org.cryptimeleon.craco.protocols.arguments.sigma.schnorr

Class SendThenDelegateFragment

java.lang.Object

org.cryptimeleon.craco.protocols.arguments.sigma.schnorr.SendThenDelegateFragment

All Implemented Interfaces:

SchnorrFragment

Direct Known Subclasses:

DelegateFragment, SetMembershipFragment

public abstract class SendThenDelegateFragment
extends java.lang.Object
implements SchnorrFragment

Many Schnorr-style protocols have the following form:

1. (Send) The prover generates some value and sends it to the verifier.
2. (Delegate) Prover and verifier run a Sigma protocol depending on the value sent/received

For example, a simple set membership proof works as follows (assuming some trusted party has published signatures on all valid set values):

1. (Send) The prover sends a randomized signature on his secret value
2. (Delegate) Prover and verifier run a Schnorr-style protocol for the statement "the prover can derandomize the signature such that it's a valid signature on his secret value"

This class helps implement SchnorrFragments with this Send-then-Delegate-to-Subfragments behavior.
To implement a SigmaProtocol with this behavior, see SendThenDelegateProtocol.
If your sendFirstValue is empty, consider using DelegateFragment or DelegateProtocol.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	SendThenDelegateFragment.ProverSpec
static class	SendThenDelegateFragment.ProverSpecBuilder Helps build SendThenDelegateFragment.ProverSpec objects to describe data contributed by the prover.
protected static class	SendThenDelegateFragment.SendThenDelegateAnnouncement
static class	SendThenDelegateFragment.SubprotocolSpec Specifies what this Fragment shall do, i.e.
static class	SendThenDelegateFragment.SubprotocolSpecBuilder A builder to help instantiate SendThenDelegateFragment.SubprotocolSpecs.
static class	SendThenDelegateFragment.WitnessValues

Constructor Summary

Constructors

Constructor and Description
SendThenDelegateFragment()

Method Summary

Modifier and Type	Method and Description
org.cryptimeleon.math.expressions.bool.BooleanExpression	checkTranscript(Announcement announcement, ZnChallenge challenge, Response response, SchnorrVariableAssignment externalResponse) Checks whether the fragment's transcript with the addition of externalResponse is accepting.
org.cryptimeleon.math.serialization.Representation	compressTranscript(Announcement announcement, ZnChallenge challenge, Response response, SchnorrVariableAssignment externalResponse) Returns a compressed (shorter) version of the given transcript.
void	debugFragment(SchnorrVariableAssignment externalWitness, ZnChallengeSpace challengeSpace) Checks if the given input is a valid witness for this fragment.
SigmaProtocolTranscript	decompressTranscript(org.cryptimeleon.math.serialization.Representation compressedTranscript, ZnChallenge challenge, SchnorrVariableAssignment externalResponse) Decompressed a transcript compressed with SchnorrFragment.compressTranscript(org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.ZnChallenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response, org.cryptimeleon.craco.protocols.arguments.sigma.schnorr.variables.SchnorrVariableAssignment) The guarantee is that if a transcript is valid, then compressing and decompressing yields the same transcript.
Announcement	generateAnnouncement(SchnorrVariableAssignment externalWitnesses, AnnouncementSecret announcementSecret, SchnorrVariableAssignment externalRandom) Generates an announcement.
AnnouncementSecret	generateAnnouncementSecret(SchnorrVariableAssignment externalWitnesses) Generates secret data that's passed in successive calls for the prover.
Response	generateResponse(SchnorrVariableAssignment externalWitnesses, AnnouncementSecret announcementSecret, ZnChallenge challenge) Generates a response.
SigmaProtocolTranscript	generateSimulatedTranscript(ZnChallenge challenge, SchnorrVariableAssignment externalRandomResponse) Generates a simulated transcript.
protected abstract org.cryptimeleon.math.expressions.bool.BooleanExpression	provideAdditionalCheck(SendFirstValue sendFirstValue) Runs an additional check on the sendFirstValue when the verifier checks a transcript.
protected abstract SendThenDelegateFragment.ProverSpec	provideProverSpec(SchnorrVariableAssignment externalWitnesses, SendThenDelegateFragment.ProverSpecBuilder builder) Run by the prover to set up (1) the sendFirstValue and (2) witness values for variables this fragment proves knowledge of itself (i.e.
protected abstract SendThenDelegateFragment.SubprotocolSpec	provideSubprotocolSpec(SendFirstValue sendFirstValue, SendThenDelegateFragment.SubprotocolSpecBuilder builder) Run by both prover and verifier to deterministically instantiate the desired subprotocols (subfragments) depending on the sendFirstValue. For this, the given SendThenDelegateFragment.SubprotocolSpecBuilder allows you to create (1) variables (witnesses) and (2) register fragments to run.
Announcement	restoreAnnouncement(org.cryptimeleon.math.serialization.Representation repr)
Response	restoreResponse(Announcement announcement, org.cryptimeleon.math.serialization.Representation repr)
protected abstract SendFirstValue	restoreSendFirstValue(org.cryptimeleon.math.serialization.Representation repr) Restores a SendFirstValue from Representation
protected abstract SendFirstValue	simulateSendFirstValue() Returns a random SendFirstValue with the same probability distribution as an honest prover would generate.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SendThenDelegateFragment

public SendThenDelegateFragment()

Method Detail

provideProverSpec

protected abstract SendThenDelegateFragment.ProverSpec provideProverSpec(SchnorrVariableAssignment externalWitnesses,
                                                                         SendThenDelegateFragment.ProverSpecBuilder builder)

Run by the prover to set up (1) the sendFirstValue and (2) witness values for variables this fragment proves knowledge of itself (i.e. those specified in provideSubprotocolSpec(SendFirstValue, SubprotocolSpecBuilder)).

A typical example implementation can be found in SetMembershipFragment.

Parameters:

externalWitnesses - the witness values for external variables

builder - helper object to instantiate a SendThenDelegateFragment.ProverSpec

Returns:

the specification of sendFirstValue and witness values for this fragment's own variables. Returned by SendThenDelegateFragment.ProverSpecBuilder.build().

restoreSendFirstValue

protected abstract SendFirstValue restoreSendFirstValue(org.cryptimeleon.math.serialization.Representation repr)

Restores a SendFirstValue from Representation

simulateSendFirstValue

protected abstract SendFirstValue simulateSendFirstValue()

Returns a random SendFirstValue with the same probability distribution as an honest prover would generate.

provideSubprotocolSpec

protected abstract SendThenDelegateFragment.SubprotocolSpec provideSubprotocolSpec(SendFirstValue sendFirstValue,
                                                                                   SendThenDelegateFragment.SubprotocolSpecBuilder builder)

Run by both prover and verifier to deterministically instantiate the desired subprotocols (subfragments) depending on the sendFirstValue.
For this, the given SendThenDelegateFragment.SubprotocolSpecBuilder allows you to create (1) variables (witnesses) and (2) register fragments to run. The SendThenDelegateFragment will then take care of proving knowledge of the desired witnesses and running the desired subfragments. For the subfragments, the registered variables will be considered "external" (cf. SchnorrFragment).

A typical example implementation can be found in SetMembershipFragment.

Parameters:

sendFirstValue - the value the prover sends as his first message.

builder - helper object to instantiate a SendThenDelegateFragment.SubprotocolSpec

Returns:

the specification of what variables to prove knowledge of and what subfragments to run (for which these variables will be "external"). Returned by SendThenDelegateFragment.SubprotocolSpecBuilder.build().

provideAdditionalCheck

protected abstract org.cryptimeleon.math.expressions.bool.BooleanExpression provideAdditionalCheck(SendFirstValue sendFirstValue)

Runs an additional check on the sendFirstValue when the verifier checks a transcript.

generateAnnouncementSecret

public AnnouncementSecret generateAnnouncementSecret(SchnorrVariableAssignment externalWitnesses)

Description copied from interface: SchnorrFragment

Generates secret data that's passed in successive calls for the prover.

Specified by:

generateAnnouncementSecret in interface SchnorrFragment

Parameters:

externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.

Returns:

arbitrary data for future calls

generateAnnouncement

public Announcement generateAnnouncement(SchnorrVariableAssignment externalWitnesses,
                                         AnnouncementSecret announcementSecret,
                                         SchnorrVariableAssignment externalRandom)

Description copied from interface: SchnorrFragment

Generates an announcement.

Specified by:

generateAnnouncement in interface SchnorrFragment

Parameters:

externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.

announcementSecret - the secret generated by SchnorrFragment.generateAnnouncementSecret(SchnorrVariableAssignment)

externalRandom - contains an assignment of external variables to random values.

Returns:

the announcement for this fragment

generateResponse

public Response generateResponse(SchnorrVariableAssignment externalWitnesses,
                                 AnnouncementSecret announcementSecret,
                                 ZnChallenge challenge)

Description copied from interface: SchnorrFragment

Generates a response.

Specified by:

generateResponse in interface SchnorrFragment

Parameters:

externalWitnesses - witnesses used by this protocol whose extractability is handled outside of this fragment. May contain some variables not relevant for this fragment.

announcementSecret - the secret generated by SchnorrFragment.generateAnnouncementSecret(SchnorrVariableAssignment).

challenge - the challenge of a Schnorr protocol.

Returns:

the response that this fragment sends (does not contain externalResponse)

checkTranscript

public org.cryptimeleon.math.expressions.bool.BooleanExpression checkTranscript(Announcement announcement,
                                                                                ZnChallenge challenge,
                                                                                Response response,
                                                                                SchnorrVariableAssignment externalResponse)

Description copied from interface: SchnorrFragment

Checks whether the fragment's transcript with the addition of externalResponse is accepting.

Specified by:

checkTranscript in interface SchnorrFragment

Returns:

an expression (without variables) that evaluates to true if the transcript is accepting or to false otherwise.

generateSimulatedTranscript

public SigmaProtocolTranscript generateSimulatedTranscript(ZnChallenge challenge,
                                                           SchnorrVariableAssignment externalRandomResponse)

Description copied from interface: SchnorrFragment

Generates a simulated transcript.

Specified by:

generateSimulatedTranscript in interface SchnorrFragment

Parameters:

challenge - challenge the transcript shall use.

externalRandomResponse - a random assignment of external variables to random values.

Returns:

a transcript with the same distribution as honest executions of this fragment that contain challenge and externalRandomResponse.

restoreAnnouncement

public Announcement restoreAnnouncement(org.cryptimeleon.math.serialization.Representation repr)

Specified by:

restoreAnnouncement in interface SchnorrFragment

restoreResponse

public Response restoreResponse(Announcement announcement,
                                org.cryptimeleon.math.serialization.Representation repr)

Specified by:

restoreResponse in interface SchnorrFragment

compressTranscript

public org.cryptimeleon.math.serialization.Representation compressTranscript(Announcement announcement,
                                                                             ZnChallenge challenge,
                                                                             Response response,
                                                                             SchnorrVariableAssignment externalResponse)

Description copied from interface: SchnorrFragment

Returns a compressed (shorter) version of the given transcript. Useful for FiatShamirProofSystem.

Specified by:

compressTranscript in interface SchnorrFragment

decompressTranscript

public SigmaProtocolTranscript decompressTranscript(org.cryptimeleon.math.serialization.Representation compressedTranscript,
                                                    ZnChallenge challenge,
                                                    SchnorrVariableAssignment externalResponse)
                                             throws java.lang.IllegalArgumentException

Description copied from interface: SchnorrFragment

Decompressed a transcript compressed with SchnorrFragment.compressTranscript(org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.ZnChallenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response, org.cryptimeleon.craco.protocols.arguments.sigma.schnorr.variables.SchnorrVariableAssignment) The guarantee is that if a transcript is valid, then compressing and decompressing yields the same transcript. Additionally, any transcript output by this method is valid (i.e. SigmaProtocol.checkTranscript(org.cryptimeleon.craco.protocols.CommonInput, org.cryptimeleon.craco.protocols.arguments.sigma.Announcement, org.cryptimeleon.craco.protocols.arguments.sigma.Challenge, org.cryptimeleon.craco.protocols.arguments.sigma.Response) returns true).

Specified by:

decompressTranscript in interface SchnorrFragment

Throws:

java.lang.IllegalArgumentException - is the given compressedTranscript cannot be decompressed into a valid transcript.

debugFragment

public void debugFragment(SchnorrVariableAssignment externalWitness,
                          ZnChallengeSpace challengeSpace)

Description copied from interface: SchnorrFragment

Checks if the given input is a valid witness for this fragment. Use for debugging. Throws an exception if something is wrong.

Specified by:

debugFragment in interface SchnorrFragment