1"]
                                    + (hash_c * witnessopenrecord["di_1"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["di_2"] * (subwitness["di_2"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["di_2"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["di_2"]
                                    + (hash_c * witnessopenrecord["di_2"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["di_3"] * (subwitness["di_3"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["di_3"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["di_3"]
                                    + (hash_c * witnessopenrecord["di_3"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["di_4"] * (subwitness["di_4"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["di_4"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["di_4"]
                                    + (hash_c * witnessopenrecord["di_4"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["di_5"] * (subwitness["di_5"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["di_5"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["di_5"]
                                    + (hash_c * witnessopenrecord["di_5"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["i"] * (subwitness["i"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["i"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["i"]
                                    + (hash_c * witnessopenrecord["i"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["vr"] * (subwitness["vr"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["vr"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["vr"]
                                    + (hash_c * witnessopenrecord["vr"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["copen_i"]
                    * (subwitness["copen_i"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["copen_i"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["copen_i"]
                                    + (hash_c * witnessopenrecord["copen_i"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
                or not (
                    random_ic_record["copen_ri"]
                    * (subwitness["copen_ri"] ** hash_c)
                    == (
                        (
                            (par_ic["g"] ** hashrecord["copen_ri"])
                            * (
                                par_ic["h"]
                                ** (
                                    random_ic_opening_record["copen_ri"]
                                    + (hash_c * witnessopenrecord["copen_ri"])
                                )
                            )
                        )
                        % self.integer_commitment.n
                    )
                )
            ):
Aditya Damodaran's avatar
Aditya Damodaran committed
996
997
998
                print(
                    "Abort: (Sigma Protocol) Integer commitment check failed."
                )
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
999
1000
1001
1002
1003
                exit()

        return 1

    def prepare_paillier_ciphertexts(self, witness, is_random=0):
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1004
        d_1, d_2, d_3, d_4, d_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1005
1006
1007
1008
1009
1010
1011
1012
            witness["d1"],
            witness["d2"],
            witness["d3"],
            witness["d4"],
            witness["d5"],
        )

        paillier_ciphertexts = ZKWitness()
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1013
1014
        ciphertext_d_1 = self.paillier_encryption.encrypt(
            self.public_key, integer(SHA256(bytes(str(d_1), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1015
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1016
1017
        ciphertext_d_2 = self.paillier_encryption.encrypt(
            self.public_key, integer(SHA256(bytes(str(d_2), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1018
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1019
1020
        ciphertext_d_3 = self.paillier_encryption.encrypt(
            self.public_key, integer(SHA256(bytes(str(d_3), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1021
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1022
1023
        ciphertext_d_4 = self.paillier_encryption.encrypt(
            self.public_key, integer(SHA256(bytes(str(d_4), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1024
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1025
1026
        ciphertext_d_5 = self.paillier_encryption.encrypt(
            self.public_key, integer(SHA256(bytes(str(d_5), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1027
1028
        )
        paillier_ciphertexts.set_d(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1029
1030
1031
1032
1033
            ciphertext_d_1,
            ciphertext_d_2,
            ciphertext_d_3,
            ciphertext_d_4,
            ciphertext_d_5,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1034
1035
1036
1037
        )

        for subwitness in witness["wit_i"]:
            #
root's avatar
root committed
1038
            [d_i_1, d_i_2, d_i_3, d_i_4, d_i_5] = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1039
1040
1041
1042
1043
1044
                subwitness["di_1"],
                subwitness["di_2"],
                subwitness["di_3"],
                subwitness["di_4"],
                subwitness["di_5"],
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1045
1046
            ciphertext_d_i_1 = self.paillier_encryption.encrypt(
                self.public_key, integer(SHA256(bytes(str(d_i_1), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1047
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1048
1049
            ciphertext_d_i_2 = self.paillier_encryption.encrypt(
                self.public_key, integer(SHA256(bytes(str(d_i_2), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1050
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1051
1052
            ciphertext_d_i_3 = self.paillier_encryption.encrypt(
                self.public_key, integer(SHA256(bytes(str(d_i_3), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1053
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1054
1055
            ciphertext_d_i_4 = self.paillier_encryption.encrypt(
                self.public_key, integer(SHA256(bytes(str(d_i_4), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1056
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1057
1058
            ciphertext_d_i_5 = self.paillier_encryption.encrypt(
                self.public_key, integer(SHA256(bytes(str(d_i_5), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1059
1060
            )
            if is_random:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1061
                ciphertext_i = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1062
1063
1064
                    self.public_key,
                    integer(SHA256(bytes(str(subwitness["i"]), "utf-8"))),
                )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1065
                ciphertext_vr = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1066
1067
1068
1069
1070
                    self.public_key,
                    integer(SHA256(bytes(str(subwitness["vr"]), "utf-8"))),
                )

            else:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1071
                ciphertext_i = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1072
1073
                    self.public_key, integer(subwitness["i"])
                )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1074
                ciphertext_vr = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1075
1076
1077
                    self.public_key, integer(subwitness["vr"])
                )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1078
            ciphertext_copen_i = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1079
1080
1081
                self.public_key,
                integer(SHA256(bytes(str(subwitness["copen_i"]), "utf-8"))),
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1082
            ciphertext_copen_ri = self.paillier_encryption.encrypt(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1083
1084
1085
1086
1087
                self.public_key,
                integer(SHA256(bytes(str(subwitness["copen_ri"]), "utf-8"))),
            )
            temp_sw_paillier_ciphertexts = SubWitnessRecord(
                subwitness["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1088
1089
1090
1091
1092
1093
1094
1095
1096
                ciphertext_i,
                ciphertext_vr,
                ciphertext_copen_i,
                ciphertext_copen_ri,
                ciphertext_d_i_1,
                ciphertext_d_i_2,
                ciphertext_d_i_3,
                ciphertext_d_i_4,
                ciphertext_d_i_5,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1097
1098
1099
1100
1101
1102
1103
1104
            )
            paillier_ciphertexts.append_subwitnesses(
                temp_sw_paillier_ciphertexts
            )

        return paillier_ciphertexts

    def prepare_integer_commitments(self, witness, is_random=0):
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1105
        d_1, d_2, d_3, d_4, d_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
            witness["d1"],
            witness["d2"],
            witness["d3"],
            witness["d4"],
            witness["d5"],
        )

        integer_commitments = ZKWitness()
        integer_openings = ZKWitness()

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1116
1117
        commitment_d_1 = self.integer_commitment.commit(
            self.par_ic, integer(SHA256(bytes(str(d_1), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1118
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1119
1120
        commitment_d_2 = self.integer_commitment.commit(
            self.par_ic, integer(SHA256(bytes(str(d_2), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1121
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1122
1123
        commitment_d_3 = self.integer_commitment.commit(
            self.par_ic, integer(SHA256(bytes(str(d_3), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1124
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1125
1126
        commitment_d_4 = self.integer_commitment.commit(
            self.par_ic, integer(SHA256(bytes(str(d_4), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1127
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1128
1129
        commitment_d_5 = self.integer_commitment.commit(
            self.par_ic, integer(SHA256(bytes(str(d_5), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1130
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1131

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1132
        integer_commitments.set_d(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
            commitment_d_1[0],
            commitment_d_2[0],
            commitment_d_3[0],
            commitment_d_4[0],
            commitment_d_5[0],
        )

        integer_openings.set_d(
            commitment_d_1[1],
            commitment_d_2[1],
            commitment_d_3[1],
            commitment_d_4[1],
            commitment_d_5[1],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1146
1147
1148
        )
        for subwitness in witness["wit_i"]:
            #
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1149
            [d_i_1, d_i_2, d_i_3, d_i_4, d_i_5] = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1150
1151
1152
1153
1154
1155
                subwitness["di_1"],
                subwitness["di_2"],
                subwitness["di_3"],
                subwitness["di_4"],
                subwitness["di_5"],
            )
root's avatar
root committed
1156
            commitment_d_i_1 = self.integer_commitment.commit(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1157
                self.par_ic, integer(SHA256(bytes(str(d_i_1), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1158
            )
root's avatar
root committed
1159
            commitment_d_i_2 = self.integer_commitment.commit(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1160
                self.par_ic, integer(SHA256(bytes(str(d_i_2), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1161
            )
root's avatar
root committed
1162
            commitment_d_i_3 = self.integer_commitment.commit(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1163
                self.par_ic, integer(SHA256(bytes(str(d_i_3), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1164
            )
root's avatar
root committed
1165
            commitment_d_i_4 = self.integer_commitment.commit(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1166
                self.par_ic, integer(SHA256(bytes(str(d_i_4), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1167
            )
root's avatar
root committed
1168
            commitment_d_i_5 = self.integer_commitment.commit(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1169
                self.par_ic, integer(SHA256(bytes(str(d_i_5), "utf-8")))
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1170
1171
            )
            if is_random:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1172
                commitment_i = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1173
1174
1175
                    self.par_ic,
                    integer(SHA256(bytes(str(subwitness["i"]), "utf-8"))),
                )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1176
                commitment_vr = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1177
1178
1179
1180
1181
                    self.par_ic,
                    integer(SHA256(bytes(str(subwitness["vr"]), "utf-8"))),
                )

            else:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1182
                commitment_i = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1183
1184
                    self.par_ic, integer(subwitness["i"])
                )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1185
                commitment_vr = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1186
1187
1188
                    self.par_ic, integer(subwitness["vr"])
                )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1189
            commitment_copen_i = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1190
1191
1192
                self.par_ic,
                integer(SHA256(bytes(str(subwitness["copen_i"]), "utf-8"))),
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1193
            commitment_copen_ri = self.integer_commitment.commit(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1194
1195
1196
                self.par_ic,
                integer(SHA256(bytes(str(subwitness["copen_ri"]), "utf-8"))),
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1197

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1198
1199
            temp_sw_integer_commitments = SubWitnessRecord(
                subwitness["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1200
1201
1202
1203
1204
1205
1206
1207
1208
                commitment_i[0],
                commitment_vr[0],
                commitment_copen_i[0],
                commitment_copen_ri[0],
                commitment_d_i_1[0],
                commitment_d_i_2[0],
                commitment_d_i_3[0],
                commitment_d_i_4[0],
                commitment_d_i_5[0],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1209
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1210

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1211
1212
            temp_sw_integer_openings = SubWitnessRecord(
                subwitness["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1213
1214
1215
1216
1217
1218
1219
1220
1221
                commitment_i[1],
                commitment_vr[1],
                commitment_copen_i[1],
                commitment_copen_ri[1],
                commitment_d_i_1[1],
                commitment_d_i_2[1],
                commitment_d_i_3[1],
                commitment_d_i_4[1],
                commitment_d_i_5[1],
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1222
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1223

Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1224
1225
1226
1227
1228
1229
1230
            integer_commitments.append_subwitnesses(
                temp_sw_integer_commitments
            )
            integer_openings.append_subwitnesses(temp_sw_integer_openings)
        return integer_commitments, integer_openings

    def prover_step_2(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1231
1232
1233
1234
1235
1236
        self,
        random_witness,
        c,
        witness,
        random_integer_openings,
        witness_integer_openings,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1237
1238
    ):
        return self.compute_s(
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1239
1240
1241
1242
1243
            random_witness,
            c,
            witness,
            random_integer_openings,
            witness_integer_openings,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1244
1245
        )

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1246
    def verifier_step_1(self,):
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
        return pairing_group.random(ZR)

    def verifier_step_2(
        self, s_j, t, c, y, gd, dsa_c, dsa_b, witness_integer_commitments, sid
    ):
        lhs = self.compute_t(dict_from_class(s_j))
        if not (lhs["t1"] == (t["tj"]["t1"] * (y["y1"] ** c))) or not (
            lhs["t2"] == (t["tj"]["t2"] * (y["y2"] ** c))
        ):
            print("Abort: (Sigma Protocol) Verifier step 2 failed.")
            exit()

        for s_i in lhs["t_i"]:
            y_record = get_record_by_index(s_i["index"], y["yl"])
            t_record = get_record_by_index(s_i["index"], t["tj"]["t_i"])
            if (
                not (t_record["t3"] * (y_record["y3"] ** c) == (s_i["t3"]))
                or not (t_record["t4"] * (y_record["y4"] ** c) == s_i["t4"])
                or not (t_record["t5"] * (y_record["y5"] ** c) == s_i["t5"])
                or not (t_record["t6"] * (y_record["y6"] ** c) == s_i["t6"])
                or not (t_record["t7"] * (y_record["y7"] ** c) == s_i["t7"])
            ):
                print("Abort: (Sigma Protocol) Verifier step 2 failed.")
                exit()
        hash_m = SHA256(
            (
                str(y)
                + str(dict_from_class(witness_integer_commitments))
                + str(t)
            ).encode("utf-8")
        )
        dsa_h = (
            self.dsa_keys[0]["g"] ** integer(SHA256(str(sid).encode("utf-8")))
        ) * (self.dsa_keys[0]["y"] ** gd)

        if not (((gd ** dsa_b) * (dsa_h ** integer(hash_m))) == (dsa_c)):
            print("Abort: (Sigma Protocol) DSA check failed.")
            exit()

    def prepare_random_witnesses(self, witness):
        random_witnesses = ZKWitness()
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1288
1289
        [r_1, r_2, r_3, r_4, r_5] = generate_n_random_exponents(5)
        random_witnesses.set_d(r_1, r_2, r_3, r_4, r_5)
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1290
1291
1292
        for subwitness in witness["wit_i"]:
            #
            [
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1293
1294
1295
1296
1297
                d_i_1,
                d_i_2,
                d_i_3,
                d_i_4,
                d_i_5,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
                i,
                vr,
                copen_i,
                copen_ri,
            ] = generate_n_random_exponents(9)
            temp_random_witnesses = SubWitnessRecord(
                subwitness["index"],
                i,
                vr,
                copen_i,
                copen_ri,
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1309
1310
1311
1312
1313
                d_i_1,
                d_i_2,
                d_i_3,
                d_i_4,
                d_i_5,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1314
1315
1316
1317
1318
1319
            )
            random_witnesses.append_subwitnesses(temp_random_witnesses)
        return random_witnesses

    def compute_t(self, random_witness):

Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1320
        d_1, d_2, d_3, d_4, d_5 = (
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1321
1322
1323
1324
1325
1326
            random_witness["d1"],
            random_witness["d2"],
            random_witness["d3"],
            random_witness["d4"],
            random_witness["d5"],
        )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1327
1328
        t_1 = self.compute_ppe_1(d_1, d_2, d_3, d_4, "rhs")
        t_2 = self.compute_ppe_2(d_1, d_5, "rhs")
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1329
1330
        t_i = []
        for record in random_witness["wit_i"]:
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1331
            t_3 = self.compute_ppe_3(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1332
1333
                record["index"], record["i"], record["copen_i"], "rhs"
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1334
            t_4 = self.compute_ppe_4(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1335
1336
                record["index"], record["vr"], record["copen_ri"], "rhs"
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1337
            t_5 = self.compute_ppe_5(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1338
1339
1340
1341
1342
1343
                record["index"],
                record["di_1"],
                record["di_2"],
                record["i"],
                "rhs",
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1344
            t_6 = self.compute_ppe_6(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1345
1346
1347
1348
1349
1350
                record["index"],
                record["di_1"],
                record["di_3"],
                record["di_4"],
                "rhs",
            )
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1351
            t_7 = self.compute_ppe_7(
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1352
1353
1354
1355
1356
1357
1358
1359
                record["index"],
                record["di_4"],
                record["di_5"],
                record["vr"],
                "rhs",
            )
            temp_t_i = {
                "index": record["index"],
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1360
1361
1362
1363
1364
                "t3": t_3,
                "t4": t_4,
                "t5": t_5,
                "t6": t_6,
                "t7": t_7,
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1365
1366
            }
            t_i.append(temp_t_i)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1367
1368

        return {"t1": t_1, "t2": t_2, "t_i": t_i}
Aditya Shyam Shankar Damodaran's avatar
Aditya Shyam Shankar Damodaran committed
1369
1370
1371
1372
1373
1374

    def prepare_random_integer_commitments(self, random_witness):
        return self.prepare_integer_commitments(random_witness, 1)

    def prepare_random_paillier_ciphertexts(self, random_witness):
        return self.prepare_paillier_ciphertexts(random_witness, 1)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1375
1376
1377
1378
1379
1380
1381
1382

    def range_proof(value, commitment, opening, limit, ped_g, ped_h, group):
        # Verifier picks x rand
        x = group.random(ZR)
        y = ped_h ** x
        u_list = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]

        a_i = [
root's avatar
root committed
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
            sign_u(0, ped_g, x),
            sign_u(1, ped_g, x),
            sign_u(2, ped_g, x),
            sign_u(3, ped_g, x),
            sign_u(4, ped_g, x),
            sign_u(5, ped_g, x),
            sign_u(6, ped_g, x),
            sign_u(7, ped_g, x),
            sign_u(8, ped_g, x),
            sign_u(9, ped_g, x),
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1393
        ]
root's avatar
root committed
1394
        str_num = num_to_str(value, 4)
Aditya Damodaran's avatar
PEP-8    
Aditya Damodaran committed
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501

        # Verifier selects V_j at random
        v_0 = group.random(ZR)
        v_1 = group.random(ZR)
        v_2 = group.random(ZR)
        v_3 = group.random(ZR)

        v_j = [
            a_i[int(str_num[3])] ** v_0,
            a_i[int(str_num[2])] ** v_1,
            a_i[int(str_num[1])] ** v_2,
            a_i[int(str_num[0])] ** v_3,
        ]

        # v_j = [a_i[0]**v0,a_i[0]**v1,a_i[1]**v2,a_i[0]**v3]

        # Prover
        s_0 = group.random(ZR)
        t_0 = group.random(ZR)
        m_0 = group.random(ZR)

        s_1 = group.random(ZR)
        t_1 = group.random(ZR)
        m_1 = group.random(ZR)

        s_2 = group.random(ZR)
        t_2 = group.random(ZR)
        m_2 = group.random(ZR)

        s_3 = group.random(ZR)
        t_3 = group.random(ZR)
        m_3 = group.random(ZR)

        gt = group.random(G2)

        a_0 = (pair(v_j[0], gt) ** (-s_0)) * (pair(ped_g, gt) ** t_0)
        a_1 = (pair(v_j[1], gt) ** (-s_1)) * (pair(ped_g, gt) ** t_1)
        a_2 = (pair(v_j[2], gt) ** (-s_2)) * (pair(ped_g, gt) ** t_2)
        a_3 = (pair(v_j[3], gt) ** (-s_3)) * (pair(ped_g, gt) ** t_3)

        d = (
            ((ped_g ** ((10 ** 0) * s_0)) * (ped_h ** m_0))
            * ((ped_g ** ((10 ** 1) * s_1)) * (ped_h ** m_1))
            * ((ped_g ** ((10 ** 2) * s_2)) * (ped_h ** m_2))
            * ((ped_g ** ((10 ** 3) * s_3)) * (ped_h ** m_3))
        )

        # Verifier picks a random challenge c
        c = group.random(ZR)

        # Prover does the following
        z_s_0 = s_0 - (int(str_num[3]) * c)
        z_v_0 = t_0 - (v_0 * c)
        z_r_0 = m_0 - (opening * c)

        z_s_1 = s_1 - (int(str_num[2]) * c)
        z_v_1 = t_1 - (v_1 * c)
        z_r_1 = m_1 - (opening * c)

        z_s_2 = s_2 - (int(str_num[1]) * c)
        z_v_2 = t_2 - (v_2 * c)
        z_r_2 = m_2 - (opening * c)

        z_s_3 = s_3 - (int(str_num[0]) * c)
        z_v_3 = t_3 - (v_3 * c)
        z_r_3 = m_3 - (opening * c)
        y = gt ** x
        z_r = (m_0 + m_1 + m_2 + m_3) - (opening * c)
        if not (
            a_0
            == (pair(v_j[0], y) ** c)
            * (pair(v_j[0], gt) ** -z_s_0)
            * (pair(ped_g, gt) ** z_v_0)
        ):
            print("Abort: (FZK_PR) A0 check failed.")
        if not (
            a_1
            == (pair(v_j[1], y) ** c)
            * (pair(v_j[1], gt) ** -z_s_1)
            * (pair(ped_g, gt) ** z_v_1)
        ):
            print("Abort: (FZK_PR) A1 check failed.")
        if not (
            a_2
            == (pair(v_j[2], y) ** c)
            * (pair(v_j[2], gt) ** -z_s_2)
            * (pair(ped_g, gt) ** z_v_2)
        ):
            print("Abort: (FZK_PR) A2 check failed.")
        if not (
            a_3
            == (pair(v_j[3], y) ** c)
            * (pair(v_j[3], gt) ** -z_s_3)
            * (pair(ped_g, gt) ** z_v_3)
        ):
            print("Abort: (FZK_PR) A3 check failed.")
        if not (
            d
            == (commitment ** c)
            * (~(ped_g ** (limit * c)))
            * (ped_h ** (z_r))
            * ((ped_g ** ((10 ** 0) * z_s_0)))
            * ((ped_g ** ((10 ** 1) * z_s_1)))
            * ((ped_g ** ((10 ** 2) * z_s_2)))
            * ((ped_g ** ((10 ** 3) * z_s_3)))
        ):
            print("Abort: (FZK_PR) D check failed.")
root's avatar
root committed
1502
        return c , y