public interface SchnorrFragment
{((h1,h2),w) | h1 = g1^w ∧ h2 = g2^w},
meaning that the same witness w simultaneously fulfills the two equations. r and sends A1 = g1^r and A2 = g2^r to the verifiercR = c * w + rg1^R = h1^c * A1 and g2^R = h2^c * A1SigmaProtocols) of w by sending c * w + r as the responsew fulfills h1 = g1^w by sending A1 = g1^r and making the verifier check {g1^R = h1^c * A1}w fulfills h2 = g2^w by sending A2 = g2^r and making the verifier check {g2^R = h2^c * A2}
Note that the second and third fragment share the same w and r. This dependency is expressed in this interface:
a SchnorrFragment's trascript generation may depend on variables that are outside of its own control. We call those variables "external" variables.
This approach allows for easy composition of fragments that depend on (some of) the same variables.
However, this also means that SchnorrFragments are basically useless by themselves because they depend on external variables.
To ultimately make use of a SchnorrFragment in an actual protocol, implement a SendThenDelegateProtocol and use the fragment as a subprotocol.
Implementing classes are usually used as follows:
SchnorrVariable)generateAnnouncementSecret(externalWitnesses) is called, where externalWitnesses is some appropriate assignment (corresponds to w in the example above)generateAnnouncement(externalWitnesses, announcementSecret, externalRandom) is called, where externalRandom is a random assignment of external variables (corresponds to r in the example above)generateResponse(externalWitnesses, announcementSecret, challenge) is called (challenge corresponds to c in the example above)checkTranscript(announcement, challenge, response, externalResponse) is called with the data generated above and externalResponse, which is the same as externalWitness * challenge + externalRandomSigmaProtocol:
A = generateAnnouncement(externalWitnesses, announcementSecret, externalRandom)cR = generateResponse(externalWitness, announcementSecret, challenge) and externalResponse = externalWitness * c + externalRandomcheckTranscript(A, c, R, externalResponse)
Most SchnorrFragments will probably be implemented by extending DelegateFragment or SendThenDelegateFragment.
To compose a bunch of SchnorrFragments into a SigmaProtocol, see DelegateProtocol or SendThenDelegateProtocol.
| Modifier and Type | Method and Description |
|---|---|
org.cryptimeleon.math.expressions.bool.BooleanExpression |
checkTranscript(Announcement announcement,
ZnChallenge challenge,
Response response,
SchnorrVariableAssignment externalResponse)
Checks whether the fragment's transcript with the addition of externalResponse is accepting.
|
default org.cryptimeleon.math.serialization.Representation |
compressTranscript(Announcement announcement,
ZnChallenge challenge,
Response response,
SchnorrVariableAssignment externalResponse)
Returns a compressed (shorter) version of the given transcript.
|
default void |
debugFragment(SchnorrVariableAssignment externalWitness,
ZnChallengeSpace challengeSpace)
Checks if the given input is a valid witness for this fragment.
|
default SigmaProtocolTranscript |
decompressTranscript(org.cryptimeleon.math.serialization.Representation compressedTranscript,
ZnChallenge challenge,
SchnorrVariableAssignment externalResponse)
Decompressed a transcript compressed with
compressTranscript(org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.ZnChallenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response, org.cryptimeleon.craco.protocols.arguments.sigma.schnorr.variables.SchnorrVariableAssignment)
The guarantee is that if a transcript is valid, then compressing and decompressing yields the same transcript. |
Announcement |
generateAnnouncement(SchnorrVariableAssignment externalWitnesses,
AnnouncementSecret announcementSecret,
SchnorrVariableAssignment externalRandom)
Generates an announcement.
|
AnnouncementSecret |
generateAnnouncementSecret(SchnorrVariableAssignment externalWitnesses)
Generates secret data that's passed in successive calls for the prover.
|
Response |
generateResponse(SchnorrVariableAssignment externalWitnesses,
AnnouncementSecret announcementSecret,
ZnChallenge challenge)
Generates a response.
|
SigmaProtocolTranscript |
generateSimulatedTranscript(ZnChallenge challenge,
SchnorrVariableAssignment externalRandomResponse)
Generates a simulated transcript.
|
Announcement |
restoreAnnouncement(org.cryptimeleon.math.serialization.Representation repr) |
Response |
restoreResponse(Announcement announcement,
org.cryptimeleon.math.serialization.Representation repr) |
AnnouncementSecret generateAnnouncementSecret(SchnorrVariableAssignment externalWitnesses)
externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.Announcement generateAnnouncement(SchnorrVariableAssignment externalWitnesses, AnnouncementSecret announcementSecret, SchnorrVariableAssignment externalRandom)
externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.announcementSecret - the secret generated by generateAnnouncementSecret(SchnorrVariableAssignment)externalRandom - contains an assignment of external variables to random values.Response generateResponse(SchnorrVariableAssignment externalWitnesses, AnnouncementSecret announcementSecret, ZnChallenge challenge)
externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.announcementSecret - the secret generated by generateAnnouncementSecret(SchnorrVariableAssignment).challenge - the challenge of a Schnorr protocol.org.cryptimeleon.math.expressions.bool.BooleanExpression checkTranscript(Announcement announcement, ZnChallenge challenge, Response response, SchnorrVariableAssignment externalResponse)
SigmaProtocolTranscript generateSimulatedTranscript(ZnChallenge challenge, SchnorrVariableAssignment externalRandomResponse)
challenge - challenge the transcript shall use.externalRandomResponse - a random assignment of external variables to random values.default org.cryptimeleon.math.serialization.Representation compressTranscript(Announcement announcement, ZnChallenge challenge, Response response, SchnorrVariableAssignment externalResponse)
FiatShamirProofSystem.default SigmaProtocolTranscript decompressTranscript(org.cryptimeleon.math.serialization.Representation compressedTranscript, ZnChallenge challenge, SchnorrVariableAssignment externalResponse) throws java.lang.IllegalArgumentException
compressTranscript(org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.ZnChallenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response, org.cryptimeleon.craco.protocols.arguments.sigma.schnorr.variables.SchnorrVariableAssignment)
The guarantee is that if a transcript is valid, then compressing and decompressing yields the same transcript.
Additionally, any transcript output by this method is valid (i.e. SigmaProtocol.checkTranscript(org.cryptimeleon.craco.protocols.CommonInput, org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.Challenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response) returns true).java.lang.IllegalArgumentException - is the given compressedTranscript cannot be decompressed into a valid transcript.Announcement restoreAnnouncement(org.cryptimeleon.math.serialization.Representation repr)
Response restoreResponse(Announcement announcement, org.cryptimeleon.math.serialization.Representation repr)
default void debugFragment(SchnorrVariableAssignment externalWitness, ZnChallengeSpace challengeSpace)