Skip to content

No public description #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
copybara-service wants to merge 1 commit into
base: main
Choose a base branch
from
Open

No public description #62

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions willow/src/zk/linear_ip.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ pub struct LinearInnerProductParameters {
F: RistrettoPoint,
F_: RistrettoPoint,
G: Vec<RistrettoPoint>,
seed: Vec<u8>,
}

pub fn inner_product(a: &[Scalar], b: &[Scalar]) -> Scalar {
Expand All @@ -59,6 +60,7 @@ fn common_setup(length: usize, parameter_seed: &[u8]) -> LinearInnerProductParam
)
})
.collect(),
seed: parameter_seed.to_vec(),
}
}

Expand All @@ -67,11 +69,9 @@ fn append_params_to_transcript(
params: &LinearInnerProductParameters,
) {
transcript.append_u64(b"n", params.n as u64);
for G_i in &params.G {
transcript.append_message(b"G_i", G_i.compress().as_bytes());
}
transcript.append_message(b"F", params.F.compress().as_bytes());
transcript.append_message(b"F_", params.F_.compress().as_bytes());
// We append the seed not the resulting params themselves because appending that many params
// more than doubles the run time of both prove and verify.
transcript.append_message(b"seed", &params.seed);
}

fn validate_and_append_point(
Expand Down
74 changes: 35 additions & 39 deletions willow/src/zk/rlwe_relation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,9 +272,9 @@ fn update_public_vec_for_range_proof(
z_r: &Vec<Scalar>,
z_e: &Vec<Scalar>,
z_vw: &Vec<Scalar>,
psi_r: Scalar,
psi_e: Scalar,
psi_vw: Scalar,
psi_r: &Vec<Scalar>,
psi_e: &Vec<Scalar>,
psi_vw: &Vec<Scalar>,
n: usize,
range_comm_offset: usize,
samples_required: usize,
Expand All @@ -298,20 +298,14 @@ fn update_public_vec_for_range_proof(

// The range proofs equation also involves length 128 innerproducts involving the relevant
// psi these are included in the last 3*128 entries of the inner product vectors.
let mut phi_psi_r_pow = phi;
let mut phi2_psi_e_pow = phi2;
let mut phi3_psi_vw_pow = phi3;
for i in 0..128 {
public_vec[i + range_comm_offset] = phi_psi_r_pow;
public_vec[i + range_comm_offset + 128] = phi2_psi_e_pow;
public_vec[i + range_comm_offset + 256] = phi3_psi_vw_pow;
public_vec[i + range_comm_offset] = phi * Scalar::from(psi_r[i]);
public_vec[i + range_comm_offset + 128] = phi2 * Scalar::from(psi_e[i]);
public_vec[i + range_comm_offset + 256] = phi3 * Scalar::from(psi_vw[i]);
// Add contributions of the range proofs to the overall inner product result.
*result += z_r[i] * phi_psi_r_pow;
*result += z_e[i] * phi2_psi_e_pow;
*result += z_vw[i] * phi3_psi_vw_pow;
phi_psi_r_pow *= psi_r;
phi2_psi_e_pow *= psi_e;
phi3_psi_vw_pow *= psi_vw;
*result += z_r[i] * public_vec[i + range_comm_offset];
*result += z_e[i] * public_vec[i + range_comm_offset + 128];
*result += z_vw[i] * public_vec[i + range_comm_offset + 256];
}
}

Expand Down Expand Up @@ -364,33 +358,37 @@ pub fn flatten_challenge_matrix(
R1: Vec<u128>,
R2: Vec<u128>,
challenge_label: &'static [u8],
) -> Result<(Vec<Scalar>, Scalar), status::StatusError> {
) -> Result<(Vec<Scalar>, Vec<Scalar>), status::StatusError> {
let n = R1.len();
if n != R2.len() {
return Err(status::failed_precondition("R1 and R2 have different lengths".to_string()));
}

let mut buf = [0u8; 64];
transcript.challenge_bytes(challenge_label, &mut buf);
let psi = Scalar::from_bytes_mod_order_wide(&buf);

let mut R = vec![Scalar::from(0 as u64); n];
let mut psi_powers = [Scalar::from(1 as u64); 128];
for j in 1..128 {
psi_powers[j] = psi_powers[j - 1] * psi;
let mut Rplus = vec![0u128; n];
let mut Rminus = vec![0u128; n];
let mut Rscalar = vec![Scalar::from(0 as u64); n];

let mut psi = [0u128; 128];
let mut psi_scalar = vec![Scalar::from(0 as u64); 128];
let mut buf = [0u8; 16];
for j in 0..128 {
transcript.challenge_bytes(challenge_label, &mut buf);
psi[j] = u128::from_le_bytes(buf).rem_euclid(1u128 << 120);
psi_scalar[j] = Scalar::from(psi[j]);
}
for i in 0..n {
for j in 0..128 {
if R1[i] & (1u128 << j) != 0 {
R[i] += psi_powers[j];
Rplus[i] += psi[j];
}
if R2[i] & (1u128 << j) != 0 {
R[i] -= psi_powers[j];
Rminus[i] += psi[j];
}
}
Rscalar[i] = Scalar::from(Rplus[i]) - Scalar::from(Rminus[i]);
}

Ok((R, psi))
Ok((Rscalar, psi_scalar))
}

// Check that loose_bound = bound*2500*sqrt(v.len()+1) fits within an i128.
Expand Down Expand Up @@ -430,7 +428,7 @@ fn generate_range_product(
transcript: &mut (impl Transcript + Clone),
challenge_label: &'static [u8],
) -> Result<
(Vec<Scalar>, RistrettoPoint, Vec<Scalar>, Scalar, Scalar, Vec<Scalar>),
(Vec<Scalar>, RistrettoPoint, Vec<Scalar>, Scalar, Vec<Scalar>, Vec<Scalar>),
status::StatusError,
> {
// Check that computing loose bound does not result in an overflow.
Expand Down Expand Up @@ -522,7 +520,7 @@ fn generate_range_product_for_verification_and_verify_z_bound(
z: &Vec<Scalar>,
transcript: &mut impl Transcript,
challenge_label: &'static [u8],
) -> Result<(Vec<Scalar>, Scalar), status::StatusError> {
) -> Result<(Vec<Scalar>, Vec<Scalar>), status::StatusError> {
// Check that computing loose bound does not result in an overflow.
check_loose_bound_will_not_overflow(bound, n)?;

Expand Down Expand Up @@ -798,9 +796,9 @@ impl<'a> ZeroKnowledgeProver<RlweRelationProofStatement<'a>, RlweRelationProofWi
&z_r,
&z_e,
&z_vw,
psi_r,
psi_e,
psi_vw,
&psi_r,
&psi_e,
&psi_vw,
n,
range_comm_offset,
samples_required,
Expand Down Expand Up @@ -977,9 +975,9 @@ impl<'a> ZeroKnowledgeVerifier<RlweRelationProofStatement<'a>, RlweRelationProof
&proof.z_r,
&proof.z_e,
&proof.z_vw,
psi_r,
psi_e,
psi_vw,
&psi_r,
&psi_e,
&psi_vw,
n,
range_comm_offset,
samples_required,
Expand Down Expand Up @@ -1260,12 +1258,10 @@ mod tests {
for i in 0..4 {
public_vec[i] = R[i];
}
let mut psi_pow = Scalar::from(1u128);
let mut result = Scalar::from(0u128);
for i in 4..132 {
public_vec[i] = psi_pow;
result += z[i - 4] * psi_pow;
psi_pow *= psi;
public_vec[i] = psi[i - 4];
result += z[i - 4] * psi[i - 4];
}
let mut expected_result = Scalar::from(0u128);
for j in 0..132 {
Expand Down