Adding ARC implementation.

ac/arc/arc_test.go

@@ -0,0 +1,106 @@
+package arc
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/cloudflare/circl/internal/test"
+)
+
+func TestCompressed(t *testing.T) {
+	id := SuiteP256
+	s := id.getSuite()
+	p := s.g.Params()
+
+	t.Run("okCompressed", func(t *testing.T) {
+		z := eltCom{s.g.RandomElement(rand.Reader)}
+		test.CheckMarshal(t, &z, &eltCom{s.newElement()})
+
+		enc, err := z.MarshalBinary()
+		test.CheckNoErr(t, err, "error on marshalling")
+		test.CheckOk(len(enc) == int(p.CompressedElementLength), "bad length", t)
+	})
+
+	t.Run("badCompressed", func(t *testing.T) {
+		// Skip on groups that do not admit point compression.
+		if p.CompressedElementLength == p.ElementLength {
+			t.Skip()
+		}
+
+		// Fails when unmarshaling non-compressed points.
+		x := s.g.RandomElement(rand.Reader)
+		enc, err := x.MarshalBinary()
+		test.CheckNoErr(t, err, "error on marshalling")
+		test.CheckOk(uint(len(enc)) == p.ElementLength, "bad length", t)
+
+		xx := eltCom{s.newElement()}
+		err1 := xx.UnmarshalBinary(enc)
+		test.CheckIsErr(t, err1, "should fail")
+	})
+}
+
+func BenchmarkArc(b *testing.B) {
+	b.Run(SuiteP256.String(), SuiteP256.benchmarkArc)
+	b.Run(SuiteRistretto255.String(), SuiteRistretto255.benchmarkArc)
+}
+
+func (id SuiteID) benchmarkArc(b *testing.B) {
+	reqContext := []byte("Credential for Alice")
+	presContext := []byte("Presentation for example.com")
+	priv := KeyGen(rand.Reader, id)
+	pub := priv.PublicKey()
+
+	fin, credReq := Request(rand.Reader, id, reqContext)
+	credRes, err := Response(rand.Reader, &priv, &credReq)
+	test.CheckNoErr(b, err, "failed Response")
+
+	credential, err := Finalize(&fin, &credReq, credRes, &pub)
+	test.CheckNoErr(b, err, "failed Finalize")
+
+	const MaxPres = 1000
+	state, err := NewState(credential, presContext, MaxPres)
+	test.CheckNoErr(b, err, "failed NewState")
+	nonce, pres, err := state.Present(rand.Reader)
+	test.CheckNoErr(b, err, "failed Finalize")
+
+	ok := Verify(&priv, pres, reqContext, presContext, *nonce, MaxPres)
+	test.CheckOk(ok, "verify failed", b)
+
+	b.Run("KeyGen", func(b *testing.B) {
+		for range b.N {
+			k := KeyGen(rand.Reader, id)
+			_ = k.PublicKey()
+		}
+	})
+
+	b.Run("Request", func(b *testing.B) {
+		for range b.N {
+			_, _ = Request(rand.Reader, id, reqContext)
+		}
+	})
+
+	b.Run("Response", func(b *testing.B) {
+		for range b.N {
+			_, _ = Response(rand.Reader, &priv, &credReq)
+		}
+	})
+
+	b.Run("Finalize", func(b *testing.B) {
+		for range b.N {
+			_, _ = Finalize(&fin, &credReq, credRes, &pub)
+		}
+	})
+
+	b.Run("Present", func(b *testing.B) {
+		for range b.N {
+			s, _ := NewState(credential, presContext, MaxPres)
+			_, _, _ = s.Present(rand.Reader)
+		}
+	})
+
+	b.Run("Verify", func(b *testing.B) {
+		for range b.N {
+			_ = Verify(&priv, pres, reqContext, presContext, *nonce, MaxPres)
+		}
+	})
+}

ac/arc/builder.go

@@ -0,0 +1,216 @@
+package arc
+
+import (
+	"crypto/rand"
+	"io"
+	"slices"
+
+	"github.com/cloudflare/circl/internal/conv"
+	"golang.org/x/crypto/cryptobyte"
+)
+
+type proof struct {
+	chal scalar
+	resp []scalar
+}
+
+func (p proof) String() string { return printAny(p.chal, p.resp) }
+
+func (p *proof) init(s *suite, num uint) {
+	p.chal = s.newScalar()
+	p.resp = make([]scalar, num)
+	for i := range num {
+		p.resp[i] = s.newScalar()
+	}
+}
+
+func (p proof) IsEqual(x proof) bool {
+	return slices.EqualFunc(
+		append([]scalar{p.chal}, p.resp...),
+		append([]scalar{x.chal}, x.resp...),
+		scalar.IsEqual)
+}
+
+func (p proof) Marshal(b *cryptobyte.Builder) error {
+	v := make([]cryptobyte.MarshalingValue, 0, 1+len(p.resp))
+	v = append(v, p.chal)
+	for i := range p.resp {
+		v = append(v, p.resp[i])
+	}
+
+	return conv.MarshalSlice(b, v...)
+}
+
+func (p proof) Unmarshal(s *cryptobyte.String) bool {
+	v := make([]conv.UnmarshalingValue, 0, 1+len(p.resp))
+	v = append(v, p.chal)
+	for i := range p.resp {
+		v = append(v, p.resp[i])
+	}
+
+	return conv.UnmarshalSlice(s, v...)
+}
+
+type (
+	scalarIndex uint
+	elemIndex   uint
+	mul         struct {
+		s scalarIndex
+		e elemIndex
+	}
+	constraint struct {
+		c []mul
+		z elemIndex
+	}
+)
+
+type builder struct {
+	*suite
+	ctx          string
+	scalarLabels [][]byte
+	elemLabels   [][]byte
+	elems        []elt
+	cons         []constraint
+}
+
+func (b *builder) AppendScalar(label []byte) scalarIndex {
+	b.scalarLabels = append(b.scalarLabels, label)
+	return scalarIndex(len(b.scalarLabels) - 1)
+}
+
+func (b *builder) AppendElement(label []byte, e elt) elemIndex {
+	b.elems = append(b.elems, e)
+	b.elemLabels = append(b.elemLabels, label)
+	return elemIndex(len(b.elems) - 1)
+}
+
+func (b *builder) Constrain(z elemIndex, m ...mul) {
+	b.cons = append(b.cons, constraint{m, z})
+}
+
+func (b *builder) calcChallenge(elems ...[]elt) scalar {
+	length := 0
+	for i := range elems {
+		length += len(elems[i])
+	}
+
+	sizeElement := b.suite.sizeElement()
+	length *= 2 + int(sizeElement)
+	cb := cryptobyte.NewFixedBuilder(make([]byte, 0, length))
+	for _, list := range elems {
+		for i := range list {
+			cb.AddUint16(uint16(sizeElement))
+			_ = eltCom{list[i]}.Marshal(cb)
+		}
+	}
+
+	return b.suite.hashToScalar(cb.BytesOrPanic(), b.suite.chalContext(b.ctx))
+}
+
+type prover struct {
+	builder
+	scalars []scalar
+}
+
+func newProver(id SuiteID, ctx string) (p prover) {
+	p.builder = builder{suite: id.getSuite(), ctx: ctx}
+	return
+}
+
+func (c *prover) AppendScalar(label []byte, s scalar) scalarIndex {
+	c.scalars = append(c.scalars, s)
+	return c.builder.AppendScalar(label)
+}
+
+func (c *prover) Prove(rnd io.Reader) (p proof) {
+	if rnd == nil {
+		rnd = rand.Reader
+	}
+
+	blindings := make([]scalar, len(c.scalars))
+	for i := range blindings {
+		blindings[i] = c.suite.randomScalar(rnd)
+	}
+
+	blindedElts := make([]elt, len(c.cons))
+	t := c.suite.newElement()
+	for i := range c.cons {
+		index := c.cons[i].z
+		if index > elemIndex(len(c.elems)) {
+			panic(ErrInvalidIndex)
+		}
+
+		sum := c.suite.newElement()
+		for j := range c.cons[i].c {
+			scalarIdx := c.cons[i].c[j].s
+			elemIdx := c.cons[i].c[j].e
+
+			if scalarIdx > scalarIndex(len(blindings)) {
+				panic(ErrInvalidIndex)
+			}
+
+			if elemIdx > elemIndex(len(c.elems)) {
+				panic(ErrInvalidIndex)
+			}
+
+			t.Mul(c.elems[elemIdx], blindings[scalarIdx])
+			sum.Add(sum, t)
+		}
+
+		blindedElts[i] = sum
+	}
+
+	p.init(c.suite, uint(len(c.scalars)))
+	p.chal = c.calcChallenge(c.elems, blindedElts)
+	for i := range p.resp {
+		p.resp[i].Sub(blindings[i], p.resp[i].Mul(p.chal, c.scalars[i]))
+	}
+
+	clear(blindings)
+	return p
+}
+
+type verifier struct{ builder }
+
+func newVerifier(id SuiteID, ctx string) (v verifier) {
+	v.builder = builder{suite: id.getSuite(), ctx: ctx}
+	return
+}
+
+func (v *verifier) Verify(p *proof) bool {
+	if len(v.elems) != len(v.elemLabels) {
+		return false
+	}
+
+	blindedElts := make([]elt, len(v.cons))
+	t := v.suite.newElement()
+	for i := range v.cons {
+		index := v.cons[i].z
+		if index > elemIndex(len(v.elems)) {
+			panic(ErrInvalidIndex)
+		}
+
+		sum := v.suite.newElement()
+		sum.Mul(v.elems[index], p.chal)
+		for j := range v.cons[i].c {
+			scalarIdx := v.cons[i].c[j].s
+			elemIdx := v.cons[i].c[j].e
+
+			if scalarIdx > scalarIndex(len(p.resp)) {
+				panic(ErrInvalidIndex)
+			}
+
+			if elemIdx > elemIndex(len(v.elems)) {
+				panic(ErrInvalidIndex)
+			}
+
+			t.Mul(v.elems[elemIdx], p.resp[scalarIdx])
+			sum.Add(sum, t)
+		}
+
+		blindedElts[i] = sum
+	}
+
+	chal := v.calcChallenge(v.elems, blindedElts)
+	return p.chal.IsEqual(chal)
+}